--- /dev/null
+From 688b1ecfb9ed0484754d2653386e3c44c58ede5c Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <luciano.coelho@intel.com>
+Date: Tue, 16 Dec 2014 16:01:39 +0200
+Subject: mac80211: notify channel switch at the end of ieee80211_chswitch_post_beacon()
+
+From: Luciano Coelho <luciano.coelho@intel.com>
+
+commit 688b1ecfb9ed0484754d2653386e3c44c58ede5c upstream.
+
+The call to cfg80211_ch_switch_notify() should be at the end of the
+ieee80211_chswitch_post_beacon() function, because it should only be
+sent if everything succeeded.
+
+Fixes: d04b5ac9e70b ("cfg80211/mac80211: allow any interface to send channel switch notifications")
+Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/mlme.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1054,8 +1054,6 @@ static void ieee80211_chswitch_post_beac
+ sdata->csa_block_tx = false;
+ }
+
+- cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
+-
+ sdata->vif.csa_active = false;
+ ifmgd->csa_waiting_bcn = false;
+
+@@ -1067,6 +1065,8 @@ static void ieee80211_chswitch_post_beac
+ &ifmgd->csa_connection_drop_work);
+ return;
+ }
++
++ cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
+ }
+
+ void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
--- /dev/null
+From 9c1c98a3bb7b7593b60264b9a07e001e68b46697 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Thu, 26 Feb 2015 15:50:50 +0200
+Subject: mac80211: Send EAPOL frames at lowest rate
+
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+
+commit 9c1c98a3bb7b7593b60264b9a07e001e68b46697 upstream.
+
+The current minstrel_ht rate control behavior is somewhat optimistic in
+trying to find optimum TX rate. While this is usually fine for normal
+Data frames, there are cases where a more conservative set of retry
+parameters would be beneficial to make the connection more robust.
+
+EAPOL frames are critical to the authentication and especially the
+EAPOL-Key message 4/4 (the last message in the 4-way handshake) is
+important to get through to the AP. If that message is lost, the only
+recovery mechanism in many cases is to reassociate with the AP and start
+from scratch. This can often be avoided by trying to send the frame with
+more conservative rate and/or with more link layer retries.
+
+In most cases, minstrel_ht is currently using the initial EAPOL-Key
+frames for probing higher rates and this results in only five link layer
+transmission attempts (one at high(ish) MCS and four at MCS0). While
+this works with most APs, it looks like there are some deployed APs that
+may have issues with the EAPOL frames using HT MCS immediately after
+association. Similarly, there may be issues in cases where the signal
+strength or radio environment is not good enough to be able to get
+frames through even at couple of MCS 0 tries.
+
+The best approach for this would likely to be to reduce the TX rate for
+the last rate (3rd rate parameter in the set) to a low basic rate (say,
+6 Mbps on 5 GHz and 2 or 5.5 Mbps on 2.4 GHz), but doing that cleanly
+requires some more effort. For now, we can start with a simple one-liner
+that forces the minimum rate to be used for EAPOL frames similarly how
+the TX rate is selected for the IEEE 802.11 Management frames. This does
+result in a small extra latency added to the cases where the AP would be
+able to receive the higher rate, but taken into account how small number
+of EAPOL frames are used, this is likely to be insignificant. A future
+optimization in the minstrel_ht design can also allow this patch to be
+reverted to get back to the more optimized initial TX rate.
+
+It should also be noted that many drivers that do not use minstrel as
+the rate control algorithm are already doing similar workarounds by
+forcing the lowest TX rate to be used for EAPOL frames.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/tx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -566,6 +566,7 @@ ieee80211_tx_h_check_control_port_protoc
+ if (tx->sdata->control_port_no_encrypt)
+ info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+ info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
++ info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
+ }
+
+ return TX_CONTINUE;
--- /dev/null
+From 2c3fbe3cf28fbd7001545a92a83b4f8acfd9fa36 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 4 Mar 2015 10:39:03 +0100
+Subject: net: irda: fix wait_until_sent poll timeout
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 2c3fbe3cf28fbd7001545a92a83b4f8acfd9fa36 upstream.
+
+In case an infinite timeout (0) is requested, the irda wait_until_sent
+implementation would use a zero poll timeout rather than the default
+200ms.
+
+Note that wait_until_sent is currently never called with a 0-timeout
+argument due to a bug in tty_wait_until_sent.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/irda/ircomm/ircomm_tty.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/irda/ircomm/ircomm_tty.c
++++ b/net/irda/ircomm/ircomm_tty.c
+@@ -798,7 +798,9 @@ static void ircomm_tty_wait_until_sent(s
+ orig_jiffies = jiffies;
+
+ /* Set poll time to 200 ms */
+- poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
++ poll_time = msecs_to_jiffies(200);
++ if (timeout)
++ poll_time = min_t(unsigned long, timeout, poll_time);
+
+ spin_lock_irqsave(&self->spinlock, flags);
+ while (self->tx_skb && self->tx_skb->len) {
--- /dev/null
+From bc4b1f486fe69b86769e07c8edce472327a8462b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 15 Feb 2015 11:57:53 +0700
+Subject: Revert "USB: serial: make bulk_out_size a lower limit"
+
+From: Johan Hovold <johan@kernel.org>
+
+commit bc4b1f486fe69b86769e07c8edce472327a8462b upstream.
+
+This reverts commit 5083fd7bdfe6760577235a724cf6dccae13652c2.
+
+A bulk-out size smaller than the end-point size is indeed valid. The
+offending commit broke the usb-debug driver for EHCI debug devices,
+which use 8-byte buffers.
+
+Fixes: 5083fd7bdfe6 ("USB: serial: make bulk_out_size a lower limit")
+Reported-by: "Li, Elvin" <elvin.li@intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb-serial.c | 5 +++--
+ include/linux/usb/serial.h | 3 +--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -940,8 +940,9 @@ static int usb_serial_probe(struct usb_i
+ port = serial->port[i];
+ if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL))
+ goto probe_error;
+- buffer_size = max_t(int, serial->type->bulk_out_size,
+- usb_endpoint_maxp(endpoint));
++ buffer_size = serial->type->bulk_out_size;
++ if (!buffer_size)
++ buffer_size = usb_endpoint_maxp(endpoint);
+ port->bulk_out_size = buffer_size;
+ port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
+
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -190,8 +190,7 @@ static inline void usb_set_serial_data(s
+ * @num_ports: the number of different ports this device will have.
+ * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer
+ * (0 = end-point size)
+- * @bulk_out_size: minimum number of bytes to allocate for bulk-out buffer
+- * (0 = end-point size)
++ * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size)
+ * @calc_num_ports: pointer to a function to determine how many ports this
+ * device has dynamically. It will be called after the probe()
+ * callback is called, but before attach()
btrfs-__add_inode_ref-out-of-bounds-memory-read-when-looking-for-extended-ref.patch
kvm-emulate-fix-cmpxchg8b-on-32-bit-hosts.patch
kvm-mips-fix-trace-event-to-save-pc-directly.patch
-target-fix-r_holder-bit-usage-for-allregistrants.patch
+uas-add-us_fl_no_report_opcodes-for-jmicron-jms539.patch
+revert-usb-serial-make-bulk_out_size-a-lower-limit.patch
+usb-serial-cp210x-adding-seletek-device-id-s.patch
+usb-mxuport-fix-null-deref-when-used-as-a-console.patch
+usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch
+usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch
+usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch
+usb-dwc3-dwc3-omap-fix-disable-irq.patch
+usb-gadget-configfs-don-t-nul-terminate-sub-compatible-ids.patch
+usb-xhci-platform-move-the-marvell-quirks-after-the-enabling-the-clocks.patch
+xhci-allocate-correct-amount-of-scratchpad-buffers.patch
+xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch
+xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch
+mac80211-send-eapol-frames-at-lowest-rate.patch
+mac80211-notify-channel-switch-at-the-end-of-ieee80211_chswitch_post_beacon.patch
+net-irda-fix-wait_until_sent-poll-timeout.patch
+usb-serial-fix-infinite-wait_until_sent-timeout.patch
+tty-fix-tty_wait_until_sent-on-64-bit-machines.patch
+usb-serial-fix-potential-use-after-free-after-failed-probe.patch
+usb-serial-fix-tty-device-error-handling-at-probe.patch
+++ /dev/null
-From d16ca7c5198fd668db10d2c7b048ed3359c12c54 Mon Sep 17 00:00:00 2001
-From: Nicholas Bellinger <nab@linux-iscsi.org>
-Date: Sun, 14 Dec 2014 01:47:19 -0800
-Subject: target: Fix R_HOLDER bit usage for AllRegistrants
-
-From: Nicholas Bellinger <nab@linux-iscsi.org>
-
-commit d16ca7c5198fd668db10d2c7b048ed3359c12c54 upstream.
-
-This patch fixes the usage of R_HOLDER bit for an All Registrants
-reservation in READ_FULL_STATUS, where only the registration who
-issued RESERVE was being reported as having an active reservation.
-
-It changes core_scsi3_pri_read_full_status() to check ahead of the
-list walk of active registrations to see if All Registrants is active,
-and if so set R_HOLDER bit and scope/type fields for all active
-registrations.
-
-Reported-by: Ilias Tsitsimpis <i.tsitsimpis@gmail.com>
-Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
-Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
-index f91b6a1b846e..c4a8da5415c5 100644
---- a/drivers/target/target_core_pr.c
-+++ b/drivers/target/target_core_pr.c
-@@ -3834,7 +3834,8 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- unsigned char *buf;
- u32 add_desc_len = 0, add_len = 0, desc_len, exp_desc_len;
- u32 off = 8; /* off into first Full Status descriptor */
-- int format_code = 0;
-+ int format_code = 0, pr_res_type = 0, pr_res_scope = 0;
-+ bool all_reg = false;
-
- if (cmd->data_length < 8) {
- pr_err("PRIN SA READ_FULL_STATUS SCSI Data Length: %u"
-@@ -3851,6 +3852,19 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- buf[2] = ((dev->t10_pr.pr_generation >> 8) & 0xff);
- buf[3] = (dev->t10_pr.pr_generation & 0xff);
-
-+ spin_lock(&dev->dev_reservation_lock);
-+ if (dev->dev_pr_res_holder) {
-+ struct t10_pr_registration *pr_holder = dev->dev_pr_res_holder;
-+
-+ if (pr_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG ||
-+ pr_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG) {
-+ all_reg = true;
-+ pr_res_type = pr_holder->pr_res_type;
-+ pr_res_scope = pr_holder->pr_res_scope;
-+ }
-+ }
-+ spin_unlock(&dev->dev_reservation_lock);
-+
- spin_lock(&pr_tmpl->registration_lock);
- list_for_each_entry_safe(pr_reg, pr_reg_tmp,
- &pr_tmpl->registration_list, pr_reg_list) {
-@@ -3898,14 +3912,20 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- * reservation holder for PR_HOLDER bit.
- *
- * Also, if this registration is the reservation
-- * holder, fill in SCOPE and TYPE in the next byte.
-+ * holder or there is an All Registrants reservation
-+ * active, fill in SCOPE and TYPE in the next byte.
- */
- if (pr_reg->pr_res_holder) {
- buf[off++] |= 0x01;
- buf[off++] = (pr_reg->pr_res_scope & 0xf0) |
- (pr_reg->pr_res_type & 0x0f);
-- } else
-+ } else if (all_reg) {
-+ buf[off++] |= 0x01;
-+ buf[off++] = (pr_res_scope & 0xf0) |
-+ (pr_res_type & 0x0f);
-+ } else {
- off += 2;
-+ }
-
- off += 4; /* Skip over reserved area */
- /*
--- /dev/null
+From 79fbf4a550ed6a22e1ae1516113e6c7fa5d56a53 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 4 Mar 2015 10:39:06 +0100
+Subject: TTY: fix tty_wait_until_sent on 64-bit machines
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 79fbf4a550ed6a22e1ae1516113e6c7fa5d56a53 upstream.
+
+Fix overflow bug in tty_wait_until_sent on 64-bit machines, where an
+infinite timeout (0) would be passed to the underlying tty-driver's
+wait_until_sent-operation as a negative timeout (-1), causing it to
+return immediately.
+
+This manifests itself for example as tcdrain() returning immediately,
+drivers not honouring the drain flags when setting terminal attributes,
+or even dropped data on close as a requested infinite closing-wait
+timeout would be ignored.
+
+The first symptom was reported by Asier LLANO who noted that tcdrain()
+returned prematurely when using the ftdi_sio usb-serial driver.
+
+Fix this by passing 0 rather than MAX_SCHEDULE_TIMEOUT (LONG_MAX) to the
+underlying tty driver.
+
+Note that the serial-core wait_until_sent-implementation is not affected
+by this bug due to a lucky chance (comparison to an unsigned maximum
+timeout), and neither is the cyclades one that had an explicit check for
+negative timeouts, but all other tty drivers appear to be affected.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: ZIV-Asier Llano Palacios <asier.llano@cgglobal.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/tty_ioctl.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -217,11 +217,17 @@ void tty_wait_until_sent(struct tty_stru
+ #endif
+ if (!timeout)
+ timeout = MAX_SCHEDULE_TIMEOUT;
++
+ if (wait_event_interruptible_timeout(tty->write_wait,
+- !tty_chars_in_buffer(tty), timeout) >= 0) {
+- if (tty->ops->wait_until_sent)
+- tty->ops->wait_until_sent(tty, timeout);
++ !tty_chars_in_buffer(tty), timeout) < 0) {
++ return;
+ }
++
++ if (timeout == MAX_SCHEDULE_TIMEOUT)
++ timeout = 0;
++
++ if (tty->ops->wait_until_sent)
++ tty->ops->wait_until_sent(tty, timeout);
+ }
+ EXPORT_SYMBOL(tty_wait_until_sent);
+
--- /dev/null
+From 59e980efafd27df83a5c85c054f906d82bcbf752 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 23 Feb 2015 13:41:14 +0100
+Subject: uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS539
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 59e980efafd27df83a5c85c054f906d82bcbf752 upstream.
+
+Like the JMicron JMS567 enclosures with the JMS539 choke on report-opcodes,
+so avoid it.
+
+Tested-and-reported-by: Tom Arild Naess <tanaess@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_uas.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
++UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
++ "JMicron",
++ "JMS539",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
++
+ /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
+ "JMicron",
--- /dev/null
+From 96e5d31244c5542f5b2ea81d76f14ba4b8a7d440 Mon Sep 17 00:00:00 2001
+From: George Cherian <george.cherian@ti.com>
+Date: Fri, 13 Feb 2015 10:13:24 +0530
+Subject: usb: dwc3: dwc3-omap: Fix disable IRQ
+
+From: George Cherian <george.cherian@ti.com>
+
+commit 96e5d31244c5542f5b2ea81d76f14ba4b8a7d440 upstream.
+
+In the wrapper the IRQ disable should be done by writing 1's to the
+IRQ*_CLR register. Existing code is broken because it instead writes
+zeros to IRQ*_SET register.
+
+Fix this by adding functions dwc3_omap_write_irqmisc_clr() and
+dwc3_omap_write_irq0_clr() which do the right thing.
+
+Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
+Signed-off-by: George Cherian <george.cherian@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/dwc3-omap.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/dwc3-omap.c
++++ b/drivers/usb/dwc3/dwc3-omap.c
+@@ -205,6 +205,18 @@ static void dwc3_omap_write_irq0_set(str
+ omap->irq0_offset, value);
+ }
+
++static void dwc3_omap_write_irqmisc_clr(struct dwc3_omap *omap, u32 value)
++{
++ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_MISC +
++ omap->irqmisc_offset, value);
++}
++
++static void dwc3_omap_write_irq0_clr(struct dwc3_omap *omap, u32 value)
++{
++ dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_0 -
++ omap->irq0_offset, value);
++}
++
+ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
+ enum omap_dwc3_vbus_id_status status)
+ {
+@@ -345,9 +357,23 @@ static void dwc3_omap_enable_irqs(struct
+
+ static void dwc3_omap_disable_irqs(struct dwc3_omap *omap)
+ {
++ u32 reg;
++
+ /* disable all IRQs */
+- dwc3_omap_write_irqmisc_set(omap, 0x00);
+- dwc3_omap_write_irq0_set(omap, 0x00);
++ reg = USBOTGSS_IRQO_COREIRQ_ST;
++ dwc3_omap_write_irq0_clr(omap, reg);
++
++ reg = (USBOTGSS_IRQMISC_OEVT |
++ USBOTGSS_IRQMISC_DRVVBUS_RISE |
++ USBOTGSS_IRQMISC_CHRGVBUS_RISE |
++ USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
++ USBOTGSS_IRQMISC_IDPULLUP_RISE |
++ USBOTGSS_IRQMISC_DRVVBUS_FALL |
++ USBOTGSS_IRQMISC_CHRGVBUS_FALL |
++ USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
++ USBOTGSS_IRQMISC_IDPULLUP_FALL);
++
++ dwc3_omap_write_irqmisc_clr(omap, reg);
+ }
+
+ static u64 dwc3_omap_dma_mask = DMA_BIT_MASK(32);
--- /dev/null
+From c7d373c3f0da2b2b78c4b1ce5ae41485b3ef848c Mon Sep 17 00:00:00 2001
+From: Max Mansfield <max.m.mansfield@gmail.com>
+Date: Mon, 2 Mar 2015 18:38:02 -0700
+Subject: usb: ftdi_sio: Add jtag quirk support for Cyber Cortex AV boards
+
+From: Max Mansfield <max.m.mansfield@gmail.com>
+
+commit c7d373c3f0da2b2b78c4b1ce5ae41485b3ef848c upstream.
+
+This patch integrates Cyber Cortex AV boards with the existing
+ftdi_jtag_quirk in order to use serial port 0 with JTAG which is
+required by the manufacturers' software.
+
+Steps: 2
+
+[ftdi_sio_ids.h]
+1. Defined the device PID
+
+[ftdi_sio.c]
+2. Added a macro declaration to the ids array, in order to enable the
+jtag quirk for the device.
+
+Signed-off-by: Max Mansfield <max.m.mansfield@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 3 +++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -799,6 +799,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
++ { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -38,6 +38,9 @@
+
+ #define FTDI_LUMEL_PD12_PID 0x6002
+
++/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
++#define CYBER_CORTEX_AV_PID 0x8698
++
+ /*
+ * Marvell OpenRD Base, Client
+ * http://www.open-rd.org
--- /dev/null
+From f6950344d3cf4a1e231b5828b50c4ac168db3886 Mon Sep 17 00:00:00 2001
+From: Mark Glover <mark@actisense.com>
+Date: Fri, 13 Feb 2015 09:04:39 +0000
+Subject: USB: ftdi_sio: add PIDs for Actisense USB devices
+
+From: Mark Glover <mark@actisense.com>
+
+commit f6950344d3cf4a1e231b5828b50c4ac168db3886 upstream.
+
+These product identifiers (PID) all deal with marine NMEA format data
+used on motor boats and yachts. We supply the programmed devices to
+Chetco, for use inside their equipment. The PIDs are a direct copy of
+our Windows device drivers (FTDI drivers with altered PIDs).
+
+Signed-off-by: Mark Glover <mark@actisense.com>
+[johan: edit commit message slightly ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++++
+ drivers/usb/serial/ftdi_sio_ids.h | 20 ++++++++++++++++++++
+ 2 files changed, 37 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -978,6 +978,23 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
+ /* GE Healthcare devices */
+ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
++ /* Active Research (Actisense) devices */
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
+ { } /* Terminating entry */
+ };
+
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1438,3 +1438,23 @@
+ */
+ #define GE_HEALTHCARE_VID 0x1901
+ #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
++
++/*
++ * Active Research (Actisense) devices
++ */
++#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */
++#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */
++#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */
++#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */
++#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */
++#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */
++#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */
++#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */
++#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */
++#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */
++#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */
++#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */
++#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */
++#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */
++#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */
++#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */
--- /dev/null
+From a0456399fb07155637a2b597b91cc1c63bc25141 Mon Sep 17 00:00:00 2001
+From: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Date: Fri, 13 Feb 2015 12:12:53 +0100
+Subject: usb: gadget: configfs: don't NUL-terminate (sub)compatible ids
+
+From: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+
+commit a0456399fb07155637a2b597b91cc1c63bc25141 upstream.
+
+The "Extended Compat ID OS Feature Descriptor Specification" does not
+require the (sub)compatible ids to be NUL-terminated, because they
+are placed in a fixed-size buffer and only unused parts of it should
+contain NULs. If the buffer is fully utilized, there is no place for NULs.
+
+Consequently, the code which uses desc->ext_compat_id never expects the
+data contained to be NUL terminated.
+
+If the compatible id is stored after sub-compatible id, and the compatible
+id is full length (8 bytes), the (useless) NUL terminator overwrites the
+first byte of the sub-compatible id.
+
+If the sub-compatible id is full length (8 bytes), the (useless) NUL
+terminator ends up out of the buffer. The situation can happen in the RNDIS
+function, where the buffer is a part of struct f_rndis_opts. The next
+member of struct f_rndis_opts is a mutex, so its first byte gets
+overwritten. The said byte is a part of a mutex'es member which contains
+the information on whether the muext is locked or not. This can lead to a
+deadlock, because, in a configfs-composed gadget when a function is linked
+into a configuration with config_usb_cfg_link(), usb_get_function()
+is called, which then calls rndis_alloc(), which tries locking the same
+mutex and (wrongly) finds it already locked.
+
+This patch eliminates NUL terminating of the (sub)compatible id.
+
+Fixes: da4243145fb1: "usb: gadget: configfs: OS Extended Compatibility descriptors support"
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/configfs.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1161,7 +1161,6 @@ static ssize_t interf_grp_compatible_id_
+ if (desc->opts_mutex)
+ mutex_lock(desc->opts_mutex);
+ memcpy(desc->ext_compat_id, page, l);
+- desc->ext_compat_id[l] = '\0';
+
+ if (desc->opts_mutex)
+ mutex_unlock(desc->opts_mutex);
+@@ -1192,7 +1191,6 @@ static ssize_t interf_grp_sub_compatible
+ if (desc->opts_mutex)
+ mutex_lock(desc->opts_mutex);
+ memcpy(desc->ext_compat_id + 8, page, l);
+- desc->ext_compat_id[l + 8] = '\0';
+
+ if (desc->opts_mutex)
+ mutex_unlock(desc->opts_mutex);
--- /dev/null
+From db81de767e375743ebb0ad2bcad3326962c2b67e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 18 Feb 2015 11:51:07 +0700
+Subject: USB: mxuport: fix null deref when used as a console
+
+From: Johan Hovold <johan@kernel.org>
+
+commit db81de767e375743ebb0ad2bcad3326962c2b67e upstream.
+
+Fix null-pointer dereference at probe when the device is used as a
+console, in which case the tty argument to open will be NULL.
+
+Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX
+driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <greg@kroah.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mxuport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/mxuport.c
++++ b/drivers/usb/serial/mxuport.c
+@@ -1284,7 +1284,8 @@ static int mxuport_open(struct tty_struc
+ }
+
+ /* Initial port termios */
+- mxuport_set_termios(tty, port, NULL);
++ if (tty)
++ mxuport_set_termios(tty, port, NULL);
+
+ /*
+ * TODO: use RQ_VENDOR_GET_MSR, once we know what it
--- /dev/null
+From 675af70856d7cc026be8b6ea7a8b9db10b8b38a1 Mon Sep 17 00:00:00 2001
+From: Michiel vd Garde <mgparser@gmail.com>
+Date: Fri, 27 Feb 2015 02:08:29 +0100
+Subject: USB: serial: cp210x: Adding Seletek device id's
+
+From: Michiel vd Garde <mgparser@gmail.com>
+
+commit 675af70856d7cc026be8b6ea7a8b9db10b8b38a1 upstream.
+
+These device ID's are not associated with the cp210x module currently,
+but should be. This patch allows the devices to operate upon connecting
+them to the usb bus as intended.
+
+Signed-off-by: Michiel van de Garde <mgparser@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -147,6 +147,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
+ { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
+ { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
++ { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */
++ { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */
+ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
+ { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
+ { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
--- /dev/null
+From f528bf4f57e43d1af4b2a5c97f09e43e0338c105 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 4 Mar 2015 10:39:05 +0100
+Subject: USB: serial: fix infinite wait_until_sent timeout
+
+From: Johan Hovold <johan@kernel.org>
+
+commit f528bf4f57e43d1af4b2a5c97f09e43e0338c105 upstream.
+
+Make sure to handle an infinite timeout (0).
+
+Note that wait_until_sent is currently never called with a 0-timeout
+argument due to a bug in tty_wait_until_sent.
+
+Fixes: dcf010503966 ("USB: serial: add generic wait_until_sent
+implementation")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/generic.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -258,7 +258,8 @@ void usb_serial_generic_wait_until_sent(
+ * character or at least one jiffy.
+ */
+ period = max_t(unsigned long, (10 * HZ / bps), 1);
+- period = min_t(unsigned long, period, timeout);
++ if (timeout)
++ period = min_t(unsigned long, period, timeout);
+
+ dev_dbg(&port->dev, "%s - timeout = %u ms, period = %u ms\n",
+ __func__, jiffies_to_msecs(timeout),
+@@ -268,7 +269,7 @@ void usb_serial_generic_wait_until_sent(
+ schedule_timeout_interruptible(period);
+ if (signal_pending(current))
+ break;
+- if (time_after(jiffies, expire))
++ if (timeout && time_after(jiffies, expire))
+ break;
+ }
+ }
--- /dev/null
+From 07fdfc5e9f1c966be8722e8fa927e5ea140df5ce Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 18 Feb 2015 10:34:50 +0700
+Subject: USB: serial: fix potential use-after-free after failed probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 07fdfc5e9f1c966be8722e8fa927e5ea140df5ce upstream.
+
+Fix return value in probe error path, which could end up returning
+success (0) on errors. This could in turn lead to use-after-free or
+double free (e.g. in port_remove) when the port device is removed.
+
+Fixes: c706ebdfc895 ("USB: usb-serial: call port_probe and port_remove
+at the right times")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <greg@kroah.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/bus.c
++++ b/drivers/usb/serial/bus.c
+@@ -75,7 +75,7 @@ static int usb_serial_device_probe(struc
+ retval = device_create_file(dev, &dev_attr_port_number);
+ if (retval) {
+ if (driver->port_remove)
+- retval = driver->port_remove(port);
++ driver->port_remove(port);
+ goto exit_with_autopm;
+ }
+
--- /dev/null
+From ca4383a3947a83286bc9b9c598a1f55e867871d7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 18 Feb 2015 10:34:51 +0700
+Subject: USB: serial: fix tty-device error handling at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ca4383a3947a83286bc9b9c598a1f55e867871d7 upstream.
+
+Add missing error handling when registering the tty device at port
+probe. This avoids trying to remove an uninitialised character device
+when the port device is removed.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Greg Kroah-Hartman <greg@kroah.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/bus.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/bus.c
++++ b/drivers/usb/serial/bus.c
+@@ -51,6 +51,7 @@ static int usb_serial_device_probe(struc
+ {
+ struct usb_serial_driver *driver;
+ struct usb_serial_port *port;
++ struct device *tty_dev;
+ int retval = 0;
+ int minor;
+
+@@ -80,7 +81,15 @@ static int usb_serial_device_probe(struc
+ }
+
+ minor = port->minor;
+- tty_register_device(usb_serial_tty_driver, minor, dev);
++ tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev);
++ if (IS_ERR(tty_dev)) {
++ retval = PTR_ERR(tty_dev);
++ device_remove_file(dev, &dev_attr_port_number);
++ if (driver->port_remove)
++ driver->port_remove(port);
++ goto exit_with_autopm;
++ }
++
+ dev_info(&port->serial->dev->dev,
+ "%s converter now attached to ttyUSB%d\n",
+ driver->description, minor);
--- /dev/null
+From f0c2b68198589249afd2b1f2c4e8de8c03e19c16 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 13 Feb 2015 10:54:53 -0500
+Subject: USB: usbfs: don't leak kernel data in siginfo
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f0c2b68198589249afd2b1f2c4e8de8c03e19c16 upstream.
+
+When a signal is delivered, the information in the siginfo structure
+is copied to userspace. Good security practice dicatates that the
+unused fields in this structure should be initialized to 0 so that
+random kernel stack data isn't exposed to the user. This patch adds
+such an initialization to the two places where usbfs raises signals.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Dave Mielke <dave@mielke.cc>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/devio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -501,6 +501,7 @@ static void async_completed(struct urb *
+ as->status = urb->status;
+ signr = as->signr;
+ if (signr) {
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.si_signo = as->signr;
+ sinfo.si_errno = as->status;
+ sinfo.si_code = SI_ASYNCIO;
+@@ -2371,6 +2372,7 @@ static void usbdev_remove(struct usb_dev
+ wake_up_all(&ps->wait);
+ list_del_init(&ps->list);
+ if (ps->discsignr) {
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.si_signo = ps->discsignr;
+ sinfo.si_errno = EPIPE;
+ sinfo.si_code = SI_ASYNCIO;
--- /dev/null
+From 1e7e4fb66489cc84366656ca5318f1cb61afd4ba Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+Date: Tue, 24 Feb 2015 18:27:00 +0200
+Subject: usb: XHCI: platform: Move the Marvell quirks after the enabling the clocks
+
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+
+commit 1e7e4fb66489cc84366656ca5318f1cb61afd4ba upstream.
+
+The commit 973747928514 ("usb: host: xhci-plat: add support for the Armada
+375/38x XHCI controllers") extended the xhci-plat driver to support the Armada
+375/38x SoCs, mostly by adding a quirk configuring the MBUS window.
+
+However, that quirk was run before the clock the controllers needs has been
+enabled. This usually worked because the clock was first enabled by the
+bootloader, and left as such until the driver is probe, where it tries to
+access the MBUS configuration registers before enabling the clock.
+
+Things get messy when EPROBE_DEFER is involved during the probe, since as part
+of its error path, the driver will rightfully disable the clock. When the
+driver will be reprobed, it will retry to access the MBUS registers, but this
+time with the clock disabled, which hangs forever.
+
+Fix this by running the quirks after the clock has been enabled by the driver.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-plat.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -83,16 +83,6 @@ static int xhci_plat_probe(struct platfo
+ if (irq < 0)
+ return -ENODEV;
+
+-
+- if (of_device_is_compatible(pdev->dev.of_node,
+- "marvell,armada-375-xhci") ||
+- of_device_is_compatible(pdev->dev.of_node,
+- "marvell,armada-380-xhci")) {
+- ret = xhci_mvebu_mbus_init_quirk(pdev);
+- if (ret)
+- return ret;
+- }
+-
+ /* Initialize dma_mask and coherent_dma_mask to 32-bits */
+ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (ret)
+@@ -127,6 +117,15 @@ static int xhci_plat_probe(struct platfo
+ goto put_hcd;
+ }
+
++ if (of_device_is_compatible(pdev->dev.of_node,
++ "marvell,armada-375-xhci") ||
++ of_device_is_compatible(pdev->dev.of_node,
++ "marvell,armada-380-xhci")) {
++ ret = xhci_mvebu_mbus_init_quirk(pdev);
++ if (ret)
++ goto disable_clk;
++ }
++
+ ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+ if (ret)
+ goto disable_clk;
--- /dev/null
+From 6596a926b0b6c80b730a1dd2fa91908e0a539c37 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 24 Feb 2015 18:27:01 +0200
+Subject: xhci: Allocate correct amount of scratchpad buffers
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 6596a926b0b6c80b730a1dd2fa91908e0a539c37 upstream.
+
+Include the high order bit fields for Max scratchpad buffers when
+calculating how many scratchpad buffers are needed.
+
+I'm suprised this hasn't caused more issues, we never allocated more than
+32 buffers even if xhci needed more. Either we got lucky and xhci never
+really used past that area, or then we got enough zeroed dma memory anyway.
+
+Should be backported as far back as possible
+
+Reported-by: Tim Chen <tim.c.chen@linux.intel.com>
+Tested-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -88,9 +88,10 @@ struct xhci_cap_regs {
+ #define HCS_IST(p) (((p) >> 0) & 0xf)
+ /* bits 4:7, max number of Event Ring segments */
+ #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf)
++/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
+ /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
+-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
+-#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f)
++/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
++#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
+
+ /* HCSPARAMS3 - hcs_params3 - bitmasks */
+ /* bits 0:7, Max U1 to U0 latency for the roothub ports */
--- /dev/null
+From 45ba2154d12fc43b70312198ec47085f10be801a Mon Sep 17 00:00:00 2001
+From: Aleksander Morgado <aleksander@aleksander.es>
+Date: Fri, 6 Mar 2015 17:14:21 +0200
+Subject: xhci: fix reporting of 0-sized URBs in control endpoint
+
+From: Aleksander Morgado <aleksander@aleksander.es>
+
+commit 45ba2154d12fc43b70312198ec47085f10be801a upstream.
+
+When a control transfer has a short data stage, the xHCI controller generates
+two transfer events: a COMP_SHORT_TX event that specifies the untransferred
+amount, and a COMP_SUCCESS event. But when the data stage is not short, only the
+COMP_SUCCESS event occurs. Therefore, xhci-hcd must set urb->actual_length to
+urb->transfer_buffer_length while processing the COMP_SUCCESS event, unless
+urb->actual_length was set already by a previous COMP_SHORT_TX event.
+
+The driver checks this by seeing whether urb->actual_length == 0, but this alone
+is the wrong test, as it is entirely possible for a short transfer to have an
+urb->actual_length = 0.
+
+This patch changes the xhci driver to rely on a new td->urb_length_set flag,
+which is set to true when a COMP_SHORT_TX event is received and the URB length
+updated at that stage.
+
+This fixes a bug which affected the HSO plugin, which relies on URBs with
+urb->actual_length == 0 to halt re-submitting the RX URB in the control
+endpoint.
+
+Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 10 ++++++++--
+ drivers/usb/host/xhci.h | 3 +++
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1946,7 +1946,7 @@ static int process_ctrl_td(struct xhci_h
+ if (event_trb != ep_ring->dequeue) {
+ /* The event was for the status stage */
+ if (event_trb == td->last_trb) {
+- if (td->urb->actual_length != 0) {
++ if (td->urb_length_set) {
+ /* Don't overwrite a previously set error code
+ */
+ if ((*status == -EINPROGRESS || *status == 0) &&
+@@ -1960,7 +1960,13 @@ static int process_ctrl_td(struct xhci_h
+ td->urb->transfer_buffer_length;
+ }
+ } else {
+- /* Maybe the event was for the data stage? */
++ /*
++ * Maybe the event was for the data stage? If so, update
++ * already the actual_length of the URB and flag it as
++ * set, so that it is not overwritten in the event for
++ * the last TRB.
++ */
++ td->urb_length_set = true;
+ td->urb->actual_length =
+ td->urb->transfer_buffer_length -
+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1,3 +1,4 @@
++
+ /*
+ * xHCI host controller driver
+ *
+@@ -1289,6 +1290,8 @@ struct xhci_td {
+ struct xhci_segment *start_seg;
+ union xhci_trb *first_trb;
+ union xhci_trb *last_trb;
++ /* actual_length of the URB has already been set */
++ bool urb_length_set;
+ };
+
+ /* xHCI command default timeout value */
--- /dev/null
+From b8cb91e058cd0c0f02059c1207293c5b31d350fa Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 6 Mar 2015 17:23:19 +0200
+Subject: xhci: Workaround for PME stuck issues in Intel xhci
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit b8cb91e058cd0c0f02059c1207293c5b31d350fa upstream.
+
+The xhci in Intel Sunrisepoint and Cherryview platforms need a driver
+workaround for a Stuck PME that might either block PME events in suspend,
+or create spurious PME events preventing runtime suspend.
+
+Workaround is to clear a internal PME flag, BIT(28) in a vendor specific
+PMCTRL register at offset 0x80a4, in both suspend resume callbacks
+
+Without this, xhci connected usb devices might never be able to wake up the
+system from suspend, or prevent device from going to suspend (xhci d3)
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-pci.c | 30 ++++++++++++++++++++++++++++++
+ drivers/usb/host/xhci.h | 1 +
+ 2 files changed, 31 insertions(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -37,6 +37,9 @@
+
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
++#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -133,6 +136,12 @@ static void xhci_pci_quirks(struct devic
+ pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ }
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
++ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
++ xhci->quirks |= XHCI_PME_STUCK_QUIRK;
++ }
+ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ pdev->device == PCI_DEVICE_ID_EJ168) {
+ xhci->quirks |= XHCI_RESET_ON_RESUME;
+@@ -159,6 +168,21 @@ static void xhci_pci_quirks(struct devic
+ "QUIRK: Resetting on resume");
+ }
+
++/*
++ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
++ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
++ */
++static void xhci_pme_quirk(struct xhci_hcd *xhci)
++{
++ u32 val;
++ void __iomem *reg;
++
++ reg = (void __iomem *) xhci->cap_regs + 0x80a4;
++ val = readl(reg);
++ writel(val | BIT(28), reg);
++ readl(reg);
++}
++
+ /* called during probe() after chip reset completes */
+ static int xhci_pci_setup(struct usb_hcd *hcd)
+ {
+@@ -283,6 +307,9 @@ static int xhci_pci_suspend(struct usb_h
+ if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
+ pdev->no_d3cold = true;
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_quirk(xhci);
++
+ return xhci_suspend(xhci, do_wakeup);
+ }
+
+@@ -313,6 +340,9 @@ static int xhci_pci_resume(struct usb_hc
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL)
+ usb_enable_intel_xhci_ports(pdev);
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_quirk(xhci);
++
+ retval = xhci_resume(xhci, hibernated);
+ return retval;
+ }
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1564,6 +1564,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_WAKEUP (1 << 18)
+ /* For controllers with a broken beyond repair streams implementation */
+ #define XHCI_BROKEN_STREAMS (1 << 19)
++#define XHCI_PME_STUCK_QUIRK (1 << 20)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
projects / thirdparty / kernel / stable-queue.git / commitdiff
