pci-limit-config-space-size-for-netronome-nfp6000-family.patch
pci-add-netronome-nfp4000-pf-device-id.patch
pci-limit-config-space-size-for-netronome-nfp4000.patch
+usb-dwc3-gadget-increment-request-actual-once.patch
+usb-define-usb_speed_super_plus-speed-for-superspeedplus-usb3.1-devices.patch
+usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch
+usb-xhci-fix-panic-if-disconnect.patch
+usb-serial-fix-memleak-in-driver-registration-error-path.patch
+usb-serial-option-add-d-link-dwm-156-a3.patch
+usb-serial-option-add-support-for-telit-le920a4.patch
+usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch
+usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch
--- /dev/null
+From 8a1b2725a60d3267135c15e80984b4406054f650 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Thu, 10 Dec 2015 09:59:25 +0200
+Subject: usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 8a1b2725a60d3267135c15e80984b4406054f650 upstream.
+
+Add a new USB_SPEED_SUPER_PLUS device speed, and make sure usb core can
+handle the new speed.
+In most cases the behaviour is the same as with USB_SPEED_SUPER SuperSpeed
+devices. In a few places we add a "Plus" string to inform the user of the
+new speed.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 3 ++-
+ drivers/usb/core/devices.c | 10 ++++++----
+ drivers/usb/core/hcd-pci.c | 2 +-
+ drivers/usb/core/hcd.c | 6 +++---
+ drivers/usb/core/hub.c | 26 +++++++++++++++-----------
+ drivers/usb/core/urb.c | 3 ++-
+ drivers/usb/core/usb.h | 2 +-
+ include/uapi/linux/usb/ch9.h | 1 +
+ 8 files changed, 31 insertions(+), 22 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -192,6 +192,7 @@ static int usb_parse_endpoint(struct dev
+ if (usb_endpoint_xfer_int(d)) {
+ i = 1;
+ switch (to_usb_device(ddev)->speed) {
++ case USB_SPEED_SUPER_PLUS:
+ case USB_SPEED_SUPER:
+ case USB_SPEED_HIGH:
+ /* Many device manufacturers are using full-speed
+@@ -264,7 +265,7 @@ static int usb_parse_endpoint(struct dev
+ }
+
+ /* Parse a possible SuperSpeed endpoint companion descriptor */
+- if (to_usb_device(ddev)->speed == USB_SPEED_SUPER)
++ if (to_usb_device(ddev)->speed >= USB_SPEED_SUPER)
+ usb_parse_ss_endpoint_companion(ddev, cfgno,
+ inum, asnum, endpoint, buffer, size);
+
+--- a/drivers/usb/core/devices.c
++++ b/drivers/usb/core/devices.c
+@@ -221,7 +221,7 @@ static char *usb_dump_endpoint_descripto
+ break;
+ case USB_ENDPOINT_XFER_INT:
+ type = "Int.";
+- if (speed == USB_SPEED_HIGH || speed == USB_SPEED_SUPER)
++ if (speed == USB_SPEED_HIGH || speed >= USB_SPEED_SUPER)
+ interval = 1 << (desc->bInterval - 1);
+ else
+ interval = desc->bInterval;
+@@ -230,7 +230,7 @@ static char *usb_dump_endpoint_descripto
+ return start;
+ }
+ interval *= (speed == USB_SPEED_HIGH ||
+- speed == USB_SPEED_SUPER) ? 125 : 1000;
++ speed >= USB_SPEED_SUPER) ? 125 : 1000;
+ if (interval % 1000)
+ unit = 'u';
+ else {
+@@ -322,7 +322,7 @@ static char *usb_dump_config_descriptor(
+
+ if (start > end)
+ return start;
+- if (speed == USB_SPEED_SUPER)
++ if (speed >= USB_SPEED_SUPER)
+ mul = 8;
+ else
+ mul = 2;
+@@ -534,6 +534,8 @@ static ssize_t usb_device_dump(char __us
+ speed = "480"; break;
+ case USB_SPEED_SUPER:
+ speed = "5000"; break;
++ case USB_SPEED_SUPER_PLUS:
++ speed = "10000"; break;
+ default:
+ speed = "??";
+ }
+@@ -553,7 +555,7 @@ static ssize_t usb_device_dump(char __us
+
+ /* super/high speed reserves 80%, full/low reserves 90% */
+ if (usbdev->speed == USB_SPEED_HIGH ||
+- usbdev->speed == USB_SPEED_SUPER)
++ usbdev->speed >= USB_SPEED_SUPER)
+ max = 800;
+ else
+ max = FRAME_TIME_MAX_USECS_ALLOC;
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -207,7 +207,7 @@ int usb_hcd_pci_probe(struct pci_dev *de
+ * The xHCI driver has its own irq management
+ * make sure irq setup is not touched for xhci in generic hcd code
+ */
+- if ((driver->flags & HCD_MASK) != HCD_USB3) {
++ if ((driver->flags & HCD_MASK) < HCD_USB3) {
+ if (!dev->irq) {
+ dev_err(&dev->dev,
+ "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1024,7 +1024,7 @@ static int register_root_hub(struct usb_
+ dev_name(&usb_dev->dev), retval);
+ return (retval < 0) ? retval : -EMSGSIZE;
+ }
+- if (usb_dev->speed == USB_SPEED_SUPER) {
++ if (usb_dev->speed >= USB_SPEED_SUPER) {
+ retval = usb_get_bos_descriptor(usb_dev);
+ if (retval < 0) {
+ mutex_unlock(&usb_bus_list_lock);
+@@ -2055,7 +2055,7 @@ int usb_alloc_streams(struct usb_interfa
+ hcd = bus_to_hcd(dev->bus);
+ if (!hcd->driver->alloc_streams || !hcd->driver->free_streams)
+ return -EINVAL;
+- if (dev->speed != USB_SPEED_SUPER)
++ if (dev->speed < USB_SPEED_SUPER)
+ return -EINVAL;
+ if (dev->state < USB_STATE_CONFIGURED)
+ return -ENODEV;
+@@ -2093,7 +2093,7 @@ int usb_free_streams(struct usb_interfac
+
+ dev = interface_to_usbdev(interface);
+ hcd = bus_to_hcd(dev->bus);
+- if (dev->speed != USB_SPEED_SUPER)
++ if (dev->speed < USB_SPEED_SUPER)
+ return -EINVAL;
+
+ /* Streams only apply to bulk endpoints. */
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -297,7 +297,7 @@ static void usb_set_lpm_parameters(struc
+ unsigned int hub_u1_del;
+ unsigned int hub_u2_del;
+
+- if (!udev->lpm_capable || udev->speed != USB_SPEED_SUPER)
++ if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER)
+ return;
+
+ hub = usb_hub_to_struct_hub(udev->parent);
+@@ -2559,7 +2559,7 @@ static unsigned hub_is_wusb(struct usb_h
+ */
+ static bool use_new_scheme(struct usb_device *udev, int retry)
+ {
+- if (udev->speed == USB_SPEED_SUPER)
++ if (udev->speed >= USB_SPEED_SUPER)
+ return false;
+
+ return USE_NEW_SCHEME(retry);
+@@ -3812,7 +3812,7 @@ int usb_disable_lpm(struct usb_device *u
+ struct usb_hcd *hcd;
+
+ if (!udev || !udev->parent ||
+- udev->speed != USB_SPEED_SUPER ||
++ udev->speed < USB_SPEED_SUPER ||
+ !udev->lpm_capable)
+ return 0;
+
+@@ -3868,7 +3868,7 @@ void usb_enable_lpm(struct usb_device *u
+ struct usb_hcd *hcd;
+
+ if (!udev || !udev->parent ||
+- udev->speed != USB_SPEED_SUPER ||
++ udev->speed < USB_SPEED_SUPER ||
+ !udev->lpm_capable)
+ return;
+
+@@ -4127,7 +4127,9 @@ hub_port_init (struct usb_hub *hub, stru
+
+ retval = -ENODEV;
+
+- if (oldspeed != USB_SPEED_UNKNOWN && oldspeed != udev->speed) {
++ /* Don't allow speed changes at reset, except usb 3.0 to faster */
++ if (oldspeed != USB_SPEED_UNKNOWN && oldspeed != udev->speed &&
++ !(oldspeed == USB_SPEED_SUPER && udev->speed > oldspeed)) {
+ dev_dbg(&udev->dev, "device reset changed speed!\n");
+ goto fail;
+ }
+@@ -4139,6 +4141,7 @@ hub_port_init (struct usb_hub *hub, stru
+ * reported as 0xff in the device descriptor). WUSB1.0[4.8.1].
+ */
+ switch (udev->speed) {
++ case USB_SPEED_SUPER_PLUS:
+ case USB_SPEED_SUPER:
+ case USB_SPEED_WIRELESS: /* fixed at 512 */
+ udev->ep0.desc.wMaxPacketSize = cpu_to_le16(512);
+@@ -4165,7 +4168,7 @@ hub_port_init (struct usb_hub *hub, stru
+ else
+ speed = usb_speed_string(udev->speed);
+
+- if (udev->speed != USB_SPEED_SUPER)
++ if (udev->speed < USB_SPEED_SUPER)
+ dev_info(&udev->dev,
+ "%s %s USB device number %d using %s\n",
+ (udev->config) ? "reset" : "new", speed,
+@@ -4291,11 +4294,12 @@ hub_port_init (struct usb_hub *hub, stru
+ devnum, retval);
+ goto fail;
+ }
+- if (udev->speed == USB_SPEED_SUPER) {
++ if (udev->speed >= USB_SPEED_SUPER) {
+ devnum = udev->devnum;
+ dev_info(&udev->dev,
+- "%s SuperSpeed USB device number %d using %s\n",
++ "%s SuperSpeed%s USB device number %d using %s\n",
+ (udev->config) ? "reset" : "new",
++ (udev->speed == USB_SPEED_SUPER_PLUS) ? "Plus" : "",
+ devnum, udev->bus->controller->driver->name);
+ }
+
+@@ -4337,7 +4341,7 @@ hub_port_init (struct usb_hub *hub, stru
+ * got from those devices show they aren't superspeed devices. Warm
+ * reset the port attached by the devices can fix them.
+ */
+- if ((udev->speed == USB_SPEED_SUPER) &&
++ if ((udev->speed >= USB_SPEED_SUPER) &&
+ (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0300)) {
+ dev_err(&udev->dev, "got a wrong device descriptor, "
+ "warm reset device\n");
+@@ -4348,7 +4352,7 @@ hub_port_init (struct usb_hub *hub, stru
+ }
+
+ if (udev->descriptor.bMaxPacketSize0 == 0xff ||
+- udev->speed == USB_SPEED_SUPER)
++ udev->speed >= USB_SPEED_SUPER)
+ i = 512;
+ else
+ i = udev->descriptor.bMaxPacketSize0;
+@@ -4607,7 +4611,7 @@ static void hub_port_connect_change(stru
+ udev->level = hdev->level + 1;
+ udev->wusb = hub_is_wusb(hub);
+
+- /* Only USB 3.0 devices are connected to SuperSpeed hubs. */
++ /* Devices connected to SuperSpeed hubs are USB 3.0 or later */
+ if (hub_is_superspeed(hub->hdev))
+ udev->speed = USB_SPEED_SUPER;
+ else
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -402,7 +402,7 @@ int usb_submit_urb(struct urb *urb, gfp_
+ /* SuperSpeed isoc endpoints have up to 16 bursts of up to
+ * 3 packets each
+ */
+- if (dev->speed == USB_SPEED_SUPER) {
++ if (dev->speed >= USB_SPEED_SUPER) {
+ int burst = 1 + ep->ss_ep_comp.bMaxBurst;
+ int mult = USB_SS_MULT(ep->ss_ep_comp.bmAttributes);
+ max *= burst;
+@@ -499,6 +499,7 @@ int usb_submit_urb(struct urb *urb, gfp_
+ }
+ /* too big? */
+ switch (dev->speed) {
++ case USB_SPEED_SUPER_PLUS:
+ case USB_SPEED_SUPER: /* units are 125us */
+ /* Handle up to 2^(16-1) microframes */
+ if (urb->interval > (1 << 15))
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -43,7 +43,7 @@ static inline unsigned usb_get_max_power
+ struct usb_host_config *c)
+ {
+ /* SuperSpeed power is in 8 mA units; others are in 2 mA units */
+- unsigned mul = (udev->speed == USB_SPEED_SUPER ? 8 : 2);
++ unsigned mul = (udev->speed >= USB_SPEED_SUPER ? 8 : 2);
+
+ return c->desc.bMaxPower * mul;
+ }
+--- a/include/uapi/linux/usb/ch9.h
++++ b/include/uapi/linux/usb/ch9.h
+@@ -913,6 +913,7 @@ enum usb_device_speed {
+ USB_SPEED_HIGH, /* usb 2.0 */
+ USB_SPEED_WIRELESS, /* wireless (usb 2.5) */
+ USB_SPEED_SUPER, /* usb 3.0 */
++ USB_SPEED_SUPER_PLUS, /* usb 3.1 */
+ };
+
+
--- /dev/null
+From c7de573471832dff7d31f0c13b0f143d6f017799 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Fri, 29 Jul 2016 03:17:58 +0300
+Subject: usb: dwc3: gadget: increment request->actual once
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit c7de573471832dff7d31f0c13b0f143d6f017799 upstream.
+
+When using SG lists, we would end up setting
+request->actual to:
+
+ num_mapped_sgs * (request->length - count)
+
+Let's fix that up by incrementing request->actual
+only once.
+
+Reported-by: Brian E Rogers <brian.e.rogers@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1799,14 +1799,6 @@ static int __dwc3_cleanup_done_trbs(stru
+ s_pkt = 1;
+ }
+
+- /*
+- * We assume here we will always receive the entire data block
+- * which we should receive. Meaning, if we program RX to
+- * receive 4K but we receive only 2K, we assume that's all we
+- * should receive and we simply bounce the request back to the
+- * gadget driver for further processing.
+- */
+- req->request.actual += req->request.length - count;
+ if (s_pkt)
+ return 1;
+ if ((event->status & DEPEVT_STATUS_LST) &&
+@@ -1826,6 +1818,7 @@ static int dwc3_cleanup_done_reqs(struct
+ struct dwc3_trb *trb;
+ unsigned int slot;
+ unsigned int i;
++ int count = 0;
+ int ret;
+
+ do {
+@@ -1842,6 +1835,8 @@ static int dwc3_cleanup_done_reqs(struct
+ slot++;
+ slot %= DWC3_TRB_NUM;
+ trb = &dep->trb_pool[slot];
++ count += trb->size & DWC3_TRB_SIZE_MASK;
++
+
+ ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
+ event, status);
+@@ -1849,6 +1844,14 @@ static int dwc3_cleanup_done_reqs(struct
+ break;
+ }while (++i < req->request.num_mapped_sgs);
+
++ /*
++ * We assume here we will always receive the entire data block
++ * which we should receive. Meaning, if we program RX to
++ * receive 4K but we receive only 2K, we assume that's all we
++ * should receive and we simply bounce the request back to the
++ * gadget driver for further processing.
++ */
++ req->request.actual += req->request.length - count;
+ dwc3_gadget_giveback(dep, req, status);
+
+ if (ret)
--- /dev/null
+From 647024a7df36014bbc4479d92d88e6b77c0afcf6 Mon Sep 17 00:00:00 2001
+From: Alexey Klimov <klimov.linux@gmail.com>
+Date: Mon, 8 Aug 2016 02:34:46 +0100
+Subject: USB: serial: fix memleak in driver-registration error path
+
+From: Alexey Klimov <klimov.linux@gmail.com>
+
+commit 647024a7df36014bbc4479d92d88e6b77c0afcf6 upstream.
+
+udriver struct allocated by kzalloc() will not be freed
+if usb_register() and next calls fail. This patch fixes this
+by adding one more step with kfree(udriver) in error path.
+
+Signed-off-by: Alexey Klimov <klimov.linux@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb-serial.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1426,7 +1426,7 @@ int usb_serial_register_drivers(struct u
+
+ rc = usb_register(udriver);
+ if (rc)
+- return rc;
++ goto failed_usb_register;
+
+ for (sd = serial_drivers; *sd; ++sd) {
+ (*sd)->usb_driver = udriver;
+@@ -1444,6 +1444,8 @@ int usb_serial_register_drivers(struct u
+ while (sd-- > serial_drivers)
+ usb_serial_deregister(*sd);
+ usb_deregister(udriver);
++failed_usb_register:
++ kfree(udriver);
+ return rc;
+ }
+ EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
--- /dev/null
+From ae34d12cc1e212ffcd92e069030e54dae69c832f Mon Sep 17 00:00:00 2001
+From: "Sheng-Hui J. Chu" <s.jeffrey.chu@gmail.com>
+Date: Thu, 28 Jul 2016 17:01:45 -0400
+Subject: USB: serial: ftdi_sio: add device ID for WICED USB UART dev board
+
+From: Sheng-Hui J. Chu <s.jeffrey.chu@gmail.com>
+
+commit ae34d12cc1e212ffcd92e069030e54dae69c832f upstream.
+
+BCM20706V2_EVAL is a WICED dev board designed with FT2232H USB 2.0
+UART/FIFO IC.
+
+To support BCM920706V2_EVAL dev board for WICED development on Linux.
+Add the VID(0a5c) and PID(6422) to ftdi_sio driver to allow loading
+ftdi_sio for this board.
+
+Signed-off-by: Sheng-Hui J. Chu <s.jeffrey.chu@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1021,6 +1021,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
++ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
+ { } /* Terminating entry */
+ };
+
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -673,6 +673,12 @@
+ #define INTREPID_NEOVI_PID 0x0701
+
+ /*
++ * WICED USB UART
++ */
++#define WICED_VID 0x0A5C
++#define WICED_USB20706V2_PID 0x6422
++
++/*
+ * Definitions for ID TECH (www.idt-net.com) devices
+ */
+ #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */
--- /dev/null
+From 6977495c06f7f47636a076ee5a0ca571279d9697 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Robert=20Deli=C3=ABn?= <robert@delien.nl>
+Date: Thu, 28 Jul 2016 18:52:55 +0000
+Subject: USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices
+
+From: Robert Deliën <robert@delien.nl>
+
+commit 6977495c06f7f47636a076ee5a0ca571279d9697 upstream.
+
+Ivium Technologies uses the FTDI VID with custom PIDs for their line of
+electrochemical interfaces and the PalmSens they developed for PalmSens
+BV.
+
+Signed-off-by: Robert Delien <robert@delien.nl>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -661,6 +661,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -406,6 +406,12 @@
+ #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
+
+ /*
++ * Ivium Technologies product IDs
++ */
++#define FTDI_PALMSENS_PID 0xf440
++#define FTDI_IVIUM_XSTAT_PID 0xf441
++
++/*
+ * Linx Technologies product ids
+ */
+ #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */
--- /dev/null
+From cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Sun, 24 Jul 2016 13:53:30 +0200
+Subject: USB: serial: option: add D-Link DWM-156/A3
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+commit cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 upstream.
+
+The device has four interfaces; the three serial ports ought to be
+handled by this driver:
+
+00 Diagnostic interface serial port
+01 NMEA device serial port
+02 Mass storage (sd card)
+03 Modem serial port
+
+The other product ids listed in the Windows driver are present already.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1839,6 +1839,7 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
--- /dev/null
+From 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Tue, 2 Aug 2016 11:29:25 +0200
+Subject: USB: serial: option: add support for Telit LE920A4
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 upstream.
+
+This patch adds a set of compositions for Telit LE920A4.
+
+Compositions in short are:
+
+0x1207: tty + tty
+0x1208: tty + adb + tty + tty
+0x1211: tty + adb + ecm
+0x1212: tty + adb
+0x1213: ecm + tty
+0x1214: tty + adb + ecm + tty
+
+telit_le922_blacklist_usbcfg3 is reused for compositions 0x1211
+and 0x1214 due to the same interfaces positions.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -275,6 +275,12 @@ static void option_instat_callback(struc
+ #define TELIT_PRODUCT_LE920 0x1200
+ #define TELIT_PRODUCT_LE910 0x1201
+ #define TELIT_PRODUCT_LE910_USBCFG4 0x1206
++#define TELIT_PRODUCT_LE920A4_1207 0x1207
++#define TELIT_PRODUCT_LE920A4_1208 0x1208
++#define TELIT_PRODUCT_LE920A4_1211 0x1211
++#define TELIT_PRODUCT_LE920A4_1212 0x1212
++#define TELIT_PRODUCT_LE920A4_1213 0x1213
++#define TELIT_PRODUCT_LE920A4_1214 0x1214
+
+ /* ZTE PRODUCTS */
+ #define ZTE_VENDOR_ID 0x19d2
+@@ -636,6 +642,11 @@ static const struct option_blacklist_inf
+ .reserved = BIT(1) | BIT(5),
+ };
+
++static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
++ .sendsetup = BIT(0),
++ .reserved = BIT(1),
++};
++
+ static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
+ .sendsetup = BIT(2),
+ .reserved = BIT(0) | BIT(1) | BIT(3),
+@@ -1211,6 +1222,16 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
--- /dev/null
+From aed9d65ac3278d4febd8665bd7db59ef53e825fe Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 1 Aug 2016 15:25:56 -0400
+Subject: USB: validate wMaxPacketValue entries in endpoint descriptors
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit aed9d65ac3278d4febd8665bd7db59ef53e825fe upstream.
+
+Erroneous or malicious endpoint descriptors may have non-zero bits in
+reserved positions, or out-of-bounds values. This patch helps prevent
+these from causing problems by bounds-checking the wMaxPacketValue
+entries in endpoint descriptors and capping the values at the maximum
+allowed.
+
+This issue was first discovered and tests were conducted by Jake Lamberson
+<jake.lamberson1@gmail.com>, an intern working for Rosie Hall.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: roswest <roswest@cisco.com>
+Tested-by: roswest <roswest@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 66 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 63 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -143,6 +143,31 @@ static void usb_parse_ss_endpoint_compan
+ }
+ }
+
++static const unsigned short low_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 8,
++ [USB_ENDPOINT_XFER_ISOC] = 0,
++ [USB_ENDPOINT_XFER_BULK] = 0,
++ [USB_ENDPOINT_XFER_INT] = 8,
++};
++static const unsigned short full_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 64,
++ [USB_ENDPOINT_XFER_ISOC] = 1023,
++ [USB_ENDPOINT_XFER_BULK] = 64,
++ [USB_ENDPOINT_XFER_INT] = 64,
++};
++static const unsigned short high_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 64,
++ [USB_ENDPOINT_XFER_ISOC] = 1024,
++ [USB_ENDPOINT_XFER_BULK] = 512,
++ [USB_ENDPOINT_XFER_INT] = 1023,
++};
++static const unsigned short super_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 512,
++ [USB_ENDPOINT_XFER_ISOC] = 1024,
++ [USB_ENDPOINT_XFER_BULK] = 1024,
++ [USB_ENDPOINT_XFER_INT] = 1024,
++};
++
+ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ int asnum, struct usb_host_interface *ifp, int num_ep,
+ unsigned char *buffer, int size)
+@@ -151,6 +176,8 @@ static int usb_parse_endpoint(struct dev
+ struct usb_endpoint_descriptor *d;
+ struct usb_host_endpoint *endpoint;
+ int n, i, j, retval;
++ unsigned int maxp;
++ const unsigned short *maxpacket_maxes;
+
+ d = (struct usb_endpoint_descriptor *) buffer;
+ buffer += d->bLength;
+@@ -247,6 +274,42 @@ static int usb_parse_endpoint(struct dev
+ endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
+ }
+
++ /* Validate the wMaxPacketSize field */
++ maxp = usb_endpoint_maxp(&endpoint->desc);
++
++ /* Find the highest legal maxpacket size for this endpoint */
++ i = 0; /* additional transactions per microframe */
++ switch (to_usb_device(ddev)->speed) {
++ case USB_SPEED_LOW:
++ maxpacket_maxes = low_speed_maxpacket_maxes;
++ break;
++ case USB_SPEED_FULL:
++ maxpacket_maxes = full_speed_maxpacket_maxes;
++ break;
++ case USB_SPEED_HIGH:
++ /* Bits 12..11 are allowed only for HS periodic endpoints */
++ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
++ i = maxp & (BIT(12) | BIT(11));
++ maxp &= ~i;
++ }
++ /* fallthrough */
++ default:
++ maxpacket_maxes = high_speed_maxpacket_maxes;
++ break;
++ case USB_SPEED_SUPER:
++ case USB_SPEED_SUPER_PLUS:
++ maxpacket_maxes = super_speed_maxpacket_maxes;
++ break;
++ }
++ j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
++
++ if (maxp > j) {
++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
++ cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
++ maxp = j;
++ endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
++ }
++
+ /*
+ * Some buggy high speed devices have bulk endpoints using
+ * maxpacket sizes other than 512. High speed HCDs may not
+@@ -254,9 +317,6 @@ static int usb_parse_endpoint(struct dev
+ */
+ if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
+ && usb_endpoint_xfer_bulk(d)) {
+- unsigned maxp;
+-
+- maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
+ if (maxp != 512)
+ dev_warn(ddev, "config %d interface %d altsetting %d "
+ "bulk endpoint 0x%X has invalid maxpacket %d\n",
--- /dev/null
+From 88716a93766b8f095cdef37a8e8f2c93aa233b21 Mon Sep 17 00:00:00 2001
+From: Jim Lin <jilin@nvidia.com>
+Date: Tue, 16 Aug 2016 10:18:05 +0300
+Subject: usb: xhci: Fix panic if disconnect
+
+From: Jim Lin <jilin@nvidia.com>
+
+commit 88716a93766b8f095cdef37a8e8f2c93aa233b21 upstream.
+
+After a device is disconnected, xhci_stop_device() will be invoked
+in xhci_bus_suspend().
+Also the "disconnect" IRQ will have ISR to invoke
+xhci_free_virt_device() in this sequence.
+xhci_irq -> xhci_handle_event -> handle_cmd_completion ->
+xhci_handle_cmd_disable_slot -> xhci_free_virt_device
+
+If xhci->devs[slot_id] has been assigned to NULL in
+xhci_free_virt_device(), then virt_dev->eps[i].ring in
+xhci_stop_device() may point to an invlid address to cause kernel
+panic.
+
+virt_dev = xhci->devs[slot_id];
+:
+if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
+
+[] Unable to handle kernel paging request at virtual address 00001a68
+[] pgd=ffffffc001430000
+[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003,
+*pmd=000000013c808003, *pte=0000000000000000
+[] Internal error: Oops: 96000006 [#1] PREEMPT SMP
+[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G U
+[] Workqueue: pm pm_runtime_work
+[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti:
+ffffffc0bc0ec000
+[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4
+
+This issue is found when running with realtek ethernet device
+(0bda:8153).
+
+Signed-off-by: Jim Lin <jilin@nvidia.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -276,6 +276,9 @@ static int xhci_stop_device(struct xhci_
+
+ ret = 0;
+ virt_dev = xhci->devs[slot_id];
++ if (!virt_dev)
++ return -ENODEV;
++
+ cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
+ if (!cmd) {
+ xhci_dbg(xhci, "Couldn't allocate command structure.\n");
projects / thirdparty / kernel / stable-queue.git / commitdiff
