--- /dev/null
+From 56abcab833fafcfaeb2f5b25e0364c1dec45f53e Mon Sep 17 00:00:00 2001
+From: Arseny Solokha <asolokha@kb.kras.ru>
+Date: Sat, 6 Dec 2014 09:54:06 +0700
+Subject: OHCI: add a quirk for ULi M5237 blocking on reset
+
+From: Arseny Solokha <asolokha@kb.kras.ru>
+
+commit 56abcab833fafcfaeb2f5b25e0364c1dec45f53e upstream.
+
+Commit 8dccddbc2368 ("OHCI: final fix for NVIDIA problems (I hope)")
+introduced into 3.1.9 broke boot on e.g. Freescale P2020DS development
+board. The code path that was previously specific to NVIDIA controllers
+had then become taken for all chips.
+
+However, the M5237 installed on the board wedges solid when accessing
+its base+OHCI_FMINTERVAL register, making it impossible to boot any
+kernel newer than 3.1.8 on this particular and apparently other similar
+machines.
+
+Don't readl() and writel() base+OHCI_FMINTERVAL on PCI ID 10b9:5237.
+
+The patch is suitable for the -next tree as well as all maintained
+kernels up to 3.2 inclusive.
+
+Signed-off-by: Arseny Solokha <asolokha@kb.kras.ru>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -571,7 +571,8 @@ static void quirk_usb_handoff_ohci(struc
+ {
+ void __iomem *base;
+ u32 control;
+- u32 fminterval;
++ u32 fminterval = 0;
++ bool no_fminterval = false;
+ int cnt;
+
+ if (!mmio_resource_enabled(pdev, 0))
+@@ -581,6 +582,13 @@ static void quirk_usb_handoff_ohci(struc
+ if (base == NULL)
+ return;
+
++ /*
++ * ULi M5237 OHCI controller locks the whole system when accessing
++ * the OHCI_FMINTERVAL offset.
++ */
++ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
++ no_fminterval = true;
++
+ control = readl(base + OHCI_CONTROL);
+
+ /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
+@@ -619,7 +627,9 @@ static void quirk_usb_handoff_ohci(struc
+ }
+
+ /* software reset of the controller, preserving HcFmInterval */
+- fminterval = readl(base + OHCI_FMINTERVAL);
++ if (!no_fminterval)
++ fminterval = readl(base + OHCI_FMINTERVAL);
++
+ writel(OHCI_HCR, base + OHCI_CMDSTATUS);
+
+ /* reset requires max 10 us delay */
+@@ -628,7 +638,9 @@ static void quirk_usb_handoff_ohci(struc
+ break;
+ udelay(1);
+ }
+- writel(fminterval, base + OHCI_FMINTERVAL);
++
++ if (!no_fminterval)
++ writel(fminterval, base + OHCI_FMINTERVAL);
+
+ /* Now the controller is safely in SUSPEND and nothing can wake it up */
+ iounmap(base);
gpio-fix-sleep-while-atomic-in-gpiochip_remove.patch
gpio-sysfs-fix-gpio-chip-device-attribute-leak.patch
gpio-sysfs-fix-gpio-device-attribute-leak.patch
+ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch
+usb-dwc3-gadget-fix-trb-preparation-during-sg.patch
+usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch
+usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch
+usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch
+usb-qcserial-option-make-at-urcs-work-for-sierra-wireless-mc73xx.patch
+usb-keyspan-fix-null-deref-at-probe.patch
+usb-gadget-gadgetfs-free-memory-allocated-by-memdup_user.patch
+usb-gadget-udc-atmel-change-setting-for-dma.patch
+usb-gadget-udc-atmel-fix-possible-in-hang-issue.patch
+usb-gadget-udc-atmel-fix-possible-oops-when-unloading-module.patch
+usb-console-fix-uninitialised-ldisc-semaphore.patch
+usb-console-fix-potential-use-after-free.patch
--- /dev/null
+From 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 5 Jan 2015 16:04:13 +0100
+Subject: USB: console: fix potential use after free
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream.
+
+Use tty kref to release the fake tty in usb_console_setup to avoid use
+after free if the underlying serial driver has acquired a reference.
+
+Note that using the tty destructor release_one_tty requires some more
+state to be initialised.
+
+Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/console.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -46,6 +46,8 @@ static struct console usbcons;
+ * ------------------------------------------------------------
+ */
+
++static const struct tty_operations usb_console_fake_tty_ops = {
++};
+
+ /*
+ * The parsing of the command line works exactly like the
+@@ -137,14 +139,17 @@ static int usb_console_setup(struct cons
+ goto reset_open_count;
+ }
+ kref_init(&tty->kref);
+- tty_port_tty_set(&port->port, tty);
+ tty->driver = usb_serial_tty_driver;
+ tty->index = co->index;
+ init_ldsem(&tty->ldisc_sem);
++ INIT_LIST_HEAD(&tty->tty_files);
++ kref_get(&tty->driver->kref);
++ tty->ops = &usb_console_fake_tty_ops;
+ if (tty_init_termios(tty)) {
+ retval = -ENOMEM;
+- goto free_tty;
++ goto put_tty;
+ }
++ tty_port_tty_set(&port->port, tty);
+ }
+
+ /* only call the device specific open if this
+@@ -162,7 +167,7 @@ static int usb_console_setup(struct cons
+ serial->type->set_termios(tty, port, &dummy);
+
+ tty_port_tty_set(&port->port, NULL);
+- kfree(tty);
++ tty_kref_put(tty);
+ }
+ set_bit(ASYNCB_INITIALIZED, &port->port.flags);
+ }
+@@ -178,8 +183,8 @@ static int usb_console_setup(struct cons
+
+ fail:
+ tty_port_tty_set(&port->port, NULL);
+- free_tty:
+- kfree(tty);
++ put_tty:
++ tty_kref_put(tty);
+ reset_open_count:
+ port->port.count = 0;
+ usb_autopm_put_interface(serial->interface);
--- /dev/null
+From d269d4434c72ed0da3a9b1230c30da82c4918c63 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 5 Jan 2015 16:04:12 +0100
+Subject: USB: console: fix uninitialised ldisc semaphore
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d269d4434c72ed0da3a9b1230c30da82c4918c63 upstream.
+
+The USB console currently allocates a temporary fake tty which is used
+to pass terminal settings to the underlying serial driver.
+
+The tty struct is not fully initialised, something which can lead to a
+lockdep warning (or worse) if a serial driver tries to acquire a
+line-discipline reference:
+
+ usbserial: USB Serial support registered for pl2303
+ pl2303 1-2.1:1.0: pl2303 converter detected
+ usb 1-2.1: pl2303 converter now attached to ttyUSB0
+ INFO: trying to register non-static key.
+ the code is fine but needs lockdep annotation.
+ turning off the locking correctness validator.
+ CPU: 0 PID: 68 Comm: udevd Tainted: G W 3.18.0-rc5 #10
+ [<c0016f04>] (unwind_backtrace) from [<c0013978>] (show_stack+0x20/0x24)
+ [<c0013978>] (show_stack) from [<c0449794>] (dump_stack+0x24/0x28)
+ [<c0449794>] (dump_stack) from [<c006f730>] (__lock_acquire+0x1e50/0x2004)
+ [<c006f730>] (__lock_acquire) from [<c0070128>] (lock_acquire+0xe4/0x18c)
+ [<c0070128>] (lock_acquire) from [<c027c6f8>] (ldsem_down_read_trylock+0x78/0x90)
+ [<c027c6f8>] (ldsem_down_read_trylock) from [<c027a1cc>] (tty_ldisc_ref+0x24/0x58)
+ [<c027a1cc>] (tty_ldisc_ref) from [<c0340760>] (usb_serial_handle_dcd_change+0x48/0xe8)
+ [<c0340760>] (usb_serial_handle_dcd_change) from [<bf000484>] (pl2303_read_int_callback+0x210/0x220 [pl2303])
+ [<bf000484>] (pl2303_read_int_callback [pl2303]) from [<c031624c>] (__usb_hcd_giveback_urb+0x80/0x140)
+ [<c031624c>] (__usb_hcd_giveback_urb) from [<c0316fc0>] (usb_giveback_urb_bh+0x98/0xd4)
+ [<c0316fc0>] (usb_giveback_urb_bh) from [<c0042e44>] (tasklet_hi_action+0x9c/0x108)
+ [<c0042e44>] (tasklet_hi_action) from [<c0042380>] (__do_softirq+0x148/0x42c)
+ [<c0042380>] (__do_softirq) from [<c00429cc>] (irq_exit+0xd8/0x114)
+ [<c00429cc>] (irq_exit) from [<c007ae58>] (__handle_domain_irq+0x84/0xdc)
+ [<c007ae58>] (__handle_domain_irq) from [<c000879c>] (omap_intc_handle_irq+0xd8/0xe0)
+ [<c000879c>] (omap_intc_handle_irq) from [<c0014544>] (__irq_svc+0x44/0x7c)
+ Exception stack(0xdf4e7f08 to 0xdf4e7f50)
+ 7f00: debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c
+ 7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50
+ 7f40: c038ebc0 c038d74c 600f0013 ffffffff
+ [<c0014544>] (__irq_svc) from [<c038d74c>] (___sys_sendmsg.part.29+0x0/0x2e0)
+ [<c038d74c>] (___sys_sendmsg.part.29) from [<c038ec08>] (SyS_sendmsg+0x18/0x1c)
+ [<c038ec08>] (SyS_sendmsg) from [<c000fa00>] (ret_fast_syscall+0x0/0x48)
+ console [ttyUSB0] enabled
+
+Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/console.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -140,6 +140,7 @@ static int usb_console_setup(struct cons
+ tty_port_tty_set(&port->port, tty);
+ tty->driver = usb_serial_tty_driver;
+ tty->index = co->index;
++ init_ldsem(&tty->ldisc_sem);
+ if (tty_init_termios(tty)) {
+ retval = -ENOMEM;
+ goto free_tty;
--- /dev/null
+From 1ae78a4870989a354028cb17dabf819b595e70e3 Mon Sep 17 00:00:00 2001
+From: David Peterson <david.peterson@cel.com>
+Date: Tue, 6 Jan 2015 15:00:52 +0000
+Subject: USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices
+
+From: David Peterson <david.peterson@cel.com>
+
+commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream.
+
+Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks
+devices.
+
+Signed-off-by: David Peterson <david.peterson@cel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -120,10 +120,12 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+- { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */
++ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */
++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
+ { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
++ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
--- /dev/null
+From 90441b4dbe90ba0c38111ea89fa093a8c9627801 Mon Sep 17 00:00:00 2001
+From: Preston Fick <pffick@gmail.com>
+Date: Sat, 27 Dec 2014 01:32:41 -0600
+Subject: USB: cp210x: fix ID for production CEL MeshConnect USB Stick
+
+From: Preston Fick <pffick@gmail.com>
+
+commit 90441b4dbe90ba0c38111ea89fa093a8c9627801 upstream.
+
+Fixing typo for MeshConnect IDs. The original PID (0x8875) is not in
+production and is not needed. Instead it has been changed to the
+official production PID (0x8857).
+
+Signed-off-by: Preston Fick <pffick@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -120,7 +120,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+- { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */
+ { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
--- /dev/null
+From ec512fb8e5611fed1df2895f90317ce6797d6b32 Mon Sep 17 00:00:00 2001
+From: Amit Virdi <amit.virdi@st.com>
+Date: Tue, 13 Jan 2015 14:27:20 +0530
+Subject: usb: dwc3: gadget: Fix TRB preparation during SG
+
+From: Amit Virdi <amit.virdi@st.com>
+
+commit ec512fb8e5611fed1df2895f90317ce6797d6b32 upstream.
+
+When scatter gather (SG) is used, multiple TRBs are prepared from one DWC3
+request (dwc3_request). So while preparing TRBs, the 'last' flag should be set
+only when it is the last TRB being prepared from the last dwc3_request entry.
+
+The current implementation uses list_is_last to check if the dwc3_request is the
+last entry from the request_list. However, list_is_last returns false for the
+last entry too. This is because, while preparing the first TRB from a request,
+the function dwc3_prepare_one_trb modifies the request's next and prev pointers
+while moving the URB to req_queued. Hence, list_is_last always returns false no
+matter what.
+
+The correct way is not to access the modified pointers of dwc3_request but to
+use list_empty macro instead.
+
+Fixes: e5ba5ec833aa (usb: dwc3: gadget: fix scatter gather implementation)
+Signed-off-by: Amit Virdi <amit.virdi@st.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -882,8 +882,7 @@ static void dwc3_prepare_trbs(struct dwc
+
+ if (i == (request->num_mapped_sgs - 1) ||
+ sg_is_last(s)) {
+- if (list_is_last(&req->list,
+- &dep->request_list))
++ if (list_empty(&dep->request_list))
+ last_one = true;
+ chain = false;
+ }
--- /dev/null
+From 39e60635a01520e8c8ed3946a28c2b98e6a46f79 Mon Sep 17 00:00:00 2001
+From: Amit Virdi <amit.virdi@st.com>
+Date: Tue, 13 Jan 2015 14:27:21 +0530
+Subject: usb: dwc3: gadget: Stop TRB preparation after limit is reached
+
+From: Amit Virdi <amit.virdi@st.com>
+
+commit 39e60635a01520e8c8ed3946a28c2b98e6a46f79 upstream.
+
+DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This
+means, the max TRBs that can be submitted for an EP is fixed to 32. Since the
+request queue for an EP is a linked list, any number of requests can be queued
+to it by the gadget layer. However, the dwc3 driver must not submit TRBs more
+than the pool it has created for. This limit wasn't respected when SG was used
+resulting in submitting more than the max TRBs, eventually leading to
+non-transfer of the TRBs submitted over the max limit.
+
+Root cause:
+When SG is used, there are two loops iterating to prepare TRBs:
+ - Outer loop over the request_list
+ - Inner loop over the SG list
+The code was missing break to get out of the outer loop.
+
+Fixes: eeb720fb21d6 (usb: dwc3: gadget: add support for SG lists)
+Signed-off-by: Amit Virdi <amit.virdi@st.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -900,6 +900,9 @@ static void dwc3_prepare_trbs(struct dwc
+ if (last_one)
+ break;
+ }
++
++ if (last_one)
++ break;
+ } else {
+ dma = req->request.dma;
+ length = req->request.length;
--- /dev/null
+From b44be2462dbe3e23f0aedff64de52a1e8e47a1cd Mon Sep 17 00:00:00 2001
+From: Mario Schuknecht <mario.schuknecht@dresearch-fe.de>
+Date: Tue, 16 Dec 2014 08:58:57 +0100
+Subject: usb: gadget: gadgetfs: Free memory allocated by memdup_user()
+
+From: Mario Schuknecht <mario.schuknecht@dresearch-fe.de>
+
+commit b44be2462dbe3e23f0aedff64de52a1e8e47a1cd upstream.
+
+Commit 3b74c73f8d6f053f422e85fce955b61fb181cfe7 switched over to memdup_user()
+in ep_write() function and removed kfree (kbuf).
+memdup_user() function allocates memory which is never freed.
+
+Fixes: 3b74c73 (usb: gadget: inode: switch over to memdup_user())
+Signed-off-by: Mario Schuknecht <mario.schuknecht@dresearch-fe.de>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/legacy/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -449,6 +449,7 @@ ep_write (struct file *fd, const char __
+ data->name, len, (int) value);
+ free1:
+ mutex_unlock(&data->lock);
++ kfree (kbuf);
+ return value;
+ }
+
--- /dev/null
+From f40afdddeb6c54ffd1e2920a5e93e363d6748db6 Mon Sep 17 00:00:00 2001
+From: Bo Shen <voice.shen@atmel.com>
+Date: Wed, 17 Dec 2014 17:18:48 +0800
+Subject: usb: gadget: udc: atmel: change setting for DMA
+
+From: Bo Shen <voice.shen@atmel.com>
+
+commit f40afdddeb6c54ffd1e2920a5e93e363d6748db6 upstream.
+
+According to the datasheet, when transfer using DMA, the control
+setting for IN packet only need END_BUF_EN, END_BUF_IE, CH_EN,
+while for OUT packet, need more two bits END_TR_EN and END_TR_IE
+to be configured.
+
+Fixes: 914a3f3b3754 (USB: add atmel_usba_udc driver)
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Bo Shen <voice.shen@atmel.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -716,10 +716,10 @@ static int queue_dma(struct usba_udc *ud
+ req->using_dma = 1;
+ req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
+ | USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
+- | USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
++ | USBA_DMA_END_BUF_EN;
+
+- if (ep->is_in)
+- req->ctrl |= USBA_DMA_END_BUF_EN;
++ if (!ep->is_in)
++ req->ctrl |= USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
+
+ /*
+ * Add this request to the queue and submit for DMA if
--- /dev/null
+From 6785a1034461c2d2c205215f63a50a740896e55b Mon Sep 17 00:00:00 2001
+From: Bo Shen <voice.shen@atmel.com>
+Date: Wed, 17 Dec 2014 17:18:49 +0800
+Subject: usb: gadget: udc: atmel: fix possible IN hang issue
+
+From: Bo Shen <voice.shen@atmel.com>
+
+commit 6785a1034461c2d2c205215f63a50a740896e55b upstream.
+
+When receive data, the RXRDY in status register set by hardware
+after a new packet has been stored in the endpoint FIFO. When it
+is copied from FIFO, this bit is cleared which make the FIFO can
+be accessed again.
+
+In the receive_data() function, this bit RXRDY has been cleared.
+So, after the receive_data() function return, this bit should
+not be cleared again, or else it may cause the accessing FIFO
+corrupt, which will make the data loss.
+
+Fixes: 914a3f3b3754 (USB: add atmel_usba_udc driver)
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Bo Shen <voice.shen@atmel.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -1572,7 +1572,6 @@ static void usba_ep_irq(struct usba_udc
+ if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
+ DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
+ receive_data(ep);
+- usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY);
+ }
+ }
+
--- /dev/null
+From 5fb694f96e7c19e66b1c55124b98812e32e3efa5 Mon Sep 17 00:00:00 2001
+From: Songjun Wu <songjun.wu@atmel.com>
+Date: Fri, 9 Jan 2015 17:11:24 +0100
+Subject: usb: gadget: udc: atmel: fix possible oops when unloading module
+
+From: Songjun Wu <songjun.wu@atmel.com>
+
+commit 5fb694f96e7c19e66b1c55124b98812e32e3efa5 upstream.
+
+When unloading the module 'g_hid.ko', the urb request will be dequeued and the
+completion routine will be excuted. If there is no urb packet, the urb request
+will not be added to the endpoint queue and the completion routine pointer in
+urb request is NULL.
+
+Accessing to this NULL function pointer will cause the Oops issue reported
+below.
+
+Add the code to check if the urb request is in the endpoint queue
+or not. If the urb request is not in the endpoint queue, a negative
+error code will be returned.
+
+Here is the Oops log:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000
+pgd = dedf0000
+[00000000] *pgd=3ede5831, *pte=00000000, *ppte=00000000
+Internal error: Oops: 80000007 [#1] ARM
+Modules linked in: g_hid(-) usb_f_hid libcomposite
+CPU: 0 PID: 923 Comm: rmmod Not tainted 3.18.0+ #2
+Hardware name: Atmel SAMA5 (Device Tree)
+task: df6b1100 ti: dedf6000 task.ti: dedf6000
+PC is at 0x0
+LR is at usb_gadget_giveback_request+0xc/0x10
+pc : [<00000000>] lr : [<c02ace88>] psr: 60000093
+sp : dedf7eb0 ip : df572634 fp : 00000000
+r10: 00000000 r9 : df52e210 r8 : 60000013
+r7 : df6a9858 r6 : df52e210 r5 : df6a9858 r4 : df572600
+r3 : 00000000 r2 : ffffff98 r1 : df572600 r0 : df6a9868
+Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
+Control: 10c53c7d Table: 3edf0059 DAC: 00000015
+Process rmmod (pid: 923, stack limit = 0xdedf6230)
+Stack: (0xdedf7eb0 to 0xdedf8000)
+7ea0: 00000000 c02adbbc df572580 deced608
+7ec0: df572600 df6a9868 df572634 c02aed3c df577c00 c01b8608 00000000 df6be27c
+7ee0: 00200200 00100100 bf0162f4 c000e544 dedf6000 00000000 00000000 bf010c00
+7f00: bf0162cc bf00159c 00000000 df572980 df52e218 00000001 df5729b8 bf0031d0
+[..]
+[<c02ace88>] (usb_gadget_giveback_request) from [<c02adbbc>] (request_complete+0x64/0x88)
+[<c02adbbc>] (request_complete) from [<c02aed3c>] (usba_ep_dequeue+0x70/0x128)
+[<c02aed3c>] (usba_ep_dequeue) from [<bf010c00>] (hidg_unbind+0x50/0x7c [usb_f_hid])
+[<bf010c00>] (hidg_unbind [usb_f_hid]) from [<bf00159c>] (remove_config.isra.6+0x98/0x9c [libcomposite])
+[<bf00159c>] (remove_config.isra.6 [libcomposite]) from [<bf0031d0>] (__composite_unbind+0x34/0x98 [libcomposite])
+[<bf0031d0>] (__composite_unbind [libcomposite]) from [<c02acee0>] (usb_gadget_remove_driver+0x50/0x78)
+[<c02acee0>] (usb_gadget_remove_driver) from [<c02ad570>] (usb_gadget_unregister_driver+0x64/0x94)
+[<c02ad570>] (usb_gadget_unregister_driver) from [<bf0160c0>] (hidg_cleanup+0x10/0x34 [g_hid])
+[<bf0160c0>] (hidg_cleanup [g_hid]) from [<c0056748>] (SyS_delete_module+0x118/0x19c)
+[<c0056748>] (SyS_delete_module) from [<c000e3c0>] (ret_fast_syscall+0x0/0x30)
+Code: bad PC value
+
+Signed-off-by: Songjun Wu <songjun.wu@atmel.com>
+[nicolas.ferre@atmel.com: reworked the commit message]
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Fixes: 914a3f3b3754 ("USB: add atmel_usba_udc driver")
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep
+ {
+ struct usba_ep *ep = to_usba_ep(_ep);
+ struct usba_udc *udc = ep->udc;
+- struct usba_request *req = to_usba_req(_req);
++ struct usba_request *req;
+ unsigned long flags;
+ u32 status;
+
+@@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep
+
+ spin_lock_irqsave(&udc->lock, flags);
+
++ list_for_each_entry(req, &ep->queue, queue) {
++ if (&req->req == _req)
++ break;
++ }
++
++ if (&req->req != _req) {
++ spin_unlock_irqrestore(&udc->lock, flags);
++ return -EINVAL;
++ }
++
+ if (req->using_dma) {
+ /*
+ * If this request is currently being transferred,
--- /dev/null
+From b5122236bba8d7ef62153da5b55cc65d0944c61e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 22 Dec 2014 18:39:39 +0100
+Subject: USB: keyspan: fix null-deref at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream.
+
+Fix null-pointer dereference during probe if the interface-status
+completion handler is called before the individual ports have been set
+up.
+
+Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and
+memory leaks")
+Reported-by: Richard <richjunk@pacbell.net>
+Tested-by: Richard <richjunk@pacbell.net>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/keyspan.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -410,6 +410,8 @@ static void usa26_instat_callback(struct
+ }
+ port = serial->port[msg->port];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -420,7 +422,7 @@ static void usa26_instat_callback(struct
+
+ if (old_dcd_state != p_priv->dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -527,6 +529,8 @@ static void usa28_instat_callback(struct
+ }
+ port = serial->port[msg->port];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -537,7 +541,7 @@ static void usa28_instat_callback(struct
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -607,6 +611,8 @@ static void usa49_instat_callback(struct
+ }
+ port = serial->port[msg->portNumber];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -617,7 +623,7 @@ static void usa49_instat_callback(struct
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -855,6 +861,8 @@ static void usa90_instat_callback(struct
+
+ port = serial->port[0];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -865,7 +873,7 @@ static void usa90_instat_callback(struct
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
+@@ -926,6 +934,8 @@ static void usa67_instat_callback(struct
+
+ port = serial->port[msg->port];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ goto resubmit;
+
+ /* Update handshaking pin state information */
+ old_dcd_state = p_priv->dcd_state;
+@@ -934,7 +944,7 @@ static void usa67_instat_callback(struct
+
+ if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
+ tty_port_tty_hangup(&port->port, true);
+-
++resubmit:
+ /* Resubmit urb so we continue receiving */
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err != 0)
--- /dev/null
+From d80c0d14183516f184a5ac88e11008ee4c7d2a2e Mon Sep 17 00:00:00 2001
+From: Reinhard Speyerer <rspmn@arcor.de>
+Date: Tue, 6 Jan 2015 22:06:38 +0100
+Subject: USB: qcserial/option: make AT URCs work for Sierra Wireless MC73xx
+
+From: Reinhard Speyerer <rspmn@arcor.de>
+
+commit d80c0d14183516f184a5ac88e11008ee4c7d2a2e upstream.
+
+As has been discussed in the thread starting with
+https://lkml.kernel.org/g/549748e9.d+SiJzqu50f1r4lSAL043YSc@arcor.de
+Sierra Wireless MC73xx devices with USB VID/PID 0x1199:0x68c0 require the
+option_send_setup() code to be used on the USB interface for the AT port
+to make unsolicited response codes work correctly. Move these devices from
+the qcserial driver where they have been added by commit
+70a3615fc07c2330ed7c1e922f3c44f4a67c0762 ("usb: qcserial: add Sierra Wireless
+MC73xx") to the option driver and add a MC73xx-specific blacklist
+to ensure that
+1. the sendsetup code is not used for the DIAG/DM and NMEA interfaces
+2. the option driver does not attach to the QMI/network interfaces
+
+Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 11 ++++++++++-
+ drivers/usb/serial/qcserial.c | 1 -
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -234,6 +234,8 @@ static void option_instat_callback(struc
+
+ #define QUALCOMM_VENDOR_ID 0x05C6
+
++#define SIERRA_VENDOR_ID 0x1199
++
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+ #define CMOTECH_PRODUCT_CMU_300 0x6002
+@@ -512,7 +514,7 @@ enum option_blacklist_reason {
+ OPTION_BLACKLIST_RESERVED_IF = 2
+ };
+
+-#define MAX_BL_NUM 8
++#define MAX_BL_NUM 11
+ struct option_blacklist_info {
+ /* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */
+ const unsigned long sendsetup;
+@@ -601,6 +603,11 @@ static const struct option_blacklist_inf
+ .reserved = BIT(1) | BIT(5),
+ };
+
++static const struct option_blacklist_info sierra_mc73xx_blacklist = {
++ .sendsetup = BIT(0) | BIT(2),
++ .reserved = BIT(8) | BIT(10) | BIT(11),
++};
++
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -1098,6 +1105,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
++ { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff),
++ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -142,7 +142,6 @@ static const struct usb_device_id id_tab
+ {DEVICE_SWI(0x0f3d, 0x68a2)}, /* Sierra Wireless MC7700 */
+ {DEVICE_SWI(0x114f, 0x68a2)}, /* Sierra Wireless MC7750 */
+ {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */
+- {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC73xx */
+ {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */
+ {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */
+ {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */
projects / thirdparty / kernel / stable-queue.git / commitdiff
