From: Greg Kroah-Hartman Date: Thu, 30 Jul 2015 01:49:53 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v4.1.4~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4bb2e924c5c3afee75a353da374204b6c1e58dcd;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: phy-berlin-usb-fix-divider-for-bg2cd.patch phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch usb-core-fix-usb-3.0-devices-lost-in-notattached-state-after-a-hub-port-reset.patch usb-core-lpm-set-lpm_capable-for-root-hub-device.patch usb-cp210x-add-id-for-aruba-networks-controllers.patch usb-devio-fix-a-condition-in-async_completed.patch usb-dwc3-gadget-don-t-clear-ep_busy-too-early.patch usb-dwc3-gadget-return-error-if-command-sent-to-depcmd-register-fails.patch usb-dwc3-gadget-return-error-if-command-sent-to-dgcmd-register-fails.patch usb-dwc3-reset-the-transfer-resource-index-on-set_interface.patch usb-f_mass_storage-limit-number-of-reported-luns.patch usb-gadget-composite-fix-null-pointer-dereference.patch usb-gadget-f_fs-do-not-set-cancel-function-on-synchronous-read-write.patch usb-gadget-mv_udc_core-fix-phy_regs-i-o-memory-leak.patch usb-musb-host-rely-on-port_mode-to-call-musb_start.patch usb-ohci-fix-race-between-ed-unlink-and-urb-submission.patch usb-option-add-2020-4000-id.patch usb-phy-mxs-suspend-to-ram-causes-null-pointer-dereference.patch usb-serial-destroy-serial_minors-idr-on-module-exit.patch usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch --- diff --git a/queue-4.1/phy-berlin-usb-fix-divider-for-bg2cd.patch b/queue-4.1/phy-berlin-usb-fix-divider-for-bg2cd.patch new file mode 100644 index 00000000000..d98ad86584c --- /dev/null +++ b/queue-4.1/phy-berlin-usb-fix-divider-for-bg2cd.patch @@ -0,0 +1,34 @@ +From 96696a9df935d15fd2e89603454c20a692ec232a Mon Sep 17 00:00:00 2001 +From: Thomas Hebb +Date: Thu, 2 Jul 2015 01:04:18 -0400 +Subject: phy: berlin-usb: fix divider for BG2CD + +From: Thomas Hebb + +commit 96696a9df935d15fd2e89603454c20a692ec232a upstream. + +The marvell,berlin2cd-usb-phy compatible incorrectly sets the PLL +divider to BG2's value instead of BG2CD/BG2Q's. Change it to the right +value. + +Signed-off-by: Thomas Hebb +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/phy-berlin-usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/phy/phy-berlin-usb.c ++++ b/drivers/phy/phy-berlin-usb.c +@@ -106,8 +106,8 @@ + static const u32 phy_berlin_pll_dividers[] = { + /* Berlin 2 */ + CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54), +- /* Berlin 2CD */ +- CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55), ++ /* Berlin 2CD/Q */ ++ CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54), + }; + + struct phy_berlin_usb_priv { diff --git a/queue-4.1/phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch b/queue-4.1/phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch new file mode 100644 index 00000000000..f30330ab85b --- /dev/null +++ b/queue-4.1/phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch @@ -0,0 +1,35 @@ +From 4724e27114c4a7eceeee07db227a17fcab6f165c Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 16 Apr 2015 18:03:04 +1000 +Subject: phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function. + +From: NeilBrown + +commit 4724e27114c4a7eceeee07db227a17fcab6f165c upstream. + +The USB phy should initialize with power-off, and will be powered on +by the USB system when a cable connection is detected. + +Having this pm_runtime_get_sync() during probe causes the phy to +*always* be powered on. +Removing it returns to sensible power management. + +Fixes: 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4 +Signed-off-by: NeilBrown +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/phy-twl4030-usb.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/phy/phy-twl4030-usb.c ++++ b/drivers/phy/phy-twl4030-usb.c +@@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct plat + pm_runtime_use_autosuspend(&pdev->dev); + pm_runtime_set_autosuspend_delay(&pdev->dev, 2000); + pm_runtime_enable(&pdev->dev); +- pm_runtime_get_sync(&pdev->dev); + + /* Our job is to use irqs and status from the power module + * to keep the transceiver disabled when nothing's connected. diff --git a/queue-4.1/series b/queue-4.1/series index 9e36a7c9306..9335bdf758a 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -90,3 +90,23 @@ libata-add-ata_horkage_notrim.patch libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch libata-do-not-blacklist-m510dc.patch libata-force-disable-trim-for-supersspeed-s238.patch +usb-dwc3-gadget-return-error-if-command-sent-to-dgcmd-register-fails.patch +usb-dwc3-gadget-return-error-if-command-sent-to-depcmd-register-fails.patch +usb-dwc3-gadget-don-t-clear-ep_busy-too-early.patch +usb-dwc3-reset-the-transfer-resource-index-on-set_interface.patch +usb-core-fix-usb-3.0-devices-lost-in-notattached-state-after-a-hub-port-reset.patch +usb-devio-fix-a-condition-in-async_completed.patch +phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch +usb-phy-mxs-suspend-to-ram-causes-null-pointer-dereference.patch +phy-berlin-usb-fix-divider-for-bg2cd.patch +usb-gadget-composite-fix-null-pointer-dereference.patch +usb-gadget-f_fs-do-not-set-cancel-function-on-synchronous-read-write.patch +usb-gadget-mv_udc_core-fix-phy_regs-i-o-memory-leak.patch +usb-f_mass_storage-limit-number-of-reported-luns.patch +usb-musb-host-rely-on-port_mode-to-call-musb_start.patch +usb-cp210x-add-id-for-aruba-networks-controllers.patch +usb-option-add-2020-4000-id.patch +usb-serial-destroy-serial_minors-idr-on-module-exit.patch +usb-ohci-fix-race-between-ed-unlink-and-urb-submission.patch +usb-core-lpm-set-lpm_capable-for-root-hub-device.patch +usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch diff --git a/queue-4.1/usb-core-fix-usb-3.0-devices-lost-in-notattached-state-after-a-hub-port-reset.patch b/queue-4.1/usb-core-fix-usb-3.0-devices-lost-in-notattached-state-after-a-hub-port-reset.patch new file mode 100644 index 00000000000..174cb58cd7f --- /dev/null +++ b/queue-4.1/usb-core-fix-usb-3.0-devices-lost-in-notattached-state-after-a-hub-port-reset.patch @@ -0,0 +1,173 @@ +From fb6d1f7df5d25299fd7b3e84b72b8851d3634764 Mon Sep 17 00:00:00 2001 +From: Robert Schlabbach +Date: Tue, 26 May 2015 00:27:30 +0200 +Subject: usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset + +From: Robert Schlabbach + +commit fb6d1f7df5d25299fd7b3e84b72b8851d3634764 upstream. + +Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset. + +Dissolve the function hub_port_finish_reset() completely and divide the +actions to be taken into those which need to be done after each reset +attempt and those which need to be done after the full procedure is +complete, and place them in the appropriate places in hub_port_reset(). +Also, remove an unneeded forward declaration of hub_port_reset(). + +Verbose Problem Description: + +USB 3.0 devices may be "lost for good" during a hub port reset. +This makes Linux unable to boot from USB 3.0 devices in certain +constellations of host controllers and devices, because the USB device is +lost during initialization, preventing the rootfs from being mounted. + +The underlying problem is that in the affected constellations, during the +processing inside hub_port_reset(), the hub link state goes from 0 to +SS.inactive after the initial reset, and back to 0 again only after the +following "warm" reset. + +However, hub_port_finish_reset() is called after each reset attempt and +sets the state the connected USB device based on the "preliminary" status +of the hot reset to USB_STATE_NOTATTACHED due to SS.inactive, yet when +the following warm reset is complete and hub_port_finish_reset() is +called again, its call to set the device to USB_STATE_DEFAULT is blocked +by usb_set_device_state() which does not allow taking USB devices out of +USB_STATE_NOTATTACHED state. + +Thanks to Alan Stern for guiding me to the proper solution and how to +submit it. + +Link: http://lkml.kernel.org/r/trinity-25981484-72a9-4d46-bf17-9c1cf9301a31-1432073240136%20()%203capp-gmx-bs27 +Signed-off-by: Robert Schlabbach +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 82 +++++++++++++++++++------------------------------ + 1 file changed, 33 insertions(+), 49 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2616,9 +2616,6 @@ static bool use_new_scheme(struct usb_de + return USE_NEW_SCHEME(retry); + } + +-static int hub_port_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, unsigned int delay, bool warm); +- + /* Is a USB 3.0 port in the Inactive or Compliance Mode state? + * Port worm reset is required to recover + */ +@@ -2706,44 +2703,6 @@ static int hub_port_wait_reset(struct us + return 0; + } + +-static void hub_port_finish_reset(struct usb_hub *hub, int port1, +- struct usb_device *udev, int *status) +-{ +- switch (*status) { +- case 0: +- /* TRSTRCY = 10 ms; plus some extra */ +- msleep(10 + 40); +- if (udev) { +- struct usb_hcd *hcd = bus_to_hcd(udev->bus); +- +- update_devnum(udev, 0); +- /* The xHC may think the device is already reset, +- * so ignore the status. +- */ +- if (hcd->driver->reset_device) +- hcd->driver->reset_device(hcd, udev); +- } +- /* FALL THROUGH */ +- case -ENOTCONN: +- case -ENODEV: +- usb_clear_port_feature(hub->hdev, +- port1, USB_PORT_FEAT_C_RESET); +- if (hub_is_superspeed(hub->hdev)) { +- usb_clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_BH_PORT_RESET); +- usb_clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_PORT_LINK_STATE); +- usb_clear_port_feature(hub->hdev, port1, +- USB_PORT_FEAT_C_CONNECTION); +- } +- if (udev) +- usb_set_device_state(udev, *status +- ? USB_STATE_NOTATTACHED +- : USB_STATE_DEFAULT); +- break; +- } +-} +- + /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */ + static int hub_port_reset(struct usb_hub *hub, int port1, + struct usb_device *udev, unsigned int delay, bool warm) +@@ -2767,13 +2726,10 @@ static int hub_port_reset(struct usb_hub + * If the caller hasn't explicitly requested a warm reset, + * double check and see if one is needed. + */ +- status = hub_port_status(hub, port1, +- &portstatus, &portchange); +- if (status < 0) +- goto done; +- +- if (hub_port_warm_reset_required(hub, port1, portstatus)) +- warm = true; ++ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0) ++ if (hub_port_warm_reset_required(hub, port1, ++ portstatus)) ++ warm = true; + } + clear_bit(port1, hub->warm_reset_bits); + +@@ -2799,11 +2755,19 @@ static int hub_port_reset(struct usb_hub + + /* Check for disconnect or reset */ + if (status == 0 || status == -ENOTCONN || status == -ENODEV) { +- hub_port_finish_reset(hub, port1, udev, &status); ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_RESET); + + if (!hub_is_superspeed(hub->hdev)) + goto done; + ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_BH_PORT_RESET); ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_PORT_LINK_STATE); ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_CONNECTION); ++ + /* + * If a USB 3.0 device migrates from reset to an error + * state, re-issue the warm reset. +@@ -2836,6 +2800,26 @@ static int hub_port_reset(struct usb_hub + dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n"); + + done: ++ if (status == 0) { ++ /* TRSTRCY = 10 ms; plus some extra */ ++ msleep(10 + 40); ++ if (udev) { ++ struct usb_hcd *hcd = bus_to_hcd(udev->bus); ++ ++ update_devnum(udev, 0); ++ /* The xHC may think the device is already reset, ++ * so ignore the status. ++ */ ++ if (hcd->driver->reset_device) ++ hcd->driver->reset_device(hcd, udev); ++ ++ usb_set_device_state(udev, USB_STATE_DEFAULT); ++ } ++ } else { ++ if (udev) ++ usb_set_device_state(udev, USB_STATE_NOTATTACHED); ++ } ++ + if (!hub_is_superspeed(hub->hdev)) + up_read(&ehci_cf_port_reset_rwsem); + diff --git a/queue-4.1/usb-core-lpm-set-lpm_capable-for-root-hub-device.patch b/queue-4.1/usb-core-lpm-set-lpm_capable-for-root-hub-device.patch new file mode 100644 index 00000000000..d866bd6eed6 --- /dev/null +++ b/queue-4.1/usb-core-lpm-set-lpm_capable-for-root-hub-device.patch @@ -0,0 +1,75 @@ +From 2d2a316765d956bc5cb6bb367b2ec52ca59ab8e9 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Tue, 16 Jun 2015 09:08:26 +0800 +Subject: usb: core: lpm: set lpm_capable for root hub device + +From: Lu Baolu + +commit 2d2a316765d956bc5cb6bb367b2ec52ca59ab8e9 upstream. + +Commit 25cd2882e2fc ("usb/xhci: Change how we indicate a host supports +Link PM.") removed the code to set lpm_capable for USB 3.0 super-speed +root hub. The intention of that change was to avoid touching usb core +internal field, a.k.a. lpm_capable, and let usb core to set it by +checking U1 and U2 exit latency values in the descriptor. + +Usb core checks and sets lpm_capable in hub_port_init(). Unfortunately, +root hub is a special usb device as it has no parent. Hub_port_init() +will never be called for a root hub device. That means lpm_capable will +by no means be set for the root hub. As the result, lpm isn't functional +at all in Linux kernel. + +This patch add the code to check and set lpm_capable when registering a +root hub device. It could be back-ported to kernels as old as v3.15, +that contains the Commit 25cd2882e2fc ("usb/xhci: Change how we indicate +a host supports Link PM."). + +Reported-by: Kevin Strasser +Signed-off-by: Lu Baolu +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 7 +++++-- + drivers/usb/core/hub.c | 2 +- + drivers/usb/core/usb.h | 1 + + 3 files changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_ + dev_name(&usb_dev->dev), retval); + return (retval < 0) ? retval : -EMSGSIZE; + } +- if (usb_dev->speed == USB_SPEED_SUPER) { ++ ++ if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) { + retval = usb_get_bos_descriptor(usb_dev); +- if (retval < 0) { ++ if (!retval) { ++ usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev); ++ } else if (usb_dev->speed == USB_SPEED_SUPER) { + mutex_unlock(&usb_bus_list_lock); + dev_dbg(parent_dev, "can't read %s bos descriptor %d\n", + dev_name(&usb_dev->dev), retval); +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(st + return usb_get_intfdata(hdev->actconfig->interface[0]); + } + +-static int usb_device_supports_lpm(struct usb_device *udev) ++int usb_device_supports_lpm(struct usb_device *udev) + { + /* USB 2.1 (and greater) devices indicate LPM support through + * their USB 2.0 Extended Capabilities BOS descriptor. +--- a/drivers/usb/core/usb.h ++++ b/drivers/usb/core/usb.h +@@ -65,6 +65,7 @@ extern int usb_hub_init(void); + extern void usb_hub_cleanup(void); + extern int usb_major_init(void); + extern void usb_major_cleanup(void); ++extern int usb_device_supports_lpm(struct usb_device *udev); + + #ifdef CONFIG_PM + diff --git a/queue-4.1/usb-cp210x-add-id-for-aruba-networks-controllers.patch b/queue-4.1/usb-cp210x-add-id-for-aruba-networks-controllers.patch new file mode 100644 index 00000000000..9de14ee6cfb --- /dev/null +++ b/queue-4.1/usb-cp210x-add-id-for-aruba-networks-controllers.patch @@ -0,0 +1,30 @@ +From f98a7aa81eeeadcad25665c3501c236d531d4382 Mon Sep 17 00:00:00 2001 +From: Peter Sanford +Date: Thu, 25 Jun 2015 17:40:05 -0700 +Subject: USB: cp210x: add ID for Aruba Networks controllers + +From: Peter Sanford + +commit f98a7aa81eeeadcad25665c3501c236d531d4382 upstream. + +Add the USB serial console device ID for Aruba Networks 7xxx series +controllers which have a USB port for their serial console. + +Signed-off-by: Peter Sanford +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -187,6 +187,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ ++ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ diff --git a/queue-4.1/usb-devio-fix-a-condition-in-async_completed.patch b/queue-4.1/usb-devio-fix-a-condition-in-async_completed.patch new file mode 100644 index 00000000000..94dcca7b464 --- /dev/null +++ b/queue-4.1/usb-devio-fix-a-condition-in-async_completed.patch @@ -0,0 +1,33 @@ +From 83ed07c5db71bc02bd646d6eb60b48908235cdf9 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 18 May 2015 15:29:51 +0300 +Subject: USB: devio: fix a condition in async_completed() + +From: Dan Carpenter + +commit 83ed07c5db71bc02bd646d6eb60b48908235cdf9 upstream. + +Static checkers complain that the current condition is never true. It +seems pretty likely that it's a typo and "URB" was intended instead of +"USB". + +Fixes: 3d97ff63f899 ('usbdevfs: Use scatter-gather lists for large bulk transfers') +Signed-off-by: Dan Carpenter +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -513,7 +513,7 @@ static void async_completed(struct urb * + snoop(&urb->dev->dev, "urb complete\n"); + snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length, + as->status, COMPLETE, NULL, 0); +- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN) ++ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN) + snoop_urb_data(urb, urb->actual_length); + + if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET && diff --git a/queue-4.1/usb-dwc3-gadget-don-t-clear-ep_busy-too-early.patch b/queue-4.1/usb-dwc3-gadget-don-t-clear-ep_busy-too-early.patch new file mode 100644 index 00000000000..c6e8df863de --- /dev/null +++ b/queue-4.1/usb-dwc3-gadget-don-t-clear-ep_busy-too-early.patch @@ -0,0 +1,51 @@ +From e18b7975c885bc3a938b9a76daf32957ea0235fa Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Fri, 29 May 2015 10:06:38 -0500 +Subject: usb: dwc3: gadget: don't clear EP_BUSY too early + +From: Felipe Balbi + +commit e18b7975c885bc3a938b9a76daf32957ea0235fa upstream. + +In case of non-Isochronous transfers, we don't +want to clear DWC3_EP_BUSY flag until XferComplete +event. That's because XferInProgress was only enabled +so we can recycle TRBs and usb_requests quicker, but +there are still other pending requests being transferred. + +In order to make sure we don't allow for another StartTransfer +command while the HW is still processing other transfers, +we must keep DWC3_EP_BUSY flag set and this what this patch +does. + +Fixes: f3af36511e60 (usb: dwc3: gadget: always enable IOC on + bulk/interrupt transfers) +Reported-by: sundeep subbaraya +Tested-by: sundeep subbaraya +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1906,12 +1906,16 @@ static void dwc3_endpoint_transfer_compl + { + unsigned status = 0; + int clean_busy; ++ u32 is_xfer_complete; ++ ++ is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE); + + if (event->status & DEPEVT_STATUS_BUSERR) + status = -ECONNRESET; + + clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status); +- if (clean_busy) ++ if (clean_busy && (is_xfer_complete || ++ usb_endpoint_xfer_isoc(dep->endpoint.desc))) + dep->flags &= ~DWC3_EP_BUSY; + + /* diff --git a/queue-4.1/usb-dwc3-gadget-return-error-if-command-sent-to-depcmd-register-fails.patch b/queue-4.1/usb-dwc3-gadget-return-error-if-command-sent-to-depcmd-register-fails.patch new file mode 100644 index 00000000000..a8e0b509a53 --- /dev/null +++ b/queue-4.1/usb-dwc3-gadget-return-error-if-command-sent-to-depcmd-register-fails.patch @@ -0,0 +1,32 @@ +From 76e838c9f7765f9a6205b4d558d75a66104bc60d Mon Sep 17 00:00:00 2001 +From: Subbaraya Sundeep Bhatta +Date: Thu, 21 May 2015 15:46:48 +0530 +Subject: usb: dwc3: gadget: return error if command sent to DEPCMD register fails + +From: Subbaraya Sundeep Bhatta + +commit 76e838c9f7765f9a6205b4d558d75a66104bc60d upstream. + +We need to return error to caller if command is not sent to +controller succesfully. + +Signed-off-by: Subbaraya Sundeep Bhatta +Fixes: 72246da40f37 (usb: Introduce DesignWare USB3 DRD Driver) +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -330,6 +330,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 + dwc3_trace(trace_dwc3_gadget, + "Command Complete --> %d", + DWC3_DEPCMD_STATUS(reg)); ++ if (DWC3_DEPCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + diff --git a/queue-4.1/usb-dwc3-gadget-return-error-if-command-sent-to-dgcmd-register-fails.patch b/queue-4.1/usb-dwc3-gadget-return-error-if-command-sent-to-dgcmd-register-fails.patch new file mode 100644 index 00000000000..0b97edab002 --- /dev/null +++ b/queue-4.1/usb-dwc3-gadget-return-error-if-command-sent-to-dgcmd-register-fails.patch @@ -0,0 +1,32 @@ +From 891b1dc022955d36cf4c0f42d383226a930db7ed Mon Sep 17 00:00:00 2001 +From: Subbaraya Sundeep Bhatta +Date: Thu, 21 May 2015 15:46:47 +0530 +Subject: usb: dwc3: gadget: return error if command sent to DGCMD register fails + +From: Subbaraya Sundeep Bhatta + +commit 891b1dc022955d36cf4c0f42d383226a930db7ed upstream. + +We need to return error to caller if command is not sent to +controller succesfully. + +Signed-off-by: Subbaraya Sundeep Bhatta +Fixes: b09bb64239c8 (usb: dwc3: gadget: implement Global Command support) +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -291,6 +291,8 @@ int dwc3_send_gadget_generic_command(str + dwc3_trace(trace_dwc3_gadget, + "Command Complete --> %d", + DWC3_DGCMD_STATUS(reg)); ++ if (DWC3_DGCMD_STATUS(reg)) ++ return -EINVAL; + return 0; + } + diff --git a/queue-4.1/usb-dwc3-reset-the-transfer-resource-index-on-set_interface.patch b/queue-4.1/usb-dwc3-reset-the-transfer-resource-index-on-set_interface.patch new file mode 100644 index 00000000000..c4e625a3af7 --- /dev/null +++ b/queue-4.1/usb-dwc3-reset-the-transfer-resource-index-on-set_interface.patch @@ -0,0 +1,56 @@ +From aebda618718157a69c0dc0adb978d69bc2b8723c Mon Sep 17 00:00:00 2001 +From: John Youn +Date: Mon, 17 Sep 2001 00:00:00 -0700 +Subject: usb: dwc3: Reset the transfer resource index on SET_INTERFACE + +From: John Youn + +commit aebda618718157a69c0dc0adb978d69bc2b8723c upstream. + +This fixes an issue introduced in commit b23c843992b6 (usb: dwc3: +gadget: fix DEPSTARTCFG for non-EP0 EPs) that made sure we would +only use DEPSTARTCFG once per SetConfig. + +The trick is that we should use one DEPSTARTCFG per SetConfig *OR* +SetInterface. SetInterface was completely missed from the original +patch. + +This problem became aparent after commit 76e838c9f776 (usb: dwc3: +gadget: return error if command sent to DEPCMD register fails) +added checking of the return status of device endpoint commands. + +'Set Endpoint Transfer Resource' command was caught failing +occasionally. This is because the Transfer Resource +Index was not getting reset during a SET_INTERFACE request. + +Finally, to fix the issue, was we have to do is make sure that +our start_config_issued flag gets reset whenever we receive a +SetInterface request. + +To verify the problem (and its fix), all we have to do is run +test 9 from testusb with 'testusb -t 9 -s 2048 -a -c 5000'. + +Tested-by: Huang Rui +Tested-by: Subbaraya Sundeep Bhatta +Fixes: b23c843992b6 (usb: dwc3: gadget: fix DEPSTARTCFG for non-EP0 EPs) +Signed-off-by: John Youn +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/ep0.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct d + dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY"); + ret = dwc3_ep0_set_isoch_delay(dwc, ctrl); + break; ++ case USB_REQ_SET_INTERFACE: ++ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE"); ++ dwc->start_config_issued = false; ++ /* Fall through */ + default: + dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver"); + ret = dwc3_ep0_delegate_req(dwc, ctrl); diff --git a/queue-4.1/usb-f_mass_storage-limit-number-of-reported-luns.patch b/queue-4.1/usb-f_mass_storage-limit-number-of-reported-luns.patch new file mode 100644 index 00000000000..b007ed9bd21 --- /dev/null +++ b/queue-4.1/usb-f_mass_storage-limit-number-of-reported-luns.patch @@ -0,0 +1,70 @@ +From 8515bac01a983d277148e4fcc5f235bf603de577 Mon Sep 17 00:00:00 2001 +From: Michal Nazarewicz +Date: Fri, 19 Jun 2015 23:56:34 +0200 +Subject: usb: f_mass_storage: limit number of reported LUNs + +From: Michal Nazarewicz + +commit 8515bac01a983d277148e4fcc5f235bf603de577 upstream. + +Mass storage function created via configfs always reports eight LUNs +to the hosts even if only one LUN has been configured. Adjust the +number when the USB function is allocated based on LUNs that user +has created. + +Tested-by: Gregory CLEMENT +Signed-off-by: Michal Nazarewicz +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_mass_storage.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_comm + return -EINVAL; + } + +- curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL); ++ curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL); + if (unlikely(!curlun)) + return -ENOMEM; + +@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_comm + common->luns = curlun; + common->nluns = nluns; + +- pr_info("Number of LUNs=%d\n", common->nluns); +- + return 0; + } + EXPORT_SYMBOL_GPL(fsg_common_set_nluns); +@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(st + struct fsg_opts *opts = fsg_opts_from_func_inst(fi); + struct fsg_common *common = opts->common; + struct fsg_dev *fsg; ++ unsigned nluns, i; + + fsg = kzalloc(sizeof(*fsg), GFP_KERNEL); + if (unlikely(!fsg)) + return ERR_PTR(-ENOMEM); + + mutex_lock(&opts->lock); ++ if (!opts->refcnt) { ++ for (nluns = i = 0; i < FSG_MAX_LUNS; ++i) ++ if (common->luns[i]) ++ nluns = i + 1; ++ if (!nluns) ++ pr_warn("No LUNS defined, continuing anyway\n"); ++ else ++ common->nluns = nluns; ++ pr_info("Number of LUNs=%u\n", common->nluns); ++ } + opts->refcnt++; + mutex_unlock(&opts->lock); ++ + fsg->function.name = FSG_DRIVER_DESC; + fsg->function.bind = fsg_bind; + fsg->function.unbind = fsg_unbind; diff --git a/queue-4.1/usb-gadget-composite-fix-null-pointer-dereference.patch b/queue-4.1/usb-gadget-composite-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..d529bfd19fe --- /dev/null +++ b/queue-4.1/usb-gadget-composite-fix-null-pointer-dereference.patch @@ -0,0 +1,47 @@ +From b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Thu, 11 Jun 2015 22:12:11 +0530 +Subject: usb: gadget: composite: Fix NULL pointer dereference + +From: Kishon Vijay Abraham I + +commit b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed upstream. + +commit f563d230903210acc ("usb: gadget: composite: add req_match method +to usb_function") accesses cdev->config even before set config +is invoked causing a NULL pointer dereferencing error while running +Lecroy Mass Storage Compliance test. + +Fix it here by accessing cdev->config only if it is non NULL. + +Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match +method to usb_function"). + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/composite.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1758,10 +1758,13 @@ unknown: + * take such requests too, if that's ever needed: to work + * in config 0, etc. + */ +- list_for_each_entry(f, &cdev->config->functions, list) +- if (f->req_match && f->req_match(f, ctrl)) +- goto try_fun_setup; +- f = NULL; ++ if (cdev->config) { ++ list_for_each_entry(f, &cdev->config->functions, list) ++ if (f->req_match && f->req_match(f, ctrl)) ++ goto try_fun_setup; ++ f = NULL; ++ } ++ + switch (ctrl->bRequestType & USB_RECIP_MASK) { + case USB_RECIP_INTERFACE: + if (!cdev->config || intf >= MAX_CONFIG_INTERFACES) diff --git a/queue-4.1/usb-gadget-f_fs-do-not-set-cancel-function-on-synchronous-read-write.patch b/queue-4.1/usb-gadget-f_fs-do-not-set-cancel-function-on-synchronous-read-write.patch new file mode 100644 index 00000000000..60ab5a07130 --- /dev/null +++ b/queue-4.1/usb-gadget-f_fs-do-not-set-cancel-function-on-synchronous-read-write.patch @@ -0,0 +1,43 @@ +From 4088acf1e845aba35f30fb91dee10649edbd0e84 Mon Sep 17 00:00:00 2001 +From: Rui Miguel Silva +Date: Mon, 18 May 2015 16:02:07 +0100 +Subject: usb: gadget: f_fs: do not set cancel function on synchronous {read,write} + +From: Rui Miguel Silva + +commit 4088acf1e845aba35f30fb91dee10649edbd0e84 upstream. + +do not try to set cancel function in synchronous operations in +ffs_epfile_{read,write}_iter. + +Acked-by: Al Viro +Signed-off-by: Rui Miguel Silva +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(str + + kiocb->private = p; + +- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); ++ if (p->aio) ++ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); + + res = ffs_epfile_io(kiocb->ki_filp, p); + if (res == -EIOCBQUEUED) +@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(stru + + kiocb->private = p; + +- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); ++ if (p->aio) ++ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); + + res = ffs_epfile_io(kiocb->ki_filp, p); + if (res == -EIOCBQUEUED) diff --git a/queue-4.1/usb-gadget-mv_udc_core-fix-phy_regs-i-o-memory-leak.patch b/queue-4.1/usb-gadget-mv_udc_core-fix-phy_regs-i-o-memory-leak.patch new file mode 100644 index 00000000000..5a2d8b56fd8 --- /dev/null +++ b/queue-4.1/usb-gadget-mv_udc_core-fix-phy_regs-i-o-memory-leak.patch @@ -0,0 +1,35 @@ +From 53e20f2eb161fbe9eea28b54dccc870cec94eca2 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Sun, 19 Jul 2015 23:13:28 +0700 +Subject: usb: gadget: mv_udc_core: fix phy_regs I/O memory leak + +From: Alexey Khoroshilov + +commit 53e20f2eb161fbe9eea28b54dccc870cec94eca2 upstream. + +There was an omission in transition to devm_xxx resource handling. +iounmap(udc->phy_regs) were removed, but ioremap() was left +without devm_. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Fixes: 3517c31a8ece6 ("usb: gadget: mv_udc: use devm_xxx for probe") +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/mv_udc_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/mv_udc_core.c ++++ b/drivers/usb/gadget/udc/mv_udc_core.c +@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_ + return -ENODEV; + } + +- udc->phy_regs = ioremap(r->start, resource_size(r)); ++ udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r)); + if (udc->phy_regs == NULL) { + dev_err(&pdev->dev, "failed to map phy I/O memory\n"); + return -EBUSY; diff --git a/queue-4.1/usb-musb-host-rely-on-port_mode-to-call-musb_start.patch b/queue-4.1/usb-musb-host-rely-on-port_mode-to-call-musb_start.patch new file mode 100644 index 00000000000..3d487cbd01c --- /dev/null +++ b/queue-4.1/usb-musb-host-rely-on-port_mode-to-call-musb_start.patch @@ -0,0 +1,41 @@ +From be9d39881fc4fa39a64b6eed6bab5d9ee5125344 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Tue, 2 Jun 2015 13:03:36 -0500 +Subject: usb: musb: host: rely on port_mode to call musb_start() + +From: Felipe Balbi + +commit be9d39881fc4fa39a64b6eed6bab5d9ee5125344 upstream. + +Currently, we're calling musb_start() twice for DRD ports +in some situations. This has been observed to cause enumeration +issues after suspend/resume cycles with AM335x. + +In order to fix the problem, we just have to fix the check +on musb_has_gadget() so that it only returns true if +current mode is Host and ignore the fact that we have or +not a gadget driver loaded. + +Fixes: ae44df2e21b5 (usb: musb: call musb_start() only once in OTG mode) +Cc: Sebastian Andrzej Siewior +Tested-by: Sekhar Nori +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_virthub.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/usb/musb/musb_virthub.c ++++ b/drivers/usb/musb/musb_virthub.c +@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb * + #ifdef CONFIG_USB_MUSB_HOST + return 1; + #else +- if (musb->port_mode == MUSB_PORT_MODE_HOST) +- return 1; +- return musb->g.dev.driver != NULL; ++ return musb->port_mode == MUSB_PORT_MODE_HOST; + #endif + } + diff --git a/queue-4.1/usb-ohci-fix-race-between-ed-unlink-and-urb-submission.patch b/queue-4.1/usb-ohci-fix-race-between-ed-unlink-and-urb-submission.patch new file mode 100644 index 00000000000..85da8303282 --- /dev/null +++ b/queue-4.1/usb-ohci-fix-race-between-ed-unlink-and-urb-submission.patch @@ -0,0 +1,65 @@ +From 7d8021c967648accd1b78e5e1ddaad655cd2c61f Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 30 Jun 2015 11:25:54 -0400 +Subject: USB: OHCI: Fix race between ED unlink and URB submission + +From: Alan Stern + +commit 7d8021c967648accd1b78e5e1ddaad655cd2c61f upstream. + +This patch fixes a bug introduced by commit 977dcfdc6031 ("USB: OHCI: +don't lose track of EDs when a controller dies"). The commit changed +ed_state from ED_UNLINK to ED_IDLE too early, before finish_urb() had +been called. The user-visible consequence is that the driver +occasionally crashes or locks up when an URB is submitted while +another URB for the same endpoint is being unlinked. + +This patch moves the ED state change later, to the right place. The +drawback is that now we may unnecessarily execute some instructions +multiple times when a controller dies. Since controllers dying is an +exceptional occurrence, a little wasted time won't matter. + +Signed-off-by: Alan Stern +Reported-by: Heiko Przybyl +Tested-by: Heiko Przybyl +Fixes: 977dcfdc60311e7aa571cabf6f39c36dde13339e +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ohci-q.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/usb/host/ohci-q.c ++++ b/drivers/usb/host/ohci-q.c +@@ -980,10 +980,6 @@ rescan_all: + int completed, modified; + __hc32 *prev; + +- /* Is this ED already invisible to the hardware? */ +- if (ed->state == ED_IDLE) +- goto ed_idle; +- + /* only take off EDs that the HC isn't using, accounting for + * frame counter wraps and EDs with partially retired TDs + */ +@@ -1011,12 +1007,10 @@ skip_ed: + } + + /* ED's now officially unlinked, hc doesn't see */ +- ed->state = ED_IDLE; + ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H); + ed->hwNextED = 0; + wmb(); + ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE); +-ed_idle: + + /* reentrancy: if we drop the schedule lock, someone might + * have modified this list. normally it's just prepending +@@ -1087,6 +1081,7 @@ rescan_this: + if (list_empty(&ed->td_list)) { + *last = ed->ed_next; + ed->ed_next = NULL; ++ ed->state = ED_IDLE; + list_del(&ed->in_use_list); + } else if (ohci->rh_state == OHCI_RH_RUNNING) { + *last = ed->ed_next; diff --git a/queue-4.1/usb-option-add-2020-4000-id.patch b/queue-4.1/usb-option-add-2020-4000-id.patch new file mode 100644 index 00000000000..0c9fbdec029 --- /dev/null +++ b/queue-4.1/usb-option-add-2020-4000-id.patch @@ -0,0 +1,45 @@ +From f6d7fb37f92622479ef6da604f27561f5045ba1e Mon Sep 17 00:00:00 2001 +From: Claudio Cappelli +Date: Wed, 10 Jun 2015 20:38:30 +0200 +Subject: USB: option: add 2020:4000 ID + +From: Claudio Cappelli + +commit f6d7fb37f92622479ef6da604f27561f5045ba1e upstream. + +Add device Olivetti Olicard 300 (Network Connect: MT6225) - IDs 2020:4000. + +T: Bus=01 Lev=02 Prnt=04 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2020 ProdID=4000 Rev=03.00 +S: Manufacturer=Network Connect +S: Product=MT6225 +C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage + +Signed-off-by: Claudio Cappelli +Suggested-by: Lars Melin +[johan: amend commit message with devices info ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1765,6 +1765,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { } /* Terminating entry */ diff --git a/queue-4.1/usb-phy-mxs-suspend-to-ram-causes-null-pointer-dereference.patch b/queue-4.1/usb-phy-mxs-suspend-to-ram-causes-null-pointer-dereference.patch new file mode 100644 index 00000000000..df0c57c3d08 --- /dev/null +++ b/queue-4.1/usb-phy-mxs-suspend-to-ram-causes-null-pointer-dereference.patch @@ -0,0 +1,35 @@ +From 543aa4867d4a2dff5fc11e1b688197ee3bad7f89 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Mon, 15 Jun 2015 04:37:00 +0000 +Subject: usb: phy: mxs: suspend to RAM causes NULL pointer dereference + +From: Stefan Wahren + +commit 543aa4867d4a2dff5fc11e1b688197ee3bad7f89 upstream. + +Triggering suspend to RAM via sysfs on a i.MX28 causes a NULL pointer +dereference. This patch avoids the oops in mxs_phy_get_vbus_status() +by aborting since there is no syscon available. + +Signed-off-by: Stefan Wahren +Fixes: efdbd3a5d6e ("usb: phy: mxs: do not set PWD.RXPWD1PT1 for low speed connection") +Acked-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/phy/phy-mxs-usb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/phy/phy-mxs-usb.c ++++ b/drivers/usb/phy/phy-mxs-usb.c +@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(stru + { + unsigned int vbus_value; + ++ if (!mxs_phy->regmap_anatop) ++ return false; ++ + if (mxs_phy->port_id == 0) + regmap_read(mxs_phy->regmap_anatop, + ANADIG_USB1_VBUS_DET_STAT, diff --git a/queue-4.1/usb-serial-destroy-serial_minors-idr-on-module-exit.patch b/queue-4.1/usb-serial-destroy-serial_minors-idr-on-module-exit.patch new file mode 100644 index 00000000000..283a14001e3 --- /dev/null +++ b/queue-4.1/usb-serial-destroy-serial_minors-idr-on-module-exit.patch @@ -0,0 +1,75 @@ +From d23f47d4927fd2f61b3a754d83c7bcec215b5cfe Mon Sep 17 00:00:00 2001 +From: Johannes Thumshirn +Date: Wed, 8 Jul 2015 17:26:37 +0200 +Subject: USB: serial: Destroy serial_minors IDR on module exit + +From: Johannes Thumshirn + +commit d23f47d4927fd2f61b3a754d83c7bcec215b5cfe upstream. + +Destroy serial_minors IDR on module exit, reclaiming the allocated memory. + +This was detected by the following semantic patch (written by Luis +Rodriguez ) + + +@ defines_module_init @ +declarer name module_init, module_exit; +declarer name DEFINE_IDR; +identifier init; +@@ + +module_init(init); + +@ defines_module_exit @ +identifier exit; +@@ + +module_exit(exit); + +@ declares_idr depends on defines_module_init && defines_module_exit @ +identifier idr; +@@ + +DEFINE_IDR(idr); + +@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @ +identifier declares_idr.idr, defines_module_exit.exit; +@@ + +exit(void) +{ + ... + idr_destroy(&idr); + ... +} + +@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @ +identifier declares_idr.idr, defines_module_exit.exit; +@@ + +exit(void) +{ + ... + +idr_destroy(&idr); +} + + +Signed-off-by: Johannes Thumshirn +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void) + tty_unregister_driver(usb_serial_tty_driver); + put_tty_driver(usb_serial_tty_driver); + bus_unregister(&usb_serial_bus_type); ++ idr_destroy(&serial_minors); + } + + diff --git a/queue-4.1/usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch b/queue-4.1/usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch new file mode 100644 index 00000000000..ef6bfc096b4 --- /dev/null +++ b/queue-4.1/usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch @@ -0,0 +1,57 @@ +From 3496810663922617d4b706ef2780c279252ddd6a Mon Sep 17 00:00:00 2001 +From: AMAN DEEP +Date: Tue, 21 Jul 2015 17:20:27 +0300 +Subject: usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function + +From: AMAN DEEP + +commit 3496810663922617d4b706ef2780c279252ddd6a upstream. + +virt_dev->num_cached_rings counts on freed ring and is not updated +correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring +is added into cache and then num_rings_cache is incremented as below: + virt_dev->ring_cache[rings_cached] = + virt_dev->eps[ep_index].ring; + virt_dev->num_rings_cached++; +here, free ring pointer is added to a current index and then +index is incremented. +So current index always points to empty location in the ring cache. +For getting available free ring, current index should be decremented +first and then corresponding ring buffer value should be taken from ring +cache. + +But In function xhci_endpoint_init(), the num_rings_cached index is +accessed before decrement. + virt_dev->eps[ep_index].new_ring = + virt_dev->ring_cache[virt_dev->num_rings_cached]; + virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; + virt_dev->num_rings_cached--; +This is bug in manipulating the index of ring cache. +And it should be as below: + virt_dev->num_rings_cached--; + virt_dev->eps[ep_index].new_ring = + virt_dev->ring_cache[virt_dev->num_rings_cached]; + virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; + +Signed-off-by: Aman Deep +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd * + /* Attempt to use the ring cache */ + if (virt_dev->num_rings_cached == 0) + return -ENOMEM; ++ virt_dev->num_rings_cached--; + virt_dev->eps[ep_index].new_ring = + virt_dev->ring_cache[virt_dev->num_rings_cached]; + virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; +- virt_dev->num_rings_cached--; + xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, + 1, type); + }