From: Greg Kroah-Hartman Date: Fri, 2 Sep 2016 14:22:30 +0000 (+0200) Subject: 3.14-stable patches X-Git-Tag: v3.14.78~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=596b5ab46c73440cc540552a690d9e8dab541159;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: usb-define-usb_speed_super_plus-speed-for-superspeedplus-usb3.1-devices.patch usb-dwc3-gadget-increment-request-actual-once.patch usb-serial-fix-memleak-in-driver-registration-error-path.patch usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch usb-serial-option-add-d-link-dwm-156-a3.patch usb-serial-option-add-support-for-telit-le920a4.patch usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch usb-xhci-fix-panic-if-disconnect.patch --- diff --git a/queue-3.14/series b/queue-3.14/series index 745dd4aa734..bef8328e84d 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -6,3 +6,12 @@ pci-add-netronome-vendor-and-device-ids.patch pci-limit-config-space-size-for-netronome-nfp6000-family.patch pci-add-netronome-nfp4000-pf-device-id.patch pci-limit-config-space-size-for-netronome-nfp4000.patch +usb-dwc3-gadget-increment-request-actual-once.patch +usb-define-usb_speed_super_plus-speed-for-superspeedplus-usb3.1-devices.patch +usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch +usb-xhci-fix-panic-if-disconnect.patch +usb-serial-fix-memleak-in-driver-registration-error-path.patch +usb-serial-option-add-d-link-dwm-156-a3.patch +usb-serial-option-add-support-for-telit-le920a4.patch +usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch +usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch diff --git a/queue-3.14/usb-define-usb_speed_super_plus-speed-for-superspeedplus-usb3.1-devices.patch b/queue-3.14/usb-define-usb_speed_super_plus-speed-for-superspeedplus-usb3.1-devices.patch new file mode 100644 index 00000000000..b69718379db --- /dev/null +++ b/queue-3.14/usb-define-usb_speed_super_plus-speed-for-superspeedplus-usb3.1-devices.patch @@ -0,0 +1,283 @@ +From 8a1b2725a60d3267135c15e80984b4406054f650 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Thu, 10 Dec 2015 09:59:25 +0200 +Subject: usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices + +From: Mathias Nyman + +commit 8a1b2725a60d3267135c15e80984b4406054f650 upstream. + +Add a new USB_SPEED_SUPER_PLUS device speed, and make sure usb core can +handle the new speed. +In most cases the behaviour is the same as with USB_SPEED_SUPER SuperSpeed +devices. In a few places we add a "Plus" string to inform the user of the +new speed. + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 3 ++- + drivers/usb/core/devices.c | 10 ++++++---- + drivers/usb/core/hcd-pci.c | 2 +- + drivers/usb/core/hcd.c | 6 +++--- + drivers/usb/core/hub.c | 26 +++++++++++++++----------- + drivers/usb/core/urb.c | 3 ++- + drivers/usb/core/usb.h | 2 +- + include/uapi/linux/usb/ch9.h | 1 + + 8 files changed, 31 insertions(+), 22 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -192,6 +192,7 @@ static int usb_parse_endpoint(struct dev + if (usb_endpoint_xfer_int(d)) { + i = 1; + switch (to_usb_device(ddev)->speed) { ++ case USB_SPEED_SUPER_PLUS: + case USB_SPEED_SUPER: + case USB_SPEED_HIGH: + /* Many device manufacturers are using full-speed +@@ -264,7 +265,7 @@ static int usb_parse_endpoint(struct dev + } + + /* Parse a possible SuperSpeed endpoint companion descriptor */ +- if (to_usb_device(ddev)->speed == USB_SPEED_SUPER) ++ if (to_usb_device(ddev)->speed >= USB_SPEED_SUPER) + usb_parse_ss_endpoint_companion(ddev, cfgno, + inum, asnum, endpoint, buffer, size); + +--- a/drivers/usb/core/devices.c ++++ b/drivers/usb/core/devices.c +@@ -221,7 +221,7 @@ static char *usb_dump_endpoint_descripto + break; + case USB_ENDPOINT_XFER_INT: + type = "Int."; +- if (speed == USB_SPEED_HIGH || speed == USB_SPEED_SUPER) ++ if (speed == USB_SPEED_HIGH || speed >= USB_SPEED_SUPER) + interval = 1 << (desc->bInterval - 1); + else + interval = desc->bInterval; +@@ -230,7 +230,7 @@ static char *usb_dump_endpoint_descripto + return start; + } + interval *= (speed == USB_SPEED_HIGH || +- speed == USB_SPEED_SUPER) ? 125 : 1000; ++ speed >= USB_SPEED_SUPER) ? 125 : 1000; + if (interval % 1000) + unit = 'u'; + else { +@@ -322,7 +322,7 @@ static char *usb_dump_config_descriptor( + + if (start > end) + return start; +- if (speed == USB_SPEED_SUPER) ++ if (speed >= USB_SPEED_SUPER) + mul = 8; + else + mul = 2; +@@ -534,6 +534,8 @@ static ssize_t usb_device_dump(char __us + speed = "480"; break; + case USB_SPEED_SUPER: + speed = "5000"; break; ++ case USB_SPEED_SUPER_PLUS: ++ speed = "10000"; break; + default: + speed = "??"; + } +@@ -553,7 +555,7 @@ static ssize_t usb_device_dump(char __us + + /* super/high speed reserves 80%, full/low reserves 90% */ + if (usbdev->speed == USB_SPEED_HIGH || +- usbdev->speed == USB_SPEED_SUPER) ++ usbdev->speed >= USB_SPEED_SUPER) + max = 800; + else + max = FRAME_TIME_MAX_USECS_ALLOC; +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -207,7 +207,7 @@ int usb_hcd_pci_probe(struct pci_dev *de + * The xHCI driver has its own irq management + * make sure irq setup is not touched for xhci in generic hcd code + */ +- if ((driver->flags & HCD_MASK) != HCD_USB3) { ++ if ((driver->flags & HCD_MASK) < HCD_USB3) { + if (!dev->irq) { + dev_err(&dev->dev, + "Found HC with no IRQ. Check BIOS/PCI %s setup!\n", +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1024,7 +1024,7 @@ static int register_root_hub(struct usb_ + dev_name(&usb_dev->dev), retval); + return (retval < 0) ? retval : -EMSGSIZE; + } +- if (usb_dev->speed == USB_SPEED_SUPER) { ++ if (usb_dev->speed >= USB_SPEED_SUPER) { + retval = usb_get_bos_descriptor(usb_dev); + if (retval < 0) { + mutex_unlock(&usb_bus_list_lock); +@@ -2055,7 +2055,7 @@ int usb_alloc_streams(struct usb_interfa + hcd = bus_to_hcd(dev->bus); + if (!hcd->driver->alloc_streams || !hcd->driver->free_streams) + return -EINVAL; +- if (dev->speed != USB_SPEED_SUPER) ++ if (dev->speed < USB_SPEED_SUPER) + return -EINVAL; + if (dev->state < USB_STATE_CONFIGURED) + return -ENODEV; +@@ -2093,7 +2093,7 @@ int usb_free_streams(struct usb_interfac + + dev = interface_to_usbdev(interface); + hcd = bus_to_hcd(dev->bus); +- if (dev->speed != USB_SPEED_SUPER) ++ if (dev->speed < USB_SPEED_SUPER) + return -EINVAL; + + /* Streams only apply to bulk endpoints. */ +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -297,7 +297,7 @@ static void usb_set_lpm_parameters(struc + unsigned int hub_u1_del; + unsigned int hub_u2_del; + +- if (!udev->lpm_capable || udev->speed != USB_SPEED_SUPER) ++ if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER) + return; + + hub = usb_hub_to_struct_hub(udev->parent); +@@ -2559,7 +2559,7 @@ static unsigned hub_is_wusb(struct usb_h + */ + static bool use_new_scheme(struct usb_device *udev, int retry) + { +- if (udev->speed == USB_SPEED_SUPER) ++ if (udev->speed >= USB_SPEED_SUPER) + return false; + + return USE_NEW_SCHEME(retry); +@@ -3812,7 +3812,7 @@ int usb_disable_lpm(struct usb_device *u + struct usb_hcd *hcd; + + if (!udev || !udev->parent || +- udev->speed != USB_SPEED_SUPER || ++ udev->speed < USB_SPEED_SUPER || + !udev->lpm_capable) + return 0; + +@@ -3868,7 +3868,7 @@ void usb_enable_lpm(struct usb_device *u + struct usb_hcd *hcd; + + if (!udev || !udev->parent || +- udev->speed != USB_SPEED_SUPER || ++ udev->speed < USB_SPEED_SUPER || + !udev->lpm_capable) + return; + +@@ -4127,7 +4127,9 @@ hub_port_init (struct usb_hub *hub, stru + + retval = -ENODEV; + +- if (oldspeed != USB_SPEED_UNKNOWN && oldspeed != udev->speed) { ++ /* Don't allow speed changes at reset, except usb 3.0 to faster */ ++ if (oldspeed != USB_SPEED_UNKNOWN && oldspeed != udev->speed && ++ !(oldspeed == USB_SPEED_SUPER && udev->speed > oldspeed)) { + dev_dbg(&udev->dev, "device reset changed speed!\n"); + goto fail; + } +@@ -4139,6 +4141,7 @@ hub_port_init (struct usb_hub *hub, stru + * reported as 0xff in the device descriptor). WUSB1.0[4.8.1]. + */ + switch (udev->speed) { ++ case USB_SPEED_SUPER_PLUS: + case USB_SPEED_SUPER: + case USB_SPEED_WIRELESS: /* fixed at 512 */ + udev->ep0.desc.wMaxPacketSize = cpu_to_le16(512); +@@ -4165,7 +4168,7 @@ hub_port_init (struct usb_hub *hub, stru + else + speed = usb_speed_string(udev->speed); + +- if (udev->speed != USB_SPEED_SUPER) ++ if (udev->speed < USB_SPEED_SUPER) + dev_info(&udev->dev, + "%s %s USB device number %d using %s\n", + (udev->config) ? "reset" : "new", speed, +@@ -4291,11 +4294,12 @@ hub_port_init (struct usb_hub *hub, stru + devnum, retval); + goto fail; + } +- if (udev->speed == USB_SPEED_SUPER) { ++ if (udev->speed >= USB_SPEED_SUPER) { + devnum = udev->devnum; + dev_info(&udev->dev, +- "%s SuperSpeed USB device number %d using %s\n", ++ "%s SuperSpeed%s USB device number %d using %s\n", + (udev->config) ? "reset" : "new", ++ (udev->speed == USB_SPEED_SUPER_PLUS) ? "Plus" : "", + devnum, udev->bus->controller->driver->name); + } + +@@ -4337,7 +4341,7 @@ hub_port_init (struct usb_hub *hub, stru + * got from those devices show they aren't superspeed devices. Warm + * reset the port attached by the devices can fix them. + */ +- if ((udev->speed == USB_SPEED_SUPER) && ++ if ((udev->speed >= USB_SPEED_SUPER) && + (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0300)) { + dev_err(&udev->dev, "got a wrong device descriptor, " + "warm reset device\n"); +@@ -4348,7 +4352,7 @@ hub_port_init (struct usb_hub *hub, stru + } + + if (udev->descriptor.bMaxPacketSize0 == 0xff || +- udev->speed == USB_SPEED_SUPER) ++ udev->speed >= USB_SPEED_SUPER) + i = 512; + else + i = udev->descriptor.bMaxPacketSize0; +@@ -4607,7 +4611,7 @@ static void hub_port_connect_change(stru + udev->level = hdev->level + 1; + udev->wusb = hub_is_wusb(hub); + +- /* Only USB 3.0 devices are connected to SuperSpeed hubs. */ ++ /* Devices connected to SuperSpeed hubs are USB 3.0 or later */ + if (hub_is_superspeed(hub->hdev)) + udev->speed = USB_SPEED_SUPER; + else +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -402,7 +402,7 @@ int usb_submit_urb(struct urb *urb, gfp_ + /* SuperSpeed isoc endpoints have up to 16 bursts of up to + * 3 packets each + */ +- if (dev->speed == USB_SPEED_SUPER) { ++ if (dev->speed >= USB_SPEED_SUPER) { + int burst = 1 + ep->ss_ep_comp.bMaxBurst; + int mult = USB_SS_MULT(ep->ss_ep_comp.bmAttributes); + max *= burst; +@@ -499,6 +499,7 @@ int usb_submit_urb(struct urb *urb, gfp_ + } + /* too big? */ + switch (dev->speed) { ++ case USB_SPEED_SUPER_PLUS: + case USB_SPEED_SUPER: /* units are 125us */ + /* Handle up to 2^(16-1) microframes */ + if (urb->interval > (1 << 15)) +--- a/drivers/usb/core/usb.h ++++ b/drivers/usb/core/usb.h +@@ -43,7 +43,7 @@ static inline unsigned usb_get_max_power + struct usb_host_config *c) + { + /* SuperSpeed power is in 8 mA units; others are in 2 mA units */ +- unsigned mul = (udev->speed == USB_SPEED_SUPER ? 8 : 2); ++ unsigned mul = (udev->speed >= USB_SPEED_SUPER ? 8 : 2); + + return c->desc.bMaxPower * mul; + } +--- a/include/uapi/linux/usb/ch9.h ++++ b/include/uapi/linux/usb/ch9.h +@@ -913,6 +913,7 @@ enum usb_device_speed { + USB_SPEED_HIGH, /* usb 2.0 */ + USB_SPEED_WIRELESS, /* wireless (usb 2.5) */ + USB_SPEED_SUPER, /* usb 3.0 */ ++ USB_SPEED_SUPER_PLUS, /* usb 3.1 */ + }; + + diff --git a/queue-3.14/usb-dwc3-gadget-increment-request-actual-once.patch b/queue-3.14/usb-dwc3-gadget-increment-request-actual-once.patch new file mode 100644 index 00000000000..a9dd139ee00 --- /dev/null +++ b/queue-3.14/usb-dwc3-gadget-increment-request-actual-once.patch @@ -0,0 +1,74 @@ +From c7de573471832dff7d31f0c13b0f143d6f017799 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Fri, 29 Jul 2016 03:17:58 +0300 +Subject: usb: dwc3: gadget: increment request->actual once + +From: Felipe Balbi + +commit c7de573471832dff7d31f0c13b0f143d6f017799 upstream. + +When using SG lists, we would end up setting +request->actual to: + + num_mapped_sgs * (request->length - count) + +Let's fix that up by incrementing request->actual +only once. + +Reported-by: Brian E Rogers +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1799,14 +1799,6 @@ static int __dwc3_cleanup_done_trbs(stru + s_pkt = 1; + } + +- /* +- * We assume here we will always receive the entire data block +- * which we should receive. Meaning, if we program RX to +- * receive 4K but we receive only 2K, we assume that's all we +- * should receive and we simply bounce the request back to the +- * gadget driver for further processing. +- */ +- req->request.actual += req->request.length - count; + if (s_pkt) + return 1; + if ((event->status & DEPEVT_STATUS_LST) && +@@ -1826,6 +1818,7 @@ static int dwc3_cleanup_done_reqs(struct + struct dwc3_trb *trb; + unsigned int slot; + unsigned int i; ++ int count = 0; + int ret; + + do { +@@ -1842,6 +1835,8 @@ static int dwc3_cleanup_done_reqs(struct + slot++; + slot %= DWC3_TRB_NUM; + trb = &dep->trb_pool[slot]; ++ count += trb->size & DWC3_TRB_SIZE_MASK; ++ + + ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, + event, status); +@@ -1849,6 +1844,14 @@ static int dwc3_cleanup_done_reqs(struct + break; + }while (++i < req->request.num_mapped_sgs); + ++ /* ++ * We assume here we will always receive the entire data block ++ * which we should receive. Meaning, if we program RX to ++ * receive 4K but we receive only 2K, we assume that's all we ++ * should receive and we simply bounce the request back to the ++ * gadget driver for further processing. ++ */ ++ req->request.actual += req->request.length - count; + dwc3_gadget_giveback(dep, req, status); + + if (ret) diff --git a/queue-3.14/usb-serial-fix-memleak-in-driver-registration-error-path.patch b/queue-3.14/usb-serial-fix-memleak-in-driver-registration-error-path.patch new file mode 100644 index 00000000000..3e62222fd48 --- /dev/null +++ b/queue-3.14/usb-serial-fix-memleak-in-driver-registration-error-path.patch @@ -0,0 +1,42 @@ +From 647024a7df36014bbc4479d92d88e6b77c0afcf6 Mon Sep 17 00:00:00 2001 +From: Alexey Klimov +Date: Mon, 8 Aug 2016 02:34:46 +0100 +Subject: USB: serial: fix memleak in driver-registration error path + +From: Alexey Klimov + +commit 647024a7df36014bbc4479d92d88e6b77c0afcf6 upstream. + +udriver struct allocated by kzalloc() will not be freed +if usb_register() and next calls fail. This patch fixes this +by adding one more step with kfree(udriver) in error path. + +Signed-off-by: Alexey Klimov +Acked-by: Alan Stern +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1426,7 +1426,7 @@ int usb_serial_register_drivers(struct u + + rc = usb_register(udriver); + if (rc) +- return rc; ++ goto failed_usb_register; + + for (sd = serial_drivers; *sd; ++sd) { + (*sd)->usb_driver = udriver; +@@ -1444,6 +1444,8 @@ int usb_serial_register_drivers(struct u + while (sd-- > serial_drivers) + usb_serial_deregister(*sd); + usb_deregister(udriver); ++failed_usb_register: ++ kfree(udriver); + return rc; + } + EXPORT_SYMBOL_GPL(usb_serial_register_drivers); diff --git a/queue-3.14/usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch b/queue-3.14/usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch new file mode 100644 index 00000000000..1af33ebd80c --- /dev/null +++ b/queue-3.14/usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch @@ -0,0 +1,50 @@ +From ae34d12cc1e212ffcd92e069030e54dae69c832f Mon Sep 17 00:00:00 2001 +From: "Sheng-Hui J. Chu" +Date: Thu, 28 Jul 2016 17:01:45 -0400 +Subject: USB: serial: ftdi_sio: add device ID for WICED USB UART dev board + +From: Sheng-Hui J. Chu + +commit ae34d12cc1e212ffcd92e069030e54dae69c832f upstream. + +BCM20706V2_EVAL is a WICED dev board designed with FT2232H USB 2.0 +UART/FIFO IC. + +To support BCM920706V2_EVAL dev board for WICED development on Linux. +Add the VID(0a5c) and PID(6422) to ftdi_sio driver to allow loading +ftdi_sio for this board. + +Signed-off-by: Sheng-Hui J. Chu +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ + 2 files changed, 7 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1021,6 +1021,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, ++ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, + { } /* Terminating entry */ + }; + +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -673,6 +673,12 @@ + #define INTREPID_NEOVI_PID 0x0701 + + /* ++ * WICED USB UART ++ */ ++#define WICED_VID 0x0A5C ++#define WICED_USB20706V2_PID 0x6422 ++ ++/* + * Definitions for ID TECH (www.idt-net.com) devices + */ + #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */ diff --git a/queue-3.14/usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch b/queue-3.14/usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch new file mode 100644 index 00000000000..2d91bc9f85d --- /dev/null +++ b/queue-3.14/usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch @@ -0,0 +1,48 @@ +From 6977495c06f7f47636a076ee5a0ca571279d9697 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Robert=20Deli=C3=ABn?= +Date: Thu, 28 Jul 2016 18:52:55 +0000 +Subject: USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices + +From: Robert Deliën + +commit 6977495c06f7f47636a076ee5a0ca571279d9697 upstream. + +Ivium Technologies uses the FTDI VID with custom PIDs for their line of +electrochemical interfaces and the PalmSens they developed for PalmSens +BV. + +Signed-off-by: Robert Delien +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -661,6 +661,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) }, + { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) }, + { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) }, + { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -406,6 +406,12 @@ + #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2 + + /* ++ * Ivium Technologies product IDs ++ */ ++#define FTDI_PALMSENS_PID 0xf440 ++#define FTDI_IVIUM_XSTAT_PID 0xf441 ++ ++/* + * Linx Technologies product ids + */ + #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */ diff --git a/queue-3.14/usb-serial-option-add-d-link-dwm-156-a3.patch b/queue-3.14/usb-serial-option-add-d-link-dwm-156-a3.patch new file mode 100644 index 00000000000..b96a917760d --- /dev/null +++ b/queue-3.14/usb-serial-option-add-d-link-dwm-156-a3.patch @@ -0,0 +1,37 @@ +From cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Sun, 24 Jul 2016 13:53:30 +0200 +Subject: USB: serial: option: add D-Link DWM-156/A3 + +From: Lubomir Rintel + +commit cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 upstream. + +The device has four interfaces; the three serial ports ought to be +handled by this driver: + +00 Diagnostic interface serial port +01 NMEA device serial port +02 Mass storage (sd card) +03 Modem serial port + +The other product ids listed in the Windows driver are present already. + +Signed-off-by: Lubomir Rintel +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1839,6 +1839,7 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, diff --git a/queue-3.14/usb-serial-option-add-support-for-telit-le920a4.patch b/queue-3.14/usb-serial-option-add-support-for-telit-le920a4.patch new file mode 100644 index 00000000000..e28f7225667 --- /dev/null +++ b/queue-3.14/usb-serial-option-add-support-for-telit-le920a4.patch @@ -0,0 +1,75 @@ +From 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Tue, 2 Aug 2016 11:29:25 +0200 +Subject: USB: serial: option: add support for Telit LE920A4 + +From: Daniele Palmas + +commit 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 upstream. + +This patch adds a set of compositions for Telit LE920A4. + +Compositions in short are: + +0x1207: tty + tty +0x1208: tty + adb + tty + tty +0x1211: tty + adb + ecm +0x1212: tty + adb +0x1213: ecm + tty +0x1214: tty + adb + ecm + tty + +telit_le922_blacklist_usbcfg3 is reused for compositions 0x1211 +and 0x1214 due to the same interfaces positions. + +Signed-off-by: Daniele Palmas +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -275,6 +275,12 @@ static void option_instat_callback(struc + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 + #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 ++#define TELIT_PRODUCT_LE920A4_1207 0x1207 ++#define TELIT_PRODUCT_LE920A4_1208 0x1208 ++#define TELIT_PRODUCT_LE920A4_1211 0x1211 ++#define TELIT_PRODUCT_LE920A4_1212 0x1212 ++#define TELIT_PRODUCT_LE920A4_1213 0x1213 ++#define TELIT_PRODUCT_LE920A4_1214 0x1214 + + /* ZTE PRODUCTS */ + #define ZTE_VENDOR_ID 0x19d2 +@@ -636,6 +642,11 @@ static const struct option_blacklist_inf + .reserved = BIT(1) | BIT(5), + }; + ++static const struct option_blacklist_info telit_le920a4_blacklist_1 = { ++ .sendsetup = BIT(0), ++ .reserved = BIT(1), ++}; ++ + static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { + .sendsetup = BIT(2), + .reserved = BIT(0) | BIT(1) | BIT(3), +@@ -1211,6 +1222,16 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, diff --git a/queue-3.14/usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch b/queue-3.14/usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch new file mode 100644 index 00000000000..6a52baefe3a --- /dev/null +++ b/queue-3.14/usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch @@ -0,0 +1,123 @@ +From aed9d65ac3278d4febd8665bd7db59ef53e825fe Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 1 Aug 2016 15:25:56 -0400 +Subject: USB: validate wMaxPacketValue entries in endpoint descriptors + +From: Alan Stern + +commit aed9d65ac3278d4febd8665bd7db59ef53e825fe upstream. + +Erroneous or malicious endpoint descriptors may have non-zero bits in +reserved positions, or out-of-bounds values. This patch helps prevent +these from causing problems by bounds-checking the wMaxPacketValue +entries in endpoint descriptors and capping the values at the maximum +allowed. + +This issue was first discovered and tests were conducted by Jake Lamberson +, an intern working for Rosie Hall. + +Signed-off-by: Alan Stern +Reported-by: roswest +Tested-by: roswest +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 66 +++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 63 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -143,6 +143,31 @@ static void usb_parse_ss_endpoint_compan + } + } + ++static const unsigned short low_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 8, ++ [USB_ENDPOINT_XFER_ISOC] = 0, ++ [USB_ENDPOINT_XFER_BULK] = 0, ++ [USB_ENDPOINT_XFER_INT] = 8, ++}; ++static const unsigned short full_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 64, ++ [USB_ENDPOINT_XFER_ISOC] = 1023, ++ [USB_ENDPOINT_XFER_BULK] = 64, ++ [USB_ENDPOINT_XFER_INT] = 64, ++}; ++static const unsigned short high_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 64, ++ [USB_ENDPOINT_XFER_ISOC] = 1024, ++ [USB_ENDPOINT_XFER_BULK] = 512, ++ [USB_ENDPOINT_XFER_INT] = 1023, ++}; ++static const unsigned short super_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 512, ++ [USB_ENDPOINT_XFER_ISOC] = 1024, ++ [USB_ENDPOINT_XFER_BULK] = 1024, ++ [USB_ENDPOINT_XFER_INT] = 1024, ++}; ++ + static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, + int asnum, struct usb_host_interface *ifp, int num_ep, + unsigned char *buffer, int size) +@@ -151,6 +176,8 @@ static int usb_parse_endpoint(struct dev + struct usb_endpoint_descriptor *d; + struct usb_host_endpoint *endpoint; + int n, i, j, retval; ++ unsigned int maxp; ++ const unsigned short *maxpacket_maxes; + + d = (struct usb_endpoint_descriptor *) buffer; + buffer += d->bLength; +@@ -247,6 +274,42 @@ static int usb_parse_endpoint(struct dev + endpoint->desc.wMaxPacketSize = cpu_to_le16(8); + } + ++ /* Validate the wMaxPacketSize field */ ++ maxp = usb_endpoint_maxp(&endpoint->desc); ++ ++ /* Find the highest legal maxpacket size for this endpoint */ ++ i = 0; /* additional transactions per microframe */ ++ switch (to_usb_device(ddev)->speed) { ++ case USB_SPEED_LOW: ++ maxpacket_maxes = low_speed_maxpacket_maxes; ++ break; ++ case USB_SPEED_FULL: ++ maxpacket_maxes = full_speed_maxpacket_maxes; ++ break; ++ case USB_SPEED_HIGH: ++ /* Bits 12..11 are allowed only for HS periodic endpoints */ ++ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { ++ i = maxp & (BIT(12) | BIT(11)); ++ maxp &= ~i; ++ } ++ /* fallthrough */ ++ default: ++ maxpacket_maxes = high_speed_maxpacket_maxes; ++ break; ++ case USB_SPEED_SUPER: ++ case USB_SPEED_SUPER_PLUS: ++ maxpacket_maxes = super_speed_maxpacket_maxes; ++ break; ++ } ++ j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)]; ++ ++ if (maxp > j) { ++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n", ++ cfgno, inum, asnum, d->bEndpointAddress, maxp, j); ++ maxp = j; ++ endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp); ++ } ++ + /* + * Some buggy high speed devices have bulk endpoints using + * maxpacket sizes other than 512. High speed HCDs may not +@@ -254,9 +317,6 @@ static int usb_parse_endpoint(struct dev + */ + if (to_usb_device(ddev)->speed == USB_SPEED_HIGH + && usb_endpoint_xfer_bulk(d)) { +- unsigned maxp; +- +- maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff; + if (maxp != 512) + dev_warn(ddev, "config %d interface %d altsetting %d " + "bulk endpoint 0x%X has invalid maxpacket %d\n", diff --git a/queue-3.14/usb-xhci-fix-panic-if-disconnect.patch b/queue-3.14/usb-xhci-fix-panic-if-disconnect.patch new file mode 100644 index 00000000000..49f90a8b608 --- /dev/null +++ b/queue-3.14/usb-xhci-fix-panic-if-disconnect.patch @@ -0,0 +1,59 @@ +From 88716a93766b8f095cdef37a8e8f2c93aa233b21 Mon Sep 17 00:00:00 2001 +From: Jim Lin +Date: Tue, 16 Aug 2016 10:18:05 +0300 +Subject: usb: xhci: Fix panic if disconnect + +From: Jim Lin + +commit 88716a93766b8f095cdef37a8e8f2c93aa233b21 upstream. + +After a device is disconnected, xhci_stop_device() will be invoked +in xhci_bus_suspend(). +Also the "disconnect" IRQ will have ISR to invoke +xhci_free_virt_device() in this sequence. +xhci_irq -> xhci_handle_event -> handle_cmd_completion -> +xhci_handle_cmd_disable_slot -> xhci_free_virt_device + +If xhci->devs[slot_id] has been assigned to NULL in +xhci_free_virt_device(), then virt_dev->eps[i].ring in +xhci_stop_device() may point to an invlid address to cause kernel +panic. + +virt_dev = xhci->devs[slot_id]; +: +if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue) + +[] Unable to handle kernel paging request at virtual address 00001a68 +[] pgd=ffffffc001430000 +[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003, +*pmd=000000013c808003, *pte=0000000000000000 +[] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G U +[] Workqueue: pm pm_runtime_work +[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti: +ffffffc0bc0ec000 +[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4 + +This issue is found when running with realtek ethernet device +(0bda:8153). + +Signed-off-by: Jim Lin +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -276,6 +276,9 @@ static int xhci_stop_device(struct xhci_ + + ret = 0; + virt_dev = xhci->devs[slot_id]; ++ if (!virt_dev) ++ return -ENODEV; ++ + cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO); + if (!cmd) { + xhci_dbg(xhci, "Couldn't allocate command structure.\n");