From: Greg Kroah-Hartman Date: Sun, 13 Aug 2017 22:19:14 +0000 (-0700) Subject: 4.4-stable patches X-Git-Tag: v3.18.66~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=630f30214d844543052604bd78967925555762f9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch iio-light-tsl2563-use-correct-event-code.patch iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch usb-check-for-dropped-connection-before-switching-to-full-speed.patch usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch usb-musb-fix-tx-fifo-flush-handling-again.patch usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch usb-serial-option-add-d-link-dwm-222-device-id.patch usb-serial-pl2303-add-new-aten-device-id.patch usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch --- diff --git a/queue-4.4/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch b/queue-4.4/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch new file mode 100644 index 00000000000..52813cb393b --- /dev/null +++ b/queue-4.4/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch @@ -0,0 +1,38 @@ +From 68227c03cba84a24faf8a7277d2b1a03c8959c2c Mon Sep 17 00:00:00 2001 +From: Mateusz Jurczyk +Date: Wed, 7 Jun 2017 12:26:49 +0200 +Subject: fuse: initialize the flock flag in fuse_file on allocation + +From: Mateusz Jurczyk + +commit 68227c03cba84a24faf8a7277d2b1a03c8959c2c upstream. + +Before the patch, the flock flag could remain uninitialized for the +lifespan of the fuse_file allocation. Unless set to true in +fuse_file_flock(), it would remain in an indeterminate state until read in +an if statement in fuse_release_common(). This could consequently lead to +taking an unexpected branch in the code. + +The bug was discovered by a runtime instrumentation designed to detect use +of uninitialized memory in the kernel. + +Signed-off-by: Mateusz Jurczyk +Fixes: 37fb3a30b462 ("fuse: fix flock") +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct + { + struct fuse_file *ff; + +- ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL); ++ ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL); + if (unlikely(!ff)) + return NULL; + diff --git a/queue-4.4/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch b/queue-4.4/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch new file mode 100644 index 00000000000..a174b686fe9 --- /dev/null +++ b/queue-4.4/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch @@ -0,0 +1,60 @@ +From e59e18989c68a8d7941005f81ad6abc4ca682de0 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 13 Jul 2017 15:13:41 +0200 +Subject: iio: accel: bmc150: Always restore device to normal mode after suspend-resume + +From: Hans de Goede + +commit e59e18989c68a8d7941005f81ad6abc4ca682de0 upstream. + +After probe we would put the device in normal mode, after a runtime +suspend-resume we would put it back in normal mode. But for a regular +suspend-resume we would only put it back in normal mode if triggers +or events have been requested. This is not consistent and breaks +reading raw values after a suspend-resume. + +This commit changes the regular resume path to also unconditionally put +the device back in normal mode, fixing reading of raw values not working +after a regular suspend-resume cycle. + +Signed-off-by: Hans de Goede +Reviewed-by: Srinivas Pandruvada +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/bmc150-accel-core.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -194,7 +194,6 @@ struct bmc150_accel_data { + struct device *dev; + int irq; + struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS]; +- atomic_t active_intr; + struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS]; + struct mutex mutex; + u8 fifo_mode, watermark; +@@ -489,11 +488,6 @@ static int bmc150_accel_set_interrupt(st + goto out_fix_power_state; + } + +- if (state) +- atomic_inc(&data->active_intr); +- else +- atomic_dec(&data->active_intr); +- + return 0; + + out_fix_power_state: +@@ -1704,8 +1698,7 @@ static int bmc150_accel_resume(struct de + struct bmc150_accel_data *data = iio_priv(indio_dev); + + mutex_lock(&data->mutex); +- if (atomic_read(&data->active_intr)) +- bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); ++ bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); + bmc150_accel_fifo_set_mode(data); + mutex_unlock(&data->mutex); + diff --git a/queue-4.4/iio-light-tsl2563-use-correct-event-code.patch b/queue-4.4/iio-light-tsl2563-use-correct-event-code.patch new file mode 100644 index 00000000000..424e8c38b0f --- /dev/null +++ b/queue-4.4/iio-light-tsl2563-use-correct-event-code.patch @@ -0,0 +1,39 @@ +From a3507e48d3f99a93a3056a34a5365f310434570f Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Wed, 21 Jun 2017 01:46:37 +0900 +Subject: iio: light: tsl2563: use correct event code + +From: Akinobu Mita + +commit a3507e48d3f99a93a3056a34a5365f310434570f upstream. + +The TSL2563 driver provides three iio channels, two of which are raw ADC +channels (channel 0 and channel 1) in the device and the remaining one +is calculated by the two. The ADC channel 0 only supports programmable +interrupt with threshold settings and this driver supports the event but +the generated event code does not contain the corresponding iio channel +type. + +This is going to change userspace ABI. Hopefully fixing this to be +what it should always have been won't break any userspace code. + +Cc: Jonathan Cameron +Signed-off-by: Akinobu Mita +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/light/tsl2563.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/tsl2563.c ++++ b/drivers/iio/light/tsl2563.c +@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler + struct tsl2563_chip *chip = iio_priv(dev_info); + + iio_push_event(dev_info, +- IIO_UNMOD_EVENT_CODE(IIO_LIGHT, ++ IIO_UNMOD_EVENT_CODE(IIO_INTENSITY, + 0, + IIO_EV_TYPE_THRESH, + IIO_EV_DIR_EITHER), diff --git a/queue-4.4/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch b/queue-4.4/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch new file mode 100644 index 00000000000..14f3ae5d684 --- /dev/null +++ b/queue-4.4/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch @@ -0,0 +1,111 @@ +From 978d13d60c34818a41fc35962602bdfa5c03f214 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Fri, 4 Aug 2017 23:59:31 -0700 +Subject: iscsi-target: Fix iscsi_np reset hung task during parallel delete + +From: Nicholas Bellinger + +commit 978d13d60c34818a41fc35962602bdfa5c03f214 upstream. + +This patch fixes a bug associated with iscsit_reset_np_thread() +that can occur during parallel configfs rmdir of a single iscsi_np +used across multiple iscsi-target instances, that would result in +hung task(s) similar to below where configfs rmdir process context +was blocked indefinately waiting for iscsi_np->np_restart_comp +to finish: + +[ 6726.112076] INFO: task dcp_proxy_node_:15550 blocked for more than 120 seconds. +[ 6726.119440] Tainted: G W O 4.1.26-3321 #2 +[ 6726.125045] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 6726.132927] dcp_proxy_node_ D ffff8803f202bc88 0 15550 1 0x00000000 +[ 6726.140058] ffff8803f202bc88 ffff88085c64d960 ffff88083b3b1ad0 ffff88087fffeb08 +[ 6726.147593] ffff8803f202c000 7fffffffffffffff ffff88083f459c28 ffff88083b3b1ad0 +[ 6726.155132] ffff88035373c100 ffff8803f202bca8 ffffffff8168ced2 ffff8803f202bcb8 +[ 6726.162667] Call Trace: +[ 6726.165150] [] schedule+0x32/0x80 +[ 6726.170156] [] schedule_timeout+0x214/0x290 +[ 6726.176030] [] ? __send_signal+0x52/0x4a0 +[ 6726.181728] [] wait_for_completion+0x96/0x100 +[ 6726.187774] [] ? wake_up_state+0x10/0x10 +[ 6726.193395] [] iscsit_reset_np_thread+0x62/0xe0 [iscsi_target_mod] +[ 6726.201278] [] iscsit_tpg_disable_portal_group+0x96/0x190 [iscsi_target_mod] +[ 6726.210033] [] lio_target_tpg_store_enable+0x4f/0xc0 [iscsi_target_mod] +[ 6726.218351] [] configfs_write_file+0xaa/0x110 +[ 6726.224392] [] vfs_write+0xa4/0x1b0 +[ 6726.229576] [] SyS_write+0x41/0xb0 +[ 6726.234659] [] system_call_fastpath+0x12/0x71 + +It would happen because each iscsit_reset_np_thread() sets state +to ISCSI_NP_THREAD_RESET, sends SIGINT, and then blocks waiting +for completion on iscsi_np->np_restart_comp. + +However, if iscsi_np was active processing a login request and +more than a single iscsit_reset_np_thread() caller to the same +iscsi_np was blocked on iscsi_np->np_restart_comp, iscsi_np +kthread process context in __iscsi_target_login_thread() would +flush pending signals and only perform a single completion of +np->np_restart_comp before going back to sleep within transport +specific iscsit_transport->iscsi_accept_np code. + +To address this bug, add a iscsi_np->np_reset_count and update +__iscsi_target_login_thread() to keep completing np->np_restart_comp +until ->np_reset_count has reached zero. + +Reported-by: Gary Guo +Tested-by: Gary Guo +Cc: Mike Christie +Cc: Hannes Reinecke +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 1 + + drivers/target/iscsi/iscsi_target_login.c | 7 +++++-- + include/target/iscsi/iscsi_target_core.h | 1 + + 3 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -418,6 +418,7 @@ int iscsit_reset_np_thread( + return 0; + } + np->np_thread_state = ISCSI_NP_THREAD_RESET; ++ atomic_inc(&np->np_reset_count); + + if (np->np_thread) { + spin_unlock_bh(&np->np_thread_lock); +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -1219,9 +1219,11 @@ static int __iscsi_target_login_thread(s + flush_signals(current); + + spin_lock_bh(&np->np_thread_lock); +- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { ++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { + np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; ++ spin_unlock_bh(&np->np_thread_lock); + complete(&np->np_restart_comp); ++ return 1; + } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) { + spin_unlock_bh(&np->np_thread_lock); + goto exit; +@@ -1254,7 +1256,8 @@ static int __iscsi_target_login_thread(s + goto exit; + } else if (rc < 0) { + spin_lock_bh(&np->np_thread_lock); +- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { ++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { ++ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; + spin_unlock_bh(&np->np_thread_lock); + complete(&np->np_restart_comp); + iscsit_put_transport(conn->conn_transport); +--- a/include/target/iscsi/iscsi_target_core.h ++++ b/include/target/iscsi/iscsi_target_core.h +@@ -784,6 +784,7 @@ struct iscsi_np { + int np_sock_type; + enum np_thread_state_table np_thread_state; + bool enabled; ++ atomic_t np_reset_count; + enum iscsi_timer_flags_table np_login_timer_flags; + u32 np_exports; + enum np_flags_table np_flags; diff --git a/queue-4.4/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch b/queue-4.4/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch new file mode 100644 index 00000000000..bb032e30b22 --- /dev/null +++ b/queue-4.4/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch @@ -0,0 +1,43 @@ +From ea8dc5b4cd2195ee582cae28afa4164c6dea1738 Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Sun, 23 Jul 2017 20:03:33 +0530 +Subject: iscsi-target: fix memory leak in iscsit_setup_text_cmd() + +From: Varun Prakash + +commit ea8dc5b4cd2195ee582cae28afa4164c6dea1738 upstream. + +On receiving text request iscsi-target allocates buffer for +payload in iscsit_handle_text_cmd() and assigns buffer pointer +to cmd->text_in_ptr, this buffer is currently freed in +iscsit_release_cmd(), if iscsi-target sets 'C' bit in text +response then it will receive another text request from the +initiator with ttt != 0xffffffff in this case iscsi-target +will find cmd using itt and call iscsit_setup_text_cmd() +which will set cmd->text_in_ptr to NULL without freeing +previously allocated buffer. + +This patch fixes this issue by calling kfree(cmd->text_in_ptr) +in iscsit_setup_text_cmd() before assigning NULL to it. + +For the first text request cmd->text_in_ptr is NULL as +cmd is memset to 0 in iscsit_allocate_cmd(). + +Signed-off-by: Varun Prakash +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1996,6 +1996,7 @@ iscsit_setup_text_cmd(struct iscsi_conn + cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); + cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); + cmd->data_direction = DMA_NONE; ++ kfree(cmd->text_in_ptr); + cmd->text_in_ptr = NULL; + + return 0; diff --git a/queue-4.4/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch b/queue-4.4/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch new file mode 100644 index 00000000000..f6461f7a9b7 --- /dev/null +++ b/queue-4.4/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch @@ -0,0 +1,30 @@ +From 1feb26162bee7b2f110facfec71b5c7bdbc7d14d Mon Sep 17 00:00:00 2001 +From: Weston Andros Adamson +Date: Tue, 1 Aug 2017 16:25:01 -0400 +Subject: nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays + +From: Weston Andros Adamson + +commit 1feb26162bee7b2f110facfec71b5c7bdbc7d14d upstream. + +The client was freeing the nfs4_ff_layout_ds, but not the contained +nfs4_ff_ds_version array. + +Signed-off-by: Weston Andros Adamson +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/flexfilelayout/flexfilelayoutdev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -30,6 +30,7 @@ void nfs4_ff_layout_free_deviceid(struct + { + nfs4_print_deviceid(&mirror_ds->id_node.deviceid); + nfs4_pnfs_ds_put(mirror_ds->ds); ++ kfree(mirror_ds->ds_versions); + kfree_rcu(mirror_ds, id_node.rcu); + } + diff --git a/queue-4.4/series b/queue-4.4/series index 24734539160..d808859f20f 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -1,2 +1,19 @@ cpuset-fix-a-deadlock-due-to-incomplete-patching-of-cpusets_enabled.patch mm-ratelimit-pfns-busy-info-message.patch +iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch +iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch +fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch +nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch +usb-serial-option-add-d-link-dwm-222-device-id.patch +usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch +usb-serial-pl2303-add-new-aten-device-id.patch +usb-musb-fix-tx-fifo-flush-handling-again.patch +usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch +staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch +iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch +iio-light-tsl2563-use-correct-event-code.patch +uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch +usb-check-for-dropped-connection-before-switching-to-full-speed.patch +usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch +usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch +usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch diff --git a/queue-4.4/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch b/queue-4.4/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch new file mode 100644 index 00000000000..b2752d34089 --- /dev/null +++ b/queue-4.4/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch @@ -0,0 +1,38 @@ +From 105967ad68d2eb1a041bc041f9cf96af2a653b65 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 14 Jul 2017 11:31:03 +0200 +Subject: staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read + +From: Arnd Bergmann + +commit 105967ad68d2eb1a041bc041f9cf96af2a653b65 upstream. + +gcc-7 points out an older regression: + +drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw': +drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context] + +The original code had 'unsigned short' here, but incorrectly got +converted to 'bool'. This reverts the regression and uses a normal +type instead. + +Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.") +Signed-off-by: Arnd Bergmann +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/resolver/ad2s1210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/iio/resolver/ad2s1210.c ++++ b/drivers/staging/iio/resolver/ad2s1210.c +@@ -468,7 +468,7 @@ static int ad2s1210_read_raw(struct iio_ + long m) + { + struct ad2s1210_state *st = iio_priv(indio_dev); +- bool negative; ++ u16 negative; + int ret = 0; + u16 pos; + s16 vel; diff --git a/queue-4.4/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch b/queue-4.4/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch new file mode 100644 index 00000000000..fb0710551f7 --- /dev/null +++ b/queue-4.4/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch @@ -0,0 +1,41 @@ +From 89f23d51defcb94a5026d4b5da13faf4e1150a6f Mon Sep 17 00:00:00 2001 +From: Alan Swanson +Date: Wed, 26 Jul 2017 12:03:33 +0100 +Subject: uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069 + +From: Alan Swanson + +commit 89f23d51defcb94a5026d4b5da13faf4e1150a6f upstream. + +Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for +Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already +present in unusual_uas.h. Both in same controller IC family. + +Issue is that MakeMKV fails during key exchange with installed bluray drive +with following error: + +002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' +occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0' + +Signed-off-by: Alan Swanson +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -123,9 +123,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99 + /* Reported-by: Benjamin Tissoires */ + UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, + "Initio Corporation", +- "", ++ "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_NO_ATA_1X), ++ US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE), + + /* Reported-by: Tom Arild Naess */ + UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999, diff --git a/queue-4.4/usb-check-for-dropped-connection-before-switching-to-full-speed.patch b/queue-4.4/usb-check-for-dropped-connection-before-switching-to-full-speed.patch new file mode 100644 index 00000000000..8ef6ec92d89 --- /dev/null +++ b/queue-4.4/usb-check-for-dropped-connection-before-switching-to-full-speed.patch @@ -0,0 +1,65 @@ +From 94c43b9897abf4ea366ed4dba027494e080c7050 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 1 Aug 2017 10:41:56 -0400 +Subject: USB: Check for dropped connection before switching to full speed + +From: Alan Stern + +commit 94c43b9897abf4ea366ed4dba027494e080c7050 upstream. + +Some buggy USB disk adapters disconnect and reconnect multiple times +during the enumeration procedure. This may lead to a device +connecting at full speed instead of high speed, because when the USB +stack sees that a device isn't able to enumerate at high speed, it +tries to hand the connection over to a full-speed companion +controller. + +The logic for doing this is careful to check that the device is still +connected. But this check is inadequate if the device disconnects and +reconnects before the check is done. The symptom is that a device +works, but much more slowly than it is capable of operating. + +The situation was made worse recently by commit 22547c4cc4fe ("usb: +hub: Wait for connection to be reestablished after port reset"), which +increases the delay following a reset before a disconnect is +recognized, thus giving the device more time to reconnect. + +This patch makes the check more robust. If the device was +disconnected at any time during enumeration, we will now skip the +full-speed handover. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Zdenek Kabelac +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4661,7 +4661,8 @@ hub_power_remaining(struct usb_hub *hub) + static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + u16 portchange) + { +- int status, i; ++ int status = -ENODEV; ++ int i; + unsigned unit_load; + struct usb_device *hdev = hub->hdev; + struct usb_hcd *hcd = bus_to_hcd(hdev->bus); +@@ -4865,9 +4866,10 @@ loop: + + done: + hub_port_disable(hub, port1, 1); +- if (hcd->driver->relinquish_port && !hub->hdev->parent) +- hcd->driver->relinquish_port(hcd, port1); +- ++ if (hcd->driver->relinquish_port && !hub->hdev->parent) { ++ if (status != -ENOTCONN && status != -ENODEV) ++ hcd->driver->relinquish_port(hcd, port1); ++ } + } + + /* Handle physical or logical connection change events. diff --git a/queue-4.4/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch b/queue-4.4/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch new file mode 100644 index 00000000000..9c730530810 --- /dev/null +++ b/queue-4.4/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch @@ -0,0 +1,41 @@ +From 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 25 Jul 2017 09:31:33 -0500 +Subject: usb: core: unlink urbs from the tail of the endpoint's urb_list + +From: Bin Liu + +commit 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e upstream. + +While unlink an urb, if the urb has been programmed in the controller, +the controller driver might do some hw related actions to tear down the +urb. + +Currently usb_hcd_flush_endpoint() passes each urb from the head of the +endpoint's urb_list to the controller driver, which could make the +controller driver think each urb has been programmed and take the +unnecessary actions for each urb. + +This patch changes the behavior in usb_hcd_flush_endpoint() to pass the +urbs from the tail of the list, to avoid any unnecessary actions in an +controller driver. + +Acked-by: Alan Stern +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1851,7 +1851,7 @@ void usb_hcd_flush_endpoint(struct usb_d + /* No more submits can occur */ + spin_lock_irq(&hcd_urb_list_lock); + rescan: +- list_for_each_entry (urb, &ep->urb_list, urb_list) { ++ list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) { + int is_in; + + if (urb->unlinked) diff --git a/queue-4.4/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch b/queue-4.4/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch new file mode 100644 index 00000000000..61997c24076 --- /dev/null +++ b/queue-4.4/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch @@ -0,0 +1,40 @@ +From cd5a6a4fdaba150089af2afc220eae0fef74878a Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 25 Jul 2017 23:58:50 +0200 +Subject: USB: hcd: Mark secondary HCD as dead if the primary one died + +From: Rafael J. Wysocki + +commit cd5a6a4fdaba150089af2afc220eae0fef74878a upstream. + +Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared +HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for +the primary one. + +Among other thigs, this prevents check_root_hub_suspended() from +returning -EBUSY for dead HCDs which helps to work around system +suspend issues in some situations. + +This actually fixes occasional suspend failures on one of my test +machines. + +Suggested-by: Alan Stern +Signed-off-by: Rafael J. Wysocki +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2448,6 +2448,8 @@ void usb_hc_died (struct usb_hcd *hcd) + } + if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) { + hcd = hcd->shared_hcd; ++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); ++ set_bit(HCD_FLAG_DEAD, &hcd->flags); + if (hcd->rh_registered) { + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + diff --git a/queue-4.4/usb-musb-fix-tx-fifo-flush-handling-again.patch b/queue-4.4/usb-musb-fix-tx-fifo-flush-handling-again.patch new file mode 100644 index 00000000000..35754356295 --- /dev/null +++ b/queue-4.4/usb-musb-fix-tx-fifo-flush-handling-again.patch @@ -0,0 +1,36 @@ +From 45d73860530a14c608f410b91c6c341777bfa85d Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 25 Jul 2017 09:31:34 -0500 +Subject: usb: musb: fix tx fifo flush handling again + +From: Bin Liu + +commit 45d73860530a14c608f410b91c6c341777bfa85d upstream. + +commit 68fe05e2a451 ("usb: musb: fix tx fifo flush handling") drops the +1ms delay trying to solve the long disconnect time issue when +application queued many tx urbs. However, the 1ms delay is needed for +some use cases, for example, without the delay, reconnecting AR9271 WIFI +dongle no longer works if the connection is dropped from the AP. + +So let's add back the 1ms delay in musb_h_tx_flush_fifo(), and solve the +long disconnect time problem with a separate patch for +usb_hcd_flush_endpoint(). + +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_host.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -138,6 +138,7 @@ static void musb_h_tx_flush_fifo(struct + "Could not flush host TX%d fifo: csr: %04x\n", + ep->epnum, csr)) + return; ++ mdelay(1); + } + } + diff --git a/queue-4.4/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch b/queue-4.4/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch new file mode 100644 index 00000000000..0936ec81337 --- /dev/null +++ b/queue-4.4/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch @@ -0,0 +1,37 @@ +From 7496cfe5431f21da5d27a8388c326397e3f0a5db Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Tue, 8 Aug 2017 17:51:27 +0800 +Subject: usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter + +From: Kai-Heng Feng + +commit 7496cfe5431f21da5d27a8388c326397e3f0a5db upstream. + +Moshi USB to Ethernet Adapter internally uses a Genesys Logic hub to +connect to Realtek r8153. + +The Realtek r8153 ethernet does not work on the internal hub, no-lpm quirk +can make it work. + +Since another r8153 dongle at my hand does not have the issue, so add +the quirk to the Genesys Logic hub instead. + +Signed-off-by: Kai-Heng Feng +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -150,6 +150,9 @@ static const struct usb_device_id usb_qu + /* appletouch */ + { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ ++ { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* Avision AV600U */ + { USB_DEVICE(0x0638, 0x0a13), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, diff --git a/queue-4.4/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch b/queue-4.4/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch new file mode 100644 index 00000000000..b7db6662bc5 --- /dev/null +++ b/queue-4.4/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch @@ -0,0 +1,32 @@ +From 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f Mon Sep 17 00:00:00 2001 +From: Stefan Triller +Date: Fri, 30 Jun 2017 14:44:03 +0200 +Subject: USB: serial: cp210x: add support for Qivicon USB ZigBee dongle + +From: Stefan Triller + +commit 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f upstream. + +The German Telekom offers a ZigBee USB Stick under the brand name Qivicon +for their SmartHome Home Base in its 1. Generation. The productId is not +known by the according kernel module, this patch adds support for it. + +Signed-off-by: Stefan Triller +Reviewed-by: Frans Klaver +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -135,6 +135,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ ++ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/queue-4.4/usb-serial-option-add-d-link-dwm-222-device-id.patch b/queue-4.4/usb-serial-option-add-d-link-dwm-222-device-id.patch new file mode 100644 index 00000000000..a52e3d20529 --- /dev/null +++ b/queue-4.4/usb-serial-option-add-d-link-dwm-222-device-id.patch @@ -0,0 +1,30 @@ +From fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 Mon Sep 17 00:00:00 2001 +From: Hector Martin +Date: Wed, 2 Aug 2017 00:45:06 +0900 +Subject: USB: serial: option: add D-Link DWM-222 device ID + +From: Hector Martin + +commit fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 upstream. + +Add device id for D-Link DWM-222. + +Signed-off-by: Hector Martin +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2025,6 +2025,8 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ diff --git a/queue-4.4/usb-serial-pl2303-add-new-aten-device-id.patch b/queue-4.4/usb-serial-pl2303-add-new-aten-device-id.patch new file mode 100644 index 00000000000..26d0180dce3 --- /dev/null +++ b/queue-4.4/usb-serial-pl2303-add-new-aten-device-id.patch @@ -0,0 +1,40 @@ +From 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 10 Aug 2017 11:54:12 -0700 +Subject: USB: serial: pl2303: add new ATEN device id + +From: Greg Kroah-Hartman + +commit 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e upstream. + +This adds a new ATEN device id for a new pl2303-based device. + +Reported-by: Peter Kuo +Cc: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -49,6 +49,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, ++ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, + { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, + { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -27,6 +27,7 @@ + #define ATEN_VENDOR_ID 0x0557 + #define ATEN_VENDOR_ID2 0x0547 + #define ATEN_PRODUCT_ID 0x2008 ++#define ATEN_PRODUCT_UC485 0x2021 + #define ATEN_PRODUCT_ID2 0x2118 + + #define IODATA_VENDOR_ID 0x04bb diff --git a/queue-4.4/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch b/queue-4.4/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch new file mode 100644 index 00000000000..320ff0fbd07 --- /dev/null +++ b/queue-4.4/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch @@ -0,0 +1,86 @@ +From e788787ef4f9c24aafefc480a8da5f92b914e5e6 Mon Sep 17 00:00:00 2001 +From: Sandeep Singh +Date: Fri, 4 Aug 2017 16:35:56 +0530 +Subject: usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume + +From: Sandeep Singh + +commit e788787ef4f9c24aafefc480a8da5f92b914e5e6 upstream. + +Certain HP keyboards would keep inputting a character automatically which +is the wake-up key after S3 resume + +On some AMD platforms USB host fails to respond (by holding resume-K) to +USB device (an HP keyboard) resume request within 1ms (TURSM) and ensures +that resume is signaled for at least 20 ms (TDRSMDN), which is defined in +USB 2.0 spec. The result is that the keyboard is out of function. + +In SNPS USB design, the host responds to the resume request only after +system gets back to S0 and the host gets to functional after the internal +HW restore operation that is more than 1 second after the initial resume +request from the USB device. + +As a workaround for specific keyboard ID(HP Keyboards), applying port reset +after resume when the keyboard is plugged in. + +Signed-off-by: Sandeep Singh +Signed-off-by: Shyam Sundar S K +cc: Nehal Shah +Reviewed-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 1 + + drivers/usb/host/pci-quirks.c | 17 ++++++++++++----- + 2 files changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -252,6 +252,7 @@ static const struct usb_device_id usb_am + { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Optical Mouse M90/M100 */ + { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME }, +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -89,6 +89,7 @@ enum amd_chipset_gen { + AMD_CHIPSET_HUDSON2, + AMD_CHIPSET_BOLTON, + AMD_CHIPSET_YANGTZE, ++ AMD_CHIPSET_TAISHAN, + AMD_CHIPSET_UNKNOWN, + }; + +@@ -132,6 +133,11 @@ static int amd_chipset_sb_type_init(stru + pinfo->sb_type.gen = AMD_CHIPSET_SB700; + else if (rev >= 0x40 && rev <= 0x4f) + pinfo->sb_type.gen = AMD_CHIPSET_SB800; ++ } ++ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, ++ 0x145c, NULL); ++ if (pinfo->smbus_dev) { ++ pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN; + } else { + pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, + PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL); +@@ -251,11 +257,12 @@ int usb_hcd_amd_remote_wakeup_quirk(stru + { + /* Make sure amd chipset type has already been initialized */ + usb_amd_find_chipset_info(); +- if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE) +- return 0; +- +- dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); +- return 1; ++ if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE || ++ amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) { ++ dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); ++ return 1; ++ } ++ return 0; + } + EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk); +