From: Greg Kroah-Hartman Date: Fri, 2 Sep 2016 14:23:54 +0000 (+0200) Subject: 4.7-stable patches X-Git-Tag: v3.14.78~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=885585e534a60abdcf49767a130e3844ea10788a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.7-stable patches added patches: clk-renesas-r8a7795-fix-sd-clocks.patch parisc-fix-automatic-selection-of-cr16-clocksource.patch uprobes-fix-the-memcg-accounting.patch usb-devio-do-not-warn-when-allocation-fails.patch usb-dwc3-gadget-always-cleanup-all-trbs.patch usb-dwc3-gadget-fix-for-short-pkts-during-chained-xfers.patch usb-dwc3-gadget-increment-request-actual-once.patch usb-dwc3-pci-add-intel-kabylake-pci-id.patch usb-ehci-change-order-of-register-cleanup-during-shutdown.patch usb-gadget-fix-gadgetfs-aio-support.patch usb-gadget-fsl_qe_udc-off-by-one-in-setup_received_handle.patch usb-hub-change-the-locking-in-hub_activate.patch usb-hub-fix-unbalanced-reference-count-memory-leak-deadlocks.patch usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch usb-misc-usbtest-add-fix-for-driver-hang.patch usb-misc-usbtest-usbtest_do_ioctl-may-return-positive-integer.patch usb-renesas_usbhs-clear-the-brdysts-in-usbhsg_ep_enable.patch usb-renesas_usbhs-fix-receiving-data-corrupt-on-r-car-gen3-with-dmac.patch usb-renesas_usbhs-use-dmac-only-if-the-pipe-type-is-bulk.patch usb-serial-fix-memleak-in-driver-registration-error-path.patch usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch usb-serial-option-add-d-link-dwm-156-a3.patch usb-serial-option-add-support-for-telit-le920a4.patch usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch usb-xhci-fix-panic-if-disconnect.patch xhci-always-handle-command-ring-stopped-events.patch xhci-don-t-dereference-a-xhci-member-after-removing-xhci.patch --- diff --git a/queue-4.7/clk-renesas-r8a7795-fix-sd-clocks.patch b/queue-4.7/clk-renesas-r8a7795-fix-sd-clocks.patch new file mode 100644 index 00000000000..83b70d6bddd --- /dev/null +++ b/queue-4.7/clk-renesas-r8a7795-fix-sd-clocks.patch @@ -0,0 +1,52 @@ +From e0cb1b84163720ec67ff0e54397fd3f57ad4a4dd Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 10 Aug 2016 09:29:43 +0200 +Subject: clk: renesas: r8a7795: Fix SD clocks + +From: Yoshihiro Shimoda + +commit e0cb1b84163720ec67ff0e54397fd3f57ad4a4dd upstream. + +According to the datasheet, SDn clocks are from the SDSRC clock. And +the SDSRC has a 1/2 divider. So, we should have ".sdsrc" as an internal +core clock. Otherwise, since the sdhi driver will calculate clock for +a sd card using the wrong parent clock rate, and then performance will +be not good. + +Fixes: 90c073e53909da85 ("clk: shmobile: r8a7795: Add SD divider support") +Signed-off-by: Yoshihiro Shimoda +Acked-by: Dirk Behme +Tested-by: Wolfram Sang +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/renesas/r8a7795-cpg-mssr.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/clk/renesas/r8a7795-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c +@@ -91,6 +91,7 @@ static const struct cpg_core_clk r8a7795 + DEF_FIXED(".s1", CLK_S1, CLK_PLL1_DIV2, 3, 1), + DEF_FIXED(".s2", CLK_S2, CLK_PLL1_DIV2, 4, 1), + DEF_FIXED(".s3", CLK_S3, CLK_PLL1_DIV2, 6, 1), ++ DEF_FIXED(".sdsrc", CLK_SDSRC, CLK_PLL1_DIV2, 2, 1), + + /* Core Clock Outputs */ + DEF_FIXED("ztr", R8A7795_CLK_ZTR, CLK_PLL1_DIV2, 6, 1), +@@ -109,10 +110,10 @@ static const struct cpg_core_clk r8a7795 + DEF_FIXED("s3d2", R8A7795_CLK_S3D2, CLK_S3, 2, 1), + DEF_FIXED("s3d4", R8A7795_CLK_S3D4, CLK_S3, 4, 1), + +- DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_PLL1_DIV2, 0x0074), +- DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_PLL1_DIV2, 0x0078), +- DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_PLL1_DIV2, 0x0268), +- DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_PLL1_DIV2, 0x026c), ++ DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_SDSRC, 0x0074), ++ DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_SDSRC, 0x0078), ++ DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_SDSRC, 0x0268), ++ DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_SDSRC, 0x026c), + + DEF_FIXED("cl", R8A7795_CLK_CL, CLK_PLL1_DIV2, 48, 1), + DEF_FIXED("cp", R8A7795_CLK_CP, CLK_EXTAL, 2, 1), diff --git a/queue-4.7/parisc-fix-automatic-selection-of-cr16-clocksource.patch b/queue-4.7/parisc-fix-automatic-selection-of-cr16-clocksource.patch new file mode 100644 index 00000000000..c2b34e876bf --- /dev/null +++ b/queue-4.7/parisc-fix-automatic-selection-of-cr16-clocksource.patch @@ -0,0 +1,69 @@ +From ae141830b118c3fb5b7eab6fa7c8ab7b7224b0a4 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Fri, 19 Aug 2016 22:39:02 +0200 +Subject: parisc: Fix automatic selection of cr16 clocksource + +From: Helge Deller + +commit ae141830b118c3fb5b7eab6fa7c8ab7b7224b0a4 upstream. + +Commit 54b66800907 (parisc: Add native high-resolution sched_clock() +implementation) added support to use the CPU-internal cr16 counters as reliable +clocksource with the help of HAVE_UNSTABLE_SCHED_CLOCK. + +Sadly the commit missed to remove the hack which prevented cr16 to become the +default clocksource even on SMP systems. + +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/processor.c | 8 -------- + arch/parisc/kernel/time.c | 12 ------------ + 2 files changed, 20 deletions(-) + +--- a/arch/parisc/kernel/processor.c ++++ b/arch/parisc/kernel/processor.c +@@ -51,8 +51,6 @@ EXPORT_SYMBOL(_parisc_requires_coherency + + DEFINE_PER_CPU(struct cpuinfo_parisc, cpu_data); + +-extern int update_cr16_clocksource(void); /* from time.c */ +- + /* + ** PARISC CPU driver - claim "device" and initialize CPU data structures. + ** +@@ -228,12 +226,6 @@ static int processor_probe(struct parisc + } + #endif + +- /* If we've registered more than one cpu, +- * we'll use the jiffies clocksource since cr16 +- * is not synchronized between CPUs. +- */ +- update_cr16_clocksource(); +- + return 0; + } + +--- a/arch/parisc/kernel/time.c ++++ b/arch/parisc/kernel/time.c +@@ -220,18 +220,6 @@ static struct clocksource clocksource_cr + .flags = CLOCK_SOURCE_IS_CONTINUOUS, + }; + +-int update_cr16_clocksource(void) +-{ +- /* since the cr16 cycle counters are not synchronized across CPUs, +- we'll check if we should switch to a safe clocksource: */ +- if (clocksource_cr16.rating != 0 && num_online_cpus() > 1) { +- clocksource_change_rating(&clocksource_cr16, 0); +- return 1; +- } +- +- return 0; +-} +- + void __init start_cpu_itimer(void) + { + unsigned int cpu = smp_processor_id(); diff --git a/queue-4.7/series b/queue-4.7/series index 9fbbec2c23f..baa54c7028b 100644 --- a/queue-4.7/series +++ b/queue-4.7/series @@ -24,3 +24,31 @@ genirq-msi-make-sure-pci-msis-are-activated-early.patch crypto-caam-fix-non-hmac-hashes.patch crypto-caam-fix-echainiv-authenc-encrypt-shared-descriptor.patch crypto-caam-defer-aead_set_sh_desc-in-case-of-zero-authsize.patch +parisc-fix-automatic-selection-of-cr16-clocksource.patch +usb-ehci-change-order-of-register-cleanup-during-shutdown.patch +usb-devio-do-not-warn-when-allocation-fails.patch +usb-misc-usbtest-add-fix-for-driver-hang.patch +usb-misc-usbtest-usbtest_do_ioctl-may-return-positive-integer.patch +usb-dwc3-pci-add-intel-kabylake-pci-id.patch +usb-dwc3-gadget-increment-request-actual-once.patch +usb-dwc3-gadget-fix-for-short-pkts-during-chained-xfers.patch +usb-dwc3-gadget-always-cleanup-all-trbs.patch +usb-hub-fix-unbalanced-reference-count-memory-leak-deadlocks.patch +usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch +usb-hub-change-the-locking-in-hub_activate.patch +usb-renesas_usbhs-fix-receiving-data-corrupt-on-r-car-gen3-with-dmac.patch +usb-renesas_usbhs-clear-the-brdysts-in-usbhsg_ep_enable.patch +usb-renesas_usbhs-use-dmac-only-if-the-pipe-type-is-bulk.patch +clk-renesas-r8a7795-fix-sd-clocks.patch +usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch +usb-gadget-fsl_qe_udc-off-by-one-in-setup_received_handle.patch +usb-gadget-fix-gadgetfs-aio-support.patch +xhci-always-handle-command-ring-stopped-events.patch +usb-xhci-fix-panic-if-disconnect.patch +xhci-don-t-dereference-a-xhci-member-after-removing-xhci.patch +usb-serial-fix-memleak-in-driver-registration-error-path.patch +usb-serial-option-add-d-link-dwm-156-a3.patch +usb-serial-option-add-support-for-telit-le920a4.patch +usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch +usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch +uprobes-fix-the-memcg-accounting.patch diff --git a/queue-4.7/uprobes-fix-the-memcg-accounting.patch b/queue-4.7/uprobes-fix-the-memcg-accounting.patch new file mode 100644 index 00000000000..9659057c744 --- /dev/null +++ b/queue-4.7/uprobes-fix-the-memcg-accounting.patch @@ -0,0 +1,60 @@ +From 6c4687cc17a788a6dd8de3e27dbeabb7cbd3e066 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Wed, 17 Aug 2016 17:36:29 +0200 +Subject: uprobes: Fix the memcg accounting + +From: Oleg Nesterov + +commit 6c4687cc17a788a6dd8de3e27dbeabb7cbd3e066 upstream. + +__replace_page() wronlgy calls mem_cgroup_cancel_charge() in "success" path, +it should only do this if page_check_address() fails. + +This means that every enable/disable leads to unbalanced mem_cgroup_uncharge() +from put_page(old_page), it is trivial to underflow the page_counter->count +and trigger OOM. + +Reported-and-tested-by: Brenden Blanco +Signed-off-by: Oleg Nesterov +Reviewed-by: Johannes Weiner +Acked-by: Michal Hocko +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: Arnaldo Carvalho de Melo +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Vladimir Davydov +Fixes: 00501b531c47 ("mm: memcontrol: rewrite charge API") +Link: http://lkml.kernel.org/r/20160817153629.GB29724@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/uprobes.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -172,8 +172,10 @@ static int __replace_page(struct vm_area + mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); + err = -EAGAIN; + ptep = page_check_address(page, mm, addr, &ptl, 0); +- if (!ptep) ++ if (!ptep) { ++ mem_cgroup_cancel_charge(kpage, memcg, false); + goto unlock; ++ } + + get_page(kpage); + page_add_new_anon_rmap(kpage, vma, addr, false); +@@ -200,7 +202,6 @@ static int __replace_page(struct vm_area + + err = 0; + unlock: +- mem_cgroup_cancel_charge(kpage, memcg, false); + mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); + unlock_page(page); + return err; diff --git a/queue-4.7/usb-devio-do-not-warn-when-allocation-fails.patch b/queue-4.7/usb-devio-do-not-warn-when-allocation-fails.patch new file mode 100644 index 00000000000..914677f06cb --- /dev/null +++ b/queue-4.7/usb-devio-do-not-warn-when-allocation-fails.patch @@ -0,0 +1,65 @@ +From 70f7ca9a0262784d0b80727860a63d64ab228e7b Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Wed, 15 Jun 2016 15:56:11 +0200 +Subject: usb: devio, do not warn when allocation fails + +From: Jiri Slaby + +commit 70f7ca9a0262784d0b80727860a63d64ab228e7b upstream. + +usbdev_mmap allocates a buffer. The size of the buffer is determined +by a user. So with this code (no need to be root): + + int fd = open("/dev/bus/usb/001/001", O_RDONLY); + mmap(NULL, 0x800000, PROT_READ, MAP_SHARED, fd, 0); + +we can see a warning: + +WARNING: CPU: 0 PID: 21771 at ../mm/page_alloc.c:3563 __alloc_pages_slowpath+0x1036/0x16e0() +... +Call Trace: + [] ? warn_slowpath_null+0x2e/0x40 + [] ? __alloc_pages_slowpath+0x1036/0x16e0 + [] ? warn_alloc_failed+0x250/0x250 + [] ? get_page_from_freelist+0x75b/0x28b0 + [] ? __alloc_pages_nodemask+0x583/0x6b0 + [] ? __alloc_pages_slowpath+0x16e0/0x16e0 + [] ? dma_generic_alloc_coherent+0x104/0x220 + [] ? hcd_buffer_alloc+0x1d6/0x3e0 [usbcore] + [] ? hcd_buffer_destroy+0xa0/0xa0 [usbcore] + [] ? usb_alloc_coherent+0x65/0x90 [usbcore] + [] ? usbdev_mmap+0x1a5/0x770 [usbcore] +... + +Allocations like this one should be marked as __GFP_NOWARN. So do so. + +The size could be also clipped by something like: + if (size >= (1 << (MAX_ORDER + PAGE_SHIFT - 1))) + return -ENOMEM; +But I think the overall limit of 16M (by usbfs_increase_memory_usage) +is enough, so that we only silence the warning here. + +Signed-off-by: Jiri Slaby +Cc: Greg Kroah-Hartman +Cc: Alan Stern +Cc: Steinar H. Gunderson +Cc: Markus Rechberger +Fixes: f7d34b445a (USB: Add support for usbfs zerocopy.) +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file + goto error_decrease_mem; + } + +- mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle); ++ mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN, ++ &dma_handle); + if (!mem) { + ret = -ENOMEM; + goto error_free_usbm; diff --git a/queue-4.7/usb-dwc3-gadget-always-cleanup-all-trbs.patch b/queue-4.7/usb-dwc3-gadget-always-cleanup-all-trbs.patch new file mode 100644 index 00000000000..0c672bfeb0b --- /dev/null +++ b/queue-4.7/usb-dwc3-gadget-always-cleanup-all-trbs.patch @@ -0,0 +1,31 @@ +From 7c705dfe2ebe731c8fd068623b6b4df2d3512c08 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Wed, 10 Aug 2016 12:35:30 +0300 +Subject: usb: dwc3: gadget: always cleanup all TRBs + +From: Felipe Balbi + +commit 7c705dfe2ebe731c8fd068623b6b4df2d3512c08 upstream. + +If we stop earlier due to short packet, we will +not be able to giveback all TRBs. + +Cc: Brian E Rogers +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1969,7 +1969,7 @@ static int __dwc3_cleanup_done_trbs(stru + s_pkt = 1; + } + +- if (s_pkt) ++ if (s_pkt && !chain) + return 1; + if ((event->status & DEPEVT_STATUS_LST) && + (trb->ctrl & (DWC3_TRB_CTRL_LST | diff --git a/queue-4.7/usb-dwc3-gadget-fix-for-short-pkts-during-chained-xfers.patch b/queue-4.7/usb-dwc3-gadget-fix-for-short-pkts-during-chained-xfers.patch new file mode 100644 index 00000000000..30d026dff25 --- /dev/null +++ b/queue-4.7/usb-dwc3-gadget-fix-for-short-pkts-during-chained-xfers.patch @@ -0,0 +1,93 @@ +From e5b36ae2f851024d43c76e51f395d32ce8d769ce Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Wed, 10 Aug 2016 11:13:26 +0300 +Subject: usb: dwc3: gadget: fix for short pkts during chained xfers + +From: Felipe Balbi + +commit e5b36ae2f851024d43c76e51f395d32ce8d769ce upstream. + +DWC3 has one interesting peculiarity with chained +transfers. If we setup N chained transfers and we +get a short packet before processing all N TRBs, +DWC3 will (conditionally) issue a XferComplete or +XferInProgress event and retire all TRBs from the +one which got a short packet to the last without +clearing their HWO bits. + +This means SW must clear HWO bit manually, which +this patch is doing. + +Cc: Brian E Rogers +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1897,7 +1897,8 @@ static void dwc3_gadget_free_endpoints(s + + static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, + struct dwc3_request *req, struct dwc3_trb *trb, +- const struct dwc3_event_depevt *event, int status) ++ const struct dwc3_event_depevt *event, int status, ++ int chain) + { + unsigned int count; + unsigned int s_pkt = 0; +@@ -1905,6 +1906,19 @@ static int __dwc3_cleanup_done_trbs(stru + + trace_dwc3_complete_trb(dep, trb); + ++ /* ++ * If we're in the middle of series of chained TRBs and we ++ * receive a short transfer along the way, DWC3 will skip ++ * through all TRBs including the last TRB in the chain (the ++ * where CHN bit is zero. DWC3 will also avoid clearing HWO ++ * bit and SW has to do it manually. ++ * ++ * We're going to do that here to avoid problems of HW trying ++ * to use bogus TRBs for transfers. ++ */ ++ if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO)) ++ trb->ctrl &= ~DWC3_TRB_CTRL_HWO; ++ + if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN) + /* + * We continue despite the error. There is not much we +@@ -1916,6 +1930,7 @@ static int __dwc3_cleanup_done_trbs(stru + */ + dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n", + dep->name, trb); ++ + count = trb->size & DWC3_TRB_SIZE_MASK; + + if (dep->direction) { +@@ -1977,10 +1992,13 @@ static int dwc3_cleanup_done_reqs(struct + int ret; + + do { ++ int chain; ++ + req = next_request(&dep->started_list); + if (WARN_ON_ONCE(!req)) + return 1; + ++ chain = req->request.num_mapped_sgs > 0; + i = 0; + do { + slot = req->first_trb_index + i; +@@ -1990,9 +2008,8 @@ static int dwc3_cleanup_done_reqs(struct + trb = &dep->trb_pool[slot]; + count += trb->size & DWC3_TRB_SIZE_MASK; + +- + ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, +- event, status); ++ event, status, chain); + if (ret) + break; + } while (++i < req->request.num_mapped_sgs); diff --git a/queue-4.7/usb-dwc3-gadget-increment-request-actual-once.patch b/queue-4.7/usb-dwc3-gadget-increment-request-actual-once.patch new file mode 100644 index 00000000000..77dbf1246cc --- /dev/null +++ b/queue-4.7/usb-dwc3-gadget-increment-request-actual-once.patch @@ -0,0 +1,74 @@ +From c7de573471832dff7d31f0c13b0f143d6f017799 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Fri, 29 Jul 2016 03:17:58 +0300 +Subject: usb: dwc3: gadget: increment request->actual once + +From: Felipe Balbi + +commit c7de573471832dff7d31f0c13b0f143d6f017799 upstream. + +When using SG lists, we would end up setting +request->actual to: + + num_mapped_sgs * (request->length - count) + +Let's fix that up by incrementing request->actual +only once. + +Reported-by: Brian E Rogers +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1954,14 +1954,6 @@ static int __dwc3_cleanup_done_trbs(stru + s_pkt = 1; + } + +- /* +- * We assume here we will always receive the entire data block +- * which we should receive. Meaning, if we program RX to +- * receive 4K but we receive only 2K, we assume that's all we +- * should receive and we simply bounce the request back to the +- * gadget driver for further processing. +- */ +- req->request.actual += req->request.length - count; + if (s_pkt) + return 1; + if ((event->status & DEPEVT_STATUS_LST) && +@@ -1981,6 +1973,7 @@ static int dwc3_cleanup_done_reqs(struct + struct dwc3_trb *trb; + unsigned int slot; + unsigned int i; ++ int count = 0; + int ret; + + do { +@@ -1995,6 +1988,8 @@ static int dwc3_cleanup_done_reqs(struct + slot++; + slot %= DWC3_TRB_NUM; + trb = &dep->trb_pool[slot]; ++ count += trb->size & DWC3_TRB_SIZE_MASK; ++ + + ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, + event, status); +@@ -2002,6 +1997,14 @@ static int dwc3_cleanup_done_reqs(struct + break; + } while (++i < req->request.num_mapped_sgs); + ++ /* ++ * We assume here we will always receive the entire data block ++ * which we should receive. Meaning, if we program RX to ++ * receive 4K but we receive only 2K, we assume that's all we ++ * should receive and we simply bounce the request back to the ++ * gadget driver for further processing. ++ */ ++ req->request.actual += req->request.length - count; + dwc3_gadget_giveback(dep, req, status); + + if (ret) diff --git a/queue-4.7/usb-dwc3-pci-add-intel-kabylake-pci-id.patch b/queue-4.7/usb-dwc3-pci-add-intel-kabylake-pci-id.patch new file mode 100644 index 00000000000..3e5b80fff2d --- /dev/null +++ b/queue-4.7/usb-dwc3-pci-add-intel-kabylake-pci-id.patch @@ -0,0 +1,38 @@ +From 4491ed5042f0419b22a4b08331adb54af31e2caa Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Fri, 1 Apr 2016 17:13:11 +0300 +Subject: usb: dwc3: pci: add Intel Kabylake PCI ID + +From: Heikki Krogerus + +commit 4491ed5042f0419b22a4b08331adb54af31e2caa upstream. + +Intel Kabylake PCH has the same DWC3 than Intel +Sunrisepoint. Add the new ID to the supported devices. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -37,6 +37,7 @@ + #define PCI_DEVICE_ID_INTEL_BXT 0x0aaa + #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa + #define PCI_DEVICE_ID_INTEL_APL 0x5aaa ++#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0 + + static const struct acpi_gpio_params reset_gpios = { 0, 0, false }; + static const struct acpi_gpio_params cs_gpios = { 1, 0, false }; +@@ -214,6 +215,7 @@ static const struct pci_device_id dwc3_p + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), }, + { } /* Terminating Entry */ + }; diff --git a/queue-4.7/usb-ehci-change-order-of-register-cleanup-during-shutdown.patch b/queue-4.7/usb-ehci-change-order-of-register-cleanup-during-shutdown.patch new file mode 100644 index 00000000000..1ac6f5683bc --- /dev/null +++ b/queue-4.7/usb-ehci-change-order-of-register-cleanup-during-shutdown.patch @@ -0,0 +1,42 @@ +From bc337b51508beb2d039aff5074a76cfe1c212030 Mon Sep 17 00:00:00 2001 +From: Marc Ohlf +Date: Wed, 3 Aug 2016 11:51:54 +0200 +Subject: usb: ehci: change order of register cleanup during shutdown + +From: Marc Ohlf + +commit bc337b51508beb2d039aff5074a76cfe1c212030 upstream. + +In ehci_turn_off_all_ports() all EHCI port registers are cleared to zero. +On some hardware, this can lead to an system hang, +when ehci_port_power() accesses the already cleared registers. + +This patch changes the order of cleanup. +First call ehci_port_power() which respects the current bits in +port status registers +and afterwards cleanup the hard way by setting everything to zero. + +Signed-off-by: Marc Ohlf +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hcd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(stru + int port = HCS_N_PORTS(ehci->hcs_params); + + while (port--) { +- ehci_writel(ehci, PORT_RWC_BITS, +- &ehci->regs->port_status[port]); + spin_unlock_irq(&ehci->lock); + ehci_port_power(ehci, port, false); + spin_lock_irq(&ehci->lock); ++ ehci_writel(ehci, PORT_RWC_BITS, ++ &ehci->regs->port_status[port]); + } + } + diff --git a/queue-4.7/usb-gadget-fix-gadgetfs-aio-support.patch b/queue-4.7/usb-gadget-fix-gadgetfs-aio-support.patch new file mode 100644 index 00000000000..f6ccffdbd05 --- /dev/null +++ b/queue-4.7/usb-gadget-fix-gadgetfs-aio-support.patch @@ -0,0 +1,31 @@ +From 327b21da884fe1a29f733e41792ddd53e4a30379 Mon Sep 17 00:00:00 2001 +From: Mathieu Laurendeau +Date: Fri, 15 Jul 2016 14:58:41 +0200 +Subject: usb/gadget: fix gadgetfs aio support. + +From: Mathieu Laurendeau + +commit 327b21da884fe1a29f733e41792ddd53e4a30379 upstream. + +Fix io submissions failing with ENODEV. + +Signed-off-by: Mathieu Laurendeau +Fixes: 7fe3976e0f3a ("gadget: switch ep_io_operations to ->read_iter/->write_iter") +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/legacy/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb + */ + spin_lock_irq(&epdata->dev->lock); + value = -ENODEV; +- if (unlikely(epdata->ep)) ++ if (unlikely(epdata->ep == NULL)) + goto fail; + + req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC); diff --git a/queue-4.7/usb-gadget-fsl_qe_udc-off-by-one-in-setup_received_handle.patch b/queue-4.7/usb-gadget-fsl_qe_udc-off-by-one-in-setup_received_handle.patch new file mode 100644 index 00000000000..88d3171350b --- /dev/null +++ b/queue-4.7/usb-gadget-fsl_qe_udc-off-by-one-in-setup_received_handle.patch @@ -0,0 +1,32 @@ +From 7442e6db5bdd0dce4615205508301f9b22e502d6 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 13 Jul 2016 13:14:33 +0300 +Subject: usb: gadget: fsl_qe_udc: off by one in setup_received_handle() + +From: Dan Carpenter + +commit 7442e6db5bdd0dce4615205508301f9b22e502d6 upstream. + +The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=. + +Fixes: 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver') +Acked-by: Peter Chen +Signed-off-by: Dan Carpenter +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/fsl_qe_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/fsl_qe_udc.c ++++ b/drivers/usb/gadget/udc/fsl_qe_udc.c +@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct + struct qe_ep *ep; + + if (wValue != 0 || wLength != 0 +- || pipe > USB_MAX_ENDPOINTS) ++ || pipe >= USB_MAX_ENDPOINTS) + break; + ep = &udc->eps[pipe]; + diff --git a/queue-4.7/usb-hub-change-the-locking-in-hub_activate.patch b/queue-4.7/usb-hub-change-the-locking-in-hub_activate.patch new file mode 100644 index 00000000000..b87553dcd5f --- /dev/null +++ b/queue-4.7/usb-hub-change-the-locking-in-hub_activate.patch @@ -0,0 +1,54 @@ +From 07d316a22e119fa301fd7dba7f1e1adfd4f72c05 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 5 Aug 2016 11:51:30 -0400 +Subject: USB: hub: change the locking in hub_activate + +From: Alan Stern + +commit 07d316a22e119fa301fd7dba7f1e1adfd4f72c05 upstream. + +The locking in hub_activate() is not adequate to provide full mutual +exclusion with hub_quiesce(). The subroutine locks the hub's +usb_interface, but the callers of hub_quiesce() (such as +hub_pre_reset() and hub_event()) hold the lock to the hub's +usb_device. + +This patch changes hub_activate() to make it acquire the same lock as +those other routines. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1052,7 +1052,7 @@ static void hub_activate(struct usb_hub + + /* Continue a partial initialization */ + if (type == HUB_INIT2 || type == HUB_INIT3) { +- device_lock(hub->intfdev); ++ device_lock(&hdev->dev); + + /* Was the hub disconnected while we were waiting? */ + if (hub->disconnected) +@@ -1259,7 +1259,7 @@ static void hub_activate(struct usb_hub + queue_delayed_work(system_power_efficient_wq, + &hub->init_work, + msecs_to_jiffies(delay)); +- device_unlock(hub->intfdev); ++ device_unlock(&hdev->dev); + return; /* Continues at init3: below */ + } else { + msleep(delay); +@@ -1282,7 +1282,7 @@ static void hub_activate(struct usb_hub + /* Allow autosuspend if it was suppressed */ + disconnected: + usb_autopm_put_interface_async(to_usb_interface(hub->intfdev)); +- device_unlock(hub->intfdev); ++ device_unlock(&hdev->dev); + } + + kref_put(&hub->kref, hub_release); diff --git a/queue-4.7/usb-hub-fix-unbalanced-reference-count-memory-leak-deadlocks.patch b/queue-4.7/usb-hub-fix-unbalanced-reference-count-memory-leak-deadlocks.patch new file mode 100644 index 00000000000..17ed3bc8a53 --- /dev/null +++ b/queue-4.7/usb-hub-fix-unbalanced-reference-count-memory-leak-deadlocks.patch @@ -0,0 +1,79 @@ +From 6bb47e8ab98accb1319bd43c64966340ba3bba9a Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Thu, 4 Aug 2016 13:32:22 -0700 +Subject: usb: hub: Fix unbalanced reference count/memory leak/deadlocks + +From: Viresh Kumar + +commit 6bb47e8ab98accb1319bd43c64966340ba3bba9a upstream. + +Memory leak and unbalanced reference count: + +If the hub gets disconnected while the core is still activating it, this +can result in leaking memory of few USB structures. + +This will happen if we have done a kref_get() from hub_activate() and +scheduled a delayed work item for HUB_INIT2/3. Now if hub_disconnect() +gets called before the delayed work expires, then we will cancel the +work from hub_quiesce(), but wouldn't do a kref_put(). And so the +unbalance. + +kmemleak reports this as (with the commit e50293ef9775 backported to +3.10 kernel with other changes, though the same is true for mainline as +well): + +unreferenced object 0xffffffc08af5b800 (size 1024): + comm "khubd", pid 73, jiffies 4295051211 (age 6482.350s) + hex dump (first 32 bytes): + 30 68 f3 8c c0 ff ff ff 00 a0 b2 2e c0 ff ff ff 0h.............. + 01 00 00 00 00 00 00 00 00 94 7d 40 c0 ff ff ff ..........}@.... + backtrace: + [] create_object+0x148/0x2a0 + [] kmemleak_alloc+0x80/0xbc + [] kmem_cache_alloc_trace+0x120/0x1ac + [] hub_probe+0x120/0xb84 + [] usb_probe_interface+0x1ec/0x298 + [] driver_probe_device+0x160/0x374 + [] __device_attach+0x28/0x4c + [] bus_for_each_drv+0x78/0xac + [] device_attach+0x6c/0x9c + [] bus_probe_device+0x28/0xa0 + [] device_add+0x324/0x604 + [] usb_set_configuration+0x660/0x6cc + [] generic_probe+0x44/0x84 + [] usb_probe_device+0x54/0x74 + [] driver_probe_device+0x160/0x374 + [] __device_attach+0x28/0x4c + +Deadlocks: + +If the hub gets disconnected early enough (i.e. before INIT2/INIT3 are +finished and the init_work is still queued), the core may call +hub_quiesce() after acquiring interface device locks and it will wait +for the work to be cancelled synchronously. But if the work handler is +already running in parallel, it may try to acquire the same interface +device lock and this may result in deadlock. + +Fix both the issues by removing the call to cancel_delayed_work_sync(). + +Fixes: e50293ef9775 ("USB: fix invalid memory access in hub_activate()") +Reported-by: Manu Gautam +Signed-off-by: Viresh Kumar +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1315,8 +1315,6 @@ static void hub_quiesce(struct usb_hub * + struct usb_device *hdev = hub->hdev; + int i; + +- cancel_delayed_work_sync(&hub->init_work); +- + /* hub_wq and related activity won't re-trigger */ + hub->quiescing = 1; + diff --git a/queue-4.7/usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch b/queue-4.7/usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch new file mode 100644 index 00000000000..a03706779f5 --- /dev/null +++ b/queue-4.7/usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch @@ -0,0 +1,64 @@ +From ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 5 Aug 2016 11:49:45 -0400 +Subject: USB: hub: fix up early-exit pathway in hub_activate + +From: Alan Stern + +commit ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 upstream. + +The early-exit pathway in hub_activate, added by commit e50293ef9775 +("USB: fix invalid memory access in hub_activate()") needs +improvement. It duplicates code that is already present at the end of +the subroutine, and it neglects to undo the effect of a +usb_autopm_get_interface_no_resume() call. + +This patch fixes both problems by making the early-exit pathway jump +directly to the end of the subroutine. It simplifies the code at the +end by merging two conditionals that actually test the same condition +although they appear different: If type < HUB_INIT3 then type must be +either HUB_INIT2 or HUB_INIT, and it can't be HUB_INIT because in that +case the subroutine would have exited earlier. + +Signed-off-by: Alan Stern +Reviewed-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1055,11 +1055,8 @@ static void hub_activate(struct usb_hub + device_lock(hub->intfdev); + + /* Was the hub disconnected while we were waiting? */ +- if (hub->disconnected) { +- device_unlock(hub->intfdev); +- kref_put(&hub->kref, hub_release); +- return; +- } ++ if (hub->disconnected) ++ goto disconnected; + if (type == HUB_INIT2) + goto init2; + goto init3; +@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub + /* Scan all ports that need attention */ + kick_hub_wq(hub); + +- /* Allow autosuspend if it was suppressed */ +- if (type <= HUB_INIT3) ++ if (type == HUB_INIT2 || type == HUB_INIT3) { ++ /* Allow autosuspend if it was suppressed */ ++ disconnected: + usb_autopm_put_interface_async(to_usb_interface(hub->intfdev)); +- +- if (type == HUB_INIT2 || type == HUB_INIT3) + device_unlock(hub->intfdev); ++ } + + kref_put(&hub->kref, hub_release); + } diff --git a/queue-4.7/usb-misc-usbtest-add-fix-for-driver-hang.patch b/queue-4.7/usb-misc-usbtest-add-fix-for-driver-hang.patch new file mode 100644 index 00000000000..ba631bbf767 --- /dev/null +++ b/queue-4.7/usb-misc-usbtest-add-fix-for-driver-hang.patch @@ -0,0 +1,50 @@ +From 539587511835ea12d8daa444cbed766cf2bc3612 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Thu, 11 Aug 2016 10:31:14 +0800 +Subject: usb: misc: usbtest: add fix for driver hang + +From: Lu Baolu + +commit 539587511835ea12d8daa444cbed766cf2bc3612 upstream. + +In sg_timeout(), req->status is set to "-ETIMEDOUT" before calling +into usb_sg_cancel(). usb_sg_cancel() will do nothing and return +directly if req->status has been set to a non-zero value. This will +cause driver hang whenever transfer time out is triggered. + +This patch fixes this issue. It could be backported to stable kernel +with version later than v3.15. + +Cc: Alan Stern +Signed-off-by: Lu Baolu +Suggested-by: Alan Stern +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/usbtest.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _re + { + struct usb_sg_request *req = (struct usb_sg_request *) _req; + +- req->status = -ETIMEDOUT; + usb_sg_cancel(req); + } + +@@ -616,8 +615,10 @@ static int perform_sglist( + mod_timer(&sg_timer, jiffies + + msecs_to_jiffies(SIMPLE_IO_TIMEOUT)); + usb_sg_wait(req); +- del_timer_sync(&sg_timer); +- retval = req->status; ++ if (!del_timer_sync(&sg_timer)) ++ retval = -ETIMEDOUT; ++ else ++ retval = req->status; + + /* FIXME check resulting data pattern */ + diff --git a/queue-4.7/usb-misc-usbtest-usbtest_do_ioctl-may-return-positive-integer.patch b/queue-4.7/usb-misc-usbtest-usbtest_do_ioctl-may-return-positive-integer.patch new file mode 100644 index 00000000000..bd217473361 --- /dev/null +++ b/queue-4.7/usb-misc-usbtest-usbtest_do_ioctl-may-return-positive-integer.patch @@ -0,0 +1,35 @@ +From 528d28138f91009f230903bd89ccd44719667831 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 26 Jul 2016 16:01:30 +0800 +Subject: usb: misc: usbtest: usbtest_do_ioctl may return positive integer + +From: Peter Chen + +commit 528d28138f91009f230903bd89ccd44719667831 upstream. + +For case 14 and case 21, their correct return value is the number +of bytes transferred, so it is a positive integer. But in usbtest_ioctl, +it takes non-zero as false return value for usbtest_do_ioctl, so +it will treat the correct test as wrong test, then the time on +tests will be the minus value. + +Signed-off-by: Peter Chen +Fixes: 18fc4ebdc705 ("usb: misc: usbtest: Remove timeval usage") +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/usbtest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/usbtest.c ++++ b/drivers/usb/misc/usbtest.c +@@ -2603,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf + ktime_get_ts64(&start); + + retval = usbtest_do_ioctl(intf, param_32); +- if (retval) ++ if (retval < 0) + goto free_mutex; + + ktime_get_ts64(&end); diff --git a/queue-4.7/usb-renesas_usbhs-clear-the-brdysts-in-usbhsg_ep_enable.patch b/queue-4.7/usb-renesas_usbhs-clear-the-brdysts-in-usbhsg_ep_enable.patch new file mode 100644 index 00000000000..221c1b19d43 --- /dev/null +++ b/queue-4.7/usb-renesas_usbhs-clear-the-brdysts-in-usbhsg_ep_enable.patch @@ -0,0 +1,52 @@ +From 9ab967e6db7412b675ecbff80d5371d53c82cb2e Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Mon, 8 Aug 2016 21:50:52 +0900 +Subject: usb: renesas_usbhs: clear the BRDYSTS in usbhsg_ep_enable() + +From: Yoshihiro Shimoda + +commit 9ab967e6db7412b675ecbff80d5371d53c82cb2e upstream. + +This patch fixes an issue that unexpected BRDY interruption happens +when the usb_ep_{enable,disable}() are called with different direction. +In this case, the driver will cause the following message: + + renesas_usbhs e6590000.usb: irq_ready run_error 1 : -16 + +This issue causes the followings: + 1) A pipe is enabled as transmission + 2) The pipe sent a data + 3) The pipe is disabled and re-enabled as reception. + 4) The pipe got a queue + +Since the driver doesn't clear the BRDYSTS flags after 2) above, the issue +happens. If we add such clearing the flags into the driver, the code will +become complicate. So, this patch clears the BRDYSTS flag of reception in +usbhsg_ep_enable() to avoid complicate. + +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/mod_gadget.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_e + * use dmaengine if possible. + * It will use pio handler if impossible. + */ +- if (usb_endpoint_dir_in(desc)) ++ if (usb_endpoint_dir_in(desc)) { + pipe->handler = &usbhs_fifo_dma_push_handler; +- else ++ } else { + pipe->handler = &usbhs_fifo_dma_pop_handler; ++ usbhs_xxxsts_clear(priv, BRDYSTS, ++ usbhs_pipe_number(pipe)); ++ } + + ret = 0; + } diff --git a/queue-4.7/usb-renesas_usbhs-fix-receiving-data-corrupt-on-r-car-gen3-with-dmac.patch b/queue-4.7/usb-renesas_usbhs-fix-receiving-data-corrupt-on-r-car-gen3-with-dmac.patch new file mode 100644 index 00000000000..c09f162f9ca --- /dev/null +++ b/queue-4.7/usb-renesas_usbhs-fix-receiving-data-corrupt-on-r-car-gen3-with-dmac.patch @@ -0,0 +1,35 @@ +From 772ce81264b179c0e61340998e3b29e900b2fa6d Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Mon, 8 Aug 2016 21:50:51 +0900 +Subject: usb: renesas_usbhs: Fix receiving data corrupt on R-Car Gen3 with dmac + +From: Yoshihiro Shimoda + +commit 772ce81264b179c0e61340998e3b29e900b2fa6d upstream. + +Since R-Car Gen3 SoC has the USB-DMAC, this driver should set +dparam->has_usb_dmac to 1. Otherwise, behavior of this driver and +the usb-dmac driver will be mismatch, then sometimes receiving data will +be corrupt. + +Fixes: de18757e272d ("usb: renesas_usbhs: add R-Car Gen3 power control") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/renesas_usbhs/common.c ++++ b/drivers/usb/renesas_usbhs/common.c +@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_inf + if (gpio > 0) + dparam->enable_gpio = gpio; + +- if (dparam->type == USBHS_TYPE_RCAR_GEN2) ++ if (dparam->type == USBHS_TYPE_RCAR_GEN2 || ++ dparam->type == USBHS_TYPE_RCAR_GEN3) + dparam->has_usb_dmac = 1; + + return info; diff --git a/queue-4.7/usb-renesas_usbhs-use-dmac-only-if-the-pipe-type-is-bulk.patch b/queue-4.7/usb-renesas_usbhs-use-dmac-only-if-the-pipe-type-is-bulk.patch new file mode 100644 index 00000000000..3824ff4b74b --- /dev/null +++ b/queue-4.7/usb-renesas_usbhs-use-dmac-only-if-the-pipe-type-is-bulk.patch @@ -0,0 +1,42 @@ +From 700aa7ff8d2c2b9cc669c99375e2ccd06d3cd38d Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Mon, 8 Aug 2016 21:50:53 +0900 +Subject: usb: renesas_usbhs: Use dmac only if the pipe type is bulk + +From: Yoshihiro Shimoda + +commit 700aa7ff8d2c2b9cc669c99375e2ccd06d3cd38d upstream. + +This patch fixes an issue that isochronous transfer's data is possible to +be lost as a workaround. Since this driver uses a workqueue to start +the dmac, the transfer is possible to be delayed when system load is high. + +Fixes: 6e4b74e4690d ("usb: renesas: fix scheduling in atomic context bug") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/fifo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struc + + /* use PIO if packet is less than pio_dma_border or pipe is DCP */ + if ((len < usbhs_get_dparam(priv, pio_dma_border)) || +- usbhs_pipe_is_dcp(pipe)) ++ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC)) + goto usbhsf_pio_prepare_push; + + /* check data length if this driver don't use USB-DMAC */ +@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_u + + /* use PIO if packet is less than pio_dma_border or pipe is DCP */ + if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) || +- usbhs_pipe_is_dcp(pipe)) ++ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC)) + goto usbhsf_pio_prepare_pop; + + fifo = usbhsf_get_dma_fifo(priv, pkt); diff --git a/queue-4.7/usb-serial-fix-memleak-in-driver-registration-error-path.patch b/queue-4.7/usb-serial-fix-memleak-in-driver-registration-error-path.patch new file mode 100644 index 00000000000..bedd3ee9208 --- /dev/null +++ b/queue-4.7/usb-serial-fix-memleak-in-driver-registration-error-path.patch @@ -0,0 +1,42 @@ +From 647024a7df36014bbc4479d92d88e6b77c0afcf6 Mon Sep 17 00:00:00 2001 +From: Alexey Klimov +Date: Mon, 8 Aug 2016 02:34:46 +0100 +Subject: USB: serial: fix memleak in driver-registration error path + +From: Alexey Klimov + +commit 647024a7df36014bbc4479d92d88e6b77c0afcf6 upstream. + +udriver struct allocated by kzalloc() will not be freed +if usb_register() and next calls fail. This patch fixes this +by adding one more step with kfree(udriver) in error path. + +Signed-off-by: Alexey Klimov +Acked-by: Alan Stern +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct u + + rc = usb_register(udriver); + if (rc) +- return rc; ++ goto failed_usb_register; + + for (sd = serial_drivers; *sd; ++sd) { + (*sd)->usb_driver = udriver; +@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct u + while (sd-- > serial_drivers) + usb_serial_deregister(*sd); + usb_deregister(udriver); ++failed_usb_register: ++ kfree(udriver); + return rc; + } + EXPORT_SYMBOL_GPL(usb_serial_register_drivers); diff --git a/queue-4.7/usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch b/queue-4.7/usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch new file mode 100644 index 00000000000..c5886a9f9ee --- /dev/null +++ b/queue-4.7/usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch @@ -0,0 +1,50 @@ +From ae34d12cc1e212ffcd92e069030e54dae69c832f Mon Sep 17 00:00:00 2001 +From: "Sheng-Hui J. Chu" +Date: Thu, 28 Jul 2016 17:01:45 -0400 +Subject: USB: serial: ftdi_sio: add device ID for WICED USB UART dev board + +From: Sheng-Hui J. Chu + +commit ae34d12cc1e212ffcd92e069030e54dae69c832f upstream. + +BCM20706V2_EVAL is a WICED dev board designed with FT2232H USB 2.0 +UART/FIFO IC. + +To support BCM920706V2_EVAL dev board for WICED development on Linux. +Add the VID(0a5c) and PID(6422) to ftdi_sio driver to allow loading +ftdi_sio for this board. + +Signed-off-by: Sheng-Hui J. Chu +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ + 2 files changed, 7 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1008,6 +1008,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, ++ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, + { } /* Terminating entry */ + }; + +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -673,6 +673,12 @@ + #define INTREPID_NEOVI_PID 0x0701 + + /* ++ * WICED USB UART ++ */ ++#define WICED_VID 0x0A5C ++#define WICED_USB20706V2_PID 0x6422 ++ ++/* + * Definitions for ID TECH (www.idt-net.com) devices + */ + #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */ diff --git a/queue-4.7/usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch b/queue-4.7/usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch new file mode 100644 index 00000000000..98ec4cc2000 --- /dev/null +++ b/queue-4.7/usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch @@ -0,0 +1,48 @@ +From 6977495c06f7f47636a076ee5a0ca571279d9697 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Robert=20Deli=C3=ABn?= +Date: Thu, 28 Jul 2016 18:52:55 +0000 +Subject: USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices + +From: Robert Deliën + +commit 6977495c06f7f47636a076ee5a0ca571279d9697 upstream. + +Ivium Technologies uses the FTDI VID with custom PIDs for their line of +electrochemical interfaces and the PalmSens they developed for PalmSens +BV. + +Signed-off-by: Robert Delien +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -648,6 +648,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) }, + { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) }, + { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) }, + { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -406,6 +406,12 @@ + #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2 + + /* ++ * Ivium Technologies product IDs ++ */ ++#define FTDI_PALMSENS_PID 0xf440 ++#define FTDI_IVIUM_XSTAT_PID 0xf441 ++ ++/* + * Linx Technologies product ids + */ + #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */ diff --git a/queue-4.7/usb-serial-option-add-d-link-dwm-156-a3.patch b/queue-4.7/usb-serial-option-add-d-link-dwm-156-a3.patch new file mode 100644 index 00000000000..629a4c6373d --- /dev/null +++ b/queue-4.7/usb-serial-option-add-d-link-dwm-156-a3.patch @@ -0,0 +1,37 @@ +From cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Sun, 24 Jul 2016 13:53:30 +0200 +Subject: USB: serial: option: add D-Link DWM-156/A3 + +From: Lubomir Rintel + +commit cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 upstream. + +The device has four interfaces; the three serial ports ought to be +handled by this driver: + +00 Diagnostic interface serial port +01 NMEA device serial port +02 Mass storage (sd card) +03 Modem serial port + +The other product ids listed in the Windows driver are present already. + +Signed-off-by: Lubomir Rintel +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1966,6 +1966,7 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, diff --git a/queue-4.7/usb-serial-option-add-support-for-telit-le920a4.patch b/queue-4.7/usb-serial-option-add-support-for-telit-le920a4.patch new file mode 100644 index 00000000000..08631885207 --- /dev/null +++ b/queue-4.7/usb-serial-option-add-support-for-telit-le920a4.patch @@ -0,0 +1,75 @@ +From 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Tue, 2 Aug 2016 11:29:25 +0200 +Subject: USB: serial: option: add support for Telit LE920A4 + +From: Daniele Palmas + +commit 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 upstream. + +This patch adds a set of compositions for Telit LE920A4. + +Compositions in short are: + +0x1207: tty + tty +0x1208: tty + adb + tty + tty +0x1211: tty + adb + ecm +0x1212: tty + adb +0x1213: ecm + tty +0x1214: tty + adb + ecm + tty + +telit_le922_blacklist_usbcfg3 is reused for compositions 0x1211 +and 0x1214 due to the same interfaces positions. + +Signed-off-by: Daniele Palmas +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -274,6 +274,12 @@ static void option_instat_callback(struc + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 + #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 ++#define TELIT_PRODUCT_LE920A4_1207 0x1207 ++#define TELIT_PRODUCT_LE920A4_1208 0x1208 ++#define TELIT_PRODUCT_LE920A4_1211 0x1211 ++#define TELIT_PRODUCT_LE920A4_1212 0x1212 ++#define TELIT_PRODUCT_LE920A4_1213 0x1213 ++#define TELIT_PRODUCT_LE920A4_1214 0x1214 + + /* ZTE PRODUCTS */ + #define ZTE_VENDOR_ID 0x19d2 +@@ -628,6 +634,11 @@ static const struct option_blacklist_inf + .reserved = BIT(1) | BIT(5), + }; + ++static const struct option_blacklist_info telit_le920a4_blacklist_1 = { ++ .sendsetup = BIT(0), ++ .reserved = BIT(1), ++}; ++ + static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { + .sendsetup = BIT(2), + .reserved = BIT(0) | BIT(1) | BIT(3), +@@ -1203,6 +1214,16 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212), ++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, diff --git a/queue-4.7/usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch b/queue-4.7/usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch new file mode 100644 index 00000000000..3ffc5a52dd8 --- /dev/null +++ b/queue-4.7/usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch @@ -0,0 +1,123 @@ +From aed9d65ac3278d4febd8665bd7db59ef53e825fe Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 1 Aug 2016 15:25:56 -0400 +Subject: USB: validate wMaxPacketValue entries in endpoint descriptors + +From: Alan Stern + +commit aed9d65ac3278d4febd8665bd7db59ef53e825fe upstream. + +Erroneous or malicious endpoint descriptors may have non-zero bits in +reserved positions, or out-of-bounds values. This patch helps prevent +these from causing problems by bounds-checking the wMaxPacketValue +entries in endpoint descriptors and capping the values at the maximum +allowed. + +This issue was first discovered and tests were conducted by Jake Lamberson +, an intern working for Rosie Hall. + +Signed-off-by: Alan Stern +Reported-by: roswest +Tested-by: roswest +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 66 +++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 63 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_compan + ep, buffer, size); + } + ++static const unsigned short low_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 8, ++ [USB_ENDPOINT_XFER_ISOC] = 0, ++ [USB_ENDPOINT_XFER_BULK] = 0, ++ [USB_ENDPOINT_XFER_INT] = 8, ++}; ++static const unsigned short full_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 64, ++ [USB_ENDPOINT_XFER_ISOC] = 1023, ++ [USB_ENDPOINT_XFER_BULK] = 64, ++ [USB_ENDPOINT_XFER_INT] = 64, ++}; ++static const unsigned short high_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 64, ++ [USB_ENDPOINT_XFER_ISOC] = 1024, ++ [USB_ENDPOINT_XFER_BULK] = 512, ++ [USB_ENDPOINT_XFER_INT] = 1023, ++}; ++static const unsigned short super_speed_maxpacket_maxes[4] = { ++ [USB_ENDPOINT_XFER_CONTROL] = 512, ++ [USB_ENDPOINT_XFER_ISOC] = 1024, ++ [USB_ENDPOINT_XFER_BULK] = 1024, ++ [USB_ENDPOINT_XFER_INT] = 1024, ++}; ++ + static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, + int asnum, struct usb_host_interface *ifp, int num_ep, + unsigned char *buffer, int size) +@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct dev + struct usb_endpoint_descriptor *d; + struct usb_host_endpoint *endpoint; + int n, i, j, retval; ++ unsigned int maxp; ++ const unsigned short *maxpacket_maxes; + + d = (struct usb_endpoint_descriptor *) buffer; + buffer += d->bLength; +@@ -286,6 +313,42 @@ static int usb_parse_endpoint(struct dev + endpoint->desc.wMaxPacketSize = cpu_to_le16(8); + } + ++ /* Validate the wMaxPacketSize field */ ++ maxp = usb_endpoint_maxp(&endpoint->desc); ++ ++ /* Find the highest legal maxpacket size for this endpoint */ ++ i = 0; /* additional transactions per microframe */ ++ switch (to_usb_device(ddev)->speed) { ++ case USB_SPEED_LOW: ++ maxpacket_maxes = low_speed_maxpacket_maxes; ++ break; ++ case USB_SPEED_FULL: ++ maxpacket_maxes = full_speed_maxpacket_maxes; ++ break; ++ case USB_SPEED_HIGH: ++ /* Bits 12..11 are allowed only for HS periodic endpoints */ ++ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { ++ i = maxp & (BIT(12) | BIT(11)); ++ maxp &= ~i; ++ } ++ /* fallthrough */ ++ default: ++ maxpacket_maxes = high_speed_maxpacket_maxes; ++ break; ++ case USB_SPEED_SUPER: ++ case USB_SPEED_SUPER_PLUS: ++ maxpacket_maxes = super_speed_maxpacket_maxes; ++ break; ++ } ++ j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)]; ++ ++ if (maxp > j) { ++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n", ++ cfgno, inum, asnum, d->bEndpointAddress, maxp, j); ++ maxp = j; ++ endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp); ++ } ++ + /* + * Some buggy high speed devices have bulk endpoints using + * maxpacket sizes other than 512. High speed HCDs may not +@@ -293,9 +356,6 @@ static int usb_parse_endpoint(struct dev + */ + if (to_usb_device(ddev)->speed == USB_SPEED_HIGH + && usb_endpoint_xfer_bulk(d)) { +- unsigned maxp; +- +- maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff; + if (maxp != 512) + dev_warn(ddev, "config %d interface %d altsetting %d " + "bulk endpoint 0x%X has invalid maxpacket %d\n", diff --git a/queue-4.7/usb-xhci-fix-panic-if-disconnect.patch b/queue-4.7/usb-xhci-fix-panic-if-disconnect.patch new file mode 100644 index 00000000000..5c91ed959c1 --- /dev/null +++ b/queue-4.7/usb-xhci-fix-panic-if-disconnect.patch @@ -0,0 +1,59 @@ +From 88716a93766b8f095cdef37a8e8f2c93aa233b21 Mon Sep 17 00:00:00 2001 +From: Jim Lin +Date: Tue, 16 Aug 2016 10:18:05 +0300 +Subject: usb: xhci: Fix panic if disconnect + +From: Jim Lin + +commit 88716a93766b8f095cdef37a8e8f2c93aa233b21 upstream. + +After a device is disconnected, xhci_stop_device() will be invoked +in xhci_bus_suspend(). +Also the "disconnect" IRQ will have ISR to invoke +xhci_free_virt_device() in this sequence. +xhci_irq -> xhci_handle_event -> handle_cmd_completion -> +xhci_handle_cmd_disable_slot -> xhci_free_virt_device + +If xhci->devs[slot_id] has been assigned to NULL in +xhci_free_virt_device(), then virt_dev->eps[i].ring in +xhci_stop_device() may point to an invlid address to cause kernel +panic. + +virt_dev = xhci->devs[slot_id]; +: +if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue) + +[] Unable to handle kernel paging request at virtual address 00001a68 +[] pgd=ffffffc001430000 +[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003, +*pmd=000000013c808003, *pte=0000000000000000 +[] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G U +[] Workqueue: pm pm_runtime_work +[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti: +ffffffc0bc0ec000 +[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4 + +This issue is found when running with realtek ethernet device +(0bda:8153). + +Signed-off-by: Jim Lin +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_ + + ret = 0; + virt_dev = xhci->devs[slot_id]; ++ if (!virt_dev) ++ return -ENODEV; ++ + cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO); + if (!cmd) { + xhci_dbg(xhci, "Couldn't allocate command structure.\n"); diff --git a/queue-4.7/xhci-always-handle-command-ring-stopped-events.patch b/queue-4.7/xhci-always-handle-command-ring-stopped-events.patch new file mode 100644 index 00000000000..54b3f09285f --- /dev/null +++ b/queue-4.7/xhci-always-handle-command-ring-stopped-events.patch @@ -0,0 +1,66 @@ +From 33be126510974e2eb9679f1ca9bca4f67ee4c4c7 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 16 Aug 2016 10:18:03 +0300 +Subject: xhci: always handle "Command Ring Stopped" events + +From: Mathias Nyman + +commit 33be126510974e2eb9679f1ca9bca4f67ee4c4c7 upstream. + +Fix "Command completion event does not match command" errors by always +handling the command ring stopped events. + +The command ring stopped event is generated as a result of aborting +or stopping the command ring with a register write. It is not caused +by a command in the command queue, and thus won't have a matching command +in the comman list. + +Solve it by handling the command ring stopped event before checking for a +matching command. + +In most command time out cases we abort the command ring, and get +a command ring stopped event. The events command pointer will point at +the current command ring dequeue, which in most cases matches the timed +out command in the command list, and no error messages are seen. + +If we instead get a command aborted event before the command ring stopped +event, the abort event will increse the command ring dequeue pointer, and +the following command ring stopped events command pointer will point at the +next, not yet queued command. This case triggered the error message + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1325,12 +1325,6 @@ static void handle_cmd_completion(struct + + cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list); + +- if (cmd->command_trb != xhci->cmd_ring->dequeue) { +- xhci_err(xhci, +- "Command completion event does not match command\n"); +- return; +- } +- + del_timer(&xhci->cmd_timer); + + trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event); +@@ -1342,6 +1336,13 @@ static void handle_cmd_completion(struct + xhci_handle_stopped_cmd_ring(xhci, cmd); + return; + } ++ ++ if (cmd->command_trb != xhci->cmd_ring->dequeue) { ++ xhci_err(xhci, ++ "Command completion event does not match command\n"); ++ return; ++ } ++ + /* + * Host aborted the command ring, check if the current command was + * supposed to be aborted, otherwise continue normally. diff --git a/queue-4.7/xhci-don-t-dereference-a-xhci-member-after-removing-xhci.patch b/queue-4.7/xhci-don-t-dereference-a-xhci-member-after-removing-xhci.patch new file mode 100644 index 00000000000..09651417530 --- /dev/null +++ b/queue-4.7/xhci-don-t-dereference-a-xhci-member-after-removing-xhci.patch @@ -0,0 +1,37 @@ +From f1f6d9a8b540df22b87a5bf6bc104edaade81f47 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 16 Aug 2016 10:18:06 +0300 +Subject: xhci: don't dereference a xhci member after removing xhci + +From: Mathias Nyman + +commit f1f6d9a8b540df22b87a5bf6bc104edaade81f47 upstream. + +Remove the hcd after checking for the xhci last quirks, not before. + +This caused a hang on a Alpine Ridge xhci based maching which remove +the whole xhci controller when unplugging the last usb device + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_d + usb_remove_hcd(xhci->shared_hcd); + usb_put_hcd(xhci->shared_hcd); + } +- usb_hcd_pci_remove(dev); + + /* Workaround for spurious wakeups at shutdown with HSW */ + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) + pci_set_power_state(dev, PCI_D3hot); ++ ++ usb_hcd_pci_remove(dev); + } + + #ifdef CONFIG_PM