From: Greg Kroah-Hartman Date: Mon, 18 Apr 2016 01:56:28 +0000 (+0900) Subject: 4.4-stable patches X-Git-Tag: v3.14.67~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=88dd83f5d5dcab93de43665973fde0c42af6824c;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-hda-fix-front-mic-problem-for-a-hp-desktop.patch alsa-hda-fix-headset-support-and-noise-on-hp-elitebook-755-g2.patch alsa-hda-fixup-speaker-pass-through-control-for-nid-0x14-on-alc225.patch alsa-hda-realtek-enable-the-alc292-dock-fixup-on-the-thinkpad-t460s.patch alsa-usb-audio-add-a-quirk-for-plantronics-bt300.patch alsa-usb-audio-add-a-sample-rate-quirk-for-phoenix-audio-tmx320.patch alsa-usb-audio-skip-volume-controls-triggers-hangup-on-dell-usb-dock.patch hid-usbhid-fix-inconsistent-reset-resume-reset-resume-behavior.patch hid-wacom-fix-bamboo-one-oops.patch revert-pci-add-helpers-to-manage-pci_dev-irq-and-pci_dev-irq_managed.patch revert-pci-x86-implement-pcibios_alloc_irq-and-pcibios_free_irq.patch revert-usb-hub-do-not-clear-bos-field-during-reset-device.patch revert-x86-pci-don-t-alloc-pcibios-irq-when-msi-is-enabled.patch staging-android-ion-set-the-length-of-the-dma-sg-entries-in-buffer.patch usbvision-fix-crash-on-detecting-device-with-invalid-configuration.patch usbvision-fix-overflow-of-interfaces-array.patch --- diff --git a/queue-4.4/alsa-hda-fix-front-mic-problem-for-a-hp-desktop.patch b/queue-4.4/alsa-hda-fix-front-mic-problem-for-a-hp-desktop.patch new file mode 100644 index 00000000000..dc278f7185b --- /dev/null +++ b/queue-4.4/alsa-hda-fix-front-mic-problem-for-a-hp-desktop.patch @@ -0,0 +1,54 @@ +From e549d190f7b5f94e9ab36bd965028112914d010d Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 1 Apr 2016 11:00:15 +0800 +Subject: ALSA: hda - fix front mic problem for a HP desktop + +From: Hui Wang + +commit e549d190f7b5f94e9ab36bd965028112914d010d upstream. + +The front mic jack (pink color) can't detect any plug or unplug. After +applying this fix, both detecting function and recording function +work well. + +BugLink: https://bugs.launchpad.net/bugs/1564712 +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4759,6 +4759,7 @@ enum { + ALC255_FIXUP_DELL_SPK_NOISE, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC280_FIXUP_HP_HEADSET_MIC, ++ ALC221_FIXUP_HP_FRONT_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5401,6 +5402,13 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MIC, + }, ++ [ALC221_FIXUP_HP_FRONT_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x02a19020 }, /* Front Mic */ ++ { } ++ }, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5506,6 +5514,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), diff --git a/queue-4.4/alsa-hda-fix-headset-support-and-noise-on-hp-elitebook-755-g2.patch b/queue-4.4/alsa-hda-fix-headset-support-and-noise-on-hp-elitebook-755-g2.patch new file mode 100644 index 00000000000..5cded3c1572 --- /dev/null +++ b/queue-4.4/alsa-hda-fix-headset-support-and-noise-on-hp-elitebook-755-g2.patch @@ -0,0 +1,53 @@ +From f883982dc1b117f04579f0896821cd9f2e397f94 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 25 Feb 2016 14:31:59 +0100 +Subject: ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 + +From: Takashi Iwai + +commit f883982dc1b117f04579f0896821cd9f2e397f94 upstream. + +HP EliteBook 755 G2 with ALC3228 (ALC280) codec [103c:221c] requires +the known fixup (ALC269_FIXUP_HEADSET_MIC) for making the headset mic +working. Also, it suffers from the loopback noise problem, so we +should disable aamix path as well. + +Reported-by: Derick Eddington +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4758,6 +4758,7 @@ enum { + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC280_FIXUP_HP_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5394,6 +5395,12 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC280_FIXUP_HP_HEADSET_MIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_disable_aamix, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MIC, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5498,6 +5505,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), diff --git a/queue-4.4/alsa-hda-fixup-speaker-pass-through-control-for-nid-0x14-on-alc225.patch b/queue-4.4/alsa-hda-fixup-speaker-pass-through-control-for-nid-0x14-on-alc225.patch new file mode 100644 index 00000000000..8ad448a8e85 --- /dev/null +++ b/queue-4.4/alsa-hda-fixup-speaker-pass-through-control-for-nid-0x14-on-alc225.patch @@ -0,0 +1,88 @@ +From 2ae955774f29bbd7d16149cb0ae8d0319bf2ecc4 Mon Sep 17 00:00:00 2001 +From: David Henningsson +Date: Thu, 25 Feb 2016 09:37:05 +0100 +Subject: ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225 + +From: David Henningsson + +commit 2ae955774f29bbd7d16149cb0ae8d0319bf2ecc4 upstream. + +On one of the machines we enable, we found that the actual speaker volume +did not always correspond to the volume set in alsamixer. This patch +fixes that problem. + +This patch was orginally written by Kailang @ Realtek, I've rebased it +to fit sound git master. + +BugLink: https://bugs.launchpad.net/bugs/1549660 +Co-Authored-By: Kailang +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3801,6 +3801,10 @@ static void alc_headset_mode_mic_in(stru + + static void alc_headset_mode_default(struct hda_codec *codec) + { ++ static struct coef_fw coef0225[] = { ++ UPDATE_COEF(0x45, 0x3f<<10, 0x34<<10), ++ {} ++ }; + static struct coef_fw coef0255[] = { + WRITE_COEF(0x45, 0xc089), + WRITE_COEF(0x45, 0xc489), +@@ -3842,6 +3846,9 @@ static void alc_headset_mode_default(str + }; + + switch (codec->core.vendor_id) { ++ case 0x10ec0225: ++ alc_process_coef_fw(codec, coef0225); ++ break; + case 0x10ec0255: + case 0x10ec0256: + alc_process_coef_fw(codec, coef0255); +@@ -4750,6 +4757,7 @@ enum { + ALC293_FIXUP_LENOVO_SPK_NOISE, + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, ++ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5375,6 +5383,17 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* Disable pass-through path for FRONT 14h */ ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 }, ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5648,10 +5667,10 @@ static const struct hda_model_fixup alc2 + {0x21, 0x03211020} + + static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { +- SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, + {0x14, 0x901701a0}), +- SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, + {0x14, 0x901701b0}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE, diff --git a/queue-4.4/alsa-hda-realtek-enable-the-alc292-dock-fixup-on-the-thinkpad-t460s.patch b/queue-4.4/alsa-hda-realtek-enable-the-alc292-dock-fixup-on-the-thinkpad-t460s.patch new file mode 100644 index 00000000000..f2492d7db99 --- /dev/null +++ b/queue-4.4/alsa-hda-realtek-enable-the-alc292-dock-fixup-on-the-thinkpad-t460s.patch @@ -0,0 +1,64 @@ +From c636b95ec5980345674ad7960a3c67135a84b687 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Mon, 11 Apr 2016 16:55:26 +0200 +Subject: ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s + +From: Sven Eckelmann + +commit c636b95ec5980345674ad7960a3c67135a84b687 upstream. + +The Lenovo Thinkpad T460s requires the alc_fixup_tpt440_dock as well in +order to get working sound output on the docking stations headphone jack. + +Patch tested on a Thinkpad T460s (20F9CT01WW) using a ThinkPad Ultradock +on kernel 4.4.6. + +Signed-off-by: Sven Eckelmann +Tested-by: Simon Wunderlich +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4760,6 +4760,7 @@ enum { + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, ++ ALC292_FIXUP_TPT460, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5409,6 +5410,12 @@ static const struct hda_fixup alc269_fix + { } + }, + }, ++ [ALC292_FIXUP_TPT460] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_tpt440_dock, ++ .chained = true, ++ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5563,7 +5570,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK), +- SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), ++ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), +@@ -5658,6 +5665,7 @@ static const struct hda_model_fixup alc2 + {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"}, + {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"}, + {.id = ALC292_FIXUP_TPT440, .name = "tpt440"}, ++ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"}, + {} + }; + #define ALC225_STANDARD_PINS \ diff --git a/queue-4.4/alsa-usb-audio-add-a-quirk-for-plantronics-bt300.patch b/queue-4.4/alsa-usb-audio-add-a-quirk-for-plantronics-bt300.patch new file mode 100644 index 00000000000..92a97a68f0b --- /dev/null +++ b/queue-4.4/alsa-usb-audio-add-a-quirk-for-plantronics-bt300.patch @@ -0,0 +1,31 @@ +From b4203ff5464da00b7812e7b480192745b0d66bbf Mon Sep 17 00:00:00 2001 +From: Dennis Kadioglu +Date: Wed, 6 Apr 2016 08:39:01 +0200 +Subject: ALSA: usb-audio: Add a quirk for Plantronics BT300 + +From: Dennis Kadioglu + +commit b4203ff5464da00b7812e7b480192745b0d66bbf upstream. + +Plantronics BT300 does not support reading the sample rate which leads +to many lines of "cannot get freq at ep 0x1". This patch adds the USB +ID of the BT300 to quirks.c and avoids those error messages. + +Signed-off-by: Dennis Kadioglu +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1135,6 +1135,7 @@ bool snd_usb_get_sample_rate_quirk(struc + case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */ + case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */ + case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */ ++ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */ + case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ diff --git a/queue-4.4/alsa-usb-audio-add-a-sample-rate-quirk-for-phoenix-audio-tmx320.patch b/queue-4.4/alsa-usb-audio-add-a-sample-rate-quirk-for-phoenix-audio-tmx320.patch new file mode 100644 index 00000000000..951dcea05f9 --- /dev/null +++ b/queue-4.4/alsa-usb-audio-add-a-sample-rate-quirk-for-phoenix-audio-tmx320.patch @@ -0,0 +1,36 @@ +From f03b24a851d32ca85dacab01785b24a7ee717d37 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 4 Apr 2016 11:47:50 +0200 +Subject: ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320 + +From: Takashi Iwai + +commit f03b24a851d32ca85dacab01785b24a7ee717d37 upstream. + +Phoenix Audio TMX320 gives the similar error when the sample rate is +asked: + usb 2-1.3: 2:1: cannot get freq at ep 0x85 + usb 2-1.3: 1:1: cannot get freq at ep 0x2 + .... + +Add the corresponding USB-device ID (1de7:0014) to +snd_usb_get_sample_rate_quirk() list. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110221 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1138,6 +1138,7 @@ bool snd_usb_get_sample_rate_quirk(struc + case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ ++ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ + case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */ + return true; + } diff --git a/queue-4.4/alsa-usb-audio-skip-volume-controls-triggers-hangup-on-dell-usb-dock.patch b/queue-4.4/alsa-usb-audio-skip-volume-controls-triggers-hangup-on-dell-usb-dock.patch new file mode 100644 index 00000000000..d55b3809186 --- /dev/null +++ b/queue-4.4/alsa-usb-audio-skip-volume-controls-triggers-hangup-on-dell-usb-dock.patch @@ -0,0 +1,57 @@ +From adcdd0d5a1cb779f6d455ae70882c19c527627a8 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Tue, 12 Apr 2016 10:55:03 +0800 +Subject: ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock + +From: Kailang Yang + +commit adcdd0d5a1cb779f6d455ae70882c19c527627a8 upstream. + +This is Dell usb dock audio workaround. +It was fixed the master volume keep lower. + +[Some background: the patch essentially skips the controls of a couple + of FU volumes. Although the firmware exposes the dB and the value + information via the usb descriptor, changing the values (we set the + min volume as default) screws up the device. Although this has been + fixed in the newer firmware, the devices are shipped with the old + firmware, thus we need the workaround in the driver side. -- tiwai] + +Signed-off-by: Kailang Yang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer_maps.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_compa + }; + + /* ++ * Dell usb dock with ALC4020 codec had a firmware problem where it got ++ * screwed up when zero volume is passed; just skip it as a workaround ++ */ ++static const struct usbmix_name_map dell_alc4020_map[] = { ++ { 16, NULL }, ++ { 19, NULL }, ++ { 0 } ++}; ++ ++/* + * Control map entries + */ + +@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_ + .map = aureon_51_2_map, + }, + { ++ .id = USB_ID(0x0bda, 0x4014), ++ .map = dell_alc4020_map, ++ }, ++ { + .id = USB_ID(0x0dba, 0x1000), + .map = mbox1_map, + }, diff --git a/queue-4.4/hid-usbhid-fix-inconsistent-reset-resume-reset-resume-behavior.patch b/queue-4.4/hid-usbhid-fix-inconsistent-reset-resume-reset-resume-behavior.patch new file mode 100644 index 00000000000..63c3e662e6a --- /dev/null +++ b/queue-4.4/hid-usbhid-fix-inconsistent-reset-resume-reset-resume-behavior.patch @@ -0,0 +1,174 @@ +From 972e6a993f278b416a8ee3ec65475724fc36feb2 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 23 Mar 2016 12:17:09 -0400 +Subject: HID: usbhid: fix inconsistent reset/resume/reset-resume behavior + +From: Alan Stern + +commit 972e6a993f278b416a8ee3ec65475724fc36feb2 upstream. + +The usbhid driver has inconsistently duplicated code in its post-reset, +resume, and reset-resume pathways. + + reset-resume doesn't check HID_STARTED before trying to + restart the I/O queues. + + resume fails to clear the HID_SUSPENDED flag if HID_STARTED + isn't set. + + resume calls usbhid_restart_queues() with usbhid->lock held + and the others call it without holding the lock. + +The first item in particular causes a problem following a reset-resume +if the driver hasn't started up its I/O. URB submission fails because +usbhid->urbin is NULL, and this triggers an unending reset-retry loop. + +This patch fixes the problem by creating a new subroutine, +hid_restart_io(), to carry out all the common activities. It also +adds some checks that were missing in the original code: + + After a reset, there's no need to clear any halted endpoints. + + After a resume, if a reset is pending there's no need to + restart any I/O until the reset is finished. + + After a resume, if the interrupt-IN endpoint is halted there's + no need to submit the input URB until the halt has been + cleared. + +Signed-off-by: Alan Stern +Reported-by: Daniel Fraga +Tested-by: Daniel Fraga +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hid-core.c | 73 +++++++++++++++++++++--------------------- + 1 file changed, 37 insertions(+), 36 deletions(-) + +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -951,14 +951,6 @@ static int usbhid_output_report(struct h + return ret; + } + +-static void usbhid_restart_queues(struct usbhid_device *usbhid) +-{ +- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) +- usbhid_restart_out_queue(usbhid); +- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) +- usbhid_restart_ctrl_queue(usbhid); +-} +- + static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) + { + struct usbhid_device *usbhid = hid->driver_data; +@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_d + usb_kill_urb(usbhid->urbout); + } + ++static void hid_restart_io(struct hid_device *hid) ++{ ++ struct usbhid_device *usbhid = hid->driver_data; ++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); ++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); ++ ++ spin_lock_irq(&usbhid->lock); ++ clear_bit(HID_SUSPENDED, &usbhid->iofl); ++ usbhid_mark_busy(usbhid); ++ ++ if (clear_halt || reset_pending) ++ schedule_work(&usbhid->reset_work); ++ usbhid->retry_delay = 0; ++ spin_unlock_irq(&usbhid->lock); ++ ++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) ++ return; ++ ++ if (!clear_halt) { ++ if (hid_start_in(hid) < 0) ++ hid_io_error(hid); ++ } ++ ++ spin_lock_irq(&usbhid->lock); ++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) ++ usbhid_restart_out_queue(usbhid); ++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) ++ usbhid_restart_ctrl_queue(usbhid); ++ spin_unlock_irq(&usbhid->lock); ++} ++ + /* Treat USB reset pretty much the same as suspend/resume */ + static int hid_pre_reset(struct usb_interface *intf) + { +@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_int + return 1; + } + ++ /* No need to do another reset or clear a halted endpoint */ + spin_lock_irq(&usbhid->lock); + clear_bit(HID_RESET_PENDING, &usbhid->iofl); ++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); + spin_unlock_irq(&usbhid->lock); + hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); +- usbhid_restart_queues(usbhid); ++ ++ hid_restart_io(hid); + + return 0; + } +@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device + #ifdef CONFIG_PM + static int hid_resume_common(struct hid_device *hid, bool driver_suspended) + { +- struct usbhid_device *usbhid = hid->driver_data; +- int status; +- +- spin_lock_irq(&usbhid->lock); +- clear_bit(HID_SUSPENDED, &usbhid->iofl); +- usbhid_mark_busy(usbhid); +- +- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || +- test_bit(HID_RESET_PENDING, &usbhid->iofl)) +- schedule_work(&usbhid->reset_work); +- usbhid->retry_delay = 0; +- +- usbhid_restart_queues(usbhid); +- spin_unlock_irq(&usbhid->lock); +- +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); ++ int status = 0; + ++ hid_restart_io(hid); + if (driver_suspended && hid->driver && hid->driver->resume) + status = hid->driver->resume(hid); + return status; +@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interf + static int hid_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata (intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- if (!test_bit(HID_STARTED, &usbhid->iofl)) +- return 0; +- + status = hid_resume_common(hid, true); + dev_dbg(&intf->dev, "resume status %d\n", status); + return 0; +@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interfa + static int hid_reset_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata(intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- clear_bit(HID_SUSPENDED, &usbhid->iofl); + status = hid_post_reset(intf); + if (status >= 0 && hid->driver && hid->driver->reset_resume) { + int ret = hid->driver->reset_resume(hid); diff --git a/queue-4.4/hid-wacom-fix-bamboo-one-oops.patch b/queue-4.4/hid-wacom-fix-bamboo-one-oops.patch new file mode 100644 index 00000000000..98ecfb71568 --- /dev/null +++ b/queue-4.4/hid-wacom-fix-bamboo-one-oops.patch @@ -0,0 +1,46 @@ +From 580549ef6b3e3fb3b958de490ca99f43a089a2cf Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Fri, 25 Mar 2016 15:26:55 +0100 +Subject: HID: wacom: fix Bamboo ONE oops + +From: Benjamin Tissoires + +commit 580549ef6b3e3fb3b958de490ca99f43a089a2cf upstream. + +Looks like recent changes in the Wacom driver made the Bamboo ONE crashes. +The tablet behaves as if it was a regular Bamboo device with pen, touch +and pad, but there is no physical pad connected to it. +The weird part is that the pad is still sending events and given that +there is no input node connected to it, we get anull pointer exception. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317116 + +Signed-off-by: Benjamin Tissoires +Acked-by: Ping Cheng +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -2493,6 +2493,17 @@ void wacom_setup_device_quirks(struct wa + } + + /* ++ * Hack for the Bamboo One: ++ * the device presents a PAD/Touch interface as most Bamboos and even ++ * sends ghosts PAD data on it. However, later, we must disable this ++ * ghost interface, and we can not detect it unless we set it here ++ * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH. ++ */ ++ if (features->type == BAMBOO_PEN && ++ features->pktlen == WACOM_PKGLEN_BBTOUCH3) ++ features->device_type |= WACOM_DEVICETYPE_PAD; ++ ++ /* + * Raw Wacom-mode pen and touch events both come from interface + * 0, whose HID descriptor has an application usage of 0xFF0D + * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back diff --git a/queue-4.4/revert-pci-add-helpers-to-manage-pci_dev-irq-and-pci_dev-irq_managed.patch b/queue-4.4/revert-pci-add-helpers-to-manage-pci_dev-irq-and-pci_dev-irq_managed.patch new file mode 100644 index 00000000000..8e5c30f77f1 --- /dev/null +++ b/queue-4.4/revert-pci-add-helpers-to-manage-pci_dev-irq-and-pci_dev-irq_managed.patch @@ -0,0 +1,148 @@ +From 67b4eab91caf2ad574cab1b17ae09180ea2e116e Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Wed, 17 Feb 2016 12:26:38 -0600 +Subject: Revert "PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed" + +From: Bjorn Helgaas + +commit 67b4eab91caf2ad574cab1b17ae09180ea2e116e upstream. + +Revert 811a4e6fce09 ("PCI: Add helpers to manage pci_dev->irq and +pci_dev->irq_managed"). + +This is part of reverting 991de2e59090 ("PCI, x86: Implement +pcibios_alloc_irq() and pcibios_free_irq()") to fix regressions it +introduced. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211 +Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") +Signed-off-by: Bjorn Helgaas +Acked-by: Rafael J. Wysocki +CC: Jiang Liu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/pci/intel_mid_pci.c | 4 ++-- + arch/x86/pci/irq.c | 10 ++++++---- + drivers/acpi/pci_irq.c | 10 ++++++---- + include/linux/pci.h | 17 ----------------- + 4 files changed, 14 insertions(+), 27 deletions(-) + +--- a/arch/x86/pci/intel_mid_pci.c ++++ b/arch/x86/pci/intel_mid_pci.c +@@ -215,7 +215,7 @@ static int intel_mid_pci_irq_enable(stru + int polarity; + int ret; + +- if (pci_has_managed_irq(dev)) ++ if (dev->irq_managed && dev->irq > 0) + return 0; + + switch (intel_mid_identify_cpu()) { +@@ -256,7 +256,7 @@ static int intel_mid_pci_irq_enable(stru + + static void intel_mid_pci_irq_disable(struct pci_dev *dev) + { +- if (pci_has_managed_irq(dev)) { ++ if (dev->irq_managed && dev->irq > 0) { + mp_unmap_irq(dev->irq); + dev->irq_managed = 0; + /* +--- a/arch/x86/pci/irq.c ++++ b/arch/x86/pci/irq.c +@@ -1202,7 +1202,7 @@ static int pirq_enable_irq(struct pci_de + struct pci_dev *temp_dev; + int irq; + +- if (pci_has_managed_irq(dev)) ++ if (dev->irq_managed && dev->irq > 0) + return 0; + + irq = IO_APIC_get_PCI_irq_vector(dev->bus->number, +@@ -1230,7 +1230,8 @@ static int pirq_enable_irq(struct pci_de + } + dev = temp_dev; + if (irq >= 0) { +- pci_set_managed_irq(dev, irq); ++ dev->irq_managed = 1; ++ dev->irq = irq; + dev_info(&dev->dev, "PCI->APIC IRQ transform: " + "INT %c -> IRQ %d\n", 'A' + pin - 1, irq); + return 0; +@@ -1258,8 +1259,9 @@ static int pirq_enable_irq(struct pci_de + + static void pirq_disable_irq(struct pci_dev *dev) + { +- if (io_apic_assign_pci_irqs && pci_has_managed_irq(dev)) { ++ if (io_apic_assign_pci_irqs && dev->irq_managed && dev->irq) { + mp_unmap_irq(dev->irq); +- pci_reset_managed_irq(dev); ++ dev->irq = 0; ++ dev->irq_managed = 0; + } + } +--- a/drivers/acpi/pci_irq.c ++++ b/drivers/acpi/pci_irq.c +@@ -409,7 +409,7 @@ int acpi_pci_irq_enable(struct pci_dev * + return 0; + } + +- if (pci_has_managed_irq(dev)) ++ if (dev->irq_managed && dev->irq > 0) + return 0; + + entry = acpi_pci_irq_lookup(dev, pin); +@@ -454,7 +454,8 @@ int acpi_pci_irq_enable(struct pci_dev * + kfree(entry); + return rc; + } +- pci_set_managed_irq(dev, rc); ++ dev->irq = rc; ++ dev->irq_managed = 1; + + if (link) + snprintf(link_desc, sizeof(link_desc), " -> Link[%s]", link); +@@ -477,7 +478,7 @@ void acpi_pci_irq_disable(struct pci_dev + u8 pin; + + pin = dev->pin; +- if (!pin || !pci_has_managed_irq(dev)) ++ if (!pin || !dev->irq_managed || dev->irq <= 0) + return; + + entry = acpi_pci_irq_lookup(dev, pin); +@@ -499,6 +500,7 @@ void acpi_pci_irq_disable(struct pci_dev + dev_dbg(&dev->dev, "PCI INT %c disabled\n", pin_name(pin)); + if (gsi >= 0) { + acpi_unregister_gsi(gsi); +- pci_reset_managed_irq(dev); ++ dev->irq_managed = 0; ++ dev->irq = 0; + } + } +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -989,23 +989,6 @@ static inline int pci_is_managed(struct + return pdev->is_managed; + } + +-static inline void pci_set_managed_irq(struct pci_dev *pdev, unsigned int irq) +-{ +- pdev->irq = irq; +- pdev->irq_managed = 1; +-} +- +-static inline void pci_reset_managed_irq(struct pci_dev *pdev) +-{ +- pdev->irq = 0; +- pdev->irq_managed = 0; +-} +- +-static inline bool pci_has_managed_irq(struct pci_dev *pdev) +-{ +- return pdev->irq_managed && pdev->irq > 0; +-} +- + void pci_disable_device(struct pci_dev *dev); + + extern unsigned int pcibios_max_latency; diff --git a/queue-4.4/revert-pci-x86-implement-pcibios_alloc_irq-and-pcibios_free_irq.patch b/queue-4.4/revert-pci-x86-implement-pcibios_alloc_irq-and-pcibios_free_irq.patch new file mode 100644 index 00000000000..a76cbd4cb38 --- /dev/null +++ b/queue-4.4/revert-pci-x86-implement-pcibios_alloc_irq-and-pcibios_free_irq.patch @@ -0,0 +1,161 @@ +From 6c777e8799a93e3bdb67bec622429e1b48dc90fb Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Wed, 17 Feb 2016 12:26:42 -0600 +Subject: Revert "PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjorn Helgaas + +commit 6c777e8799a93e3bdb67bec622429e1b48dc90fb upstream. + +991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and +pcibios_free_irq()") appeared in v4.3 and helps support IOAPIC hotplug. + +Олег reported that the Elcus-1553 TA1-PCI driver worked in v4.2 but not +v4.3 and bisected it to 991de2e59090. Sunjin reported that the RocketRAID +272x driver worked in v4.2 but not v4.3. In both cases booting with +"pci=routirq" is a workaround. + +I think the problem is that after 991de2e59090, we no longer call +pcibios_enable_irq() for upstream bridges. Prior to 991de2e59090, when a +driver called pci_enable_device(), we recursively called +pcibios_enable_irq() for upstream bridges via pci_enable_bridge(). + +After 991de2e59090, we call pcibios_enable_irq() from pci_device_probe() +instead of the pci_enable_device() path, which does *not* call +pcibios_enable_irq() for upstream bridges. + +Revert 991de2e59090 to fix these driver regressions. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211 +Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") +Reported-and-tested-by: Олег Мороз +Reported-by: Sunjin Yang +Signed-off-by: Bjorn Helgaas +Acked-by: Rafael J. Wysocki +CC: Jiang Liu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/pci_x86.h | 2 ++ + arch/x86/pci/common.c | 20 +++++++++++--------- + arch/x86/pci/intel_mid_pci.c | 7 ++----- + arch/x86/pci/irq.c | 15 ++++++++++++++- + drivers/acpi/pci_irq.c | 9 ++++++++- + 5 files changed, 37 insertions(+), 16 deletions(-) + +--- a/arch/x86/include/asm/pci_x86.h ++++ b/arch/x86/include/asm/pci_x86.h +@@ -93,6 +93,8 @@ extern raw_spinlock_t pci_config_lock; + extern int (*pcibios_enable_irq)(struct pci_dev *dev); + extern void (*pcibios_disable_irq)(struct pci_dev *dev); + ++extern bool mp_should_keep_irq(struct device *dev); ++ + struct pci_raw_ops { + int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn, + int reg, int len, u32 *val); +--- a/arch/x86/pci/common.c ++++ b/arch/x86/pci/common.c +@@ -673,20 +673,22 @@ int pcibios_add_device(struct pci_dev *d + return 0; + } + +-int pcibios_alloc_irq(struct pci_dev *dev) ++int pcibios_enable_device(struct pci_dev *dev, int mask) + { +- return pcibios_enable_irq(dev); +-} ++ int err; + +-void pcibios_free_irq(struct pci_dev *dev) +-{ +- if (pcibios_disable_irq) +- pcibios_disable_irq(dev); ++ if ((err = pci_enable_resources(dev, mask)) < 0) ++ return err; ++ ++ if (!pci_dev_msi_enabled(dev)) ++ return pcibios_enable_irq(dev); ++ return 0; + } + +-int pcibios_enable_device(struct pci_dev *dev, int mask) ++void pcibios_disable_device (struct pci_dev *dev) + { +- return pci_enable_resources(dev, mask); ++ if (!pci_dev_msi_enabled(dev) && pcibios_disable_irq) ++ pcibios_disable_irq(dev); + } + + int pci_ext_cfg_avail(void) +--- a/arch/x86/pci/intel_mid_pci.c ++++ b/arch/x86/pci/intel_mid_pci.c +@@ -256,13 +256,10 @@ static int intel_mid_pci_irq_enable(stru + + static void intel_mid_pci_irq_disable(struct pci_dev *dev) + { +- if (dev->irq_managed && dev->irq > 0) { ++ if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed && ++ dev->irq > 0) { + mp_unmap_irq(dev->irq); + dev->irq_managed = 0; +- /* +- * Don't reset dev->irq here, otherwise +- * intel_mid_pci_irq_enable() will fail on next call. +- */ + } + } + +--- a/arch/x86/pci/irq.c ++++ b/arch/x86/pci/irq.c +@@ -1257,9 +1257,22 @@ static int pirq_enable_irq(struct pci_de + return 0; + } + ++bool mp_should_keep_irq(struct device *dev) ++{ ++ if (dev->power.is_prepared) ++ return true; ++#ifdef CONFIG_PM ++ if (dev->power.runtime_status == RPM_SUSPENDING) ++ return true; ++#endif ++ ++ return false; ++} ++ + static void pirq_disable_irq(struct pci_dev *dev) + { +- if (io_apic_assign_pci_irqs && dev->irq_managed && dev->irq) { ++ if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) && ++ dev->irq_managed && dev->irq) { + mp_unmap_irq(dev->irq); + dev->irq = 0; + dev->irq_managed = 0; +--- a/drivers/acpi/pci_irq.c ++++ b/drivers/acpi/pci_irq.c +@@ -481,6 +481,14 @@ void acpi_pci_irq_disable(struct pci_dev + if (!pin || !dev->irq_managed || dev->irq <= 0) + return; + ++ /* Keep IOAPIC pin configuration when suspending */ ++ if (dev->dev.power.is_prepared) ++ return; ++#ifdef CONFIG_PM ++ if (dev->dev.power.runtime_status == RPM_SUSPENDING) ++ return; ++#endif ++ + entry = acpi_pci_irq_lookup(dev, pin); + if (!entry) + return; +@@ -501,6 +509,5 @@ void acpi_pci_irq_disable(struct pci_dev + if (gsi >= 0) { + acpi_unregister_gsi(gsi); + dev->irq_managed = 0; +- dev->irq = 0; + } + } diff --git a/queue-4.4/revert-usb-hub-do-not-clear-bos-field-during-reset-device.patch b/queue-4.4/revert-usb-hub-do-not-clear-bos-field-during-reset-device.patch new file mode 100644 index 00000000000..ebd1c924d84 --- /dev/null +++ b/queue-4.4/revert-usb-hub-do-not-clear-bos-field-during-reset-device.patch @@ -0,0 +1,67 @@ +From e5bdfd50d6f76077bf8441d130c606229e100d40 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sat, 20 Feb 2016 14:19:34 -0800 +Subject: Revert "usb: hub: do not clear BOS field during reset device" + +From: Greg Kroah-Hartman + +commit e5bdfd50d6f76077bf8441d130c606229e100d40 upstream. + +This reverts commit d8f00cd685f5c8e0def8593e520a7fef12c22407. + +Tony writes: + +This upstream commit is causing an oops: +d8f00cd685f5 ("usb: hub: do not clear BOS field during reset device") + +This patch has already been included in several -stable kernels. Here +are the affected kernels: +4.5.0-rc4 (current git) +4.4.2 +4.3.6 (currently in review) +4.1.18 +3.18.27 +3.14.61 + +How to reproduce the problem: +Boot kernel with slub debugging enabled (otherwise memory corruption +will cause random oopses later instead of immediately) +Plug in USB 3.0 disk to xhci USB 3.0 port +dd if=/dev/sdc of=/dev/null bs=65536 +(where /dev/sdc is the USB 3.0 disk) +Unplug USB cable while dd is still going +Oops is immediate: + +Reported-by: Tony Battersby +Cc: Du, Changbin +Cc: Roger Quadros +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5392,6 +5392,7 @@ static int usb_reset_and_verify_device(s + } + + bos = udev->bos; ++ udev->bos = NULL; + + for (i = 0; i < SET_CONFIG_TRIES; ++i) { + +@@ -5484,11 +5485,8 @@ done: + usb_set_usb2_hardware_lpm(udev, 1); + usb_unlocked_enable_lpm(udev); + usb_enable_ltm(udev); +- /* release the new BOS descriptor allocated by hub_port_init() */ +- if (udev->bos != bos) { +- usb_release_bos_descriptor(udev); +- udev->bos = bos; +- } ++ usb_release_bos_descriptor(udev); ++ udev->bos = bos; + return 0; + + re_enumerate: diff --git a/queue-4.4/revert-x86-pci-don-t-alloc-pcibios-irq-when-msi-is-enabled.patch b/queue-4.4/revert-x86-pci-don-t-alloc-pcibios-irq-when-msi-is-enabled.patch new file mode 100644 index 00000000000..5b5fe041113 --- /dev/null +++ b/queue-4.4/revert-x86-pci-don-t-alloc-pcibios-irq-when-msi-is-enabled.patch @@ -0,0 +1,45 @@ +From fe25d078874f2c29c38f4160467d74f5756537c9 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Wed, 17 Feb 2016 12:26:33 -0600 +Subject: Revert "x86/PCI: Don't alloc pcibios-irq when MSI is enabled" + +From: Bjorn Helgaas + +commit fe25d078874f2c29c38f4160467d74f5756537c9 upstream. + +Revert 8affb487d4a4 ("x86/PCI: Don't alloc pcibios-irq when MSI is +enabled"). + +This is part of reverting 991de2e59090 ("PCI, x86: Implement +pcibios_alloc_irq() and pcibios_free_irq()") to fix regressions it +introduced. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211 +Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") +Signed-off-by: Bjorn Helgaas +Acked-by: Rafael J. Wysocki +CC: Jiang Liu +CC: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/pci/common.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/arch/x86/pci/common.c ++++ b/arch/x86/pci/common.c +@@ -675,14 +675,6 @@ int pcibios_add_device(struct pci_dev *d + + int pcibios_alloc_irq(struct pci_dev *dev) + { +- /* +- * If the PCI device was already claimed by core code and has +- * MSI enabled, probing of the pcibios IRQ will overwrite +- * dev->irq. So bail out if MSI is already enabled. +- */ +- if (pci_dev_msi_enabled(dev)) +- return -EBUSY; +- + return pcibios_enable_irq(dev); + } + diff --git a/queue-4.4/series b/queue-4.4/series index 6d4f05f933e..aa8dd4a6650 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -119,3 +119,19 @@ arm64-replace-read_lock-to-rcu-lock-in-call_step_hook.patch perf-do-not-double-free.patch perf-cure-event-pending_disable-race.patch mmc-sdhci-pci-add-support-and-pci-ids-for-more-broxton-host-controllers.patch +alsa-hda-fixup-speaker-pass-through-control-for-nid-0x14-on-alc225.patch +alsa-hda-fix-headset-support-and-noise-on-hp-elitebook-755-g2.patch +alsa-hda-fix-front-mic-problem-for-a-hp-desktop.patch +alsa-hda-realtek-enable-the-alc292-dock-fixup-on-the-thinkpad-t460s.patch +alsa-usb-audio-add-a-sample-rate-quirk-for-phoenix-audio-tmx320.patch +alsa-usb-audio-add-a-quirk-for-plantronics-bt300.patch +alsa-usb-audio-skip-volume-controls-triggers-hangup-on-dell-usb-dock.patch +hid-wacom-fix-bamboo-one-oops.patch +hid-usbhid-fix-inconsistent-reset-resume-reset-resume-behavior.patch +revert-x86-pci-don-t-alloc-pcibios-irq-when-msi-is-enabled.patch +revert-pci-add-helpers-to-manage-pci_dev-irq-and-pci_dev-irq_managed.patch +revert-pci-x86-implement-pcibios_alloc_irq-and-pcibios_free_irq.patch +staging-android-ion-set-the-length-of-the-dma-sg-entries-in-buffer.patch +usbvision-fix-overflow-of-interfaces-array.patch +usbvision-fix-crash-on-detecting-device-with-invalid-configuration.patch +revert-usb-hub-do-not-clear-bos-field-during-reset-device.patch diff --git a/queue-4.4/staging-android-ion-set-the-length-of-the-dma-sg-entries-in-buffer.patch b/queue-4.4/staging-android-ion-set-the-length-of-the-dma-sg-entries-in-buffer.patch new file mode 100644 index 00000000000..e47d197d0b3 --- /dev/null +++ b/queue-4.4/staging-android-ion-set-the-length-of-the-dma-sg-entries-in-buffer.patch @@ -0,0 +1,36 @@ +From 70bc916b2c80913753fb188d4daee50a64d21ba0 Mon Sep 17 00:00:00 2001 +From: Liviu Dudau +Date: Thu, 21 Jan 2016 11:57:47 +0000 +Subject: staging: android: ion: Set the length of the DMA sg entries in buffer + +From: Liviu Dudau + +commit 70bc916b2c80913753fb188d4daee50a64d21ba0 upstream. + +ion_buffer_create() will allocate a buffer and then create a DMA +mapping for it, but it forgot to set the length of the page entries. + +Signed-off-by: Liviu Dudau +Signed-off-by: Jon Medhurst +Acked-by: Laura Abbott +Cc: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/ion/ion.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/android/ion/ion.c ++++ b/drivers/staging/android/ion/ion.c +@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_cre + * memory coming from the heaps is ready for dma, ie if it has a + * cached mapping that mapping has been invalidated + */ +- for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) ++ for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) { + sg_dma_address(sg) = sg_phys(sg); ++ sg_dma_len(sg) = sg->length; ++ } + mutex_lock(&dev->buffer_lock); + ion_buffer_add(dev, buffer); + mutex_unlock(&dev->buffer_lock); diff --git a/queue-4.4/usbvision-fix-crash-on-detecting-device-with-invalid-configuration.patch b/queue-4.4/usbvision-fix-crash-on-detecting-device-with-invalid-configuration.patch new file mode 100644 index 00000000000..bb143cdf9fe --- /dev/null +++ b/queue-4.4/usbvision-fix-crash-on-detecting-device-with-invalid-configuration.patch @@ -0,0 +1,49 @@ +From fa52bd506f274b7619955917abfde355e3d19ffe Mon Sep 17 00:00:00 2001 +From: Vladis Dronov +Date: Mon, 16 Nov 2015 15:55:11 -0200 +Subject: [media] usbvision: fix crash on detecting device with invalid configuration + +From: Vladis Dronov + +commit fa52bd506f274b7619955917abfde355e3d19ffe upstream. + +The usbvision driver crashes when a specially crafted usb device with invalid +number of interfaces or endpoints is detected. This fix adds checks that the +device has proper configuration expected by the driver. + +Reported-by: Ralf Spenneberg +Signed-off-by: Vladis Dronov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1470,9 +1470,23 @@ static int usbvision_probe(struct usb_in + + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; +- else ++ else if (ifnum < dev->actconfig->desc.bNumInterfaces) + interface = &dev->actconfig->interface[ifnum]->altsetting[0]; ++ else { ++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", ++ ifnum, dev->actconfig->desc.bNumInterfaces - 1); ++ ret = -ENODEV; ++ goto err_usb; ++ } ++ ++ if (interface->desc.bNumEndpoints < 2) { ++ dev_err(&intf->dev, "interface %d has %d endpoints, but must" ++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); ++ ret = -ENODEV; ++ goto err_usb; ++ } + endpoint = &interface->endpoint[1].desc; ++ + if (!usb_endpoint_xfer_isoc(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", + __func__, ifnum); diff --git a/queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch b/queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch new file mode 100644 index 00000000000..7935320f7e9 --- /dev/null +++ b/queue-4.4/usbvision-fix-overflow-of-interfaces-array.patch @@ -0,0 +1,39 @@ +From 588afcc1c0e45358159090d95bf7b246fb67565f Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 27 Oct 2015 09:51:34 -0200 +Subject: [media] usbvision fix overflow of interfaces array + +From: Oliver Neukum + +commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream. + +This fixes the crash reported in: +http://seclists.org/bugtraq/2015/Oct/35 +The interface number needs a sanity check. + +Signed-off-by: Oliver Neukum +Cc: Vladis Dronov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/usbvision/usbvision-video.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1461,6 +1461,13 @@ static int usbvision_probe(struct usb_in + printk(KERN_INFO "%s: %s found\n", __func__, + usbvision_device_data[model].model_string); + ++ /* ++ * this is a security check. ++ * an exploit using an incorrect bInterfaceNumber is known ++ */ ++ if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) ++ return -ENODEV; ++ + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; + else