From: Greg Kroah-Hartman Date: Fri, 2 Feb 2018 10:38:09 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.115~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dcd3ce44f4a80fed66ed55fac7af14d943538432;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: cdc-acm-apply-quirk-for-card-reader.patch serial-imx-only-wakeup-via-rtsden-bit-if-the-system-has-rts-cts.patch spi-imx-do-not-access-registers-while-clocks-disabled.patch staging-lustre-separate-a-connection-destroy-from-free-struct-kib_conn.patch tty-fix-data-race-between-tty_init_dev-and-flush-of-buf.patch usb-cdc-acm-do-not-log-urb-submission-errors-on-disconnect.patch usb-f_fs-prevent-gadget-unbind-if-it-is-already-unbound.patch usb-gadget-fix-high-bandwidth-check-in-usb_gadget_ep_match_desc.patch usb-option-add-support-for-fs040u-modem.patch usb-serial-io_edgeport-fix-possible-sleep-in-atomic.patch usb-serial-pl2303-new-device-id-for-chilitag.patch usb-serial-simple-add-motorola-tetra-driver.patch usb-uas-unconditionally-bring-back-host-after-reset.patch usbip-list-don-t-list-devices-attached-to-vhci_hcd.patch usbip-prevent-bind-loops-on-devices-attached-to-vhci_hcd.patch usbip-vhci_hcd-clear-just-the-usb_port_stat_power-bit.patch --- diff --git a/queue-4.9/cdc-acm-apply-quirk-for-card-reader.patch b/queue-4.9/cdc-acm-apply-quirk-for-card-reader.patch new file mode 100644 index 00000000000..1ac0938a97c --- /dev/null +++ b/queue-4.9/cdc-acm-apply-quirk-for-card-reader.patch @@ -0,0 +1,31 @@ +From df1cc78a52491f71d8170d513d0f6f114faa1bda Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 18 Jan 2018 12:13:45 +0100 +Subject: CDC-ACM: apply quirk for card reader + +From: Oliver Neukum + +commit df1cc78a52491f71d8170d513d0f6f114faa1bda upstream. + +This devices drops random bytes from messages if you talk to it +too fast. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1706,6 +1706,9 @@ static const struct usb_device_id acm_id + { USB_DEVICE(0x0ace, 0x1611), /* ZyDAS 56K USB MODEM - new version */ + .driver_info = SINGLE_RX_URB, /* firmware bug */ + }, ++ { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */ ++ .driver_info = SINGLE_RX_URB, ++ }, + { USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, diff --git a/queue-4.9/serial-imx-only-wakeup-via-rtsden-bit-if-the-system-has-rts-cts.patch b/queue-4.9/serial-imx-only-wakeup-via-rtsden-bit-if-the-system-has-rts-cts.patch new file mode 100644 index 00000000000..736ef30c8fe --- /dev/null +++ b/queue-4.9/serial-imx-only-wakeup-via-rtsden-bit-if-the-system-has-rts-cts.patch @@ -0,0 +1,46 @@ +From 38b1f0fb42f772b8c9aac53593883a18ff5eb9d7 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Thu, 4 Jan 2018 15:58:34 -0200 +Subject: serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS + +From: Fabio Estevam + +commit 38b1f0fb42f772b8c9aac53593883a18ff5eb9d7 upstream. + +The wakeup mechanism via RTSDEN bit relies on the system using the RTS/CTS +lines, so only allow such wakeup method when the system actually has +RTS/CTS support. + +Fixes: bc85734b126f ("serial: imx: allow waking up on RTSD") +Signed-off-by: Fabio Estevam +Reviewed-by: Martin Kaiser +Acked-by: Fugang Duan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/imx.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -2239,12 +2239,14 @@ static void serial_imx_enable_wakeup(str + val &= ~UCR3_AWAKEN; + writel(val, sport->port.membase + UCR3); + +- val = readl(sport->port.membase + UCR1); +- if (on) +- val |= UCR1_RTSDEN; +- else +- val &= ~UCR1_RTSDEN; +- writel(val, sport->port.membase + UCR1); ++ if (sport->have_rtscts) { ++ val = readl(sport->port.membase + UCR1); ++ if (on) ++ val |= UCR1_RTSDEN; ++ else ++ val &= ~UCR1_RTSDEN; ++ writel(val, sport->port.membase + UCR1); ++ } + } + + static int imx_serial_port_suspend_noirq(struct device *dev) diff --git a/queue-4.9/series b/queue-4.9/series index ff76f1dfac4..2cd64bee8d9 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -68,3 +68,19 @@ media-usbtv-add-a-new-usbid.patch usb-gadget-don-t-dereference-g-until-after-it-has-been-null-checked.patch staging-rtl8188eu-fix-incorrect-response-to-siocgiwessid.patch drm-vc4-move-irq-enable-to-pm-path.patch +staging-lustre-separate-a-connection-destroy-from-free-struct-kib_conn.patch +tty-fix-data-race-between-tty_init_dev-and-flush-of-buf.patch +usb-option-add-support-for-fs040u-modem.patch +usb-serial-pl2303-new-device-id-for-chilitag.patch +usb-cdc-acm-do-not-log-urb-submission-errors-on-disconnect.patch +cdc-acm-apply-quirk-for-card-reader.patch +usb-serial-io_edgeport-fix-possible-sleep-in-atomic.patch +usbip-prevent-bind-loops-on-devices-attached-to-vhci_hcd.patch +usbip-list-don-t-list-devices-attached-to-vhci_hcd.patch +usb-serial-simple-add-motorola-tetra-driver.patch +usb-f_fs-prevent-gadget-unbind-if-it-is-already-unbound.patch +usb-uas-unconditionally-bring-back-host-after-reset.patch +usb-gadget-fix-high-bandwidth-check-in-usb_gadget_ep_match_desc.patch +usbip-vhci_hcd-clear-just-the-usb_port_stat_power-bit.patch +serial-imx-only-wakeup-via-rtsden-bit-if-the-system-has-rts-cts.patch +spi-imx-do-not-access-registers-while-clocks-disabled.patch diff --git a/queue-4.9/spi-imx-do-not-access-registers-while-clocks-disabled.patch b/queue-4.9/spi-imx-do-not-access-registers-while-clocks-disabled.patch new file mode 100644 index 00000000000..3b194a671e4 --- /dev/null +++ b/queue-4.9/spi-imx-do-not-access-registers-while-clocks-disabled.patch @@ -0,0 +1,51 @@ +From d593574aff0ab846136190b1729c151c736727ec Mon Sep 17 00:00:00 2001 +From: Stefan Agner +Date: Sun, 7 Jan 2018 15:05:49 +0100 +Subject: spi: imx: do not access registers while clocks disabled + +From: Stefan Agner + +commit d593574aff0ab846136190b1729c151c736727ec upstream. + +Since clocks are disabled except during message transfer clocks +are also disabled when spi_imx_remove gets called. Accessing +registers leads to a freeeze at least on a i.MX 6ULL. Enable +clocks before disabling accessing the MXC_CSPICTRL register. + +Fixes: 9e556dcc55774 ("spi: spi-imx: only enable the clocks when we start to transfer a message") +Signed-off-by: Stefan Agner +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-imx.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1307,12 +1307,23 @@ static int spi_imx_remove(struct platfor + { + struct spi_master *master = platform_get_drvdata(pdev); + struct spi_imx_data *spi_imx = spi_master_get_devdata(master); ++ int ret; + + spi_bitbang_stop(&spi_imx->bitbang); + ++ ret = clk_enable(spi_imx->clk_per); ++ if (ret) ++ return ret; ++ ++ ret = clk_enable(spi_imx->clk_ipg); ++ if (ret) { ++ clk_disable(spi_imx->clk_per); ++ return ret; ++ } ++ + writel(0, spi_imx->base + MXC_CSPICTRL); +- clk_unprepare(spi_imx->clk_ipg); +- clk_unprepare(spi_imx->clk_per); ++ clk_disable_unprepare(spi_imx->clk_ipg); ++ clk_disable_unprepare(spi_imx->clk_per); + spi_imx_sdma_exit(spi_imx); + spi_master_put(master); + diff --git a/queue-4.9/staging-lustre-separate-a-connection-destroy-from-free-struct-kib_conn.patch b/queue-4.9/staging-lustre-separate-a-connection-destroy-from-free-struct-kib_conn.patch new file mode 100644 index 00000000000..e90bef00ebd --- /dev/null +++ b/queue-4.9/staging-lustre-separate-a-connection-destroy-from-free-struct-kib_conn.patch @@ -0,0 +1,109 @@ +From 9b046013e5837f8a58453d1e9f8e01d03adb7fe7 Mon Sep 17 00:00:00 2001 +From: Dmitry Eremin +Date: Thu, 25 Jan 2018 16:51:04 +0300 +Subject: staging: lustre: separate a connection destroy from free struct kib_conn + +From: Dmitry Eremin + +commit 9b046013e5837f8a58453d1e9f8e01d03adb7fe7 upstream. + +The logic of the original commit 4d99b2581eff ("staging: lustre: avoid +intensive reconnecting for ko2iblnd") was assumed conditional free of +struct kib_conn if the second argument free_conn in function +kiblnd_destroy_conn(struct kib_conn *conn, bool free_conn) is true. +But this hunk of code was dropped from original commit. As result the logic +works wrong and current code use struct kib_conn after free. + +> drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +> 3317 kiblnd_destroy_conn(conn, !peer); +> ^^^^ Freed always (but should be conditionally) +> 3318 +> 3319 spin_lock_irqsave(lock, flags); +> 3320 if (!peer) +> 3321 continue; +> 3322 +> 3323 conn->ibc_peer = peer; +> ^^^^^^^^^^^^^^ Use after free +> 3324 if (peer->ibp_reconnected < KIB_RECONN_HIGH_RACE) +> 3325 list_add_tail(&conn->ibc_list, +> ^^^^^^^^^^^^^^ Use after free +> 3326 &kiblnd_data.kib_reconn_list); +> 3327 else +> 3328 list_add_tail(&conn->ibc_list, +> ^^^^^^^^^^^^^^ Use after free +> 3329 &kiblnd_data.kib_reconn_wait); + +To avoid confusion this fix moved the freeing a struct kib_conn outside of +the function kiblnd_destroy_conn() and free as it was intended in original +commit. + +Fixes: 4d99b2581eff ("staging: lustre: avoid intensive reconnecting for ko2iblnd") +Signed-off-by: Dmitry Eremin +Reviewed-by: Andreas Dilger +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c | 7 +++---- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.h | 2 +- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 6 ++++-- + 3 files changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c +@@ -824,14 +824,15 @@ struct kib_conn *kiblnd_create_conn(stru + return conn; + + failed_2: +- kiblnd_destroy_conn(conn, true); ++ kiblnd_destroy_conn(conn); ++ LIBCFS_FREE(conn, sizeof(*conn)); + failed_1: + LIBCFS_FREE(init_qp_attr, sizeof(*init_qp_attr)); + failed_0: + return NULL; + } + +-void kiblnd_destroy_conn(struct kib_conn *conn, bool free_conn) ++void kiblnd_destroy_conn(struct kib_conn *conn) + { + struct rdma_cm_id *cmid = conn->ibc_cmid; + struct kib_peer *peer = conn->ibc_peer; +@@ -894,8 +895,6 @@ void kiblnd_destroy_conn(struct kib_conn + rdma_destroy_id(cmid); + atomic_dec(&net->ibn_nconns); + } +- +- LIBCFS_FREE(conn, sizeof(*conn)); + } + + int kiblnd_close_peer_conns_locked(struct kib_peer *peer, int why) +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.h ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.h +@@ -1018,7 +1018,7 @@ int kiblnd_close_peer_conns_locked(stru + struct kib_conn *kiblnd_create_conn(struct kib_peer *peer, + struct rdma_cm_id *cmid, + int state, int version); +-void kiblnd_destroy_conn(struct kib_conn *conn, bool free_conn); ++void kiblnd_destroy_conn(struct kib_conn *conn); + void kiblnd_close_conn(struct kib_conn *conn, int error); + void kiblnd_close_conn_locked(struct kib_conn *conn, int error); + +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +@@ -3323,11 +3323,13 @@ kiblnd_connd(void *arg) + spin_unlock_irqrestore(lock, flags); + dropped_lock = 1; + +- kiblnd_destroy_conn(conn, !peer); ++ kiblnd_destroy_conn(conn); + + spin_lock_irqsave(lock, flags); +- if (!peer) ++ if (!peer) { ++ kfree(conn); + continue; ++ } + + conn->ibc_peer = peer; + if (peer->ibp_reconnected < KIB_RECONN_HIGH_RACE) diff --git a/queue-4.9/tty-fix-data-race-between-tty_init_dev-and-flush-of-buf.patch b/queue-4.9/tty-fix-data-race-between-tty_init_dev-and-flush-of-buf.patch new file mode 100644 index 00000000000..0992b7fa268 --- /dev/null +++ b/queue-4.9/tty-fix-data-race-between-tty_init_dev-and-flush-of-buf.patch @@ -0,0 +1,96 @@ +From b027e2298bd588d6fa36ed2eda97447fb3eac078 Mon Sep 17 00:00:00 2001 +From: Gaurav Kohli +Date: Tue, 23 Jan 2018 13:16:34 +0530 +Subject: tty: fix data race between tty_init_dev and flush of buf + +From: Gaurav Kohli + +commit b027e2298bd588d6fa36ed2eda97447fb3eac078 upstream. + +There can be a race, if receive_buf call comes before +tty initialization completes in n_tty_open and tty->disc_data +may be NULL. + +CPU0 CPU1 +---- ---- + 000|n_tty_receive_buf_common() n_tty_open() +-001|n_tty_receive_buf2() tty_ldisc_open.isra.3() +-002|tty_ldisc_receive_buf(inline) tty_ldisc_setup() + +Using ldisc semaphore lock in tty_init_dev till disc_data +initializes completely. + +Signed-off-by: Gaurav Kohli +Reviewed-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_io.c | 8 +++++++- + drivers/tty/tty_ldisc.c | 4 ++-- + include/linux/tty.h | 2 ++ + 3 files changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1543,6 +1543,9 @@ struct tty_struct *tty_init_dev(struct t + "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n", + __func__, tty->driver->name); + ++ retval = tty_ldisc_lock(tty, 5 * HZ); ++ if (retval) ++ goto err_release_lock; + tty->port->itty = tty; + + /* +@@ -1553,6 +1556,7 @@ struct tty_struct *tty_init_dev(struct t + retval = tty_ldisc_setup(tty, tty->link); + if (retval) + goto err_release_tty; ++ tty_ldisc_unlock(tty); + /* Return the tty locked so that it cannot vanish under the caller */ + return tty; + +@@ -1565,9 +1569,11 @@ err_module_put: + + /* call the tty release_tty routine to clean out this slot */ + err_release_tty: +- tty_unlock(tty); ++ tty_ldisc_unlock(tty); + tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n", + retval, idx); ++err_release_lock: ++ tty_unlock(tty); + release_tty(tty, idx); + return ERR_PTR(retval); + } +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -336,7 +336,7 @@ static inline void __tty_ldisc_unlock(st + ldsem_up_write(&tty->ldisc_sem); + } + +-static int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) ++int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) + { + int ret; + +@@ -347,7 +347,7 @@ static int tty_ldisc_lock(struct tty_str + return 0; + } + +-static void tty_ldisc_unlock(struct tty_struct *tty) ++void tty_ldisc_unlock(struct tty_struct *tty) + { + clear_bit(TTY_LDISC_HALTED, &tty->flags); + __tty_ldisc_unlock(tty); +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -394,6 +394,8 @@ extern struct tty_struct *get_current_tt + /* tty_io.c */ + extern int __init tty_init(void); + extern const char *tty_name(const struct tty_struct *tty); ++extern int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout); ++extern void tty_ldisc_unlock(struct tty_struct *tty); + #else + static inline void console_init(void) + { } diff --git a/queue-4.9/usb-cdc-acm-do-not-log-urb-submission-errors-on-disconnect.patch b/queue-4.9/usb-cdc-acm-do-not-log-urb-submission-errors-on-disconnect.patch new file mode 100644 index 00000000000..ec505f58ebe --- /dev/null +++ b/queue-4.9/usb-cdc-acm-do-not-log-urb-submission-errors-on-disconnect.patch @@ -0,0 +1,40 @@ +From f0386c083c2ce85284dc0b419d7b89c8e567c09f Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 14 Jan 2018 16:09:00 +0100 +Subject: USB: cdc-acm: Do not log urb submission errors on disconnect + +From: Hans de Goede + +commit f0386c083c2ce85284dc0b419d7b89c8e567c09f upstream. + +When disconnected sometimes the cdc-acm driver logs errors like these: + +[20278.039417] cdc_acm 2-2:2.1: urb 9 failed submission with -19 +[20278.042924] cdc_acm 2-2:2.1: urb 10 failed submission with -19 +[20278.046449] cdc_acm 2-2:2.1: urb 11 failed submission with -19 +[20278.049920] cdc_acm 2-2:2.1: urb 12 failed submission with -19 +[20278.053442] cdc_acm 2-2:2.1: urb 13 failed submission with -19 +[20278.056915] cdc_acm 2-2:2.1: urb 14 failed submission with -19 +[20278.060418] cdc_acm 2-2:2.1: urb 15 failed submission with -19 + +Silence these by not logging errors when the result is -ENODEV. + +Signed-off-by: Hans de Goede +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -375,7 +375,7 @@ static int acm_submit_read_urb(struct ac + + res = usb_submit_urb(acm->read_urbs[index], mem_flags); + if (res) { +- if (res != -EPERM) { ++ if (res != -EPERM && res != -ENODEV) { + dev_err(&acm->data->dev, + "urb %d failed submission with %d\n", + index, res); diff --git a/queue-4.9/usb-f_fs-prevent-gadget-unbind-if-it-is-already-unbound.patch b/queue-4.9/usb-f_fs-prevent-gadget-unbind-if-it-is-already-unbound.patch new file mode 100644 index 00000000000..4bea2e89489 --- /dev/null +++ b/queue-4.9/usb-f_fs-prevent-gadget-unbind-if-it-is-already-unbound.patch @@ -0,0 +1,51 @@ +From ce5bf9a50daf2d9078b505aca1cea22e88ecb94a Mon Sep 17 00:00:00 2001 +From: Hemant Kumar +Date: Tue, 9 Jan 2018 12:30:53 +0530 +Subject: usb: f_fs: Prevent gadget unbind if it is already unbound + +From: Hemant Kumar + +commit ce5bf9a50daf2d9078b505aca1cea22e88ecb94a upstream. + +Upon usb composition switch there is possibility of ep0 file +release happening after gadget driver bind. In case of composition +switch from adb to a non-adb composition gadget will never gets +bound again resulting into failure of usb device enumeration. Fix +this issue by checking FFS_FL_BOUND flag and avoid extra +gadget driver unbind if it is already done as part of composition +switch. + +This fixes adb reconnection error reported on Android running +v4.4 and above kernel versions. Verified on Hikey running vanilla +v4.15-rc7 + few out of tree Mali patches. + +Reviewed-at: https://android-review.googlesource.com/#/c/582632/ + +Cc: Felipe Balbi +Cc: Greg KH +Cc: Michal Nazarewicz +Cc: John Stultz +Cc: Dmitry Shmidt +Cc: Badhri +Cc: Android Kernel Team +Signed-off-by: Hemant Kumar +[AmitP: Cherry-picked it from android-4.14 and updated the commit log] +Signed-off-by: Amit Pundir +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -3725,7 +3725,8 @@ static void ffs_closed(struct ffs_data * + ci = opts->func_inst.group.cg_item.ci_parent->ci_parent; + ffs_dev_unlock(); + +- unregister_gadget_item(ci); ++ if (test_bit(FFS_FL_BOUND, &ffs->flags)) ++ unregister_gadget_item(ci); + return; + done: + ffs_dev_unlock(); diff --git a/queue-4.9/usb-gadget-fix-high-bandwidth-check-in-usb_gadget_ep_match_desc.patch b/queue-4.9/usb-gadget-fix-high-bandwidth-check-in-usb_gadget_ep_match_desc.patch new file mode 100644 index 00000000000..3dacd8676ce --- /dev/null +++ b/queue-4.9/usb-gadget-fix-high-bandwidth-check-in-usb_gadget_ep_match_desc.patch @@ -0,0 +1,31 @@ +From 11fb37998759c48e4e4c200c974593cbeab25d3e Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Fri, 12 Jan 2018 17:50:02 +1100 +Subject: usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc() + +From: Benjamin Herrenschmidt + +commit 11fb37998759c48e4e4c200c974593cbeab25d3e upstream. + +The current code tries to test for bits that are masked out by +usb_endpoint_maxp(). Instead, use the proper accessor to access +the new high bandwidth bits. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -913,7 +913,7 @@ int usb_gadget_ep_match_desc(struct usb_ + return 0; + + /* "high bandwidth" works only at high speed */ +- if (!gadget_is_dualspeed(gadget) && usb_endpoint_maxp(desc) & (3<<11)) ++ if (!gadget_is_dualspeed(gadget) && usb_endpoint_maxp_mult(desc) > 1) + return 0; + + switch (type) { diff --git a/queue-4.9/usb-option-add-support-for-fs040u-modem.patch b/queue-4.9/usb-option-add-support-for-fs040u-modem.patch new file mode 100644 index 00000000000..7030fcc0122 --- /dev/null +++ b/queue-4.9/usb-option-add-support-for-fs040u-modem.patch @@ -0,0 +1,43 @@ +From 69341bd15018da0a662847e210f9b2380c71e623 Mon Sep 17 00:00:00 2001 +From: OKAMOTO Yoshiaki +Date: Tue, 16 Jan 2018 09:51:17 +0000 +Subject: usb: option: Add support for FS040U modem + +From: OKAMOTO Yoshiaki + +commit 69341bd15018da0a662847e210f9b2380c71e623 upstream. + +FS040U modem is manufactured by omega, and sold by Fujisoft. This patch +adds ID of the modem to use option1 driver. Interface 3 is used as +qmi_wwan, so the interface is ignored. + +Signed-off-by: Yoshiaki Okamoto +Signed-off-by: Hiroyuki Yamamoto +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -383,6 +383,9 @@ static void option_instat_callback(struc + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 + #define FOUR_G_SYSTEMS_PRODUCT_W100 0x9b01 + ++/* Fujisoft products */ ++#define FUJISOFT_PRODUCT_FS040U 0x9b02 ++ + /* iBall 3.5G connect wireless modem */ + #define IBALL_3_5G_CONNECT 0x9605 + +@@ -1897,6 +1900,8 @@ static const struct usb_device_id option + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), + .driver_info = (kernel_ulong_t)&four_g_w100_blacklist + }, ++ {USB_DEVICE(LONGCHEER_VENDOR_ID, FUJISOFT_PRODUCT_FS040U), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist}, + { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, + { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9801, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, diff --git a/queue-4.9/usb-serial-io_edgeport-fix-possible-sleep-in-atomic.patch b/queue-4.9/usb-serial-io_edgeport-fix-possible-sleep-in-atomic.patch new file mode 100644 index 00000000000..97edfe56ad1 --- /dev/null +++ b/queue-4.9/usb-serial-io_edgeport-fix-possible-sleep-in-atomic.patch @@ -0,0 +1,45 @@ +From c7b8f77872c73f69a16528a9eb87afefcccdc18b Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Wed, 13 Dec 2017 20:34:36 +0800 +Subject: USB: serial: io_edgeport: fix possible sleep-in-atomic + +From: Jia-Ju Bai + +commit c7b8f77872c73f69a16528a9eb87afefcccdc18b upstream. + +According to drivers/usb/serial/io_edgeport.c, the driver may sleep +under a spinlock. +The function call path is: +edge_bulk_in_callback (acquire the spinlock) + process_rcvd_data + process_rcvd_status + change_port_settings + send_iosp_ext_cmd + write_cmd_usb + usb_kill_urb --> may sleep + +To fix it, the redundant usb_kill_urb() is removed from the error path +after usb_submit_urb() fails. + +This possible bug is found by my static analysis tool (DSAC) and checked +by my code review. + +Signed-off-by: Jia-Ju Bai +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/io_edgeport.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2215,7 +2215,6 @@ static int write_cmd_usb(struct edgeport + /* something went wrong */ + dev_err(dev, "%s - usb_submit_urb(write command) failed, status = %d\n", + __func__, status); +- usb_kill_urb(urb); + usb_free_urb(urb); + atomic_dec(&CmdUrbs); + return status; diff --git a/queue-4.9/usb-serial-pl2303-new-device-id-for-chilitag.patch b/queue-4.9/usb-serial-pl2303-new-device-id-for-chilitag.patch new file mode 100644 index 00000000000..40c5a924520 --- /dev/null +++ b/queue-4.9/usb-serial-pl2303-new-device-id-for-chilitag.patch @@ -0,0 +1,43 @@ +From d08dd3f3dd2ae351b793fc5b76abdbf0fd317b12 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 25 Jan 2018 09:48:55 +0100 +Subject: USB: serial: pl2303: new device id for Chilitag +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Greg Kroah-Hartman + +commit d08dd3f3dd2ae351b793fc5b76abdbf0fd317b12 upstream. + +This adds a new device id for Chilitag devices to the pl2303 driver. + +Reported-by: "Chu.Mike [朱堅宜]" +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -39,6 +39,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ2) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_DCU11) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ3) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_CHILITAG) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_PHAROS) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ALDIGA) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -17,6 +17,7 @@ + #define PL2303_PRODUCT_ID_DCU11 0x1234 + #define PL2303_PRODUCT_ID_PHAROS 0xaaa0 + #define PL2303_PRODUCT_ID_RSAQ3 0xaaa2 ++#define PL2303_PRODUCT_ID_CHILITAG 0xaaa8 + #define PL2303_PRODUCT_ID_ALDIGA 0x0611 + #define PL2303_PRODUCT_ID_MMX 0x0612 + #define PL2303_PRODUCT_ID_GPRS 0x0609 diff --git a/queue-4.9/usb-serial-simple-add-motorola-tetra-driver.patch b/queue-4.9/usb-serial-simple-add-motorola-tetra-driver.patch new file mode 100644 index 00000000000..b41e0471236 --- /dev/null +++ b/queue-4.9/usb-serial-simple-add-motorola-tetra-driver.patch @@ -0,0 +1,73 @@ +From 46fe895e22ab3845515ec06b01eaf1282b342e29 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 18 Jan 2018 14:46:41 +1100 +Subject: USB: serial: simple: add Motorola Tetra driver + +From: Johan Hovold + +commit 46fe895e22ab3845515ec06b01eaf1282b342e29 upstream. + +Add new Motorola Tetra (simple) driver for Motorola Solutions TETRA PEI +devices. + +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=0cad ProdID=9011 Rev=24.16 +S: Manufacturer=Motorola Solutions Inc. +S: Product=Motorola Solutions TETRA PEI interface +C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) + +Note that these devices do not support the CDC SET_CONTROL_LINE_STATE +request (for any interface). + +Reported-by: Max Schulze +Tested-by: Max Schulze +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/Kconfig | 1 + + drivers/usb/serial/usb-serial-simple.c | 7 +++++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/serial/Kconfig ++++ b/drivers/usb/serial/Kconfig +@@ -63,6 +63,7 @@ config USB_SERIAL_SIMPLE + - Google USB serial devices + - HP4x calculators + - a number of Motorola phones ++ - Motorola Tetra devices + - Novatel Wireless GPS receivers + - Siemens USB/MPI adapter. + - ViVOtech ViVOpay USB device. +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -80,6 +80,11 @@ DEVICE(vivopay, VIVOPAY_IDS); + { USB_DEVICE(0x22b8, 0x2c64) } /* Motorola V950 phone */ + DEVICE(moto_modem, MOTO_IDS); + ++/* Motorola Tetra driver */ ++#define MOTOROLA_TETRA_IDS() \ ++ { USB_DEVICE(0x0cad, 0x9011) } /* Motorola Solutions TETRA PEI */ ++DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); ++ + /* Novatel Wireless GPS driver */ + #define NOVATEL_IDS() \ + { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ +@@ -110,6 +115,7 @@ static struct usb_serial_driver * const + &google_device, + &vivopay_device, + &moto_modem_device, ++ &motorola_tetra_device, + &novatel_gps_device, + &hp4x_device, + &suunto_device, +@@ -125,6 +131,7 @@ static const struct usb_device_id id_tab + GOOGLE_IDS(), + VIVOPAY_IDS(), + MOTO_IDS(), ++ MOTOROLA_TETRA_IDS(), + NOVATEL_IDS(), + HP4X_IDS(), + SUUNTO_IDS(), diff --git a/queue-4.9/usb-uas-unconditionally-bring-back-host-after-reset.patch b/queue-4.9/usb-uas-unconditionally-bring-back-host-after-reset.patch new file mode 100644 index 00000000000..17f836e3725 --- /dev/null +++ b/queue-4.9/usb-uas-unconditionally-bring-back-host-after-reset.patch @@ -0,0 +1,66 @@ +From cbeef22fd611c4f47c494b821b2b105b8af970bb Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 11 Jan 2018 13:10:16 +0100 +Subject: usb: uas: unconditionally bring back host after reset + +From: Oliver Neukum + +commit cbeef22fd611c4f47c494b821b2b105b8af970bb upstream. + +Quoting Hans: + +If we return 1 from our post_reset handler, then our disconnect handler +will be called immediately afterwards. Since pre_reset blocks all scsi +requests our disconnect handler will then hang in the scsi_remove_host +call. + +This is esp. bad because our disconnect handler hanging for ever also +stops the USB subsys from enumerating any new USB devices, causes commands +like lsusb to hang, etc. + +In practice this happens when unplugging some uas devices because the hub +code may see the device as needing a warm-reset and calls usb_reset_device +before seeing the disconnect. In this case uas_configure_endpoints fails +with -ENODEV. We do not want to print an error for this, so this commit +also silences the shost_printk for -ENODEV. + +ENDQUOTE + +However, if we do that we better drop any unconditional execution +and report to the SCSI subsystem that we have undergone a reset +but we are not operational now. + +Signed-off-by: Oliver Neukum +Reported-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/uas.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -1076,20 +1076,19 @@ static int uas_post_reset(struct usb_int + return 0; + + err = uas_configure_endpoints(devinfo); +- if (err) { ++ if (err && err != ENODEV) + shost_printk(KERN_ERR, shost, + "%s: alloc streams error %d after reset", + __func__, err); +- return 1; +- } + ++ /* we must unblock the host in every case lest we deadlock */ + spin_lock_irqsave(shost->host_lock, flags); + scsi_report_bus_reset(shost, 0); + spin_unlock_irqrestore(shost->host_lock, flags); + + scsi_unblock_requests(shost); + +- return 0; ++ return err ? 1 : 0; + } + + static int uas_suspend(struct usb_interface *intf, pm_message_t message) diff --git a/queue-4.9/usbip-list-don-t-list-devices-attached-to-vhci_hcd.patch b/queue-4.9/usbip-list-don-t-list-devices-attached-to-vhci_hcd.patch new file mode 100644 index 00000000000..4970ed7e1c6 --- /dev/null +++ b/queue-4.9/usbip-list-don-t-list-devices-attached-to-vhci_hcd.patch @@ -0,0 +1,51 @@ +From ef824501f50846589f02173d73ce3fe6021a9d2a Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Wed, 17 Jan 2018 12:08:03 -0700 +Subject: usbip: list: don't list devices attached to vhci_hcd + +From: Shuah Khan + +commit ef824501f50846589f02173d73ce3fe6021a9d2a upstream. + +usbip host lists devices attached to vhci_hcd on the same server +when user does attach over localhost or specifies the server as the +remote. + +usbip attach -r localhost -b busid +or +usbip attach -r servername (or server IP) + +Fix it to check and not list devices that are attached to vhci_hcd. + +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman + +--- + tools/usb/usbip/src/usbip_list.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/tools/usb/usbip/src/usbip_list.c ++++ b/tools/usb/usbip/src/usbip_list.c +@@ -187,6 +187,7 @@ static int list_devices(bool parsable) + const char *busid; + char product_name[128]; + int ret = -1; ++ const char *devpath; + + /* Create libudev context. */ + udev = udev_new(); +@@ -209,6 +210,14 @@ static int list_devices(bool parsable) + path = udev_list_entry_get_name(dev_list_entry); + dev = udev_device_new_from_syspath(udev, path); + ++ /* Ignore devices attached to vhci_hcd */ ++ devpath = udev_device_get_devpath(dev); ++ if (strstr(devpath, USBIP_VHCI_DRV_NAME)) { ++ dbg("Skip the device %s already attached to %s\n", ++ devpath, USBIP_VHCI_DRV_NAME); ++ continue; ++ } ++ + /* Get device information. */ + idVendor = udev_device_get_sysattr_value(dev, "idVendor"); + idProduct = udev_device_get_sysattr_value(dev, "idProduct"); diff --git a/queue-4.9/usbip-prevent-bind-loops-on-devices-attached-to-vhci_hcd.patch b/queue-4.9/usbip-prevent-bind-loops-on-devices-attached-to-vhci_hcd.patch new file mode 100644 index 00000000000..f0a1c570bc7 --- /dev/null +++ b/queue-4.9/usbip-prevent-bind-loops-on-devices-attached-to-vhci_hcd.patch @@ -0,0 +1,57 @@ +From ef54cf0c600fb8f5737fb001a9e357edda1a1de8 Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Wed, 17 Jan 2018 12:07:30 -0700 +Subject: usbip: prevent bind loops on devices attached to vhci_hcd + +From: Shuah Khan + +commit ef54cf0c600fb8f5737fb001a9e357edda1a1de8 upstream. + +usbip host binds to devices attached to vhci_hcd on the same server +when user does attach over localhost or specifies the server as the +remote. + +usbip attach -r localhost -b busid +or +usbip attach -r servername (or server IP) + +Unbind followed by bind works, however device is left in a bad state with +accesses via the attached busid result in errors and system hangs during +shutdown. + +Fix it to check and bail out if the device is already attached to vhci_hcd. + +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman + +--- + tools/usb/usbip/src/usbip_bind.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/tools/usb/usbip/src/usbip_bind.c ++++ b/tools/usb/usbip/src/usbip_bind.c +@@ -144,6 +144,7 @@ static int bind_device(char *busid) + int rc; + struct udev *udev; + struct udev_device *dev; ++ const char *devpath; + + /* Check whether the device with this bus ID exists. */ + udev = udev_new(); +@@ -152,8 +153,16 @@ static int bind_device(char *busid) + err("device with the specified bus ID does not exist"); + return -1; + } ++ devpath = udev_device_get_devpath(dev); + udev_unref(udev); + ++ /* If the device is already attached to vhci_hcd - bail out */ ++ if (strstr(devpath, USBIP_VHCI_DRV_NAME)) { ++ err("bind loop detected: device: %s is attached to %s\n", ++ devpath, USBIP_VHCI_DRV_NAME); ++ return -1; ++ } ++ + rc = unbind_other(busid); + if (rc == UNBIND_ST_FAILED) { + err("could not unbind driver from device on busid %s", busid); diff --git a/queue-4.9/usbip-vhci_hcd-clear-just-the-usb_port_stat_power-bit.patch b/queue-4.9/usbip-vhci_hcd-clear-just-the-usb_port_stat_power-bit.patch new file mode 100644 index 00000000000..1b32c3957de --- /dev/null +++ b/queue-4.9/usbip-vhci_hcd-clear-just-the-usb_port_stat_power-bit.patch @@ -0,0 +1,40 @@ +From shuahkh@osg.samsung.com Fri Feb 2 11:21:56 2018 +From: Shuah Khan +Date: Fri, 26 Jan 2018 11:54:35 -0700 +Subject: usbip: vhci_hcd: clear just the USB_PORT_STAT_POWER bit +To: valentina.manea.m@gmail.com, shuah@kernel.org, gregkh@linuxfoundation.org +Cc: Shuah Khan , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org +Message-ID: <20180126185435.15577-1-shuahkh@osg.samsung.com> + +From: Shuah Khan + +Upstream commit 1c9de5bf4286 ("usbip: vhci-hcd: Add USB3 SuperSpeed +support") + +vhci_hcd clears all the bits port_status bits instead of clearing +just the USB_PORT_STAT_POWER bit when it handles ClearPortFeature: +USB_PORT_FEAT_POWER. This causes vhci_hcd attach to fail in a bad +state, leaving device unusable by the client. The device is still +attached and however client can't use it. + +The problem was fixed as part of larger change to add USB3 Super +Speed support. This patch backports just the change to clear the +USB_PORT_STAT_POWER. + +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/usbip/vhci_hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -300,7 +300,7 @@ static int vhci_hub_control(struct usb_h + case USB_PORT_FEAT_POWER: + usbip_dbg_vhci_rh( + " ClearPortFeature: USB_PORT_FEAT_POWER\n"); +- dum->port_status[rhport] = 0; ++ dum->port_status[rhport] &= ~USB_PORT_STAT_POWER; + dum->resuming = 0; + break; + case USB_PORT_FEAT_C_RESET: