From: Greg Kroah-Hartman Date: Sun, 25 Jan 2015 14:41:07 +0000 (+0800) Subject: 3.18-stable patches X-Git-Tag: v3.10.66~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e29de7effec75908f3461ab591d67cd673302ef9;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch usb-console-fix-potential-use-after-free.patch usb-console-fix-uninitialised-ldisc-semaphore.patch usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch usb-dwc3-gadget-fix-trb-preparation-during-sg.patch usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch usb-gadget-gadgetfs-free-memory-allocated-by-memdup_user.patch usb-gadget-udc-atmel-change-setting-for-dma.patch usb-gadget-udc-atmel-fix-possible-in-hang-issue.patch usb-gadget-udc-atmel-fix-possible-oops-when-unloading-module.patch usb-keyspan-fix-null-deref-at-probe.patch usb-qcserial-option-make-at-urcs-work-for-sierra-wireless-mc73xx.patch --- diff --git a/queue-3.18/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch b/queue-3.18/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch new file mode 100644 index 00000000000..aadf569abfe --- /dev/null +++ b/queue-3.18/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch @@ -0,0 +1,81 @@ +From 56abcab833fafcfaeb2f5b25e0364c1dec45f53e Mon Sep 17 00:00:00 2001 +From: Arseny Solokha +Date: Sat, 6 Dec 2014 09:54:06 +0700 +Subject: OHCI: add a quirk for ULi M5237 blocking on reset + +From: Arseny Solokha + +commit 56abcab833fafcfaeb2f5b25e0364c1dec45f53e upstream. + +Commit 8dccddbc2368 ("OHCI: final fix for NVIDIA problems (I hope)") +introduced into 3.1.9 broke boot on e.g. Freescale P2020DS development +board. The code path that was previously specific to NVIDIA controllers +had then become taken for all chips. + +However, the M5237 installed on the board wedges solid when accessing +its base+OHCI_FMINTERVAL register, making it impossible to boot any +kernel newer than 3.1.8 on this particular and apparently other similar +machines. + +Don't readl() and writel() base+OHCI_FMINTERVAL on PCI ID 10b9:5237. + +The patch is suitable for the -next tree as well as all maintained +kernels up to 3.2 inclusive. + +Signed-off-by: Arseny Solokha +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -571,7 +571,8 @@ static void quirk_usb_handoff_ohci(struc + { + void __iomem *base; + u32 control; +- u32 fminterval; ++ u32 fminterval = 0; ++ bool no_fminterval = false; + int cnt; + + if (!mmio_resource_enabled(pdev, 0)) +@@ -581,6 +582,13 @@ static void quirk_usb_handoff_ohci(struc + if (base == NULL) + return; + ++ /* ++ * ULi M5237 OHCI controller locks the whole system when accessing ++ * the OHCI_FMINTERVAL offset. ++ */ ++ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237) ++ no_fminterval = true; ++ + control = readl(base + OHCI_CONTROL); + + /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */ +@@ -619,7 +627,9 @@ static void quirk_usb_handoff_ohci(struc + } + + /* software reset of the controller, preserving HcFmInterval */ +- fminterval = readl(base + OHCI_FMINTERVAL); ++ if (!no_fminterval) ++ fminterval = readl(base + OHCI_FMINTERVAL); ++ + writel(OHCI_HCR, base + OHCI_CMDSTATUS); + + /* reset requires max 10 us delay */ +@@ -628,7 +638,9 @@ static void quirk_usb_handoff_ohci(struc + break; + udelay(1); + } +- writel(fminterval, base + OHCI_FMINTERVAL); ++ ++ if (!no_fminterval) ++ writel(fminterval, base + OHCI_FMINTERVAL); + + /* Now the controller is safely in SUSPEND and nothing can wake it up */ + iounmap(base); diff --git a/queue-3.18/series b/queue-3.18/series index 7ce31d3ab2c..c4daf966f08 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -137,3 +137,16 @@ gpio-fix-memory-leak-and-sleep-while-atomic.patch gpio-fix-sleep-while-atomic-in-gpiochip_remove.patch gpio-sysfs-fix-gpio-chip-device-attribute-leak.patch gpio-sysfs-fix-gpio-device-attribute-leak.patch +ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch +usb-dwc3-gadget-fix-trb-preparation-during-sg.patch +usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch +usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch +usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch +usb-qcserial-option-make-at-urcs-work-for-sierra-wireless-mc73xx.patch +usb-keyspan-fix-null-deref-at-probe.patch +usb-gadget-gadgetfs-free-memory-allocated-by-memdup_user.patch +usb-gadget-udc-atmel-change-setting-for-dma.patch +usb-gadget-udc-atmel-fix-possible-in-hang-issue.patch +usb-gadget-udc-atmel-fix-possible-oops-when-unloading-module.patch +usb-console-fix-uninitialised-ldisc-semaphore.patch +usb-console-fix-potential-use-after-free.patch diff --git a/queue-3.18/usb-console-fix-potential-use-after-free.patch b/queue-3.18/usb-console-fix-potential-use-after-free.patch new file mode 100644 index 00000000000..fb195a72615 --- /dev/null +++ b/queue-3.18/usb-console-fix-potential-use-after-free.patch @@ -0,0 +1,74 @@ +From 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 5 Jan 2015 16:04:13 +0100 +Subject: USB: console: fix potential use after free + +From: Johan Hovold + +commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream. + +Use tty kref to release the fake tty in usb_console_setup to avoid use +after free if the underlying serial driver has acquired a reference. + +Note that using the tty destructor release_one_tty requires some more +state to be initialised. + +Fixes: 4a90f09b20f4 ("tty: usb-serial krefs") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/console.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -46,6 +46,8 @@ static struct console usbcons; + * ------------------------------------------------------------ + */ + ++static const struct tty_operations usb_console_fake_tty_ops = { ++}; + + /* + * The parsing of the command line works exactly like the +@@ -137,14 +139,17 @@ static int usb_console_setup(struct cons + goto reset_open_count; + } + kref_init(&tty->kref); +- tty_port_tty_set(&port->port, tty); + tty->driver = usb_serial_tty_driver; + tty->index = co->index; + init_ldsem(&tty->ldisc_sem); ++ INIT_LIST_HEAD(&tty->tty_files); ++ kref_get(&tty->driver->kref); ++ tty->ops = &usb_console_fake_tty_ops; + if (tty_init_termios(tty)) { + retval = -ENOMEM; +- goto free_tty; ++ goto put_tty; + } ++ tty_port_tty_set(&port->port, tty); + } + + /* only call the device specific open if this +@@ -162,7 +167,7 @@ static int usb_console_setup(struct cons + serial->type->set_termios(tty, port, &dummy); + + tty_port_tty_set(&port->port, NULL); +- kfree(tty); ++ tty_kref_put(tty); + } + set_bit(ASYNCB_INITIALIZED, &port->port.flags); + } +@@ -178,8 +183,8 @@ static int usb_console_setup(struct cons + + fail: + tty_port_tty_set(&port->port, NULL); +- free_tty: +- kfree(tty); ++ put_tty: ++ tty_kref_put(tty); + reset_open_count: + port->port.count = 0; + usb_autopm_put_interface(serial->interface); diff --git a/queue-3.18/usb-console-fix-uninitialised-ldisc-semaphore.patch b/queue-3.18/usb-console-fix-uninitialised-ldisc-semaphore.patch new file mode 100644 index 00000000000..2433bb36107 --- /dev/null +++ b/queue-3.18/usb-console-fix-uninitialised-ldisc-semaphore.patch @@ -0,0 +1,66 @@ +From d269d4434c72ed0da3a9b1230c30da82c4918c63 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 5 Jan 2015 16:04:12 +0100 +Subject: USB: console: fix uninitialised ldisc semaphore + +From: Johan Hovold + +commit d269d4434c72ed0da3a9b1230c30da82c4918c63 upstream. + +The USB console currently allocates a temporary fake tty which is used +to pass terminal settings to the underlying serial driver. + +The tty struct is not fully initialised, something which can lead to a +lockdep warning (or worse) if a serial driver tries to acquire a +line-discipline reference: + + usbserial: USB Serial support registered for pl2303 + pl2303 1-2.1:1.0: pl2303 converter detected + usb 1-2.1: pl2303 converter now attached to ttyUSB0 + INFO: trying to register non-static key. + the code is fine but needs lockdep annotation. + turning off the locking correctness validator. + CPU: 0 PID: 68 Comm: udevd Tainted: G W 3.18.0-rc5 #10 + [] (unwind_backtrace) from [] (show_stack+0x20/0x24) + [] (show_stack) from [] (dump_stack+0x24/0x28) + [] (dump_stack) from [] (__lock_acquire+0x1e50/0x2004) + [] (__lock_acquire) from [] (lock_acquire+0xe4/0x18c) + [] (lock_acquire) from [] (ldsem_down_read_trylock+0x78/0x90) + [] (ldsem_down_read_trylock) from [] (tty_ldisc_ref+0x24/0x58) + [] (tty_ldisc_ref) from [] (usb_serial_handle_dcd_change+0x48/0xe8) + [] (usb_serial_handle_dcd_change) from [] (pl2303_read_int_callback+0x210/0x220 [pl2303]) + [] (pl2303_read_int_callback [pl2303]) from [] (__usb_hcd_giveback_urb+0x80/0x140) + [] (__usb_hcd_giveback_urb) from [] (usb_giveback_urb_bh+0x98/0xd4) + [] (usb_giveback_urb_bh) from [] (tasklet_hi_action+0x9c/0x108) + [] (tasklet_hi_action) from [] (__do_softirq+0x148/0x42c) + [] (__do_softirq) from [] (irq_exit+0xd8/0x114) + [] (irq_exit) from [] (__handle_domain_irq+0x84/0xdc) + [] (__handle_domain_irq) from [] (omap_intc_handle_irq+0xd8/0xe0) + [] (omap_intc_handle_irq) from [] (__irq_svc+0x44/0x7c) + Exception stack(0xdf4e7f08 to 0xdf4e7f50) + 7f00: debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c + 7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50 + 7f40: c038ebc0 c038d74c 600f0013 ffffffff + [] (__irq_svc) from [] (___sys_sendmsg.part.29+0x0/0x2e0) + [] (___sys_sendmsg.part.29) from [] (SyS_sendmsg+0x18/0x1c) + [] (SyS_sendmsg) from [] (ret_fast_syscall+0x0/0x48) + console [ttyUSB0] enabled + +Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/console.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -140,6 +140,7 @@ static int usb_console_setup(struct cons + tty_port_tty_set(&port->port, tty); + tty->driver = usb_serial_tty_driver; + tty->index = co->index; ++ init_ldsem(&tty->ldisc_sem); + if (tty_init_termios(tty)) { + retval = -ENOMEM; + goto free_tty; diff --git a/queue-3.18/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch b/queue-3.18/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch new file mode 100644 index 00000000000..eabfbc8516b --- /dev/null +++ b/queue-3.18/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch @@ -0,0 +1,36 @@ +From 1ae78a4870989a354028cb17dabf819b595e70e3 Mon Sep 17 00:00:00 2001 +From: David Peterson +Date: Tue, 6 Jan 2015 15:00:52 +0000 +Subject: USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices + +From: David Peterson + +commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream. + +Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks +devices. + +Signed-off-by: David Peterson +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -120,10 +120,12 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ +- { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */ ++ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */ ++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ ++ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/queue-3.18/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch b/queue-3.18/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch new file mode 100644 index 00000000000..743bcd3f6e4 --- /dev/null +++ b/queue-3.18/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch @@ -0,0 +1,32 @@ +From 90441b4dbe90ba0c38111ea89fa093a8c9627801 Mon Sep 17 00:00:00 2001 +From: Preston Fick +Date: Sat, 27 Dec 2014 01:32:41 -0600 +Subject: USB: cp210x: fix ID for production CEL MeshConnect USB Stick + +From: Preston Fick + +commit 90441b4dbe90ba0c38111ea89fa093a8c9627801 upstream. + +Fixing typo for MeshConnect IDs. The original PID (0x8875) is not in +production and is not needed. Instead it has been changed to the +official production PID (0x8857). + +Signed-off-by: Preston Fick +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -120,7 +120,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ +- { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */ ++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ diff --git a/queue-3.18/usb-dwc3-gadget-fix-trb-preparation-during-sg.patch b/queue-3.18/usb-dwc3-gadget-fix-trb-preparation-during-sg.patch new file mode 100644 index 00000000000..e7b2e4dbf06 --- /dev/null +++ b/queue-3.18/usb-dwc3-gadget-fix-trb-preparation-during-sg.patch @@ -0,0 +1,44 @@ +From ec512fb8e5611fed1df2895f90317ce6797d6b32 Mon Sep 17 00:00:00 2001 +From: Amit Virdi +Date: Tue, 13 Jan 2015 14:27:20 +0530 +Subject: usb: dwc3: gadget: Fix TRB preparation during SG + +From: Amit Virdi + +commit ec512fb8e5611fed1df2895f90317ce6797d6b32 upstream. + +When scatter gather (SG) is used, multiple TRBs are prepared from one DWC3 +request (dwc3_request). So while preparing TRBs, the 'last' flag should be set +only when it is the last TRB being prepared from the last dwc3_request entry. + +The current implementation uses list_is_last to check if the dwc3_request is the +last entry from the request_list. However, list_is_last returns false for the +last entry too. This is because, while preparing the first TRB from a request, +the function dwc3_prepare_one_trb modifies the request's next and prev pointers +while moving the URB to req_queued. Hence, list_is_last always returns false no +matter what. + +The correct way is not to access the modified pointers of dwc3_request but to +use list_empty macro instead. + +Fixes: e5ba5ec833aa (usb: dwc3: gadget: fix scatter gather implementation) +Signed-off-by: Amit Virdi +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -882,8 +882,7 @@ static void dwc3_prepare_trbs(struct dwc + + if (i == (request->num_mapped_sgs - 1) || + sg_is_last(s)) { +- if (list_is_last(&req->list, +- &dep->request_list)) ++ if (list_empty(&dep->request_list)) + last_one = true; + chain = false; + } diff --git a/queue-3.18/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch b/queue-3.18/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch new file mode 100644 index 00000000000..677999e65fe --- /dev/null +++ b/queue-3.18/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch @@ -0,0 +1,44 @@ +From 39e60635a01520e8c8ed3946a28c2b98e6a46f79 Mon Sep 17 00:00:00 2001 +From: Amit Virdi +Date: Tue, 13 Jan 2015 14:27:21 +0530 +Subject: usb: dwc3: gadget: Stop TRB preparation after limit is reached + +From: Amit Virdi + +commit 39e60635a01520e8c8ed3946a28c2b98e6a46f79 upstream. + +DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This +means, the max TRBs that can be submitted for an EP is fixed to 32. Since the +request queue for an EP is a linked list, any number of requests can be queued +to it by the gadget layer. However, the dwc3 driver must not submit TRBs more +than the pool it has created for. This limit wasn't respected when SG was used +resulting in submitting more than the max TRBs, eventually leading to +non-transfer of the TRBs submitted over the max limit. + +Root cause: +When SG is used, there are two loops iterating to prepare TRBs: + - Outer loop over the request_list + - Inner loop over the SG list +The code was missing break to get out of the outer loop. + +Fixes: eeb720fb21d6 (usb: dwc3: gadget: add support for SG lists) +Signed-off-by: Amit Virdi +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -900,6 +900,9 @@ static void dwc3_prepare_trbs(struct dwc + if (last_one) + break; + } ++ ++ if (last_one) ++ break; + } else { + dma = req->request.dma; + length = req->request.length; diff --git a/queue-3.18/usb-gadget-gadgetfs-free-memory-allocated-by-memdup_user.patch b/queue-3.18/usb-gadget-gadgetfs-free-memory-allocated-by-memdup_user.patch new file mode 100644 index 00000000000..3e5e0e117af --- /dev/null +++ b/queue-3.18/usb-gadget-gadgetfs-free-memory-allocated-by-memdup_user.patch @@ -0,0 +1,32 @@ +From b44be2462dbe3e23f0aedff64de52a1e8e47a1cd Mon Sep 17 00:00:00 2001 +From: Mario Schuknecht +Date: Tue, 16 Dec 2014 08:58:57 +0100 +Subject: usb: gadget: gadgetfs: Free memory allocated by memdup_user() + +From: Mario Schuknecht + +commit b44be2462dbe3e23f0aedff64de52a1e8e47a1cd upstream. + +Commit 3b74c73f8d6f053f422e85fce955b61fb181cfe7 switched over to memdup_user() +in ep_write() function and removed kfree (kbuf). +memdup_user() function allocates memory which is never freed. + +Fixes: 3b74c73 (usb: gadget: inode: switch over to memdup_user()) +Signed-off-by: Mario Schuknecht +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/legacy/inode.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -449,6 +449,7 @@ ep_write (struct file *fd, const char __ + data->name, len, (int) value); + free1: + mutex_unlock(&data->lock); ++ kfree (kbuf); + return value; + } + diff --git a/queue-3.18/usb-gadget-udc-atmel-change-setting-for-dma.patch b/queue-3.18/usb-gadget-udc-atmel-change-setting-for-dma.patch new file mode 100644 index 00000000000..563bf33335e --- /dev/null +++ b/queue-3.18/usb-gadget-udc-atmel-change-setting-for-dma.patch @@ -0,0 +1,40 @@ +From f40afdddeb6c54ffd1e2920a5e93e363d6748db6 Mon Sep 17 00:00:00 2001 +From: Bo Shen +Date: Wed, 17 Dec 2014 17:18:48 +0800 +Subject: usb: gadget: udc: atmel: change setting for DMA + +From: Bo Shen + +commit f40afdddeb6c54ffd1e2920a5e93e363d6748db6 upstream. + +According to the datasheet, when transfer using DMA, the control +setting for IN packet only need END_BUF_EN, END_BUF_IE, CH_EN, +while for OUT packet, need more two bits END_TR_EN and END_TR_IE +to be configured. + +Fixes: 914a3f3b3754 (USB: add atmel_usba_udc driver) +Acked-by: Nicolas Ferre +Signed-off-by: Bo Shen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -716,10 +716,10 @@ static int queue_dma(struct usba_udc *ud + req->using_dma = 1; + req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length) + | USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE +- | USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE; ++ | USBA_DMA_END_BUF_EN; + +- if (ep->is_in) +- req->ctrl |= USBA_DMA_END_BUF_EN; ++ if (!ep->is_in) ++ req->ctrl |= USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE; + + /* + * Add this request to the queue and submit for DMA if diff --git a/queue-3.18/usb-gadget-udc-atmel-fix-possible-in-hang-issue.patch b/queue-3.18/usb-gadget-udc-atmel-fix-possible-in-hang-issue.patch new file mode 100644 index 00000000000..9af28dd0678 --- /dev/null +++ b/queue-3.18/usb-gadget-udc-atmel-fix-possible-in-hang-issue.patch @@ -0,0 +1,39 @@ +From 6785a1034461c2d2c205215f63a50a740896e55b Mon Sep 17 00:00:00 2001 +From: Bo Shen +Date: Wed, 17 Dec 2014 17:18:49 +0800 +Subject: usb: gadget: udc: atmel: fix possible IN hang issue + +From: Bo Shen + +commit 6785a1034461c2d2c205215f63a50a740896e55b upstream. + +When receive data, the RXRDY in status register set by hardware +after a new packet has been stored in the endpoint FIFO. When it +is copied from FIFO, this bit is cleared which make the FIFO can +be accessed again. + +In the receive_data() function, this bit RXRDY has been cleared. +So, after the receive_data() function return, this bit should +not be cleared again, or else it may cause the accessing FIFO +corrupt, which will make the data loss. + +Fixes: 914a3f3b3754 (USB: add atmel_usba_udc driver) +Acked-by: Nicolas Ferre +Signed-off-by: Bo Shen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -1572,7 +1572,6 @@ static void usba_ep_irq(struct usba_udc + if ((epstatus & epctrl) & USBA_RX_BK_RDY) { + DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name); + receive_data(ep); +- usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY); + } + } + diff --git a/queue-3.18/usb-gadget-udc-atmel-fix-possible-oops-when-unloading-module.patch b/queue-3.18/usb-gadget-udc-atmel-fix-possible-oops-when-unloading-module.patch new file mode 100644 index 00000000000..b6d850c2bfe --- /dev/null +++ b/queue-3.18/usb-gadget-udc-atmel-fix-possible-oops-when-unloading-module.patch @@ -0,0 +1,98 @@ +From 5fb694f96e7c19e66b1c55124b98812e32e3efa5 Mon Sep 17 00:00:00 2001 +From: Songjun Wu +Date: Fri, 9 Jan 2015 17:11:24 +0100 +Subject: usb: gadget: udc: atmel: fix possible oops when unloading module + +From: Songjun Wu + +commit 5fb694f96e7c19e66b1c55124b98812e32e3efa5 upstream. + +When unloading the module 'g_hid.ko', the urb request will be dequeued and the +completion routine will be excuted. If there is no urb packet, the urb request +will not be added to the endpoint queue and the completion routine pointer in +urb request is NULL. + +Accessing to this NULL function pointer will cause the Oops issue reported +below. + +Add the code to check if the urb request is in the endpoint queue +or not. If the urb request is not in the endpoint queue, a negative +error code will be returned. + +Here is the Oops log: + +Unable to handle kernel NULL pointer dereference at virtual address 00000000 +pgd = dedf0000 +[00000000] *pgd=3ede5831, *pte=00000000, *ppte=00000000 +Internal error: Oops: 80000007 [#1] ARM +Modules linked in: g_hid(-) usb_f_hid libcomposite +CPU: 0 PID: 923 Comm: rmmod Not tainted 3.18.0+ #2 +Hardware name: Atmel SAMA5 (Device Tree) +task: df6b1100 ti: dedf6000 task.ti: dedf6000 +PC is at 0x0 +LR is at usb_gadget_giveback_request+0xc/0x10 +pc : [<00000000>] lr : [] psr: 60000093 +sp : dedf7eb0 ip : df572634 fp : 00000000 +r10: 00000000 r9 : df52e210 r8 : 60000013 +r7 : df6a9858 r6 : df52e210 r5 : df6a9858 r4 : df572600 +r3 : 00000000 r2 : ffffff98 r1 : df572600 r0 : df6a9868 +Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +Control: 10c53c7d Table: 3edf0059 DAC: 00000015 +Process rmmod (pid: 923, stack limit = 0xdedf6230) +Stack: (0xdedf7eb0 to 0xdedf8000) +7ea0: 00000000 c02adbbc df572580 deced608 +7ec0: df572600 df6a9868 df572634 c02aed3c df577c00 c01b8608 00000000 df6be27c +7ee0: 00200200 00100100 bf0162f4 c000e544 dedf6000 00000000 00000000 bf010c00 +7f00: bf0162cc bf00159c 00000000 df572980 df52e218 00000001 df5729b8 bf0031d0 +[..] +[] (usb_gadget_giveback_request) from [] (request_complete+0x64/0x88) +[] (request_complete) from [] (usba_ep_dequeue+0x70/0x128) +[] (usba_ep_dequeue) from [] (hidg_unbind+0x50/0x7c [usb_f_hid]) +[] (hidg_unbind [usb_f_hid]) from [] (remove_config.isra.6+0x98/0x9c [libcomposite]) +[] (remove_config.isra.6 [libcomposite]) from [] (__composite_unbind+0x34/0x98 [libcomposite]) +[] (__composite_unbind [libcomposite]) from [] (usb_gadget_remove_driver+0x50/0x78) +[] (usb_gadget_remove_driver) from [] (usb_gadget_unregister_driver+0x64/0x94) +[] (usb_gadget_unregister_driver) from [] (hidg_cleanup+0x10/0x34 [g_hid]) +[] (hidg_cleanup [g_hid]) from [] (SyS_delete_module+0x118/0x19c) +[] (SyS_delete_module) from [] (ret_fast_syscall+0x0/0x30) +Code: bad PC value + +Signed-off-by: Songjun Wu +[nicolas.ferre@atmel.com: reworked the commit message] +Signed-off-by: Nicolas Ferre +Fixes: 914a3f3b3754 ("USB: add atmel_usba_udc driver") +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep + { + struct usba_ep *ep = to_usba_ep(_ep); + struct usba_udc *udc = ep->udc; +- struct usba_request *req = to_usba_req(_req); ++ struct usba_request *req; + unsigned long flags; + u32 status; + +@@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep + + spin_lock_irqsave(&udc->lock, flags); + ++ list_for_each_entry(req, &ep->queue, queue) { ++ if (&req->req == _req) ++ break; ++ } ++ ++ if (&req->req != _req) { ++ spin_unlock_irqrestore(&udc->lock, flags); ++ return -EINVAL; ++ } ++ + if (req->using_dma) { + /* + * If this request is currently being transferred, diff --git a/queue-3.18/usb-keyspan-fix-null-deref-at-probe.patch b/queue-3.18/usb-keyspan-fix-null-deref-at-probe.patch new file mode 100644 index 00000000000..15853b2e653 --- /dev/null +++ b/queue-3.18/usb-keyspan-fix-null-deref-at-probe.patch @@ -0,0 +1,116 @@ +From b5122236bba8d7ef62153da5b55cc65d0944c61e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Dec 2014 18:39:39 +0100 +Subject: USB: keyspan: fix null-deref at probe + +From: Johan Hovold + +commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream. + +Fix null-pointer dereference during probe if the interface-status +completion handler is called before the individual ports have been set +up. + +Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and +memory leaks") +Reported-by: Richard +Tested-by: Richard +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -410,6 +410,8 @@ static void usa26_instat_callback(struct + } + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -420,7 +422,7 @@ static void usa26_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -527,6 +529,8 @@ static void usa28_instat_callback(struct + } + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -537,7 +541,7 @@ static void usa28_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -607,6 +611,8 @@ static void usa49_instat_callback(struct + } + port = serial->port[msg->portNumber]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -617,7 +623,7 @@ static void usa49_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -855,6 +861,8 @@ static void usa90_instat_callback(struct + + port = serial->port[0]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -865,7 +873,7 @@ static void usa90_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -926,6 +934,8 @@ static void usa67_instat_callback(struct + + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -934,7 +944,7 @@ static void usa67_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) diff --git a/queue-3.18/usb-qcserial-option-make-at-urcs-work-for-sierra-wireless-mc73xx.patch b/queue-3.18/usb-qcserial-option-make-at-urcs-work-for-sierra-wireless-mc73xx.patch new file mode 100644 index 00000000000..652e56df864 --- /dev/null +++ b/queue-3.18/usb-qcserial-option-make-at-urcs-work-for-sierra-wireless-mc73xx.patch @@ -0,0 +1,81 @@ +From d80c0d14183516f184a5ac88e11008ee4c7d2a2e Mon Sep 17 00:00:00 2001 +From: Reinhard Speyerer +Date: Tue, 6 Jan 2015 22:06:38 +0100 +Subject: USB: qcserial/option: make AT URCs work for Sierra Wireless MC73xx + +From: Reinhard Speyerer + +commit d80c0d14183516f184a5ac88e11008ee4c7d2a2e upstream. + +As has been discussed in the thread starting with +https://lkml.kernel.org/g/549748e9.d+SiJzqu50f1r4lSAL043YSc@arcor.de +Sierra Wireless MC73xx devices with USB VID/PID 0x1199:0x68c0 require the +option_send_setup() code to be used on the USB interface for the AT port +to make unsolicited response codes work correctly. Move these devices from +the qcserial driver where they have been added by commit +70a3615fc07c2330ed7c1e922f3c44f4a67c0762 ("usb: qcserial: add Sierra Wireless +MC73xx") to the option driver and add a MC73xx-specific blacklist +to ensure that +1. the sendsetup code is not used for the DIAG/DM and NMEA interfaces +2. the option driver does not attach to the QMI/network interfaces + +Signed-off-by: Reinhard Speyerer +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 11 ++++++++++- + drivers/usb/serial/qcserial.c | 1 - + 2 files changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -234,6 +234,8 @@ static void option_instat_callback(struc + + #define QUALCOMM_VENDOR_ID 0x05C6 + ++#define SIERRA_VENDOR_ID 0x1199 ++ + #define CMOTECH_VENDOR_ID 0x16d8 + #define CMOTECH_PRODUCT_6001 0x6001 + #define CMOTECH_PRODUCT_CMU_300 0x6002 +@@ -512,7 +514,7 @@ enum option_blacklist_reason { + OPTION_BLACKLIST_RESERVED_IF = 2 + }; + +-#define MAX_BL_NUM 8 ++#define MAX_BL_NUM 11 + struct option_blacklist_info { + /* bitfield of interface numbers for OPTION_BLACKLIST_SENDSETUP */ + const unsigned long sendsetup; +@@ -601,6 +603,11 @@ static const struct option_blacklist_inf + .reserved = BIT(1) | BIT(5), + }; + ++static const struct option_blacklist_info sierra_mc73xx_blacklist = { ++ .sendsetup = BIT(0) | BIT(2), ++ .reserved = BIT(8) | BIT(10) | BIT(11), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -1098,6 +1105,8 @@ static const struct usb_device_id option + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ ++ { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff), ++ .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */ + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -142,7 +142,6 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x0f3d, 0x68a2)}, /* Sierra Wireless MC7700 */ + {DEVICE_SWI(0x114f, 0x68a2)}, /* Sierra Wireless MC7750 */ + {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */ +- {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC73xx */ + {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */ + {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */ + {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */