From 40fb742f8e098d1f0d7dba01715b44242f285f3a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 6 Apr 2015 21:01:51 +0200 Subject: [PATCH] 3.19-stable patches added patches: brcmfmac-perform-bound-checking-on-vendor-command-buffer.patch cpuidle-mvebu-fix-the-cpu-pm-notifier-usage.patch of-irq-fix-of_irq_parse_one-returned-error-codes.patch perf-fix-irq_work-tail-recursion.patch phy-find-the-right-match-in-devm_phy_destroy.patch rtlwifi-improve-handling-of-ipv6-packets.patch staging-vt6656-vnt_rf_setpower-fix-missing-rate-rate_12m.patch uas-add-us_fl_no_ata_1x-for-initio-corporation-controllers-devices.patch usb-chipidea-otg-add-a_alt_hnp_support-response-for-b-device.patch usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch usb-phy-am335x-control-check-return-value-of.patch vt6655-fix-late-setting-of-byrftype.patch vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch --- ...nd-checking-on-vendor-command-buffer.patch | 50 ++++++++++++ ...-mvebu-fix-the-cpu-pm-notifier-usage.patch | 43 ++++++++++ ...f_irq_parse_one-returned-error-codes.patch | 57 ++++++++++++++ .../perf-fix-irq_work-tail-recursion.patch | 78 +++++++++++++++++++ ...-the-right-match-in-devm_phy_destroy.patch | 36 +++++++++ ...ifi-improve-handling-of-ipv6-packets.patch | 44 +++++++++++ queue-3.19/series | 13 ++++ ...f_setpower-fix-missing-rate-rate_12m.patch | 29 +++++++ ...itio-corporation-controllers-devices.patch | 38 +++++++++ ...lt_hnp_support-response-for-b-device.patch | 66 ++++++++++++++++ ...onnect-after-switching-to-peripheral.patch | 77 ++++++++++++++++++ ...am335x-control-check-return-value-of.patch | 34 ++++++++ .../vt6655-fix-late-setting-of-byrftype.patch | 59 ++++++++++++++ ...fbsetpower-fix-missing-rate-rate_12m.patch | 29 +++++++ 14 files changed, 653 insertions(+) create mode 100644 queue-3.19/brcmfmac-perform-bound-checking-on-vendor-command-buffer.patch create mode 100644 queue-3.19/cpuidle-mvebu-fix-the-cpu-pm-notifier-usage.patch create mode 100644 queue-3.19/of-irq-fix-of_irq_parse_one-returned-error-codes.patch create mode 100644 queue-3.19/perf-fix-irq_work-tail-recursion.patch create mode 100644 queue-3.19/phy-find-the-right-match-in-devm_phy_destroy.patch create mode 100644 queue-3.19/rtlwifi-improve-handling-of-ipv6-packets.patch create mode 100644 queue-3.19/staging-vt6656-vnt_rf_setpower-fix-missing-rate-rate_12m.patch create mode 100644 queue-3.19/uas-add-us_fl_no_ata_1x-for-initio-corporation-controllers-devices.patch create mode 100644 queue-3.19/usb-chipidea-otg-add-a_alt_hnp_support-response-for-b-device.patch create mode 100644 queue-3.19/usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch create mode 100644 queue-3.19/usb-phy-am335x-control-check-return-value-of.patch create mode 100644 queue-3.19/vt6655-fix-late-setting-of-byrftype.patch create mode 100644 queue-3.19/vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch diff --git a/queue-3.19/brcmfmac-perform-bound-checking-on-vendor-command-buffer.patch b/queue-3.19/brcmfmac-perform-bound-checking-on-vendor-command-buffer.patch new file mode 100644 index 00000000000..1fe040abac2 --- /dev/null +++ b/queue-3.19/brcmfmac-perform-bound-checking-on-vendor-command-buffer.patch @@ -0,0 +1,50 @@ +From 3f1615340acea54e21f4b9d4d65921540dca84b2 Mon Sep 17 00:00:00 2001 +From: Pontus Fuchs +Date: Fri, 6 Mar 2015 16:18:41 +0100 +Subject: brcmfmac: Perform bound checking on vendor command buffer + +From: Pontus Fuchs + +commit 3f1615340acea54e21f4b9d4d65921540dca84b2 upstream. + +A short or malformed vendor command buffer could cause reads outside +the command buffer. + +Signed-off-by: Pontus Fuchs +[arend@broadcom.com: slightly modified debug trace output] +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c +@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd + void *dcmd_buf = NULL, *wr_pointer; + u16 msglen, maxmsglen = PAGE_SIZE - 0x100; + +- brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set, +- cmdhdr->len); ++ if (len < sizeof(*cmdhdr)) { ++ brcmf_err("vendor command too short: %d\n", len); ++ return -EINVAL; ++ } + + vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); + ifp = vif->ifp; + +- len -= sizeof(struct brcmf_vndr_dcmd_hdr); ++ brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd); ++ ++ if (cmdhdr->offset > len) { ++ brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len); ++ return -EINVAL; ++ } ++ ++ len -= cmdhdr->offset; + ret_len = cmdhdr->len; + if (ret_len > 0 || len > 0) { + if (len > BRCMF_DCMD_MAXLEN) { diff --git a/queue-3.19/cpuidle-mvebu-fix-the-cpu-pm-notifier-usage.patch b/queue-3.19/cpuidle-mvebu-fix-the-cpu-pm-notifier-usage.patch new file mode 100644 index 00000000000..68250b95204 --- /dev/null +++ b/queue-3.19/cpuidle-mvebu-fix-the-cpu-pm-notifier-usage.patch @@ -0,0 +1,43 @@ +From 43b68879de27b1993518687fbc6013da80cdcbfe Mon Sep 17 00:00:00 2001 +From: Gregory CLEMENT +Date: Thu, 26 Feb 2015 18:20:48 +0100 +Subject: cpuidle: mvebu: Fix the CPU PM notifier usage + +From: Gregory CLEMENT + +commit 43b68879de27b1993518687fbc6013da80cdcbfe upstream. + +As stated in kernel/cpu_pm.c, "Platform is responsible for ensuring +that cpu_pm_enter is not called twice on the same CPU before +cpu_pm_exit is called.". In the current code in case of failure when +calling mvebu_v7_cpu_suspend, the function cpu_pm_exit() is never +called whereas cpu_pm_enter() was called just before. + +This patch moves the cpu_pm_exit() in order to balance the +cpu_pm_enter() calls. + +Reported-by: Fulvio Benini +Signed-off-by: Gregory CLEMENT +Signed-off-by: Daniel Lezcano +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpuidle/cpuidle-mvebu-v7.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/cpuidle/cpuidle-mvebu-v7.c ++++ b/drivers/cpuidle/cpuidle-mvebu-v7.c +@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cp + deepidle = true; + + ret = mvebu_v7_cpu_suspend(deepidle); ++ cpu_pm_exit(); ++ + if (ret) + return ret; + +- cpu_pm_exit(); +- + return index; + } + diff --git a/queue-3.19/of-irq-fix-of_irq_parse_one-returned-error-codes.patch b/queue-3.19/of-irq-fix-of_irq_parse_one-returned-error-codes.patch new file mode 100644 index 00000000000..5d1fdcf9ba0 --- /dev/null +++ b/queue-3.19/of-irq-fix-of_irq_parse_one-returned-error-codes.patch @@ -0,0 +1,57 @@ +From d7c146053dd195b90c79b9b8131431f44541d015 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Wed, 18 Mar 2015 00:21:32 +0200 +Subject: of/irq: Fix of_irq_parse_one() returned error codes + +From: Laurent Pinchart + +commit d7c146053dd195b90c79b9b8131431f44541d015 upstream. + +The error code paths that require cleanup use a goto to jump to the +cleanup code and return an error code. However, the error code variable +res, which is initialized to -EINVAL when declared, is then overwritten +with the return value of of_parse_phandle_with_args(), and reused as the +return code from of_irq_parse_one(). This leads to an undetermined error +being returned instead of the expected -EINVAL value. Fix it. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/of/irq.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/of/irq.c ++++ b/drivers/of/irq.c +@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node + struct device_node *p; + const __be32 *intspec, *tmp, *addr; + u32 intsize, intlen; +- int i, res = -EINVAL; ++ int i, res; + + pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index); + +@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node + + /* Get size of interrupt specifier */ + tmp = of_get_property(p, "#interrupt-cells", NULL); +- if (tmp == NULL) ++ if (tmp == NULL) { ++ res = -EINVAL; + goto out; ++ } + intsize = be32_to_cpu(*tmp); + + pr_debug(" intsize=%d intlen=%d\n", intsize, intlen); + + /* Check index */ +- if ((index + 1) * intsize > intlen) ++ if ((index + 1) * intsize > intlen) { ++ res = -EINVAL; + goto out; ++ } + + /* Copy intspec into irq structure */ + intspec += index * intsize; diff --git a/queue-3.19/perf-fix-irq_work-tail-recursion.patch b/queue-3.19/perf-fix-irq_work-tail-recursion.patch new file mode 100644 index 00000000000..433acf774a0 --- /dev/null +++ b/queue-3.19/perf-fix-irq_work-tail-recursion.patch @@ -0,0 +1,78 @@ +From d525211f9d1be8b523ec7633f080f2116f5ea536 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 19 Feb 2015 18:03:11 +0100 +Subject: perf: Fix irq_work 'tail' recursion + +From: Peter Zijlstra + +commit d525211f9d1be8b523ec7633f080f2116f5ea536 upstream. + +Vince reported a watchdog lockup like: + + [] perf_tp_event+0xc4/0x210 + [] perf_trace_lock+0x12a/0x160 + [] lock_release+0x130/0x260 + [] _raw_spin_unlock_irqrestore+0x24/0x40 + [] do_send_sig_info+0x5d/0x80 + [] send_sigio_to_task+0x12f/0x1a0 + [] send_sigio+0xae/0x100 + [] kill_fasync+0x97/0xf0 + [] perf_event_wakeup+0xd4/0xf0 + [] perf_pending_event+0x33/0x60 + [] irq_work_run_list+0x4c/0x80 + [] irq_work_run+0x18/0x40 + [] smp_trace_irq_work_interrupt+0x3f/0xc0 + [] trace_irq_work_interrupt+0x6d/0x80 + +Which is caused by an irq_work generating new irq_work and therefore +not allowing forward progress. + +This happens because processing the perf irq_work triggers another +perf event (tracepoint stuff) which in turn generates an irq_work ad +infinitum. + +Avoid this by raising the recursion counter in the irq_work -- which +effectively disables all software events (including tracepoints) from +actually triggering again. + +Reported-by: Vince Weaver +Tested-by: Vince Weaver +Signed-off-by: Peter Zijlstra (Intel) +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Paul Mackerras +Cc: Steven Rostedt +Link: http://lkml.kernel.org/r/20150219170311.GH21418@twins.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -4412,6 +4412,13 @@ static void perf_pending_event(struct ir + { + struct perf_event *event = container_of(entry, + struct perf_event, pending); ++ int rctx; ++ ++ rctx = perf_swevent_get_recursion_context(); ++ /* ++ * If we 'fail' here, that's OK, it means recursion is already disabled ++ * and we won't recurse 'further'. ++ */ + + if (event->pending_disable) { + event->pending_disable = 0; +@@ -4422,6 +4429,9 @@ static void perf_pending_event(struct ir + event->pending_wakeup = 0; + perf_event_wakeup(event); + } ++ ++ if (rctx >= 0) ++ perf_swevent_put_recursion_context(rctx); + } + + /* diff --git a/queue-3.19/phy-find-the-right-match-in-devm_phy_destroy.patch b/queue-3.19/phy-find-the-right-match-in-devm_phy_destroy.patch new file mode 100644 index 00000000000..2c9294d0f91 --- /dev/null +++ b/queue-3.19/phy-find-the-right-match-in-devm_phy_destroy.patch @@ -0,0 +1,36 @@ +From 2f1bce487cd0a02623cff3d877940f9a2026341c Mon Sep 17 00:00:00 2001 +From: Thierry Reding +Date: Wed, 25 Feb 2015 16:16:29 +0100 +Subject: phy: Find the right match in devm_phy_destroy() + +From: Thierry Reding + +commit 2f1bce487cd0a02623cff3d877940f9a2026341c upstream. + +devm_phy_create() stores the pointer to the new PHY at the address +returned by devres_alloc(). The res parameter passed to devm_phy_match() +is therefore the location where the pointer to the PHY is stored, hence +it needs to be dereferenced before comparing to the match data in order +to find the correct match. + +Signed-off-by: Thierry Reding +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/phy-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -52,7 +52,9 @@ static void devm_phy_consume(struct devi + + static int devm_phy_match(struct device *dev, void *res, void *match_data) + { +- return res == match_data; ++ struct phy **phy = res; ++ ++ return *phy == match_data; + } + + /** diff --git a/queue-3.19/rtlwifi-improve-handling-of-ipv6-packets.patch b/queue-3.19/rtlwifi-improve-handling-of-ipv6-packets.patch new file mode 100644 index 00000000000..8eab0325d50 --- /dev/null +++ b/queue-3.19/rtlwifi-improve-handling-of-ipv6-packets.patch @@ -0,0 +1,44 @@ +From c8f0345586694a33f828bc6b177fb21eb1702325 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 24 Feb 2015 09:23:01 -0600 +Subject: rtlwifi: Improve handling of IPv6 packets + +From: Larry Finger + +commit c8f0345586694a33f828bc6b177fb21eb1702325 upstream. + +Routine rtl_is_special_data() is supposed to identify packets that need to +use a low bit rate so that the probability of successful transmission is +high. The current version has a bug that causes all IPv6 packets to be +labelled as special, with a corresponding low rate of transmission. A +complete fix will be quite intrusive, but until that is available, all +IPv6 packets are identified as regular. + +This patch also removes a magic number. + +Reported-and-tested-by: Alan Fisher +Signed-off-by: Larry Finger +Cc: Alan Fisher +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/base.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/base.c ++++ b/drivers/net/wireless/rtlwifi/base.c +@@ -1314,8 +1314,11 @@ u8 rtl_is_special_data(struct ieee80211_ + } + + return true; +- } else if (0x86DD == ether_type) { +- return true; ++ } else if (ETH_P_IPV6 == ether_type) { ++ /* TODO: Handle any IPv6 cases that need special handling. ++ * For now, always return false ++ */ ++ goto end; + } + + end: diff --git a/queue-3.19/series b/queue-3.19/series index 185f28f6130..9c095cff59d 100644 --- a/queue-3.19/series +++ b/queue-3.19/series @@ -42,3 +42,16 @@ iwlwifi-mvm-rs-fix-bt-coex-check-to-look-at-the-correct-ant.patch iwlwifi-fix-max_ht_ampdu_exponent-for-older-devices.patch iwlwifi-mvm-bt-coex-fix-a-null-pointer-exception.patch iwlwifi-mvm-fix-roc-removal.patch +uas-add-us_fl_no_ata_1x-for-initio-corporation-controllers-devices.patch +usb-phy-am335x-control-check-return-value-of.patch +usb-chipidea-otg-add-a_alt_hnp_support-response-for-b-device.patch +usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch +phy-find-the-right-match-in-devm_phy_destroy.patch +rtlwifi-improve-handling-of-ipv6-packets.patch +cpuidle-mvebu-fix-the-cpu-pm-notifier-usage.patch +brcmfmac-perform-bound-checking-on-vendor-command-buffer.patch +of-irq-fix-of_irq_parse_one-returned-error-codes.patch +perf-fix-irq_work-tail-recursion.patch +staging-vt6656-vnt_rf_setpower-fix-missing-rate-rate_12m.patch +vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch +vt6655-fix-late-setting-of-byrftype.patch diff --git a/queue-3.19/staging-vt6656-vnt_rf_setpower-fix-missing-rate-rate_12m.patch b/queue-3.19/staging-vt6656-vnt_rf_setpower-fix-missing-rate-rate_12m.patch new file mode 100644 index 00000000000..f15a8a3f249 --- /dev/null +++ b/queue-3.19/staging-vt6656-vnt_rf_setpower-fix-missing-rate-rate_12m.patch @@ -0,0 +1,29 @@ +From 163fe301b9f78b6de57d0014eafe504fd20c0cd4 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sat, 7 Mar 2015 16:36:37 +0000 +Subject: staging: vt6656: vnt_rf_setpower: fix missing rate RATE_12M + +From: Malcolm Priestley + +commit 163fe301b9f78b6de57d0014eafe504fd20c0cd4 upstream. + +When the driver sets this rate a power of zero value is set causing +data flow stoppage until another rate is tried. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/rf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/vt6656/rf.c ++++ b/drivers/staging/vt6656/rf.c +@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private * + break; + case RATE_6M: + case RATE_9M: ++ case RATE_12M: + case RATE_18M: + case RATE_24M: + case RATE_36M: diff --git a/queue-3.19/uas-add-us_fl_no_ata_1x-for-initio-corporation-controllers-devices.patch b/queue-3.19/uas-add-us_fl_no_ata_1x-for-initio-corporation-controllers-devices.patch new file mode 100644 index 00000000000..f4b1d32aadc --- /dev/null +++ b/queue-3.19/uas-add-us_fl_no_ata_1x-for-initio-corporation-controllers-devices.patch @@ -0,0 +1,38 @@ +From bda13e35d584dabf52c9f77e0fe62683ac4d9f86 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 16 Mar 2015 15:18:13 +0100 +Subject: uas: Add US_FL_NO_ATA_1X for Initio Corporation controllers / devices + +From: Hans de Goede + +commit bda13e35d584dabf52c9f77e0fe62683ac4d9f86 upstream. + +A new uas compatible controller has shown up in some people's devices from +the manufacturer Initio Corporation, this controller needs the US_FL_NO_ATA_1X +quirk to work properly with uas, so add it to the uas quirks table. + +Reported-and-tested-by: Benjamin Tissoires +Cc: Benjamin Tissoires +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_ATA_1X), + ++/* Reported-by: Benjamin Tissoires */ ++UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, ++ "Initio Corporation", ++ "", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* Reported-by: Tom Arild Naess */ + UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999, + "JMicron", diff --git a/queue-3.19/usb-chipidea-otg-add-a_alt_hnp_support-response-for-b-device.patch b/queue-3.19/usb-chipidea-otg-add-a_alt_hnp_support-response-for-b-device.patch new file mode 100644 index 00000000000..2d5303b97f5 --- /dev/null +++ b/queue-3.19/usb-chipidea-otg-add-a_alt_hnp_support-response-for-b-device.patch @@ -0,0 +1,66 @@ +From d20f7807996c69537e07443ef8dec4e01a28b099 Mon Sep 17 00:00:00 2001 +From: Li Jun +Date: Sun, 8 Mar 2015 16:05:01 +0800 +Subject: usb: chipidea: otg: add a_alt_hnp_support response for B device + +From: Li Jun + +commit d20f7807996c69537e07443ef8dec4e01a28b099 upstream. + +This patch adds response to a_alt_hnp_support set feature request from legacy +A device, that is, B-device can provide a message to the user indicating that +the user needs to connect the B-device to an alternate port on the A-device. +A device sets this feature indicates to the B-device that it is connected +to an A-device port that is not capable of HNP, but that the A-device does have +an alternate port that is capable of HNP. + +[Peter] +Without this patch, the OTG B device can't be enumerated on +non-HNP port at A device, see below log: +[ 2.287464] usb 1-1: Dual-Role OTG device on non-HNP port +[ 2.293105] usb 1-1: can't set HNP mode: -32 +[ 2.417422] usb 1-1: new high-speed USB device number 4 using ci_hdrc +[ 2.460635] usb 1-1: Dual-Role OTG device on non-HNP port +[ 2.466424] usb 1-1: can't set HNP mode: -32 +[ 2.587464] usb 1-1: new high-speed USB device number 5 using ci_hdrc +[ 2.630649] usb 1-1: Dual-Role OTG device on non-HNP port +[ 2.636436] usb 1-1: can't set HNP mode: -32 +[ 2.641003] usb usb1-port1: unable to enumerate USB device + +Acked-by: Peter Chen +Signed-off-by: Li Jun +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/udc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -929,6 +929,13 @@ __acquires(hwep->lock) + return retval; + } + ++static int otg_a_alt_hnp_support(struct ci_hdrc *ci) ++{ ++ dev_warn(&ci->gadget.dev, ++ "connect the device to an alternate port if you want HNP\n"); ++ return isr_setup_status_phase(ci); ++} ++ + /** + * isr_setup_packet_handler: setup packet handler + * @ci: UDC descriptor +@@ -1061,6 +1068,10 @@ __acquires(ci->lock) + ci); + } + break; ++ case USB_DEVICE_A_ALT_HNP_SUPPORT: ++ if (ci_otg_is_fsm_mode(ci)) ++ err = otg_a_alt_hnp_support(ci); ++ break; + default: + goto delegate; + } diff --git a/queue-3.19/usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch b/queue-3.19/usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch new file mode 100644 index 00000000000..e0516f9bfee --- /dev/null +++ b/queue-3.19/usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch @@ -0,0 +1,77 @@ +From a886bd92267c9e3d5c912860c6fb5a68479a7643 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Thu, 12 Mar 2015 09:47:53 +0800 +Subject: usb: common: otg-fsm: only signal connect after switching to peripheral + +From: Peter Chen + +commit a886bd92267c9e3d5c912860c6fb5a68479a7643 upstream. + +We should signal connect (pull up dp) after we have already +at peripheral mode, otherwise, the dp may be toggled due to +we reset controller or do disconnect during the initialization +for peripheral, then, the host may be confused during the +enumeration, eg, it finds the reset can't succeed, but the +device is still there, see below error message. + +hub 1-0:1.0: USB hub found +hub 1-0:1.0: 1 port detected +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: cannot reset port 1 (err = -32) +hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? +hub 1-0:1.0: unable to enumerate USB device on port 1 + +Fixes: the issue existed when the otg fsm code was added. +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/common/usb-otg-fsm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/common/usb-otg-fsm.c ++++ b/drivers/usb/common/usb-otg-fsm.c +@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm + break; + case OTG_STATE_B_PERIPHERAL: + otg_chrg_vbus(fsm, 0); +- otg_loc_conn(fsm, 1); + otg_loc_sof(fsm, 0); + otg_set_protocol(fsm, PROTO_GADGET); ++ otg_loc_conn(fsm, 1); + break; + case OTG_STATE_B_WAIT_ACON: + otg_chrg_vbus(fsm, 0); +@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm + + break; + case OTG_STATE_A_PERIPHERAL: +- otg_loc_conn(fsm, 1); + otg_loc_sof(fsm, 0); + otg_set_protocol(fsm, PROTO_GADGET); + otg_drv_vbus(fsm, 1); ++ otg_loc_conn(fsm, 1); + otg_add_timer(fsm, A_BIDL_ADIS); + break; + case OTG_STATE_A_WAIT_VFALL: diff --git a/queue-3.19/usb-phy-am335x-control-check-return-value-of.patch b/queue-3.19/usb-phy-am335x-control-check-return-value-of.patch new file mode 100644 index 00000000000..e36370b0498 --- /dev/null +++ b/queue-3.19/usb-phy-am335x-control-check-return-value-of.patch @@ -0,0 +1,34 @@ +From d0f347d62814ec0f599a05c61c5619d5e999e4ae Mon Sep 17 00:00:00 2001 +From: David Dueck +Date: Sun, 8 Feb 2015 16:29:30 +0100 +Subject: usb: phy: am335x-control: check return value of + bus_find_device + +From: David Dueck + +commit d0f347d62814ec0f599a05c61c5619d5e999e4ae upstream. + +This fixes a potential null pointer dereference. + +Fixes: d4332013919a ("driver core: dev_get_drvdata: Don't check for NULL dev") +Acked-by: Sebastian Andrzej Siewior +Signed-off-by: David Dueck +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/phy/phy-am335x-control.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/phy/phy-am335x-control.c ++++ b/drivers/usb/phy/phy-am335x-control.c +@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_contr + return NULL; + + dev = bus_find_device(&platform_bus_type, NULL, node, match); ++ if (!dev) ++ return NULL; ++ + ctrl_usb = dev_get_drvdata(dev); + if (!ctrl_usb) + return NULL; diff --git a/queue-3.19/vt6655-fix-late-setting-of-byrftype.patch b/queue-3.19/vt6655-fix-late-setting-of-byrftype.patch new file mode 100644 index 00000000000..5d991f1cbcf --- /dev/null +++ b/queue-3.19/vt6655-fix-late-setting-of-byrftype.patch @@ -0,0 +1,59 @@ +From 1f51d5801859e0b382dcc8f06875811d63ec8953 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sat, 7 Mar 2015 17:04:55 +0000 +Subject: vt6655: Fix late setting of byRFType. + +From: Malcolm Priestley + +commit 1f51d5801859e0b382dcc8f06875811d63ec8953 upstream. + +byRFType is not set prior to registration of mac80211 causing +unpredictable operation after channel scans. + +With byRFType unset all channels are enabled this causes tx power +to be set to values not present its eeprom. + +Move setting of this variable to vt6655_probe. + +byRFType must have a mask set. byRevId not used by driver and +is removed. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -357,16 +357,6 @@ static void device_init_registers(struct + /* zonetype initial */ + pDevice->byOriginalZonetype = pDevice->abyEEPROM[EEP_OFS_ZONETYPE]; + +- /* Get RFType */ +- pDevice->byRFType = SROMbyReadEmbedded(pDevice->PortOffset, EEP_OFS_RFTYPE); +- +- /* force change RevID for VT3253 emu */ +- if ((pDevice->byRFType & RF_EMU) != 0) +- pDevice->byRevId = 0x80; +- +- pDevice->byRFType &= RF_MASK; +- pr_debug("pDevice->byRFType = %x\n", pDevice->byRFType); +- + if (!pDevice->bZoneRegExist) + pDevice->byZoneType = pDevice->abyEEPROM[EEP_OFS_ZONETYPE]; + +@@ -1806,6 +1796,12 @@ vt6655_probe(struct pci_dev *pcid, const + MACvInitialize(priv->PortOffset); + MACvReadEtherAddress(priv->PortOffset, priv->abyCurrentNetAddr); + ++ /* Get RFType */ ++ priv->byRFType = SROMbyReadEmbedded(priv->PortOffset, EEP_OFS_RFTYPE); ++ priv->byRFType &= RF_MASK; ++ ++ dev_dbg(&pcid->dev, "RF Type = %x\n", priv->byRFType); ++ + device_get_options(priv); + device_set_options(priv); + /* Mask out the options cannot be set to the chip */ diff --git a/queue-3.19/vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch b/queue-3.19/vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch new file mode 100644 index 00000000000..88b55ad2ffa --- /dev/null +++ b/queue-3.19/vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch @@ -0,0 +1,29 @@ +From 40c8790bcb7ac74f3038153cd09310e220c6a1df Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sat, 7 Mar 2015 17:04:54 +0000 +Subject: vt6655: RFbSetPower fix missing rate RATE_12M + +From: Malcolm Priestley + +commit 40c8790bcb7ac74f3038153cd09310e220c6a1df upstream. + +When the driver sets this rate a power of zero value is set causing +data flow stoppage until another rate is tried. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/rf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/vt6655/rf.c ++++ b/drivers/staging/vt6655/rf.c +@@ -791,6 +791,7 @@ bool RFbSetPower( + break; + case RATE_6M: + case RATE_9M: ++ case RATE_12M: + case RATE_18M: + byPwr = priv->abyOFDMPwrTbl[uCH]; + if (priv->byRFType == RF_UW2452) -- 2.47.3