From fe8e9b288d4442a4035bb2f17c5fbc164650ee37 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 3 Nov 2011 15:36:15 -0700 Subject: [PATCH] 3.0 patches --- .../asix-simplify-condition-in-rx_fixup.patch | 32 +++++ ...only-11-bits-of-header-for-data-size.patch | 41 ++++++ ...ix-descriptor-status-of-txopexceeded.patch | 1 + ...atheros-ar3012-one-pid-vid-supported.patch | 74 +++++++++++ .../bluetooth-add-macbookair4-1-support.patch | 34 +++++ ...etooth-add-support-for-2011-mac-mini.patch | 32 +++++ ...add-toshiba-laptops-ar30xx-device-id.patch | 41 ++++++ ...evice-entry-for-broadcom-softsailing.patch | 34 +++++ ...ne-4-verizon-cdma-usb-product-id-add.patch | 41 ++++++ ...ct-...-does-not-need-tasklet_disable.patch | 31 +++++ queue-3.0/series | 16 +++ ...ter-deref-in-usb_hcd_alloc_bandwidth.patch | 32 +++++ .../usb-ehci-fix-test-mode-sequence.patch | 43 +++++++ ...b_hcd_check_unlink_urb-during-unlink.patch | 28 +++++ ...device-id-for-sierra-wireless-mc8305.patch | 28 +++++ ...-sio-driver-for-a-zeitcontrol-device.patch | 41 ++++++ ...inite-loop-when-processing-mse-event.patch | 98 +++++++++++++++ ...cm-don-t-use-stack-variables-for-dma.patch | 117 ++++++++++++++++++ 18 files changed, 764 insertions(+) create mode 100644 queue-3.0/asix-simplify-condition-in-rx_fixup.patch create mode 100644 queue-3.0/asix-use-only-11-bits-of-header-for-data-size.patch create mode 100644 queue-3.0/bluetooth-add-atheros-ar3012-one-pid-vid-supported.patch create mode 100644 queue-3.0/bluetooth-add-macbookair4-1-support.patch create mode 100644 queue-3.0/bluetooth-add-support-for-2011-mac-mini.patch create mode 100644 queue-3.0/bluetooth-add-toshiba-laptops-ar30xx-device-id.patch create mode 100644 queue-3.0/btusb-add-device-entry-for-broadcom-softsailing.patch create mode 100644 queue-3.0/ipheth-iphone-4-verizon-cdma-usb-product-id-add.patch create mode 100644 queue-3.0/rtl8150-rtl8150_disconnect-...-does-not-need-tasklet_disable.patch create mode 100644 queue-3.0/usb-avoid-null-pointer-deref-in-usb_hcd_alloc_bandwidth.patch create mode 100644 queue-3.0/usb-ehci-fix-test-mode-sequence.patch create mode 100644 queue-3.0/usb-isp1760-added-missing-call-to-usb_hcd_check_unlink_urb-during-unlink.patch create mode 100644 queue-3.0/usb-serial-add-device-id-for-sierra-wireless-mc8305.patch create mode 100644 queue-3.0/usb-serial-add-pid-0xf7c0-to-ftdi-sio-driver-for-a-zeitcontrol-device.patch create mode 100644 queue-3.0/usb-xhci-prevent-infinite-loop-when-processing-mse-event.patch create mode 100644 queue-3.0/usbnet-cdc_ncm-don-t-use-stack-variables-for-dma.patch diff --git a/queue-3.0/asix-simplify-condition-in-rx_fixup.patch b/queue-3.0/asix-simplify-condition-in-rx_fixup.patch new file mode 100644 index 00000000000..500e0e905ab --- /dev/null +++ b/queue-3.0/asix-simplify-condition-in-rx_fixup.patch @@ -0,0 +1,32 @@ +From bc466e678d0a98f445bf3f9c76fedf18e7dcc6b0 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Tue, 26 Jul 2011 16:44:46 +0000 +Subject: ASIX: Simplify condition in rx_fixup() + +From: Marek Vasut + +commit bc466e678d0a98f445bf3f9c76fedf18e7dcc6b0 upstream. + +Signed-off-by: Marek Vasut +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/asix.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -314,10 +314,9 @@ static int asix_rx_fixup(struct usbnet * + skb_pull(skb, 4); + + while (skb->len > 0) { +- if ((short)(header & 0x0000ffff) != +- ~((short)((header & 0xffff0000) >> 16))) { ++ if ((header & 0xffff) != ((~header >> 16) & 0xffff)) + netdev_err(dev->net, "asix_rx_fixup() Bad Header Length\n"); +- } ++ + /* get the packet length */ + size = (u16) (header & 0x0000ffff); + diff --git a/queue-3.0/asix-use-only-11-bits-of-header-for-data-size.patch b/queue-3.0/asix-use-only-11-bits-of-header-for-data-size.patch new file mode 100644 index 00000000000..8e4967710c5 --- /dev/null +++ b/queue-3.0/asix-use-only-11-bits-of-header-for-data-size.patch @@ -0,0 +1,41 @@ +From bca0beb9363f8487ac902931a50eb00180a2d14a Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Tue, 26 Jul 2011 16:44:47 +0000 +Subject: ASIX: Use only 11 bits of header for data size + +From: Marek Vasut + +commit bca0beb9363f8487ac902931a50eb00180a2d14a upstream. + +The AX88772B uses only 11 bits of the header for the actual size. The other bits +are used for something else. This causes dmesg full of messages: + + asix_rx_fixup() Bad Header Length + +This patch trims the check to only 11 bits. I believe on older chips, the +remaining 5 top bits are unused. + +Signed-off-by: Marek Vasut +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/asix.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -314,11 +314,11 @@ static int asix_rx_fixup(struct usbnet * + skb_pull(skb, 4); + + while (skb->len > 0) { +- if ((header & 0xffff) != ((~header >> 16) & 0xffff)) ++ if ((header & 0x07ff) != ((~header >> 16) & 0x07ff)) + netdev_err(dev->net, "asix_rx_fixup() Bad Header Length\n"); + + /* get the packet length */ +- size = (u16) (header & 0x0000ffff); ++ size = (u16) (header & 0x000007ff); + + if ((skb->len) - ((size + 1) & 0xfffe) == 0) { + u8 alignment = (unsigned long)skb->data & 0x3; diff --git a/queue-3.0/ath9k_hw-fix-descriptor-status-of-txopexceeded.patch b/queue-3.0/ath9k_hw-fix-descriptor-status-of-txopexceeded.patch index 2d8bd27742a..48c1ef6e900 100644 --- a/queue-3.0/ath9k_hw-fix-descriptor-status-of-txopexceeded.patch +++ b/queue-3.0/ath9k_hw-fix-descriptor-status-of-txopexceeded.patch @@ -9,6 +9,7 @@ commit 2a15b394f8e46dd3e2ab365ab41cfa701d92fa77 upstream. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 4 ++-- diff --git a/queue-3.0/bluetooth-add-atheros-ar3012-one-pid-vid-supported.patch b/queue-3.0/bluetooth-add-atheros-ar3012-one-pid-vid-supported.patch new file mode 100644 index 00000000000..d529a453565 --- /dev/null +++ b/queue-3.0/bluetooth-add-atheros-ar3012-one-pid-vid-supported.patch @@ -0,0 +1,74 @@ +From 2d25f8b462f3b849d8913d02978657ef06e67dd8 Mon Sep 17 00:00:00 2001 +From: "Steven.Li" +Date: Fri, 1 Jul 2011 14:02:36 +0800 +Subject: Bluetooth: Add Atheros AR3012 one PID/VID supported + +From: "Steven.Li" + +commit 2d25f8b462f3b849d8913d02978657ef06e67dd8 upstream. + +The new Ath3k needs to download patch and radio table, +and it keeps same PID/VID even after downloading the patch and radio +table. This patch is to use the bcdDevice (Device Release Number) to +judge whether the chip has been patched or not. The init bcdDevice +value of the chip is 0x0001, this value increases after patch and +radio table downloading. + +Signed-off-by: Steven.Li +Signed-off-by: Gustavo F. Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 5 +++++ + drivers/bluetooth/btusb.c | 12 +++++++++++- + 2 files changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -376,6 +376,11 @@ static int ath3k_probe(struct usb_interf + + /* load patch and sysconfig files for AR3012 */ + if (id->driver_info & BTUSB_ATH3012) { ++ ++ /* New firmware with patch and sysconfig files already loaded */ ++ if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x0001) ++ return -ENODEV; ++ + ret = ath3k_load_patch(udev); + if (ret < 0) { + BT_ERR("Loading patch file failed"); +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -54,6 +54,7 @@ static struct usb_driver btusb_driver; + #define BTUSB_BCM92035 0x10 + #define BTUSB_BROKEN_ISOC 0x20 + #define BTUSB_WRONG_SCO_MTU 0x40 ++#define BTUSB_ATH3012 0x80 + + static struct usb_device_id btusb_table[] = { + /* Generic Bluetooth USB device */ +@@ -114,7 +115,7 @@ static struct usb_device_id blacklist_ta + { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, + + /* Atheros 3012 with sflash firmware */ +- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, +@@ -918,6 +919,15 @@ static int btusb_probe(struct usb_interf + if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER) + return -ENODEV; + ++ if (id->driver_info & BTUSB_ATH3012) { ++ struct usb_device *udev = interface_to_usbdev(intf); ++ ++ /* Old firmware would otherwise let ath3k driver load ++ * patch and sysconfig files */ ++ if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001) ++ return -ENODEV; ++ } ++ + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; diff --git a/queue-3.0/bluetooth-add-macbookair4-1-support.patch b/queue-3.0/bluetooth-add-macbookair4-1-support.patch new file mode 100644 index 00000000000..0d33ee98267 --- /dev/null +++ b/queue-3.0/bluetooth-add-macbookair4-1-support.patch @@ -0,0 +1,34 @@ +From a63b723d02531f7add0b2b8a0e6a77ee176f1626 Mon Sep 17 00:00:00 2001 +From: Pieter-Augustijn Van Malleghem +Date: Wed, 7 Sep 2011 02:28:10 -0400 +Subject: Bluetooth: Add MacBookAir4,1 support + +From: Pieter-Augustijn Van Malleghem + +commit a63b723d02531f7add0b2b8a0e6a77ee176f1626 upstream. + +This patch against current git adds the hardware ID for the Apple +MacBookAir4,1, released in July 2011. The device features a BCM2046 +USB chip. The patch was inspired by the previous modifications adding +support for the MacBookAir3,x. + +Signed-off-by: Pieter-Augustijn Van Malleghem +Signed-off-by: Gustavo F. Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -71,6 +71,9 @@ static struct usb_device_id btusb_table[ + /* Apple MacBookAir3,1, MacBookAir3,2 */ + { USB_DEVICE(0x05ac, 0x821b) }, + ++ /* Apple MacBookAir4,1 */ ++ { USB_DEVICE(0x05ac, 0x821f) }, ++ + /* Apple MacBookPro8,2 */ + { USB_DEVICE(0x05ac, 0x821a) }, + diff --git a/queue-3.0/bluetooth-add-support-for-2011-mac-mini.patch b/queue-3.0/bluetooth-add-support-for-2011-mac-mini.patch new file mode 100644 index 00000000000..fe53d279a8c --- /dev/null +++ b/queue-3.0/bluetooth-add-support-for-2011-mac-mini.patch @@ -0,0 +1,32 @@ +From f78b68261e80899f81a21dfdf91e2a1456ea8175 Mon Sep 17 00:00:00 2001 +From: Jurgen Kramer +Date: Sun, 4 Sep 2011 18:01:42 +0200 +Subject: Bluetooth: add support for 2011 mac mini + +From: Jurgen Kramer + +commit f78b68261e80899f81a21dfdf91e2a1456ea8175 upstream. + +Today I noticed that the usb bluetooth adapter (BCM2046B1) on my 2011 +mac mini was not working. I've created a patch to get it going. + +Signed-off-by: Jurgen Kramer +Signed-off-by: Gustavo F. Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -78,6 +78,9 @@ static struct usb_device_id btusb_table[ + /* Apple MacBookPro8,2 */ + { USB_DEVICE(0x05ac, 0x821a) }, + ++ /* Apple MacMini5,1 */ ++ { USB_DEVICE(0x05ac, 0x8281) }, ++ + /* AVM BlueFRITZ! USB v2.0 */ + { USB_DEVICE(0x057c, 0x3800) }, + diff --git a/queue-3.0/bluetooth-add-toshiba-laptops-ar30xx-device-id.patch b/queue-3.0/bluetooth-add-toshiba-laptops-ar30xx-device-id.patch new file mode 100644 index 00000000000..b10cf0444cc --- /dev/null +++ b/queue-3.0/bluetooth-add-toshiba-laptops-ar30xx-device-id.patch @@ -0,0 +1,41 @@ +From 8e7c3d2e4ba18ee4cdcc1f89aec944fbff4ce735 Mon Sep 17 00:00:00 2001 +From: Ricardo Mendoza +Date: Wed, 13 Jul 2011 16:04:29 +0100 +Subject: Bluetooth: Add Toshiba laptops AR30XX device ID + +From: Ricardo Mendoza + +commit 8e7c3d2e4ba18ee4cdcc1f89aec944fbff4ce735 upstream. + +Blacklist Toshiba-branded AR3011 based AR5B195 [0930:0215] and add to +ath3k.c for firmware loading. + +Signed-off-by: Ricardo Mendoza +Signed-off-by: Gustavo F. Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 1 + + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[ + /* Atheros AR3011 with sflash firmware*/ + { USB_DEVICE(0x0CF3, 0x3002) }, + { USB_DEVICE(0x13d3, 0x3304) }, ++ { USB_DEVICE(0x0930, 0x0215) }, + + /* Atheros AR9285 Malbec with sflash firmware */ + { USB_DEVICE(0x03F0, 0x311D) }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -108,6 +108,7 @@ static struct usb_device_id blacklist_ta + /* Atheros 3011 with sflash firmware */ + { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, ++ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, + + /* Atheros AR9285 Malbec with sflash firmware */ + { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, diff --git a/queue-3.0/btusb-add-device-entry-for-broadcom-softsailing.patch b/queue-3.0/btusb-add-device-entry-for-broadcom-softsailing.patch new file mode 100644 index 00000000000..05a8948d2be --- /dev/null +++ b/queue-3.0/btusb-add-device-entry-for-broadcom-softsailing.patch @@ -0,0 +1,34 @@ +From c510eae377c773241ff0b6369a8f3581da941a51 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 21 Sep 2011 11:41:45 +0200 +Subject: btusb: add device entry for Broadcom SoftSailing + +From: Oliver Neukum + +commit c510eae377c773241ff0b6369a8f3581da941a51 upstream. + + +This device declares itself to be vendor specific +It therefore needs to be added to the device table +to make btusb bind. + +Signed-off-by: Oliver Neukum +Signed-off-by: Gustavo F. Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -60,6 +60,9 @@ static struct usb_device_id btusb_table[ + /* Generic Bluetooth USB device */ + { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, + ++ /* Broadcom SoftSailing reporting vendor specific */ ++ { USB_DEVICE(0x05ac, 0x21e1) }, ++ + /* Apple MacBookPro 7,1 */ + { USB_DEVICE(0x05ac, 0x8213) }, + diff --git a/queue-3.0/ipheth-iphone-4-verizon-cdma-usb-product-id-add.patch b/queue-3.0/ipheth-iphone-4-verizon-cdma-usb-product-id-add.patch new file mode 100644 index 00000000000..1c77621e02f --- /dev/null +++ b/queue-3.0/ipheth-iphone-4-verizon-cdma-usb-product-id-add.patch @@ -0,0 +1,41 @@ +From 02009afc223aae43b8e18918fc816e4520791537 Mon Sep 17 00:00:00 2001 +From: Kavan Smith +Date: Wed, 31 Aug 2011 05:12:05 +0000 +Subject: ipheth: iPhone 4 Verizon CDMA USB Product ID add + +From: Kavan Smith + +commit 02009afc223aae43b8e18918fc816e4520791537 upstream. + +Add USB product ID for iPhone 4 CDMA Verizon +Tested on at least 2 devices + +Signed-off-by: Kavan Smith +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/ipheth.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -59,6 +59,7 @@ + #define USB_PRODUCT_IPHONE_3G 0x1292 + #define USB_PRODUCT_IPHONE_3GS 0x1294 + #define USB_PRODUCT_IPHONE_4 0x1297 ++#define USB_PRODUCT_IPHONE_4_VZW 0x129c + + #define IPHETH_USBINTF_CLASS 255 + #define IPHETH_USBINTF_SUBCLASS 253 +@@ -98,6 +99,10 @@ static struct usb_device_id ipheth_table + USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4, + IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS, + IPHETH_USBINTF_PROTO) }, ++ { USB_DEVICE_AND_INTERFACE_INFO( ++ USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW, ++ IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS, ++ IPHETH_USBINTF_PROTO) }, + { } + }; + MODULE_DEVICE_TABLE(usb, ipheth_table); diff --git a/queue-3.0/rtl8150-rtl8150_disconnect-...-does-not-need-tasklet_disable.patch b/queue-3.0/rtl8150-rtl8150_disconnect-...-does-not-need-tasklet_disable.patch new file mode 100644 index 00000000000..039babae5ef --- /dev/null +++ b/queue-3.0/rtl8150-rtl8150_disconnect-...-does-not-need-tasklet_disable.patch @@ -0,0 +1,31 @@ +From c2e2a313ff8fdc25cedef5e63da712a6a0d35dfe Mon Sep 17 00:00:00 2001 +From: huajun li +Date: Sun, 7 Aug 2011 03:03:31 +0000 +Subject: rtl8150: rtl8150_disconnect(...) does not need tasklet_disable(...) + +From: huajun li + +commit c2e2a313ff8fdc25cedef5e63da712a6a0d35dfe upstream. + +Executing cmd 'rmmod rtl8150' does not return(if your device connects +to host), the root cause is tasklet_disable() causes tasklet_kill() +block, remove it from rtl8150_disconnect(). + +Signed-off-by: Huajun Li +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/rtl8150.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -977,7 +977,6 @@ static void rtl8150_disconnect(struct us + usb_set_intfdata(intf, NULL); + if (dev) { + set_bit(RTL8150_UNPLUG, &dev->flags); +- tasklet_disable(&dev->tl); + tasklet_kill(&dev->tl); + unregister_netdev(dev->netdev); + unlink_all_urbs(dev); diff --git a/queue-3.0/series b/queue-3.0/series index 96250b5d6b3..b5cdcf81c05 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -161,3 +161,19 @@ ext4-ext4_mkdir-should-dirty-dir_block-with-newly-created-directory-inode.patch ext4-call-ext4_handle_dirty_metadata-with-correct-inode-in-ext4_dx_add_entry.patch ext4-fix-race-in-xattr-block-allocation-path.patch enic-bug-fix-fix-hardware-transmit-queue-indexing-in-enic_poll_controller.patch +rtl8150-rtl8150_disconnect-...-does-not-need-tasklet_disable.patch +usb-ehci-fix-test-mode-sequence.patch +usb-isp1760-added-missing-call-to-usb_hcd_check_unlink_urb-during-unlink.patch +usb-serial-add-device-id-for-sierra-wireless-mc8305.patch +usb-serial-add-pid-0xf7c0-to-ftdi-sio-driver-for-a-zeitcontrol-device.patch +usbnet-cdc_ncm-don-t-use-stack-variables-for-dma.patch +usb-avoid-null-pointer-deref-in-usb_hcd_alloc_bandwidth.patch +ipheth-iphone-4-verizon-cdma-usb-product-id-add.patch +usb-xhci-prevent-infinite-loop-when-processing-mse-event.patch +asix-simplify-condition-in-rx_fixup.patch +asix-use-only-11-bits-of-header-for-data-size.patch +bluetooth-add-macbookair4-1-support.patch +bluetooth-add-toshiba-laptops-ar30xx-device-id.patch +bluetooth-add-atheros-ar3012-one-pid-vid-supported.patch +bluetooth-add-support-for-2011-mac-mini.patch +btusb-add-device-entry-for-broadcom-softsailing.patch diff --git a/queue-3.0/usb-avoid-null-pointer-deref-in-usb_hcd_alloc_bandwidth.patch b/queue-3.0/usb-avoid-null-pointer-deref-in-usb_hcd_alloc_bandwidth.patch new file mode 100644 index 00000000000..fae5a14b9d2 --- /dev/null +++ b/queue-3.0/usb-avoid-null-pointer-deref-in-usb_hcd_alloc_bandwidth.patch @@ -0,0 +1,32 @@ +From 8a9af4fdf6d5eeb3200a088354d266a87e8260b0 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Tue, 9 Aug 2011 16:31:54 -0700 +Subject: USB: Avoid NULL pointer deref in usb_hcd_alloc_bandwidth. + +From: Sarah Sharp + +commit 8a9af4fdf6d5eeb3200a088354d266a87e8260b0 upstream. + +usb_ifnum_to_if() can return NULL if the USB device does not have a +configuration installed (usb_device->actconfig == NULL), or if we can't +find the interface number in the installed configuration. Return an +error instead of crashing. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1764,6 +1764,8 @@ int usb_hcd_alloc_bandwidth(struct usb_d + struct usb_interface *iface = usb_ifnum_to_if(udev, + cur_alt->desc.bInterfaceNumber); + ++ if (!iface) ++ return -EINVAL; + if (iface->resetting_device) { + /* + * The USB core just reset the device, so the xHCI host diff --git a/queue-3.0/usb-ehci-fix-test-mode-sequence.patch b/queue-3.0/usb-ehci-fix-test-mode-sequence.patch new file mode 100644 index 00000000000..7557d461ad4 --- /dev/null +++ b/queue-3.0/usb-ehci-fix-test-mode-sequence.patch @@ -0,0 +1,43 @@ +From 77636c86a600b83de01719efad83567e46d7e8ce Mon Sep 17 00:00:00 2001 +From: Boris Todorov +Date: Mon, 11 Jul 2011 12:03:33 +0300 +Subject: USB: EHCI: Fix test mode sequence + +From: Boris Todorov + +commit 77636c86a600b83de01719efad83567e46d7e8ce upstream. + +The sequence to put port in test mode is not complete. +According EHCI specification all enabled ports must be +put in suspend. + +Signed-off-by: Boris Todorov +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hub.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -1120,7 +1120,19 @@ static int ehci_hub_control ( + if (!selector || selector > 5) + goto error; + ehci_quiesce(ehci); ++ ++ /* Put all enabled ports into suspend */ ++ while (ports--) { ++ u32 __iomem *sreg = ++ &ehci->regs->port_status[ports]; ++ ++ temp = ehci_readl(ehci, sreg) & ~PORT_RWC_BITS; ++ if (temp & PORT_PE) ++ ehci_writel(ehci, temp | PORT_SUSPEND, ++ sreg); ++ } + ehci_halt(ehci); ++ temp = ehci_readl(ehci, status_reg); + temp |= selector << 16; + ehci_writel(ehci, temp, status_reg); + break; diff --git a/queue-3.0/usb-isp1760-added-missing-call-to-usb_hcd_check_unlink_urb-during-unlink.patch b/queue-3.0/usb-isp1760-added-missing-call-to-usb_hcd_check_unlink_urb-during-unlink.patch new file mode 100644 index 00000000000..e182a78157a --- /dev/null +++ b/queue-3.0/usb-isp1760-added-missing-call-to-usb_hcd_check_unlink_urb-during-unlink.patch @@ -0,0 +1,28 @@ +From 17d3e145a4ad680b3d1b1c30d0696a5bbb2b65c4 Mon Sep 17 00:00:00 2001 +From: Arvid Brodin +Date: Wed, 20 Jul 2011 03:13:46 +0200 +Subject: usb/isp1760: Added missing call to usb_hcd_check_unlink_urb() during unlink + +From: Arvid Brodin + +commit 17d3e145a4ad680b3d1b1c30d0696a5bbb2b65c4 upstream. + +Signed-off-by: Arvid Brodin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/isp1760-hcd.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/isp1760-hcd.c ++++ b/drivers/usb/host/isp1760-hcd.c +@@ -1583,6 +1583,9 @@ static int isp1760_urb_dequeue(struct us + int retval = 0; + + spin_lock_irqsave(&priv->lock, spinflags); ++ retval = usb_hcd_check_unlink_urb(hcd, urb, status); ++ if (retval) ++ goto out; + + qh = urb->ep->hcpriv; + if (!qh) { diff --git a/queue-3.0/usb-serial-add-device-id-for-sierra-wireless-mc8305.patch b/queue-3.0/usb-serial-add-device-id-for-sierra-wireless-mc8305.patch new file mode 100644 index 00000000000..ab88ee65a51 --- /dev/null +++ b/queue-3.0/usb-serial-add-device-id-for-sierra-wireless-mc8305.patch @@ -0,0 +1,28 @@ +From 2f1def2695c223b2aa325e5e47d0d64200a45d23 Mon Sep 17 00:00:00 2001 +From: Florian Echtler +Date: Tue, 9 Aug 2011 13:37:49 +0200 +Subject: USB: Serial: Add device ID for Sierra Wireless MC8305 + +From: Florian Echtler + +commit 2f1def2695c223b2aa325e5e47d0d64200a45d23 upstream. + +A new device ID pair is added for Sierra Wireless MC8305. + +Signed-off-by: Florian Echtler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/qcserial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -80,6 +80,7 @@ static const struct usb_device_id id_tab + {USB_DEVICE(0x1199, 0x9008)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */ + {USB_DEVICE(0x1199, 0x9009)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */ + {USB_DEVICE(0x1199, 0x900a)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */ ++ {USB_DEVICE(0x1199, 0x9011)}, /* Sierra Wireless Gobi 2000 Modem device (MC8305) */ + {USB_DEVICE(0x16d8, 0x8001)}, /* CMDTech Gobi 2000 QDL device (VU922) */ + {USB_DEVICE(0x16d8, 0x8002)}, /* CMDTech Gobi 2000 Modem device (VU922) */ + {USB_DEVICE(0x05c6, 0x9204)}, /* Gobi 2000 QDL device */ diff --git a/queue-3.0/usb-serial-add-pid-0xf7c0-to-ftdi-sio-driver-for-a-zeitcontrol-device.patch b/queue-3.0/usb-serial-add-pid-0xf7c0-to-ftdi-sio-driver-for-a-zeitcontrol-device.patch new file mode 100644 index 00000000000..79197c220e7 --- /dev/null +++ b/queue-3.0/usb-serial-add-pid-0xf7c0-to-ftdi-sio-driver-for-a-zeitcontrol-device.patch @@ -0,0 +1,41 @@ +From ce7e9065958191e6b7ca49d7ed0e1099c486d198 Mon Sep 17 00:00:00 2001 +From: Artur Zimmer +Date: Wed, 10 Aug 2011 03:51:28 +0200 +Subject: USB: Serial: Add PID(0xF7C0) to FTDI SIO driver for a zeitcontrol-device + +From: Artur Zimmer + +commit ce7e9065958191e6b7ca49d7ed0e1099c486d198 upstream. + +Here is a patch for a new PID (zeitcontrol-device mifare-reader FT232BL(like FT232BM but lead free)). + +Signed-off-by: Artur Zimmer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 6 +++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -156,6 +156,7 @@ static struct ftdi_sio_quirk ftdi_8u2232 + * /sys/bus/usb/ftdi_sio/new_id, then send patch/report! + */ + static struct usb_device_id id_table_combined [] = { ++ { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1162,4 +1162,8 @@ + /* USB-Nano-485*/ + #define FTDI_CTI_NANO_PID 0xF60B + +- ++/* ++ * ZeitControl cardsystems GmbH rfid-readers http://zeitconrol.de ++ */ ++/* TagTracer MIFARE*/ ++#define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID 0xF7C0 diff --git a/queue-3.0/usb-xhci-prevent-infinite-loop-when-processing-mse-event.patch b/queue-3.0/usb-xhci-prevent-infinite-loop-when-processing-mse-event.patch new file mode 100644 index 00000000000..4b0a7119ec5 --- /dev/null +++ b/queue-3.0/usb-xhci-prevent-infinite-loop-when-processing-mse-event.patch @@ -0,0 +1,98 @@ +From c2d7b49f42f50d7fc5cbfd195b785a128723fdf4 Mon Sep 17 00:00:00 2001 +From: Andiry Xu +Date: Mon, 19 Sep 2011 16:05:12 -0700 +Subject: USB: xHCI: prevent infinite loop when processing MSE event + +From: Andiry Xu + +commit c2d7b49f42f50d7fc5cbfd195b785a128723fdf4 upstream. + +When a xHC host is unable to handle isochronous transfer in the +interval, it reports a Missed Service Error event and skips some tds. + +Currently xhci driver handles MSE event in the following ways: + +1. When encounter a MSE event, set ep->skip flag, update event ring + dequeue pointer and return. + +2. When encounter the next event on this ep, the driver will run the + do-while loop, fetch td from ep's td_list to find the td + corresponding to this event. All tds missed are marked as short + transfer(-EXDEV). + +The do-while loop will end in two ways: + +1. If the td pointed by the event trb is found; + +2. If the ep ring's td_list is empty. + +However, if a buggy HW reports some unpredicted event (for example, an +overrun event following a MSE event while the ep ring is actually not +empty), the driver will never find the td, and it will loop until the +td_list is empty. + +Unfortunately, the spinlock is dropped when give back a urb in the +do-while loop. During the spinlock released period, the class driver +may still submit urbs and add tds to the td_list. This may cause +disaster, since the td_list will never be empty and the loop never ends, +and the system hangs. + +To fix this, count the number of TDs on the ep ring before skipping TDs, +and quit the loop when skipped that number of tds. This guarantees the +do-while loop will end after certain number of cycles, and driver will +not be trapped in an infinite loop. + +Signed-off-by: Andiry Xu +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Linus Torvalds + +--- + drivers/usb/host/xhci-ring.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1942,8 +1942,10 @@ static int handle_tx_event(struct xhci_h + int status = -EINPROGRESS; + struct urb_priv *urb_priv; + struct xhci_ep_ctx *ep_ctx; ++ struct list_head *tmp; + u32 trb_comp_code; + int ret = 0; ++ int td_num = 0; + + slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags)); + xdev = xhci->devs[slot_id]; +@@ -1965,6 +1967,12 @@ static int handle_tx_event(struct xhci_h + return -ENODEV; + } + ++ /* Count current td numbers if ep->skip is set */ ++ if (ep->skip) { ++ list_for_each(tmp, &ep_ring->td_list) ++ td_num++; ++ } ++ + event_dma = le64_to_cpu(event->buffer); + trb_comp_code = GET_COMP_CODE(le32_to_cpu(event->transfer_len)); + /* Look for common error cases */ +@@ -2076,7 +2084,18 @@ static int handle_tx_event(struct xhci_h + goto cleanup; + } + ++ /* We've skipped all the TDs on the ep ring when ep->skip set */ ++ if (ep->skip && td_num == 0) { ++ ep->skip = false; ++ xhci_dbg(xhci, "All tds on the ep_ring skipped. " ++ "Clear skip flag.\n"); ++ ret = 0; ++ goto cleanup; ++ } ++ + td = list_entry(ep_ring->td_list.next, struct xhci_td, td_list); ++ if (ep->skip) ++ td_num--; + + /* Is this a TRB in the currently executing TD? */ + event_seg = trb_in_td(ep_ring->deq_seg, ep_ring->dequeue, diff --git a/queue-3.0/usbnet-cdc_ncm-don-t-use-stack-variables-for-dma.patch b/queue-3.0/usbnet-cdc_ncm-don-t-use-stack-variables-for-dma.patch new file mode 100644 index 00000000000..9a45beb3dd6 --- /dev/null +++ b/queue-3.0/usbnet-cdc_ncm-don-t-use-stack-variables-for-dma.patch @@ -0,0 +1,117 @@ +From 75bc8ef528f7c4ea7e80384c5593487b6b3b535e Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Mon, 8 Aug 2011 02:34:07 +0000 +Subject: usbnet/cdc_ncm: Don't use stack variables for DMA + +From: Josh Boyer + +commit 75bc8ef528f7c4ea7e80384c5593487b6b3b535e upstream. + +The cdc_ncm driver still has a few places where stack variables are +passed to the cdc_ncm_do_request function. This triggers a stack trace in +lib/dma-debug.c if the CONFIG_DEBUG_DMA_API option is set. + +Adjust these calls to pass parameters that have been allocated with +kzalloc. + +Signed-off-by: Josh Boyer +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ncm.c | 47 +++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 38 insertions(+), 9 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -229,23 +229,40 @@ static u8 cdc_ncm_setup(struct cdc_ncm_c + if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) { + + if (flags & USB_CDC_NCM_NCAP_NTB_INPUT_SIZE) { +- struct usb_cdc_ncm_ndp_input_size ndp_in_sz; ++ struct usb_cdc_ncm_ndp_input_size *ndp_in_sz; ++ ++ ndp_in_sz = kzalloc(sizeof(*ndp_in_sz), GFP_KERNEL); ++ if (!ndp_in_sz) { ++ err = -ENOMEM; ++ goto size_err; ++ } ++ + err = usb_control_msg(ctx->udev, + usb_sndctrlpipe(ctx->udev, 0), + USB_CDC_SET_NTB_INPUT_SIZE, + USB_TYPE_CLASS | USB_DIR_OUT + | USB_RECIP_INTERFACE, +- 0, iface_no, &ndp_in_sz, 8, 1000); ++ 0, iface_no, ndp_in_sz, 8, 1000); ++ kfree(ndp_in_sz); + } else { +- __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max); ++ __le32 *dwNtbInMaxSize; ++ dwNtbInMaxSize = kzalloc(sizeof(*dwNtbInMaxSize), ++ GFP_KERNEL); ++ if (!dwNtbInMaxSize) { ++ err = -ENOMEM; ++ goto size_err; ++ } ++ *dwNtbInMaxSize = cpu_to_le32(ctx->rx_max); ++ + err = usb_control_msg(ctx->udev, + usb_sndctrlpipe(ctx->udev, 0), + USB_CDC_SET_NTB_INPUT_SIZE, + USB_TYPE_CLASS | USB_DIR_OUT + | USB_RECIP_INTERFACE, +- 0, iface_no, &dwNtbInMaxSize, 4, 1000); ++ 0, iface_no, dwNtbInMaxSize, 4, 1000); ++ kfree(dwNtbInMaxSize); + } +- ++size_err: + if (err < 0) + pr_debug("Setting NTB Input Size failed\n"); + } +@@ -326,19 +343,29 @@ static u8 cdc_ncm_setup(struct cdc_ncm_c + + /* set Max Datagram Size (MTU) */ + if (flags & USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE) { +- __le16 max_datagram_size; ++ __le16 *max_datagram_size; + u16 eth_max_sz = le16_to_cpu(ctx->ether_desc->wMaxSegmentSize); ++ ++ max_datagram_size = kzalloc(sizeof(*max_datagram_size), ++ GFP_KERNEL); ++ if (!max_datagram_size) { ++ err = -ENOMEM; ++ goto max_dgram_err; ++ } ++ + err = usb_control_msg(ctx->udev, usb_rcvctrlpipe(ctx->udev, 0), + USB_CDC_GET_MAX_DATAGRAM_SIZE, + USB_TYPE_CLASS | USB_DIR_IN + | USB_RECIP_INTERFACE, +- 0, iface_no, &max_datagram_size, ++ 0, iface_no, max_datagram_size, + 2, 1000); + if (err < 0) { + pr_debug("GET_MAX_DATAGRAM_SIZE failed, use size=%u\n", + CDC_NCM_MIN_DATAGRAM_SIZE); ++ kfree(max_datagram_size); + } else { +- ctx->max_datagram_size = le16_to_cpu(max_datagram_size); ++ ctx->max_datagram_size = ++ le16_to_cpu(*max_datagram_size); + /* Check Eth descriptor value */ + if (eth_max_sz < CDC_NCM_MAX_DATAGRAM_SIZE) { + if (ctx->max_datagram_size > eth_max_sz) +@@ -361,8 +388,10 @@ static u8 cdc_ncm_setup(struct cdc_ncm_c + USB_TYPE_CLASS | USB_DIR_OUT + | USB_RECIP_INTERFACE, + 0, +- iface_no, &max_datagram_size, ++ iface_no, max_datagram_size, + 2, 1000); ++ kfree(max_datagram_size); ++max_dgram_err: + if (err < 0) + pr_debug("SET_MAX_DATAGRAM_SIZE failed\n"); + } -- 2.47.3