--- /dev/null
+From 15b2f3204a5c878c32939094775fb7349f707263 Mon Sep 17 00:00:00 2001
+From: "Marius B. Kotsbak" <marius@kotsbak.com>
+Date: Mon, 21 Mar 2011 23:27:21 +0100
+Subject: Bind only modem AT command endpoint to option module.
+
+From: "Marius B. Kotsbak" <marius@kotsbak.com>
+
+commit 15b2f3204a5c878c32939094775fb7349f707263 upstream.
+
+Network interface is handled by upcoming gt_b3730 module.
+
+Removed "GT-B3710" from comment, it is another modem with another USB ID.
+
+Signed-off-by: Marius B. Kotsbak <marius@kotsbak.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -972,7 +972,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+- { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730/GT-B3710 LTE USB modem.*/
++ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+@@ -1109,6 +1109,12 @@ static int option_probe(struct usb_seria
+ serial->interface->cur_altsetting->desc.bInterfaceNumber == 1)
+ return -ENODEV;
+
++ /* Don't bind network interface on Samsung GT-B3730, it is handled by a separate module */
++ if (serial->dev->descriptor.idVendor == SAMSUNG_VENDOR_ID &&
++ serial->dev->descriptor.idProduct == SAMSUNG_PRODUCT_GT_B3730 &&
++ serial->interface->cur_altsetting->desc.bInterfaceClass != USB_CLASS_CDC_DATA)
++ return -ENODEV;
++
+ data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL);
+
+ if (!data)
--- /dev/null
+From 1fe70e963028f34ba5e32488a7870ff4b410b19b Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Sun, 1 May 2011 06:29:37 -0300
+Subject: [media] cx88: fix locking of sub-driver operations
+
+From: Jonathan Nieder <jrnieder@gmail.com>
+
+commit 1fe70e963028f34ba5e32488a7870ff4b410b19b upstream.
+
+The BKL conversion of this driver seems to have gone wrong.
+Loading the cx88-blackbird driver deadlocks.
+
+The cause: mpeg_ops::open in the cx2388x blackbird driver acquires the
+device lock and calls the sub-driver's request_acquire, which tries to
+acquire the lock again. Fix it by clarifying the semantics of
+request_acquire, request_release, advise_acquire, and advise_release:
+now all will rely on the caller to acquire the device lock.
+
+Based on work by Ben Hutchings <ben@decadent.org.uk>.
+
+Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=31962
+
+Reported-by: Andi Huber <hobrom@gmx.at>
+Tested-by: Andi Huber <hobrom@gmx.at>
+Tested-by: Marlon de Boer <marlon@hyves.nl>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx88/cx88-blackbird.c | 4 ++--
+ drivers/media/video/cx88/cx88-dvb.c | 3 +--
+ drivers/media/video/cx88/cx88-mpeg.c | 4 ----
+ drivers/media/video/cx88/cx88.h | 3 ++-
+ 4 files changed, 5 insertions(+), 9 deletions(-)
+
+--- a/drivers/media/video/cx88/cx88-blackbird.c
++++ b/drivers/media/video/cx88/cx88-blackbird.c
+@@ -1125,13 +1125,13 @@ static int mpeg_release(struct file *fil
+
+ /* Make sure we release the hardware */
+ drv = cx8802_get_driver(dev, CX88_MPEG_BLACKBIRD);
+- mutex_unlock(&dev->core->lock);
+-
+ if (drv)
+ drv->request_release(drv);
+
+ atomic_dec(&dev->core->mpeg_users);
+
++ mutex_unlock(&dev->core->lock);
++
+ return 0;
+ }
+
+--- a/drivers/media/video/cx88/cx88-dvb.c
++++ b/drivers/media/video/cx88/cx88-dvb.c
+@@ -134,8 +134,6 @@ static int cx88_dvb_bus_ctrl(struct dvb_
+
+ mutex_lock(&dev->core->lock);
+ drv = cx8802_get_driver(dev, CX88_MPEG_DVB);
+- mutex_unlock(&dev->core->lock);
+-
+ if (drv) {
+ if (acquire){
+ dev->frontends.active_fe_id = fe_id;
+@@ -145,6 +143,7 @@ static int cx88_dvb_bus_ctrl(struct dvb_
+ dev->frontends.active_fe_id = 0;
+ }
+ }
++ mutex_unlock(&dev->core->lock);
+
+ return ret;
+ }
+--- a/drivers/media/video/cx88/cx88-mpeg.c
++++ b/drivers/media/video/cx88/cx88-mpeg.c
+@@ -624,13 +624,11 @@ static int cx8802_request_acquire(struct
+
+ if (drv->advise_acquire)
+ {
+- mutex_lock(&drv->core->lock);
+ core->active_ref++;
+ if (core->active_type_id == CX88_BOARD_NONE) {
+ core->active_type_id = drv->type_id;
+ drv->advise_acquire(drv);
+ }
+- mutex_unlock(&drv->core->lock);
+
+ mpeg_dbg(1,"%s() Post acquire GPIO=%x\n", __func__, cx_read(MO_GP0_IO));
+ }
+@@ -643,14 +641,12 @@ static int cx8802_request_release(struct
+ {
+ struct cx88_core *core = drv->core;
+
+- mutex_lock(&drv->core->lock);
+ if (drv->advise_release && --core->active_ref == 0)
+ {
+ drv->advise_release(drv);
+ core->active_type_id = CX88_BOARD_NONE;
+ mpeg_dbg(1,"%s() Post release GPIO=%x\n", __func__, cx_read(MO_GP0_IO));
+ }
+- mutex_unlock(&drv->core->lock);
+
+ return 0;
+ }
+--- a/drivers/media/video/cx88/cx88.h
++++ b/drivers/media/video/cx88/cx88.h
+@@ -500,7 +500,8 @@ struct cx8802_driver {
+ /* Caller must _not_ hold core->lock */
+ int (*probe)(struct cx8802_driver *drv);
+
+- /* Caller must hold core->lock */
++ /* Callers to the following functions must hold core->lock */
++
+ int (*remove)(struct cx8802_driver *drv);
+
+ /* MPEG 8802 -> mini driver - Access for hardware control */
--- /dev/null
+From 1d6213ab995c61f7d1d81cf6cf876acf15d6e714 Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Sun, 1 May 2011 06:29:56 -0300
+Subject: [media] cx88: hold device lock during sub-driver
+ initialization
+
+From: Jonathan Nieder <jrnieder@gmail.com>
+
+commit 1d6213ab995c61f7d1d81cf6cf876acf15d6e714 upstream.
+
+cx8802_blackbird_probe makes a device node for the mpeg sub-device
+before it has been added to dev->drvlist. If the device is opened
+during that time, the open succeeds but request_acquire cannot be
+called, so the reference count remains zero. Later, when the device
+is closed, the reference count becomes negative --- uh oh.
+
+Close the race by holding core->lock during probe and not releasing
+until the device is in drvlist and initialization finished.
+Previously the BKL prevented this race.
+
+Reported-by: Andreas Huber <hobrom@gmx.at>
+Tested-by: Andi Huber <hobrom@gmx.at>
+Tested-by: Marlon de Boer <marlon@hyves.nl>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx88/cx88-blackbird.c | 2 --
+ drivers/media/video/cx88/cx88-mpeg.c | 5 ++---
+ drivers/media/video/cx88/cx88.h | 7 ++-----
+ 3 files changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/video/cx88/cx88-blackbird.c
++++ b/drivers/media/video/cx88/cx88-blackbird.c
+@@ -1335,11 +1335,9 @@ static int cx8802_blackbird_probe(struct
+ blackbird_register_video(dev);
+
+ /* initial device configuration: needed ? */
+- mutex_lock(&dev->core->lock);
+ // init_controls(core);
+ cx88_set_tvnorm(core,core->tvnorm);
+ cx88_video_mux(core,0);
+- mutex_unlock(&dev->core->lock);
+
+ return 0;
+
+--- a/drivers/media/video/cx88/cx88-mpeg.c
++++ b/drivers/media/video/cx88/cx88-mpeg.c
+@@ -709,18 +709,17 @@ int cx8802_register_driver(struct cx8802
+ drv->request_release = cx8802_request_release;
+ memcpy(driver, drv, sizeof(*driver));
+
++ mutex_lock(&drv->core->lock);
+ err = drv->probe(driver);
+ if (err == 0) {
+ i++;
+- mutex_lock(&drv->core->lock);
+ list_add_tail(&driver->drvlist, &dev->drvlist);
+- mutex_unlock(&drv->core->lock);
+ } else {
+ printk(KERN_ERR
+ "%s/2: cx8802 probe failed, err = %d\n",
+ dev->core->name, err);
+ }
+-
++ mutex_unlock(&drv->core->lock);
+ }
+
+ return i ? 0 : -ENODEV;
+--- a/drivers/media/video/cx88/cx88.h
++++ b/drivers/media/video/cx88/cx88.h
+@@ -495,13 +495,10 @@ struct cx8802_driver {
+ int (*suspend)(struct pci_dev *pci_dev, pm_message_t state);
+ int (*resume)(struct pci_dev *pci_dev);
+
+- /* MPEG 8802 -> mini driver - Driver probe and configuration */
+-
+- /* Caller must _not_ hold core->lock */
+- int (*probe)(struct cx8802_driver *drv);
+-
+ /* Callers to the following functions must hold core->lock */
+
++ /* MPEG 8802 -> mini driver - Driver probe and configuration */
++ int (*probe)(struct cx8802_driver *drv);
+ int (*remove)(struct cx8802_driver *drv);
+
+ /* MPEG 8802 -> mini driver - Access for hardware control */
--- /dev/null
+From 8a317a8760cfffa8185b56ff59fb4b6c58488d79 Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Sun, 1 May 2011 06:29:16 -0300
+Subject: [media] cx88: protect per-device driver list with device
+ lock
+
+From: Jonathan Nieder <jrnieder@gmail.com>
+
+commit 8a317a8760cfffa8185b56ff59fb4b6c58488d79 upstream.
+
+The BKL conversion of this driver seems to have gone wrong. Various
+uses of the sub-device and driver lists appear to be subject to race
+conditions.
+
+In particular, some functions access drvlist without a relevant lock
+held, which will race against removal of drivers. Let's start with
+that --- clean up by consistently protecting dev->drvlist with
+dev->core->lock, noting driver functions that require the device lock
+to be held or not to be held.
+
+After this patch, there are still some races --- e.g.,
+cx8802_blackbird_remove can run between the time the blackbird driver
+is acquired and the time it is used in mpeg_release, and there's a
+similar race in cx88_dvb_bus_ctrl. Later patches will address the
+remaining known races and the deadlock noticed by Andi. This patch
+just makes the semantics clearer in preparation for those later
+changes.
+
+Based on work by Ben Hutchings <ben@decadent.org.uk>.
+
+Tested-by: Andi Huber <hobrom@gmx.at>
+Tested-by: Marlon de Boer <marlon@hyves.nl>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx88/cx88-blackbird.c | 3 ++-
+ drivers/media/video/cx88/cx88-dvb.c | 3 +++
+ drivers/media/video/cx88/cx88-mpeg.c | 11 +++++++----
+ drivers/media/video/cx88/cx88.h | 9 ++++++++-
+ 4 files changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/video/cx88/cx88-blackbird.c
++++ b/drivers/media/video/cx88/cx88-blackbird.c
+@@ -1122,10 +1122,11 @@ static int mpeg_release(struct file *fil
+ mutex_lock(&dev->core->lock);
+ file->private_data = NULL;
+ kfree(fh);
+- mutex_unlock(&dev->core->lock);
+
+ /* Make sure we release the hardware */
+ drv = cx8802_get_driver(dev, CX88_MPEG_BLACKBIRD);
++ mutex_unlock(&dev->core->lock);
++
+ if (drv)
+ drv->request_release(drv);
+
+--- a/drivers/media/video/cx88/cx88-dvb.c
++++ b/drivers/media/video/cx88/cx88-dvb.c
+@@ -132,7 +132,10 @@ static int cx88_dvb_bus_ctrl(struct dvb_
+ return -EINVAL;
+ }
+
++ mutex_lock(&dev->core->lock);
+ drv = cx8802_get_driver(dev, CX88_MPEG_DVB);
++ mutex_unlock(&dev->core->lock);
++
+ if (drv) {
+ if (acquire){
+ dev->frontends.active_fe_id = fe_id;
+--- a/drivers/media/video/cx88/cx88-mpeg.c
++++ b/drivers/media/video/cx88/cx88-mpeg.c
+@@ -748,6 +748,8 @@ int cx8802_unregister_driver(struct cx88
+ dev->pci->subsystem_device, dev->core->board.name,
+ dev->core->boardnr);
+
++ mutex_lock(&dev->core->lock);
++
+ list_for_each_entry_safe(d, dtmp, &dev->drvlist, drvlist) {
+ /* only unregister the correct driver type */
+ if (d->type_id != drv->type_id)
+@@ -755,15 +757,14 @@ int cx8802_unregister_driver(struct cx88
+
+ err = d->remove(d);
+ if (err == 0) {
+- mutex_lock(&drv->core->lock);
+ list_del(&d->drvlist);
+- mutex_unlock(&drv->core->lock);
+ kfree(d);
+ } else
+ printk(KERN_ERR "%s/2: cx8802 driver remove "
+ "failed (%d)\n", dev->core->name, err);
+ }
+
++ mutex_unlock(&dev->core->lock);
+ }
+
+ return err;
+@@ -827,6 +828,8 @@ static void __devexit cx8802_remove(stru
+
+ flush_request_modules(dev);
+
++ mutex_lock(&dev->core->lock);
++
+ if (!list_empty(&dev->drvlist)) {
+ struct cx8802_driver *drv, *tmp;
+ int err;
+@@ -838,9 +841,7 @@ static void __devexit cx8802_remove(stru
+ list_for_each_entry_safe(drv, tmp, &dev->drvlist, drvlist) {
+ err = drv->remove(drv);
+ if (err == 0) {
+- mutex_lock(&drv->core->lock);
+ list_del(&drv->drvlist);
+- mutex_unlock(&drv->core->lock);
+ } else
+ printk(KERN_ERR "%s/2: cx8802 driver remove "
+ "failed (%d)\n", dev->core->name, err);
+@@ -848,6 +849,8 @@ static void __devexit cx8802_remove(stru
+ }
+ }
+
++ mutex_unlock(&dev->core->lock);
++
+ /* Destroy any 8802 reference. */
+ dev->core->dvbdev = NULL;
+
+--- a/drivers/media/video/cx88/cx88.h
++++ b/drivers/media/video/cx88/cx88.h
+@@ -496,7 +496,11 @@ struct cx8802_driver {
+ int (*resume)(struct pci_dev *pci_dev);
+
+ /* MPEG 8802 -> mini driver - Driver probe and configuration */
++
++ /* Caller must _not_ hold core->lock */
+ int (*probe)(struct cx8802_driver *drv);
++
++ /* Caller must hold core->lock */
+ int (*remove)(struct cx8802_driver *drv);
+
+ /* MPEG 8802 -> mini driver - Access for hardware control */
+@@ -551,8 +555,9 @@ struct cx8802_dev {
+ /* for switching modulation types */
+ unsigned char ts_gen_cntrl;
+
+- /* List of attached drivers */
++ /* List of attached drivers; must hold core->lock to access */
+ struct list_head drvlist;
++
+ struct work_struct request_module_wk;
+ };
+
+@@ -675,6 +680,8 @@ int cx88_audio_thread(void *data);
+
+ int cx8802_register_driver(struct cx8802_driver *drv);
+ int cx8802_unregister_driver(struct cx8802_driver *drv);
++
++/* Caller must hold core->lock */
+ struct cx8802_driver * cx8802_get_driver(struct cx8802_dev *dev, enum cx88_board_type btype);
+
+ /* ----------------------------------------------------------- */
--- /dev/null
+From 8d08dab786ad5cc2aca2bf870de370144b78c85a Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Tue, 17 May 2011 00:50:33 -0500
+Subject: eCryptfs: Allow 2 scatterlist entries for encrypted
+ filenames
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit 8d08dab786ad5cc2aca2bf870de370144b78c85a upstream.
+
+The buffers allocated while encrypting and decrypting long filenames can
+sometimes straddle two pages. In this situation, virt_to_scatterlist()
+will return -ENOMEM, causing the operation to fail and the user will get
+scary error messages in their logs:
+
+kernel: ecryptfs_write_tag_70_packet: Internal error whilst attempting
+to convert filename memory to scatterlist; expected rc = 1; got rc =
+[-12]. block_aligned_filename_size = [272]
+kernel: ecryptfs_encrypt_filename: Error attempting to generate tag 70
+packet; rc = [-12]
+kernel: ecryptfs_encrypt_and_encode_filename: Error attempting to
+encrypt filename; rc = [-12]
+kernel: ecryptfs_lookup: Error attempting to encrypt and encode
+filename; rc = [-12]
+
+The solution is to allow up to 2 scatterlist entries to be used.
+
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/keystore.c | 46 +++++++++++++++++++++-------------------------
+ 1 file changed, 21 insertions(+), 25 deletions(-)
+
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -492,8 +492,8 @@ struct ecryptfs_write_tag_70_packet_sill
+ struct mutex *tfm_mutex;
+ char *block_aligned_filename;
+ struct ecryptfs_auth_tok *auth_tok;
+- struct scatterlist src_sg;
+- struct scatterlist dst_sg;
++ struct scatterlist src_sg[2];
++ struct scatterlist dst_sg[2];
+ struct blkcipher_desc desc;
+ char iv[ECRYPTFS_MAX_IV_BYTES];
+ char hash[ECRYPTFS_TAG_70_DIGEST_SIZE];
+@@ -709,23 +709,21 @@ ecryptfs_write_tag_70_packet(char *dest,
+ memcpy(&s->block_aligned_filename[s->num_rand_bytes], filename,
+ filename_size);
+ rc = virt_to_scatterlist(s->block_aligned_filename,
+- s->block_aligned_filename_size, &s->src_sg, 1);
+- if (rc != 1) {
++ s->block_aligned_filename_size, s->src_sg, 2);
++ if (rc < 1) {
+ printk(KERN_ERR "%s: Internal error whilst attempting to "
+- "convert filename memory to scatterlist; "
+- "expected rc = 1; got rc = [%d]. "
++ "convert filename memory to scatterlist; rc = [%d]. "
+ "block_aligned_filename_size = [%zd]\n", __func__, rc,
+ s->block_aligned_filename_size);
+ goto out_release_free_unlock;
+ }
+ rc = virt_to_scatterlist(&dest[s->i], s->block_aligned_filename_size,
+- &s->dst_sg, 1);
+- if (rc != 1) {
++ s->dst_sg, 2);
++ if (rc < 1) {
+ printk(KERN_ERR "%s: Internal error whilst attempting to "
+ "convert encrypted filename memory to scatterlist; "
+- "expected rc = 1; got rc = [%d]. "
+- "block_aligned_filename_size = [%zd]\n", __func__, rc,
+- s->block_aligned_filename_size);
++ "rc = [%d]. block_aligned_filename_size = [%zd]\n",
++ __func__, rc, s->block_aligned_filename_size);
+ goto out_release_free_unlock;
+ }
+ /* The characters in the first block effectively do the job
+@@ -748,7 +746,7 @@ ecryptfs_write_tag_70_packet(char *dest,
+ mount_crypt_stat->global_default_fn_cipher_key_bytes);
+ goto out_release_free_unlock;
+ }
+- rc = crypto_blkcipher_encrypt_iv(&s->desc, &s->dst_sg, &s->src_sg,
++ rc = crypto_blkcipher_encrypt_iv(&s->desc, s->dst_sg, s->src_sg,
+ s->block_aligned_filename_size);
+ if (rc) {
+ printk(KERN_ERR "%s: Error attempting to encrypt filename; "
+@@ -782,8 +780,8 @@ struct ecryptfs_parse_tag_70_packet_sill
+ struct mutex *tfm_mutex;
+ char *decrypted_filename;
+ struct ecryptfs_auth_tok *auth_tok;
+- struct scatterlist src_sg;
+- struct scatterlist dst_sg;
++ struct scatterlist src_sg[2];
++ struct scatterlist dst_sg[2];
+ struct blkcipher_desc desc;
+ char fnek_sig_hex[ECRYPTFS_SIG_SIZE_HEX + 1];
+ char iv[ECRYPTFS_MAX_IV_BYTES];
+@@ -890,13 +888,12 @@ ecryptfs_parse_tag_70_packet(char **file
+ }
+ mutex_lock(s->tfm_mutex);
+ rc = virt_to_scatterlist(&data[(*packet_size)],
+- s->block_aligned_filename_size, &s->src_sg, 1);
+- if (rc != 1) {
++ s->block_aligned_filename_size, s->src_sg, 2);
++ if (rc < 1) {
+ printk(KERN_ERR "%s: Internal error whilst attempting to "
+ "convert encrypted filename memory to scatterlist; "
+- "expected rc = 1; got rc = [%d]. "
+- "block_aligned_filename_size = [%zd]\n", __func__, rc,
+- s->block_aligned_filename_size);
++ "rc = [%d]. block_aligned_filename_size = [%zd]\n",
++ __func__, rc, s->block_aligned_filename_size);
+ goto out_unlock;
+ }
+ (*packet_size) += s->block_aligned_filename_size;
+@@ -910,13 +907,12 @@ ecryptfs_parse_tag_70_packet(char **file
+ goto out_unlock;
+ }
+ rc = virt_to_scatterlist(s->decrypted_filename,
+- s->block_aligned_filename_size, &s->dst_sg, 1);
+- if (rc != 1) {
++ s->block_aligned_filename_size, s->dst_sg, 2);
++ if (rc < 1) {
+ printk(KERN_ERR "%s: Internal error whilst attempting to "
+ "convert decrypted filename memory to scatterlist; "
+- "expected rc = 1; got rc = [%d]. "
+- "block_aligned_filename_size = [%zd]\n", __func__, rc,
+- s->block_aligned_filename_size);
++ "rc = [%d]. block_aligned_filename_size = [%zd]\n",
++ __func__, rc, s->block_aligned_filename_size);
+ goto out_free_unlock;
+ }
+ /* The characters in the first block effectively do the job of
+@@ -956,7 +952,7 @@ ecryptfs_parse_tag_70_packet(char **file
+ mount_crypt_stat->global_default_fn_cipher_key_bytes);
+ goto out_free_unlock;
+ }
+- rc = crypto_blkcipher_decrypt_iv(&s->desc, &s->dst_sg, &s->src_sg,
++ rc = crypto_blkcipher_decrypt_iv(&s->desc, s->dst_sg, s->src_sg,
+ s->block_aligned_filename_size);
+ if (rc) {
+ printk(KERN_ERR "%s: Error attempting to decrypt filename; "
--- /dev/null
+From 2b7aaf503d56216b847c8265421d2a7d9b42df3e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 16 May 2011 12:15:19 -0400
+Subject: OHCI: fix regression caused by nVidia shutdown workaround
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 2b7aaf503d56216b847c8265421d2a7d9b42df3e upstream.
+
+This patch (as1463) fixes a regression caused by commit
+3df7169e73fc1d71a39cffeacc969f6840cdf52b (OHCI: work around for nVidia
+shutdown problem).
+
+The original problem encountered by people using NVIDIA chipsets was
+that USB devices were not turning off when the system shut down. For
+example, the LED on an optical mouse would remain on, draining a
+laptop's battery. The problem was caused by a bug in the chipset; an
+OHCI controller in the Reset state would continue to drive a bus reset
+signal even after system shutdown. The workaround was to put the
+controllers into the Suspend state instead.
+
+It turns out that later NVIDIA chipsets do not suffer from this bug.
+Instead some have the opposite bug: If a system is shut down while an
+OHCI controller is in the Suspend state, USB devices remain powered!
+On other systems, shutting down with a Suspended controller causes the
+system to reboot immediately. Thus, working around the original bug
+on some machines exposes other bugs on other machines.
+
+The best solution seems to be to limit the workaround to OHCI
+controllers with a low-numbered PCI product ID. I don't know exactly
+at what point NVIDIA changed their chipsets; the value used here is a
+guess. So far it was worked out okay for all the people who have
+tested it.
+
+This fixes Bugzilla #35032.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Andre "Osku" Schmidt <andre.osku.schmidt@googlemail.com>
+Tested-by: Yury Siamashka <yurand2@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ohci-pci.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -207,10 +207,18 @@ static int ohci_quirk_amd700(struct usb_
+ */
+ static int ohci_quirk_nvidia_shutdown(struct usb_hcd *hcd)
+ {
++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+ struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+
+- ohci->flags |= OHCI_QUIRK_SHUTDOWN;
+- ohci_dbg(ohci, "enabled nVidia shutdown quirk\n");
++ /* Evidently nVidia fixed their later hardware; this is a guess at
++ * the changeover point.
++ */
++#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB 0x026d
++
++ if (pdev->device < PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB) {
++ ohci->flags |= OHCI_QUIRK_SHUTDOWN;
++ ohci_dbg(ohci, "enabled nVidia shutdown quirk\n");
++ }
+
+ return 0;
+ }
--- /dev/null
+From 9368a9a2378ab721f82f59430a135b4ce4ff5109 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Fri, 13 May 2011 21:47:23 +0200
+Subject: p54usb: add zoom 4410 usbid
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 9368a9a2378ab721f82f59430a135b4ce4ff5109 upstream.
+
+Reported-by: Mark Davis <marked86@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -82,6 +82,7 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */
+ {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */
+ {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */
++ {USB_DEVICE(0x083a, 0xc501)}, /* Zoom Wireless-G 4410 */
+ {USB_DEVICE(0x083a, 0xf503)}, /* Accton FD7050E ver 1010ec */
+ {USB_DEVICE(0x0846, 0x4240)}, /* Netgear WG111 (v2) */
+ {USB_DEVICE(0x0915, 0x2000)}, /* Cohiba Proto board */
loop-limit-max_part-module-param-to-disk_max_parts.patch
loop-handle-on-demand-devices-correctly.patch
i2c-writing-clients-fix-foo_driver.id_table.patch
+usb-cp210x-add-4-device-ids-for-ac-services-devices.patch
+usb-moto_modem-add-usb-identifier-for-the-motorola-ve240.patch
+usb-serial-ftdi_sio-adding-support-for-tavir-stk500.patch
+usb-gadget-g_multi-fixed-vendor-and-product-id-in-inf.patch
+usb-gamin_gps-fix-for-data-transfer-problems-in-native.patch
+bind-only-modem-at-command-endpoint-to-option-module.patch
+usb-cdc_acm-fix-oops-when-droids-muin-lcd-is-connected.patch
+xhci-fix-bug-in-control-transfer-cancellation.patch
+usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch
+usb-gadget-rndis-don-t-test-against-req-length.patch
+xhci-fix-full-speed-binterval-encoding.patch
+xhci-fix-memory-leak-in-ring-cache-deallocation.patch
+xhci-fix-memory-leak-bug-when-dropping-endpoints.patch
+usb-option-add-support-for-huawei-e353-device.patch
+ohci-fix-regression-caused-by-nvidia-shutdown-workaround.patch
+usb-remove-remaining-usages-of-hcd-state-from-usbcore-and.patch
+cx88-protect-per-device-driver-list-with-device.patch
+cx88-fix-locking-of-sub-driver-operations.patch
+cx88-hold-device-lock-during-sub-driver.patch
+sh-clkfwk-fixup-clk_rate_table_build-parameter-in-div6.patch
+sh-fixup-fpu.o-compile-order.patch
+p54usb-add-zoom-4410-usbid.patch
+ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch
--- /dev/null
+From 52c10ad22b7e317960b4d411c9a9ddeaf3d5ae39 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Thu, 14 Apr 2011 17:13:53 +0900
+Subject: sh: clkfwk: fixup clk_rate_table_build parameter in div6
+ clock
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+commit 52c10ad22b7e317960b4d411c9a9ddeaf3d5ae39 upstream.
+
+div6 clock should not use arch_flags for clk_rate_table_build,
+because SH_CLK_DIV6_EXT doesn't care .arch_flags.
+clk->freq_table[] will be all CPUFREQ_ENTRY_INVALID without this patch.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/sh/clk/cpg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/sh/clk/cpg.c
++++ b/drivers/sh/clk/cpg.c
+@@ -105,7 +105,7 @@ static int sh_clk_div6_set_parent(struct
+
+ /* Rebuild the frequency table */
+ clk_rate_table_build(clk, clk->freq_table, table->nr_divisors,
+- table, &clk->arch_flags);
++ table, NULL);
+
+ return 0;
+ }
--- /dev/null
+From a375b15164dd9264f724ad941825e52c90145151 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Fri, 15 Apr 2011 16:44:27 +0900
+Subject: sh: fixup fpu.o compile order
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+commit a375b15164dd9264f724ad941825e52c90145151 upstream.
+
+arch_ptrace() was modified to reference init_fpu() to fix up xstate
+initialization, which overlooked the fact that there are configurations
+that don't enable any of hard FPU support or emulation, resulting in
+build errors on DSP parts.
+
+Given that init_fpu() simply sets up the xstate slab cache and is
+side-stepped entirely for the DSP case, we can simply always build in the
+helper and fix up the references.
+
+Reported-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sh/kernel/cpu/Makefile | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/sh/kernel/cpu/Makefile
++++ b/arch/sh/kernel/cpu/Makefile
+@@ -17,7 +17,5 @@ obj-$(CONFIG_ARCH_SHMOBILE) += shmobile/
+
+ obj-$(CONFIG_SH_ADC) += adc.o
+ obj-$(CONFIG_SH_CLK_CPG_LEGACY) += clock-cpg.o
+-obj-$(CONFIG_SH_FPU) += fpu.o
+-obj-$(CONFIG_SH_FPU_EMU) += fpu.o
+
+-obj-y += irq/ init.o clock.o hwblk.o proc.o
++obj-y += irq/ init.o clock.o fpu.o hwblk.o proc.o
--- /dev/null
+From fd5054c169d29747a44b4e1419ff47f57ae82dbc Mon Sep 17 00:00:00 2001
+From: Erik Slagter <erik@slagter.name>
+Date: Wed, 11 May 2011 12:06:55 +0200
+Subject: USB: cdc_acm: Fix oops when Droids MuIn LCD is connected
+
+From: Erik Slagter <erik@slagter.name>
+
+commit fd5054c169d29747a44b4e1419ff47f57ae82dbc upstream.
+
+The Droids MuIn LCD operates like a serial remote terminal.
+Data received are displayed directly on the LCD. This patch
+fixes the kernel null pointer oops when it is plugged in.
+
+Add NO_DATA_INTERFACE quirk to tell the driver that "control"
+and "data" interfaces are not separated for this device, which
+prevents dereferencing a null pointer in the device probe code.
+
+Signed-off-by: Erik Slagter <erik@slagter.name>
+Signed-off-by: Maxin B. John <maxin.john@gmail.com>
+Tested-by: Erik Slagter <erik@slagter.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 13 +++++++++++--
+ drivers/usb/class/cdc-acm.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -946,7 +946,7 @@ static int acm_probe(struct usb_interfac
+ u8 ac_management_function = 0;
+ u8 call_management_function = 0;
+ int call_interface_num = -1;
+- int data_interface_num;
++ int data_interface_num = -1;
+ unsigned long quirks;
+ int num_rx_buf;
+ int i;
+@@ -1030,7 +1030,11 @@ next_desc:
+ if (!union_header) {
+ if (call_interface_num > 0) {
+ dev_dbg(&intf->dev, "No union descriptor, using call management descriptor\n");
+- data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
++ /* quirks for Droids MuIn LCD */
++ if (quirks & NO_DATA_INTERFACE)
++ data_interface = usb_ifnum_to_if(usb_dev, 0);
++ else
++ data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
+ control_interface = intf;
+ } else {
+ if (intf->cur_altsetting->desc.bNumEndpoints != 3) {
+@@ -1622,6 +1626,11 @@ static const struct usb_device_id acm_id
+ .driver_info = NOT_A_MODEM,
+ },
+
++ /* Support for Droids MuIn LCD */
++ { USB_DEVICE(0x04d8, 0x000b),
++ .driver_info = NO_DATA_INTERFACE,
++ },
++
+ /* control interfaces without any protocol set */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_PROTO_NONE) },
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -137,3 +137,4 @@ struct acm {
+ #define SINGLE_RX_URB 2
+ #define NO_CAP_LINE 4
+ #define NOT_A_MODEM 8
++#define NO_DATA_INTERFACE 16
--- /dev/null
+From 4eff0b40a7174896b860312910e0db51f2dcc567 Mon Sep 17 00:00:00 2001
+From: Craig Shelley <craig@microtron.org.uk>
+Date: Sun, 20 Mar 2011 13:51:13 +0000
+Subject: USB: CP210x Add 4 Device IDs for AC-Services Devices
+
+From: Craig Shelley <craig@microtron.org.uk>
+
+commit 4eff0b40a7174896b860312910e0db51f2dcc567 upstream.
+
+This patch adds 4 device IDs for CP2102 based devices manufactured by
+AC-Services. See http://www.ac-services.eu for further info.
+
+Signed-off-by: Craig Shelley <craig@microtron.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -113,6 +113,10 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+ { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
++ { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
++ { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
++ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
++ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
--- /dev/null
+From bf1f0a05d472e33dda8e5e69525be1584cdbd03a Mon Sep 17 00:00:00 2001
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Date: Fri, 13 May 2011 17:03:02 +0200
+Subject: usb/gadget: at91sam9g20 fix end point max packet size
+
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+
+commit bf1f0a05d472e33dda8e5e69525be1584cdbd03a upstream.
+
+on 9g20 they are the same as the 9260
+
+Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/at91_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/at91_udc.c
++++ b/drivers/usb/gadget/at91_udc.c
+@@ -1767,7 +1767,7 @@ static int __init at91udc_probe(struct p
+ }
+
+ /* newer chips have more FIFO memory than rm9200 */
+- if (cpu_is_at91sam9260()) {
++ if (cpu_is_at91sam9260() || cpu_is_at91sam9g20()) {
+ udc->ep[0].maxpacket = 64;
+ udc->ep[3].maxpacket = 64;
+ udc->ep[4].maxpacket = 512;
--- /dev/null
+From 7701846fd52f86dffe50715e0e63154088b7c982 Mon Sep 17 00:00:00 2001
+From: Michal Nazarewicz <mina86@mina86.com>
+Date: Tue, 26 Apr 2011 19:08:36 +0200
+Subject: USB: gadget: g_multi: fixed vendor and product ID in inf
+ files
+
+From: Michal Nazarewicz <mina86@mina86.com>
+
+commit 7701846fd52f86dffe50715e0e63154088b7c982 upstream.
+
+Commit 1c6529e92b "USB: gadget: g_multi: fixed vendor and
+product ID" replaced g_multi's vendor and product ID with
+proper ID's from Linux Foundation. This commit now updates
+INF files in the Documentation/usb directory which were
+omitted in the original commit.
+
+Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/usb/linux-cdc-acm.inf | 4 ++--
+ Documentation/usb/linux.inf | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/Documentation/usb/linux-cdc-acm.inf
++++ b/Documentation/usb/linux-cdc-acm.inf
+@@ -90,10 +90,10 @@ ServiceBinary=%12%\USBSER.sys
+ [SourceDisksFiles]
+ [SourceDisksNames]
+ [DeviceList]
+-%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_0525&PID_A4AB&MI_02
++%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_1D6B&PID_0104&MI_02
+
+ [DeviceList.NTamd64]
+-%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_0525&PID_A4AB&MI_02
++%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_1D6B&PID_0104&MI_02
+
+
+ ;------------------------------------------------------------------------------
+--- a/Documentation/usb/linux.inf
++++ b/Documentation/usb/linux.inf
+@@ -18,15 +18,15 @@ DriverVer = 06/21/2006,6.0.600
+
+ ; Decoration for x86 architecture
+ [LinuxDevices.NTx86]
+-%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00
++%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00
+
+ ; Decoration for x64 architecture
+ [LinuxDevices.NTamd64]
+-%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00
++%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00
+
+ ; Decoration for ia64 architecture
+ [LinuxDevices.NTia64]
+-%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00
++%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00
+
+ ;@@@ This is the common setting for setup
+ [ControlFlags]
--- /dev/null
+From 472b91274a6c6857877b5caddb875dcb5ecdfcb8 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Fri, 13 May 2011 16:53:48 +0300
+Subject: usb: gadget: rndis: don't test against req->length
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit 472b91274a6c6857877b5caddb875dcb5ecdfcb8 upstream.
+
+composite.c always sets req->length to zero
+and expects function driver's setup handlers
+to return the amount of bytes to be used
+on req->length. If we test against req->length
+w_length will always be greater than req->length
+thus making us always stall that particular
+SEND_ENCAPSULATED_COMMAND request.
+
+Tested against a Windows XP SP3.
+
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/f_rndis.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/f_rndis.c
++++ b/drivers/usb/gadget/f_rndis.c
+@@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, cons
+ */
+ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+ | USB_CDC_SEND_ENCAPSULATED_COMMAND:
+- if (w_length > req->length || w_value
+- || w_index != rndis->ctrl_id)
++ if (w_value || w_index != rndis->ctrl_id)
+ goto invalid;
+ /* read the request; process it later */
+ value = w_length;
--- /dev/null
+From b4026c4584cd70858d4d3450abfb1cd0714d4f32 Mon Sep 17 00:00:00 2001
+From: Hermann Kneissel <herkne@gmx.de>
+Date: Fri, 29 Apr 2011 08:58:43 +0200
+Subject: USB: gamin_gps: Fix for data transfer problems in native
+ mode
+
+From: Hermann Kneissel <herkne@gmx.de>
+
+commit b4026c4584cd70858d4d3450abfb1cd0714d4f32 upstream.
+
+This patch fixes a problem where data received from the gps is sometimes
+transferred incompletely to the serial port. If used in native mode now
+all data received via the bulk queue will be forwarded to the serial
+port.
+
+Signed-off-by: Hermann Kneissel <herkne@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/garmin_gps.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -1,7 +1,7 @@
+ /*
+ * Garmin GPS driver
+ *
+- * Copyright (C) 2006-2009 Hermann Kneissel herkne@users.sourceforge.net
++ * Copyright (C) 2006-2011 Hermann Kneissel herkne@gmx.de
+ *
+ * The latest version of the driver can be found at
+ * http://sourceforge.net/projects/garmin-gps/
+@@ -51,7 +51,7 @@ static int debug;
+ */
+
+ #define VERSION_MAJOR 0
+-#define VERSION_MINOR 33
++#define VERSION_MINOR 36
+
+ #define _STR(s) #s
+ #define _DRIVER_VERSION(a, b) "v" _STR(a) "." _STR(b)
+@@ -410,6 +410,7 @@ static int gsp_send_ack(struct garmin_da
+ */
+ static int gsp_rec_packet(struct garmin_data *garmin_data_p, int count)
+ {
++ unsigned long flags;
+ const __u8 *recpkt = garmin_data_p->inbuffer+GSP_INITIAL_OFFSET;
+ __le32 *usbdata = (__le32 *) garmin_data_p->inbuffer;
+
+@@ -458,7 +459,9 @@ static int gsp_rec_packet(struct garmin_
+ /* if this was an abort-transfer command, flush all
+ queued data. */
+ if (isAbortTrfCmnd(garmin_data_p->inbuffer)) {
++ spin_lock_irqsave(&garmin_data_p->lock, flags);
+ garmin_data_p->flags |= FLAGS_DROP_DATA;
++ spin_unlock_irqrestore(&garmin_data_p->lock, flags);
+ pkt_clear(garmin_data_p);
+ }
+
+@@ -943,7 +946,7 @@ static int garmin_open(struct tty_struct
+ spin_lock_irqsave(&garmin_data_p->lock, flags);
+ garmin_data_p->mode = initial_mode;
+ garmin_data_p->count = 0;
+- garmin_data_p->flags = 0;
++ garmin_data_p->flags &= FLAGS_SESSION_REPLY1_SEEN;
+ spin_unlock_irqrestore(&garmin_data_p->lock, flags);
+
+ /* shutdown any bulk reads that might be going on */
+@@ -1178,7 +1181,8 @@ static int garmin_write_room(struct tty_
+
+
+ static void garmin_read_process(struct garmin_data *garmin_data_p,
+- unsigned char *data, unsigned data_length)
++ unsigned char *data, unsigned data_length,
++ int bulk_data)
+ {
+ unsigned long flags;
+
+@@ -1193,7 +1197,8 @@ static void garmin_read_process(struct g
+ send it directly to the tty port */
+ if (garmin_data_p->flags & FLAGS_QUEUING) {
+ pkt_add(garmin_data_p, data, data_length);
+- } else if (getLayerId(data) == GARMIN_LAYERID_APPL) {
++ } else if (bulk_data ||
++ getLayerId(data) == GARMIN_LAYERID_APPL) {
+
+ spin_lock_irqsave(&garmin_data_p->lock, flags);
+ garmin_data_p->flags |= APP_RESP_SEEN;
+@@ -1237,7 +1242,7 @@ static void garmin_read_bulk_callback(st
+ usb_serial_debug_data(debug, &port->dev,
+ __func__, urb->actual_length, data);
+
+- garmin_read_process(garmin_data_p, data, urb->actual_length);
++ garmin_read_process(garmin_data_p, data, urb->actual_length, 1);
+
+ if (urb->actual_length == 0 &&
+ 0 != (garmin_data_p->flags & FLAGS_BULK_IN_RESTART)) {
+@@ -1346,7 +1351,7 @@ static void garmin_read_int_callback(str
+ __func__, garmin_data_p->serial_num);
+ }
+
+- garmin_read_process(garmin_data_p, data, urb->actual_length);
++ garmin_read_process(garmin_data_p, data, urb->actual_length, 0);
+
+ port->interrupt_in_urb->dev = port->serial->dev;
+ retval = usb_submit_urb(urb, GFP_ATOMIC);
+@@ -1461,6 +1466,7 @@ static int garmin_attach(struct usb_seri
+ garmin_data_p->timer.function = timeout_handler;
+ garmin_data_p->port = port;
+ garmin_data_p->state = 0;
++ garmin_data_p->flags = 0;
+ garmin_data_p->count = 0;
+ usb_set_serial_port_data(port, garmin_data_p);
+
--- /dev/null
+From 3938a0b32dc12229e76735679b37095bc2bc1578 Mon Sep 17 00:00:00 2001
+From: Elizabeth Jennifer Myers <elizabeth@sporksirc.net>
+Date: Sat, 16 Apr 2011 14:49:51 -0400
+Subject: USB: moto_modem: Add USB identifier for the Motorola VE240.
+
+From: Elizabeth Jennifer Myers <elizabeth@sporksirc.net>
+
+commit 3938a0b32dc12229e76735679b37095bc2bc1578 upstream.
+
+Tested on my phone, the ttyUSB device is created and is fully
+functional.
+
+Signed-off-by: Elizabeth Jennifer Myers <elizabeth@sporksirc.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/moto_modem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/moto_modem.c
++++ b/drivers/usb/serial/moto_modem.c
+@@ -25,6 +25,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */
+ { USB_DEVICE(0x0c44, 0x0022) }, /* unknown Mororola phone */
+ { USB_DEVICE(0x22b8, 0x2a64) }, /* Motorola KRZR K1m */
++ { USB_DEVICE(0x22b8, 0x2c84) }, /* Motorola VE240 phone */
+ { USB_DEVICE(0x22b8, 0x2c64) }, /* Motorola V950 phone */
+ { },
+ };
--- /dev/null
+From 610ba42f29c3dfa46a05ff8c2cadc29f544ff76d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marcin=20Ga=C5=82czy=C5=84ski?= <marcin@galczynski.pl>
+Date: Sun, 15 May 2011 11:41:54 +0200
+Subject: USB: option: add support for Huawei E353 device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Marcin=20Ga=C5=82czy=C5=84ski?= <marcin@galczynski.pl>
+
+commit 610ba42f29c3dfa46a05ff8c2cadc29f544ff76d upstream.
+
+I am sharing patch to the devices/usb/serial/option.c. This allows
+operation of Huawei E353 broadband modem using the “option” driver. The
+patch simply adds new constant with proper product ID and an entry to
+usb_device_id. I worked on the 2.6.38.6 sources. Tested on Dell inspiron
+1764 (i3 core cpu) and brand new Huawei E353 modem, Fedora 15 beta.
+
+Looking at the type of change, i doubt it has potential to introduce
+problems in other parts of kernel or the driver itself.
+
+Signed-off-by: Marcin Galczynski <marcin@galczynski.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -149,6 +149,7 @@ static void option_instat_callback(struc
+ #define HUAWEI_PRODUCT_K3765 0x1465
+ #define HUAWEI_PRODUCT_E14AC 0x14AC
+ #define HUAWEI_PRODUCT_ETS1220 0x1803
++#define HUAWEI_PRODUCT_E353 0x1506
+
+ #define QUANTA_VENDOR_ID 0x0408
+ #define QUANTA_PRODUCT_Q101 0xEA02
+@@ -532,6 +533,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) },
--- /dev/null
+From 69fff59de4d844f8b4c2454c3c23d32b69dcbfd7 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 17 May 2011 17:27:12 -0400
+Subject: USB: remove remaining usages of hcd->state from usbcore and
+ fix regression
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 69fff59de4d844f8b4c2454c3c23d32b69dcbfd7 upstream.
+
+This patch (as1467) removes the last usages of hcd->state from
+usbcore. We no longer check to see if an interrupt handler finds that
+a controller has died; instead we rely on host controller drivers to
+make an explicit call to usb_hc_died().
+
+This fixes a regression introduced by commit
+9b37596a2e860404503a3f2a6513db60c296bfdc (USB: move usbcore away from
+hcd->state). It used to be that when a controller shared an IRQ with
+another device and an interrupt arrived while hcd->state was set to
+HC_STATE_HALT, the interrupt handler would be skipped. The commit
+removed that test; as a result the current code doesn't skip calling
+the handler and ends up believing the controller has died, even though
+it's only temporarily stopped. The solution is to ignore HC_STATE_HALT
+following the handler's return.
+
+As a consequence of this change, several of the host controller
+drivers need to be modified. They can no longer implicitly rely on
+usbcore realizing that a controller has died because of hcd->state.
+The patch adds calls to usb_hc_died() in the appropriate places.
+
+The patch also changes a few of the interrupt handlers. They don't
+expect to be called when hcd->state is equal to HC_STATE_HALT, even if
+the controller is still alive. Early returns were added to avoid any
+confusion.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Manuel Lauss <manuel.lauss@googlemail.com>
+CC: Rodolfo Giometti <giometti@linux.it>
+CC: Olav Kongas <ok@artecdesign.ee>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.c | 5 +----
+ drivers/usb/host/ehci-hcd.c | 4 +++-
+ drivers/usb/host/ehci-sched.c | 8 ++++++--
+ drivers/usb/host/isp116x-hcd.c | 1 +
+ drivers/usb/host/ohci-hcd.c | 4 +++-
+ drivers/usb/host/oxu210hp-hcd.c | 6 +++++-
+ 6 files changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -983,7 +983,7 @@ static int register_root_hub(struct usb_
+ spin_unlock_irq (&hcd_root_hub_lock);
+
+ /* Did the HC die before the root hub was registered? */
+- if (HCD_DEAD(hcd) || hcd->state == HC_STATE_HALT)
++ if (HCD_DEAD(hcd))
+ usb_hc_died (hcd); /* This time clean up */
+ }
+
+@@ -2103,9 +2103,6 @@ irqreturn_t usb_hcd_irq (int irq, void *
+ rc = IRQ_NONE;
+ } else {
+ set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
+-
+- if (unlikely(hcd->state == HC_STATE_HALT))
+- usb_hc_died(hcd);
+ rc = IRQ_HANDLED;
+ }
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -776,8 +776,9 @@ static irqreturn_t ehci_irq (struct usb_
+ goto dead;
+ }
+
++ /* Shared IRQ? */
+ masked_status = status & INTR_MASK;
+- if (!masked_status) { /* irq sharing? */
++ if (!masked_status || unlikely(hcd->state == HC_STATE_HALT)) {
+ spin_unlock(&ehci->lock);
+ return IRQ_NONE;
+ }
+@@ -872,6 +873,7 @@ static irqreturn_t ehci_irq (struct usb_
+ dead:
+ ehci_reset(ehci);
+ ehci_writel(ehci, 0, &ehci->regs->configured_flag);
++ usb_hc_died(hcd);
+ /* generic layer kills/unlinks all urbs, then
+ * uses ehci_stop to clean up the rest
+ */
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -471,8 +471,10 @@ static int enable_periodic (struct ehci_
+ */
+ status = handshake_on_error_set_halt(ehci, &ehci->regs->status,
+ STS_PSS, 0, 9 * 125);
+- if (status)
++ if (status) {
++ usb_hc_died(ehci_to_hcd(ehci));
+ return status;
++ }
+
+ cmd = ehci_readl(ehci, &ehci->regs->command) | CMD_PSE;
+ ehci_writel(ehci, cmd, &ehci->regs->command);
+@@ -510,8 +512,10 @@ static int disable_periodic (struct ehci
+ */
+ status = handshake_on_error_set_halt(ehci, &ehci->regs->status,
+ STS_PSS, STS_PSS, 9 * 125);
+- if (status)
++ if (status) {
++ usb_hc_died(ehci_to_hcd(ehci));
+ return status;
++ }
+
+ cmd = ehci_readl(ehci, &ehci->regs->command) & ~CMD_PSE;
+ ehci_writel(ehci, cmd, &ehci->regs->command);
+--- a/drivers/usb/host/isp116x-hcd.c
++++ b/drivers/usb/host/isp116x-hcd.c
+@@ -612,6 +612,7 @@ static irqreturn_t isp116x_irq(struct us
+ /* IRQ's are off, we do no DMA,
+ perfectly ready to die ... */
+ hcd->state = HC_STATE_HALT;
++ usb_hc_died(hcd);
+ ret = IRQ_HANDLED;
+ goto done;
+ }
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -773,6 +773,7 @@ static irqreturn_t ohci_irq (struct usb_
+ if (ints == ~(u32)0) {
+ disable (ohci);
+ ohci_dbg (ohci, "device removed!\n");
++ usb_hc_died(hcd);
+ return IRQ_HANDLED;
+ }
+
+@@ -780,7 +781,7 @@ static irqreturn_t ohci_irq (struct usb_
+ ints &= ohci_readl(ohci, ®s->intrenable);
+
+ /* interrupt for some other device? */
+- if (ints == 0)
++ if (ints == 0 || unlikely(hcd->state == HC_STATE_HALT))
+ return IRQ_NOTMINE;
+
+ if (ints & OHCI_INTR_UE) {
+@@ -797,6 +798,7 @@ static irqreturn_t ohci_irq (struct usb_
+ } else {
+ disable (ohci);
+ ohci_err (ohci, "OHCI Unrecoverable Error, disabled\n");
++ usb_hc_died(hcd);
+ }
+
+ ohci_dump (ohci, 1);
+--- a/drivers/usb/host/oxu210hp-hcd.c
++++ b/drivers/usb/host/oxu210hp-hcd.c
+@@ -1884,6 +1884,7 @@ static int enable_periodic(struct oxu_hc
+ status = handshake(oxu, &oxu->regs->status, STS_PSS, 0, 9 * 125);
+ if (status != 0) {
+ oxu_to_hcd(oxu)->state = HC_STATE_HALT;
++ usb_hc_died(oxu_to_hcd(oxu));
+ return status;
+ }
+
+@@ -1909,6 +1910,7 @@ static int disable_periodic(struct oxu_h
+ status = handshake(oxu, &oxu->regs->status, STS_PSS, STS_PSS, 9 * 125);
+ if (status != 0) {
+ oxu_to_hcd(oxu)->state = HC_STATE_HALT;
++ usb_hc_died(oxu_to_hcd(oxu));
+ return status;
+ }
+
+@@ -2449,8 +2451,9 @@ static irqreturn_t oxu210_hcd_irq(struct
+ goto dead;
+ }
+
++ /* Shared IRQ? */
+ status &= INTR_MASK;
+- if (!status) { /* irq sharing? */
++ if (!status || unlikely(hcd->state == HC_STATE_HALT)) {
+ spin_unlock(&oxu->lock);
+ return IRQ_NONE;
+ }
+@@ -2516,6 +2519,7 @@ static irqreturn_t oxu210_hcd_irq(struct
+ dead:
+ ehci_reset(oxu);
+ writel(0, &oxu->regs->configured_flag);
++ usb_hc_died(hcd);
+ /* generic layer kills/unlinks all urbs, then
+ * uses oxu_stop to clean up the rest
+ */
--- /dev/null
+From 37909fe588c9e09ab57cd267e98678a17ceda64a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Benedek=20L=C3=A1szl=C3=B3?= <benedekl@gmail.com>
+Date: Wed, 20 Apr 2011 03:22:21 +0200
+Subject: USB: serial: ftdi_sio: adding support for TavIR STK500
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Benedek=20L=C3=A1szl=C3=B3?= <benedekl@gmail.com>
+
+commit 37909fe588c9e09ab57cd267e98678a17ceda64a upstream.
+
+Adding support for the TavIR STK500 (id 0403:FA33)
+Atmel AVR programmer device based on FTDI FT232RL.
+
+Signed-off-by: Benedek László <benedekl@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -566,6 +566,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_IBS_APP70_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) },
+ /*
+ * ELV devices:
+ */
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -491,6 +491,11 @@
+ /* www.canusb.com Lawicel CANUSB device (FTDI_VID) */
+ #define FTDI_CANUSB_PID 0xFFA8 /* Product Id */
+
++/*
++ * TavIR AVR product ids (FTDI_VID)
++ */
++#define FTDI_TAVIR_STK500_PID 0xFA33 /* STK500 AVR programmer */
++
+
+
+ /********************************/
--- /dev/null
+From 3abeca998a44205cfd837fa0bf1f7c24f8294acb Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Thu, 5 May 2011 19:08:09 -0700
+Subject: xhci: Fix bug in control transfer cancellation.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 3abeca998a44205cfd837fa0bf1f7c24f8294acb upstream.
+
+When the xHCI driver attempts to cancel a transfer, it issues a Stop
+Endpoint command and waits for the host controller to indicate which TRB
+it was in the middle of processing. The host will put an event TRB with
+completion code COMP_STOP on the event ring if it stops on a control
+transfer TRB (or other types of transfer TRBs). The ring handling code
+is supposed to set ep->stopped_trb to the TRB that the host stopped on
+when this happens.
+
+Unfortunately, there is a long-standing bug in the control transfer
+completion code. It doesn't actually check to see if COMP_STOP is set
+before attempting to process the transfer based on which part of the
+control TD completed. So when we get an event on the data phase of the
+control TRB with COMP_STOP set, it thinks it's a normal completion of
+the transfer and doesn't set ep->stopped_td or ep->stopped_trb.
+
+When the ring handling code goes on to process the completion of the Stop
+Endpoint command, it sees that ep->stopped_trb is not a part of the TD
+it's trying to cancel. It thinks the hardware has its enqueue pointer
+somewhere further up in the ring, and thinks it's safe to turn the control
+TRBs into no-op TRBs. Since the hardware was in the middle of the control
+TRBs to be cancelled, the proper software behavior is to issue a Set TR
+dequeue pointer command.
+
+It turns out that the NEC host controllers can handle active TRBs being
+set to no-op TRBs after a stop endpoint command, but other host
+controllers have issues with this out-of-spec software behavior. Fix this
+behavior.
+
+This patch should be backported to kernels as far back as 2.6.31, but it
+may be a bit challenging, since process_ctrl_td() was introduced in some
+refactoring done in 2.6.36, and some endian-safe patches added in 2.6.40
+that touch the same lines.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-ring.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1532,6 +1532,9 @@ static int process_ctrl_td(struct xhci_h
+ else
+ *status = 0;
+ break;
++ case COMP_STOP_INVAL:
++ case COMP_STOP:
++ return finish_td(xhci, td, event_trb, event, ep, status, false);
+ default:
+ if (!xhci_requires_manual_halt_cleanup(xhci,
+ ep_ctx, trb_comp_code))
+@@ -1576,15 +1579,12 @@ static int process_ctrl_td(struct xhci_h
+ }
+ } else {
+ /* Maybe the event was for the data stage? */
+- if (trb_comp_code != COMP_STOP_INVAL) {
+- /* We didn't stop on a link TRB in the middle */
+- td->urb->actual_length =
+- td->urb->transfer_buffer_length -
+- TRB_LEN(event->transfer_len);
+- xhci_dbg(xhci, "Waiting for status "
+- "stage event\n");
+- return 0;
+- }
++ td->urb->actual_length =
++ td->urb->transfer_buffer_length -
++ TRB_LEN(le32_to_cpu(event->transfer_len));
++ xhci_dbg(xhci, "Waiting for status "
++ "stage event\n");
++ return 0;
+ }
+ }
+
--- /dev/null
+From b513d44751bfb609a3c20463f764c8ce822d63e9 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Fri, 13 May 2011 13:10:01 -0700
+Subject: xhci: Fix full speed bInterval encoding.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit b513d44751bfb609a3c20463f764c8ce822d63e9 upstream.
+
+Dmitry's patch
+
+dfa49c4ad120a784ef1ff0717168aa79f55a483a USB: xhci - fix math in xhci_get_endpoint_interval()
+
+introduced a bug. The USB 2.0 spec says that full speed isochronous endpoints'
+bInterval must be decoded as an exponent to a power of two (e.g. interval =
+2^(bInterval - 1)). Full speed interrupt endpoints, on the other hand, don't
+use exponents, and the interval in frames is encoded straight into bInterval.
+
+Dmitry's patch was supposed to fix up the full speed isochronous to parse
+bInterval as an exponent, but instead it changed the *interrupt* endpoint
+bInterval decoding. The isochronous endpoint encoding was the same.
+
+This caused full speed devices with interrupt endpoints (including mice, hubs,
+and USB to ethernet devices) to fail under NEC 0.96 xHCI host controllers:
+
+[ 100.909818] xhci_hcd 0000:06:00.0: add ep 0x83, slot id 1, new drop flags = 0x0, new add flags = 0x99, new slot info = 0x38100000
+[ 100.909821] xhci_hcd 0000:06:00.0: xhci_check_bandwidth called for udev ffff88011f0ea000
+...
+[ 100.910187] xhci_hcd 0000:06:00.0: ERROR: unexpected command completion code 0x11.
+[ 100.910190] xhci_hcd 0000:06:00.0: xhci_reset_bandwidth called for udev ffff88011f0ea000
+
+When the interrupt endpoint was added and a Configure Endpoint command was
+issued to the host, the host controller would return a very odd error message
+(0x11 means "Slot Not Enabled", which isn't true because the slot was enabled).
+Probably the host controller was getting very confused with the bad encoding.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Cc: Dmitry Torokhov <dtor@vmware.com>
+Reported-by: Thomas Lindroth <thomas.lindroth@gmail.com>
+Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -992,12 +992,12 @@ static inline unsigned int xhci_get_endp
+ break;
+
+ case USB_SPEED_FULL:
+- if (usb_endpoint_xfer_int(&ep->desc)) {
++ if (usb_endpoint_xfer_isoc(&ep->desc)) {
+ interval = xhci_parse_exponent_interval(udev, ep);
+ break;
+ }
+ /*
+- * Fall through for isochronous endpoint interval decoding
++ * Fall through for interrupt endpoint interval decoding
+ * since it uses the same rules as low speed interrupt
+ * endpoints.
+ */
--- /dev/null
+From 834cb0fc4712a3b21c6b8c5cb55bd13607191311 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Thu, 12 May 2011 18:06:37 -0700
+Subject: xhci: Fix memory leak bug when dropping endpoints
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 834cb0fc4712a3b21c6b8c5cb55bd13607191311 upstream.
+
+When the USB core wants to change to an alternate interface setting that
+doesn't include an active endpoint, or de-configuring the device, the xHCI
+driver needs to issue a Configure Endpoint command to tell the host to
+drop some endpoints from the schedule. After the command completes, the
+xHCI driver needs to free rings for any endpoints that were dropped.
+
+Unfortunately, the xHCI driver wasn't actually freeing the endpoint rings
+for dropped endpoints. The rings would be freed if the endpoint's
+information was simply changed (and a new ring was installed), but dropped
+endpoints never had their rings freed. This caused errors when the ring
+segment DMA pool was freed when the xHCI driver was unloaded:
+
+[ 5582.883995] xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff88003371d000 busy
+[ 5582.884002] xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff880033716000 busy
+[ 5582.884011] xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff880033455000 busy
+[ 5582.884018] xhci_hcd 0000:06:00.0: Freed segment pool
+[ 5582.884026] xhci_hcd 0000:06:00.0: Freed device context pool
+[ 5582.884033] xhci_hcd 0000:06:00.0: Freed small stream array pool
+[ 5582.884038] xhci_hcd 0000:06:00.0: Freed medium stream array pool
+[ 5582.884048] xhci_hcd 0000:06:00.0: xhci_stop completed - status = 1
+[ 5582.884061] xhci_hcd 0000:06:00.0: USB bus 3 deregistered
+[ 5582.884193] xhci_hcd 0000:06:00.0: PCI INT A disabled
+
+Fix this issue and free endpoint rings when their endpoints are
+successfully dropped.
+
+This patch should be backported to kernels as old as 2.6.31.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1636,8 +1636,17 @@ int xhci_check_bandwidth(struct usb_hcd
+ xhci_dbg_ctx(xhci, virt_dev->out_ctx,
+ LAST_CTX_TO_EP_NUM(slot_ctx->dev_info));
+
++ /* Free any rings that were dropped, but not changed. */
++ for (i = 1; i < 31; ++i) {
++ if ((ctrl_ctx->drop_flags & (1 << (i + 1))) &&
++ !(ctrl_ctx->add_flags & (1 << (i + 1))))
++ xhci_free_or_cache_endpoint_ring(xhci, virt_dev, i);
++ }
+ xhci_zero_in_ctx(xhci, virt_dev);
+- /* Install new rings and free or cache any old rings */
++ /*
++ * Install any rings for completely new endpoints or changed endpoints,
++ * and free or cache any old rings from changed endpoints.
++ */
+ for (i = 1; i < 31; ++i) {
+ if (!virt_dev->eps[i].new_ring)
+ continue;
--- /dev/null
+From 30f89ca021c3e584b61bc5a14eede89f74b2e826 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Mon, 16 May 2011 13:09:08 -0700
+Subject: xhci: Fix memory leak in ring cache deallocation.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 30f89ca021c3e584b61bc5a14eede89f74b2e826 upstream.
+
+When an endpoint ring is freed, it is either cached in a per-device ring
+cache, or simply freed if the ring cache is full. If the ring was added
+to the cache, then virt_dev->num_rings_cached is incremented. The cache
+is designed to hold up to 31 endpoint rings, in array indexes 0 to 30.
+When the device is freed (when the slot was disabled),
+xhci_free_virt_device() is called, it would free the cached rings in
+array indexes 0 to virt_dev->num_rings_cached.
+
+Unfortunately, the original code in xhci_free_or_cache_endpoint_ring()
+would put the first entry into the ring cache in array index 1, instead of
+array index 0. This was caused by the second assignment to rings_cached:
+
+ rings_cached = virt_dev->num_rings_cached;
+ if (rings_cached < XHCI_MAX_RINGS_CACHED) {
+ virt_dev->num_rings_cached++;
+ rings_cached = virt_dev->num_rings_cached;
+ virt_dev->ring_cache[rings_cached] =
+ virt_dev->eps[ep_index].ring;
+
+This meant that when the device was freed, cached rings with indexes 0 to
+N would be freed, and the last cached ring in index N+1 would not be
+freed. When the driver was unloaded, this caused interesting messages
+like:
+
+xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff880063040000 busy
+
+This should be queued to stable kernels back to 2.6.33.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -207,14 +207,13 @@ void xhci_free_or_cache_endpoint_ring(st
+
+ rings_cached = virt_dev->num_rings_cached;
+ if (rings_cached < XHCI_MAX_RINGS_CACHED) {
+- virt_dev->num_rings_cached++;
+- rings_cached = virt_dev->num_rings_cached;
+ virt_dev->ring_cache[rings_cached] =
+ virt_dev->eps[ep_index].ring;
++ virt_dev->num_rings_cached++;
+ xhci_dbg(xhci, "Cached old ring, "
+ "%d ring%s cached\n",
+- rings_cached,
+- (rings_cached > 1) ? "s" : "");
++ virt_dev->num_rings_cached,
++ (virt_dev->num_rings_cached > 1) ? "s" : "");
+ } else {
+ xhci_ring_free(xhci, virt_dev->eps[ep_index].ring);
+ xhci_dbg(xhci, "Ring cache full (%d rings), "
projects / thirdparty / kernel / stable-queue.git / commitdiff
