From: Greg Kroah-Hartman Date: Mon, 5 Dec 2011 21:45:28 +0000 (-0800) Subject: 3.0 patches X-Git-Tag: v3.0.13~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=24f0d2683ad3873114874b8c86599b6a7b3f3a75;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0 patches added patches: drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch drm-radeon-kms-add-some-new-pci-ids.patch ehci-fix-a-regression-in-the-iso-scheduler.patch firmware-sigma-fix-endianess-issues.patch firmware-sigma-prevent-out-of-bounds-memory-access.patch firmware-sigma-skip-header-during-crc-generation.patch hid-correct-general-touch-pid.patch staging-comedi-fix-mmap_count.patch staging-comedi-fix-oops-for-usb-daq-devices.patch staging-comedi-fix-signal-handling-in-read-and-write.patch staging-usbip-bugfix-for-deadlock.patch usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch usb-option-add-huawei-e353-controlling-interfaces.patch usb-option-add-simcom-sim5218.patch usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch xhci-fix-bug-in-xhci_clear_command_ring.patch --- diff --git a/queue-3.0/drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch b/queue-3.0/drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch new file mode 100644 index 00000000000..b778e123d91 --- /dev/null +++ b/queue-3.0/drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch @@ -0,0 +1,119 @@ +From f64964796dedca340608fb1075ab6baad5625851 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 28 Nov 2011 14:49:26 -0500 +Subject: drm/radeon/kms: add some loop timeouts in pageflip code + +From: Alex Deucher + +commit f64964796dedca340608fb1075ab6baad5625851 upstream. + +Avoid infinite loops waiting for surface updates if a GPU +reset happens while waiting for a page flip. + +See: +https://bugs.freedesktop.org/show_bug.cgi?id=43191 + +Signed-off-by: Alex Deucher +Reviewed-by: Mario Kleiner +Tested-by: Simon Farnsworth +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/evergreen.c | 7 ++++++- + drivers/gpu/drm/radeon/r100.c | 7 ++++++- + drivers/gpu/drm/radeon/rs600.c | 7 ++++++- + drivers/gpu/drm/radeon/rv770.c | 7 ++++++- + 4 files changed, 24 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -82,6 +82,7 @@ u32 evergreen_page_flip(struct radeon_de + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset); ++ int i; + + /* Lock the graphics update lock */ + tmp |= EVERGREEN_GRPH_UPDATE_LOCK; +@@ -99,7 +100,11 @@ u32 evergreen_page_flip(struct radeon_de + (u32)crtc_base); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -84,13 +84,18 @@ u32 r100_page_flip(struct radeon_device + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = ((u32)crtc_base) | RADEON_CRTC_OFFSET__OFFSET_LOCK; ++ int i; + + /* Lock the graphics update lock */ + /* update the scanout addresses */ + WREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset, tmp); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -62,6 +62,7 @@ u32 rs600_page_flip(struct radeon_device + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset); ++ int i; + + /* Lock the graphics update lock */ + tmp |= AVIVO_D1GRPH_UPDATE_LOCK; +@@ -74,7 +75,11 @@ u32 rs600_page_flip(struct radeon_device + (u32)crtc_base); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -47,6 +47,7 @@ u32 rv770_page_flip(struct radeon_device + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset); ++ int i; + + /* Lock the graphics update lock */ + tmp |= AVIVO_D1GRPH_UPDATE_LOCK; +@@ -66,7 +67,11 @@ u32 rv770_page_flip(struct radeon_device + (u32)crtc_base); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ diff --git a/queue-3.0/drm-radeon-kms-add-some-new-pci-ids.patch b/queue-3.0/drm-radeon-kms-add-some-new-pci-ids.patch new file mode 100644 index 00000000000..de61c876e95 --- /dev/null +++ b/queue-3.0/drm-radeon-kms-add-some-new-pci-ids.patch @@ -0,0 +1,34 @@ +From 2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 1 Dec 2011 11:02:11 -0500 +Subject: drm/radeon/kms: add some new pci ids + +From: Alex Deucher + +commit 2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94 upstream. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -197,6 +197,14 @@ + {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6840, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6841, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6842, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6843, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6849, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6858, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6859, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6880, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6888, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6889, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \ diff --git a/queue-3.0/ehci-fix-a-regression-in-the-iso-scheduler.patch b/queue-3.0/ehci-fix-a-regression-in-the-iso-scheduler.patch new file mode 100644 index 00000000000..f99313da63b --- /dev/null +++ b/queue-3.0/ehci-fix-a-regression-in-the-iso-scheduler.patch @@ -0,0 +1,58 @@ +From e3420901eba65b1c46bed86d360e3a8685d20734 Mon Sep 17 00:00:00 2001 +From: Matthieu CASTET +Date: Mon, 28 Nov 2011 11:30:22 +0100 +Subject: EHCI : Fix a regression in the ISO scheduler + +From: Matthieu CASTET + +commit e3420901eba65b1c46bed86d360e3a8685d20734 upstream. + +Fix a regression that was introduced by commit +811c926c538f7e8d3c08b630dd5844efd7e000f6 (USB: EHCI: fix HUB TT scheduling +issue with iso transfer). + +We detect an error if next == start, but this means uframe 0 can't be allocated +anymore for iso transfer... + +Reported-by: Sander Eikelenboom +Signed-off-by: Matthieu CASTET +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1479,6 +1479,7 @@ iso_stream_schedule ( + * jump until after the queue is primed. + */ + else { ++ int done = 0; + start = SCHEDULE_SLOP + (now & ~0x07); + + /* NOTE: assumes URB_ISO_ASAP, to limit complexity/bugs */ +@@ -1496,18 +1497,18 @@ iso_stream_schedule ( + if (stream->highspeed) { + if (itd_slot_ok(ehci, mod, start, + stream->usecs, period)) +- break; ++ done = 1; + } else { + if ((start % 8) >= 6) + continue; + if (sitd_slot_ok(ehci, mod, stream, + start, sched, period)) +- break; ++ done = 1; + } +- } while (start > next); ++ } while (start > next && !done); + + /* no room in the schedule */ +- if (start == next) { ++ if (!done) { + ehci_dbg(ehci, "iso resched full %p (now %d max %d)\n", + urb, now, now + mod); + status = -ENOSPC; diff --git a/queue-3.0/firmware-sigma-fix-endianess-issues.patch b/queue-3.0/firmware-sigma-fix-endianess-issues.patch new file mode 100644 index 00000000000..4265a11b649 --- /dev/null +++ b/queue-3.0/firmware-sigma-fix-endianess-issues.patch @@ -0,0 +1,62 @@ +From bda63586bc5929e97288cdb371bb6456504867ed Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 28 Nov 2011 09:44:16 +0100 +Subject: firmware: Sigma: Fix endianess issues + +From: Lars-Peter Clausen + +commit bda63586bc5929e97288cdb371bb6456504867ed upstream. + +Currently the SigmaDSP firmware loader only works correctly on little-endian +systems. Fix this by using the proper endianess conversion functions. + +Signed-off-by: Lars-Peter Clausen +Acked-by: Mike Frysinger +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/sigma.c | 2 +- + include/linux/sigma.h | 8 ++++---- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/firmware/sigma.c ++++ b/drivers/firmware/sigma.c +@@ -133,7 +133,7 @@ int process_sigma_firmware(struct i2c_cl + crc = crc32(0, fw->data + sizeof(*ssfw_head), + fw->size - sizeof(*ssfw_head)); + pr_debug("%s: crc=%x\n", __func__, crc); +- if (crc != ssfw_head->crc) ++ if (crc != le32_to_cpu(ssfw_head->crc)) + goto done; + + ssfw.pos = sizeof(*ssfw_head); +--- a/include/linux/sigma.h ++++ b/include/linux/sigma.h +@@ -24,7 +24,7 @@ struct sigma_firmware { + struct sigma_firmware_header { + unsigned char magic[7]; + u8 version; +- u32 crc; ++ __le32 crc; + }; + + enum { +@@ -40,14 +40,14 @@ enum { + struct sigma_action { + u8 instr; + u8 len_hi; +- u16 len; +- u16 addr; ++ __le16 len; ++ __be16 addr; + unsigned char payload[]; + }; + + static inline u32 sigma_action_len(struct sigma_action *sa) + { +- return (sa->len_hi << 16) | sa->len; ++ return (sa->len_hi << 16) | le16_to_cpu(sa->len); + } + + extern int process_sigma_firmware(struct i2c_client *client, const char *name); diff --git a/queue-3.0/firmware-sigma-prevent-out-of-bounds-memory-access.patch b/queue-3.0/firmware-sigma-prevent-out-of-bounds-memory-access.patch new file mode 100644 index 00000000000..828afe2195a --- /dev/null +++ b/queue-3.0/firmware-sigma-prevent-out-of-bounds-memory-access.patch @@ -0,0 +1,164 @@ +From 4f718a29fe4908c2cea782f751e9805319684e2b Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 28 Nov 2011 09:44:14 +0100 +Subject: firmware: Sigma: Prevent out of bounds memory access + +From: Lars-Peter Clausen + +commit 4f718a29fe4908c2cea782f751e9805319684e2b upstream. + +The SigmaDSP firmware loader currently does not perform enough boundary size +checks when processing the firmware. As a result it is possible that a +malformed firmware can cause an out of bounds memory access. + +This patch adds checks which ensure that both the action header and the payload +are completely inside the firmware data boundaries before processing them. + +Signed-off-by: Lars-Peter Clausen +Acked-by: Mike Frysinger +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/sigma.c | 76 ++++++++++++++++++++++++++++++++++------------- + include/linux/sigma.h | 5 --- + 2 files changed, 55 insertions(+), 26 deletions(-) + +--- a/drivers/firmware/sigma.c ++++ b/drivers/firmware/sigma.c +@@ -14,13 +14,34 @@ + #include + #include + +-/* Return: 0==OK, <0==error, =1 ==no more actions */ ++static size_t sigma_action_size(struct sigma_action *sa) ++{ ++ size_t payload = 0; ++ ++ switch (sa->instr) { ++ case SIGMA_ACTION_WRITEXBYTES: ++ case SIGMA_ACTION_WRITESINGLE: ++ case SIGMA_ACTION_WRITESAFELOAD: ++ payload = sigma_action_len(sa); ++ break; ++ default: ++ break; ++ } ++ ++ payload = ALIGN(payload, 2); ++ ++ return payload + sizeof(struct sigma_action); ++} ++ ++/* ++ * Returns a negative error value in case of an error, 0 if processing of ++ * the firmware should be stopped after this action, 1 otherwise. ++ */ + static int +-process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw) ++process_sigma_action(struct i2c_client *client, struct sigma_action *sa) + { +- struct sigma_action *sa = (void *)(ssfw->fw->data + ssfw->pos); + size_t len = sigma_action_len(sa); +- int ret = 0; ++ int ret; + + pr_debug("%s: instr:%i addr:%#x len:%zu\n", __func__, + sa->instr, sa->addr, len); +@@ -29,44 +50,50 @@ process_sigma_action(struct i2c_client * + case SIGMA_ACTION_WRITEXBYTES: + case SIGMA_ACTION_WRITESINGLE: + case SIGMA_ACTION_WRITESAFELOAD: +- if (ssfw->fw->size < ssfw->pos + len) +- return -EINVAL; + ret = i2c_master_send(client, (void *)&sa->addr, len); + if (ret < 0) + return -EINVAL; + break; +- + case SIGMA_ACTION_DELAY: +- ret = 0; + udelay(len); + len = 0; + break; +- + case SIGMA_ACTION_END: +- return 1; +- ++ return 0; + default: + return -EINVAL; + } + +- /* when arrive here ret=0 or sent data */ +- ssfw->pos += sigma_action_size(sa, len); +- return ssfw->pos == ssfw->fw->size; ++ return 1; + } + + static int + process_sigma_actions(struct i2c_client *client, struct sigma_firmware *ssfw) + { +- pr_debug("%s: processing %p\n", __func__, ssfw); ++ struct sigma_action *sa; ++ size_t size; ++ int ret; ++ ++ while (ssfw->pos + sizeof(*sa) <= ssfw->fw->size) { ++ sa = (struct sigma_action *)(ssfw->fw->data + ssfw->pos); ++ ++ size = sigma_action_size(sa); ++ ssfw->pos += size; ++ if (ssfw->pos > ssfw->fw->size || size == 0) ++ break; ++ ++ ret = process_sigma_action(client, sa); + +- while (1) { +- int ret = process_sigma_action(client, ssfw); + pr_debug("%s: action returned %i\n", __func__, ret); +- if (ret == 1) +- return 0; +- else if (ret) ++ ++ if (ret <= 0) + return ret; + } ++ ++ if (ssfw->pos != ssfw->fw->size) ++ return -EINVAL; ++ ++ return 0; + } + + int process_sigma_firmware(struct i2c_client *client, const char *name) +@@ -89,7 +116,14 @@ int process_sigma_firmware(struct i2c_cl + + /* then verify the header */ + ret = -EINVAL; +- if (fw->size < sizeof(*ssfw_head)) ++ ++ /* ++ * Reject too small or unreasonable large files. The upper limit has been ++ * chosen a bit arbitrarily, but it should be enough for all practical ++ * purposes and having the limit makes it easier to avoid integer ++ * overflows later in the loading process. ++ */ ++ if (fw->size < sizeof(*ssfw_head) || fw->size >= 0x4000000) + goto done; + + ssfw_head = (void *)fw->data; +--- a/include/linux/sigma.h ++++ b/include/linux/sigma.h +@@ -50,11 +50,6 @@ static inline u32 sigma_action_len(struc + return (sa->len_hi << 16) | sa->len; + } + +-static inline size_t sigma_action_size(struct sigma_action *sa, u32 payload_len) +-{ +- return sizeof(*sa) + payload_len + (payload_len % 2); +-} +- + extern int process_sigma_firmware(struct i2c_client *client, const char *name); + + #endif diff --git a/queue-3.0/firmware-sigma-skip-header-during-crc-generation.patch b/queue-3.0/firmware-sigma-skip-header-during-crc-generation.patch new file mode 100644 index 00000000000..9de5e54f973 --- /dev/null +++ b/queue-3.0/firmware-sigma-skip-header-during-crc-generation.patch @@ -0,0 +1,33 @@ +From c56935bdc0a8edf50237d3b0205133a5b0adc604 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 28 Nov 2011 09:44:15 +0100 +Subject: firmware: Sigma: Skip header during CRC generation + +From: Lars-Peter Clausen + +commit c56935bdc0a8edf50237d3b0205133a5b0adc604 upstream. + +The firmware header is not part of the CRC, so skip it. Otherwise the firmware +will be rejected due to non-matching CRCs. + +Signed-off-by: Lars-Peter Clausen +Acked-by: Mike Frysinger +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/sigma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/firmware/sigma.c ++++ b/drivers/firmware/sigma.c +@@ -130,7 +130,8 @@ int process_sigma_firmware(struct i2c_cl + if (memcmp(ssfw_head->magic, SIGMA_MAGIC, ARRAY_SIZE(ssfw_head->magic))) + goto done; + +- crc = crc32(0, fw->data, fw->size); ++ crc = crc32(0, fw->data + sizeof(*ssfw_head), ++ fw->size - sizeof(*ssfw_head)); + pr_debug("%s: crc=%x\n", __func__, crc); + if (crc != ssfw_head->crc) + goto done; diff --git a/queue-3.0/hid-correct-general-touch-pid.patch b/queue-3.0/hid-correct-general-touch-pid.patch new file mode 100644 index 00000000000..f7aae199ada --- /dev/null +++ b/queue-3.0/hid-correct-general-touch-pid.patch @@ -0,0 +1,49 @@ +From b1807719f6acdf18cc4bde3b5400d05d77801494 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Wed, 16 Nov 2011 11:39:52 +0100 +Subject: HID: Correct General touch PID + +From: Benjamin Tissoires + +commit b1807719f6acdf18cc4bde3b5400d05d77801494 upstream. + +Genera Touch told us that 0001 is their single point device +and 0003 is the multitouch one. Apparently, we made the tests +someone having a prototype, and not the final product. +They said it should be safe to do the switch. + +This partially reverts 5572da0 ("HID: hid-mulitouch: add support +for the 'Sensing Win7-TwoFinger'"). + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 2 +- + drivers/hid/hid-ids.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1721,8 +1721,8 @@ static const struct hid_device_id hid_ig + { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0001) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0002) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0003) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0004) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_4_PHIDGETSERVO_30) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_1_PHIDGETSERVO_30) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -266,7 +266,7 @@ + #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002 + + #define USB_VENDOR_ID_GENERAL_TOUCH 0x0dfc +-#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0001 ++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003 + + #define USB_VENDOR_ID_GLAB 0x06c2 + #define USB_DEVICE_ID_4_PHIDGETSERVO_30 0x0038 diff --git a/queue-3.0/series b/queue-3.0/series index 1c81b5c1922..1613c5a69ba 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -37,3 +37,21 @@ hwmon-coretemp-fix-oops-on-driver-load.patch revert-mfd-fix-twl4030-dependencies-for-audio-codec.patch scsi-silencing-killing-requests-for-dead-queue.patch hugetlb-release-pages-in-the-error-path-of-hugetlb_cow.patch +drm-radeon-kms-add-some-new-pci-ids.patch +drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch +firmware-sigma-prevent-out-of-bounds-memory-access.patch +firmware-sigma-skip-header-during-crc-generation.patch +firmware-sigma-fix-endianess-issues.patch +staging-usbip-bugfix-for-deadlock.patch +staging-comedi-fix-oops-for-usb-daq-devices.patch +staging-comedi-fix-mmap_count.patch +staging-comedi-fix-signal-handling-in-read-and-write.patch +usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch +hid-correct-general-touch-pid.patch +usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch +usb-option-add-huawei-e353-controlling-interfaces.patch +usb-option-add-simcom-sim5218.patch +usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch +usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch +ehci-fix-a-regression-in-the-iso-scheduler.patch +xhci-fix-bug-in-xhci_clear_command_ring.patch diff --git a/queue-3.0/staging-comedi-fix-mmap_count.patch b/queue-3.0/staging-comedi-fix-mmap_count.patch new file mode 100644 index 00000000000..0d74a847826 --- /dev/null +++ b/queue-3.0/staging-comedi-fix-mmap_count.patch @@ -0,0 +1,63 @@ +From df30b21cb0eed5ba8a8e0cdfeebc66ba8cde821d Mon Sep 17 00:00:00 2001 +From: Federico Vaga +Date: Sat, 29 Oct 2011 09:45:39 +0200 +Subject: Staging: comedi: fix mmap_count + +From: Federico Vaga + +commit df30b21cb0eed5ba8a8e0cdfeebc66ba8cde821d upstream. + +In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but +it is not incremented at comedi_vm_ops->open. This may result in a negative +counter. The patch introduces the open method to keep the counter +consistent. + +The bug was triggerd by this sample code: + + mmap(0, ...., comedi_fd); + fork(); + exit(0); + +Acked-by: Alessandro Rubini +Signed-off-by: Federico Vaga +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1432,7 +1432,21 @@ static int do_cancel(struct comedi_devic + return ret; + } + +-static void comedi_unmap(struct vm_area_struct *area) ++ ++static void comedi_vm_open(struct vm_area_struct *area) ++{ ++ struct comedi_async *async; ++ struct comedi_device *dev; ++ ++ async = area->vm_private_data; ++ dev = async->subdevice->device; ++ ++ mutex_lock(&dev->mutex); ++ async->mmap_count++; ++ mutex_unlock(&dev->mutex); ++} ++ ++static void comedi_vm_close(struct vm_area_struct *area) + { + struct comedi_async *async; + struct comedi_device *dev; +@@ -1446,7 +1460,8 @@ static void comedi_unmap(struct vm_area_ + } + + static struct vm_operations_struct comedi_vm_ops = { +- .close = comedi_unmap, ++ .open = comedi_vm_open, ++ .close = comedi_vm_close, + }; + + static int comedi_mmap(struct file *file, struct vm_area_struct *vma) diff --git a/queue-3.0/staging-comedi-fix-oops-for-usb-daq-devices.patch b/queue-3.0/staging-comedi-fix-oops-for-usb-daq-devices.patch new file mode 100644 index 00000000000..e2675de9cc3 --- /dev/null +++ b/queue-3.0/staging-comedi-fix-oops-for-usb-daq-devices.patch @@ -0,0 +1,147 @@ +From 3ffab428f40849ed5f21bcfd7285bdef7902f9ca Mon Sep 17 00:00:00 2001 +From: Bernd Porr +Date: Tue, 8 Nov 2011 21:23:03 +0000 +Subject: staging: comedi: fix oops for USB DAQ devices. + +From: Bernd Porr + +commit 3ffab428f40849ed5f21bcfd7285bdef7902f9ca upstream. + +This fixes kernel oops when an USB DAQ device is plugged out while it's +communicating with the userspace software. + +Signed-off-by: Bernd Porr +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 73 +++++++++++++++++++++++++---------- + 1 file changed, 54 insertions(+), 19 deletions(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1452,9 +1452,6 @@ static struct vm_operations_struct comed + static int comedi_mmap(struct file *file, struct vm_area_struct *vma) + { + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; + struct comedi_async *async = NULL; + unsigned long start = vma->vm_start; + unsigned long size; +@@ -1462,6 +1459,15 @@ static int comedi_mmap(struct file *file + int i; + int retval; + struct comedi_subdevice *s; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ ++ dev_file_info = comedi_get_device_file_info(minor); ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + mutex_lock(&dev->mutex); + if (!dev->attached) { +@@ -1528,11 +1534,17 @@ static unsigned int comedi_poll(struct f + { + unsigned int mask = 0; + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; + struct comedi_subdevice *read_subdev; + struct comedi_subdevice *write_subdev; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + mutex_lock(&dev->mutex); + if (!dev->attached) { +@@ -1578,9 +1590,15 @@ static ssize_t comedi_write(struct file + int n, m, count = 0, retval = 0; + DECLARE_WAITQUEUE(wait, current); + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + if (!dev->attached) { + DPRINTK("no driver configured on comedi%i\n", dev->minor); +@@ -1683,9 +1701,15 @@ static ssize_t comedi_read(struct file * + int n, m, count = 0, retval = 0; + DECLARE_WAITQUEUE(wait, current); + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + if (!dev->attached) { + DPRINTK("no driver configured on comedi%i\n", dev->minor); +@@ -1885,11 +1909,17 @@ ok: + static int comedi_close(struct inode *inode, struct file *file) + { + const unsigned minor = iminor(inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; + struct comedi_subdevice *s = NULL; + int i; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + mutex_lock(&dev->mutex); + +@@ -1923,10 +1953,15 @@ static int comedi_close(struct inode *in + static int comedi_fasync(int fd, struct file *file, int on) + { + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- +- struct comedi_device *dev = dev_file_info->device; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + return fasync_helper(fd, file, on, &dev->async_queue); + } diff --git a/queue-3.0/staging-comedi-fix-signal-handling-in-read-and-write.patch b/queue-3.0/staging-comedi-fix-signal-handling-in-read-and-write.patch new file mode 100644 index 00000000000..53b6cabe83a --- /dev/null +++ b/queue-3.0/staging-comedi-fix-signal-handling-in-read-and-write.patch @@ -0,0 +1,48 @@ +From 6a9ce6b654e491981f6ef7e214cbd4f63e033848 Mon Sep 17 00:00:00 2001 +From: Federico Vaga +Date: Sat, 29 Oct 2011 09:47:39 +0200 +Subject: Staging: comedi: fix signal handling in read and write + +From: Federico Vaga + +commit 6a9ce6b654e491981f6ef7e214cbd4f63e033848 upstream. + +After sleeping on a wait queue, signal_pending(current) should be +checked (not before sleeping). + +Acked-by: Alessandro Rubini +Signed-off-by: Federico Vaga +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1673,11 +1673,11 @@ static ssize_t comedi_write(struct file + retval = -EAGAIN; + break; + } ++ schedule(); + if (signal_pending(current)) { + retval = -ERESTARTSYS; + break; + } +- schedule(); + if (!s->busy) + break; + if (s->busy != file) { +@@ -1780,11 +1780,11 @@ static ssize_t comedi_read(struct file * + retval = -EAGAIN; + break; + } ++ schedule(); + if (signal_pending(current)) { + retval = -ERESTARTSYS; + break; + } +- schedule(); + if (!s->busy) { + retval = 0; + break; diff --git a/queue-3.0/staging-usbip-bugfix-for-deadlock.patch b/queue-3.0/staging-usbip-bugfix-for-deadlock.patch new file mode 100644 index 00000000000..2f79c0468f2 --- /dev/null +++ b/queue-3.0/staging-usbip-bugfix-for-deadlock.patch @@ -0,0 +1,63 @@ +From 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 Mon Sep 17 00:00:00 2001 +From: Bart Westgeest +Date: Tue, 1 Nov 2011 15:01:28 -0400 +Subject: staging: usbip: bugfix for deadlock + +From: Bart Westgeest + +commit 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 upstream. + +Interrupts must be disabled prior to calling usb_hcd_unlink_urb_from_ep. +If interrupts are not disabled, it can potentially lead to a deadlock. +The deadlock is readily reproduceable on a slower (ARM based) device +such as the TI Pandaboard. + +Signed-off-by: Bart Westgeest +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/usbip/vhci_rx.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/staging/usbip/vhci_rx.c ++++ b/drivers/staging/usbip/vhci_rx.c +@@ -68,6 +68,7 @@ static void vhci_recv_ret_submit(struct + { + struct usbip_device *ud = &vdev->ud; + struct urb *urb; ++ unsigned long flags; + + spin_lock(&vdev->priv_lock); + urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum); +@@ -101,9 +102,9 @@ static void vhci_recv_ret_submit(struct + + usbip_dbg_vhci_rx("now giveback urb %p\n", urb); + +- spin_lock(&the_controller->lock); ++ spin_lock_irqsave(&the_controller->lock, flags); + usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb); +- spin_unlock(&the_controller->lock); ++ spin_unlock_irqrestore(&the_controller->lock, flags); + + usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status); + +@@ -141,6 +142,7 @@ static void vhci_recv_ret_unlink(struct + { + struct vhci_unlink *unlink; + struct urb *urb; ++ unsigned long flags; + + usbip_dump_header(pdu); + +@@ -170,9 +172,9 @@ static void vhci_recv_ret_unlink(struct + urb->status = pdu->u.ret_unlink.status; + pr_info("urb->status %d\n", urb->status); + +- spin_lock(&the_controller->lock); ++ spin_lock_irqsave(&the_controller->lock, flags); + usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb); +- spin_unlock(&the_controller->lock); ++ spin_unlock_irqrestore(&the_controller->lock, flags); + + usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, + urb->status); diff --git a/queue-3.0/usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch b/queue-3.0/usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch new file mode 100644 index 00000000000..bef61b82c44 --- /dev/null +++ b/queue-3.0/usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch @@ -0,0 +1,104 @@ +From 811c926c538f7e8d3c08b630dd5844efd7e000f6 Mon Sep 17 00:00:00 2001 +From: Thomas Poussevin +Date: Thu, 27 Oct 2011 18:46:48 +0200 +Subject: USB: EHCI: fix HUB TT scheduling issue with iso transfer + +From: Thomas Poussevin + +commit 811c926c538f7e8d3c08b630dd5844efd7e000f6 upstream. + +The current TT scheduling doesn't allow to play and then record on a +full-speed device connected to a high speed hub. + +The IN iso stream can only start on the first uframe (0-2 for a 165 us) +because of CSPLIT transactions. +For the OUT iso stream there no such restriction. uframe 0-5 are possible. + +The idea of this patch is that the first uframe are precious (for IN TT iso +stream) and we should allocate the last uframes first if possible. + +For that we reverse the order of uframe allocation (last uframe first). + +Here an example : + +hid interrupt stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | +---------------------------------------------------------------------- + +iso OUT stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 125 | 39 | 0 | 0 | 0 | 0 | 0 | +---------------------------------------------------------------------- + +There no place for iso IN stream (uframe 0-2 are used) and we got "cannot +submit datapipe for urb 0, error -28: not enough bandwidth" error. + +With the patch this become. + +iso OUT stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 0 | 0 | 0 | 125 | 39 | 0 | 0 | +---------------------------------------------------------------------- + +iso IN stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 0 | 125 | 40 | 125 | 39 | 0 | 0 | +---------------------------------------------------------------------- + +Signed-off-by: Matthieu Castet +Signed-off-by: Thomas Poussevin +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1483,10 +1483,15 @@ iso_stream_schedule ( + + /* NOTE: assumes URB_ISO_ASAP, to limit complexity/bugs */ + +- /* find a uframe slot with enough bandwidth */ +- next = start + period; +- for (; start < next; start++) { +- ++ /* find a uframe slot with enough bandwidth. ++ * Early uframes are more precious because full-speed ++ * iso IN transfers can't use late uframes, ++ * and therefore they should be allocated last. ++ */ ++ next = start; ++ start += period; ++ do { ++ start--; + /* check schedule: enough space? */ + if (stream->highspeed) { + if (itd_slot_ok(ehci, mod, start, +@@ -1499,7 +1504,7 @@ iso_stream_schedule ( + start, sched, period)) + break; + } +- } ++ } while (start > next); + + /* no room in the schedule */ + if (start == next) { diff --git a/queue-3.0/usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch b/queue-3.0/usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch new file mode 100644 index 00000000000..e89add651a9 --- /dev/null +++ b/queue-3.0/usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch @@ -0,0 +1,40 @@ +From 307369b0ca06b27b511b61714e335ddfccf19c4f Mon Sep 17 00:00:00 2001 +From: Marcin Kościelnicki +Date: Wed, 30 Nov 2011 17:01:04 +0100 +Subject: usb: ftdi_sio: add PID for Propox ISPcable III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marcin Kościelnicki + +commit 307369b0ca06b27b511b61714e335ddfccf19c4f upstream. + +Signed-off-by: Marcin Kościelnicki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -735,6 +735,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -112,6 +112,7 @@ + + /* Propox devices */ + #define FTDI_PROPOX_JTAGCABLEII_PID 0xD738 ++#define FTDI_PROPOX_ISPCABLEIII_PID 0xD739 + + /* Lenz LI-USB Computer Interface. */ + #define FTDI_LENZ_LIUSB_PID 0xD780 diff --git a/queue-3.0/usb-option-add-huawei-e353-controlling-interfaces.patch b/queue-3.0/usb-option-add-huawei-e353-controlling-interfaces.patch new file mode 100644 index 00000000000..4de10d169b6 --- /dev/null +++ b/queue-3.0/usb-option-add-huawei-e353-controlling-interfaces.patch @@ -0,0 +1,31 @@ +From 46b1848360c8e634e0b063932a1261062fa0f7d6 Mon Sep 17 00:00:00 2001 +From: Dirk Nehring +Date: Thu, 24 Nov 2011 19:22:23 +0100 +Subject: usb: option: add Huawei E353 controlling interfaces + +From: Dirk Nehring + +commit 46b1848360c8e634e0b063932a1261062fa0f7d6 upstream. + +This patch creates the missing controlling devices for the Huawei E353 +HSPA+ stick. + +Signed-off-by: Dirk Nehring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -657,6 +657,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x02) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x03) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x08) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) }, diff --git a/queue-3.0/usb-option-add-simcom-sim5218.patch b/queue-3.0/usb-option-add-simcom-sim5218.patch new file mode 100644 index 00000000000..447d1eab3b2 --- /dev/null +++ b/queue-3.0/usb-option-add-simcom-sim5218.patch @@ -0,0 +1,28 @@ +From ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 Mon Sep 17 00:00:00 2001 +From: Veli-Pekka Peltola +Date: Thu, 24 Nov 2011 22:08:56 +0200 +Subject: usb: option: add SIMCom SIM5218 + +From: Veli-Pekka Peltola + +commit ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 upstream. + +Tested with SIM5218EVB-KIT evaluation kit. + +Signed-off-by: Veli-Pekka Peltola +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -746,6 +746,7 @@ static const struct usb_device_id option + { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */ + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) }, diff --git a/queue-3.0/usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch b/queue-3.0/usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch new file mode 100644 index 00000000000..3ae39c24d30 --- /dev/null +++ b/queue-3.0/usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch @@ -0,0 +1,35 @@ +From cec28a5428793b6bc64e56687fb239759d6da74e Mon Sep 17 00:00:00 2001 +From: Qinglin Ye +Date: Wed, 23 Nov 2011 23:39:32 +0800 +Subject: USB: usb-storage: unusual_devs entry for Kingston DT 101 G2 + +From: Qinglin Ye + +commit cec28a5428793b6bc64e56687fb239759d6da74e upstream. + +Kingston DT 101 G2 replies a wrong tag while transporting, add an +unusal_devs entry to ignore the tag validation. + +Signed-off-by: Qinglin Ye +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1854,6 +1854,13 @@ UNUSUAL_DEV( 0x1370, 0x6828, 0x0110, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE ), + ++/* Reported by Qinglin Ye */ ++UNUSUAL_DEV( 0x13fe, 0x3600, 0x0100, 0x0100, ++ "Kingston", ++ "DT 101 G2", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BULK_IGNORE_TAG ), ++ + /* Reported by Francesco Foresti */ + UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201, + "Super Top", diff --git a/queue-3.0/usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch b/queue-3.0/usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch new file mode 100644 index 00000000000..c999f46add1 --- /dev/null +++ b/queue-3.0/usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch @@ -0,0 +1,30 @@ +From 8746c83d538cab273d335acb2be226d096f4a5af Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 22 Nov 2011 10:28:31 +0300 +Subject: USB: whci-hcd: fix endian conversion in qset_clear() + +From: Dan Carpenter + +commit 8746c83d538cab273d335acb2be226d096f4a5af upstream. + +qset->qh.link is an __le64 field and we should be using cpu_to_le64() +to fill it. + +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/whci/qset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/whci/qset.c ++++ b/drivers/usb/host/whci/qset.c +@@ -124,7 +124,7 @@ void qset_clear(struct whc *whc, struct + { + qset->td_start = qset->td_end = qset->ntds = 0; + +- qset->qh.link = cpu_to_le32(QH_LINK_NTDS(8) | QH_LINK_T); ++ qset->qh.link = cpu_to_le64(QH_LINK_NTDS(8) | QH_LINK_T); + qset->qh.status = qset->qh.status & QH_STATUS_SEQ_MASK; + qset->qh.err_count = 0; + qset->qh.scratch[0] = 0; diff --git a/queue-3.0/xhci-fix-bug-in-xhci_clear_command_ring.patch b/queue-3.0/xhci-fix-bug-in-xhci_clear_command_ring.patch new file mode 100644 index 00000000000..fc8caf7b524 --- /dev/null +++ b/queue-3.0/xhci-fix-bug-in-xhci_clear_command_ring.patch @@ -0,0 +1,44 @@ +From 158886cd2cf4599e04f9b7e10cb767f5f39b14f1 Mon Sep 17 00:00:00 2001 +From: Andiry Xu +Date: Wed, 30 Nov 2011 16:37:41 +0800 +Subject: xHCI: fix bug in xhci_clear_command_ring() + +From: Andiry Xu + +commit 158886cd2cf4599e04f9b7e10cb767f5f39b14f1 upstream. + +When system enters suspend, xHCI driver clears command ring by writing zero +to all the TRBs. However, this also writes zero to the Link TRB, and the ring +is mangled. This may cause driver accesses wrong memory address and the +result is unpredicted. + +When clear the command ring, keep the last Link TRB intact, only clear its +cycle bit. This should fix the "command ring full" issue reported by Oliver +Neukum. + +This should be backported to stable kernels as old as 2.6.37, since the +commit 89821320 "xhci: Fix command ring replay after resume" is merged. + +Signed-off-by: Andiry Xu +Signed-off-by: Sarah Sharp +Reported-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -657,7 +657,10 @@ static void xhci_clear_command_ring(stru + ring = xhci->cmd_ring; + seg = ring->deq_seg; + do { +- memset(seg->trbs, 0, SEGMENT_SIZE); ++ memset(seg->trbs, 0, ++ sizeof(union xhci_trb) * (TRBS_PER_SEGMENT - 1)); ++ seg->trbs[TRBS_PER_SEGMENT - 1].link.control &= ++ cpu_to_le32(~TRB_CYCLE); + seg = seg->next; + } while (seg != ring->deq_seg); +