From: Greg Kroah-Hartman Date: Mon, 5 Dec 2011 21:45:11 +0000 (-0800) Subject: 3.1 patches X-Git-Tag: v3.0.13~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7c5984653b371b840bd18aabc8730c85058e0c87;p=thirdparty%2Fkernel%2Fstable-queue.git 3.1 patches added patches: alsa-hda-fix-s3-s4-problem-on-machines-with-vref-pin-mute-led.patch asoc-fix-wrong-define-for-ad1836_adc_word_offset.patch drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch drm-radeon-kms-add-some-new-pci-ids.patch ehci-fix-a-regression-in-the-iso-scheduler.patch firmware-sigma-fix-endianess-issues.patch firmware-sigma-prevent-out-of-bounds-memory-access.patch firmware-sigma-skip-header-during-crc-generation.patch hid-correct-general-touch-pid.patch ib-fix-rcu-lockdep-splats.patch staging-comedi-fix-mmap_count.patch staging-comedi-fix-oops-for-usb-daq-devices.patch staging-comedi-fix-signal-handling-in-read-and-write.patch staging-rts_pstor-complete-scanning_done-variable.patch staging-usbip-bugfix-for-deadlock.patch usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch usb-musb-pm-fix-context-save-restore-in-suspend-resume-path.patch usb-option-add-huawei-e353-controlling-interfaces.patch usb-option-add-simcom-sim5218.patch usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch xhci-fix-bug-in-xhci_clear_command_ring.patch --- diff --git a/queue-3.1/alsa-hda-fix-s3-s4-problem-on-machines-with-vref-pin-mute-led.patch b/queue-3.1/alsa-hda-fix-s3-s4-problem-on-machines-with-vref-pin-mute-led.patch new file mode 100644 index 00000000000..2c6d31ec3c2 --- /dev/null +++ b/queue-3.1/alsa-hda-fix-s3-s4-problem-on-machines-with-vref-pin-mute-led.patch @@ -0,0 +1,65 @@ +From 88d686027bb43f585914c77dd363f6e817b42c2a Mon Sep 17 00:00:00 2001 +From: Charles Chin +Date: Thu, 1 Dec 2011 11:21:00 +0100 +Subject: ALSA: hda - Fix S3/S4 problem on machines with VREF-pin mute-LED + +From: Charles Chin + +commit 88d686027bb43f585914c77dd363f6e817b42c2a upstream. + +The verb command in stac92xx_post_suspend caused the audio to stop +working after resuming from S3 mode on HP laptops with the VREF-pin +mute-LED control. Removing relevant post_suspend registering. + +Although removing D3 on AFG is no optimal solution, the impact should +be small in comparison with the broken S3/S4. + +Signed-off-by: Charles Chin +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -5035,20 +5035,6 @@ static int stac92xx_pre_resume(struct hd + return 0; + } + +-static int stac92xx_post_suspend(struct hda_codec *codec) +-{ +- struct sigmatel_spec *spec = codec->spec; +- if (spec->gpio_led > 8) { +- /* with vref-out pin used for mute led control +- * codec AFG is prevented from D3 state, but on +- * system suspend it can (and should) be used +- */ +- snd_hda_codec_read(codec, codec->afg, 0, +- AC_VERB_SET_POWER_STATE, AC_PWRST_D3); +- } +- return 0; +-} +- + static void stac92xx_set_power_state(struct hda_codec *codec, hda_nid_t fg, + unsigned int power_state) + { +@@ -5655,8 +5641,6 @@ again: + } else { + codec->patch_ops.set_power_state = + stac92xx_set_power_state; +- codec->patch_ops.post_suspend = +- stac92xx_post_suspend; + } + codec->patch_ops.pre_resume = stac92xx_pre_resume; + codec->patch_ops.check_power_status = +@@ -5978,8 +5962,6 @@ again: + } else { + codec->patch_ops.set_power_state = + stac92xx_set_power_state; +- codec->patch_ops.post_suspend = +- stac92xx_post_suspend; + } + codec->patch_ops.pre_resume = stac92xx_pre_resume; + codec->patch_ops.check_power_status = diff --git a/queue-3.1/asoc-fix-wrong-define-for-ad1836_adc_word_offset.patch b/queue-3.1/asoc-fix-wrong-define-for-ad1836_adc_word_offset.patch new file mode 100644 index 00000000000..ad8431af4e0 --- /dev/null +++ b/queue-3.1/asoc-fix-wrong-define-for-ad1836_adc_word_offset.patch @@ -0,0 +1,38 @@ +From 72531c9434fa884d20cb3c36fcec83752f32fdf4 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Tue, 22 Nov 2011 09:46:51 +0800 +Subject: ASoC: Fix wrong define for AD1836_ADC_WORD_OFFSET + +From: Axel Lin + +commit 72531c9434fa884d20cb3c36fcec83752f32fdf4 upstream. + +According to the datasheet: +The BIT[5:4] of ADC Control Register 2 is to control the word width. + 00 = 25 Bits + 01 = 20 Bits + 10 = 16 Bits + 11 = Invalid + +Thus, the AD1836_ADC_WORD_OFFSET should be defined as 4. + +Signed-off-by: Axel Lin +Acked-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/ad1836.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/ad1836.h ++++ b/sound/soc/codecs/ad1836.h +@@ -34,7 +34,7 @@ + + #define AD1836_ADC_CTRL2 13 + #define AD1836_ADC_WORD_LEN_MASK 0x30 +-#define AD1836_ADC_WORD_OFFSET 5 ++#define AD1836_ADC_WORD_OFFSET 4 + #define AD1836_ADC_SERFMT_MASK (7 << 6) + #define AD1836_ADC_SERFMT_PCK256 (0x4 << 6) + #define AD1836_ADC_SERFMT_PCK128 (0x5 << 6) diff --git a/queue-3.1/drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch b/queue-3.1/drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch new file mode 100644 index 00000000000..b778e123d91 --- /dev/null +++ b/queue-3.1/drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch @@ -0,0 +1,119 @@ +From f64964796dedca340608fb1075ab6baad5625851 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 28 Nov 2011 14:49:26 -0500 +Subject: drm/radeon/kms: add some loop timeouts in pageflip code + +From: Alex Deucher + +commit f64964796dedca340608fb1075ab6baad5625851 upstream. + +Avoid infinite loops waiting for surface updates if a GPU +reset happens while waiting for a page flip. + +See: +https://bugs.freedesktop.org/show_bug.cgi?id=43191 + +Signed-off-by: Alex Deucher +Reviewed-by: Mario Kleiner +Tested-by: Simon Farnsworth +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/evergreen.c | 7 ++++++- + drivers/gpu/drm/radeon/r100.c | 7 ++++++- + drivers/gpu/drm/radeon/rs600.c | 7 ++++++- + drivers/gpu/drm/radeon/rv770.c | 7 ++++++- + 4 files changed, 24 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -82,6 +82,7 @@ u32 evergreen_page_flip(struct radeon_de + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset); ++ int i; + + /* Lock the graphics update lock */ + tmp |= EVERGREEN_GRPH_UPDATE_LOCK; +@@ -99,7 +100,11 @@ u32 evergreen_page_flip(struct radeon_de + (u32)crtc_base); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -84,13 +84,18 @@ u32 r100_page_flip(struct radeon_device + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = ((u32)crtc_base) | RADEON_CRTC_OFFSET__OFFSET_LOCK; ++ int i; + + /* Lock the graphics update lock */ + /* update the scanout addresses */ + WREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset, tmp); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -62,6 +62,7 @@ u32 rs600_page_flip(struct radeon_device + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset); ++ int i; + + /* Lock the graphics update lock */ + tmp |= AVIVO_D1GRPH_UPDATE_LOCK; +@@ -74,7 +75,11 @@ u32 rs600_page_flip(struct radeon_device + (u32)crtc_base); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ +--- a/drivers/gpu/drm/radeon/rv770.c ++++ b/drivers/gpu/drm/radeon/rv770.c +@@ -47,6 +47,7 @@ u32 rv770_page_flip(struct radeon_device + { + struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id]; + u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset); ++ int i; + + /* Lock the graphics update lock */ + tmp |= AVIVO_D1GRPH_UPDATE_LOCK; +@@ -66,7 +67,11 @@ u32 rv770_page_flip(struct radeon_device + (u32)crtc_base); + + /* Wait for update_pending to go high. */ +- while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)); ++ for (i = 0; i < rdev->usec_timeout; i++) { ++ if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING) ++ break; ++ udelay(1); ++ } + DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n"); + + /* Unlock the lock, so double-buffering can take place inside vblank */ diff --git a/queue-3.1/drm-radeon-kms-add-some-new-pci-ids.patch b/queue-3.1/drm-radeon-kms-add-some-new-pci-ids.patch new file mode 100644 index 00000000000..de61c876e95 --- /dev/null +++ b/queue-3.1/drm-radeon-kms-add-some-new-pci-ids.patch @@ -0,0 +1,34 @@ +From 2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 1 Dec 2011 11:02:11 -0500 +Subject: drm/radeon/kms: add some new pci ids + +From: Alex Deucher + +commit 2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94 upstream. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -197,6 +197,14 @@ + {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6840, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6841, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6842, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6843, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6849, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6858, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6859, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6880, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6888, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6889, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \ diff --git a/queue-3.1/ehci-fix-a-regression-in-the-iso-scheduler.patch b/queue-3.1/ehci-fix-a-regression-in-the-iso-scheduler.patch new file mode 100644 index 00000000000..334983dedaa --- /dev/null +++ b/queue-3.1/ehci-fix-a-regression-in-the-iso-scheduler.patch @@ -0,0 +1,58 @@ +From e3420901eba65b1c46bed86d360e3a8685d20734 Mon Sep 17 00:00:00 2001 +From: Matthieu CASTET +Date: Mon, 28 Nov 2011 11:30:22 +0100 +Subject: EHCI : Fix a regression in the ISO scheduler + +From: Matthieu CASTET + +commit e3420901eba65b1c46bed86d360e3a8685d20734 upstream. + +Fix a regression that was introduced by commit +811c926c538f7e8d3c08b630dd5844efd7e000f6 (USB: EHCI: fix HUB TT scheduling +issue with iso transfer). + +We detect an error if next == start, but this means uframe 0 can't be allocated +anymore for iso transfer... + +Reported-by: Sander Eikelenboom +Signed-off-by: Matthieu CASTET +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1476,6 +1476,7 @@ iso_stream_schedule ( + * jump until after the queue is primed. + */ + else { ++ int done = 0; + start = SCHEDULE_SLOP + (now & ~0x07); + + /* NOTE: assumes URB_ISO_ASAP, to limit complexity/bugs */ +@@ -1493,18 +1494,18 @@ iso_stream_schedule ( + if (stream->highspeed) { + if (itd_slot_ok(ehci, mod, start, + stream->usecs, period)) +- break; ++ done = 1; + } else { + if ((start % 8) >= 6) + continue; + if (sitd_slot_ok(ehci, mod, stream, + start, sched, period)) +- break; ++ done = 1; + } +- } while (start > next); ++ } while (start > next && !done); + + /* no room in the schedule */ +- if (start == next) { ++ if (!done) { + ehci_dbg(ehci, "iso resched full %p (now %d max %d)\n", + urb, now, now + mod); + status = -ENOSPC; diff --git a/queue-3.1/firmware-sigma-fix-endianess-issues.patch b/queue-3.1/firmware-sigma-fix-endianess-issues.patch new file mode 100644 index 00000000000..4265a11b649 --- /dev/null +++ b/queue-3.1/firmware-sigma-fix-endianess-issues.patch @@ -0,0 +1,62 @@ +From bda63586bc5929e97288cdb371bb6456504867ed Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 28 Nov 2011 09:44:16 +0100 +Subject: firmware: Sigma: Fix endianess issues + +From: Lars-Peter Clausen + +commit bda63586bc5929e97288cdb371bb6456504867ed upstream. + +Currently the SigmaDSP firmware loader only works correctly on little-endian +systems. Fix this by using the proper endianess conversion functions. + +Signed-off-by: Lars-Peter Clausen +Acked-by: Mike Frysinger +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/sigma.c | 2 +- + include/linux/sigma.h | 8 ++++---- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/firmware/sigma.c ++++ b/drivers/firmware/sigma.c +@@ -133,7 +133,7 @@ int process_sigma_firmware(struct i2c_cl + crc = crc32(0, fw->data + sizeof(*ssfw_head), + fw->size - sizeof(*ssfw_head)); + pr_debug("%s: crc=%x\n", __func__, crc); +- if (crc != ssfw_head->crc) ++ if (crc != le32_to_cpu(ssfw_head->crc)) + goto done; + + ssfw.pos = sizeof(*ssfw_head); +--- a/include/linux/sigma.h ++++ b/include/linux/sigma.h +@@ -24,7 +24,7 @@ struct sigma_firmware { + struct sigma_firmware_header { + unsigned char magic[7]; + u8 version; +- u32 crc; ++ __le32 crc; + }; + + enum { +@@ -40,14 +40,14 @@ enum { + struct sigma_action { + u8 instr; + u8 len_hi; +- u16 len; +- u16 addr; ++ __le16 len; ++ __be16 addr; + unsigned char payload[]; + }; + + static inline u32 sigma_action_len(struct sigma_action *sa) + { +- return (sa->len_hi << 16) | sa->len; ++ return (sa->len_hi << 16) | le16_to_cpu(sa->len); + } + + extern int process_sigma_firmware(struct i2c_client *client, const char *name); diff --git a/queue-3.1/firmware-sigma-prevent-out-of-bounds-memory-access.patch b/queue-3.1/firmware-sigma-prevent-out-of-bounds-memory-access.patch new file mode 100644 index 00000000000..828afe2195a --- /dev/null +++ b/queue-3.1/firmware-sigma-prevent-out-of-bounds-memory-access.patch @@ -0,0 +1,164 @@ +From 4f718a29fe4908c2cea782f751e9805319684e2b Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 28 Nov 2011 09:44:14 +0100 +Subject: firmware: Sigma: Prevent out of bounds memory access + +From: Lars-Peter Clausen + +commit 4f718a29fe4908c2cea782f751e9805319684e2b upstream. + +The SigmaDSP firmware loader currently does not perform enough boundary size +checks when processing the firmware. As a result it is possible that a +malformed firmware can cause an out of bounds memory access. + +This patch adds checks which ensure that both the action header and the payload +are completely inside the firmware data boundaries before processing them. + +Signed-off-by: Lars-Peter Clausen +Acked-by: Mike Frysinger +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/sigma.c | 76 ++++++++++++++++++++++++++++++++++------------- + include/linux/sigma.h | 5 --- + 2 files changed, 55 insertions(+), 26 deletions(-) + +--- a/drivers/firmware/sigma.c ++++ b/drivers/firmware/sigma.c +@@ -14,13 +14,34 @@ + #include + #include + +-/* Return: 0==OK, <0==error, =1 ==no more actions */ ++static size_t sigma_action_size(struct sigma_action *sa) ++{ ++ size_t payload = 0; ++ ++ switch (sa->instr) { ++ case SIGMA_ACTION_WRITEXBYTES: ++ case SIGMA_ACTION_WRITESINGLE: ++ case SIGMA_ACTION_WRITESAFELOAD: ++ payload = sigma_action_len(sa); ++ break; ++ default: ++ break; ++ } ++ ++ payload = ALIGN(payload, 2); ++ ++ return payload + sizeof(struct sigma_action); ++} ++ ++/* ++ * Returns a negative error value in case of an error, 0 if processing of ++ * the firmware should be stopped after this action, 1 otherwise. ++ */ + static int +-process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw) ++process_sigma_action(struct i2c_client *client, struct sigma_action *sa) + { +- struct sigma_action *sa = (void *)(ssfw->fw->data + ssfw->pos); + size_t len = sigma_action_len(sa); +- int ret = 0; ++ int ret; + + pr_debug("%s: instr:%i addr:%#x len:%zu\n", __func__, + sa->instr, sa->addr, len); +@@ -29,44 +50,50 @@ process_sigma_action(struct i2c_client * + case SIGMA_ACTION_WRITEXBYTES: + case SIGMA_ACTION_WRITESINGLE: + case SIGMA_ACTION_WRITESAFELOAD: +- if (ssfw->fw->size < ssfw->pos + len) +- return -EINVAL; + ret = i2c_master_send(client, (void *)&sa->addr, len); + if (ret < 0) + return -EINVAL; + break; +- + case SIGMA_ACTION_DELAY: +- ret = 0; + udelay(len); + len = 0; + break; +- + case SIGMA_ACTION_END: +- return 1; +- ++ return 0; + default: + return -EINVAL; + } + +- /* when arrive here ret=0 or sent data */ +- ssfw->pos += sigma_action_size(sa, len); +- return ssfw->pos == ssfw->fw->size; ++ return 1; + } + + static int + process_sigma_actions(struct i2c_client *client, struct sigma_firmware *ssfw) + { +- pr_debug("%s: processing %p\n", __func__, ssfw); ++ struct sigma_action *sa; ++ size_t size; ++ int ret; ++ ++ while (ssfw->pos + sizeof(*sa) <= ssfw->fw->size) { ++ sa = (struct sigma_action *)(ssfw->fw->data + ssfw->pos); ++ ++ size = sigma_action_size(sa); ++ ssfw->pos += size; ++ if (ssfw->pos > ssfw->fw->size || size == 0) ++ break; ++ ++ ret = process_sigma_action(client, sa); + +- while (1) { +- int ret = process_sigma_action(client, ssfw); + pr_debug("%s: action returned %i\n", __func__, ret); +- if (ret == 1) +- return 0; +- else if (ret) ++ ++ if (ret <= 0) + return ret; + } ++ ++ if (ssfw->pos != ssfw->fw->size) ++ return -EINVAL; ++ ++ return 0; + } + + int process_sigma_firmware(struct i2c_client *client, const char *name) +@@ -89,7 +116,14 @@ int process_sigma_firmware(struct i2c_cl + + /* then verify the header */ + ret = -EINVAL; +- if (fw->size < sizeof(*ssfw_head)) ++ ++ /* ++ * Reject too small or unreasonable large files. The upper limit has been ++ * chosen a bit arbitrarily, but it should be enough for all practical ++ * purposes and having the limit makes it easier to avoid integer ++ * overflows later in the loading process. ++ */ ++ if (fw->size < sizeof(*ssfw_head) || fw->size >= 0x4000000) + goto done; + + ssfw_head = (void *)fw->data; +--- a/include/linux/sigma.h ++++ b/include/linux/sigma.h +@@ -50,11 +50,6 @@ static inline u32 sigma_action_len(struc + return (sa->len_hi << 16) | sa->len; + } + +-static inline size_t sigma_action_size(struct sigma_action *sa, u32 payload_len) +-{ +- return sizeof(*sa) + payload_len + (payload_len % 2); +-} +- + extern int process_sigma_firmware(struct i2c_client *client, const char *name); + + #endif diff --git a/queue-3.1/firmware-sigma-skip-header-during-crc-generation.patch b/queue-3.1/firmware-sigma-skip-header-during-crc-generation.patch new file mode 100644 index 00000000000..9de5e54f973 --- /dev/null +++ b/queue-3.1/firmware-sigma-skip-header-during-crc-generation.patch @@ -0,0 +1,33 @@ +From c56935bdc0a8edf50237d3b0205133a5b0adc604 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 28 Nov 2011 09:44:15 +0100 +Subject: firmware: Sigma: Skip header during CRC generation + +From: Lars-Peter Clausen + +commit c56935bdc0a8edf50237d3b0205133a5b0adc604 upstream. + +The firmware header is not part of the CRC, so skip it. Otherwise the firmware +will be rejected due to non-matching CRCs. + +Signed-off-by: Lars-Peter Clausen +Acked-by: Mike Frysinger +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/sigma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/firmware/sigma.c ++++ b/drivers/firmware/sigma.c +@@ -130,7 +130,8 @@ int process_sigma_firmware(struct i2c_cl + if (memcmp(ssfw_head->magic, SIGMA_MAGIC, ARRAY_SIZE(ssfw_head->magic))) + goto done; + +- crc = crc32(0, fw->data, fw->size); ++ crc = crc32(0, fw->data + sizeof(*ssfw_head), ++ fw->size - sizeof(*ssfw_head)); + pr_debug("%s: crc=%x\n", __func__, crc); + if (crc != ssfw_head->crc) + goto done; diff --git a/queue-3.1/hid-correct-general-touch-pid.patch b/queue-3.1/hid-correct-general-touch-pid.patch new file mode 100644 index 00000000000..a32e48ec5a7 --- /dev/null +++ b/queue-3.1/hid-correct-general-touch-pid.patch @@ -0,0 +1,49 @@ +From b1807719f6acdf18cc4bde3b5400d05d77801494 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Wed, 16 Nov 2011 11:39:52 +0100 +Subject: HID: Correct General touch PID + +From: Benjamin Tissoires + +commit b1807719f6acdf18cc4bde3b5400d05d77801494 upstream. + +Genera Touch told us that 0001 is their single point device +and 0003 is the multitouch one. Apparently, we made the tests +someone having a prototype, and not the final product. +They said it should be safe to do the switch. + +This partially reverts 5572da0 ("HID: hid-mulitouch: add support +for the 'Sensing Win7-TwoFinger'"). + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 2 +- + drivers/hid/hid-ids.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1728,8 +1728,8 @@ static const struct hid_device_id hid_ig + { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0001) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0002) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0003) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0004) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_4_PHIDGETSERVO_30) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_1_PHIDGETSERVO_30) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -266,7 +266,7 @@ + #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002 + + #define USB_VENDOR_ID_GENERAL_TOUCH 0x0dfc +-#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0001 ++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003 + + #define USB_VENDOR_ID_GLAB 0x06c2 + #define USB_DEVICE_ID_4_PHIDGETSERVO_30 0x0038 diff --git a/queue-3.1/ib-fix-rcu-lockdep-splats.patch b/queue-3.1/ib-fix-rcu-lockdep-splats.patch new file mode 100644 index 00000000000..a7c6ad623ed --- /dev/null +++ b/queue-3.1/ib-fix-rcu-lockdep-splats.patch @@ -0,0 +1,258 @@ +From 580da35a31f91a594f3090b7a2c39b85cb051a12 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 29 Nov 2011 22:31:23 +0100 +Subject: IB: Fix RCU lockdep splats + +From: Eric Dumazet + +commit 580da35a31f91a594f3090b7a2c39b85cb051a12 upstream. + +Commit f2c31e32b37 ("net: fix NULL dereferences in check_peer_redir()") +forgot to take care of infiniband uses of dst neighbours. + +Many thanks to Marc Aurele who provided a nice bug report and feedback. + +Reported-by: Marc Aurele La France +Signed-off-by: Eric Dumazet +Cc: David Miller +Signed-off-by: Roland Dreier + +--- + drivers/infiniband/core/addr.c | 9 ++++++--- + drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++++ + drivers/infiniband/hw/cxgb4/cm.c | 4 ++++ + drivers/infiniband/hw/mlx4/qp.c | 2 +- + drivers/infiniband/hw/nes/nes_cm.c | 6 ++++-- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 18 +++++++++++------- + drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 6 ++++-- + 7 files changed, 34 insertions(+), 15 deletions(-) + +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -215,7 +215,9 @@ static int addr4_resolve(struct sockaddr + + neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, rt->dst.dev); + if (!neigh || !(neigh->nud_state & NUD_VALID)) { ++ rcu_read_lock(); + neigh_event_send(dst_get_neighbour(&rt->dst), NULL); ++ rcu_read_unlock(); + ret = -ENODATA; + if (neigh) + goto release; +@@ -273,15 +275,16 @@ static int addr6_resolve(struct sockaddr + goto put; + } + ++ rcu_read_lock(); + neigh = dst_get_neighbour(dst); + if (!neigh || !(neigh->nud_state & NUD_VALID)) { + if (neigh) + neigh_event_send(neigh, NULL); + ret = -ENODATA; +- goto put; ++ } else { ++ ret = rdma_copy_addr(addr, dst->dev, neigh->ha); + } +- +- ret = rdma_copy_addr(addr, dst->dev, neigh->ha); ++ rcu_read_unlock(); + put: + dst_release(dst); + return ret; +--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c ++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c +@@ -1365,8 +1365,10 @@ static int pass_accept_req(struct t3cdev + goto reject; + } + dst = &rt->dst; ++ rcu_read_lock(); + neigh = dst_get_neighbour(dst); + l2t = t3_l2t_get(tdev, neigh, neigh->dev); ++ rcu_read_unlock(); + if (!l2t) { + printk(KERN_ERR MOD "%s - failed to allocate l2t entry!\n", + __func__); +@@ -1936,10 +1938,12 @@ int iwch_connect(struct iw_cm_id *cm_id, + } + ep->dst = &rt->dst; + ++ rcu_read_lock(); + neigh = dst_get_neighbour(ep->dst); + + /* get a l2t entry */ + ep->l2t = t3_l2t_get(ep->com.tdev, neigh, neigh->dev); ++ rcu_read_unlock(); + if (!ep->l2t) { + printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __func__); + err = -ENOMEM; +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -1358,6 +1358,7 @@ static int pass_accept_req(struct c4iw_d + goto reject; + } + dst = &rt->dst; ++ rcu_read_lock(); + neigh = dst_get_neighbour(dst); + if (neigh->dev->flags & IFF_LOOPBACK) { + pdev = ip_dev_find(&init_net, peer_ip); +@@ -1384,6 +1385,7 @@ static int pass_accept_req(struct c4iw_d + rss_qid = dev->rdev.lldi.rxq_ids[ + cxgb4_port_idx(neigh->dev) * step]; + } ++ rcu_read_unlock(); + if (!l2t) { + printk(KERN_ERR MOD "%s - failed to allocate l2t entry!\n", + __func__); +@@ -1909,6 +1911,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, + } + ep->dst = &rt->dst; + ++ rcu_read_lock(); + neigh = dst_get_neighbour(ep->dst); + + /* get a l2t entry */ +@@ -1945,6 +1948,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, + ep->rss_qid = ep->com.dev->rdev.lldi.rxq_ids[ + cxgb4_port_idx(neigh->dev) * step]; + } ++ rcu_read_unlock(); + if (!ep->l2t) { + printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __func__); + err = -ENOMEM; +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1309,7 +1309,7 @@ static int build_mlx_header(struct mlx4_ + int is_eth; + int is_vlan = 0; + int is_grh; +- u16 vlan; ++ u16 vlan = 0; + + send_size = 0; + for (i = 0; i < wr->num_sge; ++i) +--- a/drivers/infiniband/hw/nes/nes_cm.c ++++ b/drivers/infiniband/hw/nes/nes_cm.c +@@ -1150,9 +1150,11 @@ static int nes_addr_resolve_neigh(struct + neigh_release(neigh); + } + +- if ((neigh == NULL) || (!(neigh->nud_state & NUD_VALID))) ++ if ((neigh == NULL) || (!(neigh->nud_state & NUD_VALID))) { ++ rcu_read_lock(); + neigh_event_send(dst_get_neighbour(&rt->dst), NULL); +- ++ rcu_read_unlock(); ++ } + ip_rt_put(rt); + return rc; + } +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -555,6 +555,7 @@ static int path_rec_start(struct net_dev + return 0; + } + ++/* called with rcu_read_lock */ + static void neigh_add_path(struct sk_buff *skb, struct net_device *dev) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); +@@ -636,6 +637,7 @@ err_drop: + spin_unlock_irqrestore(&priv->lock, flags); + } + ++/* called with rcu_read_lock */ + static void ipoib_path_lookup(struct sk_buff *skb, struct net_device *dev) + { + struct ipoib_dev_priv *priv = netdev_priv(skb->dev); +@@ -720,13 +722,14 @@ static int ipoib_start_xmit(struct sk_bu + struct neighbour *n = NULL; + unsigned long flags; + ++ rcu_read_lock(); + if (likely(skb_dst(skb))) + n = dst_get_neighbour(skb_dst(skb)); + + if (likely(n)) { + if (unlikely(!*to_ipoib_neigh(n))) { + ipoib_path_lookup(skb, dev); +- return NETDEV_TX_OK; ++ goto unlock; + } + + neigh = *to_ipoib_neigh(n); +@@ -749,17 +752,17 @@ static int ipoib_start_xmit(struct sk_bu + ipoib_neigh_free(dev, neigh); + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_path_lookup(skb, dev); +- return NETDEV_TX_OK; ++ goto unlock; + } + + if (ipoib_cm_get(neigh)) { + if (ipoib_cm_up(neigh)) { + ipoib_cm_send(dev, skb, ipoib_cm_get(neigh)); +- return NETDEV_TX_OK; ++ goto unlock; + } + } else if (neigh->ah) { + ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(n->ha)); +- return NETDEV_TX_OK; ++ goto unlock; + } + + if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) { +@@ -793,13 +796,14 @@ static int ipoib_start_xmit(struct sk_bu + phdr->hwaddr + 4); + dev_kfree_skb_any(skb); + ++dev->stats.tx_dropped; +- return NETDEV_TX_OK; ++ goto unlock; + } + + unicast_arp_send(skb, dev, phdr); + } + } +- ++unlock: ++ rcu_read_unlock(); + return NETDEV_TX_OK; + } + +@@ -837,7 +841,7 @@ static int ipoib_hard_header(struct sk_b + dst = skb_dst(skb); + n = NULL; + if (dst) +- n = dst_get_neighbour(dst); ++ n = dst_get_neighbour_raw(dst); + if ((!dst || !n) && daddr) { + struct ipoib_pseudoheader *phdr = + (struct ipoib_pseudoheader *) skb_push(skb, sizeof *phdr); +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -265,7 +265,7 @@ static int ipoib_mcast_join_finish(struc + + skb->dev = dev; + if (dst) +- n = dst_get_neighbour(dst); ++ n = dst_get_neighbour_raw(dst); + if (!dst || !n) { + /* put pseudoheader back on for next time */ + skb_push(skb, sizeof (struct ipoib_pseudoheader)); +@@ -721,6 +721,8 @@ out: + if (mcast && mcast->ah) { + struct dst_entry *dst = skb_dst(skb); + struct neighbour *n = NULL; ++ ++ rcu_read_lock(); + if (dst) + n = dst_get_neighbour(dst); + if (n && !*to_ipoib_neigh(n)) { +@@ -733,7 +735,7 @@ out: + list_add_tail(&neigh->list, &mcast->neigh_list); + } + } +- ++ rcu_read_unlock(); + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_send(dev, skb, mcast->ah, IB_MULTICAST_QPN); + return; diff --git a/queue-3.1/series b/queue-3.1/series index ee85ecccd18..be460d7c640 100644 --- a/queue-3.1/series +++ b/queue-3.1/series @@ -53,3 +53,26 @@ scsi-silencing-killing-requests-for-dead-queue.patch hugetlb-release-pages-in-the-error-path-of-hugetlb_cow.patch bridge-correct-ipv6-checksum-after-pull.patch iwlwifi-allow-pci_enable_msi-fail.patch +drm-radeon-kms-add-some-new-pci-ids.patch +drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch +alsa-hda-fix-s3-s4-problem-on-machines-with-vref-pin-mute-led.patch +asoc-fix-wrong-define-for-ad1836_adc_word_offset.patch +firmware-sigma-prevent-out-of-bounds-memory-access.patch +firmware-sigma-skip-header-during-crc-generation.patch +firmware-sigma-fix-endianess-issues.patch +staging-rts_pstor-complete-scanning_done-variable.patch +staging-usbip-bugfix-for-deadlock.patch +staging-comedi-fix-oops-for-usb-daq-devices.patch +staging-comedi-fix-mmap_count.patch +staging-comedi-fix-signal-handling-in-read-and-write.patch +usb-musb-pm-fix-context-save-restore-in-suspend-resume-path.patch +usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch +hid-correct-general-touch-pid.patch +usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch +usb-option-add-huawei-e353-controlling-interfaces.patch +usb-option-add-simcom-sim5218.patch +usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch +ib-fix-rcu-lockdep-splats.patch +usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch +ehci-fix-a-regression-in-the-iso-scheduler.patch +xhci-fix-bug-in-xhci_clear_command_ring.patch diff --git a/queue-3.1/staging-comedi-fix-mmap_count.patch b/queue-3.1/staging-comedi-fix-mmap_count.patch new file mode 100644 index 00000000000..0d74a847826 --- /dev/null +++ b/queue-3.1/staging-comedi-fix-mmap_count.patch @@ -0,0 +1,63 @@ +From df30b21cb0eed5ba8a8e0cdfeebc66ba8cde821d Mon Sep 17 00:00:00 2001 +From: Federico Vaga +Date: Sat, 29 Oct 2011 09:45:39 +0200 +Subject: Staging: comedi: fix mmap_count + +From: Federico Vaga + +commit df30b21cb0eed5ba8a8e0cdfeebc66ba8cde821d upstream. + +In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but +it is not incremented at comedi_vm_ops->open. This may result in a negative +counter. The patch introduces the open method to keep the counter +consistent. + +The bug was triggerd by this sample code: + + mmap(0, ...., comedi_fd); + fork(); + exit(0); + +Acked-by: Alessandro Rubini +Signed-off-by: Federico Vaga +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1432,7 +1432,21 @@ static int do_cancel(struct comedi_devic + return ret; + } + +-static void comedi_unmap(struct vm_area_struct *area) ++ ++static void comedi_vm_open(struct vm_area_struct *area) ++{ ++ struct comedi_async *async; ++ struct comedi_device *dev; ++ ++ async = area->vm_private_data; ++ dev = async->subdevice->device; ++ ++ mutex_lock(&dev->mutex); ++ async->mmap_count++; ++ mutex_unlock(&dev->mutex); ++} ++ ++static void comedi_vm_close(struct vm_area_struct *area) + { + struct comedi_async *async; + struct comedi_device *dev; +@@ -1446,7 +1460,8 @@ static void comedi_unmap(struct vm_area_ + } + + static struct vm_operations_struct comedi_vm_ops = { +- .close = comedi_unmap, ++ .open = comedi_vm_open, ++ .close = comedi_vm_close, + }; + + static int comedi_mmap(struct file *file, struct vm_area_struct *vma) diff --git a/queue-3.1/staging-comedi-fix-oops-for-usb-daq-devices.patch b/queue-3.1/staging-comedi-fix-oops-for-usb-daq-devices.patch new file mode 100644 index 00000000000..e2675de9cc3 --- /dev/null +++ b/queue-3.1/staging-comedi-fix-oops-for-usb-daq-devices.patch @@ -0,0 +1,147 @@ +From 3ffab428f40849ed5f21bcfd7285bdef7902f9ca Mon Sep 17 00:00:00 2001 +From: Bernd Porr +Date: Tue, 8 Nov 2011 21:23:03 +0000 +Subject: staging: comedi: fix oops for USB DAQ devices. + +From: Bernd Porr + +commit 3ffab428f40849ed5f21bcfd7285bdef7902f9ca upstream. + +This fixes kernel oops when an USB DAQ device is plugged out while it's +communicating with the userspace software. + +Signed-off-by: Bernd Porr +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 73 +++++++++++++++++++++++++---------- + 1 file changed, 54 insertions(+), 19 deletions(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1452,9 +1452,6 @@ static struct vm_operations_struct comed + static int comedi_mmap(struct file *file, struct vm_area_struct *vma) + { + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; + struct comedi_async *async = NULL; + unsigned long start = vma->vm_start; + unsigned long size; +@@ -1462,6 +1459,15 @@ static int comedi_mmap(struct file *file + int i; + int retval; + struct comedi_subdevice *s; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ ++ dev_file_info = comedi_get_device_file_info(minor); ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + mutex_lock(&dev->mutex); + if (!dev->attached) { +@@ -1528,11 +1534,17 @@ static unsigned int comedi_poll(struct f + { + unsigned int mask = 0; + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; + struct comedi_subdevice *read_subdev; + struct comedi_subdevice *write_subdev; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + mutex_lock(&dev->mutex); + if (!dev->attached) { +@@ -1578,9 +1590,15 @@ static ssize_t comedi_write(struct file + int n, m, count = 0, retval = 0; + DECLARE_WAITQUEUE(wait, current); + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + if (!dev->attached) { + DPRINTK("no driver configured on comedi%i\n", dev->minor); +@@ -1683,9 +1701,15 @@ static ssize_t comedi_read(struct file * + int n, m, count = 0, retval = 0; + DECLARE_WAITQUEUE(wait, current); + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + if (!dev->attached) { + DPRINTK("no driver configured on comedi%i\n", dev->minor); +@@ -1885,11 +1909,17 @@ ok: + static int comedi_close(struct inode *inode, struct file *file) + { + const unsigned minor = iminor(inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- struct comedi_device *dev = dev_file_info->device; + struct comedi_subdevice *s = NULL; + int i; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + mutex_lock(&dev->mutex); + +@@ -1923,10 +1953,15 @@ static int comedi_close(struct inode *in + static int comedi_fasync(int fd, struct file *file, int on) + { + const unsigned minor = iminor(file->f_dentry->d_inode); +- struct comedi_device_file_info *dev_file_info = +- comedi_get_device_file_info(minor); +- +- struct comedi_device *dev = dev_file_info->device; ++ struct comedi_device_file_info *dev_file_info; ++ struct comedi_device *dev; ++ dev_file_info = comedi_get_device_file_info(minor); ++ ++ if (dev_file_info == NULL) ++ return -ENODEV; ++ dev = dev_file_info->device; ++ if (dev == NULL) ++ return -ENODEV; + + return fasync_helper(fd, file, on, &dev->async_queue); + } diff --git a/queue-3.1/staging-comedi-fix-signal-handling-in-read-and-write.patch b/queue-3.1/staging-comedi-fix-signal-handling-in-read-and-write.patch new file mode 100644 index 00000000000..53b6cabe83a --- /dev/null +++ b/queue-3.1/staging-comedi-fix-signal-handling-in-read-and-write.patch @@ -0,0 +1,48 @@ +From 6a9ce6b654e491981f6ef7e214cbd4f63e033848 Mon Sep 17 00:00:00 2001 +From: Federico Vaga +Date: Sat, 29 Oct 2011 09:47:39 +0200 +Subject: Staging: comedi: fix signal handling in read and write + +From: Federico Vaga + +commit 6a9ce6b654e491981f6ef7e214cbd4f63e033848 upstream. + +After sleeping on a wait queue, signal_pending(current) should be +checked (not before sleeping). + +Acked-by: Alessandro Rubini +Signed-off-by: Federico Vaga +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1673,11 +1673,11 @@ static ssize_t comedi_write(struct file + retval = -EAGAIN; + break; + } ++ schedule(); + if (signal_pending(current)) { + retval = -ERESTARTSYS; + break; + } +- schedule(); + if (!s->busy) + break; + if (s->busy != file) { +@@ -1780,11 +1780,11 @@ static ssize_t comedi_read(struct file * + retval = -EAGAIN; + break; + } ++ schedule(); + if (signal_pending(current)) { + retval = -ERESTARTSYS; + break; + } +- schedule(); + if (!s->busy) { + retval = 0; + break; diff --git a/queue-3.1/staging-rts_pstor-complete-scanning_done-variable.patch b/queue-3.1/staging-rts_pstor-complete-scanning_done-variable.patch new file mode 100644 index 00000000000..f5edbb347ad --- /dev/null +++ b/queue-3.1/staging-rts_pstor-complete-scanning_done-variable.patch @@ -0,0 +1,28 @@ +From f7364ba04b0961f3a1f978bbe77102606801e35f Mon Sep 17 00:00:00 2001 +From: wwang +Date: Mon, 31 Oct 2011 15:02:53 +0800 +Subject: staging:rts_pstor:Complete scanning_done variable + +From: wwang + +commit f7364ba04b0961f3a1f978bbe77102606801e35f upstream. + +Complete scanning_done variable if rtsx-scan thread created failed. + +Signed-off-by: wwang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rts_pstor/rtsx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/rts_pstor/rtsx.c ++++ b/drivers/staging/rts_pstor/rtsx.c +@@ -1015,6 +1015,7 @@ static int __devinit rtsx_probe(struct p + th = kthread_create(rtsx_scan_thread, dev, "rtsx-scan"); + if (IS_ERR(th)) { + printk(KERN_ERR "Unable to start the device-scanning thread\n"); ++ complete(&dev->scanning_done); + quiesce_and_remove_host(dev); + err = PTR_ERR(th); + goto errout; diff --git a/queue-3.1/staging-usbip-bugfix-for-deadlock.patch b/queue-3.1/staging-usbip-bugfix-for-deadlock.patch new file mode 100644 index 00000000000..2f79c0468f2 --- /dev/null +++ b/queue-3.1/staging-usbip-bugfix-for-deadlock.patch @@ -0,0 +1,63 @@ +From 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 Mon Sep 17 00:00:00 2001 +From: Bart Westgeest +Date: Tue, 1 Nov 2011 15:01:28 -0400 +Subject: staging: usbip: bugfix for deadlock + +From: Bart Westgeest + +commit 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 upstream. + +Interrupts must be disabled prior to calling usb_hcd_unlink_urb_from_ep. +If interrupts are not disabled, it can potentially lead to a deadlock. +The deadlock is readily reproduceable on a slower (ARM based) device +such as the TI Pandaboard. + +Signed-off-by: Bart Westgeest +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/usbip/vhci_rx.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/staging/usbip/vhci_rx.c ++++ b/drivers/staging/usbip/vhci_rx.c +@@ -68,6 +68,7 @@ static void vhci_recv_ret_submit(struct + { + struct usbip_device *ud = &vdev->ud; + struct urb *urb; ++ unsigned long flags; + + spin_lock(&vdev->priv_lock); + urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum); +@@ -101,9 +102,9 @@ static void vhci_recv_ret_submit(struct + + usbip_dbg_vhci_rx("now giveback urb %p\n", urb); + +- spin_lock(&the_controller->lock); ++ spin_lock_irqsave(&the_controller->lock, flags); + usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb); +- spin_unlock(&the_controller->lock); ++ spin_unlock_irqrestore(&the_controller->lock, flags); + + usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status); + +@@ -141,6 +142,7 @@ static void vhci_recv_ret_unlink(struct + { + struct vhci_unlink *unlink; + struct urb *urb; ++ unsigned long flags; + + usbip_dump_header(pdu); + +@@ -170,9 +172,9 @@ static void vhci_recv_ret_unlink(struct + urb->status = pdu->u.ret_unlink.status; + pr_info("urb->status %d\n", urb->status); + +- spin_lock(&the_controller->lock); ++ spin_lock_irqsave(&the_controller->lock, flags); + usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb); +- spin_unlock(&the_controller->lock); ++ spin_unlock_irqrestore(&the_controller->lock, flags); + + usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, + urb->status); diff --git a/queue-3.1/usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch b/queue-3.1/usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch new file mode 100644 index 00000000000..cc97bd066b3 --- /dev/null +++ b/queue-3.1/usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch @@ -0,0 +1,104 @@ +From 811c926c538f7e8d3c08b630dd5844efd7e000f6 Mon Sep 17 00:00:00 2001 +From: Thomas Poussevin +Date: Thu, 27 Oct 2011 18:46:48 +0200 +Subject: USB: EHCI: fix HUB TT scheduling issue with iso transfer + +From: Thomas Poussevin + +commit 811c926c538f7e8d3c08b630dd5844efd7e000f6 upstream. + +The current TT scheduling doesn't allow to play and then record on a +full-speed device connected to a high speed hub. + +The IN iso stream can only start on the first uframe (0-2 for a 165 us) +because of CSPLIT transactions. +For the OUT iso stream there no such restriction. uframe 0-5 are possible. + +The idea of this patch is that the first uframe are precious (for IN TT iso +stream) and we should allocate the last uframes first if possible. + +For that we reverse the order of uframe allocation (last uframe first). + +Here an example : + +hid interrupt stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | +---------------------------------------------------------------------- + +iso OUT stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 125 | 39 | 0 | 0 | 0 | 0 | 0 | +---------------------------------------------------------------------- + +There no place for iso IN stream (uframe 0-2 are used) and we got "cannot +submit datapipe for urb 0, error -28: not enough bandwidth" error. + +With the patch this become. + +iso OUT stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 0 | 0 | 0 | 125 | 39 | 0 | 0 | +---------------------------------------------------------------------- + +iso IN stream +---------------------------------------------------------------------- +uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | +---------------------------------------------------------------------- +max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 | +---------------------------------------------------------------------- +used usecs on a frame | 13 | 0 | 125 | 40 | 125 | 39 | 0 | 0 | +---------------------------------------------------------------------- + +Signed-off-by: Matthieu Castet +Signed-off-by: Thomas Poussevin +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1480,10 +1480,15 @@ iso_stream_schedule ( + + /* NOTE: assumes URB_ISO_ASAP, to limit complexity/bugs */ + +- /* find a uframe slot with enough bandwidth */ +- next = start + period; +- for (; start < next; start++) { +- ++ /* find a uframe slot with enough bandwidth. ++ * Early uframes are more precious because full-speed ++ * iso IN transfers can't use late uframes, ++ * and therefore they should be allocated last. ++ */ ++ next = start; ++ start += period; ++ do { ++ start--; + /* check schedule: enough space? */ + if (stream->highspeed) { + if (itd_slot_ok(ehci, mod, start, +@@ -1496,7 +1501,7 @@ iso_stream_schedule ( + start, sched, period)) + break; + } +- } ++ } while (start > next); + + /* no room in the schedule */ + if (start == next) { diff --git a/queue-3.1/usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch b/queue-3.1/usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch new file mode 100644 index 00000000000..e89add651a9 --- /dev/null +++ b/queue-3.1/usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch @@ -0,0 +1,40 @@ +From 307369b0ca06b27b511b61714e335ddfccf19c4f Mon Sep 17 00:00:00 2001 +From: Marcin Kościelnicki +Date: Wed, 30 Nov 2011 17:01:04 +0100 +Subject: usb: ftdi_sio: add PID for Propox ISPcable III +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marcin Kościelnicki + +commit 307369b0ca06b27b511b61714e335ddfccf19c4f upstream. + +Signed-off-by: Marcin Kościelnicki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -735,6 +735,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -112,6 +112,7 @@ + + /* Propox devices */ + #define FTDI_PROPOX_JTAGCABLEII_PID 0xD738 ++#define FTDI_PROPOX_ISPCABLEIII_PID 0xD739 + + /* Lenz LI-USB Computer Interface. */ + #define FTDI_LENZ_LIUSB_PID 0xD780 diff --git a/queue-3.1/usb-musb-pm-fix-context-save-restore-in-suspend-resume-path.patch b/queue-3.1/usb-musb-pm-fix-context-save-restore-in-suspend-resume-path.patch new file mode 100644 index 00000000000..5d056b605a7 --- /dev/null +++ b/queue-3.1/usb-musb-pm-fix-context-save-restore-in-suspend-resume-path.patch @@ -0,0 +1,57 @@ +From 5d193ce8f1fa7c67c7fd7be2c03ef31eed344a4f Mon Sep 17 00:00:00 2001 +From: Kevin Hilman +Date: Tue, 22 Nov 2011 17:18:24 -0800 +Subject: usb: musb: PM: fix context save/restore in suspend/resume path + +From: Kevin Hilman + +commit 5d193ce8f1fa7c67c7fd7be2c03ef31eed344a4f upstream. + +Currently the driver tries to save context in the suspend path, but +will cause an abort if the device is already runtime suspended. This +happens, for example, if MUSB loaded/compiled-in, in host mode, but no +USB devices are attached. MUSB will be runtime suspended, but then +attempting a system suspend will crash due to the context save +being attempted while the device is disabled. + +On OMAP, as of v3.1, the driver's ->runtime_suspend() callback will be +called late in the suspend path (by the PM domain layer) if the driver +is not already runtime suspended, ensuring a full shutdown. + +Therefore, the context save is not needed in the ->suspend() method +since it will be called in the ->runtime_suspend() method anyways +(similarily for resume.) + +NOTE: this leaves the suspend/resume methods basically empty (with + some FIXMEs and comments, but I'll leave it to the maintainers + to decide whether to remove them. + +Signed-off-by: Kevin Hilman +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_core.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2302,18 +2302,12 @@ static int musb_suspend(struct device *d + */ + } + +- musb_save_context(musb); +- + spin_unlock_irqrestore(&musb->lock, flags); + return 0; + } + + static int musb_resume_noirq(struct device *dev) + { +- struct musb *musb = dev_to_musb(dev); +- +- musb_restore_context(musb); +- + /* for static cmos like DaVinci, register values were preserved + * unless for some reason the whole soc powered down or the USB + * module got reset through the PSC (vs just being disabled). diff --git a/queue-3.1/usb-option-add-huawei-e353-controlling-interfaces.patch b/queue-3.1/usb-option-add-huawei-e353-controlling-interfaces.patch new file mode 100644 index 00000000000..4de10d169b6 --- /dev/null +++ b/queue-3.1/usb-option-add-huawei-e353-controlling-interfaces.patch @@ -0,0 +1,31 @@ +From 46b1848360c8e634e0b063932a1261062fa0f7d6 Mon Sep 17 00:00:00 2001 +From: Dirk Nehring +Date: Thu, 24 Nov 2011 19:22:23 +0100 +Subject: usb: option: add Huawei E353 controlling interfaces + +From: Dirk Nehring + +commit 46b1848360c8e634e0b063932a1261062fa0f7d6 upstream. + +This patch creates the missing controlling devices for the Huawei E353 +HSPA+ stick. + +Signed-off-by: Dirk Nehring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -657,6 +657,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x02) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x03) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x08) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) }, diff --git a/queue-3.1/usb-option-add-simcom-sim5218.patch b/queue-3.1/usb-option-add-simcom-sim5218.patch new file mode 100644 index 00000000000..447d1eab3b2 --- /dev/null +++ b/queue-3.1/usb-option-add-simcom-sim5218.patch @@ -0,0 +1,28 @@ +From ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 Mon Sep 17 00:00:00 2001 +From: Veli-Pekka Peltola +Date: Thu, 24 Nov 2011 22:08:56 +0200 +Subject: usb: option: add SIMCom SIM5218 + +From: Veli-Pekka Peltola + +commit ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 upstream. + +Tested with SIM5218EVB-KIT evaluation kit. + +Signed-off-by: Veli-Pekka Peltola +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -746,6 +746,7 @@ static const struct usb_device_id option + { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */ + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) }, diff --git a/queue-3.1/usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch b/queue-3.1/usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch new file mode 100644 index 00000000000..3ae39c24d30 --- /dev/null +++ b/queue-3.1/usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch @@ -0,0 +1,35 @@ +From cec28a5428793b6bc64e56687fb239759d6da74e Mon Sep 17 00:00:00 2001 +From: Qinglin Ye +Date: Wed, 23 Nov 2011 23:39:32 +0800 +Subject: USB: usb-storage: unusual_devs entry for Kingston DT 101 G2 + +From: Qinglin Ye + +commit cec28a5428793b6bc64e56687fb239759d6da74e upstream. + +Kingston DT 101 G2 replies a wrong tag while transporting, add an +unusal_devs entry to ignore the tag validation. + +Signed-off-by: Qinglin Ye +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1854,6 +1854,13 @@ UNUSUAL_DEV( 0x1370, 0x6828, 0x0110, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE ), + ++/* Reported by Qinglin Ye */ ++UNUSUAL_DEV( 0x13fe, 0x3600, 0x0100, 0x0100, ++ "Kingston", ++ "DT 101 G2", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BULK_IGNORE_TAG ), ++ + /* Reported by Francesco Foresti */ + UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201, + "Super Top", diff --git a/queue-3.1/usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch b/queue-3.1/usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch new file mode 100644 index 00000000000..c999f46add1 --- /dev/null +++ b/queue-3.1/usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch @@ -0,0 +1,30 @@ +From 8746c83d538cab273d335acb2be226d096f4a5af Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 22 Nov 2011 10:28:31 +0300 +Subject: USB: whci-hcd: fix endian conversion in qset_clear() + +From: Dan Carpenter + +commit 8746c83d538cab273d335acb2be226d096f4a5af upstream. + +qset->qh.link is an __le64 field and we should be using cpu_to_le64() +to fill it. + +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/whci/qset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/whci/qset.c ++++ b/drivers/usb/host/whci/qset.c +@@ -124,7 +124,7 @@ void qset_clear(struct whc *whc, struct + { + qset->td_start = qset->td_end = qset->ntds = 0; + +- qset->qh.link = cpu_to_le32(QH_LINK_NTDS(8) | QH_LINK_T); ++ qset->qh.link = cpu_to_le64(QH_LINK_NTDS(8) | QH_LINK_T); + qset->qh.status = qset->qh.status & QH_STATUS_SEQ_MASK; + qset->qh.err_count = 0; + qset->qh.scratch[0] = 0; diff --git a/queue-3.1/xhci-fix-bug-in-xhci_clear_command_ring.patch b/queue-3.1/xhci-fix-bug-in-xhci_clear_command_ring.patch new file mode 100644 index 00000000000..fc8caf7b524 --- /dev/null +++ b/queue-3.1/xhci-fix-bug-in-xhci_clear_command_ring.patch @@ -0,0 +1,44 @@ +From 158886cd2cf4599e04f9b7e10cb767f5f39b14f1 Mon Sep 17 00:00:00 2001 +From: Andiry Xu +Date: Wed, 30 Nov 2011 16:37:41 +0800 +Subject: xHCI: fix bug in xhci_clear_command_ring() + +From: Andiry Xu + +commit 158886cd2cf4599e04f9b7e10cb767f5f39b14f1 upstream. + +When system enters suspend, xHCI driver clears command ring by writing zero +to all the TRBs. However, this also writes zero to the Link TRB, and the ring +is mangled. This may cause driver accesses wrong memory address and the +result is unpredicted. + +When clear the command ring, keep the last Link TRB intact, only clear its +cycle bit. This should fix the "command ring full" issue reported by Oliver +Neukum. + +This should be backported to stable kernels as old as 2.6.37, since the +commit 89821320 "xhci: Fix command ring replay after resume" is merged. + +Signed-off-by: Andiry Xu +Signed-off-by: Sarah Sharp +Reported-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -657,7 +657,10 @@ static void xhci_clear_command_ring(stru + ring = xhci->cmd_ring; + seg = ring->deq_seg; + do { +- memset(seg->trbs, 0, SEGMENT_SIZE); ++ memset(seg->trbs, 0, ++ sizeof(union xhci_trb) * (TRBS_PER_SEGMENT - 1)); ++ seg->trbs[TRBS_PER_SEGMENT - 1].link.control &= ++ cpu_to_le32(~TRB_CYCLE); + seg = seg->next; + } while (seg != ring->deq_seg); +