diff options
author | Greg Kroah-Hartman <gregkh@suse.de> | 2011-05-30 14:12:31 +0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-05-30 14:12:31 +0800 |
commit | 1c258d2c9ace09fd43430a15b5f715d0849886a1 (patch) | |
tree | 5eea2bc29450dff98cb6207147f28c1fee08e137 | |
parent | 655783a6b95676576a840e17bba4c7340f4d02ae (diff) | |
download | stable-queue-1c258d2c9ace09fd43430a15b5f715d0849886a1.tar.gz |
.38 patches
24 files changed, 1677 insertions, 0 deletions
diff --git a/queue-2.6.38/bind-only-modem-at-command-endpoint-to-option-module.patch b/queue-2.6.38/bind-only-modem-at-command-endpoint-to-option-module.patch new file mode 100644 index 0000000000..82a6cd4a1b --- /dev/null +++ b/queue-2.6.38/bind-only-modem-at-command-endpoint-to-option-module.patch @@ -0,0 +1,44 @@ +From 15b2f3204a5c878c32939094775fb7349f707263 Mon Sep 17 00:00:00 2001 +From: "Marius B. Kotsbak" <marius@kotsbak.com> +Date: Mon, 21 Mar 2011 23:27:21 +0100 +Subject: Bind only modem AT command endpoint to option module. + +From: "Marius B. Kotsbak" <marius@kotsbak.com> + +commit 15b2f3204a5c878c32939094775fb7349f707263 upstream. + +Network interface is handled by upcoming gt_b3730 module. + +Removed "GT-B3710" from comment, it is another modem with another USB ID. + +Signed-off-by: Marius B. Kotsbak <marius@kotsbak.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/option.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -972,7 +972,7 @@ static const struct usb_device_id option + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */ +- { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730/GT-B3710 LTE USB modem.*/ ++ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +@@ -1109,6 +1109,12 @@ static int option_probe(struct usb_seria + serial->interface->cur_altsetting->desc.bInterfaceNumber == 1) + return -ENODEV; + ++ /* Don't bind network interface on Samsung GT-B3730, it is handled by a separate module */ ++ if (serial->dev->descriptor.idVendor == SAMSUNG_VENDOR_ID && ++ serial->dev->descriptor.idProduct == SAMSUNG_PRODUCT_GT_B3730 && ++ serial->interface->cur_altsetting->desc.bInterfaceClass != USB_CLASS_CDC_DATA) ++ return -ENODEV; ++ + data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL); + + if (!data) diff --git a/queue-2.6.38/cx88-fix-locking-of-sub-driver-operations.patch b/queue-2.6.38/cx88-fix-locking-of-sub-driver-operations.patch new file mode 100644 index 0000000000..7213f3429b --- /dev/null +++ b/queue-2.6.38/cx88-fix-locking-of-sub-driver-operations.patch @@ -0,0 +1,116 @@ +From 1fe70e963028f34ba5e32488a7870ff4b410b19b Mon Sep 17 00:00:00 2001 +From: Jonathan Nieder <jrnieder@gmail.com> +Date: Sun, 1 May 2011 06:29:37 -0300 +Subject: [media] cx88: fix locking of sub-driver operations + +From: Jonathan Nieder <jrnieder@gmail.com> + +commit 1fe70e963028f34ba5e32488a7870ff4b410b19b upstream. + +The BKL conversion of this driver seems to have gone wrong. +Loading the cx88-blackbird driver deadlocks. + +The cause: mpeg_ops::open in the cx2388x blackbird driver acquires the +device lock and calls the sub-driver's request_acquire, which tries to +acquire the lock again. Fix it by clarifying the semantics of +request_acquire, request_release, advise_acquire, and advise_release: +now all will rely on the caller to acquire the device lock. + +Based on work by Ben Hutchings <ben@decadent.org.uk>. + +Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=31962 + +Reported-by: Andi Huber <hobrom@gmx.at> +Tested-by: Andi Huber <hobrom@gmx.at> +Tested-by: Marlon de Boer <marlon@hyves.nl> +Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/media/video/cx88/cx88-blackbird.c | 4 ++-- + drivers/media/video/cx88/cx88-dvb.c | 3 +-- + drivers/media/video/cx88/cx88-mpeg.c | 4 ---- + drivers/media/video/cx88/cx88.h | 3 ++- + 4 files changed, 5 insertions(+), 9 deletions(-) + +--- a/drivers/media/video/cx88/cx88-blackbird.c ++++ b/drivers/media/video/cx88/cx88-blackbird.c +@@ -1125,13 +1125,13 @@ static int mpeg_release(struct file *fil + + /* Make sure we release the hardware */ + drv = cx8802_get_driver(dev, CX88_MPEG_BLACKBIRD); +- mutex_unlock(&dev->core->lock); +- + if (drv) + drv->request_release(drv); + + atomic_dec(&dev->core->mpeg_users); + ++ mutex_unlock(&dev->core->lock); ++ + return 0; + } + +--- a/drivers/media/video/cx88/cx88-dvb.c ++++ b/drivers/media/video/cx88/cx88-dvb.c +@@ -134,8 +134,6 @@ static int cx88_dvb_bus_ctrl(struct dvb_ + + mutex_lock(&dev->core->lock); + drv = cx8802_get_driver(dev, CX88_MPEG_DVB); +- mutex_unlock(&dev->core->lock); +- + if (drv) { + if (acquire){ + dev->frontends.active_fe_id = fe_id; +@@ -145,6 +143,7 @@ static int cx88_dvb_bus_ctrl(struct dvb_ + dev->frontends.active_fe_id = 0; + } + } ++ mutex_unlock(&dev->core->lock); + + return ret; + } +--- a/drivers/media/video/cx88/cx88-mpeg.c ++++ b/drivers/media/video/cx88/cx88-mpeg.c +@@ -624,13 +624,11 @@ static int cx8802_request_acquire(struct + + if (drv->advise_acquire) + { +- mutex_lock(&drv->core->lock); + core->active_ref++; + if (core->active_type_id == CX88_BOARD_NONE) { + core->active_type_id = drv->type_id; + drv->advise_acquire(drv); + } +- mutex_unlock(&drv->core->lock); + + mpeg_dbg(1,"%s() Post acquire GPIO=%x\n", __func__, cx_read(MO_GP0_IO)); + } +@@ -643,14 +641,12 @@ static int cx8802_request_release(struct + { + struct cx88_core *core = drv->core; + +- mutex_lock(&drv->core->lock); + if (drv->advise_release && --core->active_ref == 0) + { + drv->advise_release(drv); + core->active_type_id = CX88_BOARD_NONE; + mpeg_dbg(1,"%s() Post release GPIO=%x\n", __func__, cx_read(MO_GP0_IO)); + } +- mutex_unlock(&drv->core->lock); + + return 0; + } +--- a/drivers/media/video/cx88/cx88.h ++++ b/drivers/media/video/cx88/cx88.h +@@ -500,7 +500,8 @@ struct cx8802_driver { + /* Caller must _not_ hold core->lock */ + int (*probe)(struct cx8802_driver *drv); + +- /* Caller must hold core->lock */ ++ /* Callers to the following functions must hold core->lock */ ++ + int (*remove)(struct cx8802_driver *drv); + + /* MPEG 8802 -> mini driver - Access for hardware control */ diff --git a/queue-2.6.38/cx88-hold-device-lock-during-sub-driver.patch b/queue-2.6.38/cx88-hold-device-lock-during-sub-driver.patch new file mode 100644 index 0000000000..8edf602c75 --- /dev/null +++ b/queue-2.6.38/cx88-hold-device-lock-during-sub-driver.patch @@ -0,0 +1,88 @@ +From 1d6213ab995c61f7d1d81cf6cf876acf15d6e714 Mon Sep 17 00:00:00 2001 +From: Jonathan Nieder <jrnieder@gmail.com> +Date: Sun, 1 May 2011 06:29:56 -0300 +Subject: [media] cx88: hold device lock during sub-driver + initialization + +From: Jonathan Nieder <jrnieder@gmail.com> + +commit 1d6213ab995c61f7d1d81cf6cf876acf15d6e714 upstream. + +cx8802_blackbird_probe makes a device node for the mpeg sub-device +before it has been added to dev->drvlist. If the device is opened +during that time, the open succeeds but request_acquire cannot be +called, so the reference count remains zero. Later, when the device +is closed, the reference count becomes negative --- uh oh. + +Close the race by holding core->lock during probe and not releasing +until the device is in drvlist and initialization finished. +Previously the BKL prevented this race. + +Reported-by: Andreas Huber <hobrom@gmx.at> +Tested-by: Andi Huber <hobrom@gmx.at> +Tested-by: Marlon de Boer <marlon@hyves.nl> +Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/media/video/cx88/cx88-blackbird.c | 2 -- + drivers/media/video/cx88/cx88-mpeg.c | 5 ++--- + drivers/media/video/cx88/cx88.h | 7 ++----- + 3 files changed, 4 insertions(+), 10 deletions(-) + +--- a/drivers/media/video/cx88/cx88-blackbird.c ++++ b/drivers/media/video/cx88/cx88-blackbird.c +@@ -1335,11 +1335,9 @@ static int cx8802_blackbird_probe(struct + blackbird_register_video(dev); + + /* initial device configuration: needed ? */ +- mutex_lock(&dev->core->lock); + // init_controls(core); + cx88_set_tvnorm(core,core->tvnorm); + cx88_video_mux(core,0); +- mutex_unlock(&dev->core->lock); + + return 0; + +--- a/drivers/media/video/cx88/cx88-mpeg.c ++++ b/drivers/media/video/cx88/cx88-mpeg.c +@@ -709,18 +709,17 @@ int cx8802_register_driver(struct cx8802 + drv->request_release = cx8802_request_release; + memcpy(driver, drv, sizeof(*driver)); + ++ mutex_lock(&drv->core->lock); + err = drv->probe(driver); + if (err == 0) { + i++; +- mutex_lock(&drv->core->lock); + list_add_tail(&driver->drvlist, &dev->drvlist); +- mutex_unlock(&drv->core->lock); + } else { + printk(KERN_ERR + "%s/2: cx8802 probe failed, err = %d\n", + dev->core->name, err); + } +- ++ mutex_unlock(&drv->core->lock); + } + + return i ? 0 : -ENODEV; +--- a/drivers/media/video/cx88/cx88.h ++++ b/drivers/media/video/cx88/cx88.h +@@ -495,13 +495,10 @@ struct cx8802_driver { + int (*suspend)(struct pci_dev *pci_dev, pm_message_t state); + int (*resume)(struct pci_dev *pci_dev); + +- /* MPEG 8802 -> mini driver - Driver probe and configuration */ +- +- /* Caller must _not_ hold core->lock */ +- int (*probe)(struct cx8802_driver *drv); +- + /* Callers to the following functions must hold core->lock */ + ++ /* MPEG 8802 -> mini driver - Driver probe and configuration */ ++ int (*probe)(struct cx8802_driver *drv); + int (*remove)(struct cx8802_driver *drv); + + /* MPEG 8802 -> mini driver - Access for hardware control */ diff --git a/queue-2.6.38/cx88-protect-per-device-driver-list-with-device.patch b/queue-2.6.38/cx88-protect-per-device-driver-list-with-device.patch new file mode 100644 index 0000000000..396b055647 --- /dev/null +++ b/queue-2.6.38/cx88-protect-per-device-driver-list-with-device.patch @@ -0,0 +1,161 @@ +From 8a317a8760cfffa8185b56ff59fb4b6c58488d79 Mon Sep 17 00:00:00 2001 +From: Jonathan Nieder <jrnieder@gmail.com> +Date: Sun, 1 May 2011 06:29:16 -0300 +Subject: [media] cx88: protect per-device driver list with device + lock + +From: Jonathan Nieder <jrnieder@gmail.com> + +commit 8a317a8760cfffa8185b56ff59fb4b6c58488d79 upstream. + +The BKL conversion of this driver seems to have gone wrong. Various +uses of the sub-device and driver lists appear to be subject to race +conditions. + +In particular, some functions access drvlist without a relevant lock +held, which will race against removal of drivers. Let's start with +that --- clean up by consistently protecting dev->drvlist with +dev->core->lock, noting driver functions that require the device lock +to be held or not to be held. + +After this patch, there are still some races --- e.g., +cx8802_blackbird_remove can run between the time the blackbird driver +is acquired and the time it is used in mpeg_release, and there's a +similar race in cx88_dvb_bus_ctrl. Later patches will address the +remaining known races and the deadlock noticed by Andi. This patch +just makes the semantics clearer in preparation for those later +changes. + +Based on work by Ben Hutchings <ben@decadent.org.uk>. + +Tested-by: Andi Huber <hobrom@gmx.at> +Tested-by: Marlon de Boer <marlon@hyves.nl> +Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/media/video/cx88/cx88-blackbird.c | 3 ++- + drivers/media/video/cx88/cx88-dvb.c | 3 +++ + drivers/media/video/cx88/cx88-mpeg.c | 11 +++++++---- + drivers/media/video/cx88/cx88.h | 9 ++++++++- + 4 files changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/media/video/cx88/cx88-blackbird.c ++++ b/drivers/media/video/cx88/cx88-blackbird.c +@@ -1122,10 +1122,11 @@ static int mpeg_release(struct file *fil + mutex_lock(&dev->core->lock); + file->private_data = NULL; + kfree(fh); +- mutex_unlock(&dev->core->lock); + + /* Make sure we release the hardware */ + drv = cx8802_get_driver(dev, CX88_MPEG_BLACKBIRD); ++ mutex_unlock(&dev->core->lock); ++ + if (drv) + drv->request_release(drv); + +--- a/drivers/media/video/cx88/cx88-dvb.c ++++ b/drivers/media/video/cx88/cx88-dvb.c +@@ -132,7 +132,10 @@ static int cx88_dvb_bus_ctrl(struct dvb_ + return -EINVAL; + } + ++ mutex_lock(&dev->core->lock); + drv = cx8802_get_driver(dev, CX88_MPEG_DVB); ++ mutex_unlock(&dev->core->lock); ++ + if (drv) { + if (acquire){ + dev->frontends.active_fe_id = fe_id; +--- a/drivers/media/video/cx88/cx88-mpeg.c ++++ b/drivers/media/video/cx88/cx88-mpeg.c +@@ -748,6 +748,8 @@ int cx8802_unregister_driver(struct cx88 + dev->pci->subsystem_device, dev->core->board.name, + dev->core->boardnr); + ++ mutex_lock(&dev->core->lock); ++ + list_for_each_entry_safe(d, dtmp, &dev->drvlist, drvlist) { + /* only unregister the correct driver type */ + if (d->type_id != drv->type_id) +@@ -755,15 +757,14 @@ int cx8802_unregister_driver(struct cx88 + + err = d->remove(d); + if (err == 0) { +- mutex_lock(&drv->core->lock); + list_del(&d->drvlist); +- mutex_unlock(&drv->core->lock); + kfree(d); + } else + printk(KERN_ERR "%s/2: cx8802 driver remove " + "failed (%d)\n", dev->core->name, err); + } + ++ mutex_unlock(&dev->core->lock); + } + + return err; +@@ -827,6 +828,8 @@ static void __devexit cx8802_remove(stru + + flush_request_modules(dev); + ++ mutex_lock(&dev->core->lock); ++ + if (!list_empty(&dev->drvlist)) { + struct cx8802_driver *drv, *tmp; + int err; +@@ -838,9 +841,7 @@ static void __devexit cx8802_remove(stru + list_for_each_entry_safe(drv, tmp, &dev->drvlist, drvlist) { + err = drv->remove(drv); + if (err == 0) { +- mutex_lock(&drv->core->lock); + list_del(&drv->drvlist); +- mutex_unlock(&drv->core->lock); + } else + printk(KERN_ERR "%s/2: cx8802 driver remove " + "failed (%d)\n", dev->core->name, err); +@@ -848,6 +849,8 @@ static void __devexit cx8802_remove(stru + } + } + ++ mutex_unlock(&dev->core->lock); ++ + /* Destroy any 8802 reference. */ + dev->core->dvbdev = NULL; + +--- a/drivers/media/video/cx88/cx88.h ++++ b/drivers/media/video/cx88/cx88.h +@@ -496,7 +496,11 @@ struct cx8802_driver { + int (*resume)(struct pci_dev *pci_dev); + + /* MPEG 8802 -> mini driver - Driver probe and configuration */ ++ ++ /* Caller must _not_ hold core->lock */ + int (*probe)(struct cx8802_driver *drv); ++ ++ /* Caller must hold core->lock */ + int (*remove)(struct cx8802_driver *drv); + + /* MPEG 8802 -> mini driver - Access for hardware control */ +@@ -551,8 +555,9 @@ struct cx8802_dev { + /* for switching modulation types */ + unsigned char ts_gen_cntrl; + +- /* List of attached drivers */ ++ /* List of attached drivers; must hold core->lock to access */ + struct list_head drvlist; ++ + struct work_struct request_module_wk; + }; + +@@ -675,6 +680,8 @@ int cx88_audio_thread(void *data); + + int cx8802_register_driver(struct cx8802_driver *drv); + int cx8802_unregister_driver(struct cx8802_driver *drv); ++ ++/* Caller must hold core->lock */ + struct cx8802_driver * cx8802_get_driver(struct cx8802_dev *dev, enum cx88_board_type btype); + + /* ----------------------------------------------------------- */ diff --git a/queue-2.6.38/ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch b/queue-2.6.38/ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch new file mode 100644 index 0000000000..3a855beb40 --- /dev/null +++ b/queue-2.6.38/ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch @@ -0,0 +1,143 @@ +From 8d08dab786ad5cc2aca2bf870de370144b78c85a Mon Sep 17 00:00:00 2001 +From: Tyler Hicks <tyhicks@linux.vnet.ibm.com> +Date: Tue, 17 May 2011 00:50:33 -0500 +Subject: eCryptfs: Allow 2 scatterlist entries for encrypted + filenames + +From: Tyler Hicks <tyhicks@linux.vnet.ibm.com> + +commit 8d08dab786ad5cc2aca2bf870de370144b78c85a upstream. + +The buffers allocated while encrypting and decrypting long filenames can +sometimes straddle two pages. In this situation, virt_to_scatterlist() +will return -ENOMEM, causing the operation to fail and the user will get +scary error messages in their logs: + +kernel: ecryptfs_write_tag_70_packet: Internal error whilst attempting +to convert filename memory to scatterlist; expected rc = 1; got rc = +[-12]. block_aligned_filename_size = [272] +kernel: ecryptfs_encrypt_filename: Error attempting to generate tag 70 +packet; rc = [-12] +kernel: ecryptfs_encrypt_and_encode_filename: Error attempting to +encrypt filename; rc = [-12] +kernel: ecryptfs_lookup: Error attempting to encrypt and encode +filename; rc = [-12] + +The solution is to allow up to 2 scatterlist entries to be used. + +Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/ecryptfs/keystore.c | 46 +++++++++++++++++++++------------------------- + 1 file changed, 21 insertions(+), 25 deletions(-) + +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -492,8 +492,8 @@ struct ecryptfs_write_tag_70_packet_sill + struct mutex *tfm_mutex; + char *block_aligned_filename; + struct ecryptfs_auth_tok *auth_tok; +- struct scatterlist src_sg; +- struct scatterlist dst_sg; ++ struct scatterlist src_sg[2]; ++ struct scatterlist dst_sg[2]; + struct blkcipher_desc desc; + char iv[ECRYPTFS_MAX_IV_BYTES]; + char hash[ECRYPTFS_TAG_70_DIGEST_SIZE]; +@@ -709,23 +709,21 @@ ecryptfs_write_tag_70_packet(char *dest, + memcpy(&s->block_aligned_filename[s->num_rand_bytes], filename, + filename_size); + rc = virt_to_scatterlist(s->block_aligned_filename, +- s->block_aligned_filename_size, &s->src_sg, 1); +- if (rc != 1) { ++ s->block_aligned_filename_size, s->src_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " +- "convert filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " ++ "convert filename memory to scatterlist; rc = [%d]. " + "block_aligned_filename_size = [%zd]\n", __func__, rc, + s->block_aligned_filename_size); + goto out_release_free_unlock; + } + rc = virt_to_scatterlist(&dest[s->i], s->block_aligned_filename_size, +- &s->dst_sg, 1); +- if (rc != 1) { ++ s->dst_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " + "convert encrypted filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " +- "block_aligned_filename_size = [%zd]\n", __func__, rc, +- s->block_aligned_filename_size); ++ "rc = [%d]. block_aligned_filename_size = [%zd]\n", ++ __func__, rc, s->block_aligned_filename_size); + goto out_release_free_unlock; + } + /* The characters in the first block effectively do the job +@@ -748,7 +746,7 @@ ecryptfs_write_tag_70_packet(char *dest, + mount_crypt_stat->global_default_fn_cipher_key_bytes); + goto out_release_free_unlock; + } +- rc = crypto_blkcipher_encrypt_iv(&s->desc, &s->dst_sg, &s->src_sg, ++ rc = crypto_blkcipher_encrypt_iv(&s->desc, s->dst_sg, s->src_sg, + s->block_aligned_filename_size); + if (rc) { + printk(KERN_ERR "%s: Error attempting to encrypt filename; " +@@ -782,8 +780,8 @@ struct ecryptfs_parse_tag_70_packet_sill + struct mutex *tfm_mutex; + char *decrypted_filename; + struct ecryptfs_auth_tok *auth_tok; +- struct scatterlist src_sg; +- struct scatterlist dst_sg; ++ struct scatterlist src_sg[2]; ++ struct scatterlist dst_sg[2]; + struct blkcipher_desc desc; + char fnek_sig_hex[ECRYPTFS_SIG_SIZE_HEX + 1]; + char iv[ECRYPTFS_MAX_IV_BYTES]; +@@ -890,13 +888,12 @@ ecryptfs_parse_tag_70_packet(char **file + } + mutex_lock(s->tfm_mutex); + rc = virt_to_scatterlist(&data[(*packet_size)], +- s->block_aligned_filename_size, &s->src_sg, 1); +- if (rc != 1) { ++ s->block_aligned_filename_size, s->src_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " + "convert encrypted filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " +- "block_aligned_filename_size = [%zd]\n", __func__, rc, +- s->block_aligned_filename_size); ++ "rc = [%d]. block_aligned_filename_size = [%zd]\n", ++ __func__, rc, s->block_aligned_filename_size); + goto out_unlock; + } + (*packet_size) += s->block_aligned_filename_size; +@@ -910,13 +907,12 @@ ecryptfs_parse_tag_70_packet(char **file + goto out_unlock; + } + rc = virt_to_scatterlist(s->decrypted_filename, +- s->block_aligned_filename_size, &s->dst_sg, 1); +- if (rc != 1) { ++ s->block_aligned_filename_size, s->dst_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " + "convert decrypted filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " +- "block_aligned_filename_size = [%zd]\n", __func__, rc, +- s->block_aligned_filename_size); ++ "rc = [%d]. block_aligned_filename_size = [%zd]\n", ++ __func__, rc, s->block_aligned_filename_size); + goto out_free_unlock; + } + /* The characters in the first block effectively do the job of +@@ -956,7 +952,7 @@ ecryptfs_parse_tag_70_packet(char **file + mount_crypt_stat->global_default_fn_cipher_key_bytes); + goto out_free_unlock; + } +- rc = crypto_blkcipher_decrypt_iv(&s->desc, &s->dst_sg, &s->src_sg, ++ rc = crypto_blkcipher_decrypt_iv(&s->desc, s->dst_sg, s->src_sg, + s->block_aligned_filename_size); + if (rc) { + printk(KERN_ERR "%s: Error attempting to decrypt filename; " diff --git a/queue-2.6.38/ohci-fix-regression-caused-by-nvidia-shutdown-workaround.patch b/queue-2.6.38/ohci-fix-regression-caused-by-nvidia-shutdown-workaround.patch new file mode 100644 index 0000000000..0e4d02433d --- /dev/null +++ b/queue-2.6.38/ohci-fix-regression-caused-by-nvidia-shutdown-workaround.patch @@ -0,0 +1,68 @@ +From 2b7aaf503d56216b847c8265421d2a7d9b42df3e Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Mon, 16 May 2011 12:15:19 -0400 +Subject: OHCI: fix regression caused by nVidia shutdown workaround + +From: Alan Stern <stern@rowland.harvard.edu> + +commit 2b7aaf503d56216b847c8265421d2a7d9b42df3e upstream. + +This patch (as1463) fixes a regression caused by commit +3df7169e73fc1d71a39cffeacc969f6840cdf52b (OHCI: work around for nVidia +shutdown problem). + +The original problem encountered by people using NVIDIA chipsets was +that USB devices were not turning off when the system shut down. For +example, the LED on an optical mouse would remain on, draining a +laptop's battery. The problem was caused by a bug in the chipset; an +OHCI controller in the Reset state would continue to drive a bus reset +signal even after system shutdown. The workaround was to put the +controllers into the Suspend state instead. + +It turns out that later NVIDIA chipsets do not suffer from this bug. +Instead some have the opposite bug: If a system is shut down while an +OHCI controller is in the Suspend state, USB devices remain powered! +On other systems, shutting down with a Suspended controller causes the +system to reboot immediately. Thus, working around the original bug +on some machines exposes other bugs on other machines. + +The best solution seems to be to limit the workaround to OHCI +controllers with a low-numbered PCI product ID. I don't know exactly +at what point NVIDIA changed their chipsets; the value used here is a +guess. So far it was worked out okay for all the people who have +tested it. + +This fixes Bugzilla #35032. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Tested-by: Andre "Osku" Schmidt <andre.osku.schmidt@googlemail.com> +Tested-by: Yury Siamashka <yurand2@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/ohci-pci.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ohci-pci.c ++++ b/drivers/usb/host/ohci-pci.c +@@ -207,10 +207,18 @@ static int ohci_quirk_amd700(struct usb_ + */ + static int ohci_quirk_nvidia_shutdown(struct usb_hcd *hcd) + { ++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); + struct ohci_hcd *ohci = hcd_to_ohci(hcd); + +- ohci->flags |= OHCI_QUIRK_SHUTDOWN; +- ohci_dbg(ohci, "enabled nVidia shutdown quirk\n"); ++ /* Evidently nVidia fixed their later hardware; this is a guess at ++ * the changeover point. ++ */ ++#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB 0x026d ++ ++ if (pdev->device < PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_USB) { ++ ohci->flags |= OHCI_QUIRK_SHUTDOWN; ++ ohci_dbg(ohci, "enabled nVidia shutdown quirk\n"); ++ } + + return 0; + } diff --git a/queue-2.6.38/p54usb-add-zoom-4410-usbid.patch b/queue-2.6.38/p54usb-add-zoom-4410-usbid.patch new file mode 100644 index 0000000000..979aaea9c1 --- /dev/null +++ b/queue-2.6.38/p54usb-add-zoom-4410-usbid.patch @@ -0,0 +1,28 @@ +From 9368a9a2378ab721f82f59430a135b4ce4ff5109 Mon Sep 17 00:00:00 2001 +From: Christian Lamparter <chunkeey@googlemail.com> +Date: Fri, 13 May 2011 21:47:23 +0200 +Subject: p54usb: add zoom 4410 usbid + +From: Christian Lamparter <chunkeey@googlemail.com> + +commit 9368a9a2378ab721f82f59430a135b4ce4ff5109 upstream. + +Reported-by: Mark Davis <marked86@gmail.com> +Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/p54/p54usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/p54/p54usb.c ++++ b/drivers/net/wireless/p54/p54usb.c +@@ -82,6 +82,7 @@ static struct usb_device_id p54u_table[] + {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */ + {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */ + {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */ ++ {USB_DEVICE(0x083a, 0xc501)}, /* Zoom Wireless-G 4410 */ + {USB_DEVICE(0x083a, 0xf503)}, /* Accton FD7050E ver 1010ec */ + {USB_DEVICE(0x0846, 0x4240)}, /* Netgear WG111 (v2) */ + {USB_DEVICE(0x0915, 0x2000)}, /* Cohiba Proto board */ diff --git a/queue-2.6.38/series b/queue-2.6.38/series index aa320247a2..1783f01e05 100644 --- a/queue-2.6.38/series +++ b/queue-2.6.38/series @@ -100,3 +100,26 @@ mm-page_alloc.c-prevent-unending-loop-in.patch loop-limit-max_part-module-param-to-disk_max_parts.patch loop-handle-on-demand-devices-correctly.patch i2c-writing-clients-fix-foo_driver.id_table.patch +usb-cp210x-add-4-device-ids-for-ac-services-devices.patch +usb-moto_modem-add-usb-identifier-for-the-motorola-ve240.patch +usb-serial-ftdi_sio-adding-support-for-tavir-stk500.patch +usb-gadget-g_multi-fixed-vendor-and-product-id-in-inf.patch +usb-gamin_gps-fix-for-data-transfer-problems-in-native.patch +bind-only-modem-at-command-endpoint-to-option-module.patch +usb-cdc_acm-fix-oops-when-droids-muin-lcd-is-connected.patch +xhci-fix-bug-in-control-transfer-cancellation.patch +usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch +usb-gadget-rndis-don-t-test-against-req-length.patch +xhci-fix-full-speed-binterval-encoding.patch +xhci-fix-memory-leak-in-ring-cache-deallocation.patch +xhci-fix-memory-leak-bug-when-dropping-endpoints.patch +usb-option-add-support-for-huawei-e353-device.patch +ohci-fix-regression-caused-by-nvidia-shutdown-workaround.patch +usb-remove-remaining-usages-of-hcd-state-from-usbcore-and.patch +cx88-protect-per-device-driver-list-with-device.patch +cx88-fix-locking-of-sub-driver-operations.patch +cx88-hold-device-lock-during-sub-driver.patch +sh-clkfwk-fixup-clk_rate_table_build-parameter-in-div6.patch +sh-fixup-fpu.o-compile-order.patch +p54usb-add-zoom-4410-usbid.patch +ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch diff --git a/queue-2.6.38/sh-clkfwk-fixup-clk_rate_table_build-parameter-in-div6.patch b/queue-2.6.38/sh-clkfwk-fixup-clk_rate_table_build-parameter-in-div6.patch new file mode 100644 index 0000000000..4a78dfa440 --- /dev/null +++ b/queue-2.6.38/sh-clkfwk-fixup-clk_rate_table_build-parameter-in-div6.patch @@ -0,0 +1,33 @@ +From 52c10ad22b7e317960b4d411c9a9ddeaf3d5ae39 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> +Date: Thu, 14 Apr 2011 17:13:53 +0900 +Subject: sh: clkfwk: fixup clk_rate_table_build parameter in div6 + clock + +From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> + +commit 52c10ad22b7e317960b4d411c9a9ddeaf3d5ae39 upstream. + +div6 clock should not use arch_flags for clk_rate_table_build, +because SH_CLK_DIV6_EXT doesn't care .arch_flags. +clk->freq_table[] will be all CPUFREQ_ENTRY_INVALID without this patch. + +Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> +Signed-off-by: Paul Mundt <lethal@linux-sh.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/sh/clk/cpg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/sh/clk/cpg.c ++++ b/drivers/sh/clk/cpg.c +@@ -105,7 +105,7 @@ static int sh_clk_div6_set_parent(struct + + /* Rebuild the frequency table */ + clk_rate_table_build(clk, clk->freq_table, table->nr_divisors, +- table, &clk->arch_flags); ++ table, NULL); + + return 0; + } diff --git a/queue-2.6.38/sh-fixup-fpu.o-compile-order.patch b/queue-2.6.38/sh-fixup-fpu.o-compile-order.patch new file mode 100644 index 0000000000..26f5fb484c --- /dev/null +++ b/queue-2.6.38/sh-fixup-fpu.o-compile-order.patch @@ -0,0 +1,38 @@ +From a375b15164dd9264f724ad941825e52c90145151 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> +Date: Fri, 15 Apr 2011 16:44:27 +0900 +Subject: sh: fixup fpu.o compile order + +From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> + +commit a375b15164dd9264f724ad941825e52c90145151 upstream. + +arch_ptrace() was modified to reference init_fpu() to fix up xstate +initialization, which overlooked the fact that there are configurations +that don't enable any of hard FPU support or emulation, resulting in +build errors on DSP parts. + +Given that init_fpu() simply sets up the xstate slab cache and is +side-stepped entirely for the DSP case, we can simply always build in the +helper and fix up the references. + +Reported-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org> +Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> +Signed-off-by: Paul Mundt <lethal@linux-sh.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/sh/kernel/cpu/Makefile | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/arch/sh/kernel/cpu/Makefile ++++ b/arch/sh/kernel/cpu/Makefile +@@ -17,7 +17,5 @@ obj-$(CONFIG_ARCH_SHMOBILE) += shmobile/ + + obj-$(CONFIG_SH_ADC) += adc.o + obj-$(CONFIG_SH_CLK_CPG_LEGACY) += clock-cpg.o +-obj-$(CONFIG_SH_FPU) += fpu.o +-obj-$(CONFIG_SH_FPU_EMU) += fpu.o + +-obj-y += irq/ init.o clock.o hwblk.o proc.o ++obj-y += irq/ init.o clock.o fpu.o hwblk.o proc.o diff --git a/queue-2.6.38/usb-cdc_acm-fix-oops-when-droids-muin-lcd-is-connected.patch b/queue-2.6.38/usb-cdc_acm-fix-oops-when-droids-muin-lcd-is-connected.patch new file mode 100644 index 0000000000..b169b3b372 --- /dev/null +++ b/queue-2.6.38/usb-cdc_acm-fix-oops-when-droids-muin-lcd-is-connected.patch @@ -0,0 +1,70 @@ +From fd5054c169d29747a44b4e1419ff47f57ae82dbc Mon Sep 17 00:00:00 2001 +From: Erik Slagter <erik@slagter.name> +Date: Wed, 11 May 2011 12:06:55 +0200 +Subject: USB: cdc_acm: Fix oops when Droids MuIn LCD is connected + +From: Erik Slagter <erik@slagter.name> + +commit fd5054c169d29747a44b4e1419ff47f57ae82dbc upstream. + +The Droids MuIn LCD operates like a serial remote terminal. +Data received are displayed directly on the LCD. This patch +fixes the kernel null pointer oops when it is plugged in. + +Add NO_DATA_INTERFACE quirk to tell the driver that "control" +and "data" interfaces are not separated for this device, which +prevents dereferencing a null pointer in the device probe code. + +Signed-off-by: Erik Slagter <erik@slagter.name> +Signed-off-by: Maxin B. John <maxin.john@gmail.com> +Tested-by: Erik Slagter <erik@slagter.name> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/class/cdc-acm.c | 13 +++++++++++-- + drivers/usb/class/cdc-acm.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -946,7 +946,7 @@ static int acm_probe(struct usb_interfac + u8 ac_management_function = 0; + u8 call_management_function = 0; + int call_interface_num = -1; +- int data_interface_num; ++ int data_interface_num = -1; + unsigned long quirks; + int num_rx_buf; + int i; +@@ -1030,7 +1030,11 @@ next_desc: + if (!union_header) { + if (call_interface_num > 0) { + dev_dbg(&intf->dev, "No union descriptor, using call management descriptor\n"); +- data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num)); ++ /* quirks for Droids MuIn LCD */ ++ if (quirks & NO_DATA_INTERFACE) ++ data_interface = usb_ifnum_to_if(usb_dev, 0); ++ else ++ data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num)); + control_interface = intf; + } else { + if (intf->cur_altsetting->desc.bNumEndpoints != 3) { +@@ -1622,6 +1626,11 @@ static const struct usb_device_id acm_id + .driver_info = NOT_A_MODEM, + }, + ++ /* Support for Droids MuIn LCD */ ++ { USB_DEVICE(0x04d8, 0x000b), ++ .driver_info = NO_DATA_INTERFACE, ++ }, ++ + /* control interfaces without any protocol set */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, + USB_CDC_PROTO_NONE) }, +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -137,3 +137,4 @@ struct acm { + #define SINGLE_RX_URB 2 + #define NO_CAP_LINE 4 + #define NOT_A_MODEM 8 ++#define NO_DATA_INTERFACE 16 diff --git a/queue-2.6.38/usb-cp210x-add-4-device-ids-for-ac-services-devices.patch b/queue-2.6.38/usb-cp210x-add-4-device-ids-for-ac-services-devices.patch new file mode 100644 index 0000000000..a4cb94d6e4 --- /dev/null +++ b/queue-2.6.38/usb-cp210x-add-4-device-ids-for-ac-services-devices.patch @@ -0,0 +1,32 @@ +From 4eff0b40a7174896b860312910e0db51f2dcc567 Mon Sep 17 00:00:00 2001 +From: Craig Shelley <craig@microtron.org.uk> +Date: Sun, 20 Mar 2011 13:51:13 +0000 +Subject: USB: CP210x Add 4 Device IDs for AC-Services Devices + +From: Craig Shelley <craig@microtron.org.uk> + +commit 4eff0b40a7174896b860312910e0db51f2dcc567 upstream. + +This patch adds 4 device IDs for CP2102 based devices manufactured by +AC-Services. See http://www.ac-services.eu for further info. + +Signed-off-by: Craig Shelley <craig@microtron.org.uk> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/cp210x.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -113,6 +113,10 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ + { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ ++ { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ ++ { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ ++ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ ++ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ diff --git a/queue-2.6.38/usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch b/queue-2.6.38/usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch new file mode 100644 index 0000000000..e446d0558a --- /dev/null +++ b/queue-2.6.38/usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch @@ -0,0 +1,30 @@ +From bf1f0a05d472e33dda8e5e69525be1584cdbd03a Mon Sep 17 00:00:00 2001 +From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> +Date: Fri, 13 May 2011 17:03:02 +0200 +Subject: usb/gadget: at91sam9g20 fix end point max packet size + +From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> + +commit bf1f0a05d472e33dda8e5e69525be1584cdbd03a upstream. + +on 9g20 they are the same as the 9260 + +Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> +Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/gadget/at91_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/at91_udc.c ++++ b/drivers/usb/gadget/at91_udc.c +@@ -1767,7 +1767,7 @@ static int __init at91udc_probe(struct p + } + + /* newer chips have more FIFO memory than rm9200 */ +- if (cpu_is_at91sam9260()) { ++ if (cpu_is_at91sam9260() || cpu_is_at91sam9g20()) { + udc->ep[0].maxpacket = 64; + udc->ep[3].maxpacket = 64; + udc->ep[4].maxpacket = 512; diff --git a/queue-2.6.38/usb-gadget-g_multi-fixed-vendor-and-product-id-in-inf.patch b/queue-2.6.38/usb-gadget-g_multi-fixed-vendor-and-product-id-in-inf.patch new file mode 100644 index 0000000000..22802b2735 --- /dev/null +++ b/queue-2.6.38/usb-gadget-g_multi-fixed-vendor-and-product-id-in-inf.patch @@ -0,0 +1,60 @@ +From 7701846fd52f86dffe50715e0e63154088b7c982 Mon Sep 17 00:00:00 2001 +From: Michal Nazarewicz <mina86@mina86.com> +Date: Tue, 26 Apr 2011 19:08:36 +0200 +Subject: USB: gadget: g_multi: fixed vendor and product ID in inf + files + +From: Michal Nazarewicz <mina86@mina86.com> + +commit 7701846fd52f86dffe50715e0e63154088b7c982 upstream. + +Commit 1c6529e92b "USB: gadget: g_multi: fixed vendor and +product ID" replaced g_multi's vendor and product ID with +proper ID's from Linux Foundation. This commit now updates +INF files in the Documentation/usb directory which were +omitted in the original commit. + +Signed-off-by: Michal Nazarewicz <mina86@mina86.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + Documentation/usb/linux-cdc-acm.inf | 4 ++-- + Documentation/usb/linux.inf | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/Documentation/usb/linux-cdc-acm.inf ++++ b/Documentation/usb/linux-cdc-acm.inf +@@ -90,10 +90,10 @@ ServiceBinary=%12%\USBSER.sys + [SourceDisksFiles] + [SourceDisksNames] + [DeviceList] +-%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_0525&PID_A4AB&MI_02 ++%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_1D6B&PID_0104&MI_02 + + [DeviceList.NTamd64] +-%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_0525&PID_A4AB&MI_02 ++%DESCRIPTION%=DriverInstall, USB\VID_0525&PID_A4A7, USB\VID_1D6B&PID_0104&MI_02 + + + ;------------------------------------------------------------------------------ +--- a/Documentation/usb/linux.inf ++++ b/Documentation/usb/linux.inf +@@ -18,15 +18,15 @@ DriverVer = 06/21/2006,6.0.600 + + ; Decoration for x86 architecture + [LinuxDevices.NTx86] +-%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00 ++%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00 + + ; Decoration for x64 architecture + [LinuxDevices.NTamd64] +-%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00 ++%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00 + + ; Decoration for ia64 architecture + [LinuxDevices.NTia64] +-%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_0525&PID_a4ab&MI_00 ++%LinuxDevice% = RNDIS.NT.5.1, USB\VID_0525&PID_a4a2, USB\VID_1d6b&PID_0104&MI_00 + + ;@@@ This is the common setting for setup + [ControlFlags] diff --git a/queue-2.6.38/usb-gadget-rndis-don-t-test-against-req-length.patch b/queue-2.6.38/usb-gadget-rndis-don-t-test-against-req-length.patch new file mode 100644 index 0000000000..f878fa39c1 --- /dev/null +++ b/queue-2.6.38/usb-gadget-rndis-don-t-test-against-req-length.patch @@ -0,0 +1,38 @@ +From 472b91274a6c6857877b5caddb875dcb5ecdfcb8 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi <balbi@ti.com> +Date: Fri, 13 May 2011 16:53:48 +0300 +Subject: usb: gadget: rndis: don't test against req->length + +From: Felipe Balbi <balbi@ti.com> + +commit 472b91274a6c6857877b5caddb875dcb5ecdfcb8 upstream. + +composite.c always sets req->length to zero +and expects function driver's setup handlers +to return the amount of bytes to be used +on req->length. If we test against req->length +w_length will always be greater than req->length +thus making us always stall that particular +SEND_ENCAPSULATED_COMMAND request. + +Tested against a Windows XP SP3. + +Signed-off-by: Felipe Balbi <balbi@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/gadget/f_rndis.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/gadget/f_rndis.c ++++ b/drivers/usb/gadget/f_rndis.c +@@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, cons + */ + case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8) + | USB_CDC_SEND_ENCAPSULATED_COMMAND: +- if (w_length > req->length || w_value +- || w_index != rndis->ctrl_id) ++ if (w_value || w_index != rndis->ctrl_id) + goto invalid; + /* read the request; process it later */ + value = w_length; diff --git a/queue-2.6.38/usb-gamin_gps-fix-for-data-transfer-problems-in-native.patch b/queue-2.6.38/usb-gamin_gps-fix-for-data-transfer-problems-in-native.patch new file mode 100644 index 0000000000..28031fbc4e --- /dev/null +++ b/queue-2.6.38/usb-gamin_gps-fix-for-data-transfer-problems-in-native.patch @@ -0,0 +1,115 @@ +From b4026c4584cd70858d4d3450abfb1cd0714d4f32 Mon Sep 17 00:00:00 2001 +From: Hermann Kneissel <herkne@gmx.de> +Date: Fri, 29 Apr 2011 08:58:43 +0200 +Subject: USB: gamin_gps: Fix for data transfer problems in native + mode + +From: Hermann Kneissel <herkne@gmx.de> + +commit b4026c4584cd70858d4d3450abfb1cd0714d4f32 upstream. + +This patch fixes a problem where data received from the gps is sometimes +transferred incompletely to the serial port. If used in native mode now +all data received via the bulk queue will be forwarded to the serial +port. + +Signed-off-by: Hermann Kneissel <herkne@gmx.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/garmin_gps.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/usb/serial/garmin_gps.c ++++ b/drivers/usb/serial/garmin_gps.c +@@ -1,7 +1,7 @@ + /* + * Garmin GPS driver + * +- * Copyright (C) 2006-2009 Hermann Kneissel herkne@users.sourceforge.net ++ * Copyright (C) 2006-2011 Hermann Kneissel herkne@gmx.de + * + * The latest version of the driver can be found at + * http://sourceforge.net/projects/garmin-gps/ +@@ -51,7 +51,7 @@ static int debug; + */ + + #define VERSION_MAJOR 0 +-#define VERSION_MINOR 33 ++#define VERSION_MINOR 36 + + #define _STR(s) #s + #define _DRIVER_VERSION(a, b) "v" _STR(a) "." _STR(b) +@@ -410,6 +410,7 @@ static int gsp_send_ack(struct garmin_da + */ + static int gsp_rec_packet(struct garmin_data *garmin_data_p, int count) + { ++ unsigned long flags; + const __u8 *recpkt = garmin_data_p->inbuffer+GSP_INITIAL_OFFSET; + __le32 *usbdata = (__le32 *) garmin_data_p->inbuffer; + +@@ -458,7 +459,9 @@ static int gsp_rec_packet(struct garmin_ + /* if this was an abort-transfer command, flush all + queued data. */ + if (isAbortTrfCmnd(garmin_data_p->inbuffer)) { ++ spin_lock_irqsave(&garmin_data_p->lock, flags); + garmin_data_p->flags |= FLAGS_DROP_DATA; ++ spin_unlock_irqrestore(&garmin_data_p->lock, flags); + pkt_clear(garmin_data_p); + } + +@@ -943,7 +946,7 @@ static int garmin_open(struct tty_struct + spin_lock_irqsave(&garmin_data_p->lock, flags); + garmin_data_p->mode = initial_mode; + garmin_data_p->count = 0; +- garmin_data_p->flags = 0; ++ garmin_data_p->flags &= FLAGS_SESSION_REPLY1_SEEN; + spin_unlock_irqrestore(&garmin_data_p->lock, flags); + + /* shutdown any bulk reads that might be going on */ +@@ -1178,7 +1181,8 @@ static int garmin_write_room(struct tty_ + + + static void garmin_read_process(struct garmin_data *garmin_data_p, +- unsigned char *data, unsigned data_length) ++ unsigned char *data, unsigned data_length, ++ int bulk_data) + { + unsigned long flags; + +@@ -1193,7 +1197,8 @@ static void garmin_read_process(struct g + send it directly to the tty port */ + if (garmin_data_p->flags & FLAGS_QUEUING) { + pkt_add(garmin_data_p, data, data_length); +- } else if (getLayerId(data) == GARMIN_LAYERID_APPL) { ++ } else if (bulk_data || ++ getLayerId(data) == GARMIN_LAYERID_APPL) { + + spin_lock_irqsave(&garmin_data_p->lock, flags); + garmin_data_p->flags |= APP_RESP_SEEN; +@@ -1237,7 +1242,7 @@ static void garmin_read_bulk_callback(st + usb_serial_debug_data(debug, &port->dev, + __func__, urb->actual_length, data); + +- garmin_read_process(garmin_data_p, data, urb->actual_length); ++ garmin_read_process(garmin_data_p, data, urb->actual_length, 1); + + if (urb->actual_length == 0 && + 0 != (garmin_data_p->flags & FLAGS_BULK_IN_RESTART)) { +@@ -1346,7 +1351,7 @@ static void garmin_read_int_callback(str + __func__, garmin_data_p->serial_num); + } + +- garmin_read_process(garmin_data_p, data, urb->actual_length); ++ garmin_read_process(garmin_data_p, data, urb->actual_length, 0); + + port->interrupt_in_urb->dev = port->serial->dev; + retval = usb_submit_urb(urb, GFP_ATOMIC); +@@ -1461,6 +1466,7 @@ static int garmin_attach(struct usb_seri + garmin_data_p->timer.function = timeout_handler; + garmin_data_p->port = port; + garmin_data_p->state = 0; ++ garmin_data_p->flags = 0; + garmin_data_p->count = 0; + usb_set_serial_port_data(port, garmin_data_p); + diff --git a/queue-2.6.38/usb-moto_modem-add-usb-identifier-for-the-motorola-ve240.patch b/queue-2.6.38/usb-moto_modem-add-usb-identifier-for-the-motorola-ve240.patch new file mode 100644 index 0000000000..89380eec65 --- /dev/null +++ b/queue-2.6.38/usb-moto_modem-add-usb-identifier-for-the-motorola-ve240.patch @@ -0,0 +1,29 @@ +From 3938a0b32dc12229e76735679b37095bc2bc1578 Mon Sep 17 00:00:00 2001 +From: Elizabeth Jennifer Myers <elizabeth@sporksirc.net> +Date: Sat, 16 Apr 2011 14:49:51 -0400 +Subject: USB: moto_modem: Add USB identifier for the Motorola VE240. + +From: Elizabeth Jennifer Myers <elizabeth@sporksirc.net> + +commit 3938a0b32dc12229e76735679b37095bc2bc1578 upstream. + +Tested on my phone, the ttyUSB device is created and is fully +functional. + +Signed-off-by: Elizabeth Jennifer Myers <elizabeth@sporksirc.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/moto_modem.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/moto_modem.c ++++ b/drivers/usb/serial/moto_modem.c +@@ -25,6 +25,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */ + { USB_DEVICE(0x0c44, 0x0022) }, /* unknown Mororola phone */ + { USB_DEVICE(0x22b8, 0x2a64) }, /* Motorola KRZR K1m */ ++ { USB_DEVICE(0x22b8, 0x2c84) }, /* Motorola VE240 phone */ + { USB_DEVICE(0x22b8, 0x2c64) }, /* Motorola V950 phone */ + { }, + }; diff --git a/queue-2.6.38/usb-option-add-support-for-huawei-e353-device.patch b/queue-2.6.38/usb-option-add-support-for-huawei-e353-device.patch new file mode 100644 index 0000000000..17a3cd877a --- /dev/null +++ b/queue-2.6.38/usb-option-add-support-for-huawei-e353-device.patch @@ -0,0 +1,46 @@ +From 610ba42f29c3dfa46a05ff8c2cadc29f544ff76d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marcin=20Ga=C5=82czy=C5=84ski?= <marcin@galczynski.pl> +Date: Sun, 15 May 2011 11:41:54 +0200 +Subject: USB: option: add support for Huawei E353 device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Marcin=20Ga=C5=82czy=C5=84ski?= <marcin@galczynski.pl> + +commit 610ba42f29c3dfa46a05ff8c2cadc29f544ff76d upstream. + +I am sharing patch to the devices/usb/serial/option.c. This allows +operation of Huawei E353 broadband modem using the “option” driver. The +patch simply adds new constant with proper product ID and an entry to +usb_device_id. I worked on the 2.6.38.6 sources. Tested on Dell inspiron +1764 (i3 core cpu) and brand new Huawei E353 modem, Fedora 15 beta. + +Looking at the type of change, i doubt it has potential to introduce +problems in other parts of kernel or the driver itself. + +Signed-off-by: Marcin Galczynski <marcin@galczynski.pl> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -149,6 +149,7 @@ static void option_instat_callback(struc + #define HUAWEI_PRODUCT_K3765 0x1465 + #define HUAWEI_PRODUCT_E14AC 0x14AC + #define HUAWEI_PRODUCT_ETS1220 0x1803 ++#define HUAWEI_PRODUCT_E353 0x1506 + + #define QUANTA_VENDOR_ID 0x0408 + #define QUANTA_PRODUCT_Q101 0xEA02 +@@ -532,6 +533,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) }, diff --git a/queue-2.6.38/usb-remove-remaining-usages-of-hcd-state-from-usbcore-and.patch b/queue-2.6.38/usb-remove-remaining-usages-of-hcd-state-from-usbcore-and.patch new file mode 100644 index 0000000000..0e1765286e --- /dev/null +++ b/queue-2.6.38/usb-remove-remaining-usages-of-hcd-state-from-usbcore-and.patch @@ -0,0 +1,192 @@ +From 69fff59de4d844f8b4c2454c3c23d32b69dcbfd7 Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Tue, 17 May 2011 17:27:12 -0400 +Subject: USB: remove remaining usages of hcd->state from usbcore and + fix regression + +From: Alan Stern <stern@rowland.harvard.edu> + +commit 69fff59de4d844f8b4c2454c3c23d32b69dcbfd7 upstream. + +This patch (as1467) removes the last usages of hcd->state from +usbcore. We no longer check to see if an interrupt handler finds that +a controller has died; instead we rely on host controller drivers to +make an explicit call to usb_hc_died(). + +This fixes a regression introduced by commit +9b37596a2e860404503a3f2a6513db60c296bfdc (USB: move usbcore away from +hcd->state). It used to be that when a controller shared an IRQ with +another device and an interrupt arrived while hcd->state was set to +HC_STATE_HALT, the interrupt handler would be skipped. The commit +removed that test; as a result the current code doesn't skip calling +the handler and ends up believing the controller has died, even though +it's only temporarily stopped. The solution is to ignore HC_STATE_HALT +following the handler's return. + +As a consequence of this change, several of the host controller +drivers need to be modified. They can no longer implicitly rely on +usbcore realizing that a controller has died because of hcd->state. +The patch adds calls to usb_hc_died() in the appropriate places. + +The patch also changes a few of the interrupt handlers. They don't +expect to be called when hcd->state is equal to HC_STATE_HALT, even if +the controller is still alive. Early returns were added to avoid any +confusion. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Tested-by: Manuel Lauss <manuel.lauss@googlemail.com> +CC: Rodolfo Giometti <giometti@linux.it> +CC: Olav Kongas <ok@artecdesign.ee> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/core/hcd.c | 5 +---- + drivers/usb/host/ehci-hcd.c | 4 +++- + drivers/usb/host/ehci-sched.c | 8 ++++++-- + drivers/usb/host/isp116x-hcd.c | 1 + + drivers/usb/host/ohci-hcd.c | 4 +++- + drivers/usb/host/oxu210hp-hcd.c | 6 +++++- + 6 files changed, 19 insertions(+), 9 deletions(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -983,7 +983,7 @@ static int register_root_hub(struct usb_ + spin_unlock_irq (&hcd_root_hub_lock); + + /* Did the HC die before the root hub was registered? */ +- if (HCD_DEAD(hcd) || hcd->state == HC_STATE_HALT) ++ if (HCD_DEAD(hcd)) + usb_hc_died (hcd); /* This time clean up */ + } + +@@ -2103,9 +2103,6 @@ irqreturn_t usb_hcd_irq (int irq, void * + rc = IRQ_NONE; + } else { + set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags); +- +- if (unlikely(hcd->state == HC_STATE_HALT)) +- usb_hc_died(hcd); + rc = IRQ_HANDLED; + } + +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -776,8 +776,9 @@ static irqreturn_t ehci_irq (struct usb_ + goto dead; + } + ++ /* Shared IRQ? */ + masked_status = status & INTR_MASK; +- if (!masked_status) { /* irq sharing? */ ++ if (!masked_status || unlikely(hcd->state == HC_STATE_HALT)) { + spin_unlock(&ehci->lock); + return IRQ_NONE; + } +@@ -872,6 +873,7 @@ static irqreturn_t ehci_irq (struct usb_ + dead: + ehci_reset(ehci); + ehci_writel(ehci, 0, &ehci->regs->configured_flag); ++ usb_hc_died(hcd); + /* generic layer kills/unlinks all urbs, then + * uses ehci_stop to clean up the rest + */ +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -471,8 +471,10 @@ static int enable_periodic (struct ehci_ + */ + status = handshake_on_error_set_halt(ehci, &ehci->regs->status, + STS_PSS, 0, 9 * 125); +- if (status) ++ if (status) { ++ usb_hc_died(ehci_to_hcd(ehci)); + return status; ++ } + + cmd = ehci_readl(ehci, &ehci->regs->command) | CMD_PSE; + ehci_writel(ehci, cmd, &ehci->regs->command); +@@ -510,8 +512,10 @@ static int disable_periodic (struct ehci + */ + status = handshake_on_error_set_halt(ehci, &ehci->regs->status, + STS_PSS, STS_PSS, 9 * 125); +- if (status) ++ if (status) { ++ usb_hc_died(ehci_to_hcd(ehci)); + return status; ++ } + + cmd = ehci_readl(ehci, &ehci->regs->command) & ~CMD_PSE; + ehci_writel(ehci, cmd, &ehci->regs->command); +--- a/drivers/usb/host/isp116x-hcd.c ++++ b/drivers/usb/host/isp116x-hcd.c +@@ -612,6 +612,7 @@ static irqreturn_t isp116x_irq(struct us + /* IRQ's are off, we do no DMA, + perfectly ready to die ... */ + hcd->state = HC_STATE_HALT; ++ usb_hc_died(hcd); + ret = IRQ_HANDLED; + goto done; + } +--- a/drivers/usb/host/ohci-hcd.c ++++ b/drivers/usb/host/ohci-hcd.c +@@ -773,6 +773,7 @@ static irqreturn_t ohci_irq (struct usb_ + if (ints == ~(u32)0) { + disable (ohci); + ohci_dbg (ohci, "device removed!\n"); ++ usb_hc_died(hcd); + return IRQ_HANDLED; + } + +@@ -780,7 +781,7 @@ static irqreturn_t ohci_irq (struct usb_ + ints &= ohci_readl(ohci, ®s->intrenable); + + /* interrupt for some other device? */ +- if (ints == 0) ++ if (ints == 0 || unlikely(hcd->state == HC_STATE_HALT)) + return IRQ_NOTMINE; + + if (ints & OHCI_INTR_UE) { +@@ -797,6 +798,7 @@ static irqreturn_t ohci_irq (struct usb_ + } else { + disable (ohci); + ohci_err (ohci, "OHCI Unrecoverable Error, disabled\n"); ++ usb_hc_died(hcd); + } + + ohci_dump (ohci, 1); +--- a/drivers/usb/host/oxu210hp-hcd.c ++++ b/drivers/usb/host/oxu210hp-hcd.c +@@ -1884,6 +1884,7 @@ static int enable_periodic(struct oxu_hc + status = handshake(oxu, &oxu->regs->status, STS_PSS, 0, 9 * 125); + if (status != 0) { + oxu_to_hcd(oxu)->state = HC_STATE_HALT; ++ usb_hc_died(oxu_to_hcd(oxu)); + return status; + } + +@@ -1909,6 +1910,7 @@ static int disable_periodic(struct oxu_h + status = handshake(oxu, &oxu->regs->status, STS_PSS, STS_PSS, 9 * 125); + if (status != 0) { + oxu_to_hcd(oxu)->state = HC_STATE_HALT; ++ usb_hc_died(oxu_to_hcd(oxu)); + return status; + } + +@@ -2449,8 +2451,9 @@ static irqreturn_t oxu210_hcd_irq(struct + goto dead; + } + ++ /* Shared IRQ? */ + status &= INTR_MASK; +- if (!status) { /* irq sharing? */ ++ if (!status || unlikely(hcd->state == HC_STATE_HALT)) { + spin_unlock(&oxu->lock); + return IRQ_NONE; + } +@@ -2516,6 +2519,7 @@ static irqreturn_t oxu210_hcd_irq(struct + dead: + ehci_reset(oxu); + writel(0, &oxu->regs->configured_flag); ++ usb_hc_died(hcd); + /* generic layer kills/unlinks all urbs, then + * uses oxu_stop to clean up the rest + */ diff --git a/queue-2.6.38/usb-serial-ftdi_sio-adding-support-for-tavir-stk500.patch b/queue-2.6.38/usb-serial-ftdi_sio-adding-support-for-tavir-stk500.patch new file mode 100644 index 0000000000..49316951d9 --- /dev/null +++ b/queue-2.6.38/usb-serial-ftdi_sio-adding-support-for-tavir-stk500.patch @@ -0,0 +1,47 @@ +From 37909fe588c9e09ab57cd267e98678a17ceda64a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Benedek=20L=C3=A1szl=C3=B3?= <benedekl@gmail.com> +Date: Wed, 20 Apr 2011 03:22:21 +0200 +Subject: USB: serial: ftdi_sio: adding support for TavIR STK500 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Benedek=20L=C3=A1szl=C3=B3?= <benedekl@gmail.com> + +commit 37909fe588c9e09ab57cd267e98678a17ceda64a upstream. + +Adding support for the TavIR STK500 (id 0403:FA33) +Atmel AVR programmer device based on FTDI FT232RL. + +Signed-off-by: Benedek László <benedekl@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 5 +++++ + 2 files changed, 6 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -566,6 +566,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(FTDI_VID, FTDI_IBS_APP70_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, + /* + * ELV devices: + */ +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -491,6 +491,11 @@ + /* www.canusb.com Lawicel CANUSB device (FTDI_VID) */ + #define FTDI_CANUSB_PID 0xFFA8 /* Product Id */ + ++/* ++ * TavIR AVR product ids (FTDI_VID) ++ */ ++#define FTDI_TAVIR_STK500_PID 0xFA33 /* STK500 AVR programmer */ ++ + + + /********************************/ diff --git a/queue-2.6.38/xhci-fix-bug-in-control-transfer-cancellation.patch b/queue-2.6.38/xhci-fix-bug-in-control-transfer-cancellation.patch new file mode 100644 index 0000000000..de195e94ed --- /dev/null +++ b/queue-2.6.38/xhci-fix-bug-in-control-transfer-cancellation.patch @@ -0,0 +1,84 @@ +From 3abeca998a44205cfd837fa0bf1f7c24f8294acb Mon Sep 17 00:00:00 2001 +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Date: Thu, 5 May 2011 19:08:09 -0700 +Subject: xhci: Fix bug in control transfer cancellation. + +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> + +commit 3abeca998a44205cfd837fa0bf1f7c24f8294acb upstream. + +When the xHCI driver attempts to cancel a transfer, it issues a Stop +Endpoint command and waits for the host controller to indicate which TRB +it was in the middle of processing. The host will put an event TRB with +completion code COMP_STOP on the event ring if it stops on a control +transfer TRB (or other types of transfer TRBs). The ring handling code +is supposed to set ep->stopped_trb to the TRB that the host stopped on +when this happens. + +Unfortunately, there is a long-standing bug in the control transfer +completion code. It doesn't actually check to see if COMP_STOP is set +before attempting to process the transfer based on which part of the +control TD completed. So when we get an event on the data phase of the +control TRB with COMP_STOP set, it thinks it's a normal completion of +the transfer and doesn't set ep->stopped_td or ep->stopped_trb. + +When the ring handling code goes on to process the completion of the Stop +Endpoint command, it sees that ep->stopped_trb is not a part of the TD +it's trying to cancel. It thinks the hardware has its enqueue pointer +somewhere further up in the ring, and thinks it's safe to turn the control +TRBs into no-op TRBs. Since the hardware was in the middle of the control +TRBs to be cancelled, the proper software behavior is to issue a Set TR +dequeue pointer command. + +It turns out that the NEC host controllers can handle active TRBs being +set to no-op TRBs after a stop endpoint command, but other host +controllers have issues with this out-of-spec software behavior. Fix this +behavior. + +This patch should be backported to kernels as far back as 2.6.31, but it +may be a bit challenging, since process_ctrl_td() was introduced in some +refactoring done in 2.6.36, and some endian-safe patches added in 2.6.40 +that touch the same lines. + +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/xhci-ring.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1532,6 +1532,9 @@ static int process_ctrl_td(struct xhci_h + else + *status = 0; + break; ++ case COMP_STOP_INVAL: ++ case COMP_STOP: ++ return finish_td(xhci, td, event_trb, event, ep, status, false); + default: + if (!xhci_requires_manual_halt_cleanup(xhci, + ep_ctx, trb_comp_code)) +@@ -1576,15 +1579,12 @@ static int process_ctrl_td(struct xhci_h + } + } else { + /* Maybe the event was for the data stage? */ +- if (trb_comp_code != COMP_STOP_INVAL) { +- /* We didn't stop on a link TRB in the middle */ +- td->urb->actual_length = +- td->urb->transfer_buffer_length - +- TRB_LEN(event->transfer_len); +- xhci_dbg(xhci, "Waiting for status " +- "stage event\n"); +- return 0; +- } ++ td->urb->actual_length = ++ td->urb->transfer_buffer_length - ++ TRB_LEN(le32_to_cpu(event->transfer_len)); ++ xhci_dbg(xhci, "Waiting for status " ++ "stage event\n"); ++ return 0; + } + } + diff --git a/queue-2.6.38/xhci-fix-full-speed-binterval-encoding.patch b/queue-2.6.38/xhci-fix-full-speed-binterval-encoding.patch new file mode 100644 index 0000000000..629d0ca8f4 --- /dev/null +++ b/queue-2.6.38/xhci-fix-full-speed-binterval-encoding.patch @@ -0,0 +1,63 @@ +From b513d44751bfb609a3c20463f764c8ce822d63e9 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Date: Fri, 13 May 2011 13:10:01 -0700 +Subject: xhci: Fix full speed bInterval encoding. + +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> + +commit b513d44751bfb609a3c20463f764c8ce822d63e9 upstream. + +Dmitry's patch + +dfa49c4ad120a784ef1ff0717168aa79f55a483a USB: xhci - fix math in xhci_get_endpoint_interval() + +introduced a bug. The USB 2.0 spec says that full speed isochronous endpoints' +bInterval must be decoded as an exponent to a power of two (e.g. interval = +2^(bInterval - 1)). Full speed interrupt endpoints, on the other hand, don't +use exponents, and the interval in frames is encoded straight into bInterval. + +Dmitry's patch was supposed to fix up the full speed isochronous to parse +bInterval as an exponent, but instead it changed the *interrupt* endpoint +bInterval decoding. The isochronous endpoint encoding was the same. + +This caused full speed devices with interrupt endpoints (including mice, hubs, +and USB to ethernet devices) to fail under NEC 0.96 xHCI host controllers: + +[ 100.909818] xhci_hcd 0000:06:00.0: add ep 0x83, slot id 1, new drop flags = 0x0, new add flags = 0x99, new slot info = 0x38100000 +[ 100.909821] xhci_hcd 0000:06:00.0: xhci_check_bandwidth called for udev ffff88011f0ea000 +... +[ 100.910187] xhci_hcd 0000:06:00.0: ERROR: unexpected command completion code 0x11. +[ 100.910190] xhci_hcd 0000:06:00.0: xhci_reset_bandwidth called for udev ffff88011f0ea000 + +When the interrupt endpoint was added and a Configure Endpoint command was +issued to the host, the host controller would return a very odd error message +(0x11 means "Slot Not Enabled", which isn't true because the slot was enabled). +Probably the host controller was getting very confused with the bad encoding. + +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Cc: Dmitry Torokhov <dtor@vmware.com> +Reported-by: Thomas Lindroth <thomas.lindroth@gmail.com> +Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/xhci-mem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -992,12 +992,12 @@ static inline unsigned int xhci_get_endp + break; + + case USB_SPEED_FULL: +- if (usb_endpoint_xfer_int(&ep->desc)) { ++ if (usb_endpoint_xfer_isoc(&ep->desc)) { + interval = xhci_parse_exponent_interval(udev, ep); + break; + } + /* +- * Fall through for isochronous endpoint interval decoding ++ * Fall through for interrupt endpoint interval decoding + * since it uses the same rules as low speed interrupt + * endpoints. + */ diff --git a/queue-2.6.38/xhci-fix-memory-leak-bug-when-dropping-endpoints.patch b/queue-2.6.38/xhci-fix-memory-leak-bug-when-dropping-endpoints.patch new file mode 100644 index 0000000000..77b3fddde4 --- /dev/null +++ b/queue-2.6.38/xhci-fix-memory-leak-bug-when-dropping-endpoints.patch @@ -0,0 +1,65 @@ +From 834cb0fc4712a3b21c6b8c5cb55bd13607191311 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Date: Thu, 12 May 2011 18:06:37 -0700 +Subject: xhci: Fix memory leak bug when dropping endpoints + +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> + +commit 834cb0fc4712a3b21c6b8c5cb55bd13607191311 upstream. + +When the USB core wants to change to an alternate interface setting that +doesn't include an active endpoint, or de-configuring the device, the xHCI +driver needs to issue a Configure Endpoint command to tell the host to +drop some endpoints from the schedule. After the command completes, the +xHCI driver needs to free rings for any endpoints that were dropped. + +Unfortunately, the xHCI driver wasn't actually freeing the endpoint rings +for dropped endpoints. The rings would be freed if the endpoint's +information was simply changed (and a new ring was installed), but dropped +endpoints never had their rings freed. This caused errors when the ring +segment DMA pool was freed when the xHCI driver was unloaded: + +[ 5582.883995] xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff88003371d000 busy +[ 5582.884002] xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff880033716000 busy +[ 5582.884011] xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff880033455000 busy +[ 5582.884018] xhci_hcd 0000:06:00.0: Freed segment pool +[ 5582.884026] xhci_hcd 0000:06:00.0: Freed device context pool +[ 5582.884033] xhci_hcd 0000:06:00.0: Freed small stream array pool +[ 5582.884038] xhci_hcd 0000:06:00.0: Freed medium stream array pool +[ 5582.884048] xhci_hcd 0000:06:00.0: xhci_stop completed - status = 1 +[ 5582.884061] xhci_hcd 0000:06:00.0: USB bus 3 deregistered +[ 5582.884193] xhci_hcd 0000:06:00.0: PCI INT A disabled + +Fix this issue and free endpoint rings when their endpoints are +successfully dropped. + +This patch should be backported to kernels as old as 2.6.31. + +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/xhci.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1636,8 +1636,17 @@ int xhci_check_bandwidth(struct usb_hcd + xhci_dbg_ctx(xhci, virt_dev->out_ctx, + LAST_CTX_TO_EP_NUM(slot_ctx->dev_info)); + ++ /* Free any rings that were dropped, but not changed. */ ++ for (i = 1; i < 31; ++i) { ++ if ((ctrl_ctx->drop_flags & (1 << (i + 1))) && ++ !(ctrl_ctx->add_flags & (1 << (i + 1)))) ++ xhci_free_or_cache_endpoint_ring(xhci, virt_dev, i); ++ } + xhci_zero_in_ctx(xhci, virt_dev); +- /* Install new rings and free or cache any old rings */ ++ /* ++ * Install any rings for completely new endpoints or changed endpoints, ++ * and free or cache any old rings from changed endpoints. ++ */ + for (i = 1; i < 31; ++i) { + if (!virt_dev->eps[i].new_ring) + continue; diff --git a/queue-2.6.38/xhci-fix-memory-leak-in-ring-cache-deallocation.patch b/queue-2.6.38/xhci-fix-memory-leak-in-ring-cache-deallocation.patch new file mode 100644 index 0000000000..b5c3756bb4 --- /dev/null +++ b/queue-2.6.38/xhci-fix-memory-leak-in-ring-cache-deallocation.patch @@ -0,0 +1,64 @@ +From 30f89ca021c3e584b61bc5a14eede89f74b2e826 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Date: Mon, 16 May 2011 13:09:08 -0700 +Subject: xhci: Fix memory leak in ring cache deallocation. + +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> + +commit 30f89ca021c3e584b61bc5a14eede89f74b2e826 upstream. + +When an endpoint ring is freed, it is either cached in a per-device ring +cache, or simply freed if the ring cache is full. If the ring was added +to the cache, then virt_dev->num_rings_cached is incremented. The cache +is designed to hold up to 31 endpoint rings, in array indexes 0 to 30. +When the device is freed (when the slot was disabled), +xhci_free_virt_device() is called, it would free the cached rings in +array indexes 0 to virt_dev->num_rings_cached. + +Unfortunately, the original code in xhci_free_or_cache_endpoint_ring() +would put the first entry into the ring cache in array index 1, instead of +array index 0. This was caused by the second assignment to rings_cached: + + rings_cached = virt_dev->num_rings_cached; + if (rings_cached < XHCI_MAX_RINGS_CACHED) { + virt_dev->num_rings_cached++; + rings_cached = virt_dev->num_rings_cached; + virt_dev->ring_cache[rings_cached] = + virt_dev->eps[ep_index].ring; + +This meant that when the device was freed, cached rings with indexes 0 to +N would be freed, and the last cached ring in index N+1 would not be +freed. When the driver was unloaded, this caused interesting messages +like: + +xhci_hcd 0000:06:00.0: dma_pool_destroy xHCI ring segments, ffff880063040000 busy + +This should be queued to stable kernels back to 2.6.33. + +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/xhci-mem.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -207,14 +207,13 @@ void xhci_free_or_cache_endpoint_ring(st + + rings_cached = virt_dev->num_rings_cached; + if (rings_cached < XHCI_MAX_RINGS_CACHED) { +- virt_dev->num_rings_cached++; +- rings_cached = virt_dev->num_rings_cached; + virt_dev->ring_cache[rings_cached] = + virt_dev->eps[ep_index].ring; ++ virt_dev->num_rings_cached++; + xhci_dbg(xhci, "Cached old ring, " + "%d ring%s cached\n", +- rings_cached, +- (rings_cached > 1) ? "s" : ""); ++ virt_dev->num_rings_cached, ++ (virt_dev->num_rings_cached > 1) ? "s" : ""); + } else { + xhci_ring_free(xhci, virt_dev->eps[ep_index].ring); + xhci_dbg(xhci, "Ring cache full (%d rings), " |