Kim Liu found that in the original code certain class setup requests
are wrongly recognized and processed as standard setup requests.
For that reason gadget ether can't work in RNDIS mode with Windows host.

The patch fixes the setup request processing code, and makes class
requests correctly passed to gadget layer.
Signed-off-by: NLi Yang <leoli@freescale.com>
Signed-off-by: NKim Liu <KLiu@vixs.com>
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as963) fixes a recently-introduced bug.  The gadget
conversion removing DMA-mapped buffer allocation did not remove quite
enough code from the g_file_storage driver; DMA pointers were being
set to 0.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as966) fixes a bug in the autosuspend code.  The last_busy
field should be updated whenever any event occurs, not just events
that cause an autosuspend or an autoresume.

This partially fixes Bugzilla #8892.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

the pwc driver has a disconnect method that waits for user space to
close the device. This opens up an opportunity for a DoS attack,
blocking the USB subsystem and making khubd's task busy wait in
kernel space. This patch shifts freeing resources to close if an opened
device is disconnected.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
CC: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as964) was suggested by Steffen Koepf.  It makes
usb_get_descriptor() retry on all errors other than ETIMEDOUT, instead
of only on EPIPE.  This helps with some devices.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

it seems like you overdid it a bit in your quest to clean up the
use of urb->status. In this driver you read it the first thing, which
means that you are in a race against URB completion you'll
usually lose, returning -EINPROGRESS. This kills the driver.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch enables support for HTC Smartphones. The original patch is at
https://bugs.gentoo.org/show_bug.cgi?id=187522. Original author is Mike Doty
<kingtaco@gentoo.org>.
Signed-off-by: NChristian Heim <phreak@gentoo.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

for the drive Jean reported.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this device has been reported to break with autosuspend.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some versions of GCC recently grew annoying warnings about constants.
This gets rid of that warning from the OHCI driver.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as961) fixes a couple of bugs in the disconnect pathway of
usb-storage.

The first problem, which apparently has been around for a while
although nobody noticed it, shows up when an aborted command is still
pending when a disconnect occurs.  The SCSI error-handler will
continue to wait in command_abort() until the us->notify completion is
signalled.  Thus quiesce_and_remove_host() needs to signal it.

The second problem was introduced recently along with autosuspend
support.  Since usb_stor_scan_thread() now calls
usb_autopm_put_interface() before exiting, we can't simply leave the
scanning thread running after a disconnect; we must wait until the
thread exits.  This is solved by adding a new struct completion to the
private data structure.  Fortuitously, it allows the removal of the
rather clunky mechanism used in the past to insure that all threads
have finished before the module is unloaded.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some devices have a bug which causes them to send a 1-byte reply to
Get-Device-Status requests instead of 2 bytes as required by the
spec.  This doesn't play well with autosuspend, since we look for a
valid status reply to make sure the device is still present when it
resumes.  Without both bytes, we assume the device has been
disconnected.

Lack of the second byte shouldn't matter much, since the spec requires
it always to be equal to 0.  Hence this patch (as959) causes
finish_port_resume() to accept a 1-byte reply as valid.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Hi,

this printer does not survive suspension.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The oti6858 usb serial driver should use kernel_termios_to_user_termios/
user_termios_to_kernel_termios to avoid segfaults because the kernel
uses a structure differing from that of user space with a different
size.
Signed-off-by: NThomas Viehmann <tv@beamnet.de>
CC: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as958) removes an unneeded and unwanted #define line from
dummy_hcd.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If, in em28xx_usb_probe() the memory allocation
	dev->alt_max_pkt_size = kmalloc(32*
						dev->num_alt,GFP_KERNEL);
fails, then we'll bail out and return -ENOMEM.
The problem is that in that case we don't free the storage allocated
to 'dev', thus causing a memory leak.

This patch fixes the leak by freeing 'dev' before we return -ENOMEM.
This fixes Coverity bug #647.
Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The belkin_sa module has a problem coping with a 0 return from
tty_get_baud_rate() -- the subsequent BELKIN_SA_BAUD macro

drivers/usb/serial/belkin_sa.h:#define BELKIN_SA_BAUD(b) (230400/b)

performs a divide with it leading to the following divide error:

usb 3-1: Belkin / Peracom / GoHubs USB Serial Adapter converter now attached to ttyUSB0
PM: Adding info for No Bus:usbdev3.3_ep81
PM: Adding info for No Bus:usbdev3.3_ep01
PM: Adding info for No Bus:usbdev3.3_ep82
divide error: 0000 [#1]
SMP
Modules linked in: vfat fat iwl3945 mac80211 cfg80211 belkin_sa usbserial usb_storage autofs4 vmnet(P) vmmon(P) aes nf_conntrack_netbios_ns ipt_REJECT nf_conntrack_ipv4 xt_state nf_conntrack nfnetlink xt_tcpudp iptable_filter ip_tables x_tables cpufreq_ondemand acpi_cpufreq video output sbs button dock battery ac arc4 snd_hda_intel ecb blkcipher snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss sr_mod snd_mixer_oss rtc_cmos cdrom iTCO_wdt iTCO_vendor_support snd_pcm rtc_core snd_timer serio_raw b44 ssb rtc_lib parport ata_piix snd soundcore snd_page_alloc mii ata_generic sg ahci libata sd_mod scsi_mod ext3 jbd mbcache ehci_hcd ohci_hcd uhci_hcd
CPU:    1
EIP:    0060:[<f8dd1747>]    Tainted: P        VLI
EFLAGS: 00010246   (2.6.23-rc1 #1)
EIP is at belkin_sa_set_termios+0x18e/0x5b9 [belkin_sa]
eax: 00038400   ebx: 00000000   ecx: 00000000   edx: 00000000
esi: 00038400   edi: 00001cb2   ebp: de49adb0   esp: de49ad6c
ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
Process minicom (pid: 7306, ti=de49a000 task=eed6c3b0 task.ti=de49a000)
Stack: d85c74f0 00000046 00000002 00000001 d85c74f0 d85c74f0 00000246 c887c658
       00000001 00000cb0 00000001 00000084 00000000 d01b58c0 f6ba10e0 de49ade8
       de49ae40 de49add0 f8e2526b d85c74b8 ca6e6dbc de49ae40 d85c746c eded72e8
Call Trace:
 [<c0405f35>] show_trace_log_lvl+0x1a/0x2f
 [<c0405fe5>] show_stack_log_lvl+0x9b/0xa3
 [<c04061a5>] show_registers+0x1b8/0x289
 [<c0406389>] die+0x113/0x246
 [<c0622f98>] do_trap+0x8a/0xa3
 [<c04068dc>] do_divide_error+0x85/0x8f
 [<c0622d6a>] error_code+0x72/0x78
 [<f8e2526b>] serial_set_termios+0x86/0x8d [usbserial]
 [<c0542d33>] set_termios+0x309/0x34c
 [<c0542ece>] n_tty_ioctl+0x158/0x4ba
 [<c054030b>] tty_ioctl+0xc78/0xcd6
 [<c048aea0>] do_ioctl+0x50/0x67
 [<c048b100>] vfs_ioctl+0x249/0x25c
 [<c048b15c>] sys_ioctl+0x49/0x61
 [<c0404ed2>] sysenter_past_esp+0x5f/0x99
 =======================
Code: 85 c0 79 14 c7 44 24 04 67 1c dd f8 c7 04 24 d4 1e dd f8 e8 96 99 65 c7 8b 46 04 be 00 84 03 00 e8 47 11 77 c7 31 d2 89 c1 89 f0 <f7> f1 66 85 c0 89 c1 b8 01 00 00 00 0f 44 c8 8b 45 d8 85 db 8b
EIP: [<f8dd1747>] belkin_sa_set_termios+0x18e/0x5b9 [belkin_sa] SS:ESP 0068:de49ad6c

The small patch below should take care of this situation.  Note that my
kernel was tainted (vmware) but the problem will occur if
tty_get_baud_rate() ever returns zero and should be taken care of.
Signed-off-by: NAndy Green <andy@warmcat.com>
Cc: William Greathouse <wgreathouse@smva.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

  The attached (mostly trivial) patches adds support for the Evolution
Scorpion Robots.
  Evolution Robotics supplies a patch against 2.6.8 with their
software. My patch is based on their work, so I don't know if I can
sign it off, or if you need some Evolution people to do this (which
might be hard).
  The patch adds device ID's for some robots which is trivial.



From: Søren Hauberg <hauberg@gmail.com>
Acked-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Søren

It appears that one reason the "iConnect"-labeled multi-card reader was
on sale for only $5 is that it doesn't handle suspend/resume correctly.
Other than that, it was a good deal for a highspeed MMC/SD bridge.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Currently when registration fails we're left with a stray reference to
release_mem_region(), this leads to the following case:

    r8a66597_hcd r8a66597_hcd: irq 13, io base 0x18040000
    drivers/usb/host/r8a66597-hcd.c: register access fail.
    r8a66597_hcd r8a66597_hcd: startup error -6
    r8a66597_hcd r8a66597_hcd: USB bus 1 deregistered
    drivers/usb/host/r8a66597-hcd.c: Failed to add hcd
    Trying to free nonexistent resource <0000000018040000-0000000018040000>

This fixes it up.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Previous boards were likely seeing USB_ARCH_HAS_HCD selected by way
of PCMCIA or PCI, though none of those are required for hcd support
on SH. Enable support unconditionally.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Dell Wireless Broadband ExpressCards are rebrands of Novatel's cards.
Add all of their known PCI IDs to date along with their mapping to the exact
Novatel model to the Option driver which already claims to support them.
Signed-off-by: NFaidon Liambotis <paravoid@debian.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I noticed this warning with CONFING_PM=n 

...

drivers/usb/host/u132-hcd.c:1525: warning: 'port_power' defined but not used

...
Signed-off-by: NGabriel Craciunescu <nix.or.die@googlemail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix typo in safe_serial.c to match the actual CONFIG variable.
Signed-off-by: NRobert P. J. Day <rpjday@mindspring.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch makes the File Storage Gadget stall the control endpoint
when a MSC class request is made with wValue != 0.  This change makes
some MSC compliance test warnings disappear.
Signed-off-by: NLuis Lloret <luislloret@gmail.com>
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch contains two fixes submitted by Ondrej Palkovsky:
- the 'ACK' packet is sent after the transfer of the USB packet is
completed, i.e. in the write_callback function. Because the close
function sends the 'abort' command, a parameter is added that allows
the caller of garmin_write_bulk to specify, if the 'ack' should be
propagated to the serial link or dimissed.
This fixes the problem with gpsbabel, it has sent several packets that
were acknowledged before they were sent to the GPS and GpsBabel closed
the device - thus effectively cancelled all outstanding requests in the
queue.
- removed the APP_RESP_SEEN and APP_REQ_SEEN flags and changed
them into counters. It evades USB reset of the gps on every device close.
Signed-off-by: NHermann Kneissel <hermann.kneissel@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

modprobe visor vendor=0x502 product=0x1
is said to work, plus there are patch instructions for it.
fixes http://bugs.debian.org/340547
see http://www.chinaitpower.com/A/2004-07-28/87909.htmlSigned-off-by: NMaximilian Attems <max@stro.at>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as950) fixes a bug in the cdc-acm driver.  It doesn't keep
track of which interface (control or data) the sysfs attributes get
registered for, and as a result, during disconnect it will sometimes
attempt to remove the attributes from the wrong interface.  The
left-over attributes can cause a crash later on, particularly if the driver
module has been unloaded.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Acked-by: NOliver Neukum <oneukum@suse.de>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

git commit b2bbb20b added direct
support for PXA GPIO D+ pullup as alternative to the older udc_command
ops method.  This was done by introduction of the pxa2xx_udc_mach_info
member "gpio_pullup" which, if initialized, is now used in (almost)
all places where udc_command used to be called.

This patch fixes two places where checks for availability of D+ pullup
control still only honor udc_command.
Signed-off-by: NUli Luckas <u.luckas@road.de>
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  [WATCHDOG] Add support for 1533 bridge to alim1535_wdt
  [WATCHDOG] Add a 00-INDEX file to Documentation/watchdog/
  [WATCHDOG] Eurotechwdt.c - clean-up comments

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC32]: Revert f642b263.
  [SPARC64]: Need to clobber global reg vars in switch_to().

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IRDA] irda_nl_get_mode: always results in failure
  [PPP]: Fix output buffer size in ppp_decompress_frame().
  [IRDA]: Avoid a label defined but not used warning in irda_init()
  [IPV6]: Fix kernel panic while send SCTP data with IP fragments
  [SNAP]: Check packet length before reading
  [DCCP]: Allocation in atomic context

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] Change atomic_read/set to inline functions with barrier semantics.
  [S390] kprobes: fix instruction length calculation
  [S390] hypfs: inode corruption due to missing locking
  [S390] disassembler: fix b2 opcodes like srst, bsg, and others
  [S390] vmur: fix reference counting for vmur device structure
  [S390] vmur: fix diag14 exceptions with addresses > 2GB.
  [S390] qdio: Refresh buffer states for IQDIO Asynchronous output queue
  [S390] qdio: fix EQBS handling on CCQ96
  [S390] cio: change confusing message in cmf.
  [S390] cio: dont forget to set last slot to NULL in ccw_uevent().

Touching vmalloc memory in the middle of a lazy mode update can generate
a kernel PDE update, which must be flushed immediately.  The fix is to
leave lazy mode when doing a vmalloc sync.
Signed-off-by: NZachary Amsden <zach@vmware.com>
Acked-by: NJeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

After doing some tests this seems to be the best variant for s390 and
should be correct as well. With gcc 4.2.1 we get the following kernel
image sizes using the default configuration:

atomic_t type volatile, atomic_read/set defines   5311824 bytes
atomic_t type int, atomic_read/set defines        5270864 bytes
atomic_t type int, atomic_read/set inline asm     5279056 bytes
atomic_t type int, atomic_read/set inline barrier 5270864 bytes
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Placing a kprobe on "bc" instruction (s390/s390x) can cause an oops.
The instruction length is encoded into the first two bits of the s390
instruction. Kprobe is incorrectly computing the instruction length.
The instruction length is used for determining what type of "fix-up" is
needed for conditional branch instruction. The problem can bee seen by
placing a kprobe on a "bc" instruction that will not branch. The
results is that Kprobe incorrectly computes the new instruction
pointer (psw.addr) after single stepping the instruction. The problem
is corrected with this patch.
Signed-off-by: NDavid Wilder <dwilder@us.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>

hypfs removes the whole hypfs directory tree and creates a new one, when a
process triggers an update by writing to the "update" attribute. When removing
and creating files, it is necessary to lock the inode of the parent directory
where the files live. Currently hypfs does not lock the parent inode, which
can lead to inode corruption. This patch:
 * Introduces correct locking
 * Fixes i_nlink reference counting for inodes, when creating directories
 * Adds info printk, when hypfs filesystem has been mounted
Signed-off-by: NMichael Holzheu <holzheu@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>

The instruction table for b2 opcodes was missing an opfrag value
for the cpya instruction. All instructions specified after cpya
were not considered by the disassembler. The fix is simple and
obvious - add the opfrag field to the cpya instruction.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>

When a vmur device is removed due to a detach of the device, currently the
ur device structure is freed. Unfortunately it can happen, that there is
still a user of the device structure, when the character device is open
during the detach process. To fix this, reference counting for the vmur
structure is introduced.
In addition to that, the online, offline, probe and remove functions are
serialized now using a global mutex.
Signed-off-by: NMichael Holzheu <holzheu@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>