--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Nobutaka Okabe <nob77413@gmail.com>
+Date: Fri, 23 Mar 2018 19:18:22 +0900
+Subject: ALSA: usb-audio: Add native DSD support for Luxman DA-06
+
+From: Nobutaka Okabe <nob77413@gmail.com>
+
+[ Upstream commit 71426535f49fe6034d0e0db77608b91a0c1a022d ]
+
+Add native DSD support quirk for Luxman DA-06 DAC, by adding the
+PID/VID 1852:5065.
+
+Rename "is_marantz_denon_dac()" function to "is_itf_usb_dsd_2alts_dac()"
+to cover broader device family sharing the same USB audio
+implementation(*).
+For the same reason, rename "is_teac_dsd_dac()" function to
+"is_itf_usb_dsd_3alts_dac()".
+
+(*)
+These devices have the same USB controller "ITF-USB DSD", supplied by
+INTERFACE Co., Ltd.
+"ITF-USB DSD" USB controller has two patterns,
+
+Pattern 1. (2 altsets version)
+- Altset 0: for control
+- Altset 1: for stream (S32)
+- Altset 2: for stream (S32, DSD_U32)
+
+Pattern 2. (3 altsets version)
+- Altset 0: for control
+- Altset 1: for stream (S16)
+- Altset 2: for stream (S32)
+- Altset 3: for stream (S32, DSD_U32)
+
+"is_itf_usb_dsd_2alts_dac()" returns true, if the DAC has "Pattern 1"
+USB controller, and "is_itf_usb_dsd_3alts_dac()" returns true, if
+"Pattern2".
+
+Signed-off-by: Nobutaka Okabe <nob77413@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1155,24 +1155,27 @@ bool snd_usb_get_sample_rate_quirk(struc
+ return false;
+ }
+
+-/* Marantz/Denon USB DACs need a vendor cmd to switch
++/* ITF-USB DSD based DACs need a vendor cmd to switch
+ * between PCM and native DSD mode
++ * (2 altsets version)
+ */
+-static bool is_marantz_denon_dac(unsigned int id)
++static bool is_itf_usb_dsd_2alts_dac(unsigned int id)
+ {
+ switch (id) {
+ case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
+ case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
+ case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
++ case USB_ID(0x1852, 0x5065): /* Luxman DA-06 */
+ return true;
+ }
+ return false;
+ }
+
+-/* TEAC UD-501/UD-503/NT-503 USB DACs need a vendor cmd to switch
+- * between PCM/DOP and native DSD mode
++/* ITF-USB DSD based DACs need a vendor cmd to switch
++ * between PCM and native DSD mode
++ * (3 altsets version)
+ */
+-static bool is_teac_dsd_dac(unsigned int id)
++static bool is_itf_usb_dsd_3alts_dac(unsigned int id)
+ {
+ switch (id) {
+ case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */
+@@ -1189,7 +1192,7 @@ int snd_usb_select_mode_quirk(struct snd
+ struct usb_device *dev = subs->dev;
+ int err;
+
+- if (is_marantz_denon_dac(subs->stream->chip->usb_id)) {
++ if (is_itf_usb_dsd_2alts_dac(subs->stream->chip->usb_id)) {
+ /* First switch to alt set 0, otherwise the mode switch cmd
+ * will not be accepted by the DAC
+ */
+@@ -1210,7 +1213,7 @@ int snd_usb_select_mode_quirk(struct snd
+ break;
+ }
+ mdelay(20);
+- } else if (is_teac_dsd_dac(subs->stream->chip->usb_id)) {
++ } else if (is_itf_usb_dsd_3alts_dac(subs->stream->chip->usb_id)) {
+ /* Vendor mode switch cmd is required. */
+ switch (fmt->altsetting) {
+ case 3: /* DSD mode (DSD_U32) requested */
+@@ -1306,10 +1309,10 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ mdelay(20);
+
+- /* Marantz/Denon devices with USB DAC functionality need a delay
++ /* ITF-USB DSD based DACs functionality need a delay
+ * after each class compliant request
+ */
+- if (is_marantz_denon_dac(chip->usb_id)
++ if (is_itf_usb_dsd_2alts_dac(chip->usb_id)
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ mdelay(20);
+
+@@ -1396,14 +1399,14 @@ u64 snd_usb_interface_dsd_format_quirks(
+ break;
+ }
+
+- /* Denon/Marantz devices with USB DAC functionality */
+- if (is_marantz_denon_dac(chip->usb_id)) {
++ /* ITF-USB DSD based DACs (2 altsets version) */
++ if (is_itf_usb_dsd_2alts_dac(chip->usb_id)) {
+ if (fp->altsetting == 2)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ }
+
+- /* TEAC devices with USB DAC functionality */
+- if (is_teac_dsd_dac(chip->usb_id)) {
++ /* ITF-USB DSD based DACs (3 altsets version) */
++ if (is_itf_usb_dsd_3alts_dac(chip->usb_id)) {
+ if (fp->altsetting == 3)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Thu, 1 Mar 2018 14:52:08 +0200
+Subject: ARM: dts: imx7d-sdb: Fix regulator-usb-otg2-vbus node name
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+[ Upstream commit 970656b3246d30955894951ed16bd658e42d8c24 ]
+
+The two usb-otg regulators for imx7d-sdb are both called
+"regulator-usb-otg1-vbus" and they effectively override each other.
+
+This is most likely a copy-paste error.
+
+Fixes: b877039aa1fe ("ARM: dts: imx7d-sdb: Adjust the regulator nodes")
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx7d-sdb.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx7d-sdb.dts
++++ b/arch/arm/boot/dts/imx7d-sdb.dts
+@@ -82,7 +82,7 @@
+ enable-active-high;
+ };
+
+- reg_usb_otg2_vbus: regulator-usb-otg1-vbus {
++ reg_usb_otg2_vbus: regulator-usb-otg2-vbus {
+ compatible = "regulator-fixed";
+ regulator-name = "usb_otg2_vbus";
+ regulator-min-microvolt = <5000000>;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Sun, 3 Dec 2017 17:50:00 +0000
+Subject: arm64: insn: Allow ADD/SUB (immediate) with LSL #12
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+[ Upstream commit 11d764079c9f25d1da8e10906d54da7fefec5844 ]
+
+The encoder for ADD/SUB (immediate) can only cope with 12bit
+immediates, while there is an encoding for a 12bit immediate shifted
+by 12 bits to the left.
+
+Let's fix this small oversight by allowing the LSL_12 bit to be set.
+
+Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/insn.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kernel/insn.c
++++ b/arch/arm64/kernel/insn.c
+@@ -35,6 +35,7 @@
+
+ #define AARCH64_INSN_SF_BIT BIT(31)
+ #define AARCH64_INSN_N_BIT BIT(22)
++#define AARCH64_INSN_LSL_12 BIT(22)
+
+ static int aarch64_insn_encoding_class[] = {
+ AARCH64_INSN_CLS_UNKNOWN,
+@@ -899,9 +900,18 @@ u32 aarch64_insn_gen_add_sub_imm(enum aa
+ return AARCH64_BREAK_FAULT;
+ }
+
++ /* We can't encode more than a 24bit value (12bit + 12bit shift) */
++ if (imm & ~(BIT(24) - 1))
++ goto out;
++
++ /* If we have something in the top 12 bits... */
+ if (imm & ~(SZ_4K - 1)) {
+- pr_err("%s: invalid immediate encoding %d\n", __func__, imm);
+- return AARCH64_BREAK_FAULT;
++ /* ... and in the low 12 bits -> error */
++ if (imm & (SZ_4K - 1))
++ goto out;
++
++ imm >>= 12;
++ insn |= AARCH64_INSN_LSL_12;
+ }
+
+ insn = aarch64_insn_encode_register(AARCH64_INSN_REGTYPE_RD, insn, dst);
+@@ -909,6 +919,10 @@ u32 aarch64_insn_gen_add_sub_imm(enum aa
+ insn = aarch64_insn_encode_register(AARCH64_INSN_REGTYPE_RN, insn, src);
+
+ return aarch64_insn_encode_immediate(AARCH64_INSN_IMM_12, insn, imm);
++
++out:
++ pr_err("%s: invalid immediate encoding %d\n", __func__, imm);
++ return AARCH64_BREAK_FAULT;
+ }
+
+ u32 aarch64_insn_gen_bitfield(enum aarch64_insn_register dst,
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Tue, 20 Feb 2018 16:19:05 +0200
+Subject: ASoC: hdmi-codec: Fix module unloading caused kernel crash
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 5e558f8afaec8957932b1dbe5aeff800f9fc6957 ]
+
+The hcp->chmap_info must not be freed up in the hdmi_codec_remove()
+function as it leads to kernel crash due ALSA core's
+pcm_chmap_ctl_private_free() is trying to free it up again when the card
+destroyed via snd_card_free.
+
+Commit cd6111b26280a ("ASoC: hdmi-codec: add channel mapping control")
+should not have added the kfree(hcp->chmap_info); to the hdmi_codec_remove
+function.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reviewed-by: Jyri Sarha <jsarha@ti.com>
+Tested-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/hdmi-codec.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -801,12 +801,7 @@ static int hdmi_codec_probe(struct platf
+
+ static int hdmi_codec_remove(struct platform_device *pdev)
+ {
+- struct device *dev = &pdev->dev;
+- struct hdmi_codec_priv *hcp;
+-
+- hcp = dev_get_drvdata(dev);
+- kfree(hcp->chmap_info);
+- snd_soc_unregister_codec(dev);
++ snd_soc_unregister_codec(&pdev->dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Ezequiel Garcia <ezequiel@collabora.co.uk>
+Date: Tue, 20 Mar 2018 13:03:31 -0300
+Subject: ASoC: rockchip: rk3288-hdmi-analog: Select needed codecs
+
+From: Ezequiel Garcia <ezequiel@collabora.co.uk>
+
+[ Upstream commit b1d0db067fbe2598d62b248beea5d705a0ea7642 ]
+
+The driver does not select all the codec drivers that needs.
+Fix it by selecting the analog and HDMI codecs.
+
+Cc: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.co.uk>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/rockchip/Kconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/rockchip/Kconfig
++++ b/sound/soc/rockchip/Kconfig
+@@ -56,6 +56,9 @@ config SND_SOC_RK3288_HDMI_ANALOG
+ depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && CLKDEV_LOOKUP
+ select SND_SOC_ROCKCHIP_I2S
+ select SND_SOC_HDMI_CODEC
++ select SND_SOC_ES8328_I2C
++ select SND_SOC_ES8328_SPI if SPI_MASTER
++ select DRM_DW_HDMI_I2S_AUDIO if DRM_DW_HDMI
+ help
+ Say Y or M here if you want to add support for SoC audio on Rockchip
+ RK3288 boards using an analog output and the built-in HDMI audio.
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Mon, 5 Feb 2018 16:43:56 +0100
+Subject: ASoC: samsung: i2s: Ensure the RCLK rate is properly determined
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+[ Upstream commit 647d04f8e07afc7c3b7a42b3ee01a8b28db29631 ]
+
+If the RCLK mux clock configuration is specified in DT and no set_sysclk()
+callback is used in the sound card driver the sclk_srcrate field will remain
+set to 0, leading to an incorrect PSR divider setting.
+To fix this the frequency value is retrieved from the CLK_I2S_RCLK_SRC clock,
+so the actual RCLK mux selection is taken into account.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/samsung/i2s.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -653,8 +653,12 @@ static int i2s_set_fmt(struct snd_soc_da
+ tmp |= mod_slave;
+ break;
+ case SND_SOC_DAIFMT_CBS_CFS:
+- /* Set default source clock in Master mode */
+- if (i2s->rclk_srcrate == 0)
++ /*
++ * Set default source clock in Master mode, only when the
++ * CLK_I2S_RCLK_SRC clock is not exposed so we ensure any
++ * clock configuration assigned in DT is not overwritten.
++ */
++ if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL)
+ i2s_set_sysclk(dai, SAMSUNG_I2S_RCLKSRC_0,
+ 0, SND_SOC_CLOCK_IN);
+ break;
+@@ -878,6 +882,11 @@ static int config_setup(struct i2s_dai *
+ return 0;
+
+ if (!(i2s->quirks & QUIRK_NO_MUXPSR)) {
++ struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
++
++ if (i2s->rclk_srcrate == 0 && rclksrc && !IS_ERR(rclksrc))
++ i2s->rclk_srcrate = clk_get_rate(rclksrc);
++
+ psr = i2s->rclk_srcrate / i2s->frmclk / rfs;
+ writel(((psr - 1) << 8) | PSR_PSREN, i2s->addr + I2SPSR);
+ dev_dbg(&i2s->pdev->dev,
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Wed, 14 Mar 2018 17:41:13 +0100
+Subject: ASoC: samsung: odroid: Fix 32000 sample rate handling
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+[ Upstream commit 1d22c337dc8f3a25638f7262e7bcb5729a34d140 ]
+
+In case of sample rates lower than 44100 currently there is too low MCLK
+frequency set for the CODEC. Playback fails with following errors:
+
+$ speaker-test -c2 -t sine -f 1500 -l2 -r 32000
+
+Sine wave rate is 1500.0000Hz
+Rate set to 32000Hz (requested 32000Hz)
+Buffer size range from 128 to 131072
+Period size range from 64 to 65536
+Using max buffer size 131072
+Periods = 4
+Unable to set hw params for playback: Invalid argument
+Setting of hwparams failed: Invalid argument
+
+[ 497.883700] max98090 1-0010: Invalid master clock frequency
+
+To fix this the I2S root clock's frequency is increased, depending
+on sampling rate.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/samsung/odroid.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -36,23 +36,26 @@ static int odroid_card_hw_params(struct
+ {
+ struct snd_soc_pcm_runtime *rtd = substream->private_data;
+ struct odroid_priv *priv = snd_soc_card_get_drvdata(rtd->card);
+- unsigned int pll_freq, rclk_freq;
++ unsigned int pll_freq, rclk_freq, rfs;
+ int ret;
+
+ switch (params_rate(params)) {
+- case 32000:
+ case 64000:
+- pll_freq = 131072006U;
++ pll_freq = 196608001U;
++ rfs = 384;
+ break;
+ case 44100:
+ case 88200:
+ case 176400:
+ pll_freq = 180633609U;
++ rfs = 512;
+ break;
++ case 32000:
+ case 48000:
+ case 96000:
+ case 192000:
+ pll_freq = 196608001U;
++ rfs = 512;
+ break;
+ default:
+ return -EINVAL;
+@@ -67,7 +70,7 @@ static int odroid_card_hw_params(struct
+ * frequency values due to the EPLL output frequency not being exact
+ * multiple of the audio sampling rate.
+ */
+- rclk_freq = params_rate(params) * 256 + 1;
++ rclk_freq = params_rate(params) * rfs + 1;
+
+ ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
+ if (ret < 0)
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Date: Fri, 9 Mar 2018 11:11:17 -0800
+Subject: ASoC: topology: create TLV data for dapm widgets
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit bde8b3887add8368ecf0ca71117baf2fd56a6fc9 ]
+
+This patch adds the change required to create the TLV data
+for dapm widget kcontrols from topology. This also fixes the following
+TLV read error shown in amixer while showing the card control contents.
+"amixer: Control hw:1 element TLV read error: No such device or address"
+
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-topology.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1276,6 +1276,9 @@ static struct snd_kcontrol_new *soc_tplg
+ kfree(sm);
+ continue;
+ }
++
++ /* create any TLV data */
++ soc_tplg_create_tlv(tplg, &kc[i], &mc->hdr);
+ }
+ return kc;
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 11 Feb 2018 12:24:32 -0600
+Subject: Bluetooth: btusb: Add device ID for RTL8822BE
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit fed03fe7e55b7dc16077f672bd9d7bbe92b3a691 ]
+
+The Asus Z370-I contains a Realtek RTL8822BE device with an associated
+BT chip using a USB ID of 0b05:185c. This device is added to the driver.
+
+Signed-off-by: Hon Weng Chong <honwchong@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -380,6 +380,9 @@ static const struct usb_device_id blackl
+ { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
+
++ /* Additional Realtek 8822BE Bluetooth devices */
++ { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
++
+ /* Silicon Wave based devices */
+ { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Vicente Bergas <vicencb@gmail.com>
+Date: Tue, 20 Mar 2018 19:41:10 +0100
+Subject: Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB
+
+From: Vicente Bergas <vicencb@gmail.com>
+
+[ Upstream commit a41e0796396eeceff673af4a38feaee149c6ff86 ]
+
+This WiFi/Bluetooth USB dongle uses a Realtek chipset, so, use btrtl for it.
+
+Product information:
+https://wikidevi.com/wiki/Edimax_EW-7611ULB
+
+>From /sys/kernel/debug/usb/devices
+T: Bus=02 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=7392 ProdID=a611 Rev= 2.00
+S: Manufacturer=Realtek
+S: Product=Edimax Wi-Fi N150 Bluetooth4.0 USB Adapter
+S: SerialNumber=00e04c000001
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 6 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtl8723bu
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=500us
+E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Tested-by: Vicente Bergas <vicencb@gmail.com>
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -370,6 +370,9 @@ static const struct usb_device_id blackl
+ { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
+
++ /* Additional Realtek 8723BU Bluetooth devices */
++ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
++
+ /* Additional Realtek 8821AE Bluetooth devices */
+ { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Wed, 14 Mar 2018 08:28:31 +0800
+Subject: clk: Don't show the incorrect clock phase
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit 1f9c63e8de3d7b377c9d74e4a17524cfb60e6384 ]
+
+It's found that the clock phase output from clk_summary is
+wrong compared to the actual phase reading from the register.
+
+cat /sys/kernel/debug/clk/clk_summary | grep sdio_sample
+sdio_sample 0 1 0 50000000 0 -22
+
+It exposes an issue that clk core, clk_core_get_phase, always
+returns the cached core->phase which should be either updated
+by calling clk_set_phase or directly from the first place the
+clk was registered.
+
+When registering the clk, the core->phase geting from ->get_phase()
+may return negative value indicating error. This is quite common
+since the clk's phase may be highly related to its parent chain,
+but it was temporarily orphan when registered, since its parent
+chains hadn't be ready at that time, so the clk drivers decide to
+return error in this case. However, if no clk_set_phase is called or
+maybe the ->set_phase() isn't even implemented, the core->phase would
+never be updated. This is wrong, and we should try to update it when
+all its parent chains are settled down, like the way of updating clock
+rate for that. But it's not deserved to complicate the code now and
+just update it anyway when calling clk_core_get_phase, which would be
+much simple and enough.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Acked-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/clk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -1931,6 +1931,9 @@ static int clk_core_get_phase(struct clk
+ int ret;
+
+ clk_prepare_lock();
++ /* Always try to update cached phase if possible */
++ if (core->ops->get_phase)
++ core->phase = core->ops->get_phase(core->hw);
+ ret = core->phase;
+ clk_prepare_unlock();
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 20 Feb 2018 16:15:21 +0100
+Subject: clk: hisilicon: mark wdt_mux_p[] as const
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit df934cbcbff7afbc024bf05f02615917c61f6470 ]
+
+The symbol is in the __initconst section but not marked init, which
+caused a warning when building with LTO.
+
+This makes it 'const' as was obviously intended.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: c80dfd9bf54e ("clk: hisilicon: add CRG driver for Hi3516CV300 SoC")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/hisilicon/crg-hi3516cv300.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/hisilicon/crg-hi3516cv300.c
++++ b/drivers/clk/hisilicon/crg-hi3516cv300.c
+@@ -204,7 +204,7 @@ static const struct hisi_crg_funcs hi351
+ /* hi3516CV300 sysctrl CRG */
+ #define HI3516CV300_SYSCTRL_NR_CLKS 16
+
+-static const char *wdt_mux_p[] __initconst = { "3m", "apb" };
++static const char *const wdt_mux_p[] __initconst = { "3m", "apb" };
+ static u32 wdt_mux_table[] = {0, 1};
+
+ static const struct hisi_mux_clock hi3516cv300_sysctrl_mux_clks[] = {
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Wed, 21 Mar 2018 10:39:19 +0800
+Subject: clk: rockchip: Fix wrong parent for SDMMC phase clock for rk3228
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit 4b0556a441dd37e598887215bc89b49a6ef525b3 ]
+
+commit c420c1e4db22 ("clk: rockchip: Prevent calculating mmc phase
+if clock rate is zero") catches one gremlin again for clk-rk3228.c
+that the parent of SDMMC phase clock should be sclk_sdmmc0, but not
+sclk_sdmmc. However, the naming of the sdmmc clocks varies in the
+manual with the card clock having the 0 while the hclk is named
+without appended 0. So standardize one one format to prevent
+confusion, as there also is only one (non-sdio) mmc controller on
+the soc.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/rockchip/clk-rk3228.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/rockchip/clk-rk3228.c
++++ b/drivers/clk/rockchip/clk-rk3228.c
+@@ -387,7 +387,7 @@ static struct rockchip_clk_branch rk3228
+ RK2928_CLKSEL_CON(23), 5, 2, MFLAGS, 0, 6, DFLAGS,
+ RK2928_CLKGATE_CON(2), 15, GFLAGS),
+
+- COMPOSITE(SCLK_SDMMC, "sclk_sdmmc0", mux_mmc_src_p, 0,
++ COMPOSITE(SCLK_SDMMC, "sclk_sdmmc", mux_mmc_src_p, 0,
+ RK2928_CLKSEL_CON(11), 8, 2, MFLAGS, 0, 8, DFLAGS,
+ RK2928_CLKGATE_CON(2), 11, GFLAGS),
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Mon, 5 Mar 2018 11:25:58 +0800
+Subject: clk: rockchip: Prevent calculating mmc phase if clock rate is zero
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+[ Upstream commit 4bf59902b50012b1dddeeaa23b217d9c4956cdda ]
+
+The MMC sample and drv clock for rockchip platforms are derived from
+the bus clock output to the MMC/SDIO card. So it should never happens
+that the clk rate is zero given it should inherits the clock rate from
+its parent. If something goes wrong and makes the clock rate to be zero,
+the calculation would be wrong but may still make the mmc tuning process
+work luckily. However it makes people harder to debug when the following
+data transfer is unstable.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/rockchip/clk-mmc-phase.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/drivers/clk/rockchip/clk-mmc-phase.c
++++ b/drivers/clk/rockchip/clk-mmc-phase.c
+@@ -58,6 +58,12 @@ static int rockchip_mmc_get_phase(struct
+ u16 degrees;
+ u32 delay_num = 0;
+
++ /* See the comment for rockchip_mmc_set_phase below */
++ if (!rate) {
++ pr_err("%s: invalid clk rate\n", __func__);
++ return -EINVAL;
++ }
++
+ raw_value = readl(mmc_clock->reg) >> (mmc_clock->shift);
+
+ degrees = (raw_value & ROCKCHIP_MMC_DEGREE_MASK) * 90;
+@@ -84,6 +90,23 @@ static int rockchip_mmc_set_phase(struct
+ u32 raw_value;
+ u32 delay;
+
++ /*
++ * The below calculation is based on the output clock from
++ * MMC host to the card, which expects the phase clock inherits
++ * the clock rate from its parent, namely the output clock
++ * provider of MMC host. However, things may go wrong if
++ * (1) It is orphan.
++ * (2) It is assigned to the wrong parent.
++ *
++ * This check help debug the case (1), which seems to be the
++ * most likely problem we often face and which makes it difficult
++ * for people to debug unstable mmc tuning results.
++ */
++ if (!rate) {
++ pr_err("%s: invalid clk rate\n", __func__);
++ return -EINVAL;
++ }
++
+ nineties = degrees / 90;
+ remainder = (degrees % 90);
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Andrzej Hajda <a.hajda@samsung.com>
+Date: Fri, 16 Feb 2018 15:57:48 +0100
+Subject: clk: samsung: exynos3250: Fix PLL rates
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit a8321e7887410a2b2e80ab89d1ef7b30562658ea ]
+
+Rates declared in PLL rate tables should match exactly rates calculated
+from PLL coefficients. If that is not the case, rate of the PLL's child clock
+might be set not as expected. For instance, if in the PLL rates table we have
+a 393216000 Hz entry and the real value as returned by the PLL's recalc_rate
+callback is 393216003, after setting PLL's clk rate to 393216000 clk_get_rate
+will return 393216003. If we now attempt to set rate of a PLL's child divider
+clock to 393216000/2 its rate will be 131072001, rather than 196608000.
+That is, the divider will be set to 3 instead of 2, because 393216003/2 is
+greater than 196608000.
+
+To fix this issue declared rates are changed to exactly match rates generated
+by the PLL, as calculated from the P, M, S, K coefficients.
+
+In this patch an erroneous P value for 74176002 output frequency is also
+corrected.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Acked-by: Tomasz Figa <tomasz.figa@gmail.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/samsung/clk-exynos3250.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/samsung/clk-exynos3250.c
++++ b/drivers/clk/samsung/clk-exynos3250.c
+@@ -698,7 +698,7 @@ static const struct samsung_pll_rate_tab
+ PLL_36XX_RATE(144000000, 96, 2, 3, 0),
+ PLL_36XX_RATE( 96000000, 128, 2, 4, 0),
+ PLL_36XX_RATE( 84000000, 112, 2, 4, 0),
+- PLL_36XX_RATE( 80000004, 106, 2, 4, 43691),
++ PLL_36XX_RATE( 80000003, 106, 2, 4, 43691),
+ PLL_36XX_RATE( 73728000, 98, 2, 4, 19923),
+ PLL_36XX_RATE( 67737598, 270, 3, 5, 62285),
+ PLL_36XX_RATE( 65535999, 174, 2, 5, 49982),
+@@ -734,7 +734,7 @@ static const struct samsung_pll_rate_tab
+ PLL_36XX_RATE(148352005, 98, 2, 3, 59070),
+ PLL_36XX_RATE(108000000, 144, 2, 4, 0),
+ PLL_36XX_RATE( 74250000, 99, 2, 4, 0),
+- PLL_36XX_RATE( 74176002, 98, 3, 4, 59070),
++ PLL_36XX_RATE( 74176002, 98, 2, 4, 59070),
+ PLL_36XX_RATE( 54054000, 216, 3, 5, 14156),
+ PLL_36XX_RATE( 54000000, 144, 2, 5, 0),
+ { /* sentinel */ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Andrzej Hajda <a.hajda@samsung.com>
+Date: Fri, 16 Feb 2018 15:57:49 +0100
+Subject: clk: samsung: exynos5250: Fix PLL rates
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit 2ac051eeabaa411ef89ae7cd5bb8e60cb41ad780 ]
+
+Rates declared in PLL rate tables should match exactly rates calculated
+from PLL coefficients. If that is not the case, rate of the PLL's child clock
+might be set not as expected. For instance, if in the PLL rates table we have
+a 393216000 Hz entry and the real value as returned by the PLL's recalc_rate
+callback is 393216003, after setting PLL's clk rate to 393216000 clk_get_rate
+will return 393216003. If we now attempt to set rate of a PLL's child divider
+clock to 393216000/2 its rate will be 131072001, rather than 196608000.
+That is, the divider will be set to 3 instead of 2, because 393216003/2 is
+greater than 196608000.
+
+To fix this issue declared rates are changed to exactly match rates generated
+by the PLL, as calculated from the P, M, S, K coefficients.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Acked-by: Tomasz Figa <tomasz.figa@gmail.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/samsung/clk-exynos5250.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/samsung/clk-exynos5250.c
++++ b/drivers/clk/samsung/clk-exynos5250.c
+@@ -711,13 +711,13 @@ static const struct samsung_pll_rate_tab
+ /* sorted in descending order */
+ /* PLL_36XX_RATE(rate, m, p, s, k) */
+ PLL_36XX_RATE(192000000, 64, 2, 2, 0),
+- PLL_36XX_RATE(180633600, 90, 3, 2, 20762),
++ PLL_36XX_RATE(180633605, 90, 3, 2, 20762),
+ PLL_36XX_RATE(180000000, 90, 3, 2, 0),
+ PLL_36XX_RATE(73728000, 98, 2, 4, 19923),
+- PLL_36XX_RATE(67737600, 90, 2, 4, 20762),
++ PLL_36XX_RATE(67737602, 90, 2, 4, 20762),
+ PLL_36XX_RATE(49152000, 98, 3, 4, 19923),
+- PLL_36XX_RATE(45158400, 90, 3, 4, 20762),
+- PLL_36XX_RATE(32768000, 131, 3, 5, 4719),
++ PLL_36XX_RATE(45158401, 90, 3, 4, 20762),
++ PLL_36XX_RATE(32768001, 131, 3, 5, 4719),
+ { },
+ };
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Andrzej Hajda <a.hajda@samsung.com>
+Date: Fri, 16 Feb 2018 15:57:50 +0100
+Subject: clk: samsung: exynos5260: Fix PLL rates
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit cdb68fbd4e7962be742c4f29475220c5bf28d8a5 ]
+
+Rates declared in PLL rate tables should match exactly rates calculated from
+the PLL coefficients. If that is not the case, rate of the PLL's child clock
+might be set not as expected. For instance, if in the PLL rates table we have
+a 393216000 Hz entry and the real value as returned by the PLL's recalc_rate
+callback is 393216003, after setting PLL's clk rate to 393216000 clk_get_rate
+will return 393216003. If we now attempt to set rate of a PLL's child divider
+clock to 393216000/2 its rate will be 131072001, rather than 196608000.
+That is, the divider will be set to 3 instead of 2, because 393216003/2 is
+greater than 196608000.
+
+To fix this issue declared rates are changed to exactly match rates generated
+by the PLL, as calculated from the P, M, S, K coefficients.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Acked-by: Tomasz Figa <tomasz.figa@gmail.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/samsung/clk-exynos5260.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/samsung/clk-exynos5260.c
++++ b/drivers/clk/samsung/clk-exynos5260.c
+@@ -65,7 +65,7 @@ static const struct samsung_pll_rate_tab
+ PLL_36XX_RATE(480000000, 160, 2, 2, 0),
+ PLL_36XX_RATE(432000000, 144, 2, 2, 0),
+ PLL_36XX_RATE(400000000, 200, 3, 2, 0),
+- PLL_36XX_RATE(394073130, 459, 7, 2, 49282),
++ PLL_36XX_RATE(394073128, 459, 7, 2, 49282),
+ PLL_36XX_RATE(333000000, 111, 2, 2, 0),
+ PLL_36XX_RATE(300000000, 100, 2, 2, 0),
+ PLL_36XX_RATE(266000000, 266, 3, 3, 0),
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Andrzej Hajda <a.hajda@samsung.com>
+Date: Fri, 16 Feb 2018 15:57:51 +0100
+Subject: clk: samsung: exynos5433: Fix PLL rates
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit ab0447845cffc0fd752df2ccd6b4e34006000ce4 ]
+
+Rates declared in PLL rate tables should match exactly rates calculated from
+the PLL coefficients. If that is not the case, rate of the PLL's child clock
+might be set not as expected. For instance, if in the PLL rates table we have
+a 393216000 Hz entry and the real value as returned by the PLL's recalc_rate
+callback is 393216003, after setting PLL's clk rate to 393216000 clk_get_rate
+will return 393216003. If we now attempt to set rate of a PLL's child divider
+clock to 393216000/2 its rate will be 131072001, rather than 196608000.
+That is, the divider will be set to 3 instead of 2, because 393216003/2 is
+greater than 196608000.
+
+To fix this issue declared rates are changed to exactly match rates generated
+by the PLL, as calculated from the P, M, S, K coefficients.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Acked-by: Tomasz Figa <tomasz.figa@gmail.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/samsung/clk-exynos5433.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -725,7 +725,7 @@ static const struct samsung_pll_rate_tab
+ PLL_35XX_RATE(800000000U, 400, 6, 1),
+ PLL_35XX_RATE(733000000U, 733, 12, 1),
+ PLL_35XX_RATE(700000000U, 175, 3, 1),
+- PLL_35XX_RATE(667000000U, 222, 4, 1),
++ PLL_35XX_RATE(666000000U, 222, 4, 1),
+ PLL_35XX_RATE(633000000U, 211, 4, 1),
+ PLL_35XX_RATE(600000000U, 500, 5, 2),
+ PLL_35XX_RATE(552000000U, 460, 5, 2),
+@@ -753,12 +753,12 @@ static const struct samsung_pll_rate_tab
+ /* AUD_PLL */
+ static const struct samsung_pll_rate_table exynos5433_aud_pll_rates[] __initconst = {
+ PLL_36XX_RATE(400000000U, 200, 3, 2, 0),
+- PLL_36XX_RATE(393216000U, 197, 3, 2, -25690),
++ PLL_36XX_RATE(393216003U, 197, 3, 2, -25690),
+ PLL_36XX_RATE(384000000U, 128, 2, 2, 0),
+- PLL_36XX_RATE(368640000U, 246, 4, 2, -15729),
+- PLL_36XX_RATE(361507200U, 181, 3, 2, -16148),
+- PLL_36XX_RATE(338688000U, 113, 2, 2, -6816),
+- PLL_36XX_RATE(294912000U, 98, 1, 3, 19923),
++ PLL_36XX_RATE(368639991U, 246, 4, 2, -15729),
++ PLL_36XX_RATE(361507202U, 181, 3, 2, -16148),
++ PLL_36XX_RATE(338687988U, 113, 2, 2, -6816),
++ PLL_36XX_RATE(294912002U, 98, 1, 3, 19923),
+ PLL_36XX_RATE(288000000U, 96, 1, 3, 0),
+ PLL_36XX_RATE(252000000U, 84, 1, 3, 0),
+ { /* sentinel */ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Andrzej Hajda <a.hajda@samsung.com>
+Date: Fri, 16 Feb 2018 15:57:52 +0100
+Subject: clk: samsung: exynos7: Fix PLL rates
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit 7e4db0c2836e892766565965207eee051c8037b9 ]
+
+Rates declared in PLL rate tables should match exactly rates calculated from
+the PLL coefficients. If that is not the case, rate of the PLL's child clock
+might be set not as expected. For instance, if in the PLL rates table we have
+a 393216000 Hz entry and the real value as returned by the PLL's recalc_rate
+callback is 393216003, after setting PLL's clk rate to 393216000 clk_get_rate
+will return 393216003. If we now attempt to set rate of a PLL's child divider
+clock to 393216000/2 its rate will be 131072001, rather than 196608000.
+That is, the divider will be set to 3 instead of 2, because 393216003/2 is
+greater than 196608000.
+
+To fix this issue declared rates are changed to exactly match rates generated
+by the PLL, as calculated from the P, M, S, K coefficients.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Acked-by: Tomasz Figa <tomasz.figa@gmail.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/samsung/clk-exynos7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/samsung/clk-exynos7.c
++++ b/drivers/clk/samsung/clk-exynos7.c
+@@ -140,7 +140,7 @@ static const struct samsung_div_clock to
+ };
+
+ static const struct samsung_pll_rate_table pll1460x_24mhz_tbl[] __initconst = {
+- PLL_36XX_RATE(491520000, 20, 1, 0, 31457),
++ PLL_36XX_RATE(491519897, 20, 1, 0, 31457),
+ {},
+ };
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Andrzej Hajda <a.hajda@samsung.com>
+Date: Fri, 16 Feb 2018 15:57:53 +0100
+Subject: clk: samsung: s3c2410: Fix PLL rates
+
+From: Andrzej Hajda <a.hajda@samsung.com>
+
+[ Upstream commit 179db533c08431f509a3823077549773d519358b ]
+
+Rates declared in PLL rate tables should match exactly rates calculated from
+the PLL coefficients. If that is not the case, rate of the PLL's child clock
+might be set not as expected. For instance, if in the PLL rates table we have
+a 393216000 Hz entry and the real value as returned by the PLL's recalc_rate
+callback is 393216003, after setting PLL's clk rate to 393216000 clk_get_rate
+will return 393216003. If we now attempt to set rate of a PLL's child divider
+clock to 393216000/2 its rate will be 131072001, rather than 196608000.
+That is, the divider will be set to 3 instead of 2, because 393216003/2 is
+greater than 196608000.
+
+To fix this issue declared rates are changed to exactly match rates generated
+by the PLL, as calculated from the P, M, S, K coefficients.
+
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Acked-by: Tomasz Figa <tomasz.figa@gmail.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/samsung/clk-s3c2410.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/samsung/clk-s3c2410.c
++++ b/drivers/clk/samsung/clk-s3c2410.c
+@@ -168,7 +168,7 @@ static struct samsung_pll_rate_table pll
+ PLL_35XX_RATE(226000000, 105, 1, 1),
+ PLL_35XX_RATE(210000000, 132, 2, 1),
+ /* 2410 common */
+- PLL_35XX_RATE(203000000, 161, 3, 1),
++ PLL_35XX_RATE(202800000, 161, 3, 1),
+ PLL_35XX_RATE(192000000, 88, 1, 1),
+ PLL_35XX_RATE(186000000, 85, 1, 1),
+ PLL_35XX_RATE(180000000, 82, 1, 1),
+@@ -178,18 +178,18 @@ static struct samsung_pll_rate_table pll
+ PLL_35XX_RATE(147000000, 90, 2, 1),
+ PLL_35XX_RATE(135000000, 82, 2, 1),
+ PLL_35XX_RATE(124000000, 116, 1, 2),
+- PLL_35XX_RATE(118000000, 150, 2, 2),
++ PLL_35XX_RATE(118500000, 150, 2, 2),
+ PLL_35XX_RATE(113000000, 105, 1, 2),
+- PLL_35XX_RATE(101000000, 127, 2, 2),
++ PLL_35XX_RATE(101250000, 127, 2, 2),
+ PLL_35XX_RATE(90000000, 112, 2, 2),
+- PLL_35XX_RATE(85000000, 105, 2, 2),
++ PLL_35XX_RATE(84750000, 105, 2, 2),
+ PLL_35XX_RATE(79000000, 71, 1, 2),
+- PLL_35XX_RATE(68000000, 82, 2, 2),
+- PLL_35XX_RATE(56000000, 142, 2, 3),
++ PLL_35XX_RATE(67500000, 82, 2, 2),
++ PLL_35XX_RATE(56250000, 142, 2, 3),
+ PLL_35XX_RATE(48000000, 120, 2, 3),
+- PLL_35XX_RATE(51000000, 161, 3, 3),
++ PLL_35XX_RATE(50700000, 161, 3, 3),
+ PLL_35XX_RATE(45000000, 82, 1, 3),
+- PLL_35XX_RATE(34000000, 82, 2, 3),
++ PLL_35XX_RATE(33750000, 82, 2, 3),
+ { /* sentinel */ },
+ };
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Marcel Ziswiler <marcel@ziswiler.com>
+Date: Fri, 23 Feb 2018 00:04:51 +0100
+Subject: clk: tegra: Fix pll_u rate configuration
+
+From: Marcel Ziswiler <marcel@ziswiler.com>
+
+[ Upstream commit c35b518f9ba06c9de79fb3ff62eed7462d804995 ]
+
+Turns out latest upstream U-Boot does not configure/enable pll_u which
+leaves it at some default rate of 500 kHz:
+
+root@apalis-t30:~# cat /sys/kernel/debug/clk/clk_summary | grep pll_u
+ pll_u 3 3 0 500000 0
+
+Of course this won't quite work leading to the following messages:
+
+[ 6.559593] usb 2-1: new full-speed USB device number 2 using tegra-
+ehci
+[ 11.759173] usb 2-1: device descriptor read/64, error -110
+[ 27.119453] usb 2-1: device descriptor read/64, error -110
+[ 27.389217] usb 2-1: new full-speed USB device number 3 using tegra-
+ehci
+[ 32.559454] usb 2-1: device descriptor read/64, error -110
+[ 47.929777] usb 2-1: device descriptor read/64, error -110
+[ 48.049658] usb usb2-port1: attempt power cycle
+[ 48.759475] usb 2-1: new full-speed USB device number 4 using tegra-
+ehci
+[ 59.349457] usb 2-1: device not accepting address 4, error -110
+[ 59.509449] usb 2-1: new full-speed USB device number 5 using tegra-
+ehci
+[ 70.069457] usb 2-1: device not accepting address 5, error -110
+[ 70.079721] usb usb2-port1: unable to enumerate USB device
+
+Fix this by actually allowing the rate also being set from within
+the Linux kernel.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/tegra/clk-pll.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -1151,6 +1151,8 @@ static const struct clk_ops tegra_clk_pl
+ .enable = clk_pllu_enable,
+ .disable = clk_pll_disable,
+ .recalc_rate = clk_pll_recalc_rate,
++ .round_rate = clk_pll_round_rate,
++ .set_rate = clk_pll_set_rate,
+ };
+
+ static int _pll_fixed_mdiv(struct tegra_clk_pll_params *pll_params,
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Fri, 23 Feb 2018 10:01:40 +0100
+Subject: crypto: atmel-aes - fix the keys zeroing on errors
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit 5d804a5157dbaa64872a675923ae87161165c66b ]
+
+The Atmel AES driver uses memzero_explicit on the keys on error, but the
+variable zeroed isn't the right one because of a typo. Fix this by using
+the right variable.
+
+Fixes: 89a82ef87e01 ("crypto: atmel-authenc - add support to authenc(hmac(shaX), Y(aes)) modes")
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/atmel-aes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/atmel-aes.c
++++ b/drivers/crypto/atmel-aes.c
+@@ -2145,7 +2145,7 @@ static int atmel_aes_authenc_setkey(stru
+
+ badkey:
+ crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+- memzero_explicit(&key, sizeof(keys));
++ memzero_explicit(&keys, sizeof(keys));
+ return -EINVAL;
+ }
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Fri, 23 Feb 2018 23:33:07 +0100
+Subject: crypto: ccp - don't disable interrupts while setting up debugfs
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 79eb382b5e06a6dca5806465d7195d686a463ab0 ]
+
+I don't why we need take a single write lock and disable interrupts
+while setting up debugfs. This is what what happens when we try anyway:
+
+|ccp 0000:03:00.2: enabling device (0000 -> 0002)
+|BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:69
+|in_atomic(): 1, irqs_disabled(): 1, pid: 3, name: kworker/0:0
+|irq event stamp: 17150
+|hardirqs last enabled at (17149): [<0000000097a18c49>] restore_regs_and_return_to_kernel+0x0/0x23
+|hardirqs last disabled at (17150): [<000000000773b3a9>] _raw_write_lock_irqsave+0x1b/0x50
+|softirqs last enabled at (17148): [<0000000064d56155>] __do_softirq+0x3b8/0x4c1
+|softirqs last disabled at (17125): [<0000000092633c18>] irq_exit+0xb1/0xc0
+|CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.16.0-rc2+ #30
+|Workqueue: events work_for_cpu_fn
+|Call Trace:
+| dump_stack+0x7d/0xb6
+| ___might_sleep+0x1eb/0x250
+| down_write+0x17/0x60
+| start_creating+0x4c/0xe0
+| debugfs_create_dir+0x9/0x100
+| ccp5_debugfs_setup+0x191/0x1b0
+| ccp5_init+0x8a7/0x8c0
+| ccp_dev_init+0xb8/0xe0
+| sp_init+0x6c/0x90
+| sp_pci_probe+0x26e/0x590
+| local_pci_probe+0x3f/0x90
+| work_for_cpu_fn+0x11/0x20
+| process_one_work+0x1ff/0x650
+| worker_thread+0x1d4/0x3a0
+| kthread+0xfe/0x130
+| ret_from_fork+0x27/0x50
+
+If any locking is required, a simple mutex will do it.
+
+Cc: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Acked-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/ccp/ccp-debugfs.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/crypto/ccp/ccp-debugfs.c
++++ b/drivers/crypto/ccp/ccp-debugfs.c
+@@ -278,7 +278,7 @@ static const struct file_operations ccp_
+ };
+
+ static struct dentry *ccp_debugfs_dir;
+-static DEFINE_RWLOCK(ccp_debugfs_lock);
++static DEFINE_MUTEX(ccp_debugfs_lock);
+
+ #define MAX_NAME_LEN 20
+
+@@ -290,16 +290,15 @@ void ccp5_debugfs_setup(struct ccp_devic
+ struct dentry *debugfs_stats;
+ struct dentry *debugfs_q_instance;
+ struct dentry *debugfs_q_stats;
+- unsigned long flags;
+ int i;
+
+ if (!debugfs_initialized())
+ return;
+
+- write_lock_irqsave(&ccp_debugfs_lock, flags);
++ mutex_lock(&ccp_debugfs_lock);
+ if (!ccp_debugfs_dir)
+ ccp_debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+- write_unlock_irqrestore(&ccp_debugfs_lock, flags);
++ mutex_unlock(&ccp_debugfs_lock);
+ if (!ccp_debugfs_dir)
+ return;
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Tue, 13 Feb 2018 09:26:54 +0100
+Subject: crypto: inside-secure - do not process request if no command was issued
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit 95831ceafc0de7d94a5fe86ebb1c2042317cc2cd ]
+
+This patch adds a check in the SafeXcel dequeue function, to avoid
+processing request further if no hardware command was issued. This can
+happen in certain cases where the ->send() function caches all the data
+that would have been send.
+
+Fixes: 809778e02cd4 ("crypto: inside-secure - fix hash when length is a multiple of a block")
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -462,6 +462,15 @@ void safexcel_dequeue(struct safexcel_cr
+ if (backlog)
+ backlog->complete(backlog, -EINPROGRESS);
+
++ /* In case the send() helper did not issue any command to push
++ * to the engine because the input data was cached, continue to
++ * dequeue other requests as this is valid and not an error.
++ */
++ if (!commands && !results) {
++ kfree(request);
++ continue;
++ }
++
+ spin_lock_bh(&priv->ring[ring].egress_lock);
+ list_add_tail(&request->list, &priv->ring[ring].list);
+ spin_unlock_bh(&priv->ring[ring].egress_lock);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Tue, 13 Feb 2018 09:26:53 +0100
+Subject: crypto: inside-secure - fix the cache_len computation
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit 666a9c70b04fccabde5cea5e680ae1ae92460a62 ]
+
+This patch fixes the cache length computation as cache_len could end up
+being a negative value. The check between the queued size and the
+block size is updated to reflect the caching mechanism which can cache
+up to a full block size (included!).
+
+Fixes: 809778e02cd4 ("crypto: inside-secure - fix hash when length is a multiple of a block")
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -185,7 +185,7 @@ static int safexcel_ahash_send_req(struc
+ int i, queued, len, cache_len, extra, n_cdesc = 0, ret = 0;
+
+ queued = len = req->len - req->processed;
+- if (queued < crypto_ahash_blocksize(ahash))
++ if (queued <= crypto_ahash_blocksize(ahash))
+ cache_len = queued;
+ else
+ cache_len = queued - areq->nbytes;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Tue, 13 Feb 2018 09:26:52 +0100
+Subject: crypto: inside-secure - fix the extra cache computation
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit c1a8fa6e240ed4b99778d48ab790743565cb61c8 ]
+
+This patch fixes the extra cache computation when the queued data is a
+multiple of a block size. This fixes the hash support in some cases.
+
+Fixes: 809778e02cd4 ("crypto: inside-secure - fix hash when length is a multiple of a block")
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -199,7 +199,7 @@ static int safexcel_ahash_send_req(struc
+ /* If this is not the last request and the queued data
+ * is a multiple of a block, cache the last one for now.
+ */
+- extra = queued - crypto_ahash_blocksize(ahash);
++ extra = crypto_ahash_blocksize(ahash);
+
+ if (extra) {
+ sg_pcopy_to_buffer(areq->src, sg_nents(areq->src),
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Tue, 13 Feb 2018 09:26:55 +0100
+Subject: crypto: inside-secure - fix the invalidation step during cra_exit
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit b7007dbccd92f7b8c00e590020bee542a48c6a2c ]
+
+When exiting a transformation, the cra_exit() helper is called in each
+driver providing one. The Inside Secure SafeXcel driver has one, which
+is responsible of freeing some areas and of sending one invalidation
+request to the crypto engine, to invalidate the context that was used
+during the transformation.
+
+We could see in some setups (when lots of transformations were being
+used with a short lifetime, and hence lots of cra_exit() calls) NULL
+pointer dereferences and other weird issues. All these issues were
+coming from accessing the tfm context.
+
+The issue is the invalidation request completion is checked using a
+wait_for_completion_interruptible() call in both the cipher and hash
+cra_exit() helpers. In some cases this was interrupted while the
+invalidation request wasn't processed yet. And then cra_exit() returned,
+and its caller was freeing the tfm instance. Only then the request was
+being handled by the SafeXcel driver, which lead to the said issues.
+
+This patch fixes this by using wait_for_completion() calls in these
+specific cases.
+
+Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel_cipher.c | 2 +-
+ drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/inside-secure/safexcel_cipher.c
++++ b/drivers/crypto/inside-secure/safexcel_cipher.c
+@@ -446,7 +446,7 @@ static int safexcel_cipher_exit_inv(stru
+ if (!priv->ring[ring].need_dequeue)
+ safexcel_dequeue(priv, ring);
+
+- wait_for_completion_interruptible(&result.completion);
++ wait_for_completion(&result.completion);
+
+ if (result.error) {
+ dev_warn(priv->dev,
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -494,7 +494,7 @@ static int safexcel_ahash_exit_inv(struc
+ if (!priv->ring[ring].need_dequeue)
+ safexcel_dequeue(priv, ring);
+
+- wait_for_completion_interruptible(&result.completion);
++ wait_for_completion(&result.completion);
+
+ if (result.error) {
+ dev_warn(priv->dev, "hash: completion error (%d)\n",
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Mon, 26 Feb 2018 14:45:12 +0100
+Subject: crypto: inside-secure - wait for the request to complete if in the backlog
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit 4dc5475ae0375ea4f9283dfd9b2ddc91b20d4c4b ]
+
+This patch updates the safexcel_hmac_init_pad() function to also wait
+for completion when the digest return code is -EBUSY, as it would mean
+the request is in the backlog to be processed later.
+
+Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")
+Suggested-by: Ofer Heifetz <oferh@marvell.com>
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -819,7 +819,7 @@ static int safexcel_hmac_init_pad(struct
+ init_completion(&result.completion);
+
+ ret = crypto_ahash_digest(areq);
+- if (ret == -EINPROGRESS) {
++ if (ret == -EINPROGRESS || ret == -EBUSY) {
+ wait_for_completion_interruptible(&result.completion);
+ ret = result.error;
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Sun, 11 Feb 2018 23:15:37 +0000
+Subject: crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 7c73cf4cc2ac16465f5102437dc0a12d66671bd6 ]
+
+The MODULE_ALIAS is required to enable the sun4i-ss driver to load
+automatically when built at a module. Tested on a Cubietruck.
+
+Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/sunxi-ss/sun4i-ss-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-core.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-core.c
+@@ -451,6 +451,7 @@ static struct platform_driver sun4i_ss_d
+
+ module_platform_driver(sun4i_ss_driver);
+
++MODULE_ALIAS("platform:sun4i-ss");
+ MODULE_DESCRIPTION("Allwinner Security System cryptographic accelerator");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Corentin LABBE <clabbe.montjoie@gmail.com>");
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Tue, 6 Mar 2018 14:15:37 -0500
+Subject: media: cx23885: Override 888 ImpactVCBe crystal frequency
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit 779c79d4b833ec646b0aed878da38edb45bbe156 ]
+
+Hauppauge produced a revision of ImpactVCBe using an 888,
+with a 25MHz crystal, instead of using the default third
+overtone 50Mhz crystal. This overrides that frequency so
+that the cx25840 is properly configured. Without the proper
+crystal setup the cx25840 cannot load the firmware or
+decode video.
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx23885/cx23885-core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/media/pci/cx23885/cx23885-core.c
++++ b/drivers/media/pci/cx23885/cx23885-core.c
+@@ -873,6 +873,16 @@ static int cx23885_dev_setup(struct cx23
+ if (cx23885_boards[dev->board].clk_freq > 0)
+ dev->clk_freq = cx23885_boards[dev->board].clk_freq;
+
++ if (dev->board == CX23885_BOARD_HAUPPAUGE_IMPACTVCBE &&
++ dev->pci->subsystem_device == 0x7137) {
++ /* Hauppauge ImpactVCBe device ID 0x7137 is populated
++ * with an 888, and a 25Mhz crystal, instead of the
++ * usual third overtone 50Mhz. The default clock rate must
++ * be overridden so the cx25840 is properly configured
++ */
++ dev->clk_freq = 25000000;
++ }
++
+ dev->pci_bus = dev->pci->bus->number;
+ dev->pci_slot = PCI_SLOT(dev->pci->devfn);
+ cx23885_irq_add(dev, 0x001f00);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Tue, 6 Mar 2018 14:15:36 -0500
+Subject: media: cx23885: Set subdev host data to clk_freq pointer
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit 5ceade1d97fc6687e050c44c257382c192f56276 ]
+
+Currently clk_freq is ignored entirely, because the cx235840 driver
+configures the xtal at the chip defaults. This is an issue if a
+board is produced with a non-default frequency crystal. If clk_freq
+is not zero the cx25840 will attempt to use the setting provided,
+or fall back to defaults otherwise.
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx23885/cx23885-cards.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/pci/cx23885/cx23885-cards.c
++++ b/drivers/media/pci/cx23885/cx23885-cards.c
+@@ -2286,6 +2286,10 @@ void cx23885_card_setup(struct cx23885_d
+ &dev->i2c_bus[2].i2c_adap,
+ "cx25840", 0x88 >> 1, NULL);
+ if (dev->sd_cx25840) {
++ /* set host data for clk_freq configuration */
++ v4l2_set_subdev_hostdata(dev->sd_cx25840,
++ &dev->clk_freq);
++
+ dev->sd_cx25840->grp_id = CX23885_HW_AV_CORE;
+ v4l2_subdev_call(dev->sd_cx25840, core, load_fw);
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 31 Jan 2018 12:33:09 -0500
+Subject: media: cx25821: prevent out-of-bounds read on array card
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 67300abdbe9f1717532aaf4e037222762716d0f6 ]
+
+Currently an out of range dev->nr is detected by just reporting the
+issue and later on an out-of-bounds read on array card occurs because
+of this. Fix this by checking the upper range of dev->nr with the size
+of array card (removes the hard coded size), move this check earlier
+and also exit with the error -ENOSYS to avoid the later out-of-bounds
+array read.
+
+Detected by CoverityScan, CID#711191 ("Out-of-bounds-read")
+
+Fixes: commit 02b20b0b4cde ("V4L/DVB (12730): Add conexant cx25821 driver")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+[hans.verkuil@cisco.com: %ld -> %zd]
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -867,6 +867,10 @@ static int cx25821_dev_setup(struct cx25
+ dev->nr = ++cx25821_devcount;
+ sprintf(dev->name, "cx25821[%d]", dev->nr);
+
++ if (dev->nr >= ARRAY_SIZE(card)) {
++ CX25821_INFO("dev->nr >= %zd", ARRAY_SIZE(card));
++ return -ENODEV;
++ }
+ if (dev->pci->device != 0x8210) {
+ pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n",
+ __func__, dev->pci->device);
+@@ -882,9 +886,6 @@ static int cx25821_dev_setup(struct cx25
+ dev->channels[i].sram_channels = &cx25821_sram_channels[i];
+ }
+
+- if (dev->nr > 1)
+- CX25821_INFO("dev->nr > 1!");
+-
+ /* board config */
+ dev->board = 1; /* card[dev->nr]; */
+ dev->_max_num_decoders = MAX_DECODERS;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Sun, 11 Feb 2018 05:44:21 -0500
+Subject: media: dmxdev: fix error code for invalid ioctls
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit a145f64c6107d3aa5a7cec9f8977d04ac2a896c9 ]
+
+Returning -EINVAL when an ioctl is not implemented is a very
+bad idea, as it is hard to distinguish from other error
+contitions that an ioctl could lead. Replace it by its
+right error code: -ENOTTY.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-core/dmxdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -1055,7 +1055,7 @@ static int dvb_demux_do_ioctl(struct fil
+ break;
+
+ default:
+- ret = -EINVAL;
++ ret = -ENOTTY;
+ break;
+ }
+ mutex_unlock(&dmxdev->mutex);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Date: Mon, 19 Feb 2018 13:23:39 -0500
+Subject: media: Don't let tvp5150_get_vbi() go out of vbi_ram_default array
+
+From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+
+[ Upstream commit 3dd6b560dc5d59e7cb6dbda6e85dc9af7925fcf8 ]
+
+As pointed by Dan, possible values for bits[3:0] of te Line Mode Registers
+can range from 0x0 to 0xf, but the check logic allow values ranging
+from 0x0 to 0xe.
+
+As static arrays are initialized with zero, using a value without
+an explicit initializer at the array won't cause any harm.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/tvp5150.c | 88 ++++++++++++++++++++++----------------------
+ 1 file changed, 45 insertions(+), 43 deletions(-)
+
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -506,80 +506,77 @@ static struct i2c_vbi_ram_value vbi_ram_
+ /* FIXME: Current api doesn't handle all VBI types, those not
+ yet supported are placed under #if 0 */
+ #if 0
+- {0x010, /* Teletext, SECAM, WST System A */
++ [0] = {0x010, /* Teletext, SECAM, WST System A */
+ {V4L2_SLICED_TELETEXT_SECAM,6,23,1},
+ { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x26,
+ 0xe6, 0xb4, 0x0e, 0x00, 0x00, 0x00, 0x10, 0x00 }
+ },
+ #endif
+- {0x030, /* Teletext, PAL, WST System B */
++ [1] = {0x030, /* Teletext, PAL, WST System B */
+ {V4L2_SLICED_TELETEXT_B,6,22,1},
+ { 0xaa, 0xaa, 0xff, 0xff, 0x27, 0x2e, 0x20, 0x2b,
+ 0xa6, 0x72, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00 }
+ },
+ #if 0
+- {0x050, /* Teletext, PAL, WST System C */
++ [2] = {0x050, /* Teletext, PAL, WST System C */
+ {V4L2_SLICED_TELETEXT_PAL_C,6,22,1},
+ { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x22,
+ 0xa6, 0x98, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 }
+ },
+- {0x070, /* Teletext, NTSC, WST System B */
++ [3] = {0x070, /* Teletext, NTSC, WST System B */
+ {V4L2_SLICED_TELETEXT_NTSC_B,10,21,1},
+ { 0xaa, 0xaa, 0xff, 0xff, 0x27, 0x2e, 0x20, 0x23,
+ 0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 }
+ },
+- {0x090, /* Tetetext, NTSC NABTS System C */
++ [4] = {0x090, /* Tetetext, NTSC NABTS System C */
+ {V4L2_SLICED_TELETEXT_NTSC_C,10,21,1},
+ { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x22,
+ 0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x15, 0x00 }
+ },
+- {0x0b0, /* Teletext, NTSC-J, NABTS System D */
++ [5] = {0x0b0, /* Teletext, NTSC-J, NABTS System D */
+ {V4L2_SLICED_TELETEXT_NTSC_D,10,21,1},
+ { 0xaa, 0xaa, 0xff, 0xff, 0xa7, 0x2e, 0x20, 0x23,
+ 0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 }
+ },
+- {0x0d0, /* Closed Caption, PAL/SECAM */
++ [6] = {0x0d0, /* Closed Caption, PAL/SECAM */
+ {V4L2_SLICED_CAPTION_625,22,22,1},
+ { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02,
+ 0xa6, 0x7b, 0x09, 0x00, 0x00, 0x00, 0x27, 0x00 }
+ },
+ #endif
+- {0x0f0, /* Closed Caption, NTSC */
++ [7] = {0x0f0, /* Closed Caption, NTSC */
+ {V4L2_SLICED_CAPTION_525,21,21,1},
+ { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02,
+ 0x69, 0x8c, 0x09, 0x00, 0x00, 0x00, 0x27, 0x00 }
+ },
+- {0x110, /* Wide Screen Signal, PAL/SECAM */
++ [8] = {0x110, /* Wide Screen Signal, PAL/SECAM */
+ {V4L2_SLICED_WSS_625,23,23,1},
+ { 0x5b, 0x55, 0xc5, 0xff, 0x00, 0x71, 0x6e, 0x42,
+ 0xa6, 0xcd, 0x0f, 0x00, 0x00, 0x00, 0x3a, 0x00 }
+ },
+ #if 0
+- {0x130, /* Wide Screen Signal, NTSC C */
++ [9] = {0x130, /* Wide Screen Signal, NTSC C */
+ {V4L2_SLICED_WSS_525,20,20,1},
+ { 0x38, 0x00, 0x3f, 0x00, 0x00, 0x71, 0x6e, 0x43,
+ 0x69, 0x7c, 0x08, 0x00, 0x00, 0x00, 0x39, 0x00 }
+ },
+- {0x150, /* Vertical Interval Timecode (VITC), PAL/SECAM */
++ [10] = {0x150, /* Vertical Interval Timecode (VITC), PAL/SECAM */
+ {V4l2_SLICED_VITC_625,6,22,0},
+ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x8f, 0x6d, 0x49,
+ 0xa6, 0x85, 0x08, 0x00, 0x00, 0x00, 0x4c, 0x00 }
+ },
+- {0x170, /* Vertical Interval Timecode (VITC), NTSC */
++ [11] = {0x170, /* Vertical Interval Timecode (VITC), NTSC */
+ {V4l2_SLICED_VITC_525,10,20,0},
+ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x8f, 0x6d, 0x49,
+ 0x69, 0x94, 0x08, 0x00, 0x00, 0x00, 0x4c, 0x00 }
+ },
+ #endif
+- {0x190, /* Video Program System (VPS), PAL */
++ [12] = {0x190, /* Video Program System (VPS), PAL */
+ {V4L2_SLICED_VPS,16,16,0},
+ { 0xaa, 0xaa, 0xff, 0xff, 0xba, 0xce, 0x2b, 0x0d,
+ 0xa6, 0xda, 0x0b, 0x00, 0x00, 0x00, 0x60, 0x00 }
+ },
+ /* 0x1d0 User programmable */
+-
+- /* End of struct */
+- { (u16)-1 }
+ };
+
+ static int tvp5150_write_inittab(struct v4l2_subdev *sd,
+@@ -592,10 +589,10 @@ static int tvp5150_write_inittab(struct
+ return 0;
+ }
+
+-static int tvp5150_vdp_init(struct v4l2_subdev *sd,
+- const struct i2c_vbi_ram_value *regs)
++static int tvp5150_vdp_init(struct v4l2_subdev *sd)
+ {
+ unsigned int i;
++ int j;
+
+ /* Disable Full Field */
+ tvp5150_write(sd, TVP5150_FULL_FIELD_ENA, 0);
+@@ -605,14 +602,17 @@ static int tvp5150_vdp_init(struct v4l2_
+ tvp5150_write(sd, i, 0xff);
+
+ /* Load Ram Table */
+- while (regs->reg != (u16)-1) {
++ for (j = 0; j < ARRAY_SIZE(vbi_ram_default); j++) {
++ const struct i2c_vbi_ram_value *regs = &vbi_ram_default[j];
++
++ if (!regs->type.vbi_type)
++ continue;
++
+ tvp5150_write(sd, TVP5150_CONF_RAM_ADDR_HIGH, regs->reg >> 8);
+ tvp5150_write(sd, TVP5150_CONF_RAM_ADDR_LOW, regs->reg);
+
+ for (i = 0; i < 16; i++)
+ tvp5150_write(sd, TVP5150_VDP_CONF_RAM_DATA, regs->values[i]);
+-
+- regs++;
+ }
+ return 0;
+ }
+@@ -621,19 +621,23 @@ static int tvp5150_vdp_init(struct v4l2_
+ static int tvp5150_g_sliced_vbi_cap(struct v4l2_subdev *sd,
+ struct v4l2_sliced_vbi_cap *cap)
+ {
+- const struct i2c_vbi_ram_value *regs = vbi_ram_default;
+- int line;
++ int line, i;
+
+ dev_dbg_lvl(sd->dev, 1, debug, "g_sliced_vbi_cap\n");
+ memset(cap, 0, sizeof *cap);
+
+- while (regs->reg != (u16)-1 ) {
+- for (line=regs->type.ini_line;line<=regs->type.end_line;line++) {
++ for (i = 0; i < ARRAY_SIZE(vbi_ram_default); i++) {
++ const struct i2c_vbi_ram_value *regs = &vbi_ram_default[i];
++
++ if (!regs->type.vbi_type)
++ continue;
++
++ for (line = regs->type.ini_line;
++ line <= regs->type.end_line;
++ line++) {
+ cap->service_lines[0][line] |= regs->type.vbi_type;
+ }
+ cap->service_set |= regs->type.vbi_type;
+-
+- regs++;
+ }
+ return 0;
+ }
+@@ -652,14 +656,13 @@ static int tvp5150_g_sliced_vbi_cap(stru
+ * MSB = field2
+ */
+ static int tvp5150_set_vbi(struct v4l2_subdev *sd,
+- const struct i2c_vbi_ram_value *regs,
+ unsigned int type,u8 flags, int line,
+ const int fields)
+ {
+ struct tvp5150 *decoder = to_tvp5150(sd);
+ v4l2_std_id std = decoder->norm;
+ u8 reg;
+- int pos = 0;
++ int i, pos = 0;
+
+ if (std == V4L2_STD_ALL) {
+ dev_err(sd->dev, "VBI can't be configured without knowing number of lines\n");
+@@ -672,19 +675,19 @@ static int tvp5150_set_vbi(struct v4l2_s
+ if (line < 6 || line > 27)
+ return 0;
+
+- while (regs->reg != (u16)-1) {
++ for (i = 0; i < ARRAY_SIZE(vbi_ram_default); i++) {
++ const struct i2c_vbi_ram_value *regs = &vbi_ram_default[i];
++
++ if (!regs->type.vbi_type)
++ continue;
++
+ if ((type & regs->type.vbi_type) &&
+ (line >= regs->type.ini_line) &&
+ (line <= regs->type.end_line))
+ break;
+-
+- regs++;
+ pos++;
+ }
+
+- if (regs->reg == (u16)-1)
+- return 0;
+-
+ type = pos | (flags & 0xf0);
+ reg = ((line - 6) << 1) + TVP5150_LINE_MODE_INI;
+
+@@ -697,8 +700,7 @@ static int tvp5150_set_vbi(struct v4l2_s
+ return type;
+ }
+
+-static int tvp5150_get_vbi(struct v4l2_subdev *sd,
+- const struct i2c_vbi_ram_value *regs, int line)
++static int tvp5150_get_vbi(struct v4l2_subdev *sd, int line)
+ {
+ struct tvp5150 *decoder = to_tvp5150(sd);
+ v4l2_std_id std = decoder->norm;
+@@ -727,8 +729,8 @@ static int tvp5150_get_vbi(struct v4l2_s
+ return 0;
+ }
+ pos = ret & 0x0f;
+- if (pos < 0x0f)
+- type |= regs[pos].type.vbi_type;
++ if (pos < ARRAY_SIZE(vbi_ram_default))
++ type |= vbi_ram_default[pos].type.vbi_type;
+ }
+
+ return type;
+@@ -789,7 +791,7 @@ static int tvp5150_reset(struct v4l2_sub
+ tvp5150_write_inittab(sd, tvp5150_init_default);
+
+ /* Initializes VDP registers */
+- tvp5150_vdp_init(sd, vbi_ram_default);
++ tvp5150_vdp_init(sd);
+
+ /* Selects decoder input */
+ tvp5150_selmux(sd);
+@@ -1122,8 +1124,8 @@ static int tvp5150_s_sliced_fmt(struct v
+ for (i = 0; i <= 23; i++) {
+ svbi->service_lines[1][i] = 0;
+ svbi->service_lines[0][i] =
+- tvp5150_set_vbi(sd, vbi_ram_default,
+- svbi->service_lines[0][i], 0xf0, i, 3);
++ tvp5150_set_vbi(sd, svbi->service_lines[0][i],
++ 0xf0, i, 3);
+ }
+ /* Enables FIFO */
+ tvp5150_write(sd, TVP5150_FIFO_OUT_CTRL, 1);
+@@ -1149,7 +1151,7 @@ static int tvp5150_g_sliced_fmt(struct v
+
+ for (i = 0; i <= 23; i++) {
+ svbi->service_lines[0][i] =
+- tvp5150_get_vbi(sd, vbi_ram_default, i);
++ tvp5150_get_vbi(sd, i);
+ mask |= svbi->service_lines[0][i];
+ }
+ svbi->service_set = mask;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Thu, 4 Jan 2018 19:04:15 -0500
+Subject: media: em28xx: Add Hauppauge SoloHD/DualHD bulk models
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit f2a326c928cca1f5e36a3dceaf66e8c6b34e9cb8 ]
+
+Add additional pids to driver list
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -508,8 +508,10 @@ static struct em28xx_reg_seq plex_px_bcu
+ };
+
+ /*
+- * 2040:0265 Hauppauge WinTV-dualHD DVB
+- * 2040:026d Hauppauge WinTV-dualHD ATSC/QAM
++ * 2040:0265 Hauppauge WinTV-dualHD DVB Isoc
++ * 2040:8265 Hauppauge WinTV-dualHD DVB Bulk
++ * 2040:026d Hauppauge WinTV-dualHD ATSC/QAM Isoc
++ * 2040:826d Hauppauge WinTV-dualHD ATSC/QAM Bulk
+ * reg 0x80/0x84:
+ * GPIO_0: Yellow LED tuner 1, 0=on, 1=off
+ * GPIO_1: Green LED tuner 1, 0=on, 1=off
+@@ -2392,7 +2394,8 @@ struct em28xx_board em28xx_boards[] = {
+ .has_dvb = 1,
+ },
+ /*
+- * 2040:0265 Hauppauge WinTV-dualHD (DVB version).
++ * 2040:0265 Hauppauge WinTV-dualHD (DVB version) Isoc.
++ * 2040:8265 Hauppauge WinTV-dualHD (DVB version) Bulk.
+ * Empia EM28274, 2x Silicon Labs Si2168, 2x Silicon Labs Si2157
+ */
+ [EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_DVB] = {
+@@ -2407,7 +2410,8 @@ struct em28xx_board em28xx_boards[] = {
+ .leds = hauppauge_dualhd_leds,
+ },
+ /*
+- * 2040:026d Hauppauge WinTV-dualHD (model 01595 - ATSC/QAM).
++ * 2040:026d Hauppauge WinTV-dualHD (model 01595 - ATSC/QAM) Isoc.
++ * 2040:826d Hauppauge WinTV-dualHD (model 01595 - ATSC/QAM) Bulk.
+ * Empia EM28274, 2x LG LGDT3306A, 2x Silicon Labs Si2157
+ */
+ [EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_01595] = {
+@@ -2548,8 +2552,12 @@ struct usb_device_id em28xx_id_table[] =
+ .driver_info = EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850 },
+ { USB_DEVICE(0x2040, 0x0265),
+ .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_DVB },
++ { USB_DEVICE(0x2040, 0x8265),
++ .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_DVB },
+ { USB_DEVICE(0x2040, 0x026d),
+ .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_01595 },
++ { USB_DEVICE(0x2040, 0x826d),
++ .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_01595 },
+ { USB_DEVICE(0x0438, 0xb002),
+ .driver_info = EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600 },
+ { USB_DEVICE(0x2001, 0xf112),
+@@ -2610,7 +2618,11 @@ struct usb_device_id em28xx_id_table[] =
+ .driver_info = EM28178_BOARD_PCTV_461E },
+ { USB_DEVICE(0x2013, 0x025f),
+ .driver_info = EM28178_BOARD_PCTV_292E },
+- { USB_DEVICE(0x2040, 0x0264), /* Hauppauge WinTV-soloHD */
++ { USB_DEVICE(0x2040, 0x0264), /* Hauppauge WinTV-soloHD Isoc */
++ .driver_info = EM28178_BOARD_PCTV_292E },
++ { USB_DEVICE(0x2040, 0x8264), /* Hauppauge OEM Generic WinTV-soloHD Bulk */
++ .driver_info = EM28178_BOARD_PCTV_292E },
++ { USB_DEVICE(0x2040, 0x8268), /* Hauppauge Retail WinTV-soloHD Bulk */
+ .driver_info = EM28178_BOARD_PCTV_292E },
+ { USB_DEVICE(0x0413, 0x6f07),
+ .driver_info = EM2861_BOARD_LEADTEK_VC100 },
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Thu, 4 Jan 2018 19:04:13 -0500
+Subject: media: em28xx: USB bulk packet size fix
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit c7c7e8d7803406daa21e96d00c357de8b77b6764 ]
+
+Hauppauge em28xx bulk devices exhibit continuity errors and corrupted
+packets, when run in VMWare virtual machines. Unknown if other
+manufacturers bulk models exhibit the same issue. KVM/Qemu is unaffected.
+
+According to documentation the maximum packet multiplier for em28xx in bulk
+transfer mode is 256 * 188 bytes. This changes the size of bulk transfers
+to maximum supported value and have a bonus beneficial alignment.
+
+Before:
+
+After:
+
+This sets up USB to expect just as many bytes as the em28xx is set to emit.
+
+Successful usage under load afterwards natively and in both VMWare
+and KVM/Qemu virtual machines.
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/em28xx/em28xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/em28xx/em28xx.h
++++ b/drivers/media/usb/em28xx/em28xx.h
+@@ -191,7 +191,7 @@
+ USB 2.0 spec says bulk packet size is always 512 bytes
+ */
+ #define EM28XX_BULK_PACKET_MULTIPLIER 384
+-#define EM28XX_DVB_BULK_PACKET_MULTIPLIER 384
++#define EM28XX_DVB_BULK_PACKET_MULTIPLIER 94
+
+ #define EM28XX_INTERLACED_DEFAULT 1
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Mon, 8 Jan 2018 13:14:04 -0500
+Subject: media: i2c: adv748x: fix HDMI field heights
+
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+[ Upstream commit 9f564184e6cc21a86c26bab920afac1bab7653ff ]
+
+The ADV748x handles interlaced media using V4L2_FIELD_ALTERNATE field
+types. The correct specification for the height on the mbus is the
+image height, in this instance, the field height.
+
+The AFE component already correctly adjusts the height on the mbus, but
+the HDMI component got left behind.
+
+Adjust the mbus height to correctly describe the image height of the
+fields when processing interlaced video for HDMI pipelines.
+
+Fixes: 3e89586a64df ("media: i2c: adv748x: add adv748x driver")
+
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/adv748x/adv748x-hdmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/i2c/adv748x/adv748x-hdmi.c
++++ b/drivers/media/i2c/adv748x/adv748x-hdmi.c
+@@ -105,6 +105,9 @@ static void adv748x_hdmi_fill_format(str
+
+ fmt->width = hdmi->timings.bt.width;
+ fmt->height = hdmi->timings.bt.height;
++
++ if (fmt->field == V4L2_FIELD_ALTERNATE)
++ fmt->height /= 2;
+ }
+
+ static void adv748x_fill_optional_dv_timings(struct v4l2_dv_timings *timings)
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Fri, 5 Jan 2018 09:57:13 -0500
+Subject: media: lgdt3306a: Fix a double kfree on i2c device remove
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit 94448e21cf08b10f7dc7acdaca387594370396b0 ]
+
+Both lgdt33606a_release and lgdt3306a_remove kfree state, but _release is
+called first, then _remove operates on states members before kfree'ing it.
+This can lead to random oops/GPF/etc on USB disconnect.
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-frontends/lgdt3306a.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-frontends/lgdt3306a.c
++++ b/drivers/media/dvb-frontends/lgdt3306a.c
+@@ -1767,7 +1767,13 @@ static void lgdt3306a_release(struct dvb
+ struct lgdt3306a_state *state = fe->demodulator_priv;
+
+ dbg_info("\n");
+- kfree(state);
++
++ /*
++ * If state->muxc is not NULL, then we are an i2c device
++ * and lgdt3306a_remove will clean up state
++ */
++ if (!state->muxc)
++ kfree(state);
+ }
+
+ static const struct dvb_frontend_ops lgdt3306a_ops;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Brad Love <brad@nextdimension.cc>
+Date: Fri, 5 Jan 2018 09:57:12 -0500
+Subject: media: lgdt3306a: Fix module count mismatch on usb unplug
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit 835d66173a38538c072a7c393d02360dcfac8582 ]
+
+When used as an i2c device there is a module usage count mismatch on
+removal, preventing the driver from being used thereafter. dvb_attach
+increments the usage count so it is properly balanced on removal.
+
+On disconnect of Hauppauge SoloHD/DualHD before:
+
+lsmod | grep lgdt3306a
+lgdt3306a 28672 -1
+i2c_mux 16384 1 lgdt3306a
+
+On disconnect of Hauppauge SoloHD/DualHD after:
+
+lsmod | grep lgdt3306a
+lgdt3306a 28672 0
+i2c_mux 16384 1 lgdt3306a
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-frontends/lgdt3306a.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-frontends/lgdt3306a.c
++++ b/drivers/media/dvb-frontends/lgdt3306a.c
+@@ -2168,7 +2168,7 @@ static int lgdt3306a_probe(struct i2c_cl
+ sizeof(struct lgdt3306a_config));
+
+ config->i2c_addr = client->addr;
+- fe = lgdt3306a_attach(config, client->adapter);
++ fe = dvb_attach(lgdt3306a_attach, config, client->adapter);
+ if (fe == NULL) {
+ ret = -ENODEV;
+ goto err_fe;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Mon, 19 Mar 2018 12:14:17 -0400
+Subject: media: ov5645: add missing of_node_put() in error path
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+[ Upstream commit 06fe932307d58108a11c3e603517dd2a73a57b80 ]
+
+The device node obtained with of_graph_get_next_endpoint() should be
+released by calling of_node_put(). But it was not released when
+v4l2_fwnode_endpoint_parse() failed.
+
+This change moves the of_node_put() call before the error check and
+fixes the issue.
+
+Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Todor Tomov <todor.tomov@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ov5645.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ov5645.c
++++ b/drivers/media/i2c/ov5645.c
+@@ -1131,13 +1131,14 @@ static int ov5645_probe(struct i2c_clien
+
+ ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(endpoint),
+ &ov5645->ep);
++
++ of_node_put(endpoint);
++
+ if (ret < 0) {
+ dev_err(dev, "parsing endpoint node failed\n");
+ return ret;
+ }
+
+- of_node_put(endpoint);
+-
+ if (ov5645->ep.bus_type != V4L2_MBUS_CSI2) {
+ dev_err(dev, "invalid bus type, must be CSI2\n");
+ return -EINVAL;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 16 Jan 2018 16:52:15 -0500
+Subject: media: s3c-camif: fix out-of-bounds array access
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a398e043637a4819a0e96467bfecaabf3224dd62 ]
+
+While experimenting with older compiler versions, I ran
+into a warning that no longer shows up on gcc-4.8 or newer:
+
+drivers/media/platform/s3c-camif/camif-capture.c: In function '__camif_subdev_try_format':
+drivers/media/platform/s3c-camif/camif-capture.c:1265:25: error: array subscript is below array bounds
+
+This is an off-by-one bug, leading to an access before the start of the
+array, while newer compilers silently assume this undefined behavior
+cannot happen and leave the loop at index 0 if no other entry matches.
+
+As Sylvester explains, we actually need to ensure that the
+value is within the range, so this reworks the loop to be
+easier to parse correctly, and an additional check to fall
+back on the first format value for any unexpected input.
+
+I found an existing gcc bug for it and added a reduced version
+of the function there.
+
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69249#c3
+Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/s3c-camif/camif-capture.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/s3c-camif/camif-capture.c
++++ b/drivers/media/platform/s3c-camif/camif-capture.c
+@@ -1256,16 +1256,17 @@ static void __camif_subdev_try_format(st
+ {
+ const struct s3c_camif_variant *variant = camif->variant;
+ const struct vp_pix_limits *pix_lim;
+- int i = ARRAY_SIZE(camif_mbus_formats);
++ unsigned int i;
+
+ /* FIXME: constraints against codec or preview path ? */
+ pix_lim = &variant->vp_pix_limits[VP_CODEC];
+
+- while (i-- >= 0)
++ for (i = 0; i < ARRAY_SIZE(camif_mbus_formats); i++)
+ if (camif_mbus_formats[i] == mf->code)
+ break;
+
+- mf->code = camif_mbus_formats[i];
++ if (i == ARRAY_SIZE(camif_mbus_formats))
++ mf->code = camif_mbus_formats[0];
+
+ if (pad == CAMIF_SD_PAD_SINK) {
+ v4l_bound_align_image(&mf->width, 8, CAMIF_MAX_PIX_WIDTH,
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Sun, 3 Dec 2017 05:06:57 -0500
+Subject: media: v4l: vsp1: Fix display stalls when requesting too many inputs
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 5e3e4cb5e24b92773b194aa90066170b12133bc6 ]
+
+Make sure we don't accept more inputs than the hardware can handle. This
+is a temporary fix to avoid display stall, we need to instead allocate
+the BRU or BRS to display pipelines dynamically based on the number of
+planes they each use.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/vsp1/vsp1_drm.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/platform/vsp1/vsp1_drm.c
++++ b/drivers/media/platform/vsp1/vsp1_drm.c
+@@ -504,6 +504,15 @@ void vsp1_du_atomic_flush(struct device
+ struct vsp1_rwpf *rpf = vsp1->rpf[i];
+ unsigned int j;
+
++ /*
++ * Make sure we don't accept more inputs than the hardware can
++ * handle. This is a temporary fix to avoid display stall, we
++ * need to instead allocate the BRU or BRS to display pipelines
++ * dynamically based on the number of planes they each use.
++ */
++ if (pipe->num_inputs >= pipe->bru->source_pad)
++ pipe->inputs[i] = NULL;
++
+ if (!pipe->inputs[i])
+ continue;
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Tue, 6 Feb 2018 03:02:23 -0500
+Subject: media: vb2: Fix videobuf2 to map correct area
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit d13a0139d7874a0577b5955d6eed895517d23b72 ]
+
+Fixes vb2_vmalloc_get_userptr() to ioremap correct area.
+Since the current code does ioremap the page address, if the offset > 0,
+it does not do ioremap the last page and results in kernel panic.
+
+This fixes to pass the size + offset to ioremap so that ioremap
+can map correct area. Also, this uses __pfn_to_phys() to get the physical
+address of given PFN.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reported-by: Takao Orito <orito.takao@socionext.com>
+Reported-by: Fumihiro ATSUMI <atsumi@infinitegra.co.jp>
+Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/v4l2-core/videobuf2-vmalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-vmalloc.c
++++ b/drivers/media/v4l2-core/videobuf2-vmalloc.c
+@@ -106,7 +106,7 @@ static void *vb2_vmalloc_get_userptr(str
+ if (nums[i-1] + 1 != nums[i])
+ goto fail_map;
+ buf->vaddr = (__force void *)
+- ioremap_nocache(nums[0] << PAGE_SHIFT, size);
++ ioremap_nocache(__pfn_to_phys(nums[0]), size + offset);
+ } else {
+ buf->vaddr = vm_map_ram(frame_vector_pages(vec), n_pages, -1,
+ PAGE_KERNEL);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Thu, 1 Feb 2018 02:36:33 -0500
+Subject: media: vivid: fix incorrect capabilities for radio
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit 65243386f41d38460bfd4375d231a7c0346d0401 ]
+
+The vivid driver has two custom controls that change the behavior of RDS.
+Depending on the control setting the V4L2_CAP_READWRITE capability is toggled.
+However, after an earlier commit the capability was no longer set correctly.
+This is now fixed.
+
+Fixes: 9765a32cd8 ("vivid: set device_caps in video_device")
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/vivid/vivid-ctrls.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/platform/vivid/vivid-ctrls.c
++++ b/drivers/media/platform/vivid/vivid-ctrls.c
+@@ -1191,6 +1191,7 @@ static int vivid_radio_rx_s_ctrl(struct
+ v4l2_ctrl_activate(dev->radio_rx_rds_ta, dev->radio_rx_rds_controls);
+ v4l2_ctrl_activate(dev->radio_rx_rds_tp, dev->radio_rx_rds_controls);
+ v4l2_ctrl_activate(dev->radio_rx_rds_ms, dev->radio_rx_rds_controls);
++ dev->radio_rx_dev.device_caps = dev->radio_rx_caps;
+ break;
+ case V4L2_CID_RDS_RECEPTION:
+ dev->radio_rx_rds_enabled = ctrl->val;
+@@ -1265,6 +1266,7 @@ static int vivid_radio_tx_s_ctrl(struct
+ dev->radio_tx_caps &= ~V4L2_CAP_READWRITE;
+ if (!dev->radio_tx_rds_controls)
+ dev->radio_tx_caps |= V4L2_CAP_READWRITE;
++ dev->radio_tx_dev.device_caps = dev->radio_tx_caps;
+ break;
+ case V4L2_CID_RDS_TX_PTY:
+ if (dev->radio_rx_rds_controls)
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Giuseppe Lippolis <giu.lippolis@gmail.com>
+Date: Mon, 26 Mar 2018 16:34:39 +0200
+Subject: net-usb: add qmi_wwan if on lte modem wistron neweb d18q1
+
+From: Giuseppe Lippolis <giu.lippolis@gmail.com>
+
+[ Upstream commit d4c4bc11353f3bea6754f7d21e3612c9f32d1d64 ]
+
+This modem is embedded on dlink dwr-921 router.
+ The oem configuration states:
+
+ T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+ D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+ P: Vendor=1435 ProdID=0918 Rev= 2.32
+ S: Manufacturer=Android
+ S: Product=Android
+ S: SerialNumber=0123456789ABCDEF
+ C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA
+ I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+ E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+ E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+ E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+ E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+ E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+ E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+ E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+ E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+ E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
+ E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
+
+Tested on openwrt distribution
+
+Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1105,6 +1105,9 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
+ {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */
+ {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */
++ {QMI_FIXED_INTF(0x1435, 0xd181, 3)}, /* Wistron NeWeb D18Q1 */
++ {QMI_FIXED_INTF(0x1435, 0xd181, 4)}, /* Wistron NeWeb D18Q1 */
++ {QMI_FIXED_INTF(0x1435, 0xd181, 5)}, /* Wistron NeWeb D18Q1 */
+ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */
+ {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */
+ {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+Date: Mon, 26 Mar 2018 07:19:57 +0200
+Subject: net/usb/qmi_wwan.c: Add USB id for lt4120 modem
+
+From: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+
+[ Upstream commit f3d801baf118c9d452ee7c278df16880c892e669 ]
+
+This is needed to support the modem found in HP EliteBook 820 G3.
+
+Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1241,6 +1241,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
++ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */
+ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */
+ {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 5 Mar 2018 11:41:13 -0800
+Subject: net: usbnet: fix potential deadlock on 32bit hosts
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 2695578b896aea472b2c0dcbe9d92daa71738484 ]
+
+Marek reported a LOCKDEP issue occurring on 32bit host,
+that we tracked down to the fact that usbnet could either
+run from soft or hard irqs.
+
+This patch adds u64_stats_update_begin_irqsave() and
+u64_stats_update_end_irqrestore() helpers to solve this case.
+
+[ 17.768040] ================================
+[ 17.772239] WARNING: inconsistent lock state
+[ 17.776511] 4.16.0-rc3-next-20180227-00007-g876c53a7493c #453 Not tainted
+[ 17.783329] --------------------------------
+[ 17.787580] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
+[ 17.793607] swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
+[ 17.798751] (&syncp->seq#5){?.-.}, at: [<9b22e5f0>]
+asix_rx_fixup_internal+0x188/0x288
+[ 17.806790] {IN-HARDIRQ-W} state was registered at:
+[ 17.811677] tx_complete+0x100/0x208
+[ 17.815319] __usb_hcd_giveback_urb+0x60/0xf0
+[ 17.819770] xhci_giveback_urb_in_irq+0xa8/0x240
+[ 17.824469] xhci_td_cleanup+0xf4/0x16c
+[ 17.828367] xhci_irq+0xe74/0x2240
+[ 17.831827] usb_hcd_irq+0x24/0x38
+[ 17.835343] __handle_irq_event_percpu+0x98/0x510
+[ 17.840111] handle_irq_event_percpu+0x1c/0x58
+[ 17.844623] handle_irq_event+0x38/0x5c
+[ 17.848519] handle_fasteoi_irq+0xa4/0x138
+[ 17.852681] generic_handle_irq+0x18/0x28
+[ 17.856760] __handle_domain_irq+0x6c/0xe4
+[ 17.860941] gic_handle_irq+0x54/0xa0
+[ 17.864666] __irq_svc+0x70/0xb0
+[ 17.867964] arch_cpu_idle+0x20/0x3c
+[ 17.871578] arch_cpu_idle+0x20/0x3c
+[ 17.875190] do_idle+0x144/0x218
+[ 17.878468] cpu_startup_entry+0x18/0x1c
+[ 17.882454] start_kernel+0x394/0x400
+[ 17.886177] irq event stamp: 161912
+[ 17.889616] hardirqs last enabled at (161912): [<7bedfacf>]
+__netdev_alloc_skb+0xcc/0x140
+[ 17.897893] hardirqs last disabled at (161911): [<d58261d0>]
+__netdev_alloc_skb+0x94/0x140
+[ 17.904903] exynos5-hsi2c 12ca0000.i2c: tx timeout
+[ 17.906116] softirqs last enabled at (161904): [<387102ff>]
+irq_enter+0x78/0x80
+[ 17.906123] softirqs last disabled at (161905): [<cf4c628e>]
+irq_exit+0x134/0x158
+[ 17.925722].
+[ 17.925722] other info that might help us debug this:
+[ 17.933435] Possible unsafe locking scenario:
+[ 17.933435].
+[ 17.940331] CPU0
+[ 17.942488] ----
+[ 17.944894] lock(&syncp->seq#5);
+[ 17.948274] <Interrupt>
+[ 17.950847] lock(&syncp->seq#5);
+[ 17.954386].
+[ 17.954386] *** DEADLOCK ***
+[ 17.954386].
+[ 17.962422] no locks held by swapper/0/0.
+
+Fixes: c8b5d129ee29 ("net: usbnet: support 64bit stats")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/usbnet.c | 10 ++++++----
+ include/linux/u64_stats_sync.h | 22 ++++++++++++++++++++++
+ 2 files changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -315,6 +315,7 @@ static void __usbnet_status_stop_force(s
+ void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
+ {
+ struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64);
++ unsigned long flags;
+ int status;
+
+ if (test_bit(EVENT_RX_PAUSED, &dev->flags)) {
+@@ -326,10 +327,10 @@ void usbnet_skb_return (struct usbnet *d
+ if (skb->protocol == 0)
+ skb->protocol = eth_type_trans (skb, dev->net);
+
+- u64_stats_update_begin(&stats64->syncp);
++ flags = u64_stats_update_begin_irqsave(&stats64->syncp);
+ stats64->rx_packets++;
+ stats64->rx_bytes += skb->len;
+- u64_stats_update_end(&stats64->syncp);
++ u64_stats_update_end_irqrestore(&stats64->syncp, flags);
+
+ netif_dbg(dev, rx_status, dev->net, "< rx, len %zu, type 0x%x\n",
+ skb->len + sizeof (struct ethhdr), skb->protocol);
+@@ -1250,11 +1251,12 @@ static void tx_complete (struct urb *urb
+
+ if (urb->status == 0) {
+ struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64);
++ unsigned long flags;
+
+- u64_stats_update_begin(&stats64->syncp);
++ flags = u64_stats_update_begin_irqsave(&stats64->syncp);
+ stats64->tx_packets += entry->packets;
+ stats64->tx_bytes += entry->length;
+- u64_stats_update_end(&stats64->syncp);
++ u64_stats_update_end_irqrestore(&stats64->syncp, flags);
+ } else {
+ dev->net->stats.tx_errors++;
+
+--- a/include/linux/u64_stats_sync.h
++++ b/include/linux/u64_stats_sync.h
+@@ -90,6 +90,28 @@ static inline void u64_stats_update_end(
+ #endif
+ }
+
++static inline unsigned long
++u64_stats_update_begin_irqsave(struct u64_stats_sync *syncp)
++{
++ unsigned long flags = 0;
++
++#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
++ local_irq_save(flags);
++ write_seqcount_begin(&syncp->seq);
++#endif
++ return flags;
++}
++
++static inline void
++u64_stats_update_end_irqrestore(struct u64_stats_sync *syncp,
++ unsigned long flags)
++{
++#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
++ write_seqcount_end(&syncp->seq);
++ local_irq_restore(flags);
++#endif
++}
++
+ static inline void u64_stats_update_begin_raw(struct u64_stats_sync *syncp)
+ {
+ #if BITS_PER_LONG==32 && defined(CONFIG_SMP)
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: James Hogan <jhogan@kernel.org>
+Date: Tue, 16 Jan 2018 14:45:21 +0000
+Subject: rtc: goldfish: Add missing MODULE_LICENSE
+
+From: James Hogan <jhogan@kernel.org>
+
+[ Upstream commit 82d632b85eb89f97051530f556cb49ee1c04bde7 ]
+
+Fix the following warning in MIPS allmodconfig by adding a
+MODULE_LICENSE() at the end of rtc-goldfish.c, based on the file header
+comment which says GNU General Public License version 2:
+
+WARNING: modpost: missing MODULE_LICENSE() in drivers/rtc/rtc-goldfish.o
+
+Fixes: f22d9cdcb5eb ("rtc: goldfish: Add RTC driver for Android emulator")
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Cc: Miodrag Dinic <miodrag.dinic@mips.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Cc: linux-rtc@vger.kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-goldfish.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/rtc/rtc-goldfish.c
++++ b/drivers/rtc/rtc-goldfish.c
+@@ -235,3 +235,5 @@ static struct platform_driver goldfish_r
+ };
+
+ module_platform_driver(goldfish_rtc);
++
++MODULE_LICENSE("GPL v2");
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Thu, 8 Mar 2018 23:27:31 +0100
+Subject: rtc: hctosys: Ensure system time doesn't overflow time_t
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit b3a5ac42ab18b7d1a8f2f072ca0ee76a3b754a43 ]
+
+On 32bit platforms, time_t is still a signed 32bit long. If it is
+overflowed, userspace and the kernel cant agree on the current system time.
+This causes multiple issues, in particular with systemd:
+https://github.com/systemd/systemd/issues/1143
+
+A good workaround is to simply avoid using hctosys which is something I
+greatly encourage as the time is better set by userspace.
+
+However, many distribution enable it and use systemd which is rendering the
+system unusable in case the RTC holds a date after 2038 (and more so after
+2106). Many drivers have workaround for this case and they should be
+eliminated so there is only one place left to fix when userspace is able to
+cope with dates after the 31bit overflow.
+
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/hctosys.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/rtc/hctosys.c
++++ b/drivers/rtc/hctosys.c
+@@ -49,6 +49,11 @@ static int __init rtc_hctosys(void)
+
+ tv64.tv_sec = rtc_tm_to_time64(&tm);
+
++#if BITS_PER_LONG == 32
++ if (tv64.tv_sec > INT_MAX)
++ goto err_read;
++#endif
++
+ err = do_settimeofday64(&tv64);
+
+ dev_info(rtc->dev.parent,
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Sun, 25 Feb 2018 21:14:31 +0100
+Subject: rtc: m41t80: fix race conditions
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 10d0c768cc6d581523d673b9d1b54213f8a5eb24 ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler, leading to:
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000017c
+pgd = a38a2f9b
+[0000017c] *pgd=00000000
+Internal error: Oops: 5 [#1] ARM
+Modules linked in:
+CPU: 0 PID: 613 Comm: irq/48-m41t80 Not tainted 4.16.0-rc1+ #42
+Hardware name: Atmel SAMA5
+PC is at mutex_lock+0x14/0x38
+LR is at m41t80_handle_irq+0x1c/0x9c
+pc : [<c06e864c>] lr : [<c04b70f0>] psr: 20000013
+sp : dec73f30 ip : 00000000 fp : dec56d98
+r10: df437cf0 r9 : c0a03008 r8 : c0145ffc
+r7 : df5c4300 r6 : dec568d0 r5 : df593000 r4 : 0000017c
+r3 : df592800 r2 : 60000013 r1 : df593000 r0 : 0000017c
+Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+Control: 10c53c7d Table: 20004059 DAC: 00000051
+Process irq/48-m41t80 (pid: 613, stack limit = 0xb52d091e)
+Stack: (0xdec73f30 to 0xdec74000)
+3f20: dec56840 df5c4300 00000001 df5c4300
+3f40: c0145ffc c0146018 dec56840 ffffe000 00000001 c0146290 dec567c0 00000000
+3f60: c0146084 ed7c9a62 c014615c dec56d80 dec567c0 00000000 dec72000 dec56840
+3f80: c014615c c012ffc0 dec72000 dec567c0 c012fe80 00000000 00000000 00000000
+3fa0: 00000000 00000000 00000000 c01010e8 00000000 00000000 00000000 00000000
+3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 29282726 2d2c2b2a
+[<c06e864c>] (mutex_lock) from [<c04b70f0>] (m41t80_handle_irq+0x1c/0x9c)
+[<c04b70f0>] (m41t80_handle_irq) from [<c0146018>] (irq_thread_fn+0x1c/0x54)
+[<c0146018>] (irq_thread_fn) from [<c0146290>] (irq_thread+0x134/0x1c0)
+[<c0146290>] (irq_thread) from [<c012ffc0>] (kthread+0x140/0x148)
+[<c012ffc0>] (kthread) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
+Exception stack(0xdec73fb0 to 0xdec73ff8)
+3fa0: 00000000 00000000 00000000 00000000
+3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+3fe0: 00000000 00000000 00000000 00000000 00000013 00000000
+Code: e3c33d7f e3c3303f f5d0f000 e593300c (e1901f9f)
+---[ end trace 22b027302eb7c604 ]---
+genirq: exiting task "irq/48-m41t80" (613) is an active IRQ thread (irq 48)
+
+Also, there is another possible race condition. The probe function is not
+allowed to fail after the RTC is registered because the following may
+happen:
+
+CPU0: CPU1:
+sys_load_module()
+ do_init_module()
+ do_one_initcall()
+ cmos_do_probe()
+ rtc_device_register()
+ __register_chrdev()
+ cdev->owner = struct module*
+ open("/dev/rtc0")
+ rtc_device_unregister()
+ module_put()
+ free_module()
+ module_free(mod->module_core)
+ /* struct module *module is now
+ freed */
+ chrdev_open()
+ spin_lock(cdev_lock)
+ cdev_get()
+ try_module_get()
+ module_is_live()
+ /* dereferences already
+ freed struct module* */
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ and register it as late as possible.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-m41t80.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/rtc/rtc-m41t80.c
++++ b/drivers/rtc/rtc-m41t80.c
+@@ -885,7 +885,6 @@ static int m41t80_probe(struct i2c_clien
+ {
+ struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+ int rc = 0;
+- struct rtc_device *rtc = NULL;
+ struct rtc_time tm;
+ struct m41t80_data *m41t80_data = NULL;
+ bool wakeup_source = false;
+@@ -909,6 +908,10 @@ static int m41t80_probe(struct i2c_clien
+ m41t80_data->features = id->driver_data;
+ i2c_set_clientdata(client, m41t80_data);
+
++ m41t80_data->rtc = devm_rtc_allocate_device(&client->dev);
++ if (IS_ERR(m41t80_data->rtc))
++ return PTR_ERR(m41t80_data->rtc);
++
+ #ifdef CONFIG_OF
+ wakeup_source = of_property_read_bool(client->dev.of_node,
+ "wakeup-source");
+@@ -932,15 +935,11 @@ static int m41t80_probe(struct i2c_clien
+ device_init_wakeup(&client->dev, true);
+ }
+
+- rtc = devm_rtc_device_register(&client->dev, client->name,
+- &m41t80_rtc_ops, THIS_MODULE);
+- if (IS_ERR(rtc))
+- return PTR_ERR(rtc);
++ m41t80_data->rtc->ops = &m41t80_rtc_ops;
+
+- m41t80_data->rtc = rtc;
+ if (client->irq <= 0) {
+ /* We cannot support UIE mode if we do not have an IRQ line */
+- rtc->uie_unsupported = 1;
++ m41t80_data->rtc->uie_unsupported = 1;
+ }
+
+ /* Make sure HT (Halt Update) bit is cleared */
+@@ -993,6 +992,11 @@ static int m41t80_probe(struct i2c_clien
+ if (m41t80_data->features & M41T80_FEATURE_SQ)
+ m41t80_sqw_register_clk(m41t80_data);
+ #endif
++
++ rc = rtc_register_device(m41t80_data->rtc);
++ if (rc)
++ return rc;
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Wed, 21 Feb 2018 11:57:05 +0100
+Subject: rtc: rk808: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 201fac95e799c3d0304ec724d555e1251b9f6e84 ]
+
+The probe function is not allowed to fail after registering the RTC because
+the following may happen:
+
+CPU0: CPU1:
+sys_load_module()
+ do_init_module()
+ do_one_initcall()
+ cmos_do_probe()
+ rtc_device_register()
+ __register_chrdev()
+ cdev->owner = struct module*
+ open("/dev/rtc0")
+ rtc_device_unregister()
+ module_put()
+ free_module()
+ module_free(mod->module_core)
+ /* struct module *module is now
+ freed */
+ chrdev_open()
+ spin_lock(cdev_lock)
+ cdev_get()
+ try_module_get()
+ module_is_live()
+ /* dereferences already
+ freed struct module* */
+
+Switch to devm_rtc_allocate_device/rtc_register_device to register the rtc
+as late as possible.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-rk808.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/rtc/rtc-rk808.c
++++ b/drivers/rtc/rtc-rk808.c
+@@ -416,12 +416,11 @@ static int rk808_rtc_probe(struct platfo
+
+ device_init_wakeup(&pdev->dev, 1);
+
+- rk808_rtc->rtc = devm_rtc_device_register(&pdev->dev, "rk808-rtc",
+- &rk808_rtc_ops, THIS_MODULE);
+- if (IS_ERR(rk808_rtc->rtc)) {
+- ret = PTR_ERR(rk808_rtc->rtc);
+- return ret;
+- }
++ rk808_rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(rk808_rtc->rtc))
++ return PTR_ERR(rk808_rtc->rtc);
++
++ rk808_rtc->rtc->ops = &rk808_rtc_ops;
+
+ rk808_rtc->irq = platform_get_irq(pdev, 0);
+ if (rk808_rtc->irq < 0) {
+@@ -438,9 +437,10 @@ static int rk808_rtc_probe(struct platfo
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to request alarm IRQ %d: %d\n",
+ rk808_rtc->irq, ret);
++ return ret;
+ }
+
+- return ret;
++ return rtc_register_device(rk808_rtc->rtc);
+ }
+
+ static struct platform_driver rk808_rtc_driver = {
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Mon, 12 Feb 2018 23:47:49 +0100
+Subject: rtc: rp5c01: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit bcdd559268039d8340d38fa58668393596e29fdc ]
+
+The probe function is not allowed to fail after registering the RTC because
+the following may happen:
+
+CPU0: CPU1:
+sys_load_module()
+ do_init_module()
+ do_one_initcall()
+ cmos_do_probe()
+ rtc_device_register()
+ __register_chrdev()
+ cdev->owner = struct module*
+ open("/dev/rtc0")
+ rtc_device_unregister()
+ module_put()
+ free_module()
+ module_free(mod->module_core)
+ /* struct module *module is now
+ freed */
+ chrdev_open()
+ spin_lock(cdev_lock)
+ cdev_get()
+ try_module_get()
+ module_is_live()
+ /* dereferences already
+ freed struct module* */
+
+Switch to devm_rtc_allocate_device/rtc_register_device to register the rtc
+as late as possible.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-rp5c01.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/rtc-rp5c01.c
++++ b/drivers/rtc/rtc-rp5c01.c
+@@ -249,16 +249,24 @@ static int __init rp5c01_rtc_probe(struc
+
+ platform_set_drvdata(dev, priv);
+
+- rtc = devm_rtc_device_register(&dev->dev, "rtc-rp5c01", &rp5c01_rtc_ops,
+- THIS_MODULE);
++ rtc = devm_rtc_allocate_device(&dev->dev);
+ if (IS_ERR(rtc))
+ return PTR_ERR(rtc);
++
++ rtc->ops = &rp5c01_rtc_ops;
++
+ priv->rtc = rtc;
+
+ error = sysfs_create_bin_file(&dev->dev.kobj, &priv->nvram_attr);
+ if (error)
+ return error;
+
++ error = rtc_register_device(rtc);
++ if (error) {
++ sysfs_remove_bin_file(&dev->dev.kobj, &priv->nvram_attr);
++ return error;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Date: Wed, 28 Mar 2018 20:14:05 +0100
+Subject: rtc: snvs: Fix usage of snvs_rtc_enable
+
+From: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+
+[ Upstream commit 1485991c024603b2fb4ae77beb7a0d741128a48e ]
+
+commit 179a502f8c46 ("rtc: snvs: add Freescale rtc-snvs driver") introduces
+the SNVS RTC driver with a function snvs_rtc_enable().
+
+snvs_rtc_enable() can return an error on the enable path however this
+driver does not currently trap that failure on the probe() path and
+consequently if enabling the RTC fails we encounter a later error spinning
+forever in rtc_write_sync_lp().
+
+[ 36.093481] [<c010d630>] (__irq_svc) from [<c0c2e9ec>] (_raw_spin_unlock_irqrestore+0x34/0x44)
+[ 36.102122] [<c0c2e9ec>] (_raw_spin_unlock_irqrestore) from [<c072e32c>] (regmap_read+0x4c/0x5c)
+[ 36.110938] [<c072e32c>] (regmap_read) from [<c085d0f4>] (rtc_write_sync_lp+0x6c/0x98)
+[ 36.118881] [<c085d0f4>] (rtc_write_sync_lp) from [<c085d160>] (snvs_rtc_alarm_irq_enable+0x40/0x4c)
+[ 36.128041] [<c085d160>] (snvs_rtc_alarm_irq_enable) from [<c08567b4>] (rtc_timer_do_work+0xd8/0x1a8)
+[ 36.137291] [<c08567b4>] (rtc_timer_do_work) from [<c01441b8>] (process_one_work+0x28c/0x76c)
+[ 36.145840] [<c01441b8>] (process_one_work) from [<c01446cc>] (worker_thread+0x34/0x58c)
+[ 36.153961] [<c01446cc>] (worker_thread) from [<c014aee4>] (kthread+0x138/0x150)
+[ 36.161388] [<c014aee4>] (kthread) from [<c0107e14>] (ret_from_fork+0x14/0x20)
+[ 36.168635] rcu_sched kthread starved for 2602 jiffies! g496 c495 f0x2 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=0
+[ 36.178564] rcu_sched R running task 0 8 2 0x00000000
+[ 36.185664] [<c0c288b0>] (__schedule) from [<c0c29134>] (schedule+0x3c/0xa0)
+[ 36.192739] [<c0c29134>] (schedule) from [<c0c2db80>] (schedule_timeout+0x78/0x4e0)
+[ 36.200422] [<c0c2db80>] (schedule_timeout) from [<c01a7ab0>] (rcu_gp_kthread+0x648/0x1864)
+[ 36.208800] [<c01a7ab0>] (rcu_gp_kthread) from [<c014aee4>] (kthread+0x138/0x150)
+[ 36.216309] [<c014aee4>] (kthread) from [<c0107e14>] (ret_from_fork+0x14/0x20)
+
+This patch fixes by parsing the result of rtc_write_sync_lp() and
+propagating both in the probe and elsewhere. If the RTC doesn't start we
+don't proceed loading the driver and don't get into this loop mess later
+on.
+
+Fixes: 179a502f8c46 ("rtc: snvs: add Freescale rtc-snvs driver")
+Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-snvs.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -132,20 +132,23 @@ static int snvs_rtc_set_time(struct devi
+ {
+ struct snvs_rtc_data *data = dev_get_drvdata(dev);
+ unsigned long time;
++ int ret;
+
+ rtc_tm_to_time(tm, &time);
+
+ /* Disable RTC first */
+- snvs_rtc_enable(data, false);
++ ret = snvs_rtc_enable(data, false);
++ if (ret)
++ return ret;
+
+ /* Write 32-bit time to 47-bit timer, leaving 15 LSBs blank */
+ regmap_write(data->regmap, data->offset + SNVS_LPSRTCLR, time << CNTR_TO_SECS_SH);
+ regmap_write(data->regmap, data->offset + SNVS_LPSRTCMR, time >> (32 - CNTR_TO_SECS_SH));
+
+ /* Enable RTC again */
+- snvs_rtc_enable(data, true);
++ ret = snvs_rtc_enable(data, true);
+
+- return 0;
++ return ret;
+ }
+
+ static int snvs_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+@@ -288,7 +291,11 @@ static int snvs_rtc_probe(struct platfor
+ regmap_write(data->regmap, data->offset + SNVS_LPSR, 0xffffffff);
+
+ /* Enable RTC */
+- snvs_rtc_enable(data, true);
++ ret = snvs_rtc_enable(data, true);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to enable rtc %d\n", ret);
++ goto error_rtc_device_register;
++ }
+
+ device_init_wakeup(&pdev->dev, true);
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 15 Feb 2018 19:36:14 +0000
+Subject: rtc: tx4939: avoid unintended sign extension on a 24 bit shift
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 347876ad47b9923ce26e686173bbf46581802ffa ]
+
+The shifting of buf[5] by 24 bits to the left will be promoted to
+a 32 bit signed int and then sign-extended to an unsigned long. If
+the top bit of buf[5] is set then all then all the upper bits sec
+end up as also being set because of the sign-extension. Fix this by
+casting buf[5] to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#1465292 ("Unintended sign extension")
+
+Fixes: 0e1492330cd2 ("rtc: add rtc-tx4939 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-tx4939.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/rtc-tx4939.c
++++ b/drivers/rtc/rtc-tx4939.c
+@@ -86,7 +86,8 @@ static int tx4939_rtc_read_time(struct d
+ for (i = 2; i < 6; i++)
+ buf[i] = __raw_readl(&rtcreg->dat);
+ spin_unlock_irq(&pdata->lock);
+- sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2];
++ sec = ((unsigned long)buf[5] << 24) | (buf[4] << 16) |
++ (buf[3] << 8) | buf[2];
+ rtc_time_to_tm(sec, tm);
+ return rtc_valid_tm(tm);
+ }
+@@ -147,7 +148,8 @@ static int tx4939_rtc_read_alarm(struct
+ alrm->enabled = (ctl & TX4939_RTCCTL_ALME) ? 1 : 0;
+ alrm->pending = (ctl & TX4939_RTCCTL_ALMD) ? 1 : 0;
+ spin_unlock_irq(&pdata->lock);
+- sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2];
++ sec = ((unsigned long)buf[5] << 24) | (buf[4] << 16) |
++ (buf[3] << 8) | buf[2];
+ rtc_time_to_tm(sec, &alrm->time);
+ return rtc_valid_tm(&alrm->time);
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Meelis Roos <mroos@linux.ee>
+Date: Fri, 9 Feb 2018 08:57:44 +0200
+Subject: scsi: aacraid: fix shutdown crash when init fails
+
+From: Meelis Roos <mroos@linux.ee>
+
+[ Upstream commit 00c20cdc79259c6c5bf978b21af96c2d3edb646d ]
+
+When aacraid init fails with "AAC0: adapter self-test failed.", shutdown
+leads to UBSAN warning and then oops:
+
+[154316.118423] ================================================================================
+[154316.118508] UBSAN: Undefined behaviour in drivers/scsi/scsi_lib.c:2328:27
+[154316.118566] member access within null pointer of type 'struct Scsi_Host'
+[154316.118631] CPU: 2 PID: 14530 Comm: reboot Tainted: G W 4.15.0-dirty #89
+[154316.118701] Hardware name: Hewlett Packard HP NetServer/HP System Board, BIOS 4.06.46 PW 06/25/2003
+[154316.118774] Call Trace:
+[154316.118848] dump_stack+0x48/0x65
+[154316.118916] ubsan_epilogue+0xe/0x40
+[154316.118976] __ubsan_handle_type_mismatch+0xfb/0x180
+[154316.119043] scsi_block_requests+0x20/0x30
+[154316.119135] aac_shutdown+0x18/0x40 [aacraid]
+[154316.119196] pci_device_shutdown+0x33/0x50
+[154316.119269] device_shutdown+0x18a/0x390
+[...]
+[154316.123435] BUG: unable to handle kernel NULL pointer dereference at 000000f4
+[154316.123515] IP: scsi_block_requests+0xa/0x30
+
+This is because aac_shutdown() does
+
+ struct Scsi_Host *shost = pci_get_drvdata(dev);
+ scsi_block_requests(shost);
+
+and that assumes shost has been assigned with pci_set_drvdata().
+
+However, pci_set_drvdata(pdev, shost) is done in aac_probe_one() far
+after bailing out with error from calling the init function
+((*aac_drivers[index].init)(aac)), and when the init function fails, no
+error is returned from aac_probe_one() so PCI layer assumes there is
+driver attached, and tries to shut it down later.
+
+Fix it by returning error from aac_probe_one() when card-specific init
+function fails.
+
+This fixes reboot on my HP NetRAID-4M with dead battery.
+
+Signed-off-by: Meelis Roos <mroos@linux.ee>
+Reviewed-by: Dave Carroll <david.carroll@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/aacraid/linit.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -1690,8 +1690,10 @@ static int aac_probe_one(struct pci_dev
+ * Map in the registers from the adapter.
+ */
+ aac->base_size = AAC_MIN_FOOTPRINT_SIZE;
+- if ((*aac_drivers[index].init)(aac))
++ if ((*aac_drivers[index].init)(aac)) {
++ error = -ENODEV;
+ goto out_unmap;
++ }
+
+ if (aac->sync_mode) {
+ if (aac_sync_mode)
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Dave Carroll <david.carroll@microsemi.com>
+Date: Tue, 3 Apr 2018 15:50:42 -0600
+Subject: scsi: aacraid: Insure command thread is not recursively stopped
+
+From: Dave Carroll <david.carroll@microsemi.com>
+
+[ Upstream commit 1c6b41fb92936fa5facea464d5d7cbf855966d04 ]
+
+If a recursive IOP_RESET is invoked, usually due to the eh_thread
+handling errors after the first reset, be sure we flag that the command
+thread has been stopped to avoid an Oops of the form;
+
+ [ 336.620256] CPU: 28 PID: 1193 Comm: scsi_eh_0 Kdump: loaded Not tainted 4.14.0-49.el7a.ppc64le #1
+ [ 336.620297] task: c000003fd630b800 task.stack: c000003fd61a4000
+ [ 336.620326] NIP: c000000000176794 LR: c00000000013038c CTR: c00000000024bc10
+ [ 336.620361] REGS: c000003fd61a7720 TRAP: 0300 Not tainted (4.14.0-49.el7a.ppc64le)
+ [ 336.620395] MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 22084022 XER: 20040000
+ [ 336.620435] CFAR: c000000000130388 DAR: 0000000000000000 DSISR: 40000000 SOFTE: 1
+ [ 336.620435] GPR00: c00000000013038c c000003fd61a79a0 c0000000014c7e00 0000000000000000
+ [ 336.620435] GPR04: 000000000000000c 000000000000000c 9000000000009033 0000000000000477
+ [ 336.620435] GPR08: 0000000000000477 0000000000000000 0000000000000000 c008000010f7d940
+ [ 336.620435] GPR12: c00000000024bc10 c000000007a33400 c0000000001708a8 c000003fe3b881d8
+ [ 336.620435] GPR16: c000003fe3b88060 c000003fd61a7d10 fffffffffffff000 000000000000001e
+ [ 336.620435] GPR20: 0000000000000001 c000000000ebf1a0 0000000000000001 c000003fe3b88000
+ [ 336.620435] GPR24: 0000000000000003 0000000000000002 c000003fe3b88840 c000003fe3b887e8
+ [ 336.620435] GPR28: c000003fe3b88000 c000003fc8181788 0000000000000000 c000003fc8181700
+ [ 336.620750] NIP [c000000000176794] exit_creds+0x34/0x160
+ [ 336.620775] LR [c00000000013038c] __put_task_struct+0x8c/0x1f0
+ [ 336.620804] Call Trace:
+ [ 336.620817] [c000003fd61a79a0] [c000003fe3b88000] 0xc000003fe3b88000 (unreliable)
+ [ 336.620853] [c000003fd61a79d0] [c00000000013038c] __put_task_struct+0x8c/0x1f0
+ [ 336.620889] [c000003fd61a7a00] [c000000000171418] kthread_stop+0x1e8/0x1f0
+ [ 336.620922] [c000003fd61a7a40] [c008000010f7448c] aac_reset_adapter+0x14c/0x8d0 [aacraid]
+ [ 336.620959] [c000003fd61a7b00] [c008000010f60174] aac_eh_host_reset+0x84/0x100 [aacraid]
+ [ 336.621010] [c000003fd61a7b30] [c000000000864f24] scsi_try_host_reset+0x74/0x180
+ [ 336.621046] [c000003fd61a7bb0] [c000000000867ac0] scsi_eh_ready_devs+0xc00/0x14d0
+ [ 336.625165] [c000003fd61a7ca0] [c0000000008699e0] scsi_error_handler+0x550/0x730
+ [ 336.632101] [c000003fd61a7dc0] [c000000000170a08] kthread+0x168/0x1b0
+ [ 336.639031] [c000003fd61a7e30] [c00000000000b528] ret_from_kernel_thread+0x5c/0xb4
+ [ 336.645971] Instruction dump:
+ [ 336.648743] 384216a0 7c0802a6 fbe1fff8 f8010010 f821ffd1 7c7f1b78 60000000 60000000
+ [ 336.657056] 39400000 e87f0838 f95f0838 7c0004ac <7d401828> 314affff 7d40192d 40c2fff4
+ [ 336.663997] -[ end trace 4640cf8d4945ad95 ]-
+
+So flag when the thread is stopped by setting the thread pointer to NULL.
+
+Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
+Reviewed-by: Raghava Aditya Renukunta <raghavaaditya.renukunta@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/aacraid/commsup.c | 4 +++-
+ drivers/scsi/aacraid/linit.c | 1 +
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -1530,9 +1530,10 @@ static int _aac_reset_adapter(struct aac
+ host = aac->scsi_host_ptr;
+ scsi_block_requests(host);
+ aac_adapter_disable_int(aac);
+- if (aac->thread->pid != current->pid) {
++ if (aac->thread && aac->thread->pid != current->pid) {
+ spin_unlock_irq(host->host_lock);
+ kthread_stop(aac->thread);
++ aac->thread = NULL;
+ jafo = 1;
+ }
+
+@@ -1619,6 +1620,7 @@ static int _aac_reset_adapter(struct aac
+ aac->name);
+ if (IS_ERR(aac->thread)) {
+ retval = PTR_ERR(aac->thread);
++ aac->thread = NULL;
+ goto out;
+ }
+ }
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -1565,6 +1565,7 @@ static void __aac_shutdown(struct aac_de
+ up(&fib->event_wait);
+ }
+ kthread_stop(aac->thread);
++ aac->thread = NULL;
+ }
+
+ aac_send_shutdown(aac);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Chad Dupuis <chad.dupuis@cavium.com>
+Date: Wed, 24 Jan 2018 08:07:06 -0800
+Subject: scsi: bnx2fc: Fix check in SCSI completion handler for timed out request
+
+From: Chad Dupuis <chad.dupuis@cavium.com>
+
+[ Upstream commit ecf7ff49945f5741fa1da112f994939f942031d3 ]
+
+When a request times out we set the io_req flag BNX2FC_FLAG_IO_COMPL so
+that if a subsequent completion comes in on that task ID we will ignore
+it. The issue is that in the check for this flag there is a missing
+return so we will continue to process a request which may have already
+been returned to the ownership of the SCSI layer. This can cause
+unpredictable results.
+
+Solution is to add in the missing return.
+
+[mkp: typo plus title shortening]
+
+Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com>
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Tested-by: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/bnx2fc/bnx2fc_io.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
+@@ -1865,6 +1865,7 @@ void bnx2fc_process_scsi_cmd_compl(struc
+ /* we will not receive ABTS response for this IO */
+ BNX2FC_IO_DBG(io_req, "Timer context finished processing "
+ "this scsi cmd\n");
++ return;
+ }
+
+ /* Cancel the timeout_work, as we received IO completion */
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Douglas Gilbert <dgilbert@interlog.com>
+Date: Tue, 6 Mar 2018 22:19:49 -0500
+Subject: scsi: core: Make SCSI Status CONDITION MET equivalent to GOOD
+
+From: Douglas Gilbert <dgilbert@interlog.com>
+
+[ Upstream commit 1875ede02ed5e176a18dccbca84abc28d5b3e141 ]
+
+The SCSI PRE-FETCH (10 or 16) command is present both on hard disks
+and some SSDs. It is useful when the address of the next block(s) to
+be read is known but it is not following the LBA of the current READ
+(so read-ahead won't help). It returns two "good" SCSI Status values.
+If the requested blocks have fitted (or will most likely fit (when
+the IMMED bit is set)) into the disk's cache, it returns CONDITION
+MET. If it didn't (or will not) fit then it returns GOOD status.
+
+The goal of this patch is to stop the SCSI subsystem treating the
+CONDITION MET SCSI status as an error. The current state makes the
+PRE-FETCH command effectively unusable via pass-throughs.
+
+Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_lib.c | 11 +++++++++++
+ include/scsi/scsi.h | 2 ++
+ 2 files changed, 13 insertions(+)
+
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -857,6 +857,17 @@ void scsi_io_completion(struct scsi_cmnd
+ /* for passthrough error may be set */
+ error = BLK_STS_OK;
+ }
++ /*
++ * Another corner case: the SCSI status byte is non-zero but 'good'.
++ * Example: PRE-FETCH command returns SAM_STAT_CONDITION_MET when
++ * it is able to fit nominated LBs in its cache (and SAM_STAT_GOOD
++ * if it can't fit). Treat SAM_STAT_CONDITION_MET and the related
++ * intermediate statuses (both obsolete in SAM-4) as good.
++ */
++ if (status_byte(result) && scsi_status_is_good(result)) {
++ result = 0;
++ error = BLK_STS_OK;
++ }
+
+ /*
+ * special case: failed zero length commands always need to
+--- a/include/scsi/scsi.h
++++ b/include/scsi/scsi.h
+@@ -47,6 +47,8 @@ static inline int scsi_status_is_good(in
+ */
+ status &= 0xfe;
+ return ((status == SAM_STAT_GOOD) ||
++ (status == SAM_STAT_CONDITION_MET) ||
++ /* Next two "intermediate" statuses are obsolete in SAM-4 */
+ (status == SAM_STAT_INTERMEDIATE) ||
+ (status == SAM_STAT_INTERMEDIATE_CONDITION_MET) ||
+ /* FIXME: this is obsolete in SAM-3 */
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Hannes Reinecke <hare@suse.de>
+Date: Mon, 26 Feb 2018 08:39:59 +0100
+Subject: scsi: core: return BLK_STS_OK for DID_OK in __scsi_error_from_host_byte()
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit e39a97353e5378eb46bf01679799c5704d397f32 ]
+
+When converting __scsi_error_from_host_byte() to BLK_STS error codes the
+case DID_OK was forgotten, resulting in it always returning an error.
+
+Fixes: 2a842acab109 ("block: introduce new block status code type")
+Cc: Doug Gilbert <dgilbert@interlog.com>
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_lib.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -720,6 +720,8 @@ static blk_status_t __scsi_error_from_ho
+ int result)
+ {
+ switch (host_byte(result)) {
++ case DID_OK:
++ return BLK_STS_OK;
+ case DID_TRANSPORT_FAILFAST:
+ return BLK_STS_TRANSPORT;
+ case DID_TARGET_FAILURE:
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+Date: Wed, 7 Mar 2018 20:29:03 +0800
+Subject: scsi: iscsi_tcp: set BDI_CAP_STABLE_WRITES when data digest enabled
+
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+
+[ Upstream commit 89d0c804392bb962553f23dc4c119d11b6bd1675 ]
+
+iscsi tcp will first send out data, then calculate and send data
+digest. If we don't have BDI_CAP_STABLE_WRITES, the page cache will be
+written in spite of the on going writeback. Consequently, wrong digest
+will be got and sent to target.
+
+To fix this, set BDI_CAP_STABLE_WRITES when data digest is enabled
+in iscsi_tcp .slave_configure callback.
+
+Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
+Acked-by: Chris Leech <cleech@redhat.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/iscsi_tcp.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -37,6 +37,7 @@
+ #include <linux/kfifo.h>
+ #include <linux/scatterlist.h>
+ #include <linux/module.h>
++#include <linux/backing-dev.h>
+ #include <net/tcp.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <scsi/scsi_device.h>
+@@ -952,6 +953,13 @@ static int iscsi_sw_tcp_slave_alloc(stru
+
+ static int iscsi_sw_tcp_slave_configure(struct scsi_device *sdev)
+ {
++ struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(sdev->host);
++ struct iscsi_session *session = tcp_sw_host->session;
++ struct iscsi_conn *conn = session->leadconn;
++
++ if (conn->datadgst_en)
++ sdev->request_queue->backing_dev_info->capabilities
++ |= BDI_CAP_STABLE_WRITES;
+ blk_queue_bounce_limit(sdev->request_queue, BLK_BOUNCE_ANY);
+ blk_queue_dma_alignment(sdev->request_queue, 0);
+ return 0;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Tue, 30 Jan 2018 15:58:45 -0800
+Subject: scsi: lpfc: Fix frequency of Release WQE CQEs
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 04673e38f56b30cd39b1fa0f386137d818b17781 ]
+
+The driver controls when the hardware sends completions that communicate
+consumption of elements from the WQ. This is done by setting a WQEC bit
+on a WQE.
+
+The current driver sets it on every Nth WQE posting. However, the driver
+isn't clearing the bit if the WQE is reused. Thus, if the queue depth
+isn't evenly divisible by N, with enough time, it can be set on every
+element, creating a lot of overhead and risking CQ full conditions.
+
+Correct by clearing the bit when not setting it on an Nth element.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -129,6 +129,8 @@ lpfc_sli4_wq_put(struct lpfc_queue *q, u
+ /* set consumption flag every once in a while */
+ if (!((q->host_index + 1) % q->entry_repost))
+ bf_set(wqe_wqec, &wqe->generic.wqe_com, 1);
++ else
++ bf_set(wqe_wqec, &wqe->generic.wqe_com, 0);
+ if (q->phba->sli3_options & LPFC_SLI4_PHWQ_ENABLED)
+ bf_set(wqe_wqid, &wqe->generic.wqe_com, q->queue_id);
+ lpfc_sli_pcimem_bcopy(wqe, temp_wqe, q->entry_size);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Tue, 30 Jan 2018 15:58:55 -0800
+Subject: scsi: lpfc: Fix issue_lip if link is disabled
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 2289e9598dde9705400559ca2606fb8c145c34f0 ]
+
+The driver ignored checks on whether the link should be kept
+administratively down after a link bounce. Correct the checks.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_attr.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -871,7 +871,12 @@ lpfc_issue_lip(struct Scsi_Host *shost)
+ LPFC_MBOXQ_t *pmboxq;
+ int mbxstatus = MBXERR_ERROR;
+
++ /*
++ * If the link is offline, disabled or BLOCK_MGMT_IO
++ * it doesn't make any sense to allow issue_lip
++ */
+ if ((vport->fc_flag & FC_OFFLINE_MODE) ||
++ (phba->hba_flag & LINK_DISABLED) ||
+ (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO))
+ return -EPERM;
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Tue, 30 Jan 2018 15:58:54 -0800
+Subject: scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 161df4f09987ae2e9f0f97f0b38eee298b4a39ff ]
+
+During link bounce testing in a point-to-point topology, the host may
+enter a soft lockup on the lpfc_worker thread:
+
+ Call Trace:
+ lpfc_work_done+0x1f3/0x1390 [lpfc]
+ lpfc_do_work+0x16f/0x180 [lpfc]
+ kthread+0xc7/0xe0
+ ret_from_fork+0x3f/0x70
+
+The driver was simultaneously setting a combination of flags that caused
+lpfc_do_work()to effectively spin between slow path work and new event
+data, causing the lockup.
+
+Ensure in the typical wq completions, that new event data flags are set
+if the slow path flag is running. The slow path will eventually
+reschedule the wq handling.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -698,8 +698,9 @@ lpfc_work_done(struct lpfc_hba *phba)
+ phba->hba_flag & HBA_SP_QUEUE_EVT)) {
+ if (pring->flag & LPFC_STOP_IOCB_EVENT) {
+ pring->flag |= LPFC_DEFERRED_RING_EVENT;
+- /* Set the lpfc data pending flag */
+- set_bit(LPFC_DATA_READY, &phba->data_flags);
++ /* Preserve legacy behavior. */
++ if (!(phba->hba_flag & HBA_SP_QUEUE_EVT))
++ set_bit(LPFC_DATA_READY, &phba->data_flags);
+ } else {
+ if (phba->link_state >= LPFC_LINK_UP ||
+ phba->link_flag & LS_MDS_LOOPBACK) {
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Hannes Reinecke <hare@suse.de>
+Date: Mon, 26 Feb 2018 15:26:01 +0100
+Subject: scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 864449eea7c600596e305ffdc4a6a846414b222c ]
+
+The firmware event workqueue should not be marked as WQ_MEM_RECLAIM
+as it's doesn't need to make forward progress under memory pressure.
+In the current state it will result in a deadlock if the device had been
+forcefully removed.
+
+Cc: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Cc: Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>
+Acked-by: Sreekanth Reddy <Sreekanth.Reddy@broadcom.com>
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -8941,7 +8941,7 @@ _scsih_probe(struct pci_dev *pdev, const
+ snprintf(ioc->firmware_event_name, sizeof(ioc->firmware_event_name),
+ "fw_event_%s%d", ioc->driver_name, ioc->id);
+ ioc->firmware_event_thread = alloc_ordered_workqueue(
+- ioc->firmware_event_name, WQ_MEM_RECLAIM);
++ ioc->firmware_event_name, 0);
+ if (!ioc->firmware_event_thread) {
+ pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n",
+ ioc->name, __FILE__, __LINE__, __func__);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Tomas Henzl <thenzl@redhat.com>
+Date: Fri, 19 Jan 2018 16:22:05 +0100
+Subject: scsi: mpt3sas: fix an out of bound write
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit 4a8842de8db4953fdda7866626b78b12fb8adb97 ]
+
+cpu_msix_table is allocated to store online cpus, but pci_irq_get_affinity
+may return cpu_possible_mask which is then used to access cpu_msix_table.
+That causes bad user experience. Fix limits access to only online cpus,
+I've also added an additional test to protect from an unlikely change in
+cpu_online_mask.
+
+[mkp: checkpatch]
+
+Fixes: 1d55abc0e98a ("scsi: mpt3sas: switch to pci_alloc_irq_vectors")
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Acked-by: Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -1921,8 +1921,11 @@ _base_assign_reply_queues(struct MPT3SAS
+ continue;
+ }
+
+- for_each_cpu(cpu, mask)
++ for_each_cpu_and(cpu, mask, cpu_online_mask) {
++ if (cpu >= ioc->cpu_msix_table_sz)
++ break;
+ ioc->cpu_msix_table[cpu] = reply_q->msix_index;
++ }
+ }
+ return;
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 25 Jan 2018 17:27:27 +0300
+Subject: scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit a7043e9529f3c367cc4d82997e00be034cbe57ca ]
+
+My static checker complains about an out of bounds read:
+
+ drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
+ error: buffer overflow 'hd->sel_timeout' 255 <= u32max.
+
+It's true that we probably should have a bounds check here.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/message/fusion/mptctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/message/fusion/mptctl.c
++++ b/drivers/message/fusion/mptctl.c
+@@ -2698,6 +2698,8 @@ mptctl_hp_targetinfo(unsigned long arg)
+ __FILE__, __LINE__, iocnum);
+ return -ENODEV;
+ }
++ if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
++ return -EINVAL;
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
+ ioc->name));
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Wilfried Weissmann <wilfried.weissmann@gmx.at>
+Date: Fri, 23 Feb 2018 20:52:34 +0100
+Subject: scsi: mvsas: fix wrong endianness of sgpio api
+
+From: Wilfried Weissmann <wilfried.weissmann@gmx.at>
+
+[ Upstream commit e75fba9c0668b3767f608ea07485f48d33c270cf ]
+
+This patch fixes the byte order of the SGPIO api and brings it back in
+sync with ledmon v0.80 and above.
+
+[mkp: added missing SoB and fixed whitespace]
+
+Signed-off-by: Wilfried Weissmann <wilfried.weissmann@gmx.at>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mvsas/mv_94xx.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+--- a/drivers/scsi/mvsas/mv_94xx.c
++++ b/drivers/scsi/mvsas/mv_94xx.c
+@@ -1080,16 +1080,16 @@ static int mvs_94xx_gpio_write(struct mv
+ void __iomem *regs = mvi->regs_ex - 0x10200;
+
+ int drive = (i/3) & (4-1); /* drive number on host */
+- u32 block = mr32(MVS_SGPIO_DCTRL +
++ int driveshift = drive * 8; /* bit offset of drive */
++ u32 block = ioread32be(regs + MVS_SGPIO_DCTRL +
+ MVS_SGPIO_HOST_OFFSET * mvi->id);
+
+-
+ /*
+ * if bit is set then create a mask with the first
+ * bit of the drive set in the mask ...
+ */
+- u32 bit = (write_data[i/8] & (1 << (i&(8-1)))) ?
+- 1<<(24-drive*8) : 0;
++ u32 bit = get_unaligned_be32(write_data) & (1 << i) ?
++ 1 << driveshift : 0;
+
+ /*
+ * ... and then shift it to the right position based
+@@ -1098,26 +1098,27 @@ static int mvs_94xx_gpio_write(struct mv
+ switch (i%3) {
+ case 0: /* activity */
+ block &= ~((0x7 << MVS_SGPIO_DCTRL_ACT_SHIFT)
+- << (24-drive*8));
++ << driveshift);
+ /* hardwire activity bit to SOF */
+ block |= LED_BLINKA_SOF << (
+ MVS_SGPIO_DCTRL_ACT_SHIFT +
+- (24-drive*8));
++ driveshift);
+ break;
+ case 1: /* id */
+ block &= ~((0x3 << MVS_SGPIO_DCTRL_LOC_SHIFT)
+- << (24-drive*8));
++ << driveshift);
+ block |= bit << MVS_SGPIO_DCTRL_LOC_SHIFT;
+ break;
+ case 2: /* fail */
+ block &= ~((0x7 << MVS_SGPIO_DCTRL_ERR_SHIFT)
+- << (24-drive*8));
++ << driveshift);
+ block |= bit << MVS_SGPIO_DCTRL_ERR_SHIFT;
+ break;
+ }
+
+- mw32(MVS_SGPIO_DCTRL + MVS_SGPIO_HOST_OFFSET * mvi->id,
+- block);
++ iowrite32be(block,
++ regs + MVS_SGPIO_DCTRL +
++ MVS_SGPIO_HOST_OFFSET * mvi->id);
+
+ }
+
+@@ -1132,7 +1133,7 @@ static int mvs_94xx_gpio_write(struct mv
+ void __iomem *regs = mvi->regs_ex - 0x10200;
+
+ mw32(MVS_SGPIO_DCTRL + MVS_SGPIO_HOST_OFFSET * mvi->id,
+- be32_to_cpu(((u32 *) write_data)[i]));
++ ((u32 *) write_data)[i]);
+ }
+ return reg_count;
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Manish Rangankar <manish.rangankar@cavium.com>
+Date: Mon, 26 Feb 2018 01:01:17 -0800
+Subject: scsi: qedi: Fix kernel crash during port toggle
+
+From: Manish Rangankar <manish.rangankar@cavium.com>
+
+[ Upstream commit 967823d6c3980a30e214b92bfe6a101e7b46d025 ]
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000100
+
+[ 985.596918] IP: _raw_spin_lock_bh+0x17/0x30
+[ 985.601581] PGD 0 P4D 0
+[ 985.604405] Oops: 0002 [#1] SMP
+:
+[ 985.704533] CPU: 16 PID: 1156 Comm: qedi_thread/16 Not tainted 4.16.0-rc2 #1
+[ 985.712397] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 2.4.3 01/17/2017
+[ 985.720747] RIP: 0010:_raw_spin_lock_bh+0x17/0x30
+[ 985.725996] RSP: 0018:ffffa4b1c43d3e10 EFLAGS: 00010246
+[ 985.731823] RAX: 0000000000000000 RBX: ffff94a31bd03000 RCX: 0000000000000000
+[ 985.739783] RDX: 0000000000000001 RSI: ffff94a32fa16938 RDI: 0000000000000100
+[ 985.747744] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000a33
+[ 985.755703] R10: 0000000000000000 R11: ffffa4b1c43d3af0 R12: 0000000000000000
+[ 985.763662] R13: ffff94a301f40818 R14: 0000000000000000 R15: 000000000000000c
+[ 985.771622] FS: 0000000000000000(0000) GS:ffff94a32fa00000(0000) knlGS:0000000000000000
+[ 985.780649] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 985.787057] CR2: 0000000000000100 CR3: 000000067a009006 CR4: 00000000001606e0
+[ 985.795017] Call Trace:
+[ 985.797747] qedi_fp_process_cqes+0x258/0x980 [qedi]
+[ 985.803294] qedi_percpu_io_thread+0x10f/0x1b0 [qedi]
+[ 985.808931] kthread+0xf5/0x130
+[ 985.812434] ? qedi_free_uio+0xd0/0xd0 [qedi]
+[ 985.817298] ? kthread_bind+0x10/0x10
+[ 985.821372] ? do_syscall_64+0x6e/0x1a0
+
+Signed-off-by: Manish Rangankar <manish.rangankar@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qedi/qedi_fw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/scsi/qedi/qedi_fw.c
++++ b/drivers/scsi/qedi/qedi_fw.c
+@@ -769,6 +769,11 @@ static void qedi_process_cmd_cleanup_res
+
+ iscsi_cid = cqe->conn_id;
+ qedi_conn = qedi->cid_que.conn_cid_tbl[iscsi_cid];
++ if (!qedi_conn) {
++ QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
++ "icid not found 0x%x\n", cqe->conn_id);
++ return;
++ }
+
+ /* Based on this itt get the corresponding qedi_cmd */
+ spin_lock_bh(&qedi_conn->tmf_work_lock);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Andrew Vasquez <andrew.vasquez@cavium.com>
+Date: Wed, 7 Feb 2018 08:12:35 -0800
+Subject: scsi: qedi: Fix truncation of CHAP name and secret
+
+From: Andrew Vasquez <andrew.vasquez@cavium.com>
+
+[ Upstream commit 1683ce57f568c7c92d53e9234624a53554a29cd5 ]
+
+The data in NVRAM is not guaranteed to be NUL terminated. Since
+snprintf expects byte-stream to accommodate null byte, the CHAP secret
+is truncated. Use sprintf instead of snprintf to fix the truncation of
+CHAP name and secret.
+
+Signed-off-by: Andrew Vasquez <andrew.vasquez@cavium.com>
+Signed-off-by: Nilesh Javali <nilesh.javali@cavium.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Acked-by: Chris Leech <cleech@redhat.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1840,8 +1840,8 @@ static ssize_t qedi_show_boot_ini_info(v
+
+ switch (type) {
+ case ISCSI_BOOT_INI_INITIATOR_NAME:
+- rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
+- initiator->initiator_name.byte);
++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
++ initiator->initiator_name.byte);
+ break;
+ default:
+ rc = 0;
+@@ -1908,8 +1908,8 @@ qedi_show_boot_tgt_info(struct qedi_ctx
+
+ switch (type) {
+ case ISCSI_BOOT_TGT_NAME:
+- rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
+- block->target[idx].target_name.byte);
++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
++ block->target[idx].target_name.byte);
+ break;
+ case ISCSI_BOOT_TGT_IP_ADDR:
+ if (ipv6_en)
+@@ -1930,20 +1930,20 @@ qedi_show_boot_tgt_info(struct qedi_ctx
+ block->target[idx].lun.value[0]);
+ break;
+ case ISCSI_BOOT_TGT_CHAP_NAME:
+- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
+- chap_name);
++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
++ chap_name);
+ break;
+ case ISCSI_BOOT_TGT_CHAP_SECRET:
+- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
+- chap_secret);
++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
++ chap_secret);
+ break;
+ case ISCSI_BOOT_TGT_REV_CHAP_NAME:
+- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
+- mchap_name);
++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
++ mchap_name);
+ break;
+ case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
+- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
+- mchap_secret);
++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
++ mchap_secret);
+ break;
+ case ISCSI_BOOT_TGT_FLAGS:
+ rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Thu, 25 Jan 2018 08:24:29 -0800
+Subject: scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+[ Upstream commit c02189e12ce3bf3808cb880569d3b10249f50bd9 ]
+
+A left shift must shift less than the bit width of the left argument.
+Avoid triggering undefined behavior if ha->mbx_count == 32.
+
+This patch avoids that UBSAN reports the following complaint:
+
+UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14
+shift exponent 32 is too large for 32-bit type 'int'
+Call Trace:
+ dump_stack+0x4e/0x6c
+ ubsan_epilogue+0xd/0x3b
+ __ubsan_handle_shift_out_of_bounds+0x112/0x14c
+ qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx]
+ qla2300_intr_handler+0x1ea/0x3bb [qla2xxx]
+ qla2x00_mailbox_command+0x77b/0x139a [qla2xxx]
+ qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx]
+ qla2x00_chip_diag+0x354/0x45f [qla2xxx]
+ qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx]
+ qla2x00_probe_one+0x1681/0x392e [qla2xxx]
+ pci_device_probe+0x10b/0x1f1
+ driver_probe_device+0x21f/0x3a4
+ __driver_attach+0xa9/0xe1
+ bus_for_each_dev+0x6e/0xb5
+ driver_attach+0x22/0x3c
+ bus_add_driver+0x1d1/0x2ae
+ driver_register+0x78/0x130
+ __pci_register_driver+0x75/0xa8
+ qla2x00_module_init+0x21b/0x267 [qla2xxx]
+ do_one_initcall+0x5a/0x1e2
+ do_init_module+0x9d/0x285
+ load_module+0x20db/0x38e3
+ SYSC_finit_module+0xa8/0xbc
+ SyS_finit_module+0x9/0xb
+ do_syscall_64+0x77/0x271
+ entry_SYSCALL64_slow_path+0x25/0x25
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Himanshu Madhani <himanshu.madhani@cavium.com>
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *
+ struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+ /* Read all mbox registers? */
+- mboxes = (1 << ha->mbx_count) - 1;
++ WARN_ON_ONCE(ha->mbx_count > 32);
++ mboxes = (1ULL << ha->mbx_count) - 1;
+ if (!ha->mcp)
+ ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n");
+ else
+@@ -2821,7 +2822,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *
+ struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+
+ /* Read all mbox registers? */
+- mboxes = (1 << ha->mbx_count) - 1;
++ WARN_ON_ONCE(ha->mbx_count > 32);
++ mboxes = (1ULL << ha->mbx_count) - 1;
+ if (!ha->mcp)
+ ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n");
+ else
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 23 Jan 2018 11:05:21 -0800
+Subject: scsi: qla2xxx: Fix memory corruption during hba reset test
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 2ce87cc5b269510de9ca1185ca8a6e10ec78c069 ]
+
+This patch fixes memory corrpution while performing HBA Reset test.
+
+Following stack trace is seen:
+
+[ 466.397219] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
+[ 466.433669] IP: [<ffffffffc06f5dd0>] qlt_free_session_done+0x260/0x5f0 [qla2xxx]
+[ 466.467731] PGD 0
+[ 466.476718] Oops: 0000 [#1] SMP
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3581,6 +3581,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
+ }
+ qla2x00_wait_for_hba_ready(base_vha);
+
++ qla2x00_wait_for_sess_deletion(base_vha);
++
+ /*
+ * if UNLOAD flag is already set, then continue unload,
+ * where it was set first.
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Manish Rangankar <manish.rangankar@cavium.com>
+Date: Sun, 11 Feb 2018 22:48:41 -0800
+Subject: scsi: qla4xxx: skip error recovery in case of register disconnect.
+
+From: Manish Rangankar <manish.rangankar@cavium.com>
+
+[ Upstream commit 1bc5ad3a6acdcf56f83272f2de1cd2389ea9e9e2 ]
+
+A system crashes when continuously removing/re-adding the storage
+controller.
+
+Signed-off-by: Manish Rangankar <manish.rangankar@cavium.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla4xxx/ql4_def.h | 2 +
+ drivers/scsi/qla4xxx/ql4_os.c | 46 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 48 insertions(+)
+
+--- a/drivers/scsi/qla4xxx/ql4_def.h
++++ b/drivers/scsi/qla4xxx/ql4_def.h
+@@ -168,6 +168,8 @@
+ #define DEV_DB_NON_PERSISTENT 0
+ #define DEV_DB_PERSISTENT 1
+
++#define QL4_ISP_REG_DISCONNECT 0xffffffffU
++
+ #define COPY_ISID(dst_isid, src_isid) { \
+ int i, j; \
+ for (i = 0, j = ISID_SIZE - 1; i < ISID_SIZE;) \
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -262,6 +262,24 @@ static struct iscsi_transport qla4xxx_is
+
+ static struct scsi_transport_template *qla4xxx_scsi_transport;
+
++static int qla4xxx_isp_check_reg(struct scsi_qla_host *ha)
++{
++ u32 reg_val = 0;
++ int rval = QLA_SUCCESS;
++
++ if (is_qla8022(ha))
++ reg_val = readl(&ha->qla4_82xx_reg->host_status);
++ else if (is_qla8032(ha) || is_qla8042(ha))
++ reg_val = qla4_8xxx_rd_direct(ha, QLA8XXX_PEG_ALIVE_COUNTER);
++ else
++ reg_val = readw(&ha->reg->ctrl_status);
++
++ if (reg_val == QL4_ISP_REG_DISCONNECT)
++ rval = QLA_ERROR;
++
++ return rval;
++}
++
+ static int qla4xxx_send_ping(struct Scsi_Host *shost, uint32_t iface_num,
+ uint32_t iface_type, uint32_t payload_size,
+ uint32_t pid, struct sockaddr *dst_addr)
+@@ -9188,10 +9206,17 @@ static int qla4xxx_eh_abort(struct scsi_
+ struct srb *srb = NULL;
+ int ret = SUCCESS;
+ int wait = 0;
++ int rval;
+
+ ql4_printk(KERN_INFO, ha, "scsi%ld:%d:%llu: Abort command issued cmd=%p, cdb=0x%x\n",
+ ha->host_no, id, lun, cmd, cmd->cmnd[0]);
+
++ rval = qla4xxx_isp_check_reg(ha);
++ if (rval != QLA_SUCCESS) {
++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
++ return FAILED;
++ }
++
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ srb = (struct srb *) CMD_SP(cmd);
+ if (!srb) {
+@@ -9243,6 +9268,7 @@ static int qla4xxx_eh_device_reset(struc
+ struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
+ struct ddb_entry *ddb_entry = cmd->device->hostdata;
+ int ret = FAILED, stat;
++ int rval;
+
+ if (!ddb_entry)
+ return ret;
+@@ -9262,6 +9288,12 @@ static int qla4xxx_eh_device_reset(struc
+ cmd, jiffies, cmd->request->timeout / HZ,
+ ha->dpc_flags, cmd->result, cmd->allowed));
+
++ rval = qla4xxx_isp_check_reg(ha);
++ if (rval != QLA_SUCCESS) {
++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
++ return FAILED;
++ }
++
+ /* FIXME: wait for hba to go online */
+ stat = qla4xxx_reset_lun(ha, ddb_entry, cmd->device->lun);
+ if (stat != QLA_SUCCESS) {
+@@ -9305,6 +9337,7 @@ static int qla4xxx_eh_target_reset(struc
+ struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
+ struct ddb_entry *ddb_entry = cmd->device->hostdata;
+ int stat, ret;
++ int rval;
+
+ if (!ddb_entry)
+ return FAILED;
+@@ -9322,6 +9355,12 @@ static int qla4xxx_eh_target_reset(struc
+ ha->host_no, cmd, jiffies, cmd->request->timeout / HZ,
+ ha->dpc_flags, cmd->result, cmd->allowed));
+
++ rval = qla4xxx_isp_check_reg(ha);
++ if (rval != QLA_SUCCESS) {
++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
++ return FAILED;
++ }
++
+ stat = qla4xxx_reset_target(ha, ddb_entry);
+ if (stat != QLA_SUCCESS) {
+ starget_printk(KERN_INFO, scsi_target(cmd->device),
+@@ -9376,9 +9415,16 @@ static int qla4xxx_eh_host_reset(struct
+ {
+ int return_status = FAILED;
+ struct scsi_qla_host *ha;
++ int rval;
+
+ ha = to_qla_host(cmd->device->host);
+
++ rval = qla4xxx_isp_check_reg(ha);
++ if (rval != QLA_SUCCESS) {
++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
++ return FAILED;
++ }
++
+ if ((is_qla8032(ha) || is_qla8042(ha)) && ql4xdontresethba)
+ qla4_83xx_set_idc_dontreset(ha);
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Jeremy Cline <jeremy@jcline.org>
+Date: Tue, 6 Mar 2018 21:47:32 +0000
+Subject: scsi: sd: Keep disk read-only when re-reading partition
+
+From: Jeremy Cline <jeremy@jcline.org>
+
+[ Upstream commit 20bd1d026aacc5399464f8328f305985c493cde3 ]
+
+If the read-only flag is true on a SCSI disk, re-reading the partition
+table sets the flag back to false.
+
+To observe this bug, you can run:
+
+1. blockdev --setro /dev/sda
+2. blockdev --rereadpt /dev/sda
+3. blockdev --getro /dev/sda
+
+This commit reads the disk's old state and combines it with the device
+disk-reported state rather than unconditionally marking it as RW.
+
+Reported-by: Li Ning <lining916740672@icloud.com>
+Signed-off-by: Jeremy Cline <jeremy@jcline.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2608,6 +2608,7 @@ sd_read_write_protect_flag(struct scsi_d
+ int res;
+ struct scsi_device *sdp = sdkp->device;
+ struct scsi_mode_data data;
++ int disk_ro = get_disk_ro(sdkp->disk);
+ int old_wp = sdkp->write_prot;
+
+ set_disk_ro(sdkp->disk, 0);
+@@ -2648,7 +2649,7 @@ sd_read_write_protect_flag(struct scsi_d
+ "Test WP failed, assume Write Enabled\n");
+ } else {
+ sdkp->write_prot = ((data.device_specific & 0x80) != 0);
+- set_disk_ro(sdkp->disk, sdkp->write_prot);
++ set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro);
+ if (sdkp->first_scan || old_wp != sdkp->write_prot) {
+ sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n",
+ sdkp->write_prot ? "on" : "off");
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: "Michael Kelley (EOSG)" <Michael.H.Kelley@microsoft.com>
+Date: Wed, 24 Jan 2018 22:49:57 +0000
+Subject: scsi: storvsc: Increase cmd_per_lun for higher speed devices
+
+From: "Michael Kelley (EOSG)" <Michael.H.Kelley@microsoft.com>
+
+[ Upstream commit cabe92a55e3a12005a4ac4d3954c9a174b0efe2a ]
+
+Increase cmd_per_lun to allow more I/Os in progress per device,
+particularly for NVMe's. The Hyper-V host side can handle the higher
+count with no issues.
+
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
+Acked-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/storvsc_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1661,7 +1661,7 @@ static struct scsi_host_template scsi_dr
+ .eh_timed_out = storvsc_eh_timed_out,
+ .slave_alloc = storvsc_device_alloc,
+ .slave_configure = storvsc_device_configure,
+- .cmd_per_lun = 255,
++ .cmd_per_lun = 2048,
+ .this_id = -1,
+ .use_clustering = ENABLE_CLUSTERING,
+ /* Make sure we dont get a sg segment crosses a page boundary */
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 25 Jan 2018 17:13:40 +0300
+Subject: scsi: sym53c8xx_2: iterator underflow in sym_getsync()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e6f791d95313c85f3dd4a26141e28e50ae9aa0ae ]
+
+We wanted to exit the loop with "div" set to zero, but instead, if we
+don't hit the break then "div" is -1 when we finish the loop. It leads
+to an array underflow a few lines later.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Acked-by: Matthew Wilcox <mawilcox@microsoft.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sym53c8xx_2/sym_hipd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -536,7 +536,7 @@ sym_getsync(struct sym_hcb *np, u_char d
+ * Look for the greatest clock divisor that allows an
+ * input speed faster than the period.
+ */
+- while (div-- > 0)
++ while (--div > 0)
+ if (kpc >= (div_10M[div] << 2)) break;
+
+ /*
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Sujit Reddy Thumma <sthumma@codeaurora.org>
+Date: Wed, 24 Jan 2018 09:52:35 +0530
+Subject: scsi: ufs: Enable quirk to ignore sending WRITE_SAME command
+
+From: Sujit Reddy Thumma <sthumma@codeaurora.org>
+
+[ Upstream commit 84af7e8b895088d89f246d6b0f82717fafdebf61 ]
+
+WRITE_SAME command is not supported by UFS. Enable a quirk for the upper
+level drivers to not send WRITE SAME command.
+
+[mkp: botched patch, applied by hand]
+
+Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
+Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
+Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4347,6 +4347,8 @@ static int ufshcd_slave_alloc(struct scs
+ /* REPORT SUPPORTED OPERATION CODES is not supported */
+ sdev->no_report_opcodes = 1;
+
++ /* WRITE_SAME command is not supported */
++ sdev->no_write_same = 1;
+
+ ufshcd_set_queue_depth(sdev);
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Vignesh R <vigneshr@ti.com>
+Date: Thu, 8 Feb 2018 18:25:41 +0530
+Subject: serial: 8250: Don't service RX FIFO if interrupts are disabled
+
+From: Vignesh R <vigneshr@ti.com>
+
+[ Upstream commit 2e9fe539108320820016f78ca7704a7342788380 ]
+
+Currently, data in RX FIFO is read based on UART_LSR register state even
+if RDI and RLSI interrupts are disabled in UART_IER register.
+This is because when IRQ handler is called due to TX FIFO empty event,
+RX FIFO is serviced based on UART_LSR register status instead of
+UART_IIR status. This defeats the purpose of disabling UART RX
+FIFO interrupts during throttling(see, omap_8250_throttle()) as IRQ
+handler continues to drain UART RX FIFO resulting in overflow of buffer
+at tty layer.
+Fix this by making sure that driver drains UART RX FIFO only when
+UART_IIR_RDI is set along with UART_LSR_BI or UART_LSR_DR bits.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1874,7 +1874,8 @@ int serial8250_handle_irq(struct uart_po
+
+ status = serial_port_in(port, UART_LSR);
+
+- if (status & (UART_LSR_DR | UART_LSR_BI)) {
++ if (status & (UART_LSR_DR | UART_LSR_BI) &&
++ iir & UART_IIR_RDI) {
+ if (!up->dma || handle_rx_dma(up, iir))
+ status = serial8250_rx_chars(up, status);
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
+Date: Thu, 25 Jan 2018 14:30:43 +0100
+Subject: serial: altera: ensure port->regshift is honored consistently
+
+From: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 0e254963b6ba4d63ac911e79537fea38dd03dc50 ]
+
+Most register accesses in the altera driver honor port->regshift by
+using altera_uart_writel(). There are a few accesses however that were
+missed when the driver was converted to use port->regshift and some
+others were added later in commit 4d9d7d896d77 ("serial: altera_uart:
+add earlycon support").
+
+Fixes: 2780ad42f5fe ("tty: serial: altera_uart: Use port->regshift to store bus shift")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Tobias Klauser <tklauser@distanz.ch>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/altera_uart.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/tty/serial/altera_uart.c
++++ b/drivers/tty/serial/altera_uart.c
+@@ -331,7 +331,7 @@ static int altera_uart_startup(struct ua
+
+ /* Enable RX interrupts now */
+ pp->imr = ALTERA_UART_CONTROL_RRDY_MSK;
+- writel(pp->imr, port->membase + ALTERA_UART_CONTROL_REG);
++ altera_uart_writel(port, pp->imr, ALTERA_UART_CONTROL_REG);
+
+ spin_unlock_irqrestore(&port->lock, flags);
+
+@@ -347,7 +347,7 @@ static void altera_uart_shutdown(struct
+
+ /* Disable all interrupts now */
+ pp->imr = 0;
+- writel(pp->imr, port->membase + ALTERA_UART_CONTROL_REG);
++ altera_uart_writel(port, pp->imr, ALTERA_UART_CONTROL_REG);
+
+ spin_unlock_irqrestore(&port->lock, flags);
+
+@@ -436,7 +436,7 @@ static void altera_uart_console_putc(str
+ ALTERA_UART_STATUS_TRDY_MSK))
+ cpu_relax();
+
+- writel(c, port->membase + ALTERA_UART_TXDATA_REG);
++ altera_uart_writel(port, c, ALTERA_UART_TXDATA_REG);
+ }
+
+ static void altera_uart_console_write(struct console *co, const char *s,
+@@ -506,13 +506,13 @@ static int __init altera_uart_earlycon_s
+ return -ENODEV;
+
+ /* Enable RX interrupts now */
+- writel(ALTERA_UART_CONTROL_RRDY_MSK,
+- port->membase + ALTERA_UART_CONTROL_REG);
++ altera_uart_writel(port, ALTERA_UART_CONTROL_RRDY_MSK,
++ ALTERA_UART_CONTROL_REG);
+
+ if (dev->baud) {
+ unsigned int baudclk = port->uartclk / dev->baud;
+
+- writel(baudclk, port->membase + ALTERA_UART_DIVISOR_REG);
++ altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG);
+ }
+
+ dev->con->write = altera_uart_earlycon_write;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:29 +0100
+Subject: serial: arc_uart: Fix out-of-bounds access through DT alias
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit f9f5786987e81d166c60833edcb7d1836aa16944 ]
+
+The arc_uart_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Note that the array size is defined by a Kconfig symbol
+(CONFIG_SERIAL_ARC_NR_PORTS), so this can even be triggered using a
+legitimate DTB.
+
+Fixes: ea28fd56fcde69af ("serial/arc-uart: switch to devicetree based probing")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/arc_uart.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/tty/serial/arc_uart.c
++++ b/drivers/tty/serial/arc_uart.c
+@@ -596,6 +596,11 @@ static int arc_serial_probe(struct platf
+ if (dev_id < 0)
+ dev_id = 0;
+
++ if (dev_id >= ARRAY_SIZE(arc_uart_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", dev_id);
++ return -EINVAL;
++ }
++
+ uart = &arc_uart_ports[dev_id];
+ port = &uart->port;
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:30 +0100
+Subject: serial: fsl_lpuart: Fix out-of-bounds access through DT alias
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit ffab87fdecc655cc676f8be8dd1a2c5e22bd6d47 ]
+
+The lpuart_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: c9e2e946fb0ba5d2 ("tty: serial: add Freescale lpuart driver support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -2151,6 +2151,10 @@ static int lpuart_probe(struct platform_
+ dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret);
+ return ret;
+ }
++ if (ret >= ARRAY_SIZE(lpuart_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", ret);
++ return -EINVAL;
++ }
+ sport->port.line = ret;
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ sport->port.membase = devm_ioremap_resource(&pdev->dev, res);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:31 +0100
+Subject: serial: imx: Fix out-of-bounds access through serial port index
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5673444821406dda5fc25e4b52aca419f8065a19 ]
+
+The imx_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, or from platform data, which may lead to an
+out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: ff05967a07225ab6 ("serial/imx: add of_alias_get_id() reference back")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/imx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2096,6 +2096,12 @@ static int serial_imx_probe(struct platf
+ else if (ret < 0)
+ return ret;
+
++ if (sport->port.line >= ARRAY_SIZE(imx_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n",
++ sport->port.line);
++ return -EINVAL;
++ }
++
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(base))
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:32 +0100
+Subject: serial: mxs-auart: Fix out-of-bounds access through serial port index
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit dd345a31bfdec350d2593e6de5964e55c7f19c76 ]
+
+The auart_port[] array is indexed using a value derived from the
+"serialN" alias in DT, or from platform data, which may lead to an
+out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: 1ea6607d4cdc9179 ("serial: mxs-auart: Allow device tree probing")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/mxs-auart.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1667,6 +1667,10 @@ static int mxs_auart_probe(struct platfo
+ s->port.line = pdev->id < 0 ? 0 : pdev->id;
+ else if (ret < 0)
+ return ret;
++ if (s->port.line >= ARRAY_SIZE(auart_port)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", s->port.line);
++ return -EINVAL;
++ }
+
+ if (of_id) {
+ pdev->id_entry = of_id->data;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:34 +0100
+Subject: serial: samsung: Fix out-of-bounds access through serial port index
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 49ee23b71877831ac087d6083f6f397dc19c9664 ]
+
+The s3c24xx_serial_ports[] array is indexed using a value derived from
+the "serialN" alias in DT, or from an incrementing probe index, which
+may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Note that the array size is defined by a Kconfig symbol
+(CONFIG_SERIAL_SAMSUNG_UARTS), so this can even be triggered using
+a legitimate DTB or legitimate board code.
+
+Fixes: 13a9f6c64fdc55eb ("serial: samsung: Consider DT alias when probing ports")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/samsung.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1821,6 +1821,10 @@ static int s3c24xx_serial_probe(struct p
+
+ dbg("s3c24xx_serial_probe(%p) %d\n", pdev, index);
+
++ if (index >= ARRAY_SIZE(s3c24xx_serial_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", index);
++ return -EINVAL;
++ }
+ ourport = &s3c24xx_serial_ports[index];
+
+ ourport->drv_data = s3c24xx_get_driver_data(pdev);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:35 +0100
+Subject: serial: sh-sci: Fix out-of-bounds access through DT alias
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 090fa4b0dccfa3d04e1c5ab0fe4eba16e6713895 ]
+
+The sci_ports[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Note that the array size is defined by a Kconfig symbol
+(CONFIG_SERIAL_SH_SCI_NR_UARTS), so this can even be triggered using a
+legitimate DTB.
+
+Fixes: 97ed9790c514066b ("serial: sh-sci: Remove unused platform data capabilities field")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sh-sci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -3076,6 +3076,10 @@ static struct plat_sci_port *sci_parse_d
+ dev_err(&pdev->dev, "failed to get alias id (%d)\n", id);
+ return NULL;
+ }
++ if (id >= ARRAY_SIZE(sci_ports)) {
++ dev_err(&pdev->dev, "serial%d out of range\n", id);
++ return NULL;
++ }
+
+ sp = &sci_ports[id];
+ *dev_id = id;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 23 Feb 2018 14:38:37 +0100
+Subject: serial: xuartps: Fix out-of-bounds access through DT alias
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit e7d75e18d0fc3f7193b65282b651f980c778d935 ]
+
+The cdns_uart_port[] array is indexed using a value derived from the
+"serialN" alias in DT, which may lead to an out-of-bounds access.
+
+Fix this by adding a range check.
+
+Fixes: 928e9263492069ee ("tty: xuartps: Initialize ports according to aliases")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/xilinx_uartps.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1115,7 +1115,7 @@ static struct uart_port *cdns_uart_get_p
+ struct uart_port *port;
+
+ /* Try the given port id if failed use default method */
+- if (cdns_uart_port[id].mapbase != 0) {
++ if (id < CDNS_UART_NR_PORTS && cdns_uart_port[id].mapbase != 0) {
+ /* Find the next unused port */
+ for (id = 0; id < CDNS_UART_NR_PORTS; id++)
+ if (cdns_uart_port[id].mapbase == 0)
cfg80211-limit-wiphy-names-to-128-bytes.patch
hfsplus-stop-workqueue-when-fill_super-failed.patch
x86-kexec-avoid-double-free_page-upon-do_kexec_load-failure.patch
+usb-gadget-f_uac2-fix-bfirstinterface-in-composite-gadget.patch
+usb-dwc3-undo-phy-init-if-soft-reset-fails.patch
+usb-dwc3-omap-don-t-miss-events-during-suspend-resume.patch
+usb-gadget-core-fix-use-after-free-of-usb_request.patch
+usb-gadget-fsl_udc_core-fix-ep-valid-checks.patch
+usb-dwc2-fix-dwc2_hsotg_core_init_disconnected.patch
+usb-cdc_acm-prevent-race-at-write-to-acm-while-system-resumes.patch
+net-usbnet-fix-potential-deadlock-on-32bit-hosts.patch
+arm-dts-imx7d-sdb-fix-regulator-usb-otg2-vbus-node-name.patch
+usb-host-xhci-plat-revert-usb-host-xhci-plat-enable-clk-in-resume-timing.patch
+usb-ohci-fix-null-dereference-in-hcds-using-hcd_local_mem.patch
+net-usb-qmi_wwan.c-add-usb-id-for-lt4120-modem.patch
+net-usb-add-qmi_wwan-if-on-lte-modem-wistron-neweb-d18q1.patch
+bluetooth-btusb-add-usb-id-7392-a611-for-edimax-ew-7611ulb.patch
+alsa-usb-audio-add-native-dsd-support-for-luxman-da-06.patch
+usb-dwc3-add-softreset-phy-synchonization-delay.patch
+usb-dwc3-update-dwc_usb31-gtxfifosiz-reg-fields.patch
+usb-dwc3-makefile-fix-link-error-on-randconfig.patch
+xhci-zero-usb-device-slot_id-member-when-disabling-and-freeing-a-xhci-slot.patch
+usb-dwc2-fix-interval-type-issue.patch
+usb-dwc2-hcd-fix-host-channel-halt-flow.patch
+usb-dwc2-host-fix-transaction-errors-in-host-mode.patch
+usb-gadget-ffs-let-setup-return-usb_gadget_delayed_status.patch
+usb-gadget-ffs-execute-copy_to_user-with-user_ds-set.patch
+usbip-correct-maximum-value-of-config_usbip_vhci_hc_ports.patch
+usb-gadget-udc-change-comparison-to-bitshift-when-dealing-with-a-mask.patch
+usb-gadget-composite-fix-incorrect-handling-of-os-desc-requests.patch
+media-lgdt3306a-fix-module-count-mismatch-on-usb-unplug.patch
+media-em28xx-usb-bulk-packet-size-fix.patch
+bluetooth-btusb-add-device-id-for-rtl8822be.patch
+xhci-show-what-usb-release-number-the-xhc-supports-from-protocol-capablity.patch
+staging-bcm2835-audio-release-resources-on-module_exit.patch
+staging-lustre-fix-bug-in-osc_enter_cache_try.patch
+staging-fsl-dpaa2-eth-fix-incorrect-casts.patch
+staging-rtl8192u-return-enomem-on-failed-allocation-of-priv-oldaddr.patch
+staging-ks7010-use-constants-from-ieee80211_eid-instead-of-literal-ints.patch
+staging-lustre-lmv-correctly-iput-lmo_root.patch
+crypto-inside-secure-wait-for-the-request-to-complete-if-in-the-backlog.patch
+crypto-atmel-aes-fix-the-keys-zeroing-on-errors.patch
+crypto-ccp-don-t-disable-interrupts-while-setting-up-debugfs.patch
+crypto-inside-secure-do-not-process-request-if-no-command-was-issued.patch
+crypto-inside-secure-fix-the-cache_len-computation.patch
+crypto-inside-secure-fix-the-extra-cache-computation.patch
+crypto-sunxi-ss-add-module_alias-to-sun4i-ss.patch
+crypto-inside-secure-fix-the-invalidation-step-during-cra_exit.patch
+scsi-mpt3sas-fix-an-out-of-bound-write.patch
+scsi-qla2xxx-fix-memory-corruption-during-hba-reset-test.patch
+scsi-ufs-enable-quirk-to-ignore-sending-write_same-command.patch
+scsi-bnx2fc-fix-check-in-scsi-completion-handler-for-timed-out-request.patch
+scsi-sym53c8xx_2-iterator-underflow-in-sym_getsync.patch
+scsi-mptfusion-add-bounds-check-in-mptctl_hp_targetinfo.patch
+scsi-qla2xxx-avoid-triggering-undefined-behavior-in-qla2x00_mbx_completion.patch
+scsi-storvsc-increase-cmd_per_lun-for-higher-speed-devices.patch
+scsi-qedi-fix-truncation-of-chap-name-and-secret.patch
+scsi-aacraid-fix-shutdown-crash-when-init-fails.patch
+scsi-qla4xxx-skip-error-recovery-in-case-of-register-disconnect.patch
+scsi-core-return-blk_sts_ok-for-did_ok-in-__scsi_error_from_host_byte.patch
+scsi-qedi-fix-kernel-crash-during-port-toggle.patch
+scsi-mpt3sas-do-not-mark-fw_event-workqueue-as-wq_mem_reclaim.patch
+scsi-sd-keep-disk-read-only-when-re-reading-partition.patch
+scsi-iscsi_tcp-set-bdi_cap_stable_writes-when-data-digest-enabled.patch
+scsi-aacraid-insure-command-thread-is-not-recursively-stopped.patch
+scsi-core-make-scsi-status-condition-met-equivalent-to-good.patch
+scsi-mvsas-fix-wrong-endianness-of-sgpio-api.patch
+scsi-lpfc-fix-issue_lip-if-link-is-disabled.patch
+scsi-lpfc-fix-soft-lockup-in-lpfc-worker-thread-during-lip-testing.patch
+scsi-lpfc-fix-frequency-of-release-wqe-cqes.patch
+asoc-hdmi-codec-fix-module-unloading-caused-kernel-crash.patch
+asoc-rockchip-rk3288-hdmi-analog-select-needed-codecs.patch
+asoc-samsung-odroid-fix-32000-sample-rate-handling.patch
+asoc-topology-create-tlv-data-for-dapm-widgets.patch
+asoc-samsung-i2s-ensure-the-rclk-rate-is-properly-determined.patch
+clk-rockchip-fix-wrong-parent-for-sdmmc-phase-clock-for-rk3228.patch
+clk-don-t-show-the-incorrect-clock-phase.patch
+clk-hisilicon-mark-wdt_mux_p-as-const.patch
+clk-tegra-fix-pll_u-rate-configuration.patch
+clk-rockchip-prevent-calculating-mmc-phase-if-clock-rate-is-zero.patch
+clk-samsung-s3c2410-fix-pll-rates.patch
+clk-samsung-exynos7-fix-pll-rates.patch
+clk-samsung-exynos5260-fix-pll-rates.patch
+clk-samsung-exynos5433-fix-pll-rates.patch
+clk-samsung-exynos5250-fix-pll-rates.patch
+clk-samsung-exynos3250-fix-pll-rates.patch
+media-dmxdev-fix-error-code-for-invalid-ioctls.patch
+media-don-t-let-tvp5150_get_vbi-go-out-of-vbi_ram_default-array.patch
+media-ov5645-add-missing-of_node_put-in-error-path.patch
+arm64-insn-allow-add-sub-immediate-with-lsl-12.patch
+media-cx23885-override-888-impactvcbe-crystal-frequency.patch
+media-cx23885-set-subdev-host-data-to-clk_freq-pointer.patch
+media-s3c-camif-fix-out-of-bounds-array-access.patch
+media-lgdt3306a-fix-a-double-kfree-on-i2c-device-remove.patch
+media-em28xx-add-hauppauge-solohd-dualhd-bulk-models.patch
+media-v4l-vsp1-fix-display-stalls-when-requesting-too-many-inputs.patch
+media-i2c-adv748x-fix-hdmi-field-heights.patch
+media-vb2-fix-videobuf2-to-map-correct-area.patch
+media-vivid-fix-incorrect-capabilities-for-radio.patch
+media-cx25821-prevent-out-of-bounds-read-on-array-card.patch
+serial-xuartps-fix-out-of-bounds-access-through-dt-alias.patch
+serial-sh-sci-fix-out-of-bounds-access-through-dt-alias.patch
+serial-samsung-fix-out-of-bounds-access-through-serial-port-index.patch
+serial-mxs-auart-fix-out-of-bounds-access-through-serial-port-index.patch
+serial-imx-fix-out-of-bounds-access-through-serial-port-index.patch
+serial-fsl_lpuart-fix-out-of-bounds-access-through-dt-alias.patch
+serial-arc_uart-fix-out-of-bounds-access-through-dt-alias.patch
+serial-8250-don-t-service-rx-fifo-if-interrupts-are-disabled.patch
+serial-altera-ensure-port-regshift-is-honored-consistently.patch
+rtc-snvs-fix-usage-of-snvs_rtc_enable.patch
+rtc-hctosys-ensure-system-time-doesn-t-overflow-time_t.patch
+rtc-rk808-fix-possible-race-condition.patch
+rtc-m41t80-fix-race-conditions.patch
+rtc-tx4939-avoid-unintended-sign-extension-on-a-24-bit-shift.patch
+rtc-rp5c01-fix-possible-race-condition.patch
+rtc-goldfish-add-missing-module_license.patch
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Kirill Marinushkin <k.marinushkin@gmail.com>
+Date: Fri, 23 Mar 2018 20:32:54 +0100
+Subject: staging: bcm2835-audio: Release resources on module_exit()
+
+From: Kirill Marinushkin <k.marinushkin@gmail.com>
+
+[ Upstream commit 626118b472d2eb45f83a0276a18d3e6a01c69f6a ]
+
+In the current implementation, `rmmod snd_bcm2835` does not release
+resources properly. It causes an oops when trying to list sound devices.
+
+This commit fixes it.
+
+The details WRT allocation / free are described below.
+
+Device structure WRT allocation:
+
+pdev
+ \childdev[]
+ \card
+ \chip
+ \pcm
+ \ctl
+
+Allocation / register sequence:
+
+* childdev: devm_kzalloc - freed during driver detach
+* childdev: device_initialize - freed during device_unregister
+* pdev: devres_alloc - freed during driver detach
+* childdev: device_add - removed during device_unregister
+* pdev, childdev: devres_add - freed during driver detach
+* card: snd_card_new - freed during snd_card_free
+* chip: kzalloc - freed during kfree
+* card, chip: snd_device_new - freed during snd_device_free
+* chip: new_pcm - TODO: free pcm
+* chip: new_ctl - TODO: free ctl
+* card: snd_card_register - unregistered during snd_card_free
+
+Free / unregister sequence:
+
+* card: snd_card_free
+* card, chip: snd_device_free
+* childdev: device_unregister
+* chip: kfree
+
+Steps to reproduce the issue before this commit:
+
+~~~~
+$ rmmod snd_bcm2835
+$ aplay -L
+[ 138.648130] Unable to handle kernel paging request at virtual address 7f1343c0
+[ 138.660415] pgd = ad8f0000
+[ 138.665567] [7f1343c0] *pgd=3864c811, *pte=00000000, *ppte=00000000
+[ 138.674887] Internal error: Oops: 7 [#1] SMP ARM
+[ 138.683571] Modules linked in: sha256_generic cfg80211 rfkill snd_pcm snd_timer
+ snd fixed uio_pdrv_genirq uio ip_tables x_tables ipv6 [last unloaded: snd_bcm2835
+]
+[ 138.706594] CPU: 3 PID: 463 Comm: aplay Tainted: G WC 4.15.0-rc1-v
+7+ #6
+[ 138.719833] Hardware name: BCM2835
+[ 138.726016] task: b877ac00 task.stack: aebec000
+[ 138.733408] PC is at try_module_get+0x38/0x24c
+[ 138.740813] LR is at snd_ctl_open+0x58/0x194 [snd]
+[ 138.748485] pc : [<801c4d5c>] lr : [<7f0e6b2c>] psr: 20000013
+[ 138.757709] sp : aebedd60 ip : aebedd88 fp : aebedd84
+[ 138.765884] r10: 00000000 r9 : 00000004 r8 : 7f0ed440
+[ 138.774040] r7 : b7e469b0 r6 : 7f0e6b2c r5 : afd91900 r4 : 7f1343c0
+[ 138.783571] r3 : aebec000 r2 : 00000001 r1 : b877ac00 r0 : 7f1343c0
+[ 138.793084] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 138.803300] Control: 10c5387d Table: 2d8f006a DAC: 00000055
+[ 138.812064] Process aplay (pid: 463, stack limit = 0xaebec210)
+[ 138.820868] Stack: (0xaebedd60 to 0xaebee000)
+[ 138.828207] dd60: 00000000 b848d000 afd91900 00000000 b7e469b0 7f0ed440 aebedda4 aebedd88
+[ 138.842371] dd80: 7f0e6b2c 801c4d30 afd91900 7f0ea4dc 00000000 b7e469b0 aebeddcc aebedda8
+[ 138.856611] dda0: 7f0e250c 7f0e6ae0 7f0e2464 b8478ec0 b7e469b0 afd91900 7f0ea388 00000000
+[ 138.870864] ddc0: aebeddf4 aebeddd0 802ce590 7f0e2470 8090ab64 afd91900 afd91900 b7e469b0
+[ 138.885301] dde0: afd91908 802ce4e4 aebede1c aebeddf8 802c57b4 802ce4f0 afd91900 aebedea8
+[ 138.900110] de00: b7fa4c00 00000000 00000000 00000004 aebede3c aebede20 802c6ba8 802c56b4
+[ 138.915260] de20: aebedea8 00000000 aebedf5c 00000000 aebedea4 aebede40 802d9a68 802c6b58
+[ 138.930661] de40: b874ddd0 00000000 00000000 00000001 00000041 00000000 afd91900 aebede70
+[ 138.946402] de60: 00000000 00000000 00000002 b7e469b0 b8a87610 b8d6ab80 801852f8 00080000
+[ 138.962314] de80: aebedf5c aebedea8 00000001 80108464 aebec000 00000000 aebedf4c aebedea8
+[ 138.978414] dea0: 802dacd4 802d970c b8a87610 b8d6ab80 a7982bc6 00000009 af363019 b9231480
+[ 138.994617] dec0: 00000000 b8c038a0 b7e469b0 00000101 00000002 00000238 00000000 00000000
+[ 139.010823] dee0: 00000000 aebedee8 00080000 0000000f aebedf3c aebedf00 802ed7e4 80843f94
+[ 139.027025] df00: 00000003 00080000 b9231490 b9231480 00000000 00080000 af363000 00000000
+[ 139.043229] df20: 00000005 00000002 ffffff9c 00000000 00080000 ffffff9c af363000 00000003
+[ 139.059430] df40: aebedf94 aebedf50 802c6f70 802dac70 aebec000 00000000 00000001 00000000
+[ 139.075629] df60: 00020000 00000004 00000100 00000001 7ebe577c 0002e038 00000000 00000005
+[ 139.091828] df80: 80108464 aebec000 aebedfa4 aebedf98 802c7060 802c6e6c 00000000 aebedfa8
+[ 139.108025] dfa0: 801082c0 802c7040 7ebe577c 0002e038 7ebe577c 00080000 00000b98 e81c8400
+[ 139.124222] dfc0: 7ebe577c 0002e038 00000000 00000005 7ebe57e4 00a20af8 7ebe57f0 76f87394
+[ 139.140419] dfe0: 00000000 7ebe55c4 76ec88e8 76df1d9c 60000010 7ebe577c 00000000 00000000
+[ 139.156715] [<801c4d5c>] (try_module_get) from [<7f0e6b2c>] (snd_ctl_open+0x58/0x194 [snd])
+[ 139.173222] [<7f0e6b2c>] (snd_ctl_open [snd]) from [<7f0e250c>] (snd_open+0xa8/0x14c [snd])
+[ 139.189683] [<7f0e250c>] (snd_open [snd]) from [<802ce590>] (chrdev_open+0xac/0x188)
+[ 139.205465] [<802ce590>] (chrdev_open) from [<802c57b4>] (do_dentry_open+0x10c/0x314)
+[ 139.221347] [<802c57b4>] (do_dentry_open) from [<802c6ba8>] (vfs_open+0x5c/0x88)
+[ 139.236788] [<802c6ba8>] (vfs_open) from [<802d9a68>] (path_openat+0x368/0x944)
+[ 139.248270] [<802d9a68>] (path_openat) from [<802dacd4>] (do_filp_open+0x70/0xc4)
+[ 139.263731] [<802dacd4>] (do_filp_open) from [<802c6f70>] (do_sys_open+0x110/0x1d4)
+[ 139.279378] [<802c6f70>] (do_sys_open) from [<802c7060>] (SyS_open+0x2c/0x30)
+[ 139.290647] [<802c7060>] (SyS_open) from [<801082c0>] (ret_fast_syscall+0x0/0x28)
+[ 139.306021] Code: e3c3303f e5932004 e2822001 e5832004 (e5943000)
+[ 139.316265] ---[ end trace 7f3f7f6193b663ed ]---
+[ 139.324956] note: aplay[463] exited with preempt_count 1
+~~~~
+
+Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
+Cc: Eric Anholt <eric@anholt.net>
+Cc: Stefan Wahren <stefan.wahren@i2se.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Ray Jui <rjui@broadcom.com>
+Cc: Scott Branden <sbranden@broadcom.com>
+Cc: bcm-kernel-feedback-list@broadcom.com
+Cc: Michael Zoran <mzoran@crowfest.net>
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: linux-rpi-kernel@lists.infradead.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: devel@driverdev.osuosl.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/vc04_services/bcm2835-audio/bcm2835.c | 54 ++++++++----------
+ 1 file changed, 25 insertions(+), 29 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+@@ -36,6 +36,10 @@ MODULE_PARM_DESC(enable_compat_alsa,
+ static void snd_devm_unregister_child(struct device *dev, void *res)
+ {
+ struct device *childdev = *(struct device **)res;
++ struct bcm2835_chip *chip = dev_get_drvdata(childdev);
++ struct snd_card *card = chip->card;
++
++ snd_card_free(card);
+
+ device_unregister(childdev);
+ }
+@@ -61,6 +65,13 @@ static int snd_devm_add_child(struct dev
+ return 0;
+ }
+
++static void snd_bcm2835_release(struct device *dev)
++{
++ struct bcm2835_chip *chip = dev_get_drvdata(dev);
++
++ kfree(chip);
++}
++
+ static struct device *
+ snd_create_device(struct device *parent,
+ struct device_driver *driver,
+@@ -76,6 +87,7 @@ snd_create_device(struct device *parent,
+ device_initialize(device);
+ device->parent = parent;
+ device->driver = driver;
++ device->release = snd_bcm2835_release;
+
+ dev_set_name(device, "%s", name);
+
+@@ -86,18 +98,19 @@ snd_create_device(struct device *parent,
+ return device;
+ }
+
+-static int snd_bcm2835_free(struct bcm2835_chip *chip)
+-{
+- kfree(chip);
+- return 0;
+-}
+-
+ /* component-destructor
+ * (see "Management of Cards and Components")
+ */
+ static int snd_bcm2835_dev_free(struct snd_device *device)
+ {
+- return snd_bcm2835_free(device->device_data);
++ struct bcm2835_chip *chip = device->device_data;
++ struct snd_card *card = chip->card;
++
++ /* TODO: free pcm, ctl */
++
++ snd_device_free(card, chip);
++
++ return 0;
+ }
+
+ /* chip-specific constructor
+@@ -122,7 +135,7 @@ static int snd_bcm2835_create(struct snd
+
+ err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
+ if (err) {
+- snd_bcm2835_free(chip);
++ kfree(chip);
+ return err;
+ }
+
+@@ -130,31 +143,14 @@ static int snd_bcm2835_create(struct snd
+ return 0;
+ }
+
+-static void snd_devm_card_free(struct device *dev, void *res)
++static struct snd_card *snd_bcm2835_card_new(struct device *dev)
+ {
+- struct snd_card *snd_card = *(struct snd_card **)res;
+-
+- snd_card_free(snd_card);
+-}
+-
+-static struct snd_card *snd_devm_card_new(struct device *dev)
+-{
+- struct snd_card **dr;
+ struct snd_card *card;
+ int ret;
+
+- dr = devres_alloc(snd_devm_card_free, sizeof(*dr), GFP_KERNEL);
+- if (!dr)
+- return ERR_PTR(-ENOMEM);
+-
+ ret = snd_card_new(dev, -1, NULL, THIS_MODULE, 0, &card);
+- if (ret) {
+- devres_free(dr);
++ if (ret)
+ return ERR_PTR(ret);
+- }
+-
+- *dr = card;
+- devres_add(dev, dr);
+
+ return card;
+ }
+@@ -271,7 +267,7 @@ static int snd_add_child_device(struct d
+ return PTR_ERR(child);
+ }
+
+- card = snd_devm_card_new(child);
++ card = snd_bcm2835_card_new(child);
+ if (IS_ERR(card)) {
+ dev_err(child, "Failed to create card");
+ return PTR_ERR(card);
+@@ -313,7 +309,7 @@ static int snd_add_child_device(struct d
+ return err;
+ }
+
+- dev_set_drvdata(child, card);
++ dev_set_drvdata(child, chip);
+ dev_info(child, "card created with %d channels\n", numchans);
+
+ return 0;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Ioana Radulescu <ruxandra.radulescu@nxp.com>
+Date: Mon, 26 Feb 2018 10:28:06 -0600
+Subject: staging: fsl-dpaa2/eth: Fix incorrect casts
+
+From: Ioana Radulescu <ruxandra.radulescu@nxp.com>
+
+[ Upstream commit 75c583ab9709692a60871d4719006391cde8dc1d ]
+
+The DPAA2 Ethernet driver incorrectly assumes virtual addresses
+are always 64b long, which causes compiler errors when building
+for a 32b platform.
+
+Fix this by using explicit casts to uintptr_t where necessary.
+
+Signed-off-by: Ioana Radulescu <ruxandra.radulescu@nxp.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
++++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
+@@ -315,7 +315,7 @@ static int consume_frames(struct dpaa2_e
+ }
+
+ fd = dpaa2_dq_fd(dq);
+- fq = (struct dpaa2_eth_fq *)dpaa2_dq_fqd_ctx(dq);
++ fq = (struct dpaa2_eth_fq *)(uintptr_t)dpaa2_dq_fqd_ctx(dq);
+ fq->stats.frames++;
+
+ fq->consume(priv, ch, fd, &ch->napi);
+@@ -1888,7 +1888,7 @@ static int setup_rx_flow(struct dpaa2_et
+ queue.destination.id = fq->channel->dpcon_id;
+ queue.destination.type = DPNI_DEST_DPCON;
+ queue.destination.priority = 1;
+- queue.user_context = (u64)fq;
++ queue.user_context = (u64)(uintptr_t)fq;
+ err = dpni_set_queue(priv->mc_io, 0, priv->mc_token,
+ DPNI_QUEUE_RX, 0, fq->flowid,
+ DPNI_QUEUE_OPT_USER_CTX | DPNI_QUEUE_OPT_DEST,
+@@ -1940,7 +1940,7 @@ static int setup_tx_flow(struct dpaa2_et
+ queue.destination.id = fq->channel->dpcon_id;
+ queue.destination.type = DPNI_DEST_DPCON;
+ queue.destination.priority = 0;
+- queue.user_context = (u64)fq;
++ queue.user_context = (u64)(uintptr_t)fq;
+ err = dpni_set_queue(priv->mc_io, 0, priv->mc_token,
+ DPNI_QUEUE_TX_CONFIRM, 0, fq->flowid,
+ DPNI_QUEUE_OPT_USER_CTX | DPNI_QUEUE_OPT_DEST,
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Quytelda Kahja <quytelda@tamalin.org>
+Date: Wed, 28 Feb 2018 21:19:07 -0800
+Subject: staging: ks7010: Use constants from ieee80211_eid instead of literal ints.
+
+From: Quytelda Kahja <quytelda@tamalin.org>
+
+[ Upstream commit dc13498ab47fdfae3cda4df712beb2e4244b3fe0 ]
+
+The case statement in get_ap_information() should not use literal integers
+to parse information element IDs when these values are provided by name
+in 'enum ieee80211_eid' in the header 'linux/ieee80211.h'.
+
+Signed-off-by: Quytelda Kahja <quytelda@tamalin.org>
+Reviewed-by: Tobin C. Harding <me@tobin.cc>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/ks7010/ks_hostif.c | 31 +++++++++++++++----------------
+ drivers/staging/ks7010/ks_hostif.h | 1 +
+ 2 files changed, 16 insertions(+), 16 deletions(-)
+
+--- a/drivers/staging/ks7010/ks_hostif.c
++++ b/drivers/staging/ks7010/ks_hostif.c
+@@ -242,9 +242,8 @@ int get_ap_information(struct ks_wlan_pr
+ offset = 0;
+
+ while (bsize > offset) {
+- /* DPRINTK(4, "Element ID=%d\n",*bp); */
+- switch (*bp) {
+- case 0: /* ssid */
++ switch (*bp) { /* Information Element ID */
++ case WLAN_EID_SSID:
+ if (*(bp + 1) <= SSID_MAX_SIZE) {
+ ap->ssid.size = *(bp + 1);
+ } else {
+@@ -254,8 +253,8 @@ int get_ap_information(struct ks_wlan_pr
+ }
+ memcpy(ap->ssid.body, bp + 2, ap->ssid.size);
+ break;
+- case 1: /* rate */
+- case 50: /* ext rate */
++ case WLAN_EID_SUPP_RATES:
++ case WLAN_EID_EXT_SUPP_RATES:
+ if ((*(bp + 1) + ap->rate_set.size) <=
+ RATE_SET_MAX_SIZE) {
+ memcpy(&ap->rate_set.body[ap->rate_set.size],
+@@ -271,9 +270,9 @@ int get_ap_information(struct ks_wlan_pr
+ (RATE_SET_MAX_SIZE - ap->rate_set.size);
+ }
+ break;
+- case 3: /* DS parameter */
++ case WLAN_EID_DS_PARAMS:
+ break;
+- case 48: /* RSN(WPA2) */
++ case WLAN_EID_RSN:
+ ap->rsn_ie.id = *bp;
+ if (*(bp + 1) <= RSN_IE_BODY_MAX) {
+ ap->rsn_ie.size = *(bp + 1);
+@@ -284,8 +283,8 @@ int get_ap_information(struct ks_wlan_pr
+ }
+ memcpy(ap->rsn_ie.body, bp + 2, ap->rsn_ie.size);
+ break;
+- case 221: /* WPA */
+- if (memcmp(bp + 2, "\x00\x50\xf2\x01", 4) == 0) { /* WPA OUI check */
++ case WLAN_EID_VENDOR_SPECIFIC: /* WPA */
++ if (memcmp(bp + 2, "\x00\x50\xf2\x01", 4) == 0) { /* WPA OUI check */
+ ap->wpa_ie.id = *bp;
+ if (*(bp + 1) <= RSN_IE_BODY_MAX) {
+ ap->wpa_ie.size = *(bp + 1);
+@@ -300,18 +299,18 @@ int get_ap_information(struct ks_wlan_pr
+ }
+ break;
+
+- case 2: /* FH parameter */
+- case 4: /* CF parameter */
+- case 5: /* TIM */
+- case 6: /* IBSS parameter */
+- case 7: /* Country */
+- case 42: /* ERP information */
+- case 47: /* Reserve ID 47 Broadcom AP */
++ case WLAN_EID_FH_PARAMS:
++ case WLAN_EID_CF_PARAMS:
++ case WLAN_EID_TIM:
++ case WLAN_EID_IBSS_PARAMS:
++ case WLAN_EID_COUNTRY:
++ case WLAN_EID_ERP_INFO:
+ break;
+ default:
+ DPRINTK(4, "unknown Element ID=%d\n", *bp);
+ break;
+ }
++
+ offset += 2; /* id & size field */
+ offset += *(bp + 1); /* +size offset */
+ bp += (*(bp + 1) + 2); /* pointer update */
+--- a/drivers/staging/ks7010/ks_hostif.h
++++ b/drivers/staging/ks7010/ks_hostif.h
+@@ -13,6 +13,7 @@
+ #define _KS_HOSTIF_H_
+
+ #include <linux/compiler.h>
++#include <linux/ieee80211.h>
+
+ /*
+ * HOST-MAC I/F events
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 2 Mar 2018 10:31:25 +1100
+Subject: staging: lustre: fix bug in osc_enter_cache_try
+
+From: NeilBrown <neilb@suse.com>
+
+[ Upstream commit 2fab9faf9b27298c4536c1c1b14072ab18b8f80b ]
+
+The lustre-release patch commit bdc5bb52c554 ("LU-4933 osc:
+Automatically increase the max_dirty_mb") changed
+
+- if (cli->cl_dirty + PAGE_CACHE_SIZE <= cli->cl_dirty_max &&
++ if (cli->cl_dirty_pages < cli->cl_dirty_max_pages &&
+
+When this patch landed in Linux a couple of years later, it landed as
+
+- if (cli->cl_dirty + PAGE_SIZE <= cli->cl_dirty_max &&
++ if (cli->cl_dirty_pages <= cli->cl_dirty_max_pages &&
+
+which is clearly different ('<=' vs '<'), and allows cl_dirty_pages to
+increase beyond cl_dirty_max_pages - which causes a latter assertion
+to fails.
+
+Fixes: 3147b268400a ("staging: lustre: osc: Automatically increase the max_dirty_mb")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/include/obd.h | 2 +-
+ drivers/staging/lustre/lustre/osc/osc_cache.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/lustre/lustre/include/obd.h
++++ b/drivers/staging/lustre/lustre/include/obd.h
+@@ -190,7 +190,7 @@ struct client_obd {
+ struct sptlrpc_flavor cl_flvr_mgc; /* fixed flavor of mgc->mgs */
+
+ /* the grant values are protected by loi_list_lock below */
+- unsigned long cl_dirty_pages; /* all _dirty_ in pahges */
++ unsigned long cl_dirty_pages; /* all _dirty_ in pages */
+ unsigned long cl_dirty_max_pages; /* allowed w/o rpc */
+ unsigned long cl_dirty_transit; /* dirty synchronous */
+ unsigned long cl_avail_grant; /* bytes of credit for ost */
+--- a/drivers/staging/lustre/lustre/osc/osc_cache.c
++++ b/drivers/staging/lustre/lustre/osc/osc_cache.c
+@@ -1528,7 +1528,7 @@ static int osc_enter_cache_try(struct cl
+ if (rc < 0)
+ return 0;
+
+- if (cli->cl_dirty_pages <= cli->cl_dirty_max_pages &&
++ if (cli->cl_dirty_pages < cli->cl_dirty_max_pages &&
+ atomic_long_read(&obd_dirty_pages) + 1 <= obd_max_dirty_pages) {
+ osc_consume_write_grant(cli, &oap->oap_brw_page);
+ if (transient) {
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 23 Feb 2018 09:09:33 +1100
+Subject: staging: lustre: lmv: correctly iput lmo_root
+
+From: NeilBrown <neilb@suse.com>
+
+[ Upstream commit 17556cdbe6ed70a6a20e597b228628f7f34387f8 ]
+
+Commit 8f18c8a48b73 ("staging: lustre: lmv: separate master object
+with master stripe") changed how lmo_root inodes were managed,
+particularly when LMV_HASH_FLAG_MIGRATION is not set.
+Previously lsm_md_oinfo[0].lmo_root was always a borrowed
+inode reference and didn't need to by iput().
+Since the change, that special case only applies when
+LMV_HASH_FLAG_MIGRATION is set
+
+In the upstream (lustre-release) version of this patch [Commit
+60e07b972114 ("LU-4690 lod: separate master object with master
+stripe")] the for loop in the lmv_unpack_md() was changed to count
+from 0 and to ignore entry 0 if LMV_HASH_FLAG_MIGRATION is set.
+In the patch that got applied to Linux, that change was missing,
+so lsm_md_oinfo[0].lmo_root is never iput().
+This results in a "VFS: Busy inodes" warning at unmount.
+
+Fixes: 8f18c8a48b73 ("staging: lustre: lmv: separate master object with master stripe")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Reviewed-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/lmv/lmv_obd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c
++++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
+@@ -2694,7 +2694,7 @@ static int lmv_unpackmd(struct obd_expor
+ if (lsm && !lmm) {
+ int i;
+
+- for (i = 1; i < lsm->lsm_md_stripe_count; i++) {
++ for (i = 0; i < lsm->lsm_md_stripe_count; i++) {
+ /*
+ * For migrating inode, the master stripe and master
+ * object will be the same, so do not need iput, see
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 28 Feb 2018 11:28:49 +0000
+Subject: staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e1a7418529e33bc4efc346324557251a16a3e79b ]
+
+Currently the allocation of priv->oldaddr is not null checked which will
+lead to subsequent errors when accessing priv->oldaddr. Fix this with
+a null pointer check and a return of -ENOMEM on allocation failure.
+
+Detected with Coccinelle:
+drivers/staging/rtl8192u/r8192U_core.c:1708:2-15: alloc with no test,
+possible model on line 1723
+
+Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8192u/r8192U_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -1702,6 +1702,8 @@ static short rtl8192_usb_initendpoints(s
+
+ priv->rx_urb[16] = usb_alloc_urb(0, GFP_KERNEL);
+ priv->oldaddr = kmalloc(16, GFP_KERNEL);
++ if (!priv->oldaddr)
++ return -ENOMEM;
+ oldaddr = priv->oldaddr;
+ align = ((long)oldaddr) & 3;
+ if (align) {
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Dominik Bozek <dominikx.bozek@intel.com>
+Date: Thu, 15 Feb 2018 21:27:48 -0800
+Subject: usb: cdc_acm: prevent race at write to acm while system resumes
+
+From: Dominik Bozek <dominikx.bozek@intel.com>
+
+[ Upstream commit b86b8eb6fecb5a4bac1ed0ca925c4082a61ea6e9 ]
+
+ACM driver may accept data to transmit while system is not fully
+resumed. In this case ACM driver buffers data and prepare URBs
+on usb anchor list.
+There is a little chance that two tasks put a char and initiate
+acm_tty_flush_chars(). In such a case, driver will put one URB
+twice on usb anchor list.
+This patch also reset length of data before resue of a buffer.
+This not only prevent sending rubbish, but also lower risc of race.
+
+Without this patch we hit following kernel panic in one of our
+stabilty/stress tests.
+
+[ 46.884442] *list_add double add*: new=ffff9b2ab7289330, prev=ffff9b2ab7289330, next=ffff9b2ab81e28e0.
+[ 46.884476] Modules linked in: hci_uart btbcm bluetooth rfkill_gpio igb_avb(O) cfg80211 snd_soc_sst_bxt_tdf8532 snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_soc_sst_acpi snd_soc_sst_match snd_hda_ext_core snd_hda_core trusty_timer trusty_wall trusty_log trusty_virtio trusty_ipc trusty_mem trusty_irq trusty virtio_ring virtio intel_ipu4_mmu_bxtB0 lib2600_mod_bxtB0 intel_ipu4_isys_mod_bxtB0 lib2600psys_mod_bxtB0 intel_ipu4_psys_mod_bxtB0 intel_ipu4_mod_bxtB0 intel_ipu4_wrapper_bxtB0 intel_ipu4_acpi videobuf2_dma_contig as3638 dw9714 lm3643 crlmodule smiapp smiapp_pll
+[ 46.884480] CPU: 1 PID: 33 Comm: kworker/u8:1 Tainted: G U W O 4.9.56-quilt-2e5dc0ac-g618ed69ced6e-dirty #4
+[ 46.884489] Workqueue: events_unbound flush_to_ldisc
+[ 46.884494] ffffb98ac012bb08 ffffffffad3e82e5 ffffb98ac012bb58 0000000000000000
+[ 46.884497] ffffb98ac012bb48 ffffffffad0a23d1 00000024ad6374dd ffff9b2ab7289330
+[ 46.884500] ffff9b2ab81e28e0 ffff9b2ab7289330 0000000000000002 0000000000000000
+[ 46.884501] Call Trace:
+[ 46.884507] [<ffffffffad3e82e5>] dump_stack+0x67/0x92
+[ 46.884511] [<ffffffffad0a23d1>] __warn+0xd1/0xf0
+[ 46.884513] [<ffffffffad0a244f>] warn_slowpath_fmt+0x5f/0x80
+[ 46.884516] [<ffffffffad407443>] __list_add+0xb3/0xc0
+[ 46.884521] [<ffffffffad71133c>] *usb_anchor_urb*+0x4c/0xa0
+[ 46.884524] [<ffffffffad782c6f>] *acm_tty_flush_chars*+0x8f/0xb0
+[ 46.884527] [<ffffffffad782cd1>] *acm_tty_put_char*+0x41/0x100
+[ 46.884530] [<ffffffffad4ced34>] tty_put_char+0x24/0x40
+[ 46.884533] [<ffffffffad4d3bf5>] do_output_char+0xa5/0x200
+[ 46.884535] [<ffffffffad4d3e98>] __process_echoes+0x148/0x290
+[ 46.884538] [<ffffffffad4d654c>] n_tty_receive_buf_common+0x57c/0xb00
+[ 46.884541] [<ffffffffad4d6ae4>] n_tty_receive_buf2+0x14/0x20
+[ 46.884543] [<ffffffffad4d9662>] tty_ldisc_receive_buf+0x22/0x50
+[ 46.884545] [<ffffffffad4d9c05>] flush_to_ldisc+0xc5/0xe0
+[ 46.884549] [<ffffffffad0bcfe8>] process_one_work+0x148/0x440
+[ 46.884551] [<ffffffffad0bdc19>] worker_thread+0x69/0x4a0
+[ 46.884554] [<ffffffffad0bdbb0>] ? max_active_store+0x80/0x80
+[ 46.884556] [<ffffffffad0c2e10>] kthread+0x110/0x130
+[ 46.884559] [<ffffffffad0c2d00>] ? kthread_park+0x60/0x60
+[ 46.884563] [<ffffffffadad9917>] ret_from_fork+0x27/0x40
+[ 46.884566] ---[ end trace 3bd599058b8a9eb3 ]---
+
+Signed-off-by: Dominik Bozek <dominikx.bozek@intel.com>
+Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -187,6 +187,7 @@ static int acm_wb_alloc(struct acm *acm)
+ wb = &acm->wb[wbn];
+ if (!wb->use) {
+ wb->use = 1;
++ wb->len = 0;
+ return wbn;
+ }
+ wbn = (wbn + 1) % ACM_NW;
+@@ -818,16 +819,18 @@ static int acm_tty_write(struct tty_stru
+ static void acm_tty_flush_chars(struct tty_struct *tty)
+ {
+ struct acm *acm = tty->driver_data;
+- struct acm_wb *cur = acm->putbuffer;
++ struct acm_wb *cur;
+ int err;
+ unsigned long flags;
+
++ spin_lock_irqsave(&acm->write_lock, flags);
++
++ cur = acm->putbuffer;
+ if (!cur) /* nothing to do */
+- return;
++ goto out;
+
+ acm->putbuffer = NULL;
+ err = usb_autopm_get_interface_async(acm->control);
+- spin_lock_irqsave(&acm->write_lock, flags);
+ if (err < 0) {
+ cur->use = 0;
+ acm->putbuffer = cur;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Vardan Mikayelyan <mvardan@synopsys.com>
+Date: Tue, 16 Jan 2018 16:04:24 +0400
+Subject: usb: dwc2: Fix dwc2_hsotg_core_init_disconnected()
+
+From: Vardan Mikayelyan <mvardan@synopsys.com>
+
+[ Upstream commit 755d739534f998d92e348fba8ffb0478416576e7 ]
+
+We should call dwc2_hsotg_enqueue_setup() after properly
+setting lx_state. Because it may cause error-out from
+dwc2_hsotg_enqueue_setup() due to wrong value in lx_state.
+
+Issue can be reproduced by loading driver while connected
+A-Connector (start in A-HOST mode) then disconnect A-Connector
+to switch to B-DEVICE.
+
+Acked-by: John Youn <johnyoun@synopsys.com>
+Signed-off-by: Vardan Mikayelyan <mvardan@synopsys.com>
+Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/gadget.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3414,12 +3414,6 @@ void dwc2_hsotg_core_init_disconnected(s
+ dwc2_writel(dwc2_hsotg_ep0_mps(hsotg->eps_out[0]->ep.maxpacket) |
+ DXEPCTL_USBACTEP, hsotg->regs + DIEPCTL0);
+
+- dwc2_hsotg_enqueue_setup(hsotg);
+-
+- dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
+- dwc2_readl(hsotg->regs + DIEPCTL0),
+- dwc2_readl(hsotg->regs + DOEPCTL0));
+-
+ /* clear global NAKs */
+ val = DCTL_CGOUTNAK | DCTL_CGNPINNAK;
+ if (!is_usb_reset)
+@@ -3430,6 +3424,12 @@ void dwc2_hsotg_core_init_disconnected(s
+ mdelay(3);
+
+ hsotg->lx_state = DWC2_L0;
++
++ dwc2_hsotg_enqueue_setup(hsotg);
++
++ dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
++ dwc2_readl(hsotg->regs + DIEPCTL0),
++ dwc2_readl(hsotg->regs + DOEPCTL0));
+ }
+
+ static void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg)
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Grigor Tovmasyan <Grigor.Tovmasyan@synopsys.com>
+Date: Tue, 6 Feb 2018 19:07:38 +0400
+Subject: usb: dwc2: Fix interval type issue
+
+From: Grigor Tovmasyan <Grigor.Tovmasyan@synopsys.com>
+
+[ Upstream commit 12814a3f8f9b247531d7863170cc82b3fe4218fd ]
+
+The maximum value that unsigned char can hold is 255, meanwhile
+the maximum value of interval is 2^(bIntervalMax-1)=2^15.
+
+Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/core.h
++++ b/drivers/usb/dwc2/core.h
+@@ -216,7 +216,7 @@ struct dwc2_hsotg_ep {
+ unsigned char dir_in;
+ unsigned char index;
+ unsigned char mc;
+- unsigned char interval;
++ u16 interval;
+
+ unsigned int halted:1;
+ unsigned int periodic:1;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Minas Harutyunyan <hminas@synopsys.com>
+Date: Fri, 19 Jan 2018 14:43:53 +0400
+Subject: usb: dwc2: hcd: Fix host channel halt flow
+
+From: Minas Harutyunyan <hminas@synopsys.com>
+
+[ Upstream commit a82c7abdf8fc3b09c4a0ed2eee6d43ecef2ccdb0 ]
+
+According databook in Buffer and External DMA mode
+non-split periodic channels can't be halted.
+
+Acked-by: John Youn <johnyoun@synopsys.com>
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -979,6 +979,24 @@ void dwc2_hc_halt(struct dwc2_hsotg *hso
+
+ if (dbg_hc(chan))
+ dev_vdbg(hsotg->dev, "%s()\n", __func__);
++
++ /*
++ * In buffer DMA or external DMA mode channel can't be halted
++ * for non-split periodic channels. At the end of the next
++ * uframe/frame (in the worst case), the core generates a channel
++ * halted and disables the channel automatically.
++ */
++ if ((hsotg->params.g_dma && !hsotg->params.g_dma_desc) ||
++ hsotg->hw_params.arch == GHWCFG2_EXT_DMA_ARCH) {
++ if (!chan->do_split &&
++ (chan->ep_type == USB_ENDPOINT_XFER_ISOC ||
++ chan->ep_type == USB_ENDPOINT_XFER_INT)) {
++ dev_err(hsotg->dev, "%s() Channel can't be halted\n",
++ __func__);
++ return;
++ }
++ }
++
+ if (halt_status == DWC2_HC_XFER_NO_HALT_STATUS)
+ dev_err(hsotg->dev, "!!! halt_status = %d !!!\n", halt_status);
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Minas Harutyunyan <hminas@synopsys.com>
+Date: Fri, 19 Jan 2018 14:44:20 +0400
+Subject: usb: dwc2: host: Fix transaction errors in host mode
+
+From: Minas Harutyunyan <hminas@synopsys.com>
+
+[ Upstream commit 92a8dd26464e1f21f1d869ec53717bd2c1200d63 ]
+
+Added missing GUSBCFG programming in host mode, which fixes
+transaction errors issue on HiKey and Altera Cyclone V boards.
+
+These field even if was programmed in device mode (in function
+dwc2_hsotg_core_init_disconnected()) will be resetting to POR values
+after core soft reset applied.
+So, each time when switching to host mode required to set this field
+to correct value.
+
+Acked-by: John Youn <johnyoun@synopsys.com>
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -2329,10 +2329,22 @@ static int dwc2_core_init(struct dwc2_hs
+ */
+ static void dwc2_core_host_init(struct dwc2_hsotg *hsotg)
+ {
+- u32 hcfg, hfir, otgctl;
++ u32 hcfg, hfir, otgctl, usbcfg;
+
+ dev_dbg(hsotg->dev, "%s(%p)\n", __func__, hsotg);
+
++ /* Set HS/FS Timeout Calibration to 7 (max available value).
++ * The number of PHY clocks that the application programs in
++ * this field is added to the high/full speed interpacket timeout
++ * duration in the core to account for any additional delays
++ * introduced by the PHY. This can be required, because the delay
++ * introduced by the PHY in generating the linestate condition
++ * can vary from one PHY to another.
++ */
++ usbcfg = dwc2_readl(hsotg->regs + GUSBCFG);
++ usbcfg |= GUSBCFG_TOUTCAL(7);
++ dwc2_writel(usbcfg, hsotg->regs + GUSBCFG);
++
+ /* Restart the Phy Clock */
+ dwc2_writel(0, hsotg->regs + PCGCTL);
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Fri, 16 Mar 2018 15:33:48 -0700
+Subject: usb: dwc3: Add SoftReset PHY synchonization delay
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit fab3833338779e1e668bd58d1f76d601657304b8 ]
+
+>From DWC_usb31 programming guide section 1.3.2, once DWC3_DCTL_CSFTRST
+bit is cleared, we must wait at least 50ms before accessing the PHY
+domain (synchronization delay).
+
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -243,7 +243,7 @@ static int dwc3_core_soft_reset(struct d
+ do {
+ reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ if (!(reg & DWC3_DCTL_CSFTRST))
+- return 0;
++ goto done;
+
+ udelay(1);
+ } while (--retries);
+@@ -252,6 +252,17 @@ static int dwc3_core_soft_reset(struct d
+ phy_exit(dwc->usb2_generic_phy);
+
+ return -ETIMEDOUT;
++
++done:
++ /*
++ * For DWC_usb31 controller, once DWC3_DCTL_CSFTRST bit is cleared,
++ * we must wait at least 50ms before accessing the PHY domain
++ * (synchronization delay). DWC_usb31 programming guide section 1.3.2.
++ */
++ if (dwc3_is_usb31(dwc))
++ msleep(50);
++
++ return 0;
+ }
+
+ /*
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Thu, 22 Mar 2018 10:45:20 +0200
+Subject: usb: dwc3: Makefile: fix link error on randconfig
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+[ Upstream commit de948a74ad6f0eefddf36d765b8f2dd6df82caa0 ]
+
+If building a kernel without FTRACE but with TRACING, dwc3.ko fails to
+link due to missing trace events. Fix this by using the correct
+Kconfig symbol on Makefile.
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/Makefile
++++ b/drivers/usb/dwc3/Makefile
+@@ -6,7 +6,7 @@ obj-$(CONFIG_USB_DWC3) += dwc3.o
+
+ dwc3-y := core.o
+
+-ifneq ($(CONFIG_FTRACE),)
++ifneq ($(CONFIG_TRACING),)
+ dwc3-y += trace.o
+ endif
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Roger Quadros <rogerq@ti.com>
+Date: Mon, 22 Jan 2018 15:01:42 +0200
+Subject: usb: dwc3: omap: don't miss events during suspend/resume
+
+From: Roger Quadros <rogerq@ti.com>
+
+[ Upstream commit c49f63055e252810e5d6c83a4943b18db16b3cd8 ]
+
+The USB cable state can change during suspend/resume
+so be sure to check and update the extcon state.
+
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-omap.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-omap.c
++++ b/drivers/usb/dwc3/dwc3-omap.c
+@@ -590,9 +590,25 @@ static int dwc3_omap_resume(struct devic
+ return 0;
+ }
+
++static void dwc3_omap_complete(struct device *dev)
++{
++ struct dwc3_omap *omap = dev_get_drvdata(dev);
++
++ if (extcon_get_state(omap->edev, EXTCON_USB))
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID);
++ else
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF);
++
++ if (extcon_get_state(omap->edev, EXTCON_USB_HOST))
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND);
++ else
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT);
++}
++
+ static const struct dev_pm_ops dwc3_omap_dev_pm_ops = {
+
+ SET_SYSTEM_SLEEP_PM_OPS(dwc3_omap_suspend, dwc3_omap_resume)
++ .complete = dwc3_omap_complete,
+ };
+
+ #define DEV_PM_OPS (&dwc3_omap_dev_pm_ops)
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Brian Norris <briannorris@chromium.org>
+Date: Wed, 17 Jan 2018 13:22:49 -0800
+Subject: usb: dwc3: Undo PHY init if soft reset fails
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 00b42170c86f90ac9dea83a7dfcd3f0c38098fe2 ]
+
+In this function, we init the USB2 and USB3 PHYs, but if soft reset
+times out, we don't unwind this.
+
+Noticed by inspection.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -248,6 +248,9 @@ static int dwc3_core_soft_reset(struct d
+ udelay(1);
+ } while (--retries);
+
++ phy_exit(dwc->usb3_generic_phy);
++ phy_exit(dwc->usb2_generic_phy);
++
+ return -ETIMEDOUT;
+ }
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Fri, 16 Mar 2018 15:33:54 -0700
+Subject: usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit 0cab8d26d6e5e053b2bed3356992aaa71dc93628 ]
+
+Update two GTXFIFOSIZ bit fields for the DWC_usb31 controller. TXFDEP
+is a 15-bit value instead of 16-bit value, and bit 15 is TXFRAMNUM.
+
+The GTXFIFOSIZ register for DWC_usb31 is as follows:
+ +-------+-----------+----------------------------------+
+ | BITS | Name | Description |
+ +=======+===========+==================================+
+ | 31:16 | TXFSTADDR | Transmit FIFOn RAM Start Address |
+ | 15 | TXFRAMNUM | Asynchronous/Periodic TXFIFO |
+ | 14:0 | TXFDEP | TXFIFO Depth |
+ +-------+-----------+----------------------------------+
+
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -249,6 +249,8 @@
+ #define DWC3_GUSB3PIPECTL_TX_DEEPH(n) ((n) << 1)
+
+ /* Global TX Fifo Size Register */
++#define DWC31_GTXFIFOSIZ_TXFRAMNUM BIT(15) /* DWC_usb31 only */
++#define DWC31_GTXFIFOSIZ_TXFDEF(n) ((n) & 0x7fff) /* DWC_usb31 only */
+ #define DWC3_GTXFIFOSIZ_TXFDEF(n) ((n) & 0xffff)
+ #define DWC3_GTXFIFOSIZ_TXFSTADDR(n) ((n) & 0xffff0000)
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Chris Dickens <christopher.a.dickens@gmail.com>
+Date: Sun, 31 Dec 2017 18:59:42 -0800
+Subject: usb: gadget: composite: fix incorrect handling of OS desc requests
+
+From: Chris Dickens <christopher.a.dickens@gmail.com>
+
+[ Upstream commit 5d6ae4f0da8a64a185074dabb1b2f8c148efa741 ]
+
+When handling an OS descriptor request, one of the first operations is
+to zero out the request buffer using the wLength from the setup packet.
+There is no bounds checking, so a wLength > 4096 would clobber memory
+adjacent to the request buffer. Fix this by taking the min of wLength
+and the request buffer length prior to the memset. While at it, define
+the buffer length in a header file so that magic numbers don't appear
+throughout the code.
+
+When returning data to the host, the data length should be the min of
+the wLength and the valid data we have to return. Currently we are
+returning wLength, thus requests for a wLength greater than the amount
+of data in the OS descriptor buffer would return invalid (albeit zero'd)
+data following the valid descriptor data. Fix this by counting the
+number of bytes when constructing the data and using this when
+determining the length of the request.
+
+Signed-off-by: Chris Dickens <christopher.a.dickens@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/composite.c | 40 +++++++++++++++++++---------------------
+ include/linux/usb/composite.h | 3 +++
+ 2 files changed, 22 insertions(+), 21 deletions(-)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1425,7 +1425,7 @@ static int count_ext_compat(struct usb_c
+ return res;
+ }
+
+-static void fill_ext_compat(struct usb_configuration *c, u8 *buf)
++static int fill_ext_compat(struct usb_configuration *c, u8 *buf)
+ {
+ int i, count;
+
+@@ -1452,10 +1452,12 @@ static void fill_ext_compat(struct usb_c
+ buf += 23;
+ }
+ count += 24;
+- if (count >= 4096)
+- return;
++ if (count + 24 >= USB_COMP_EP0_OS_DESC_BUFSIZ)
++ return count;
+ }
+ }
++
++ return count;
+ }
+
+ static int count_ext_prop(struct usb_configuration *c, int interface)
+@@ -1500,25 +1502,20 @@ static int fill_ext_prop(struct usb_conf
+ struct usb_os_desc *d;
+ struct usb_os_desc_ext_prop *ext_prop;
+ int j, count, n, ret;
+- u8 *start = buf;
+
+ f = c->interface[interface];
++ count = 10; /* header length */
+ for (j = 0; j < f->os_desc_n; ++j) {
+ if (interface != f->os_desc_table[j].if_id)
+ continue;
+ d = f->os_desc_table[j].os_desc;
+ if (d)
+ list_for_each_entry(ext_prop, &d->ext_prop, entry) {
+- /* 4kB minus header length */
+- n = buf - start;
+- if (n >= 4086)
+- return 0;
+-
+- count = ext_prop->data_len +
++ n = ext_prop->data_len +
+ ext_prop->name_len + 14;
+- if (count > 4086 - n)
+- return -EINVAL;
+- usb_ext_prop_put_size(buf, count);
++ if (count + n >= USB_COMP_EP0_OS_DESC_BUFSIZ)
++ return count;
++ usb_ext_prop_put_size(buf, n);
+ usb_ext_prop_put_type(buf, ext_prop->type);
+ ret = usb_ext_prop_put_name(buf, ext_prop->name,
+ ext_prop->name_len);
+@@ -1544,11 +1541,12 @@ static int fill_ext_prop(struct usb_conf
+ default:
+ return -EINVAL;
+ }
+- buf += count;
++ buf += n;
++ count += n;
+ }
+ }
+
+- return 0;
++ return count;
+ }
+
+ /*
+@@ -1830,6 +1828,7 @@ unknown:
+ req->complete = composite_setup_complete;
+ buf = req->buf;
+ os_desc_cfg = cdev->os_desc_config;
++ w_length = min_t(u16, w_length, USB_COMP_EP0_OS_DESC_BUFSIZ);
+ memset(buf, 0, w_length);
+ buf[5] = 0x01;
+ switch (ctrl->bRequestType & USB_RECIP_MASK) {
+@@ -1853,8 +1852,8 @@ unknown:
+ count += 16; /* header */
+ put_unaligned_le32(count, buf);
+ buf += 16;
+- fill_ext_compat(os_desc_cfg, buf);
+- value = w_length;
++ value = fill_ext_compat(os_desc_cfg, buf);
++ value = min_t(u16, w_length, value);
+ }
+ break;
+ case USB_RECIP_INTERFACE:
+@@ -1883,8 +1882,7 @@ unknown:
+ interface, buf);
+ if (value < 0)
+ return value;
+-
+- value = w_length;
++ value = min_t(u16, w_length, value);
+ }
+ break;
+ }
+@@ -2159,8 +2157,8 @@ int composite_os_desc_req_prepare(struct
+ goto end;
+ }
+
+- /* OS feature descriptor length <= 4kB */
+- cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL);
++ cdev->os_desc_req->buf = kmalloc(USB_COMP_EP0_OS_DESC_BUFSIZ,
++ GFP_KERNEL);
+ if (!cdev->os_desc_req->buf) {
+ ret = -ENOMEM;
+ usb_ep_free_request(ep0, cdev->os_desc_req);
+--- a/include/linux/usb/composite.h
++++ b/include/linux/usb/composite.h
+@@ -53,6 +53,9 @@
+ /* big enough to hold our biggest descriptor */
+ #define USB_COMP_EP0_BUFSIZ 1024
+
++/* OS feature descriptor length <= 4kB */
++#define USB_COMP_EP0_OS_DESC_BUFSIZ 4096
++
+ #define USB_MS_TO_HS_INTERVAL(x) (ilog2((x * 1000 / 125)) + 1)
+ struct usb_configuration;
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Manu Gautam <mgautam@codeaurora.org>
+Date: Thu, 21 Dec 2017 09:54:25 +0530
+Subject: usb: gadget: core: Fix use-after-free of usb_request
+
+From: Manu Gautam <mgautam@codeaurora.org>
+
+[ Upstream commit e74bd4d358e5455233f1dcc3975425905b270b91 ]
+
+Driver is tracing usb_request after freeing it.
+Fix it by changing the order.
+
+Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -191,8 +191,8 @@ EXPORT_SYMBOL_GPL(usb_ep_alloc_request);
+ void usb_ep_free_request(struct usb_ep *ep,
+ struct usb_request *req)
+ {
+- ep->ops->free_request(ep, req);
+ trace_usb_ep_free_request(ep, req, 0);
++ ep->ops->free_request(ep, req);
+ }
+ EXPORT_SYMBOL_GPL(usb_ep_free_request);
+
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: John Keeping <john@metanate.com>
+Date: Fri, 12 Jan 2018 18:43:32 +0000
+Subject: usb: gadget: f_uac2: fix bFirstInterface in composite gadget
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit 8813a59ed892305b5ac1b5b901740b1ad4b5fefa ]
+
+If there are multiple functions associated with a configuration, then
+the UAC2 interfaces may not start at zero. Set the correct first
+interface number in the association descriptor so that the audio
+interfaces are enumerated correctly in this case.
+
+Reviewed-by: Krzysztof Opasiak <k.opasiak@samsung.com>
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_uac2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_uac2.c
++++ b/drivers/usb/gadget/function/f_uac2.c
+@@ -528,6 +528,8 @@ afunc_bind(struct usb_configuration *cfg
+ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
+ return ret;
+ }
++ iad_desc.bFirstInterface = ret;
++
+ std_ac_if_desc.bInterfaceNumber = ret;
+ uac2->ac_intf = ret;
+ uac2->ac_alt = 0;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Fri, 12 Jan 2018 11:05:02 +0100
+Subject: usb: gadget: ffs: Execute copy_to_user() with USER_DS set
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit 4058ebf33cb0be88ca516f968eda24ab7b6b93e4 ]
+
+When using a AIO read() operation on the function FS gadget driver a URB is
+submitted asynchronously and on URB completion the received data is copied
+to the userspace buffer associated with the read operation.
+
+This is done from a kernel worker thread invoking copy_to_user() (through
+copy_to_iter()). And while the user space process memory is made available
+to the kernel thread using use_mm(), some architecture require in addition
+to this that the operation runs with USER_DS set. Otherwise the userspace
+memory access will fail.
+
+For example on ARM64 with Privileged Access Never (PAN) and User Access
+Override (UAO) enabled the following crash occurs.
+
+ Internal error: Accessing user space memory with fs=KERNEL_DS: 9600004f [#1] SMP
+ Modules linked in:
+ CPU: 2 PID: 1636 Comm: kworker/2:1 Not tainted 4.9.0-04081-g8ab2dfb-dirty #487
+ Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
+ Workqueue: events ffs_user_copy_worker
+ task: ffffffc87afc8080 task.stack: ffffffc87a00c000
+ PC is at __arch_copy_to_user+0x190/0x220
+ LR is at copy_to_iter+0x78/0x3c8
+ [...]
+ [<ffffff800847b790>] __arch_copy_to_user+0x190/0x220
+ [<ffffff80086f25d8>] ffs_user_copy_worker+0x70/0x130
+ [<ffffff80080b8c64>] process_one_work+0x1dc/0x460
+ [<ffffff80080b8f38>] worker_thread+0x50/0x4b0
+ [<ffffff80080bf5a0>] kthread+0xd8/0xf0
+ [<ffffff8008083680>] ret_from_fork+0x10/0x50
+
+Address this by placing a set_fs(USER_DS) before of the copy operation
+and revert it again once the copy operation has finished.
+
+This patch is analogous to commit d7ffde35e31a ("vhost: use USER_DS in
+vhost_worker thread") which addresses the same underlying issue.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -759,9 +759,13 @@ static void ffs_user_copy_worker(struct
+ bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
+
+ if (io_data->read && ret > 0) {
++ mm_segment_t oldfs = get_fs();
++
++ set_fs(USER_DS);
+ use_mm(io_data->mm);
+ ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data);
+ unuse_mm(io_data->mm);
++ set_fs(oldfs);
+ }
+
+ io_data->kiocb->ki_complete(io_data->kiocb, ret, ret);
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Fri, 12 Jan 2018 11:26:16 +0100
+Subject: usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit 946ef68ad4e45aa048a5fb41ce8823ed29da866a ]
+
+Some UDC drivers (like the DWC3) expect that the response to a setup()
+request is queued from within the setup function itself so that it is
+available as soon as setup() has completed.
+
+Upon receiving a setup request the function fs driver creates an event that
+is made available to userspace. And only once userspace has acknowledged
+that event the response to the setup request is queued.
+
+So it violates the requirement of those UDC drivers and random failures can
+be observed. This is basically a race condition and if userspace is able to
+read the event and queue the response fast enough all is good. But if it is
+not, for example because other processes are currently scheduled to run,
+the USB host that sent the setup request will observe an error.
+
+To avoid this the gadget framework provides the USB_GADGET_DELAYED_STATUS
+return code. If a setup() callback returns this value the UDC driver is
+aware that response is not yet available and can uses the appropriate
+methods to handle this case.
+
+Since in the case of function fs the response will never be available when
+the setup() function returns make sure that this status code is used.
+
+This fixed random occasional failures that were previously observed on a
+DWC3 based system under high system load.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -3239,7 +3239,7 @@ static int ffs_func_setup(struct usb_fun
+ __ffs_event_add(ffs, FUNCTIONFS_SETUP);
+ spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
+
+- return 0;
++ return USB_GADGET_DELAYED_STATUS;
+ }
+
+ static bool ffs_func_req_match(struct usb_function *f,
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Stefan Agner <stefan@agner.ch>
+Date: Mon, 12 Feb 2018 00:14:42 +0100
+Subject: usb: gadget: fsl_udc_core: fix ep valid checks
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 20c63f4089cceab803438c383631963e34c4d8e5 ]
+
+Clang reports the following warning:
+ drivers/usb/gadget/udc/fsl_udc_core.c:1312:10: warning: address of array
+ 'ep->name' will always evaluate to 'true' [-Wpointer-bool-conversion]
+ if (ep->name)
+ ~~ ~~~~^~~~
+
+It seems that the authors intention was to check if the ep has been
+configured through struct_ep_setup. Check whether struct usb_ep name
+pointer has been set instead.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/fsl_udc_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -1309,7 +1309,7 @@ static void udc_reset_ep_queue(struct fs
+ {
+ struct fsl_ep *ep = get_ep_by_pipe(udc, pipe);
+
+- if (ep->name)
++ if (ep->ep.name)
+ nuke(ep, -ESHUTDOWN);
+ }
+
+@@ -1697,7 +1697,7 @@ static void dtd_complete_irq(struct fsl_
+ curr_ep = get_ep_by_pipe(udc, i);
+
+ /* If the ep is configured */
+- if (curr_ep->name == NULL) {
++ if (!curr_ep->ep.name) {
+ WARNING("Invalid EP?");
+ continue;
+ }
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Tue, 6 Feb 2018 09:50:40 +0100
+Subject: usb: gadget: udc: change comparison to bitshift when dealing with a mask
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit ac87e560f7c0f91b62012e9a159c0681a373b922 ]
+
+Due to a typo, the mask was destroyed by a comparison instead of a bit
+shift.
+
+Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/goku_udc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/goku_udc.h
++++ b/drivers/usb/gadget/udc/goku_udc.h
+@@ -28,7 +28,7 @@ struct goku_udc_regs {
+ # define INT_EP1DATASET 0x00040
+ # define INT_EP2DATASET 0x00080
+ # define INT_EP3DATASET 0x00100
+-#define INT_EPnNAK(n) (0x00100 < (n)) /* 0 < n < 4 */
++#define INT_EPnNAK(n) (0x00100 << (n)) /* 0 < n < 4 */
+ # define INT_EP1NAK 0x00200
+ # define INT_EP2NAK 0x00400
+ # define INT_EP3NAK 0x00800
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Thu, 8 Mar 2018 17:17:16 +0200
+Subject: usb: host: xhci-plat: revert "usb: host: xhci-plat: enable clk in resume timing"
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit d56e57ca030c8b4296944a2ae61ac167bf979c07 ]
+
+This patch reverts the commit 835e4241e714 ("usb: host: xhci-plat:
+enable clk in resume timing") because this driver also has runtime PM
+and the commit 560869100b99 ("clk: renesas: cpg-mssr: Restore module
+clocks during resume") will restore the clock on R-Car H3 environment.
+
+If the xhci_plat_suspend() disables the clk, the system cannot enable
+the clk in resume like the following behavior:
+
+< In resume >
+ - genpd_resume_noirq() runs and enable the clk (enable_count = 1)
+ - cpg_mssr_resume_noirq() restores the clk register.
+ -- Since the clk was disabled in suspend, cpg_mssr_resume_noirq()
+ will disable the clk and keep the enable_count.
+ - Even if xhci_plat_resume() calls clk_prepare_enable(), since
+ the enable_count is 1, the clk will be not enabled.
+
+After this patch is applied, the cpg-mssr driver will save the clk
+as enable, so the clk will be enabled in resume.
+
+Fixes: 835e4241e714 ("usb: host: xhci-plat: enable clk in resume timing")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-plat.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -355,7 +355,6 @@ static int __maybe_unused xhci_plat_susp
+ {
+ struct usb_hcd *hcd = dev_get_drvdata(dev);
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- int ret;
+
+ /*
+ * xhci_suspend() needs `do_wakeup` to know whether host is allowed
+@@ -365,12 +364,7 @@ static int __maybe_unused xhci_plat_susp
+ * reconsider this when xhci_plat_suspend enlarges its scope, e.g.,
+ * also applies to runtime suspend.
+ */
+- ret = xhci_suspend(xhci, device_may_wakeup(dev));
+-
+- if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
+- clk_disable_unprepare(xhci->clk);
+-
+- return ret;
++ return xhci_suspend(xhci, device_may_wakeup(dev));
+ }
+
+ static int __maybe_unused xhci_plat_resume(struct device *dev)
+@@ -379,9 +373,6 @@ static int __maybe_unused xhci_plat_resu
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ int ret;
+
+- if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
+- clk_prepare_enable(xhci->clk);
+-
+ ret = xhci_priv_resume_quirk(hcd);
+ if (ret)
+ return ret;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Fredrik Noring <noring@nocrew.org>
+Date: Fri, 9 Mar 2018 18:34:34 +0100
+Subject: USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM
+
+From: Fredrik Noring <noring@nocrew.org>
+
+[ Upstream commit d6c931ea32dc08ac2665bb5f009f9c40ad1bbdb3 ]
+
+Scatter-gather needs to be disabled when using dma_declare_coherent_memory
+and HCD_LOCAL_MEM. Andrea Righi made the equivalent fix for EHCI drivers
+in commit 4307a28eb01284 "USB: EHCI: fix NULL pointer dererence in HCDs
+that use HCD_LOCAL_MEM".
+
+The following NULL pointer WARN_ON_ONCE triggered with OHCI drivers:
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 49 at drivers/usb/core/hcd.c:1379 hcd_alloc_coherent+0x4c/0xc8
+Modules linked in:
+CPU: 0 PID: 49 Comm: usb-storage Not tainted 4.15.0+ #1014
+Stack : 00000000 00000000 805a78d2 0000003a 81f5c2cc 8053d367 804d77fc 00000031
+ 805a3a08 00000563 81ee9400 805a0000 00000000 10058c00 81f61b10 805c0000
+ 00000000 00000000 805a0000 00d9038e 00000004 803ee818 00000006 312e3420
+ 805c0000 00000000 00000073 81f61958 00000000 00000000 802eb380 804fd538
+ 00000009 00000563 81ee9400 805a0000 00000002 80056148 00000000 805a0000
+ ...
+Call Trace:
+[<578af360>] show_stack+0x74/0x104
+[<2f3702c6>] __warn+0x118/0x120
+[<ae93fc9e>] warn_slowpath_null+0x44/0x58
+[<a891a517>] hcd_alloc_coherent+0x4c/0xc8
+[<3578fa36>] usb_hcd_map_urb_for_dma+0x4d8/0x534
+[<110bc94c>] usb_hcd_submit_urb+0x82c/0x834
+[<02eb5baf>] usb_sg_wait+0x14c/0x1a0
+[<ccd09e85>] usb_stor_bulk_transfer_sglist.part.1+0xac/0x124
+[<87a5c34c>] usb_stor_bulk_srb+0x40/0x60
+[<ff1792ac>] usb_stor_Bulk_transport+0x160/0x37c
+[<b9e2709c>] usb_stor_invoke_transport+0x3c/0x500
+[<004754f4>] usb_stor_control_thread+0x258/0x28c
+[<22edf42e>] kthread+0x134/0x13c
+[<a419ffd0>] ret_from_kernel_thread+0x14/0x1c
+---[ end trace bcdb825805eefdcc ]---
+
+Signed-off-by: Fredrik Noring <noring@nocrew.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ohci-hcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -446,7 +446,8 @@ static int ohci_init (struct ohci_hcd *o
+ struct usb_hcd *hcd = ohci_to_hcd(ohci);
+
+ /* Accept arbitrarily long scatter-gather lists */
+- hcd->self.sg_tablesize = ~0;
++ if (!(hcd->driver->flags & HCD_LOCAL_MEM))
++ hcd->self.sg_tablesize = ~0;
+
+ if (distrust_firmware)
+ ohci->flags |= OHCI_QUIRK_HUB_POWER;
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 29 Jan 2018 00:04:18 +0000
+Subject: usbip: Correct maximum value of CONFIG_USBIP_VHCI_HC_PORTS
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 351a8d4837ae0d61744e64262c3a80ab92ff3e42 ]
+
+Now that usbip supports USB3, the maximum number of ports allowed
+on a hub is 15 (USB_SS_MAXPORTS), not 31 (USB_MAXCHILDREN).
+
+Reported-by: Gianluigi Tiesi <sherpya@netfarm.it>
+Reported-by: Borissh1983 <borissh1983@gmail.com>
+References: https://bugs.debian.org/878866
+Fixes: 1c9de5bf4286 ("usbip: vhci-hcd: Add USB3 SuperSpeed support")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/usbip/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/usbip/Kconfig
++++ b/drivers/usb/usbip/Kconfig
+@@ -27,7 +27,7 @@ config USBIP_VHCI_HCD
+
+ config USBIP_VHCI_HC_PORTS
+ int "Number of ports per USB/IP virtual host controller"
+- range 1 31
++ range 1 15
+ default 8
+ depends on USBIP_VHCI_HCD
+ ---help---
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 16 Mar 2018 16:33:06 +0200
+Subject: xhci: Show what USB release number the xHC supports from protocol capablity
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 0ee78c101425aae681c631ba59c6ac7f44b1d83a ]
+
+xhci driver displays the supported xHC USB revision in a message during
+driver load:
+
+"Host supports USB 3.1 Enhanced SuperSpeed"
+
+Get the USB minor revision number from the xhci protocol capability.
+This will show the correct supported revisions for new USB 3.2 and later
+hosts
+
+Don't rely on the SBRN (serial bus revision number) register, it's often
+showing 0x30 (USB3.0) for hosts that support USB 3.1
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4764,6 +4764,7 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ * quirks
+ */
+ struct device *dev = hcd->self.sysdev;
++ unsigned int minor_rev;
+ int retval;
+
+ /* Accept arbitrarily long scatter-gather lists */
+@@ -4791,12 +4792,19 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ */
+ hcd->has_tt = 1;
+ } else {
+- /* Some 3.1 hosts return sbrn 0x30, can't rely on sbrn alone */
+- if (xhci->sbrn == 0x31 || xhci->usb3_rhub.min_rev >= 1) {
+- xhci_info(xhci, "Host supports USB 3.1 Enhanced SuperSpeed\n");
++ /*
++ * Some 3.1 hosts return sbrn 0x30, use xhci supported protocol
++ * minor revision instead of sbrn
++ */
++ minor_rev = xhci->usb3_rhub.min_rev;
++ if (minor_rev) {
+ hcd->speed = HCD_USB31;
+ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
+ }
++ xhci_info(xhci, "Host supports USB 3.%x %s SuperSpeed\n",
++ minor_rev,
++ minor_rev ? "Enhanced" : "");
++
+ /* xHCI private pointer was set in xhci_pci_probe for the second
+ * registered roothub.
+ */
--- /dev/null
+From foo@baz Thu May 24 11:09:34 CEST 2018
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 16 Mar 2018 16:33:01 +0200
+Subject: xhci: zero usb device slot_id member when disabling and freeing a xhci slot
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit a400efe455f7b61ac9a801ac8d0d01f8c8d82dd5 ]
+
+set udev->slot_id to zero when disabling and freeing the xhci slot.
+Prevents usb core from calling xhci with a stale slot id.
+
+xHC controller may be reset during resume to recover from some error.
+All slots are unusable as they are disabled and freed.
+xhci driver starts slot enumeration again from 1 in the order they are
+enabled. In the worst case a stale udev->slot_id for one device matches
+a newly enabled slot_id for a different device, causing us to
+perform a action on the wrong device.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-mem.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -926,6 +926,8 @@ void xhci_free_virt_device(struct xhci_h
+ if (dev->out_ctx)
+ xhci_free_container_ctx(xhci, dev->out_ctx);
+
++ if (dev->udev && dev->udev->slot_id)
++ dev->udev->slot_id = 0;
+ kfree(xhci->devs[slot_id]);
+ xhci->devs[slot_id] = NULL;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
