--- /dev/null
+From d6f756e09f01ea7a0efbbcef269a1e384a35d824 Mon Sep 17 00:00:00 2001
+From: "Wladimir J. van der Laan" <laanwj@gmail.com>
+Date: Tue, 25 Jul 2017 14:33:36 +0200
+Subject: drm/etnaviv: Fix off-by-one error in reloc checking
+
+From: Wladimir J. van der Laan <laanwj@gmail.com>
+
+commit d6f756e09f01ea7a0efbbcef269a1e384a35d824 upstream.
+
+A relocation pointing to the last four bytes of a buffer can
+legitimately happen in the case of small vertex buffers.
+
+Signed-off-by: Wladimir J. van der Laan <laanwj@gmail.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+@@ -264,8 +264,8 @@ static int submit_reloc(struct etnaviv_g
+ if (ret)
+ return ret;
+
+- if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) {
+- DRM_ERROR("relocation %u outside object", i);
++ if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) {
++ DRM_ERROR("relocation %u outside object\n", i);
+ return -EINVAL;
+ }
+
--- /dev/null
+From 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Date: Mon, 24 Jul 2017 11:14:31 +0200
+Subject: drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut
+
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+
+commit 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 upstream.
+
+bdw_load_gamma_lut is writing beyond the array to the maximum value.
+The intend of the function is to clamp values > 1 to 1, so write
+the intended color to the max register.
+
+This fixes the following KASAN warning:
+
+[ 197.020857] [IGT] kms_pipe_color: executing
+[ 197.063434] [IGT] kms_pipe_color: starting subtest ctm-0-25-pipe0
+[ 197.078989] ==================================================================
+[ 197.079127] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
+[ 197.079188] Read of size 2 at addr ffff8800d38db150 by task kms_pipe_color/1839
+[ 197.079208] CPU: 2 PID: 1839 Comm: kms_pipe_color Tainted: G U 4.13.0-rc1-patser+ #5211
+[ 197.079215] Hardware name: NUC5i7RYB, BIOS RYBDWi35.86A.0246.2015.0309.1355 03/09/2015
+[ 197.079220] Call Trace:
+[ 197.079230] dump_stack+0x68/0x9e
+[ 197.079239] print_address_description+0x6f/0x250
+[ 197.079251] kasan_report+0x216/0x370
+[ 197.079374] ? bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
+[ 197.079451] ? gen8_write16+0x4e0/0x4e0 [i915]
+[ 197.079460] __asan_report_load2_noabort+0x14/0x20
+[ 197.079535] bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
+[ 197.079612] broadwell_load_luts+0x1df/0x550 [i915]
+[ 197.079690] intel_color_load_luts+0x7b/0x80 [i915]
+[ 197.079764] intel_begin_crtc_commit+0x138/0x760 [i915]
+[ 197.079783] drm_atomic_helper_commit_planes_on_crtc+0x1a3/0x820 [drm_kms_helper]
+[ 197.079859] ? intel_pre_plane_update+0x571/0x580 [i915]
+[ 197.079937] intel_update_crtc+0x238/0x330 [i915]
+[ 197.080016] intel_update_crtcs+0x10f/0x210 [i915]
+[ 197.080092] intel_atomic_commit_tail+0x1552/0x3340 [i915]
+[ 197.080101] ? _raw_spin_unlock+0x3c/0x40
+[ 197.080110] ? __queue_work+0xb40/0xbf0
+[ 197.080188] ? skl_update_crtcs+0xc00/0xc00 [i915]
+[ 197.080195] ? trace_hardirqs_on+0xd/0x10
+[ 197.080269] ? intel_atomic_commit_ready+0x128/0x13c [i915]
+[ 197.080329] ? __i915_sw_fence_complete+0x5b8/0x6d0 [i915]
+[ 197.080336] ? debug_object_activate+0x39e/0x580
+[ 197.080397] ? i915_sw_fence_await+0x30/0x30 [i915]
+[ 197.080409] ? __might_sleep+0x15b/0x180
+[ 197.080483] intel_atomic_commit+0x944/0xa70 [i915]
+[ 197.080490] ? refcount_dec_and_test+0x11/0x20
+[ 197.080567] ? intel_atomic_commit_tail+0x3340/0x3340 [i915]
+[ 197.080597] ? drm_atomic_crtc_set_property+0x303/0x580 [drm]
+[ 197.080674] ? intel_atomic_commit_tail+0x3340/0x3340 [i915]
+[ 197.080704] drm_atomic_commit+0xd7/0xe0 [drm]
+[ 197.080722] drm_atomic_helper_crtc_set_property+0xec/0x130 [drm_kms_helper]
+[ 197.080749] drm_mode_crtc_set_obj_prop+0x7d/0xb0 [drm]
+[ 197.080775] drm_mode_obj_set_property_ioctl+0x50b/0x5d0 [drm]
+[ 197.080783] ? __might_fault+0x104/0x180
+[ 197.080809] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
+[ 197.080838] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
+[ 197.080861] drm_ioctl_kernel+0x154/0x1a0 [drm]
+[ 197.080885] drm_ioctl+0x624/0x8f0 [drm]
+[ 197.080910] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
+[ 197.080934] ? drm_getunique+0x210/0x210 [drm]
+[ 197.080943] ? __handle_mm_fault+0x1bd0/0x1ce0
+[ 197.080949] ? lock_downgrade+0x610/0x610
+[ 197.080957] ? __lru_cache_add+0x15a/0x180
+[ 197.080967] do_vfs_ioctl+0xd92/0xe40
+[ 197.080975] ? ioctl_preallocate+0x1b0/0x1b0
+[ 197.080982] ? selinux_capable+0x20/0x20
+[ 197.080991] ? __do_page_fault+0x7b7/0x9a0
+[ 197.080997] ? lock_downgrade+0x5bb/0x610
+[ 197.081007] ? security_file_ioctl+0x57/0x90
+[ 197.081016] SyS_ioctl+0x4e/0x80
+[ 197.081024] entry_SYSCALL_64_fastpath+0x18/0xad
+[ 197.081030] RIP: 0033:0x7f61f287a987
+[ 197.081035] RSP: 002b:00007fff7d44d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+[ 197.081043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61f287a987
+[ 197.081048] RDX: 00007fff7d44d1c0 RSI: 00000000c01864ba RDI: 0000000000000003
+[ 197.081053] RBP: 00007f61f2b3eb00 R08: 0000000000000059 R09: 0000000000000000
+[ 197.081058] R10: 0000002ea5c4a290 R11: 0000000000000246 R12: 00007f61f2b3eb58
+[ 197.081063] R13: 0000000000001010 R14: 00007f61f2b3eb58 R15: 0000000000002702
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101659
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reported-by: Martin Peres <martin.peres@linux.intel.com>
+Cc: Martin Peres <martin.peres@linux.intel.com>
+Fixes: 82cf435b3134 ("drm/i915: Implement color management on bdw/skl/bxt/kbl")
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Kiran S Kumar <kiran.s.kumar@intel.com>
+Cc: Kausal Malladi <kausalmalladi@gmail.com>
+Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Daniel Vetter <daniel.vetter@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20170724091431.24251-1-maarten.lankhorst@linux.intel.com
+Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+(cherry picked from commit 09a92bc8773b4314e02b478e003fe5936ce85adb)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_color.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/intel_color.c
++++ b/drivers/gpu/drm/i915/intel_color.c
+@@ -394,6 +394,7 @@ static void broadwell_load_luts(struct d
+ }
+
+ /* Program the max register to clamp values > 1.0. */
++ i = lut_size - 1;
+ I915_WRITE(PREC_PAL_GC_MAX(pipe, 0),
+ drm_color_lut_extract(lut[i].red, 16));
+ I915_WRITE(PREC_PAL_GC_MAX(pipe, 1),
--- /dev/null
+From 68227c03cba84a24faf8a7277d2b1a03c8959c2c Mon Sep 17 00:00:00 2001
+From: Mateusz Jurczyk <mjurczyk@google.com>
+Date: Wed, 7 Jun 2017 12:26:49 +0200
+Subject: fuse: initialize the flock flag in fuse_file on allocation
+
+From: Mateusz Jurczyk <mjurczyk@google.com>
+
+commit 68227c03cba84a24faf8a7277d2b1a03c8959c2c upstream.
+
+Before the patch, the flock flag could remain uninitialized for the
+lifespan of the fuse_file allocation. Unless set to true in
+fuse_file_flock(), it would remain in an indeterminate state until read in
+an if statement in fuse_release_common(). This could consequently lead to
+taking an unexpected branch in the code.
+
+The bug was discovered by a runtime instrumentation designed to detect use
+of uninitialized memory in the kernel.
+
+Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
+Fixes: 37fb3a30b462 ("fuse: fix flock")
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct
+ {
+ struct fuse_file *ff;
+
+- ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
++ ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL);
+ if (unlikely(!ff))
+ return NULL;
+
--- /dev/null
+From e59e18989c68a8d7941005f81ad6abc4ca682de0 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 13 Jul 2017 15:13:41 +0200
+Subject: iio: accel: bmc150: Always restore device to normal mode after suspend-resume
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e59e18989c68a8d7941005f81ad6abc4ca682de0 upstream.
+
+After probe we would put the device in normal mode, after a runtime
+suspend-resume we would put it back in normal mode. But for a regular
+suspend-resume we would only put it back in normal mode if triggers
+or events have been requested. This is not consistent and breaks
+reading raw values after a suspend-resume.
+
+This commit changes the regular resume path to also unconditionally put
+the device back in normal mode, fixing reading of raw values not working
+after a regular suspend-resume cycle.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/bmc150-accel-core.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -193,7 +193,6 @@ struct bmc150_accel_data {
+ struct regmap *regmap;
+ int irq;
+ struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
+- atomic_t active_intr;
+ struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
+ struct mutex mutex;
+ u8 fifo_mode, watermark;
+@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(st
+ goto out_fix_power_state;
+ }
+
+- if (state)
+- atomic_inc(&data->active_intr);
+- else
+- atomic_dec(&data->active_intr);
+-
+ return 0;
+
+ out_fix_power_state:
+@@ -1709,8 +1703,7 @@ static int bmc150_accel_resume(struct de
+ struct bmc150_accel_data *data = iio_priv(indio_dev);
+
+ mutex_lock(&data->mutex);
+- if (atomic_read(&data->active_intr))
+- bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
++ bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
+ bmc150_accel_fifo_set_mode(data);
+ mutex_unlock(&data->mutex);
+
--- /dev/null
+From a3507e48d3f99a93a3056a34a5365f310434570f Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Wed, 21 Jun 2017 01:46:37 +0900
+Subject: iio: light: tsl2563: use correct event code
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+commit a3507e48d3f99a93a3056a34a5365f310434570f upstream.
+
+The TSL2563 driver provides three iio channels, two of which are raw ADC
+channels (channel 0 and channel 1) in the device and the remaining one
+is calculated by the two. The ADC channel 0 only supports programmable
+interrupt with threshold settings and this driver supports the event but
+the generated event code does not contain the corresponding iio channel
+type.
+
+This is going to change userspace ABI. Hopefully fixing this to be
+what it should always have been won't break any userspace code.
+
+Cc: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/light/tsl2563.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/tsl2563.c
++++ b/drivers/iio/light/tsl2563.c
+@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler
+ struct tsl2563_chip *chip = iio_priv(dev_info);
+
+ iio_push_event(dev_info,
+- IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
++ IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
+ 0,
+ IIO_EV_TYPE_THRESH,
+ IIO_EV_DIR_EITHER),
--- /dev/null
+From 978d13d60c34818a41fc35962602bdfa5c03f214 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Fri, 4 Aug 2017 23:59:31 -0700
+Subject: iscsi-target: Fix iscsi_np reset hung task during parallel delete
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 978d13d60c34818a41fc35962602bdfa5c03f214 upstream.
+
+This patch fixes a bug associated with iscsit_reset_np_thread()
+that can occur during parallel configfs rmdir of a single iscsi_np
+used across multiple iscsi-target instances, that would result in
+hung task(s) similar to below where configfs rmdir process context
+was blocked indefinately waiting for iscsi_np->np_restart_comp
+to finish:
+
+[ 6726.112076] INFO: task dcp_proxy_node_:15550 blocked for more than 120 seconds.
+[ 6726.119440] Tainted: G W O 4.1.26-3321 #2
+[ 6726.125045] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 6726.132927] dcp_proxy_node_ D ffff8803f202bc88 0 15550 1 0x00000000
+[ 6726.140058] ffff8803f202bc88 ffff88085c64d960 ffff88083b3b1ad0 ffff88087fffeb08
+[ 6726.147593] ffff8803f202c000 7fffffffffffffff ffff88083f459c28 ffff88083b3b1ad0
+[ 6726.155132] ffff88035373c100 ffff8803f202bca8 ffffffff8168ced2 ffff8803f202bcb8
+[ 6726.162667] Call Trace:
+[ 6726.165150] [<ffffffff8168ced2>] schedule+0x32/0x80
+[ 6726.170156] [<ffffffff8168f5b4>] schedule_timeout+0x214/0x290
+[ 6726.176030] [<ffffffff810caef2>] ? __send_signal+0x52/0x4a0
+[ 6726.181728] [<ffffffff8168d7d6>] wait_for_completion+0x96/0x100
+[ 6726.187774] [<ffffffff810e7c80>] ? wake_up_state+0x10/0x10
+[ 6726.193395] [<ffffffffa035d6e2>] iscsit_reset_np_thread+0x62/0xe0 [iscsi_target_mod]
+[ 6726.201278] [<ffffffffa0355d86>] iscsit_tpg_disable_portal_group+0x96/0x190 [iscsi_target_mod]
+[ 6726.210033] [<ffffffffa0363f7f>] lio_target_tpg_store_enable+0x4f/0xc0 [iscsi_target_mod]
+[ 6726.218351] [<ffffffff81260c5a>] configfs_write_file+0xaa/0x110
+[ 6726.224392] [<ffffffff811ea364>] vfs_write+0xa4/0x1b0
+[ 6726.229576] [<ffffffff811eb111>] SyS_write+0x41/0xb0
+[ 6726.234659] [<ffffffff8169042e>] system_call_fastpath+0x12/0x71
+
+It would happen because each iscsit_reset_np_thread() sets state
+to ISCSI_NP_THREAD_RESET, sends SIGINT, and then blocks waiting
+for completion on iscsi_np->np_restart_comp.
+
+However, if iscsi_np was active processing a login request and
+more than a single iscsit_reset_np_thread() caller to the same
+iscsi_np was blocked on iscsi_np->np_restart_comp, iscsi_np
+kthread process context in __iscsi_target_login_thread() would
+flush pending signals and only perform a single completion of
+np->np_restart_comp before going back to sleep within transport
+specific iscsit_transport->iscsi_accept_np code.
+
+To address this bug, add a iscsi_np->np_reset_count and update
+__iscsi_target_login_thread() to keep completing np->np_restart_comp
+until ->np_reset_count has reached zero.
+
+Reported-by: Gary Guo <ghg@datera.io>
+Tested-by: Gary Guo <ghg@datera.io>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 1 +
+ drivers/target/iscsi/iscsi_target_login.c | 7 +++++--
+ include/target/iscsi/iscsi_target_core.h | 1 +
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -418,6 +418,7 @@ int iscsit_reset_np_thread(
+ return 0;
+ }
+ np->np_thread_state = ISCSI_NP_THREAD_RESET;
++ atomic_inc(&np->np_reset_count);
+
+ if (np->np_thread) {
+ spin_unlock_bh(&np->np_thread_lock);
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -1233,9 +1233,11 @@ static int __iscsi_target_login_thread(s
+ flush_signals(current);
+
+ spin_lock_bh(&np->np_thread_lock);
+- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
+ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
++ spin_unlock_bh(&np->np_thread_lock);
+ complete(&np->np_restart_comp);
++ return 1;
+ } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
+ spin_unlock_bh(&np->np_thread_lock);
+ goto exit;
+@@ -1268,7 +1270,8 @@ static int __iscsi_target_login_thread(s
+ goto exit;
+ } else if (rc < 0) {
+ spin_lock_bh(&np->np_thread_lock);
+- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
++ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+ spin_unlock_bh(&np->np_thread_lock);
+ complete(&np->np_restart_comp);
+ iscsit_put_transport(conn->conn_transport);
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -785,6 +785,7 @@ struct iscsi_np {
+ int np_sock_type;
+ enum np_thread_state_table np_thread_state;
+ bool enabled;
++ atomic_t np_reset_count;
+ enum iscsi_timer_flags_table np_login_timer_flags;
+ u32 np_exports;
+ enum np_flags_table np_flags;
--- /dev/null
+From ea8dc5b4cd2195ee582cae28afa4164c6dea1738 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Sun, 23 Jul 2017 20:03:33 +0530
+Subject: iscsi-target: fix memory leak in iscsit_setup_text_cmd()
+
+From: Varun Prakash <varun@chelsio.com>
+
+commit ea8dc5b4cd2195ee582cae28afa4164c6dea1738 upstream.
+
+On receiving text request iscsi-target allocates buffer for
+payload in iscsit_handle_text_cmd() and assigns buffer pointer
+to cmd->text_in_ptr, this buffer is currently freed in
+iscsit_release_cmd(), if iscsi-target sets 'C' bit in text
+response then it will receive another text request from the
+initiator with ttt != 0xffffffff in this case iscsi-target
+will find cmd using itt and call iscsit_setup_text_cmd()
+which will set cmd->text_in_ptr to NULL without freeing
+previously allocated buffer.
+
+This patch fixes this issue by calling kfree(cmd->text_in_ptr)
+in iscsit_setup_text_cmd() before assigning NULL to it.
+
+For the first text request cmd->text_in_ptr is NULL as
+cmd is memset to 0 in iscsit_allocate_cmd().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -2177,6 +2177,7 @@ iscsit_setup_text_cmd(struct iscsi_conn
+ cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
+ cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
+ cmd->data_direction = DMA_NONE;
++ kfree(cmd->text_in_ptr);
+ cmd->text_in_ptr = NULL;
+
+ return 0;
--- /dev/null
+From 92ddd95919466de5d34f3cb43635da9a7f9ab814 Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Tue, 8 Aug 2017 18:54:01 +0800
+Subject: mmc: mmc: correct the logic for setting HS400ES signal voltage
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit 92ddd95919466de5d34f3cb43635da9a7f9ab814 upstream.
+
+Change the default err value to -EINVAL, make sure the card only
+has type EXT_CSD_CARD_TYPE_HS400_1_8V also do the signal voltage
+setting when select hs400es mode.
+
+Fixes: commit 1720d3545b77 ("mmc: core: switch to 1V8 or 1V2 for hs400es mode")
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/mmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1258,7 +1258,7 @@ out_err:
+ static int mmc_select_hs400es(struct mmc_card *card)
+ {
+ struct mmc_host *host = card->host;
+- int err = 0;
++ int err = -EINVAL;
+ u8 val;
+
+ if (!(host->caps & MMC_CAP_8_BIT_DATA)) {
--- /dev/null
+From a11bf5ed951f8900d244d09eb03a888b59c7fc82 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Mon, 31 Jul 2017 10:29:56 +0200
+Subject: mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit a11bf5ed951f8900d244d09eb03a888b59c7fc82 upstream.
+
+Some ONFI NANDs do not support the SET/GET FEATURES commands, which,
+according to the spec, is perfectly valid.
+
+On these NANDs we can't set a specific timing mode using the "timing
+mode" feature, and we should assume the NAND does not require any setup
+to enter a specific timing mode.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: d8e725dd8311 ("mtd: nand: automate NAND timings selection")
+Reported-by: Alexander Dahl <ada@thorsis.com>
+Tested-by: Alexander Dahl <ada@thorsis.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_base.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -1081,7 +1081,9 @@ static int nand_setup_data_interface(str
+ * Ensure the timing mode has been changed on the chip side
+ * before changing timings on the controller side.
+ */
+- if (chip->onfi_version) {
++ if (chip->onfi_version &&
++ (le16_to_cpu(chip->onfi_params.opt_cmd) &
++ ONFI_OPT_CMD_SET_GET_FEATURES)) {
+ u8 tmode_param[ONFI_SUBFEATURE_PARAM_LEN] = {
+ chip->onfi_timing_mode_default,
+ };
--- /dev/null
+From f7f8c1756e9a5f1258a7cc6b663f8451b724900f Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+Date: Wed, 5 Jul 2017 08:51:09 +0200
+Subject: nand: fix wrong default oob layout for small pages using soft ecc
+
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+
+commit f7f8c1756e9a5f1258a7cc6b663f8451b724900f upstream.
+
+When using soft ecc, if no ooblayout is given, the core automatically
+uses one of the nand_ooblayout_{sp,lp}*() functions to determine the
+layout inside the out of band data.
+
+Until kernel version 4.6, struct nand_ecclayout was used for that
+purpose. During the migration from 4.6 to 4.7, an error shown up in the
+small page layout, in the case oob section is only 8 bytes long.
+
+The layout was using three bytes (0, 1, 2) for ecc, two bytes (3, 4)
+as free bytes, one byte (5) for bad block marker and finally
+two bytes (6, 7) as free bytes, as shown there:
+
+[linux-4.6] drivers/mtd/nand/nand_base.c:52
+static struct nand_ecclayout nand_oob_8 = {
+ .eccbytes = 3,
+ .eccpos = {0, 1, 2},
+ .oobfree = {
+ {.offset = 3,
+ .length = 2},
+ {.offset = 6,
+ .length = 2} }
+};
+
+This fixes the current implementation which is incoherent. It
+references bit 3 at the same time as an ecc byte and a free byte.
+
+Furthermore, it is clear with the previous implementation that there
+is only one ecc section with 8 bytes oob sections. We shall return
+-ERANGE in the nand_ooblayout_ecc_sp() function when asked for the
+second section.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+Fixes: 41b207a70d3a ("mtd: nand: implement the default mtd_ooblayout_ops")
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_base.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -64,8 +64,14 @@ static int nand_ooblayout_ecc_sp(struct
+
+ if (!section) {
+ oobregion->offset = 0;
+- oobregion->length = 4;
++ if (mtd->oobsize == 16)
++ oobregion->length = 4;
++ else
++ oobregion->length = 3;
+ } else {
++ if (mtd->oobsize == 8)
++ return -ERANGE;
++
+ oobregion->offset = 6;
+ oobregion->length = ecc->total - 4;
+ }
--- /dev/null
+From 1feb26162bee7b2f110facfec71b5c7bdbc7d14d Mon Sep 17 00:00:00 2001
+From: Weston Andros Adamson <dros@monkey.org>
+Date: Tue, 1 Aug 2017 16:25:01 -0400
+Subject: nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays
+
+From: Weston Andros Adamson <dros@monkey.org>
+
+commit 1feb26162bee7b2f110facfec71b5c7bdbc7d14d upstream.
+
+The client was freeing the nfs4_ff_layout_ds, but not the contained
+nfs4_ff_ds_version array.
+
+Signed-off-by: Weston Andros Adamson <dros@primarydata.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/flexfilelayout/flexfilelayoutdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -30,6 +30,7 @@ void nfs4_ff_layout_free_deviceid(struct
+ {
+ nfs4_print_deviceid(&mirror_ds->id_node.deviceid);
+ nfs4_pnfs_ds_put(mirror_ds->ds);
++ kfree(mirror_ds->ds_versions);
+ kfree_rcu(mirror_ds, id_node.rcu);
+ }
+
mm-ratelimit-pfns-busy-info-message.patch
mm-fix-list-corruptions-on-shmem-shrinklist.patch
futex-remove-unnecessary-warning-from-get_futex_key.patch
+xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch
+xtensa-mm-cache-add-missing-export_symbols.patch
+xtensa-don-t-limit-csum_partial-export-by-config_net.patch
+mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch
+iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch
+iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch
+target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch
+fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch
+nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch
+mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch
+nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch
+drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch
+drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch
+usb-serial-option-add-d-link-dwm-222-device-id.patch
+usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch
+usb-serial-pl2303-add-new-aten-device-id.patch
+usb-musb-fix-tx-fifo-flush-handling-again.patch
+usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch
+staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch
+iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch
+iio-light-tsl2563-use-correct-event-code.patch
+staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch
+uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch
+usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch
+usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch
+usb-check-for-dropped-connection-before-switching-to-full-speed.patch
+usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch
+usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch
+usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch
--- /dev/null
+From cef988642cdac44e910a27cb6e8166c96f86a0df Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 28 Jul 2017 16:22:31 +0100
+Subject: staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit cef988642cdac44e910a27cb6e8166c96f86a0df upstream.
+
+Comedi's read and write file operation handlers (`comedi_read()` and
+`comedi_write()`) currently call `copy_to_user()` or `copy_from_user()`
+whilst in the `TASK_INTERRUPTIBLE` state, which falls foul of the
+`might_fault()` checks when enabled. Fix it by setting the current task
+state back to `TASK_RUNNING` a bit earlier before calling these
+functions.
+
+Reported-by: Piotr Gregor <piotrgregor@rsyncme.org>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_fops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -2385,6 +2385,7 @@ static ssize_t comedi_write(struct file
+ continue;
+ }
+
++ set_current_state(TASK_RUNNING);
+ wp = async->buf_write_ptr;
+ n1 = min(n, async->prealloc_bufsz - wp);
+ n2 = n - n1;
+@@ -2517,6 +2518,8 @@ static ssize_t comedi_read(struct file *
+ }
+ continue;
+ }
++
++ set_current_state(TASK_RUNNING);
+ rp = async->buf_read_ptr;
+ n1 = min(n, async->prealloc_bufsz - rp);
+ n2 = n - n1;
--- /dev/null
+From 105967ad68d2eb1a041bc041f9cf96af2a653b65 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 14 Jul 2017 11:31:03 +0200
+Subject: staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 105967ad68d2eb1a041bc041f9cf96af2a653b65 upstream.
+
+gcc-7 points out an older regression:
+
+drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw':
+drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]
+
+The original code had 'unsigned short' here, but incorrectly got
+converted to 'bool'. This reverts the regression and uses a normal
+type instead.
+
+Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/resolver/ad2s1210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/iio/resolver/ad2s1210.c
++++ b/drivers/staging/iio/resolver/ad2s1210.c
+@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_
+ long m)
+ {
+ struct ad2s1210_state *st = iio_priv(indio_dev);
+- bool negative;
++ u16 negative;
+ int ret = 0;
+ u16 pos;
+ s16 vel;
--- /dev/null
+From 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sun, 6 Aug 2017 16:10:03 -0700
+Subject: target: Fix node_acl demo-mode + uncached dynamic shutdown regression
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd upstream.
+
+This patch fixes a generate_node_acls = 1 + cache_dynamic_acls = 0
+regression, that was introduced by
+
+ commit 01d4d673558985d9a118e1e05026633c3e2ade9b
+ Author: Nicholas Bellinger <nab@linux-iscsi.org>
+ Date: Wed Dec 7 12:55:54 2016 -0800
+
+which originally had the proper list_del_init() usage, but was
+dropped during list review as it was thought unnecessary by HCH.
+
+However, list_del_init() usage is required during the special
+generate_node_acls = 1 + cache_dynamic_acls = 0 case when
+transport_free_session() does a list_del(&se_nacl->acl_list),
+followed by target_complete_nacl() doing the same thing.
+
+This was manifesting as a general protection fault as reported
+by Justin:
+
+kernel: general protection fault: 0000 [#1] SMP
+kernel: Modules linked in:
+kernel: CPU: 0 PID: 11047 Comm: iscsi_ttx Not tainted 4.13.0-rc2.x86_64.1+ #20
+kernel: Hardware name: Intel Corporation S5500BC/S5500BC, BIOS S5500.86B.01.00.0064.050520141428 05/05/2014
+kernel: task: ffff88026939e800 task.stack: ffffc90007884000
+kernel: RIP: 0010:target_put_nacl+0x49/0xb0
+kernel: RSP: 0018:ffffc90007887d70 EFLAGS: 00010246
+kernel: RAX: dead000000000200 RBX: ffff8802556ca000 RCX: 0000000000000000
+kernel: RDX: dead000000000100 RSI: 0000000000000246 RDI: ffff8802556ce028
+kernel: RBP: ffffc90007887d88 R08: 0000000000000001 R09: 0000000000000000
+kernel: R10: ffffc90007887df8 R11: ffffea0009986900 R12: ffff8802556ce020
+kernel: R13: ffff8802556ce028 R14: ffff8802556ce028 R15: ffffffff88d85540
+kernel: FS: 0000000000000000(0000) GS:ffff88027fc00000(0000) knlGS:0000000000000000
+kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+kernel: CR2: 00007fffe36f5f94 CR3: 0000000009209000 CR4: 00000000003406f0
+kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+kernel: Call Trace:
+kernel: transport_free_session+0x67/0x140
+kernel: transport_deregister_session+0x7a/0xc0
+kernel: iscsit_close_session+0x92/0x210
+kernel: iscsit_close_connection+0x5f9/0x840
+kernel: iscsit_take_action_for_connection_exit+0xfe/0x110
+kernel: iscsi_target_tx_thread+0x140/0x1e0
+kernel: ? wait_woken+0x90/0x90
+kernel: kthread+0x124/0x160
+kernel: ? iscsit_thread_get_cpumask+0x90/0x90
+kernel: ? kthread_create_on_node+0x40/0x40
+kernel: ret_from_fork+0x22/0x30
+kernel: Code: 00 48 89 fb 4c 8b a7 48 01 00 00 74 68 4d 8d 6c 24 08 4c
+89 ef e8 e8 28 43 00 48 8b 93 20 04 00 00 48 8b 83 28 04 00 00 4c 89
+ef <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 20
+kernel: RIP: target_put_nacl+0x49/0xb0 RSP: ffffc90007887d70
+kernel: ---[ end trace f12821adbfd46fed ]---
+
+To address this, go ahead and use proper list_del_list() for all
+cases of se_nacl->acl_list deletion.
+
+Reported-by: Justin Maggard <jmaggard01@gmail.com>
+Tested-by: Justin Maggard <jmaggard01@gmail.com>
+Cc: Justin Maggard <jmaggard01@gmail.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_tpg.c | 4 ++--
+ drivers/target/target_core_transport.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(str
+ mutex_lock(&tpg->acl_node_mutex);
+ if (acl->dynamic_node_acl)
+ acl->dynamic_node_acl = 0;
+- list_del(&acl->acl_list);
++ list_del_init(&acl->acl_list);
+ mutex_unlock(&tpg->acl_node_mutex);
+
+ target_shutdown_sessions(acl);
+@@ -540,7 +540,7 @@ int core_tpg_deregister(struct se_portal
+ * in transport_deregister_session().
+ */
+ list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) {
+- list_del(&nacl->acl_list);
++ list_del_init(&nacl->acl_list);
+
+ core_tpg_wait_for_nacl_pr_ref(nacl);
+ core_free_device_list_for_node(nacl, se_tpg);
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -465,7 +465,7 @@ static void target_complete_nacl(struct
+ }
+
+ mutex_lock(&se_tpg->acl_node_mutex);
+- list_del(&nacl->acl_list);
++ list_del_init(&nacl->acl_list);
+ mutex_unlock(&se_tpg->acl_node_mutex);
+
+ core_tpg_wait_for_nacl_pr_ref(nacl);
+@@ -537,7 +537,7 @@ void transport_free_session(struct se_se
+ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
+
+ if (se_nacl->dynamic_stop)
+- list_del(&se_nacl->acl_list);
++ list_del_init(&se_nacl->acl_list);
+ }
+ mutex_unlock(&se_tpg->acl_node_mutex);
+
--- /dev/null
+From 89f23d51defcb94a5026d4b5da13faf4e1150a6f Mon Sep 17 00:00:00 2001
+From: Alan Swanson <reiver@improbability.net>
+Date: Wed, 26 Jul 2017 12:03:33 +0100
+Subject: uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069
+
+From: Alan Swanson <reiver@improbability.net>
+
+commit 89f23d51defcb94a5026d4b5da13faf4e1150a6f upstream.
+
+Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for
+Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already
+present in unusual_uas.h. Both in same controller IC family.
+
+Issue is that MakeMKV fails during key exchange with installed bluray drive
+with following error:
+
+002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED'
+occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
+
+Signed-off-by: Alan Swanson <reiver@improbability.net>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_uas.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+ UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+ "Initio Corporation",
+- "",
++ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_NO_ATA_1X),
++ US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE),
+
+ /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
--- /dev/null
+From 94c43b9897abf4ea366ed4dba027494e080c7050 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 1 Aug 2017 10:41:56 -0400
+Subject: USB: Check for dropped connection before switching to full speed
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 94c43b9897abf4ea366ed4dba027494e080c7050 upstream.
+
+Some buggy USB disk adapters disconnect and reconnect multiple times
+during the enumeration procedure. This may lead to a device
+connecting at full speed instead of high speed, because when the USB
+stack sees that a device isn't able to enumerate at high speed, it
+tries to hand the connection over to a full-speed companion
+controller.
+
+The logic for doing this is careful to check that the device is still
+connected. But this check is inadequate if the device disconnects and
+reconnects before the check is done. The symptom is that a device
+works, but much more slowly than it is capable of operating.
+
+The situation was made worse recently by commit 22547c4cc4fe ("usb:
+hub: Wait for connection to be reestablished after port reset"), which
+increases the delay following a reset before a disconnect is
+recognized, thus giving the device more time to reconnect.
+
+This patch makes the check more robust. If the device was
+disconnected at any time during enumeration, we will now skip the
+full-speed handover.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Zdenek Kabelac <zkabelac@redhat.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4728,7 +4728,8 @@ hub_power_remaining(struct usb_hub *hub)
+ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ u16 portchange)
+ {
+- int status, i;
++ int status = -ENODEV;
++ int i;
+ unsigned unit_load;
+ struct usb_device *hdev = hub->hdev;
+ struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
+@@ -4932,9 +4933,10 @@ loop:
+
+ done:
+ hub_port_disable(hub, port1, 1);
+- if (hcd->driver->relinquish_port && !hub->hdev->parent)
+- hcd->driver->relinquish_port(hcd, port1);
+-
++ if (hcd->driver->relinquish_port && !hub->hdev->parent) {
++ if (status != -ENOTCONN && status != -ENODEV)
++ hcd->driver->relinquish_port(hcd, port1);
++ }
+ }
+
+ /* Handle physical or logical connection change events.
--- /dev/null
+From 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e Mon Sep 17 00:00:00 2001
+From: Bin Liu <b-liu@ti.com>
+Date: Tue, 25 Jul 2017 09:31:33 -0500
+Subject: usb: core: unlink urbs from the tail of the endpoint's urb_list
+
+From: Bin Liu <b-liu@ti.com>
+
+commit 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e upstream.
+
+While unlink an urb, if the urb has been programmed in the controller,
+the controller driver might do some hw related actions to tear down the
+urb.
+
+Currently usb_hcd_flush_endpoint() passes each urb from the head of the
+endpoint's urb_list to the controller driver, which could make the
+controller driver think each urb has been programmed and take the
+unnecessary actions for each urb.
+
+This patch changes the behavior in usb_hcd_flush_endpoint() to pass the
+urbs from the tail of the list, to avoid any unnecessary actions in an
+controller driver.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1877,7 +1877,7 @@ void usb_hcd_flush_endpoint(struct usb_d
+ /* No more submits can occur */
+ spin_lock_irq(&hcd_urb_list_lock);
+ rescan:
+- list_for_each_entry (urb, &ep->urb_list, urb_list) {
++ list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) {
+ int is_in;
+
+ if (urb->unlinked)
--- /dev/null
+From aca5b9ebd096039657417c321a9252c696b359c2 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 2 Aug 2017 21:06:35 +0900
+Subject: usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() calling
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit aca5b9ebd096039657417c321a9252c696b359c2 upstream.
+
+According to the gadget.h, a "complete" function will always be called
+with interrupts disabled. However, sometimes usb3_request_done() function
+is called with interrupts enabled. So, this function should be held
+by spin_lock_irqsave() to disable interruption. Also, this driver has
+to call spin_unlock() to avoid spinlock recursion by this driver before
+calling usb_gadget_giveback_request().
+
+Reported-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
+Tested-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
+Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -685,21 +685,32 @@ static struct renesas_usb3_request *usb3
+ return usb3_req;
+ }
+
+-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+- struct renesas_usb3_request *usb3_req, int status)
++static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep,
++ struct renesas_usb3_request *usb3_req,
++ int status)
+ {
+ struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
+- unsigned long flags;
+
+ dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n",
+ usb3_ep->num, usb3_req->req.length, usb3_req->req.actual,
+ status);
+ usb3_req->req.status = status;
+- spin_lock_irqsave(&usb3->lock, flags);
+ usb3_ep->started = false;
+ list_del_init(&usb3_req->queue);
+- spin_unlock_irqrestore(&usb3->lock, flags);
++ spin_unlock(&usb3->lock);
+ usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req);
++ spin_lock(&usb3->lock);
++}
++
++static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
++ struct renesas_usb3_request *usb3_req, int status)
++{
++ struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
++ unsigned long flags;
++
++ spin_lock_irqsave(&usb3->lock, flags);
++ __usb3_request_done(usb3_ep, usb3_req, status);
++ spin_unlock_irqrestore(&usb3->lock, flags);
+ }
+
+ static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3)
--- /dev/null
+From cd5a6a4fdaba150089af2afc220eae0fef74878a Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 25 Jul 2017 23:58:50 +0200
+Subject: USB: hcd: Mark secondary HCD as dead if the primary one died
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit cd5a6a4fdaba150089af2afc220eae0fef74878a upstream.
+
+Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared
+HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for
+the primary one.
+
+Among other thigs, this prevents check_root_hub_suspended() from
+returning -EBUSY for dead HCDs which helps to work around system
+suspend issues in some situations.
+
+This actually fixes occasional suspend failures on one of my test
+machines.
+
+Suggested-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -2474,6 +2474,8 @@ void usb_hc_died (struct usb_hcd *hcd)
+ }
+ if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
+ hcd = hcd->shared_hcd;
++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
++ set_bit(HCD_FLAG_DEAD, &hcd->flags);
+ if (hcd->rh_registered) {
+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+
--- /dev/null
+From 45d73860530a14c608f410b91c6c341777bfa85d Mon Sep 17 00:00:00 2001
+From: Bin Liu <b-liu@ti.com>
+Date: Tue, 25 Jul 2017 09:31:34 -0500
+Subject: usb: musb: fix tx fifo flush handling again
+
+From: Bin Liu <b-liu@ti.com>
+
+commit 45d73860530a14c608f410b91c6c341777bfa85d upstream.
+
+commit 68fe05e2a451 ("usb: musb: fix tx fifo flush handling") drops the
+1ms delay trying to solve the long disconnect time issue when
+application queued many tx urbs. However, the 1ms delay is needed for
+some use cases, for example, without the delay, reconnecting AR9271 WIFI
+dongle no longer works if the connection is dropped from the AP.
+
+So let's add back the 1ms delay in musb_h_tx_flush_fifo(), and solve the
+long disconnect time problem with a separate patch for
+usb_hcd_flush_endpoint().
+
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_host.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct
+ "Could not flush host TX%d fifo: csr: %04x\n",
+ ep->epnum, csr))
+ return;
++ mdelay(1);
+ }
+ }
+
--- /dev/null
+From 7496cfe5431f21da5d27a8388c326397e3f0a5db Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Tue, 8 Aug 2017 17:51:27 +0800
+Subject: usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 7496cfe5431f21da5d27a8388c326397e3f0a5db upstream.
+
+Moshi USB to Ethernet Adapter internally uses a Genesys Logic hub to
+connect to Realtek r8153.
+
+The Realtek r8153 ethernet does not work on the internal hub, no-lpm quirk
+can make it work.
+
+Since another r8153 dongle at my hand does not have the issue, so add
+the quirk to the Genesys Logic hub instead.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -150,6 +150,9 @@ static const struct usb_device_id usb_qu
+ /* appletouch */
+ { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
++ { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Avision AV600U */
+ { USB_DEVICE(0x0638, 0x0a13), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
--- /dev/null
+From 2acecd58969897795cf015c9057ebd349a3fda8a Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 2 Aug 2017 13:21:45 +0900
+Subject: usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 2acecd58969897795cf015c9057ebd349a3fda8a upstream.
+
+The latest HW manual (Rev.0.55) shows us this UGCTRL2.VBUSSEL bit.
+If the bit sets to 1, the VBUS drive is controlled by phy related
+registers (called "UCOM Registers" on the manual). Since R-Car Gen3
+environment will control VBUS by phy-rcar-gen3-usb2 driver,
+the UGCTRL2.VBUSSEL bit should be set to 1. So, this patch fixes
+the register's value. Otherwise, even if the ID pin indicates to
+peripheral, the R-Car will output USBn_PWEN to 1 when a host driver
+is running.
+
+Fixes: de18757e272d ("usb: renesas_usbhs: add R-Car Gen3 power control"
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/rcar3.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/renesas_usbhs/rcar3.c
++++ b/drivers/usb/renesas_usbhs/rcar3.c
+@@ -20,9 +20,13 @@
+ /* Low Power Status register (LPSTS) */
+ #define LPSTS_SUSPM 0x4000
+
+-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */
++/*
++ * USB General control register 2 (UGCTRL2)
++ * Remarks: bit[31:11] and bit[9:6] should be 0
++ */
+ #define UGCTRL2_RESERVED_3 0x00000001 /* bit[3:0] should be B'0001 */
+ #define UGCTRL2_USB0SEL_OTG 0x00000030
++#define UGCTRL2_VBUSSEL 0x00000400
+
+ static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data)
+ {
+@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct
+ {
+ struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev);
+
+- usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
++ usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG |
++ UGCTRL2_VBUSSEL);
+
+ if (enable) {
+ usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
--- /dev/null
+From 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f Mon Sep 17 00:00:00 2001
+From: Stefan Triller <github@stefantriller.de>
+Date: Fri, 30 Jun 2017 14:44:03 +0200
+Subject: USB: serial: cp210x: add support for Qivicon USB ZigBee dongle
+
+From: Stefan Triller <github@stefantriller.de>
+
+commit 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f upstream.
+
+The German Telekom offers a ZigBee USB Stick under the brand name Qivicon
+for their SmartHome Home Base in its 1. Generation. The productId is not
+known by the according kernel module, this patch adds support for it.
+
+Signed-off-by: Stefan Triller <github@stefantriller.de>
+Reviewed-by: Frans Klaver <fransklaver@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -136,6 +136,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
+ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
++ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
--- /dev/null
+From fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 Mon Sep 17 00:00:00 2001
+From: Hector Martin <marcan@marcan.st>
+Date: Wed, 2 Aug 2017 00:45:06 +0900
+Subject: USB: serial: option: add D-Link DWM-222 device ID
+
+From: Hector Martin <marcan@marcan.st>
+
+commit fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 upstream.
+
+Add device id for D-Link DWM-222.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2025,6 +2025,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
--- /dev/null
+From 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 10 Aug 2017 11:54:12 -0700
+Subject: USB: serial: pl2303: add new ATEN device id
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e upstream.
+
+This adds a new ATEN device id for a new pl2303-based device.
+
+Reported-by: Peter Kuo <PeterKuo@aten.com.tw>
+Cc: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/pl2303.c | 1 +
+ drivers/usb/serial/pl2303.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -49,6 +49,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
++ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485) },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
+ { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
+ { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -27,6 +27,7 @@
+ #define ATEN_VENDOR_ID 0x0557
+ #define ATEN_VENDOR_ID2 0x0547
+ #define ATEN_PRODUCT_ID 0x2008
++#define ATEN_PRODUCT_UC485 0x2021
+ #define ATEN_PRODUCT_ID2 0x2118
+
+ #define IODATA_VENDOR_ID 0x04bb
--- /dev/null
+From e788787ef4f9c24aafefc480a8da5f92b914e5e6 Mon Sep 17 00:00:00 2001
+From: Sandeep Singh <sandeep.singh@amd.com>
+Date: Fri, 4 Aug 2017 16:35:56 +0530
+Subject: usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume
+
+From: Sandeep Singh <sandeep.singh@amd.com>
+
+commit e788787ef4f9c24aafefc480a8da5f92b914e5e6 upstream.
+
+Certain HP keyboards would keep inputting a character automatically which
+is the wake-up key after S3 resume
+
+On some AMD platforms USB host fails to respond (by holding resume-K) to
+USB device (an HP keyboard) resume request within 1ms (TURSM) and ensures
+that resume is signaled for at least 20 ms (TDRSMDN), which is defined in
+USB 2.0 spec. The result is that the keyboard is out of function.
+
+In SNPS USB design, the host responds to the resume request only after
+system gets back to S0 and the host gets to functional after the internal
+HW restore operation that is more than 1 second after the initial resume
+request from the USB device.
+
+As a workaround for specific keyboard ID(HP Keyboards), applying port reset
+after resume when the keyboard is plugged in.
+
+Signed-off-by: Sandeep Singh <Sandeep.Singh@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+cc: Nehal Shah <Nehal-bakulchandra.Shah@amd.com>
+Reviewed-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 1 +
+ drivers/usb/host/pci-quirks.c | 17 ++++++++++++-----
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -252,6 +252,7 @@ static const struct usb_device_id usb_am
+ { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
+ { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
+ { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Optical Mouse M90/M100 */
+ { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -98,6 +98,7 @@ enum amd_chipset_gen {
+ AMD_CHIPSET_HUDSON2,
+ AMD_CHIPSET_BOLTON,
+ AMD_CHIPSET_YANGTZE,
++ AMD_CHIPSET_TAISHAN,
+ AMD_CHIPSET_UNKNOWN,
+ };
+
+@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(stru
+ pinfo->sb_type.gen = AMD_CHIPSET_SB700;
+ else if (rev >= 0x40 && rev <= 0x4f)
+ pinfo->sb_type.gen = AMD_CHIPSET_SB800;
++ }
++ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
++ 0x145c, NULL);
++ if (pinfo->smbus_dev) {
++ pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
+ } else {
+ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+ PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
+@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(stru
+ {
+ /* Make sure amd chipset type has already been initialized */
+ usb_amd_find_chipset_info();
+- if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
+- return 0;
+-
+- dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+- return 1;
++ if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE ||
++ amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) {
++ dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
++ return 1;
++ }
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
+
--- /dev/null
+From 7f81e55c737a8fa82c71f290945d729a4902f8d2 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Tue, 1 Aug 2017 11:02:46 -0700
+Subject: xtensa: don't limit csum_partial export by CONFIG_NET
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 7f81e55c737a8fa82c71f290945d729a4902f8d2 upstream.
+
+csum_partial and csum_partial_copy_generic are defined unconditionally
+and are available even when CONFIG_NET is disabled. They are used not
+only by the network drivers, but also by scsi and media.
+Don't limit these functions export by CONFIG_NET.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
+index d159e9b9c018..672391003e40 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -94,13 +94,11 @@ unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v)
+ }
+ EXPORT_SYMBOL(__sync_fetch_and_or_4);
+
+-#ifdef CONFIG_NET
+ /*
+ * Networking support
+ */
+ EXPORT_SYMBOL(csum_partial);
+ EXPORT_SYMBOL(csum_partial_copy_generic);
+-#endif /* CONFIG_NET */
+
+ /*
+ * Architecture-specific symbols
--- /dev/null
+From 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 28 Jul 2017 17:42:59 -0700
+Subject: xtensa: fix cache aliasing handling code for WT cache
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 upstream.
+
+Currently building kernel for xtensa core with aliasing WT cache fails
+with the following messages:
+
+ mm/memory.c:2152: undefined reference to `flush_dcache_page'
+ mm/memory.c:2332: undefined reference to `local_flush_cache_page'
+ mm/memory.c:1919: undefined reference to `local_flush_cache_range'
+ mm/memory.c:4179: undefined reference to `copy_to_user_page'
+ mm/memory.c:4183: undefined reference to `copy_from_user_page'
+
+This happens because implementation of these functions is only compiled
+when data cache is WB, which looks wrong: even when data cache doesn't
+need flushing it still needs invalidation. The functions like
+__flush_[invalidate_]dcache_* are correctly defined for both WB and WT
+caches (and even if they weren't that'd still be ok, just slower).
+
+Fix this by providing the same implementation of the above functions for
+both WB and WT cache.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/mm/cache.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/arch/xtensa/mm/cache.c
++++ b/arch/xtensa/mm/cache.c
+@@ -120,10 +120,6 @@ void copy_user_highpage(struct page *dst
+ preempt_enable();
+ }
+
+-#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
+-
+-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
+-
+ /*
+ * Any time the kernel writes to a user page cache page, or it is about to
+ * read from a page cache page this routine is called.
+@@ -208,7 +204,7 @@ void local_flush_cache_page(struct vm_ar
+ __invalidate_icache_page_alias(virt, phys);
+ }
+
+-#endif
++#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
+
+ void
+ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
+@@ -225,7 +221,7 @@ update_mmu_cache(struct vm_area_struct *
+
+ flush_tlb_page(vma, addr);
+
+-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
++#if (DCACHE_WAY_SIZE > PAGE_SIZE)
+
+ if (!PageReserved(page) && test_bit(PG_arch_1, &page->flags)) {
+ unsigned long phys = page_to_phys(page);
+@@ -256,7 +252,7 @@ update_mmu_cache(struct vm_area_struct *
+ * flush_dcache_page() on the page.
+ */
+
+-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
++#if (DCACHE_WAY_SIZE > PAGE_SIZE)
+
+ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
+ unsigned long vaddr, void *dst, const void *src,
--- /dev/null
+From bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Tue, 1 Aug 2017 11:15:15 -0700
+Subject: xtensa: mm/cache: add missing EXPORT_SYMBOLs
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed upstream.
+
+Functions clear_user_highpage, copy_user_highpage, flush_dcache_page,
+local_flush_cache_range and local_flush_cache_page may be used from
+modules. Export them.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
+index dbb1cdef3663..3c75c4e597da 100644
+--- a/arch/xtensa/mm/cache.c
++++ b/arch/xtensa/mm/cache.c
+@@ -103,6 +103,7 @@ void clear_user_highpage(struct page *page, unsigned long vaddr)
+ clear_page_alias(kvaddr, paddr);
+ preempt_enable();
+ }
++EXPORT_SYMBOL(clear_user_highpage);
+
+ void copy_user_highpage(struct page *dst, struct page *src,
+ unsigned long vaddr, struct vm_area_struct *vma)
+@@ -119,6 +120,7 @@ void copy_user_highpage(struct page *dst, struct page *src,
+ copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr);
+ preempt_enable();
+ }
++EXPORT_SYMBOL(copy_user_highpage);
+
+ /*
+ * Any time the kernel writes to a user page cache page, or it is about to
+@@ -172,7 +174,7 @@ void flush_dcache_page(struct page *page)
+
+ /* There shouldn't be an entry in the cache for this page anymore. */
+ }
+-
++EXPORT_SYMBOL(flush_dcache_page);
+
+ /*
+ * For now, flush the whole cache. FIXME??
+@@ -184,6 +186,7 @@ void local_flush_cache_range(struct vm_area_struct *vma,
+ __flush_invalidate_dcache_all();
+ __invalidate_icache_all();
+ }
++EXPORT_SYMBOL(local_flush_cache_range);
+
+ /*
+ * Remove any entry in the cache for this page.
+@@ -203,6 +206,7 @@ void local_flush_cache_page(struct vm_area_struct *vma, unsigned long address,
+ __flush_invalidate_dcache_page_alias(virt, phys);
+ __invalidate_icache_page_alias(virt, phys);
+ }
++EXPORT_SYMBOL(local_flush_cache_page);
+
+ #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
