--- /dev/null
+From 9bb201a5d5acc733943e8af7151cceab9d976a69 Mon Sep 17 00:00:00 2001
+From: Jussi Laako <jussi@sonarnerd.net>
+Date: Sun, 15 Oct 2017 12:41:32 +0300
+Subject: ALSA: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital
+
+From: Jussi Laako <jussi@sonarnerd.net>
+
+commit 9bb201a5d5acc733943e8af7151cceab9d976a69 upstream.
+
+Add native DSD support quirk for Pro-Ject Pre Box S2 Digital USB id
+2772:0230.
+
+Signed-off-by: Jussi Laako <jussi@sonarnerd.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1352,6 +1352,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+ case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
+ case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
+ case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
++ case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */
+ if (fp->altsetting == 2)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
--- /dev/null
+From 5a606223c6b5b7560da253ed52e62c67fa18e29b Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Sat, 29 Jul 2017 11:51:01 +0200
+Subject: can: af_can: can_pernet_init(): add missing error handling for kzalloc returning NULL
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 5a606223c6b5b7560da253ed52e62c67fa18e29b upstream.
+
+This patch adds the missing check and error handling for out-of-memory
+situations, when kzalloc cannot allocate memory.
+
+Fixes: cb5635a36776 ("can: complete initial namespace support")
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/can/af_can.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -875,9 +875,14 @@ static int can_pernet_init(struct net *n
+ spin_lock_init(&net->can.can_rcvlists_lock);
+ net->can.can_rx_alldev_list =
+ kzalloc(sizeof(struct dev_rcv_lists), GFP_KERNEL);
+-
++ if (!net->can.can_rx_alldev_list)
++ goto out;
+ net->can.can_stats = kzalloc(sizeof(struct s_stats), GFP_KERNEL);
++ if (!net->can.can_stats)
++ goto out_free_alldev_list;
+ net->can.can_pstats = kzalloc(sizeof(struct s_pstats), GFP_KERNEL);
++ if (!net->can.can_pstats)
++ goto out_free_can_stats;
+
+ if (IS_ENABLED(CONFIG_PROC_FS)) {
+ /* the statistics are updated every second (timer triggered) */
+@@ -892,6 +897,13 @@ static int can_pernet_init(struct net *n
+ }
+
+ return 0;
++
++ out_free_can_stats:
++ kfree(net->can.can_stats);
++ out_free_alldev_list:
++ kfree(net->can.can_rx_alldev_list);
++ out:
++ return -ENOMEM;
+ }
+
+ static void can_pernet_exit(struct net *net)
--- /dev/null
+From 72d92e865d1560723e1957ee3f393688c49ca5bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20M=C3=A4tje?= <Stefan.Maetje@esd.eu>
+Date: Wed, 18 Oct 2017 13:25:17 +0200
+Subject: can: esd_usb2: Fix can_dlc value for received RTR, frames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Mätje <Stefan.Maetje@esd.eu>
+
+commit 72d92e865d1560723e1957ee3f393688c49ca5bf upstream.
+
+The dlc member of the struct rx_msg contains also the ESD_RTR flag to
+mark received RTR frames. Without the fix the can_dlc value for received
+RTR frames would always be set to 8 by get_can_dlc() instead of the
+received value.
+
+Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
+Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/esd_usb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -333,7 +333,7 @@ static void esd_usb2_rx_can_msg(struct e
+ }
+
+ cf->can_id = id & ESD_IDMASK;
+- cf->can_dlc = get_can_dlc(msg->msg.rx.dlc);
++ cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR);
+
+ if (id & ESD_EXTID)
+ cf->can_id |= CAN_EFF_FLAG;
--- /dev/null
+From 083c5571290a2d4308b75f1a59cf376b6e907808 Mon Sep 17 00:00:00 2001
+From: "ZHU Yi (ST-FIR/ENG1-Zhu)" <Yi.Zhu5@cn.bosch.com>
+Date: Fri, 15 Sep 2017 07:08:23 +0000
+Subject: can: flexcan: fix i.MX28 state transition issue
+
+From: ZHU Yi (ST-FIR/ENG1-Zhu) <Yi.Zhu5@cn.bosch.com>
+
+commit 083c5571290a2d4308b75f1a59cf376b6e907808 upstream.
+
+Enable FLEXCAN_QUIRK_BROKEN_PERR_STATE for i.MX28 to report correct
+state transitions, especially to error passive.
+
+Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Zhu Yi <yi.zhu5@cn.bosch.com>
+Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index d6ad12744ff1..ed544c44848f 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -285,7 +285,9 @@ static const struct flexcan_devtype_data fsl_p1010_devtype_data = {
+ .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE,
+ };
+
+-static const struct flexcan_devtype_data fsl_imx28_devtype_data;
++static const struct flexcan_devtype_data fsl_imx28_devtype_data = {
++ .quirks = FLEXCAN_QUIRK_BROKEN_PERR_STATE,
++};
+
+ static const struct flexcan_devtype_data fsl_imx6q_devtype_data = {
+ .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
--- /dev/null
+From cf9c04677f2bf599b44511963039ec6e25583feb Mon Sep 17 00:00:00 2001
+From: "ZHU Yi (ST-FIR/ENG1-Zhu)" <Yi.Zhu5@cn.bosch.com>
+Date: Fri, 15 Sep 2017 07:05:50 +0000
+Subject: can: flexcan: fix i.MX6 state transition issue
+
+From: ZHU Yi (ST-FIR/ENG1-Zhu) <Yi.Zhu5@cn.bosch.com>
+
+commit cf9c04677f2bf599b44511963039ec6e25583feb upstream.
+
+Enable FLEXCAN_QUIRK_BROKEN_PERR_STATE for i.MX6 to report correct state
+transitions.
+
+Signed-off-by: Zhu Yi <yi.zhu5@cn.bosch.com>
+Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -289,7 +289,7 @@ static const struct flexcan_devtype_data
+
+ static const struct flexcan_devtype_data fsl_imx6q_devtype_data = {
+ .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
+- FLEXCAN_QUIRK_USE_OFF_TIMESTAMP,
++ FLEXCAN_QUIRK_USE_OFF_TIMESTAMP | FLEXCAN_QUIRK_BROKEN_PERR_STATE,
+ };
+
+ static const struct flexcan_devtype_data fsl_vf610_devtype_data = {
--- /dev/null
+From fb5b91d61bebc24686ffc379138fd67808b1a1e6 Mon Sep 17 00:00:00 2001
+From: "ZHU Yi (ST-FIR/ENG1-Zhu)" <Yi.Zhu5@cn.bosch.com>
+Date: Fri, 15 Sep 2017 07:09:37 +0000
+Subject: can: flexcan: fix p1010 state transition issue
+
+From: ZHU Yi (ST-FIR/ENG1-Zhu) <Yi.Zhu5@cn.bosch.com>
+
+commit fb5b91d61bebc24686ffc379138fd67808b1a1e6 upstream.
+
+Enable FLEXCAN_QUIRK_BROKEN_WERR_STATE and
+FLEXCAN_QUIRK_BROKEN_PERR_STATE for p1010 to report correct state
+transitions.
+
+Signed-off-by: Zhu Yi <yi.zhu5@cn.bosch.com>
+Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -282,7 +282,8 @@ struct flexcan_priv {
+ };
+
+ static const struct flexcan_devtype_data fsl_p1010_devtype_data = {
+- .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE,
++ .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE |
++ FLEXCAN_QUIRK_BROKEN_PERR_STATE,
+ };
+
+ static const struct flexcan_devtype_data fsl_imx28_devtype_data = {
--- /dev/null
+From ad2302345d59d29232cb668baaae9e840925d153 Mon Sep 17 00:00:00 2001
+From: "ZHU Yi (ST-FIR/ENG1-Zhu)" <Yi.Zhu5@cn.bosch.com>
+Date: Fri, 15 Sep 2017 06:59:15 +0000
+Subject: can: flexcan: fix state transition regression
+
+From: ZHU Yi (ST-FIR/ENG1-Zhu) <Yi.Zhu5@cn.bosch.com>
+
+commit ad2302345d59d29232cb668baaae9e840925d153 upstream.
+
+Update state upon any interrupt to report correct state transitions in
+case the flexcan core enabled the broken error state quirk fix.
+
+Signed-off-by: Zhu Yi <yi.zhu5@cn.bosch.com>
+Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -765,8 +765,9 @@ static irqreturn_t flexcan_irq(int irq,
+ flexcan_write(reg_esr & FLEXCAN_ESR_ALL_INT, ®s->esr);
+ }
+
+- /* state change interrupt */
+- if (reg_esr & FLEXCAN_ESR_ERR_STATE)
++ /* state change interrupt or broken error state quirk fix is enabled */
++ if ((reg_esr & FLEXCAN_ESR_ERR_STATE) ||
++ (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_ERR_STATE))
+ flexcan_irq_state(dev, reg_esr);
+
+ /* bus error IRQ - handle if bus error reporting is activated */
--- /dev/null
+From da49a8075c00b4d98ef069a0ee201177a8b79ead Mon Sep 17 00:00:00 2001
+From: "ZHU Yi (ST-FIR/ENG1-Zhu)" <Yi.Zhu5@cn.bosch.com>
+Date: Fri, 15 Sep 2017 07:03:58 +0000
+Subject: can: flexcan: implement error passive state quirk
+
+From: ZHU Yi (ST-FIR/ENG1-Zhu) <Yi.Zhu5@cn.bosch.com>
+
+commit da49a8075c00b4d98ef069a0ee201177a8b79ead upstream.
+
+Add FLEXCAN_QUIRK_BROKEN_PERR_STATE for better description of the
+missing error passive interrupt quirk.
+
+Error interrupt flooding may happen if the broken error state quirk fix
+is enabled. For example, in case there is singled out node on the bus
+and the node sends a frame, then error interrupt flooding happens and
+will not stop because the node cannot go to bus off. The flooding will
+stop after another node connected to the bus again.
+
+If high bitrate configured on the low end system, then the flooding
+may causes performance issue, hence, this patch mitigates this by:
+1. disable error interrupt upon error passive state transition
+2. re-enable error interrupt upon error warning state transition
+3. disable/enable error interrupt upon error active state transition
+ depends on FLEXCAN_QUIRK_BROKEN_WERR_STATE
+
+In this way, the driver is still able to report correct state
+transitions without additional latency. When there are bus problems,
+flooding of error interrupts is limited to the number of frames required
+to change state from error warning to error passive if the core has
+[TR]WRN_INT connected (FLEXCAN_QUIRK_BROKEN_WERR_STATE is not enabled),
+otherwise, the flooding is limited to the number of frames required to
+change state from error active to error passive.
+
+Signed-off-by: Zhu Yi <yi.zhu5@cn.bosch.com>
+Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 75 ++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 66 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -182,14 +182,14 @@
+ /* FLEXCAN hardware feature flags
+ *
+ * Below is some version info we got:
+- * SOC Version IP-Version Glitch- [TR]WRN_INT Memory err RTR re-
+- * Filter? connected? detection ception in MB
+- * MX25 FlexCAN2 03.00.00.00 no no no no
+- * MX28 FlexCAN2 03.00.04.00 yes yes no no
+- * MX35 FlexCAN2 03.00.00.00 no no no no
+- * MX53 FlexCAN2 03.00.00.00 yes no no no
+- * MX6s FlexCAN3 10.00.12.00 yes yes no yes
+- * VF610 FlexCAN3 ? no yes yes yes?
++ * SOC Version IP-Version Glitch- [TR]WRN_INT IRQ Err Memory err RTR re-
++ * Filter? connected? Passive detection ception in MB
++ * MX25 FlexCAN2 03.00.00.00 no no ? no no
++ * MX28 FlexCAN2 03.00.04.00 yes yes no no no
++ * MX35 FlexCAN2 03.00.00.00 no no ? no no
++ * MX53 FlexCAN2 03.00.00.00 yes no no no no
++ * MX6s FlexCAN3 10.00.12.00 yes yes no no yes
++ * VF610 FlexCAN3 ? no yes ? yes yes?
+ *
+ * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
+ */
+@@ -198,6 +198,7 @@
+ #define FLEXCAN_QUIRK_ENABLE_EACEN_RRS BIT(3) /* Enable EACEN and RRS bit in ctrl2 */
+ #define FLEXCAN_QUIRK_DISABLE_MECR BIT(4) /* Disable Memory error detection */
+ #define FLEXCAN_QUIRK_USE_OFF_TIMESTAMP BIT(5) /* Use timestamp based offloading */
++#define FLEXCAN_QUIRK_BROKEN_PERR_STATE BIT(6) /* No interrupt for error passive */
+
+ /* Structure of the message buffer */
+ struct flexcan_mb {
+@@ -335,6 +336,22 @@ static inline void flexcan_write(u32 val
+ }
+ #endif
+
++static inline void flexcan_error_irq_enable(const struct flexcan_priv *priv)
++{
++ struct flexcan_regs __iomem *regs = priv->regs;
++ u32 reg_ctrl = (priv->reg_ctrl_default | FLEXCAN_CTRL_ERR_MSK);
++
++ flexcan_write(reg_ctrl, ®s->ctrl);
++}
++
++static inline void flexcan_error_irq_disable(const struct flexcan_priv *priv)
++{
++ struct flexcan_regs __iomem *regs = priv->regs;
++ u32 reg_ctrl = (priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_MSK);
++
++ flexcan_write(reg_ctrl, ®s->ctrl);
++}
++
+ static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv)
+ {
+ if (!priv->reg_xceiver)
+@@ -713,6 +730,7 @@ static irqreturn_t flexcan_irq(int irq,
+ struct flexcan_regs __iomem *regs = priv->regs;
+ irqreturn_t handled = IRQ_NONE;
+ u32 reg_iflag1, reg_esr;
++ enum can_state last_state = priv->can.state;
+
+ reg_iflag1 = flexcan_read(®s->iflag1);
+
+@@ -767,7 +785,8 @@ static irqreturn_t flexcan_irq(int irq,
+
+ /* state change interrupt or broken error state quirk fix is enabled */
+ if ((reg_esr & FLEXCAN_ESR_ERR_STATE) ||
+- (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_WERR_STATE))
++ (priv->devtype_data->quirks & (FLEXCAN_QUIRK_BROKEN_WERR_STATE |
++ FLEXCAN_QUIRK_BROKEN_PERR_STATE)))
+ flexcan_irq_state(dev, reg_esr);
+
+ /* bus error IRQ - handle if bus error reporting is activated */
+@@ -775,6 +794,44 @@ static irqreturn_t flexcan_irq(int irq,
+ (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING))
+ flexcan_irq_bus_err(dev, reg_esr);
+
++ /* availability of error interrupt among state transitions in case
++ * bus error reporting is de-activated and
++ * FLEXCAN_QUIRK_BROKEN_PERR_STATE is enabled:
++ * +--------------------------------------------------------------+
++ * | +----------------------------------------------+ [stopped / |
++ * | | | sleeping] -+
++ * +-+-> active <-> warning <-> passive -> bus off -+
++ * ___________^^^^^^^^^^^^_______________________________
++ * disabled(1) enabled disabled
++ *
++ * (1): enabled if FLEXCAN_QUIRK_BROKEN_WERR_STATE is enabled
++ */
++ if ((last_state != priv->can.state) &&
++ (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_PERR_STATE) &&
++ !(priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)) {
++ switch (priv->can.state) {
++ case CAN_STATE_ERROR_ACTIVE:
++ if (priv->devtype_data->quirks &
++ FLEXCAN_QUIRK_BROKEN_WERR_STATE)
++ flexcan_error_irq_enable(priv);
++ else
++ flexcan_error_irq_disable(priv);
++ break;
++
++ case CAN_STATE_ERROR_WARNING:
++ flexcan_error_irq_enable(priv);
++ break;
++
++ case CAN_STATE_ERROR_PASSIVE:
++ case CAN_STATE_BUS_OFF:
++ flexcan_error_irq_disable(priv);
++ break;
++
++ default:
++ break;
++ }
++ }
++
+ return handled;
+ }
+
--- /dev/null
+From 2f8639b24b4f4f9dd6cf7c1f2aea90e2fcbcc451 Mon Sep 17 00:00:00 2001
+From: "ZHU Yi (ST-FIR/ENG1-Zhu)" <Yi.Zhu5@cn.bosch.com>
+Date: Fri, 15 Sep 2017 07:01:23 +0000
+Subject: can: flexcan: rename legacy error state quirk
+
+From: ZHU Yi (ST-FIR/ENG1-Zhu) <Yi.Zhu5@cn.bosch.com>
+
+commit 2f8639b24b4f4f9dd6cf7c1f2aea90e2fcbcc451 upstream.
+
+Rename FLEXCAN_QUIRK_BROKEN_ERR_STATE to FLEXCAN_QUIRK_BROKEN_WERR_STATE
+for better description of the missing [TR]WRN_INT quirk.
+
+Signed-off-by: Zhu Yi <yi.zhu5@cn.bosch.com>
+Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -193,7 +193,7 @@
+ *
+ * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
+ */
+-#define FLEXCAN_QUIRK_BROKEN_ERR_STATE BIT(1) /* [TR]WRN_INT not connected */
++#define FLEXCAN_QUIRK_BROKEN_WERR_STATE BIT(1) /* [TR]WRN_INT not connected */
+ #define FLEXCAN_QUIRK_DISABLE_RXFG BIT(2) /* Disable RX FIFO Global mask */
+ #define FLEXCAN_QUIRK_ENABLE_EACEN_RRS BIT(3) /* Enable EACEN and RRS bit in ctrl2 */
+ #define FLEXCAN_QUIRK_DISABLE_MECR BIT(4) /* Disable Memory error detection */
+@@ -281,7 +281,7 @@ struct flexcan_priv {
+ };
+
+ static const struct flexcan_devtype_data fsl_p1010_devtype_data = {
+- .quirks = FLEXCAN_QUIRK_BROKEN_ERR_STATE,
++ .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE,
+ };
+
+ static const struct flexcan_devtype_data fsl_imx28_devtype_data;
+@@ -767,7 +767,7 @@ static irqreturn_t flexcan_irq(int irq,
+
+ /* state change interrupt or broken error state quirk fix is enabled */
+ if ((reg_esr & FLEXCAN_ESR_ERR_STATE) ||
+- (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_ERR_STATE))
++ (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_WERR_STATE))
+ flexcan_irq_state(dev, reg_esr);
+
+ /* bus error IRQ - handle if bus error reporting is activated */
+@@ -888,7 +888,7 @@ static int flexcan_chip_start(struct net
+ * on most Flexcan cores, too. Otherwise we don't get
+ * any error warning or passive interrupts.
+ */
+- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_ERR_STATE ||
++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_WERR_STATE ||
+ priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
+ reg_ctrl |= FLEXCAN_CTRL_ERR_MSK;
+ else
--- /dev/null
+From 97819f943063b622eca44d3644067c190dc75039 Mon Sep 17 00:00:00 2001
+From: Wolfgang Grandegger <wg@grandegger.com>
+Date: Thu, 14 Sep 2017 18:37:14 +0200
+Subject: can: gs_usb: fix busy loop if no more TX context is available
+
+From: Wolfgang Grandegger <wg@grandegger.com>
+
+commit 97819f943063b622eca44d3644067c190dc75039 upstream.
+
+If sending messages with no cable connected, it quickly happens that
+there is no more TX context available. Then "gs_can_start_xmit()"
+returns with "NETDEV_TX_BUSY" and the upper layer does retry
+immediately keeping the CPU busy. To fix that issue, I moved
+"atomic_dec(&dev->active_tx_urbs)" from "gs_usb_xmit_callback()" to
+the TX done handling in "gs_usb_receive_bulk_callback()". Renaming
+"active_tx_urbs" to "active_tx_contexts" and moving it into
+"gs_[alloc|free]_tx_context()" would also make sense.
+
+Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/gs_usb.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -375,6 +375,8 @@ static void gs_usb_receive_bulk_callback
+
+ gs_free_tx_context(txc);
+
++ atomic_dec(&dev->active_tx_urbs);
++
+ netif_wake_queue(netdev);
+ }
+
+@@ -463,14 +465,6 @@ static void gs_usb_xmit_callback(struct
+ urb->transfer_buffer_length,
+ urb->transfer_buffer,
+ urb->transfer_dma);
+-
+- atomic_dec(&dev->active_tx_urbs);
+-
+- if (!netif_device_present(netdev))
+- return;
+-
+- if (netif_queue_stopped(netdev))
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
--- /dev/null
+From be94a6f6d488b4767662e8949dc62361bd1d6311 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Fri, 29 Sep 2017 15:24:05 +0200
+Subject: iio: dummy: events: Add missing break
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit be94a6f6d488b4767662e8949dc62361bd1d6311 upstream.
+
+Add missing break in iio_simple_dummy_write_event_config() for the voltage
+threshold event enable attribute. Without this writing to the
+in_voltage0_thresh_rising_en always returns -EINVAL even though the change
+was correctly applied.
+
+Fixes: 3e34e650db197 ("iio: dummy: Demonstrate the usage of new channel types")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/dummy/iio_simple_dummy_events.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/dummy/iio_simple_dummy_events.c
++++ b/drivers/iio/dummy/iio_simple_dummy_events.c
+@@ -72,6 +72,7 @@ int iio_simple_dummy_write_event_config(
+ st->event_en = state;
+ else
+ return -EINVAL;
++ break;
+ default:
+ return -EINVAL;
+ }
--- /dev/null
+From 13923d0865ca96312197962522e88bc0aedccd74 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 9 Oct 2017 12:37:49 -0700
+Subject: KEYS: encrypted: fix dereference of NULL user_key_payload
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 13923d0865ca96312197962522e88bc0aedccd74 upstream.
+
+A key of type "encrypted" references a "master key" which is used to
+encrypt and decrypt the encrypted key's payload. However, when we
+accessed the master key's payload, we failed to handle the case where
+the master key has been revoked, which sets the payload pointer to NULL.
+Note that request_key() *does* skip revoked keys, but there is still a
+window where the key can be revoked before we acquire its semaphore.
+
+Fix it by checking for a NULL payload, treating it like a key which was
+already revoked at the time it was requested.
+
+This was an issue for master keys of type "user" only. Master keys can
+also be of type "trusted", but those cannot be revoked.
+
+Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
+Reviewed-by: James Morris <james.l.morris@oracle.com>
+Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Cc: David Safford <safford@us.ibm.com>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/encrypted-keys/encrypted.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -309,6 +309,13 @@ static struct key *request_user_key(cons
+
+ down_read(&ukey->sem);
+ upayload = user_key_payload_locked(ukey);
++ if (!upayload) {
++ /* key was revoked before we acquired its semaphore */
++ up_read(&ukey->sem);
++ key_put(ukey);
++ ukey = ERR_PTR(-EKEYREVOKED);
++ goto error;
++ }
+ *master_key = upayload->data;
+ *master_keylen = upayload->datalen;
+ error:
--- /dev/null
+From 639812a1ed9bf49ae2c026086fbf975339cd1eef Mon Sep 17 00:00:00 2001
+From: Josef Bacik <jbacik@fb.com>
+Date: Mon, 9 Oct 2017 13:12:10 -0400
+Subject: nbd: don't set the device size until we're connected
+
+From: Josef Bacik <jbacik@fb.com>
+
+commit 639812a1ed9bf49ae2c026086fbf975339cd1eef upstream.
+
+A user reported a regression with using the normal ioctl interface on
+newer kernels. This happens because I was setting the device size
+before the device was actually connected, which caused us to error out
+and close everything down. This didn't happen on netlink because we
+hold the device lock the whole time we're setting things up, but we
+don't do that for the ioctl path. This fixes the problem.
+
+Fixes: 29eaadc ("nbd: stop using the bdev everywhere")
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/nbd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -243,7 +243,6 @@ static void nbd_size_set(struct nbd_devi
+ struct nbd_config *config = nbd->config;
+ config->blksize = blocksize;
+ config->bytesize = blocksize * nr_blocks;
+- nbd_size_update(nbd);
+ }
+
+ static void nbd_complete_rq(struct request *req)
+@@ -1090,6 +1089,7 @@ static int nbd_start_device(struct nbd_d
+ args->index = i;
+ queue_work(recv_workqueue, &args->work);
+ }
++ nbd_size_update(nbd);
+ return error;
+ }
+
--- /dev/null
+From 8642b31ba9eef8a01845146a26682d4869e62513 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Wed, 18 Oct 2017 22:25:00 +0200
+Subject: parisc: Fix detection of nonsynchronous cr16 cycle counters
+
+From: Helge Deller <deller@gmx.de>
+
+commit 8642b31ba9eef8a01845146a26682d4869e62513 upstream.
+
+For CPUs which have an unknown or invalid CPU location (physical location)
+assume that their cycle counters aren't syncronized across CPUs.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Fixes: c8c3735997a3 ("parisc: Enhance detection of synchronous cr16 clocksources")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/time.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/parisc/kernel/time.c
++++ b/arch/parisc/kernel/time.c
+@@ -253,7 +253,10 @@ static int __init init_cr16_clocksource(
+ cpu0_loc = per_cpu(cpu_data, 0).cpu_loc;
+
+ for_each_online_cpu(cpu) {
+- if (cpu0_loc == per_cpu(cpu_data, cpu).cpu_loc)
++ if (cpu == 0)
++ continue;
++ if ((cpu0_loc != 0) &&
++ (cpu0_loc == per_cpu(cpu_data, cpu).cpu_loc))
+ continue;
+
+ clocksource_cr16.name = "cr16_unstable";
--- /dev/null
+From 374b3bf8e8b519f61eb9775888074c6e46b3bf0c Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Sat, 30 Sep 2017 17:24:23 -0400
+Subject: parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit 374b3bf8e8b519f61eb9775888074c6e46b3bf0c upstream.
+
+As discussed on the debian-hppa list, double-wordcompare and exchange
+operations fail on 32-bit kernels. Looking at the code, I realized that
+the ",ma" completer does the wrong thing in the "ldw,ma 4(%r26), %r29"
+instruction. This increments %r26 and causes the following store to
+write to the wrong location.
+
+Note by Helge Deller:
+The patch applies cleanly to stable kernel series if this upstream
+commit is merged in advance:
+f4125cfdb300 ("parisc: Avoid trashing sr2 and sr3 in LWS code").
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Tested-by: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
+Fixes: 89206491201c ("parisc: Implement new LWS CAS supporting 64 bit operations.")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/syscall.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -742,7 +742,7 @@ lws_compare_and_swap_2:
+ 10: ldd 0(%r25), %r25
+ 11: ldd 0(%r24), %r24
+ #else
+- /* Load new value into r22/r23 - high/low */
++ /* Load old value into r22/r23 - high/low */
+ 10: ldw 0(%r25), %r22
+ 11: ldw 4(%r25), %r23
+ /* Load new value into fr4 for atomic store later */
+@@ -834,11 +834,11 @@ cas2_action:
+ copy %r0, %r28
+ #else
+ /* Compare first word */
+-19: ldw,ma 0(%r26), %r29
++19: ldw 0(%r26), %r29
+ sub,= %r29, %r22, %r0
+ b,n cas2_end
+ /* Compare second word */
+-20: ldw,ma 4(%r26), %r29
++20: ldw 4(%r26), %r29
+ sub,= %r29, %r23, %r0
+ b,n cas2_end
+ /* Perform the store */
--- /dev/null
+From b7662eef14caf4f582d453d45395825b5a8f594c Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Wed, 4 Oct 2017 14:46:17 +0200
+Subject: s390/cputime: fix guest/irq/softirq times after CPU hotplug
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+commit b7662eef14caf4f582d453d45395825b5a8f594c upstream.
+
+On CPU hotplug some cpu stats contain bogus values:
+
+$ cat /proc/stat
+cpu 0 0 49 1280 0 0 0 3 0 0
+cpu0 0 0 49 618 0 0 0 3 0 0
+cpu1 0 0 0 662 0 0 0 0 0 0
+[...]
+$ echo 0 > /sys/devices/system/cpu/cpu1/online
+$ echo 1 > /sys/devices/system/cpu/cpu1/online
+$ cat /proc/stat
+cpu 0 0 49 3200 0 450359962737 450359962737 3 0 0
+cpu0 0 0 49 1956 0 0 0 3 0 0
+cpu1 0 0 0 1244 0 450359962737 450359962737 0 0 0
+[...]
+
+pcpu_attach_task() needs the same assignments as vtime_task_switch.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Fixes: b7394a5f4ce9 ("sched/cputime, s390: Implement delayed accounting of system time")
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/smp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -293,7 +293,10 @@ static void pcpu_attach_task(struct pcpu
+ lc->lpp = LPP_MAGIC;
+ lc->current_pid = tsk->pid;
+ lc->user_timer = tsk->thread.user_timer;
++ lc->guest_timer = tsk->thread.guest_timer;
+ lc->system_timer = tsk->thread.system_timer;
++ lc->hardirq_timer = tsk->thread.hardirq_timer;
++ lc->softirq_timer = tsk->thread.softirq_timer;
+ lc->steal_timer = 0;
+ }
+
--- /dev/null
+From a9e170e28636fd577249f39029d59e4e960a42b8 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 10 Oct 2017 12:08:22 -0700
+Subject: scsi: qla2xxx: Fix uninitialized work element
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit a9e170e28636fd577249f39029d59e4e960a42b8 upstream.
+
+Fixes following stack trace
+
+kernel: Call Trace:
+kernel: dump_stack+0x63/0x84
+kernel: __warn+0xd1/0xf0
+kernel: warn_slowpath_null+0x1d/0x20
+kernel: __queue_work+0x37a/0x420
+kernel: queue_work_on+0x27/0x40
+kernel: queue_work+0x14/0x20 [qla2xxx]
+kernel: schedule_work+0x13/0x20 [qla2xxx]
+kernel: qla2x00_post_work+0xab/0xb0 [qla2xxx]
+kernel: qla2x00_post_aen_work+0x3b/0x50 [qla2xxx]
+kernel: qla2x00_async_event+0x20d/0x15d0 [qla2xxx]
+kernel: ? lock_timer_base+0x7d/0xa0
+kernel: qla24xx_intr_handler+0x1da/0x310 [qla2xxx]
+kernel: qla2x00_poll+0x36/0x60 [qla2xxx]
+kernel: qla2x00_mailbox_command+0x659/0xec0 [qla2xxx]
+kernel: ? proc_create_data+0x7a/0xd0
+kernel: qla25xx_init_rsp_que+0x15b/0x240 [qla2xxx]
+kernel: ? request_irq+0x14/0x20 [qla2xxx]
+kernel: qla25xx_create_rsp_que+0x256/0x3c0 [qla2xxx]
+kernel: qla2xxx_create_qpair+0x2af/0x5b0 [qla2xxx]
+kernel: qla2x00_probe_one+0x1107/0x1c30 [qla2xxx]
+
+Fixes: ec7193e26055 ("qla2xxx: Fix delayed response to command for loop mode/direct connect.")
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_os.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3165,6 +3165,8 @@ qla2x00_probe_one(struct pci_dev *pdev,
+ host->can_queue, base_vha->req,
+ base_vha->mgmt_svr_loop_id, host->sg_tablesize);
+
++ INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
++
+ if (ha->mqenable) {
+ bool mq = false;
+ bool startit = false;
+@@ -3213,7 +3215,6 @@ qla2x00_probe_one(struct pci_dev *pdev,
+ */
+ qla2xxx_wake_dpc(base_vha);
+
+- INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
+ INIT_WORK(&ha->board_disable, qla2x00_disable_board_on_pci_error);
+
+ if (IS_QLA8031(ha) || IS_MCTP_CAPABLE(ha)) {
staging-bcm2835-audio-fix-memory-corruption.patch
usb-devio-revert-usb-devio-don-t-corrupt-user-memory.patch
+usb-core-fix-out-of-bounds-access-bug-in-usb_get_bos_descriptor.patch
+usb-serial-metro-usb-add-ms7820-device-id.patch
+usb-cdc_acm-add-quirk-for-elatec-twn3.patch
+usb-quirks-add-quirk-for-worlde-mini-midi-keyboard.patch
+usb-hub-allow-reset-retry-for-usb2-devices-on-connect-bounce.patch
+alsa-usb-audio-add-native-dsd-support-for-pro-ject-pre-box-s2-digital.patch
+can-gs_usb-fix-busy-loop-if-no-more-tx-context-is-available.patch
+scsi-qla2xxx-fix-uninitialized-work-element.patch
+nbd-don-t-set-the-device-size-until-we-re-connected.patch
+s390-cputime-fix-guest-irq-softirq-times-after-cpu-hotplug.patch
+parisc-fix-double-word-compare-and-exchange-in-lws-code-on-32-bit-kernels.patch
+parisc-fix-detection-of-nonsynchronous-cr16-cycle-counters.patch
+iio-dummy-events-add-missing-break.patch
+usb-musb-sunxi-explicitly-release-usb-phy-on-exit.patch
+usb-musb-fix-session-bit-runtime-pm-quirk.patch
+usb-musb-fix-late-external-abort-on-suspend.patch
+usb-musb-musb_cppi41-fix-the-address-of-teardown-and-autoreq-registers.patch
+usb-musb-musb_cppi41-fix-cppi41_set_dma_mode-for-da8xx.patch
+usb-musb-musb_cppi41-configure-the-number-of-channels-for-da8xx.patch
+usb-musb-check-for-host-mode-using-is_host_active-on-reset-interrupt.patch
+xhci-identify-usb-3.1-capable-hosts-by-their-port-protocol-capability.patch
+xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch
+usb-xhci-reset-halted-endpoint-if-trb-is-noop.patch
+usb-xhci-handle-error-condition-in-xhci_stop_device.patch
+can-esd_usb2-fix-can_dlc-value-for-received-rtr-frames.patch
+can-af_can-can_pernet_init-add-missing-error-handling-for-kzalloc-returning-null.patch
+can-flexcan-fix-state-transition-regression.patch
+can-flexcan-rename-legacy-error-state-quirk.patch
+can-flexcan-implement-error-passive-state-quirk.patch
+can-flexcan-fix-i.mx6-state-transition-issue.patch
+can-flexcan-fix-i.mx28-state-transition-issue.patch
+can-flexcan-fix-p1010-state-transition-issue.patch
+keys-encrypted-fix-dereference-of-null-user_key_payload.patch
--- /dev/null
+From 765fb2f181cad669f2beb87842a05d8071f2be85 Mon Sep 17 00:00:00 2001
+From: Maksim Salau <msalau@iotecha.com>
+Date: Wed, 11 Oct 2017 11:10:52 +0300
+Subject: usb: cdc_acm: Add quirk for Elatec TWN3
+
+From: Maksim Salau <msalau@iotecha.com>
+
+commit 765fb2f181cad669f2beb87842a05d8071f2be85 upstream.
+
+Elatec TWN3 has the union descriptor on data interface. This results in
+failure to bind the device to the driver with the following log:
+ usb 1-1.2: new full speed USB device using streamplug-ehci and address 4
+ usb 1-1.2: New USB device found, idVendor=09d8, idProduct=0320
+ usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
+ usb 1-1.2: Product: RFID Device (COM)
+ usb 1-1.2: Manufacturer: OEM
+ cdc_acm 1-1.2:1.0: Zero length descriptor references
+ cdc_acm: probe of 1-1.2:1.0 failed with error -22
+
+Adding the NO_UNION_NORMAL quirk for the device fixes the issue.
+
+`lsusb -v` of the device:
+
+Bus 001 Device 003: ID 09d8:0320
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 2.00
+ bDeviceClass 2 Communications
+ bDeviceSubClass 0
+ bDeviceProtocol 0
+ bMaxPacketSize0 32
+ idVendor 0x09d8
+ idProduct 0x0320
+ bcdDevice 3.00
+ iManufacturer 1 OEM
+ iProduct 2 RFID Device (COM)
+ iSerial 0
+ bNumConfigurations 1
+ Configuration Descriptor:
+ bLength 9
+ bDescriptorType 2
+ wTotalLength 67
+ bNumInterfaces 2
+ bConfigurationValue 1
+ iConfiguration 0
+ bmAttributes 0x80
+ (Bus Powered)
+ MaxPower 250mA
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 0
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 2 Abstract (modem)
+ bInterfaceProtocol 1 AT-commands (v.25ter)
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x83 EP 3 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0020 1x 32 bytes
+ bInterval 2
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 1
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0 Unused
+ bInterfaceProtocol 0
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x02 EP 2 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0020 1x 32 bytes
+ bInterval 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x81 EP 1 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0020 1x 32 bytes
+ bInterval 0
+ CDC Header:
+ bcdCDC 1.10
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 1
+ CDC ACM:
+ bmCapabilities 0x06
+ sends break
+ line coding and serial state
+ CDC Union:
+ bMasterInterface 0
+ bSlaveInterface 1
+Device Status: 0x0000
+ (Bus Powered)
+
+Signed-off-by: Maksim Salau <msalau@iotecha.com>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1832,6 +1832,9 @@ static const struct usb_device_id acm_id
+ { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
+ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+ },
++ { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
++ .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
++ },
+
+ { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
+ .driver_info = CLEAR_HALT_CONDITIONS,
--- /dev/null
+From 1c0edc3633b56000e18d82fc241e3995ca18a69e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 18 Oct 2017 12:49:38 -0400
+Subject: USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 1c0edc3633b56000e18d82fc241e3995ca18a69e upstream.
+
+Andrey used the syzkaller fuzzer to find an out-of-bounds memory
+access in usb_get_bos_descriptor(). The code wasn't checking that the
+next usb_dev_cap_header structure could fit into the remaining buffer
+space.
+
+This patch fixes the error and also reduces the bNumDeviceCaps field
+in the header to match the actual number of capabilities found, in
+cases where there are fewer than expected.
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -960,10 +960,12 @@ int usb_get_bos_descriptor(struct usb_de
+ for (i = 0; i < num; i++) {
+ buffer += length;
+ cap = (struct usb_dev_cap_header *)buffer;
+- length = cap->bLength;
+
+- if (total_len < length)
++ if (total_len < sizeof(*cap) || total_len < cap->bLength) {
++ dev->bos->desc->bNumDeviceCaps = i;
+ break;
++ }
++ length = cap->bLength;
+ total_len -= length;
+
+ if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
--- /dev/null
+From 1ac7db63333db1eeff901bfd6bbcd502b4634fa4 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 17 Oct 2017 16:07:33 +0300
+Subject: usb: hub: Allow reset retry for USB2 devices on connect bounce
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 1ac7db63333db1eeff901bfd6bbcd502b4634fa4 upstream.
+
+If the connect status change is set during reset signaling, but
+the status remains connected just retry port reset.
+
+This solves an issue with connecting a 90W HP Thunderbolt 3 dock
+with a Lenovo Carbon x1 (5th generation) which causes a 30min loop
+of a high speed device being re-discovererd before usb ports starts
+working.
+
+[...]
+[ 389.023845] usb 3-1: new high-speed USB device number 55 using xhci_hcd
+[ 389.491841] usb 3-1: new high-speed USB device number 56 using xhci_hcd
+[ 389.959928] usb 3-1: new high-speed USB device number 57 using xhci_hcd
+[...]
+
+This is caused by a high speed device that doesn't successfully go to the
+enabled state after the second port reset. Instead the connection bounces
+(connected, with connect status change), bailing out completely from
+enumeration just to restart from scratch.
+
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1716332
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2710,13 +2710,16 @@ static int hub_port_wait_reset(struct us
+ if (!(portstatus & USB_PORT_STAT_CONNECTION))
+ return -ENOTCONN;
+
+- /* bomb out completely if the connection bounced. A USB 3.0
+- * connection may bounce if multiple warm resets were issued,
++ /* Retry if connect change is set but status is still connected.
++ * A USB 3.0 connection may bounce if multiple warm resets were issued,
+ * but the device may have successfully re-connected. Ignore it.
+ */
+ if (!hub_is_superspeed(hub->hdev) &&
+- (portchange & USB_PORT_STAT_C_CONNECTION))
+- return -ENOTCONN;
++ (portchange & USB_PORT_STAT_C_CONNECTION)) {
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_CONNECTION);
++ return -EAGAIN;
++ }
+
+ if (!(portstatus & USB_PORT_STAT_ENABLE))
+ return -EBUSY;
--- /dev/null
+From 445ef61543da3db5b699f87fb0aa4f227165f6ed Mon Sep 17 00:00:00 2001
+From: Jonathan Liu <net147@gmail.com>
+Date: Mon, 9 Oct 2017 22:46:12 -0500
+Subject: usb: musb: Check for host-mode using is_host_active() on reset interrupt
+
+From: Jonathan Liu <net147@gmail.com>
+
+commit 445ef61543da3db5b699f87fb0aa4f227165f6ed upstream.
+
+The sunxi musb has a bug where sometimes it will generate a babble
+error on device disconnect instead of a disconnect IRQ. When this
+happens the musb controller switches from host mode to device mode
+(it clears MUSB_DEVCTL_HM/MUSB_DEVCTL_SESSION and sets
+MUSB_DEVCTL_BDEVICE) and gets stuck in this state.
+
+The babble error is misdetected as a bus reset because MUSB_DEVCTL_HM
+was cleared.
+
+To fix this, use is_host_active() rather than (devctl & MUSB_DEVCTL_HM)
+to detect babble error so that sunxi musb babble recovery can handle it
+by restoring the mode. This information is provided by the driver logic
+and does not rely on register contents.
+
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_core.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -906,7 +906,7 @@ b_host:
+ */
+ if (int_usb & MUSB_INTR_RESET) {
+ handled = IRQ_HANDLED;
+- if (devctl & MUSB_DEVCTL_HM) {
++ if (is_host_active(musb)) {
+ /*
+ * When BABBLE happens what we can depends on which
+ * platform MUSB is running, because some platforms
+@@ -916,9 +916,7 @@ b_host:
+ * drop the session.
+ */
+ dev_err(musb->controller, "Babble\n");
+-
+- if (is_host_active(musb))
+- musb_recover_from_babble(musb);
++ musb_recover_from_babble(musb);
+ } else {
+ musb_dbg(musb, "BUS RESET as %s",
+ usb_otg_state_string(musb->xceiv->otg->state));
--- /dev/null
+From 0c3aae9bd59978fb8c3557d7883380bef0f2cfa1 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 9 Oct 2017 22:46:08 -0500
+Subject: USB: musb: fix late external abort on suspend
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 0c3aae9bd59978fb8c3557d7883380bef0f2cfa1 upstream.
+
+The musb delayed irq work was never flushed on suspend, something which
+since 4.9 can lead to an external abort if the work is scheduled after
+the grandparent's clock has been disabled:
+
+PM: Suspending system (mem)
+PM: suspend of devices complete after 125.224 msecs
+PM: suspend devices took 0.132 seconds
+PM: late suspend of devices complete after 7.423 msecs
+PM: noirq suspend of devices complete after 7.083 msecs
+suspend debug: Waiting for 5 second(s).
+Unhandled fault: external abort on non-linefetch (0x1008) at 0xd0262c60
+...
+[<c054880c>] (musb_default_readb) from [<c0547b5c>] (musb_irq_work+0x48/0x220)
+[<c0547b5c>] (musb_irq_work) from [<c014f8a4>] (process_one_work+0x1f4/0x758)
+[<c014f8a4>] (process_one_work) from [<c014fe5c>] (worker_thread+0x54/0x514)
+[<c014fe5c>] (worker_thread) from [<c015704c>] (kthread+0x128/0x158)
+[<c015704c>] (kthread) from [<c0109330>] (ret_from_fork+0x14/0x24)
+
+Commit 2bff3916fda9 ("usb: musb: Fix PM for hub disconnect") started
+scheduling musb_irq_work with a delay of up to a second and with
+retries thereby making this easy to trigger, for example, by suspending
+shortly after a disconnect.
+
+Note that we set a flag to prevent the irq work from rescheduling itself
+during suspend and instead process a disconnect immediately. This takes
+care of the case where we are disconnected shortly before suspending.
+
+However, when in host mode, a disconnect while suspended will still
+go unnoticed and thus prevent the controller from runtime suspending
+upon resume as the session bit is always set. This will need to be
+addressed separately.
+
+Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
+Fixes: 467d5c980709 ("usb: musb: Implement session bit based runtime PM for musb-core")
+Fixes: 2bff3916fda9 ("usb: musb: Fix PM for hub disconnect")
+Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
+Cc: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_core.c | 11 +++++++++--
+ drivers/usb/musb/musb_core.h | 2 ++
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1861,7 +1861,7 @@ static void musb_pm_runtime_check_sessio
+ MUSB_DEVCTL_HR;
+ switch (devctl & ~s) {
+ case MUSB_QUIRK_B_INVALID_VBUS_91:
+- if (musb->quirk_retries) {
++ if (musb->quirk_retries && !musb->flush_irq_work) {
+ musb_dbg(musb,
+ "Poll devctl on invalid vbus, assume no session");
+ schedule_delayed_work(&musb->irq_work,
+@@ -1871,7 +1871,7 @@ static void musb_pm_runtime_check_sessio
+ }
+ /* fall through */
+ case MUSB_QUIRK_A_DISCONNECT_19:
+- if (musb->quirk_retries) {
++ if (musb->quirk_retries && !musb->flush_irq_work) {
+ musb_dbg(musb,
+ "Poll devctl on possible host mode disconnect");
+ schedule_delayed_work(&musb->irq_work,
+@@ -2681,8 +2681,15 @@ static int musb_suspend(struct device *d
+
+ musb_platform_disable(musb);
+ musb_disable_interrupts(musb);
++
++ musb->flush_irq_work = true;
++ while (flush_delayed_work(&musb->irq_work))
++ ;
++ musb->flush_irq_work = false;
++
+ if (!(musb->io.quirks & MUSB_PRESERVE_SESSION))
+ musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
++
+ WARN_ON(!list_empty(&musb->pending_list));
+
+ spin_lock_irqsave(&musb->lock, flags);
+--- a/drivers/usb/musb/musb_core.h
++++ b/drivers/usb/musb/musb_core.h
+@@ -428,6 +428,8 @@ struct musb {
+ unsigned test_mode:1;
+ unsigned softconnect:1;
+
++ unsigned flush_irq_work:1;
++
+ u8 address;
+ u8 test_mode_nr;
+ u16 ackpend; /* ep0 */
--- /dev/null
+From 4f190e0b9de89c4c917c3ffb3799e9d00fc534ac Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 9 Oct 2017 22:46:07 -0500
+Subject: USB: musb: fix session-bit runtime-PM quirk
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 4f190e0b9de89c4c917c3ffb3799e9d00fc534ac upstream.
+
+The current session-bit quirk implementation does not prevent the retry
+counter from underflowing, something which could break runtime PM and
+keep the device active for a very long time (about 2^32 seconds) after a
+disconnect.
+
+This notably breaks the B-device timeout case, but could potentially
+cause problems also when the controller is operating as an A-device.
+
+Fixes: 2bff3916fda9 ("usb: musb: Fix PM for hub disconnect")
+Cc: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1861,22 +1861,22 @@ static void musb_pm_runtime_check_sessio
+ MUSB_DEVCTL_HR;
+ switch (devctl & ~s) {
+ case MUSB_QUIRK_B_INVALID_VBUS_91:
+- if (musb->quirk_retries--) {
++ if (musb->quirk_retries) {
+ musb_dbg(musb,
+ "Poll devctl on invalid vbus, assume no session");
+ schedule_delayed_work(&musb->irq_work,
+ msecs_to_jiffies(1000));
+-
++ musb->quirk_retries--;
+ return;
+ }
+ /* fall through */
+ case MUSB_QUIRK_A_DISCONNECT_19:
+- if (musb->quirk_retries--) {
++ if (musb->quirk_retries) {
+ musb_dbg(musb,
+ "Poll devctl on possible host mode disconnect");
+ schedule_delayed_work(&musb->irq_work,
+ msecs_to_jiffies(1000));
+-
++ musb->quirk_retries--;
+ return;
+ }
+ if (!musb->session)
--- /dev/null
+From 297d7fe9e439473800ab1f2f853b4b5f8c888500 Mon Sep 17 00:00:00 2001
+From: Alexandre Bailon <abailon@baylibre.com>
+Date: Mon, 9 Oct 2017 22:46:11 -0500
+Subject: usb: musb: musb_cppi41: Configure the number of channels for DA8xx
+
+From: Alexandre Bailon <abailon@baylibre.com>
+
+commit 297d7fe9e439473800ab1f2f853b4b5f8c888500 upstream.
+
+Currently, the number of channels is set to 15 but in the case of DA8xx,
+the number of channels is 4.
+Update the driver to configure the number of channels at runtime.
+
+Signed-off-by: Alexandre Bailon <abailon@baylibre.com>
+Tested-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_cppi41.c | 31 ++++++++++++++++++++++++++-----
+ 1 file changed, 26 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -30,10 +30,12 @@
+ #define DA8XX_USB_AUTOREQ 0x14
+ #define DA8XX_USB_TEARDOWN 0x1c
+
++#define DA8XX_DMA_NUM_CHANNELS 4
++
+ struct cppi41_dma_controller {
+ struct dma_controller controller;
+- struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS];
+- struct cppi41_dma_channel tx_channel[MUSB_DMA_NUM_CHANNELS];
++ struct cppi41_dma_channel *rx_channel;
++ struct cppi41_dma_channel *tx_channel;
+ struct hrtimer early_tx;
+ struct list_head early_tx_list;
+ u32 rx_mode;
+@@ -45,6 +47,7 @@ struct cppi41_dma_controller {
+
+ void (*set_dma_mode)(struct cppi41_dma_channel *cppi41_channel,
+ unsigned int mode);
++ u8 num_channels;
+ };
+
+ static void save_rx_toggle(struct cppi41_dma_channel *cppi41_channel)
+@@ -483,7 +486,7 @@ static struct dma_channel *cppi41_dma_ch
+ struct cppi41_dma_channel *cppi41_channel = NULL;
+ u8 ch_num = hw_ep->epnum - 1;
+
+- if (ch_num >= MUSB_DMA_NUM_CHANNELS)
++ if (ch_num >= controller->num_channels)
+ return NULL;
+
+ if (is_tx)
+@@ -643,7 +646,7 @@ static void cppi41_release_all_dma_chans
+ struct dma_chan *dc;
+ int i;
+
+- for (i = 0; i < MUSB_DMA_NUM_CHANNELS; i++) {
++ for (i = 0; i < ctrl->num_channels; i++) {
+ dc = ctrl->tx_channel[i].dc;
+ if (dc)
+ dma_release_channel(dc);
+@@ -695,7 +698,7 @@ static int cppi41_dma_controller_start(s
+ goto err;
+
+ ret = -EINVAL;
+- if (port > MUSB_DMA_NUM_CHANNELS || !port)
++ if (port > controller->num_channels || !port)
+ goto err;
+ if (is_tx)
+ cppi41_channel = &controller->tx_channel[port - 1];
+@@ -736,6 +739,8 @@ void cppi41_dma_controller_destroy(struc
+
+ hrtimer_cancel(&controller->early_tx);
+ cppi41_dma_controller_stop(controller);
++ kfree(controller->rx_channel);
++ kfree(controller->tx_channel);
+ kfree(controller);
+ }
+ EXPORT_SYMBOL_GPL(cppi41_dma_controller_destroy);
+@@ -744,6 +749,7 @@ struct dma_controller *
+ cppi41_dma_controller_create(struct musb *musb, void __iomem *base)
+ {
+ struct cppi41_dma_controller *controller;
++ int channel_size;
+ int ret = 0;
+
+ if (!musb->controller->parent->of_node) {
+@@ -770,18 +776,33 @@ cppi41_dma_controller_create(struct musb
+ controller->tdown_reg = DA8XX_USB_TEARDOWN;
+ controller->autoreq_reg = DA8XX_USB_AUTOREQ;
+ controller->set_dma_mode = da8xx_set_dma_mode;
++ controller->num_channels = DA8XX_DMA_NUM_CHANNELS;
+ } else {
+ controller->tdown_reg = USB_TDOWN;
+ controller->autoreq_reg = USB_CTRL_AUTOREQ;
+ controller->set_dma_mode = cppi41_set_dma_mode;
++ controller->num_channels = MUSB_DMA_NUM_CHANNELS;
+ }
+
++ channel_size = controller->num_channels *
++ sizeof(struct cppi41_dma_channel);
++ controller->rx_channel = kzalloc(channel_size, GFP_KERNEL);
++ if (!controller->rx_channel)
++ goto rx_channel_alloc_fail;
++ controller->tx_channel = kzalloc(channel_size, GFP_KERNEL);
++ if (!controller->tx_channel)
++ goto tx_channel_alloc_fail;
++
+ ret = cppi41_dma_controller_start(controller);
+ if (ret)
+ goto plat_get_fail;
+ return &controller->controller;
+
+ plat_get_fail:
++ kfree(controller->tx_channel);
++tx_channel_alloc_fail:
++ kfree(controller->rx_channel);
++rx_channel_alloc_fail:
+ kfree(controller);
+ kzalloc_fail:
+ if (ret == -EPROBE_DEFER)
--- /dev/null
+From e10c5b0c773efb8643ee89d387d310584ca30830 Mon Sep 17 00:00:00 2001
+From: Alexandre Bailon <abailon@baylibre.com>
+Date: Mon, 9 Oct 2017 22:46:10 -0500
+Subject: usb: musb: musb_cppi41: Fix cppi41_set_dma_mode() for DA8xx
+
+From: Alexandre Bailon <abailon@baylibre.com>
+
+commit e10c5b0c773efb8643ee89d387d310584ca30830 upstream.
+
+The way to configure the DMA mode on DA8xx is different from DSPS.
+Add a new function to configure DMA mode on DA8xx and use a callback
+to call the right function based on the platform.
+
+Signed-off-by: Alexandre Bailon <abailon@baylibre.com>
+Tested-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_cppi41.c | 40 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 37 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -26,6 +26,7 @@
+
+ #define MUSB_DMA_NUM_CHANNELS 15
+
++#define DA8XX_USB_MODE 0x10
+ #define DA8XX_USB_AUTOREQ 0x14
+ #define DA8XX_USB_TEARDOWN 0x1c
+
+@@ -41,6 +42,9 @@ struct cppi41_dma_controller {
+
+ u32 tdown_reg;
+ u32 autoreq_reg;
++
++ void (*set_dma_mode)(struct cppi41_dma_channel *cppi41_channel,
++ unsigned int mode);
+ };
+
+ static void save_rx_toggle(struct cppi41_dma_channel *cppi41_channel)
+@@ -355,6 +359,32 @@ static void cppi41_set_dma_mode(struct c
+ }
+ }
+
++static void da8xx_set_dma_mode(struct cppi41_dma_channel *cppi41_channel,
++ unsigned int mode)
++{
++ struct cppi41_dma_controller *controller = cppi41_channel->controller;
++ struct musb *musb = controller->controller.musb;
++ unsigned int shift;
++ u32 port;
++ u32 new_mode;
++ u32 old_mode;
++
++ old_mode = controller->tx_mode;
++ port = cppi41_channel->port_num;
++
++ shift = (port - 1) * 4;
++ if (!cppi41_channel->is_tx)
++ shift += 16;
++ new_mode = old_mode & ~(3 << shift);
++ new_mode |= mode << shift;
++
++ if (new_mode == old_mode)
++ return;
++ controller->tx_mode = new_mode;
++ musb_writel(musb->ctrl_base, DA8XX_USB_MODE, new_mode);
++}
++
++
+ static void cppi41_set_autoreq_mode(struct cppi41_dma_channel *cppi41_channel,
+ unsigned mode)
+ {
+@@ -379,6 +409,7 @@ static bool cppi41_configure_channel(str
+ dma_addr_t dma_addr, u32 len)
+ {
+ struct cppi41_dma_channel *cppi41_channel = channel->private_data;
++ struct cppi41_dma_controller *controller = cppi41_channel->controller;
+ struct dma_chan *dc = cppi41_channel->dc;
+ struct dma_async_tx_descriptor *dma_desc;
+ enum dma_transfer_direction direction;
+@@ -404,7 +435,7 @@ static bool cppi41_configure_channel(str
+ musb_writel(musb->ctrl_base,
+ RNDIS_REG(cppi41_channel->port_num), len);
+ /* gen rndis */
+- cppi41_set_dma_mode(cppi41_channel,
++ controller->set_dma_mode(cppi41_channel,
+ EP_MODE_DMA_GEN_RNDIS);
+
+ /* auto req */
+@@ -413,14 +444,15 @@ static bool cppi41_configure_channel(str
+ } else {
+ musb_writel(musb->ctrl_base,
+ RNDIS_REG(cppi41_channel->port_num), 0);
+- cppi41_set_dma_mode(cppi41_channel,
++ controller->set_dma_mode(cppi41_channel,
+ EP_MODE_DMA_TRANSPARENT);
+ cppi41_set_autoreq_mode(cppi41_channel,
+ EP_MODE_AUTOREQ_NONE);
+ }
+ } else {
+ /* fallback mode */
+- cppi41_set_dma_mode(cppi41_channel, EP_MODE_DMA_TRANSPARENT);
++ controller->set_dma_mode(cppi41_channel,
++ EP_MODE_DMA_TRANSPARENT);
+ cppi41_set_autoreq_mode(cppi41_channel, EP_MODE_AUTOREQ_NONE);
+ len = min_t(u32, packet_sz, len);
+ }
+@@ -737,9 +769,11 @@ cppi41_dma_controller_create(struct musb
+ if (musb->io.quirks & MUSB_DA8XX) {
+ controller->tdown_reg = DA8XX_USB_TEARDOWN;
+ controller->autoreq_reg = DA8XX_USB_AUTOREQ;
++ controller->set_dma_mode = da8xx_set_dma_mode;
+ } else {
+ controller->tdown_reg = USB_TDOWN;
+ controller->autoreq_reg = USB_CTRL_AUTOREQ;
++ controller->set_dma_mode = cppi41_set_dma_mode;
+ }
+
+ ret = cppi41_dma_controller_start(controller);
--- /dev/null
+From bfa53e0e366b98185fadb03f7916d1538cb90ebd Mon Sep 17 00:00:00 2001
+From: Alexandre Bailon <abailon@baylibre.com>
+Date: Mon, 9 Oct 2017 22:46:09 -0500
+Subject: usb: musb: musb_cppi41: Fix the address of teardown and autoreq registers
+
+From: Alexandre Bailon <abailon@baylibre.com>
+
+commit bfa53e0e366b98185fadb03f7916d1538cb90ebd upstream.
+
+The DA8xx and DSPS platforms don't use the same address for few registers.
+On Da8xx, this is causing some issues (e.g. teardown that doesn't work).
+Configure the address of the register during the init and use them instead
+of constants.
+
+Reported-by: nsekhar@ti.com
+Signed-off-by: Alexandre Bailon <abailon@baylibre.com>
+Tested-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_cppi41.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -26,6 +26,9 @@
+
+ #define MUSB_DMA_NUM_CHANNELS 15
+
++#define DA8XX_USB_AUTOREQ 0x14
++#define DA8XX_USB_TEARDOWN 0x1c
++
+ struct cppi41_dma_controller {
+ struct dma_controller controller;
+ struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS];
+@@ -35,6 +38,9 @@ struct cppi41_dma_controller {
+ u32 rx_mode;
+ u32 tx_mode;
+ u32 auto_req;
++
++ u32 tdown_reg;
++ u32 autoreq_reg;
+ };
+
+ static void save_rx_toggle(struct cppi41_dma_channel *cppi41_channel)
+@@ -364,8 +370,8 @@ static void cppi41_set_autoreq_mode(stru
+ if (new_mode == old_mode)
+ return;
+ controller->auto_req = new_mode;
+- musb_writel(controller->controller.musb->ctrl_base, USB_CTRL_AUTOREQ,
+- new_mode);
++ musb_writel(controller->controller.musb->ctrl_base,
++ controller->autoreq_reg, new_mode);
+ }
+
+ static bool cppi41_configure_channel(struct dma_channel *channel,
+@@ -581,12 +587,13 @@ static int cppi41_dma_channel_abort(stru
+
+ do {
+ if (is_tx)
+- musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
++ musb_writel(musb->ctrl_base, controller->tdown_reg,
++ tdbit);
+ ret = dmaengine_terminate_all(cppi41_channel->dc);
+ } while (ret == -EAGAIN);
+
+ if (is_tx) {
+- musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
++ musb_writel(musb->ctrl_base, controller->tdown_reg, tdbit);
+
+ csr = musb_readw(epio, MUSB_TXCSR);
+ if (csr & MUSB_TXCSR_TXPKTRDY) {
+@@ -727,6 +734,14 @@ cppi41_dma_controller_create(struct musb
+ controller->controller.is_compatible = cppi41_is_compatible;
+ controller->controller.musb = musb;
+
++ if (musb->io.quirks & MUSB_DA8XX) {
++ controller->tdown_reg = DA8XX_USB_TEARDOWN;
++ controller->autoreq_reg = DA8XX_USB_AUTOREQ;
++ } else {
++ controller->tdown_reg = USB_TDOWN;
++ controller->autoreq_reg = USB_CTRL_AUTOREQ;
++ }
++
+ ret = cppi41_dma_controller_start(controller);
+ if (ret)
+ goto plat_get_fail;
--- /dev/null
+From 6ed05c68cbcae42cd52b8e53b66952bfa9c002ce Mon Sep 17 00:00:00 2001
+From: Jonathan Liu <net147@gmail.com>
+Date: Mon, 9 Oct 2017 22:46:13 -0500
+Subject: usb: musb: sunxi: Explicitly release USB PHY on exit
+
+From: Jonathan Liu <net147@gmail.com>
+
+commit 6ed05c68cbcae42cd52b8e53b66952bfa9c002ce upstream.
+
+This fixes a kernel oops when unloading the driver due to usb_put_phy
+being called after usb_phy_generic_unregister when the device is
+detached. Calling usb_phy_generic_unregister causes x->dev->driver to
+be NULL in usb_put_phy and results in a NULL pointer dereference.
+
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/sunxi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/musb/sunxi.c
++++ b/drivers/usb/musb/sunxi.c
+@@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *
+ if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags))
+ sunxi_sram_release(musb->controller->parent);
+
++ devm_usb_put_phy(glue->dev, glue->xceiv);
++
+ return 0;
+ }
+
--- /dev/null
+From 2811501e6d8f5747d08f8e25b9ecf472d0dc4c7d Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Tue, 3 Oct 2017 11:16:43 +0300
+Subject: usb: quirks: add quirk for WORLDE MINI MIDI keyboard
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 2811501e6d8f5747d08f8e25b9ecf472d0dc4c7d upstream.
+
+This keyboard doesn't implement Get String descriptors properly even
+though string indexes are valid. What happens is that when requesting
+for the String descriptor, the device disconnects and
+reconnects. Without this quirk, this loop will continue forever.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Владимир Мартьянов <vilgeforce@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -221,6 +221,10 @@ static const struct usb_device_id usb_qu
+ /* Corsair Strafe RGB */
+ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* MIDI keyboard WORLDE MINI */
++ { USB_DEVICE(0x1c75, 0x0204), .driver_info =
++ USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* Acer C120 LED Projector */
+ { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
+
--- /dev/null
+From 31dc3f819bac28a0990b36510197560258ab7421 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 12 Oct 2017 14:50:46 +0200
+Subject: USB: serial: metro-usb: add MS7820 device id
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 31dc3f819bac28a0990b36510197560258ab7421 upstream.
+
+Add device-id entry for (Honeywell) Metrologic MS7820 bar code scanner.
+
+The device has two interfaces (in this mode?); a vendor-specific
+interface with two interrupt endpoints and a second HID interface, which
+we do not bind to.
+
+Reported-by: Ladislav Dobrovsky <ladislav.dobrovsky@gmail.com>
+Tested-by: Ladislav Dobrovsky <ladislav.dobrovsky@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/metro-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/metro-usb.c
++++ b/drivers/usb/serial/metro-usb.c
+@@ -45,6 +45,7 @@ struct metrousb_private {
+ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) },
+ { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) },
++ { USB_DEVICE_INTERFACE_CLASS(0x0c2e, 0x0730, 0xff) }, /* MS7820 */
+ { }, /* Terminating entry. */
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
--- /dev/null
+From b3207c65dfafae27e7c492cb9188c0dc0eeaf3fd Mon Sep 17 00:00:00 2001
+From: Mayank Rana <mrana@codeaurora.org>
+Date: Fri, 6 Oct 2017 17:45:30 +0300
+Subject: usb: xhci: Handle error condition in xhci_stop_device()
+
+From: Mayank Rana <mrana@codeaurora.org>
+
+commit b3207c65dfafae27e7c492cb9188c0dc0eeaf3fd upstream.
+
+xhci_stop_device() calls xhci_queue_stop_endpoint() multiple times
+without checking the return value. xhci_queue_stop_endpoint() can
+return error if the HC is already halted or unable to queue commands.
+This can cause a deadlock condition as xhci_stop_device() would
+end up waiting indefinitely for a completion for the command that
+didn't get queued. Fix this by checking the return value and bailing
+out of xhci_stop_device() in case of error. This patch happens to fix
+potential memory leaks of the allocated command structures as well.
+
+Fixes: c311e391a7ef ("xhci: rework command timeout and cancellation,")
+Signed-off-by: Mayank Rana <mrana@codeaurora.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -420,14 +420,25 @@ static int xhci_stop_device(struct xhci_
+ GFP_NOWAIT);
+ if (!command) {
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_free_command(xhci, cmd);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto cmd_cleanup;
++ }
++
++ ret = xhci_queue_stop_endpoint(xhci, command, slot_id,
++ i, suspend);
++ if (ret) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_free_command(xhci, command);
++ goto cmd_cleanup;
+ }
+- xhci_queue_stop_endpoint(xhci, command, slot_id, i,
+- suspend);
+ }
+ }
+- xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend);
++ ret = xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend);
++ if (ret) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ goto cmd_cleanup;
++ }
++
+ xhci_ring_cmd_db(xhci);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+
+@@ -439,6 +450,8 @@ static int xhci_stop_device(struct xhci_
+ xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
+ ret = -ETIME;
+ }
++
++cmd_cleanup:
+ xhci_free_command(xhci, cmd);
+ return ret;
+ }
--- /dev/null
+From 810a624bd1b64b13ddcc2eb5c1880526a750a870 Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Fri, 6 Oct 2017 17:45:29 +0300
+Subject: usb: xhci: Reset halted endpoint if trb is noop
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit 810a624bd1b64b13ddcc2eb5c1880526a750a870 upstream.
+
+When a URB is cancled, xhci driver turns the untransferred trbs
+into no-ops. If an endpoint stalls on a no-op trb that belongs
+to the cancelled URB, the event handler won't reset the endpoint.
+Hence, it will stay halted.
+
+Link: http://marc.info/?l=linux-usb&m=149582598330127&w=2
+
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2578,15 +2578,21 @@ static int handle_tx_event(struct xhci_h
+ (struct xhci_generic_trb *) ep_trb);
+
+ /*
+- * No-op TRB should not trigger interrupts.
+- * If ep_trb is a no-op TRB, it means the
+- * corresponding TD has been cancelled. Just ignore
+- * the TD.
++ * No-op TRB could trigger interrupts in a case where
++ * a URB was killed and a STALL_ERROR happens right
++ * after the endpoint ring stopped. Reset the halted
++ * endpoint. Otherwise, the endpoint remains stalled
++ * indefinitely.
+ */
+ if (trb_is_noop(ep_trb)) {
+- xhci_dbg(xhci,
+- "ep_trb is a no-op TRB. Skip it for slot %u ep %u\n",
+- slot_id, ep_index);
++ if (trb_comp_code == COMP_STALL_ERROR ||
++ xhci_requires_manual_halt_cleanup(xhci, ep_ctx,
++ trb_comp_code))
++ xhci_cleanup_halted_endpoint(xhci, slot_id,
++ ep_index,
++ ep_ring->stream_id,
++ td, ep_trb,
++ EP_HARD_RESET);
+ goto cleanup;
+ }
+
--- /dev/null
+From d1aad52cf8b3f95dfe9b5b64da66343306ddf73b Mon Sep 17 00:00:00 2001
+From: Jeffy Chen <jeffy.chen@rock-chips.com>
+Date: Fri, 6 Oct 2017 17:45:28 +0300
+Subject: xhci: Cleanup current_cmd in xhci_cleanup_command_queue()
+
+From: Jeffy Chen <jeffy.chen@rock-chips.com>
+
+commit d1aad52cf8b3f95dfe9b5b64da66343306ddf73b upstream.
+
+KASAN reported use-after-free bug when xhci host controller died:
+[ 176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224
+[ 176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680
+...
+[ 177.180644] Freed by task 0:
+[ 177.183882] kasan_slab_free+0x90/0x15c
+[ 177.188194] kfree+0x114/0x28c
+[ 177.191630] xhci_cleanup_command_queue+0xc8/0xf8
+[ 177.196916] xhci_hc_died+0x84/0x358
+
+Problem here is that when the cmd_timer fired, it would try to access
+current_cmd while the command queue is already freed by xhci_hc_died().
+
+Cleanup current_cmd in xhci_cleanup_command_queue() to avoid that.
+
+Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts")
+Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1309,6 +1309,7 @@ static void xhci_complete_del_and_free_c
+ void xhci_cleanup_command_queue(struct xhci_hcd *xhci)
+ {
+ struct xhci_command *cur_cmd, *tmp_cmd;
++ xhci->current_cmd = NULL;
+ list_for_each_entry_safe(cur_cmd, tmp_cmd, &xhci->cmd_list, cmd_list)
+ xhci_complete_del_and_free_cmd(cur_cmd, COMP_COMMAND_ABORTED);
+ }
--- /dev/null
+From ea7d0d69426cab6747ed311c53f4142eb48b9454 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 6 Oct 2017 17:45:27 +0300
+Subject: xhci: Identify USB 3.1 capable hosts by their port protocol capability
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit ea7d0d69426cab6747ed311c53f4142eb48b9454 upstream.
+
+Many USB 3.1 capable hosts never updated the Serial Bus Release Number
+(SBRN) register to USB 3.1 from USB 3.0
+
+xhci driver identified USB 3.1 capable hosts based on this SBRN register,
+which according to specs "contains the release of the Universal Serial
+Bus Specification with which this Universal Serial Bus Host Controller
+module is compliant." but still in october 2017 gives USB 3.0 as
+the only possible option.
+
+Make an additional check for USB 3.1 support and enable it if the xHCI
+supported protocol capablity lists USB 3.1 capable ports.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4805,7 +4805,8 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ */
+ hcd->has_tt = 1;
+ } else {
+- if (xhci->sbrn == 0x31) {
++ /* Some 3.1 hosts return sbrn 0x30, can't rely on sbrn alone */
++ if (xhci->sbrn == 0x31 || xhci->usb3_rhub.min_rev >= 1) {
+ xhci_info(xhci, "Host supports USB 3.1 Enhanced SuperSpeed\n");
+ hcd->speed = HCD_USB31;
+ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
projects / thirdparty / kernel / stable-queue.git / commitdiff
