--- /dev/null
+From 51227bf52008bd4c4c50da4b749bbc6e7bbbca52 Mon Sep 17 00:00:00 2001
+From: Marcin Wojtas <mw@semihalf.com>
+Date: Tue, 6 Sep 2016 19:41:11 +0200
+Subject: arm64: dts: marvell: fix clocksource for CP110 master SPI0
+
+From: Marcin Wojtas <mw@semihalf.com>
+
+commit 51227bf52008bd4c4c50da4b749bbc6e7bbbca52 upstream.
+
+I2C and SPI interfaces share common clock trees within the CP110 HW block.
+It occurred that SPI0 interface has wrong clock assignment in the device
+tree, which is fixed in this commit to a proper value.
+
+Fixes: 728dacc7f4dd ("arm64: dts: marvell: initial DT description of ...")
+Signed-off-by: Marcin Wojtas <mw@semihalf.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
+@@ -131,7 +131,7 @@
+ #address-cells = <0x1>;
+ #size-cells = <0x0>;
+ cell-index = <1>;
+- clocks = <&cpm_syscon0 0 3>;
++ clocks = <&cpm_syscon0 1 21>;
+ status = "disabled";
+ };
+
--- /dev/null
+From d09960b0032174eb493c4c13be5b9c9ef36dc9a7 Mon Sep 17 00:00:00 2001
+From: Tahsin Erdogan <tahsin@google.com>
+Date: Mon, 10 Oct 2016 05:35:19 -0700
+Subject: dm: free io_barrier after blk_cleanup_queue call
+
+From: Tahsin Erdogan <tahsin@google.com>
+
+commit d09960b0032174eb493c4c13be5b9c9ef36dc9a7 upstream.
+
+dm_old_request_fn() has paths that access md->io_barrier. The party
+destroying io_barrier should ensure that no future execution of
+dm_old_request_fn() is possible. Move io_barrier destruction to below
+blk_cleanup_queue() to ensure this and avoid a NULL pointer crash during
+request-based DM device shutdown.
+
+Signed-off-by: Tahsin Erdogan <tahsin@google.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1423,8 +1423,6 @@ static void cleanup_mapped_device(struct
+ if (md->bs)
+ bioset_free(md->bs);
+
+- cleanup_srcu_struct(&md->io_barrier);
+-
+ if (md->disk) {
+ spin_lock(&_minor_lock);
+ md->disk->private_data = NULL;
+@@ -1436,6 +1434,8 @@ static void cleanup_mapped_device(struct
+ if (md->queue)
+ blk_cleanup_queue(md->queue);
+
++ cleanup_srcu_struct(&md->io_barrier);
++
+ if (md->bdev) {
+ bdput(md->bdev);
+ md->bdev = NULL;
--- /dev/null
+From 407a3aee6ee2d2cb46d9ba3fc380bc29f35d020c Mon Sep 17 00:00:00 2001
+From: Long Li <longli@microsoft.com>
+Date: Wed, 5 Oct 2016 16:57:46 -0700
+Subject: hv: do not lose pending heartbeat vmbus packets
+
+From: Long Li <longli@microsoft.com>
+
+commit 407a3aee6ee2d2cb46d9ba3fc380bc29f35d020c upstream.
+
+The host keeps sending heartbeat packets independent of the
+guest responding to them. Even though we respond to the heartbeat messages at
+interrupt level, we can have situations where there maybe multiple heartbeat
+messages pending that have not been responded to. For instance this occurs when the
+VM is paused and the host continues to send the heartbeat messages.
+Address this issue by draining and responding to all
+the heartbeat messages that maybe pending.
+
+Signed-off-by: Long Li <longli@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv_util.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/hv/hv_util.c
++++ b/drivers/hv/hv_util.c
+@@ -283,10 +283,14 @@ static void heartbeat_onchannelcallback(
+ u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
+ struct icmsg_negotiate *negop = NULL;
+
+- vmbus_recvpacket(channel, hbeat_txf_buf,
+- PAGE_SIZE, &recvlen, &requestid);
++ while (1) {
++
++ vmbus_recvpacket(channel, hbeat_txf_buf,
++ PAGE_SIZE, &recvlen, &requestid);
++
++ if (!recvlen)
++ break;
+
+- if (recvlen > 0) {
+ icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[
+ sizeof(struct vmbuspipe_hdr)];
+
--- /dev/null
+From d1fe85ec7702917f2f1515b4c421d5d4792201a0 Mon Sep 17 00:00:00 2001
+From: Sandhya Bankar <bankarsandhya512@gmail.com>
+Date: Sun, 25 Sep 2016 00:46:21 +0530
+Subject: iio:chemical:atlas-ph-sensor: Fix use of 32 bit int to hold 16 bit big endian value
+
+From: Sandhya Bankar <bankarsandhya512@gmail.com>
+
+commit d1fe85ec7702917f2f1515b4c421d5d4792201a0 upstream.
+
+This will result in a random value being reported on big endian architectures.
+(thanks to Lars-Peter Clausen for pointing out the effects of this bug)
+
+Only effects a value printed to the log, but as this reports the settings of
+the probe in question it may be of direct interest to users.
+
+Also, fixes the following sparse endianness warnings:
+
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16
+
+Signed-off-by: Sandhya Bankar <bankarsandhya512@gmail.com>
+Fixes: e8dd92bfbff25 ("iio: chemical: atlas-ph-sensor: add EC feature")
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/chemical/atlas-ph-sensor.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/chemical/atlas-ph-sensor.c
++++ b/drivers/iio/chemical/atlas-ph-sensor.c
+@@ -207,13 +207,14 @@ static int atlas_check_ec_calibration(st
+ struct device *dev = &data->client->dev;
+ int ret;
+ unsigned int val;
++ __be16 rval;
+
+- ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &val, 2);
++ ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &rval, 2);
+ if (ret)
+ return ret;
+
+- dev_info(dev, "probe set to K = %d.%.2d", be16_to_cpu(val) / 100,
+- be16_to_cpu(val) % 100);
++ val = be16_to_cpu(rval);
++ dev_info(dev, "probe set to K = %d.%.2d", val / 100, val % 100);
+
+ ret = regmap_read(data->regmap, ATLAS_REG_EC_CALIB_STATUS, &val);
+ if (ret)
usb-renesas_usbhs-add-wait-after-initialization-for-r-car-gen3.patch
usb-increase-ohci-watchdog-delay-to-275-msec.patch
genwqe-fix-bad-page-access-during-abort-of-resource-allocation.patch
+x86-smpboot-init-apic-mapping-before-usage.patch
+vt-clear-selection-before-resizing.patch
+hv-do-not-lose-pending-heartbeat-vmbus-packets.patch
+xhci-add-restart-quirk-for-intel-wildcatpoint-pch.patch
+xhci-workaround-for-hosts-missing-cas-bit.patch
+tty-limit-terminal-size-to-4m-chars.patch
+arm64-dts-marvell-fix-clocksource-for-cp110-master-spi0.patch
+iio-chemical-atlas-ph-sensor-fix-use-of-32-bit-int-to-hold-16-bit-big-endian-value.patch
+staging-wilc1000-fix-kernel-oops-on-opening-the-device.patch
+dm-free-io_barrier-after-blk_cleanup_queue-call.patch
--- /dev/null
+From 1d4f1d53e1e2d5e38f4d3ca3bf60f8be5025540f Mon Sep 17 00:00:00 2001
+From: Aditya Shankar <Aditya.Shankar@microchip.com>
+Date: Fri, 7 Oct 2016 09:45:03 +0530
+Subject: Staging: wilc1000: Fix kernel Oops on opening the device
+
+From: Aditya Shankar <Aditya.Shankar@microchip.com>
+
+commit 1d4f1d53e1e2d5e38f4d3ca3bf60f8be5025540f upstream.
+
+Commit 2518ac59eb27 ("staging: wilc1000: Replace kthread with workqueue
+for host interface") adds an unconditional destroy_workqueue() on the
+wilc's "hif_workqueue" soon after its creation thereby rendering
+it unusable. It then further attempts to queue work onto this
+non-existing hif_worqueue and results in:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000010
+pgd = de478000
+[00000010] *pgd=3eec0831, *pte=00000000, *ppte=00000000
+Internal error: Oops: 17 [#1] ARM
+Modules linked in: wilc1000_sdio(C) wilc1000(C)
+CPU: 0 PID: 825 Comm: ifconfig Tainted: G C 4.8.0-rc8+ #37
+Hardware name: Atmel SAMA5
+task: df56f800 task.stack: deeb0000
+PC is at __queue_work+0x90/0x284
+LR is at __queue_work+0x58/0x284
+pc : [<c0126bb0>] lr : [<c0126b78>] psr: 600f0093
+sp : deeb1aa0 ip : def22d78 fp : deea6000
+r10: 00000000 r9 : c0a08150 r8 : c0a2f058
+r7 : 00000001 r6 : dee9b600 r5 : def22d74 r4 : 00000000
+r3 : 00000000 r2 : def22d74 r1 : 07ffffff r0 : 00000000
+Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none
+...
+[<c0127060>] (__queue_work) from [<c0127298>] (queue_work_on+0x34/0x40)
+[<c0127298>] (queue_work_on) from [<bf0076b4>] (wilc_enqueue_cmd+0x54/0x64 [wilc1000])
+[<bf0076b4>] (wilc_enqueue_cmd [wilc1000]) from [<bf0082b4>] (wilc_set_wfi_drv_handler+0x48/0x70 [wilc1000])
+[<bf0082b4>] (wilc_set_wfi_drv_handler [wilc1000]) from [<bf00509c>] (wilc_mac_open+0x214/0x250 [wilc1000])
+[<bf00509c>] (wilc_mac_open [wilc1000]) from [<c04fde98>] (__dev_open+0xb8/0x11c)
+[<c04fde98>] (__dev_open) from [<c04fe128>] (__dev_change_flags+0x94/0x158)
+[<c04fe128>] (__dev_change_flags) from [<c04fe204>] (dev_change_flags+0x18/0x48)
+[<c04fe204>] (dev_change_flags) from [<c0557d5c>] (devinet_ioctl+0x6b4/0x788)
+[<c0557d5c>] (devinet_ioctl) from [<c04e40a0>] (sock_ioctl+0x154/0x2cc)
+[<c04e40a0>] (sock_ioctl) from [<c01b16e0>] (do_vfs_ioctl+0x9c/0x878)
+[<c01b16e0>] (do_vfs_ioctl) from [<c01b1ef0>] (SyS_ioctl+0x34/0x5c)
+[<c01b1ef0>] (SyS_ioctl) from [<c0107520>] (ret_fast_syscall+0x0/0x3c)
+Code: e5932004 e1520006 01a04003 0affffff (e5943010)
+---[ end trace b612328adaa6bf20 ]---
+
+This fix removes the unnecessary call to destroy_workqueue() while opening
+the device to avoid the above kernel panic. The deinit routine already
+does a good job of terminating the workqueue when no longer needed.
+
+Reported-by: Nicolas Ferre <Nicolas.Ferre@microchip.com>
+Fixes: 2518ac59eb27 ("staging: wilc1000: Replace kthread with workqueue for host interface")
+Signed-off-by: Aditya Shankar <Aditya.Shankar@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wilc1000/host_interface.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/staging/wilc1000/host_interface.c
++++ b/drivers/staging/wilc1000/host_interface.c
+@@ -3391,7 +3391,6 @@ int wilc_init(struct net_device *dev, st
+
+ clients_count++;
+
+- destroy_workqueue(hif_workqueue);
+ _fail_:
+ return result;
+ }
--- /dev/null
+From 32b2921e6a7461fe63b71217067a6cf4bddb132f Mon Sep 17 00:00:00 2001
+From: Dmitry Vyukov <dvyukov@google.com>
+Date: Fri, 14 Oct 2016 15:18:28 +0200
+Subject: tty: limit terminal size to 4M chars
+
+From: Dmitry Vyukov <dvyukov@google.com>
+
+commit 32b2921e6a7461fe63b71217067a6cf4bddb132f upstream.
+
+Size of kmalloc() in vc_do_resize() is controlled by user.
+Too large kmalloc() size triggers WARNING message on console.
+Put a reasonable upper bound on terminal size to prevent WARNINGs.
+
+Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
+CC: David Rientjes <rientjes@google.com>
+Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Cc: Peter Hurley <peter@hurleysoftware.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: syzkaller@googlegroups.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -870,6 +870,8 @@ static int vc_do_resize(struct tty_struc
+ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+ return 0;
+
++ if (new_screen_size > (4 << 20))
++ return -EINVAL;
+ newscreen = kmalloc(new_screen_size, GFP_USER);
+ if (!newscreen)
+ return -ENOMEM;
--- /dev/null
+From 009e39ae44f4191188aeb6dfbf661b771dbbe515 Mon Sep 17 00:00:00 2001
+From: Scot Doyle <lkml14@scotdoyle.com>
+Date: Thu, 13 Oct 2016 12:12:43 -0500
+Subject: vt: clear selection before resizing
+
+From: Scot Doyle <lkml14@scotdoyle.com>
+
+commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 upstream.
+
+When resizing a vt its selection may exceed the new size, resulting in
+an invalid memory access [1]. Clear the selection before resizing.
+
+[1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com
+
+Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Scot Doyle <lkml14@scotdoyle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -874,6 +874,9 @@ static int vc_do_resize(struct tty_struc
+ if (!newscreen)
+ return -ENOMEM;
+
++ if (vc == sel_cons)
++ clear_selection();
++
+ old_rows = vc->vc_rows;
+ old_row_size = vc->vc_size_row;
+
--- /dev/null
+From 1e90a13d0c3dc94512af1ccb2b6563e8297838fa Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sat, 29 Oct 2016 13:42:42 +0200
+Subject: x86/smpboot: Init apic mapping before usage
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 1e90a13d0c3dc94512af1ccb2b6563e8297838fa upstream.
+
+The recent changes, which forced the registration of the boot cpu on UP
+systems, which do not have ACPI tables, have been fixed for systems w/o
+local APIC, but left a wreckage for systems which have neither ACPI nor
+mptables, but the CPU has an APIC, e.g. virtualbox.
+
+The boot process crashes in prefill_possible_map() as it wants to register
+the boot cpu, which needs to access the local apic, but the local APIC is
+not yet mapped.
+
+There is no reason why init_apic_mapping() can't be invoked before
+prefill_possible_map(). So instead of playing another silly early mapping
+game, as the ACPI/mptables code does, we just move init_apic_mapping()
+before the call to prefill_possible_map().
+
+In hindsight, I should have noticed that combination earlier.
+
+Sorry for the churn (also in stable)!
+
+Fixes: ff8560512b8d ("x86/boot/smp: Don't try to poke disabled/non-existent APIC")
+Reported-and-debugged-by: Michal Necasek <michal.necasek@oracle.com>
+Reported-and-tested-by: Wolfgang Bauer <wbauer@tmo.at>
+Cc: prarit@redhat.com
+Cc: ville.syrjala@linux.intel.com
+Cc: michael.thayer@oracle.com
+Cc: knut.osmundsen@oracle.com
+Cc: frank.mehnert@oracle.com
+Cc: Borislav Petkov <bp@alien8.de>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1610282114380.5053@nanos
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/setup.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -1222,11 +1222,16 @@ void __init setup_arch(char **cmdline_p)
+ if (smp_found_config)
+ get_smp_config();
+
++ /*
++ * Systems w/o ACPI and mptables might not have it mapped the local
++ * APIC yet, but prefill_possible_map() might need to access it.
++ */
++ init_apic_mappings();
++
+ prefill_possible_map();
+
+ init_cpu_to_node();
+
+- init_apic_mappings();
+ io_apic_init_mappings();
+
+ kvm_guest_init();
--- /dev/null
+From 4c39135aa412d2f1381e43802523da110ca7855c Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Thu, 20 Oct 2016 18:09:18 +0300
+Subject: xhci: add restart quirk for Intel Wildcatpoint PCH
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 4c39135aa412d2f1381e43802523da110ca7855c upstream.
+
+xHC in Wildcatpoint-LP PCH is similar to LynxPoint-LP and need the
+same quirks to prevent machines from spurious restart while
+shutting them down.
+
+Reported-by: Hasan Mahmood <hasan.mahm@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -45,6 +45,7 @@
+
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
++#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1
+ #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
+@@ -153,7 +154,8 @@ static void xhci_pci_quirks(struct devic
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
++ (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) {
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+ }
--- /dev/null
+From 346e99736c3ce328fd42d678343b70243aca5f36 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Thu, 20 Oct 2016 18:09:19 +0300
+Subject: xhci: workaround for hosts missing CAS bit
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 346e99736c3ce328fd42d678343b70243aca5f36 upstream.
+
+If a device is unplugged and replugged during Sx system suspend
+some Intel xHC hosts will overwrite the CAS (Cold attach status) flag
+and no device connection is noticed in resume.
+
+A device in this state can be identified in resume if its link state
+is in polling or compliance mode, and the current connect status is 0.
+A device in this state needs to be warm reset.
+
+Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8
+
+Observed on Cherryview and Apollolake as they go into compliance mode
+if LFPS times out during polling, and re-plugged devices are not
+discovered at resume.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 37 +++++++++++++++++++++++++++++++++++++
+ drivers/usb/host/xhci-pci.c | 6 ++++++
+ drivers/usb/host/xhci.h | 3 +++
+ 3 files changed, 46 insertions(+)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1355,6 +1355,35 @@ int xhci_bus_suspend(struct usb_hcd *hcd
+ return 0;
+ }
+
++/*
++ * Workaround for missing Cold Attach Status (CAS) if device re-plugged in S3.
++ * warm reset a USB3 device stuck in polling or compliance mode after resume.
++ * See Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8
++ */
++static bool xhci_port_missing_cas_quirk(int port_index,
++ __le32 __iomem **port_array)
++{
++ u32 portsc;
++
++ portsc = readl(port_array[port_index]);
++
++ /* if any of these are set we are not stuck */
++ if (portsc & (PORT_CONNECT | PORT_CAS))
++ return false;
++
++ if (((portsc & PORT_PLS_MASK) != XDEV_POLLING) &&
++ ((portsc & PORT_PLS_MASK) != XDEV_COMP_MODE))
++ return false;
++
++ /* clear wakeup/change bits, and do a warm port reset */
++ portsc &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
++ portsc |= PORT_WR;
++ writel(portsc, port_array[port_index]);
++ /* flush write */
++ readl(port_array[port_index]);
++ return true;
++}
++
+ int xhci_bus_resume(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+@@ -1392,6 +1421,14 @@ int xhci_bus_resume(struct usb_hcd *hcd)
+ u32 temp;
+
+ temp = readl(port_array[port_index]);
++
++ /* warm reset CAS limited ports stuck in polling/compliance */
++ if ((xhci->quirks & XHCI_MISSING_CAS) &&
++ (hcd->speed >= HCD_USB3) &&
++ xhci_port_missing_cas_quirk(port_index, port_array)) {
++ xhci_dbg(xhci, "reset stuck port %d\n", port_index);
++ continue;
++ }
+ if (DEV_SUPERSPEED_ANY(temp))
+ temp &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
+ else
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -51,6 +51,7 @@
+ #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
+ #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
+ #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
++#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -171,6 +172,11 @@ static void xhci_pci_quirks(struct devic
+ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
+ xhci->quirks |= XHCI_SSIC_PORT_UNUSED;
+ }
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
++ (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
++ xhci->quirks |= XHCI_MISSING_CAS;
++
+ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ pdev->device == PCI_DEVICE_ID_EJ168) {
+ xhci->quirks |= XHCI_RESET_ON_RESUME;
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -314,6 +314,8 @@ struct xhci_op_regs {
+ #define XDEV_U2 (0x2 << 5)
+ #define XDEV_U3 (0x3 << 5)
+ #define XDEV_INACTIVE (0x6 << 5)
++#define XDEV_POLLING (0x7 << 5)
++#define XDEV_COMP_MODE (0xa << 5)
+ #define XDEV_RESUME (0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER (1 << 9)
+@@ -1653,6 +1655,7 @@ struct xhci_hcd {
+ #define XHCI_MTK_HOST (1 << 21)
+ #define XHCI_SSIC_PORT_UNUSED (1 << 22)
+ #define XHCI_NO_64BIT_SUPPORT (1 << 23)
++#define XHCI_MISSING_CAS (1 << 24)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
projects / thirdparty / kernel / stable-queue.git / commitdiff
