--- /dev/null
+From e0cb1b84163720ec67ff0e54397fd3f57ad4a4dd Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 10 Aug 2016 09:29:43 +0200
+Subject: clk: renesas: r8a7795: Fix SD clocks
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit e0cb1b84163720ec67ff0e54397fd3f57ad4a4dd upstream.
+
+According to the datasheet, SDn clocks are from the SDSRC clock. And
+the SDSRC has a 1/2 divider. So, we should have ".sdsrc" as an internal
+core clock. Otherwise, since the sdhi driver will calculate clock for
+a sd card using the wrong parent clock rate, and then performance will
+be not good.
+
+Fixes: 90c073e53909da85 ("clk: shmobile: r8a7795: Add SD divider support")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Acked-by: Dirk Behme <dirk.behme@de.bosch.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/renesas/r8a7795-cpg-mssr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/renesas/r8a7795-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c
+@@ -91,6 +91,7 @@ static const struct cpg_core_clk r8a7795
+ DEF_FIXED(".s1", CLK_S1, CLK_PLL1_DIV2, 3, 1),
+ DEF_FIXED(".s2", CLK_S2, CLK_PLL1_DIV2, 4, 1),
+ DEF_FIXED(".s3", CLK_S3, CLK_PLL1_DIV2, 6, 1),
++ DEF_FIXED(".sdsrc", CLK_SDSRC, CLK_PLL1_DIV2, 2, 1),
+
+ /* Core Clock Outputs */
+ DEF_FIXED("ztr", R8A7795_CLK_ZTR, CLK_PLL1_DIV2, 6, 1),
+@@ -109,10 +110,10 @@ static const struct cpg_core_clk r8a7795
+ DEF_FIXED("s3d2", R8A7795_CLK_S3D2, CLK_S3, 2, 1),
+ DEF_FIXED("s3d4", R8A7795_CLK_S3D4, CLK_S3, 4, 1),
+
+- DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_PLL1_DIV2, 0x0074),
+- DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_PLL1_DIV2, 0x0078),
+- DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_PLL1_DIV2, 0x0268),
+- DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_PLL1_DIV2, 0x026c),
++ DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_SDSRC, 0x0074),
++ DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_SDSRC, 0x0078),
++ DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_SDSRC, 0x0268),
++ DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_SDSRC, 0x026c),
+
+ DEF_FIXED("cl", R8A7795_CLK_CL, CLK_PLL1_DIV2, 48, 1),
+ DEF_FIXED("cp", R8A7795_CLK_CP, CLK_EXTAL, 2, 1),
--- /dev/null
+From ae141830b118c3fb5b7eab6fa7c8ab7b7224b0a4 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 19 Aug 2016 22:39:02 +0200
+Subject: parisc: Fix automatic selection of cr16 clocksource
+
+From: Helge Deller <deller@gmx.de>
+
+commit ae141830b118c3fb5b7eab6fa7c8ab7b7224b0a4 upstream.
+
+Commit 54b66800907 (parisc: Add native high-resolution sched_clock()
+implementation) added support to use the CPU-internal cr16 counters as reliable
+clocksource with the help of HAVE_UNSTABLE_SCHED_CLOCK.
+
+Sadly the commit missed to remove the hack which prevented cr16 to become the
+default clocksource even on SMP systems.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/processor.c | 8 --------
+ arch/parisc/kernel/time.c | 12 ------------
+ 2 files changed, 20 deletions(-)
+
+--- a/arch/parisc/kernel/processor.c
++++ b/arch/parisc/kernel/processor.c
+@@ -51,8 +51,6 @@ EXPORT_SYMBOL(_parisc_requires_coherency
+
+ DEFINE_PER_CPU(struct cpuinfo_parisc, cpu_data);
+
+-extern int update_cr16_clocksource(void); /* from time.c */
+-
+ /*
+ ** PARISC CPU driver - claim "device" and initialize CPU data structures.
+ **
+@@ -228,12 +226,6 @@ static int processor_probe(struct parisc
+ }
+ #endif
+
+- /* If we've registered more than one cpu,
+- * we'll use the jiffies clocksource since cr16
+- * is not synchronized between CPUs.
+- */
+- update_cr16_clocksource();
+-
+ return 0;
+ }
+
+--- a/arch/parisc/kernel/time.c
++++ b/arch/parisc/kernel/time.c
+@@ -220,18 +220,6 @@ static struct clocksource clocksource_cr
+ .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+ };
+
+-int update_cr16_clocksource(void)
+-{
+- /* since the cr16 cycle counters are not synchronized across CPUs,
+- we'll check if we should switch to a safe clocksource: */
+- if (clocksource_cr16.rating != 0 && num_online_cpus() > 1) {
+- clocksource_change_rating(&clocksource_cr16, 0);
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+ void __init start_cpu_itimer(void)
+ {
+ unsigned int cpu = smp_processor_id();
crypto-caam-fix-non-hmac-hashes.patch
crypto-caam-fix-echainiv-authenc-encrypt-shared-descriptor.patch
crypto-caam-defer-aead_set_sh_desc-in-case-of-zero-authsize.patch
+parisc-fix-automatic-selection-of-cr16-clocksource.patch
+usb-ehci-change-order-of-register-cleanup-during-shutdown.patch
+usb-devio-do-not-warn-when-allocation-fails.patch
+usb-misc-usbtest-add-fix-for-driver-hang.patch
+usb-misc-usbtest-usbtest_do_ioctl-may-return-positive-integer.patch
+usb-dwc3-pci-add-intel-kabylake-pci-id.patch
+usb-dwc3-gadget-increment-request-actual-once.patch
+usb-dwc3-gadget-fix-for-short-pkts-during-chained-xfers.patch
+usb-dwc3-gadget-always-cleanup-all-trbs.patch
+usb-hub-fix-unbalanced-reference-count-memory-leak-deadlocks.patch
+usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch
+usb-hub-change-the-locking-in-hub_activate.patch
+usb-renesas_usbhs-fix-receiving-data-corrupt-on-r-car-gen3-with-dmac.patch
+usb-renesas_usbhs-clear-the-brdysts-in-usbhsg_ep_enable.patch
+usb-renesas_usbhs-use-dmac-only-if-the-pipe-type-is-bulk.patch
+clk-renesas-r8a7795-fix-sd-clocks.patch
+usb-validate-wmaxpacketvalue-entries-in-endpoint-descriptors.patch
+usb-gadget-fsl_qe_udc-off-by-one-in-setup_received_handle.patch
+usb-gadget-fix-gadgetfs-aio-support.patch
+xhci-always-handle-command-ring-stopped-events.patch
+usb-xhci-fix-panic-if-disconnect.patch
+xhci-don-t-dereference-a-xhci-member-after-removing-xhci.patch
+usb-serial-fix-memleak-in-driver-registration-error-path.patch
+usb-serial-option-add-d-link-dwm-156-a3.patch
+usb-serial-option-add-support-for-telit-le920a4.patch
+usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch
+usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch
+uprobes-fix-the-memcg-accounting.patch
--- /dev/null
+From 6c4687cc17a788a6dd8de3e27dbeabb7cbd3e066 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Wed, 17 Aug 2016 17:36:29 +0200
+Subject: uprobes: Fix the memcg accounting
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 6c4687cc17a788a6dd8de3e27dbeabb7cbd3e066 upstream.
+
+__replace_page() wronlgy calls mem_cgroup_cancel_charge() in "success" path,
+it should only do this if page_check_address() fails.
+
+This means that every enable/disable leads to unbalanced mem_cgroup_uncharge()
+from put_page(old_page), it is trivial to underflow the page_counter->count
+and trigger OOM.
+
+Reported-and-tested-by: Brenden Blanco <bblanco@plumgrid.com>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
+Fixes: 00501b531c47 ("mm: memcontrol: rewrite charge API")
+Link: http://lkml.kernel.org/r/20160817153629.GB29724@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/uprobes.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -172,8 +172,10 @@ static int __replace_page(struct vm_area
+ mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
+ err = -EAGAIN;
+ ptep = page_check_address(page, mm, addr, &ptl, 0);
+- if (!ptep)
++ if (!ptep) {
++ mem_cgroup_cancel_charge(kpage, memcg, false);
+ goto unlock;
++ }
+
+ get_page(kpage);
+ page_add_new_anon_rmap(kpage, vma, addr, false);
+@@ -200,7 +202,6 @@ static int __replace_page(struct vm_area
+
+ err = 0;
+ unlock:
+- mem_cgroup_cancel_charge(kpage, memcg, false);
+ mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
+ unlock_page(page);
+ return err;
--- /dev/null
+From 70f7ca9a0262784d0b80727860a63d64ab228e7b Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Wed, 15 Jun 2016 15:56:11 +0200
+Subject: usb: devio, do not warn when allocation fails
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 70f7ca9a0262784d0b80727860a63d64ab228e7b upstream.
+
+usbdev_mmap allocates a buffer. The size of the buffer is determined
+by a user. So with this code (no need to be root):
+
+ int fd = open("/dev/bus/usb/001/001", O_RDONLY);
+ mmap(NULL, 0x800000, PROT_READ, MAP_SHARED, fd, 0);
+
+we can see a warning:
+
+WARNING: CPU: 0 PID: 21771 at ../mm/page_alloc.c:3563 __alloc_pages_slowpath+0x1036/0x16e0()
+...
+Call Trace:
+ [<ffffffff8117a3ae>] ? warn_slowpath_null+0x2e/0x40
+ [<ffffffff815178b6>] ? __alloc_pages_slowpath+0x1036/0x16e0
+ [<ffffffff81516880>] ? warn_alloc_failed+0x250/0x250
+ [<ffffffff8151226b>] ? get_page_from_freelist+0x75b/0x28b0
+ [<ffffffff815184e3>] ? __alloc_pages_nodemask+0x583/0x6b0
+ [<ffffffff81517f60>] ? __alloc_pages_slowpath+0x16e0/0x16e0
+ [<ffffffff810565d4>] ? dma_generic_alloc_coherent+0x104/0x220
+ [<ffffffffa0269e56>] ? hcd_buffer_alloc+0x1d6/0x3e0 [usbcore]
+ [<ffffffffa0269c80>] ? hcd_buffer_destroy+0xa0/0xa0 [usbcore]
+ [<ffffffffa0228f05>] ? usb_alloc_coherent+0x65/0x90 [usbcore]
+ [<ffffffffa0275c05>] ? usbdev_mmap+0x1a5/0x770 [usbcore]
+...
+
+Allocations like this one should be marked as __GFP_NOWARN. So do so.
+
+The size could be also clipped by something like:
+ if (size >= (1 << (MAX_ORDER + PAGE_SHIFT - 1)))
+ return -ENOMEM;
+But I think the overall limit of 16M (by usbfs_increase_memory_usage)
+is enough, so that we only silence the warning here.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Markus Rechberger <mrechberger@gmail.com>
+Fixes: f7d34b445a (USB: Add support for usbfs zerocopy.)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/devio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file
+ goto error_decrease_mem;
+ }
+
+- mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
++ mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
++ &dma_handle);
+ if (!mem) {
+ ret = -ENOMEM;
+ goto error_free_usbm;
--- /dev/null
+From 7c705dfe2ebe731c8fd068623b6b4df2d3512c08 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Wed, 10 Aug 2016 12:35:30 +0300
+Subject: usb: dwc3: gadget: always cleanup all TRBs
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 7c705dfe2ebe731c8fd068623b6b4df2d3512c08 upstream.
+
+If we stop earlier due to short packet, we will
+not be able to giveback all TRBs.
+
+Cc: Brian E Rogers <brian.e.rogers@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1969,7 +1969,7 @@ static int __dwc3_cleanup_done_trbs(stru
+ s_pkt = 1;
+ }
+
+- if (s_pkt)
++ if (s_pkt && !chain)
+ return 1;
+ if ((event->status & DEPEVT_STATUS_LST) &&
+ (trb->ctrl & (DWC3_TRB_CTRL_LST |
--- /dev/null
+From e5b36ae2f851024d43c76e51f395d32ce8d769ce Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Wed, 10 Aug 2016 11:13:26 +0300
+Subject: usb: dwc3: gadget: fix for short pkts during chained xfers
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit e5b36ae2f851024d43c76e51f395d32ce8d769ce upstream.
+
+DWC3 has one interesting peculiarity with chained
+transfers. If we setup N chained transfers and we
+get a short packet before processing all N TRBs,
+DWC3 will (conditionally) issue a XferComplete or
+XferInProgress event and retire all TRBs from the
+one which got a short packet to the last without
+clearing their HWO bits.
+
+This means SW must clear HWO bit manually, which
+this patch is doing.
+
+Cc: Brian E Rogers <brian.e.rogers@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1897,7 +1897,8 @@ static void dwc3_gadget_free_endpoints(s
+
+ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ struct dwc3_request *req, struct dwc3_trb *trb,
+- const struct dwc3_event_depevt *event, int status)
++ const struct dwc3_event_depevt *event, int status,
++ int chain)
+ {
+ unsigned int count;
+ unsigned int s_pkt = 0;
+@@ -1905,6 +1906,19 @@ static int __dwc3_cleanup_done_trbs(stru
+
+ trace_dwc3_complete_trb(dep, trb);
+
++ /*
++ * If we're in the middle of series of chained TRBs and we
++ * receive a short transfer along the way, DWC3 will skip
++ * through all TRBs including the last TRB in the chain (the
++ * where CHN bit is zero. DWC3 will also avoid clearing HWO
++ * bit and SW has to do it manually.
++ *
++ * We're going to do that here to avoid problems of HW trying
++ * to use bogus TRBs for transfers.
++ */
++ if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
++ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
++
+ if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
+ /*
+ * We continue despite the error. There is not much we
+@@ -1916,6 +1930,7 @@ static int __dwc3_cleanup_done_trbs(stru
+ */
+ dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
+ dep->name, trb);
++
+ count = trb->size & DWC3_TRB_SIZE_MASK;
+
+ if (dep->direction) {
+@@ -1977,10 +1992,13 @@ static int dwc3_cleanup_done_reqs(struct
+ int ret;
+
+ do {
++ int chain;
++
+ req = next_request(&dep->started_list);
+ if (WARN_ON_ONCE(!req))
+ return 1;
+
++ chain = req->request.num_mapped_sgs > 0;
+ i = 0;
+ do {
+ slot = req->first_trb_index + i;
+@@ -1990,9 +2008,8 @@ static int dwc3_cleanup_done_reqs(struct
+ trb = &dep->trb_pool[slot];
+ count += trb->size & DWC3_TRB_SIZE_MASK;
+
+-
+ ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
+- event, status);
++ event, status, chain);
+ if (ret)
+ break;
+ } while (++i < req->request.num_mapped_sgs);
--- /dev/null
+From c7de573471832dff7d31f0c13b0f143d6f017799 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Fri, 29 Jul 2016 03:17:58 +0300
+Subject: usb: dwc3: gadget: increment request->actual once
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit c7de573471832dff7d31f0c13b0f143d6f017799 upstream.
+
+When using SG lists, we would end up setting
+request->actual to:
+
+ num_mapped_sgs * (request->length - count)
+
+Let's fix that up by incrementing request->actual
+only once.
+
+Reported-by: Brian E Rogers <brian.e.rogers@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1954,14 +1954,6 @@ static int __dwc3_cleanup_done_trbs(stru
+ s_pkt = 1;
+ }
+
+- /*
+- * We assume here we will always receive the entire data block
+- * which we should receive. Meaning, if we program RX to
+- * receive 4K but we receive only 2K, we assume that's all we
+- * should receive and we simply bounce the request back to the
+- * gadget driver for further processing.
+- */
+- req->request.actual += req->request.length - count;
+ if (s_pkt)
+ return 1;
+ if ((event->status & DEPEVT_STATUS_LST) &&
+@@ -1981,6 +1973,7 @@ static int dwc3_cleanup_done_reqs(struct
+ struct dwc3_trb *trb;
+ unsigned int slot;
+ unsigned int i;
++ int count = 0;
+ int ret;
+
+ do {
+@@ -1995,6 +1988,8 @@ static int dwc3_cleanup_done_reqs(struct
+ slot++;
+ slot %= DWC3_TRB_NUM;
+ trb = &dep->trb_pool[slot];
++ count += trb->size & DWC3_TRB_SIZE_MASK;
++
+
+ ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
+ event, status);
+@@ -2002,6 +1997,14 @@ static int dwc3_cleanup_done_reqs(struct
+ break;
+ } while (++i < req->request.num_mapped_sgs);
+
++ /*
++ * We assume here we will always receive the entire data block
++ * which we should receive. Meaning, if we program RX to
++ * receive 4K but we receive only 2K, we assume that's all we
++ * should receive and we simply bounce the request back to the
++ * gadget driver for further processing.
++ */
++ req->request.actual += req->request.length - count;
+ dwc3_gadget_giveback(dep, req, status);
+
+ if (ret)
--- /dev/null
+From 4491ed5042f0419b22a4b08331adb54af31e2caa Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Fri, 1 Apr 2016 17:13:11 +0300
+Subject: usb: dwc3: pci: add Intel Kabylake PCI ID
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 4491ed5042f0419b22a4b08331adb54af31e2caa upstream.
+
+Intel Kabylake PCH has the same DWC3 than Intel
+Sunrisepoint. Add the new ID to the supported devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/dwc3-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -37,6 +37,7 @@
+ #define PCI_DEVICE_ID_INTEL_BXT 0x0aaa
+ #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa
+ #define PCI_DEVICE_ID_INTEL_APL 0x5aaa
++#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0
+
+ static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
+ static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
+@@ -214,6 +215,7 @@ static const struct pci_device_id dwc3_p
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
+ { } /* Terminating Entry */
+ };
--- /dev/null
+From bc337b51508beb2d039aff5074a76cfe1c212030 Mon Sep 17 00:00:00 2001
+From: Marc Ohlf <ohlf@mkt-sys.de>
+Date: Wed, 3 Aug 2016 11:51:54 +0200
+Subject: usb: ehci: change order of register cleanup during shutdown
+
+From: Marc Ohlf <ohlf@mkt-sys.de>
+
+commit bc337b51508beb2d039aff5074a76cfe1c212030 upstream.
+
+In ehci_turn_off_all_ports() all EHCI port registers are cleared to zero.
+On some hardware, this can lead to an system hang,
+when ehci_port_power() accesses the already cleared registers.
+
+This patch changes the order of cleanup.
+First call ehci_port_power() which respects the current bits in
+port status registers
+and afterwards cleanup the hard way by setting everything to zero.
+
+Signed-off-by: Marc Ohlf <ohlf@mkt-sys.de>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hcd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(stru
+ int port = HCS_N_PORTS(ehci->hcs_params);
+
+ while (port--) {
+- ehci_writel(ehci, PORT_RWC_BITS,
+- &ehci->regs->port_status[port]);
+ spin_unlock_irq(&ehci->lock);
+ ehci_port_power(ehci, port, false);
+ spin_lock_irq(&ehci->lock);
++ ehci_writel(ehci, PORT_RWC_BITS,
++ &ehci->regs->port_status[port]);
+ }
+ }
+
--- /dev/null
+From 327b21da884fe1a29f733e41792ddd53e4a30379 Mon Sep 17 00:00:00 2001
+From: Mathieu Laurendeau <mat.lau@laposte.net>
+Date: Fri, 15 Jul 2016 14:58:41 +0200
+Subject: usb/gadget: fix gadgetfs aio support.
+
+From: Mathieu Laurendeau <mat.lau@laposte.net>
+
+commit 327b21da884fe1a29f733e41792ddd53e4a30379 upstream.
+
+Fix io submissions failing with ENODEV.
+
+Signed-off-by: Mathieu Laurendeau <mat.lau@laposte.net>
+Fixes: 7fe3976e0f3a ("gadget: switch ep_io_operations to ->read_iter/->write_iter")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/legacy/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb
+ */
+ spin_lock_irq(&epdata->dev->lock);
+ value = -ENODEV;
+- if (unlikely(epdata->ep))
++ if (unlikely(epdata->ep == NULL))
+ goto fail;
+
+ req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
--- /dev/null
+From 7442e6db5bdd0dce4615205508301f9b22e502d6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 13 Jul 2016 13:14:33 +0300
+Subject: usb: gadget: fsl_qe_udc: off by one in setup_received_handle()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 7442e6db5bdd0dce4615205508301f9b22e502d6 upstream.
+
+The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=.
+
+Fixes: 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver')
+Acked-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/fsl_qe_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
++++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
+@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct
+ struct qe_ep *ep;
+
+ if (wValue != 0 || wLength != 0
+- || pipe > USB_MAX_ENDPOINTS)
++ || pipe >= USB_MAX_ENDPOINTS)
+ break;
+ ep = &udc->eps[pipe];
+
--- /dev/null
+From 07d316a22e119fa301fd7dba7f1e1adfd4f72c05 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 5 Aug 2016 11:51:30 -0400
+Subject: USB: hub: change the locking in hub_activate
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 07d316a22e119fa301fd7dba7f1e1adfd4f72c05 upstream.
+
+The locking in hub_activate() is not adequate to provide full mutual
+exclusion with hub_quiesce(). The subroutine locks the hub's
+usb_interface, but the callers of hub_quiesce() (such as
+hub_pre_reset() and hub_event()) hold the lock to the hub's
+usb_device.
+
+This patch changes hub_activate() to make it acquire the same lock as
+those other routines.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1052,7 +1052,7 @@ static void hub_activate(struct usb_hub
+
+ /* Continue a partial initialization */
+ if (type == HUB_INIT2 || type == HUB_INIT3) {
+- device_lock(hub->intfdev);
++ device_lock(&hdev->dev);
+
+ /* Was the hub disconnected while we were waiting? */
+ if (hub->disconnected)
+@@ -1259,7 +1259,7 @@ static void hub_activate(struct usb_hub
+ queue_delayed_work(system_power_efficient_wq,
+ &hub->init_work,
+ msecs_to_jiffies(delay));
+- device_unlock(hub->intfdev);
++ device_unlock(&hdev->dev);
+ return; /* Continues at init3: below */
+ } else {
+ msleep(delay);
+@@ -1282,7 +1282,7 @@ static void hub_activate(struct usb_hub
+ /* Allow autosuspend if it was suppressed */
+ disconnected:
+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
+- device_unlock(hub->intfdev);
++ device_unlock(&hdev->dev);
+ }
+
+ kref_put(&hub->kref, hub_release);
--- /dev/null
+From 6bb47e8ab98accb1319bd43c64966340ba3bba9a Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Thu, 4 Aug 2016 13:32:22 -0700
+Subject: usb: hub: Fix unbalanced reference count/memory leak/deadlocks
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit 6bb47e8ab98accb1319bd43c64966340ba3bba9a upstream.
+
+Memory leak and unbalanced reference count:
+
+If the hub gets disconnected while the core is still activating it, this
+can result in leaking memory of few USB structures.
+
+This will happen if we have done a kref_get() from hub_activate() and
+scheduled a delayed work item for HUB_INIT2/3. Now if hub_disconnect()
+gets called before the delayed work expires, then we will cancel the
+work from hub_quiesce(), but wouldn't do a kref_put(). And so the
+unbalance.
+
+kmemleak reports this as (with the commit e50293ef9775 backported to
+3.10 kernel with other changes, though the same is true for mainline as
+well):
+
+unreferenced object 0xffffffc08af5b800 (size 1024):
+ comm "khubd", pid 73, jiffies 4295051211 (age 6482.350s)
+ hex dump (first 32 bytes):
+ 30 68 f3 8c c0 ff ff ff 00 a0 b2 2e c0 ff ff ff 0h..............
+ 01 00 00 00 00 00 00 00 00 94 7d 40 c0 ff ff ff ..........}@....
+ backtrace:
+ [<ffffffc0003079ec>] create_object+0x148/0x2a0
+ [<ffffffc000cc150c>] kmemleak_alloc+0x80/0xbc
+ [<ffffffc000303a7c>] kmem_cache_alloc_trace+0x120/0x1ac
+ [<ffffffc0006fa610>] hub_probe+0x120/0xb84
+ [<ffffffc000702b20>] usb_probe_interface+0x1ec/0x298
+ [<ffffffc0005d50cc>] driver_probe_device+0x160/0x374
+ [<ffffffc0005d5308>] __device_attach+0x28/0x4c
+ [<ffffffc0005d3164>] bus_for_each_drv+0x78/0xac
+ [<ffffffc0005d4ee0>] device_attach+0x6c/0x9c
+ [<ffffffc0005d42b8>] bus_probe_device+0x28/0xa0
+ [<ffffffc0005d23a4>] device_add+0x324/0x604
+ [<ffffffc000700fcc>] usb_set_configuration+0x660/0x6cc
+ [<ffffffc00070a350>] generic_probe+0x44/0x84
+ [<ffffffc000702914>] usb_probe_device+0x54/0x74
+ [<ffffffc0005d50cc>] driver_probe_device+0x160/0x374
+ [<ffffffc0005d5308>] __device_attach+0x28/0x4c
+
+Deadlocks:
+
+If the hub gets disconnected early enough (i.e. before INIT2/INIT3 are
+finished and the init_work is still queued), the core may call
+hub_quiesce() after acquiring interface device locks and it will wait
+for the work to be cancelled synchronously. But if the work handler is
+already running in parallel, it may try to acquire the same interface
+device lock and this may result in deadlock.
+
+Fix both the issues by removing the call to cancel_delayed_work_sync().
+
+Fixes: e50293ef9775 ("USB: fix invalid memory access in hub_activate()")
+Reported-by: Manu Gautam <mgautam@codeaurora.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1315,8 +1315,6 @@ static void hub_quiesce(struct usb_hub *
+ struct usb_device *hdev = hub->hdev;
+ int i;
+
+- cancel_delayed_work_sync(&hub->init_work);
+-
+ /* hub_wq and related activity won't re-trigger */
+ hub->quiescing = 1;
+
--- /dev/null
+From ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 5 Aug 2016 11:49:45 -0400
+Subject: USB: hub: fix up early-exit pathway in hub_activate
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 upstream.
+
+The early-exit pathway in hub_activate, added by commit e50293ef9775
+("USB: fix invalid memory access in hub_activate()") needs
+improvement. It duplicates code that is already present at the end of
+the subroutine, and it neglects to undo the effect of a
+usb_autopm_get_interface_no_resume() call.
+
+This patch fixes both problems by making the early-exit pathway jump
+directly to the end of the subroutine. It simplifies the code at the
+end by merging two conditionals that actually test the same condition
+although they appear different: If type < HUB_INIT3 then type must be
+either HUB_INIT2 or HUB_INIT, and it can't be HUB_INIT because in that
+case the subroutine would have exited earlier.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1055,11 +1055,8 @@ static void hub_activate(struct usb_hub
+ device_lock(hub->intfdev);
+
+ /* Was the hub disconnected while we were waiting? */
+- if (hub->disconnected) {
+- device_unlock(hub->intfdev);
+- kref_put(&hub->kref, hub_release);
+- return;
+- }
++ if (hub->disconnected)
++ goto disconnected;
+ if (type == HUB_INIT2)
+ goto init2;
+ goto init3;
+@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub
+ /* Scan all ports that need attention */
+ kick_hub_wq(hub);
+
+- /* Allow autosuspend if it was suppressed */
+- if (type <= HUB_INIT3)
++ if (type == HUB_INIT2 || type == HUB_INIT3) {
++ /* Allow autosuspend if it was suppressed */
++ disconnected:
+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
+-
+- if (type == HUB_INIT2 || type == HUB_INIT3)
+ device_unlock(hub->intfdev);
++ }
+
+ kref_put(&hub->kref, hub_release);
+ }
--- /dev/null
+From 539587511835ea12d8daa444cbed766cf2bc3612 Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 11 Aug 2016 10:31:14 +0800
+Subject: usb: misc: usbtest: add fix for driver hang
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit 539587511835ea12d8daa444cbed766cf2bc3612 upstream.
+
+In sg_timeout(), req->status is set to "-ETIMEDOUT" before calling
+into usb_sg_cancel(). usb_sg_cancel() will do nothing and return
+directly if req->status has been set to a non-zero value. This will
+cause driver hang whenever transfer time out is triggered.
+
+This patch fixes this issue. It could be backported to stable kernel
+with version later than v3.15.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Suggested-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/usbtest.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _re
+ {
+ struct usb_sg_request *req = (struct usb_sg_request *) _req;
+
+- req->status = -ETIMEDOUT;
+ usb_sg_cancel(req);
+ }
+
+@@ -616,8 +615,10 @@ static int perform_sglist(
+ mod_timer(&sg_timer, jiffies +
+ msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
+ usb_sg_wait(req);
+- del_timer_sync(&sg_timer);
+- retval = req->status;
++ if (!del_timer_sync(&sg_timer))
++ retval = -ETIMEDOUT;
++ else
++ retval = req->status;
+
+ /* FIXME check resulting data pattern */
+
--- /dev/null
+From 528d28138f91009f230903bd89ccd44719667831 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 26 Jul 2016 16:01:30 +0800
+Subject: usb: misc: usbtest: usbtest_do_ioctl may return positive integer
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 528d28138f91009f230903bd89ccd44719667831 upstream.
+
+For case 14 and case 21, their correct return value is the number
+of bytes transferred, so it is a positive integer. But in usbtest_ioctl,
+it takes non-zero as false return value for usbtest_do_ioctl, so
+it will treat the correct test as wrong test, then the time on
+tests will be the minus value.
+
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Fixes: 18fc4ebdc705 ("usb: misc: usbtest: Remove timeval usage")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/usbtest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -2603,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf
+ ktime_get_ts64(&start);
+
+ retval = usbtest_do_ioctl(intf, param_32);
+- if (retval)
++ if (retval < 0)
+ goto free_mutex;
+
+ ktime_get_ts64(&end);
--- /dev/null
+From 9ab967e6db7412b675ecbff80d5371d53c82cb2e Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Mon, 8 Aug 2016 21:50:52 +0900
+Subject: usb: renesas_usbhs: clear the BRDYSTS in usbhsg_ep_enable()
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 9ab967e6db7412b675ecbff80d5371d53c82cb2e upstream.
+
+This patch fixes an issue that unexpected BRDY interruption happens
+when the usb_ep_{enable,disable}() are called with different direction.
+In this case, the driver will cause the following message:
+
+ renesas_usbhs e6590000.usb: irq_ready run_error 1 : -16
+
+This issue causes the followings:
+ 1) A pipe is enabled as transmission
+ 2) The pipe sent a data
+ 3) The pipe is disabled and re-enabled as reception.
+ 4) The pipe got a queue
+
+Since the driver doesn't clear the BRDYSTS flags after 2) above, the issue
+happens. If we add such clearing the flags into the driver, the code will
+become complicate. So, this patch clears the BRDYSTS flag of reception in
+usbhsg_ep_enable() to avoid complicate.
+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/mod_gadget.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_e
+ * use dmaengine if possible.
+ * It will use pio handler if impossible.
+ */
+- if (usb_endpoint_dir_in(desc))
++ if (usb_endpoint_dir_in(desc)) {
+ pipe->handler = &usbhs_fifo_dma_push_handler;
+- else
++ } else {
+ pipe->handler = &usbhs_fifo_dma_pop_handler;
++ usbhs_xxxsts_clear(priv, BRDYSTS,
++ usbhs_pipe_number(pipe));
++ }
+
+ ret = 0;
+ }
--- /dev/null
+From 772ce81264b179c0e61340998e3b29e900b2fa6d Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Mon, 8 Aug 2016 21:50:51 +0900
+Subject: usb: renesas_usbhs: Fix receiving data corrupt on R-Car Gen3 with dmac
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 772ce81264b179c0e61340998e3b29e900b2fa6d upstream.
+
+Since R-Car Gen3 SoC has the USB-DMAC, this driver should set
+dparam->has_usb_dmac to 1. Otherwise, behavior of this driver and
+the usb-dmac driver will be mismatch, then sometimes receiving data will
+be corrupt.
+
+Fixes: de18757e272d ("usb: renesas_usbhs: add R-Car Gen3 power control")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/renesas_usbhs/common.c
++++ b/drivers/usb/renesas_usbhs/common.c
+@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_inf
+ if (gpio > 0)
+ dparam->enable_gpio = gpio;
+
+- if (dparam->type == USBHS_TYPE_RCAR_GEN2)
++ if (dparam->type == USBHS_TYPE_RCAR_GEN2 ||
++ dparam->type == USBHS_TYPE_RCAR_GEN3)
+ dparam->has_usb_dmac = 1;
+
+ return info;
--- /dev/null
+From 700aa7ff8d2c2b9cc669c99375e2ccd06d3cd38d Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Mon, 8 Aug 2016 21:50:53 +0900
+Subject: usb: renesas_usbhs: Use dmac only if the pipe type is bulk
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 700aa7ff8d2c2b9cc669c99375e2ccd06d3cd38d upstream.
+
+This patch fixes an issue that isochronous transfer's data is possible to
+be lost as a workaround. Since this driver uses a workqueue to start
+the dmac, the transfer is possible to be delayed when system load is high.
+
+Fixes: 6e4b74e4690d ("usb: renesas: fix scheduling in atomic context bug")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/fifo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struc
+
+ /* use PIO if packet is less than pio_dma_border or pipe is DCP */
+ if ((len < usbhs_get_dparam(priv, pio_dma_border)) ||
+- usbhs_pipe_is_dcp(pipe))
++ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
+ goto usbhsf_pio_prepare_push;
+
+ /* check data length if this driver don't use USB-DMAC */
+@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_u
+
+ /* use PIO if packet is less than pio_dma_border or pipe is DCP */
+ if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) ||
+- usbhs_pipe_is_dcp(pipe))
++ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
+ goto usbhsf_pio_prepare_pop;
+
+ fifo = usbhsf_get_dma_fifo(priv, pkt);
--- /dev/null
+From 647024a7df36014bbc4479d92d88e6b77c0afcf6 Mon Sep 17 00:00:00 2001
+From: Alexey Klimov <klimov.linux@gmail.com>
+Date: Mon, 8 Aug 2016 02:34:46 +0100
+Subject: USB: serial: fix memleak in driver-registration error path
+
+From: Alexey Klimov <klimov.linux@gmail.com>
+
+commit 647024a7df36014bbc4479d92d88e6b77c0afcf6 upstream.
+
+udriver struct allocated by kzalloc() will not be freed
+if usb_register() and next calls fail. This patch fixes this
+by adding one more step with kfree(udriver) in error path.
+
+Signed-off-by: Alexey Klimov <klimov.linux@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb-serial.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct u
+
+ rc = usb_register(udriver);
+ if (rc)
+- return rc;
++ goto failed_usb_register;
+
+ for (sd = serial_drivers; *sd; ++sd) {
+ (*sd)->usb_driver = udriver;
+@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct u
+ while (sd-- > serial_drivers)
+ usb_serial_deregister(*sd);
+ usb_deregister(udriver);
++failed_usb_register:
++ kfree(udriver);
+ return rc;
+ }
+ EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
--- /dev/null
+From ae34d12cc1e212ffcd92e069030e54dae69c832f Mon Sep 17 00:00:00 2001
+From: "Sheng-Hui J. Chu" <s.jeffrey.chu@gmail.com>
+Date: Thu, 28 Jul 2016 17:01:45 -0400
+Subject: USB: serial: ftdi_sio: add device ID for WICED USB UART dev board
+
+From: Sheng-Hui J. Chu <s.jeffrey.chu@gmail.com>
+
+commit ae34d12cc1e212ffcd92e069030e54dae69c832f upstream.
+
+BCM20706V2_EVAL is a WICED dev board designed with FT2232H USB 2.0
+UART/FIFO IC.
+
+To support BCM920706V2_EVAL dev board for WICED development on Linux.
+Add the VID(0a5c) and PID(6422) to ftdi_sio driver to allow loading
+ftdi_sio for this board.
+
+Signed-off-by: Sheng-Hui J. Chu <s.jeffrey.chu@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1008,6 +1008,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
++ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
+ { } /* Terminating entry */
+ };
+
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -673,6 +673,12 @@
+ #define INTREPID_NEOVI_PID 0x0701
+
+ /*
++ * WICED USB UART
++ */
++#define WICED_VID 0x0A5C
++#define WICED_USB20706V2_PID 0x6422
++
++/*
+ * Definitions for ID TECH (www.idt-net.com) devices
+ */
+ #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */
--- /dev/null
+From 6977495c06f7f47636a076ee5a0ca571279d9697 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Robert=20Deli=C3=ABn?= <robert@delien.nl>
+Date: Thu, 28 Jul 2016 18:52:55 +0000
+Subject: USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices
+
+From: Robert Deliën <robert@delien.nl>
+
+commit 6977495c06f7f47636a076ee5a0ca571279d9697 upstream.
+
+Ivium Technologies uses the FTDI VID with custom PIDs for their line of
+electrochemical interfaces and the PalmSens they developed for PalmSens
+BV.
+
+Signed-off-by: Robert Delien <robert@delien.nl>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -648,6 +648,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
+ { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -406,6 +406,12 @@
+ #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
+
+ /*
++ * Ivium Technologies product IDs
++ */
++#define FTDI_PALMSENS_PID 0xf440
++#define FTDI_IVIUM_XSTAT_PID 0xf441
++
++/*
+ * Linx Technologies product ids
+ */
+ #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */
--- /dev/null
+From cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Sun, 24 Jul 2016 13:53:30 +0200
+Subject: USB: serial: option: add D-Link DWM-156/A3
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+commit cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 upstream.
+
+The device has four interfaces; the three serial ports ought to be
+handled by this driver:
+
+00 Diagnostic interface serial port
+01 NMEA device serial port
+02 Mass storage (sd card)
+03 Modem serial port
+
+The other product ids listed in the Windows driver are present already.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1966,6 +1966,7 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
--- /dev/null
+From 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Tue, 2 Aug 2016 11:29:25 +0200
+Subject: USB: serial: option: add support for Telit LE920A4
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 01d7956b58e644ea0d2e8d9340c5727a8fc39d70 upstream.
+
+This patch adds a set of compositions for Telit LE920A4.
+
+Compositions in short are:
+
+0x1207: tty + tty
+0x1208: tty + adb + tty + tty
+0x1211: tty + adb + ecm
+0x1212: tty + adb
+0x1213: ecm + tty
+0x1214: tty + adb + ecm + tty
+
+telit_le922_blacklist_usbcfg3 is reused for compositions 0x1211
+and 0x1214 due to the same interfaces positions.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -274,6 +274,12 @@ static void option_instat_callback(struc
+ #define TELIT_PRODUCT_LE920 0x1200
+ #define TELIT_PRODUCT_LE910 0x1201
+ #define TELIT_PRODUCT_LE910_USBCFG4 0x1206
++#define TELIT_PRODUCT_LE920A4_1207 0x1207
++#define TELIT_PRODUCT_LE920A4_1208 0x1208
++#define TELIT_PRODUCT_LE920A4_1211 0x1211
++#define TELIT_PRODUCT_LE920A4_1212 0x1212
++#define TELIT_PRODUCT_LE920A4_1213 0x1213
++#define TELIT_PRODUCT_LE920A4_1214 0x1214
+
+ /* ZTE PRODUCTS */
+ #define ZTE_VENDOR_ID 0x19d2
+@@ -628,6 +634,11 @@ static const struct option_blacklist_inf
+ .reserved = BIT(1) | BIT(5),
+ };
+
++static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
++ .sendsetup = BIT(0),
++ .reserved = BIT(1),
++};
++
+ static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
+ .sendsetup = BIT(2),
+ .reserved = BIT(0) | BIT(1) | BIT(3),
+@@ -1203,6 +1214,16 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
++ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
--- /dev/null
+From aed9d65ac3278d4febd8665bd7db59ef53e825fe Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 1 Aug 2016 15:25:56 -0400
+Subject: USB: validate wMaxPacketValue entries in endpoint descriptors
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit aed9d65ac3278d4febd8665bd7db59ef53e825fe upstream.
+
+Erroneous or malicious endpoint descriptors may have non-zero bits in
+reserved positions, or out-of-bounds values. This patch helps prevent
+these from causing problems by bounds-checking the wMaxPacketValue
+entries in endpoint descriptors and capping the values at the maximum
+allowed.
+
+This issue was first discovered and tests were conducted by Jake Lamberson
+<jake.lamberson1@gmail.com>, an intern working for Rosie Hall.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: roswest <roswest@cisco.com>
+Tested-by: roswest <roswest@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 66 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 63 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_compan
+ ep, buffer, size);
+ }
+
++static const unsigned short low_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 8,
++ [USB_ENDPOINT_XFER_ISOC] = 0,
++ [USB_ENDPOINT_XFER_BULK] = 0,
++ [USB_ENDPOINT_XFER_INT] = 8,
++};
++static const unsigned short full_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 64,
++ [USB_ENDPOINT_XFER_ISOC] = 1023,
++ [USB_ENDPOINT_XFER_BULK] = 64,
++ [USB_ENDPOINT_XFER_INT] = 64,
++};
++static const unsigned short high_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 64,
++ [USB_ENDPOINT_XFER_ISOC] = 1024,
++ [USB_ENDPOINT_XFER_BULK] = 512,
++ [USB_ENDPOINT_XFER_INT] = 1023,
++};
++static const unsigned short super_speed_maxpacket_maxes[4] = {
++ [USB_ENDPOINT_XFER_CONTROL] = 512,
++ [USB_ENDPOINT_XFER_ISOC] = 1024,
++ [USB_ENDPOINT_XFER_BULK] = 1024,
++ [USB_ENDPOINT_XFER_INT] = 1024,
++};
++
+ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ int asnum, struct usb_host_interface *ifp, int num_ep,
+ unsigned char *buffer, int size)
+@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct dev
+ struct usb_endpoint_descriptor *d;
+ struct usb_host_endpoint *endpoint;
+ int n, i, j, retval;
++ unsigned int maxp;
++ const unsigned short *maxpacket_maxes;
+
+ d = (struct usb_endpoint_descriptor *) buffer;
+ buffer += d->bLength;
+@@ -286,6 +313,42 @@ static int usb_parse_endpoint(struct dev
+ endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
+ }
+
++ /* Validate the wMaxPacketSize field */
++ maxp = usb_endpoint_maxp(&endpoint->desc);
++
++ /* Find the highest legal maxpacket size for this endpoint */
++ i = 0; /* additional transactions per microframe */
++ switch (to_usb_device(ddev)->speed) {
++ case USB_SPEED_LOW:
++ maxpacket_maxes = low_speed_maxpacket_maxes;
++ break;
++ case USB_SPEED_FULL:
++ maxpacket_maxes = full_speed_maxpacket_maxes;
++ break;
++ case USB_SPEED_HIGH:
++ /* Bits 12..11 are allowed only for HS periodic endpoints */
++ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
++ i = maxp & (BIT(12) | BIT(11));
++ maxp &= ~i;
++ }
++ /* fallthrough */
++ default:
++ maxpacket_maxes = high_speed_maxpacket_maxes;
++ break;
++ case USB_SPEED_SUPER:
++ case USB_SPEED_SUPER_PLUS:
++ maxpacket_maxes = super_speed_maxpacket_maxes;
++ break;
++ }
++ j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
++
++ if (maxp > j) {
++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
++ cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
++ maxp = j;
++ endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
++ }
++
+ /*
+ * Some buggy high speed devices have bulk endpoints using
+ * maxpacket sizes other than 512. High speed HCDs may not
+@@ -293,9 +356,6 @@ static int usb_parse_endpoint(struct dev
+ */
+ if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
+ && usb_endpoint_xfer_bulk(d)) {
+- unsigned maxp;
+-
+- maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
+ if (maxp != 512)
+ dev_warn(ddev, "config %d interface %d altsetting %d "
+ "bulk endpoint 0x%X has invalid maxpacket %d\n",
--- /dev/null
+From 88716a93766b8f095cdef37a8e8f2c93aa233b21 Mon Sep 17 00:00:00 2001
+From: Jim Lin <jilin@nvidia.com>
+Date: Tue, 16 Aug 2016 10:18:05 +0300
+Subject: usb: xhci: Fix panic if disconnect
+
+From: Jim Lin <jilin@nvidia.com>
+
+commit 88716a93766b8f095cdef37a8e8f2c93aa233b21 upstream.
+
+After a device is disconnected, xhci_stop_device() will be invoked
+in xhci_bus_suspend().
+Also the "disconnect" IRQ will have ISR to invoke
+xhci_free_virt_device() in this sequence.
+xhci_irq -> xhci_handle_event -> handle_cmd_completion ->
+xhci_handle_cmd_disable_slot -> xhci_free_virt_device
+
+If xhci->devs[slot_id] has been assigned to NULL in
+xhci_free_virt_device(), then virt_dev->eps[i].ring in
+xhci_stop_device() may point to an invlid address to cause kernel
+panic.
+
+virt_dev = xhci->devs[slot_id];
+:
+if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
+
+[] Unable to handle kernel paging request at virtual address 00001a68
+[] pgd=ffffffc001430000
+[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003,
+*pmd=000000013c808003, *pte=0000000000000000
+[] Internal error: Oops: 96000006 [#1] PREEMPT SMP
+[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G U
+[] Workqueue: pm pm_runtime_work
+[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti:
+ffffffc0bc0ec000
+[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4
+
+This issue is found when running with realtek ethernet device
+(0bda:8153).
+
+Signed-off-by: Jim Lin <jilin@nvidia.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_
+
+ ret = 0;
+ virt_dev = xhci->devs[slot_id];
++ if (!virt_dev)
++ return -ENODEV;
++
+ cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
+ if (!cmd) {
+ xhci_dbg(xhci, "Couldn't allocate command structure.\n");
--- /dev/null
+From 33be126510974e2eb9679f1ca9bca4f67ee4c4c7 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 16 Aug 2016 10:18:03 +0300
+Subject: xhci: always handle "Command Ring Stopped" events
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 33be126510974e2eb9679f1ca9bca4f67ee4c4c7 upstream.
+
+Fix "Command completion event does not match command" errors by always
+handling the command ring stopped events.
+
+The command ring stopped event is generated as a result of aborting
+or stopping the command ring with a register write. It is not caused
+by a command in the command queue, and thus won't have a matching command
+in the comman list.
+
+Solve it by handling the command ring stopped event before checking for a
+matching command.
+
+In most command time out cases we abort the command ring, and get
+a command ring stopped event. The events command pointer will point at
+the current command ring dequeue, which in most cases matches the timed
+out command in the command list, and no error messages are seen.
+
+If we instead get a command aborted event before the command ring stopped
+event, the abort event will increse the command ring dequeue pointer, and
+the following command ring stopped events command pointer will point at the
+next, not yet queued command. This case triggered the error message
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1325,12 +1325,6 @@ static void handle_cmd_completion(struct
+
+ cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
+
+- if (cmd->command_trb != xhci->cmd_ring->dequeue) {
+- xhci_err(xhci,
+- "Command completion event does not match command\n");
+- return;
+- }
+-
+ del_timer(&xhci->cmd_timer);
+
+ trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
+@@ -1342,6 +1336,13 @@ static void handle_cmd_completion(struct
+ xhci_handle_stopped_cmd_ring(xhci, cmd);
+ return;
+ }
++
++ if (cmd->command_trb != xhci->cmd_ring->dequeue) {
++ xhci_err(xhci,
++ "Command completion event does not match command\n");
++ return;
++ }
++
+ /*
+ * Host aborted the command ring, check if the current command was
+ * supposed to be aborted, otherwise continue normally.
--- /dev/null
+From f1f6d9a8b540df22b87a5bf6bc104edaade81f47 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 16 Aug 2016 10:18:06 +0300
+Subject: xhci: don't dereference a xhci member after removing xhci
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit f1f6d9a8b540df22b87a5bf6bc104edaade81f47 upstream.
+
+Remove the hcd after checking for the xhci last quirks, not before.
+
+This caused a hang on a Alpine Ridge xhci based maching which remove
+the whole xhci controller when unplugging the last usb device
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_d
+ usb_remove_hcd(xhci->shared_hcd);
+ usb_put_hcd(xhci->shared_hcd);
+ }
+- usb_hcd_pci_remove(dev);
+
+ /* Workaround for spurious wakeups at shutdown with HSW */
+ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+ pci_set_power_state(dev, PCI_D3hot);
++
++ usb_hcd_pci_remove(dev);
+ }
+
+ #ifdef CONFIG_PM
projects / thirdparty / kernel / stable-queue.git / commitdiff
