--- /dev/null
+From 4763601a56f155ddf94ef35fc2c41504a2de15f5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 29 Nov 2016 22:28:40 +0100
+Subject: ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4763601a56f155ddf94ef35fc2c41504a2de15f5 upstream.
+
+The function returns -EINVAL even if it builds the stream properly.
+The bogus error code sneaked in during the code refactoring, but it
+wasn't noticed until now since the returned error code itself is
+ignored in anyway. Kill it here, but there is no behavior change by
+this patch, obviously.
+
+Fixes: e5779998bf8b ('ALSA: usb-audio: refactor code')
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/card.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -206,7 +206,6 @@ static int snd_usb_create_stream(struct
+ if (! snd_usb_parse_audio_interface(chip, interface)) {
+ usb_set_interface(dev, interface, 0); /* reset the current interface */
+ usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
+- return -EINVAL;
+ }
+
+ return 0;
--- /dev/null
+From dc8ee9dbdba509fb58e23ba79f2e6059fe5d8b3b Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 7 Nov 2016 20:07:07 +0100
+Subject: ARM: dts: r8a7794: Correct hsusb parent clock
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit dc8ee9dbdba509fb58e23ba79f2e6059fe5d8b3b upstream.
+
+The parent clock of the HSUSB clock is the HP clock, not the MP clock.
+
+Fixes: c7bab9f929e51761 ("ARM: shmobile: r8a7794: Add USB clocks to device tree")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/r8a7794.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/r8a7794.dtsi
++++ b/arch/arm/boot/dts/r8a7794.dtsi
+@@ -1260,7 +1260,7 @@
+ mstp7_clks: mstp7_clks@e615014c {
+ compatible = "renesas,r8a7794-mstp-clocks", "renesas,cpg-mstp-clocks";
+ reg = <0 0xe615014c 0 4>, <0 0xe61501c4 0 4>;
+- clocks = <&mp_clk>, <&mp_clk>,
++ clocks = <&mp_clk>, <&hp_clk>,
+ <&zs_clk>, <&p_clk>, <&p_clk>, <&zs_clk>,
+ <&zs_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
+ <&zx_clk>;
--- /dev/null
+From 0cff18cbab4f55581d9da86e4286655d9723d7d2 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Tue, 15 Nov 2016 21:51:04 +0800
+Subject: ARM: dts: sun7i: bananapi-m1-plus: Enable USB PHY for USB host support
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 0cff18cbab4f55581d9da86e4286655d9723d7d2 upstream.
+
+The 2 USB host ports are directly tied to the 2 USB hosts in the SoC.
+The 2 host pairs were already enabled, but the USB PHY wasn't.
+VBUS on the 2 ports are always on.
+
+Enable the USB PHY.
+
+Fixes: 04c85ecad32a ("ARM: dts: sun7i: Add dts file for Bananapi M1 Plus
+ board")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
++++ b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
+@@ -227,3 +227,8 @@
+ pinctrl-0 = <&uart0_pins_a>;
+ status = "okay";
+ };
++
++&usbphy {
++ /* VBUS on usb host ports are tied to DC5V and therefore always on */
++ status = "okay";
++};
--- /dev/null
+From 4d75a171b67ffc3f4dadbd654c9d281091300eb2 Mon Sep 17 00:00:00 2001
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+Date: Sat, 24 Sep 2016 17:14:21 +0800
+Subject: arm64: dts: hip06: Correct hardware pin number of usb node
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+commit 4d75a171b67ffc3f4dadbd654c9d281091300eb2 upstream.
+
+The ohci/ehci hardware pin number should be 640/641, correct them.
+
+Fixes: commit aa8d3e74f54d ("arm64: dts: Add initial dts for Hisilicon Hip06 D03 board")
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/hisilicon/hip06.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/hisilicon/hip06.dtsi
++++ b/arch/arm64/boot/dts/hisilicon/hip06.dtsi
+@@ -322,7 +322,7 @@
+ compatible = "generic-ohci";
+ reg = <0x0 0xa7030000 0x0 0x10000>;
+ interrupt-parent = <&mbigen_usb>;
+- interrupts = <64 4>;
++ interrupts = <640 4>;
+ dma-coherent;
+ status = "disabled";
+ };
+@@ -331,7 +331,7 @@
+ compatible = "generic-ehci";
+ reg = <0x0 0xa7020000 0x0 0x10000>;
+ interrupt-parent = <&mbigen_usb>;
+- interrupts = <65 4>;
++ interrupts = <641 4>;
+ dma-coherent;
+ status = "disabled";
+ };
--- /dev/null
+From 1f5ecaf985c46889278f51fcb7bc143f60f4eb14 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Sat, 29 Oct 2016 23:36:24 -0200
+Subject: [media] dibusb: fix possible memory leak in dibusb_rc_query()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 1f5ecaf985c46889278f51fcb7bc143f60f4eb14 upstream.
+
+'buf' is malloced in dibusb_rc_query() and should be freed before
+leaving from the error handling cases, otherwise it will cause
+memory leak.
+
+Fixes: ff1c123545d7 ("[media] dibusb: handle error code on RC query")
+
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/dibusb-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/dvb-usb/dibusb-common.c
++++ b/drivers/media/usb/dvb-usb/dibusb-common.c
+@@ -382,9 +382,9 @@ int dibusb_rc_query(struct dvb_usb_devic
+ if (buf[0] != 0)
+ deb_info("key: %*ph\n", 5, buf);
+
++ret:
+ kfree(buf);
+
+-ret:
+ return ret;
+ }
+ EXPORT_SYMBOL(dibusb_rc_query);
--- /dev/null
+From 65e4345c8ef8811bbb4860fe5f2df10646b7f2e1 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Fri, 30 Dec 2016 23:54:18 +0100
+Subject: iio: accel: st_accel: fix LIS3LV02 reading and scaling
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 65e4345c8ef8811bbb4860fe5f2df10646b7f2e1 upstream.
+
+The LIS3LV02 has a special bit that need to be set to get the
+read values left aligned. Before this patch we get gibberish
+like this:
+
+iio_generic_buffer -a -c10 -n lis3lv02dl_accel
+(...)
+0.000000 -0.010042 -0.642688 19155832931907
+0.000000 -0.010042 -0.642688 19155858751073
+
+Which is because we read a raw value for 1g as 64 which is
+the nominal 1024 for 1g shifted 4 bits to the left by being
+right-aligned rather than left aligned.
+
+Since all other sensors are left aligned, add some code to
+set the special DAS (data alignment setting) bit to 1 so that
+the right value is now read like this:
+
+iio_generic_buffer -a -c10 -n lis3lv02dl_accel
+(...)
+0.000000 -0.147095 -10.120135 24761614364956
+-0.029419 -0.176514 -10.120135 24761631624540
+
+The scaling was weird as well: we have a gain of 1000 for 1g
+and 3000 for 6g. I don't even remember how I came up with the
+old values but they are wrong.
+
+Fixes: 3acddf74f807 ("iio: st-sensors: add support for lis3lv02d accelerometer")
+Cc: Lorenzo Bianconi <lorenzo.bianconi@st.com>
+Cc: Giuseppe Barba <giuseppe.barba@st.com>
+Cc: Denis Ciocca <denis.ciocca@st.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/st_accel_core.c | 12 ++++++++++--
+ drivers/iio/common/st_sensors/st_sensors_core.c | 9 +++++++++
+ include/linux/iio/common/st_sensors.h | 12 ++++++++++++
+ 3 files changed, 31 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/accel/st_accel_core.c
++++ b/drivers/iio/accel/st_accel_core.c
+@@ -154,8 +154,8 @@
+ #define ST_ACCEL_4_FS_MASK 0x80
+ #define ST_ACCEL_4_FS_AVL_2_VAL 0X00
+ #define ST_ACCEL_4_FS_AVL_6_VAL 0X01
+-#define ST_ACCEL_4_FS_AVL_2_GAIN IIO_G_TO_M_S_2(1024)
+-#define ST_ACCEL_4_FS_AVL_6_GAIN IIO_G_TO_M_S_2(340)
++#define ST_ACCEL_4_FS_AVL_2_GAIN IIO_G_TO_M_S_2(1000)
++#define ST_ACCEL_4_FS_AVL_6_GAIN IIO_G_TO_M_S_2(3000)
+ #define ST_ACCEL_4_BDU_ADDR 0x21
+ #define ST_ACCEL_4_BDU_MASK 0x40
+ #define ST_ACCEL_4_DRDY_IRQ_ADDR 0x21
+@@ -346,6 +346,14 @@ static const struct st_sensor_settings s
+ .addr = ST_ACCEL_1_BDU_ADDR,
+ .mask = ST_ACCEL_1_BDU_MASK,
+ },
++ /*
++ * Data Alignment Setting - needs to be set to get
++ * left-justified data like all other sensors.
++ */
++ .das = {
++ .addr = 0x21,
++ .mask = 0x01,
++ },
+ .drdy_irq = {
+ .addr = ST_ACCEL_1_DRDY_IRQ_ADDR,
+ .mask_int1 = ST_ACCEL_1_DRDY_IRQ_INT1_MASK,
+--- a/drivers/iio/common/st_sensors/st_sensors_core.c
++++ b/drivers/iio/common/st_sensors/st_sensors_core.c
+@@ -401,6 +401,15 @@ int st_sensors_init_sensor(struct iio_de
+ return err;
+ }
+
++ /* set DAS */
++ if (sdata->sensor_settings->das.addr) {
++ err = st_sensors_write_data_with_mask(indio_dev,
++ sdata->sensor_settings->das.addr,
++ sdata->sensor_settings->das.mask, 1);
++ if (err < 0)
++ return err;
++ }
++
+ if (sdata->int_pin_open_drain) {
+ dev_info(&indio_dev->dev,
+ "set interrupt line to open drain mode\n");
+--- a/include/linux/iio/common/st_sensors.h
++++ b/include/linux/iio/common/st_sensors.h
+@@ -116,6 +116,16 @@ struct st_sensor_bdu {
+ };
+
+ /**
++ * struct st_sensor_das - ST sensor device data alignment selection
++ * @addr: address of the register.
++ * @mask: mask to write the das flag for left alignment.
++ */
++struct st_sensor_das {
++ u8 addr;
++ u8 mask;
++};
++
++/**
+ * struct st_sensor_data_ready_irq - ST sensor device data-ready interrupt
+ * @addr: address of the register.
+ * @mask_int1: mask to enable/disable IRQ on INT1 pin.
+@@ -185,6 +195,7 @@ struct st_sensor_transfer_function {
+ * @enable_axis: Enable one or more axis of the sensor.
+ * @fs: Full scale register and full scale list available.
+ * @bdu: Block data update register.
++ * @das: Data Alignment Selection register.
+ * @drdy_irq: Data ready register of the sensor.
+ * @multi_read_bit: Use or not particular bit for [I2C/SPI] multi-read.
+ * @bootime: samples to discard when sensor passing from power-down to power-up.
+@@ -200,6 +211,7 @@ struct st_sensor_settings {
+ struct st_sensor_axis enable_axis;
+ struct st_sensor_fullscale fs;
+ struct st_sensor_bdu bdu;
++ struct st_sensor_das das;
+ struct st_sensor_data_ready_irq drdy_irq;
+ bool multi_read_bit;
+ unsigned int bootime;
--- /dev/null
+From 5026c9cb0744a9cd40242743ca91a5d712f468c6 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Wed, 14 Dec 2016 17:56:51 +0200
+Subject: mei: bus: fix mei_cldev_enable KDoc
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 5026c9cb0744a9cd40242743ca91a5d712f468c6 upstream.
+
+Adjust function name in KDoc.
+
+Fixes: d49dc5e76fc9 (mei: bus: use mei_cldev_ prefix for the API functions)
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -408,7 +408,7 @@ bool mei_cldev_enabled(struct mei_cl_dev
+ EXPORT_SYMBOL_GPL(mei_cldev_enabled);
+
+ /**
+- * mei_cldev_enable_device - enable me client device
++ * mei_cldev_enable - enable me client device
+ * create connection with me client
+ *
+ * @cldev: me client device
--- /dev/null
+From 967b274e02e18c9fbb4d19b96a89bd0afbc77b7a Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Fri, 11 Nov 2016 03:00:09 +0200
+Subject: mei: fix parameter rename KDoc
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 967b274e02e18c9fbb4d19b96a89bd0afbc77b7a upstream.
+
+Parameter renaming to fop_type was not reflected in KDoc
+
+Fixes: 3030dc0564594 (mei: add wrapper for queuing control commands)
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -425,7 +425,7 @@ static inline void mei_io_list_free(stru
+ *
+ * @cl: host client
+ * @length: size of the buffer
+- * @type: operation type
++ * @fop_type: operation type
+ * @fp: associated file pointer (might be NULL)
+ *
+ * Return: cb on success and NULL on failure
+@@ -459,7 +459,7 @@ struct mei_cl_cb *mei_cl_alloc_cb(struct
+ *
+ * @cl: host client
+ * @length: size of the buffer
+- * @type: operation type
++ * @fop_type: operation type
+ * @fp: associated file pointer (might be NULL)
+ *
+ * Return: cb on success and NULL on failure
--- /dev/null
+From e09ee853c92011860a4bd2fbdf6126f60fc16bd3 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Wed, 14 Dec 2016 17:56:52 +0200
+Subject: mei: move write cb to completion on credentials failures
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit e09ee853c92011860a4bd2fbdf6126f60fc16bd3 upstream.
+
+The credentials handling was pushed to the write handlers
+but error handling wasn't done properly.
+Move write callbacks to completion queue to destroy them
+and to notify a blocked writer about the failure
+
+Fixes: 136698e535cd1 (mei: push credentials inside the irq write handler)
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -1536,7 +1536,7 @@ int mei_cl_irq_write(struct mei_cl *cl,
+
+ rets = first_chunk ? mei_cl_tx_flow_ctrl_creds(cl) : 1;
+ if (rets < 0)
+- return rets;
++ goto err;
+
+ if (rets == 0) {
+ cl_dbg(dev, cl, "No flow control credentials: not sending.\n");
+@@ -1570,11 +1570,8 @@ int mei_cl_irq_write(struct mei_cl *cl,
+ cb->buf.size, cb->buf_idx);
+
+ rets = mei_write_message(dev, &mei_hdr, buf->data + cb->buf_idx);
+- if (rets) {
+- cl->status = rets;
+- list_move_tail(&cb->list, &cmpl_list->list);
+- return rets;
+- }
++ if (rets)
++ goto err;
+
+ cl->status = 0;
+ cl->writing_state = MEI_WRITING;
+@@ -1582,14 +1579,21 @@ int mei_cl_irq_write(struct mei_cl *cl,
+ cb->completed = mei_hdr.msg_complete == 1;
+
+ if (first_chunk) {
+- if (mei_cl_tx_flow_ctrl_creds_reduce(cl))
+- return -EIO;
++ if (mei_cl_tx_flow_ctrl_creds_reduce(cl)) {
++ rets = -EIO;
++ goto err;
++ }
+ }
+
+ if (mei_hdr.msg_complete)
+ list_move_tail(&cb->list, &dev->write_waiting_list.list);
+
+ return 0;
++
++err:
++ cl->status = rets;
++ list_move_tail(&cb->list, &cmpl_list->list);
++ return rets;
+ }
+
+ /**
usb-hub-move-hub_port_disable-to-fix-warning-if-pm-is-disabled.patch
usb-gadget-udc-core-fix-return-code-of-usb_gadget_probe_driver.patch
usb-musb-blackfin-add-bfin_fifo_offset-in-bfin_ops.patch
+alsa-usb-audio-fix-bogus-error-return-in-snd_usb_create_stream.patch
+usb-serial-kl5kusb105-abort-on-open-exception-path.patch
+usb-gadget-fix-second-argument-of-percpu_ida_alloc.patch
+usb-gadget-fix-request-length-error-for-isoc-transfer.patch
+arm-dts-r8a7794-correct-hsusb-parent-clock.patch
+usb-phy-am335x-control-fix-device-and-of_node-leaks.patch
+arm64-dts-hip06-correct-hardware-pin-number-of-usb-node.patch
+arm-dts-sun7i-bananapi-m1-plus-enable-usb-phy-for-usb-host-support.patch
+dibusb-fix-possible-memory-leak-in-dibusb_rc_query.patch
+usb-serial-io_ti-bind-to-interface-after-fw-download.patch
+mei-fix-parameter-rename-kdoc.patch
+mei-bus-fix-mei_cldev_enable-kdoc.patch
+mei-move-write-cb-to-completion-on-credentials-failures.patch
+staging-iio-ad7606-fix-improper-setting-of-oversampling-pins.patch
+iio-accel-st_accel-fix-lis3lv02-reading-and-scaling.patch
--- /dev/null
+From b321a38d2407c7e425c54bc09be909a34e49f740 Mon Sep 17 00:00:00 2001
+From: Eva Rachel Retuya <eraretuya@gmail.com>
+Date: Sun, 9 Oct 2016 00:05:39 +0800
+Subject: staging: iio: ad7606: fix improper setting of oversampling pins
+
+From: Eva Rachel Retuya <eraretuya@gmail.com>
+
+commit b321a38d2407c7e425c54bc09be909a34e49f740 upstream.
+
+The oversampling ratio is controlled using the oversampling pins,
+OS [2:0] with OS2 being the MSB control bit, and OS0 the LSB control
+bit.
+
+The gpio connected to the OS2 pin is not being set correctly, only OS0
+and OS1 pins are being set. Fix the typo to allow proper control of the
+oversampling pins.
+
+Signed-off-by: Eva Rachel Retuya <eraretuya@gmail.com>
+Fixes: b9618c0 ("staging: IIO: ADC: New driver for AD7606/AD7606-6/AD7606-4")
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/adc/ad7606_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/iio/adc/ad7606_core.c
++++ b/drivers/staging/iio/adc/ad7606_core.c
+@@ -189,7 +189,7 @@ static ssize_t ad7606_store_oversampling
+ mutex_lock(&indio_dev->mlock);
+ gpio_set_value(st->pdata->gpio_os0, (ret >> 0) & 1);
+ gpio_set_value(st->pdata->gpio_os1, (ret >> 1) & 1);
+- gpio_set_value(st->pdata->gpio_os1, (ret >> 2) & 1);
++ gpio_set_value(st->pdata->gpio_os2, (ret >> 2) & 1);
+ st->oversampling = lval;
+ mutex_unlock(&indio_dev->mlock);
+
--- /dev/null
+From 982555fc26f9d8bcdbd5f9db0378fe0682eb4188 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 8 Nov 2016 10:08:24 +0800
+Subject: usb: gadget: fix request length error for isoc transfer
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 982555fc26f9d8bcdbd5f9db0378fe0682eb4188 upstream.
+
+For isoc endpoint descriptor, the wMaxPacketSize is not real max packet
+size (see Table 9-13. Standard Endpoint Descriptor, USB 2.0 specifcation),
+it may contain the number of packet, so the real max packet should be
+ep->desc->wMaxPacketSize && 0x7ff.
+
+Cc: Felipe F. Tonello <eu@felipetonello.com>
+Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
+Fixes: 16b114a6d797 ("usb: gadget: fix usb_ep_align_maybe
+ endianness and new usb_ep_aligna")
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/usb/gadget.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/include/linux/usb/gadget.h
++++ b/include/linux/usb/gadget.h
+@@ -429,7 +429,9 @@ static inline struct usb_gadget *dev_to_
+ */
+ static inline size_t usb_ep_align(struct usb_ep *ep, size_t len)
+ {
+- return round_up(len, (size_t)le16_to_cpu(ep->desc->wMaxPacketSize));
++ int max_packet_size = (size_t)usb_endpoint_maxp(ep->desc) & 0x7ff;
++
++ return round_up(len, max_packet_size);
+ }
+
+ /**
--- /dev/null
+From 03274445c01562d5352ea522431ab8c6175e2bbf Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Fri, 18 Nov 2016 15:42:41 -0800
+Subject: usb: gadget: Fix second argument of percpu_ida_alloc()
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 03274445c01562d5352ea522431ab8c6175e2bbf upstream.
+
+Pass a task state as second argument to percpu_ida_alloc().
+
+Fixes: commit 71e7ae8e1fb2 ("usb-gadget/tcm: Conversion to percpu_ida tag pre-allocation")
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_tcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_tcm.c
++++ b/drivers/usb/gadget/function/f_tcm.c
+@@ -1073,7 +1073,7 @@ static struct usbg_cmd *usbg_get_cmd(str
+ struct usbg_cmd *cmd;
+ int tag;
+
+- tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
++ tag = percpu_ida_alloc(&se_sess->sess_tag_pool, TASK_RUNNING);
+ if (tag < 0)
+ return ERR_PTR(-ENOMEM);
+
--- /dev/null
+From 015105b12183556771e111e93f5266851e7c5582 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 1 Nov 2016 11:40:25 +0100
+Subject: USB: phy: am335x-control: fix device and of_node leaks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 015105b12183556771e111e93f5266851e7c5582 upstream.
+
+Make sure to drop the references taken by of_parse_phandle() and
+bus_find_device() before returning from am335x_get_phy_control().
+
+Note that there is no guarantee that the devres-managed struct
+phy_control will be valid for the lifetime of the sibling phy device
+regardless of this change.
+
+Fixes: 3bb869c8b3f1 ("usb: phy: Add AM335x PHY driver")
+Acked-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/phy/phy-am335x-control.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/phy/phy-am335x-control.c
++++ b/drivers/usb/phy/phy-am335x-control.c
+@@ -134,10 +134,12 @@ struct phy_control *am335x_get_phy_contr
+ return NULL;
+
+ dev = bus_find_device(&platform_bus_type, NULL, node, match);
++ of_node_put(node);
+ if (!dev)
+ return NULL;
+
+ ctrl_usb = dev_get_drvdata(dev);
++ put_device(dev);
+ if (!ctrl_usb)
+ return NULL;
+ return &ctrl_usb->phy_ctrl;
--- /dev/null
+From e35d6d7c4e6532a89732cf4bace0e910ee684c88 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 3 Jan 2017 16:39:46 +0100
+Subject: USB: serial: io_ti: bind to interface after fw download
+
+From: Johan Hovold <johan@kernel.org>
+
+commit e35d6d7c4e6532a89732cf4bace0e910ee684c88 upstream.
+
+Bind to the interface, but do not register any ports, after having
+downloaded the firmware. The device will still disconnect and
+re-enumerate, but this way we avoid an error messages from being logged
+as part of the process:
+
+io_ti: probe of 1-1.3:1.0 failed with error -5
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/io_ti.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -1499,8 +1499,7 @@ static int do_boot_mode(struct edgeport_
+
+ dev_dbg(dev, "%s - Download successful -- Device rebooting...\n", __func__);
+
+- /* return an error on purpose */
+- return -ENODEV;
++ return 1;
+ }
+
+ stayinbootmode:
--- /dev/null
+From 3c3dd1e058cb01e835dcade4b54a6f13ffaeaf7c Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Tue, 29 Nov 2016 16:55:02 +0100
+Subject: USB: serial: kl5kusb105: abort on open exception path
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 3c3dd1e058cb01e835dcade4b54a6f13ffaeaf7c upstream.
+
+Function klsi_105_open() calls usb_control_msg() (to "enable read") and
+checks its return value. When the return value is unexpected, it only
+assigns the error code to the return variable retval, but does not
+terminate the exception path. This patch fixes the bug by inserting
+"goto err_generic_close;" when the call to usb_control_msg() fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+[johan: rebase on prerequisite fix and amend commit message]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/kl5kusb105.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/kl5kusb105.c
++++ b/drivers/usb/serial/kl5kusb105.c
+@@ -311,6 +311,7 @@ static int klsi_105_open(struct tty_str
+ if (rc < 0) {
+ dev_err(&port->dev, "Enabling read failed (error = %d)\n", rc);
+ retval = rc;
++ goto err_generic_close;
+ } else
+ dev_dbg(&port->dev, "%s - enabled reading\n", __func__);
+
+@@ -337,6 +338,7 @@ err_disable_read:
+ 0, /* index */
+ NULL, 0,
+ KLSI_TIMEOUT);
++err_generic_close:
+ usb_serial_generic_close(port);
+ err_free_cfg:
+ kfree(cfg);
projects / thirdparty / kernel / stable-queue.git / commitdiff
