--- /dev/null
+From d4acf3650c7c968f46ad932b9a25d1cc24cf4998 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Wed, 9 Aug 2017 11:28:06 -0700
+Subject: block: Make blk_mq_delay_kick_requeue_list() rerun the queue at a quiet time
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+commit d4acf3650c7c968f46ad932b9a25d1cc24cf4998 upstream.
+
+The blk_mq_delay_kick_requeue_list() function is used by the device
+mapper and only by the device mapper to rerun the queue and requeue
+list after a delay. This function is called once per request that
+gets requeued. Modify this function such that the queue is run once
+per path change event instead of once per request that is requeued.
+
+Fixes: commit 2849450ad39d ("blk-mq: introduce blk_mq_delay_kick_requeue_list()")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Mike Snitzer <snitzer@redhat.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -620,8 +620,8 @@ EXPORT_SYMBOL(blk_mq_kick_requeue_list);
+ void blk_mq_delay_kick_requeue_list(struct request_queue *q,
+ unsigned long msecs)
+ {
+- kblockd_schedule_delayed_work(&q->requeue_work,
+- msecs_to_jiffies(msecs));
++ kblockd_mod_delayed_work_on(WORK_CPU_UNBOUND, &q->requeue_work,
++ msecs_to_jiffies(msecs));
+ }
+ EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list);
+
--- /dev/null
+From d630213f2a47933e1037909273a20023ba3e598d Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Mon, 10 Jul 2017 14:41:25 +0200
+Subject: drm/bridge: tc358767: fix probe without attached output node
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit d630213f2a47933e1037909273a20023ba3e598d upstream.
+
+The output node of the TC358767 is only used if another bridge is chained
+behind it. Panels attached to the TC358767 can be detected using the usual
+DP AUX probing. This restores the old behavior of ignoring the output if
+no endpoint is found.
+
+Fixes: ebc944613567 (drm: convert drivers to use drm_of_find_panel_or_bridge)
+Acked-by: Andrey Gusakov <andrey.gusakov@cogentembedded.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Archit Taneja <architt@codeaurora.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20170710124125.9019-1-l.stach@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/bridge/tc358767.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1255,7 +1255,7 @@ static int tc_probe(struct i2c_client *c
+
+ /* port@2 is the output port */
+ ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &tc->panel, NULL);
+- if (ret)
++ if (ret && ret != -ENODEV)
+ return ret;
+
+ /* Shut down GPIO is optional */
--- /dev/null
+From d6f756e09f01ea7a0efbbcef269a1e384a35d824 Mon Sep 17 00:00:00 2001
+From: "Wladimir J. van der Laan" <laanwj@gmail.com>
+Date: Tue, 25 Jul 2017 14:33:36 +0200
+Subject: drm/etnaviv: Fix off-by-one error in reloc checking
+
+From: Wladimir J. van der Laan <laanwj@gmail.com>
+
+commit d6f756e09f01ea7a0efbbcef269a1e384a35d824 upstream.
+
+A relocation pointing to the last four bytes of a buffer can
+legitimately happen in the case of small vertex buffers.
+
+Signed-off-by: Wladimir J. van der Laan <laanwj@gmail.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+@@ -270,8 +270,8 @@ static int submit_reloc(struct etnaviv_g
+ if (ret)
+ return ret;
+
+- if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) {
+- DRM_ERROR("relocation %u outside object", i);
++ if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) {
++ DRM_ERROR("relocation %u outside object\n", i);
+ return -EINVAL;
+ }
+
--- /dev/null
+From 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Date: Mon, 24 Jul 2017 11:14:31 +0200
+Subject: drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut
+
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+
+commit 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 upstream.
+
+bdw_load_gamma_lut is writing beyond the array to the maximum value.
+The intend of the function is to clamp values > 1 to 1, so write
+the intended color to the max register.
+
+This fixes the following KASAN warning:
+
+[ 197.020857] [IGT] kms_pipe_color: executing
+[ 197.063434] [IGT] kms_pipe_color: starting subtest ctm-0-25-pipe0
+[ 197.078989] ==================================================================
+[ 197.079127] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
+[ 197.079188] Read of size 2 at addr ffff8800d38db150 by task kms_pipe_color/1839
+[ 197.079208] CPU: 2 PID: 1839 Comm: kms_pipe_color Tainted: G U 4.13.0-rc1-patser+ #5211
+[ 197.079215] Hardware name: NUC5i7RYB, BIOS RYBDWi35.86A.0246.2015.0309.1355 03/09/2015
+[ 197.079220] Call Trace:
+[ 197.079230] dump_stack+0x68/0x9e
+[ 197.079239] print_address_description+0x6f/0x250
+[ 197.079251] kasan_report+0x216/0x370
+[ 197.079374] ? bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
+[ 197.079451] ? gen8_write16+0x4e0/0x4e0 [i915]
+[ 197.079460] __asan_report_load2_noabort+0x14/0x20
+[ 197.079535] bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915]
+[ 197.079612] broadwell_load_luts+0x1df/0x550 [i915]
+[ 197.079690] intel_color_load_luts+0x7b/0x80 [i915]
+[ 197.079764] intel_begin_crtc_commit+0x138/0x760 [i915]
+[ 197.079783] drm_atomic_helper_commit_planes_on_crtc+0x1a3/0x820 [drm_kms_helper]
+[ 197.079859] ? intel_pre_plane_update+0x571/0x580 [i915]
+[ 197.079937] intel_update_crtc+0x238/0x330 [i915]
+[ 197.080016] intel_update_crtcs+0x10f/0x210 [i915]
+[ 197.080092] intel_atomic_commit_tail+0x1552/0x3340 [i915]
+[ 197.080101] ? _raw_spin_unlock+0x3c/0x40
+[ 197.080110] ? __queue_work+0xb40/0xbf0
+[ 197.080188] ? skl_update_crtcs+0xc00/0xc00 [i915]
+[ 197.080195] ? trace_hardirqs_on+0xd/0x10
+[ 197.080269] ? intel_atomic_commit_ready+0x128/0x13c [i915]
+[ 197.080329] ? __i915_sw_fence_complete+0x5b8/0x6d0 [i915]
+[ 197.080336] ? debug_object_activate+0x39e/0x580
+[ 197.080397] ? i915_sw_fence_await+0x30/0x30 [i915]
+[ 197.080409] ? __might_sleep+0x15b/0x180
+[ 197.080483] intel_atomic_commit+0x944/0xa70 [i915]
+[ 197.080490] ? refcount_dec_and_test+0x11/0x20
+[ 197.080567] ? intel_atomic_commit_tail+0x3340/0x3340 [i915]
+[ 197.080597] ? drm_atomic_crtc_set_property+0x303/0x580 [drm]
+[ 197.080674] ? intel_atomic_commit_tail+0x3340/0x3340 [i915]
+[ 197.080704] drm_atomic_commit+0xd7/0xe0 [drm]
+[ 197.080722] drm_atomic_helper_crtc_set_property+0xec/0x130 [drm_kms_helper]
+[ 197.080749] drm_mode_crtc_set_obj_prop+0x7d/0xb0 [drm]
+[ 197.080775] drm_mode_obj_set_property_ioctl+0x50b/0x5d0 [drm]
+[ 197.080783] ? __might_fault+0x104/0x180
+[ 197.080809] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
+[ 197.080838] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
+[ 197.080861] drm_ioctl_kernel+0x154/0x1a0 [drm]
+[ 197.080885] drm_ioctl+0x624/0x8f0 [drm]
+[ 197.080910] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm]
+[ 197.080934] ? drm_getunique+0x210/0x210 [drm]
+[ 197.080943] ? __handle_mm_fault+0x1bd0/0x1ce0
+[ 197.080949] ? lock_downgrade+0x610/0x610
+[ 197.080957] ? __lru_cache_add+0x15a/0x180
+[ 197.080967] do_vfs_ioctl+0xd92/0xe40
+[ 197.080975] ? ioctl_preallocate+0x1b0/0x1b0
+[ 197.080982] ? selinux_capable+0x20/0x20
+[ 197.080991] ? __do_page_fault+0x7b7/0x9a0
+[ 197.080997] ? lock_downgrade+0x5bb/0x610
+[ 197.081007] ? security_file_ioctl+0x57/0x90
+[ 197.081016] SyS_ioctl+0x4e/0x80
+[ 197.081024] entry_SYSCALL_64_fastpath+0x18/0xad
+[ 197.081030] RIP: 0033:0x7f61f287a987
+[ 197.081035] RSP: 002b:00007fff7d44d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+[ 197.081043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61f287a987
+[ 197.081048] RDX: 00007fff7d44d1c0 RSI: 00000000c01864ba RDI: 0000000000000003
+[ 197.081053] RBP: 00007f61f2b3eb00 R08: 0000000000000059 R09: 0000000000000000
+[ 197.081058] R10: 0000002ea5c4a290 R11: 0000000000000246 R12: 00007f61f2b3eb58
+[ 197.081063] R13: 0000000000001010 R14: 00007f61f2b3eb58 R15: 0000000000002702
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101659
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reported-by: Martin Peres <martin.peres@linux.intel.com>
+Cc: Martin Peres <martin.peres@linux.intel.com>
+Fixes: 82cf435b3134 ("drm/i915: Implement color management on bdw/skl/bxt/kbl")
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Kiran S Kumar <kiran.s.kumar@intel.com>
+Cc: Kausal Malladi <kausalmalladi@gmail.com>
+Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Daniel Vetter <daniel.vetter@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20170724091431.24251-1-maarten.lankhorst@linux.intel.com
+Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+(cherry picked from commit 09a92bc8773b4314e02b478e003fe5936ce85adb)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_color.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/intel_color.c
++++ b/drivers/gpu/drm/i915/intel_color.c
+@@ -398,6 +398,7 @@ static void bdw_load_gamma_lut(struct dr
+ }
+
+ /* Program the max register to clamp values > 1.0. */
++ i = lut_size - 1;
+ I915_WRITE(PREC_PAL_GC_MAX(pipe, 0),
+ drm_color_lut_extract(lut[i].red, 16));
+ I915_WRITE(PREC_PAL_GC_MAX(pipe, 1),
--- /dev/null
+From 260d9f2fc5655a2552701cdd0b909c4466732f19 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Thu, 20 Jul 2017 13:13:11 -0700
+Subject: firmware: avoid invalid fallback aborts by using killable wait
+
+From: Luis R. Rodriguez <mcgrof@kernel.org>
+
+commit 260d9f2fc5655a2552701cdd0b909c4466732f19 upstream.
+
+Commit 0cb64249ca500 ("firmware_loader: abort request if wait_for_completion
+is interrupted") added via 4.0 added support to abort the fallback mechanism
+when a signal was detected and wait_for_completion_interruptible() returned
+-ERESTARTSYS -- for instance when a user hits CTRL-C. The abort was overly
+*too* effective.
+
+When a child process terminates (successful or not) the signal SIGCHLD can
+be sent to the parent process which ran the child in the background and
+later triggered a sync request for firmware through a sysfs interface which
+relies on the fallback mechanism. This signal in turn can be recieved by the
+interruptible wait we constructed on firmware_class and detects it as an
+abort *before* userspace could get a chance to write the firmware. Upon
+failure -EAGAIN is returned, so userspace is also kept in the dark about
+exactly what happened.
+
+We can reproduce the issue with the fw_fallback.sh selftest:
+
+Before this patch:
+$ sudo tools/testing/selftests/firmware/fw_fallback.sh
+...
+tools/testing/selftests/firmware/fw_fallback.sh: error - sync firmware request cancelled due to SIGCHLD
+
+After this patch:
+$ sudo tools/testing/selftests/firmware/fw_fallback.sh
+...
+tools/testing/selftests/firmware/fw_fallback.sh: SIGCHLD on sync ignored as expected
+
+Fix this by making the wait killable -- only killable by SIGKILL (kill -9).
+We loose the ability to allow userspace to cancel a write with CTRL-C
+(SIGINT), however its been decided the compromise to require SIGKILL is
+worth the gains.
+
+Chances of this issue occuring are low due to the number of drivers upstream
+exclusively relying on the fallback mechanism for firmware (2 drivers),
+however this is observed in the field with custom drivers with sysfs
+triggers to load firmware. Only distributions relying on the fallback
+mechanism are impacted as well. An example reported issue was on Android,
+as follows:
+
+1) Android init (pid=1) fork()s (say pid=42) [this child process is totally
+ unrelated to firmware loading, it could be sleep 2; for all we care ]
+2) Android init (pid=1) does a write() on a (driver custom) sysfs file which
+ ends up calling request_firmware() kernel side
+3) The firmware loading fallback mechanism is used, the request is sent to
+ userspace and pid 1 waits in the kernel on wait_*
+4) before firmware loading completes pid 42 dies (for any reason, even
+ normal termination)
+5) Kernel delivers SIGCHLD to pid=1 to tell it a child has died, which
+ causes -ERESTARTSYS to be returned from wait_*
+6) The kernel's wait aborts and return -EAGAIN for the
+ request_firmware() caller.
+
+Fixes: 0cb64249ca500 ("firmware_loader: abort request if wait_for_completion is interrupted")
+Suggested-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Tested-by: Martin Fuzzey <mfuzzey@parkeon.com>
+Reported-by: Martin Fuzzey <mfuzzey@parkeon.com>
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/firmware_class.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -130,8 +130,7 @@ static int __fw_state_wait_common(struct
+ {
+ long ret;
+
+- ret = wait_for_completion_interruptible_timeout(&fw_st->completion,
+- timeout);
++ ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout);
+ if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
+ return -ENOENT;
+ if (!ret)
--- /dev/null
+From 90d41e74a9c36a84e2efbd2a5b8d79299feee6fa Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Thu, 20 Jul 2017 13:13:10 -0700
+Subject: firmware: fix batched requests - send wake up on failure on direct lookups
+
+From: Luis R. Rodriguez <mcgrof@kernel.org>
+
+commit 90d41e74a9c36a84e2efbd2a5b8d79299feee6fa upstream.
+
+Fix batched requests from waiting forever on failure.
+
+The firmware API batched requests feature has been broken since the API call
+request_firmware_direct() was introduced on commit bba3a87e982ad ("firmware:
+Introduce request_firmware_direct()"), added on v3.14 *iff* the firmware
+being requested was not present in *certain kernel builds* [0].
+
+When no firmware is found the worker which goes on to finish never informs
+waiters queued up of this, so any batched request will stall in what seems
+to be forever (MAX_SCHEDULE_TIMEOUT). Sadly, a reboot will also stall, as
+the reboot notifier was only designed to kill custom fallback workers. The
+issue seems to the user as a type of soft lockup, what *actually* happens
+underneath the hood is a wait call which never completes as we failed to
+issue a completion on error.
+
+For device drivers with optional firmware schemes (ie, Intel iwlwifi, or
+Netronome -- even though it uses request_firmware() and not
+request_firmware_direct()), this could mean that when you boot a system with
+multiple cards the firmware will seem to never load on the system, or that
+the card is just not responsive even the driver initialization. Due to
+differences in scheduling possible this should not always trigger --
+one would need to to ensure that multiple requests are in place at the
+right time for this to work, also release_firmware() must not be called
+prior to any other incoming request. The complexity may not be worth
+supporting batched requests in the future given the wait mechanism is
+only used also for the fallback mechanism. We'll keep it for now and
+just fix it.
+
+Its reported that at least with the Intel WiFi cards on one system this
+issue was creeping up 50% of the boots [0].
+
+Before this commit batched requests testing revealed:
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Most common Linux distribution setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() FAIL OK
+request_firmware_direct() FAIL OK
+request_firmware_nowait(uevent=true) FAIL OK
+request_firmware_nowait(uevent=false) FAIL OK
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=n
+
+Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() FAIL OK
+request_firmware_direct() FAIL OK
+request_firmware_nowait(uevent=true) FAIL OK
+request_firmware_nowait(uevent=false) FAIL OK
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Google Android setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() OK OK
+request_firmware_direct() FAIL OK
+request_firmware_nowait(uevent=true) OK OK
+request_firmware_nowait(uevent=false) OK OK
+============================================================================
+
+Ater this commit batched testing results:
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Most common Linux distribution setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() OK OK
+request_firmware_direct() OK OK
+request_firmware_nowait(uevent=true) OK OK
+request_firmware_nowait(uevent=false) OK OK
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=n
+
+Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() OK OK
+request_firmware_direct() OK OK
+request_firmware_nowait(uevent=true) OK OK
+request_firmware_nowait(uevent=false) OK OK
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Google Android setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() OK OK
+request_firmware_direct() OK OK
+request_firmware_nowait(uevent=true) OK OK
+request_firmware_nowait(uevent=false) OK OK
+============================================================================
+
+[0] https://bugzilla.kernel.org/show_bug.cgi?id=195477
+
+Fixes: bba3a87e982ad ("firmware: Introduce request_firmware_direct()"
+Reported-by: Nicolas <nbroeking@me.com>
+Reported-by: John Ewalt <jewalt@lgsinnovations.com>
+Reported-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/firmware_class.c | 38 ++++++++++++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 8 deletions(-)
+
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -153,28 +153,27 @@ static void __fw_state_set(struct fw_sta
+ __fw_state_set(fw_st, FW_STATUS_LOADING)
+ #define fw_state_done(fw_st) \
+ __fw_state_set(fw_st, FW_STATUS_DONE)
++#define fw_state_aborted(fw_st) \
++ __fw_state_set(fw_st, FW_STATUS_ABORTED)
+ #define fw_state_wait(fw_st) \
+ __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT)
+
+-#ifndef CONFIG_FW_LOADER_USER_HELPER
+-
+-#define fw_state_is_aborted(fw_st) false
+-
+-#else /* CONFIG_FW_LOADER_USER_HELPER */
+-
+ static int __fw_state_check(struct fw_state *fw_st, enum fw_status status)
+ {
+ return fw_st->status == status;
+ }
+
++#define fw_state_is_aborted(fw_st) \
++ __fw_state_check(fw_st, FW_STATUS_ABORTED)
++
++#ifdef CONFIG_FW_LOADER_USER_HELPER
++
+ #define fw_state_aborted(fw_st) \
+ __fw_state_set(fw_st, FW_STATUS_ABORTED)
+ #define fw_state_is_done(fw_st) \
+ __fw_state_check(fw_st, FW_STATUS_DONE)
+ #define fw_state_is_loading(fw_st) \
+ __fw_state_check(fw_st, FW_STATUS_LOADING)
+-#define fw_state_is_aborted(fw_st) \
+- __fw_state_check(fw_st, FW_STATUS_ABORTED)
+ #define fw_state_wait_timeout(fw_st, timeout) \
+ __fw_state_wait_common(fw_st, timeout)
+
+@@ -1161,6 +1160,28 @@ static int assign_firmware_buf(struct fi
+ return 0;
+ }
+
++/*
++ * Batched requests need only one wake, we need to do this step last due to the
++ * fallback mechanism. The buf is protected with kref_get(), and it won't be
++ * released until the last user calls release_firmware().
++ *
++ * Failed batched requests are possible as well, in such cases we just share
++ * the struct firmware_buf and won't release it until all requests are woken
++ * and have gone through this same path.
++ */
++static void fw_abort_batch_reqs(struct firmware *fw)
++{
++ struct firmware_buf *buf;
++
++ /* Loaded directly? */
++ if (!fw || !fw->priv)
++ return;
++
++ buf = fw->priv;
++ if (!fw_state_is_aborted(&buf->fw_st))
++ fw_state_aborted(&buf->fw_st);
++}
++
+ /* called from request_firmware() and request_firmware_work_func() */
+ static int
+ _request_firmware(const struct firmware **firmware_p, const char *name,
+@@ -1222,6 +1243,7 @@ _request_firmware(const struct firmware
+
+ out:
+ if (ret < 0) {
++ fw_abort_batch_reqs(fw);
+ release_firmware(fw);
+ fw = NULL;
+ }
--- /dev/null
+From e44565f62a72064e686f7a852137595ec94d78f2 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Thu, 20 Jul 2017 13:13:09 -0700
+Subject: firmware: fix batched requests - wake all waiters
+
+From: Luis R. Rodriguez <mcgrof@kernel.org>
+
+commit e44565f62a72064e686f7a852137595ec94d78f2 upstream.
+
+The firmware cache mechanism serves two purposes, the secondary purpose is
+not well documented nor understood. This fixes a regression with the
+secondary purpose of the firmware cache mechanism: batched requests on
+successful lookups. Without this fix *any* time a batched request is
+triggered, secondary requests for which the batched request mechanism
+was designed for will seem to last forver and seem to never return.
+This issue is present for all kernel builds possible, and a hard reset
+is required.
+
+The firmware cache is used for:
+
+1) Addressing races with file lookups during the suspend/resume cycle
+ by keeping firmware in memory during the suspend/resume cycle
+
+2) Batched requests for the same file rely only on work from the first file
+ lookup, which keeps the firmware in memory until the last
+ release_firmware() is called
+
+Batched requests *only* take effect if secondary requests come in prior to
+the first user calling release_firmware(). The devres name used for the
+internal firmware cache is used as a hint other pending requests are
+ongoing, the firmware buffer data is kept in memory until the last user of
+the buffer calls release_firmware(), therefore serializing requests and
+delaying the release until all requests are done.
+
+Batched requests wait for a wakup or signal so we can rely on the first file
+fetch to write to the pending secondary requests. Commit 5b029624948d
+("firmware: do not use fw_lock for fw_state protection") ported the firmware
+API to use swait, and in doing so failed to convert complete_all() to
+swake_up_all() -- it used swake_up(), loosing the ability for *some* batched
+requests to take effect.
+
+We *could* fix this by just using swake_up_all() *but* swait is now known
+to be very special use case, so its best to just move away from it. So we
+just go back to using completions as before commit 5b029624948d ("firmware:
+do not use fw_lock for fw_state protection") given this was using
+complete_all().
+
+Without this fix it has been reported plugging in two Intel 6260 Wifi cards
+on a system will end up enumerating the two devices only 50% of the time
+[0]. The ported swake_up() should have actually handled the case with two
+devices, however, *if more than two cards are used* the swake_up() would
+not have sufficed. This change is only part of the required fixes for
+batched requests. Another fix is provided in the next patch.
+
+This particular change should fix the cases where more than three requests
+with the same firmware name is used, otherwise batched requests will wait
+for MAX_SCHEDULE_TIMEOUT and just timeout eventually.
+
+Below is a summary of tests triggering batched requests on different
+kernel builds.
+
+Before this patch:
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Most common Linux distribution setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() FAIL FAIL
+request_firmware_direct() FAIL FAIL
+request_firmware_nowait(uevent=true) FAIL FAIL
+request_firmware_nowait(uevent=false) FAIL FAIL
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=n
+
+Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() FAIL FAIL
+request_firmware_direct() FAIL FAIL
+request_firmware_nowait(uevent=true) FAIL FAIL
+request_firmware_nowait(uevent=false) FAIL FAIL
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Google Android setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() FAIL FAIL
+request_firmware_direct() FAIL FAIL
+request_firmware_nowait(uevent=true) FAIL FAIL
+request_firmware_nowait(uevent=false) FAIL FAIL
+============================================================================
+
+After this patch:
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Most common Linux distribution setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() FAIL OK
+request_firmware_direct() FAIL OK
+request_firmware_nowait(uevent=true) FAIL OK
+request_firmware_nowait(uevent=false) FAIL OK
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n
+CONFIG_FW_LOADER_USER_HELPER=n
+
+Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() FAIL OK
+request_firmware_direct() FAIL OK
+request_firmware_nowait(uevent=true) FAIL OK
+request_firmware_nowait(uevent=false) FAIL OK
+============================================================================
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+CONFIG_FW_LOADER_USER_HELPER=y
+
+Google Android setup.
+
+API-type no-firmware-found firmware-found
+----------------------------------------------------------------------
+request_firmware() OK OK
+request_firmware_direct() FAIL OK
+request_firmware_nowait(uevent=true) OK OK
+request_firmware_nowait(uevent=false) OK OK
+============================================================================
+
+[0] https://bugzilla.kernel.org/show_bug.cgi?id=195477
+
+Cc: Ming Lei <ming.lei@redhat.com>
+Fixes: 5b029624948d ("firmware: do not use fw_lock for fw_state protection")
+Reported-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/firmware_class.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -30,7 +30,6 @@
+ #include <linux/syscore_ops.h>
+ #include <linux/reboot.h>
+ #include <linux/security.h>
+-#include <linux/swait.h>
+
+ #include <generated/utsrelease.h>
+
+@@ -112,13 +111,13 @@ static inline long firmware_loading_time
+ * state of the firmware loading.
+ */
+ struct fw_state {
+- struct swait_queue_head wq;
++ struct completion completion;
+ enum fw_status status;
+ };
+
+ static void fw_state_init(struct fw_state *fw_st)
+ {
+- init_swait_queue_head(&fw_st->wq);
++ init_completion(&fw_st->completion);
+ fw_st->status = FW_STATUS_UNKNOWN;
+ }
+
+@@ -131,9 +130,8 @@ static int __fw_state_wait_common(struct
+ {
+ long ret;
+
+- ret = swait_event_interruptible_timeout(fw_st->wq,
+- __fw_state_is_done(READ_ONCE(fw_st->status)),
+- timeout);
++ ret = wait_for_completion_interruptible_timeout(&fw_st->completion,
++ timeout);
+ if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
+ return -ENOENT;
+ if (!ret)
+@@ -148,7 +146,7 @@ static void __fw_state_set(struct fw_sta
+ WRITE_ONCE(fw_st->status, status);
+
+ if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
+- swake_up(&fw_st->wq);
++ complete_all(&fw_st->completion);
+ }
+
+ #define fw_state_start(fw_st) \
--- /dev/null
+From 68227c03cba84a24faf8a7277d2b1a03c8959c2c Mon Sep 17 00:00:00 2001
+From: Mateusz Jurczyk <mjurczyk@google.com>
+Date: Wed, 7 Jun 2017 12:26:49 +0200
+Subject: fuse: initialize the flock flag in fuse_file on allocation
+
+From: Mateusz Jurczyk <mjurczyk@google.com>
+
+commit 68227c03cba84a24faf8a7277d2b1a03c8959c2c upstream.
+
+Before the patch, the flock flag could remain uninitialized for the
+lifespan of the fuse_file allocation. Unless set to true in
+fuse_file_flock(), it would remain in an indeterminate state until read in
+an if statement in fuse_release_common(). This could consequently lead to
+taking an unexpected branch in the code.
+
+The bug was discovered by a runtime instrumentation designed to detect use
+of uninitialized memory in the kernel.
+
+Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
+Fixes: 37fb3a30b462 ("fuse: fix flock")
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct
+ {
+ struct fuse_file *ff;
+
+- ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
++ ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL);
+ if (unlikely(!ff))
+ return NULL;
+
--- /dev/null
+From 682c6c2188f39d13548ccdc89c9888fbcb547889 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 13 Jul 2017 15:45:02 +0200
+Subject: i2c: designware: Some broken DSTDs use 1MiHz instead of 1MHz
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 682c6c2188f39d13548ccdc89c9888fbcb547889 upstream.
+
+At least the Acer Iconia Tab8 / aka W1-810 uses 1MiHz instead of
+1MHz for one of its busses, fix this up to 1MHz instead of failing
+the probe of that bus.
+
+This fixes the accelerometer on the Acer Iconia Tab8 not working.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -254,6 +254,9 @@ static int dw_i2c_plat_probe(struct plat
+ }
+
+ acpi_speed = i2c_acpi_find_bus_speed(&pdev->dev);
++ /* Some broken DSTDs use 1MiHz instead of 1MHz */
++ if (acpi_speed == 1048576)
++ acpi_speed = 1000000;
+ /*
+ * Find bus speed from the "clock-frequency" device property, ACPI
+ * or by using fast mode if neither is set.
--- /dev/null
+From e59e18989c68a8d7941005f81ad6abc4ca682de0 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 13 Jul 2017 15:13:41 +0200
+Subject: iio: accel: bmc150: Always restore device to normal mode after suspend-resume
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e59e18989c68a8d7941005f81ad6abc4ca682de0 upstream.
+
+After probe we would put the device in normal mode, after a runtime
+suspend-resume we would put it back in normal mode. But for a regular
+suspend-resume we would only put it back in normal mode if triggers
+or events have been requested. This is not consistent and breaks
+reading raw values after a suspend-resume.
+
+This commit changes the regular resume path to also unconditionally put
+the device back in normal mode, fixing reading of raw values not working
+after a regular suspend-resume cycle.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/bmc150-accel-core.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -193,7 +193,6 @@ struct bmc150_accel_data {
+ struct regmap *regmap;
+ int irq;
+ struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
+- atomic_t active_intr;
+ struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
+ struct mutex mutex;
+ u8 fifo_mode, watermark;
+@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(st
+ goto out_fix_power_state;
+ }
+
+- if (state)
+- atomic_inc(&data->active_intr);
+- else
+- atomic_dec(&data->active_intr);
+-
+ return 0;
+
+ out_fix_power_state:
+@@ -1710,8 +1704,7 @@ static int bmc150_accel_resume(struct de
+ struct bmc150_accel_data *data = iio_priv(indio_dev);
+
+ mutex_lock(&data->mutex);
+- if (atomic_read(&data->active_intr))
+- bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
++ bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
+ bmc150_accel_fifo_set_mode(data);
+ mutex_unlock(&data->mutex);
+
--- /dev/null
+From a7b8829d242b1a58107e9c02b09e93aec446d55c Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+Date: Wed, 5 Jul 2017 20:30:01 +0200
+Subject: iio: accel: st_accel: add SPI-3wire support
+
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+
+commit a7b8829d242b1a58107e9c02b09e93aec446d55c upstream.
+
+Add SPI Serial Interface Mode (SIM) register information
+in st_sensor_settings look up table to support devices
+(like LSM303AGR accel sensor) that allow just SPI-3wire
+communication mode. SIM mode has to be configured before any
+other operation since it is not enabled by default and the driver
+is not able to read without that configuration
+
+Whilst a fairly substantial patch, the actual logic is simple and it
+is better to have the generic fix than a band aid.
+
+Fixes: ddc05fa28606 (iio: st-accel: add support for lsm303agr accel)
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@st.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/st_accel_core.c | 32 ++++++++++++++++++++++++
+ drivers/iio/common/st_sensors/st_sensors_core.c | 29 +++++++++++++++++++++
+ include/linux/iio/common/st_sensors.h | 7 +++++
+ include/linux/platform_data/st_sensors_pdata.h | 2 +
+ 4 files changed, 70 insertions(+)
+
+--- a/drivers/iio/accel/st_accel_core.c
++++ b/drivers/iio/accel/st_accel_core.c
+@@ -166,6 +166,10 @@ static const struct st_sensor_settings s
+ .mask_ihl = 0x02,
+ .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+ },
++ .sim = {
++ .addr = 0x23,
++ .value = BIT(0),
++ },
+ .multi_read_bit = true,
+ .bootime = 2,
+ },
+@@ -234,6 +238,10 @@ static const struct st_sensor_settings s
+ .mask_od = 0x40,
+ .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+ },
++ .sim = {
++ .addr = 0x23,
++ .value = BIT(0),
++ },
+ .multi_read_bit = true,
+ .bootime = 2,
+ },
+@@ -316,6 +324,10 @@ static const struct st_sensor_settings s
+ .en_mask = 0x08,
+ },
+ },
++ .sim = {
++ .addr = 0x24,
++ .value = BIT(0),
++ },
+ .multi_read_bit = false,
+ .bootime = 2,
+ },
+@@ -379,6 +391,10 @@ static const struct st_sensor_settings s
+ .mask_int1 = 0x04,
+ .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+ },
++ .sim = {
++ .addr = 0x21,
++ .value = BIT(1),
++ },
+ .multi_read_bit = true,
+ .bootime = 2, /* guess */
+ },
+@@ -437,6 +453,10 @@ static const struct st_sensor_settings s
+ .mask_od = 0x40,
+ .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+ },
++ .sim = {
++ .addr = 0x21,
++ .value = BIT(7),
++ },
+ .multi_read_bit = false,
+ .bootime = 2, /* guess */
+ },
+@@ -499,6 +519,10 @@ static const struct st_sensor_settings s
+ .addr_ihl = 0x22,
+ .mask_ihl = 0x80,
+ },
++ .sim = {
++ .addr = 0x23,
++ .value = BIT(0),
++ },
+ .multi_read_bit = true,
+ .bootime = 2,
+ },
+@@ -547,6 +571,10 @@ static const struct st_sensor_settings s
+ .mask_int1 = 0x04,
+ .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+ },
++ .sim = {
++ .addr = 0x21,
++ .value = BIT(1),
++ },
+ .multi_read_bit = false,
+ .bootime = 2,
+ },
+@@ -614,6 +642,10 @@ static const struct st_sensor_settings s
+ .mask_ihl = 0x02,
+ .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+ },
++ .sim = {
++ .addr = 0x23,
++ .value = BIT(0),
++ },
+ .multi_read_bit = true,
+ .bootime = 2,
+ },
+--- a/drivers/iio/common/st_sensors/st_sensors_core.c
++++ b/drivers/iio/common/st_sensors/st_sensors_core.c
+@@ -550,6 +550,31 @@ out:
+ }
+ EXPORT_SYMBOL(st_sensors_read_info_raw);
+
++static int st_sensors_init_interface_mode(struct iio_dev *indio_dev,
++ const struct st_sensor_settings *sensor_settings)
++{
++ struct st_sensor_data *sdata = iio_priv(indio_dev);
++ struct device_node *np = sdata->dev->of_node;
++ struct st_sensors_platform_data *pdata;
++
++ pdata = (struct st_sensors_platform_data *)sdata->dev->platform_data;
++ if (((np && of_property_read_bool(np, "spi-3wire")) ||
++ (pdata && pdata->spi_3wire)) && sensor_settings->sim.addr) {
++ int err;
++
++ err = sdata->tf->write_byte(&sdata->tb, sdata->dev,
++ sensor_settings->sim.addr,
++ sensor_settings->sim.value);
++ if (err < 0) {
++ dev_err(&indio_dev->dev,
++ "failed to init interface mode\n");
++ return err;
++ }
++ }
++
++ return 0;
++}
++
+ int st_sensors_check_device_support(struct iio_dev *indio_dev,
+ int num_sensors_list,
+ const struct st_sensor_settings *sensor_settings)
+@@ -574,6 +599,10 @@ int st_sensors_check_device_support(stru
+ return -ENODEV;
+ }
+
++ err = st_sensors_init_interface_mode(indio_dev, &sensor_settings[i]);
++ if (err < 0)
++ return err;
++
+ if (sensor_settings[i].wai_addr) {
+ err = sdata->tf->read_byte(&sdata->tb, sdata->dev,
+ sensor_settings[i].wai_addr, &wai);
+--- a/include/linux/iio/common/st_sensors.h
++++ b/include/linux/iio/common/st_sensors.h
+@@ -105,6 +105,11 @@ struct st_sensor_fullscale {
+ struct st_sensor_fullscale_avl fs_avl[ST_SENSORS_FULLSCALE_AVL_MAX];
+ };
+
++struct st_sensor_sim {
++ u8 addr;
++ u8 value;
++};
++
+ /**
+ * struct st_sensor_bdu - ST sensor device block data update
+ * @addr: address of the register.
+@@ -197,6 +202,7 @@ struct st_sensor_transfer_function {
+ * @bdu: Block data update register.
+ * @das: Data Alignment Selection register.
+ * @drdy_irq: Data ready register of the sensor.
++ * @sim: SPI serial interface mode register of the sensor.
+ * @multi_read_bit: Use or not particular bit for [I2C/SPI] multi-read.
+ * @bootime: samples to discard when sensor passing from power-down to power-up.
+ */
+@@ -213,6 +219,7 @@ struct st_sensor_settings {
+ struct st_sensor_bdu bdu;
+ struct st_sensor_das das;
+ struct st_sensor_data_ready_irq drdy_irq;
++ struct st_sensor_sim sim;
+ bool multi_read_bit;
+ unsigned int bootime;
+ };
+--- a/include/linux/platform_data/st_sensors_pdata.h
++++ b/include/linux/platform_data/st_sensors_pdata.h
+@@ -17,10 +17,12 @@
+ * Available only for accelerometer and pressure sensors.
+ * Accelerometer DRDY on LSM330 available only on pin 1 (see datasheet).
+ * @open_drain: set the interrupt line to be open drain if possible.
++ * @spi_3wire: enable spi-3wire mode.
+ */
+ struct st_sensors_platform_data {
+ u8 drdy_int_pin;
+ bool open_drain;
++ bool spi_3wire;
+ };
+
+ #endif /* ST_SENSORS_PDATA_H */
--- /dev/null
+From 631b010abc5b57009c6a8328f51492665f6ef310 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 30 Jun 2017 19:42:54 +0200
+Subject: iio: adc: Revert "axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications"
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 631b010abc5b57009c6a8328f51492665f6ef310 upstream.
+
+Inheriting the ADC BIAS current settings from the BIOS instead of
+hardcoding then causes the AXP288 to disable charging (I think it
+mis-detects an overheated battery) on at least one model tablet.
+
+So lets go back to hard coding the values, this reverts
+commit fa2849e9649b ("iio: adc: axp288: Drop bogus
+AXP288_ADC_TS_PIN_CTRL register modifications"), fixing charging not
+working on the model tablet in question.
+
+The exact cause is not fully understood, hence the revert to a known working
+state.
+
+Reported-by: Umberto Ixxo <sfumato1977@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/axp288_adc.c | 32 +++++++++++++++++++++++++++++++-
+ 1 file changed, 31 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/axp288_adc.c
++++ b/drivers/iio/adc/axp288_adc.c
+@@ -28,6 +28,8 @@
+ #include <linux/iio/driver.h>
+
+ #define AXP288_ADC_EN_MASK 0xF1
++#define AXP288_ADC_TS_PIN_GPADC 0xF2
++#define AXP288_ADC_TS_PIN_ON 0xF3
+
+ enum axp288_adc_id {
+ AXP288_ADC_TS,
+@@ -121,6 +123,16 @@ static int axp288_adc_read_channel(int *
+ return IIO_VAL_INT;
+ }
+
++static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
++ unsigned long address)
++{
++ /* channels other than GPADC do not need to switch TS pin */
++ if (address != AXP288_GP_ADC_H)
++ return 0;
++
++ return regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
++}
++
+ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
+ struct iio_chan_spec const *chan,
+ int *val, int *val2, long mask)
+@@ -131,7 +143,16 @@ static int axp288_adc_read_raw(struct ii
+ mutex_lock(&indio_dev->mlock);
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
++ if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
++ chan->address)) {
++ dev_err(&indio_dev->dev, "GPADC mode\n");
++ ret = -EINVAL;
++ break;
++ }
+ ret = axp288_adc_read_channel(val, chan->address, info->regmap);
++ if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
++ chan->address))
++ dev_err(&indio_dev->dev, "TS pin restore\n");
+ break;
+ default:
+ ret = -EINVAL;
+@@ -141,6 +162,15 @@ static int axp288_adc_read_raw(struct ii
+ return ret;
+ }
+
++static int axp288_adc_set_state(struct regmap *regmap)
++{
++ /* ADC should be always enabled for internal FG to function */
++ if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
++ return -EIO;
++
++ return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
++}
++
+ static const struct iio_info axp288_adc_iio_info = {
+ .read_raw = &axp288_adc_read_raw,
+ .driver_module = THIS_MODULE,
+@@ -169,7 +199,7 @@ static int axp288_adc_probe(struct platf
+ * Set ADC to enabled state at all time, including system suspend.
+ * otherwise internal fuel gauge functionality may be affected.
+ */
+- ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
++ ret = axp288_adc_set_state(axp20x->regmap);
+ if (ret) {
+ dev_err(&pdev->dev, "unable to enable ADC device\n");
+ return ret;
--- /dev/null
+From 737cc2a593782df6846b3cab7e0f64384f58364a Mon Sep 17 00:00:00 2001
+From: Mykola Kostenok <c_mykolak@mellanox.com>
+Date: Mon, 17 Jul 2017 12:00:35 +0300
+Subject: iio: aspeed-adc: wait for initial sequence.
+
+From: Mykola Kostenok <c_mykolak@mellanox.com>
+
+commit 737cc2a593782df6846b3cab7e0f64384f58364a upstream.
+
+This patch enables adc engine at initialization time and waits
+for the initial sequence completion before enabling adc channels.
+
+Without this code adc channels are not functional and shows
+zeros for all connected channels.
+
+Tested on mellanox msn platform.
+
+v1 -> v2:
+Pointed by Rick Altherr:
+ - Wait init sequence code enabled by bool
+from OF match table.
+
+Signed-off-by: Mykola Kostenok <c_mykolak@mellanox.com>
+Reviewed-by: Rick Altherr <raltherr@google.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/aspeed_adc.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/iio/adc/aspeed_adc.c
++++ b/drivers/iio/adc/aspeed_adc.c
+@@ -22,6 +22,7 @@
+
+ #include <linux/iio/iio.h>
+ #include <linux/iio/driver.h>
++#include <linux/iopoll.h>
+
+ #define ASPEED_RESOLUTION_BITS 10
+ #define ASPEED_CLOCKS_PER_SAMPLE 12
+@@ -38,11 +39,17 @@
+
+ #define ASPEED_ENGINE_ENABLE BIT(0)
+
++#define ASPEED_ADC_CTRL_INIT_RDY BIT(8)
++
++#define ASPEED_ADC_INIT_POLLING_TIME 500
++#define ASPEED_ADC_INIT_TIMEOUT 500000
++
+ struct aspeed_adc_model_data {
+ const char *model_name;
+ unsigned int min_sampling_rate; // Hz
+ unsigned int max_sampling_rate; // Hz
+ unsigned int vref_voltage; // mV
++ bool wait_init_sequence;
+ };
+
+ struct aspeed_adc_data {
+@@ -211,6 +218,24 @@ static int aspeed_adc_probe(struct platf
+ goto scaler_error;
+ }
+
++ model_data = of_device_get_match_data(&pdev->dev);
++
++ if (model_data->wait_init_sequence) {
++ /* Enable engine in normal mode. */
++ writel(ASPEED_OPERATION_MODE_NORMAL | ASPEED_ENGINE_ENABLE,
++ data->base + ASPEED_REG_ENGINE_CONTROL);
++
++ /* Wait for initial sequence complete. */
++ ret = readl_poll_timeout(data->base + ASPEED_REG_ENGINE_CONTROL,
++ adc_engine_control_reg_val,
++ adc_engine_control_reg_val &
++ ASPEED_ADC_CTRL_INIT_RDY,
++ ASPEED_ADC_INIT_POLLING_TIME,
++ ASPEED_ADC_INIT_TIMEOUT);
++ if (ret)
++ goto scaler_error;
++ }
++
+ /* Start all channels in normal mode. */
+ clk_prepare_enable(data->clk_scaler->clk);
+ adc_engine_control_reg_val = GENMASK(31, 16) |
+@@ -270,6 +295,7 @@ static const struct aspeed_adc_model_dat
+ .vref_voltage = 1800, // mV
+ .min_sampling_rate = 1,
+ .max_sampling_rate = 1000000,
++ .wait_init_sequence = true,
+ };
+
+ static const struct of_device_id aspeed_adc_matches[] = {
--- /dev/null
+From a3507e48d3f99a93a3056a34a5365f310434570f Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Wed, 21 Jun 2017 01:46:37 +0900
+Subject: iio: light: tsl2563: use correct event code
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+commit a3507e48d3f99a93a3056a34a5365f310434570f upstream.
+
+The TSL2563 driver provides three iio channels, two of which are raw ADC
+channels (channel 0 and channel 1) in the device and the remaining one
+is calculated by the two. The ADC channel 0 only supports programmable
+interrupt with threshold settings and this driver supports the event but
+the generated event code does not contain the corresponding iio channel
+type.
+
+This is going to change userspace ABI. Hopefully fixing this to be
+what it should always have been won't break any userspace code.
+
+Cc: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/light/tsl2563.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/tsl2563.c
++++ b/drivers/iio/light/tsl2563.c
+@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler
+ struct tsl2563_chip *chip = iio_priv(dev_info);
+
+ iio_push_event(dev_info,
+- IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
++ IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
+ 0,
+ IIO_EV_TYPE_THRESH,
+ IIO_EV_DIR_EITHER),
--- /dev/null
+From add6e6ab3ee0e237822e0951476d3df039b49ec8 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+Date: Thu, 22 Jun 2017 19:46:43 +0200
+Subject: iio: pressure: st_pressure_core: disable multiread by default for LPS22HB
+
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+
+commit add6e6ab3ee0e237822e0951476d3df039b49ec8 upstream.
+
+Set multiread variable to false for LPS22HB pressure sensor since
+it is already enabled in CTRL_REG2. Previous configuration does not
+cause any issue in I2C communication since SUB Msb has no meaning
+whereas it breaks register address in SPI communication
+
+Fixes: e039e2f5b4da (iio:st_pressure:initial lps22hb sensor support)
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@st.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/pressure/st_pressure_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/pressure/st_pressure_core.c
++++ b/drivers/iio/pressure/st_pressure_core.c
+@@ -456,7 +456,7 @@ static const struct st_sensor_settings s
+ .mask_od = 0x40,
+ .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+ },
+- .multi_read_bit = true,
++ .multi_read_bit = false,
+ .bootime = 2,
+ },
+ };
--- /dev/null
+From 978d13d60c34818a41fc35962602bdfa5c03f214 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Fri, 4 Aug 2017 23:59:31 -0700
+Subject: iscsi-target: Fix iscsi_np reset hung task during parallel delete
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 978d13d60c34818a41fc35962602bdfa5c03f214 upstream.
+
+This patch fixes a bug associated with iscsit_reset_np_thread()
+that can occur during parallel configfs rmdir of a single iscsi_np
+used across multiple iscsi-target instances, that would result in
+hung task(s) similar to below where configfs rmdir process context
+was blocked indefinately waiting for iscsi_np->np_restart_comp
+to finish:
+
+[ 6726.112076] INFO: task dcp_proxy_node_:15550 blocked for more than 120 seconds.
+[ 6726.119440] Tainted: G W O 4.1.26-3321 #2
+[ 6726.125045] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 6726.132927] dcp_proxy_node_ D ffff8803f202bc88 0 15550 1 0x00000000
+[ 6726.140058] ffff8803f202bc88 ffff88085c64d960 ffff88083b3b1ad0 ffff88087fffeb08
+[ 6726.147593] ffff8803f202c000 7fffffffffffffff ffff88083f459c28 ffff88083b3b1ad0
+[ 6726.155132] ffff88035373c100 ffff8803f202bca8 ffffffff8168ced2 ffff8803f202bcb8
+[ 6726.162667] Call Trace:
+[ 6726.165150] [<ffffffff8168ced2>] schedule+0x32/0x80
+[ 6726.170156] [<ffffffff8168f5b4>] schedule_timeout+0x214/0x290
+[ 6726.176030] [<ffffffff810caef2>] ? __send_signal+0x52/0x4a0
+[ 6726.181728] [<ffffffff8168d7d6>] wait_for_completion+0x96/0x100
+[ 6726.187774] [<ffffffff810e7c80>] ? wake_up_state+0x10/0x10
+[ 6726.193395] [<ffffffffa035d6e2>] iscsit_reset_np_thread+0x62/0xe0 [iscsi_target_mod]
+[ 6726.201278] [<ffffffffa0355d86>] iscsit_tpg_disable_portal_group+0x96/0x190 [iscsi_target_mod]
+[ 6726.210033] [<ffffffffa0363f7f>] lio_target_tpg_store_enable+0x4f/0xc0 [iscsi_target_mod]
+[ 6726.218351] [<ffffffff81260c5a>] configfs_write_file+0xaa/0x110
+[ 6726.224392] [<ffffffff811ea364>] vfs_write+0xa4/0x1b0
+[ 6726.229576] [<ffffffff811eb111>] SyS_write+0x41/0xb0
+[ 6726.234659] [<ffffffff8169042e>] system_call_fastpath+0x12/0x71
+
+It would happen because each iscsit_reset_np_thread() sets state
+to ISCSI_NP_THREAD_RESET, sends SIGINT, and then blocks waiting
+for completion on iscsi_np->np_restart_comp.
+
+However, if iscsi_np was active processing a login request and
+more than a single iscsit_reset_np_thread() caller to the same
+iscsi_np was blocked on iscsi_np->np_restart_comp, iscsi_np
+kthread process context in __iscsi_target_login_thread() would
+flush pending signals and only perform a single completion of
+np->np_restart_comp before going back to sleep within transport
+specific iscsit_transport->iscsi_accept_np code.
+
+To address this bug, add a iscsi_np->np_reset_count and update
+__iscsi_target_login_thread() to keep completing np->np_restart_comp
+until ->np_reset_count has reached zero.
+
+Reported-by: Gary Guo <ghg@datera.io>
+Tested-by: Gary Guo <ghg@datera.io>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 1 +
+ drivers/target/iscsi/iscsi_target_login.c | 7 +++++--
+ include/target/iscsi/iscsi_target_core.h | 1 +
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -418,6 +418,7 @@ int iscsit_reset_np_thread(
+ return 0;
+ }
+ np->np_thread_state = ISCSI_NP_THREAD_RESET;
++ atomic_inc(&np->np_reset_count);
+
+ if (np->np_thread) {
+ spin_unlock_bh(&np->np_thread_lock);
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -1237,9 +1237,11 @@ static int __iscsi_target_login_thread(s
+ flush_signals(current);
+
+ spin_lock_bh(&np->np_thread_lock);
+- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
+ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
++ spin_unlock_bh(&np->np_thread_lock);
+ complete(&np->np_restart_comp);
++ return 1;
+ } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
+ spin_unlock_bh(&np->np_thread_lock);
+ goto exit;
+@@ -1272,7 +1274,8 @@ static int __iscsi_target_login_thread(s
+ goto exit;
+ } else if (rc < 0) {
+ spin_lock_bh(&np->np_thread_lock);
+- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
++ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+ spin_unlock_bh(&np->np_thread_lock);
+ complete(&np->np_restart_comp);
+ iscsit_put_transport(conn->conn_transport);
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -787,6 +787,7 @@ struct iscsi_np {
+ int np_sock_type;
+ enum np_thread_state_table np_thread_state;
+ bool enabled;
++ atomic_t np_reset_count;
+ enum iscsi_timer_flags_table np_login_timer_flags;
+ u32 np_exports;
+ enum np_flags_table np_flags;
--- /dev/null
+From ea8dc5b4cd2195ee582cae28afa4164c6dea1738 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Sun, 23 Jul 2017 20:03:33 +0530
+Subject: iscsi-target: fix memory leak in iscsit_setup_text_cmd()
+
+From: Varun Prakash <varun@chelsio.com>
+
+commit ea8dc5b4cd2195ee582cae28afa4164c6dea1738 upstream.
+
+On receiving text request iscsi-target allocates buffer for
+payload in iscsit_handle_text_cmd() and assigns buffer pointer
+to cmd->text_in_ptr, this buffer is currently freed in
+iscsit_release_cmd(), if iscsi-target sets 'C' bit in text
+response then it will receive another text request from the
+initiator with ttt != 0xffffffff in this case iscsi-target
+will find cmd using itt and call iscsit_setup_text_cmd()
+which will set cmd->text_in_ptr to NULL without freeing
+previously allocated buffer.
+
+This patch fixes this issue by calling kfree(cmd->text_in_ptr)
+in iscsit_setup_text_cmd() before assigning NULL to it.
+
+For the first text request cmd->text_in_ptr is NULL as
+cmd is memset to 0 in iscsit_allocate_cmd().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -2173,6 +2173,7 @@ iscsit_setup_text_cmd(struct iscsi_conn
+ cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
+ cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
+ cmd->data_direction = DMA_NONE;
++ kfree(cmd->text_in_ptr);
+ cmd->text_in_ptr = NULL;
+
+ return 0;
--- /dev/null
+From 92ddd95919466de5d34f3cb43635da9a7f9ab814 Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Tue, 8 Aug 2017 18:54:01 +0800
+Subject: mmc: mmc: correct the logic for setting HS400ES signal voltage
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit 92ddd95919466de5d34f3cb43635da9a7f9ab814 upstream.
+
+Change the default err value to -EINVAL, make sure the card only
+has type EXT_CSD_CARD_TYPE_HS400_1_8V also do the signal voltage
+setting when select hs400es mode.
+
+Fixes: commit 1720d3545b77 ("mmc: core: switch to 1V8 or 1V2 for hs400es mode")
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/mmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1288,7 +1288,7 @@ out_err:
+ static int mmc_select_hs400es(struct mmc_card *card)
+ {
+ struct mmc_host *host = card->host;
+- int err = 0;
++ int err = -EINVAL;
+ u8 val;
+
+ if (!(host->caps & MMC_CAP_8_BIT_DATA)) {
--- /dev/null
+From 3aa0907675a38498d8f2d343e94207ad28a117cf Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Mon, 17 Jul 2017 20:20:08 +0200
+Subject: mtd: nand: atmel: Fix DT backward compatibility in pmecc.c
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit 3aa0907675a38498d8f2d343e94207ad28a117cf upstream.
+
+PMECC caps extraction from old DT bindings is broken, thus leading to
+erroneous EL registers offset, which in turn make HW ECC unusable on
+sama5d2 when old bindings are in use.
+
+Passing the NAND dev node instead of the NFC node to of_match_node()
+solves the problem.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+Tested-by: Romain Izard <romain.izard.pro@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/atmel/pmecc.c | 21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+--- a/drivers/mtd/nand/atmel/pmecc.c
++++ b/drivers/mtd/nand/atmel/pmecc.c
+@@ -945,6 +945,7 @@ struct atmel_pmecc *devm_atmel_pmecc_get
+ */
+ struct platform_device *pdev = to_platform_device(userdev);
+ const struct atmel_pmecc_caps *caps;
++ const struct of_device_id *match;
+
+ /* No PMECC engine available. */
+ if (!of_property_read_bool(userdev->of_node,
+@@ -953,21 +954,11 @@ struct atmel_pmecc *devm_atmel_pmecc_get
+
+ caps = &at91sam9g45_caps;
+
+- /*
+- * Try to find the NFC subnode and extract the associated caps
+- * from there.
+- */
+- np = of_find_compatible_node(userdev->of_node, NULL,
+- "atmel,sama5d3-nfc");
+- if (np) {
+- const struct of_device_id *match;
+-
+- match = of_match_node(atmel_pmecc_legacy_match, np);
+- if (match && match->data)
+- caps = match->data;
+-
+- of_node_put(np);
+- }
++ /* Find the caps associated to the NAND dev node. */
++ match = of_match_node(atmel_pmecc_legacy_match,
++ userdev->of_node);
++ if (match && match->data)
++ caps = match->data;
+
+ pmecc = atmel_pmecc_create(pdev, caps, 1, 2);
+ }
--- /dev/null
+From 6d29231000bbe0fb9e4893a9c68151ffdd3b5469 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Mon, 31 Jul 2017 10:31:27 +0200
+Subject: mtd: nand: Declare tBERS, tR and tPROG as u64 to avoid integer overflow
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit 6d29231000bbe0fb9e4893a9c68151ffdd3b5469 upstream.
+
+All timings in nand_sdr_timings are expressed in picoseconds but some
+of them may not fit in an u32.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: 204e7ecd47e2 ("mtd: nand: Add a few more timings to nand_sdr_timings")
+Reported-by: Alexander Dahl <ada@thorsis.com>
+Reviewed-by: Alexander Dahl <ada@thorsis.com>
+Tested-by: Alexander Dahl <ada@thorsis.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_timings.c | 6 +++---
+ include/linux/mtd/nand.h | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/mtd/nand/nand_timings.c
++++ b/drivers/mtd/nand/nand_timings.c
+@@ -311,9 +311,9 @@ int onfi_init_data_interface(struct nand
+ struct nand_sdr_timings *timings = &iface->timings.sdr;
+
+ /* microseconds -> picoseconds */
+- timings->tPROG_max = 1000000UL * le16_to_cpu(params->t_prog);
+- timings->tBERS_max = 1000000UL * le16_to_cpu(params->t_bers);
+- timings->tR_max = 1000000UL * le16_to_cpu(params->t_r);
++ timings->tPROG_max = 1000000ULL * le16_to_cpu(params->t_prog);
++ timings->tBERS_max = 1000000ULL * le16_to_cpu(params->t_bers);
++ timings->tR_max = 1000000ULL * le16_to_cpu(params->t_r);
+
+ /* nanoseconds -> picoseconds */
+ timings->tCCS_min = 1000UL * le16_to_cpu(params->t_ccs);
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -638,10 +638,10 @@ struct nand_buffers {
+ * @tWW_min: WP# transition to WE# low
+ */
+ struct nand_sdr_timings {
+- u32 tBERS_max;
++ u64 tBERS_max;
+ u32 tCCS_min;
+- u32 tPROG_max;
+- u32 tR_max;
++ u64 tPROG_max;
++ u64 tR_max;
+ u32 tALH_min;
+ u32 tADL_min;
+ u32 tALS_min;
--- /dev/null
+From a11bf5ed951f8900d244d09eb03a888b59c7fc82 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Mon, 31 Jul 2017 10:29:56 +0200
+Subject: mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit a11bf5ed951f8900d244d09eb03a888b59c7fc82 upstream.
+
+Some ONFI NANDs do not support the SET/GET FEATURES commands, which,
+according to the spec, is perfectly valid.
+
+On these NANDs we can't set a specific timing mode using the "timing
+mode" feature, and we should assume the NAND does not require any setup
+to enter a specific timing mode.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: d8e725dd8311 ("mtd: nand: automate NAND timings selection")
+Reported-by: Alexander Dahl <ada@thorsis.com>
+Tested-by: Alexander Dahl <ada@thorsis.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_base.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -1102,7 +1102,9 @@ static int nand_setup_data_interface(str
+ * Ensure the timing mode has been changed on the chip side
+ * before changing timings on the controller side.
+ */
+- if (chip->onfi_version) {
++ if (chip->onfi_version &&
++ (le16_to_cpu(chip->onfi_params.opt_cmd) &
++ ONFI_OPT_CMD_SET_GET_FEATURES)) {
+ u8 tmode_param[ONFI_SUBFEATURE_PARAM_LEN] = {
+ chip->onfi_timing_mode_default,
+ };
--- /dev/null
+From f7f8c1756e9a5f1258a7cc6b663f8451b724900f Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+Date: Wed, 5 Jul 2017 08:51:09 +0200
+Subject: nand: fix wrong default oob layout for small pages using soft ecc
+
+From: Miquel Raynal <miquel.raynal@free-electrons.com>
+
+commit f7f8c1756e9a5f1258a7cc6b663f8451b724900f upstream.
+
+When using soft ecc, if no ooblayout is given, the core automatically
+uses one of the nand_ooblayout_{sp,lp}*() functions to determine the
+layout inside the out of band data.
+
+Until kernel version 4.6, struct nand_ecclayout was used for that
+purpose. During the migration from 4.6 to 4.7, an error shown up in the
+small page layout, in the case oob section is only 8 bytes long.
+
+The layout was using three bytes (0, 1, 2) for ecc, two bytes (3, 4)
+as free bytes, one byte (5) for bad block marker and finally
+two bytes (6, 7) as free bytes, as shown there:
+
+[linux-4.6] drivers/mtd/nand/nand_base.c:52
+static struct nand_ecclayout nand_oob_8 = {
+ .eccbytes = 3,
+ .eccpos = {0, 1, 2},
+ .oobfree = {
+ {.offset = 3,
+ .length = 2},
+ {.offset = 6,
+ .length = 2} }
+};
+
+This fixes the current implementation which is incoherent. It
+references bit 3 at the same time as an ecc byte and a free byte.
+
+Furthermore, it is clear with the previous implementation that there
+is only one ecc section with 8 bytes oob sections. We shall return
+-ERANGE in the nand_ooblayout_ecc_sp() function when asked for the
+second section.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@free-electrons.com>
+Fixes: 41b207a70d3a ("mtd: nand: implement the default mtd_ooblayout_ops")
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_base.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -65,8 +65,14 @@ static int nand_ooblayout_ecc_sp(struct
+
+ if (!section) {
+ oobregion->offset = 0;
+- oobregion->length = 4;
++ if (mtd->oobsize == 16)
++ oobregion->length = 4;
++ else
++ oobregion->length = 3;
+ } else {
++ if (mtd->oobsize == 8)
++ return -ERANGE;
++
+ oobregion->offset = 6;
+ oobregion->length = ecc->total - 4;
+ }
--- /dev/null
+From 1feb26162bee7b2f110facfec71b5c7bdbc7d14d Mon Sep 17 00:00:00 2001
+From: Weston Andros Adamson <dros@monkey.org>
+Date: Tue, 1 Aug 2017 16:25:01 -0400
+Subject: nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays
+
+From: Weston Andros Adamson <dros@monkey.org>
+
+commit 1feb26162bee7b2f110facfec71b5c7bdbc7d14d upstream.
+
+The client was freeing the nfs4_ff_layout_ds, but not the contained
+nfs4_ff_ds_version array.
+
+Signed-off-by: Weston Andros Adamson <dros@primarydata.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/flexfilelayout/flexfilelayoutdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -32,6 +32,7 @@ void nfs4_ff_layout_free_deviceid(struct
+ {
+ nfs4_print_deviceid(&mirror_ds->id_node.deviceid);
+ nfs4_pnfs_ds_put(mirror_ds->ds);
++ kfree(mirror_ds->ds_versions);
+ kfree_rcu(mirror_ds, id_node.rcu);
+ }
+
--- /dev/null
+From 6b67c3906cd74d88da4f6717b4b294bd52fce56a Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Date: Tue, 1 Aug 2017 17:57:20 +0200
+Subject: pinctrl: armada-37xx: Fix number of pin in south bridge
+
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+
+commit 6b67c3906cd74d88da4f6717b4b294bd52fce56a upstream.
+
+On the south bridge we have pin from to 29, so it gives 30 pins (and not
+29).
+
+Without this patch the kernel complain with the following traces:
+cat /sys/kernel/debug/pinctrl/d0018800.pinctrl/pingroups
+[ 154.530205] armada-37xx-pinctrl d0018800.pinctrl: failed to get pin(29) name
+[ 154.537567] ------------[ cut here ]------------
+[ 154.542348] WARNING: CPU: 1 PID: 1347 at /home/gclement/open/kernel/marvell-mainline-linux/drivers/pinctrl/core.c:1610 pinctrl_groups_show+0x15c/0x1a0
+[ 154.555918] Modules linked in:
+[ 154.558890] CPU: 1 PID: 1347 Comm: cat Tainted: G W 4.13.0-rc1-00001-g19e1b9fa219d #525
+[ 154.568316] Hardware name: Marvell Armada 3720 Development Board DB-88F3720-DDR3 (DT)
+[ 154.576311] task: ffff80001d32d100 task.stack: ffff80001bdc0000
+[ 154.583048] PC is at pinctrl_groups_show+0x15c/0x1a0
+[ 154.587816] LR is at pinctrl_groups_show+0x148/0x1a0
+[ 154.592847] pc : [<ffff0000083e3adc>] lr : [<ffff0000083e3ac8>] pstate: 00000145
+[ 154.600840] sp : ffff80001bdc3c80
+[ 154.604255] x29: ffff80001bdc3c80 x28: 00000000f7750000
+[ 154.609825] x27: ffff80001d05d198 x26: 0000000000000009
+[ 154.615224] x25: ffff0000089ead20 x24: 0000000000000002
+[ 154.620705] x23: ffff000008c8e1d0 x22: ffff80001be55700
+[ 154.626187] x21: ffff80001d05d100 x20: 0000000000000005
+[ 154.631667] x19: 0000000000000006 x18: 0000000000000010
+[ 154.637238] x17: 0000000000000000 x16: ffff0000081fc4b8
+[ 154.642726] x15: 0000000000000006 x14: ffff0000899e537f
+[ 154.648214] x13: ffff0000099e538d x12: 206f742064656c69
+[ 154.653613] x11: 6166203a6c727463 x10: 0000000005f5e0ff
+[ 154.659094] x9 : ffff80001bdc38c0 x8 : 286e697020746567
+[ 154.664576] x7 : ffff000008551870 x6 : 000000000000011b
+[ 154.670146] x5 : 0000000000000000 x4 : 0000000000000000
+[ 154.675544] x3 : 0000000000000000 x2 : 0000000000000000
+[ 154.681025] x1 : ffff000008c8e1d0 x0 : ffff80001be55700
+[ 154.686507] Call trace:
+[ 154.688668] Exception stack(0xffff80001bdc3ab0 to 0xffff80001bdc3be0)
+[ 154.695224] 3aa0: 0000000000000006 0001000000000000
+[ 154.703310] 3ac0: ffff80001bdc3c80 ffff0000083e3adc ffff80001bdc3bb0 00000000ffffffd8
+[ 154.711304] 3ae0: 4554535953425553 6f6674616c703d4d 4349564544006d72 6674616c702b3d45
+[ 154.719478] 3b00: 313030643a6d726f 6e69702e30303838 ffff80006c727463 ffff0000089635d8
+[ 154.727562] 3b20: ffff80001d1ca0cb ffff000008af0fa4 ffff80001bdc3b40 ffff000008c8e1dc
+[ 154.735648] 3b40: ffff80001bdc3bc0 ffff000008223174 ffff80001be55700 ffff000008c8e1d0
+[ 154.743731] 3b60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[ 154.752354] 3b80: 000000000000011b ffff000008551870 286e697020746567 ffff80001bdc38c0
+[ 154.760446] 3ba0: 0000000005f5e0ff 6166203a6c727463 206f742064656c69 ffff0000099e538d
+[ 154.767910] 3bc0: ffff0000899e537f 0000000000000006 ffff0000081fc4b8 0000000000000000
+[ 154.776085] [<ffff0000083e3adc>] pinctrl_groups_show+0x15c/0x1a0
+[ 154.782823] [<ffff000008222abc>] seq_read+0x184/0x460
+[ 154.787505] [<ffff000008344120>] full_proxy_read+0x60/0xa8
+[ 154.793431] [<ffff0000081f9bec>] __vfs_read+0x1c/0x110
+[ 154.799001] [<ffff0000081faff4>] vfs_read+0x84/0x140
+[ 154.803860] [<ffff0000081fc4fc>] SyS_read+0x44/0xa0
+[ 154.808983] [<ffff000008082f30>] el0_svc_naked+0x24/0x28
+[ 154.814459] ---[ end trace 4cbb00a92d616b95 ]---
+
+Fixes: 87466ccd9401 ("pinctrl: armada-37xx: Add pin controller support
+for Armada 37xx")
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -176,7 +176,7 @@ const struct armada_37xx_pin_data armada
+ };
+
+ const struct armada_37xx_pin_data armada_37xx_pin_sb = {
+- .nr_pins = 29,
++ .nr_pins = 30,
+ .name = "GPIO2",
+ .groups = armada_37xx_sb_groups,
+ .ngroups = ARRAY_SIZE(armada_37xx_sb_groups),
mm-ratelimit-pfns-busy-info-message.patch
mm-fix-list-corruptions-on-shmem-shrinklist.patch
futex-remove-unnecessary-warning-from-get_futex_key.patch
+xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch
+xtensa-mm-cache-add-missing-export_symbols.patch
+xtensa-don-t-limit-csum_partial-export-by-config_net.patch
+xfs-fix-leak-of-discard-bio.patch
+pinctrl-armada-37xx-fix-number-of-pin-in-south-bridge.patch
+mtd-nand-atmel-fix-dt-backward-compatibility-in-pmecc.c.patch
+mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch
+mtd-nand-declare-tbers-tr-and-tprog-as-u64-to-avoid-integer-overflow.patch
+iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch
+iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch
+usb-storage-fix-deadlock-involving-host-lock-and-scsi_done.patch
+target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch
+fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch
+i2c-designware-some-broken-dstds-use-1mihz-instead-of-1mhz.patch
+nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch
+mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch
+nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch
+drm-bridge-tc358767-fix-probe-without-attached-output-node.patch
+drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch
+drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch
+usb-serial-option-add-d-link-dwm-222-device-id.patch
+usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch
+usb-serial-pl2303-add-new-aten-device-id.patch
+usb-musb-fix-tx-fifo-flush-handling-again.patch
+usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch
+staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch
+iio-aspeed-adc-wait-for-initial-sequence.patch
+iio-accel-st_accel-add-spi-3wire-support.patch
+iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch
+iio-pressure-st_pressure_core-disable-multiread-by-default-for-lps22hb.patch
+iio-light-tsl2563-use-correct-event-code.patch
+iio-adc-revert-axp288-drop-bogus-axp288_adc_ts_pin_ctrl-register-modifications.patch
+staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch
+uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch
+firmware-fix-batched-requests-wake-all-waiters.patch
+firmware-fix-batched-requests-send-wake-up-on-failure-on-direct-lookups.patch
+firmware-avoid-invalid-fallback-aborts-by-using-killable-wait.patch
+block-make-blk_mq_delay_kick_requeue_list-rerun-the-queue-at-a-quiet-time.patch
+usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch
+usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch
+usb-check-for-dropped-connection-before-switching-to-full-speed.patch
+usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch
+usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch
+usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch
--- /dev/null
+From cef988642cdac44e910a27cb6e8166c96f86a0df Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 28 Jul 2017 16:22:31 +0100
+Subject: staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit cef988642cdac44e910a27cb6e8166c96f86a0df upstream.
+
+Comedi's read and write file operation handlers (`comedi_read()` and
+`comedi_write()`) currently call `copy_to_user()` or `copy_from_user()`
+whilst in the `TASK_INTERRUPTIBLE` state, which falls foul of the
+`might_fault()` checks when enabled. Fix it by setting the current task
+state back to `TASK_RUNNING` a bit earlier before calling these
+functions.
+
+Reported-by: Piotr Gregor <piotrgregor@rsyncme.org>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_fops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -2396,6 +2396,7 @@ static ssize_t comedi_write(struct file
+ continue;
+ }
+
++ set_current_state(TASK_RUNNING);
+ wp = async->buf_write_ptr;
+ n1 = min(n, async->prealloc_bufsz - wp);
+ n2 = n - n1;
+@@ -2528,6 +2529,8 @@ static ssize_t comedi_read(struct file *
+ }
+ continue;
+ }
++
++ set_current_state(TASK_RUNNING);
+ rp = async->buf_read_ptr;
+ n1 = min(n, async->prealloc_bufsz - rp);
+ n2 = n - n1;
--- /dev/null
+From 105967ad68d2eb1a041bc041f9cf96af2a653b65 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 14 Jul 2017 11:31:03 +0200
+Subject: staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 105967ad68d2eb1a041bc041f9cf96af2a653b65 upstream.
+
+gcc-7 points out an older regression:
+
+drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw':
+drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]
+
+The original code had 'unsigned short' here, but incorrectly got
+converted to 'bool'. This reverts the regression and uses a normal
+type instead.
+
+Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/resolver/ad2s1210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/iio/resolver/ad2s1210.c
++++ b/drivers/staging/iio/resolver/ad2s1210.c
+@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_
+ long m)
+ {
+ struct ad2s1210_state *st = iio_priv(indio_dev);
+- bool negative;
++ u16 negative;
+ int ret = 0;
+ u16 pos;
+ s16 vel;
--- /dev/null
+From 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sun, 6 Aug 2017 16:10:03 -0700
+Subject: target: Fix node_acl demo-mode + uncached dynamic shutdown regression
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd upstream.
+
+This patch fixes a generate_node_acls = 1 + cache_dynamic_acls = 0
+regression, that was introduced by
+
+ commit 01d4d673558985d9a118e1e05026633c3e2ade9b
+ Author: Nicholas Bellinger <nab@linux-iscsi.org>
+ Date: Wed Dec 7 12:55:54 2016 -0800
+
+which originally had the proper list_del_init() usage, but was
+dropped during list review as it was thought unnecessary by HCH.
+
+However, list_del_init() usage is required during the special
+generate_node_acls = 1 + cache_dynamic_acls = 0 case when
+transport_free_session() does a list_del(&se_nacl->acl_list),
+followed by target_complete_nacl() doing the same thing.
+
+This was manifesting as a general protection fault as reported
+by Justin:
+
+kernel: general protection fault: 0000 [#1] SMP
+kernel: Modules linked in:
+kernel: CPU: 0 PID: 11047 Comm: iscsi_ttx Not tainted 4.13.0-rc2.x86_64.1+ #20
+kernel: Hardware name: Intel Corporation S5500BC/S5500BC, BIOS S5500.86B.01.00.0064.050520141428 05/05/2014
+kernel: task: ffff88026939e800 task.stack: ffffc90007884000
+kernel: RIP: 0010:target_put_nacl+0x49/0xb0
+kernel: RSP: 0018:ffffc90007887d70 EFLAGS: 00010246
+kernel: RAX: dead000000000200 RBX: ffff8802556ca000 RCX: 0000000000000000
+kernel: RDX: dead000000000100 RSI: 0000000000000246 RDI: ffff8802556ce028
+kernel: RBP: ffffc90007887d88 R08: 0000000000000001 R09: 0000000000000000
+kernel: R10: ffffc90007887df8 R11: ffffea0009986900 R12: ffff8802556ce020
+kernel: R13: ffff8802556ce028 R14: ffff8802556ce028 R15: ffffffff88d85540
+kernel: FS: 0000000000000000(0000) GS:ffff88027fc00000(0000) knlGS:0000000000000000
+kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+kernel: CR2: 00007fffe36f5f94 CR3: 0000000009209000 CR4: 00000000003406f0
+kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+kernel: Call Trace:
+kernel: transport_free_session+0x67/0x140
+kernel: transport_deregister_session+0x7a/0xc0
+kernel: iscsit_close_session+0x92/0x210
+kernel: iscsit_close_connection+0x5f9/0x840
+kernel: iscsit_take_action_for_connection_exit+0xfe/0x110
+kernel: iscsi_target_tx_thread+0x140/0x1e0
+kernel: ? wait_woken+0x90/0x90
+kernel: kthread+0x124/0x160
+kernel: ? iscsit_thread_get_cpumask+0x90/0x90
+kernel: ? kthread_create_on_node+0x40/0x40
+kernel: ret_from_fork+0x22/0x30
+kernel: Code: 00 48 89 fb 4c 8b a7 48 01 00 00 74 68 4d 8d 6c 24 08 4c
+89 ef e8 e8 28 43 00 48 8b 93 20 04 00 00 48 8b 83 28 04 00 00 4c 89
+ef <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 20
+kernel: RIP: target_put_nacl+0x49/0xb0 RSP: ffffc90007887d70
+kernel: ---[ end trace f12821adbfd46fed ]---
+
+To address this, go ahead and use proper list_del_list() for all
+cases of se_nacl->acl_list deletion.
+
+Reported-by: Justin Maggard <jmaggard01@gmail.com>
+Tested-by: Justin Maggard <jmaggard01@gmail.com>
+Cc: Justin Maggard <jmaggard01@gmail.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_tpg.c | 4 ++--
+ drivers/target/target_core_transport.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(str
+ mutex_lock(&tpg->acl_node_mutex);
+ if (acl->dynamic_node_acl)
+ acl->dynamic_node_acl = 0;
+- list_del(&acl->acl_list);
++ list_del_init(&acl->acl_list);
+ mutex_unlock(&tpg->acl_node_mutex);
+
+ target_shutdown_sessions(acl);
+@@ -548,7 +548,7 @@ int core_tpg_deregister(struct se_portal
+ * in transport_deregister_session().
+ */
+ list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) {
+- list_del(&nacl->acl_list);
++ list_del_init(&nacl->acl_list);
+
+ core_tpg_wait_for_nacl_pr_ref(nacl);
+ core_free_device_list_for_node(nacl, se_tpg);
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -466,7 +466,7 @@ static void target_complete_nacl(struct
+ }
+
+ mutex_lock(&se_tpg->acl_node_mutex);
+- list_del(&nacl->acl_list);
++ list_del_init(&nacl->acl_list);
+ mutex_unlock(&se_tpg->acl_node_mutex);
+
+ core_tpg_wait_for_nacl_pr_ref(nacl);
+@@ -538,7 +538,7 @@ void transport_free_session(struct se_se
+ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
+
+ if (se_nacl->dynamic_stop)
+- list_del(&se_nacl->acl_list);
++ list_del_init(&se_nacl->acl_list);
+ }
+ mutex_unlock(&se_tpg->acl_node_mutex);
+
--- /dev/null
+From 89f23d51defcb94a5026d4b5da13faf4e1150a6f Mon Sep 17 00:00:00 2001
+From: Alan Swanson <reiver@improbability.net>
+Date: Wed, 26 Jul 2017 12:03:33 +0100
+Subject: uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069
+
+From: Alan Swanson <reiver@improbability.net>
+
+commit 89f23d51defcb94a5026d4b5da13faf4e1150a6f upstream.
+
+Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for
+Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already
+present in unusual_uas.h. Both in same controller IC family.
+
+Issue is that MakeMKV fails during key exchange with installed bluray drive
+with following error:
+
+002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED'
+occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
+
+Signed-off-by: Alan Swanson <reiver@improbability.net>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_uas.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+ UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+ "Initio Corporation",
+- "",
++ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_NO_ATA_1X),
++ US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE),
+
+ /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
--- /dev/null
+From 94c43b9897abf4ea366ed4dba027494e080c7050 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 1 Aug 2017 10:41:56 -0400
+Subject: USB: Check for dropped connection before switching to full speed
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 94c43b9897abf4ea366ed4dba027494e080c7050 upstream.
+
+Some buggy USB disk adapters disconnect and reconnect multiple times
+during the enumeration procedure. This may lead to a device
+connecting at full speed instead of high speed, because when the USB
+stack sees that a device isn't able to enumerate at high speed, it
+tries to hand the connection over to a full-speed companion
+controller.
+
+The logic for doing this is careful to check that the device is still
+connected. But this check is inadequate if the device disconnects and
+reconnects before the check is done. The symptom is that a device
+works, but much more slowly than it is capable of operating.
+
+The situation was made worse recently by commit 22547c4cc4fe ("usb:
+hub: Wait for connection to be reestablished after port reset"), which
+increases the delay following a reset before a disconnect is
+recognized, thus giving the device more time to reconnect.
+
+This patch makes the check more robust. If the device was
+disconnected at any time during enumeration, we will now skip the
+full-speed handover.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Zdenek Kabelac <zkabelac@redhat.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4730,7 +4730,8 @@ hub_power_remaining(struct usb_hub *hub)
+ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ u16 portchange)
+ {
+- int status, i;
++ int status = -ENODEV;
++ int i;
+ unsigned unit_load;
+ struct usb_device *hdev = hub->hdev;
+ struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
+@@ -4934,9 +4935,10 @@ loop:
+
+ done:
+ hub_port_disable(hub, port1, 1);
+- if (hcd->driver->relinquish_port && !hub->hdev->parent)
+- hcd->driver->relinquish_port(hcd, port1);
+-
++ if (hcd->driver->relinquish_port && !hub->hdev->parent) {
++ if (status != -ENOTCONN && status != -ENODEV)
++ hcd->driver->relinquish_port(hcd, port1);
++ }
+ }
+
+ /* Handle physical or logical connection change events.
--- /dev/null
+From 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e Mon Sep 17 00:00:00 2001
+From: Bin Liu <b-liu@ti.com>
+Date: Tue, 25 Jul 2017 09:31:33 -0500
+Subject: usb: core: unlink urbs from the tail of the endpoint's urb_list
+
+From: Bin Liu <b-liu@ti.com>
+
+commit 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e upstream.
+
+While unlink an urb, if the urb has been programmed in the controller,
+the controller driver might do some hw related actions to tear down the
+urb.
+
+Currently usb_hcd_flush_endpoint() passes each urb from the head of the
+endpoint's urb_list to the controller driver, which could make the
+controller driver think each urb has been programmed and take the
+unnecessary actions for each urb.
+
+This patch changes the behavior in usb_hcd_flush_endpoint() to pass the
+urbs from the tail of the list, to avoid any unnecessary actions in an
+controller driver.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1878,7 +1878,7 @@ void usb_hcd_flush_endpoint(struct usb_d
+ /* No more submits can occur */
+ spin_lock_irq(&hcd_urb_list_lock);
+ rescan:
+- list_for_each_entry (urb, &ep->urb_list, urb_list) {
++ list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) {
+ int is_in;
+
+ if (urb->unlinked)
--- /dev/null
+From aca5b9ebd096039657417c321a9252c696b359c2 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 2 Aug 2017 21:06:35 +0900
+Subject: usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() calling
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit aca5b9ebd096039657417c321a9252c696b359c2 upstream.
+
+According to the gadget.h, a "complete" function will always be called
+with interrupts disabled. However, sometimes usb3_request_done() function
+is called with interrupts enabled. So, this function should be held
+by spin_lock_irqsave() to disable interruption. Also, this driver has
+to call spin_unlock() to avoid spinlock recursion by this driver before
+calling usb_gadget_giveback_request().
+
+Reported-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
+Tested-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
+Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -758,21 +758,32 @@ static struct renesas_usb3_request *usb3
+ return usb3_req;
+ }
+
+-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+- struct renesas_usb3_request *usb3_req, int status)
++static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep,
++ struct renesas_usb3_request *usb3_req,
++ int status)
+ {
+ struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
+- unsigned long flags;
+
+ dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n",
+ usb3_ep->num, usb3_req->req.length, usb3_req->req.actual,
+ status);
+ usb3_req->req.status = status;
+- spin_lock_irqsave(&usb3->lock, flags);
+ usb3_ep->started = false;
+ list_del_init(&usb3_req->queue);
+- spin_unlock_irqrestore(&usb3->lock, flags);
++ spin_unlock(&usb3->lock);
+ usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req);
++ spin_lock(&usb3->lock);
++}
++
++static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
++ struct renesas_usb3_request *usb3_req, int status)
++{
++ struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
++ unsigned long flags;
++
++ spin_lock_irqsave(&usb3->lock, flags);
++ __usb3_request_done(usb3_ep, usb3_req, status);
++ spin_unlock_irqrestore(&usb3->lock, flags);
+ }
+
+ static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3)
--- /dev/null
+From cd5a6a4fdaba150089af2afc220eae0fef74878a Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 25 Jul 2017 23:58:50 +0200
+Subject: USB: hcd: Mark secondary HCD as dead if the primary one died
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit cd5a6a4fdaba150089af2afc220eae0fef74878a upstream.
+
+Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared
+HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for
+the primary one.
+
+Among other thigs, this prevents check_root_hub_suspended() from
+returning -EBUSY for dead HCDs which helps to work around system
+suspend issues in some situations.
+
+This actually fixes occasional suspend failures on one of my test
+machines.
+
+Suggested-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -2475,6 +2475,8 @@ void usb_hc_died (struct usb_hcd *hcd)
+ }
+ if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
+ hcd = hcd->shared_hcd;
++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
++ set_bit(HCD_FLAG_DEAD, &hcd->flags);
+ if (hcd->rh_registered) {
+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+
--- /dev/null
+From 45d73860530a14c608f410b91c6c341777bfa85d Mon Sep 17 00:00:00 2001
+From: Bin Liu <b-liu@ti.com>
+Date: Tue, 25 Jul 2017 09:31:34 -0500
+Subject: usb: musb: fix tx fifo flush handling again
+
+From: Bin Liu <b-liu@ti.com>
+
+commit 45d73860530a14c608f410b91c6c341777bfa85d upstream.
+
+commit 68fe05e2a451 ("usb: musb: fix tx fifo flush handling") drops the
+1ms delay trying to solve the long disconnect time issue when
+application queued many tx urbs. However, the 1ms delay is needed for
+some use cases, for example, without the delay, reconnecting AR9271 WIFI
+dongle no longer works if the connection is dropped from the AP.
+
+So let's add back the 1ms delay in musb_h_tx_flush_fifo(), and solve the
+long disconnect time problem with a separate patch for
+usb_hcd_flush_endpoint().
+
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_host.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct
+ "Could not flush host TX%d fifo: csr: %04x\n",
+ ep->epnum, csr))
+ return;
++ mdelay(1);
+ }
+ }
+
--- /dev/null
+From 7496cfe5431f21da5d27a8388c326397e3f0a5db Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Tue, 8 Aug 2017 17:51:27 +0800
+Subject: usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 7496cfe5431f21da5d27a8388c326397e3f0a5db upstream.
+
+Moshi USB to Ethernet Adapter internally uses a Genesys Logic hub to
+connect to Realtek r8153.
+
+The Realtek r8153 ethernet does not work on the internal hub, no-lpm quirk
+can make it work.
+
+Since another r8153 dongle at my hand does not have the issue, so add
+the quirk to the Genesys Logic hub instead.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -150,6 +150,9 @@ static const struct usb_device_id usb_qu
+ /* appletouch */
+ { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
++ { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Avision AV600U */
+ { USB_DEVICE(0x0638, 0x0a13), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
--- /dev/null
+From 2acecd58969897795cf015c9057ebd349a3fda8a Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 2 Aug 2017 13:21:45 +0900
+Subject: usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 2acecd58969897795cf015c9057ebd349a3fda8a upstream.
+
+The latest HW manual (Rev.0.55) shows us this UGCTRL2.VBUSSEL bit.
+If the bit sets to 1, the VBUS drive is controlled by phy related
+registers (called "UCOM Registers" on the manual). Since R-Car Gen3
+environment will control VBUS by phy-rcar-gen3-usb2 driver,
+the UGCTRL2.VBUSSEL bit should be set to 1. So, this patch fixes
+the register's value. Otherwise, even if the ID pin indicates to
+peripheral, the R-Car will output USBn_PWEN to 1 when a host driver
+is running.
+
+Fixes: de18757e272d ("usb: renesas_usbhs: add R-Car Gen3 power control"
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/rcar3.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/renesas_usbhs/rcar3.c
++++ b/drivers/usb/renesas_usbhs/rcar3.c
+@@ -20,9 +20,13 @@
+ /* Low Power Status register (LPSTS) */
+ #define LPSTS_SUSPM 0x4000
+
+-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */
++/*
++ * USB General control register 2 (UGCTRL2)
++ * Remarks: bit[31:11] and bit[9:6] should be 0
++ */
+ #define UGCTRL2_RESERVED_3 0x00000001 /* bit[3:0] should be B'0001 */
+ #define UGCTRL2_USB0SEL_OTG 0x00000030
++#define UGCTRL2_VBUSSEL 0x00000400
+
+ static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data)
+ {
+@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct
+ {
+ struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev);
+
+- usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
++ usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG |
++ UGCTRL2_VBUSSEL);
+
+ if (enable) {
+ usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
--- /dev/null
+From 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f Mon Sep 17 00:00:00 2001
+From: Stefan Triller <github@stefantriller.de>
+Date: Fri, 30 Jun 2017 14:44:03 +0200
+Subject: USB: serial: cp210x: add support for Qivicon USB ZigBee dongle
+
+From: Stefan Triller <github@stefantriller.de>
+
+commit 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f upstream.
+
+The German Telekom offers a ZigBee USB Stick under the brand name Qivicon
+for their SmartHome Home Base in its 1. Generation. The productId is not
+known by the according kernel module, this patch adds support for it.
+
+Signed-off-by: Stefan Triller <github@stefantriller.de>
+Reviewed-by: Frans Klaver <fransklaver@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -142,6 +142,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
+ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
++ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
--- /dev/null
+From fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 Mon Sep 17 00:00:00 2001
+From: Hector Martin <marcan@marcan.st>
+Date: Wed, 2 Aug 2017 00:45:06 +0900
+Subject: USB: serial: option: add D-Link DWM-222 device ID
+
+From: Hector Martin <marcan@marcan.st>
+
+commit fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 upstream.
+
+Add device id for D-Link DWM-222.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2025,6 +2025,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
--- /dev/null
+From 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 10 Aug 2017 11:54:12 -0700
+Subject: USB: serial: pl2303: add new ATEN device id
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e upstream.
+
+This adds a new ATEN device id for a new pl2303-based device.
+
+Reported-by: Peter Kuo <PeterKuo@aten.com.tw>
+Cc: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/pl2303.c | 2 ++
+ drivers/usb/serial/pl2303.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -52,6 +52,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
+ .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
++ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485),
++ .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
+ { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
+ { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -27,6 +27,7 @@
+ #define ATEN_VENDOR_ID 0x0557
+ #define ATEN_VENDOR_ID2 0x0547
+ #define ATEN_PRODUCT_ID 0x2008
++#define ATEN_PRODUCT_UC485 0x2021
+ #define ATEN_PRODUCT_ID2 0x2118
+
+ #define IODATA_VENDOR_ID 0x04bb
--- /dev/null
+From 8b52291a0743fc4db4a7495c846a6f31ee84d282 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 26 Jul 2017 11:49:19 -0400
+Subject: usb-storage: fix deadlock involving host lock and scsi_done
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 8b52291a0743fc4db4a7495c846a6f31ee84d282 upstream.
+
+Christoph Hellwig says that since version 4.12, the kernel switched to
+using blk-mq by default. The old code used a softirq for handling
+request completions, but blk-mq can handle completions in the caller's
+context. This may cause a problem for usb-storage, because it invokes
+the ->scsi_done callback while holding the host lock, and the
+completion routine sometimes tries to acquire the same lock (when
+running the error handler, for example).
+
+The consequence is that the existing code will sometimes deadlock upon
+error completion of a SCSI command (with a lockdep warning).
+
+This is easy enough to fix, since usb-storage doesn't really need to
+hold the host lock while the callback runs. It was simpler to write
+it that way, but moving the call outside the locked region is pretty
+easy and there's no downside. That's what this patch does.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Arthur Marsh <arthur.marsh@internode.on.net>
+CC: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/usb.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -315,6 +315,7 @@ static int usb_stor_control_thread(void
+ {
+ struct us_data *us = (struct us_data *)__us;
+ struct Scsi_Host *host = us_to_host(us);
++ struct scsi_cmnd *srb;
+
+ for (;;) {
+ usb_stor_dbg(us, "*** thread sleeping\n");
+@@ -330,6 +331,7 @@ static int usb_stor_control_thread(void
+ scsi_lock(host);
+
+ /* When we are called with no command pending, we're done */
++ srb = us->srb;
+ if (us->srb == NULL) {
+ scsi_unlock(host);
+ mutex_unlock(&us->dev_mutex);
+@@ -398,14 +400,11 @@ static int usb_stor_control_thread(void
+ /* lock access to the state */
+ scsi_lock(host);
+
+- /* indicate that the command is done */
+- if (us->srb->result != DID_ABORT << 16) {
+- usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
+- us->srb->result);
+- us->srb->scsi_done(us->srb);
+- } else {
++ /* was the command aborted? */
++ if (us->srb->result == DID_ABORT << 16) {
+ SkipForAbort:
+ usb_stor_dbg(us, "scsi command aborted\n");
++ srb = NULL; /* Don't call srb->scsi_done() */
+ }
+
+ /*
+@@ -429,6 +428,13 @@ SkipForAbort:
+
+ /* unlock the device pointers */
+ mutex_unlock(&us->dev_mutex);
++
++ /* now that the locks are released, notify the SCSI core */
++ if (srb) {
++ usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
++ srb->result);
++ srb->scsi_done(srb);
++ }
+ } /* for (;;) */
+
+ /* Wait until we are told to stop */
--- /dev/null
+From e788787ef4f9c24aafefc480a8da5f92b914e5e6 Mon Sep 17 00:00:00 2001
+From: Sandeep Singh <sandeep.singh@amd.com>
+Date: Fri, 4 Aug 2017 16:35:56 +0530
+Subject: usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume
+
+From: Sandeep Singh <sandeep.singh@amd.com>
+
+commit e788787ef4f9c24aafefc480a8da5f92b914e5e6 upstream.
+
+Certain HP keyboards would keep inputting a character automatically which
+is the wake-up key after S3 resume
+
+On some AMD platforms USB host fails to respond (by holding resume-K) to
+USB device (an HP keyboard) resume request within 1ms (TURSM) and ensures
+that resume is signaled for at least 20 ms (TDRSMDN), which is defined in
+USB 2.0 spec. The result is that the keyboard is out of function.
+
+In SNPS USB design, the host responds to the resume request only after
+system gets back to S0 and the host gets to functional after the internal
+HW restore operation that is more than 1 second after the initial resume
+request from the USB device.
+
+As a workaround for specific keyboard ID(HP Keyboards), applying port reset
+after resume when the keyboard is plugged in.
+
+Signed-off-by: Sandeep Singh <Sandeep.Singh@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+cc: Nehal Shah <Nehal-bakulchandra.Shah@amd.com>
+Reviewed-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 1 +
+ drivers/usb/host/pci-quirks.c | 17 ++++++++++++-----
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -252,6 +252,7 @@ static const struct usb_device_id usb_am
+ { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
+ { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
+ { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Optical Mouse M90/M100 */
+ { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -98,6 +98,7 @@ enum amd_chipset_gen {
+ AMD_CHIPSET_HUDSON2,
+ AMD_CHIPSET_BOLTON,
+ AMD_CHIPSET_YANGTZE,
++ AMD_CHIPSET_TAISHAN,
+ AMD_CHIPSET_UNKNOWN,
+ };
+
+@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(stru
+ pinfo->sb_type.gen = AMD_CHIPSET_SB700;
+ else if (rev >= 0x40 && rev <= 0x4f)
+ pinfo->sb_type.gen = AMD_CHIPSET_SB800;
++ }
++ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
++ 0x145c, NULL);
++ if (pinfo->smbus_dev) {
++ pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
+ } else {
+ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+ PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
+@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(stru
+ {
+ /* Make sure amd chipset type has already been initialized */
+ usb_amd_find_chipset_info();
+- if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
+- return 0;
+-
+- dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+- return 1;
++ if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE ||
++ amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) {
++ dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
++ return 1;
++ }
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
+
--- /dev/null
+From ea7bd56fa309d10a41b1041827a63c0746c47554 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 2 Aug 2017 12:37:16 -0700
+Subject: xfs: Fix leak of discard bio
+
+From: Jan Kara <jack@suse.cz>
+
+commit ea7bd56fa309d10a41b1041827a63c0746c47554 upstream.
+
+The bio describing discard operation is allocated by
+__blkdev_issue_discard() which returns us a reference to it. That
+reference is never released and thus we leak this bio. Drop the bio
+reference once it completes in xlog_discard_endio().
+
+Fixes: 4560e78f40cb55bd2ea8f1ef4001c5baa88531c7
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_log_cil.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/xfs/xfs_log_cil.c
++++ b/fs/xfs/xfs_log_cil.c
+@@ -519,6 +519,7 @@ xlog_discard_endio(
+
+ INIT_WORK(&ctx->discard_endio_work, xlog_discard_endio_work);
+ queue_work(xfs_discard_wq, &ctx->discard_endio_work);
++ bio_put(bio);
+ }
+
+ static void
--- /dev/null
+From 7f81e55c737a8fa82c71f290945d729a4902f8d2 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Tue, 1 Aug 2017 11:02:46 -0700
+Subject: xtensa: don't limit csum_partial export by CONFIG_NET
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 7f81e55c737a8fa82c71f290945d729a4902f8d2 upstream.
+
+csum_partial and csum_partial_copy_generic are defined unconditionally
+and are available even when CONFIG_NET is disabled. They are used not
+only by the network drivers, but also by scsi and media.
+Don't limit these functions export by CONFIG_NET.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/kernel/xtensa_ksyms.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -94,13 +94,11 @@ unsigned long __sync_fetch_and_or_4(unsi
+ }
+ EXPORT_SYMBOL(__sync_fetch_and_or_4);
+
+-#ifdef CONFIG_NET
+ /*
+ * Networking support
+ */
+ EXPORT_SYMBOL(csum_partial);
+ EXPORT_SYMBOL(csum_partial_copy_generic);
+-#endif /* CONFIG_NET */
+
+ /*
+ * Architecture-specific symbols
--- /dev/null
+From 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Fri, 28 Jul 2017 17:42:59 -0700
+Subject: xtensa: fix cache aliasing handling code for WT cache
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 upstream.
+
+Currently building kernel for xtensa core with aliasing WT cache fails
+with the following messages:
+
+ mm/memory.c:2152: undefined reference to `flush_dcache_page'
+ mm/memory.c:2332: undefined reference to `local_flush_cache_page'
+ mm/memory.c:1919: undefined reference to `local_flush_cache_range'
+ mm/memory.c:4179: undefined reference to `copy_to_user_page'
+ mm/memory.c:4183: undefined reference to `copy_from_user_page'
+
+This happens because implementation of these functions is only compiled
+when data cache is WB, which looks wrong: even when data cache doesn't
+need flushing it still needs invalidation. The functions like
+__flush_[invalidate_]dcache_* are correctly defined for both WB and WT
+caches (and even if they weren't that'd still be ok, just slower).
+
+Fix this by providing the same implementation of the above functions for
+both WB and WT cache.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/mm/cache.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/arch/xtensa/mm/cache.c
++++ b/arch/xtensa/mm/cache.c
+@@ -120,10 +120,6 @@ void copy_user_highpage(struct page *dst
+ preempt_enable();
+ }
+
+-#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
+-
+-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
+-
+ /*
+ * Any time the kernel writes to a user page cache page, or it is about to
+ * read from a page cache page this routine is called.
+@@ -208,7 +204,7 @@ void local_flush_cache_page(struct vm_ar
+ __invalidate_icache_page_alias(virt, phys);
+ }
+
+-#endif
++#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
+
+ void
+ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
+@@ -225,7 +221,7 @@ update_mmu_cache(struct vm_area_struct *
+
+ flush_tlb_page(vma, addr);
+
+-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
++#if (DCACHE_WAY_SIZE > PAGE_SIZE)
+
+ if (!PageReserved(page) && test_bit(PG_arch_1, &page->flags)) {
+ unsigned long phys = page_to_phys(page);
+@@ -256,7 +252,7 @@ update_mmu_cache(struct vm_area_struct *
+ * flush_dcache_page() on the page.
+ */
+
+-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
++#if (DCACHE_WAY_SIZE > PAGE_SIZE)
+
+ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
+ unsigned long vaddr, void *dst, const void *src,
--- /dev/null
+From bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Tue, 1 Aug 2017 11:15:15 -0700
+Subject: xtensa: mm/cache: add missing EXPORT_SYMBOLs
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed upstream.
+
+Functions clear_user_highpage, copy_user_highpage, flush_dcache_page,
+local_flush_cache_range and local_flush_cache_page may be used from
+modules. Export them.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/mm/cache.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/arch/xtensa/mm/cache.c
++++ b/arch/xtensa/mm/cache.c
+@@ -103,6 +103,7 @@ void clear_user_highpage(struct page *pa
+ clear_page_alias(kvaddr, paddr);
+ preempt_enable();
+ }
++EXPORT_SYMBOL(clear_user_highpage);
+
+ void copy_user_highpage(struct page *dst, struct page *src,
+ unsigned long vaddr, struct vm_area_struct *vma)
+@@ -119,6 +120,7 @@ void copy_user_highpage(struct page *dst
+ copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr);
+ preempt_enable();
+ }
++EXPORT_SYMBOL(copy_user_highpage);
+
+ /*
+ * Any time the kernel writes to a user page cache page, or it is about to
+@@ -172,7 +174,7 @@ void flush_dcache_page(struct page *page
+
+ /* There shouldn't be an entry in the cache for this page anymore. */
+ }
+-
++EXPORT_SYMBOL(flush_dcache_page);
+
+ /*
+ * For now, flush the whole cache. FIXME??
+@@ -184,6 +186,7 @@ void local_flush_cache_range(struct vm_a
+ __flush_invalidate_dcache_all();
+ __invalidate_icache_all();
+ }
++EXPORT_SYMBOL(local_flush_cache_range);
+
+ /*
+ * Remove any entry in the cache for this page.
+@@ -203,6 +206,7 @@ void local_flush_cache_page(struct vm_ar
+ __flush_invalidate_dcache_page_alias(virt, phys);
+ __invalidate_icache_page_alias(virt, phys);
+ }
++EXPORT_SYMBOL(local_flush_cache_page);
+
+ #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
