From: Greg Kroah-Hartman Date: Mon, 6 May 2019 07:47:43 +0000 (+0200) Subject: 5.0-stable patches X-Git-Tag: v4.9.174~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e3be61456b1b64956a1978f9b801951c989b3ba;p=thirdparty%2Fkernel%2Fstable-queue.git 5.0-stable patches added patches: bluetooth-btusb-request-wake-pin-with-noautoen.patch bluetooth-mediatek-fix-up-an-error-path-to-restore-bdev-tx_state.patch clk-qcom-add-missing-freq-for-usb30_master_clk-on-8998.patch scsi-hisi_sas-fix-to-only-call-scsi_get_prot_op-for-non-null-scsi_cmnd.patch scsi-rdma-srpt-fix-a-credit-leak-for-aborted-commands.patch staging-iio-adt7316-allow-adt751x-to-use-internal-vref-for-all-dacs.patch staging-iio-adt7316-fix-handling-of-dac-high-resolution-option.patch staging-iio-adt7316-fix-the-dac-read-calculation.patch staging-iio-adt7316-fix-the-dac-write-calculation.patch usb-dwc3-reset-num_trbs-after-skipping.patch --- diff --git a/queue-5.0/bluetooth-btusb-request-wake-pin-with-noautoen.patch b/queue-5.0/bluetooth-btusb-request-wake-pin-with-noautoen.patch new file mode 100644 index 00000000000..c91e4cb0e9d --- /dev/null +++ b/queue-5.0/bluetooth-btusb-request-wake-pin-with-noautoen.patch @@ -0,0 +1,46 @@ +From 771acc7e4a6e5dba779cb1a7fd851a164bc81033 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Tue, 9 Apr 2019 11:49:17 -0700 +Subject: Bluetooth: btusb: request wake pin with NOAUTOEN + +From: Brian Norris + +commit 771acc7e4a6e5dba779cb1a7fd851a164bc81033 upstream. + +Badly-designed systems might have (for example) active-high wake pins +that default to high (e.g., because of external pull ups) until they +have an active firmware which starts driving it low. This can cause an +interrupt storm in the time between request_irq() and disable_irq(). + +We don't support shared interrupts here, so let's just pre-configure the +interrupt to avoid auto-enabling it. + +Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") +Fixes: 5364a0b4f4be ("arm64: dts: rockchip: move QCA6174A wakeup pin into its USB node") +Signed-off-by: Brian Norris +Reviewed-by: Matthias Kaehlcke +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2885,6 +2885,7 @@ static int btusb_config_oob_wake(struct + return 0; + } + ++ irq_set_status_flags(irq, IRQ_NOAUTOEN); + ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, + 0, "OOB Wake-on-BT", data); + if (ret) { +@@ -2899,7 +2900,6 @@ static int btusb_config_oob_wake(struct + } + + data->oob_wake_irq = irq; +- disable_irq(irq); + bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); + return 0; + } diff --git a/queue-5.0/bluetooth-mediatek-fix-up-an-error-path-to-restore-bdev-tx_state.patch b/queue-5.0/bluetooth-mediatek-fix-up-an-error-path-to-restore-bdev-tx_state.patch new file mode 100644 index 00000000000..a38bd81f59d --- /dev/null +++ b/queue-5.0/bluetooth-mediatek-fix-up-an-error-path-to-restore-bdev-tx_state.patch @@ -0,0 +1,37 @@ +From 77f328dbc6cf42f22c691a164958a5452142a542 Mon Sep 17 00:00:00 2001 +From: Sean Wang +Date: Fri, 15 Feb 2019 07:19:35 +0800 +Subject: Bluetooth: mediatek: fix up an error path to restore bdev->tx_state + +From: Sean Wang + +commit 77f328dbc6cf42f22c691a164958a5452142a542 upstream. + +Restore bdev->tx_state with clearing bit BTMTKUART_TX_WAIT_VND_EVT +when there is an error on waiting for the corresponding event. + +Fixes: 7237c4c9ec92 ("Bluetooth: mediatek: Add protocol support for MediaTek serial devices") +Signed-off-by: Sean Wang +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btmtkuart.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btmtkuart.c ++++ b/drivers/bluetooth/btmtkuart.c +@@ -115,11 +115,13 @@ static int mtk_hci_wmt_sync(struct hci_d + TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT); + if (err == -EINTR) { + bt_dev_err(hdev, "Execution of wmt command interrupted"); ++ clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); + return err; + } + + if (err) { + bt_dev_err(hdev, "Execution of wmt command timed out"); ++ clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); + return -ETIMEDOUT; + } + diff --git a/queue-5.0/clk-qcom-add-missing-freq-for-usb30_master_clk-on-8998.patch b/queue-5.0/clk-qcom-add-missing-freq-for-usb30_master_clk-on-8998.patch new file mode 100644 index 00000000000..055996f1489 --- /dev/null +++ b/queue-5.0/clk-qcom-add-missing-freq-for-usb30_master_clk-on-8998.patch @@ -0,0 +1,31 @@ +From 0c8ff62504e3a667387e87889a259632c3199a86 Mon Sep 17 00:00:00 2001 +From: Jeffrey Hugo +Date: Fri, 4 Jan 2019 09:49:46 -0700 +Subject: clk: qcom: Add missing freq for usb30_master_clk on 8998 + +From: Jeffrey Hugo + +commit 0c8ff62504e3a667387e87889a259632c3199a86 upstream. + +The usb30_master_clk supports a 60Mhz frequency, but that is missing from +the table of supported frequencies. Add it. + +Fixes: b5f5f525c547 (clk: qcom: Add MSM8998 Global Clock Control (GCC) driver) +Signed-off-by: Jeffrey Hugo +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/gcc-msm8998.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/clk/qcom/gcc-msm8998.c ++++ b/drivers/clk/qcom/gcc-msm8998.c +@@ -1112,6 +1112,7 @@ static struct clk_rcg2 ufs_axi_clk_src = + + static const struct freq_tbl ftbl_usb30_master_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ F(60000000, P_GPLL0_OUT_MAIN, 10, 0, 0), + F(120000000, P_GPLL0_OUT_MAIN, 5, 0, 0), + F(150000000, P_GPLL0_OUT_MAIN, 4, 0, 0), + { } diff --git a/queue-5.0/scsi-hisi_sas-fix-to-only-call-scsi_get_prot_op-for-non-null-scsi_cmnd.patch b/queue-5.0/scsi-hisi_sas-fix-to-only-call-scsi_get_prot_op-for-non-null-scsi_cmnd.patch new file mode 100644 index 00000000000..ed0f8fb60b1 --- /dev/null +++ b/queue-5.0/scsi-hisi_sas-fix-to-only-call-scsi_get_prot_op-for-non-null-scsi_cmnd.patch @@ -0,0 +1,43 @@ +From e1ba0b0b44512c5a209526c09ea3eb7d256b6951 Mon Sep 17 00:00:00 2001 +From: John Garry +Date: Fri, 25 Jan 2019 22:22:38 +0800 +Subject: scsi: hisi_sas: Fix to only call scsi_get_prot_op() for non-NULL scsi_cmnd + +From: John Garry + +commit e1ba0b0b44512c5a209526c09ea3eb7d256b6951 upstream. + +A NULL-pointer dereference was introduced for TMF SSP commands from the +upstreaming reworking. + +Fix this by relocating the scsi_get_prot_op() callsite. + +Fixes: d6a9000b81be ("scsi: hisi_sas: Add support for DIF feature for v2 hw") +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -1033,8 +1033,8 @@ static void prep_ssp_v3_hw(struct hisi_h + struct sas_ssp_task *ssp_task = &task->ssp_task; + struct scsi_cmnd *scsi_cmnd = ssp_task->cmd; + struct hisi_sas_tmf_task *tmf = slot->tmf; +- unsigned char prot_op = scsi_get_prot_op(scsi_cmnd); + int has_data = 0, priority = !!tmf; ++ unsigned char prot_op; + u8 *buf_cmd; + u32 dw1 = 0, dw2 = 0, len = 0; + +@@ -1049,6 +1049,7 @@ static void prep_ssp_v3_hw(struct hisi_h + dw1 |= 2 << CMD_HDR_FRAME_TYPE_OFF; + dw1 |= DIR_NO_DATA << CMD_HDR_DIR_OFF; + } else { ++ prot_op = scsi_get_prot_op(scsi_cmnd); + dw1 |= 1 << CMD_HDR_FRAME_TYPE_OFF; + switch (scsi_cmnd->sc_data_direction) { + case DMA_TO_DEVICE: diff --git a/queue-5.0/scsi-rdma-srpt-fix-a-credit-leak-for-aborted-commands.patch b/queue-5.0/scsi-rdma-srpt-fix-a-credit-leak-for-aborted-commands.patch new file mode 100644 index 00000000000..aee546155dd --- /dev/null +++ b/queue-5.0/scsi-rdma-srpt-fix-a-credit-leak-for-aborted-commands.patch @@ -0,0 +1,49 @@ +From 40ca8757291ca7a8775498112d320205b2a2e571 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Fri, 25 Jan 2019 10:34:51 -0800 +Subject: scsi: RDMA/srpt: Fix a credit leak for aborted commands + +From: Bart Van Assche + +commit 40ca8757291ca7a8775498112d320205b2a2e571 upstream. + +Make sure that the next time a response is sent to the initiator that the +credit it had allocated for the aborted request gets freed. + +Cc: Doug Ledford +Cc: Jason Gunthorpe +Cc: Nicholas Bellinger +Cc: Mike Christie +Cc: Hannes Reinecke +Cc: Christoph Hellwig +Fixes: 131e6abc674e ("target: Add TFO->abort_task for aborted task resources release") # v3.15 +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2887,8 +2887,19 @@ static void srpt_queue_tm_rsp(struct se_ + srpt_queue_response(cmd); + } + ++/* ++ * This function is called for aborted commands if no response is sent to the ++ * initiator. Make sure that the credits freed by aborting a command are ++ * returned to the initiator the next time a response is sent by incrementing ++ * ch->req_lim_delta. ++ */ + static void srpt_aborted_task(struct se_cmd *cmd) + { ++ struct srpt_send_ioctx *ioctx = container_of(cmd, ++ struct srpt_send_ioctx, cmd); ++ struct srpt_rdma_ch *ch = ioctx->ch; ++ ++ atomic_inc(&ch->req_lim_delta); + } + + static int srpt_queue_status(struct se_cmd *cmd) diff --git a/queue-5.0/series b/queue-5.0/series index afe3f6f75b5..d117baf4493 100644 --- a/queue-5.0/series +++ b/queue-5.0/series @@ -81,3 +81,13 @@ fs-stream_open-opener-for-stream-like-files-so-that-.patch arm-orion-don-t-use-using-64-bit-dma-masks.patch arm-iop-don-t-use-using-64-bit-dma-masks.patch perf-x86-amd-update-generic-hardware-cache-events-for-family-17h.patch +bluetooth-btusb-request-wake-pin-with-noautoen.patch +bluetooth-mediatek-fix-up-an-error-path-to-restore-bdev-tx_state.patch +clk-qcom-add-missing-freq-for-usb30_master_clk-on-8998.patch +usb-dwc3-reset-num_trbs-after-skipping.patch +staging-iio-adt7316-allow-adt751x-to-use-internal-vref-for-all-dacs.patch +staging-iio-adt7316-fix-the-dac-read-calculation.patch +staging-iio-adt7316-fix-handling-of-dac-high-resolution-option.patch +staging-iio-adt7316-fix-the-dac-write-calculation.patch +scsi-hisi_sas-fix-to-only-call-scsi_get_prot_op-for-non-null-scsi_cmnd.patch +scsi-rdma-srpt-fix-a-credit-leak-for-aborted-commands.patch diff --git a/queue-5.0/staging-iio-adt7316-allow-adt751x-to-use-internal-vref-for-all-dacs.patch b/queue-5.0/staging-iio-adt7316-allow-adt751x-to-use-internal-vref-for-all-dacs.patch new file mode 100644 index 00000000000..b7e682f80d2 --- /dev/null +++ b/queue-5.0/staging-iio-adt7316-allow-adt751x-to-use-internal-vref-for-all-dacs.patch @@ -0,0 +1,34 @@ +From 10bfe7cc1739c22f0aa296b39e53f61e9e3f4d99 Mon Sep 17 00:00:00 2001 +From: Jeremy Fertic +Date: Tue, 11 Dec 2018 17:55:00 -0700 +Subject: staging: iio: adt7316: allow adt751x to use internal vref for all dacs + +From: Jeremy Fertic + +commit 10bfe7cc1739c22f0aa296b39e53f61e9e3f4d99 upstream. + +With adt7516/7/9, internal vref is available for dacs a and b, dacs c and +d, or all dacs. The driver doesn't currently support internal vref for all +dacs. Change the else if to an if so both bits are checked rather than +just one or the other. + +Signed-off-by: Jeremy Fertic +Fixes: 35f6b6b86ede ("staging: iio: new ADT7316/7/8 and ADT7516/7/9 driver") +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/addac/adt7316.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/iio/addac/adt7316.c ++++ b/drivers/staging/iio/addac/adt7316.c +@@ -1079,7 +1079,7 @@ static ssize_t adt7316_store_DAC_interna + ldac_config = chip->ldac_config & (~ADT7516_DAC_IN_VREF_MASK); + if (data & 0x1) + ldac_config |= ADT7516_DAC_AB_IN_VREF; +- else if (data & 0x2) ++ if (data & 0x2) + ldac_config |= ADT7516_DAC_CD_IN_VREF; + } else { + ret = kstrtou8(buf, 16, &data); diff --git a/queue-5.0/staging-iio-adt7316-fix-handling-of-dac-high-resolution-option.patch b/queue-5.0/staging-iio-adt7316-fix-handling-of-dac-high-resolution-option.patch new file mode 100644 index 00000000000..1c5466abd69 --- /dev/null +++ b/queue-5.0/staging-iio-adt7316-fix-handling-of-dac-high-resolution-option.patch @@ -0,0 +1,62 @@ +From 76b7fe8d6c4daf4db672eb953c892c6f6572a282 Mon Sep 17 00:00:00 2001 +From: Jeremy Fertic +Date: Sat, 22 Dec 2018 21:57:41 -0700 +Subject: staging: iio: adt7316: fix handling of dac high resolution option + +From: Jeremy Fertic + +commit 76b7fe8d6c4daf4db672eb953c892c6f6572a282 upstream. + +The adt7316/7 and adt7516/7 have the option to output voltage proportional +to temperature on dac a and/or dac b. The default dac resolution in this +mode is 8 bits with the dac high resolution option enabling 10 bits. None +of these settings affect dacs c and d. Remove the "1 (12 bits)" output from +the show function since that is not an option for this mode. Return +"1 (10 bits)" if the device is one of the above mentioned chips and the dac +high resolution mode is enabled. + +In the store function, the driver currently allows the user to write to the +ADT7316_DA_HIGH_RESOLUTION bit regardless of the device in use. Add a check +to return an error in the case of an adt7318 or adt7519. Remove the else +statement that clears the ADT7316_DA_HIGH_RESOLUTION bit. Instead, clear it +before conditionally enabling it, depending on user input. This matches the +typical pattern in the driver when an attribute is a boolean. + +Fixes: 35f6b6b86ede ("staging: iio: new ADT7316/7/8 and ADT7516/7/9 driver") +Signed-off-by: Jeremy Fertic +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/addac/adt7316.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/staging/iio/addac/adt7316.c ++++ b/drivers/staging/iio/addac/adt7316.c +@@ -634,9 +634,7 @@ static ssize_t adt7316_show_da_high_reso + struct adt7316_chip_info *chip = iio_priv(dev_info); + + if (chip->config3 & ADT7316_DA_HIGH_RESOLUTION) { +- if (chip->id == ID_ADT7316 || chip->id == ID_ADT7516) +- return sprintf(buf, "1 (12 bits)\n"); +- if (chip->id == ID_ADT7317 || chip->id == ID_ADT7517) ++ if (chip->id != ID_ADT7318 && chip->id != ID_ADT7519) + return sprintf(buf, "1 (10 bits)\n"); + } + +@@ -653,10 +651,12 @@ static ssize_t adt7316_store_da_high_res + u8 config3; + int ret; + ++ if (chip->id == ID_ADT7318 || chip->id == ID_ADT7519) ++ return -EPERM; ++ ++ config3 = chip->config3 & (~ADT7316_DA_HIGH_RESOLUTION); + if (buf[0] == '1') +- config3 = chip->config3 | ADT7316_DA_HIGH_RESOLUTION; +- else +- config3 = chip->config3 & (~ADT7316_DA_HIGH_RESOLUTION); ++ config3 |= ADT7316_DA_HIGH_RESOLUTION; + + ret = chip->bus.write(chip->bus.client, ADT7316_CONFIG3, config3); + if (ret) diff --git a/queue-5.0/staging-iio-adt7316-fix-the-dac-read-calculation.patch b/queue-5.0/staging-iio-adt7316-fix-the-dac-read-calculation.patch new file mode 100644 index 00000000000..86be7cf1256 --- /dev/null +++ b/queue-5.0/staging-iio-adt7316-fix-the-dac-read-calculation.patch @@ -0,0 +1,57 @@ +From 45130fb030aec26ac28b4bb23344901df3ec3b7f Mon Sep 17 00:00:00 2001 +From: Jeremy Fertic +Date: Sat, 22 Dec 2018 21:57:42 -0700 +Subject: staging: iio: adt7316: fix the dac read calculation + +From: Jeremy Fertic + +commit 45130fb030aec26ac28b4bb23344901df3ec3b7f upstream. + +The calculation of the current dac value is using the wrong bits of the +dac lsb register. Create two macros to shift the lsb register value into +lsb position, depending on whether the dac is 10 or 12 bit. Initialize +data to 0 so, with an 8 bit dac, the msb register value can be bitwise +ORed with data. + +Fixes: 35f6b6b86ede ("staging: iio: new ADT7316/7/8 and ADT7516/7/9 driver") +Signed-off-by: Jeremy Fertic +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/addac/adt7316.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/staging/iio/addac/adt7316.c ++++ b/drivers/staging/iio/addac/adt7316.c +@@ -47,6 +47,8 @@ + #define ADT7516_MSB_AIN3 0xA + #define ADT7516_MSB_AIN4 0xB + #define ADT7316_DA_DATA_BASE 0x10 ++#define ADT7316_DA_10_BIT_LSB_SHIFT 6 ++#define ADT7316_DA_12_BIT_LSB_SHIFT 4 + #define ADT7316_DA_MSB_DATA_REGS 4 + #define ADT7316_LSB_DAC_A 0x10 + #define ADT7316_MSB_DAC_A 0x11 +@@ -1403,7 +1405,7 @@ static IIO_DEVICE_ATTR(ex_analog_temp_of + static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, + int channel, char *buf) + { +- u16 data; ++ u16 data = 0; + u8 msb, lsb, offset; + int ret; + +@@ -1428,7 +1430,11 @@ static ssize_t adt7316_show_DAC(struct a + if (ret) + return -EIO; + +- data = (msb << offset) + (lsb & ((1 << offset) - 1)); ++ if (chip->dac_bits == 12) ++ data = lsb >> ADT7316_DA_12_BIT_LSB_SHIFT; ++ else if (chip->dac_bits == 10) ++ data = lsb >> ADT7316_DA_10_BIT_LSB_SHIFT; ++ data |= msb << offset; + + return sprintf(buf, "%d\n", data); + } diff --git a/queue-5.0/staging-iio-adt7316-fix-the-dac-write-calculation.patch b/queue-5.0/staging-iio-adt7316-fix-the-dac-write-calculation.patch new file mode 100644 index 00000000000..3de886c7c98 --- /dev/null +++ b/queue-5.0/staging-iio-adt7316-fix-the-dac-write-calculation.patch @@ -0,0 +1,54 @@ +From 78accaea117c1ae878774974fab91ac4a0b0e2b0 Mon Sep 17 00:00:00 2001 +From: Jeremy Fertic +Date: Sat, 22 Dec 2018 21:57:43 -0700 +Subject: staging: iio: adt7316: fix the dac write calculation + +From: Jeremy Fertic + +commit 78accaea117c1ae878774974fab91ac4a0b0e2b0 upstream. + +The lsb calculation is not masking the correct bits from the user input. +Subtract 1 from (1 << offset) to correctly set up the mask to be applied +to user input. + +The lsb register stores its value starting at the bit 7 position. +adt7316_store_DAC() currently assumes the value is at the other end of the +register. Shift the lsb value before storing it in a new variable lsb_reg, +and write this variable to the lsb register. + +Fixes: 35f6b6b86ede ("staging: iio: new ADT7316/7/8 and ADT7516/7/9 driver") +Signed-off-by: Jeremy Fertic +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/addac/adt7316.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/staging/iio/addac/adt7316.c ++++ b/drivers/staging/iio/addac/adt7316.c +@@ -1442,7 +1442,7 @@ static ssize_t adt7316_show_DAC(struct a + static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip, + int channel, const char *buf, size_t len) + { +- u8 msb, lsb, offset; ++ u8 msb, lsb, lsb_reg, offset; + u16 data; + int ret; + +@@ -1460,9 +1460,13 @@ static ssize_t adt7316_store_DAC(struct + return -EINVAL; + + if (chip->dac_bits > 8) { +- lsb = data & (1 << offset); ++ lsb = data & ((1 << offset) - 1); ++ if (chip->dac_bits == 12) ++ lsb_reg = lsb << ADT7316_DA_12_BIT_LSB_SHIFT; ++ else ++ lsb_reg = lsb << ADT7316_DA_10_BIT_LSB_SHIFT; + ret = chip->bus.write(chip->bus.client, +- ADT7316_DA_DATA_BASE + channel * 2, lsb); ++ ADT7316_DA_DATA_BASE + channel * 2, lsb_reg); + if (ret) + return -EIO; + } diff --git a/queue-5.0/usb-dwc3-reset-num_trbs-after-skipping.patch b/queue-5.0/usb-dwc3-reset-num_trbs-after-skipping.patch new file mode 100644 index 00000000000..bff2391b264 --- /dev/null +++ b/queue-5.0/usb-dwc3-reset-num_trbs-after-skipping.patch @@ -0,0 +1,35 @@ +From c7152763f02e05567da27462b2277a554e507c89 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 12 Feb 2019 19:39:27 -0800 +Subject: usb: dwc3: Reset num_trbs after skipping + +From: Thinh Nguyen + +commit c7152763f02e05567da27462b2277a554e507c89 upstream. + +Currently req->num_trbs is not reset after the TRBs are skipped and +processed from the cancelled list. The gadget driver may reuse the +request with an invalid req->num_trbs, and DWC3 will incorrectly skip +trbs. To fix this, simply reset req->num_trbs to 0 after skipping +through all of them. + +Fixes: c3acd5901414 ("usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue()") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1506,6 +1506,8 @@ static void dwc3_gadget_ep_skip_trbs(str + trb->ctrl &= ~DWC3_TRB_CTRL_HWO; + dwc3_ep_inc_deq(dep); + } ++ ++ req->num_trbs = 0; + } + + static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep)