From: Greg Kroah-Hartman Date: Mon, 19 Mar 2018 17:10:32 +0000 (+0100) Subject: 4.15-stable patches X-Git-Tag: v4.15.12~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ab5879425285a292559c9110fe5838218d11ba44;p=thirdparty%2Fkernel%2Fstable-queue.git 4.15-stable patches added patches: dt-bindings-usb-fix-the-stm32f7-dwc2-otg-hs-core-binding.patch phy-phy-brcm-usb-fix-two-dt-properties-to-match-bindings-doc.patch phy-phy-brcm-usb-init-drd-mode-can-cause-crash-on-startup.patch phy-phy-brcm-usb-init-power-down-usb-3.0-phy-when-xhci-disabled.patch phy-phy-brcm-usb-init-some-low-speed-keyboards-fail-on-7271.patch scsi-qla2xxx-fix-crashes-in-qla2x00_probe_one-on-probe-failure.patch scsi-qla2xxx-fix-logo-flag-for-qlt_free_session_done.patch scsi-qla2xxx-fix-null-pointer-access-for-fcport-structure.patch scsi-qla2xxx-fix-smatch-warning-in-qla25xx_delete_-rsp-req-_que.patch usb-dwc2-fix-stm32f7-usb-otg-hs-compatible.patch usb-dwc3-core-power-off-core-phys-on-system_suspend-in-host-mode.patch usb-dwc3-fix-gdbgfifospace_type-values.patch usb-dwc3-of-simple-fix-oops-by-unbalanced-clk-disable-call.patch usb-gadget-udc-add-missing-platform_device_put-on-error-in-bdc_pci_probe.patch usb-gadget-udc-renesas_usb3-fix-oops-in-renesas_usb3_remove.patch --- diff --git a/queue-4.15/dt-bindings-usb-fix-the-stm32f7-dwc2-otg-hs-core-binding.patch b/queue-4.15/dt-bindings-usb-fix-the-stm32f7-dwc2-otg-hs-core-binding.patch new file mode 100644 index 00000000000..85ee03001a9 --- /dev/null +++ b/queue-4.15/dt-bindings-usb-fix-the-stm32f7-dwc2-otg-hs-core-binding.patch @@ -0,0 +1,36 @@ +From 4c437920fa216f66f6a5d469cae2a0360cc2d9c7 Mon Sep 17 00:00:00 2001 +From: Amelie Delaunay +Date: Thu, 1 Mar 2018 11:05:34 +0100 +Subject: dt-bindings: usb: fix the STM32F7 DWC2 OTG HS core binding + +From: Amelie Delaunay + +commit 4c437920fa216f66f6a5d469cae2a0360cc2d9c7 upstream. + +This patch fixes binding documentation for DWC2 controller in HS mode +found on STMicroelectronics STM32F7 SoC. +The v2 former patch [1] had been acked by Rob Herring, but v1 was merged. + +[1] https://patchwork.kernel.org/patch/9925575/ + +Fixes: 000777dadc7e ("dt-bindings: usb: Document the STM32F7xx DWC2 ...") +Signed-off-by: Amelie Delaunay +Reviewed-by: Rob Herring +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/usb/dwc2.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/usb/dwc2.txt ++++ b/Documentation/devicetree/bindings/usb/dwc2.txt +@@ -19,7 +19,7 @@ Required properties: + configured in FS mode; + - "st,stm32f4x9-hsotg": The DWC2 USB HS controller instance in STM32F4x9 SoCs + configured in HS mode; +- - "st,stm32f7xx-hsotg": The DWC2 USB HS controller instance in STM32F7xx SoCs ++ - "st,stm32f7-hsotg": The DWC2 USB HS controller instance in STM32F7 SoCs + configured in HS mode; + - reg : Should contain 1 register range (address and length) + - interrupts : Should contain 1 interrupt diff --git a/queue-4.15/phy-phy-brcm-usb-fix-two-dt-properties-to-match-bindings-doc.patch b/queue-4.15/phy-phy-brcm-usb-fix-two-dt-properties-to-match-bindings-doc.patch new file mode 100644 index 00000000000..dbc1629d141 --- /dev/null +++ b/queue-4.15/phy-phy-brcm-usb-fix-two-dt-properties-to-match-bindings-doc.patch @@ -0,0 +1,37 @@ +From 5e498ff117c19fd80181b5bb09ecb024b552ece8 Mon Sep 17 00:00:00 2001 +From: Al Cooper +Date: Wed, 27 Dec 2017 14:28:48 -0500 +Subject: phy: phy-brcm-usb: Fix two DT properties to match bindings doc + +From: Al Cooper + +commit 5e498ff117c19fd80181b5bb09ecb024b552ece8 upstream. + +Change "brcm,has_xhci" and "brcm,has_eohci" device tree properties +to the preferred "brcm,has-xhci" and "brcm,has-eohci". This also +matches the existing device tree bindings document. + +Fixes: 49859e55e364 ("phy: usb: phy-brcm-usb: Add Broadcom STB USB phy driver") +Signed-off-by: Al Cooper +Acked-by: Florian Fainelli +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/broadcom/phy-brcm-usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/phy/broadcom/phy-brcm-usb.c ++++ b/drivers/phy/broadcom/phy-brcm-usb.c +@@ -338,9 +338,9 @@ static int brcm_usb_phy_probe(struct pla + ARRAY_SIZE(brcm_dr_mode_to_name), + mode, &priv->ini.mode); + } +- if (of_property_read_bool(dn, "brcm,has_xhci")) ++ if (of_property_read_bool(dn, "brcm,has-xhci")) + priv->has_xhci = true; +- if (of_property_read_bool(dn, "brcm,has_eohci")) ++ if (of_property_read_bool(dn, "brcm,has-eohci")) + priv->has_eohci = true; + + err = brcm_usb_phy_dvr_init(dev, priv, dn); diff --git a/queue-4.15/phy-phy-brcm-usb-init-drd-mode-can-cause-crash-on-startup.patch b/queue-4.15/phy-phy-brcm-usb-init-drd-mode-can-cause-crash-on-startup.patch new file mode 100644 index 00000000000..ee205fe62af --- /dev/null +++ b/queue-4.15/phy-phy-brcm-usb-init-drd-mode-can-cause-crash-on-startup.patch @@ -0,0 +1,45 @@ +From 0aa0c12262fd848c48448c39ff6c1c097be00dd4 Mon Sep 17 00:00:00 2001 +From: Al Cooper +Date: Wed, 27 Dec 2017 14:28:51 -0500 +Subject: phy: phy-brcm-usb-init: DRD mode can cause crash on startup + +From: Al Cooper + +commit 0aa0c12262fd848c48448c39ff6c1c097be00dd4 upstream. + +This is caused by a bug in the BDC core. When the BDC core comes +out of reset and it's not selected, it gets a backup clock. When +the BDC core is selected, it get's the main clock. If HOST mode +is then selected the BDC core has the main clock shut off but +the backup clock is not restored. + +The failure scenario and cause are as follows: +- DRD mode is active +- Device mode is selected first in bootloader +- When host mode is now selected, the clock to the BDC is cut off. +- BDC registers are inaccessible and therefore the BDC driver + crashes upon Linux boot. + +The fix is to have the phy driver always force a BDC reset on +startup. + +Fixes: 49859e55e364 ("phy: usb: phy-brcm-usb: Add Broadcom STB USB phy driver") +Signed-off-by: Al Cooper +Acked-by: Florian Fainelli +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/broadcom/phy-brcm-usb-init.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/phy/broadcom/phy-brcm-usb-init.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init.c +@@ -917,6 +917,7 @@ void brcm_usb_init_common(struct brcm_us + USB_CTRL_UNSET_FAMILY(params, USB_PM, BDC_SOFT_RESETB); + break; + default: ++ USB_CTRL_UNSET_FAMILY(params, USB_PM, BDC_SOFT_RESETB); + USB_CTRL_SET_FAMILY(params, USB_PM, BDC_SOFT_RESETB); + break; + } diff --git a/queue-4.15/phy-phy-brcm-usb-init-power-down-usb-3.0-phy-when-xhci-disabled.patch b/queue-4.15/phy-phy-brcm-usb-init-power-down-usb-3.0-phy-when-xhci-disabled.patch new file mode 100644 index 00000000000..ae11cfdd14c --- /dev/null +++ b/queue-4.15/phy-phy-brcm-usb-init-power-down-usb-3.0-phy-when-xhci-disabled.patch @@ -0,0 +1,40 @@ +From cd6f769fdea7ff7d77a6cc97658c60ca0b836d0e Mon Sep 17 00:00:00 2001 +From: Al Cooper +Date: Wed, 27 Dec 2017 14:28:50 -0500 +Subject: phy: phy-brcm-usb-init: Power down USB 3.0 PHY when XHCI disabled + +From: Al Cooper + +commit cd6f769fdea7ff7d77a6cc97658c60ca0b836d0e upstream. + +Set PHY3_IDDQ_OVERRIDE in the xhci uninit routine. This will save +additional power when the XHCI driver is not enabled. + +Fixes: 49859e55e364 ("phy: usb: phy-brcm-usb: Add Broadcom STB USB phy driver") +Signed-off-by: Al Cooper +Acked-by: Florian Fainelli +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/broadcom/phy-brcm-usb-init.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/phy/broadcom/phy-brcm-usb-init.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init.c +@@ -73,6 +73,7 @@ + #define USB_CTRL_USB30_CTL1_USB3_IPP_MASK 0x20000000 /* option */ + #define USB_CTRL_USB30_PCTL 0x70 + #define USB_CTRL_USB30_PCTL_PHY3_SOFT_RESETB_MASK 0x00000002 ++#define USB_CTRL_USB30_PCTL_PHY3_IDDQ_OVERRIDE_MASK 0x00008000 + #define USB_CTRL_USB30_PCTL_PHY3_SOFT_RESETB_P1_MASK 0x00020000 + #define USB_CTRL_USB_DEVICE_CTL1 0x90 + #define USB_CTRL_USB_DEVICE_CTL1_PORT_MODE_MASK 0x00000003 /* option */ +@@ -999,6 +1000,7 @@ void brcm_usb_uninit_eohci(struct brcm_u + void brcm_usb_uninit_xhci(struct brcm_usb_init_params *params) + { + brcmusb_xhci_soft_reset(params, 1); ++ USB_CTRL_SET(params->ctrl_regs, USB30_PCTL, PHY3_IDDQ_OVERRIDE); + } + + void brcm_usb_set_family_map(struct brcm_usb_init_params *params) diff --git a/queue-4.15/phy-phy-brcm-usb-init-some-low-speed-keyboards-fail-on-7271.patch b/queue-4.15/phy-phy-brcm-usb-init-some-low-speed-keyboards-fail-on-7271.patch new file mode 100644 index 00000000000..1e3b6dc1ae0 --- /dev/null +++ b/queue-4.15/phy-phy-brcm-usb-init-some-low-speed-keyboards-fail-on-7271.patch @@ -0,0 +1,145 @@ +From 279a0cd0e02aa1e506d9acf94a7ecb530821359c Mon Sep 17 00:00:00 2001 +From: Al Cooper +Date: Wed, 27 Dec 2017 14:28:49 -0500 +Subject: phy: phy-brcm-usb-init: Some Low Speed keyboards fail on 7271 + +From: Al Cooper + +commit 279a0cd0e02aa1e506d9acf94a7ecb530821359c upstream. + +Enable the the Low Speed Keep Alive signal on the 7271b0 by setting +the LS_KEEP_ALIVE bit in the USB CTRL OBRIDGE register otherwise +some Dell Low Speed keyboards fail. + +Also do a little cleanup of the EBRIDGE ESTOP_SCB_REQ bit. Since +this is only used on one platform, remove it from the platform +tables and just use "if (family == "). + +Fixes: 49859e55e364 ("phy: usb: phy-brcm-usb: Add Broadcom STB USB phy driver") +Signed-off-by: Al Cooper +Acked-by: Florian Fainelli +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/broadcom/phy-brcm-usb-init.c | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +--- a/drivers/phy/broadcom/phy-brcm-usb-init.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init.c +@@ -50,6 +50,8 @@ + #define USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK 0x80000000 /* option */ + #define USB_CTRL_EBRIDGE 0x0c + #define USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK 0x00020000 /* option */ ++#define USB_CTRL_OBRIDGE 0x10 ++#define USB_CTRL_OBRIDGE_LS_KEEP_ALIVE_MASK 0x08000000 + #define USB_CTRL_MDIO 0x14 + #define USB_CTRL_MDIO2 0x18 + #define USB_CTRL_UTMI_CTL_1 0x2c +@@ -116,7 +118,6 @@ enum { + USB_CTRL_SETUP_STRAP_IPP_SEL_SELECTOR, + USB_CTRL_SETUP_OC3_DISABLE_SELECTOR, + USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_SELECTOR, +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_SELECTOR, + USB_CTRL_USB_PM_BDC_SOFT_RESETB_SELECTOR, + USB_CTRL_USB_PM_XHC_SOFT_RESETB_SELECTOR, + USB_CTRL_USB_PM_USB_PWRDN_SELECTOR, +@@ -203,7 +204,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + USB_CTRL_SETUP_STRAP_IPP_SEL_MASK, + USB_CTRL_SETUP_OC3_DISABLE_MASK, + 0, /* USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK */ +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK, + 0, /* USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK */ + USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_USB_PWRDN_MASK, +@@ -225,7 +225,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + 0, /* USB_CTRL_SETUP_STRAP_IPP_SEL_MASK */ + USB_CTRL_SETUP_OC3_DISABLE_MASK, + USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK, +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK, + 0, /* USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK */ + USB_CTRL_USB_PM_XHC_SOFT_RESETB_VAR_MASK, + 0, /* USB_CTRL_USB_PM_USB_PWRDN_MASK */ +@@ -247,7 +246,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + USB_CTRL_SETUP_STRAP_IPP_SEL_MASK, + USB_CTRL_SETUP_OC3_DISABLE_MASK, + 0, /* USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK */ +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK, + USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_USB_PWRDN_MASK, +@@ -269,7 +267,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + 0, /* USB_CTRL_SETUP_STRAP_IPP_SEL_MASK */ + USB_CTRL_SETUP_OC3_DISABLE_MASK, + USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK, +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK, + 0, /* USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK */ + USB_CTRL_USB_PM_XHC_SOFT_RESETB_VAR_MASK, + 0, /* USB_CTRL_USB_PM_USB_PWRDN_MASK */ +@@ -291,7 +288,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + 0, /* USB_CTRL_SETUP_STRAP_IPP_SEL_MASK */ + USB_CTRL_SETUP_OC3_DISABLE_MASK, + 0, /* USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK */ +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK, + 0, /* USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK */ + USB_CTRL_USB_PM_XHC_SOFT_RESETB_VAR_MASK, + USB_CTRL_USB_PM_USB_PWRDN_MASK, +@@ -313,7 +309,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + 0, /* USB_CTRL_SETUP_STRAP_IPP_SEL_MASK */ + 0, /* USB_CTRL_SETUP_OC3_DISABLE_MASK */ + USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK, +- 0, /* USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK */ + 0, /* USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK */ + 0, /* USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK */ + 0, /* USB_CTRL_USB_PM_USB_PWRDN_MASK */ +@@ -335,7 +330,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + USB_CTRL_SETUP_STRAP_IPP_SEL_MASK, + USB_CTRL_SETUP_OC3_DISABLE_MASK, + 0, /* USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK */ +- 0, /* USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK */ + USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_USB_PWRDN_MASK, +@@ -357,7 +351,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + 0, /* USB_CTRL_SETUP_STRAP_IPP_SEL_MASK */ + USB_CTRL_SETUP_OC3_DISABLE_MASK, + USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK, +- 0, /* USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK */ + 0, /* USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK */ + 0, /* USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK */ + 0, /* USB_CTRL_USB_PM_USB_PWRDN_MASK */ +@@ -379,7 +372,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + USB_CTRL_SETUP_STRAP_IPP_SEL_MASK, + USB_CTRL_SETUP_OC3_DISABLE_MASK, + 0, /* USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK */ +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK, + USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_USB_PWRDN_MASK, +@@ -401,7 +393,6 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT + USB_CTRL_SETUP_STRAP_IPP_SEL_MASK, + USB_CTRL_SETUP_OC3_DISABLE_MASK, + 0, /* USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK */ +- USB_CTRL_EBRIDGE_ESTOP_SCB_REQ_MASK, + USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK, + USB_CTRL_USB_PM_USB_PWRDN_MASK, +@@ -952,13 +943,17 @@ void brcm_usb_init_eohci(struct brcm_usb + * Don't enable this so the memory controller doesn't read + * into memory holes. NOTE: This bit is low true on 7366C0. + */ +- USB_CTRL_SET_FAMILY(params, EBRIDGE, ESTOP_SCB_REQ); ++ USB_CTRL_SET(ctrl, EBRIDGE, ESTOP_SCB_REQ); + + /* Setup the endian bits */ + reg = brcmusb_readl(USB_CTRL_REG(ctrl, SETUP)); + reg &= ~USB_CTRL_SETUP_ENDIAN_BITS; + reg |= USB_CTRL_MASK_FAMILY(params, SETUP, ENDIAN); + brcmusb_writel(reg, USB_CTRL_REG(ctrl, SETUP)); ++ ++ if (params->selected_family == BRCM_FAMILY_7271A0) ++ /* Enable LS keep alive fix for certain keyboards */ ++ USB_CTRL_SET(ctrl, OBRIDGE, LS_KEEP_ALIVE); + } + + void brcm_usb_init_xhci(struct brcm_usb_init_params *params) diff --git a/queue-4.15/scsi-qla2xxx-fix-crashes-in-qla2x00_probe_one-on-probe-failure.patch b/queue-4.15/scsi-qla2xxx-fix-crashes-in-qla2x00_probe_one-on-probe-failure.patch new file mode 100644 index 00000000000..6d4a5f22abf --- /dev/null +++ b/queue-4.15/scsi-qla2xxx-fix-crashes-in-qla2x00_probe_one-on-probe-failure.patch @@ -0,0 +1,163 @@ +From 6a2cf8d3663e13e19af636c2a8d92e766261dc45 Mon Sep 17 00:00:00 2001 +From: Bill Kuzeja +Date: Mon, 5 Mar 2018 00:02:55 -0500 +Subject: scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure + +From: Bill Kuzeja + +commit 6a2cf8d3663e13e19af636c2a8d92e766261dc45 upstream. + +Because of the shifting around of code in qla2x00_probe_one recently, +failures during adapter initialization can lead to problems, i.e. NULL +pointer crashes and doubly freed data structures which cause eventual +panics. + +This V2 version makes the relevant memory free routines idempotent, so +repeat calls won't cause any harm. I also removed the problematic +probe_init_failed exit point as it is not needed. + +Fixes: d64d6c5671db ("scsi: qla2xxx: Fix NULL pointer crash due to probe failure") +Signed-off-by: Bill Kuzeja +Acked-by: Himanshu Madhani +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_os.c | 59 ++++++++++++++++++++++++++---------------- + 1 file changed, 37 insertions(+), 22 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -449,7 +449,7 @@ static int qla2x00_alloc_queues(struct q + ha->req_q_map[0] = req; + set_bit(0, ha->rsp_qid_map); + set_bit(0, ha->req_qid_map); +- return 1; ++ return 0; + + fail_qpair_map: + kfree(ha->base_qpair); +@@ -466,6 +466,9 @@ fail_req_map: + + static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req) + { ++ if (!ha->req_q_map) ++ return; ++ + if (IS_QLAFX00(ha)) { + if (req && req->ring_fx00) + dma_free_coherent(&ha->pdev->dev, +@@ -476,14 +479,17 @@ static void qla2x00_free_req_que(struct + (req->length + 1) * sizeof(request_t), + req->ring, req->dma); + +- if (req) ++ if (req) { + kfree(req->outstanding_cmds); +- +- kfree(req); ++ kfree(req); ++ } + } + + static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp) + { ++ if (!ha->rsp_q_map) ++ return; ++ + if (IS_QLAFX00(ha)) { + if (rsp && rsp->ring) + dma_free_coherent(&ha->pdev->dev, +@@ -494,7 +500,8 @@ static void qla2x00_free_rsp_que(struct + (rsp->length + 1) * sizeof(response_t), + rsp->ring, rsp->dma); + } +- kfree(rsp); ++ if (rsp) ++ kfree(rsp); + } + + static void qla2x00_free_queues(struct qla_hw_data *ha) +@@ -1717,6 +1724,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t * + struct qla_tgt_cmd *cmd; + uint8_t trace = 0; + ++ if (!ha->req_q_map) ++ return; + spin_lock_irqsave(&ha->hardware_lock, flags); + for (que = 0; que < ha->max_req_queues; que++) { + req = ha->req_q_map[que]; +@@ -3071,14 +3080,14 @@ qla2x00_probe_one(struct pci_dev *pdev, + /* Set up the irqs */ + ret = qla2x00_request_irqs(ha, rsp); + if (ret) +- goto probe_hw_failed; ++ goto probe_failed; + + /* Alloc arrays of request and response ring ptrs */ +- if (!qla2x00_alloc_queues(ha, req, rsp)) { ++ if (qla2x00_alloc_queues(ha, req, rsp)) { + ql_log(ql_log_fatal, base_vha, 0x003d, + "Failed to allocate memory for queue pointers..." + "aborting.\n"); +- goto probe_init_failed; ++ goto probe_failed; + } + + if (ha->mqenable && shost_use_blk_mq(host)) { +@@ -3363,15 +3372,6 @@ skip_dpc: + + return 0; + +-probe_init_failed: +- qla2x00_free_req_que(ha, req); +- ha->req_q_map[0] = NULL; +- clear_bit(0, ha->req_qid_map); +- qla2x00_free_rsp_que(ha, rsp); +- ha->rsp_q_map[0] = NULL; +- clear_bit(0, ha->rsp_qid_map); +- ha->max_req_queues = ha->max_rsp_queues = 0; +- + probe_failed: + if (base_vha->timer_active) + qla2x00_stop_timer(base_vha); +@@ -4451,11 +4451,17 @@ qla2x00_mem_free(struct qla_hw_data *ha) + if (ha->init_cb) + dma_free_coherent(&ha->pdev->dev, ha->init_cb_size, + ha->init_cb, ha->init_cb_dma); +- vfree(ha->optrom_buffer); +- kfree(ha->nvram); +- kfree(ha->npiv_info); +- kfree(ha->swl); +- kfree(ha->loop_id_map); ++ ++ if (ha->optrom_buffer) ++ vfree(ha->optrom_buffer); ++ if (ha->nvram) ++ kfree(ha->nvram); ++ if (ha->npiv_info) ++ kfree(ha->npiv_info); ++ if (ha->swl) ++ kfree(ha->swl); ++ if (ha->loop_id_map) ++ kfree(ha->loop_id_map); + + ha->srb_mempool = NULL; + ha->ctx_mempool = NULL; +@@ -4471,6 +4477,15 @@ qla2x00_mem_free(struct qla_hw_data *ha) + ha->ex_init_cb_dma = 0; + ha->async_pd = NULL; + ha->async_pd_dma = 0; ++ ha->loop_id_map = NULL; ++ ha->npiv_info = NULL; ++ ha->optrom_buffer = NULL; ++ ha->swl = NULL; ++ ha->nvram = NULL; ++ ha->mctp_dump = NULL; ++ ha->dcbx_tlv = NULL; ++ ha->xgmac_data = NULL; ++ ha->sfp_data = NULL; + + ha->s_dma_pool = NULL; + ha->dl_dma_pool = NULL; diff --git a/queue-4.15/scsi-qla2xxx-fix-logo-flag-for-qlt_free_session_done.patch b/queue-4.15/scsi-qla2xxx-fix-logo-flag-for-qlt_free_session_done.patch new file mode 100644 index 00000000000..8498cd4328d --- /dev/null +++ b/queue-4.15/scsi-qla2xxx-fix-logo-flag-for-qlt_free_session_done.patch @@ -0,0 +1,37 @@ +From a2390348c19d0819d525d375414a7cfdacb51a68 Mon Sep 17 00:00:00 2001 +From: Himanshu Madhani +Date: Mon, 22 Jan 2018 12:04:20 -0800 +Subject: scsi: qla2xxx: Fix logo flag for qlt_free_session_done() + +From: Himanshu Madhani + +commit a2390348c19d0819d525d375414a7cfdacb51a68 upstream. + +Commit 3515832cc614 ("scsi: qla2xxx: Reset the logo flag, after target +re-login.")fixed the target re-login after session relogin is complete, +but missed out the qlt_free_session_done() path. + +This patch clears send_els_logo flag in qlt_free_session_done() +callback. + +[mkp: checkpatch] + +Fixes: 3515832cc614 ("scsi: qla2xxx: Reset the logo flag, after target re-login.") +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_target.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -982,6 +982,7 @@ static void qlt_free_session_done(struct + + logo.id = sess->d_id; + logo.cmd_count = 0; ++ sess->send_els_logo = 0; + qlt_send_first_logo(vha, &logo); + } + diff --git a/queue-4.15/scsi-qla2xxx-fix-null-pointer-access-for-fcport-structure.patch b/queue-4.15/scsi-qla2xxx-fix-null-pointer-access-for-fcport-structure.patch new file mode 100644 index 00000000000..5f28e1f20c7 --- /dev/null +++ b/queue-4.15/scsi-qla2xxx-fix-null-pointer-access-for-fcport-structure.patch @@ -0,0 +1,46 @@ +From 5c25d451163cab9be80744cbc5448d6b95ab8d1a Mon Sep 17 00:00:00 2001 +From: Quinn Tran +Date: Thu, 28 Dec 2017 12:33:09 -0800 +Subject: scsi: qla2xxx: Fix NULL pointer access for fcport structure + +From: Quinn Tran + +commit 5c25d451163cab9be80744cbc5448d6b95ab8d1a upstream. + +when processing iocb in a timeout case, driver was trying to log messages +without verifying if the fcport structure could have valid data. This +results in a NULL pointer access. + +Fixes: 726b85487067("qla2xxx: Add framework for async fabric discovery") +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_init.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -102,11 +102,16 @@ qla2x00_async_iocb_timeout(void *data) + struct srb_iocb *lio = &sp->u.iocb_cmd; + struct event_arg ea; + +- ql_dbg(ql_dbg_disc, fcport->vha, 0x2071, +- "Async-%s timeout - hdl=%x portid=%06x %8phC.\n", +- sp->name, sp->handle, fcport->d_id.b24, fcport->port_name); ++ if (fcport) { ++ ql_dbg(ql_dbg_disc, fcport->vha, 0x2071, ++ "Async-%s timeout - hdl=%x portid=%06x %8phC.\n", ++ sp->name, sp->handle, fcport->d_id.b24, fcport->port_name); + +- fcport->flags &= ~FCF_ASYNC_SENT; ++ fcport->flags &= ~FCF_ASYNC_SENT; ++ } else { ++ pr_info("Async-%s timeout - hdl=%x.\n", ++ sp->name, sp->handle); ++ } + + switch (sp->type) { + case SRB_LOGIN_CMD: diff --git a/queue-4.15/scsi-qla2xxx-fix-smatch-warning-in-qla25xx_delete_-rsp-req-_que.patch b/queue-4.15/scsi-qla2xxx-fix-smatch-warning-in-qla25xx_delete_-rsp-req-_que.patch new file mode 100644 index 00000000000..e72b116a55b --- /dev/null +++ b/queue-4.15/scsi-qla2xxx-fix-smatch-warning-in-qla25xx_delete_-rsp-req-_que.patch @@ -0,0 +1,51 @@ +From 62aa281470fdb7c0796d63a1cc918a8c1f02dde2 Mon Sep 17 00:00:00 2001 +From: Himanshu Madhani +Date: Sat, 16 Dec 2017 16:05:09 -0800 +Subject: scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que + +From: Himanshu Madhani + +commit 62aa281470fdb7c0796d63a1cc918a8c1f02dde2 upstream. + +This patch fixes following warnings reported by smatch: + +drivers/scsi/qla2xxx/qla_mid.c:586 qla25xx_delete_req_que() +error: we previously assumed 'req' could be null (see line 580) + +drivers/scsi/qla2xxx/qla_mid.c:602 qla25xx_delete_rsp_que() +error: we previously assumed 'rsp' could be null (see line 596) + +Fixes: 7867b98dceb7 ("scsi: qla2xxx: Fix memory leak in dual/target mode") +Reported-by: Dan Carpenter +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_mid.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -582,8 +582,9 @@ qla25xx_delete_req_que(struct scsi_qla_h + ret = qla25xx_init_req_que(vha, req); + if (ret != QLA_SUCCESS) + return QLA_FUNCTION_FAILED; ++ ++ qla25xx_free_req_que(vha, req); + } +- qla25xx_free_req_que(vha, req); + + return ret; + } +@@ -598,8 +599,9 @@ qla25xx_delete_rsp_que(struct scsi_qla_h + ret = qla25xx_init_rsp_que(vha, rsp); + if (ret != QLA_SUCCESS) + return QLA_FUNCTION_FAILED; ++ ++ qla25xx_free_rsp_que(vha, rsp); + } +- qla25xx_free_rsp_que(vha, rsp); + + return ret; + } diff --git a/queue-4.15/series b/queue-4.15/series index 1ac30c937a2..53b247b807d 100644 --- a/queue-4.15/series +++ b/queue-4.15/series @@ -35,3 +35,18 @@ btrfs-alloc_chunk-fix-dup-stripe-size-handling.patch btrfs-fix-use-after-free-when-cleaning-up-fs_devs-with-a-single-stale-device.patch btrfs-remove-spurious-warn_on-ref-count-0-in-find_parent_nodes.patch btrfs-fix-memory-barriers-usage-with-device-stats-counters.patch +scsi-qla2xxx-fix-smatch-warning-in-qla25xx_delete_-rsp-req-_que.patch +scsi-qla2xxx-fix-null-pointer-access-for-fcport-structure.patch +scsi-qla2xxx-fix-logo-flag-for-qlt_free_session_done.patch +scsi-qla2xxx-fix-crashes-in-qla2x00_probe_one-on-probe-failure.patch +usb-dwc2-fix-stm32f7-usb-otg-hs-compatible.patch +dt-bindings-usb-fix-the-stm32f7-dwc2-otg-hs-core-binding.patch +usb-gadget-udc-add-missing-platform_device_put-on-error-in-bdc_pci_probe.patch +usb-dwc3-fix-gdbgfifospace_type-values.patch +usb-dwc3-core-power-off-core-phys-on-system_suspend-in-host-mode.patch +usb-dwc3-of-simple-fix-oops-by-unbalanced-clk-disable-call.patch +usb-gadget-udc-renesas_usb3-fix-oops-in-renesas_usb3_remove.patch +phy-phy-brcm-usb-fix-two-dt-properties-to-match-bindings-doc.patch +phy-phy-brcm-usb-init-some-low-speed-keyboards-fail-on-7271.patch +phy-phy-brcm-usb-init-drd-mode-can-cause-crash-on-startup.patch +phy-phy-brcm-usb-init-power-down-usb-3.0-phy-when-xhci-disabled.patch diff --git a/queue-4.15/usb-dwc2-fix-stm32f7-usb-otg-hs-compatible.patch b/queue-4.15/usb-dwc2-fix-stm32f7-usb-otg-hs-compatible.patch new file mode 100644 index 00000000000..e3ab38f8f17 --- /dev/null +++ b/queue-4.15/usb-dwc2-fix-stm32f7-usb-otg-hs-compatible.patch @@ -0,0 +1,46 @@ +From 1a149e3554e0324a3d551dfb327bdb67b150a320 Mon Sep 17 00:00:00 2001 +From: Amelie Delaunay +Date: Thu, 1 Mar 2018 11:05:35 +0100 +Subject: usb: dwc2: fix STM32F7 USB OTG HS compatible + +From: Amelie Delaunay + +commit 1a149e3554e0324a3d551dfb327bdb67b150a320 upstream. + +This patch fixes compatible for STM32F7 USB OTG HS and consistently rename +dw2_set_params function. +The v2 former patch [1] had been acked by Paul Young, but v1 was merged. + +[1] https://patchwork.kernel.org/patch/9925573/ + +Fixes: d8fae8b93682 ("usb: dwc2: add support for STM32F7xx USB OTG HS") +Signed-off-by: Amelie Delaunay +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/params.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc2/params.c ++++ b/drivers/usb/dwc2/params.c +@@ -137,7 +137,7 @@ static void dwc2_set_stm32f4x9_fsotg_par + p->activate_stm_fs_transceiver = true; + } + +-static void dwc2_set_stm32f7xx_hsotg_params(struct dwc2_hsotg *hsotg) ++static void dwc2_set_stm32f7_hsotg_params(struct dwc2_hsotg *hsotg) + { + struct dwc2_core_params *p = &hsotg->params; + +@@ -164,8 +164,8 @@ const struct of_device_id dwc2_of_match_ + { .compatible = "st,stm32f4x9-fsotg", + .data = dwc2_set_stm32f4x9_fsotg_params }, + { .compatible = "st,stm32f4x9-hsotg" }, +- { .compatible = "st,stm32f7xx-hsotg", +- .data = dwc2_set_stm32f7xx_hsotg_params }, ++ { .compatible = "st,stm32f7-hsotg", ++ .data = dwc2_set_stm32f7_hsotg_params }, + {}, + }; + MODULE_DEVICE_TABLE(of, dwc2_of_match_table); diff --git a/queue-4.15/usb-dwc3-core-power-off-core-phys-on-system_suspend-in-host-mode.patch b/queue-4.15/usb-dwc3-core-power-off-core-phys-on-system_suspend-in-host-mode.patch new file mode 100644 index 00000000000..ee0dd74f6cf --- /dev/null +++ b/queue-4.15/usb-dwc3-core-power-off-core-phys-on-system_suspend-in-host-mode.patch @@ -0,0 +1,172 @@ +From c4a5153e87fdf6805f63ff57556260e2554155a5 Mon Sep 17 00:00:00 2001 +From: Manu Gautam +Date: Thu, 18 Jan 2018 16:54:30 +0530 +Subject: usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode + +From: Manu Gautam + +commit c4a5153e87fdf6805f63ff57556260e2554155a5 upstream. + +Commit 689bf72c6e0d ("usb: dwc3: Don't reinitialize core during +host bus-suspend/resume") updated suspend/resume routines to not +power_off and reinit PHYs/core for host mode. +It broke platforms that rely on DWC3 core to power_off PHYs to +enter low power state on system suspend. + +Perform dwc3_core_exit/init only during host mode system_suspend/ +resume to addresses power regression from above mentioned patch +and also allow USB session to stay connected across +runtime_suspend/resume in host mode. While at it also replace +existing checks for HOST only dr_mode with current_dr_role to +have similar core driver behavior for both Host-only and DRD+Host +configurations. + +Fixes: 689bf72c6e0d ("usb: dwc3: Don't reinitialize core during host bus-suspend/resume") +Reviewed-by: Roger Quadros +Signed-off-by: Manu Gautam +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/core.c | 36 ++++++++++++++++++++++-------------- + 1 file changed, 22 insertions(+), 14 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -100,6 +100,8 @@ static void dwc3_set_prtcap(struct dwc3 + reg &= ~(DWC3_GCTL_PRTCAPDIR(DWC3_GCTL_PRTCAP_OTG)); + reg |= DWC3_GCTL_PRTCAPDIR(mode); + dwc3_writel(dwc->regs, DWC3_GCTL, reg); ++ ++ dwc->current_dr_role = mode; + } + + static void __dwc3_set_mode(struct work_struct *work) +@@ -133,8 +135,6 @@ static void __dwc3_set_mode(struct work_ + + dwc3_set_prtcap(dwc, dwc->desired_dr_role); + +- dwc->current_dr_role = dwc->desired_dr_role; +- + spin_unlock_irqrestore(&dwc->lock, flags); + + switch (dwc->desired_dr_role) { +@@ -218,7 +218,7 @@ static int dwc3_core_soft_reset(struct d + * XHCI driver will reset the host block. If dwc3 was configured for + * host-only mode, then we can return early. + */ +- if (dwc->dr_mode == USB_DR_MODE_HOST) ++ if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST) + return 0; + + reg = dwc3_readl(dwc->regs, DWC3_DCTL); +@@ -915,7 +915,6 @@ static int dwc3_core_init_mode(struct dw + + switch (dwc->dr_mode) { + case USB_DR_MODE_PERIPHERAL: +- dwc->current_dr_role = DWC3_GCTL_PRTCAP_DEVICE; + dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE); + + if (dwc->usb2_phy) +@@ -931,7 +930,6 @@ static int dwc3_core_init_mode(struct dw + } + break; + case USB_DR_MODE_HOST: +- dwc->current_dr_role = DWC3_GCTL_PRTCAP_HOST; + dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_HOST); + + if (dwc->usb2_phy) +@@ -1279,7 +1277,7 @@ static int dwc3_remove(struct platform_d + } + + #ifdef CONFIG_PM +-static int dwc3_suspend_common(struct dwc3 *dwc) ++static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + { + unsigned long flags; + +@@ -1291,6 +1289,10 @@ static int dwc3_suspend_common(struct dw + dwc3_core_exit(dwc); + break; + case DWC3_GCTL_PRTCAP_HOST: ++ /* do nothing during host runtime_suspend */ ++ if (!PMSG_IS_AUTO(msg)) ++ dwc3_core_exit(dwc); ++ break; + default: + /* do nothing */ + break; +@@ -1299,7 +1301,7 @@ static int dwc3_suspend_common(struct dw + return 0; + } + +-static int dwc3_resume_common(struct dwc3 *dwc) ++static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) + { + unsigned long flags; + int ret; +@@ -1315,6 +1317,13 @@ static int dwc3_resume_common(struct dwc + spin_unlock_irqrestore(&dwc->lock, flags); + break; + case DWC3_GCTL_PRTCAP_HOST: ++ /* nothing to do on host runtime_resume */ ++ if (!PMSG_IS_AUTO(msg)) { ++ ret = dwc3_core_init(dwc); ++ if (ret) ++ return ret; ++ } ++ break; + default: + /* do nothing */ + break; +@@ -1326,12 +1335,11 @@ static int dwc3_resume_common(struct dwc + static int dwc3_runtime_checks(struct dwc3 *dwc) + { + switch (dwc->current_dr_role) { +- case USB_DR_MODE_PERIPHERAL: +- case USB_DR_MODE_OTG: ++ case DWC3_GCTL_PRTCAP_DEVICE: + if (dwc->connected) + return -EBUSY; + break; +- case USB_DR_MODE_HOST: ++ case DWC3_GCTL_PRTCAP_HOST: + default: + /* do nothing */ + break; +@@ -1348,7 +1356,7 @@ static int dwc3_runtime_suspend(struct d + if (dwc3_runtime_checks(dwc)) + return -EBUSY; + +- ret = dwc3_suspend_common(dwc); ++ ret = dwc3_suspend_common(dwc, PMSG_AUTO_SUSPEND); + if (ret) + return ret; + +@@ -1364,7 +1372,7 @@ static int dwc3_runtime_resume(struct de + + device_init_wakeup(dev, false); + +- ret = dwc3_resume_common(dwc); ++ ret = dwc3_resume_common(dwc, PMSG_AUTO_RESUME); + if (ret) + return ret; + +@@ -1411,7 +1419,7 @@ static int dwc3_suspend(struct device *d + struct dwc3 *dwc = dev_get_drvdata(dev); + int ret; + +- ret = dwc3_suspend_common(dwc); ++ ret = dwc3_suspend_common(dwc, PMSG_SUSPEND); + if (ret) + return ret; + +@@ -1427,7 +1435,7 @@ static int dwc3_resume(struct device *de + + pinctrl_pm_select_default_state(dev); + +- ret = dwc3_resume_common(dwc); ++ ret = dwc3_resume_common(dwc, PMSG_RESUME); + if (ret) + return ret; + diff --git a/queue-4.15/usb-dwc3-fix-gdbgfifospace_type-values.patch b/queue-4.15/usb-dwc3-fix-gdbgfifospace_type-values.patch new file mode 100644 index 00000000000..f116b876464 --- /dev/null +++ b/queue-4.15/usb-dwc3-fix-gdbgfifospace_type-values.patch @@ -0,0 +1,48 @@ +From b16ea8b9492e99e03b1269fe93ebdbf8e4eabf8a Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Fri, 2 Feb 2018 13:21:35 -0800 +Subject: usb: dwc3: Fix GDBGFIFOSPACE_TYPE values + +From: Thinh Nguyen + +commit b16ea8b9492e99e03b1269fe93ebdbf8e4eabf8a upstream. + +The FIFO/Queue type values are incorrect. Correct them according to +DWC_usb3 programming guide section 1.2.27 (or DWC_usb31 section 1.2.25). + +Additionally, this patch includes ProtocolStatusQ and AuxEventQ types. + +Fixes: cf6d867d3b57 ("usb: dwc3: core: add fifo space helper") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/core.h | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -158,13 +158,15 @@ + #define DWC3_GDBGFIFOSPACE_TYPE(n) (((n) << 5) & 0x1e0) + #define DWC3_GDBGFIFOSPACE_SPACE_AVAILABLE(n) (((n) >> 16) & 0xffff) + +-#define DWC3_TXFIFOQ 1 +-#define DWC3_RXFIFOQ 3 +-#define DWC3_TXREQQ 5 +-#define DWC3_RXREQQ 7 +-#define DWC3_RXINFOQ 9 +-#define DWC3_DESCFETCHQ 13 +-#define DWC3_EVENTQ 15 ++#define DWC3_TXFIFOQ 0 ++#define DWC3_RXFIFOQ 1 ++#define DWC3_TXREQQ 2 ++#define DWC3_RXREQQ 3 ++#define DWC3_RXINFOQ 4 ++#define DWC3_PSTATQ 5 ++#define DWC3_DESCFETCHQ 6 ++#define DWC3_EVENTQ 7 ++#define DWC3_AUXEVENTQ 8 + + /* Global RX Threshold Configuration Register */ + #define DWC3_GRXTHRCFG_MAXRXBURSTSIZE(n) (((n) & 0x1f) << 19) diff --git a/queue-4.15/usb-dwc3-of-simple-fix-oops-by-unbalanced-clk-disable-call.patch b/queue-4.15/usb-dwc3-of-simple-fix-oops-by-unbalanced-clk-disable-call.patch new file mode 100644 index 00000000000..5d2ba7bdab2 --- /dev/null +++ b/queue-4.15/usb-dwc3-of-simple-fix-oops-by-unbalanced-clk-disable-call.patch @@ -0,0 +1,57 @@ +From bff52352e0ccc2481f2b6b0d612ff8ff56c50f3a Mon Sep 17 00:00:00 2001 +From: Enric Balletbo i Serra +Date: Mon, 18 Dec 2017 16:14:36 +0100 +Subject: usb: dwc3: of-simple: fix oops by unbalanced clk disable call + +From: Enric Balletbo i Serra + +commit bff52352e0ccc2481f2b6b0d612ff8ff56c50f3a upstream. + +dwc3_of_simple_dev_pm_ops has never been used since commit a0d8c4cfdf31 +("usb: dwc3: of-simple: set dev_pm_ops"), but this commit has brought +and oops when unbind the device due this sequence: + + dwc3_of_simple_remove + -> clk_disable ... + -> pm_runtime_put_sync + -> dwc3_of_simple_runtime_suspend + -> clk_disable (again) + +This double call to clk_core_disable causes a kernel oops like this: + + WARNING: CPU: 1 PID: 4022 at drivers/clk/clk.c:656 clk_core_disable+0x78/0x80 + CPU: 1 PID: 4022 Comm: bash Not tainted 4.15.0-rc4+ #44 + Hardware name: Google Kevin (DT) + pstate: 80000085 (Nzcv daIf -PAN -UAO) + pc : clk_core_disable+0x78/0x80 + lr : clk_core_disable_lock+0x20/0x38 + sp : ffff00000bbf3a90 + ... + Call trace: + clk_core_disable+0x78/0x80 + clk_disable+0x1c/0x30 + dwc3_of_simple_runtime_suspend+0x30/0x50 + pm_generic_runtime_suspend+0x28/0x40 + +This patch fixes the unbalanced clk disable call by setting the num_clocks +variable to zero once the clocks were disabled. + +Fixes: a0d8c4cfdf31 ("usb: dwc3: of-simple: set dev_pm_ops") +Signed-off-by: Enric Balletbo i Serra +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-of-simple.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/dwc3/dwc3-of-simple.c ++++ b/drivers/usb/dwc3/dwc3-of-simple.c +@@ -143,6 +143,7 @@ static int dwc3_of_simple_remove(struct + clk_disable_unprepare(simple->clks[i]); + clk_put(simple->clks[i]); + } ++ simple->num_clocks = 0; + + reset_control_assert(simple->resets); + reset_control_put(simple->resets); diff --git a/queue-4.15/usb-gadget-udc-add-missing-platform_device_put-on-error-in-bdc_pci_probe.patch b/queue-4.15/usb-gadget-udc-add-missing-platform_device_put-on-error-in-bdc_pci_probe.patch new file mode 100644 index 00000000000..ce68be343b4 --- /dev/null +++ b/queue-4.15/usb-gadget-udc-add-missing-platform_device_put-on-error-in-bdc_pci_probe.patch @@ -0,0 +1,31 @@ +From 8874ae5f15f3feef3b4a415b9aed51edcf449aa1 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Tue, 23 Jan 2018 09:35:14 +0000 +Subject: USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() + +From: Wei Yongjun + +commit 8874ae5f15f3feef3b4a415b9aed51edcf449aa1 upstream. + +Add the missing platform_device_put() before return from bdc_pci_probe() +in the platform_device_add_resources() error handling case. + +Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC") +Signed-off-by: Wei Yongjun +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/bdc/bdc_pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/bdc/bdc_pci.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_pci.c +@@ -77,6 +77,7 @@ static int bdc_pci_probe(struct pci_dev + if (ret) { + dev_err(&pci->dev, + "couldn't add resources to bdc device\n"); ++ platform_device_put(bdc); + return ret; + } + diff --git a/queue-4.15/usb-gadget-udc-renesas_usb3-fix-oops-in-renesas_usb3_remove.patch b/queue-4.15/usb-gadget-udc-renesas_usb3-fix-oops-in-renesas_usb3_remove.patch new file mode 100644 index 00000000000..06e4bae73c3 --- /dev/null +++ b/queue-4.15/usb-gadget-udc-renesas_usb3-fix-oops-in-renesas_usb3_remove.patch @@ -0,0 +1,33 @@ +From e3190868e5f52fb26544f16463593d54ce46ce61 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Fri, 12 Jan 2018 20:00:56 +0900 +Subject: usb: gadget: udc: renesas_usb3: fix oops in renesas_usb3_remove() + +From: Yoshihiro Shimoda + +commit e3190868e5f52fb26544f16463593d54ce46ce61 upstream. + +This patch fixes an issue that the renesas_usb3_remove() causes +NULL pointer dereference because the usb3_to_dev() macro will use +the gadget instance and it will be deleted before. + +Fixes: cf06df3fae28 ("usb: gadget: udc: renesas_usb3: move pm_runtime_{en,dis}able()") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2410,7 +2410,7 @@ static int renesas_usb3_remove(struct pl + __renesas_usb3_ep_free_request(usb3->ep0_req); + if (usb3->phy) + phy_put(usb3->phy); +- pm_runtime_disable(usb3_to_dev(usb3)); ++ pm_runtime_disable(&pdev->dev); + + return 0; + }