From 56200cb80cdcaca477d26f87dd087802ca415e64 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 13 Aug 2017 15:19:22 -0700 Subject: [PATCH] 4.9-stable patches added patches: drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch iio-light-tsl2563-use-correct-event-code.patch iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch usb-check-for-dropped-connection-before-switching-to-full-speed.patch usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch usb-musb-fix-tx-fifo-flush-handling-again.patch usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch usb-serial-option-add-d-link-dwm-222-device-id.patch usb-serial-pl2303-add-new-aten-device-id.patch usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch xtensa-don-t-limit-csum_partial-export-by-config_net.patch xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch xtensa-mm-cache-add-missing-export_symbols.patch --- ...x-off-by-one-error-in-reloc-checking.patch | 35 ++++++ ...s-array-access-in-bdw_load_gamma_lut.patch | 115 +++++++++++++++++ ...lock-flag-in-fuse_file-on-allocation.patch | 38 ++++++ ...-to-normal-mode-after-suspend-resume.patch | 60 +++++++++ ...light-tsl2563-use-correct-event-code.patch | 39 ++++++ ...set-hung-task-during-parallel-delete.patch | 111 +++++++++++++++++ ...memory-leak-in-iscsit_setup_text_cmd.patch | 43 +++++++ ...c-for-setting-hs400es-signal-voltage.patch | 34 +++++ ...nds-that-do-not-support-set-features.patch | 40 ++++++ ...ayout-for-small-pages-using-soft-ecc.patch | 67 ++++++++++ ...ix-leak-of-nfs4_ff_ds_version-arrays.patch | 30 +++++ queue-4.9/series | 29 +++++ ...-call-blocking-ops-when-task_running.patch | 43 +++++++ ...s1210-fix-negative-iio_angl_vel-read.patch | 38 ++++++ ...uncached-dynamic-shutdown-regression.patch | 116 ++++++++++++++++++ ...due-for-initio-corporation-inic-3069.patch | 41 +++++++ ...ction-before-switching-to-full-speed.patch | 65 ++++++++++ ...-the-tail-of-the-endpoint-s-urb_list.patch | 41 +++++++ ...-usb_gadget_giveback_request-calling.patch | 67 ++++++++++ ...-hcd-as-dead-if-the-primary-one-died.patch | 40 ++++++ ...usb-fix-tx-fifo-flush-handling-again.patch | 36 ++++++ ...rk-for-moshi-usb-to-ethernet-adapter.patch | 37 ++++++ ...bhs-fix-ugctrl2-value-for-r-car-gen3.patch | 54 ++++++++ ...upport-for-qivicon-usb-zigbee-dongle.patch | 32 +++++ ...-option-add-d-link-dwm-222-device-id.patch | 30 +++++ ...serial-pl2303-add-new-aten-device-id.patch | 40 ++++++ ...ng-hp-keyboard-on-reset-after-resume.patch | 86 +++++++++++++ ...it-csum_partial-export-by-config_net.patch | 35 ++++++ ...-aliasing-handling-code-for-wt-cache.patch | 74 +++++++++++ ...-mm-cache-add-missing-export_symbols.patch | 61 +++++++++ 30 files changed, 1577 insertions(+) create mode 100644 queue-4.9/drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch create mode 100644 queue-4.9/drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch create mode 100644 queue-4.9/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch create mode 100644 queue-4.9/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch create mode 100644 queue-4.9/iio-light-tsl2563-use-correct-event-code.patch create mode 100644 queue-4.9/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch create mode 100644 queue-4.9/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch create mode 100644 queue-4.9/mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch create mode 100644 queue-4.9/mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch create mode 100644 queue-4.9/nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch create mode 100644 queue-4.9/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch create mode 100644 queue-4.9/staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch create mode 100644 queue-4.9/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch create mode 100644 queue-4.9/target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch create mode 100644 queue-4.9/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch create mode 100644 queue-4.9/usb-check-for-dropped-connection-before-switching-to-full-speed.patch create mode 100644 queue-4.9/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch create mode 100644 queue-4.9/usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch create mode 100644 queue-4.9/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch create mode 100644 queue-4.9/usb-musb-fix-tx-fifo-flush-handling-again.patch create mode 100644 queue-4.9/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch create mode 100644 queue-4.9/usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch create mode 100644 queue-4.9/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch create mode 100644 queue-4.9/usb-serial-option-add-d-link-dwm-222-device-id.patch create mode 100644 queue-4.9/usb-serial-pl2303-add-new-aten-device-id.patch create mode 100644 queue-4.9/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch create mode 100644 queue-4.9/xtensa-don-t-limit-csum_partial-export-by-config_net.patch create mode 100644 queue-4.9/xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch create mode 100644 queue-4.9/xtensa-mm-cache-add-missing-export_symbols.patch diff --git a/queue-4.9/drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch b/queue-4.9/drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch new file mode 100644 index 00000000000..b0539213c4f --- /dev/null +++ b/queue-4.9/drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch @@ -0,0 +1,35 @@ +From d6f756e09f01ea7a0efbbcef269a1e384a35d824 Mon Sep 17 00:00:00 2001 +From: "Wladimir J. van der Laan" +Date: Tue, 25 Jul 2017 14:33:36 +0200 +Subject: drm/etnaviv: Fix off-by-one error in reloc checking + +From: Wladimir J. van der Laan + +commit d6f756e09f01ea7a0efbbcef269a1e384a35d824 upstream. + +A relocation pointing to the last four bytes of a buffer can +legitimately happen in the case of small vertex buffers. + +Signed-off-by: Wladimir J. van der Laan +Reviewed-by: Philipp Zabel +Reviewed-by: Christian Gmeiner +Signed-off-by: Lucas Stach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c +@@ -264,8 +264,8 @@ static int submit_reloc(struct etnaviv_g + if (ret) + return ret; + +- if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) { +- DRM_ERROR("relocation %u outside object", i); ++ if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) { ++ DRM_ERROR("relocation %u outside object\n", i); + return -EINVAL; + } + diff --git a/queue-4.9/drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch b/queue-4.9/drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch new file mode 100644 index 00000000000..b4d8c1d2fed --- /dev/null +++ b/queue-4.9/drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch @@ -0,0 +1,115 @@ +From 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Mon, 24 Jul 2017 11:14:31 +0200 +Subject: drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut + +From: Maarten Lankhorst + +commit 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 upstream. + +bdw_load_gamma_lut is writing beyond the array to the maximum value. +The intend of the function is to clamp values > 1 to 1, so write +the intended color to the max register. + +This fixes the following KASAN warning: + +[ 197.020857] [IGT] kms_pipe_color: executing +[ 197.063434] [IGT] kms_pipe_color: starting subtest ctm-0-25-pipe0 +[ 197.078989] ================================================================== +[ 197.079127] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] +[ 197.079188] Read of size 2 at addr ffff8800d38db150 by task kms_pipe_color/1839 +[ 197.079208] CPU: 2 PID: 1839 Comm: kms_pipe_color Tainted: G U 4.13.0-rc1-patser+ #5211 +[ 197.079215] Hardware name: NUC5i7RYB, BIOS RYBDWi35.86A.0246.2015.0309.1355 03/09/2015 +[ 197.079220] Call Trace: +[ 197.079230] dump_stack+0x68/0x9e +[ 197.079239] print_address_description+0x6f/0x250 +[ 197.079251] kasan_report+0x216/0x370 +[ 197.079374] ? bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] +[ 197.079451] ? gen8_write16+0x4e0/0x4e0 [i915] +[ 197.079460] __asan_report_load2_noabort+0x14/0x20 +[ 197.079535] bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] +[ 197.079612] broadwell_load_luts+0x1df/0x550 [i915] +[ 197.079690] intel_color_load_luts+0x7b/0x80 [i915] +[ 197.079764] intel_begin_crtc_commit+0x138/0x760 [i915] +[ 197.079783] drm_atomic_helper_commit_planes_on_crtc+0x1a3/0x820 [drm_kms_helper] +[ 197.079859] ? intel_pre_plane_update+0x571/0x580 [i915] +[ 197.079937] intel_update_crtc+0x238/0x330 [i915] +[ 197.080016] intel_update_crtcs+0x10f/0x210 [i915] +[ 197.080092] intel_atomic_commit_tail+0x1552/0x3340 [i915] +[ 197.080101] ? _raw_spin_unlock+0x3c/0x40 +[ 197.080110] ? __queue_work+0xb40/0xbf0 +[ 197.080188] ? skl_update_crtcs+0xc00/0xc00 [i915] +[ 197.080195] ? trace_hardirqs_on+0xd/0x10 +[ 197.080269] ? intel_atomic_commit_ready+0x128/0x13c [i915] +[ 197.080329] ? __i915_sw_fence_complete+0x5b8/0x6d0 [i915] +[ 197.080336] ? debug_object_activate+0x39e/0x580 +[ 197.080397] ? i915_sw_fence_await+0x30/0x30 [i915] +[ 197.080409] ? __might_sleep+0x15b/0x180 +[ 197.080483] intel_atomic_commit+0x944/0xa70 [i915] +[ 197.080490] ? refcount_dec_and_test+0x11/0x20 +[ 197.080567] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] +[ 197.080597] ? drm_atomic_crtc_set_property+0x303/0x580 [drm] +[ 197.080674] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] +[ 197.080704] drm_atomic_commit+0xd7/0xe0 [drm] +[ 197.080722] drm_atomic_helper_crtc_set_property+0xec/0x130 [drm_kms_helper] +[ 197.080749] drm_mode_crtc_set_obj_prop+0x7d/0xb0 [drm] +[ 197.080775] drm_mode_obj_set_property_ioctl+0x50b/0x5d0 [drm] +[ 197.080783] ? __might_fault+0x104/0x180 +[ 197.080809] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] +[ 197.080838] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] +[ 197.080861] drm_ioctl_kernel+0x154/0x1a0 [drm] +[ 197.080885] drm_ioctl+0x624/0x8f0 [drm] +[ 197.080910] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] +[ 197.080934] ? drm_getunique+0x210/0x210 [drm] +[ 197.080943] ? __handle_mm_fault+0x1bd0/0x1ce0 +[ 197.080949] ? lock_downgrade+0x610/0x610 +[ 197.080957] ? __lru_cache_add+0x15a/0x180 +[ 197.080967] do_vfs_ioctl+0xd92/0xe40 +[ 197.080975] ? ioctl_preallocate+0x1b0/0x1b0 +[ 197.080982] ? selinux_capable+0x20/0x20 +[ 197.080991] ? __do_page_fault+0x7b7/0x9a0 +[ 197.080997] ? lock_downgrade+0x5bb/0x610 +[ 197.081007] ? security_file_ioctl+0x57/0x90 +[ 197.081016] SyS_ioctl+0x4e/0x80 +[ 197.081024] entry_SYSCALL_64_fastpath+0x18/0xad +[ 197.081030] RIP: 0033:0x7f61f287a987 +[ 197.081035] RSP: 002b:00007fff7d44d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +[ 197.081043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61f287a987 +[ 197.081048] RDX: 00007fff7d44d1c0 RSI: 00000000c01864ba RDI: 0000000000000003 +[ 197.081053] RBP: 00007f61f2b3eb00 R08: 0000000000000059 R09: 0000000000000000 +[ 197.081058] R10: 0000002ea5c4a290 R11: 0000000000000246 R12: 00007f61f2b3eb58 +[ 197.081063] R13: 0000000000001010 R14: 00007f61f2b3eb58 R15: 0000000000002702 + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101659 +Signed-off-by: Maarten Lankhorst +Reported-by: Martin Peres +Cc: Martin Peres +Fixes: 82cf435b3134 ("drm/i915: Implement color management on bdw/skl/bxt/kbl") +Cc: Shashank Sharma +Cc: Kiran S Kumar +Cc: Kausal Malladi +Cc: Lionel Landwerlin +Cc: Matt Roper +Cc: Daniel Vetter +Cc: Jani Nikula +Cc: intel-gfx@lists.freedesktop.org +Link: https://patchwork.freedesktop.org/patch/msgid/20170724091431.24251-1-maarten.lankhorst@linux.intel.com +Reviewed-by: Lionel Landwerlin +(cherry picked from commit 09a92bc8773b4314e02b478e003fe5936ce85adb) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_color.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/intel_color.c ++++ b/drivers/gpu/drm/i915/intel_color.c +@@ -394,6 +394,7 @@ static void broadwell_load_luts(struct d + } + + /* Program the max register to clamp values > 1.0. */ ++ i = lut_size - 1; + I915_WRITE(PREC_PAL_GC_MAX(pipe, 0), + drm_color_lut_extract(lut[i].red, 16)); + I915_WRITE(PREC_PAL_GC_MAX(pipe, 1), diff --git a/queue-4.9/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch b/queue-4.9/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch new file mode 100644 index 00000000000..52813cb393b --- /dev/null +++ b/queue-4.9/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch @@ -0,0 +1,38 @@ +From 68227c03cba84a24faf8a7277d2b1a03c8959c2c Mon Sep 17 00:00:00 2001 +From: Mateusz Jurczyk +Date: Wed, 7 Jun 2017 12:26:49 +0200 +Subject: fuse: initialize the flock flag in fuse_file on allocation + +From: Mateusz Jurczyk + +commit 68227c03cba84a24faf8a7277d2b1a03c8959c2c upstream. + +Before the patch, the flock flag could remain uninitialized for the +lifespan of the fuse_file allocation. Unless set to true in +fuse_file_flock(), it would remain in an indeterminate state until read in +an if statement in fuse_release_common(). This could consequently lead to +taking an unexpected branch in the code. + +The bug was discovered by a runtime instrumentation designed to detect use +of uninitialized memory in the kernel. + +Signed-off-by: Mateusz Jurczyk +Fixes: 37fb3a30b462 ("fuse: fix flock") +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct + { + struct fuse_file *ff; + +- ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL); ++ ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL); + if (unlikely(!ff)) + return NULL; + diff --git a/queue-4.9/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch b/queue-4.9/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch new file mode 100644 index 00000000000..c6cce6f9cf3 --- /dev/null +++ b/queue-4.9/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch @@ -0,0 +1,60 @@ +From e59e18989c68a8d7941005f81ad6abc4ca682de0 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 13 Jul 2017 15:13:41 +0200 +Subject: iio: accel: bmc150: Always restore device to normal mode after suspend-resume + +From: Hans de Goede + +commit e59e18989c68a8d7941005f81ad6abc4ca682de0 upstream. + +After probe we would put the device in normal mode, after a runtime +suspend-resume we would put it back in normal mode. But for a regular +suspend-resume we would only put it back in normal mode if triggers +or events have been requested. This is not consistent and breaks +reading raw values after a suspend-resume. + +This commit changes the regular resume path to also unconditionally put +the device back in normal mode, fixing reading of raw values not working +after a regular suspend-resume cycle. + +Signed-off-by: Hans de Goede +Reviewed-by: Srinivas Pandruvada +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/bmc150-accel-core.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -193,7 +193,6 @@ struct bmc150_accel_data { + struct regmap *regmap; + int irq; + struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS]; +- atomic_t active_intr; + struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS]; + struct mutex mutex; + u8 fifo_mode, watermark; +@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(st + goto out_fix_power_state; + } + +- if (state) +- atomic_inc(&data->active_intr); +- else +- atomic_dec(&data->active_intr); +- + return 0; + + out_fix_power_state: +@@ -1709,8 +1703,7 @@ static int bmc150_accel_resume(struct de + struct bmc150_accel_data *data = iio_priv(indio_dev); + + mutex_lock(&data->mutex); +- if (atomic_read(&data->active_intr)) +- bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); ++ bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); + bmc150_accel_fifo_set_mode(data); + mutex_unlock(&data->mutex); + diff --git a/queue-4.9/iio-light-tsl2563-use-correct-event-code.patch b/queue-4.9/iio-light-tsl2563-use-correct-event-code.patch new file mode 100644 index 00000000000..424e8c38b0f --- /dev/null +++ b/queue-4.9/iio-light-tsl2563-use-correct-event-code.patch @@ -0,0 +1,39 @@ +From a3507e48d3f99a93a3056a34a5365f310434570f Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Wed, 21 Jun 2017 01:46:37 +0900 +Subject: iio: light: tsl2563: use correct event code + +From: Akinobu Mita + +commit a3507e48d3f99a93a3056a34a5365f310434570f upstream. + +The TSL2563 driver provides three iio channels, two of which are raw ADC +channels (channel 0 and channel 1) in the device and the remaining one +is calculated by the two. The ADC channel 0 only supports programmable +interrupt with threshold settings and this driver supports the event but +the generated event code does not contain the corresponding iio channel +type. + +This is going to change userspace ABI. Hopefully fixing this to be +what it should always have been won't break any userspace code. + +Cc: Jonathan Cameron +Signed-off-by: Akinobu Mita +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/light/tsl2563.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/tsl2563.c ++++ b/drivers/iio/light/tsl2563.c +@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler + struct tsl2563_chip *chip = iio_priv(dev_info); + + iio_push_event(dev_info, +- IIO_UNMOD_EVENT_CODE(IIO_LIGHT, ++ IIO_UNMOD_EVENT_CODE(IIO_INTENSITY, + 0, + IIO_EV_TYPE_THRESH, + IIO_EV_DIR_EITHER), diff --git a/queue-4.9/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch b/queue-4.9/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch new file mode 100644 index 00000000000..d064e41ca51 --- /dev/null +++ b/queue-4.9/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch @@ -0,0 +1,111 @@ +From 978d13d60c34818a41fc35962602bdfa5c03f214 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Fri, 4 Aug 2017 23:59:31 -0700 +Subject: iscsi-target: Fix iscsi_np reset hung task during parallel delete + +From: Nicholas Bellinger + +commit 978d13d60c34818a41fc35962602bdfa5c03f214 upstream. + +This patch fixes a bug associated with iscsit_reset_np_thread() +that can occur during parallel configfs rmdir of a single iscsi_np +used across multiple iscsi-target instances, that would result in +hung task(s) similar to below where configfs rmdir process context +was blocked indefinately waiting for iscsi_np->np_restart_comp +to finish: + +[ 6726.112076] INFO: task dcp_proxy_node_:15550 blocked for more than 120 seconds. +[ 6726.119440] Tainted: G W O 4.1.26-3321 #2 +[ 6726.125045] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 6726.132927] dcp_proxy_node_ D ffff8803f202bc88 0 15550 1 0x00000000 +[ 6726.140058] ffff8803f202bc88 ffff88085c64d960 ffff88083b3b1ad0 ffff88087fffeb08 +[ 6726.147593] ffff8803f202c000 7fffffffffffffff ffff88083f459c28 ffff88083b3b1ad0 +[ 6726.155132] ffff88035373c100 ffff8803f202bca8 ffffffff8168ced2 ffff8803f202bcb8 +[ 6726.162667] Call Trace: +[ 6726.165150] [] schedule+0x32/0x80 +[ 6726.170156] [] schedule_timeout+0x214/0x290 +[ 6726.176030] [] ? __send_signal+0x52/0x4a0 +[ 6726.181728] [] wait_for_completion+0x96/0x100 +[ 6726.187774] [] ? wake_up_state+0x10/0x10 +[ 6726.193395] [] iscsit_reset_np_thread+0x62/0xe0 [iscsi_target_mod] +[ 6726.201278] [] iscsit_tpg_disable_portal_group+0x96/0x190 [iscsi_target_mod] +[ 6726.210033] [] lio_target_tpg_store_enable+0x4f/0xc0 [iscsi_target_mod] +[ 6726.218351] [] configfs_write_file+0xaa/0x110 +[ 6726.224392] [] vfs_write+0xa4/0x1b0 +[ 6726.229576] [] SyS_write+0x41/0xb0 +[ 6726.234659] [] system_call_fastpath+0x12/0x71 + +It would happen because each iscsit_reset_np_thread() sets state +to ISCSI_NP_THREAD_RESET, sends SIGINT, and then blocks waiting +for completion on iscsi_np->np_restart_comp. + +However, if iscsi_np was active processing a login request and +more than a single iscsit_reset_np_thread() caller to the same +iscsi_np was blocked on iscsi_np->np_restart_comp, iscsi_np +kthread process context in __iscsi_target_login_thread() would +flush pending signals and only perform a single completion of +np->np_restart_comp before going back to sleep within transport +specific iscsit_transport->iscsi_accept_np code. + +To address this bug, add a iscsi_np->np_reset_count and update +__iscsi_target_login_thread() to keep completing np->np_restart_comp +until ->np_reset_count has reached zero. + +Reported-by: Gary Guo +Tested-by: Gary Guo +Cc: Mike Christie +Cc: Hannes Reinecke +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 1 + + drivers/target/iscsi/iscsi_target_login.c | 7 +++++-- + include/target/iscsi/iscsi_target_core.h | 1 + + 3 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -418,6 +418,7 @@ int iscsit_reset_np_thread( + return 0; + } + np->np_thread_state = ISCSI_NP_THREAD_RESET; ++ atomic_inc(&np->np_reset_count); + + if (np->np_thread) { + spin_unlock_bh(&np->np_thread_lock); +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -1233,9 +1233,11 @@ static int __iscsi_target_login_thread(s + flush_signals(current); + + spin_lock_bh(&np->np_thread_lock); +- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { ++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { + np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; ++ spin_unlock_bh(&np->np_thread_lock); + complete(&np->np_restart_comp); ++ return 1; + } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) { + spin_unlock_bh(&np->np_thread_lock); + goto exit; +@@ -1268,7 +1270,8 @@ static int __iscsi_target_login_thread(s + goto exit; + } else if (rc < 0) { + spin_lock_bh(&np->np_thread_lock); +- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { ++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { ++ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; + spin_unlock_bh(&np->np_thread_lock); + complete(&np->np_restart_comp); + iscsit_put_transport(conn->conn_transport); +--- a/include/target/iscsi/iscsi_target_core.h ++++ b/include/target/iscsi/iscsi_target_core.h +@@ -785,6 +785,7 @@ struct iscsi_np { + int np_sock_type; + enum np_thread_state_table np_thread_state; + bool enabled; ++ atomic_t np_reset_count; + enum iscsi_timer_flags_table np_login_timer_flags; + u32 np_exports; + enum np_flags_table np_flags; diff --git a/queue-4.9/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch b/queue-4.9/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch new file mode 100644 index 00000000000..f7cb2ac4830 --- /dev/null +++ b/queue-4.9/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch @@ -0,0 +1,43 @@ +From ea8dc5b4cd2195ee582cae28afa4164c6dea1738 Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Sun, 23 Jul 2017 20:03:33 +0530 +Subject: iscsi-target: fix memory leak in iscsit_setup_text_cmd() + +From: Varun Prakash + +commit ea8dc5b4cd2195ee582cae28afa4164c6dea1738 upstream. + +On receiving text request iscsi-target allocates buffer for +payload in iscsit_handle_text_cmd() and assigns buffer pointer +to cmd->text_in_ptr, this buffer is currently freed in +iscsit_release_cmd(), if iscsi-target sets 'C' bit in text +response then it will receive another text request from the +initiator with ttt != 0xffffffff in this case iscsi-target +will find cmd using itt and call iscsit_setup_text_cmd() +which will set cmd->text_in_ptr to NULL without freeing +previously allocated buffer. + +This patch fixes this issue by calling kfree(cmd->text_in_ptr) +in iscsit_setup_text_cmd() before assigning NULL to it. + +For the first text request cmd->text_in_ptr is NULL as +cmd is memset to 0 in iscsit_allocate_cmd(). + +Signed-off-by: Varun Prakash +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -2177,6 +2177,7 @@ iscsit_setup_text_cmd(struct iscsi_conn + cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); + cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); + cmd->data_direction = DMA_NONE; ++ kfree(cmd->text_in_ptr); + cmd->text_in_ptr = NULL; + + return 0; diff --git a/queue-4.9/mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch b/queue-4.9/mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch new file mode 100644 index 00000000000..d52a9e5fe7a --- /dev/null +++ b/queue-4.9/mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch @@ -0,0 +1,34 @@ +From 92ddd95919466de5d34f3cb43635da9a7f9ab814 Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Tue, 8 Aug 2017 18:54:01 +0800 +Subject: mmc: mmc: correct the logic for setting HS400ES signal voltage + +From: Haibo Chen + +commit 92ddd95919466de5d34f3cb43635da9a7f9ab814 upstream. + +Change the default err value to -EINVAL, make sure the card only +has type EXT_CSD_CARD_TYPE_HS400_1_8V also do the signal voltage +setting when select hs400es mode. + +Fixes: commit 1720d3545b77 ("mmc: core: switch to 1V8 or 1V2 for hs400es mode") +Signed-off-by: Haibo Chen +Reviewed-by: Shawn Lin +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/mmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -1258,7 +1258,7 @@ out_err: + static int mmc_select_hs400es(struct mmc_card *card) + { + struct mmc_host *host = card->host; +- int err = 0; ++ int err = -EINVAL; + u8 val; + + if (!(host->caps & MMC_CAP_8_BIT_DATA)) { diff --git a/queue-4.9/mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch b/queue-4.9/mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch new file mode 100644 index 00000000000..3562895112a --- /dev/null +++ b/queue-4.9/mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch @@ -0,0 +1,40 @@ +From a11bf5ed951f8900d244d09eb03a888b59c7fc82 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Mon, 31 Jul 2017 10:29:56 +0200 +Subject: mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES + +From: Boris Brezillon + +commit a11bf5ed951f8900d244d09eb03a888b59c7fc82 upstream. + +Some ONFI NANDs do not support the SET/GET FEATURES commands, which, +according to the spec, is perfectly valid. + +On these NANDs we can't set a specific timing mode using the "timing +mode" feature, and we should assume the NAND does not require any setup +to enter a specific timing mode. + +Signed-off-by: Boris Brezillon +Fixes: d8e725dd8311 ("mtd: nand: automate NAND timings selection") +Reported-by: Alexander Dahl +Tested-by: Alexander Dahl +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nand_base.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -1081,7 +1081,9 @@ static int nand_setup_data_interface(str + * Ensure the timing mode has been changed on the chip side + * before changing timings on the controller side. + */ +- if (chip->onfi_version) { ++ if (chip->onfi_version && ++ (le16_to_cpu(chip->onfi_params.opt_cmd) & ++ ONFI_OPT_CMD_SET_GET_FEATURES)) { + u8 tmode_param[ONFI_SUBFEATURE_PARAM_LEN] = { + chip->onfi_timing_mode_default, + }; diff --git a/queue-4.9/nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch b/queue-4.9/nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch new file mode 100644 index 00000000000..f85adf08db9 --- /dev/null +++ b/queue-4.9/nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch @@ -0,0 +1,67 @@ +From f7f8c1756e9a5f1258a7cc6b663f8451b724900f Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Wed, 5 Jul 2017 08:51:09 +0200 +Subject: nand: fix wrong default oob layout for small pages using soft ecc + +From: Miquel Raynal + +commit f7f8c1756e9a5f1258a7cc6b663f8451b724900f upstream. + +When using soft ecc, if no ooblayout is given, the core automatically +uses one of the nand_ooblayout_{sp,lp}*() functions to determine the +layout inside the out of band data. + +Until kernel version 4.6, struct nand_ecclayout was used for that +purpose. During the migration from 4.6 to 4.7, an error shown up in the +small page layout, in the case oob section is only 8 bytes long. + +The layout was using three bytes (0, 1, 2) for ecc, two bytes (3, 4) +as free bytes, one byte (5) for bad block marker and finally +two bytes (6, 7) as free bytes, as shown there: + +[linux-4.6] drivers/mtd/nand/nand_base.c:52 +static struct nand_ecclayout nand_oob_8 = { + .eccbytes = 3, + .eccpos = {0, 1, 2}, + .oobfree = { + {.offset = 3, + .length = 2}, + {.offset = 6, + .length = 2} } +}; + +This fixes the current implementation which is incoherent. It +references bit 3 at the same time as an ecc byte and a free byte. + +Furthermore, it is clear with the previous implementation that there +is only one ecc section with 8 bytes oob sections. We shall return +-ERANGE in the nand_ooblayout_ecc_sp() function when asked for the +second section. + +Signed-off-by: Miquel Raynal +Fixes: 41b207a70d3a ("mtd: nand: implement the default mtd_ooblayout_ops") +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nand_base.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -64,8 +64,14 @@ static int nand_ooblayout_ecc_sp(struct + + if (!section) { + oobregion->offset = 0; +- oobregion->length = 4; ++ if (mtd->oobsize == 16) ++ oobregion->length = 4; ++ else ++ oobregion->length = 3; + } else { ++ if (mtd->oobsize == 8) ++ return -ERANGE; ++ + oobregion->offset = 6; + oobregion->length = ecc->total - 4; + } diff --git a/queue-4.9/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch b/queue-4.9/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch new file mode 100644 index 00000000000..f6461f7a9b7 --- /dev/null +++ b/queue-4.9/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch @@ -0,0 +1,30 @@ +From 1feb26162bee7b2f110facfec71b5c7bdbc7d14d Mon Sep 17 00:00:00 2001 +From: Weston Andros Adamson +Date: Tue, 1 Aug 2017 16:25:01 -0400 +Subject: nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays + +From: Weston Andros Adamson + +commit 1feb26162bee7b2f110facfec71b5c7bdbc7d14d upstream. + +The client was freeing the nfs4_ff_layout_ds, but not the contained +nfs4_ff_ds_version array. + +Signed-off-by: Weston Andros Adamson +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/flexfilelayout/flexfilelayoutdev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -30,6 +30,7 @@ void nfs4_ff_layout_free_deviceid(struct + { + nfs4_print_deviceid(&mirror_ds->id_node.deviceid); + nfs4_pnfs_ds_put(mirror_ds->ds); ++ kfree(mirror_ds->ds_versions); + kfree_rcu(mirror_ds, id_node.rcu); + } + diff --git a/queue-4.9/series b/queue-4.9/series index 257dcd53558..65a78bc494e 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -1,3 +1,32 @@ mm-ratelimit-pfns-busy-info-message.patch mm-fix-list-corruptions-on-shmem-shrinklist.patch futex-remove-unnecessary-warning-from-get_futex_key.patch +xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch +xtensa-mm-cache-add-missing-export_symbols.patch +xtensa-don-t-limit-csum_partial-export-by-config_net.patch +mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch +iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch +iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch +target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch +fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch +nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch +mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch +nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch +drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch +drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch +usb-serial-option-add-d-link-dwm-222-device-id.patch +usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch +usb-serial-pl2303-add-new-aten-device-id.patch +usb-musb-fix-tx-fifo-flush-handling-again.patch +usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch +staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch +iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch +iio-light-tsl2563-use-correct-event-code.patch +staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch +uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch +usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch +usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch +usb-check-for-dropped-connection-before-switching-to-full-speed.patch +usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch +usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch +usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch diff --git a/queue-4.9/staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch b/queue-4.9/staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch new file mode 100644 index 00000000000..21575ceae40 --- /dev/null +++ b/queue-4.9/staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch @@ -0,0 +1,43 @@ +From cef988642cdac44e910a27cb6e8166c96f86a0df Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 28 Jul 2017 16:22:31 +0100 +Subject: staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING + +From: Ian Abbott + +commit cef988642cdac44e910a27cb6e8166c96f86a0df upstream. + +Comedi's read and write file operation handlers (`comedi_read()` and +`comedi_write()`) currently call `copy_to_user()` or `copy_from_user()` +whilst in the `TASK_INTERRUPTIBLE` state, which falls foul of the +`might_fault()` checks when enabled. Fix it by setting the current task +state back to `TASK_RUNNING` a bit earlier before calling these +functions. + +Reported-by: Piotr Gregor +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -2385,6 +2385,7 @@ static ssize_t comedi_write(struct file + continue; + } + ++ set_current_state(TASK_RUNNING); + wp = async->buf_write_ptr; + n1 = min(n, async->prealloc_bufsz - wp); + n2 = n - n1; +@@ -2517,6 +2518,8 @@ static ssize_t comedi_read(struct file * + } + continue; + } ++ ++ set_current_state(TASK_RUNNING); + rp = async->buf_read_ptr; + n1 = min(n, async->prealloc_bufsz - rp); + n2 = n - n1; diff --git a/queue-4.9/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch b/queue-4.9/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch new file mode 100644 index 00000000000..8fc0526691b --- /dev/null +++ b/queue-4.9/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch @@ -0,0 +1,38 @@ +From 105967ad68d2eb1a041bc041f9cf96af2a653b65 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 14 Jul 2017 11:31:03 +0200 +Subject: staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read + +From: Arnd Bergmann + +commit 105967ad68d2eb1a041bc041f9cf96af2a653b65 upstream. + +gcc-7 points out an older regression: + +drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw': +drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context] + +The original code had 'unsigned short' here, but incorrectly got +converted to 'bool'. This reverts the regression and uses a normal +type instead. + +Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.") +Signed-off-by: Arnd Bergmann +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/resolver/ad2s1210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/iio/resolver/ad2s1210.c ++++ b/drivers/staging/iio/resolver/ad2s1210.c +@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_ + long m) + { + struct ad2s1210_state *st = iio_priv(indio_dev); +- bool negative; ++ u16 negative; + int ret = 0; + u16 pos; + s16 vel; diff --git a/queue-4.9/target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch b/queue-4.9/target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch new file mode 100644 index 00000000000..ba3968e5798 --- /dev/null +++ b/queue-4.9/target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch @@ -0,0 +1,116 @@ +From 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Sun, 6 Aug 2017 16:10:03 -0700 +Subject: target: Fix node_acl demo-mode + uncached dynamic shutdown regression + +From: Nicholas Bellinger + +commit 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd upstream. + +This patch fixes a generate_node_acls = 1 + cache_dynamic_acls = 0 +regression, that was introduced by + + commit 01d4d673558985d9a118e1e05026633c3e2ade9b + Author: Nicholas Bellinger + Date: Wed Dec 7 12:55:54 2016 -0800 + +which originally had the proper list_del_init() usage, but was +dropped during list review as it was thought unnecessary by HCH. + +However, list_del_init() usage is required during the special +generate_node_acls = 1 + cache_dynamic_acls = 0 case when +transport_free_session() does a list_del(&se_nacl->acl_list), +followed by target_complete_nacl() doing the same thing. + +This was manifesting as a general protection fault as reported +by Justin: + +kernel: general protection fault: 0000 [#1] SMP +kernel: Modules linked in: +kernel: CPU: 0 PID: 11047 Comm: iscsi_ttx Not tainted 4.13.0-rc2.x86_64.1+ #20 +kernel: Hardware name: Intel Corporation S5500BC/S5500BC, BIOS S5500.86B.01.00.0064.050520141428 05/05/2014 +kernel: task: ffff88026939e800 task.stack: ffffc90007884000 +kernel: RIP: 0010:target_put_nacl+0x49/0xb0 +kernel: RSP: 0018:ffffc90007887d70 EFLAGS: 00010246 +kernel: RAX: dead000000000200 RBX: ffff8802556ca000 RCX: 0000000000000000 +kernel: RDX: dead000000000100 RSI: 0000000000000246 RDI: ffff8802556ce028 +kernel: RBP: ffffc90007887d88 R08: 0000000000000001 R09: 0000000000000000 +kernel: R10: ffffc90007887df8 R11: ffffea0009986900 R12: ffff8802556ce020 +kernel: R13: ffff8802556ce028 R14: ffff8802556ce028 R15: ffffffff88d85540 +kernel: FS: 0000000000000000(0000) GS:ffff88027fc00000(0000) knlGS:0000000000000000 +kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +kernel: CR2: 00007fffe36f5f94 CR3: 0000000009209000 CR4: 00000000003406f0 +kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +kernel: Call Trace: +kernel: transport_free_session+0x67/0x140 +kernel: transport_deregister_session+0x7a/0xc0 +kernel: iscsit_close_session+0x92/0x210 +kernel: iscsit_close_connection+0x5f9/0x840 +kernel: iscsit_take_action_for_connection_exit+0xfe/0x110 +kernel: iscsi_target_tx_thread+0x140/0x1e0 +kernel: ? wait_woken+0x90/0x90 +kernel: kthread+0x124/0x160 +kernel: ? iscsit_thread_get_cpumask+0x90/0x90 +kernel: ? kthread_create_on_node+0x40/0x40 +kernel: ret_from_fork+0x22/0x30 +kernel: Code: 00 48 89 fb 4c 8b a7 48 01 00 00 74 68 4d 8d 6c 24 08 4c +89 ef e8 e8 28 43 00 48 8b 93 20 04 00 00 48 8b 83 28 04 00 00 4c 89 +ef <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 20 +kernel: RIP: target_put_nacl+0x49/0xb0 RSP: ffffc90007887d70 +kernel: ---[ end trace f12821adbfd46fed ]--- + +To address this, go ahead and use proper list_del_list() for all +cases of se_nacl->acl_list deletion. + +Reported-by: Justin Maggard +Tested-by: Justin Maggard +Cc: Justin Maggard +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_tpg.c | 4 ++-- + drivers/target/target_core_transport.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/target/target_core_tpg.c ++++ b/drivers/target/target_core_tpg.c +@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(str + mutex_lock(&tpg->acl_node_mutex); + if (acl->dynamic_node_acl) + acl->dynamic_node_acl = 0; +- list_del(&acl->acl_list); ++ list_del_init(&acl->acl_list); + mutex_unlock(&tpg->acl_node_mutex); + + target_shutdown_sessions(acl); +@@ -540,7 +540,7 @@ int core_tpg_deregister(struct se_portal + * in transport_deregister_session(). + */ + list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) { +- list_del(&nacl->acl_list); ++ list_del_init(&nacl->acl_list); + + core_tpg_wait_for_nacl_pr_ref(nacl); + core_free_device_list_for_node(nacl, se_tpg); +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -465,7 +465,7 @@ static void target_complete_nacl(struct + } + + mutex_lock(&se_tpg->acl_node_mutex); +- list_del(&nacl->acl_list); ++ list_del_init(&nacl->acl_list); + mutex_unlock(&se_tpg->acl_node_mutex); + + core_tpg_wait_for_nacl_pr_ref(nacl); +@@ -537,7 +537,7 @@ void transport_free_session(struct se_se + spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); + + if (se_nacl->dynamic_stop) +- list_del(&se_nacl->acl_list); ++ list_del_init(&se_nacl->acl_list); + } + mutex_unlock(&se_tpg->acl_node_mutex); + diff --git a/queue-4.9/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch b/queue-4.9/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch new file mode 100644 index 00000000000..6d4eae138e4 --- /dev/null +++ b/queue-4.9/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch @@ -0,0 +1,41 @@ +From 89f23d51defcb94a5026d4b5da13faf4e1150a6f Mon Sep 17 00:00:00 2001 +From: Alan Swanson +Date: Wed, 26 Jul 2017 12:03:33 +0100 +Subject: uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069 + +From: Alan Swanson + +commit 89f23d51defcb94a5026d4b5da13faf4e1150a6f upstream. + +Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for +Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already +present in unusual_uas.h. Both in same controller IC family. + +Issue is that MakeMKV fails during key exchange with installed bluray drive +with following error: + +002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' +occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0' + +Signed-off-by: Alan Swanson +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99 + /* Reported-by: Benjamin Tissoires */ + UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, + "Initio Corporation", +- "", ++ "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_NO_ATA_1X), ++ US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE), + + /* Reported-by: Tom Arild Naess */ + UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999, diff --git a/queue-4.9/usb-check-for-dropped-connection-before-switching-to-full-speed.patch b/queue-4.9/usb-check-for-dropped-connection-before-switching-to-full-speed.patch new file mode 100644 index 00000000000..ba92e761a18 --- /dev/null +++ b/queue-4.9/usb-check-for-dropped-connection-before-switching-to-full-speed.patch @@ -0,0 +1,65 @@ +From 94c43b9897abf4ea366ed4dba027494e080c7050 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 1 Aug 2017 10:41:56 -0400 +Subject: USB: Check for dropped connection before switching to full speed + +From: Alan Stern + +commit 94c43b9897abf4ea366ed4dba027494e080c7050 upstream. + +Some buggy USB disk adapters disconnect and reconnect multiple times +during the enumeration procedure. This may lead to a device +connecting at full speed instead of high speed, because when the USB +stack sees that a device isn't able to enumerate at high speed, it +tries to hand the connection over to a full-speed companion +controller. + +The logic for doing this is careful to check that the device is still +connected. But this check is inadequate if the device disconnects and +reconnects before the check is done. The symptom is that a device +works, but much more slowly than it is capable of operating. + +The situation was made worse recently by commit 22547c4cc4fe ("usb: +hub: Wait for connection to be reestablished after port reset"), which +increases the delay following a reset before a disconnect is +recognized, thus giving the device more time to reconnect. + +This patch makes the check more robust. If the device was +disconnected at any time during enumeration, we will now skip the +full-speed handover. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Zdenek Kabelac +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4728,7 +4728,8 @@ hub_power_remaining(struct usb_hub *hub) + static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + u16 portchange) + { +- int status, i; ++ int status = -ENODEV; ++ int i; + unsigned unit_load; + struct usb_device *hdev = hub->hdev; + struct usb_hcd *hcd = bus_to_hcd(hdev->bus); +@@ -4932,9 +4933,10 @@ loop: + + done: + hub_port_disable(hub, port1, 1); +- if (hcd->driver->relinquish_port && !hub->hdev->parent) +- hcd->driver->relinquish_port(hcd, port1); +- ++ if (hcd->driver->relinquish_port && !hub->hdev->parent) { ++ if (status != -ENOTCONN && status != -ENODEV) ++ hcd->driver->relinquish_port(hcd, port1); ++ } + } + + /* Handle physical or logical connection change events. diff --git a/queue-4.9/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch b/queue-4.9/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch new file mode 100644 index 00000000000..f369d6d21c2 --- /dev/null +++ b/queue-4.9/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch @@ -0,0 +1,41 @@ +From 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 25 Jul 2017 09:31:33 -0500 +Subject: usb: core: unlink urbs from the tail of the endpoint's urb_list + +From: Bin Liu + +commit 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e upstream. + +While unlink an urb, if the urb has been programmed in the controller, +the controller driver might do some hw related actions to tear down the +urb. + +Currently usb_hcd_flush_endpoint() passes each urb from the head of the +endpoint's urb_list to the controller driver, which could make the +controller driver think each urb has been programmed and take the +unnecessary actions for each urb. + +This patch changes the behavior in usb_hcd_flush_endpoint() to pass the +urbs from the tail of the list, to avoid any unnecessary actions in an +controller driver. + +Acked-by: Alan Stern +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1877,7 +1877,7 @@ void usb_hcd_flush_endpoint(struct usb_d + /* No more submits can occur */ + spin_lock_irq(&hcd_urb_list_lock); + rescan: +- list_for_each_entry (urb, &ep->urb_list, urb_list) { ++ list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) { + int is_in; + + if (urb->unlinked) diff --git a/queue-4.9/usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch b/queue-4.9/usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch new file mode 100644 index 00000000000..b0e5bfd01e8 --- /dev/null +++ b/queue-4.9/usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch @@ -0,0 +1,67 @@ +From aca5b9ebd096039657417c321a9252c696b359c2 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 2 Aug 2017 21:06:35 +0900 +Subject: usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() calling + +From: Yoshihiro Shimoda + +commit aca5b9ebd096039657417c321a9252c696b359c2 upstream. + +According to the gadget.h, a "complete" function will always be called +with interrupts disabled. However, sometimes usb3_request_done() function +is called with interrupts enabled. So, this function should be held +by spin_lock_irqsave() to disable interruption. Also, this driver has +to call spin_unlock() to avoid spinlock recursion by this driver before +calling usb_gadget_giveback_request(). + +Reported-by: Kazuya Mizuguchi +Tested-by: Kazuya Mizuguchi +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -685,21 +685,32 @@ static struct renesas_usb3_request *usb3 + return usb3_req; + } + +-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep, +- struct renesas_usb3_request *usb3_req, int status) ++static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep, ++ struct renesas_usb3_request *usb3_req, ++ int status) + { + struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep); +- unsigned long flags; + + dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n", + usb3_ep->num, usb3_req->req.length, usb3_req->req.actual, + status); + usb3_req->req.status = status; +- spin_lock_irqsave(&usb3->lock, flags); + usb3_ep->started = false; + list_del_init(&usb3_req->queue); +- spin_unlock_irqrestore(&usb3->lock, flags); ++ spin_unlock(&usb3->lock); + usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req); ++ spin_lock(&usb3->lock); ++} ++ ++static void usb3_request_done(struct renesas_usb3_ep *usb3_ep, ++ struct renesas_usb3_request *usb3_req, int status) ++{ ++ struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&usb3->lock, flags); ++ __usb3_request_done(usb3_ep, usb3_req, status); ++ spin_unlock_irqrestore(&usb3->lock, flags); + } + + static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3) diff --git a/queue-4.9/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch b/queue-4.9/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch new file mode 100644 index 00000000000..67043b04444 --- /dev/null +++ b/queue-4.9/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch @@ -0,0 +1,40 @@ +From cd5a6a4fdaba150089af2afc220eae0fef74878a Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 25 Jul 2017 23:58:50 +0200 +Subject: USB: hcd: Mark secondary HCD as dead if the primary one died + +From: Rafael J. Wysocki + +commit cd5a6a4fdaba150089af2afc220eae0fef74878a upstream. + +Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared +HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for +the primary one. + +Among other thigs, this prevents check_root_hub_suspended() from +returning -EBUSY for dead HCDs which helps to work around system +suspend issues in some situations. + +This actually fixes occasional suspend failures on one of my test +machines. + +Suggested-by: Alan Stern +Signed-off-by: Rafael J. Wysocki +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2474,6 +2474,8 @@ void usb_hc_died (struct usb_hcd *hcd) + } + if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) { + hcd = hcd->shared_hcd; ++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); ++ set_bit(HCD_FLAG_DEAD, &hcd->flags); + if (hcd->rh_registered) { + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + diff --git a/queue-4.9/usb-musb-fix-tx-fifo-flush-handling-again.patch b/queue-4.9/usb-musb-fix-tx-fifo-flush-handling-again.patch new file mode 100644 index 00000000000..5339929fcfe --- /dev/null +++ b/queue-4.9/usb-musb-fix-tx-fifo-flush-handling-again.patch @@ -0,0 +1,36 @@ +From 45d73860530a14c608f410b91c6c341777bfa85d Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 25 Jul 2017 09:31:34 -0500 +Subject: usb: musb: fix tx fifo flush handling again + +From: Bin Liu + +commit 45d73860530a14c608f410b91c6c341777bfa85d upstream. + +commit 68fe05e2a451 ("usb: musb: fix tx fifo flush handling") drops the +1ms delay trying to solve the long disconnect time issue when +application queued many tx urbs. However, the 1ms delay is needed for +some use cases, for example, without the delay, reconnecting AR9271 WIFI +dongle no longer works if the connection is dropped from the AP. + +So let's add back the 1ms delay in musb_h_tx_flush_fifo(), and solve the +long disconnect time problem with a separate patch for +usb_hcd_flush_endpoint(). + +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_host.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct + "Could not flush host TX%d fifo: csr: %04x\n", + ep->epnum, csr)) + return; ++ mdelay(1); + } + } + diff --git a/queue-4.9/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch b/queue-4.9/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch new file mode 100644 index 00000000000..0936ec81337 --- /dev/null +++ b/queue-4.9/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch @@ -0,0 +1,37 @@ +From 7496cfe5431f21da5d27a8388c326397e3f0a5db Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Tue, 8 Aug 2017 17:51:27 +0800 +Subject: usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter + +From: Kai-Heng Feng + +commit 7496cfe5431f21da5d27a8388c326397e3f0a5db upstream. + +Moshi USB to Ethernet Adapter internally uses a Genesys Logic hub to +connect to Realtek r8153. + +The Realtek r8153 ethernet does not work on the internal hub, no-lpm quirk +can make it work. + +Since another r8153 dongle at my hand does not have the issue, so add +the quirk to the Genesys Logic hub instead. + +Signed-off-by: Kai-Heng Feng +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -150,6 +150,9 @@ static const struct usb_device_id usb_qu + /* appletouch */ + { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ ++ { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* Avision AV600U */ + { USB_DEVICE(0x0638, 0x0a13), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, diff --git a/queue-4.9/usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch b/queue-4.9/usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch new file mode 100644 index 00000000000..8cb9295bc26 --- /dev/null +++ b/queue-4.9/usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch @@ -0,0 +1,54 @@ +From 2acecd58969897795cf015c9057ebd349a3fda8a Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 2 Aug 2017 13:21:45 +0900 +Subject: usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3 + +From: Yoshihiro Shimoda + +commit 2acecd58969897795cf015c9057ebd349a3fda8a upstream. + +The latest HW manual (Rev.0.55) shows us this UGCTRL2.VBUSSEL bit. +If the bit sets to 1, the VBUS drive is controlled by phy related +registers (called "UCOM Registers" on the manual). Since R-Car Gen3 +environment will control VBUS by phy-rcar-gen3-usb2 driver, +the UGCTRL2.VBUSSEL bit should be set to 1. So, this patch fixes +the register's value. Otherwise, even if the ID pin indicates to +peripheral, the R-Car will output USBn_PWEN to 1 when a host driver +is running. + +Fixes: de18757e272d ("usb: renesas_usbhs: add R-Car Gen3 power control" +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/rcar3.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/renesas_usbhs/rcar3.c ++++ b/drivers/usb/renesas_usbhs/rcar3.c +@@ -20,9 +20,13 @@ + /* Low Power Status register (LPSTS) */ + #define LPSTS_SUSPM 0x4000 + +-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */ ++/* ++ * USB General control register 2 (UGCTRL2) ++ * Remarks: bit[31:11] and bit[9:6] should be 0 ++ */ + #define UGCTRL2_RESERVED_3 0x00000001 /* bit[3:0] should be B'0001 */ + #define UGCTRL2_USB0SEL_OTG 0x00000030 ++#define UGCTRL2_VBUSSEL 0x00000400 + + static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data) + { +@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct + { + struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev); + +- usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG); ++ usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG | ++ UGCTRL2_VBUSSEL); + + if (enable) { + usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM); diff --git a/queue-4.9/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch b/queue-4.9/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch new file mode 100644 index 00000000000..a34d7554048 --- /dev/null +++ b/queue-4.9/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch @@ -0,0 +1,32 @@ +From 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f Mon Sep 17 00:00:00 2001 +From: Stefan Triller +Date: Fri, 30 Jun 2017 14:44:03 +0200 +Subject: USB: serial: cp210x: add support for Qivicon USB ZigBee dongle + +From: Stefan Triller + +commit 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f upstream. + +The German Telekom offers a ZigBee USB Stick under the brand name Qivicon +for their SmartHome Home Base in its 1. Generation. The productId is not +known by the according kernel module, this patch adds support for it. + +Signed-off-by: Stefan Triller +Reviewed-by: Frans Klaver +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -136,6 +136,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ ++ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/queue-4.9/usb-serial-option-add-d-link-dwm-222-device-id.patch b/queue-4.9/usb-serial-option-add-d-link-dwm-222-device-id.patch new file mode 100644 index 00000000000..a52e3d20529 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-d-link-dwm-222-device-id.patch @@ -0,0 +1,30 @@ +From fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 Mon Sep 17 00:00:00 2001 +From: Hector Martin +Date: Wed, 2 Aug 2017 00:45:06 +0900 +Subject: USB: serial: option: add D-Link DWM-222 device ID + +From: Hector Martin + +commit fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 upstream. + +Add device id for D-Link DWM-222. + +Signed-off-by: Hector Martin +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2025,6 +2025,8 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ diff --git a/queue-4.9/usb-serial-pl2303-add-new-aten-device-id.patch b/queue-4.9/usb-serial-pl2303-add-new-aten-device-id.patch new file mode 100644 index 00000000000..26d0180dce3 --- /dev/null +++ b/queue-4.9/usb-serial-pl2303-add-new-aten-device-id.patch @@ -0,0 +1,40 @@ +From 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 10 Aug 2017 11:54:12 -0700 +Subject: USB: serial: pl2303: add new ATEN device id + +From: Greg Kroah-Hartman + +commit 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e upstream. + +This adds a new ATEN device id for a new pl2303-based device. + +Reported-by: Peter Kuo +Cc: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -49,6 +49,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, ++ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, + { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, + { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -27,6 +27,7 @@ + #define ATEN_VENDOR_ID 0x0557 + #define ATEN_VENDOR_ID2 0x0547 + #define ATEN_PRODUCT_ID 0x2008 ++#define ATEN_PRODUCT_UC485 0x2021 + #define ATEN_PRODUCT_ID2 0x2118 + + #define IODATA_VENDOR_ID 0x04bb diff --git a/queue-4.9/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch b/queue-4.9/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch new file mode 100644 index 00000000000..6d2896b82b3 --- /dev/null +++ b/queue-4.9/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch @@ -0,0 +1,86 @@ +From e788787ef4f9c24aafefc480a8da5f92b914e5e6 Mon Sep 17 00:00:00 2001 +From: Sandeep Singh +Date: Fri, 4 Aug 2017 16:35:56 +0530 +Subject: usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume + +From: Sandeep Singh + +commit e788787ef4f9c24aafefc480a8da5f92b914e5e6 upstream. + +Certain HP keyboards would keep inputting a character automatically which +is the wake-up key after S3 resume + +On some AMD platforms USB host fails to respond (by holding resume-K) to +USB device (an HP keyboard) resume request within 1ms (TURSM) and ensures +that resume is signaled for at least 20 ms (TDRSMDN), which is defined in +USB 2.0 spec. The result is that the keyboard is out of function. + +In SNPS USB design, the host responds to the resume request only after +system gets back to S0 and the host gets to functional after the internal +HW restore operation that is more than 1 second after the initial resume +request from the USB device. + +As a workaround for specific keyboard ID(HP Keyboards), applying port reset +after resume when the keyboard is plugged in. + +Signed-off-by: Sandeep Singh +Signed-off-by: Shyam Sundar S K +cc: Nehal Shah +Reviewed-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 1 + + drivers/usb/host/pci-quirks.c | 17 ++++++++++++----- + 2 files changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -252,6 +252,7 @@ static const struct usb_device_id usb_am + { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Optical Mouse M90/M100 */ + { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME }, +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -98,6 +98,7 @@ enum amd_chipset_gen { + AMD_CHIPSET_HUDSON2, + AMD_CHIPSET_BOLTON, + AMD_CHIPSET_YANGTZE, ++ AMD_CHIPSET_TAISHAN, + AMD_CHIPSET_UNKNOWN, + }; + +@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(stru + pinfo->sb_type.gen = AMD_CHIPSET_SB700; + else if (rev >= 0x40 && rev <= 0x4f) + pinfo->sb_type.gen = AMD_CHIPSET_SB800; ++ } ++ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, ++ 0x145c, NULL); ++ if (pinfo->smbus_dev) { ++ pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN; + } else { + pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, + PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL); +@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(stru + { + /* Make sure amd chipset type has already been initialized */ + usb_amd_find_chipset_info(); +- if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE) +- return 0; +- +- dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); +- return 1; ++ if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE || ++ amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) { ++ dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); ++ return 1; ++ } ++ return 0; + } + EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk); + diff --git a/queue-4.9/xtensa-don-t-limit-csum_partial-export-by-config_net.patch b/queue-4.9/xtensa-don-t-limit-csum_partial-export-by-config_net.patch new file mode 100644 index 00000000000..05420a1e1a1 --- /dev/null +++ b/queue-4.9/xtensa-don-t-limit-csum_partial-export-by-config_net.patch @@ -0,0 +1,35 @@ +From 7f81e55c737a8fa82c71f290945d729a4902f8d2 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Tue, 1 Aug 2017 11:02:46 -0700 +Subject: xtensa: don't limit csum_partial export by CONFIG_NET + +From: Max Filippov + +commit 7f81e55c737a8fa82c71f290945d729a4902f8d2 upstream. + +csum_partial and csum_partial_copy_generic are defined unconditionally +and are available even when CONFIG_NET is disabled. They are used not +only by the network drivers, but also by scsi and media. +Don't limit these functions export by CONFIG_NET. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c +index d159e9b9c018..672391003e40 100644 +--- a/arch/xtensa/kernel/xtensa_ksyms.c ++++ b/arch/xtensa/kernel/xtensa_ksyms.c +@@ -94,13 +94,11 @@ unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v) + } + EXPORT_SYMBOL(__sync_fetch_and_or_4); + +-#ifdef CONFIG_NET + /* + * Networking support + */ + EXPORT_SYMBOL(csum_partial); + EXPORT_SYMBOL(csum_partial_copy_generic); +-#endif /* CONFIG_NET */ + + /* + * Architecture-specific symbols diff --git a/queue-4.9/xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch b/queue-4.9/xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch new file mode 100644 index 00000000000..475b5a0b34a --- /dev/null +++ b/queue-4.9/xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch @@ -0,0 +1,74 @@ +From 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Fri, 28 Jul 2017 17:42:59 -0700 +Subject: xtensa: fix cache aliasing handling code for WT cache + +From: Max Filippov + +commit 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 upstream. + +Currently building kernel for xtensa core with aliasing WT cache fails +with the following messages: + + mm/memory.c:2152: undefined reference to `flush_dcache_page' + mm/memory.c:2332: undefined reference to `local_flush_cache_page' + mm/memory.c:1919: undefined reference to `local_flush_cache_range' + mm/memory.c:4179: undefined reference to `copy_to_user_page' + mm/memory.c:4183: undefined reference to `copy_from_user_page' + +This happens because implementation of these functions is only compiled +when data cache is WB, which looks wrong: even when data cache doesn't +need flushing it still needs invalidation. The functions like +__flush_[invalidate_]dcache_* are correctly defined for both WB and WT +caches (and even if they weren't that'd still be ok, just slower). + +Fix this by providing the same implementation of the above functions for +both WB and WT cache. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/mm/cache.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/arch/xtensa/mm/cache.c ++++ b/arch/xtensa/mm/cache.c +@@ -120,10 +120,6 @@ void copy_user_highpage(struct page *dst + preempt_enable(); + } + +-#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ +- +-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK +- + /* + * Any time the kernel writes to a user page cache page, or it is about to + * read from a page cache page this routine is called. +@@ -208,7 +204,7 @@ void local_flush_cache_page(struct vm_ar + __invalidate_icache_page_alias(virt, phys); + } + +-#endif ++#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ + + void + update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep) +@@ -225,7 +221,7 @@ update_mmu_cache(struct vm_area_struct * + + flush_tlb_page(vma, addr); + +-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK ++#if (DCACHE_WAY_SIZE > PAGE_SIZE) + + if (!PageReserved(page) && test_bit(PG_arch_1, &page->flags)) { + unsigned long phys = page_to_phys(page); +@@ -256,7 +252,7 @@ update_mmu_cache(struct vm_area_struct * + * flush_dcache_page() on the page. + */ + +-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK ++#if (DCACHE_WAY_SIZE > PAGE_SIZE) + + void copy_to_user_page(struct vm_area_struct *vma, struct page *page, + unsigned long vaddr, void *dst, const void *src, diff --git a/queue-4.9/xtensa-mm-cache-add-missing-export_symbols.patch b/queue-4.9/xtensa-mm-cache-add-missing-export_symbols.patch new file mode 100644 index 00000000000..2f05a03c98f --- /dev/null +++ b/queue-4.9/xtensa-mm-cache-add-missing-export_symbols.patch @@ -0,0 +1,61 @@ +From bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Tue, 1 Aug 2017 11:15:15 -0700 +Subject: xtensa: mm/cache: add missing EXPORT_SYMBOLs + +From: Max Filippov + +commit bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed upstream. + +Functions clear_user_highpage, copy_user_highpage, flush_dcache_page, +local_flush_cache_range and local_flush_cache_page may be used from +modules. Export them. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c +index dbb1cdef3663..3c75c4e597da 100644 +--- a/arch/xtensa/mm/cache.c ++++ b/arch/xtensa/mm/cache.c +@@ -103,6 +103,7 @@ void clear_user_highpage(struct page *page, unsigned long vaddr) + clear_page_alias(kvaddr, paddr); + preempt_enable(); + } ++EXPORT_SYMBOL(clear_user_highpage); + + void copy_user_highpage(struct page *dst, struct page *src, + unsigned long vaddr, struct vm_area_struct *vma) +@@ -119,6 +120,7 @@ void copy_user_highpage(struct page *dst, struct page *src, + copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr); + preempt_enable(); + } ++EXPORT_SYMBOL(copy_user_highpage); + + /* + * Any time the kernel writes to a user page cache page, or it is about to +@@ -172,7 +174,7 @@ void flush_dcache_page(struct page *page) + + /* There shouldn't be an entry in the cache for this page anymore. */ + } +- ++EXPORT_SYMBOL(flush_dcache_page); + + /* + * For now, flush the whole cache. FIXME?? +@@ -184,6 +186,7 @@ void local_flush_cache_range(struct vm_area_struct *vma, + __flush_invalidate_dcache_all(); + __invalidate_icache_all(); + } ++EXPORT_SYMBOL(local_flush_cache_range); + + /* + * Remove any entry in the cache for this page. +@@ -203,6 +206,7 @@ void local_flush_cache_page(struct vm_area_struct *vma, unsigned long address, + __flush_invalidate_dcache_page_alias(virt, phys); + __invalidate_icache_page_alias(virt, phys); + } ++EXPORT_SYMBOL(local_flush_cache_page); + + #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ + -- 2.47.3