ipv6-inhibit-ipv4-mapped-src-address-on-the-wire.patch
log2-make-order_base_2-behave-correctly-on-const-input-value-zero.patch
sparc64-make-string-buffers-large-enough.patch
+configfs-fix-race-between-create_link-and-configfs_rmdir.patch
+can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch
+cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch
+vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch
+mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch
+serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch
+x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch
+mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch
+staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch
+iio-proximity-as3935-recalibrate-rco-after-resume.patch
+usb-hub-fix-ss-max-number-of-ports.patch
+usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch
+pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch
+usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch
+usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch
+usb-r8a66597-hcd-decrease-timeout.patch
+drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch
--- /dev/null
+From 12ee4022f67f8854061b46e5c0a7ad6258ab66c2 Mon Sep 17 00:00:00 2001
+From: "Subhransu S. Prusty" <subhransu.s.prusty@intel.com>
+Date: Wed, 12 Apr 2017 09:54:00 +0530
+Subject: ALSA: hda: Add Geminilake id to SKL_PLUS
+
+From: Subhransu S. Prusty <subhransu.s.prusty@intel.com>
+
+commit 12ee4022f67f8854061b46e5c0a7ad6258ab66c2 upstream.
+
+Geminilake is Skylake family platform. So add it's id to skl_plus check.
+
+Fixes: 126cfa2f5e15 ("ALSA: hda: Add Geminilake HDMI codec ID")
+Signed-off-by: Subhransu S. Prusty <subhransu.s.prusty@intel.com>
+Cc: Senthilnathan Veppur <senthilnathanx.veppur@intel.com>
+Cc: Vinod Koul <vinod.koul@intel.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -369,8 +369,10 @@ enum {
+ #define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71)
+ #define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0)
+ #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
++#define IS_GLK(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x3198)
+ #define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \
+- IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci)
++ IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) || \
++ IS_GLK(pci)
+
+ static char *driver_short_names[] = {
+ [AZX_DRIVER_ICH] = "HDA Intel",
--- /dev/null
+From f83914fdfcc3ecb62a5a83eeb609ff59a9c2052d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 12 May 2017 14:34:37 +0200
+Subject: ALSA: usb-audio: fix Amanero Combo384 quirk on big-endian hosts
+
+From: Johan Hovold <johan@kernel.org>
+
+commit f83914fdfcc3ecb62a5a83eeb609ff59a9c2052d upstream.
+
+Add missing endianness conversion when using the USB device-descriptor
+bcdDevice field when applying the Amanero Combo384 (endianness!) quirk.
+
+Fixes: 3eff682d765b ("ALSA: usb-audio: Support both DSD LE/BE Amanero firmware versions")
+Cc: Jussi Laako <jussi@sonarnerd.net>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1364,7 +1364,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+ /* Amanero Combo384 USB interface with native DSD support */
+ case USB_ID(0x16d0, 0x071a):
+ if (fp->altsetting == 2) {
+- switch (chip->dev->descriptor.bcdDevice) {
++ switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
+ case 0x199:
+ return SNDRV_PCM_FMTBIT_DSD_U32_LE;
+ case 0x19b:
--- /dev/null
+From 5cda3ee5138e91ac369ed9d0b55eab0dab077686 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Sun, 4 Jun 2017 14:03:42 +0200
+Subject: can: gs_usb: fix memory leak in gs_cmd_reset()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 5cda3ee5138e91ac369ed9d0b55eab0dab077686 upstream.
+
+This patch adds the missing kfree() in gs_cmd_reset() to free the
+memory that is not used anymore after usb_control_msg().
+
+Cc: Maximilian Schneider <max@schneidersoft.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/gs_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -265,6 +265,8 @@ static int gs_cmd_reset(struct gs_usb *g
+ sizeof(*dm),
+ 1000);
+
++ kfree(dm);
++
+ return rc;
+ }
+
--- /dev/null
+From b94aac64a4c17c5af92f9b4ba7164c5b384d5c02 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Wed, 7 Jun 2017 12:07:51 -0300
+Subject: [media] cec: race fix: don't return -ENONET in cec_receive()
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit b94aac64a4c17c5af92f9b4ba7164c5b384d5c02 upstream.
+
+When calling CEC_RECEIVE do not check if the adapter is configured.
+Typically CEC_RECEIVE is called after a select() and if that indicates
+that there are messages in the receive queue, then you should always be
+able to dequeue a message.
+
+The race condition here is that a message has been received and is
+queued, so select() tells userspace that a message is available. But
+before the application calls CEC_RECEIVE the adapter is unconfigured
+(e.g. the HDMI cable is removed). Now select will always report that
+there is a message, but calling CEC_RECEIVE will always return -ENONET
+because the adapter is no longer configured and so will never actually
+dequeue the message.
+
+There is really no need for this check, and in fact the ENONET error
+code was never documented for CEC_RECEIVE. This may have been a left-over
+of old code that was never updated.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/cec/cec-api.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/media/cec/cec-api.c
++++ b/drivers/media/cec/cec-api.c
+@@ -267,16 +267,10 @@ static long cec_receive(struct cec_adapt
+ bool block, struct cec_msg __user *parg)
+ {
+ struct cec_msg msg = {};
+- long err = 0;
++ long err;
+
+ if (copy_from_user(&msg, parg, sizeof(msg)))
+ return -EFAULT;
+- mutex_lock(&adap->lock);
+- if (!adap->is_configured && fh->mode_follower < CEC_MODE_MONITOR)
+- err = -ENONET;
+- mutex_unlock(&adap->lock);
+- if (err)
+- return err;
+
+ err = cec_receive_msg(fh, &msg, block);
+ if (err)
--- /dev/null
+From 1e9b71d53ddc3b8df81ef6be052e31b70442a47f Mon Sep 17 00:00:00 2001
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Wed, 8 Mar 2017 09:30:50 -0300
+Subject: [media] coda: restore original firmware locations
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+commit 1e9b71d53ddc3b8df81ef6be052e31b70442a47f upstream.
+
+Recently, an unfinished patch was merged that added a third entry to the
+beginning of the array of firmware locations without changing the code
+to also look at the third element, thus pushing an old firmware location
+off the list.
+
+Fixes: 8af7779f3cbc ("[media] coda: add Freescale firmware compatibility location")
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Baruch Siach <baruch@tkos.co.il>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/coda/coda-common.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -2126,7 +2126,12 @@ static void coda_fw_callback(const struc
+
+ static int coda_firmware_request(struct coda_dev *dev)
+ {
+- char *fw = dev->devtype->firmware[dev->firmware];
++ char *fw;
++
++ if (dev->firmware >= ARRAY_SIZE(dev->devtype->firmware))
++ return -EINVAL;
++
++ fw = dev->devtype->firmware[dev->firmware];
+
+ dev_dbg(&dev->plat_dev->dev, "requesting firmware '%s' for %s\n", fw,
+ coda_product_name(dev->devtype->product));
+@@ -2142,16 +2147,16 @@ static void coda_fw_callback(const struc
+ struct platform_device *pdev = dev->plat_dev;
+ int i, ret;
+
+- if (!fw && dev->firmware == 1) {
+- v4l2_err(&dev->v4l2_dev, "firmware request failed\n");
+- goto put_pm;
+- }
+ if (!fw) {
+- dev->firmware = 1;
+- coda_firmware_request(dev);
++ dev->firmware++;
++ ret = coda_firmware_request(dev);
++ if (ret < 0) {
++ v4l2_err(&dev->v4l2_dev, "firmware request failed\n");
++ goto put_pm;
++ }
+ return;
+ }
+- if (dev->firmware == 1) {
++ if (dev->firmware > 0) {
+ /*
+ * Since we can't suppress warnings for failed asynchronous
+ * firmware requests, report that the fallback firmware was
--- /dev/null
+From ba80aa909c99802c428682c352b0ee0baac0acd3 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 8 Jun 2017 04:51:54 +0000
+Subject: configfs: Fix race between create_link and configfs_rmdir
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit ba80aa909c99802c428682c352b0ee0baac0acd3 upstream.
+
+This patch closes a long standing race in configfs between
+the creation of a new symlink in create_link(), while the
+symlink target's config_item is being concurrently removed
+via configfs_rmdir().
+
+This can happen because the symlink target's reference
+is obtained by config_item_get() in create_link() before
+the CONFIGFS_USET_DROPPING bit set by configfs_detach_prep()
+during configfs_rmdir() shutdown is actually checked..
+
+This originally manifested itself on ppc64 on v4.8.y under
+heavy load using ibmvscsi target ports with Novalink API:
+
+[ 7877.289863] rpadlpar_io: slot U8247.22L.212A91A-V1-C8 added
+[ 7879.893760] ------------[ cut here ]------------
+[ 7879.893768] WARNING: CPU: 15 PID: 17585 at ./include/linux/kref.h:46 config_item_get+0x7c/0x90 [configfs]
+[ 7879.893811] CPU: 15 PID: 17585 Comm: targetcli Tainted: G O 4.8.17-customv2.22 #12
+[ 7879.893812] task: c00000018a0d3400 task.stack: c0000001f3b40000
+[ 7879.893813] NIP: d000000002c664ec LR: d000000002c60980 CTR: c000000000b70870
+[ 7879.893814] REGS: c0000001f3b43810 TRAP: 0700 Tainted: G O (4.8.17-customv2.22)
+[ 7879.893815] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28222242 XER: 00000000
+[ 7879.893820] CFAR: d000000002c664bc SOFTE: 1
+ GPR00: d000000002c60980 c0000001f3b43a90 d000000002c70908 c0000000fbc06820
+ GPR04: c0000001ef1bd900 0000000000000004 0000000000000001 0000000000000000
+ GPR08: 0000000000000000 0000000000000001 d000000002c69560 d000000002c66d80
+ GPR12: c000000000b70870 c00000000e798700 c0000001f3b43ca0 c0000001d4949d40
+ GPR16: c00000014637e1c0 0000000000000000 0000000000000000 c0000000f2392940
+ GPR20: c0000001f3b43b98 0000000000000041 0000000000600000 0000000000000000
+ GPR24: fffffffffffff000 0000000000000000 d000000002c60be0 c0000001f1dac490
+ GPR28: 0000000000000004 0000000000000000 c0000001ef1bd900 c0000000f2392940
+[ 7879.893839] NIP [d000000002c664ec] config_item_get+0x7c/0x90 [configfs]
+[ 7879.893841] LR [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
+[ 7879.893842] Call Trace:
+[ 7879.893844] [c0000001f3b43ac0] [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
+[ 7879.893847] [c0000001f3b43b10] [c000000000329770] do_dentry_open+0x2c0/0x460
+[ 7879.893849] [c0000001f3b43b70] [c000000000344480] path_openat+0x210/0x1490
+[ 7879.893851] [c0000001f3b43c80] [c00000000034708c] do_filp_open+0xfc/0x170
+[ 7879.893853] [c0000001f3b43db0] [c00000000032b5bc] do_sys_open+0x1cc/0x390
+[ 7879.893856] [c0000001f3b43e30] [c000000000009584] system_call+0x38/0xec
+[ 7879.893856] Instruction dump:
+[ 7879.893858] 409d0014 38210030 e8010010 7c0803a6 4e800020 3d220000 e94981e0 892a0000
+[ 7879.893861] 2f890000 409effe0 39200001 992a0000 <0fe00000> 4bffffd0 60000000 60000000
+[ 7879.893866] ---[ end trace 14078f0b3b5ad0aa ]---
+
+To close this race, go ahead and obtain the symlink's target
+config_item reference only after the existing CONFIGFS_USET_DROPPING
+check succeeds.
+
+This way, if configfs_rmdir() wins create_link() will return -ENONET,
+and if create_link() wins configfs_rmdir() will return -EBUSY.
+
+Reported-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
+Tested-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/configfs/symlink.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/configfs/symlink.c
++++ b/fs/configfs/symlink.c
+@@ -83,14 +83,13 @@ static int create_link(struct config_ite
+ ret = -ENOMEM;
+ sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL);
+ if (sl) {
+- sl->sl_target = config_item_get(item);
+ spin_lock(&configfs_dirent_lock);
+ if (target_sd->s_type & CONFIGFS_USET_DROPPING) {
+ spin_unlock(&configfs_dirent_lock);
+- config_item_put(item);
+ kfree(sl);
+ return -ENOENT;
+ }
++ sl->sl_target = config_item_get(item);
+ list_add(&sl->sl_list, &target_sd->s_links);
+ spin_unlock(&configfs_dirent_lock);
+ ret = configfs_create_link(sl, parent_item->ci_dentry,
--- /dev/null
+From b8e11f7d2791bd9320be1c6e772a60b2aa093e45 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomasz=20Wilczy=C5=84ski?= <twilczynski@naver.com>
+Date: Sun, 11 Jun 2017 17:28:39 +0900
+Subject: cpufreq: conservative: Allow down_threshold to take values from 1 to 10
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Wilczyński <twilczynski@naver.com>
+
+commit b8e11f7d2791bd9320be1c6e772a60b2aa093e45 upstream.
+
+Commit 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency
+decrease checking) removed the 10 point substraction when comparing the
+load against down_threshold but did not remove the related limit for the
+down_threshold value. As a result, down_threshold lower than 11 is not
+allowed even though values from 1 to 10 do work correctly too. The
+comment ("cannot be lower than 11 otherwise freq will not fall") also
+does not apply after removing the substraction.
+
+For this reason, allow down_threshold to take any value from 1 to 99
+and fix the related comment.
+
+Fixes: 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency decrease checking)
+Signed-off-by: Tomasz Wilczyński <twilczynski@naver.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq_conservative.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq_conservative.c
++++ b/drivers/cpufreq/cpufreq_conservative.c
+@@ -185,8 +185,8 @@ static ssize_t store_down_threshold(stru
+ int ret;
+ ret = sscanf(buf, "%u", &input);
+
+- /* cannot be lower than 11 otherwise freq will not fall */
+- if (ret != 1 || input < 11 || input > 100 ||
++ /* cannot be lower than 1 otherwise freq will not fall */
++ if (ret != 1 || input < 1 || input > 100 ||
+ input >= dbs_data->up_threshold)
+ return -EINVAL;
+
--- /dev/null
+From 8128a31eaadbcdfa37774bbd28f3f00bac69996a Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 8 May 2017 15:55:17 -0700
+Subject: drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 8128a31eaadbcdfa37774bbd28f3f00bac69996a upstream.
+
+c2port_device_register() never returns NULL, it uses error pointers.
+
+Link: http://lkml.kernel.org/r/20170412083321.GC3250@mwanda
+Fixes: 65131cd52b9e ("c2port: add c2port support for Eurotech Duramar 2150")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Rodolfo Giometti <giometti@linux.it>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/c2port/c2port-duramar2150.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/c2port/c2port-duramar2150.c
++++ b/drivers/misc/c2port/c2port-duramar2150.c
+@@ -129,8 +129,8 @@ static int __init duramar2150_c2port_ini
+
+ duramar2150_c2port_dev = c2port_device_register("uc",
+ &duramar2150_c2port_ops, NULL);
+- if (!duramar2150_c2port_dev) {
+- ret = -ENODEV;
++ if (IS_ERR(duramar2150_c2port_dev)) {
++ ret = PTR_ERR(duramar2150_c2port_dev);
+ goto free_region;
+ }
+
--- /dev/null
+From bea10413934dcf98cb9b2dfcdc56e1d28f192897 Mon Sep 17 00:00:00 2001
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+Date: Tue, 13 Jun 2017 07:17:10 +0200
+Subject: drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+commit bea10413934dcf98cb9b2dfcdc56e1d28f192897 upstream.
+
+Commit d63c277dc672e0
+("drm/amdgpu: Make display watermark calculations more accurate")
+made watermark calculations more accurate, but not for > 4k
+resolutions on 32-Bit architectures, as it introduced an integer
+overflow for those setups and resolutions.
+
+Fix this by proper u64 casting and division.
+
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Fixes: d63c277dc672 ("drm/amdgpu: Make display watermark calculations more accurate")
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 7 +++++--
+ drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 7 +++++--
+ drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 7 +++++--
+ drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 7 +++++--
+ 4 files changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+@@ -1207,8 +1207,11 @@ static void dce_v10_0_program_watermarks
+ u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
+
+ if (amdgpu_crtc->base.enabled && num_heads && mode) {
+- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
++ (u32)mode->clock);
++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
++ (u32)mode->clock);
++ line_time = min(line_time, (u32)65535);
+
+ /* watermark for high clocks */
+ if (adev->pm.dpm_enabled) {
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+@@ -1176,8 +1176,11 @@ static void dce_v11_0_program_watermarks
+ u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
+
+ if (amdgpu_crtc->base.enabled && num_heads && mode) {
+- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
++ (u32)mode->clock);
++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
++ (u32)mode->clock);
++ line_time = min(line_time, (u32)65535);
+
+ /* watermark for high clocks */
+ if (adev->pm.dpm_enabled) {
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+@@ -983,8 +983,11 @@ static void dce_v6_0_program_watermarks(
+ fixed20_12 a, b, c;
+
+ if (amdgpu_crtc->base.enabled && num_heads && mode) {
+- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
++ (u32)mode->clock);
++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
++ (u32)mode->clock);
++ line_time = min(line_time, (u32)65535);
+ priority_a_cnt = 0;
+ priority_b_cnt = 0;
+
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+@@ -1091,8 +1091,11 @@ static void dce_v8_0_program_watermarks(
+ u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
+
+ if (amdgpu_crtc->base.enabled && num_heads && mode) {
+- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
++ (u32)mode->clock);
++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
++ (u32)mode->clock);
++ line_time = min(line_time, (u32)65535);
+
+ /* watermark for high clocks */
+ if (adev->pm.dpm_enabled) {
--- /dev/null
+From 4681ee21d62cfed4364e09ec50ee8e88185dd628 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Thu, 18 May 2017 11:49:39 +0300
+Subject: drm/i915: Do not sync RCU during shrinking
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 4681ee21d62cfed4364e09ec50ee8e88185dd628 upstream.
+
+Due to the complex dependencies between workqueues and RCU, which
+are not easily detected by lockdep, do not synchronize RCU during
+shrinking.
+
+On low-on-memory systems (mem=1G for example), the RCU sync leads
+to all system workqueus freezing and unrelated lockdep splats are
+displayed according to reports. GIT bisecting done by J. R.
+Okajima points to the commit where RCU syncing was extended.
+
+RCU sync gains us very little benefit in real life scenarios
+where the amount of memory used by object backing storage is
+dominant over the metadata under RCU, so drop it altogether.
+
+ " Yeeeaah, if core could just, go ahead and reclaim RCU
+ queues, that'd be great. "
+
+ - Chris Wilson, 2016 (0eafec6d3244)
+
+v2: More information to commit message.
+v3: Remove "grep _rcu_" escapee from i915_gem_shrink_all (Andrea)
+
+Fixes: c053b5a506d3 ("drm/i915: Don't call synchronize_rcu_expedited under struct_mutex")
+Suggested-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reported-by: J. R. Okajima <hooanon05g@gmail.com>
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Tested-by: Hugh Dickins <hughd@google.com>
+Tested-by: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: J. R. Okajima <hooanon05g@gmail.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 73cc0b9aa9afa5ba65d92e46ded61d29430d72a4)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1495097379-573-1-git-send-email-joonas.lahtinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/i915/i915_gem_shrinker.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
++++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
+@@ -59,9 +59,6 @@ static void i915_gem_shrinker_unlock(str
+ return;
+
+ mutex_unlock(&dev->struct_mutex);
+-
+- /* expedite the RCU grace period to free some request slabs */
+- synchronize_rcu_expedited();
+ }
+
+ static bool any_vma_pinned(struct drm_i915_gem_object *obj)
+@@ -271,8 +268,6 @@ unsigned long i915_gem_shrink_all(struct
+ I915_SHRINK_BOUND |
+ I915_SHRINK_UNBOUND |
+ I915_SHRINK_ACTIVE);
+- synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
+-
+ return freed;
+ }
+
--- /dev/null
+From c380f681245d7ae57f17d9ebbbe8f8f1557ee1fb Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Fri, 9 Jun 2017 15:48:05 +0800
+Subject: drm/i915: Fix GVT-g PVINFO version compatibility check
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit c380f681245d7ae57f17d9ebbbe8f8f1557ee1fb upstream.
+
+Current it's strictly checked if PVINFO version matches 1.0
+for GVT-g i915 guest which doesn't help for compatibility at
+all and forces GVT-g host can't extend PVINFO easily with version
+bump for real compatibility check.
+
+This fixes that to check minimal required PVINFO version instead.
+
+v2:
+- drop unneeded version macro
+- use only major version for sanity check
+
+v3:
+- fix up PVInfo value with kernel type
+- one indent fix
+
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Chuanxiao Dong <chuanxiao.dong@intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170609074805.5101-1-zhenyuw@linux.intel.com
+(cherry picked from commit 0c8792d00d38de85b6ceb1dd67d3ee009d7c8e42)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_pvinfo.h | 8 ++------
+ drivers/gpu/drm/i915/i915_vgpu.c | 10 ++++------
+ 2 files changed, 6 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_pvinfo.h
++++ b/drivers/gpu/drm/i915/i915_pvinfo.h
+@@ -36,10 +36,6 @@
+ #define VGT_VERSION_MAJOR 1
+ #define VGT_VERSION_MINOR 0
+
+-#define INTEL_VGT_IF_VERSION_ENCODE(major, minor) ((major) << 16 | (minor))
+-#define INTEL_VGT_IF_VERSION \
+- INTEL_VGT_IF_VERSION_ENCODE(VGT_VERSION_MAJOR, VGT_VERSION_MINOR)
+-
+ /*
+ * notifications from guest to vgpu device model
+ */
+@@ -55,8 +51,8 @@ enum vgt_g2v_type {
+
+ struct vgt_if {
+ u64 magic; /* VGT_MAGIC */
+- uint16_t version_major;
+- uint16_t version_minor;
++ u16 version_major;
++ u16 version_minor;
+ u32 vgt_id; /* ID of vGT instance */
+ u32 rsv1[12]; /* pad to offset 0x40 */
+ /*
+--- a/drivers/gpu/drm/i915/i915_vgpu.c
++++ b/drivers/gpu/drm/i915/i915_vgpu.c
+@@ -60,8 +60,8 @@
+ */
+ void i915_check_vgpu(struct drm_i915_private *dev_priv)
+ {
+- uint64_t magic;
+- uint32_t version;
++ u64 magic;
++ u16 version_major;
+
+ BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
+
+@@ -69,10 +69,8 @@ void i915_check_vgpu(struct drm_i915_pri
+ if (magic != VGT_MAGIC)
+ return;
+
+- version = INTEL_VGT_IF_VERSION_ENCODE(
+- __raw_i915_read16(dev_priv, vgtif_reg(version_major)),
+- __raw_i915_read16(dev_priv, vgtif_reg(version_minor)));
+- if (version != INTEL_VGT_IF_VERSION) {
++ version_major = __raw_i915_read16(dev_priv, vgtif_reg(version_major));
++ if (version_major < VGT_VERSION_MAJOR) {
+ DRM_INFO("VGT interface version mismatch!\n");
+ return;
+ }
--- /dev/null
+From 9a775e0308b575e3a17c66a586ed049b07f48199 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 8 Jun 2017 17:40:01 +0300
+Subject: drm/i915: Fix scaling check for 90/270 degree plane rotation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 9a775e0308b575e3a17c66a586ed049b07f48199 upstream.
+
+Starting from commit b63a16f6cd89 ("drm/i915: Compute display surface
+offset in the plane check hook for SKL+") we've already rotated the src
+coordinates by 270 degrees by the time we check if a scaler is needed
+or not, so we must not account for the rotation a second time.
+Previously we did these steps in the opposite order and hence the
+scaler check had to deal with rotation itself. The double rotation
+handling causes us to enable a scaler pretty much every time 90/270
+degree plane rotation is requested, leading to fuzzier fonts and whatnot.
+
+v2: s/unsigned/unsigned int/ to appease checkpatch
+v3: s/DRM_ROTATE_0/DRM_MODE_ROTATE_0/
+
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Tested-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Fixes: b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170331180056.14086-2-ville.syrjala@linux.intel.com
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+(cherry picked from commit d96a7d2adb040a67e163a82dad6316f9f572498a)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170608144002.1605-1-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4633,7 +4633,7 @@ static void cpt_verify_modeset(struct dr
+
+ static int
+ skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach,
+- unsigned scaler_user, int *scaler_id, unsigned int rotation,
++ unsigned int scaler_user, int *scaler_id,
+ int src_w, int src_h, int dst_w, int dst_h)
+ {
+ struct intel_crtc_scaler_state *scaler_state =
+@@ -4642,9 +4642,12 @@ skl_update_scaler(struct intel_crtc_stat
+ to_intel_crtc(crtc_state->base.crtc);
+ int need_scaling;
+
+- need_scaling = drm_rotation_90_or_270(rotation) ?
+- (src_h != dst_w || src_w != dst_h):
+- (src_w != dst_w || src_h != dst_h);
++ /*
++ * Src coordinates are already rotated by 270 degrees for
++ * the 90/270 degree plane rotation cases (to match the
++ * GTT mapping), hence no need to account for rotation here.
++ */
++ need_scaling = src_w != dst_w || src_h != dst_h;
+
+ /*
+ * if plane is being disabled or scaler is no more required or force detach
+@@ -4706,7 +4709,7 @@ int skl_update_scaler_crtc(struct intel_
+ const struct drm_display_mode *adjusted_mode = &state->base.adjusted_mode;
+
+ return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX,
+- &state->scaler_state.scaler_id, DRM_ROTATE_0,
++ &state->scaler_state.scaler_id,
+ state->pipe_src_w, state->pipe_src_h,
+ adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay);
+ }
+@@ -4735,7 +4738,6 @@ static int skl_update_scaler_plane(struc
+ ret = skl_update_scaler(crtc_state, force_detach,
+ drm_plane_index(&intel_plane->base),
+ &plane_state->scaler_id,
+- plane_state->base.rotation,
+ drm_rect_width(&plane_state->base.src) >> 16,
+ drm_rect_height(&plane_state->base.src) >> 16,
+ drm_rect_width(&plane_state->base.dst),
--- /dev/null
+From 014580ffab654bb83256783a2b185cf6c06dffaa Mon Sep 17 00:00:00 2001
+From: YYS <nickey.yang@rock-chips.com>
+Date: Tue, 21 Mar 2017 16:27:03 +0800
+Subject: drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake
+
+From: YYS <nickey.yang@rock-chips.com>
+
+commit 014580ffab654bb83256783a2b185cf6c06dffaa upstream.
+
+mtk_hdmi_setup_vendor_specific_infoframe will return before handle
+mtk_hdmi_hw_send_info_frame.Because hdmi_vendor_infoframe_pack
+returns the number of bytes packed into the binary buffer or
+a negative error code on failure.
+So correct it.
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Signed-off-by: Nickey Yang <nickey.yang@rock-chips.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specifi
+ }
+
+ err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer));
+- if (err) {
++ if (err < 0) {
+ dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n",
+ err);
+ return err;
--- /dev/null
+From 0f933328f018c118ded2035f12068bbdfdef399d Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Fri, 5 May 2017 15:01:41 -0300
+Subject: drm: mxsfb_crtc: Reset the eLCDIF controller
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+commit 0f933328f018c118ded2035f12068bbdfdef399d upstream.
+
+According to the eLCDIF initialization steps listed in the MX6SX
+Reference Manual the eLCDIF block reset is mandatory.
+
+Without performing the eLCDIF reset the display shows garbage content
+when the kernel boots.
+
+In earlier tests this issue has not been observed because the bootloader
+was previously showing a splash screen and the bootloader display driver
+does properly implement the eLCDIF reset.
+
+Add the eLCDIF reset to the driver, so that it can operate correctly
+independently of the bootloader.
+
+Tested on a imx6sx-sdb board.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: http://patchwork.freedesktop.org/patch/msgid/1494007301-14535-1-git-send-email-fabio.estevam@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mxsfb/mxsfb_crtc.c | 42 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
++++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
+@@ -35,6 +35,13 @@
+ #include "mxsfb_drv.h"
+ #include "mxsfb_regs.h"
+
++#define MXS_SET_ADDR 0x4
++#define MXS_CLR_ADDR 0x8
++#define MODULE_CLKGATE BIT(30)
++#define MODULE_SFTRST BIT(31)
++/* 1 second delay should be plenty of time for block reset */
++#define RESET_TIMEOUT 1000000
++
+ static u32 set_hsync_pulse_width(struct mxsfb_drm_private *mxsfb, u32 val)
+ {
+ return (val & mxsfb->devdata->hs_wdth_mask) <<
+@@ -159,6 +166,36 @@ static void mxsfb_disable_controller(str
+ clk_disable_unprepare(mxsfb->clk_disp_axi);
+ }
+
++/*
++ * Clear the bit and poll it cleared. This is usually called with
++ * a reset address and mask being either SFTRST(bit 31) or CLKGATE
++ * (bit 30).
++ */
++static int clear_poll_bit(void __iomem *addr, u32 mask)
++{
++ u32 reg;
++
++ writel(mask, addr + MXS_CLR_ADDR);
++ return readl_poll_timeout(addr, reg, !(reg & mask), 0, RESET_TIMEOUT);
++}
++
++static int mxsfb_reset_block(void __iomem *reset_addr)
++{
++ int ret;
++
++ ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
++ if (ret)
++ return ret;
++
++ writel(MODULE_CLKGATE, reset_addr + MXS_CLR_ADDR);
++
++ ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
++ if (ret)
++ return ret;
++
++ return clear_poll_bit(reset_addr, MODULE_CLKGATE);
++}
++
+ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
+ {
+ struct drm_display_mode *m = &mxsfb->pipe.crtc.state->adjusted_mode;
+@@ -173,6 +210,11 @@ static void mxsfb_crtc_mode_set_nofb(str
+ */
+ mxsfb_enable_axi_clk(mxsfb);
+
++ /* Mandatory eLCDIF reset as per the Reference Manual */
++ err = mxsfb_reset_block(mxsfb->base);
++ if (err)
++ return;
++
+ /* Clear the FIFOs */
+ writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET);
+
--- /dev/null
+From ca39b449f6d03e8235969f12f5dd25b8eb4304d6 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Wed, 1 Mar 2017 10:56:02 -0800
+Subject: drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
+
+From: Eric Anholt <eric@anholt.net>
+
+commit ca39b449f6d03e8235969f12f5dd25b8eb4304d6 upstream.
+
+If a CMA allocation failed, the partially constructed BO would be
+unreferenced through the normal path, and we might choose to put it in
+the BO cache. If we then reused it before it expired from the cache,
+the kernel would OOPS.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.")
+Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170301185602.6873-2-eric@anholt.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vc4/vc4_bo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -313,6 +313,14 @@ void vc4_free_object(struct drm_gem_obje
+ goto out;
+ }
+
++ /* If this object was partially constructed but CMA allocation
++ * had failed, just free it.
++ */
++ if (!bo->base.vaddr) {
++ vc4_bo_destroy(bo);
++ goto out;
++ }
++
+ cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size);
+ if (!cache_list) {
+ vc4_bo_destroy(bo);
--- /dev/null
+From 8461cf20d17e0090e9236b73d25b31be4f7fadc5 Mon Sep 17 00:00:00 2001
+From: Rask Ingemann Lambertsen <rask@formelder.dk>
+Date: Wed, 22 Feb 2017 20:41:02 +0100
+Subject: dt-bindings: mfd: axp20x: Add "xpowers,master-mode" property for AXP806 PMICs
+
+From: Rask Ingemann Lambertsen <rask@formelder.dk>
+
+commit 8461cf20d17e0090e9236b73d25b31be4f7fadc5 upstream.
+
+commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot")
+was intended to fix the case where a board uses an AXP806 in slave mode,
+but the boot loader leaves it in master mode for lack of AXP806 support.
+But now the driver breaks on boards where the PMIC is operating in master
+mode. To let the device tree describe which mode of operation is needed,
+this patch introduces a new property "xpowers,master-mode".
+
+Fixes: 204ae2963e10 ("mfd: axp20x: Add bindings for AXP806 PMIC")
+Signed-off-by: Rask Ingemann Lambertsen <rask@formelder.dk>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/mfd/axp20x.txt | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/Documentation/devicetree/bindings/mfd/axp20x.txt
++++ b/Documentation/devicetree/bindings/mfd/axp20x.txt
+@@ -28,6 +28,9 @@ Optional properties:
+ regulator to drive the OTG VBus, rather then as an input pin
+ which signals whether the board is driving OTG VBus or not.
+
++- x-powers,master-mode: Boolean (axp806 only). Set this when the PMIC is
++ wired for master mode. The default is slave mode.
++
+ - <input>-supply: a phandle to the regulator supply node. May be omitted if
+ inputs are unregulated, such as using the IPSOUT output
+ from the PMIC.
--- /dev/null
+From 20223f0f39ea9d31ece08f04ac79f8c4e8d98246 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Fri, 16 Jun 2017 11:08:24 +0200
+Subject: fs: pass on flags in compat_writev
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 20223f0f39ea9d31ece08f04ac79f8c4e8d98246 upstream.
+
+Fixes: 793b80ef14af ("vfs: pass a flags argument to vfs_readv/vfs_writev")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/read_write.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1210,7 +1210,7 @@ static size_t compat_writev(struct file
+ if (!(file->f_mode & FMODE_CAN_WRITE))
+ goto out;
+
+- ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, 0);
++ ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, flags);
+
+ out:
+ if (ret > 0)
--- /dev/null
+From 5ba5b437efaa7a502eec393c045d3bf90c92c4e9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 10 May 2017 08:51:09 +0300
+Subject: iio: adc: ti_am335x_adc: allocating too much in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 5ba5b437efaa7a502eec393c045d3bf90c92c4e9 upstream.
+
+We should be allocating enough information for a tiadc_device struct
+which is about 400 bytes but instead we allocate enough for a second
+iio_dev struct which is over 2000 bytes.
+
+Fixes: fea89e2dfcea ("iio: adc: ti_am335x_adc: use variable names for sizeof() operator")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ti_am335x_adc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -614,7 +614,7 @@ static int tiadc_probe(struct platform_d
+ return -EINVAL;
+ }
+
+- indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev));
++ indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev));
+ if (indio_dev == NULL) {
+ dev_err(&pdev->dev, "failed to allocate iio device\n");
+ return -ENOMEM;
--- /dev/null
+From 2ccc15036d812e75f334c0fb813104ef765a2c77 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+Date: Sun, 2 Apr 2017 14:58:45 +0200
+Subject: iio: imu: st_lsm6dsx: do not apply ODR configuration in write_raw handler
+
+From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+
+commit 2ccc15036d812e75f334c0fb813104ef765a2c77 upstream.
+
+This patch allows to avoid a transitory that occurs when a given sensor
+has been already enabled (e.g. gyroscope) and the user is configuring
+the sample frequency of the other one (e.g. accelerometer).
+The transitory lasts until the accelerometer is enabled.
+During that time slice the gyroscope ODR is incorrectly modified as well.
+At the end of the transitory both sensors work at the right frequency.
+Fix it introducing st_lsm6dsx_check_odr() routine to check ODR consistency
+in write_raw handler in order to apply frequency configuration just
+in st_lsm6dsx_set_odr()
+
+Fixes: 290a6ce11d93 (iio: imu: add support to lsm6dsx driver)
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@st.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 41 +++++++++++++++++----------
+ 1 file changed, 26 insertions(+), 15 deletions(-)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+@@ -298,32 +298,40 @@ static int st_lsm6dsx_set_full_scale(str
+ return 0;
+ }
+
+-static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 odr)
++static int st_lsm6dsx_check_odr(struct st_lsm6dsx_sensor *sensor, u16 odr,
++ u8 *val)
+ {
+- enum st_lsm6dsx_sensor_id id = sensor->id;
+- int i, err;
+- u8 val;
++ int i;
+
+ for (i = 0; i < ST_LSM6DSX_ODR_LIST_SIZE; i++)
+- if (st_lsm6dsx_odr_table[id].odr_avl[i].hz == odr)
++ if (st_lsm6dsx_odr_table[sensor->id].odr_avl[i].hz == odr)
+ break;
+
+ if (i == ST_LSM6DSX_ODR_LIST_SIZE)
+ return -EINVAL;
+
+- val = st_lsm6dsx_odr_table[id].odr_avl[i].val;
+- err = st_lsm6dsx_write_with_mask(sensor->hw,
+- st_lsm6dsx_odr_table[id].reg.addr,
+- st_lsm6dsx_odr_table[id].reg.mask,
+- val);
+- if (err < 0)
+- return err;
+-
++ *val = st_lsm6dsx_odr_table[sensor->id].odr_avl[i].val;
+ sensor->odr = odr;
+
+ return 0;
+ }
+
++static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 odr)
++{
++ enum st_lsm6dsx_sensor_id id = sensor->id;
++ int err;
++ u8 val;
++
++ err = st_lsm6dsx_check_odr(sensor, odr, &val);
++ if (err < 0)
++ return err;
++
++ return st_lsm6dsx_write_with_mask(sensor->hw,
++ st_lsm6dsx_odr_table[id].reg.addr,
++ st_lsm6dsx_odr_table[id].reg.mask,
++ val);
++}
++
+ int st_lsm6dsx_sensor_enable(struct st_lsm6dsx_sensor *sensor)
+ {
+ int err;
+@@ -426,9 +434,12 @@ static int st_lsm6dsx_write_raw(struct i
+ case IIO_CHAN_INFO_SCALE:
+ err = st_lsm6dsx_set_full_scale(sensor, val2);
+ break;
+- case IIO_CHAN_INFO_SAMP_FREQ:
+- err = st_lsm6dsx_set_odr(sensor, val);
++ case IIO_CHAN_INFO_SAMP_FREQ: {
++ u8 data;
++
++ err = st_lsm6dsx_check_odr(sensor, val, &data);
+ break;
++ }
+ default:
+ err = -EINVAL;
+ break;
--- /dev/null
+From 6272c0de13abf1480f701d38288f28a11b4301c4 Mon Sep 17 00:00:00 2001
+From: Matt Ranostay <matt.ranostay@konsulko.com>
+Date: Fri, 14 Apr 2017 16:38:19 -0700
+Subject: iio: proximity: as3935: recalibrate RCO after resume
+
+From: Matt Ranostay <matt.ranostay@konsulko.com>
+
+commit 6272c0de13abf1480f701d38288f28a11b4301c4 upstream.
+
+According to the datasheet the RCO must be recalibrated
+on every power-on-reset. Also remove mutex locking in the
+calibration function since callers other than the probe
+function (which doesn't need it) will have a lock.
+
+Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support")
+Cc: George McCollister <george.mccollister@gmail.com>
+Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/proximity/as3935.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/proximity/as3935.c
++++ b/drivers/iio/proximity/as3935.c
+@@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_hand
+
+ static void calibrate_as3935(struct as3935_state *st)
+ {
+- mutex_lock(&st->lock);
+-
+ /* mask disturber interrupt bit */
+ as3935_write(st, AS3935_INT, BIT(5));
+
+@@ -280,8 +278,6 @@ static void calibrate_as3935(struct as39
+
+ mdelay(2);
+ as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
+-
+- mutex_unlock(&st->lock);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+@@ -318,6 +314,8 @@ static int as3935_resume(struct device *
+ val &= ~AS3935_AFE_PWR_BIT;
+ ret = as3935_write(st, AS3935_AFE_GAIN, val);
+
++ calibrate_as3935(st);
++
+ err_resume:
+ mutex_unlock(&st->lock);
+
--- /dev/null
+From 0db47e3d323411beeb6ea97f2c4d19395c91fd8b Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 8 Jun 2017 09:54:24 +0200
+Subject: ila_xlat: add missing hash secret initialization
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 0db47e3d323411beeb6ea97f2c4d19395c91fd8b upstream.
+
+While discussing the possible merits of clang warning about unused initialized
+functions, I found one function that was clearly meant to be called but
+never actually is.
+
+__ila_hash_secret_init() initializes the hash value for the ila locator,
+apparently this is intended to prevent hash collision attacks, but this ends
+up being a read-only zero constant since there is no caller. I could find
+no indication of why it was never called, the earliest patch submission
+for the module already was like this. If my interpretation is right, we
+certainly want to backport the patch to stable kernels as well.
+
+I considered adding it to the ila_xlat_init callback, but for best effect
+the random data is read as late as possible, just before it is first used.
+The underlying net_get_random_once() is already highly optimized to avoid
+overhead when called frequently.
+
+Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility")
+Link: https://www.spinics.net/lists/kernel/msg2527243.html
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/ila/ila_xlat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/ila/ila_xlat.c
++++ b/net/ipv6/ila/ila_xlat.c
+@@ -68,6 +68,7 @@ static inline u32 ila_locator_hash(struc
+ {
+ u32 *v = (u32 *)loc.v32;
+
++ __ila_hash_secret_init();
+ return jhash_2words(v[0], v[1], hashrnd);
+ }
+
--- /dev/null
+From 769dc04db3ed8484798aceb015b94deacc2ba557 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 8 Jun 2017 14:00:49 +0300
+Subject: mac80211: don't look at the PM bit of BAR frames
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 769dc04db3ed8484798aceb015b94deacc2ba557 upstream.
+
+When a peer sends a BAR frame with PM bit clear, we should
+not modify its PM state as madated by the spec in
+802.11-20012 10.2.1.2.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1587,12 +1587,16 @@ ieee80211_rx_h_sta_process(struct ieee80
+ */
+ if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
+ !ieee80211_has_morefrags(hdr->frame_control) &&
++ !ieee80211_is_back_req(hdr->frame_control) &&
+ !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
+ (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
+ rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
+- /* PM bit is only checked in frames where it isn't reserved,
++ /*
++ * PM bit is only checked in frames where it isn't reserved,
+ * in AP mode it's reserved in non-bufferable management frames
+ * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
++ * BAR frames should be ignored as specified in
++ * IEEE 802.11-2012 10.2.1.2.
+ */
+ (!ieee80211_is_mgmt(hdr->frame_control) ||
+ ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
--- /dev/null
+From b3dd8279659f14f3624bb32559782d699fa6f7d1 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sat, 10 Jun 2017 13:52:45 +0300
+Subject: mac80211: don't send SMPS action frame in AP mode when not needed
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit b3dd8279659f14f3624bb32559782d699fa6f7d1 upstream.
+
+mac80211 allows to modify the SMPS state of an AP both,
+when it is started, and after it has been started. Such a
+change will trigger an action frame to all the peers that
+are currently connected, and will be remembered so that
+new peers will get notified as soon as they connect (since
+the SMPS setting in the beacon may not be the right one).
+
+This means that we need to remember the SMPS state
+currently requested as well as the SMPS state that was
+configured initially (and advertised in the beacon).
+The former is bss->req_smps and the latter is
+sdata->smps_mode.
+
+Initially, the AP interface could only be started with
+SMPS_OFF, which means that sdata->smps_mode was SMPS_OFF
+always. Later, a nl80211 API was added to be able to start
+an AP with a different AP mode. That code forgot to update
+bss->req_smps and because of that, if the AP interface was
+started with SMPS_DYNAMIC, we had:
+ sdata->smps_mode = SMPS_DYNAMIC
+ bss->req_smps = SMPS_OFF
+
+That configuration made mac80211 think it needs to fire off
+an action frame to any new station connecting to the AP in
+order to let it know that the actual SMPS configuration is
+SMPS_OFF.
+
+Fix that by properly setting bss->req_smps in
+ieee80211_start_ap.
+
+Fixes: f69931748730 ("mac80211: set smps_mode according to ap params")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/cfg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -862,6 +862,8 @@ static int ieee80211_start_ap(struct wip
+ default:
+ return -EINVAL;
+ }
++ sdata->u.ap.req_smps = sdata->smps_mode;
++
+ sdata->needed_rx_chains = sdata->local->rx_chains;
+
+ sdata->vif.bss_conf.beacon_int = params->beacon_interval;
--- /dev/null
+From e165bc02a02c70e40d5c811c705ba269aeca0497 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 1 Jun 2017 21:26:03 +0200
+Subject: mac80211: fix dropped counter in multiqueue RX
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit e165bc02a02c70e40d5c811c705ba269aeca0497 upstream.
+
+In the commit enabling per-CPU station statistics, I inadvertedly
+copy-pasted some code to update rx_packets and forgot to change it
+to update rx_dropped_misc. Fix that.
+
+This addresses https://bugzilla.kernel.org/show_bug.cgi?id=195953.
+
+Fixes: c9c5962b56c1 ("mac80211: enable collecting station statistics per-CPU")
+Reported-by: Petru-Florin Mihancea <petrum@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/sta_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2143,7 +2143,7 @@ void sta_set_sinfo(struct sta_info *sta,
+ struct ieee80211_sta_rx_stats *cpurxs;
+
+ cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
+- sinfo->rx_packets += cpurxs->dropped;
++ sinfo->rx_dropped_misc += cpurxs->dropped;
+ }
+ }
+
--- /dev/null
+From f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 27 Apr 2017 13:19:04 +0200
+Subject: mac80211: fix IBSS presp allocation size
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 upstream.
+
+When VHT IBSS support was added, the size of the extra elements
+wasn't considered in ieee80211_ibss_build_presp(), which makes
+it possible that it would overrun the allocated buffer. Fix it
+by allocating the necessary space.
+
+Fixes: abcff6ef01f9 ("mac80211: add VHT support for IBSS")
+Reported-by: Shaul Triebitz <shaul.triebitz@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/ibss.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -66,6 +66,8 @@ ieee80211_ibss_build_presp(struct ieee80
+ 2 + (IEEE80211_MAX_SUPP_RATES - 8) +
+ 2 + sizeof(struct ieee80211_ht_cap) +
+ 2 + sizeof(struct ieee80211_ht_operation) +
++ 2 + sizeof(struct ieee80211_vht_cap) +
++ 2 + sizeof(struct ieee80211_vht_operation) +
+ ifibss->ie_len;
+ presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
+ if (!presp)
--- /dev/null
+From 5667c86acf021e6dcf02584408b4484a273ac68f Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
+Date: Sun, 14 May 2017 21:41:55 -0700
+Subject: mac80211: strictly check mesh address extension mode
+
+From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
+
+commit 5667c86acf021e6dcf02584408b4484a273ac68f upstream.
+
+Mesh forwarding path checks for address extension mode to fetch
+appropriate proxied address and MPP address. Existing condition
+that looks for 6 address format is not strict enough so that
+frames with improper values are processed and invalid entries
+are added into MPP table. Fix that by adding a stricter check before
+processing the packet.
+
+Per IEEE Std 802.11s-2011 spec. Table 7-6g1 lists address extension
+mode 0x3 as reserved one. And also Table Table 9-13 does not specify
+0x3 as valid address field.
+
+Fixes: 9b395bc3be1c ("mac80211: verify that skb data is present")
+Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 3 ++-
+ net/wireless/util.c | 10 ++++++----
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2470,7 +2470,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ if (is_multicast_ether_addr(hdr->addr1)) {
+ mpp_addr = hdr->addr3;
+ proxied_addr = mesh_hdr->eaddr1;
+- } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
++ } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
++ MESH_FLAGS_AE_A5_A6) {
+ /* has_a4 already checked in ieee80211_rx_mesh_check */
+ mpp_addr = hdr->addr4;
+ proxied_addr = mesh_hdr->eaddr2;
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct
+ if (iftype == NL80211_IFTYPE_MESH_POINT)
+ skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
+
++ mesh_flags &= MESH_FLAGS_AE;
++
+ switch (hdr->frame_control &
+ cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
+ case cpu_to_le16(IEEE80211_FCTL_TODS):
+@@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ iftype != NL80211_IFTYPE_STATION))
+ return -1;
+ if (iftype == NL80211_IFTYPE_MESH_POINT) {
+- if (mesh_flags & MESH_FLAGS_AE_A4)
++ if (mesh_flags == MESH_FLAGS_AE_A4)
+ return -1;
+- if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
++ if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
+ skb_copy_bits(skb, hdrlen +
+ offsetof(struct ieee80211s_hdr, eaddr1),
+ tmp.h_dest, 2 * ETH_ALEN);
+@@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ ether_addr_equal(tmp.h_source, addr)))
+ return -1;
+ if (iftype == NL80211_IFTYPE_MESH_POINT) {
+- if (mesh_flags & MESH_FLAGS_AE_A5_A6)
++ if (mesh_flags == MESH_FLAGS_AE_A5_A6)
+ return -1;
+- if (mesh_flags & MESH_FLAGS_AE_A4)
++ if (mesh_flags == MESH_FLAGS_AE_A4)
+ skb_copy_bits(skb, hdrlen +
+ offsetof(struct ieee80211s_hdr, eaddr1),
+ tmp.h_source, ETH_ALEN);
--- /dev/null
+From 98c67d187db7808b1f3c95f2110dd4392d034182 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sat, 10 Jun 2017 04:59:12 +0200
+Subject: mac80211/wpa: use constant time memory comparison for MACs
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 98c67d187db7808b1f3c95f2110dd4392d034182 upstream.
+
+Otherwise, we enable all sorts of forgeries via timing attack.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: linux-wireless@vger.kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/wpa.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -17,6 +17,7 @@
+ #include <asm/unaligned.h>
+ #include <net/mac80211.h>
+ #include <crypto/aes.h>
++#include <crypto/algapi.h>
+
+ #include "ieee80211_i.h"
+ #include "michael.h"
+@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct
+ data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
+ key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
+ michael_mic(key, hdr, data, data_len, mic);
+- if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
++ if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
+ goto mic_fail;
+
+ /* remove Michael MIC from payload */
+@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct
+ bip_aad(skb, aad);
+ ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
+ skb->data + 24, skb->len - 24, mic);
+- if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
++ if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
+ key->u.aes_cmac.icverrors++;
+ return RX_DROP_UNUSABLE;
+ }
+@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(st
+ bip_aad(skb, aad);
+ ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
+ skb->data + 24, skb->len - 24, mic);
+- if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
++ if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
+ key->u.aes_cmac.icverrors++;
+ return RX_DROP_UNUSABLE;
+ }
+@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
+ if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
+ skb->data + 24, skb->len - 24,
+ mic) < 0 ||
+- memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
++ crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
+ key->u.aes_gmac.icverrors++;
+ return RX_DROP_UNUSABLE;
+ }
--- /dev/null
+From c0369698e6455c734a772e3acb09cff9a0c8ed9f Mon Sep 17 00:00:00 2001
+From: Rask Ingemann Lambertsen <rask@formelder.dk>
+Date: Wed, 22 Feb 2017 20:42:02 +0100
+Subject: mfd: axp20x: Add support for dts property "xpowers,master-mode"
+
+From: Rask Ingemann Lambertsen <rask@formelder.dk>
+
+commit c0369698e6455c734a772e3acb09cff9a0c8ed9f upstream.
+
+commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot")
+was intended to fix the case where a board uses an AXP806 in slave mode,
+but the boot loader leaves it in master mode for lack of AXP806 support.
+But now the driver breaks on boards where the PMIC is operating in master
+mode. This patch lets the driver use the new device tree property
+"xpowers,master-mode" to set the correct operating mode for the board.
+
+Fixes: 8824ee857348 ("mfd: axp20x: Add support for AXP806 PMIC")
+Signed-off-by: Rask Ingemann Lambertsen <rask@formelder.dk>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/axp20x.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -31,6 +31,7 @@
+
+ #define AXP20X_OFF 0x80
+
++#define AXP806_REG_ADDR_EXT_ADDR_MASTER_MODE 0
+ #define AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE BIT(4)
+
+ static const char * const axp20x_model_names[] = {
+@@ -877,15 +878,19 @@ int axp20x_device_probe(struct axp20x_de
+ * the these device addressing bits (in the upper 4 bits of the
+ * registers) match.
+ *
+- * Since we only support an AXP806 chained to an AXP809 in slave
+- * mode, and there isn't any existing hardware which uses AXP806
+- * in master mode, or has 2 AXP806s in the same system, we can
+- * just program the register address extension to the slave mode
+- * address.
++ * By default we support an AXP806 chained to an AXP809 in slave
++ * mode. Boards which use an AXP806 in master mode can set the
++ * property "x-powers,master-mode" to override the default.
+ */
+- if (axp20x->variant == AXP806_ID)
+- regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT,
+- AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE);
++ if (axp20x->variant == AXP806_ID) {
++ if (of_property_read_bool(axp20x->dev->of_node,
++ "x-powers,master-mode"))
++ regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT,
++ AXP806_REG_ADDR_EXT_ADDR_MASTER_MODE);
++ else
++ regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT,
++ AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE);
++ }
+
+ ret = regmap_add_irq_chip(axp20x->regmap, axp20x->irq,
+ IRQF_ONESHOT | IRQF_SHARED | axp20x->irq_flags,
--- /dev/null
+From be269180c9335c257a2763c3fd3a44e65c90c1f0 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 3 Apr 2017 20:15:56 -0700
+Subject: mfd: cpcap: Fix bad use of IRQ sense register
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit be269180c9335c257a2763c3fd3a44e65c90c1f0 upstream.
+
+The cpcap INTS registers are for getting the value of the line,
+not for configuring the type.
+
+Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support")
+Reviewed-By: Sebastian Reichel <sre@kernel.org>
+Tested-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/motorola-cpcap.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/mfd/motorola-cpcap.c
++++ b/drivers/mfd/motorola-cpcap.c
+@@ -88,7 +88,6 @@ static struct regmap_irq_chip cpcap_irq_
+ .status_base = CPCAP_REG_INT1,
+ .ack_base = CPCAP_REG_INT1,
+ .mask_base = CPCAP_REG_INTM1,
+- .type_base = CPCAP_REG_INTS1,
+ .use_ack = true,
+ .ack_invert = true,
+ },
--- /dev/null
+From ac89473213c602b98172d92e40f5e78032b1aba0 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 3 Apr 2017 20:15:54 -0700
+Subject: mfd: cpcap: Fix interrupt to use level interrupt
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit ac89473213c602b98172d92e40f5e78032b1aba0 upstream.
+
+I made a mistake assuming the device tree configuration for interrupt
+triggering was somehow passed to the SPI device but it's not.
+
+In the Motorola Linux kernel tree CPCAP PMIC is configured as a rising
+edge triggered interrupt, but then then it's interrupt handler keeps
+looping until the GPIO line goes down. So the CPCAP interrupt is clearly
+a level interrupt and not an edge interrupt.
+
+Earlier when I tried to configure it as level interrupt using the
+device tree, I did not account that the triggering only gets passed
+to the SPI core and it also needs to be specified in the CPCAP driver
+when we do devm_regmap_add_irq_chip().
+
+Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/motorola-cpcap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mfd/motorola-cpcap.c
++++ b/drivers/mfd/motorola-cpcap.c
+@@ -126,7 +126,7 @@ static int cpcap_init_irq_chip(struct cp
+
+ ret = devm_regmap_add_irq_chip(&cpcap->spi->dev, cpcap->regmap,
+ cpcap->spi->irq,
+- IRQF_TRIGGER_RISING |
++ irq_get_trigger_type(cpcap->spi->irq) |
+ IRQF_SHARED, -1,
+ chip, &cpcap->irqdata[irq_chip]);
+ if (ret) {
--- /dev/null
+From 5a88d4120029601a0868e20774382d312952d3b5 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 3 Apr 2017 20:15:55 -0700
+Subject: mfd: cpcap: Use ack_invert interrupts
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 5a88d4120029601a0868e20774382d312952d3b5 upstream.
+
+We should use ack_invert as the int_read_and_clear() in the Motorola
+kernel tree does "ireg_val & ~mreg_val" before writing to the mask
+register.
+
+Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support")
+Tested-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/motorola-cpcap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mfd/motorola-cpcap.c
++++ b/drivers/mfd/motorola-cpcap.c
+@@ -71,6 +71,7 @@ static struct regmap_irq_chip cpcap_irq_
+ .ack_base = CPCAP_REG_MI1,
+ .mask_base = CPCAP_REG_MIM1,
+ .use_ack = true,
++ .ack_invert = true,
+ },
+ {
+ .name = "cpcap-m2",
+@@ -79,6 +80,7 @@ static struct regmap_irq_chip cpcap_irq_
+ .ack_base = CPCAP_REG_MI2,
+ .mask_base = CPCAP_REG_MIM2,
+ .use_ack = true,
++ .ack_invert = true,
+ },
+ {
+ .name = "cpcap1-4",
+@@ -88,6 +90,7 @@ static struct regmap_irq_chip cpcap_irq_
+ .mask_base = CPCAP_REG_INTM1,
+ .type_base = CPCAP_REG_INTS1,
+ .use_ack = true,
++ .ack_invert = true,
+ },
+ };
+
--- /dev/null
+From 8b8a84c54aff4256d592dc18346c65ecf6811b45 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Sat, 15 Apr 2017 10:05:08 -0700
+Subject: mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 8b8a84c54aff4256d592dc18346c65ecf6811b45 upstream.
+
+Commit 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver")
+added support for USB TLL, but uses OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF
+bit the wrong way. The comments in the code are correct, but the inverted
+use of OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF causes the register to be
+enabled instead of disabled unlike what the comments say.
+
+Without this change the Wrigley 3G LTE modem on droid 4 EHCI bus can
+be only pinged few times before it stops responding.
+
+Fixes: 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/omap-usb-tll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mfd/omap-usb-tll.c
++++ b/drivers/mfd/omap-usb-tll.c
+@@ -377,8 +377,8 @@ int omap_tll_init(struct usbhs_omap_plat
+ * and use SDR Mode
+ */
+ reg &= ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE
+- | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF
+ | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE);
++ reg |= OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF;
+ } else if (pdata->port_mode[i] ==
+ OMAP_EHCI_PORT_MODE_HSIC) {
+ /*
--- /dev/null
+From 8c925b263584e5a37244297ea9bd072020265fd4 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Thu, 30 Mar 2017 17:36:39 +0200
+Subject: mtd: physmap_of: really fix the physmap add-ons
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 8c925b263584e5a37244297ea9bd072020265fd4 upstream.
+
+The current way of building the of_physmap add-ons result in just
+the add-on being in the object code, and not the actual core
+implementation and regress the Gemini and Versatile.
+
+Bake the physmap_of.o object by baking physmap_of_core.o and
+adding the Versatile and/or Gemini add-ons to the final object.
+Rename the source file physmap_of_core.c to get the desired
+build components.
+
+Suggested-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: 4f04f68e1598 ("mtd: physmap_of: fixup gemini/versatile dependencies")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/maps/Makefile | 10
+ drivers/mtd/maps/physmap_of.c | 389 -------------------------------------
+ drivers/mtd/maps/physmap_of_core.c | 389 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 393 insertions(+), 395 deletions(-)
+
+--- a/drivers/mtd/maps/Makefile
++++ b/drivers/mtd/maps/Makefile
+@@ -17,12 +17,10 @@ obj-$(CONFIG_MTD_CK804XROM) += ck804xrom
+ obj-$(CONFIG_MTD_TSUNAMI) += tsunami_flash.o
+ obj-$(CONFIG_MTD_PXA2XX) += pxa2xx-flash.o
+ obj-$(CONFIG_MTD_PHYSMAP) += physmap.o
+-ifdef CONFIG_MTD_PHYSMAP_OF_VERSATILE
+-physmap_of-objs += physmap_of_versatile.o
+-endif
+-ifdef CONFIG_MTD_PHYSMAP_OF_GEMINI
+-physmap_of-objs += physmap_of_gemini.o
+-endif
++physmap_of-objs-y += physmap_of_core.o
++physmap_of-objs-$(CONFIG_MTD_PHYSMAP_OF_VERSATILE) += physmap_of_versatile.o
++physmap_of-objs-$(CONFIG_MTD_PHYSMAP_OF_GEMINI) += physmap_of_gemini.o
++physmap_of-objs := $(physmap_of-objs-y)
+ obj-$(CONFIG_MTD_PHYSMAP_OF) += physmap_of.o
+ obj-$(CONFIG_MTD_PISMO) += pismo.o
+ obj-$(CONFIG_MTD_PMC_MSP_EVM) += pmcmsp-flash.o
+--- a/drivers/mtd/maps/physmap_of.c
++++ /dev/null
+@@ -1,389 +0,0 @@
+-/*
+- * Flash mappings described by the OF (or flattened) device tree
+- *
+- * Copyright (C) 2006 MontaVista Software Inc.
+- * Author: Vitaly Wool <vwool@ru.mvista.com>
+- *
+- * Revised to handle newer style flash binding by:
+- * Copyright (C) 2007 David Gibson, IBM Corporation.
+- *
+- * This program is free software; you can redistribute it and/or modify it
+- * under the terms of the GNU General Public License as published by the
+- * Free Software Foundation; either version 2 of the License, or (at your
+- * option) any later version.
+- */
+-
+-#include <linux/module.h>
+-#include <linux/types.h>
+-#include <linux/device.h>
+-#include <linux/mtd/mtd.h>
+-#include <linux/mtd/map.h>
+-#include <linux/mtd/partitions.h>
+-#include <linux/mtd/concat.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_platform.h>
+-#include <linux/slab.h>
+-#include "physmap_of_gemini.h"
+-#include "physmap_of_versatile.h"
+-
+-struct of_flash_list {
+- struct mtd_info *mtd;
+- struct map_info map;
+- struct resource *res;
+-};
+-
+-struct of_flash {
+- struct mtd_info *cmtd;
+- int list_size; /* number of elements in of_flash_list */
+- struct of_flash_list list[0];
+-};
+-
+-static int of_flash_remove(struct platform_device *dev)
+-{
+- struct of_flash *info;
+- int i;
+-
+- info = dev_get_drvdata(&dev->dev);
+- if (!info)
+- return 0;
+- dev_set_drvdata(&dev->dev, NULL);
+-
+- if (info->cmtd) {
+- mtd_device_unregister(info->cmtd);
+- if (info->cmtd != info->list[0].mtd)
+- mtd_concat_destroy(info->cmtd);
+- }
+-
+- for (i = 0; i < info->list_size; i++) {
+- if (info->list[i].mtd)
+- map_destroy(info->list[i].mtd);
+-
+- if (info->list[i].map.virt)
+- iounmap(info->list[i].map.virt);
+-
+- if (info->list[i].res) {
+- release_resource(info->list[i].res);
+- kfree(info->list[i].res);
+- }
+- }
+- return 0;
+-}
+-
+-static const char * const rom_probe_types[] = {
+- "cfi_probe", "jedec_probe", "map_rom" };
+-
+-/* Helper function to handle probing of the obsolete "direct-mapped"
+- * compatible binding, which has an extra "probe-type" property
+- * describing the type of flash probe necessary. */
+-static struct mtd_info *obsolete_probe(struct platform_device *dev,
+- struct map_info *map)
+-{
+- struct device_node *dp = dev->dev.of_node;
+- const char *of_probe;
+- struct mtd_info *mtd;
+- int i;
+-
+- dev_warn(&dev->dev, "Device tree uses obsolete \"direct-mapped\" "
+- "flash binding\n");
+-
+- of_probe = of_get_property(dp, "probe-type", NULL);
+- if (!of_probe) {
+- for (i = 0; i < ARRAY_SIZE(rom_probe_types); i++) {
+- mtd = do_map_probe(rom_probe_types[i], map);
+- if (mtd)
+- return mtd;
+- }
+- return NULL;
+- } else if (strcmp(of_probe, "CFI") == 0) {
+- return do_map_probe("cfi_probe", map);
+- } else if (strcmp(of_probe, "JEDEC") == 0) {
+- return do_map_probe("jedec_probe", map);
+- } else {
+- if (strcmp(of_probe, "ROM") != 0)
+- dev_warn(&dev->dev, "obsolete_probe: don't know probe "
+- "type '%s', mapping as rom\n", of_probe);
+- return do_map_probe("map_rom", map);
+- }
+-}
+-
+-/* When partitions are set we look for a linux,part-probe property which
+- specifies the list of partition probers to use. If none is given then the
+- default is use. These take precedence over other device tree
+- information. */
+-static const char * const part_probe_types_def[] = {
+- "cmdlinepart", "RedBoot", "ofpart", "ofoldpart", NULL };
+-
+-static const char * const *of_get_probes(struct device_node *dp)
+-{
+- const char *cp;
+- int cplen;
+- unsigned int l;
+- unsigned int count;
+- const char **res;
+-
+- cp = of_get_property(dp, "linux,part-probe", &cplen);
+- if (cp == NULL)
+- return part_probe_types_def;
+-
+- count = 0;
+- for (l = 0; l != cplen; l++)
+- if (cp[l] == 0)
+- count++;
+-
+- res = kzalloc((count + 1)*sizeof(*res), GFP_KERNEL);
+- if (!res)
+- return NULL;
+- count = 0;
+- while (cplen > 0) {
+- res[count] = cp;
+- l = strlen(cp) + 1;
+- cp += l;
+- cplen -= l;
+- count++;
+- }
+- return res;
+-}
+-
+-static void of_free_probes(const char * const *probes)
+-{
+- if (probes != part_probe_types_def)
+- kfree(probes);
+-}
+-
+-static const struct of_device_id of_flash_match[];
+-static int of_flash_probe(struct platform_device *dev)
+-{
+- const char * const *part_probe_types;
+- const struct of_device_id *match;
+- struct device_node *dp = dev->dev.of_node;
+- struct resource res;
+- struct of_flash *info;
+- const char *probe_type;
+- const __be32 *width;
+- int err;
+- int i;
+- int count;
+- const __be32 *p;
+- int reg_tuple_size;
+- struct mtd_info **mtd_list = NULL;
+- resource_size_t res_size;
+- bool map_indirect;
+- const char *mtd_name = NULL;
+-
+- match = of_match_device(of_flash_match, &dev->dev);
+- if (!match)
+- return -EINVAL;
+- probe_type = match->data;
+-
+- reg_tuple_size = (of_n_addr_cells(dp) + of_n_size_cells(dp)) * sizeof(u32);
+-
+- of_property_read_string(dp, "linux,mtd-name", &mtd_name);
+-
+- /*
+- * Get number of "reg" tuples. Scan for MTD devices on area's
+- * described by each "reg" region. This makes it possible (including
+- * the concat support) to support the Intel P30 48F4400 chips which
+- * consists internally of 2 non-identical NOR chips on one die.
+- */
+- p = of_get_property(dp, "reg", &count);
+- if (!p || count % reg_tuple_size != 0) {
+- dev_err(&dev->dev, "Malformed reg property on %s\n",
+- dev->dev.of_node->full_name);
+- err = -EINVAL;
+- goto err_flash_remove;
+- }
+- count /= reg_tuple_size;
+-
+- map_indirect = of_property_read_bool(dp, "no-unaligned-direct-access");
+-
+- err = -ENOMEM;
+- info = devm_kzalloc(&dev->dev,
+- sizeof(struct of_flash) +
+- sizeof(struct of_flash_list) * count, GFP_KERNEL);
+- if (!info)
+- goto err_flash_remove;
+-
+- dev_set_drvdata(&dev->dev, info);
+-
+- mtd_list = kzalloc(sizeof(*mtd_list) * count, GFP_KERNEL);
+- if (!mtd_list)
+- goto err_flash_remove;
+-
+- for (i = 0; i < count; i++) {
+- err = -ENXIO;
+- if (of_address_to_resource(dp, i, &res)) {
+- /*
+- * Continue with next register tuple if this
+- * one is not mappable
+- */
+- continue;
+- }
+-
+- dev_dbg(&dev->dev, "of_flash device: %pR\n", &res);
+-
+- err = -EBUSY;
+- res_size = resource_size(&res);
+- info->list[i].res = request_mem_region(res.start, res_size,
+- dev_name(&dev->dev));
+- if (!info->list[i].res)
+- goto err_out;
+-
+- err = -ENXIO;
+- width = of_get_property(dp, "bank-width", NULL);
+- if (!width) {
+- dev_err(&dev->dev, "Can't get bank width from device"
+- " tree\n");
+- goto err_out;
+- }
+-
+- info->list[i].map.name = mtd_name ?: dev_name(&dev->dev);
+- info->list[i].map.phys = res.start;
+- info->list[i].map.size = res_size;
+- info->list[i].map.bankwidth = be32_to_cpup(width);
+- info->list[i].map.device_node = dp;
+-
+- err = of_flash_probe_gemini(dev, dp, &info->list[i].map);
+- if (err)
+- return err;
+- err = of_flash_probe_versatile(dev, dp, &info->list[i].map);
+- if (err)
+- return err;
+-
+- err = -ENOMEM;
+- info->list[i].map.virt = ioremap(info->list[i].map.phys,
+- info->list[i].map.size);
+- if (!info->list[i].map.virt) {
+- dev_err(&dev->dev, "Failed to ioremap() flash"
+- " region\n");
+- goto err_out;
+- }
+-
+- simple_map_init(&info->list[i].map);
+-
+- /*
+- * On some platforms (e.g. MPC5200) a direct 1:1 mapping
+- * may cause problems with JFFS2 usage, as the local bus (LPB)
+- * doesn't support unaligned accesses as implemented in the
+- * JFFS2 code via memcpy(). By setting NO_XIP, the
+- * flash will not be exposed directly to the MTD users
+- * (e.g. JFFS2) any more.
+- */
+- if (map_indirect)
+- info->list[i].map.phys = NO_XIP;
+-
+- if (probe_type) {
+- info->list[i].mtd = do_map_probe(probe_type,
+- &info->list[i].map);
+- } else {
+- info->list[i].mtd = obsolete_probe(dev,
+- &info->list[i].map);
+- }
+-
+- /* Fall back to mapping region as ROM */
+- if (!info->list[i].mtd) {
+- dev_warn(&dev->dev,
+- "do_map_probe() failed for type %s\n",
+- probe_type);
+-
+- info->list[i].mtd = do_map_probe("map_rom",
+- &info->list[i].map);
+- }
+- mtd_list[i] = info->list[i].mtd;
+-
+- err = -ENXIO;
+- if (!info->list[i].mtd) {
+- dev_err(&dev->dev, "do_map_probe() failed\n");
+- goto err_out;
+- } else {
+- info->list_size++;
+- }
+- info->list[i].mtd->dev.parent = &dev->dev;
+- }
+-
+- err = 0;
+- info->cmtd = NULL;
+- if (info->list_size == 1) {
+- info->cmtd = info->list[0].mtd;
+- } else if (info->list_size > 1) {
+- /*
+- * We detected multiple devices. Concatenate them together.
+- */
+- info->cmtd = mtd_concat_create(mtd_list, info->list_size,
+- dev_name(&dev->dev));
+- }
+- if (info->cmtd == NULL)
+- err = -ENXIO;
+-
+- if (err)
+- goto err_out;
+-
+- info->cmtd->dev.parent = &dev->dev;
+- mtd_set_of_node(info->cmtd, dp);
+- part_probe_types = of_get_probes(dp);
+- if (!part_probe_types) {
+- err = -ENOMEM;
+- goto err_out;
+- }
+- mtd_device_parse_register(info->cmtd, part_probe_types, NULL,
+- NULL, 0);
+- of_free_probes(part_probe_types);
+-
+- kfree(mtd_list);
+-
+- return 0;
+-
+-err_out:
+- kfree(mtd_list);
+-err_flash_remove:
+- of_flash_remove(dev);
+-
+- return err;
+-}
+-
+-static const struct of_device_id of_flash_match[] = {
+- {
+- .compatible = "cfi-flash",
+- .data = (void *)"cfi_probe",
+- },
+- {
+- /* FIXME: JEDEC chips can't be safely and reliably
+- * probed, although the mtd code gets it right in
+- * practice most of the time. We should use the
+- * vendor and device ids specified by the binding to
+- * bypass the heuristic probe code, but the mtd layer
+- * provides, at present, no interface for doing so
+- * :(. */
+- .compatible = "jedec-flash",
+- .data = (void *)"jedec_probe",
+- },
+- {
+- .compatible = "mtd-ram",
+- .data = (void *)"map_ram",
+- },
+- {
+- .compatible = "mtd-rom",
+- .data = (void *)"map_rom",
+- },
+- {
+- .type = "rom",
+- .compatible = "direct-mapped"
+- },
+- { },
+-};
+-MODULE_DEVICE_TABLE(of, of_flash_match);
+-
+-static struct platform_driver of_flash_driver = {
+- .driver = {
+- .name = "of-flash",
+- .of_match_table = of_flash_match,
+- },
+- .probe = of_flash_probe,
+- .remove = of_flash_remove,
+-};
+-
+-module_platform_driver(of_flash_driver);
+-
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Vitaly Wool <vwool@ru.mvista.com>");
+-MODULE_DESCRIPTION("Device tree based MTD map driver");
+--- /dev/null
++++ b/drivers/mtd/maps/physmap_of_core.c
+@@ -0,0 +1,389 @@
++/*
++ * Flash mappings described by the OF (or flattened) device tree
++ *
++ * Copyright (C) 2006 MontaVista Software Inc.
++ * Author: Vitaly Wool <vwool@ru.mvista.com>
++ *
++ * Revised to handle newer style flash binding by:
++ * Copyright (C) 2007 David Gibson, IBM Corporation.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/device.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/map.h>
++#include <linux/mtd/partitions.h>
++#include <linux/mtd/concat.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_platform.h>
++#include <linux/slab.h>
++#include "physmap_of_gemini.h"
++#include "physmap_of_versatile.h"
++
++struct of_flash_list {
++ struct mtd_info *mtd;
++ struct map_info map;
++ struct resource *res;
++};
++
++struct of_flash {
++ struct mtd_info *cmtd;
++ int list_size; /* number of elements in of_flash_list */
++ struct of_flash_list list[0];
++};
++
++static int of_flash_remove(struct platform_device *dev)
++{
++ struct of_flash *info;
++ int i;
++
++ info = dev_get_drvdata(&dev->dev);
++ if (!info)
++ return 0;
++ dev_set_drvdata(&dev->dev, NULL);
++
++ if (info->cmtd) {
++ mtd_device_unregister(info->cmtd);
++ if (info->cmtd != info->list[0].mtd)
++ mtd_concat_destroy(info->cmtd);
++ }
++
++ for (i = 0; i < info->list_size; i++) {
++ if (info->list[i].mtd)
++ map_destroy(info->list[i].mtd);
++
++ if (info->list[i].map.virt)
++ iounmap(info->list[i].map.virt);
++
++ if (info->list[i].res) {
++ release_resource(info->list[i].res);
++ kfree(info->list[i].res);
++ }
++ }
++ return 0;
++}
++
++static const char * const rom_probe_types[] = {
++ "cfi_probe", "jedec_probe", "map_rom" };
++
++/* Helper function to handle probing of the obsolete "direct-mapped"
++ * compatible binding, which has an extra "probe-type" property
++ * describing the type of flash probe necessary. */
++static struct mtd_info *obsolete_probe(struct platform_device *dev,
++ struct map_info *map)
++{
++ struct device_node *dp = dev->dev.of_node;
++ const char *of_probe;
++ struct mtd_info *mtd;
++ int i;
++
++ dev_warn(&dev->dev, "Device tree uses obsolete \"direct-mapped\" "
++ "flash binding\n");
++
++ of_probe = of_get_property(dp, "probe-type", NULL);
++ if (!of_probe) {
++ for (i = 0; i < ARRAY_SIZE(rom_probe_types); i++) {
++ mtd = do_map_probe(rom_probe_types[i], map);
++ if (mtd)
++ return mtd;
++ }
++ return NULL;
++ } else if (strcmp(of_probe, "CFI") == 0) {
++ return do_map_probe("cfi_probe", map);
++ } else if (strcmp(of_probe, "JEDEC") == 0) {
++ return do_map_probe("jedec_probe", map);
++ } else {
++ if (strcmp(of_probe, "ROM") != 0)
++ dev_warn(&dev->dev, "obsolete_probe: don't know probe "
++ "type '%s', mapping as rom\n", of_probe);
++ return do_map_probe("map_rom", map);
++ }
++}
++
++/* When partitions are set we look for a linux,part-probe property which
++ specifies the list of partition probers to use. If none is given then the
++ default is use. These take precedence over other device tree
++ information. */
++static const char * const part_probe_types_def[] = {
++ "cmdlinepart", "RedBoot", "ofpart", "ofoldpart", NULL };
++
++static const char * const *of_get_probes(struct device_node *dp)
++{
++ const char *cp;
++ int cplen;
++ unsigned int l;
++ unsigned int count;
++ const char **res;
++
++ cp = of_get_property(dp, "linux,part-probe", &cplen);
++ if (cp == NULL)
++ return part_probe_types_def;
++
++ count = 0;
++ for (l = 0; l != cplen; l++)
++ if (cp[l] == 0)
++ count++;
++
++ res = kzalloc((count + 1)*sizeof(*res), GFP_KERNEL);
++ if (!res)
++ return NULL;
++ count = 0;
++ while (cplen > 0) {
++ res[count] = cp;
++ l = strlen(cp) + 1;
++ cp += l;
++ cplen -= l;
++ count++;
++ }
++ return res;
++}
++
++static void of_free_probes(const char * const *probes)
++{
++ if (probes != part_probe_types_def)
++ kfree(probes);
++}
++
++static const struct of_device_id of_flash_match[];
++static int of_flash_probe(struct platform_device *dev)
++{
++ const char * const *part_probe_types;
++ const struct of_device_id *match;
++ struct device_node *dp = dev->dev.of_node;
++ struct resource res;
++ struct of_flash *info;
++ const char *probe_type;
++ const __be32 *width;
++ int err;
++ int i;
++ int count;
++ const __be32 *p;
++ int reg_tuple_size;
++ struct mtd_info **mtd_list = NULL;
++ resource_size_t res_size;
++ bool map_indirect;
++ const char *mtd_name = NULL;
++
++ match = of_match_device(of_flash_match, &dev->dev);
++ if (!match)
++ return -EINVAL;
++ probe_type = match->data;
++
++ reg_tuple_size = (of_n_addr_cells(dp) + of_n_size_cells(dp)) * sizeof(u32);
++
++ of_property_read_string(dp, "linux,mtd-name", &mtd_name);
++
++ /*
++ * Get number of "reg" tuples. Scan for MTD devices on area's
++ * described by each "reg" region. This makes it possible (including
++ * the concat support) to support the Intel P30 48F4400 chips which
++ * consists internally of 2 non-identical NOR chips on one die.
++ */
++ p = of_get_property(dp, "reg", &count);
++ if (!p || count % reg_tuple_size != 0) {
++ dev_err(&dev->dev, "Malformed reg property on %s\n",
++ dev->dev.of_node->full_name);
++ err = -EINVAL;
++ goto err_flash_remove;
++ }
++ count /= reg_tuple_size;
++
++ map_indirect = of_property_read_bool(dp, "no-unaligned-direct-access");
++
++ err = -ENOMEM;
++ info = devm_kzalloc(&dev->dev,
++ sizeof(struct of_flash) +
++ sizeof(struct of_flash_list) * count, GFP_KERNEL);
++ if (!info)
++ goto err_flash_remove;
++
++ dev_set_drvdata(&dev->dev, info);
++
++ mtd_list = kzalloc(sizeof(*mtd_list) * count, GFP_KERNEL);
++ if (!mtd_list)
++ goto err_flash_remove;
++
++ for (i = 0; i < count; i++) {
++ err = -ENXIO;
++ if (of_address_to_resource(dp, i, &res)) {
++ /*
++ * Continue with next register tuple if this
++ * one is not mappable
++ */
++ continue;
++ }
++
++ dev_dbg(&dev->dev, "of_flash device: %pR\n", &res);
++
++ err = -EBUSY;
++ res_size = resource_size(&res);
++ info->list[i].res = request_mem_region(res.start, res_size,
++ dev_name(&dev->dev));
++ if (!info->list[i].res)
++ goto err_out;
++
++ err = -ENXIO;
++ width = of_get_property(dp, "bank-width", NULL);
++ if (!width) {
++ dev_err(&dev->dev, "Can't get bank width from device"
++ " tree\n");
++ goto err_out;
++ }
++
++ info->list[i].map.name = mtd_name ?: dev_name(&dev->dev);
++ info->list[i].map.phys = res.start;
++ info->list[i].map.size = res_size;
++ info->list[i].map.bankwidth = be32_to_cpup(width);
++ info->list[i].map.device_node = dp;
++
++ err = of_flash_probe_gemini(dev, dp, &info->list[i].map);
++ if (err)
++ return err;
++ err = of_flash_probe_versatile(dev, dp, &info->list[i].map);
++ if (err)
++ return err;
++
++ err = -ENOMEM;
++ info->list[i].map.virt = ioremap(info->list[i].map.phys,
++ info->list[i].map.size);
++ if (!info->list[i].map.virt) {
++ dev_err(&dev->dev, "Failed to ioremap() flash"
++ " region\n");
++ goto err_out;
++ }
++
++ simple_map_init(&info->list[i].map);
++
++ /*
++ * On some platforms (e.g. MPC5200) a direct 1:1 mapping
++ * may cause problems with JFFS2 usage, as the local bus (LPB)
++ * doesn't support unaligned accesses as implemented in the
++ * JFFS2 code via memcpy(). By setting NO_XIP, the
++ * flash will not be exposed directly to the MTD users
++ * (e.g. JFFS2) any more.
++ */
++ if (map_indirect)
++ info->list[i].map.phys = NO_XIP;
++
++ if (probe_type) {
++ info->list[i].mtd = do_map_probe(probe_type,
++ &info->list[i].map);
++ } else {
++ info->list[i].mtd = obsolete_probe(dev,
++ &info->list[i].map);
++ }
++
++ /* Fall back to mapping region as ROM */
++ if (!info->list[i].mtd) {
++ dev_warn(&dev->dev,
++ "do_map_probe() failed for type %s\n",
++ probe_type);
++
++ info->list[i].mtd = do_map_probe("map_rom",
++ &info->list[i].map);
++ }
++ mtd_list[i] = info->list[i].mtd;
++
++ err = -ENXIO;
++ if (!info->list[i].mtd) {
++ dev_err(&dev->dev, "do_map_probe() failed\n");
++ goto err_out;
++ } else {
++ info->list_size++;
++ }
++ info->list[i].mtd->dev.parent = &dev->dev;
++ }
++
++ err = 0;
++ info->cmtd = NULL;
++ if (info->list_size == 1) {
++ info->cmtd = info->list[0].mtd;
++ } else if (info->list_size > 1) {
++ /*
++ * We detected multiple devices. Concatenate them together.
++ */
++ info->cmtd = mtd_concat_create(mtd_list, info->list_size,
++ dev_name(&dev->dev));
++ }
++ if (info->cmtd == NULL)
++ err = -ENXIO;
++
++ if (err)
++ goto err_out;
++
++ info->cmtd->dev.parent = &dev->dev;
++ mtd_set_of_node(info->cmtd, dp);
++ part_probe_types = of_get_probes(dp);
++ if (!part_probe_types) {
++ err = -ENOMEM;
++ goto err_out;
++ }
++ mtd_device_parse_register(info->cmtd, part_probe_types, NULL,
++ NULL, 0);
++ of_free_probes(part_probe_types);
++
++ kfree(mtd_list);
++
++ return 0;
++
++err_out:
++ kfree(mtd_list);
++err_flash_remove:
++ of_flash_remove(dev);
++
++ return err;
++}
++
++static const struct of_device_id of_flash_match[] = {
++ {
++ .compatible = "cfi-flash",
++ .data = (void *)"cfi_probe",
++ },
++ {
++ /* FIXME: JEDEC chips can't be safely and reliably
++ * probed, although the mtd code gets it right in
++ * practice most of the time. We should use the
++ * vendor and device ids specified by the binding to
++ * bypass the heuristic probe code, but the mtd layer
++ * provides, at present, no interface for doing so
++ * :(. */
++ .compatible = "jedec-flash",
++ .data = (void *)"jedec_probe",
++ },
++ {
++ .compatible = "mtd-ram",
++ .data = (void *)"map_ram",
++ },
++ {
++ .compatible = "mtd-rom",
++ .data = (void *)"map_rom",
++ },
++ {
++ .type = "rom",
++ .compatible = "direct-mapped"
++ },
++ { },
++};
++MODULE_DEVICE_TABLE(of, of_flash_match);
++
++static struct platform_driver of_flash_driver = {
++ .driver = {
++ .name = "of-flash",
++ .of_match_table = of_flash_match,
++ },
++ .probe = of_flash_probe,
++ .remove = of_flash_remove,
++};
++
++module_platform_driver(of_flash_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Vitaly Wool <vwool@ru.mvista.com>");
++MODULE_DESCRIPTION("Device tree based MTD map driver");
--- /dev/null
+From 441a681b8843474c9796b50c35794ff102701f37 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Tue, 14 Mar 2017 08:37:40 +0900
+Subject: phy: rcar-gen3-usb2: fix implementation for runtime PM
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 441a681b8843474c9796b50c35794ff102701f37 upstream.
+
+This patch fixes an issue that this driver doesn't take care of the runtime
+PM. This code assumed that devm_phy_create() called pm_runtime_enable(dev),
+but it misunderstood the dev_phy_create()'s specification.
+This driver should call its own pm_runtime_enable() before
+dev_phy_create().
+
+Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/phy-rcar-gen3-usb2.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+--- a/drivers/phy/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/phy-rcar-gen3-usb2.c
+@@ -20,6 +20,7 @@
+ #include <linux/of_address.h>
+ #include <linux/phy/phy.h>
+ #include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/workqueue.h>
+
+@@ -395,7 +396,7 @@ static int rcar_gen3_phy_usb2_probe(stru
+ struct rcar_gen3_chan *channel;
+ struct phy_provider *provider;
+ struct resource *res;
+- int irq;
++ int irq, ret = 0;
+
+ if (!dev->of_node) {
+ dev_err(dev, "This driver needs device tree\n");
+@@ -434,17 +435,24 @@ static int rcar_gen3_phy_usb2_probe(stru
+ }
+ }
+
+- /* devm_phy_create() will call pm_runtime_enable(dev); */
++ /*
++ * devm_phy_create() will call pm_runtime_enable(&phy->dev);
++ * And then, phy-core will manage runtime pm for this device.
++ */
++ pm_runtime_enable(dev);
+ channel->phy = devm_phy_create(dev, NULL, &rcar_gen3_phy_usb2_ops);
+ if (IS_ERR(channel->phy)) {
+ dev_err(dev, "Failed to create USB2 PHY\n");
+- return PTR_ERR(channel->phy);
++ ret = PTR_ERR(channel->phy);
++ goto error;
+ }
+
+ channel->vbus = devm_regulator_get_optional(dev, "vbus");
+ if (IS_ERR(channel->vbus)) {
+- if (PTR_ERR(channel->vbus) == -EPROBE_DEFER)
+- return PTR_ERR(channel->vbus);
++ if (PTR_ERR(channel->vbus) == -EPROBE_DEFER) {
++ ret = PTR_ERR(channel->vbus);
++ goto error;
++ }
+ channel->vbus = NULL;
+ }
+
+@@ -454,15 +462,22 @@ static int rcar_gen3_phy_usb2_probe(stru
+ provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
+ if (IS_ERR(provider)) {
+ dev_err(dev, "Failed to register PHY provider\n");
++ ret = PTR_ERR(provider);
++ goto error;
+ } else if (channel->has_otg) {
+ int ret;
+
+ ret = device_create_file(dev, &dev_attr_role);
+ if (ret < 0)
+- return ret;
++ goto error;
+ }
+
+- return PTR_ERR_OR_ZERO(provider);
++ return 0;
++
++error:
++ pm_runtime_disable(dev);
++
++ return ret;
+ }
+
+ static int rcar_gen3_phy_usb2_remove(struct platform_device *pdev)
+@@ -472,6 +487,8 @@ static int rcar_gen3_phy_usb2_remove(str
+ if (channel->has_otg)
+ device_remove_file(&pdev->dev, &dev_attr_role);
+
++ pm_runtime_disable(&pdev->dev);
++
+ return 0;
+ };
+
--- /dev/null
+From aaa229529244a1135b29353fefb001c430db79f0 Mon Sep 17 00:00:00 2001
+From: Oliver O'Halloran <oohall@gmail.com>
+Date: Fri, 31 Mar 2017 12:37:49 +1100
+Subject: powerpc/mm: Add physical address to Linux page table dump
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+commit aaa229529244a1135b29353fefb001c430db79f0 upstream.
+
+The current page table dumper scans the Linux page tables and coalesces mappings
+with adjacent virtual addresses and similar PTE flags. This behaviour is
+somewhat broken when you consider the IOREMAP space where entirely unrelated
+mappings will appear to be virtually contiguous. This patch modifies the range
+coalescing so that only ranges that are both physically and virtually contiguous
+are combined. This patch also adds to the dump output the physical address at
+the start of each range.
+
+Fixes: 8eb07b187000 ("powerpc/mm: Dump linux pagetables")
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+[mpe: Print the physicall address with 0x like the other addresses]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/dump_linuxpagetables.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ b/arch/powerpc/mm/dump_linuxpagetables.c
+@@ -57,6 +57,8 @@ struct pg_state {
+ struct seq_file *seq;
+ const struct addr_marker *marker;
+ unsigned long start_address;
++ unsigned long start_pa;
++ unsigned long last_pa;
+ unsigned int level;
+ u64 current_flags;
+ };
+@@ -253,7 +255,9 @@ static void dump_addr(struct pg_state *s
+ const char *unit = units;
+ unsigned long delta;
+
+- seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr-1);
++ seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr-1);
++ seq_printf(st->seq, "0x%016lx ", st->start_pa);
++
+ delta = (addr - st->start_address) >> 10;
+ /* Work out what appropriate unit to use */
+ while (!(delta & 1023) && unit[1]) {
+@@ -268,11 +272,15 @@ static void note_page(struct pg_state *s
+ unsigned int level, u64 val)
+ {
+ u64 flag = val & pg_level[level].mask;
++ u64 pa = val & PTE_RPN_MASK;
++
+ /* At first no level is set */
+ if (!st->level) {
+ st->level = level;
+ st->current_flags = flag;
+ st->start_address = addr;
++ st->start_pa = pa;
++ st->last_pa = pa;
+ seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
+ /*
+ * Dump the section of virtual memory when:
+@@ -280,9 +288,11 @@ static void note_page(struct pg_state *s
+ * - we change levels in the tree.
+ * - the address is in a different section of memory and is thus
+ * used for a different purpose, regardless of the flags.
++ * - the pa of this page is not adjacent to the last inspected page
+ */
+ } else if (flag != st->current_flags || level != st->level ||
+- addr >= st->marker[1].start_address) {
++ addr >= st->marker[1].start_address ||
++ pa != st->last_pa + PAGE_SIZE) {
+
+ /* Check the PTE flags */
+ if (st->current_flags) {
+@@ -306,8 +316,12 @@ static void note_page(struct pg_state *s
+ seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
+ }
+ st->start_address = addr;
++ st->start_pa = pa;
++ st->last_pa = pa;
+ st->current_flags = flag;
+ st->level = level;
++ } else {
++ st->last_pa = pa;
+ }
+ }
+
--- /dev/null
+From 6830733d53a4517588e56227b9c8538633f0c496 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 2 Feb 2017 12:53:04 -0200
+Subject: [media] pvrusb2: reduce stack usage pvr2_eeprom_analyze()
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 6830733d53a4517588e56227b9c8538633f0c496 upstream.
+
+The driver uses a relatively large data structure on the stack, which
+showed up on my radar as we get a warning with the "latent entropy"
+GCC plugin:
+
+drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:153:1: error: the frame size of 1376 bytes is larger than 1152 bytes [-Werror=frame-larger-than=]
+
+The warning is usually hidden as we raise the warning limit to 2048
+when the plugin is enabled, but I'd like to lower that again in the
+future, and making this function smaller helps to do that without
+build regressions.
+
+Further analysis shows that putting an 'i2c_client' structure on
+the stack is not really supported, as the embedded 'struct device'
+is not initialized here, and we are only saved by the fact that
+the function that is called here does not use the pointer at all.
+
+Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/pvrusb2/pvrusb2-eeprom.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c
+@@ -118,15 +118,10 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
+ memset(&tvdata,0,sizeof(tvdata));
+
+ eeprom = pvr2_eeprom_fetch(hdw);
+- if (!eeprom) return -EINVAL;
++ if (!eeprom)
++ return -EINVAL;
+
+- {
+- struct i2c_client fake_client;
+- /* Newer version expects a useless client interface */
+- fake_client.addr = hdw->eeprom_addr;
+- fake_client.adapter = &hdw->i2c_adap;
+- tveeprom_hauppauge_analog(&fake_client,&tvdata,eeprom);
+- }
++ tveeprom_hauppauge_analog(NULL, &tvdata, eeprom);
+
+ trace_eeprom("eeprom assumed v4l tveeprom module");
+ trace_eeprom("eeprom direct call results:");
--- /dev/null
+From 023f108dcc187e34ef864bf10ed966cf25e14e2a Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Wed, 7 Jun 2017 16:48:19 -0400
+Subject: selinux: fix double free in selinux_parse_opts_str()
+
+From: Paul Moore <paul@paul-moore.com>
+
+commit 023f108dcc187e34ef864bf10ed966cf25e14e2a upstream.
+
+This patch is based on a discussion generated by an earlier patch
+from Tetsuo Handa:
+
+* https://marc.info/?t=149035659300001&r=1&w=2
+
+The double free problem involves the mnt_opts field of the
+security_mnt_opts struct, selinux_parse_opts_str() frees the memory
+on error, but doesn't set the field to NULL so if the caller later
+attempts to call security_free_mnt_opts() we trigger the problem.
+
+In order to play it safe we change selinux_parse_opts_str() to call
+security_free_mnt_opts() on error instead of free'ing the memory
+directly. This should ensure that everything is handled correctly,
+regardless of what the caller may do.
+
+Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
+Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/selinux/hooks.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1106,10 +1106,8 @@ static int selinux_parse_opts_str(char *
+
+ opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
+ GFP_KERNEL);
+- if (!opts->mnt_opts_flags) {
+- kfree(opts->mnt_opts);
++ if (!opts->mnt_opts_flags)
+ goto out_err;
+- }
+
+ if (fscontext) {
+ opts->mnt_opts[num_mnt_opts] = fscontext;
+@@ -1132,6 +1130,7 @@ static int selinux_parse_opts_str(char *
+ return 0;
+
+ out_err:
++ security_free_mnt_opts(opts);
+ kfree(context);
+ kfree(defcontext);
+ kfree(fscontext);
--- /dev/null
+From 7cd3e9dbdd4c0025d0e37c8c73a2ac8641fc55bc Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Thu, 23 Mar 2017 09:26:42 +0100
+Subject: serial: 8250_lpss: Unconditionally set PCI master for Quark
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+commit 7cd3e9dbdd4c0025d0e37c8c73a2ac8641fc55bc upstream.
+
+MSI needs it as well.
+
+Should have no practical impact, though, as DMA is always available on
+the Quark. But given the few users of pci_alloc_irq_vectors so far, this
+incorrect pattern may spread otherwise.
+
+Fixes: 3f3a46951e02 ("serial: 8250_lpss: set PCI master only for private DMA")
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_lpss.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_lpss.c
++++ b/drivers/tty/serial/8250/8250_lpss.c
+@@ -183,7 +183,6 @@ static void qrk_serial_setup_dma(struct
+ if (ret)
+ return;
+
+- pci_set_master(pdev);
+ pci_try_set_mwi(pdev);
+
+ /* Special DMA address for UART */
+@@ -216,6 +215,8 @@ static int qrk_serial_setup(struct lpss8
+ struct pci_dev *pdev = to_pci_dev(port->dev);
+ int ret;
+
++ pci_set_master(pdev);
++
+ ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
+ if (ret < 0)
+ return ret;
--- /dev/null
+From be40597a1bc173bf9dadccdf5388b956f620ae8f Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 12 May 2017 16:35:45 +0200
+Subject: serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit be40597a1bc173bf9dadccdf5388b956f620ae8f upstream.
+
+UARTn_FRAME_PARITY_ODD is 0x0300
+UARTn_FRAME_PARITY_EVEN is 0x0200
+So if the UART is configured for EVEN parity, it would be reported as ODD.
+Fix it by correctly testing if the 2 bits are set.
+
+Fixes: 3afbd89c9639 ("serial/efm32: add new driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/efm32-uart.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/efm32-uart.c
++++ b/drivers/tty/serial/efm32-uart.c
+@@ -27,6 +27,7 @@
+ #define UARTn_FRAME 0x04
+ #define UARTn_FRAME_DATABITS__MASK 0x000f
+ #define UARTn_FRAME_DATABITS(n) ((n) - 3)
++#define UARTn_FRAME_PARITY__MASK 0x0300
+ #define UARTn_FRAME_PARITY_NONE 0x0000
+ #define UARTn_FRAME_PARITY_EVEN 0x0200
+ #define UARTn_FRAME_PARITY_ODD 0x0300
+@@ -572,12 +573,16 @@ static void efm32_uart_console_get_optio
+ 16 * (4 + (clkdiv >> 6)));
+
+ frame = efm32_uart_read32(efm_port, UARTn_FRAME);
+- if (frame & UARTn_FRAME_PARITY_ODD)
++ switch (frame & UARTn_FRAME_PARITY__MASK) {
++ case UARTn_FRAME_PARITY_ODD:
+ *parity = 'o';
+- else if (frame & UARTn_FRAME_PARITY_EVEN)
++ break;
++ case UARTn_FRAME_PARITY_EVEN:
+ *parity = 'e';
+- else
++ break;
++ default:
+ *parity = 'n';
++ }
+
+ *bits = (frame & UARTn_FRAME_DATABITS__MASK) -
+ UARTn_FRAME_DATABITS(4) + 4;
--- /dev/null
+From cfa6eb239154315e6efcdda1d929e024097f927b Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 28 Mar 2017 11:13:46 +0200
+Subject: serial: sh-sci: Fix (AUTO)RTS in sci_init_pins()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit cfa6eb239154315e6efcdda1d929e024097f927b upstream.
+
+If a UART has dedicated RTS/CTS pins, and hardware control flow is
+disabled (or AUTORTS is not yet effective), changing any serial port
+configuration deasserts RTS, as .set_termios() calls sci_init_pins().
+
+To fix this, consider the current (AUTO)RTS state when (re)initializing
+the pins. Note that for SCIFA/SCIFB, AUTORTS needs explicit
+configuration of the RTS# pin function, while (H)SCIF handles this
+automatically.
+
+Fixes: d2b9775d795ec05f ("serial: sh-sci: Correct pin initialization on (H)SCIF")
+Fixes: e9d7a45a03991349 ("serial: sh-sci: Add pin initialization for SCIFA/SCIFB")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sh-sci.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -683,24 +683,37 @@ static void sci_init_pins(struct uart_po
+ }
+
+ if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
++ u16 data = serial_port_in(port, SCPDR);
+ u16 ctrl = serial_port_in(port, SCPCR);
+
+ /* Enable RXD and TXD pin functions */
+ ctrl &= ~(SCPCR_RXDC | SCPCR_TXDC);
+ if (to_sci_port(port)->has_rtscts) {
+- /* RTS# is output, driven 1 */
+- ctrl |= SCPCR_RTSC;
+- serial_port_out(port, SCPDR,
+- serial_port_in(port, SCPDR) | SCPDR_RTSD);
++ /* RTS# is output, active low, unless autorts */
++ if (!(port->mctrl & TIOCM_RTS)) {
++ ctrl |= SCPCR_RTSC;
++ data |= SCPDR_RTSD;
++ } else if (!s->autorts) {
++ ctrl |= SCPCR_RTSC;
++ data &= ~SCPDR_RTSD;
++ } else {
++ /* Enable RTS# pin function */
++ ctrl &= ~SCPCR_RTSC;
++ }
+ /* Enable CTS# pin function */
+ ctrl &= ~SCPCR_CTSC;
+ }
++ serial_port_out(port, SCPDR, data);
+ serial_port_out(port, SCPCR, ctrl);
+ } else if (sci_getreg(port, SCSPTR)->size) {
+ u16 status = serial_port_in(port, SCSPTR);
+
+- /* RTS# is output, driven 1 */
+- status |= SCSPTR_RTSIO | SCSPTR_RTSDT;
++ /* RTS# is always output; and active low, unless autorts */
++ status |= SCSPTR_RTSIO;
++ if (!(port->mctrl & TIOCM_RTS))
++ status |= SCSPTR_RTSDT;
++ else if (!s->autorts)
++ status &= ~SCSPTR_RTSDT;
+ /* CTS# and SCK are inputs */
+ status &= ~(SCSPTR_CTSIO | SCSPTR_SCKIO);
+ serial_port_out(port, SCSPTR, status);
--- /dev/null
+From 5f76895e4c712b1b5af450cf344389b8c53ac2c2 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 28 Mar 2017 11:13:45 +0200
+Subject: serial: sh-sci: Fix late enablement of AUTORTS
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 5f76895e4c712b1b5af450cf344389b8c53ac2c2 upstream.
+
+When changing hardware control flow for a UART with dedicated RTS/CTS
+pins, the new AUTORTS state is not immediately reflected in the
+hardware, but only when RTS is raised. However, the serial core does
+not call .set_mctrl() after .set_termios(), hence AUTORTS may only
+become effective when the port is closed, and reopened later.
+Note that this problem does not happen when manually using stty to
+change CRTSCTS, as AUTORTS will work fine on next open.
+
+To fix this, call .set_mctrl() from .set_termios() when dedicated
+RTS/CTS pins are present, to refresh the AUTORTS or RTS state.
+This is similar to what other drivers supporting AUTORTS do (e.g.
+omap-serial).
+
+Reported-by: Baumann, Christoph (C.) <cbaumann@visteon.com>
+Fixes: 33f50ffc253854cf ("serial: sh-sci: Fix support for hardware-assisted RTS/CTS")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sh-sci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -2389,6 +2389,10 @@ done:
+
+ serial_port_out(port, SCFCR, ctrl);
+ }
++ if (port->flags & UPF_HARD_FLOW) {
++ /* Refresh (Auto) RTS */
++ sci_set_mctrl(port, port->mctrl);
++ }
+
+ scr_val |= SCSCR_RE | SCSCR_TE |
+ (s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0));
--- /dev/null
+fs-pass-on-flags-in-compat_writev.patch
+configfs-fix-race-between-create_link-and-configfs_rmdir.patch
+can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch
+ila_xlat-add-missing-hash-secret-initialization.patch
+cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch
+vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch
+cec-race-fix-don-t-return-enonet-in-cec_receive.patch
+selinux-fix-double-free-in-selinux_parse_opts_str.patch
+mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch
+mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch
+drm-mxsfb_crtc-reset-the-elcdif-controller.patch
+drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch
+drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch
+drm-i915-fix-scaling-check-for-90-270-degree-plane-rotation.patch
+drm-i915-do-not-sync-rcu-during-shrinking.patch
+mac80211-fix-ibss-presp-allocation-size.patch
+mac80211-strictly-check-mesh-address-extension-mode.patch
+mac80211-fix-dropped-counter-in-multiqueue-rx.patch
+mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch
+drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch
+drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch
+serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch
+serial-8250_lpss-unconditionally-set-pci-master-for-quark.patch
+serial-sh-sci-fix-auto-rts-in-sci_init_pins.patch
+serial-sh-sci-fix-late-enablement-of-autorts.patch
+x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch
+mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch
+mfd-axp20x-add-support-for-dts-property-xpowers-master-mode.patch
+dt-bindings-mfd-axp20x-add-xpowers-master-mode-property-for-axp806-pmics.patch
+mfd-cpcap-fix-interrupt-to-use-level-interrupt.patch
+mfd-cpcap-use-ack_invert-interrupts.patch
+mfd-cpcap-fix-bad-use-of-irq-sense-register.patch
+phy-rcar-gen3-usb2-fix-implementation-for-runtime-pm.patch
+mtd-physmap_of-really-fix-the-physmap-add-ons.patch
+powerpc-mm-add-physical-address-to-linux-page-table-dump.patch
+staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch
+staging-bcm2835-camera-fix-error-handling-in-init.patch
+staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch
+iio-imu-st_lsm6dsx-do-not-apply-odr-configuration-in-write_raw-handler.patch
+iio-proximity-as3935-recalibrate-rco-after-resume.patch
+iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch
+alsa-hda-add-geminilake-id-to-skl_plus.patch
+alsa-usb-audio-fix-amanero-combo384-quirk-on-big-endian-hosts.patch
+usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch
+usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch
+usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch
+usb-hub-fix-ss-max-number-of-ports.patch
+usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch
+usb-usbip-fix-nonconforming-hub-descriptor.patch
+usb-dwc3-gadget-fix-iso-transfer-performance.patch
+pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch
+usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch
+usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch
+usb-r8a66597-hcd-decrease-timeout.patch
+coda-restore-original-firmware-locations.patch
+drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch
--- /dev/null
+From 8e17858a8818b40d66e83de2bf3724c64eaad72d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 18 Feb 2017 02:20:15 +0300
+Subject: staging: bcm2835-camera: fix error handling in init
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 8e17858a8818b40d66e83de2bf3724c64eaad72d upstream.
+
+The unwinding here isn't right. We don't free gdev[0] and instead
+free 1 step past what was allocated. Also we can't allocate "dev" then
+we should unwind instead of returning directly.
+
+Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: walter harms <wharms@bfs.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/platform/bcm2835/bcm2835-camera.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/media/platform/bcm2835/bcm2835-camera.c
++++ b/drivers/staging/media/platform/bcm2835/bcm2835-camera.c
+@@ -1901,6 +1901,7 @@ static int __init bm2835_mmal_init(void)
+ unsigned int num_cameras;
+ struct vchiq_mmal_instance *instance;
+ unsigned int resolutions[MAX_BCM2835_CAMERAS][2];
++ int i;
+
+ ret = vchiq_mmal_init(&instance);
+ if (ret < 0)
+@@ -1914,8 +1915,10 @@ static int __init bm2835_mmal_init(void)
+
+ for (camera = 0; camera < num_cameras; camera++) {
+ dev = kzalloc(sizeof(struct bm2835_mmal_dev), GFP_KERNEL);
+- if (!dev)
+- return -ENOMEM;
++ if (!dev) {
++ ret = -ENOMEM;
++ goto cleanup_gdev;
++ }
+
+ dev->camera_num = camera;
+ dev->max_width = resolutions[camera][0];
+@@ -1998,9 +2001,10 @@ unreg_dev:
+ free_dev:
+ kfree(dev);
+
+- for ( ; camera > 0; camera--) {
+- bcm2835_cleanup_instance(gdev[camera]);
+- gdev[camera] = NULL;
++cleanup_gdev:
++ for (i = 0; i < camera; i++) {
++ bcm2835_cleanup_instance(gdev[i]);
++ gdev[i] = NULL;
+ }
+ pr_info("%s: error %d while loading driver\n",
+ BM2835_MMAL_MODULE_NAME, ret);
--- /dev/null
+From cf6c77323a96fc40309cc8a4921ef206cccdd961 Mon Sep 17 00:00:00 2001
+From: Eva Rachel Retuya <eraretuya@gmail.com>
+Date: Mon, 20 Mar 2017 19:27:05 +0800
+Subject: staging: iio: tsl2x7x_core: Fix standard deviation calculation
+
+From: Eva Rachel Retuya <eraretuya@gmail.com>
+
+commit cf6c77323a96fc40309cc8a4921ef206cccdd961 upstream.
+
+Standard deviation is calculated as the square root of the variance
+where variance is the mean of sample_sum and length. Correct the
+computation of statP->stddev in accordance to the proper calculation.
+
+Fixes: 3c97c08b5735 ("staging: iio: add TAOS tsl2x7x driver")
+Reported-by: Abhiram Balasubramanian <abhiram@cs.utah.edu>
+Signed-off-by: Eva Rachel Retuya <eraretuya@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/light/tsl2x7x_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/iio/light/tsl2x7x_core.c
++++ b/drivers/staging/iio/light/tsl2x7x_core.c
+@@ -854,7 +854,7 @@ void tsl2x7x_prox_calculate(int *data, i
+ tmp = data[i] - statP->mean;
+ sample_sum += tmp * tmp;
+ }
+- statP->stddev = int_sqrt((long)sample_sum) / length;
++ statP->stddev = int_sqrt((long)sample_sum / length);
+ }
+
+ /**
--- /dev/null
+From 784047eb2d3405a35087af70cba46170c5576b25 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 22 Apr 2017 13:47:23 +0300
+Subject: staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 784047eb2d3405a35087af70cba46170c5576b25 upstream.
+
+The "len" could be as low as -14 so we should check for negatives.
+
+Fixes: 9a7fe54ddc3a ("staging: r8188eu: Add source files for new driver - part 1")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/core/rtw_ap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
++++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
+@@ -888,7 +888,7 @@ int rtw_check_beacon_data(struct adapter
+ return _FAIL;
+
+
+- if (len > MAX_IE_SZ)
++ if (len < 0 || len > MAX_IE_SZ)
+ return _FAIL;
+
+ pbss_network->IELength = len;
--- /dev/null
+From 1a744d2eb76aaafb997fda004ae3ae62a1538f85 Mon Sep 17 00:00:00 2001
+From: Anton Bondarenko <anton.bondarenko.sama@gmail.com>
+Date: Sun, 7 May 2017 01:53:46 +0200
+Subject: usb: core: fix potential memory leak in error path during hcd creation
+
+From: Anton Bondarenko <anton.bondarenko.sama@gmail.com>
+
+commit 1a744d2eb76aaafb997fda004ae3ae62a1538f85 upstream.
+
+Free memory allocated for address0_mutex if allocation of bandwidth_mutex
+failed.
+
+Fixes: feb26ac31a2a ("usb: core: hub: hub_port_init lock controller instead of bus")
+
+Signed-off-by: Anton Bondarenko <anton.bondarenko.sama@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -2535,6 +2535,7 @@ struct usb_hcd *usb_create_shared_hcd(co
+ hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
+ GFP_KERNEL);
+ if (!hcd->bandwidth_mutex) {
++ kfree(hcd->address0_mutex);
+ kfree(hcd);
+ dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");
+ return NULL;
--- /dev/null
+From f1d6826cae30e97e37a1f2481d7e1dc4faa09ce1 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Fri, 21 Apr 2017 15:58:08 +0300
+Subject: usb: dwc3: gadget: Fix ISO transfer performance
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit f1d6826cae30e97e37a1f2481d7e1dc4faa09ce1 upstream.
+
+Commit 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()")
+caused a small change in the way ISO transfer is handled in the case
+when XferInProgress event happens on Isoc EP with an active transfer.
+This caused a performance degradation of 50%. e.g. using g_webcam on DUT
+and luvcview on host the video frame rate dropped from 16fps to 8fps
+@high-speed.
+
+Make the ISO transfer handling equivalent to that prior to that commit
+to get back the original ISO performance numbers.
+
+Fixes: 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()")
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1258,14 +1258,24 @@ static int __dwc3_gadget_ep_queue(struct
+ __dwc3_gadget_start_isoc(dwc, dep, cur_uf);
+ dep->flags &= ~DWC3_EP_PENDING_REQUEST;
+ }
++ return 0;
+ }
+- return 0;
++
++ if ((dep->flags & DWC3_EP_BUSY) &&
++ !(dep->flags & DWC3_EP_MISSED_ISOC)) {
++ WARN_ON_ONCE(!dep->resource_index);
++ ret = __dwc3_gadget_kick_transfer(dep,
++ dep->resource_index);
++ }
++
++ goto out;
+ }
+
+ if (!dwc3_calc_trbs_left(dep))
+ return 0;
+
+ ret = __dwc3_gadget_kick_transfer(dep, 0);
++out:
+ if (ret == -EBUSY)
+ ret = 0;
+
--- /dev/null
+From d81182ce30dbd497a1e7047d7fda2af040347790 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 10 May 2017 18:18:25 +0200
+Subject: USB: gadget: dummy_hcd: fix hub-descriptor removable fields
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d81182ce30dbd497a1e7047d7fda2af040347790 upstream.
+
+Flag the first and only port as removable while also leaving the
+remaining bits (including the reserved bit zero) unset in accordance
+with the specifications:
+
+ "Within a byte, if no port exists for a given location, the bit
+ field representing the port characteristics shall be 0."
+
+Also add a comment marking the legacy PortPwrCtrlMask field.
+
+Fixes: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support")
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: Tatyana Brokhman <tlinder@codeaurora.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/dummy_hcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -2008,7 +2008,7 @@ ss_hub_descriptor(struct usb_hub_descrip
+ HUB_CHAR_COMMON_OCPM);
+ desc->bNbrPorts = 1;
+ desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/
+- desc->u.ss.DeviceRemovable = 0xffff;
++ desc->u.ss.DeviceRemovable = 0;
+ }
+
+ static inline void hub_descriptor(struct usb_hub_descriptor *desc)
+@@ -2020,8 +2020,8 @@ static inline void hub_descriptor(struct
+ HUB_CHAR_INDV_PORT_LPSM |
+ HUB_CHAR_COMMON_OCPM);
+ desc->bNbrPorts = 1;
+- desc->u.hs.DeviceRemovable[0] = 0xff;
+- desc->u.hs.DeviceRemovable[1] = 0xff;
++ desc->u.hs.DeviceRemovable[0] = 0;
++ desc->u.hs.DeviceRemovable[1] = 0xff; /* PortPwrCtrlMask */
+ }
+
+ static int dummy_hub_control(
--- /dev/null
+From 067d6fdc558d2c43f0bfdc7af99630dd5eb08dc5 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 26 Apr 2017 20:50:08 +0900
+Subject: usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 067d6fdc558d2c43f0bfdc7af99630dd5eb08dc5 upstream.
+
+This patch fixes an issue that this driver is possible to cause
+deadlock by double-spinclocked in renesas_usb3_stop_controller().
+So, this patch removes spinlock API calling in renesas_usb3_stop().
+(In other words, the previous code had a redundant lock.)
+
+Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -1718,14 +1718,11 @@ static int renesas_usb3_start(struct usb
+ static int renesas_usb3_stop(struct usb_gadget *gadget)
+ {
+ struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget);
+- unsigned long flags;
+
+- spin_lock_irqsave(&usb3->lock, flags);
+ usb3->softconnect = false;
+ usb3->gadget.speed = USB_SPEED_UNKNOWN;
+ usb3->driver = NULL;
+ renesas_usb3_stop_controller(usb3);
+- spin_unlock_irqrestore(&usb3->lock, flags);
+
+ pm_runtime_put(usb3_to_dev(usb3));
+ pm_runtime_disable(usb3_to_dev(usb3));
--- /dev/null
+From cdc876877ebc3f0677b267756d4564e2a429e730 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 26 Apr 2017 20:50:07 +0900
+Subject: usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit cdc876877ebc3f0677b267756d4564e2a429e730 upstream.
+
+This patch fixes an issue that this driver is possible to access
+the registers before pm_runtime_get_sync() if a gadget driver is
+installed first. After that, oops happens on R-Car Gen3 environment.
+To avoid it, this patch changes the pm_runtime call timing from
+probe/remove to udc_start/udc_stop.
+
+Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -1707,6 +1707,9 @@ static int renesas_usb3_start(struct usb
+ /* hook up the driver */
+ usb3->driver = driver;
+
++ pm_runtime_enable(usb3_to_dev(usb3));
++ pm_runtime_get_sync(usb3_to_dev(usb3));
++
+ renesas_usb3_init_controller(usb3);
+
+ return 0;
+@@ -1724,6 +1727,9 @@ static int renesas_usb3_stop(struct usb_
+ renesas_usb3_stop_controller(usb3);
+ spin_unlock_irqrestore(&usb3->lock, flags);
+
++ pm_runtime_put(usb3_to_dev(usb3));
++ pm_runtime_disable(usb3_to_dev(usb3));
++
+ return 0;
+ }
+
+@@ -1761,9 +1767,6 @@ static int renesas_usb3_remove(struct pl
+ {
+ struct renesas_usb3 *usb3 = platform_get_drvdata(pdev);
+
+- pm_runtime_put(&pdev->dev);
+- pm_runtime_disable(&pdev->dev);
+-
+ usb_del_gadget_udc(&usb3->gadget);
+
+ __renesas_usb3_ep_free_request(usb3->ep0_req);
+@@ -1948,9 +1951,6 @@ static int renesas_usb3_probe(struct pla
+
+ usb3->workaround_for_vbus = priv->workaround_for_vbus;
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_get_sync(&pdev->dev);
+-
+ dev_info(&pdev->dev, "probed\n");
+
+ return 0;
--- /dev/null
+From 940f538a100c84c6e72813e4ac88bd1753a86945 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Wed, 26 Apr 2017 20:50:09 +0900
+Subject: usb: gadget: udc: renesas_usb3: lock for PN_ registers access
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 940f538a100c84c6e72813e4ac88bd1753a86945 upstream.
+
+This controller disallows to change the PIPE until reading/writing
+a packet finishes. However. the previous code is not enough to hold
+the lock in some functions. So, this patch fixes it.
+
+Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 28 +++++++++++++++++++++++++---
+ 1 file changed, 25 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -1401,7 +1401,13 @@ static void usb3_request_done_pipen(stru
+ struct renesas_usb3_request *usb3_req,
+ int status)
+ {
+- usb3_pn_stop(usb3);
++ unsigned long flags;
++
++ spin_lock_irqsave(&usb3->lock, flags);
++ if (usb3_pn_change(usb3, usb3_ep->num))
++ usb3_pn_stop(usb3);
++ spin_unlock_irqrestore(&usb3->lock, flags);
++
+ usb3_disable_pipe_irq(usb3, usb3_ep->num);
+ usb3_request_done(usb3_ep, usb3_req, status);
+
+@@ -1430,30 +1436,46 @@ static void usb3_irq_epc_pipen_bfrdy(str
+ {
+ struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num);
+ struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep);
++ bool done = false;
+
+ if (!usb3_req)
+ return;
+
++ spin_lock(&usb3->lock);
++ if (usb3_pn_change(usb3, num))
++ goto out;
++
+ if (usb3_ep->dir_in) {
+ /* Do not stop the IN pipe here to detect LSTTR interrupt */
+ if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE))
+ usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA);
+ } else {
+ if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ))
+- usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
++ done = true;
+ }
++
++out:
++ /* need to unlock because usb3_request_done_pipen() locks it */
++ spin_unlock(&usb3->lock);
++
++ if (done)
++ usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
+ }
+
+ static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num)
+ {
+ u32 pn_int_sta;
+
+- if (usb3_pn_change(usb3, num) < 0)
++ spin_lock(&usb3->lock);
++ if (usb3_pn_change(usb3, num) < 0) {
++ spin_unlock(&usb3->lock);
+ return;
++ }
+
+ pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA);
+ pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA);
+ usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA);
++ spin_unlock(&usb3->lock);
+ if (pn_int_sta & PN_INT_LSTTR)
+ usb3_irq_epc_pipen_lsttr(usb3, num);
+ if (pn_int_sta & PN_INT_BFRDY)
--- /dev/null
+From 93491ced3c87c94b12220dbac0527e1356702179 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 10 May 2017 18:18:29 +0200
+Subject: USB: hub: fix SS max number of ports
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 93491ced3c87c94b12220dbac0527e1356702179 upstream.
+
+Add define for the maximum number of ports on a SuperSpeed hub as per
+USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub
+descriptor.
+
+This specifically avoids benign attempts to update the DeviceRemovable
+mask for non-existing ports (should we get that far).
+
+Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes")
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 8 +++++++-
+ include/uapi/linux/usb/ch11.h | 3 +++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1336,7 +1336,13 @@ static int hub_configure(struct usb_hub
+ if (ret < 0) {
+ message = "can't read hub descriptor";
+ goto fail;
+- } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
++ }
++
++ maxchild = USB_MAXCHILDREN;
++ if (hub_is_superspeed(hdev))
++ maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
++
++ if (hub->descriptor->bNbrPorts > maxchild) {
+ message = "hub has too many ports!";
+ ret = -ENODEV;
+ goto fail;
+--- a/include/uapi/linux/usb/ch11.h
++++ b/include/uapi/linux/usb/ch11.h
+@@ -22,6 +22,9 @@
+ */
+ #define USB_MAXCHILDREN 31
+
++/* See USB 3.1 spec Table 10-5 */
++#define USB_SS_MAXPORTS 15
++
+ /*
+ * Hub request types
+ */
--- /dev/null
+From dd14a3e9b92ac6f0918054f9e3477438760a4fa6 Mon Sep 17 00:00:00 2001
+From: Chris Brandt <chris.brandt@renesas.com>
+Date: Thu, 27 Apr 2017 12:12:49 -0700
+Subject: usb: r8a66597-hcd: decrease timeout
+
+From: Chris Brandt <chris.brandt@renesas.com>
+
+commit dd14a3e9b92ac6f0918054f9e3477438760a4fa6 upstream.
+
+The timeout for BULK packets was 300ms which is a long time if other
+endpoints or devices are waiting for their turn. Changing it to 50ms
+greatly increased the overall performance for multi-endpoint devices.
+
+Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659")
+Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/r8a66597-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597
+ time = 30;
+ break;
+ default:
+- time = 300;
++ time = 50;
+ break;
+ }
+
--- /dev/null
+From 1f873d857b6c2fefb4dada952674aa01bcfb92bd Mon Sep 17 00:00:00 2001
+From: Chris Brandt <chris.brandt@renesas.com>
+Date: Thu, 27 Apr 2017 12:12:02 -0700
+Subject: usb: r8a66597-hcd: select a different endpoint on timeout
+
+From: Chris Brandt <chris.brandt@renesas.com>
+
+commit 1f873d857b6c2fefb4dada952674aa01bcfb92bd upstream.
+
+If multiple endpoints on a single device have pending IN URBs and one
+endpoint times out due to NAKs (perfectly legal), select a different
+endpoint URB to try.
+The existing code only checked to see another device address has pending
+URBs and ignores other IN endpoints on the current device address. This
+leads to endpoints never getting serviced if one endpoint is using NAK as
+a flow control method.
+
+Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659")
+Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/r8a66597-hcd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned l
+ pipe = td->pipe;
+ pipe_stop(r8a66597, pipe);
+
++ /* Select a different address or endpoint */
+ new_td = td;
+ do {
+ list_move_tail(&new_td->queue,
+@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned l
+ new_td = td;
+ break;
+ }
+- } while (td != new_td && td->address == new_td->address);
++ } while (td != new_td && td->address == new_td->address &&
++ td->pipe->info.epnum == new_td->pipe->info.epnum);
+
+ start_transfer(r8a66597, new_td);
+
--- /dev/null
+From ec963b412a54aac8e527708ecad06a6988a86fb4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 10 May 2017 18:18:26 +0200
+Subject: USB: usbip: fix nonconforming hub descriptor
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ec963b412a54aac8e527708ecad06a6988a86fb4 upstream.
+
+Fix up the root-hub descriptor to accommodate the variable-length
+DeviceRemovable and PortPwrCtrlMask fields, while marking all ports as
+removable (and leaving the reserved bit zero unset).
+
+Also add a build-time constraint on VHCI_HC_PORTS which must never be
+greater than USB_MAXCHILDREN (but this was only enforced through a
+KConfig constant).
+
+This specifically fixes the descriptor layout whenever VHCI_HC_PORTS is
+greater than seven (default is 8).
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Cc: Takahiro Hirofuchi <hirofuchi@users.sourceforge.net>
+Cc: Valentina Manea <valentina.manea.m@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/usbip/vhci_hcd.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -235,14 +235,19 @@ done:
+
+ static inline void hub_descriptor(struct usb_hub_descriptor *desc)
+ {
++ int width;
++
+ memset(desc, 0, sizeof(*desc));
+ desc->bDescriptorType = USB_DT_HUB;
+- desc->bDescLength = 9;
+ desc->wHubCharacteristics = cpu_to_le16(
+ HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM);
++
+ desc->bNbrPorts = VHCI_HC_PORTS;
+- desc->u.hs.DeviceRemovable[0] = 0xff;
+- desc->u.hs.DeviceRemovable[1] = 0xff;
++ BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN);
++ width = desc->bNbrPorts / 8 + 1;
++ desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width;
++ memset(&desc->u.hs.DeviceRemovable[0], 0, width);
++ memset(&desc->u.hs.DeviceRemovable[width], 0xff, width);
+ }
+
+ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
--- /dev/null
+From 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 28 Apr 2017 01:51:40 -0300
+Subject: [media] vb2: Fix an off by one error in 'vb2_plane_vaddr'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 upstream.
+
+We should ensure that 'plane_no' is '< vb->num_planes' as done in
+'vb2_plane_cookie' just a few lines below.
+
+Fixes: e23ccc0ad925 ("[media] v4l: add videobuf2 Video for Linux 2 driver framework")
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs);
+
+ void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
+ {
+- if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
++ if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
+ return NULL;
+
+ return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv);
--- /dev/null
+From 861ce4a3244c21b0af64f880d5bfe5e6e2fb9e4a Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@redhat.com>
+Date: Mon, 8 May 2017 14:23:16 -0700
+Subject: x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
+
+From: Laura Abbott <labbott@redhat.com>
+
+commit 861ce4a3244c21b0af64f880d5bfe5e6e2fb9e4a upstream.
+
+'__vmalloc_start_set' currently only gets set in initmem_init() when
+!CONFIG_NEED_MULTIPLE_NODES. This breaks detection of vmalloc address
+with virt_addr_valid() with CONFIG_NEED_MULTIPLE_NODES=y, causing
+a kernel crash:
+
+ [mm/usercopy] 517e1fbeb6: kernel BUG at arch/x86/mm/physaddr.c:78!
+
+Set '__vmalloc_start_set' appropriately for that case as well.
+
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: dc16ecf7fd1f ("x86-32: use specific __vmalloc_start_set flag in __virt_addr_valid")
+Link: http://lkml.kernel.org/r/1494278596-30373-1-git-send-email-labbott@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/mm/numa_32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/mm/numa_32.c
++++ b/arch/x86/mm/numa_32.c
+@@ -100,5 +100,6 @@ void __init initmem_init(void)
+ printk(KERN_DEBUG "High memory starts at vaddr %08lx\n",
+ (ulong) pfn_to_kaddr(highstart_pfn));
+
++ __vmalloc_start_set = true;
+ setup_bootmem_allocator();
+ }
--- /dev/null
+configfs-fix-race-between-create_link-and-configfs_rmdir.patch
+can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch
+cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch
+vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch
+mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch
+mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch
+mac80211-fix-csa-in-ibss-mode.patch
+mac80211-fix-ibss-presp-allocation-size.patch
+serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch
+x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch
+mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch
+staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch
+iio-proximity-as3935-recalibrate-rco-after-resume.patch
+usb-hub-fix-ss-max-number-of-ports.patch
+usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch
+pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch
+usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch
+usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch
+usb-r8a66597-hcd-decrease-timeout.patch
+drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch
--- /dev/null
+fs-pass-on-flags-in-compat_writev.patch
+configfs-fix-race-between-create_link-and-configfs_rmdir.patch
+can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch
+ila_xlat-add-missing-hash-secret-initialization.patch
+cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch
+vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch
+mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch
+mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch
+drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch
+drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch
+usb-musb-dsps-keep-vbus-on-for-host-only-mode.patch
+mac80211-fix-csa-in-ibss-mode.patch
+mac80211-fix-packet-statistics-for-fast-rx.patch
+mac80211-fix-ibss-presp-allocation-size.patch
+mac80211-strictly-check-mesh-address-extension-mode.patch
+mac80211-fix-dropped-counter-in-multiqueue-rx.patch
+mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch
+drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch
+drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch
+serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch
+serial-sh-sci-fix-late-enablement-of-autorts.patch
+x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch
+mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch
+staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch
+staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch
+iio-st_pressure-fix-data-sign.patch
+iio-proximity-as3935-recalibrate-rco-after-resume.patch
+iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch
+ib-mlx5-fix-kernel-to-user-leak-prevention-logic.patch
+usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch
+usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch
+usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch
+usb-hub-fix-ss-max-number-of-ports.patch
+usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch
+usb-usbip-fix-nonconforming-hub-descriptor.patch
+pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch
+usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch
+usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch
+usb-r8a66597-hcd-decrease-timeout.patch
+ath10k-fix-napi-crash-during-rmmod-when-probe-firmware-fails.patch
+misc-mic-double-free-on-ioctl-error-path.patch
+drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
