--- /dev/null
+From 1dc9f1a66e1718479e1c4f95514e1750602a3cb9 Mon Sep 17 00:00:00 2001
+From: Wang Qing <wangqing@vivo.com>
+Date: Sun, 10 Apr 2022 19:36:19 -0700
+Subject: arch_topology: Do not set llc_sibling if llc_id is invalid
+
+From: Wang Qing <wangqing@vivo.com>
+
+commit 1dc9f1a66e1718479e1c4f95514e1750602a3cb9 upstream.
+
+When ACPI is not enabled, cpuid_topo->llc_id = cpu_topo->llc_id = -1, which
+will set llc_sibling 0xff(...), this is misleading.
+
+Don't set llc_sibling(default 0) if we don't know the cache topology.
+
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Wang Qing <wangqing@vivo.com>
+Fixes: 37c3ec2d810f ("arm64: topology: divorce MC scheduling domain from core_siblings")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1649644580-54626-1-git-send-email-wangqing@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/arch_topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/arch_topology.c
++++ b/drivers/base/arch_topology.c
+@@ -645,7 +645,7 @@ void update_siblings_masks(unsigned int
+ for_each_online_cpu(cpu) {
+ cpu_topo = &cpu_topology[cpu];
+
+- if (cpuid_topo->llc_id == cpu_topo->llc_id) {
++ if (cpu_topo->llc_id != -1 && cpuid_topo->llc_id == cpu_topo->llc_id) {
+ cpumask_set_cpu(cpu, &cpuid_topo->llc_sibling);
+ cpumask_set_cpu(cpuid, &cpu_topo->llc_sibling);
+ }
--- /dev/null
+From 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 Mon Sep 17 00:00:00 2001
+From: Alessandro Astone <ales.astone@gmail.com>
+Date: Fri, 15 Apr 2022 14:00:15 +0200
+Subject: binder: Address corner cases in deferred copy and fixup
+
+From: Alessandro Astone <ales.astone@gmail.com>
+
+commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 upstream.
+
+When handling BINDER_TYPE_FDA object we are pushing a parent fixup
+with a certain skip_size but no scatter-gather copy object, since
+the copy is handled standalone.
+If BINDER_TYPE_FDA is the last children the scatter-gather copy
+loop will never stop to skip it, thus we are left with an item in
+the parent fixup list. This will trigger the BUG_ON().
+
+This is reproducible in android when playing a video.
+We receive a transaction that looks like this:
+ obj[0] BINDER_TYPE_PTR, parent
+ obj[1] BINDER_TYPE_PTR, child
+ obj[2] BINDER_TYPE_PTR, child
+ obj[3] BINDER_TYPE_FDA, child
+
+Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
+Acked-by: Todd Kjos <tkjos@google.com>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
+Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2295,6 +2295,7 @@ static int binder_do_deferred_txn_copies
+ {
+ int ret = 0;
+ struct binder_sg_copy *sgc, *tmpsgc;
++ struct binder_ptr_fixup *tmppf;
+ struct binder_ptr_fixup *pf =
+ list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
+ node);
+@@ -2349,7 +2350,11 @@ static int binder_do_deferred_txn_copies
+ list_del(&sgc->node);
+ kfree(sgc);
+ }
+- BUG_ON(!list_empty(pf_head));
++ list_for_each_entry_safe(pf, tmppf, pf_head, node) {
++ BUG_ON(pf->skip_size == 0);
++ list_del(&pf->node);
++ kfree(pf);
++ }
+ BUG_ON(!list_empty(sgc_head));
+
+ return ret > 0 ? -EINVAL : ret;
--- /dev/null
+From ef38de9217a04c9077629a24652689d8fdb4c6c6 Mon Sep 17 00:00:00 2001
+From: Alessandro Astone <ales.astone@gmail.com>
+Date: Fri, 15 Apr 2022 14:00:14 +0200
+Subject: binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
+
+From: Alessandro Astone <ales.astone@gmail.com>
+
+commit ef38de9217a04c9077629a24652689d8fdb4c6c6 upstream.
+
+Some android userspace is sending BINDER_TYPE_FDA objects with
+num_fds=0. Like the previous patch, this is reproducible when
+playing a video.
+
+Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0
+were 'correctly handled', as in no fixup was performed.
+
+After commit 09184ae9b575 we aggregate fixup and skip regions in
+binder_ptr_fixup structs and distinguish between the two by using
+the skip_size field: if it's 0, then it's a fixup, otherwise skip.
+When processing BINDER_TYPE_FDA objects with num_fds=0 we add a
+skip region of skip_size=0, and this causes issues because now
+binder_do_deferred_txn_copies will think this was a fixup region.
+
+To address that, return early from binder_translate_fd_array to
+avoid adding an empty skip region.
+
+Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
+Acked-by: Todd Kjos <tkjos@google.com>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
+Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2486,6 +2486,9 @@ static int binder_translate_fd_array(str
+ struct binder_proc *proc = thread->proc;
+ int ret;
+
++ if (fda->num_fds == 0)
++ return 0;
++
+ fd_buf_size = sizeof(u32) * fda->num_fds;
+ if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
+ binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",
--- /dev/null
+From 7acae6183cf37c48b8da48bbbdb78820fb3913f3 Mon Sep 17 00:00:00 2001
+From: Xiubo Li <xiubli@redhat.com>
+Date: Thu, 14 Apr 2022 09:07:21 +0800
+Subject: ceph: fix possible NULL pointer dereference for req->r_session
+
+From: Xiubo Li <xiubli@redhat.com>
+
+commit 7acae6183cf37c48b8da48bbbdb78820fb3913f3 upstream.
+
+The request will be inserted into the ci->i_unsafe_dirops before
+assigning the req->r_session, so it's possible that we will hit
+NULL pointer dereference bug here.
+
+Cc: stable@vger.kernel.org
+URL: https://tracker.ceph.com/issues/55327
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Tested-by: Aaron Tomlin <atomlin@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/caps.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -2267,6 +2267,8 @@ retry:
+ list_for_each_entry(req, &ci->i_unsafe_dirops,
+ r_unsafe_dir_item) {
+ s = req->r_session;
++ if (!s)
++ continue;
+ if (unlikely(s->s_mds >= max_sessions)) {
+ spin_unlock(&ci->i_unsafe_lock);
+ for (i = 0; i < max_sessions; i++) {
+@@ -2287,6 +2289,8 @@ retry:
+ list_for_each_entry(req, &ci->i_unsafe_iops,
+ r_unsafe_target_item) {
+ s = req->r_session;
++ if (!s)
++ continue;
+ if (unlikely(s->s_mds >= max_sessions)) {
+ spin_unlock(&ci->i_unsafe_lock);
+ for (i = 0; i < max_sessions; i++) {
--- /dev/null
+From 5b47b751b760ee1c74a51660fd096aa148a362cd Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Wed, 23 Mar 2022 11:51:55 +0100
+Subject: eeprom: at25: Use DMA safe buffers
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 5b47b751b760ee1c74a51660fd096aa148a362cd upstream.
+
+Reading EEPROM fails with following warning:
+
+[ 16.357496] ------------[ cut here ]------------
+[ 16.357529] fsl_spi b01004c0.spi: rejecting DMA map of vmalloc memory
+[ 16.357698] WARNING: CPU: 0 PID: 371 at include/linux/dma-mapping.h:326 fsl_spi_cpm_bufs+0x2a0/0x2d8
+[ 16.357775] CPU: 0 PID: 371 Comm: od Not tainted 5.16.11-s3k-dev-01743-g19beecbfe9d6-dirty #109
+[ 16.357806] NIP: c03fbc9c LR: c03fbc9c CTR: 00000000
+[ 16.357825] REGS: e68d9b20 TRAP: 0700 Not tainted (5.16.11-s3k-dev-01743-g19beecbfe9d6-dirty)
+[ 16.357849] MSR: 00029032 <EE,ME,IR,DR,RI> CR: 24002282 XER: 00000000
+[ 16.357931]
+[ 16.357931] GPR00: c03fbc9c e68d9be0 c26d06a0 00000039 00000001 c0d36364 c0e96428 00000027
+[ 16.357931] GPR08: 00000001 00000000 00000023 3fffc000 24002282 100d3dd6 100a2ffc 00000000
+[ 16.357931] GPR16: 100cd280 100b0000 00000000 aff54f7e 100d0000 100d0000 00000001 100cf328
+[ 16.357931] GPR24: 100cf328 00000000 00000003 e68d9e30 c156b410 e67ab4c0 e68d9d38 c24ab278
+[ 16.358253] NIP [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8
+[ 16.358292] LR [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8
+[ 16.358325] Call Trace:
+[ 16.358336] [e68d9be0] [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8 (unreliable)
+[ 16.358388] [e68d9c00] [c03fcb44] fsl_spi_bufs.isra.0+0x94/0x1a0
+[ 16.358436] [e68d9c20] [c03fd970] fsl_spi_do_one_msg+0x254/0x3dc
+[ 16.358483] [e68d9cb0] [c03f7e50] __spi_pump_messages+0x274/0x8a4
+[ 16.358529] [e68d9ce0] [c03f9d30] __spi_sync+0x344/0x378
+[ 16.358573] [e68d9d20] [c03fb52c] spi_sync+0x34/0x60
+[ 16.358616] [e68d9d30] [c03b4dec] at25_ee_read+0x138/0x1a8
+[ 16.358667] [e68d9e50] [c04a8fb8] bin_attr_nvmem_read+0x98/0x110
+[ 16.358725] [e68d9e60] [c0204b14] kernfs_fop_read_iter+0xc0/0x1fc
+[ 16.358774] [e68d9e80] [c0168660] vfs_read+0x284/0x410
+[ 16.358821] [e68d9f00] [c016925c] ksys_read+0x6c/0x11c
+[ 16.358863] [e68d9f30] [c00160e0] ret_from_syscall+0x0/0x28
+...
+[ 16.359608] ---[ end trace a4ce3e34afef0cb5 ]---
+[ 16.359638] fsl_spi b01004c0.spi: unable to map tx dma
+
+This is due to the AT25 driver using buffers on stack, which is not
+possible with CONFIG_VMAP_STACK.
+
+As mentionned in kernel Documentation (Documentation/spi/spi-summary.rst):
+
+ - Follow standard kernel rules, and provide DMA-safe buffers in
+ your messages. That way controller drivers using DMA aren't forced
+ to make extra copies unless the hardware requires it (e.g. working
+ around hardware errata that force the use of bounce buffering).
+
+Modify the driver to use a buffer located in the at25 device structure
+which is allocated via kmalloc during probe.
+
+Protect writes in this new buffer with the driver's mutex.
+
+Fixes: b587b13a4f67 ("[PATCH] SPI eeprom driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/r/230a9486fc68ea0182df46255e42a51099403642.1648032613.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/eeprom/at25.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/misc/eeprom/at25.c
++++ b/drivers/misc/eeprom/at25.c
+@@ -31,6 +31,8 @@
+ */
+
+ #define FM25_SN_LEN 8 /* serial number length */
++#define EE_MAXADDRLEN 3 /* 24 bit addresses, up to 2 MBytes */
++
+ struct at25_data {
+ struct spi_eeprom chip;
+ struct spi_device *spi;
+@@ -39,6 +41,7 @@ struct at25_data {
+ struct nvmem_config nvmem_config;
+ struct nvmem_device *nvmem;
+ u8 sernum[FM25_SN_LEN];
++ u8 command[EE_MAXADDRLEN + 1];
+ };
+
+ #define AT25_WREN 0x06 /* latch the write enable */
+@@ -61,8 +64,6 @@ struct at25_data {
+
+ #define FM25_ID_LEN 9 /* ID length */
+
+-#define EE_MAXADDRLEN 3 /* 24 bit addresses, up to 2 MBytes */
+-
+ /*
+ * Specs often allow 5ms for a page write, sometimes 20ms;
+ * it's important to recover from write timeouts.
+@@ -78,7 +79,6 @@ static int at25_ee_read(void *priv, unsi
+ {
+ struct at25_data *at25 = priv;
+ char *buf = val;
+- u8 command[EE_MAXADDRLEN + 1];
+ u8 *cp;
+ ssize_t status;
+ struct spi_transfer t[2];
+@@ -92,12 +92,15 @@ static int at25_ee_read(void *priv, unsi
+ if (unlikely(!count))
+ return -EINVAL;
+
+- cp = command;
++ cp = at25->command;
+
+ instr = AT25_READ;
+ if (at25->chip.flags & EE_INSTR_BIT3_IS_ADDR)
+ if (offset >= BIT(at25->addrlen * 8))
+ instr |= AT25_INSTR_BIT3;
++
++ mutex_lock(&at25->lock);
++
+ *cp++ = instr;
+
+ /* 8/16/24-bit address is written MSB first */
+@@ -116,7 +119,7 @@ static int at25_ee_read(void *priv, unsi
+ spi_message_init(&m);
+ memset(t, 0, sizeof(t));
+
+- t[0].tx_buf = command;
++ t[0].tx_buf = at25->command;
+ t[0].len = at25->addrlen + 1;
+ spi_message_add_tail(&t[0], &m);
+
+@@ -124,8 +127,6 @@ static int at25_ee_read(void *priv, unsi
+ t[1].len = count;
+ spi_message_add_tail(&t[1], &m);
+
+- mutex_lock(&at25->lock);
+-
+ /*
+ * Read it all at once.
+ *
+@@ -152,7 +153,7 @@ static int fm25_aux_read(struct at25_dat
+ spi_message_init(&m);
+ memset(t, 0, sizeof(t));
+
+- t[0].tx_buf = &command;
++ t[0].tx_buf = at25->command;
+ t[0].len = 1;
+ spi_message_add_tail(&t[0], &m);
+
+@@ -162,6 +163,8 @@ static int fm25_aux_read(struct at25_dat
+
+ mutex_lock(&at25->lock);
+
++ at25->command[0] = command;
++
+ status = spi_sync(at25->spi, &m);
+ dev_dbg(&at25->spi->dev, "read %d aux bytes --> %d\n", len, status);
+
--- /dev/null
+From 89a01cd688d3c0ac983ef0b0e5f40018ab768317 Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Wed, 6 Apr 2022 12:56:20 +0200
+Subject: iio: dac: ad5446: Fix read_raw not returning set value
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+commit 89a01cd688d3c0ac983ef0b0e5f40018ab768317 upstream.
+
+read_raw should return the un-scaled value.
+
+Fixes: 5e06bdfb46e8b ("staging:iio:dac:ad5446: Return cached value for 'raw' attribute")
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20220406105620.1171340-1-michael.hennerich@analog.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5446.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/dac/ad5446.c
++++ b/drivers/iio/dac/ad5446.c
+@@ -178,7 +178,7 @@ static int ad5446_read_raw(struct iio_de
+
+ switch (m) {
+ case IIO_CHAN_INFO_RAW:
+- *val = st->cached_val;
++ *val = st->cached_val >> chan->scan_type.shift;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ *val = st->vref_mv;
--- /dev/null
+From b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 Mon Sep 17 00:00:00 2001
+From: Zizhuang Deng <sunsetdzz@gmail.com>
+Date: Thu, 10 Mar 2022 20:54:50 +0800
+Subject: iio: dac: ad5592r: Fix the missing return value.
+
+From: Zizhuang Deng <sunsetdzz@gmail.com>
+
+commit b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 upstream.
+
+The third call to `fwnode_property_read_u32` did not record
+the return value, resulting in `channel_offstate` possibly
+being assigned the wrong value.
+
+Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs")
+Signed-off-by: Zizhuang Deng <sunsetdzz@gmail.com>
+Link: https://lore.kernel.org/r/20220310125450.4164164-1-sunsetdzz@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5592r-base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/dac/ad5592r-base.c
++++ b/drivers/iio/dac/ad5592r-base.c
+@@ -523,7 +523,7 @@ static int ad5592r_alloc_channels(struct
+ if (!ret)
+ st->channel_modes[reg] = tmp;
+
+- fwnode_property_read_u32(child, "adi,off-state", &tmp);
++ ret = fwnode_property_read_u32(child, "adi,off-state", &tmp);
+ if (!ret)
+ st->channel_offstate[reg] = tmp;
+ }
--- /dev/null
+From b5d6ba09b10d2ccb865ed9bc45941db0a41c6756 Mon Sep 17 00:00:00 2001
+From: Fawzi Khaber <fawzi.khaber@tdk.com>
+Date: Mon, 11 Apr 2022 13:15:33 +0200
+Subject: iio: imu: inv_icm42600: Fix I2C init possible nack
+
+From: Fawzi Khaber <fawzi.khaber@tdk.com>
+
+commit b5d6ba09b10d2ccb865ed9bc45941db0a41c6756 upstream.
+
+This register write to REG_INTF_CONFIG6 enables a spike filter that
+is impacting the line and can prevent the I2C ACK to be seen by the
+controller. So we don't test the return value.
+
+Fixes: 7297ef1e261672b8 ("iio: imu: inv_icm42600: add I2C driver")
+Signed-off-by: Fawzi Khaber <fawzi.khaber@tdk.com>
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Link: https://lore.kernel.org/r/20220411111533.5826-1-jmaneyrol@invensense.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_icm42600/inv_icm42600_i2c.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_i2c.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_i2c.c
+@@ -18,12 +18,15 @@ static int inv_icm42600_i2c_bus_setup(st
+ unsigned int mask, val;
+ int ret;
+
+- /* setup interface registers */
+- ret = regmap_update_bits(st->map, INV_ICM42600_REG_INTF_CONFIG6,
+- INV_ICM42600_INTF_CONFIG6_MASK,
+- INV_ICM42600_INTF_CONFIG6_I3C_EN);
+- if (ret)
+- return ret;
++ /*
++ * setup interface registers
++ * This register write to REG_INTF_CONFIG6 enables a spike filter that
++ * is impacting the line and can prevent the I2C ACK to be seen by the
++ * controller. So we don't test the return value.
++ */
++ regmap_update_bits(st->map, INV_ICM42600_REG_INTF_CONFIG6,
++ INV_ICM42600_INTF_CONFIG6_MASK,
++ INV_ICM42600_INTF_CONFIG6_I3C_EN);
+
+ ret = regmap_update_bits(st->map, INV_ICM42600_REG_INTF_CONFIG4,
+ INV_ICM42600_INTF_CONFIG4_I3C_BUS_ONLY, 0);
--- /dev/null
+From 3a26787dacf04257a68b16315c984eb2c340bc5e Mon Sep 17 00:00:00 2001
+From: Zheyu Ma <zheyuma97@gmail.com>
+Date: Sat, 9 Apr 2022 11:48:49 +0800
+Subject: iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+commit 3a26787dacf04257a68b16315c984eb2c340bc5e upstream.
+
+When the driver fails to enable the regulator 'vid', we will get the
+following splat:
+
+[ 79.955610] WARNING: CPU: 5 PID: 441 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0
+[ 79.959641] RIP: 0010:_regulator_put+0x3ec/0x4e0
+[ 79.967570] Call Trace:
+[ 79.967773] <TASK>
+[ 79.967951] regulator_put+0x1f/0x30
+[ 79.968254] devres_release_group+0x319/0x3d0
+[ 79.968608] i2c_device_probe+0x766/0x940
+
+Fix this by disabling the 'vdd' regulator when failing to enable 'vid'
+regulator.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Link: https://lore.kernel.org/r/20220409034849.3717231-2-zheyuma97@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -416,6 +416,7 @@ static int ak8975_power_on(const struct
+ if (ret) {
+ dev_warn(&data->client->dev,
+ "Failed to enable specified Vid supply\n");
++ regulator_disable(data->vdd);
+ return ret;
+ }
+
--- /dev/null
+From f50232193e61cf89a73130b5e843fef30763c428 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Mon, 28 Feb 2022 18:52:23 -0800
+Subject: iio: scd4x: check return of scd4x_write_and_fetch
+
+From: Tom Rix <trix@redhat.com>
+
+commit f50232193e61cf89a73130b5e843fef30763c428 upstream.
+
+Clang static analysis reports this problem
+scd4x.c:474:10: warning: The left operand of '==' is a
+ garbage value
+ if (val == 0xff) {
+ ~~~ ^
+val is only set from a successful call to scd4x_write_and_fetch()
+So check it's return.
+
+Fixes: 49d22b695cbb ("drivers: iio: chemical: Add support for Sensirion SCD4x CO2 sensor")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Link: https://lore.kernel.org/r/20220301025223.223223-1-trix@redhat.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/chemical/scd4x.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/chemical/scd4x.c b/drivers/iio/chemical/scd4x.c
+index 20d4e7584e92..37143b5526ee 100644
+--- a/drivers/iio/chemical/scd4x.c
++++ b/drivers/iio/chemical/scd4x.c
+@@ -471,12 +471,15 @@ static ssize_t calibration_forced_value_store(struct device *dev,
+ ret = scd4x_write_and_fetch(state, CMD_FRC, arg, &val, sizeof(val));
+ mutex_unlock(&state->lock);
+
++ if (ret)
++ return ret;
++
+ if (val == 0xff) {
+ dev_err(dev, "forced calibration has failed");
+ return -EINVAL;
+ }
+
+- return ret ?: len;
++ return len;
+ }
+
+ static IIO_DEVICE_ATTR_RW(calibration_auto_enable, 0);
+--
+2.36.0
+
--- /dev/null
+From ad8d869343ae4a07a2038a4ca923f699308c8323 Mon Sep 17 00:00:00 2001
+From: Minchan Kim <minchan@kernel.org>
+Date: Wed, 27 Apr 2022 10:21:51 -0700
+Subject: kernfs: fix NULL dereferencing in kernfs_remove
+
+From: Minchan Kim <minchan@kernel.org>
+
+commit ad8d869343ae4a07a2038a4ca923f699308c8323 upstream.
+
+kernfs_remove supported NULL kernfs_node param to bail out but revent
+per-fs lock change introduced regression that dereferencing the
+param without NULL check so kernel goes crash.
+
+This patch checks the NULL kernfs_node in kernfs_remove and if so,
+just return.
+
+Quote from bug report by Jirka
+
+```
+The bug is triggered by running NAS Parallel benchmark suite on
+SuperMicro servers with 2x Xeon(R) Gold 6126 CPU. Here is the error
+log:
+
+[ 247.035564] BUG: kernel NULL pointer dereference, address: 0000000000000008
+[ 247.036009] #PF: supervisor read access in kernel mode
+[ 247.036009] #PF: error_code(0x0000) - not-present page
+[ 247.036009] PGD 0 P4D 0
+[ 247.036009] Oops: 0000 [#1] PREEMPT SMP PTI
+[ 247.058060] CPU: 1 PID: 6546 Comm: umount Not tainted
+5.16.0393c3714081a53795bbff0e985d24146def6f57f+ #16
+[ 247.058060] Hardware name: Supermicro Super Server/X11DDW-L, BIOS
+2.0b 03/07/2018
+[ 247.058060] RIP: 0010:kernfs_remove+0x8/0x50
+[ 247.058060] Code: 4c 89 e0 5b 5d 41 5c 41 5d 41 5e c3 49 c7 c4 f4
+ff ff ff eb b2 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00 00
+41 54 55 <48> 8b 47 08 48 89 fd 48 85 c0 48 0f 44 c7 4c 8b 60 50 49 83
+c4 60
+[ 247.058060] RSP: 0018:ffffbbfa48a27e48 EFLAGS: 00010246
+[ 247.058060] RAX: 0000000000000001 RBX: ffffffff89e31f98 RCX: 0000000080200018
+[ 247.058060] RDX: 0000000080200019 RSI: fffff6760786c900 RDI: 0000000000000000
+[ 247.058060] RBP: ffffffff89e31f98 R08: ffff926b61b24d00 R09: 0000000080200018
+[ 247.122048] R10: ffff926b61b24d00 R11: ffff926a8040c000 R12: ffff927bd09a2000
+[ 247.122048] R13: ffffffff89e31fa0 R14: dead000000000122 R15: dead000000000100
+[ 247.122048] FS: 00007f01be0a8c40(0000) GS:ffff926fa8e40000(0000)
+knlGS:0000000000000000
+[ 247.122048] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 247.122048] CR2: 0000000000000008 CR3: 00000001145c6003 CR4: 00000000007706e0
+[ 247.122048] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 247.122048] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 247.122048] PKRU: 55555554
+[ 247.122048] Call Trace:
+[ 247.122048] <TASK>
+[ 247.122048] rdt_kill_sb+0x29d/0x350
+[ 247.122048] deactivate_locked_super+0x36/0xa0
+[ 247.122048] cleanup_mnt+0x131/0x190
+[ 247.122048] task_work_run+0x5c/0x90
+[ 247.122048] exit_to_user_mode_prepare+0x229/0x230
+[ 247.122048] syscall_exit_to_user_mode+0x18/0x40
+[ 247.122048] do_syscall_64+0x48/0x90
+[ 247.122048] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 247.122048] RIP: 0033:0x7f01be2d735b
+```
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215696
+Link: https://lore.kernel.org/lkml/CAE4VaGDZr_4wzRn2___eDYRtmdPaGGJdzu_LCSkJYuY9BEO3cw@mail.gmail.com/
+Fixes: 393c3714081a (kernfs: switch global kernfs_rwsem lock to per-fs lock)
+Cc: stable@vger.kernel.org
+Reported-by: Jirka Hladky <jhladky@redhat.com>
+Tested-by: Jirka Hladky <jhladky@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Minchan Kim <minchan@kernel.org>
+Link: https://lore.kernel.org/r/20220427172152.3505364-1-minchan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/kernfs/dir.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -1397,7 +1397,12 @@ static void __kernfs_remove(struct kernf
+ */
+ void kernfs_remove(struct kernfs_node *kn)
+ {
+- struct kernfs_root *root = kernfs_root(kn);
++ struct kernfs_root *root;
++
++ if (!kn)
++ return;
++
++ root = kernfs_root(kn);
+
+ down_write(&root->kernfs_rwsem);
+ __kernfs_remove(kn);
--- /dev/null
+From 6e6eebdf5e2455f089ccd000754a0deaeb79af82 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@orcam.me.uk>
+Date: Mon, 18 Apr 2022 16:27:10 +0100
+Subject: serial: 8250: Also set sticky MCR bits in console restoration
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+commit 6e6eebdf5e2455f089ccd000754a0deaeb79af82 upstream.
+
+Sticky MCR bits are lost in console restoration if console suspending
+has been disabled. This currently affects the AFE bit, which works in
+combination with RTS which we set, so we want to make sure the UART
+retains control of its FIFO where previously requested. Also specific
+drivers may need other bits in the future.
+
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Fixes: 4516d50aabed ("serial: 8250: Use canary to restart console after suspend")
+Cc: stable@vger.kernel.org # v4.0+
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181518490.9383@angie.orcam.me.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -3340,7 +3340,7 @@ static void serial8250_console_restore(s
+
+ serial8250_set_divisor(port, baud, quot, frac);
+ serial_port_out(port, UART_LCR, up->lcr);
+- serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS);
++ serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS);
+ }
+
+ /*
--- /dev/null
+From 637674fa40059cddcc3ad2212728965072f62ea3 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@orcam.me.uk>
+Date: Mon, 18 Apr 2022 16:27:16 +0100
+Subject: serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+commit 637674fa40059cddcc3ad2212728965072f62ea3 upstream.
+
+The EndRun PTP/1588 dual serial port device is based on the Oxford
+Semiconductor OXPCIe952 UART device with the PCI vendor:device ID set
+for EndRun Technologies and is therefore driven by a fixed 62.5MHz clock
+input derived from the 100MHz PCI Express clock. The clock rate is
+divided by the oversampling rate of 16 as it is supplied to the baud
+rate generator, yielding the baud base of 3906250.
+
+Replace the incorrect baud base of 4000000 with the right value of
+3906250 then, complementing commit 6cbe45d8ac93 ("serial: 8250: Correct
+the clock for OxSemi PCIe devices").
+
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Cc: stable <stable@kernel.org>
+Fixes: 1bc8cde46a159 ("8250_pci: Added driver for Endrun Technologies PTP PCIe card.")
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181515270.9383@angie.orcam.me.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_pci.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -2667,7 +2667,7 @@ enum pci_board_num_t {
+ pbn_panacom2,
+ pbn_panacom4,
+ pbn_plx_romulus,
+- pbn_endrun_2_4000000,
++ pbn_endrun_2_3906250,
+ pbn_oxsemi,
+ pbn_oxsemi_1_3906250,
+ pbn_oxsemi_2_3906250,
+@@ -3195,10 +3195,10 @@ static struct pciserial_board pci_boards
+ * signal now many ports are available
+ * 2 port 952 Uart support
+ */
+- [pbn_endrun_2_4000000] = {
++ [pbn_endrun_2_3906250] = {
+ .flags = FL_BASE0,
+ .num_ports = 2,
+- .base_baud = 4000000,
++ .base_baud = 3906250,
+ .uart_offset = 0x200,
+ .first_offset = 0x1000,
+ },
+@@ -4115,7 +4115,7 @@ static const struct pci_device_id serial
+ */
+ { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_endrun_2_4000000 },
++ pbn_endrun_2_3906250 },
+ /*
+ * Quatech cards. These actually have configurable clocks but for
+ * now we just use the default.
--- /dev/null
+From 0e4deb56b0c625efdb70c94f150429e2f2a16fa1 Mon Sep 17 00:00:00 2001
+From: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Date: Sat, 9 Apr 2022 01:35:02 +0200
+Subject: serial: amba-pl011: do not time out prematurely when draining tx fifo
+
+From: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+
+commit 0e4deb56b0c625efdb70c94f150429e2f2a16fa1 upstream.
+
+The current timeout for draining the tx fifo in RS485 mode is calculated by
+multiplying the time it takes to transmit one character (with the given
+baud rate) with the maximal number of characters in the tx queue.
+
+This timeout is too short for two reasons:
+First when calculating the time to transmit one character integer division
+is used which may round down the result in case of a remainder of the
+division.
+
+Fix this by rounding up the division result.
+
+Second the hardware may need additional time (e.g for first putting the
+characters from the fifo into the shift register) before the characters are
+actually put onto the wire.
+
+To be on the safe side double the current maximum number of iterations
+that are used to wait for the queue draining.
+
+Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Link: https://lore.kernel.org/r/20220408233503.7251-1-LinoSanfilippo@gmx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/amba-pl011.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1255,13 +1255,18 @@ static inline bool pl011_dma_rx_running(
+
+ static void pl011_rs485_tx_stop(struct uart_amba_port *uap)
+ {
++ /*
++ * To be on the safe side only time out after twice as many iterations
++ * as fifo size.
++ */
++ const int MAX_TX_DRAIN_ITERS = uap->port.fifosize * 2;
+ struct uart_port *port = &uap->port;
+ int i = 0;
+ u32 cr;
+
+ /* Wait until hardware tx queue is empty */
+ while (!pl011_tx_empty(port)) {
+- if (i == port->fifosize) {
++ if (i > MAX_TX_DRAIN_ITERS) {
+ dev_warn(port->dev,
+ "timeout while draining hardware tx queue\n");
+ break;
+@@ -2052,7 +2057,7 @@ pl011_set_termios(struct uart_port *port
+ * with the given baud rate. We use this as the poll interval when we
+ * wait for the tx queue to empty.
+ */
+- uap->rs485_tx_drain_interval = (bits * 1000 * 1000) / baud;
++ uap->rs485_tx_drain_interval = DIV_ROUND_UP(bits * 1000 * 1000, baud);
+
+ pl011_setup_status_masks(port, termios);
+
--- /dev/null
+From 3ee82c6e41f3d2212647ce0bc5a05a0f69097824 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 11 Apr 2022 10:19:57 +0200
+Subject: serial: imx: fix overrun interrupts in DMA mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 3ee82c6e41f3d2212647ce0bc5a05a0f69097824 upstream.
+
+Commit 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is
+off") accidentally enabled overrun interrupts unconditionally when
+deferring DMA enable until after the receiver has been enabled during
+startup.
+
+Fix this by using the DMA-initialised instead of DMA-enabled flag to
+determine whether overrun interrupts should be enabled.
+
+Note that overrun interrupts are already accounted for in
+imx_uart_clear_rx_errors() when using DMA since commit 41d98b5da92f
+("serial: imx-serial - update RX error counters when DMA is used").
+
+Fixes: 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is off")
+Cc: stable@vger.kernel.org # 4.17
+Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20220411081957.7846-1-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/imx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1438,7 +1438,7 @@ static int imx_uart_startup(struct uart_
+ imx_uart_writel(sport, ucr1, UCR1);
+
+ ucr4 = imx_uart_readl(sport, UCR4) & ~(UCR4_OREN | UCR4_INVR);
+- if (!sport->dma_is_enabled)
++ if (!dma_is_inited)
+ ucr4 |= UCR4_OREN;
+ if (sport->inverted_rx)
+ ucr4 |= UCR4_INVR;
xhci-enable-runtime-pm-on-second-alderlake-controller.patch
xhci-stop-polling-roothubs-after-shutdown.patch
xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch
+iio-dac-ad5592r-fix-the-missing-return-value.patch
+iio-scd4x-check-return-of-scd4x_write_and_fetch.patch
+iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch
+iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch
+iio-imu-inv_icm42600-fix-i2c-init-possible-nack.patch
+usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch
+usb-core-don-t-hold-the-device-lock-while-sleeping-in-do_proc_control.patch
+usb-typec-ucsi-fix-reuse-of-completion-structure.patch
+usb-typec-ucsi-fix-role-swapping.patch
+usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch
+usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch
+usb-dwc3-try-usb-role-switch-first-in-dwc3_drd_init.patch
+usb-dwc3-core-fix-tx-rx-threshold-settings.patch
+usb-dwc3-core-only-handle-soft-reset-in-dctl.patch
+usb-dwc3-gadget-return-proper-request-status.patch
+usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch
+usb-cdns3-fix-issue-for-clear-halt-endpoint.patch
+usb-phy-generic-get-the-vbus-supply.patch
+kernfs-fix-null-dereferencing-in-kernfs_remove.patch
+binder-gracefully-handle-binder_type_fda-objects-with-num_fds-0.patch
+binder-address-corner-cases-in-deferred-copy-and-fixup.patch
+serial-imx-fix-overrun-interrupts-in-dma-mode.patch
+serial-amba-pl011-do-not-time-out-prematurely-when-draining-tx-fifo.patch
+serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch
+serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch
+eeprom-at25-use-dma-safe-buffers.patch
+arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch
+topology-make-core_mask-include-at-least-cluster_siblings.patch
+ceph-fix-possible-null-pointer-dereference-for-req-r_session.patch
--- /dev/null
+From db1e59483dfd8d4e956575302520bb8f7e20c79b Mon Sep 17 00:00:00 2001
+From: Darren Hart <darren@os.amperecomputing.com>
+Date: Mon, 11 Apr 2022 13:53:34 -0700
+Subject: topology: make core_mask include at least cluster_siblings
+
+From: Darren Hart <darren@os.amperecomputing.com>
+
+commit db1e59483dfd8d4e956575302520bb8f7e20c79b upstream.
+
+Ampere Altra defines CPU clusters in the ACPI PPTT. They share a Snoop
+Control Unit, but have no shared CPU-side last level cache.
+
+cpu_coregroup_mask() will return a cpumask with weight 1, while
+cpu_clustergroup_mask() will return a cpumask with weight 2.
+
+As a result, build_sched_domain() will BUG() once per CPU with:
+
+BUG: arch topology borken
+the CLS domain not a subset of the MC domain
+
+The MC level cpumask is then extended to that of the CLS child, and is
+later removed entirely as redundant. This sched domain topology is an
+improvement over previous topologies, or those built without
+SCHED_CLUSTER, particularly for certain latency sensitive workloads.
+With the current scheduler model and heuristics, this is a desirable
+default topology for Ampere Altra and Altra Max system.
+
+Rather than create a custom sched domains topology structure and
+introduce new logic in arch/arm64 to detect these systems, update the
+core_mask so coregroup is never a subset of clustergroup, extending it
+to cluster_siblings if necessary. Only do this if CONFIG_SCHED_CLUSTER
+is enabled to avoid also changing the topology (MC) when
+CONFIG_SCHED_CLUSTER is disabled.
+
+This has the added benefit over a custom topology of working for both
+symmetric and asymmetric topologies. It does not address systems where
+the CLUSTER topology is above a populated MC topology, but these are not
+considered today and can be addressed separately if and when they
+appear.
+
+The final sched domain topology for a 2 socket Ampere Altra system is
+unchanged with or without CONFIG_SCHED_CLUSTER, and the BUG is avoided:
+
+For CPU0:
+
+CONFIG_SCHED_CLUSTER=y
+CLS [0-1]
+DIE [0-79]
+NUMA [0-159]
+
+CONFIG_SCHED_CLUSTER is not set
+DIE [0-79]
+NUMA [0-159]
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: D. Scott Phillips <scott@os.amperecomputing.com>
+Cc: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Cc: <stable@vger.kernel.org> # 5.16.x
+Suggested-by: Barry Song <song.bao.hua@hisilicon.com>
+Reviewed-by: Barry Song <song.bao.hua@hisilicon.com>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Darren Hart <darren@os.amperecomputing.com>
+Link: https://lore.kernel.org/r/c8fe9fce7c86ed56b4c455b8c902982dc2303868.1649696956.git.darren@os.amperecomputing.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/arch_topology.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/base/arch_topology.c
++++ b/drivers/base/arch_topology.c
+@@ -628,6 +628,15 @@ const struct cpumask *cpu_coregroup_mask
+ core_mask = &cpu_topology[cpu].llc_sibling;
+ }
+
++ /*
++ * For systems with no shared cpu-side LLC but with clusters defined,
++ * extend core_mask to cluster_siblings. The sched domain builder will
++ * then remove MC as redundant with CLS if SCHED_CLUSTER is enabled.
++ */
++ if (IS_ENABLED(CONFIG_SCHED_CLUSTER) &&
++ cpumask_subset(core_mask, &cpu_topology[cpu].cluster_sibling))
++ core_mask = &cpu_topology[cpu].cluster_sibling;
++
+ return core_mask;
+ }
+
--- /dev/null
+From b3fa25de31fb7e9afebe9599b8ff32eda13d7c94 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Tue, 29 Mar 2022 10:46:05 +0200
+Subject: usb: cdns3: Fix issue for clear halt endpoint
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit b3fa25de31fb7e9afebe9599b8ff32eda13d7c94 upstream.
+
+Path fixes bug which occurs during resetting endpoint in
+__cdns3_gadget_ep_clear_halt function. During resetting endpoint
+controller will change HW/DMA owned TRB. It set Abort flag in
+trb->control and will change trb->length field. If driver want
+to use the aborted trb it must update the changed field in
+TRB.
+
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+cc: <stable@vger.kernel.org>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Link: https://lore.kernel.org/r/20220329084605.4022-1-pawell@cadence.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -2684,6 +2684,7 @@ int __cdns3_gadget_ep_clear_halt(struct
+ struct usb_request *request;
+ struct cdns3_request *priv_req;
+ struct cdns3_trb *trb = NULL;
++ struct cdns3_trb trb_tmp;
+ int ret;
+ int val;
+
+@@ -2693,8 +2694,10 @@ int __cdns3_gadget_ep_clear_halt(struct
+ if (request) {
+ priv_req = to_cdns3_request(request);
+ trb = priv_req->trb;
+- if (trb)
++ if (trb) {
++ trb_tmp = *trb;
+ trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE);
++ }
+ }
+
+ writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd);
+@@ -2709,7 +2712,7 @@ int __cdns3_gadget_ep_clear_halt(struct
+
+ if (request) {
+ if (trb)
+- trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE);
++ *trb = trb_tmp;
+
+ cdns3_rearm_transfer(priv_ep, 1);
+ }
--- /dev/null
+From 0543e4e8852ef5ff1809ae62f1ea963e2ab23b66 Mon Sep 17 00:00:00 2001
+From: Tasos Sahanidis <tasos@tasossah.com>
+Date: Fri, 1 Apr 2022 00:47:00 +0300
+Subject: usb: core: Don't hold the device lock while sleeping in do_proc_control()
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+commit 0543e4e8852ef5ff1809ae62f1ea963e2ab23b66 upstream.
+
+Since commit ae8709b296d8 ("USB: core: Make do_proc_control() and
+do_proc_bulk() killable") if a device has the USB_QUIRK_DELAY_CTRL_MSG
+quirk set, it will temporarily block all other URBs (e.g. interrupts)
+while sleeping due to a control.
+
+This results in noticeable delays when, for example, a userspace usbfs
+application is sending URB interrupts at a high rate to a keyboard and
+simultaneously updates the lock indicators using controls. Interrupts
+with direction set to IN are also affected by this, meaning that
+delivery of HID reports (containing scancodes) to the usbfs application
+is delayed as well.
+
+This patch fixes the regression by calling msleep() while the device
+mutex is unlocked, as was the case originally with usb_control_msg().
+
+Fixes: ae8709b296d8 ("USB: core: Make do_proc_control() and do_proc_bulk() killable")
+Cc: stable <stable@kernel.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Link: https://lore.kernel.org/r/3e299e2a-13b9-ddff-7fee-6845e868bc06@tasossah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/devio.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1197,12 +1197,16 @@ static int do_proc_control(struct usb_de
+
+ usb_unlock_device(dev);
+ i = usbfs_start_wait_urb(urb, tmo, &actlen);
++
++ /* Linger a bit, prior to the next control message. */
++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
++ msleep(200);
+ usb_lock_device(dev);
+ snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, tbuf, actlen);
+ if (!i && actlen) {
+ if (copy_to_user(ctrl->data, tbuf, actlen)) {
+ ret = -EFAULT;
+- goto recv_fault;
++ goto done;
+ }
+ }
+ } else {
+@@ -1219,6 +1223,10 @@ static int do_proc_control(struct usb_de
+
+ usb_unlock_device(dev);
+ i = usbfs_start_wait_urb(urb, tmo, &actlen);
++
++ /* Linger a bit, prior to the next control message. */
++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
++ msleep(200);
+ usb_lock_device(dev);
+ snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, NULL, 0);
+ }
+@@ -1230,10 +1238,6 @@ static int do_proc_control(struct usb_de
+ }
+ ret = (i < 0 ? i : actlen);
+
+- recv_fault:
+- /* Linger a bit, prior to the next control message. */
+- if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
+- msleep(200);
+ done:
+ kfree(dr);
+ usb_free_urb(urb);
--- /dev/null
+From f28ad9069363dec7deb88032b70612755eed9ee6 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Mon, 11 Apr 2022 18:33:47 -0700
+Subject: usb: dwc3: core: Fix tx/rx threshold settings
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit f28ad9069363dec7deb88032b70612755eed9ee6 upstream.
+
+The current driver logic checks against 0 to determine whether the
+periodic tx/rx threshold settings are set, but we may get bogus values
+from uninitialized variables if no device property is set. Properly
+default these variables to 0.
+
+Fixes: 938a5ad1d305 ("usb: dwc3: Check for ESS TX/RX threshold config")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/cccfce990b11b730b0dae42f9d217dc6fb988c90.1649727139.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1295,10 +1295,10 @@ static void dwc3_get_properties(struct d
+ u8 lpm_nyet_threshold;
+ u8 tx_de_emphasis;
+ u8 hird_threshold;
+- u8 rx_thr_num_pkt_prd;
+- u8 rx_max_burst_prd;
+- u8 tx_thr_num_pkt_prd;
+- u8 tx_max_burst_prd;
++ u8 rx_thr_num_pkt_prd = 0;
++ u8 rx_max_burst_prd = 0;
++ u8 tx_thr_num_pkt_prd = 0;
++ u8 tx_max_burst_prd = 0;
+ u8 tx_fifo_resize_max_num;
+ const char *usb_psy_name;
+ int ret;
--- /dev/null
+From f4fd84ae0765a80494b28c43b756a95100351a94 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Thu, 21 Apr 2022 19:33:56 -0700
+Subject: usb: dwc3: core: Only handle soft-reset in DCTL
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit f4fd84ae0765a80494b28c43b756a95100351a94 upstream.
+
+Make sure not to set run_stop bit or link state change request while
+initiating soft-reset. Register read-modify-write operation may
+unintentionally start the controller before the initialization completes
+with its previous DCTL value, which can cause initialization failure.
+
+Fixes: f59dcab17629 ("usb: dwc3: core: improve reset sequence")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/6aecbd78328f102003d40ccf18ceeebd411d3703.1650594792.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -276,7 +276,8 @@ static int dwc3_core_soft_reset(struct d
+
+ reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg |= DWC3_DCTL_CSFTRST;
+- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
++ reg &= ~DWC3_DCTL_RUN_STOP;
++ dwc3_gadget_dctl_write_safe(dwc, reg);
+
+ /*
+ * For DWC_usb31 controller 1.90a and later, the DCTL.CSFRST bit
--- /dev/null
+From c7428dbddcf4ea1919e1c8e15f715b94ca359268 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Fri, 22 Apr 2022 17:36:28 -0700
+Subject: usb: dwc3: gadget: Return proper request status
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit c7428dbddcf4ea1919e1c8e15f715b94ca359268 upstream.
+
+If the user sets the usb_request's no_interrupt, then there will be no
+completion event for the request. Currently the driver incorrectly uses
+the event status of a different request to report the status for a
+request with no_interrupt. The dwc3 driver needs to check the TRB status
+associated with the request when reporting its status.
+
+Note: this is only applicable to missed_isoc TRB completion status, but
+the other status are also listed for completeness/documentation.
+
+Fixes: 6d8a019614f3 ("usb: dwc3: gadget: check for Missed Isoc from event status")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/db2c80108286cfd108adb05bad52138b78d7c3a7.1650673655.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 31 ++++++++++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3229,6 +3229,7 @@ static int dwc3_gadget_ep_cleanup_comple
+ const struct dwc3_event_depevt *event,
+ struct dwc3_request *req, int status)
+ {
++ int request_status;
+ int ret;
+
+ if (req->request.num_mapped_sgs)
+@@ -3249,7 +3250,35 @@ static int dwc3_gadget_ep_cleanup_comple
+ req->needs_extra_trb = false;
+ }
+
+- dwc3_gadget_giveback(dep, req, status);
++ /*
++ * The event status only reflects the status of the TRB with IOC set.
++ * For the requests that don't set interrupt on completion, the driver
++ * needs to check and return the status of the completed TRBs associated
++ * with the request. Use the status of the last TRB of the request.
++ */
++ if (req->request.no_interrupt) {
++ struct dwc3_trb *trb;
++
++ trb = dwc3_ep_prev_trb(dep, dep->trb_dequeue);
++ switch (DWC3_TRB_SIZE_TRBSTS(trb->size)) {
++ case DWC3_TRBSTS_MISSED_ISOC:
++ /* Isoc endpoint only */
++ request_status = -EXDEV;
++ break;
++ case DWC3_TRB_STS_XFER_IN_PROG:
++ /* Applicable when End Transfer with ForceRM=0 */
++ case DWC3_TRBSTS_SETUP_PENDING:
++ /* Control endpoint only */
++ case DWC3_TRBSTS_OK:
++ default:
++ request_status = 0;
++ break;
++ }
++ } else {
++ request_status = status;
++ }
++
++ dwc3_gadget_giveback(dep, req, request_status);
+
+ out:
+ return ret;
--- /dev/null
+From 973e0f7a847ef13ade840d4c30729ce329a66895 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Mon, 25 Apr 2022 13:35:18 +0300
+Subject: usb: dwc3: pci: add support for the Intel Meteor Lake-P
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 973e0f7a847ef13ade840d4c30729ce329a66895 upstream.
+
+This patch adds the necessary PCI IDs for Intel Meteor Lake-P
+devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220425103518.44028-1-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -44,6 +44,8 @@
+ #define PCI_DEVICE_ID_INTEL_ADLM 0x54ee
+ #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1
+ #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61
++#define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1
++#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e
+ #define PCI_DEVICE_ID_INTEL_TGL 0x9a15
+ #define PCI_DEVICE_ID_AMD_MR 0x163a
+
+@@ -421,6 +423,12 @@ static const struct pci_device_id dwc3_p
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP),
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL),
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
--- /dev/null
+From ab7aa2866d295438dc60522f85c5421c6b4f1507 Mon Sep 17 00:00:00 2001
+From: Sven Peter <sven@svenpeter.dev>
+Date: Mon, 11 Apr 2022 17:53:00 +0200
+Subject: usb: dwc3: Try usb-role-switch first in dwc3_drd_init
+
+From: Sven Peter <sven@svenpeter.dev>
+
+commit ab7aa2866d295438dc60522f85c5421c6b4f1507 upstream.
+
+If the PHY controller node has a "port" dwc3 tries to find an
+extcon device even when "usb-role-switch" is present. This happens
+because dwc3_get_extcon() sees that "port" node and then calls
+extcon_find_edev_by_node() which will always return EPROBE_DEFER
+in that case.
+
+On the other hand, even if an extcon was present and dwc3_get_extcon()
+was successful it would still be ignored in favor of "usb-role-switch".
+
+Let's just first check if "usb-role-switch" is configured in the device
+tree and directly use it instead and only try to look for an extcon
+device otherwise.
+
+Fixes: 8a0a13799744 ("usb: dwc3: Registering a role switch in the DRD code.")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Sven Peter <sven@svenpeter.dev>
+Link: https://lore.kernel.org/r/20220411155300.9766-1-sven@svenpeter.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/drd.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/dwc3/drd.c
++++ b/drivers/usb/dwc3/drd.c
+@@ -571,16 +571,15 @@ int dwc3_drd_init(struct dwc3 *dwc)
+ {
+ int ret, irq;
+
++ if (ROLE_SWITCH &&
++ device_property_read_bool(dwc->dev, "usb-role-switch"))
++ return dwc3_setup_role_switch(dwc);
++
+ dwc->edev = dwc3_get_extcon(dwc);
+ if (IS_ERR(dwc->edev))
+ return PTR_ERR(dwc->edev);
+
+- if (ROLE_SWITCH &&
+- device_property_read_bool(dwc->dev, "usb-role-switch")) {
+- ret = dwc3_setup_role_switch(dwc);
+- if (ret < 0)
+- return ret;
+- } else if (dwc->edev) {
++ if (dwc->edev) {
+ dwc->edev_nb.notifier_call = dwc3_drd_notifier;
+ ret = extcon_register_notifier(dwc->edev, EXTCON_USB_HOST,
+ &dwc->edev_nb);
--- /dev/null
+From bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 Mon Sep 17 00:00:00 2001
+From: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
+Date: Wed, 13 Apr 2022 16:10:38 -0500
+Subject: usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
+
+From: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
+
+commit bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 upstream.
+
+If any function like UVC is deactivating gadget as part of composition
+switch which results in not calling pullup enablement, it is not getting
+enabled after switch to new composition due to this deactivation flag
+not cleared. This results in USB enumeration not happening after switch
+to new USB composition. Hence clear deactivation flag inside gadget
+structure in configfs_composite_unbind() before switch to new USB
+composition.
+
+Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
+Signed-off-by: Dan Vacura <w36195@motorola.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220413211038.72797-1-w36195@motorola.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1434,6 +1434,8 @@ static void configfs_composite_unbind(st
+ usb_ep_autoconfig_reset(cdev->gadget);
+ spin_lock_irqsave(&gi->spinlock, flags);
+ cdev->gadget = NULL;
++ cdev->deactivations = 0;
++ gadget->deactivated = false;
+ set_gadget_data(gadget, NULL);
+ spin_unlock_irqrestore(&gi->spinlock, flags);
+ }
--- /dev/null
+From 71d471e3faf90c9674cadc7605ac719e82cb7fac Mon Sep 17 00:00:00 2001
+From: Dan Vacura <w36195@motorola.com>
+Date: Thu, 31 Mar 2022 13:40:23 -0500
+Subject: usb: gadget: uvc: Fix crash when encoding data for usb request
+
+From: Dan Vacura <w36195@motorola.com>
+
+commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream.
+
+During the uvcg_video_pump() process, if an error occurs and
+uvcg_queue_cancel() is called, the buffer queue will be cleared out, but
+the current marker (queue->buf_used) of the active buffer (no longer
+active) is not reset. On the next iteration of uvcg_video_pump() the
+stale buf_used count will be used and the logic of min((unsigned
+int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a
+nbytes size, causing an invalid memory access.
+
+[80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed
+with status -18.
+[80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed
+with status -18.
+...
+uvcg_queue_cancel() is called and the queue is cleared out, but the
+marker queue->buf_used is not reset.
+...
+[80802.262328][ T8682] Unable to handle kernel paging request at virtual
+address ffffffc03af9f000
+...
+...
+[80802.263138][ T8682] Call trace:
+[80802.263146][ T8682] __memcpy+0x12c/0x180
+[80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0
+[80802.263165][ T8682] process_one_work+0x2cc/0x568
+[80802.263173][ T8682] worker_thread+0x28c/0x518
+[80802.263181][ T8682] kthread+0x160/0x170
+[80802.263188][ T8682] ret_from_fork+0x10/0x18
+[80802.263198][ T8682] Code: a8c12829 a88130cb a8c130
+
+Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Dan Vacura <w36195@motorola.com>
+Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_queue.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c
+index d852ac9e47e7..2cda982f3765 100644
+--- a/drivers/usb/gadget/function/uvc_queue.c
++++ b/drivers/usb/gadget/function/uvc_queue.c
+@@ -264,6 +264,8 @@ void uvcg_queue_cancel(struct uvc_video_queue *queue, int disconnect)
+ buf->state = UVC_BUF_STATE_ERROR;
+ vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR);
+ }
++ queue->buf_used = 0;
++
+ /* This must be protected by the irqlock spinlock to avoid race
+ * conditions between uvc_queue_buffer and the disconnection event that
+ * could result in an interruptible wait in uvc_dequeue_buffer. Do not
+--
+2.36.0
+
--- /dev/null
+From 0a96fa640dc928da9eaa46a22c46521b037b78ad Mon Sep 17 00:00:00 2001
+From: Hangyu Hua <hbh25y@gmail.com>
+Date: Thu, 7 Apr 2022 10:40:01 +0800
+Subject: usb: misc: fix improper handling of refcount in uss720_probe()
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+commit 0a96fa640dc928da9eaa46a22c46521b037b78ad upstream.
+
+usb_put_dev shouldn't be called when uss720_probe succeeds because of
+priv->usbdev. At the same time, priv->usbdev shouldn't be set to NULL
+before destroy_priv in uss720_disconnect because usb_put_dev is in
+destroy_priv.
+
+Fix this by moving priv->usbdev = NULL after usb_put_dev.
+
+Fixes: dcb4b8ad6a44 ("misc/uss720: fix memory leak in uss720_probe")
+Cc: stable <stable@kernel.org>
+Reviewed-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Link: https://lore.kernel.org/r/20220407024001.11761-1-hbh25y@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/uss720.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -71,6 +71,7 @@ static void destroy_priv(struct kref *kr
+
+ dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n");
+ usb_put_dev(priv->usbdev);
++ priv->usbdev = NULL;
+ kfree(priv);
+ }
+
+@@ -736,7 +737,6 @@ static int uss720_probe(struct usb_inter
+ parport_announce_port(pp);
+
+ usb_set_intfdata(intf, pp);
+- usb_put_dev(usbdev);
+ return 0;
+
+ probe_abort:
+@@ -754,7 +754,6 @@ static void uss720_disconnect(struct usb
+ usb_set_intfdata(intf, NULL);
+ if (pp) {
+ priv = pp->private_data;
+- priv->usbdev = NULL;
+ priv->pp = NULL;
+ dev_dbg(&intf->dev, "parport_remove_port\n");
+ parport_remove_port(pp);
--- /dev/null
+From 03e607cbb2931374db1825f371e9c7f28526d3f4 Mon Sep 17 00:00:00 2001
+From: Sean Anderson <sean.anderson@seco.com>
+Date: Mon, 25 Apr 2022 13:14:09 -0400
+Subject: usb: phy: generic: Get the vbus supply
+
+From: Sean Anderson <sean.anderson@seco.com>
+
+commit 03e607cbb2931374db1825f371e9c7f28526d3f4 upstream.
+
+While support for working with a vbus was added, the regulator was never
+actually gotten (despite what was documented). Fix this by actually
+getting the supply from the device tree.
+
+Fixes: 7acc9973e3c4 ("usb: phy: generic: add vbus support")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Sean Anderson <sean.anderson@seco.com>
+Link: https://lore.kernel.org/r/20220425171412.1188485-3-sean.anderson@seco.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/phy/phy-generic.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/phy/phy-generic.c
++++ b/drivers/usb/phy/phy-generic.c
+@@ -268,6 +268,13 @@ int usb_phy_gen_create_phy(struct device
+ return -EPROBE_DEFER;
+ }
+
++ nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus");
++ if (PTR_ERR(nop->vbus_draw) == -ENODEV)
++ nop->vbus_draw = NULL;
++ if (IS_ERR(nop->vbus_draw))
++ return dev_err_probe(dev, PTR_ERR(nop->vbus_draw),
++ "could not get vbus regulator\n");
++
+ nop->dev = dev;
+ nop->phy.dev = nop->dev;
+ nop->phy.label = "nop-xceiv";
--- /dev/null
+From e25adcca917d7e4cdc1dc6444d0692ffda7594bf Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Tue, 5 Apr 2022 16:48:23 +0300
+Subject: usb: typec: ucsi: Fix reuse of completion structure
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit e25adcca917d7e4cdc1dc6444d0692ffda7594bf upstream.
+
+The role swapping completion variable is reused, so it needs
+to be reinitialised every time. Otherwise it will be marked
+as done after the first time it's used and completing
+immediately.
+
+Link: https://lore.kernel.org/linux-usb/20220325203959.GA19752@jackp-linux.qualcomm.com/
+Fixes: 6df475f804e6 ("usb: typec: ucsi: Start using struct typec_operations")
+Cc: stable@vger.kernel.org
+Reported-and-suggested-by: Jack Pham <quic_jackp@quicinc.com>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20220405134824.68067-2-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -949,6 +949,8 @@ static int ucsi_dr_swap(struct typec_por
+ role == TYPEC_HOST))
+ goto out_unlock;
+
++ reinit_completion(&con->complete);
++
+ command = UCSI_SET_UOR | UCSI_CONNECTOR_NUMBER(con->num);
+ command |= UCSI_SET_UOR_ROLE(role);
+ command |= UCSI_SET_UOR_ACCEPT_ROLE_SWAPS;
+@@ -985,6 +987,8 @@ static int ucsi_pr_swap(struct typec_por
+ if (cur_role == role)
+ goto out_unlock;
+
++ reinit_completion(&con->complete);
++
+ command = UCSI_SET_PDR | UCSI_CONNECTOR_NUMBER(con->num);
+ command |= UCSI_SET_PDR_ROLE(role);
+ command |= UCSI_SET_PDR_ACCEPT_ROLE_SWAPS;
--- /dev/null
+From eb5d7ff3cf0d55093c619b5ad107cd5c05ce8134 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Tue, 5 Apr 2022 16:48:24 +0300
+Subject: usb: typec: ucsi: Fix role swapping
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit eb5d7ff3cf0d55093c619b5ad107cd5c05ce8134 upstream.
+
+All attempts to swap the roles timed out because the
+completion was done without releasing the port lock. Fixing
+that by releasing the lock before starting to wait for the
+completion.
+
+Link: https://lore.kernel.org/linux-usb/037de7ac-e210-bdf5-ec7a-8c0c88a0be20@gmail.com/
+Fixes: ad74b8649bea ("usb: typec: ucsi: Preliminary support for alternate modes")
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20220405134824.68067-3-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -958,14 +958,18 @@ static int ucsi_dr_swap(struct typec_por
+ if (ret < 0)
+ goto out_unlock;
+
++ mutex_unlock(&con->lock);
++
+ if (!wait_for_completion_timeout(&con->complete,
+- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS)))
+- ret = -ETIMEDOUT;
++ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS)))
++ return -ETIMEDOUT;
++
++ return 0;
+
+ out_unlock:
+ mutex_unlock(&con->lock);
+
+- return ret < 0 ? ret : 0;
++ return ret;
+ }
+
+ static int ucsi_pr_swap(struct typec_port *port, enum typec_role role)
+@@ -996,11 +1000,13 @@ static int ucsi_pr_swap(struct typec_por
+ if (ret < 0)
+ goto out_unlock;
+
++ mutex_unlock(&con->lock);
++
+ if (!wait_for_completion_timeout(&con->complete,
+- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) {
+- ret = -ETIMEDOUT;
+- goto out_unlock;
+- }
++ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS)))
++ return -ETIMEDOUT;
++
++ mutex_lock(&con->lock);
+
+ /* Something has gone wrong while swapping the role */
+ if (UCSI_CONSTAT_PWR_OPMODE(con->status.flags) !=
projects / thirdparty / kernel / stable-queue.git / commitdiff
