--- /dev/null
+From 5ae4f61f012a097df93de2285070ec8e34716d29 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 18 Dec 2018 11:52:16 -0600
+Subject: ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 5ae4f61f012a097df93de2285070ec8e34716d29 upstream.
+
+ipcm->substream is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/pci/emu10k1/emufx.c:1031 snd_emu10k1_ipcm_poke() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)
+sound/pci/emu10k1/emufx.c:1075 snd_emu10k1_ipcm_peek() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)
+
+Fix this by sanitizing ipcm->substream before using it to index emu->fx8010.pcm
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/emu10k1/emufx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/emu10k1/emufx.c
++++ b/sound/pci/emu10k1/emufx.c
+@@ -36,6 +36,7 @@
+ #include <linux/init.h>
+ #include <linux/mutex.h>
+ #include <linux/moduleparam.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/tlv.h>
+@@ -1026,6 +1027,8 @@ static int snd_emu10k1_ipcm_poke(struct
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ if (ipcm->channels > 32)
+ return -EINVAL;
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+@@ -1072,6 +1075,8 @@ static int snd_emu10k1_ipcm_peek(struct
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+ mutex_lock(&emu->fx8010.lock);
+ spin_lock_irq(&emu->reg_lock);
--- /dev/null
+From 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 12 Dec 2018 11:20:49 -0600
+Subject: ALSA: emux: Fix potential Spectre v1 vulnerabilities
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0 upstream.
+
+info.mode and info.port are indirectly controlled by user-space,
+hence leading to a potential exploitation of the Spectre variant 1
+vulnerability.
+
+These issues were detected with the help of Smatch:
+
+sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap)
+sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs' [w] (local cap)
+sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap)
+
+Fix this by sanitizing both info.mode and info.port before using them
+to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and
+emu->portptrs.
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/synth/emux/emux_hwdep.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/synth/emux/emux_hwdep.c
++++ b/sound/synth/emux/emux_hwdep.c
+@@ -22,9 +22,9 @@
+ #include <sound/core.h>
+ #include <sound/hwdep.h>
+ #include <linux/uaccess.h>
++#include <linux/nospec.h>
+ #include "emux_voice.h"
+
+-
+ #define TMP_CLIENT_ID 0x1001
+
+ /*
+@@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux
+ return -EFAULT;
+ if (info.mode < 0 || info.mode >= EMUX_MD_END)
+ return -EINVAL;
++ info.mode = array_index_nospec(info.mode, EMUX_MD_END);
+
+ if (info.port < 0) {
+ for (i = 0; i < emu->num_ports; i++)
+ emu->portptrs[i]->ctrls[info.mode] = info.value;
+ } else {
+- if (info.port < emu->num_ports)
++ if (info.port < emu->num_ports) {
++ info.port = array_index_nospec(info.port, emu->num_ports);
+ emu->portptrs[info.port]->ctrls[info.mode] = info.value;
++ }
+ }
+ return 0;
+ }
--- /dev/null
+From 3d16200a3e55a39caa1c88419cb559c00316f721 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:06:48 +0900
+Subject: ALSA: fireface: fix for state to fetch PCM frames
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit 3d16200a3e55a39caa1c88419cb559c00316f721 upstream.
+
+According to my memo at hand and saved records, writing 0x00000001 to
+SND_FF_REG_FETCH_PCM_FRAMES disables fetching PCM frames in corresponding
+channel, however current implement uses reversed logic. This results in
+muted volume in device side during playback.
+
+This commit corrects the bug.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: 76fdb3a9e13a ('ALSA: fireface: add support for Fireface 400')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/fireface/ff-protocol-ff400.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/fireface/ff-protocol-ff400.c
++++ b/sound/firewire/fireface/ff-protocol-ff400.c
+@@ -152,7 +152,7 @@ static int ff400_switch_fetching_mode(st
+ if (reg == NULL)
+ return -ENOMEM;
+
+- if (enable) {
++ if (!enable) {
+ /*
+ * Each quadlet is corresponding to data channels in a data
+ * blocks in reverse order. Precisely, quadlets for available
--- /dev/null
+From aa9a9e39b4f65733bf19d90cbd026e85a74efb99 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:03:20 +0900
+Subject: ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit aa9a9e39b4f65733bf19d90cbd026e85a74efb99 upstream.
+
+An initial commit to add tracepoints for packets without CIP headers
+introduces a wrong assignment to 'data_blocks' value of
+'out_packet_without_header' tracepoint.
+
+This commit fixes the bug.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: b164d2fd6e49 ('ALSA: firewire_lib: add tracepoints for packets without CIP headers')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/amdtp-stream-trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/amdtp-stream-trace.h
++++ b/sound/firewire/amdtp-stream-trace.h
+@@ -169,7 +169,7 @@ TRACE_EVENT(out_packet_without_header,
+ __entry->dest = fw_parent_device(s->unit)->node_id;
+ __entry->payload_quadlets = payload_length / 4;
+ __entry->data_blocks = data_blocks,
+- __entry->data_blocks = s->data_block_counter,
++ __entry->data_block_counter = s->data_block_counter,
+ __entry->packet_index = s->packet_index;
+ __entry->irq = !!in_interrupt();
+ __entry->index = index;
--- /dev/null
+From ada79fa5a0b374dd2c2262137c734da7524a8263 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:03:19 +0900
+Subject: ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit ada79fa5a0b374dd2c2262137c734da7524a8263 upstream.
+
+In IEC 61883-1/6 engine of ALSA firewire stack, a packet handler has a
+second argument for 'the number of bytes in payload of isochronous
+packet'. However, an incoming packet handler without CIP header uses the
+value as 'the number of quadlets in the payload'. This brings userspace
+applications to receive the number of PCM frames as four times against
+real time.
+
+This commit fixes the bug.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: 3b196c394dd ('ALSA: firewire-lib: add no-header packet processing')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/amdtp-stream.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -629,15 +629,17 @@ end:
+ }
+
+ static int handle_in_packet_without_header(struct amdtp_stream *s,
+- unsigned int payload_quadlets, unsigned int cycle,
++ unsigned int payload_length, unsigned int cycle,
+ unsigned int index)
+ {
+ __be32 *buffer;
++ unsigned int payload_quadlets;
+ unsigned int data_blocks;
+ struct snd_pcm_substream *pcm;
+ unsigned int pcm_frames;
+
+ buffer = s->buffer.packets[s->packet_index].buffer;
++ payload_quadlets = payload_length / 4;
+ data_blocks = payload_quadlets / s->data_block_quadlets;
+
+ trace_in_packet_without_header(s, cycle, payload_quadlets, data_blocks,
--- /dev/null
+From 5ef108c53e6efd695e32aad969638ccbc35b4be9 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:03:21 +0900
+Subject: ALSA: firewire-lib: use the same print format for 'without_header' tracepoints
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit 5ef108c53e6efd695e32aad969638ccbc35b4be9 upstream.
+
+An initial commit to add tracepoints for packets without CIP headers
+uses different print formats for added tracepoints. However this is not
+convenient for users/developers to prepare debug tools.
+
+This commit uses the same format for the two tracepoints.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: b164d2fd6e49 ('ALSA: firewire_lib: add tracepoints for packets without CIP headers')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/amdtp-stream-trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/amdtp-stream-trace.h
++++ b/sound/firewire/amdtp-stream-trace.h
+@@ -131,7 +131,7 @@ TRACE_EVENT(in_packet_without_header,
+ __entry->index = index;
+ ),
+ TP_printk(
+- "%02u %04u %04x %04x %02d %03u %3u %3u %02u %01u %02u",
++ "%02u %04u %04x %04x %02d %03u %02u %03u %02u %01u %02u",
+ __entry->second,
+ __entry->cycle,
+ __entry->src,
--- /dev/null
+From 40906ebe3af6a48457151b3c6726b480f6a6cb13 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mantas=20Mikul=C4=97nas?= <grawity@gmail.com>
+Date: Sun, 16 Dec 2018 15:44:47 +0200
+Subject: ALSA: hda: add mute LED support for HP EliteBook 840 G4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mantas Mikulėnas <grawity@gmail.com>
+
+commit 40906ebe3af6a48457151b3c6726b480f6a6cb13 upstream.
+
+Tested with 4.19.9.
+
+v2: Changed from CXT_FIXUP_MUTE_LED_GPIO to CXT_FIXUP_HP_DOCK because
+ that's what the existing fixups for EliteBooks use.
+
+Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -923,6 +923,7 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
--- /dev/null
+From 9cf6533e8060d3896b88ea14b27f620e6504b84b Mon Sep 17 00:00:00 2001
+From: Wandrille RONCE <w@ndrille.fr>
+Date: Wed, 19 Dec 2018 14:52:44 +0100
+Subject: ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294
+
+From: Wandrille RONCE <w@ndrille.fr>
+
+commit 9cf6533e8060d3896b88ea14b27f620e6504b84b upstream.
+
+By default, there is no sound on Asus UX391UA on Linux.
+
+This patch adds sound support on Asus UX391UA. Tested working by three
+different users.
+
+The problem has also been described at
+https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1784485
+
+Signed-off-by: Wandrille RONCE <w@ndrille.fr>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6573,6 +6573,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From 82b01149ec94d746867d7f9156c44d775d4d2d67 Mon Sep 17 00:00:00 2001
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+Date: Thu, 27 Dec 2018 16:46:31 +0800
+Subject: ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops
+
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+
+commit 82b01149ec94d746867d7f9156c44d775d4d2d67 upstream.
+
+The headset mic of ASUS laptops like UX533FD, UX433FN and UX333FA, whose
+CODEC is Realtek ALC294 has jack auto detection feature. This patch
+enables the feature.
+
+Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294")
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6424,7 +6424,7 @@ static const struct hda_fixup alc269_fix
+ [ALC294_FIXUP_ASUS_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+- { 0x19, 0x01a1113c }, /* use as headset mic, without its own jack detect */
++ { 0x19, 0x01a1103c }, /* use as headset mic */
+ { }
+ },
+ .chained = true,
--- /dev/null
+From 63d2a9ec310d8bcc955574220d4631aa55c1a80c Mon Sep 17 00:00:00 2001
+From: Sameer Pujar <spujar@nvidia.com>
+Date: Wed, 26 Dec 2018 16:04:49 +0530
+Subject: ALSA: hda/tegra: clear pending irq handlers
+
+From: Sameer Pujar <spujar@nvidia.com>
+
+commit 63d2a9ec310d8bcc955574220d4631aa55c1a80c upstream.
+
+Even after disabling interrupts on the module, it could be possible
+that irq handlers are still running. System hang is seen during
+suspend path. It was found that, there were pending writes on the
+HDA bus and clock was disabled by that time.
+
+Above mentioned issue is fixed by clearing any pending irq handlers
+before disabling clocks and returning from hda suspend.
+
+Suggested-by: Mohan Kumar <mkumard@nvidia.com>
+Suggested-by: Dara Ramesh <dramesh@nvidia.com>
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_tegra.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -249,10 +249,12 @@ static int hda_tegra_suspend(struct devi
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip = card->private_data;
+ struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip);
++ struct hdac_bus *bus = azx_bus(chip);
+
+ snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+
+ azx_stop_chip(chip);
++ synchronize_irq(bus->irq);
+ azx_enter_link_reset(chip);
+ hda_tegra_disable_clocks(hda);
+
--- /dev/null
+From 94ffb030b6d31ec840bb811be455dd2e26a4f43e Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 12 Dec 2018 15:36:28 -0600
+Subject: ALSA: pcm: Fix potential Spectre v1 vulnerability
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 94ffb030b6d31ec840bb811be455dd2e26a4f43e upstream.
+
+stream is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/core/pcm.c:140 snd_pcm_control_ioctl() warn: potential spectre issue 'pcm->streams' [r] (local cap)
+
+Fix this by sanitizing stream before using it to index pcm->streams
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -25,6 +25,7 @@
+ #include <linux/time.h>
+ #include <linux/mutex.h>
+ #include <linux/device.h>
++#include <linux/nospec.h>
+ #include <sound/core.h>
+ #include <sound/minors.h>
+ #include <sound/pcm.h>
+@@ -129,6 +130,7 @@ static int snd_pcm_control_ioctl(struct
+ return -EFAULT;
+ if (stream < 0 || stream > 1)
+ return -EINVAL;
++ stream = array_index_nospec(stream, 2);
+ if (get_user(subdevice, &info->subdevice))
+ return -EFAULT;
+ mutex_lock(®ister_mutex);
--- /dev/null
+From 0b84304ef5da92add8dc75a1b07879c5374cdb05 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 18 Dec 2018 11:18:34 -0600
+Subject: ALSA: rme9652: Fix potential Spectre v1 vulnerability
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 0b84304ef5da92add8dc75a1b07879c5374cdb05 upstream.
+
+info->channel is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/pci/rme9652/hdsp.c:4100 snd_hdsp_channel_info() warn: potential spectre issue 'hdsp->channel_map' [r] (local cap)
+
+Fix this by sanitizing info->channel before using it to index hdsp->channel_map
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+Also, notice that I refactored the code a bit in order to get rid of the
+following checkpatch warning:
+
+ERROR: do not use assignment in if condition
+FILE: sound/pci/rme9652/hdsp.c:4103:
+ if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/rme9652/hdsp.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -30,6 +30,7 @@
+ #include <linux/math64.h>
+ #include <linux/vmalloc.h>
+ #include <linux/io.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/control.h>
+@@ -4092,15 +4093,16 @@ static int snd_hdsp_channel_info(struct
+ struct snd_pcm_channel_info *info)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- int mapped_channel;
++ unsigned int channel = info->channel;
+
+- if (snd_BUG_ON(info->channel >= hdsp->max_channels))
++ if (snd_BUG_ON(channel >= hdsp->max_channels))
+ return -EINVAL;
++ channel = array_index_nospec(channel, hdsp->max_channels);
+
+- if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
++ if (hdsp->channel_map[channel] < 0)
+ return -EINVAL;
+
+- info->offset = mapped_channel * HDSP_CHANNEL_BUFFER_BYTES;
++ info->offset = hdsp->channel_map[channel] * HDSP_CHANNEL_BUFFER_BYTES;
+ info->first = 0;
+ info->step = 32;
+ return 0;
--- /dev/null
+From dbc2970caef74e8ff41923d302aa6fb5a4812d0e Mon Sep 17 00:00:00 2001
+From: "Michael J. Ruhl" <michael.j.ruhl@intel.com>
+Date: Wed, 28 Nov 2018 10:19:36 -0800
+Subject: IB/hfi1: Incorrect sizing of sge for PIO will OOPs
+
+From: Michael J. Ruhl <michael.j.ruhl@intel.com>
+
+commit dbc2970caef74e8ff41923d302aa6fb5a4812d0e upstream.
+
+An incorrect sge sizing in the HFI PIO path will cause an OOPs similar to
+this:
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [] hfi1_verbs_send_pio+0x3d8/0x530 [hfi1]
+PGD 0
+Oops: 0000 1 SMP
+ Call Trace:
+ ? hfi1_verbs_send_dma+0xad0/0xad0 [hfi1]
+ hfi1_verbs_send+0xdf/0x250 [hfi1]
+ ? make_rc_ack+0xa80/0xa80 [hfi1]
+ hfi1_do_send+0x192/0x430 [hfi1]
+ hfi1_do_send_from_rvt+0x10/0x20 [hfi1]
+ rvt_post_send+0x369/0x820 [rdmavt]
+ ib_uverbs_post_send+0x317/0x570 [ib_uverbs]
+ ib_uverbs_write+0x26f/0x420 [ib_uverbs]
+ ? security_file_permission+0x21/0xa0
+ vfs_write+0xbd/0x1e0
+ ? mntput+0x24/0x40
+ SyS_write+0x7f/0xe0
+ system_call_fastpath+0x16/0x1b
+
+Fix by adding the missing sizing check to correctly determine the sge
+length.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hfi1/verbs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1141,6 +1141,8 @@ int hfi1_verbs_send_pio(struct rvt_qp *q
+
+ if (slen > len)
+ slen = len;
++ if (slen > ss->sge.sge_length)
++ slen = ss->sge.sge_length;
+ rvt_update_sge(ss, slen, false);
+ seg_pio_copy_mid(pbuf, addr, slen);
+ len -= slen;
--- /dev/null
+From 255095fa7f62ff09b6f61393414535c59c6b4cb0 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Mon, 26 Nov 2018 15:18:25 -0500
+Subject: media: dvb-usb-v2: Fix incorrect use of transfer_flags URB_FREE_BUFFER
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 255095fa7f62ff09b6f61393414535c59c6b4cb0 upstream.
+
+commit 1a0c10ed7bb1 ("media: dvb-usb-v2: stop using coherent memory for
+URBs") incorrectly adds URB_FREE_BUFFER after every urb transfer.
+
+It cannot use this flag because it reconfigures the URBs accordingly
+to suit connected devices. In doing a call to usb_free_urb is made and
+invertedly frees the buffers.
+
+The stream buffer should remain constant while driver is up.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+CC: stable@vger.kernel.org # v4.18+
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb-v2/usb_urb.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb-v2/usb_urb.c
++++ b/drivers/media/usb/dvb-usb-v2/usb_urb.c
+@@ -155,7 +155,6 @@ static int usb_urb_alloc_bulk_urbs(struc
+ stream->props.u.bulk.buffersize,
+ usb_urb_complete, stream);
+
+- stream->urb_list[i]->transfer_flags = URB_FREE_BUFFER;
+ stream->urbs_initialized++;
+ }
+ return 0;
+@@ -186,7 +185,7 @@ static int usb_urb_alloc_isoc_urbs(struc
+ urb->complete = usb_urb_complete;
+ urb->pipe = usb_rcvisocpipe(stream->udev,
+ stream->props.endpoint);
+- urb->transfer_flags = URB_ISO_ASAP | URB_FREE_BUFFER;
++ urb->transfer_flags = URB_ISO_ASAP;
+ urb->interval = stream->props.u.isoc.interval;
+ urb->number_of_packets = stream->props.u.isoc.framesperurb;
+ urb->transfer_buffer_length = stream->props.u.isoc.framesize *
+@@ -210,7 +209,7 @@ static int usb_free_stream_buffers(struc
+ if (stream->state & USB_STATE_URB_BUF) {
+ while (stream->buf_num) {
+ stream->buf_num--;
+- stream->buf_list[stream->buf_num] = NULL;
++ kfree(stream->buf_list[stream->buf_num]);
+ }
+ }
+
--- /dev/null
+From 2a9d92fb3a1282a4659f1bb6d5684018846537b7 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 10 Dec 2018 21:38:16 +0100
+Subject: mtd: atmel-quadspi: disallow building on ebsa110
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 2a9d92fb3a1282a4659f1bb6d5684018846537b7 upstream.
+
+I ran into a link-time error with the atmel-quadspi driver on the
+EBSA110 platform:
+
+drivers/mtd/built-in.o: In function `atmel_qspi_run_command':
+:(.text+0x1ee3c): undefined reference to `_memcpy_toio'
+:(.text+0x1ee48): undefined reference to `_memcpy_fromio'
+
+The problem is that _memcpy_toio/_memcpy_fromio are not available on
+that platform, and we have to prevent building the driver there.
+
+In case we want to backport this to older kernels: between linux-4.8
+and linux-4.20, the Kconfig entry was in drivers/mtd/spi-nor/Kconfig
+but had the same problem.
+
+Link: https://lore.kernel.org/patchwork/patch/812860/
+Fixes: 161aaab8a067 ("mtd: atmel-quadspi: add driver for Atmel QSPI controller")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/spi-nor/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/Kconfig
++++ b/drivers/mtd/spi-nor/Kconfig
+@@ -41,7 +41,7 @@ config SPI_ASPEED_SMC
+
+ config SPI_ATMEL_QUADSPI
+ tristate "Atmel Quad SPI Controller"
+- depends on ARCH_AT91 || (ARM && COMPILE_TEST)
++ depends on ARCH_AT91 || (ARM && COMPILE_TEST && !ARCH_EBSA110)
+ depends on OF && HAS_IOMEM
+ help
+ This enables support for the Quad SPI controller in master mode.
--- /dev/null
+From cafb56dd741e61c99709bcd2b193a9a1d36def3b Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 11 Dec 2018 18:38:28 +0100
+Subject: mtd: rawnand: marvell: prevent timeouts on a loaded machine
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit cafb56dd741e61c99709bcd2b193a9a1d36def3b upstream.
+
+marvell_nfc_wait_op() waits for completion during 'timeout_ms'
+milliseconds before throwing an error. While the logic is fine, the
+value of 'timeout_ms' is given by the core and actually correspond to
+the maximum time the NAND chip will take to complete the
+operation. Assuming there is no overhead in the propagation of the
+interrupt signal to the the NAND controller (through the Ready/Busy
+line), this delay does not take into account the latency of the
+operating system. For instance, for a page write, the delay given by
+the core is rounded up to 1ms. Hence, when the machine is over loaded,
+there is chances that this timeout will be reached.
+
+There are two ways to solve this issue that are not incompatible:
+1/ Enlarge the timeout value (if so, how much?).
+2/ Check after the waiting method if we did not miss any interrupt
+because of the OS latency (an interrupt is still pending). In this
+case, we assume the operation exited successfully.
+
+We choose the second approach that is a must in all cases, with the
+possibility to also modify the timeout value to be, e.g. at least 1
+second in all cases.
+
+Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/marvell_nand.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -444,9 +444,14 @@ static void marvell_nfc_enable_int(struc
+ writel_relaxed(reg & ~int_mask, nfc->regs + NDCR);
+ }
+
+-static void marvell_nfc_clear_int(struct marvell_nfc *nfc, u32 int_mask)
++static u32 marvell_nfc_clear_int(struct marvell_nfc *nfc, u32 int_mask)
+ {
++ u32 reg;
++
++ reg = readl_relaxed(nfc->regs + NDSR);
+ writel_relaxed(int_mask, nfc->regs + NDSR);
++
++ return reg & int_mask;
+ }
+
+ static void marvell_nfc_force_byte_access(struct nand_chip *chip,
+@@ -613,6 +618,7 @@ static int marvell_nfc_wait_cmdd(struct
+ static int marvell_nfc_wait_op(struct nand_chip *chip, unsigned int timeout_ms)
+ {
+ struct marvell_nfc *nfc = to_marvell_nfc(chip->controller);
++ u32 pending;
+ int ret;
+
+ /* Timeout is expressed in ms */
+@@ -625,8 +631,13 @@ static int marvell_nfc_wait_op(struct na
+ ret = wait_for_completion_timeout(&nfc->complete,
+ msecs_to_jiffies(timeout_ms));
+ marvell_nfc_disable_int(nfc, NDCR_RDYM);
+- marvell_nfc_clear_int(nfc, NDSR_RDY(0) | NDSR_RDY(1));
+- if (!ret) {
++ pending = marvell_nfc_clear_int(nfc, NDSR_RDY(0) | NDSR_RDY(1));
++
++ /*
++ * In case the interrupt was not served in the required time frame,
++ * check if the ISR was not served or if something went actually wrong.
++ */
++ if (ret && !pending) {
+ dev_err(nfc->dev, "Timeout waiting for RB signal\n");
+ return -ETIMEDOUT;
+ }
--- /dev/null
+From 9b432630e0150b777c423fdef6a7b8d17dfa70b6 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+Date: Thu, 13 Dec 2018 20:22:27 +0100
+Subject: mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan()
+
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+
+commit 9b432630e0150b777c423fdef6a7b8d17dfa70b6 upstream.
+
+Commit e1e6255c311b ("mtd: rawnand: omap2: convert driver to
+nand_scan()") moved part of the init code in the ->attach_chip hook
+and at the same time changed the struct device object passed to
+dma_request_chan() (&pdev->dev instead of pdev->dev.parent).
+
+Fixes: e1e6255c311b ("mtd: rawnand: omap2: convert driver to nand_scan()")
+Reported-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Tested-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/omap2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/omap2.c
++++ b/drivers/mtd/nand/raw/omap2.c
+@@ -1938,7 +1938,7 @@ static int omap_nand_attach_chip(struct
+ case NAND_OMAP_PREFETCH_DMA:
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+- info->dma = dma_request_chan(dev, "rxtx");
++ info->dma = dma_request_chan(dev->parent, "rxtx");
+
+ if (IS_ERR(info->dma)) {
+ dev_err(dev, "DMA engine request failed\n");
--- /dev/null
+From 7d8bad99ba5a22892f0cad6881289fdc3875a930 Mon Sep 17 00:00:00 2001
+From: Diana Craciun <diana.craciun@nxp.com>
+Date: Wed, 12 Dec 2018 16:03:02 +0200
+Subject: powerpc/fsl: Fix spectre_v2 mitigations reporting
+
+From: Diana Craciun <diana.craciun@nxp.com>
+
+commit 7d8bad99ba5a22892f0cad6881289fdc3875a930 upstream.
+
+Currently for CONFIG_PPC_FSL_BOOK3E the spectre_v2 file is incorrect:
+
+ $ cat /sys/devices/system/cpu/vulnerabilities/spectre_v2
+ "Mitigation: Software count cache flush"
+
+Which is wrong. Fix it to report vulnerable for now.
+
+Fixes: ee13cb249fab ("powerpc/64s: Add support for software count cache flush")
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Diana Craciun <diana.craciun@nxp.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/security.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -22,7 +22,7 @@ enum count_cache_flush_type {
+ COUNT_CACHE_FLUSH_SW = 0x2,
+ COUNT_CACHE_FLUSH_HW = 0x4,
+ };
+-static enum count_cache_flush_type count_cache_flush_type;
++static enum count_cache_flush_type count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
+
+ bool barrier_nospec_enabled;
+ static bool no_nospec;
--- /dev/null
+From 3004cfd6204927c1294060b849029cf0c2651074 Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan@gerhold.net>
+Date: Thu, 6 Dec 2018 19:42:28 +0100
+Subject: Revert "usb: dwc3: pci: Use devm functions to get the phy GPIOs"
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+commit 3004cfd6204927c1294060b849029cf0c2651074 upstream.
+
+Commit 211f658b7b40 ("usb: dwc3: pci: Use devm functions to get
+the phy GPIOs") changed the code to claim the PHY GPIOs permanently
+for Intel Baytrail devices.
+
+This causes issues when the actual PHY driver attempts to claim the
+same GPIO descriptors. For example, tusb1210 now fails to probe with:
+
+ tusb1210: probe of dwc3.0.auto.ulpi failed with error -16 (EBUSY)
+
+dwc3-pci needs to turn on the PHY once before dwc3 is loaded, but
+usually the PHY driver will then hold the GPIOs to turn off the
+PHY when requested (e.g. during suspend).
+
+To fix the problem, this reverts the commit to restore the old
+behavior to put the GPIOs immediately after usage.
+
+Link: https://www.spinics.net/lists/linux-usb/msg174681.html
+Cc: stable@vger.kernel.org
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/dwc3-pci.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -170,20 +170,20 @@ static int dwc3_pci_quirks(struct dwc3_p
+ * put the gpio descriptors again here because the phy driver
+ * might want to grab them, too.
+ */
+- gpio = devm_gpiod_get_optional(&pdev->dev, "cs",
+- GPIOD_OUT_LOW);
++ gpio = gpiod_get_optional(&pdev->dev, "cs", GPIOD_OUT_LOW);
+ if (IS_ERR(gpio))
+ return PTR_ERR(gpio);
+
+ gpiod_set_value_cansleep(gpio, 1);
++ gpiod_put(gpio);
+
+- gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
+- GPIOD_OUT_LOW);
++ gpio = gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(gpio))
+ return PTR_ERR(gpio);
+
+ if (gpio) {
+ gpiod_set_value_cansleep(gpio, 1);
++ gpiod_put(gpio);
+ usleep_range(10000, 11000);
+ }
+ }
net-mvneta-fix-operation-for-64k-page_size.patch
net-use-__kernel_clockid_t-in-uapi-net_stamp.h.patch
r8169-fix-wol-device-wakeup-enable.patch
+ib-hfi1-incorrect-sizing-of-sge-for-pio-will-oops.patch
+alsa-rme9652-fix-potential-spectre-v1-vulnerability.patch
+alsa-emu10k1-fix-potential-spectre-v1-vulnerabilities.patch
+alsa-pcm-fix-potential-spectre-v1-vulnerability.patch
+alsa-emux-fix-potential-spectre-v1-vulnerabilities.patch
+powerpc-fsl-fix-spectre_v2-mitigations-reporting.patch
+mtd-atmel-quadspi-disallow-building-on-ebsa110.patch
+mtd-rawnand-marvell-prevent-timeouts-on-a-loaded-machine.patch
+mtd-rawnand-omap2-pass-the-parent-of-pdev-to-dma_request_chan.patch
+alsa-hda-add-mute-led-support-for-hp-elitebook-840-g4.patch
+alsa-hda-realtek-enable-audio-jacks-of-asus-ux391ua-with-alc294.patch
+alsa-fireface-fix-for-state-to-fetch-pcm-frames.patch
+alsa-firewire-lib-fix-wrong-handling-payload_length-as-payload_quadlet.patch
+alsa-firewire-lib-fix-wrong-assignment-for-out_packet_without_header-tracepoint.patch
+alsa-firewire-lib-use-the-same-print-format-for-without_header-tracepoints.patch
+alsa-hda-realtek-enable-the-headset-mic-auto-detection-for-asus-laptops.patch
+alsa-hda-tegra-clear-pending-irq-handlers.patch
+usb-dwc2-host-use-hrtimer-for-nak-retries.patch
+usb-serial-pl2303-add-ids-for-hewlett-packard-hp-pos-pole-displays.patch
+usb-serial-option-add-fibocom-nl678-series.patch
+usb-r8a66597-fix-a-possible-concurrency-use-after-free-bug-in-r8a66597_endpoint_disable.patch
+usb-dwc2-disable-power_down-on-amlogic-devices.patch
+revert-usb-dwc3-pci-use-devm-functions-to-get-the-phy-gpios.patch
+usb-roles-add-a-description-for-the-class-to-kconfig.patch
+media-dvb-usb-v2-fix-incorrect-use-of-transfer_flags-urb_free_buffer.patch
--- /dev/null
+From cc10ce0c51b13d1566d0ec1dcb472fb86330b391 Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sun, 9 Dec 2018 20:01:29 +0100
+Subject: usb: dwc2: disable power_down on Amlogic devices
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+commit cc10ce0c51b13d1566d0ec1dcb472fb86330b391 upstream.
+
+Disable power_down by setting the parameter to
+DWC2_POWER_DOWN_PARAM_NONE. This fixes a problem on various Amlogic
+Meson SoCs where USB devices are only recognized when plugged in before
+booting Linux. A hot-plugged USB device was not detected even though the
+device got power (my USB thumb drive for example has an LED which lit
+up).
+
+A similar fix was implemented for Rockchip SoCs in commit c216765d3a1def
+("usb: dwc2: disable power_down on rockchip devices"). That commit
+suggests that a change in the dwc2 driver is the cause because the
+default value for the "hibernate" parameter (which then got renamed to
+"power_down" to support other modes) was changed in the v4.17 merge
+window with:
+commit 6d23ee9caa6790 ("Merge tag 'usb-for-v4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-testing").
+
+Cc: <stable@vger.kernel.org> # 4.19
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Suggested-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc2/params.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/dwc2/params.c
++++ b/drivers/usb/dwc2/params.c
+@@ -110,6 +110,7 @@ static void dwc2_set_amlogic_params(stru
+ p->phy_type = DWC2_PHY_TYPE_PARAM_UTMI;
+ p->ahbcfg = GAHBCFG_HBSTLEN_INCR8 <<
+ GAHBCFG_HBSTLEN_SHIFT;
++ p->power_down = DWC2_POWER_DOWN_PARAM_NONE;
+ }
+
+ static void dwc2_set_amcc_params(struct dwc2_hsotg *hsotg)
--- /dev/null
+From 6ed30a7d8ec29d3aba46e47aa8b4a44f077dda4e Mon Sep 17 00:00:00 2001
+From: Terin Stock <terin@terinstock.com>
+Date: Sun, 9 Sep 2018 21:24:31 -0700
+Subject: usb: dwc2: host: use hrtimer for NAK retries
+
+From: Terin Stock <terin@terinstock.com>
+
+commit 6ed30a7d8ec29d3aba46e47aa8b4a44f077dda4e upstream.
+
+Modify the wait delay utilize the high resolution timer API to allow for
+more precisely scheduled callbacks.
+
+A previous commit added a 1ms retry delay after multiple consecutive
+NAKed transactions using jiffies. On systems with a low timer interrupt
+frequency, this delay may be significantly longer than specified,
+resulting in misbehavior with some USB devices.
+
+This scenario was reached on a Raspberry Pi 3B with a Macally FDD-USB
+floppy drive (identified as 0424:0fdc Standard Microsystems Corp.
+Floppy, based on the USB97CFDC USB FDC). With the relay delay, the drive
+would be unable to mount a disk, replying with NAKs until the device was
+reset.
+
+Using ktime, the delta between starting the timer (in dwc2_hcd_qh_add)
+and the callback function can be determined. With the original delay
+implementation, this value was consistently approximately 12ms. (output
+in us).
+
+ <idle>-0 [000] ..s. 1600.559974: dwc2_wait_timer_fn: wait_timer delta: 11976
+ <idle>-0 [000] ..s. 1600.571974: dwc2_wait_timer_fn: wait_timer delta: 11977
+ <idle>-0 [000] ..s. 1600.583974: dwc2_wait_timer_fn: wait_timer delta: 11976
+ <idle>-0 [000] ..s. 1600.595974: dwc2_wait_timer_fn: wait_timer delta: 11977
+
+After converting the relay delay to using a higher resolution timer, the
+delay was much closer to 1ms.
+
+ <idle>-0 [000] d.h. 1956.553017: dwc2_wait_timer_fn: wait_timer delta: 1002
+ <idle>-0 [000] d.h. 1956.554114: dwc2_wait_timer_fn: wait_timer delta: 1002
+ <idle>-0 [000] d.h. 1957.542660: dwc2_wait_timer_fn: wait_timer delta: 1004
+ <idle>-0 [000] d.h. 1957.543701: dwc2_wait_timer_fn: wait_timer delta: 1002
+
+The floppy drive operates properly with delays up to approximately 5ms,
+and sends NAKs for any delays that are longer.
+
+Fixes: 38d2b5fb75c1 ("usb: dwc2: host: Don't retry NAKed transactions right away")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Terin Stock <terin@terinstock.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc2/hcd.h | 2 +-
+ drivers/usb/dwc2/hcd_queue.c | 19 ++++++++++++-------
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/dwc2/hcd.h
++++ b/drivers/usb/dwc2/hcd.h
+@@ -366,7 +366,7 @@ struct dwc2_qh {
+ u32 desc_list_sz;
+ u32 *n_bytes;
+ struct timer_list unreserve_timer;
+- struct timer_list wait_timer;
++ struct hrtimer wait_timer;
+ struct dwc2_tt *dwc_tt;
+ int ttport;
+ unsigned tt_buffer_dirty:1;
+--- a/drivers/usb/dwc2/hcd_queue.c
++++ b/drivers/usb/dwc2/hcd_queue.c
+@@ -59,7 +59,7 @@
+ #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5))
+
+ /* If we get a NAK, wait this long before retrying */
+-#define DWC2_RETRY_WAIT_DELAY (msecs_to_jiffies(1))
++#define DWC2_RETRY_WAIT_DELAY 1*1E6L
+
+ /**
+ * dwc2_periodic_channel_available() - Checks that a channel is available for a
+@@ -1464,10 +1464,12 @@ static void dwc2_deschedule_periodic(str
+ * qh back to the "inactive" list, then queues transactions.
+ *
+ * @t: Pointer to wait_timer in a qh.
++ *
++ * Return: HRTIMER_NORESTART to not automatically restart this timer.
+ */
+-static void dwc2_wait_timer_fn(struct timer_list *t)
++static enum hrtimer_restart dwc2_wait_timer_fn(struct hrtimer *t)
+ {
+- struct dwc2_qh *qh = from_timer(qh, t, wait_timer);
++ struct dwc2_qh *qh = container_of(t, struct dwc2_qh, wait_timer);
+ struct dwc2_hsotg *hsotg = qh->hsotg;
+ unsigned long flags;
+
+@@ -1491,6 +1493,7 @@ static void dwc2_wait_timer_fn(struct ti
+ }
+
+ spin_unlock_irqrestore(&hsotg->lock, flags);
++ return HRTIMER_NORESTART;
+ }
+
+ /**
+@@ -1521,7 +1524,8 @@ static void dwc2_qh_init(struct dwc2_hso
+ /* Initialize QH */
+ qh->hsotg = hsotg;
+ timer_setup(&qh->unreserve_timer, dwc2_unreserve_timer_fn, 0);
+- timer_setup(&qh->wait_timer, dwc2_wait_timer_fn, 0);
++ hrtimer_init(&qh->wait_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ qh->wait_timer.function = &dwc2_wait_timer_fn;
+ qh->ep_type = ep_type;
+ qh->ep_is_in = ep_is_in;
+
+@@ -1690,7 +1694,7 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg
+ * won't do anything anyway, but we want it to finish before we free
+ * memory.
+ */
+- del_timer_sync(&qh->wait_timer);
++ hrtimer_cancel(&qh->wait_timer);
+
+ dwc2_host_put_tt_info(hsotg, qh->dwc_tt);
+
+@@ -1716,6 +1720,7 @@ int dwc2_hcd_qh_add(struct dwc2_hsotg *h
+ {
+ int status;
+ u32 intr_mask;
++ ktime_t delay;
+
+ if (dbg_qh(qh))
+ dev_vdbg(hsotg->dev, "%s()\n", __func__);
+@@ -1734,8 +1739,8 @@ int dwc2_hcd_qh_add(struct dwc2_hsotg *h
+ list_add_tail(&qh->qh_list_entry,
+ &hsotg->non_periodic_sched_waiting);
+ qh->wait_timer_cancel = false;
+- mod_timer(&qh->wait_timer,
+- jiffies + DWC2_RETRY_WAIT_DELAY + 1);
++ delay = ktime_set(0, DWC2_RETRY_WAIT_DELAY);
++ hrtimer_start(&qh->wait_timer, delay, HRTIMER_MODE_REL);
+ } else {
+ list_add_tail(&qh->qh_list_entry,
+ &hsotg->non_periodic_sched_inactive);
--- /dev/null
+From c85400f886e3d41e69966470879f635a2b50084c Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 18 Dec 2018 20:04:25 +0800
+Subject: usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+commit c85400f886e3d41e69966470879f635a2b50084c upstream.
+
+The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may
+be concurrently executed.
+The two functions both access a possible shared variable "hep->hcpriv".
+
+This shared variable is freed by r8a66597_endpoint_disable() via the
+call path:
+r8a66597_endpoint_disable
+ kfree(hep->hcpriv) (line 1995 in Linux-4.19)
+
+This variable is read by r8a66597_urb_enqueue() via the call path:
+r8a66597_urb_enqueue
+ spin_lock_irqsave(&r8a66597->lock)
+ init_pipe_info
+ enable_r8a66597_pipe
+ pipe = hep->hcpriv (line 802 in Linux-4.19)
+
+The read operation is protected by a spinlock, but the free operation
+is not protected by this spinlock, thus a concurrency use-after-free bug
+may occur.
+
+To fix this bug, the spin-lock and spin-unlock function calls in
+r8a66597_endpoint_disable() are moved to protect the free operation.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/r8a66597-hcd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -1979,6 +1979,8 @@ static int r8a66597_urb_dequeue(struct u
+
+ static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
+ struct usb_host_endpoint *hep)
++__acquires(r8a66597->lock)
++__releases(r8a66597->lock)
+ {
+ struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
+ struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv;
+@@ -1991,13 +1993,14 @@ static void r8a66597_endpoint_disable(st
+ return;
+ pipenum = pipe->info.pipenum;
+
++ spin_lock_irqsave(&r8a66597->lock, flags);
+ if (pipenum == 0) {
+ kfree(hep->hcpriv);
+ hep->hcpriv = NULL;
++ spin_unlock_irqrestore(&r8a66597->lock, flags);
+ return;
+ }
+
+- spin_lock_irqsave(&r8a66597->lock, flags);
+ pipe_stop(r8a66597, pipe);
+ pipe_irq_disable(r8a66597, pipenum);
+ disable_irq_empty(r8a66597, pipenum);
--- /dev/null
+From c3788cd9963eb2e77de3c24142fb7c67b61f1a26 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Wed, 12 Dec 2018 20:13:55 +0300
+Subject: usb: roles: Add a description for the class to Kconfig
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit c3788cd9963eb2e77de3c24142fb7c67b61f1a26 upstream.
+
+That makes the USB role switch support option visible and
+selectable for the user. The class driver is also moved to
+drivers/usb/roles/ directory.
+
+This will fix an issue that we have with the Intel USB role
+switch driver on systems that don't have USB Type-C connectors:
+
+Intel USB role switch driver depends on the USB role switch
+class as it should, but since there was no way for the user
+to enable the USB role switch class, there was also no way
+to select that driver. USB Type-C drivers select the USB
+role switch class which makes the Intel USB role switch
+driver available and therefore hides the problem.
+
+So in practice Intel USB role switch driver was depending on
+USB Type-C drivers.
+
+Fixes: f6fb9ec02be1 ("usb: roles: Add Intel xHCI USB role switch driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/Kconfig | 4
+ drivers/usb/common/Makefile | 1
+ drivers/usb/common/roles.c | 314 --------------------------------------------
+ drivers/usb/roles/Kconfig | 13 +
+ drivers/usb/roles/Makefile | 4
+ drivers/usb/roles/class.c | 314 ++++++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 330 insertions(+), 320 deletions(-)
+
+--- a/drivers/usb/Kconfig
++++ b/drivers/usb/Kconfig
+@@ -205,8 +205,4 @@ config USB_ULPI_BUS
+ To compile this driver as a module, choose M here: the module will
+ be called ulpi.
+
+-config USB_ROLE_SWITCH
+- tristate
+- select USB_COMMON
+-
+ endif # USB_SUPPORT
+--- a/drivers/usb/common/Makefile
++++ b/drivers/usb/common/Makefile
+@@ -9,4 +9,3 @@ usb-common-$(CONFIG_USB_LED_TRIG) += led
+
+ obj-$(CONFIG_USB_OTG_FSM) += usb-otg-fsm.o
+ obj-$(CONFIG_USB_ULPI_BUS) += ulpi.o
+-obj-$(CONFIG_USB_ROLE_SWITCH) += roles.o
+--- a/drivers/usb/common/roles.c
++++ /dev/null
+@@ -1,314 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * USB Role Switch Support
+- *
+- * Copyright (C) 2018 Intel Corporation
+- * Author: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+- * Hans de Goede <hdegoede@redhat.com>
+- */
+-
+-#include <linux/usb/role.h>
+-#include <linux/device.h>
+-#include <linux/module.h>
+-#include <linux/mutex.h>
+-#include <linux/slab.h>
+-
+-static struct class *role_class;
+-
+-struct usb_role_switch {
+- struct device dev;
+- struct mutex lock; /* device lock*/
+- enum usb_role role;
+-
+- /* From descriptor */
+- struct device *usb2_port;
+- struct device *usb3_port;
+- struct device *udc;
+- usb_role_switch_set_t set;
+- usb_role_switch_get_t get;
+- bool allow_userspace_control;
+-};
+-
+-#define to_role_switch(d) container_of(d, struct usb_role_switch, dev)
+-
+-/**
+- * usb_role_switch_set_role - Set USB role for a switch
+- * @sw: USB role switch
+- * @role: USB role to be switched to
+- *
+- * Set USB role @role for @sw.
+- */
+-int usb_role_switch_set_role(struct usb_role_switch *sw, enum usb_role role)
+-{
+- int ret;
+-
+- if (IS_ERR_OR_NULL(sw))
+- return 0;
+-
+- mutex_lock(&sw->lock);
+-
+- ret = sw->set(sw->dev.parent, role);
+- if (!ret)
+- sw->role = role;
+-
+- mutex_unlock(&sw->lock);
+-
+- return ret;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_set_role);
+-
+-/**
+- * usb_role_switch_get_role - Get the USB role for a switch
+- * @sw: USB role switch
+- *
+- * Depending on the role-switch-driver this function returns either a cached
+- * value of the last set role, or reads back the actual value from the hardware.
+- */
+-enum usb_role usb_role_switch_get_role(struct usb_role_switch *sw)
+-{
+- enum usb_role role;
+-
+- if (IS_ERR_OR_NULL(sw))
+- return USB_ROLE_NONE;
+-
+- mutex_lock(&sw->lock);
+-
+- if (sw->get)
+- role = sw->get(sw->dev.parent);
+- else
+- role = sw->role;
+-
+- mutex_unlock(&sw->lock);
+-
+- return role;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_get_role);
+-
+-static int __switch_match(struct device *dev, const void *name)
+-{
+- return !strcmp((const char *)name, dev_name(dev));
+-}
+-
+-static void *usb_role_switch_match(struct device_connection *con, int ep,
+- void *data)
+-{
+- struct device *dev;
+-
+- dev = class_find_device(role_class, NULL, con->endpoint[ep],
+- __switch_match);
+-
+- return dev ? to_role_switch(dev) : ERR_PTR(-EPROBE_DEFER);
+-}
+-
+-/**
+- * usb_role_switch_get - Find USB role switch linked with the caller
+- * @dev: The caller device
+- *
+- * Finds and returns role switch linked with @dev. The reference count for the
+- * found switch is incremented.
+- */
+-struct usb_role_switch *usb_role_switch_get(struct device *dev)
+-{
+- struct usb_role_switch *sw;
+-
+- sw = device_connection_find_match(dev, "usb-role-switch", NULL,
+- usb_role_switch_match);
+-
+- if (!IS_ERR_OR_NULL(sw))
+- WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
+-
+- return sw;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_get);
+-
+-/**
+- * usb_role_switch_put - Release handle to a switch
+- * @sw: USB Role Switch
+- *
+- * Decrement reference count for @sw.
+- */
+-void usb_role_switch_put(struct usb_role_switch *sw)
+-{
+- if (!IS_ERR_OR_NULL(sw)) {
+- put_device(&sw->dev);
+- module_put(sw->dev.parent->driver->owner);
+- }
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_put);
+-
+-static umode_t
+-usb_role_switch_is_visible(struct kobject *kobj, struct attribute *attr, int n)
+-{
+- struct device *dev = container_of(kobj, typeof(*dev), kobj);
+- struct usb_role_switch *sw = to_role_switch(dev);
+-
+- if (sw->allow_userspace_control)
+- return attr->mode;
+-
+- return 0;
+-}
+-
+-static const char * const usb_roles[] = {
+- [USB_ROLE_NONE] = "none",
+- [USB_ROLE_HOST] = "host",
+- [USB_ROLE_DEVICE] = "device",
+-};
+-
+-static ssize_t
+-role_show(struct device *dev, struct device_attribute *attr, char *buf)
+-{
+- struct usb_role_switch *sw = to_role_switch(dev);
+- enum usb_role role = usb_role_switch_get_role(sw);
+-
+- return sprintf(buf, "%s\n", usb_roles[role]);
+-}
+-
+-static ssize_t role_store(struct device *dev, struct device_attribute *attr,
+- const char *buf, size_t size)
+-{
+- struct usb_role_switch *sw = to_role_switch(dev);
+- int ret;
+-
+- ret = sysfs_match_string(usb_roles, buf);
+- if (ret < 0) {
+- bool res;
+-
+- /* Extra check if the user wants to disable the switch */
+- ret = kstrtobool(buf, &res);
+- if (ret || res)
+- return -EINVAL;
+- }
+-
+- ret = usb_role_switch_set_role(sw, ret);
+- if (ret)
+- return ret;
+-
+- return size;
+-}
+-static DEVICE_ATTR_RW(role);
+-
+-static struct attribute *usb_role_switch_attrs[] = {
+- &dev_attr_role.attr,
+- NULL,
+-};
+-
+-static const struct attribute_group usb_role_switch_group = {
+- .is_visible = usb_role_switch_is_visible,
+- .attrs = usb_role_switch_attrs,
+-};
+-
+-static const struct attribute_group *usb_role_switch_groups[] = {
+- &usb_role_switch_group,
+- NULL,
+-};
+-
+-static int
+-usb_role_switch_uevent(struct device *dev, struct kobj_uevent_env *env)
+-{
+- int ret;
+-
+- ret = add_uevent_var(env, "USB_ROLE_SWITCH=%s", dev_name(dev));
+- if (ret)
+- dev_err(dev, "failed to add uevent USB_ROLE_SWITCH\n");
+-
+- return ret;
+-}
+-
+-static void usb_role_switch_release(struct device *dev)
+-{
+- struct usb_role_switch *sw = to_role_switch(dev);
+-
+- kfree(sw);
+-}
+-
+-static const struct device_type usb_role_dev_type = {
+- .name = "usb_role_switch",
+- .groups = usb_role_switch_groups,
+- .uevent = usb_role_switch_uevent,
+- .release = usb_role_switch_release,
+-};
+-
+-/**
+- * usb_role_switch_register - Register USB Role Switch
+- * @parent: Parent device for the switch
+- * @desc: Description of the switch
+- *
+- * USB Role Switch is a device capable or choosing the role for USB connector.
+- * On platforms where the USB controller is dual-role capable, the controller
+- * driver will need to register the switch. On platforms where the USB host and
+- * USB device controllers behind the connector are separate, there will be a
+- * mux, and the driver for that mux will need to register the switch.
+- *
+- * Returns handle to a new role switch or ERR_PTR. The content of @desc is
+- * copied.
+- */
+-struct usb_role_switch *
+-usb_role_switch_register(struct device *parent,
+- const struct usb_role_switch_desc *desc)
+-{
+- struct usb_role_switch *sw;
+- int ret;
+-
+- if (!desc || !desc->set)
+- return ERR_PTR(-EINVAL);
+-
+- sw = kzalloc(sizeof(*sw), GFP_KERNEL);
+- if (!sw)
+- return ERR_PTR(-ENOMEM);
+-
+- mutex_init(&sw->lock);
+-
+- sw->allow_userspace_control = desc->allow_userspace_control;
+- sw->usb2_port = desc->usb2_port;
+- sw->usb3_port = desc->usb3_port;
+- sw->udc = desc->udc;
+- sw->set = desc->set;
+- sw->get = desc->get;
+-
+- sw->dev.parent = parent;
+- sw->dev.class = role_class;
+- sw->dev.type = &usb_role_dev_type;
+- dev_set_name(&sw->dev, "%s-role-switch", dev_name(parent));
+-
+- ret = device_register(&sw->dev);
+- if (ret) {
+- put_device(&sw->dev);
+- return ERR_PTR(ret);
+- }
+-
+- /* TODO: Symlinks for the host port and the device controller. */
+-
+- return sw;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_register);
+-
+-/**
+- * usb_role_switch_unregister - Unregsiter USB Role Switch
+- * @sw: USB Role Switch
+- *
+- * Unregister switch that was registered with usb_role_switch_register().
+- */
+-void usb_role_switch_unregister(struct usb_role_switch *sw)
+-{
+- if (!IS_ERR_OR_NULL(sw))
+- device_unregister(&sw->dev);
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_unregister);
+-
+-static int __init usb_roles_init(void)
+-{
+- role_class = class_create(THIS_MODULE, "usb_role");
+- return PTR_ERR_OR_ZERO(role_class);
+-}
+-subsys_initcall(usb_roles_init);
+-
+-static void __exit usb_roles_exit(void)
+-{
+- class_destroy(role_class);
+-}
+-module_exit(usb_roles_exit);
+-
+-MODULE_AUTHOR("Heikki Krogerus <heikki.krogerus@linux.intel.com>");
+-MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
+-MODULE_LICENSE("GPL v2");
+-MODULE_DESCRIPTION("USB Role Class");
+--- a/drivers/usb/roles/Kconfig
++++ b/drivers/usb/roles/Kconfig
+@@ -1,3 +1,16 @@
++config USB_ROLE_SWITCH
++ tristate "USB Role Switch Support"
++ help
++ USB Role Switch is a device that can select the USB role - host or
++ device - for a USB port (connector). In most cases dual-role capable
++ USB controller will also represent the switch, but on some platforms
++ multiplexer/demultiplexer switch is used to route the data lines on
++ the USB connector between separate USB host and device controllers.
++
++ Say Y here if your USB connectors support both device and host roles.
++ To compile the driver as module, choose M here: the module will be
++ called roles.ko.
++
+ if USB_ROLE_SWITCH
+
+ config USB_ROLES_INTEL_XHCI
+--- a/drivers/usb/roles/Makefile
++++ b/drivers/usb/roles/Makefile
+@@ -1 +1,3 @@
+-obj-$(CONFIG_USB_ROLES_INTEL_XHCI) += intel-xhci-usb-role-switch.o
++obj-$(CONFIG_USB_ROLE_SWITCH) += roles.o
++roles-y := class.o
++obj-$(CONFIG_USB_ROLES_INTEL_XHCI) += intel-xhci-usb-role-switch.o
+--- /dev/null
++++ b/drivers/usb/roles/class.c
+@@ -0,0 +1,314 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * USB Role Switch Support
++ *
++ * Copyright (C) 2018 Intel Corporation
++ * Author: Heikki Krogerus <heikki.krogerus@linux.intel.com>
++ * Hans de Goede <hdegoede@redhat.com>
++ */
++
++#include <linux/usb/role.h>
++#include <linux/device.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++
++static struct class *role_class;
++
++struct usb_role_switch {
++ struct device dev;
++ struct mutex lock; /* device lock*/
++ enum usb_role role;
++
++ /* From descriptor */
++ struct device *usb2_port;
++ struct device *usb3_port;
++ struct device *udc;
++ usb_role_switch_set_t set;
++ usb_role_switch_get_t get;
++ bool allow_userspace_control;
++};
++
++#define to_role_switch(d) container_of(d, struct usb_role_switch, dev)
++
++/**
++ * usb_role_switch_set_role - Set USB role for a switch
++ * @sw: USB role switch
++ * @role: USB role to be switched to
++ *
++ * Set USB role @role for @sw.
++ */
++int usb_role_switch_set_role(struct usb_role_switch *sw, enum usb_role role)
++{
++ int ret;
++
++ if (IS_ERR_OR_NULL(sw))
++ return 0;
++
++ mutex_lock(&sw->lock);
++
++ ret = sw->set(sw->dev.parent, role);
++ if (!ret)
++ sw->role = role;
++
++ mutex_unlock(&sw->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_set_role);
++
++/**
++ * usb_role_switch_get_role - Get the USB role for a switch
++ * @sw: USB role switch
++ *
++ * Depending on the role-switch-driver this function returns either a cached
++ * value of the last set role, or reads back the actual value from the hardware.
++ */
++enum usb_role usb_role_switch_get_role(struct usb_role_switch *sw)
++{
++ enum usb_role role;
++
++ if (IS_ERR_OR_NULL(sw))
++ return USB_ROLE_NONE;
++
++ mutex_lock(&sw->lock);
++
++ if (sw->get)
++ role = sw->get(sw->dev.parent);
++ else
++ role = sw->role;
++
++ mutex_unlock(&sw->lock);
++
++ return role;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_get_role);
++
++static int __switch_match(struct device *dev, const void *name)
++{
++ return !strcmp((const char *)name, dev_name(dev));
++}
++
++static void *usb_role_switch_match(struct device_connection *con, int ep,
++ void *data)
++{
++ struct device *dev;
++
++ dev = class_find_device(role_class, NULL, con->endpoint[ep],
++ __switch_match);
++
++ return dev ? to_role_switch(dev) : ERR_PTR(-EPROBE_DEFER);
++}
++
++/**
++ * usb_role_switch_get - Find USB role switch linked with the caller
++ * @dev: The caller device
++ *
++ * Finds and returns role switch linked with @dev. The reference count for the
++ * found switch is incremented.
++ */
++struct usb_role_switch *usb_role_switch_get(struct device *dev)
++{
++ struct usb_role_switch *sw;
++
++ sw = device_connection_find_match(dev, "usb-role-switch", NULL,
++ usb_role_switch_match);
++
++ if (!IS_ERR_OR_NULL(sw))
++ WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
++
++ return sw;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_get);
++
++/**
++ * usb_role_switch_put - Release handle to a switch
++ * @sw: USB Role Switch
++ *
++ * Decrement reference count for @sw.
++ */
++void usb_role_switch_put(struct usb_role_switch *sw)
++{
++ if (!IS_ERR_OR_NULL(sw)) {
++ put_device(&sw->dev);
++ module_put(sw->dev.parent->driver->owner);
++ }
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_put);
++
++static umode_t
++usb_role_switch_is_visible(struct kobject *kobj, struct attribute *attr, int n)
++{
++ struct device *dev = container_of(kobj, typeof(*dev), kobj);
++ struct usb_role_switch *sw = to_role_switch(dev);
++
++ if (sw->allow_userspace_control)
++ return attr->mode;
++
++ return 0;
++}
++
++static const char * const usb_roles[] = {
++ [USB_ROLE_NONE] = "none",
++ [USB_ROLE_HOST] = "host",
++ [USB_ROLE_DEVICE] = "device",
++};
++
++static ssize_t
++role_show(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ struct usb_role_switch *sw = to_role_switch(dev);
++ enum usb_role role = usb_role_switch_get_role(sw);
++
++ return sprintf(buf, "%s\n", usb_roles[role]);
++}
++
++static ssize_t role_store(struct device *dev, struct device_attribute *attr,
++ const char *buf, size_t size)
++{
++ struct usb_role_switch *sw = to_role_switch(dev);
++ int ret;
++
++ ret = sysfs_match_string(usb_roles, buf);
++ if (ret < 0) {
++ bool res;
++
++ /* Extra check if the user wants to disable the switch */
++ ret = kstrtobool(buf, &res);
++ if (ret || res)
++ return -EINVAL;
++ }
++
++ ret = usb_role_switch_set_role(sw, ret);
++ if (ret)
++ return ret;
++
++ return size;
++}
++static DEVICE_ATTR_RW(role);
++
++static struct attribute *usb_role_switch_attrs[] = {
++ &dev_attr_role.attr,
++ NULL,
++};
++
++static const struct attribute_group usb_role_switch_group = {
++ .is_visible = usb_role_switch_is_visible,
++ .attrs = usb_role_switch_attrs,
++};
++
++static const struct attribute_group *usb_role_switch_groups[] = {
++ &usb_role_switch_group,
++ NULL,
++};
++
++static int
++usb_role_switch_uevent(struct device *dev, struct kobj_uevent_env *env)
++{
++ int ret;
++
++ ret = add_uevent_var(env, "USB_ROLE_SWITCH=%s", dev_name(dev));
++ if (ret)
++ dev_err(dev, "failed to add uevent USB_ROLE_SWITCH\n");
++
++ return ret;
++}
++
++static void usb_role_switch_release(struct device *dev)
++{
++ struct usb_role_switch *sw = to_role_switch(dev);
++
++ kfree(sw);
++}
++
++static const struct device_type usb_role_dev_type = {
++ .name = "usb_role_switch",
++ .groups = usb_role_switch_groups,
++ .uevent = usb_role_switch_uevent,
++ .release = usb_role_switch_release,
++};
++
++/**
++ * usb_role_switch_register - Register USB Role Switch
++ * @parent: Parent device for the switch
++ * @desc: Description of the switch
++ *
++ * USB Role Switch is a device capable or choosing the role for USB connector.
++ * On platforms where the USB controller is dual-role capable, the controller
++ * driver will need to register the switch. On platforms where the USB host and
++ * USB device controllers behind the connector are separate, there will be a
++ * mux, and the driver for that mux will need to register the switch.
++ *
++ * Returns handle to a new role switch or ERR_PTR. The content of @desc is
++ * copied.
++ */
++struct usb_role_switch *
++usb_role_switch_register(struct device *parent,
++ const struct usb_role_switch_desc *desc)
++{
++ struct usb_role_switch *sw;
++ int ret;
++
++ if (!desc || !desc->set)
++ return ERR_PTR(-EINVAL);
++
++ sw = kzalloc(sizeof(*sw), GFP_KERNEL);
++ if (!sw)
++ return ERR_PTR(-ENOMEM);
++
++ mutex_init(&sw->lock);
++
++ sw->allow_userspace_control = desc->allow_userspace_control;
++ sw->usb2_port = desc->usb2_port;
++ sw->usb3_port = desc->usb3_port;
++ sw->udc = desc->udc;
++ sw->set = desc->set;
++ sw->get = desc->get;
++
++ sw->dev.parent = parent;
++ sw->dev.class = role_class;
++ sw->dev.type = &usb_role_dev_type;
++ dev_set_name(&sw->dev, "%s-role-switch", dev_name(parent));
++
++ ret = device_register(&sw->dev);
++ if (ret) {
++ put_device(&sw->dev);
++ return ERR_PTR(ret);
++ }
++
++ /* TODO: Symlinks for the host port and the device controller. */
++
++ return sw;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_register);
++
++/**
++ * usb_role_switch_unregister - Unregsiter USB Role Switch
++ * @sw: USB Role Switch
++ *
++ * Unregister switch that was registered with usb_role_switch_register().
++ */
++void usb_role_switch_unregister(struct usb_role_switch *sw)
++{
++ if (!IS_ERR_OR_NULL(sw))
++ device_unregister(&sw->dev);
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_unregister);
++
++static int __init usb_roles_init(void)
++{
++ role_class = class_create(THIS_MODULE, "usb_role");
++ return PTR_ERR_OR_ZERO(role_class);
++}
++subsys_initcall(usb_roles_init);
++
++static void __exit usb_roles_exit(void)
++{
++ class_destroy(role_class);
++}
++module_exit(usb_roles_exit);
++
++MODULE_AUTHOR("Heikki Krogerus <heikki.krogerus@linux.intel.com>");
++MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("USB Role Class");
--- /dev/null
+From 4b2c01ad902ec02fa962b233decd2f14be3714ba Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Fri, 21 Dec 2018 14:40:44 +0100
+Subject: USB: serial: option: add Fibocom NL678 series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jörgen Storvist <jorgen.storvist@gmail.com>
+
+commit 4b2c01ad902ec02fa962b233decd2f14be3714ba upstream.
+
+Added USB serial option driver support for Fibocom NL678 series cellular
+module: VID 2cb7 and PIDs 0x0104 and 0x0105.
+Reserved network and ADB interfaces.
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2cb7 ProdID=0104 Rev=03.10
+S: Manufacturer=Fibocom
+S: Product=Fibocom NL678-E Modem
+S: SerialNumber=12345678
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2cb7 ProdID=0105 Rev=03.10
+S: Manufacturer=Fibocom
+S: Product=Fibocom NL678-E Modem
+S: SerialNumber=12345678
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1955,6 +1955,10 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
++ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
++ .driver_info = RSVD(4) | RSVD(5) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
++ .driver_info = RSVD(6) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
--- /dev/null
+From 8d503f206c336677954160ac62f0c7d9c219cd89 Mon Sep 17 00:00:00 2001
+From: Scott Chen <scott@labau.com.tw>
+Date: Thu, 13 Dec 2018 06:01:47 -0500
+Subject: USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
+
+From: Scott Chen <scott@labau.com.tw>
+
+commit 8d503f206c336677954160ac62f0c7d9c219cd89 upstream.
+
+Add device ids to pl2303 for the HP POS pole displays:
+LM920: 03f0:026b
+TD620: 03f0:0956
+LD960TA: 03f0:4439
+LD220TA: 03f0:4349
+LM940: 03f0:5039
+
+Signed-off-by: Scott Chen <scott@labau.com.tw>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/pl2303.c | 5 +++++
+ drivers/usb/serial/pl2303.h | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -91,9 +91,14 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
+ { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) },
+ { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+ { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
+ { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -119,10 +119,15 @@
+
+ /* Hewlett-Packard POS Pole Displays */
+ #define HP_VENDOR_ID 0x03f0
++#define HP_LM920_PRODUCT_ID 0x026b
++#define HP_TD620_PRODUCT_ID 0x0956
+ #define HP_LD960_PRODUCT_ID 0x0b39
+ #define HP_LCM220_PRODUCT_ID 0x3139
+ #define HP_LCM960_PRODUCT_ID 0x3239
+ #define HP_LD220_PRODUCT_ID 0x3524
++#define HP_LD220TA_PRODUCT_ID 0x4349
++#define HP_LD960TA_PRODUCT_ID 0x4439
++#define HP_LM940_PRODUCT_ID 0x5039
+
+ /* Cressi Edy (diving computer) PC interface */
+ #define CRESSI_VENDOR_ID 0x04b8
projects / thirdparty / kernel / stable-queue.git / commitdiff
