--- /dev/null
+From 52d256cc71f546f67037100c64eb4fa3ae5e4704 Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
+Date: Thu, 20 Oct 2022 22:46:26 +0200
+Subject: ALSA: ac97: Use snd_ctl_rename() to rename a control
+
+From: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+
+commit 52d256cc71f546f67037100c64eb4fa3ae5e4704 upstream.
+
+With the recent addition of hashed controls lookup it's not enough to just
+update the control name field, the hash entries for the modified control
+have to be updated too.
+
+snd_ctl_rename() takes care of that, so use it instead of directly
+modifying the control name.
+
+While we are at it, check also that the new control name doesn't
+accidentally overwrite the available buffer space.
+
+Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+Link: https://lore.kernel.org/r/adb68bfa0885ba4a2583794b828f8e20d23f67c7.1666296963.git.maciej.szmigiero@oracle.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/ac97/ac97_codec.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -2655,11 +2655,18 @@ EXPORT_SYMBOL(snd_ac97_resume);
+ */
+ static void set_ctl_name(char *dst, const char *src, const char *suffix)
+ {
+- if (suffix)
+- sprintf(dst, "%s %s", src, suffix);
+- else
+- strcpy(dst, src);
+-}
++ const size_t msize = SNDRV_CTL_ELEM_ID_NAME_MAXLEN;
++
++ if (suffix) {
++ if (snprintf(dst, msize, "%s %s", src, suffix) >= msize)
++ pr_warn("ALSA: AC97 control name '%s %s' truncated to '%s'\n",
++ src, suffix, dst);
++ } else {
++ if (strscpy(dst, src, msize) < 0)
++ pr_warn("ALSA: AC97 control name '%s' truncated to '%s'\n",
++ src, dst);
++ }
++}
+
+ /* remove the control with the given name and optional suffix */
+ static int snd_ac97_remove_ctl(struct snd_ac97 *ac97, const char *name,
+@@ -2686,8 +2693,11 @@ static int snd_ac97_rename_ctl(struct sn
+ const char *dst, const char *suffix)
+ {
+ struct snd_kcontrol *kctl = ctl_find(ac97, src, suffix);
++ char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
++
+ if (kctl) {
+- set_ctl_name(kctl->id.name, dst, suffix);
++ set_ctl_name(name, dst, suffix);
++ snd_ctl_rename(ac97->bus->card, kctl, name);
+ return 0;
+ }
+ return -ENOENT;
+@@ -2706,11 +2716,17 @@ static int snd_ac97_swap_ctl(struct snd_
+ const char *s2, const char *suffix)
+ {
+ struct snd_kcontrol *kctl1, *kctl2;
++ char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
++
+ kctl1 = ctl_find(ac97, s1, suffix);
+ kctl2 = ctl_find(ac97, s2, suffix);
+ if (kctl1 && kctl2) {
+- set_ctl_name(kctl1->id.name, s2, suffix);
+- set_ctl_name(kctl2->id.name, s1, suffix);
++ set_ctl_name(name, s2, suffix);
++ snd_ctl_rename(ac97->bus->card, kctl1, name);
++
++ set_ctl_name(name, s1, suffix);
++ snd_ctl_rename(ac97->bus->card, kctl2, name);
++
+ return 0;
+ }
+ return -ENOENT;
--- /dev/null
+From ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Mon, 24 Oct 2022 18:29:29 +0200
+Subject: ALSA: au88x0: use explicitly signed char
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 upstream.
+
+With char becoming unsigned by default, and with `char` alone being
+ambiguous and based on architecture, signed chars need to be marked
+explicitly as such. This fixes warnings like:
+
+sound/pci/au88x0/au88x0_core.c:2029 vortex_adb_checkinout() warn: signedness bug returning '(-22)'
+sound/pci/au88x0/au88x0_core.c:2046 vortex_adb_checkinout() warn: signedness bug returning '(-12)'
+sound/pci/au88x0/au88x0_core.c:2125 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, (0), en, 0)' is unsigned
+sound/pci/au88x0/au88x0_core.c:2170 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, stream->resources, en, 4)' is unsigned
+
+As well, since one function returns errnos, return an `int` rather than
+a `signed char`.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221024162929.536004-1-Jason@zx2c4.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/au88x0/au88x0.h | 6 +++---
+ sound/pci/au88x0/au88x0_core.c | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/au88x0/au88x0.h
++++ b/sound/pci/au88x0/au88x0.h
+@@ -141,7 +141,7 @@ struct snd_vortex {
+ #ifndef CHIP_AU8810
+ stream_t dma_wt[NR_WT];
+ wt_voice_t wt_voice[NR_WT]; /* WT register cache. */
+- char mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */
++ s8 mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */
+ #endif
+
+ /* Global resources */
+@@ -235,8 +235,8 @@ static int vortex_alsafmt_aspfmt(snd_pcm
+ static void vortex_connect_default(vortex_t * vortex, int en);
+ static int vortex_adb_allocroute(vortex_t * vortex, int dma, int nr_ch,
+ int dir, int type, int subdev);
+-static char vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out,
+- int restype);
++static int vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out,
++ int restype);
+ #ifndef CHIP_AU8810
+ static int vortex_wt_allocroute(vortex_t * vortex, int dma, int nr_ch);
+ static void vortex_wt_connect(vortex_t * vortex, int en);
+--- a/sound/pci/au88x0/au88x0_core.c
++++ b/sound/pci/au88x0/au88x0_core.c
+@@ -1998,7 +1998,7 @@ static const int resnum[VORTEX_RESOURCE_
+ out: Mean checkout if != 0. Else mean Checkin resource.
+ restype: Indicates type of resource to be checked in or out.
+ */
+-static char
++static int
+ vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, int restype)
+ {
+ int i, qty = resnum[restype], resinuse = 0;
--- /dev/null
+From 957ccc434c398a88a332ae92d70790c186a18a1c Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
+Date: Thu, 20 Oct 2022 22:46:25 +0200
+Subject: ALSA: ca0106: Use snd_ctl_rename() to rename a control
+
+From: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+
+commit 957ccc434c398a88a332ae92d70790c186a18a1c upstream.
+
+With the recent addition of hashed controls lookup it's not enough to just
+update the control name field, the hash entries for the modified control
+have to be updated too.
+
+snd_ctl_rename() takes care of that, so use it instead of directly
+modifying the control name.
+
+Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+Link: https://lore.kernel.org/r/bffee980a420f9b0eee5681d2f48d34a70cec0ce.1666296963.git.maciej.szmigiero@oracle.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/ca0106/ca0106_mixer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/ca0106/ca0106_mixer.c b/sound/pci/ca0106/ca0106_mixer.c
+index 05f56015ddd8..f6381c098d4f 100644
+--- a/sound/pci/ca0106/ca0106_mixer.c
++++ b/sound/pci/ca0106/ca0106_mixer.c
+@@ -720,7 +720,7 @@ static int rename_ctl(struct snd_card *card, const char *src, const char *dst)
+ {
+ struct snd_kcontrol *kctl = ctl_find(card, src);
+ if (kctl) {
+- strcpy(kctl->id.name, dst);
++ snd_ctl_rename(card, kctl, dst);
+ return 0;
+ }
+ return -ENOENT;
+--
+2.38.1
+
--- /dev/null
+From 966f015fe4329199cc49084ee2886cfb626b34d3 Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
+Date: Thu, 20 Oct 2022 22:46:21 +0200
+Subject: ALSA: control: add snd_ctl_rename()
+
+From: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+
+commit 966f015fe4329199cc49084ee2886cfb626b34d3 upstream.
+
+Add a snd_ctl_rename() function that takes care of updating the control
+hash entries for callers that already have the relevant struct snd_kcontrol
+at hand and hold the control write lock (or simply haven't registered the
+card yet).
+
+Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+Link: https://lore.kernel.org/r/4170b71117ea81357a4f7eb8410f7cde20836c70.1666296963.git.maciej.szmigiero@oracle.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/control.h | 1 +
+ sound/core/control.c | 23 +++++++++++++++++++++++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/include/sound/control.h b/include/sound/control.h
+index eae443ba79ba..cc3dcc6cfb0f 100644
+--- a/include/sound/control.h
++++ b/include/sound/control.h
+@@ -138,6 +138,7 @@ int snd_ctl_remove(struct snd_card * card, struct snd_kcontrol * kcontrol);
+ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol, bool add_on_replace);
+ int snd_ctl_remove_id(struct snd_card * card, struct snd_ctl_elem_id *id);
+ int snd_ctl_rename_id(struct snd_card * card, struct snd_ctl_elem_id *src_id, struct snd_ctl_elem_id *dst_id);
++void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl, const char *name);
+ int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id, int active);
+ struct snd_kcontrol *snd_ctl_find_numid(struct snd_card * card, unsigned int numid);
+ struct snd_kcontrol *snd_ctl_find_id(struct snd_card * card, struct snd_ctl_elem_id *id);
+diff --git a/sound/core/control.c b/sound/core/control.c
+index a7271927d875..50e7ba66f187 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -753,6 +753,29 @@ int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id,
+ }
+ EXPORT_SYMBOL(snd_ctl_rename_id);
+
++/**
++ * snd_ctl_rename - rename the control on the card
++ * @card: the card instance
++ * @kctl: the control to rename
++ * @name: the new name
++ *
++ * Renames the specified control on the card to the new name.
++ *
++ * Make sure to take the control write lock - down_write(&card->controls_rwsem).
++ */
++void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl,
++ const char *name)
++{
++ remove_hash_entries(card, kctl);
++
++ if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0)
++ pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n",
++ name, kctl->id.name);
++
++ add_hash_entries(card, kctl);
++}
++EXPORT_SYMBOL(snd_ctl_rename);
++
+ #ifndef CONFIG_SND_CTL_FAST_LOOKUP
+ static struct snd_kcontrol *
+ snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid)
+--
+2.38.1
+
--- /dev/null
+From 36476b81b2b5db1de5adb8ced1f71b8972a9d4dd Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
+Date: Thu, 20 Oct 2022 22:46:24 +0200
+Subject: ALSA: emu10k1: Use snd_ctl_rename() to rename a control
+
+From: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+
+commit 36476b81b2b5db1de5adb8ced1f71b8972a9d4dd upstream.
+
+With the recent addition of hashed controls lookup it's not enough to just
+update the control name field, the hash entries for the modified control
+have to be updated too.
+
+snd_ctl_rename() takes care of that, so use it instead of directly
+modifying the control name.
+
+Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+Link: https://lore.kernel.org/r/38b19f019f95ee78a6e4e59d39afb9e2c3379413.1666296963.git.maciej.szmigiero@oracle.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/emu10k1/emumixer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/emu10k1/emumixer.c b/sound/pci/emu10k1/emumixer.c
+index e9c0fe3b8446..3c115f8ab96c 100644
+--- a/sound/pci/emu10k1/emumixer.c
++++ b/sound/pci/emu10k1/emumixer.c
+@@ -1767,7 +1767,7 @@ static int rename_ctl(struct snd_card *card, const char *src, const char *dst)
+ {
+ struct snd_kcontrol *kctl = ctl_find(card, src);
+ if (kctl) {
+- strcpy(kctl->id.name, dst);
++ snd_ctl_rename(card, kctl, dst);
+ return 0;
+ }
+ return -ENOENT;
+--
+2.38.1
+
--- /dev/null
+From f86bfeb689f2c4ebe12782ef0578ef778fb1a050 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 22 Oct 2022 09:21:07 +0200
+Subject: ALSA: hda/realtek: Add another HP ZBook G9 model quirks
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f86bfeb689f2c4ebe12782ef0578ef778fb1a050 upstream.
+
+HP ZBook Firefly 16 G9 (103c:896d) and HP ZBook Power 15.6 G9
+(103c:89c0) require the same quirk for enabling CS35L41 speaker amps.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221022072107.3401-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9333,6 +9333,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
++ SND_PCI_QUIRK(0x103c, 0x896d, "HP ZBook Firefly 16 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x896e, "HP EliteBook x360 830 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8971, "HP EliteBook 830 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8972, "HP EliteBook 840 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+@@ -9351,6 +9352,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x89aa, "HP EliteBook 630 G9", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x89ac, "HP EliteBook 640 G9", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x89ae, "HP EliteBook 650 G9", ALC236_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x89c0, "HP ZBook Power 15.6 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x89c3, "Zbook Studio G9", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x89c6, "Zbook Fury 17 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x89ca, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
--- /dev/null
+From 491a4ccd8a0258392900c80c6b2b622c7115fc23 Mon Sep 17 00:00:00 2001
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+Date: Tue, 18 Oct 2022 13:15:06 +0100
+Subject: ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+commit 491a4ccd8a0258392900c80c6b2b622c7115fc23 upstream.
+
+This Asus Zenbook laptop use Realtek HDA codec combined with
+2xCS35L41 Amplifiers using SPI with External Boost.
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221018121506.2561397-1-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9405,6 +9405,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
++ SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+ SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
+ SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS),
--- /dev/null
+From b51c225376a684d02fb58b49cf0ce3d693b6f14b Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
+Date: Thu, 20 Oct 2022 22:46:23 +0200
+Subject: ALSA: hda/realtek: Use snd_ctl_rename() to rename a control
+
+From: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+
+commit b51c225376a684d02fb58b49cf0ce3d693b6f14b upstream.
+
+With the recent addition of hashed controls lookup it's not enough to just
+update the control name field, the hash entries for the modified control
+have to be updated too.
+
+snd_ctl_rename() takes care of that, so use it instead of directly
+modifying the control name.
+
+Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+Link: https://lore.kernel.org/r/37496bd80f91f373268148f877fd735917d97287.1666296963.git.maciej.szmigiero@oracle.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2141,7 +2141,7 @@ static void rename_ctl(struct hda_codec
+
+ kctl = snd_hda_find_mixer_ctl(codec, oldname);
+ if (kctl)
+- strcpy(kctl->id.name, newname);
++ snd_ctl_rename(codec->card, kctl, newname);
+ }
+
+ static void alc1220_fixup_gb_dual_codecs(struct hda_codec *codec,
--- /dev/null
+From 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Tue, 25 Oct 2022 02:03:13 +0200
+Subject: ALSA: rme9652: use explicitly signed char
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 upstream.
+
+With char becoming unsigned by default, and with `char` alone being
+ambiguous and based on architecture, signed chars need to be marked
+explicitly as such. This fixes warnings like:
+
+sound/pci/rme9652/hdsp.c:3953 hdsp_channel_buffer_location() warn: 'hdsp->channel_map[channel]' is unsigned
+sound/pci/rme9652/hdsp.c:4153 snd_hdsp_channel_info() warn: impossible condition '(hdsp->channel_map[channel] < 0) => (0-255 < 0)'
+sound/pci/rme9652/rme9652.c:1833 rme9652_channel_buffer_location() warn: 'rme9652->channel_map[channel]' is unsigned
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221025000313.546261-1-Jason@zx2c4.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/rme9652/hdsp.c | 26 +++++++++++++-------------
+ sound/pci/rme9652/rme9652.c | 22 +++++++++++-----------
+ 2 files changed, 24 insertions(+), 24 deletions(-)
+
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -433,7 +433,7 @@ struct hdsp_midi {
+ struct snd_rawmidi *rmidi;
+ struct snd_rawmidi_substream *input;
+ struct snd_rawmidi_substream *output;
+- char istimer; /* timer in use */
++ signed char istimer; /* timer in use */
+ struct timer_list timer;
+ spinlock_t lock;
+ int pending;
+@@ -480,7 +480,7 @@ struct hdsp {
+ pid_t playback_pid;
+ int running;
+ int system_sample_rate;
+- const char *channel_map;
++ const signed char *channel_map;
+ int dev;
+ int irq;
+ unsigned long port;
+@@ -502,7 +502,7 @@ struct hdsp {
+ where the data for that channel can be read/written from/to.
+ */
+
+-static const char channel_map_df_ss[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_df_ss[HDSP_MAX_CHANNELS] = {
+ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17,
+ 18, 19, 20, 21, 22, 23, 24, 25
+ };
+@@ -517,7 +517,7 @@ static const char channel_map_mf_ss[HDSP
+ -1, -1, -1, -1, -1, -1, -1, -1
+ };
+
+-static const char channel_map_ds[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_ds[HDSP_MAX_CHANNELS] = {
+ /* ADAT channels are remapped */
+ 1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23,
+ /* channels 12 and 13 are S/PDIF */
+@@ -526,7 +526,7 @@ static const char channel_map_ds[HDSP_MA
+ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+ };
+
+-static const char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = {
+ /* ADAT channels */
+ 0, 1, 2, 3, 4, 5, 6, 7,
+ /* SPDIF */
+@@ -540,7 +540,7 @@ static const char channel_map_H9632_ss[H
+ -1, -1
+ };
+
+-static const char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = {
+ /* ADAT */
+ 1, 3, 5, 7,
+ /* SPDIF */
+@@ -554,7 +554,7 @@ static const char channel_map_H9632_ds[H
+ -1, -1, -1, -1, -1, -1
+ };
+
+-static const char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = {
+ /* ADAT is disabled in this mode */
+ /* SPDIF */
+ 8, 9,
+@@ -3939,7 +3939,7 @@ static snd_pcm_uframes_t snd_hdsp_hw_poi
+ return hdsp_hw_pointer(hdsp);
+ }
+
+-static char *hdsp_channel_buffer_location(struct hdsp *hdsp,
++static signed char *hdsp_channel_buffer_location(struct hdsp *hdsp,
+ int stream,
+ int channel)
+
+@@ -3964,7 +3964,7 @@ static int snd_hdsp_playback_copy(struct
+ void __user *src, unsigned long count)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES))
+ return -EINVAL;
+@@ -3982,7 +3982,7 @@ static int snd_hdsp_playback_copy_kernel
+ void *src, unsigned long count)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel);
+ if (snd_BUG_ON(!channel_buf))
+@@ -3996,7 +3996,7 @@ static int snd_hdsp_capture_copy(struct
+ void __user *dst, unsigned long count)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES))
+ return -EINVAL;
+@@ -4014,7 +4014,7 @@ static int snd_hdsp_capture_copy_kernel(
+ void *dst, unsigned long count)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel);
+ if (snd_BUG_ON(!channel_buf))
+@@ -4028,7 +4028,7 @@ static int snd_hdsp_hw_silence(struct sn
+ unsigned long count)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ channel_buf = hdsp_channel_buffer_location (hdsp, substream->pstr->stream, channel);
+ if (snd_BUG_ON(!channel_buf))
+--- a/sound/pci/rme9652/rme9652.c
++++ b/sound/pci/rme9652/rme9652.c
+@@ -230,7 +230,7 @@ struct snd_rme9652 {
+ int last_spdif_sample_rate; /* so that we can catch externally ... */
+ int last_adat_sample_rate; /* ... induced rate changes */
+
+- const char *channel_map;
++ const signed char *channel_map;
+
+ struct snd_card *card;
+ struct snd_pcm *pcm;
+@@ -247,12 +247,12 @@ struct snd_rme9652 {
+ where the data for that channel can be read/written from/to.
+ */
+
+-static const char channel_map_9652_ss[26] = {
++static const signed char channel_map_9652_ss[26] = {
+ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17,
+ 18, 19, 20, 21, 22, 23, 24, 25
+ };
+
+-static const char channel_map_9636_ss[26] = {
++static const signed char channel_map_9636_ss[26] = {
+ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+ /* channels 16 and 17 are S/PDIF */
+ 24, 25,
+@@ -260,7 +260,7 @@ static const char channel_map_9636_ss[26
+ -1, -1, -1, -1, -1, -1, -1, -1
+ };
+
+-static const char channel_map_9652_ds[26] = {
++static const signed char channel_map_9652_ds[26] = {
+ /* ADAT channels are remapped */
+ 1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23,
+ /* channels 12 and 13 are S/PDIF */
+@@ -269,7 +269,7 @@ static const char channel_map_9652_ds[26
+ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+ };
+
+-static const char channel_map_9636_ds[26] = {
++static const signed char channel_map_9636_ds[26] = {
+ /* ADAT channels are remapped */
+ 1, 3, 5, 7, 9, 11, 13, 15,
+ /* channels 8 and 9 are S/PDIF */
+@@ -1819,7 +1819,7 @@ static snd_pcm_uframes_t snd_rme9652_hw_
+ return rme9652_hw_pointer(rme9652);
+ }
+
+-static char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652,
++static signed char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652,
+ int stream,
+ int channel)
+
+@@ -1847,7 +1847,7 @@ static int snd_rme9652_playback_copy(str
+ void __user *src, unsigned long count)
+ {
+ struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES))
+ return -EINVAL;
+@@ -1867,7 +1867,7 @@ static int snd_rme9652_playback_copy_ker
+ void *src, unsigned long count)
+ {
+ struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ channel_buf = rme9652_channel_buffer_location(rme9652,
+ substream->pstr->stream,
+@@ -1883,7 +1883,7 @@ static int snd_rme9652_capture_copy(stru
+ void __user *dst, unsigned long count)
+ {
+ struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES))
+ return -EINVAL;
+@@ -1903,7 +1903,7 @@ static int snd_rme9652_capture_copy_kern
+ void *dst, unsigned long count)
+ {
+ struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ channel_buf = rme9652_channel_buffer_location(rme9652,
+ substream->pstr->stream,
+@@ -1919,7 +1919,7 @@ static int snd_rme9652_hw_silence(struct
+ unsigned long count)
+ {
+ struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+- char *channel_buf;
++ signed char *channel_buf;
+
+ channel_buf = rme9652_channel_buffer_location (rme9652,
+ substream->pstr->stream,
--- /dev/null
+From 794814529384721ce8f4d34228dc599cc010353d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 21 Oct 2022 14:27:22 +0200
+Subject: ALSA: usb-audio: Add quirks for M-Audio Fast Track C400/600
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 794814529384721ce8f4d34228dc599cc010353d upstream.
+
+M-Audio Fast Track C400 and C600 devices (0763:2030 and 0763:2031,
+respectively) seem requiring the explicit setup for the implicit
+feedback mode. This patch adds the quirk entries for those.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214817
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221021122722.24784-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/implicit.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/implicit.c
++++ b/sound/usb/implicit.c
+@@ -47,6 +47,8 @@ struct snd_usb_implicit_fb_match {
+ static const struct snd_usb_implicit_fb_match playback_implicit_fb_quirks[] = {
+ /* Fixed EP */
+ /* FIXME: check the availability of generic matching */
++ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2030, 0x81, 3), /* M-Audio Fast Track C400 */
++ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2031, 0x81, 3), /* M-Audio Fast Track C600 */
+ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2080, 0x81, 2), /* M-Audio FastTrack Ultra */
+ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2081, 0x81, 2), /* M-Audio FastTrack Ultra */
+ IMPLICIT_FB_FIXED_DEV(0x2466, 0x8010, 0x81, 2), /* Fractal Audio Axe-Fx III */
--- /dev/null
+From 0b4f0debb34754002cee295441c9ca89ba8cdfcc Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
+Date: Thu, 20 Oct 2022 22:46:22 +0200
+Subject: ALSA: usb-audio: Use snd_ctl_rename() to rename a control
+
+From: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+
+commit 0b4f0debb34754002cee295441c9ca89ba8cdfcc upstream.
+
+With the recent addition of hashed controls lookup it's not enough to just
+update the control name field, the hash entries for the modified control
+have to be updated too.
+
+snd_ctl_rename() takes care of that, so use it instead of directly
+modifying the control name.
+
+Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+Link: https://lore.kernel.org/r/723877882e3a56bb42a2a2214cfc85f347d36e19.1666296963.git.maciej.szmigiero@oracle.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index a5641956ef10..9105ec623120 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1631,7 +1631,7 @@ static void check_no_speaker_on_headset(struct snd_kcontrol *kctl,
+ if (!found)
+ return;
+
+- strscpy(kctl->id.name, "Headphone", sizeof(kctl->id.name));
++ snd_ctl_rename(card, kctl, "Headphone");
+ }
+
+ static const struct usb_feature_control_info *get_feature_control_info(int control)
+--
+2.38.1
+
--- /dev/null
+From f0a868788fcbf63cdab51f5adcf73b271ede8164 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Wed, 26 Oct 2022 23:12:36 -0400
+Subject: ALSA: Use del_timer_sync() before freeing timer
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream.
+
+The current code for freeing the emux timer is extremely dangerous:
+
+ CPU0 CPU1
+ ---- ----
+snd_emux_timer_callback()
+ snd_emux_free()
+ spin_lock(&emu->voice_lock)
+ del_timer(&emu->tlist); <-- returns immediately
+ spin_unlock(&emu->voice_lock);
+ [..]
+ kfree(emu);
+
+ spin_lock(&emu->voice_lock);
+
+ [BOOM!]
+
+Instead just use del_timer_sync() which will wait for the timer to finish
+before continuing. No need to check if the timer is active or not when
+doing so.
+
+This doesn't fix the race of a possible re-arming of the timer, but at
+least it won't use the data that has just been freed.
+
+[ Fixed unused variable warning by tiwai ]
+
+Cc: stable@vger.kernel.org
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20221026231236.6834b551@gandalf.local.home
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/synth/emux/emux.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/sound/synth/emux/emux.c
++++ b/sound/synth/emux/emux.c
+@@ -126,15 +126,10 @@ EXPORT_SYMBOL(snd_emux_register);
+ */
+ int snd_emux_free(struct snd_emux *emu)
+ {
+- unsigned long flags;
+-
+ if (! emu)
+ return -EINVAL;
+
+- spin_lock_irqsave(&emu->voice_lock, flags);
+- if (emu->timer_active)
+- del_timer(&emu->tlist);
+- spin_unlock_irqrestore(&emu->voice_lock, flags);
++ del_timer_sync(&emu->tlist);
+
+ snd_emux_proc_free(emu);
+ snd_emux_delete_virmidi(emu);
--- /dev/null
+From c3c06c61890da80494bb196f75d89b791adda87f Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Thu, 27 Oct 2022 17:12:37 +0800
+Subject: can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit c3c06c61890da80494bb196f75d89b791adda87f upstream.
+
+It is not allowed to call kfree_skb() from hardware interrupt context
+or with interrupts being disabled. The skb is unlinked from the queue,
+so it can be freed after spin_unlock_irqrestore().
+
+Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/all/20221027091237.2290111-1-yangyingliang@huawei.com
+Cc: stable@vger.kernel.org
+[mkl: adjust subject]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/j1939/transport.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -342,10 +342,12 @@ static void j1939_session_skb_drop_old(s
+ __skb_unlink(do_skb, &session->skb_queue);
+ /* drop ref taken in j1939_session_skb_queue() */
+ skb_unref(do_skb);
++ spin_unlock_irqrestore(&session->skb_queue.lock, flags);
+
+ kfree_skb(do_skb);
++ } else {
++ spin_unlock_irqrestore(&session->skb_queue.lock, flags);
+ }
+- spin_unlock_irqrestore(&session->skb_queue.lock, flags);
+ }
+
+ void j1939_session_skb_queue(struct j1939_session *session,
--- /dev/null
+From 2871edb32f4622c3a25ce4b3977bad9050b91974 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 20:52:27 +0200
+Subject: can: kvaser_usb: Fix possible completions during init_completion
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 2871edb32f4622c3a25ce4b3977bad9050b91974 upstream.
+
+kvaser_usb uses completions to signal when a response event is received
+for outgoing commands.
+
+However, it uses init_completion() to reinitialize the start_comp and
+stop_comp completions before sending the start/stop commands.
+
+In case the device sends the corresponding response just before the
+actual command is sent, complete() may be called concurrently with
+init_completion() which is not safe.
+
+This might be triggerable even with a properly functioning device by
+stopping the interface (CMD_STOP_CHIP) just after it goes bus-off (which
+also causes the driver to send CMD_STOP_CHIP when restart-ms is off),
+but that was not tested.
+
+Fix the issue by using reinit_completion() instead.
+
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010185237.319219-2-extja@kvaser.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 ++--
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1875,7 +1875,7 @@ static int kvaser_usb_hydra_start_chip(s
+ {
+ int err;
+
+- init_completion(&priv->start_comp);
++ reinit_completion(&priv->start_comp);
+
+ err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_START_CHIP_REQ,
+ priv->channel);
+@@ -1893,7 +1893,7 @@ static int kvaser_usb_hydra_stop_chip(st
+ {
+ int err;
+
+- init_completion(&priv->stop_comp);
++ reinit_completion(&priv->stop_comp);
+
+ /* Make sure we do not report invalid BUS_OFF from CMD_CHIP_STATE_EVENT
+ * see comment in kvaser_usb_hydra_update_state()
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1320,7 +1320,7 @@ static int kvaser_usb_leaf_start_chip(st
+ {
+ int err;
+
+- init_completion(&priv->start_comp);
++ reinit_completion(&priv->start_comp);
+
+ err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_START_CHIP,
+ priv->channel);
+@@ -1338,7 +1338,7 @@ static int kvaser_usb_leaf_stop_chip(str
+ {
+ int err;
+
+- init_completion(&priv->stop_comp);
++ reinit_completion(&priv->stop_comp);
+
+ err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP,
+ priv->channel);
--- /dev/null
+From d887087c896881715c1a82f1d4f71fbfe5344ffd Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Tue, 25 Oct 2022 16:56:56 +0100
+Subject: can: rcar_canfd: fix channel specific IRQ handling for RZ/G2L
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit d887087c896881715c1a82f1d4f71fbfe5344ffd upstream.
+
+RZ/G2L has separate channel specific IRQs for transmit and error
+interrupts. But the IRQ handler processes both channels, even if there
+no interrupt occurred on one of the channels.
+
+This patch fixes the issue by passing a channel specific context
+parameter instead of global one for the IRQ register and the IRQ
+handler, it just handles the channel which is triggered the interrupt.
+
+Fixes: 76e9353a80e9 ("can: rcar_canfd: Add support for RZ/G2L family")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/all/20221025155657.1426948-3-biju.das.jz@bp.renesas.com
+Cc: stable@vger.kernel.org
+[mkl: adjust commit message]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -1246,11 +1246,9 @@ static void rcar_canfd_handle_channel_tx
+
+ static irqreturn_t rcar_canfd_channel_tx_interrupt(int irq, void *dev_id)
+ {
+- struct rcar_canfd_global *gpriv = dev_id;
+- u32 ch;
++ struct rcar_canfd_channel *priv = dev_id;
+
+- for_each_set_bit(ch, &gpriv->channels_mask, gpriv->max_channels)
+- rcar_canfd_handle_channel_tx(gpriv, ch);
++ rcar_canfd_handle_channel_tx(priv->gpriv, priv->channel);
+
+ return IRQ_HANDLED;
+ }
+@@ -1278,11 +1276,9 @@ static void rcar_canfd_handle_channel_er
+
+ static irqreturn_t rcar_canfd_channel_err_interrupt(int irq, void *dev_id)
+ {
+- struct rcar_canfd_global *gpriv = dev_id;
+- u32 ch;
++ struct rcar_canfd_channel *priv = dev_id;
+
+- for_each_set_bit(ch, &gpriv->channels_mask, gpriv->max_channels)
+- rcar_canfd_handle_channel_err(gpriv, ch);
++ rcar_canfd_handle_channel_err(priv->gpriv, priv->channel);
+
+ return IRQ_HANDLED;
+ }
+@@ -1723,6 +1719,7 @@ static int rcar_canfd_channel_probe(stru
+ priv->ndev = ndev;
+ priv->base = gpriv->base;
+ priv->channel = ch;
++ priv->gpriv = gpriv;
+ priv->can.clock.freq = fcan_freq;
+ dev_info(&pdev->dev, "can_clk rate is %u\n", priv->can.clock.freq);
+
+@@ -1751,7 +1748,7 @@ static int rcar_canfd_channel_probe(stru
+ }
+ err = devm_request_irq(&pdev->dev, err_irq,
+ rcar_canfd_channel_err_interrupt, 0,
+- irq_name, gpriv);
++ irq_name, priv);
+ if (err) {
+ dev_err(&pdev->dev, "devm_request_irq CH Err(%d) failed, error %d\n",
+ err_irq, err);
+@@ -1765,7 +1762,7 @@ static int rcar_canfd_channel_probe(stru
+ }
+ err = devm_request_irq(&pdev->dev, tx_irq,
+ rcar_canfd_channel_tx_interrupt, 0,
+- irq_name, gpriv);
++ irq_name, priv);
+ if (err) {
+ dev_err(&pdev->dev, "devm_request_irq Tx (%d) failed, error %d\n",
+ tx_irq, err);
+@@ -1791,7 +1788,6 @@ static int rcar_canfd_channel_probe(stru
+
+ priv->can.do_set_mode = rcar_canfd_do_set_mode;
+ priv->can.do_get_berr_counter = rcar_canfd_get_berr_counter;
+- priv->gpriv = gpriv;
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+
+ netif_napi_add_weight(ndev, &priv->napi, rcar_canfd_rx_poll,
--- /dev/null
+From 702de2c21eed04c67cefaaedc248ef16e5f6b293 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Tue, 25 Oct 2022 16:56:55 +0100
+Subject: can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 702de2c21eed04c67cefaaedc248ef16e5f6b293 upstream.
+
+We are seeing an IRQ storm on the global receive IRQ line under heavy
+CAN bus load conditions with both CAN channels enabled.
+
+Conditions:
+
+The global receive IRQ line is shared between can0 and can1, either of
+the channels can trigger interrupt while the other channel's IRQ line
+is disabled (RFIE).
+
+When global a receive IRQ interrupt occurs, we mask the interrupt in
+the IRQ handler. Clearing and unmasking of the interrupt is happening
+in rx_poll(). There is a race condition where rx_poll() unmasks the
+interrupt, but the next IRQ handler does not mask the IRQ due to
+NAPIF_STATE_MISSED flag (e.g.: can0 RX FIFO interrupt is disabled and
+can1 is triggering RX interrupt, the delay in rx_poll() processing
+results in setting NAPIF_STATE_MISSED flag) leading to an IRQ storm.
+
+This patch fixes the issue by checking IRQ active and enabled before
+handling the IRQ on a particular channel.
+
+Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver")
+Suggested-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/all/20221025155657.1426948-2-biju.das.jz@bp.renesas.com
+Cc: stable@vger.kernel.org
+[mkl: adjust commit message]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -1157,11 +1157,13 @@ static void rcar_canfd_handle_global_rec
+ {
+ struct rcar_canfd_channel *priv = gpriv->ch[ch];
+ u32 ridx = ch + RCANFD_RFFIFO_IDX;
+- u32 sts;
++ u32 sts, cc;
+
+ /* Handle Rx interrupts */
+ sts = rcar_canfd_read(priv->base, RCANFD_RFSTS(gpriv, ridx));
+- if (likely(sts & RCANFD_RFSTS_RFIF)) {
++ cc = rcar_canfd_read(priv->base, RCANFD_RFCC(gpriv, ridx));
++ if (likely(sts & RCANFD_RFSTS_RFIF &&
++ cc & RCANFD_RFCC_RFIE)) {
+ if (napi_schedule_prep(&priv->napi)) {
+ /* Disable Rx FIFO interrupts */
+ rcar_canfd_clear_bit(priv->base,
--- /dev/null
+From 05e258c6ec669d6d18c494ea03d35962d6f5b545 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 18 Oct 2022 11:11:29 +0200
+Subject: mtd: parsers: bcm47xxpart: Fix halfblock reads
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 05e258c6ec669d6d18c494ea03d35962d6f5b545 upstream.
+
+There is some code in the parser that tries to read 0x8000
+bytes into a block to "read in the middle" of the block. Well
+that only works if the block is also 0x10000 bytes all the time,
+else we get these parse errors as we reach the end of the flash:
+
+spi-nor spi0.0: mx25l1606e (2048 Kbytes)
+mtd_read error while parsing (offset: 0x200000): -22
+mtd_read error while parsing (offset: 0x201000): -22
+(...)
+
+Fix the code to do what I think was intended.
+
+Cc: stable@vger.kernel.org
+Fixes: f0501e81fbaa ("mtd: bcm47xxpart: alternative MAGIC for board_data partition")
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20221018091129.280026-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/parsers/bcm47xxpart.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/parsers/bcm47xxpart.c
++++ b/drivers/mtd/parsers/bcm47xxpart.c
+@@ -233,11 +233,11 @@ static int bcm47xxpart_parse(struct mtd_
+ }
+
+ /* Read middle of the block */
+- err = mtd_read(master, offset + 0x8000, 0x4, &bytes_read,
++ err = mtd_read(master, offset + (blocksize / 2), 0x4, &bytes_read,
+ (uint8_t *)buf);
+ if (err && !mtd_is_bitflip(err)) {
+ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n",
+- offset + 0x8000, err);
++ offset + (blocksize / 2), err);
+ continue;
+ }
+
--- /dev/null
+From ce107713b722af57c4b7f2477594d445b496420e Mon Sep 17 00:00:00 2001
+From: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
+Date: Tue, 27 Sep 2022 15:47:28 +1300
+Subject: mtd: rawnand: marvell: Use correct logic for nand-keep-config
+
+From: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
+
+commit ce107713b722af57c4b7f2477594d445b496420e upstream.
+
+Originally the absence of the marvell,nand-keep-config property caused
+the setup_data_interface function to be provided. However when
+setup_data_interface was moved into nand_controller_ops the logic was
+unintentionally inverted. Update the logic so that only if the
+marvell,nand-keep-config property is present the bootloader NAND config
+kept.
+
+Cc: stable@vger.kernel.org
+Fixes: 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops")
+Signed-off-by: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220927024728.28447-1-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/marvell_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -2672,7 +2672,7 @@ static int marvell_nand_chip_init(struct
+ chip->controller = &nfc->controller;
+ nand_set_flash_node(chip, np);
+
+- if (!of_property_read_bool(np, "marvell,nand-keep-config"))
++ if (of_property_read_bool(np, "marvell,nand-keep-config"))
+ chip->options |= NAND_KEEP_TIMINGS;
+
+ mtd = nand_to_mtd(chip);
--- /dev/null
+From 3ada71310d2c68eebb57772df6bb1f5f033ae802 Mon Sep 17 00:00:00 2001
+From: Zhang Qilong <zhangqilong3@huawei.com>
+Date: Mon, 26 Sep 2022 16:44:56 +0800
+Subject: mtd: rawnand: tegra: Fix PM disable depth imbalance in probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+commit 3ada71310d2c68eebb57772df6bb1f5f033ae802 upstream.
+
+The pm_runtime_enable will increase power disable depth. Thus
+a pairing decrement is needed on the error handling path to
+keep it balanced according to context.
+
+Cc: stable@vger.kernel.org
+Fixes: d7d9f8ec77fe9 ("mtd: rawnand: add NVIDIA Tegra NAND Flash controller driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220926084456.98160-1-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/tegra_nand.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/tegra_nand.c
++++ b/drivers/mtd/nand/raw/tegra_nand.c
+@@ -1181,7 +1181,7 @@ static int tegra_nand_probe(struct platf
+ pm_runtime_enable(&pdev->dev);
+ err = pm_runtime_resume_and_get(&pdev->dev);
+ if (err)
+- return err;
++ goto err_dis_pm;
+
+ err = reset_control_reset(rst);
+ if (err) {
+@@ -1215,6 +1215,8 @@ static int tegra_nand_probe(struct platf
+ err_put_pm:
+ pm_runtime_put_sync_suspend(ctrl->dev);
+ pm_runtime_force_suspend(ctrl->dev);
++err_dis_pm:
++ pm_runtime_disable(&pdev->dev);
+ return err;
+ }
+
--- /dev/null
+From 69d04ca999499bccb6ca849fa2bfc5e6448f7233 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Fri, 23 Sep 2022 12:34:41 +0300
+Subject: mtd: spi-nor: core: Ignore -ENOTSUPP in spi_nor_init()
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 69d04ca999499bccb6ca849fa2bfc5e6448f7233 upstream.
+
+The Intel SPI-NOR controller does not support the 4-byte address opcode
+so ->set_4byte_addr_mode() ends up returning -ENOTSUPP and the SPI flash
+chip probe fail like this:
+
+ [ 12.291082] spi-nor: probe of spi0.0 failed with error -524
+
+Whereas previously before commit 08412e72afba ("mtd: spi-nor: core:
+Return error code from set_4byte_addr_mode()") it worked just fine.
+
+Fix this by ignoring -ENOTSUPP in spi_nor_init().
+
+Fixes: 08412e72afba ("mtd: spi-nor: core: Return error code from set_4byte_addr_mode()")
+Cc: stable@vger.kernel.org
+Reported-by: Hongyu Ning <hongyu.ning@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Michael Walle <michael@walle.cc>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220923093441.3178-1-mika.westerberg@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -2724,7 +2724,9 @@ static int spi_nor_init(struct spi_nor *
+ */
+ WARN_ONCE(nor->flags & SNOR_F_BROKEN_RESET,
+ "enabling reset hack; may not recover from unexpected reboots\n");
+- return nor->params->set_4byte_addr_mode(nor, true);
++ err = nor->params->set_4byte_addr_mode(nor, true);
++ if (err && err != -ENOTSUPP)
++ return err;
+ }
+
+ return 0;
--- /dev/null
+From 88c8e05ed5c0f05a637e654bbe4e49a1ebe7013c Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Wed, 26 Oct 2022 14:09:06 +0200
+Subject: Revert "usb: gadget: uvc: limit isoc_sg to super speed gadgets"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 88c8e05ed5c0f05a637e654bbe4e49a1ebe7013c upstream.
+
+This reverts commit 19905240aef0181d1e6944070eb85fce75f75bcd.
+
+It was a new feature, and it doesn't even work properly yet, so revert
+it from this branch as it is not needed for 6.1-final.
+
+Cc: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Cc: stable <stable@kernel.org>
+Fixes: 19905240aef0 ("usb: gadget: uvc: limit isoc_sg to super speed gadgets")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_queue.c | 9 ++++++---
+ drivers/usb/gadget/function/uvc_video.c | 9 ++-------
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/gadget/function/uvc_queue.c
++++ b/drivers/usb/gadget/function/uvc_queue.c
+@@ -84,9 +84,12 @@ static int uvc_buffer_prepare(struct vb2
+ return -ENODEV;
+
+ buf->state = UVC_BUF_STATE_QUEUED;
+- buf->sgt = vb2_dma_sg_plane_desc(vb, 0);
+- buf->sg = buf->sgt->sgl;
+- buf->mem = vb2_plane_vaddr(vb, 0);
++ if (queue->use_sg) {
++ buf->sgt = vb2_dma_sg_plane_desc(vb, 0);
++ buf->sg = buf->sgt->sgl;
++ } else {
++ buf->mem = vb2_plane_vaddr(vb, 0);
++ }
+ buf->length = vb2_plane_size(vb, 0);
+ if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+ buf->bytesused = 0;
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -448,9 +448,6 @@ static void uvcg_video_pump(struct work_
+ */
+ int uvcg_video_enable(struct uvc_video *video, int enable)
+ {
+- struct uvc_device *uvc = video->uvc;
+- struct usb_composite_dev *cdev = uvc->func.config->cdev;
+- struct usb_gadget *gadget = cdev->gadget;
+ unsigned int i;
+ int ret;
+
+@@ -482,11 +479,9 @@ int uvcg_video_enable(struct uvc_video *
+ if (video->max_payload_size) {
+ video->encode = uvc_video_encode_bulk;
+ video->payload_size = 0;
+- } else {
+- video->encode = (video->queue.use_sg &&
+- !(gadget->speed <= USB_SPEED_HIGH)) ?
++ } else
++ video->encode = video->queue.use_sg ?
+ uvc_video_encode_isoc_sg : uvc_video_encode_isoc;
+- }
+
+ video->req_int_count = 0;
+
platform-x86-amd-pmc-remove-config_debug_fs-checks.patch
+can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch
+can-kvaser_usb-fix-possible-completions-during-init_completion.patch
+can-rcar_canfd-rcar_canfd_handle_global_receive-fix-irq-storm-on-global-fifo-receive.patch
+can-rcar_canfd-fix-channel-specific-irq-handling-for-rz-g2l.patch
+alsa-use-del_timer_sync-before-freeing-timer.patch
+alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch
+alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch
+alsa-hda-realtek-add-another-hp-zbook-g9-model-quirks.patch
+alsa-control-add-snd_ctl_rename.patch
+alsa-hda-realtek-use-snd_ctl_rename-to-rename-a-control.patch
+alsa-emu10k1-use-snd_ctl_rename-to-rename-a-control.patch
+alsa-ac97-use-snd_ctl_rename-to-rename-a-control.patch
+alsa-usb-audio-use-snd_ctl_rename-to-rename-a-control.patch
+alsa-ca0106-use-snd_ctl_rename-to-rename-a-control.patch
+alsa-au88x0-use-explicitly-signed-char.patch
+alsa-rme9652-use-explicitly-signed-char.patch
+usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch
+usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch
+revert-usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch
+usb-gadget-uvc-fix-dropped-frame-after-missed-isoc.patch
+usb-gadget-uvc-fix-sg-handling-in-error-case.patch
+usb-gadget-uvc-fix-sg-handling-during-video-encode.patch
+usb-gadget-aspeed-fix-probe-regression.patch
+usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch
+usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch
+usb-dwc3-gadget-force-sending-delayed-status-during-soft-disconnect.patch
+usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch
+usb-typec-ucsi-check-the-connection-on-resume.patch
+usb-typec-ucsi-acpi-implement-resume-callback.patch
+usb-dwc3-st-rely-on-child-s-compatible-instead-of-name.patch
+usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch
+usb-bdc-change-state-when-port-disconnected.patch
+usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch
+mtd-rawnand-tegra-fix-pm-disable-depth-imbalance-in-probe.patch
+mtd-spi-nor-core-ignore-enotsupp-in-spi_nor_init.patch
+mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch
+mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch
+squashfs-fix-read-regression-introduced-in-readahead-code.patch
+squashfs-fix-extending-readahead-beyond-end-of-file.patch
+squashfs-fix-buffer-release-race-condition-in-readahead-code.patch
--- /dev/null
+From e11c4e088be4c39d17f304fcf331670891905f42 Mon Sep 17 00:00:00 2001
+From: Phillip Lougher <phillip@squashfs.org.uk>
+Date: Thu, 20 Oct 2022 23:36:16 +0100
+Subject: squashfs: fix buffer release race condition in readahead code
+
+From: Phillip Lougher <phillip@squashfs.org.uk>
+
+commit e11c4e088be4c39d17f304fcf331670891905f42 upstream.
+
+Fix a buffer release race condition, where the error value was used after
+release.
+
+Link: https://lkml.kernel.org/r/20221020223616.7571-4-phillip@squashfs.org.uk
+Fixes: b09a7a036d20 ("squashfs: support reading fragments in readahead call")
+Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
+Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Reported-by: Marc Miltenberger <marcmiltenberger@gmail.com>
+Cc: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
+Cc: Hsin-Yi Wang <hsinyi@chromium.org>
+Cc: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+Cc: Slade Watkins <srw@sladewatkins.net>
+Cc: Thorsten Leemhuis <regressions@leemhuis.info>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/squashfs/file.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
+index f0afd4d6fd30..8ba8c4c50770 100644
+--- a/fs/squashfs/file.c
++++ b/fs/squashfs/file.c
+@@ -506,8 +506,9 @@ static int squashfs_readahead_fragment(struct page **page,
+ squashfs_i(inode)->fragment_size);
+ struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
+ unsigned int n, mask = (1 << (msblk->block_log - PAGE_SHIFT)) - 1;
++ int error = buffer->error;
+
+- if (buffer->error)
++ if (error)
+ goto out;
+
+ expected += squashfs_i(inode)->fragment_offset;
+@@ -529,7 +530,7 @@ static int squashfs_readahead_fragment(struct page **page,
+
+ out:
+ squashfs_cache_put(buffer);
+- return buffer->error;
++ return error;
+ }
+
+ static void squashfs_readahead(struct readahead_control *ractl)
+--
+2.38.1
+
--- /dev/null
+From c9199de82bad03bceb94ec3c5195c879d7e11911 Mon Sep 17 00:00:00 2001
+From: Phillip Lougher <phillip@squashfs.org.uk>
+Date: Thu, 20 Oct 2022 23:36:15 +0100
+Subject: squashfs: fix extending readahead beyond end of file
+
+From: Phillip Lougher <phillip@squashfs.org.uk>
+
+commit c9199de82bad03bceb94ec3c5195c879d7e11911 upstream.
+
+The readahead code will try to extend readahead to the entire size of the
+Squashfs data block.
+
+But, it didn't take into account that the last block at the end of the
+file may not be a whole block. In this case, the code would extend
+readahead to beyond the end of the file, leaving trailing pages.
+
+Fix this by only requesting the expected number of pages.
+
+Link: https://lkml.kernel.org/r/20221020223616.7571-3-phillip@squashfs.org.uk
+Fixes: 8fc78b6fe24c ("squashfs: implement readahead")
+Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
+Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Reported-by: Marc Miltenberger <marcmiltenberger@gmail.com>
+Cc: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
+Cc: Hsin-Yi Wang <hsinyi@chromium.org>
+Cc: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+Cc: Slade Watkins <srw@sladewatkins.net>
+Cc: Thorsten Leemhuis <regressions@leemhuis.info>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/squashfs/file.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
+index e526eb7a1658..f0afd4d6fd30 100644
+--- a/fs/squashfs/file.c
++++ b/fs/squashfs/file.c
+@@ -559,6 +559,12 @@ static void squashfs_readahead(struct readahead_control *ractl)
+ unsigned int expected;
+ struct page *last_page;
+
++ expected = start >> msblk->block_log == file_end ?
++ (i_size_read(inode) & (msblk->block_size - 1)) :
++ msblk->block_size;
++
++ max_pages = (expected + PAGE_SIZE - 1) >> PAGE_SHIFT;
++
+ nr_pages = __readahead_batch(ractl, pages, max_pages);
+ if (!nr_pages)
+ break;
+@@ -567,13 +573,10 @@ static void squashfs_readahead(struct readahead_control *ractl)
+ goto skip_pages;
+
+ index = pages[0]->index >> shift;
++
+ if ((pages[nr_pages - 1]->index >> shift) != index)
+ goto skip_pages;
+
+- expected = index == file_end ?
+- (i_size_read(inode) & (msblk->block_size - 1)) :
+- msblk->block_size;
+-
+ if (index == file_end && squashfs_i(inode)->fragment_block !=
+ SQUASHFS_INVALID_BLK) {
+ res = squashfs_readahead_fragment(pages, nr_pages,
+--
+2.38.1
+
--- /dev/null
+From 9ef8eb6104527bfe9ed31f7a4ffa721390adf9a8 Mon Sep 17 00:00:00 2001
+From: Phillip Lougher <phillip@squashfs.org.uk>
+Date: Thu, 20 Oct 2022 23:36:14 +0100
+Subject: squashfs: fix read regression introduced in readahead code
+
+From: Phillip Lougher <phillip@squashfs.org.uk>
+
+commit 9ef8eb6104527bfe9ed31f7a4ffa721390adf9a8 upstream.
+
+Patch series "squashfs: fix some regressions introduced in the readahead
+code".
+
+This patchset fixes 3 regressions introduced by the recent readahead code
+changes. The first regression is causing "snaps" to randomly fail after a
+couple of hours or days, which how the regression came to light.
+
+
+This patch (of 3):
+
+If a file isn't a whole multiple of the page size, the last page will have
+trailing bytes unfilled.
+
+There was a mistake in the readahead code which did this. In particular
+it incorrectly assumed that the last page in the readahead page array
+(page[nr_pages - 1]) will always contain the last page in the block, which
+if we're at file end, will be the page that needs to be zero filled.
+
+But the readahead code may not return the last page in the block, which
+means it is unmapped and will be skipped by the decompressors (a temporary
+buffer used).
+
+In this case the zero filling code will zero out the wrong page, leading
+to data corruption.
+
+Fix this by by extending the "page actor" to return the last page if
+present, or NULL if a temporary buffer was used.
+
+Link: https://lkml.kernel.org/r/20221020223616.7571-1-phillip@squashfs.org.uk
+Link: https://lkml.kernel.org/r/20221020223616.7571-2-phillip@squashfs.org.uk
+Fixes: 8fc78b6fe24c ("squashfs: implement readahead")
+Link: https://lore.kernel.org/lkml/b0c258c3-6dcf-aade-efc4-d62a8b3a1ce2@alu.unizg.hr/
+Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
+Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+Tested-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
+Tested-by: Slade Watkins <srw@sladewatkins.net>
+Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Reported-by: Marc Miltenberger <marcmiltenberger@gmail.com>
+Cc: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
+Cc: Hsin-Yi Wang <hsinyi@chromium.org>
+Cc: Thorsten Leemhuis <regressions@leemhuis.info>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/squashfs/file.c | 7 ++++---
+ fs/squashfs/page_actor.c | 3 +++
+ fs/squashfs/page_actor.h | 6 +++++-
+ 3 files changed, 12 insertions(+), 4 deletions(-)
+
+--- a/fs/squashfs/file.c
++++ b/fs/squashfs/file.c
+@@ -557,6 +557,7 @@ static void squashfs_readahead(struct re
+ int res, bsize;
+ u64 block = 0;
+ unsigned int expected;
++ struct page *last_page;
+
+ nr_pages = __readahead_batch(ractl, pages, max_pages);
+ if (!nr_pages)
+@@ -593,15 +594,15 @@ static void squashfs_readahead(struct re
+
+ res = squashfs_read_data(inode->i_sb, block, bsize, NULL, actor);
+
+- squashfs_page_actor_free(actor);
++ last_page = squashfs_page_actor_free(actor);
+
+ if (res == expected) {
+ int bytes;
+
+ /* Last page (if present) may have trailing bytes not filled */
+ bytes = res % PAGE_SIZE;
+- if (pages[nr_pages - 1]->index == file_end && bytes)
+- memzero_page(pages[nr_pages - 1], bytes,
++ if (index == file_end && bytes && last_page)
++ memzero_page(last_page, bytes,
+ PAGE_SIZE - bytes);
+
+ for (i = 0; i < nr_pages; i++) {
+--- a/fs/squashfs/page_actor.c
++++ b/fs/squashfs/page_actor.c
+@@ -71,11 +71,13 @@ static void *handle_next_page(struct squ
+ (actor->next_index != actor->page[actor->next_page]->index)) {
+ actor->next_index++;
+ actor->returned_pages++;
++ actor->last_page = NULL;
+ return actor->alloc_buffer ? actor->tmp_buffer : ERR_PTR(-ENOMEM);
+ }
+
+ actor->next_index++;
+ actor->returned_pages++;
++ actor->last_page = actor->page[actor->next_page];
+ return actor->pageaddr = kmap_local_page(actor->page[actor->next_page++]);
+ }
+
+@@ -125,6 +127,7 @@ struct squashfs_page_actor *squashfs_pag
+ actor->returned_pages = 0;
+ actor->next_index = page[0]->index & ~((1 << (msblk->block_log - PAGE_SHIFT)) - 1);
+ actor->pageaddr = NULL;
++ actor->last_page = NULL;
+ actor->alloc_buffer = msblk->decompressor->alloc_buffer;
+ actor->squashfs_first_page = direct_first_page;
+ actor->squashfs_next_page = direct_next_page;
+--- a/fs/squashfs/page_actor.h
++++ b/fs/squashfs/page_actor.h
+@@ -16,6 +16,7 @@ struct squashfs_page_actor {
+ void *(*squashfs_first_page)(struct squashfs_page_actor *);
+ void *(*squashfs_next_page)(struct squashfs_page_actor *);
+ void (*squashfs_finish_page)(struct squashfs_page_actor *);
++ struct page *last_page;
+ int pages;
+ int length;
+ int next_page;
+@@ -29,10 +30,13 @@ extern struct squashfs_page_actor *squas
+ extern struct squashfs_page_actor *squashfs_page_actor_init_special(
+ struct squashfs_sb_info *msblk,
+ struct page **page, int pages, int length);
+-static inline void squashfs_page_actor_free(struct squashfs_page_actor *actor)
++static inline struct page *squashfs_page_actor_free(struct squashfs_page_actor *actor)
+ {
++ struct page *last_page = actor->last_page;
++
+ kfree(actor->tmp_buffer);
+ kfree(actor);
++ return last_page;
+ }
+ static inline void *squashfs_first_page(struct squashfs_page_actor *actor)
+ {
--- /dev/null
+From fc4ade55c617dc73c7e9756b57f3230b4ff24540 Mon Sep 17 00:00:00 2001
+From: Hannu Hartikainen <hannu@hrtk.in>
+Date: Mon, 19 Sep 2022 20:16:10 +0300
+Subject: USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
+
+From: Hannu Hartikainen <hannu@hrtk.in>
+
+commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 upstream.
+
+NVIDIA Jetson devices in Force Recovery mode (RCM) do not support
+suspending, ie. flashing fails if the device has been suspended. The
+devices are still visible in lsusb and seem to work otherwise, making
+the issue hard to debug. This has been discovered in various forum
+posts, eg. [1].
+
+The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding
+all the Jetson models listed in [2] on the assumption that they all
+behave similarly.
+
+[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365
+[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html
+
+Signed-off-by: Hannu Hartikainen <hannu@hrtk.in>
+Cc: stable <stable@kernel.org> # after 6.1-rc3
+Link: https://lore.kernel.org/r/20220919171610.30484-1-hannu@hrtk.in
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index f99a65a64588..11b27953ccd0 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -388,6 +388,15 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Kingston DataTraveler 3.0 */
+ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* NVIDIA Jetson devices in Force Recovery mode */
++ { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
+--
+2.38.1
+
--- /dev/null
+From fb8f60dd1b67520e0e0d7978ef17d015690acfc1 Mon Sep 17 00:00:00 2001
+From: Justin Chen <justinpopo6@gmail.com>
+Date: Wed, 5 Oct 2022 12:13:55 -0700
+Subject: usb: bdc: change state when port disconnected
+
+From: Justin Chen <justinpopo6@gmail.com>
+
+commit fb8f60dd1b67520e0e0d7978ef17d015690acfc1 upstream.
+
+When port is connected and then disconnected, the state stays as
+configured. Which is incorrect as the port is no longer configured,
+but in a not attached state.
+
+Signed-off-by: Justin Chen <justinpopo6@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC")
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/1664997235-18198-1-git-send-email-justinpopo6@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/udc/bdc/bdc_udc.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c
+@@ -151,6 +151,7 @@ static void bdc_uspc_disconnected(struct
+ bdc->delayed_status = false;
+ bdc->reinit = reinit;
+ bdc->test_mode = false;
++ usb_gadget_set_state(&bdc->gadget, USB_STATE_NOTATTACHED);
+ }
+
+ /* TNotify wkaeup timer */
--- /dev/null
+From d182c2e1bc92084c038b44c618f29589a4de9f66 Mon Sep 17 00:00:00 2001
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+Date: Tue, 18 Oct 2022 02:35:10 +0300
+Subject: usb: dwc3: Don't switch OTG -> peripheral if extcon is present
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+commit d182c2e1bc92084c038b44c618f29589a4de9f66 upstream.
+
+If the extcon device exists, get the mode from the extcon device. If
+the controller is DRD and the driver is unable to determine the mode,
+only then default the dr_mode to USB_DR_MODE_PERIPHERAL.
+
+Reported-by: Steev Klimaszewski <steev@kali.org>
+Fixes: 7a84e7353e23 ("Revert "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"")
+Cc: stable <stable@kernel.org>
+Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/20221017233510.53336-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++-
+ drivers/usb/dwc3/drd.c | 50 ------------------------------------------------
+ 2 files changed, 48 insertions(+), 51 deletions(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -23,6 +23,7 @@
+ #include <linux/delay.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/of.h>
++#include <linux/of_graph.h>
+ #include <linux/acpi.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/reset.h>
+@@ -85,7 +86,7 @@ static int dwc3_get_dr_mode(struct dwc3
+ * mode. If the controller supports DRD but the dr_mode is not
+ * specified or set to OTG, then set the mode to peripheral.
+ */
+- if (mode == USB_DR_MODE_OTG &&
++ if (mode == USB_DR_MODE_OTG && !dwc->edev &&
+ (!IS_ENABLED(CONFIG_USB_ROLE_SWITCH) ||
+ !device_property_read_bool(dwc->dev, "usb-role-switch")) &&
+ !DWC3_VER_IS_PRIOR(DWC3, 330A))
+@@ -1690,6 +1691,46 @@ static void dwc3_check_params(struct dwc
+ }
+ }
+
++static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc)
++{
++ struct device *dev = dwc->dev;
++ struct device_node *np_phy;
++ struct extcon_dev *edev = NULL;
++ const char *name;
++
++ if (device_property_read_bool(dev, "extcon"))
++ return extcon_get_edev_by_phandle(dev, 0);
++
++ /*
++ * Device tree platforms should get extcon via phandle.
++ * On ACPI platforms, we get the name from a device property.
++ * This device property is for kernel internal use only and
++ * is expected to be set by the glue code.
++ */
++ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0)
++ return extcon_get_extcon_dev(name);
++
++ /*
++ * Try to get an extcon device from the USB PHY controller's "port"
++ * node. Check if it has the "port" node first, to avoid printing the
++ * error message from underlying code, as it's a valid case: extcon
++ * device (and "port" node) may be missing in case of "usb-role-switch"
++ * or OTG mode.
++ */
++ np_phy = of_parse_phandle(dev->of_node, "phys", 0);
++ if (of_graph_is_present(np_phy)) {
++ struct device_node *np_conn;
++
++ np_conn = of_graph_get_remote_node(np_phy, -1, -1);
++ if (np_conn)
++ edev = extcon_find_edev_by_node(np_conn);
++ of_node_put(np_conn);
++ }
++ of_node_put(np_phy);
++
++ return edev;
++}
++
+ static int dwc3_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -1840,6 +1881,12 @@ static int dwc3_probe(struct platform_de
+ goto err2;
+ }
+
++ dwc->edev = dwc3_get_extcon(dwc);
++ if (IS_ERR(dwc->edev)) {
++ ret = dev_err_probe(dwc->dev, PTR_ERR(dwc->edev), "failed to get extcon\n");
++ goto err3;
++ }
++
+ ret = dwc3_get_dr_mode(dwc);
+ if (ret)
+ goto err3;
+--- a/drivers/usb/dwc3/drd.c
++++ b/drivers/usb/dwc3/drd.c
+@@ -8,7 +8,6 @@
+ */
+
+ #include <linux/extcon.h>
+-#include <linux/of_graph.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
+@@ -439,51 +438,6 @@ static int dwc3_drd_notifier(struct noti
+ return NOTIFY_DONE;
+ }
+
+-static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc)
+-{
+- struct device *dev = dwc->dev;
+- struct device_node *np_phy;
+- struct extcon_dev *edev = NULL;
+- const char *name;
+-
+- if (device_property_read_bool(dev, "extcon"))
+- return extcon_get_edev_by_phandle(dev, 0);
+-
+- /*
+- * Device tree platforms should get extcon via phandle.
+- * On ACPI platforms, we get the name from a device property.
+- * This device property is for kernel internal use only and
+- * is expected to be set by the glue code.
+- */
+- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
+- edev = extcon_get_extcon_dev(name);
+- if (!edev)
+- return ERR_PTR(-EPROBE_DEFER);
+-
+- return edev;
+- }
+-
+- /*
+- * Try to get an extcon device from the USB PHY controller's "port"
+- * node. Check if it has the "port" node first, to avoid printing the
+- * error message from underlying code, as it's a valid case: extcon
+- * device (and "port" node) may be missing in case of "usb-role-switch"
+- * or OTG mode.
+- */
+- np_phy = of_parse_phandle(dev->of_node, "phys", 0);
+- if (of_graph_is_present(np_phy)) {
+- struct device_node *np_conn;
+-
+- np_conn = of_graph_get_remote_node(np_phy, -1, -1);
+- if (np_conn)
+- edev = extcon_find_edev_by_node(np_conn);
+- of_node_put(np_conn);
+- }
+- of_node_put(np_phy);
+-
+- return edev;
+-}
+-
+ #if IS_ENABLED(CONFIG_USB_ROLE_SWITCH)
+ #define ROLE_SWITCH 1
+ static int dwc3_usb_role_switch_set(struct usb_role_switch *sw,
+@@ -588,10 +542,6 @@ int dwc3_drd_init(struct dwc3 *dwc)
+ device_property_read_bool(dwc->dev, "usb-role-switch"))
+ return dwc3_setup_role_switch(dwc);
+
+- dwc->edev = dwc3_get_extcon(dwc);
+- if (IS_ERR(dwc->edev))
+- return PTR_ERR(dwc->edev);
+-
+ if (dwc->edev) {
+ dwc->edev_nb.notifier_call = dwc3_drd_notifier;
+ ret = extcon_register_notifier(dwc->edev, EXTCON_USB_HOST,
--- /dev/null
+From 4db0fbb601361767144e712beb96704b966339f5 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Tue, 18 Oct 2022 19:39:01 -0700
+Subject: usb: dwc3: gadget: Don't delay End Transfer on delayed_status
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 4db0fbb601361767144e712beb96704b966339f5 upstream.
+
+The gadget driver may wait on the request completion when it sets the
+USB_GADGET_DELAYED_STATUS. Make sure that the End Transfer command can
+go through if the dwc->delayed_status is set so that the request can
+complete. When the delayed_status is set, the Setup packet is already
+processed, and the next phase should be either Data or Status. It's
+unlikely that the host would cancel the control transfer and send a new
+Setup packet during End Transfer command. But if that's the case, we can
+try again when ep0state returns to EP0_SETUP_PHASE.
+
+Fixes: e1ee843488d5 ("usb: dwc3: gadget: Force sending delayed status during soft disconnect")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/3f9f59e5d74efcbaee444cf4b30ef639cc7b124e.1666146954.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1683,6 +1683,16 @@ static int __dwc3_stop_active_transfer(s
+ cmd |= DWC3_DEPCMD_PARAM(dep->resource_index);
+ memset(¶ms, 0, sizeof(params));
+ ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms);
++ /*
++ * If the End Transfer command was timed out while the device is
++ * not in SETUP phase, it's possible that an incoming Setup packet
++ * may prevent the command's completion. Let's retry when the
++ * ep0state returns to EP0_SETUP_PHASE.
++ */
++ if (ret == -ETIMEDOUT && dep->dwc->ep0state != EP0_SETUP_PHASE) {
++ dep->flags |= DWC3_EP_DELAY_STOP;
++ return 0;
++ }
+ WARN_ON_ONCE(ret);
+ dep->resource_index = 0;
+
+@@ -3702,7 +3712,7 @@ void dwc3_stop_active_transfer(struct dw
+ * timeout. Delay issuing the End Transfer command until the Setup TRB is
+ * prepared.
+ */
+- if (dwc->ep0state != EP0_SETUP_PHASE) {
++ if (dwc->ep0state != EP0_SETUP_PHASE && !dwc->delayed_status) {
+ dep->flags |= DWC3_EP_DELAY_STOP;
+ return;
+ }
--- /dev/null
+From 308c316d16cbad99bb834767382baa693ac42169 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Tue, 25 Oct 2022 15:10:20 -0700
+Subject: usb: dwc3: gadget: Don't set IMI for no_interrupt
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 308c316d16cbad99bb834767382baa693ac42169 upstream.
+
+The gadget driver may have a certain expectation of how the request
+completion flow should be from to its configuration. Make sure the
+controller driver respect that. That is, don't set IMI (Interrupt on
+Missed Isoc) when usb_request->no_interrupt is set. Also, the driver
+should only set IMI to the last TRB of a chain.
+
+Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Reviewed-by: Jeff Vanhoof <jdv1029@gmail.com>
+Tested-by: Jeff Vanhoof <jdv1029@gmail.com>
+Link: https://lore.kernel.org/r/ced336c84434571340c07994e3667a0ee284fefe.1666735451.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1277,8 +1277,8 @@ static void dwc3_prepare_one_trb(struct
+ trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS;
+ }
+
+- /* always enable Interrupt on Missed ISOC */
+- trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
++ if (!no_interrupt && !chain)
++ trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
+ break;
+
+ case USB_ENDPOINT_XFER_BULK:
--- /dev/null
+From e1ee843488d58099a89979627ef85d5bd6c5cacd Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+Date: Wed, 17 Aug 2022 11:23:52 -0700
+Subject: usb: dwc3: gadget: Force sending delayed status during soft disconnect
+
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+
+commit e1ee843488d58099a89979627ef85d5bd6c5cacd upstream.
+
+If any function drivers request for a delayed status phase, this leads to a
+SETUP transfer timeout error, since the function may take longer to process
+the DATA stage. This eventually results in end transfer timeouts, as there
+is a pending SETUP transaction.
+
+In addition, allow the DWC3_EP_DELAY_STOP to be set for if there is a
+delayed status requested. Ocasionally, a host may abort the current SETUP
+transaction, by issuing a subsequent SETUP token. In those situations, it
+would result in an endxfer timeout as well.
+
+Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Link: https://lore.kernel.org/r/20220817182359.13550-3-quic_wcheng@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2501,6 +2501,9 @@ static int dwc3_gadget_soft_disconnect(s
+ if (dwc->ep0state != EP0_SETUP_PHASE) {
+ int ret;
+
++ if (dwc->delayed_status)
++ dwc3_ep0_send_delayed_status(dwc);
++
+ reinit_completion(&dwc->ep0_in_setup);
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+@@ -3699,7 +3702,7 @@ void dwc3_stop_active_transfer(struct dw
+ * timeout. Delay issuing the End Transfer command until the Setup TRB is
+ * prepared.
+ */
+- if (dwc->ep0state != EP0_SETUP_PHASE && !dwc->delayed_status) {
++ if (dwc->ep0state != EP0_SETUP_PHASE) {
+ dep->flags |= DWC3_EP_DELAY_STOP;
+ return;
+ }
--- /dev/null
+From f78961f8380b940e0cfc7e549336c21a2ad44f4d Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Tue, 25 Oct 2022 15:10:14 -0700
+Subject: usb: dwc3: gadget: Stop processing more requests on IMI
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit f78961f8380b940e0cfc7e549336c21a2ad44f4d upstream.
+
+When servicing a transfer completion event, the dwc3 driver will reclaim
+TRBs of started requests up to the request associated with the interrupt
+event. Currently we don't check for interrupt due to missed isoc, and
+the driver may attempt to reclaim TRBs beyond the associated event. This
+causes invalid memory access when the hardware still owns the TRB. If
+there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure
+to stop servicing further.
+
+Note that only the last TRB of chained TRBs has its status updated with
+missed isoc.
+
+Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
+Cc: stable@vger.kernel.org
+Reported-by: Jeff Vanhoof <jdv1029@gmail.com>
+Reported-by: Dan Vacura <w36195@motorola.com>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Reviewed-by: Jeff Vanhoof <jdv1029@gmail.com>
+Tested-by: Jeff Vanhoof <jdv1029@gmail.com>
+Link: https://lore.kernel.org/r/b29acbeab531b666095dfdafd8cb5c7654fbb3e1.1666735451.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3215,6 +3215,10 @@ static int dwc3_gadget_ep_reclaim_comple
+ if (event->status & DEPEVT_STATUS_SHORT && !chain)
+ return 1;
+
++ if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) &&
++ DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC)
++ return 1;
++
+ if ((trb->ctrl & DWC3_TRB_CTRL_IOC) ||
+ (trb->ctrl & DWC3_TRB_CTRL_LST))
+ return 1;
--- /dev/null
+From 3f53c329b31d53b2a2e7992819242fc0d4f883e0 Mon Sep 17 00:00:00 2001
+From: Patrice Chotard <patrice.chotard@foss.st.com>
+Date: Fri, 30 Sep 2022 16:20:18 +0200
+Subject: usb: dwc3: st: Rely on child's compatible instead of name
+
+From: Patrice Chotard <patrice.chotard@foss.st.com>
+
+commit 3f53c329b31d53b2a2e7992819242fc0d4f883e0 upstream.
+
+To ensure that child node is found, don't rely on child's node name
+which can take different value, but on child's compatible name.
+
+Fixes: f5c5936d6b4d ("usb: dwc3: st: Fix node's child name")
+Cc: stable <stable@kernel.org>
+Cc: Jerome Audu <jerome.audu@st.com>
+Reported-by: Felipe Balbi <felipe@balbi.sh>
+Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://lore.kernel.org/r/20220930142018.890535-1-patrice.chotard@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-st.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-st.c
++++ b/drivers/usb/dwc3/dwc3-st.c
+@@ -251,7 +251,7 @@ static int st_dwc3_probe(struct platform
+ /* Manage SoftReset */
+ reset_control_deassert(dwc3_data->rstc_rst);
+
+- child = of_get_child_by_name(node, "usb");
++ child = of_get_compatible_child(node, "snps,dwc3");
+ if (!child) {
+ dev_err(&pdev->dev, "failed to find dwc3 core node\n");
+ ret = -ENODEV;
--- /dev/null
+From 48ed32482c4100069d0c0eebdc6b198c6ae5f71f Mon Sep 17 00:00:00 2001
+From: Joel Stanley <joel@jms.id.au>
+Date: Mon, 17 Oct 2022 16:00:06 +1030
+Subject: usb: gadget: aspeed: Fix probe regression
+
+From: Joel Stanley <joel@jms.id.au>
+
+commit 48ed32482c4100069d0c0eebdc6b198c6ae5f71f upstream.
+
+Since commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets"),
+the gadget devices are proper driver core devices, which caused each
+device to request pinmux settings:
+
+ aspeed_vhub 1e6a0000.usb-vhub: Initialized virtual hub in USB2 mode
+ aspeed-g5-pinctrl 1e6e2080.pinctrl: pin A7 already requested by 1e6a0000.usb-vhub; cannot claim for gadget.0
+ aspeed-g5-pinctrl 1e6e2080.pinctrl: pin-232 (gadget.0) status -22
+ aspeed-g5-pinctrl 1e6e2080.pinctrl: could not request pin 232 (A7) from group USB2AD on device aspeed-g5-pinctrl
+ g_mass_storage gadget.0: Error applying setting, reverse things back
+
+The vhub driver has already claimed the pins, so prevent the gadgets
+from requesting them too by setting the magic of_node_reused flag. This
+causes the driver core to skip the mux request.
+
+Reported-by: Zev Weiss <zev@bewilderbeest.net>
+Reported-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets")
+Cc: stable@vger.kernel.org
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Tested-by: Zev Weiss <zev@bewilderbeest.net>
+Tested-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+Link: https://lore.kernel.org/r/20221017053006.358520-1-joel@jms.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/aspeed-vhub/dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/udc/aspeed-vhub/dev.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/dev.c
+@@ -591,6 +591,7 @@ int ast_vhub_init_dev(struct ast_vhub *v
+ d->gadget.max_speed = USB_SPEED_HIGH;
+ d->gadget.speed = USB_SPEED_UNKNOWN;
+ d->gadget.dev.of_node = vhub->pdev->dev.of_node;
++ d->gadget.dev.of_node_reused = true;
+
+ rc = usb_add_gadget_udc(d->port_dev, &d->gadget);
+ if (rc != 0)
--- /dev/null
+From 8e8e923a49967b798e7d69f1ce9eff1dd2533547 Mon Sep 17 00:00:00 2001
+From: Dan Vacura <w36195@motorola.com>
+Date: Tue, 18 Oct 2022 16:50:37 -0500
+Subject: usb: gadget: uvc: fix dropped frame after missed isoc
+
+From: Dan Vacura <w36195@motorola.com>
+
+commit 8e8e923a49967b798e7d69f1ce9eff1dd2533547 upstream.
+
+With the re-use of the previous completion status in 0d1c407b1a749
+("usb: dwc3: gadget: Return proper request status") it could be possible
+that the next frame would also get dropped if the current frame has a
+missed isoc error. Ensure that an interrupt is requested for the start
+of a new frame.
+
+Fixes: fc78941d8169 ("usb: gadget: uvc: decrease the interrupt load to a quarter")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Dan Vacura <w36195@motorola.com>
+Link: https://lore.kernel.org/r/20221018215044.765044-2-w36195@motorola.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -431,7 +431,8 @@ static void uvcg_video_pump(struct work_
+
+ /* Endpoint now owns the request */
+ req = NULL;
+- video->req_int_count++;
++ if (buf->state != UVC_BUF_STATE_DONE)
++ video->req_int_count++;
+ }
+
+ if (!req)
--- /dev/null
+From b57b08e6f431348363adffa5b6643fe3ec9dc7fe Mon Sep 17 00:00:00 2001
+From: Jeff Vanhoof <qjv001@motorola.com>
+Date: Tue, 18 Oct 2022 16:50:40 -0500
+Subject: usb: gadget: uvc: fix sg handling during video encode
+
+From: Jeff Vanhoof <qjv001@motorola.com>
+
+commit b57b08e6f431348363adffa5b6643fe3ec9dc7fe upstream.
+
+In uvc_video_encode_isoc_sg, the uvc_request's sg list is
+incorrectly being populated leading to corrupt video being
+received by the remote end. When building the sg list the
+usage of buf->sg's 'dma_length' field is not correct and
+instead its 'length' field should be used.
+
+Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jeff Vanhoof <qjv001@motorola.com>
+Signed-off-by: Dan Vacura <w36195@motorola.com>
+Link: https://lore.kernel.org/r/20221018215044.765044-5-w36195@motorola.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -157,10 +157,10 @@ uvc_video_encode_isoc_sg(struct usb_requ
+ sg = sg_next(sg);
+
+ for_each_sg(sg, iter, ureq->sgt.nents - 1, i) {
+- if (!len || !buf->sg || !sg_dma_len(buf->sg))
++ if (!len || !buf->sg || !buf->sg->length)
+ break;
+
+- sg_left = sg_dma_len(buf->sg) - buf->offset;
++ sg_left = buf->sg->length - buf->offset;
+ part = min_t(unsigned int, len, sg_left);
+
+ sg_set_page(iter, sg_page(buf->sg), part, buf->offset);
--- /dev/null
+From 0a0a2760b04814428800d48281a447a7522470ad Mon Sep 17 00:00:00 2001
+From: Dan Vacura <w36195@motorola.com>
+Date: Tue, 18 Oct 2022 16:50:39 -0500
+Subject: usb: gadget: uvc: fix sg handling in error case
+
+From: Dan Vacura <w36195@motorola.com>
+
+commit 0a0a2760b04814428800d48281a447a7522470ad upstream.
+
+If there is a transmission error the buffer will be returned too early,
+causing a memory fault as subsequent requests for that buffer are still
+queued up to be sent. Refactor the error handling to wait for the final
+request to come in before reporting back the buffer to userspace for all
+transfer types (bulk/isoc/isoc_sg). This ensures userspace knows if the
+frame was successfully sent.
+
+Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Dan Vacura <w36195@motorola.com>
+Link: https://lore.kernel.org/r/20221018215044.765044-4-w36195@motorola.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_queue.c | 8 +++++---
+ drivers/usb/gadget/function/uvc_video.c | 18 ++++++++++++++----
+ 2 files changed, 19 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/gadget/function/uvc_queue.c
++++ b/drivers/usb/gadget/function/uvc_queue.c
+@@ -304,6 +304,7 @@ int uvcg_queue_enable(struct uvc_video_q
+
+ queue->sequence = 0;
+ queue->buf_used = 0;
++ queue->flags &= ~UVC_QUEUE_DROP_INCOMPLETE;
+ } else {
+ ret = vb2_streamoff(&queue->queue, queue->queue.type);
+ if (ret < 0)
+@@ -329,10 +330,11 @@ int uvcg_queue_enable(struct uvc_video_q
+ void uvcg_complete_buffer(struct uvc_video_queue *queue,
+ struct uvc_buffer *buf)
+ {
+- if ((queue->flags & UVC_QUEUE_DROP_INCOMPLETE) &&
+- buf->length != buf->bytesused) {
+- buf->state = UVC_BUF_STATE_QUEUED;
++ if (queue->flags & UVC_QUEUE_DROP_INCOMPLETE) {
++ queue->flags &= ~UVC_QUEUE_DROP_INCOMPLETE;
++ buf->state = UVC_BUF_STATE_ERROR;
+ vb2_set_plane_payload(&buf->buf.vb2_buf, 0, 0);
++ vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR);
+ return;
+ }
+
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -88,6 +88,7 @@ uvc_video_encode_bulk(struct usb_request
+ struct uvc_buffer *buf)
+ {
+ void *mem = req->buf;
++ struct uvc_request *ureq = req->context;
+ int len = video->req_size;
+ int ret;
+
+@@ -113,13 +114,14 @@ uvc_video_encode_bulk(struct usb_request
+ video->queue.buf_used = 0;
+ buf->state = UVC_BUF_STATE_DONE;
+ list_del(&buf->queue);
+- uvcg_complete_buffer(&video->queue, buf);
+ video->fid ^= UVC_STREAM_FID;
++ ureq->last_buf = buf;
+
+ video->payload_size = 0;
+ }
+
+ if (video->payload_size == video->max_payload_size ||
++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE ||
+ buf->bytesused == video->queue.buf_used)
+ video->payload_size = 0;
+ }
+@@ -180,7 +182,8 @@ uvc_video_encode_isoc_sg(struct usb_requ
+ req->length -= len;
+ video->queue.buf_used += req->length - header_len;
+
+- if (buf->bytesused == video->queue.buf_used || !buf->sg) {
++ if (buf->bytesused == video->queue.buf_used || !buf->sg ||
++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE) {
+ video->queue.buf_used = 0;
+ buf->state = UVC_BUF_STATE_DONE;
+ buf->offset = 0;
+@@ -195,6 +198,7 @@ uvc_video_encode_isoc(struct usb_request
+ struct uvc_buffer *buf)
+ {
+ void *mem = req->buf;
++ struct uvc_request *ureq = req->context;
+ int len = video->req_size;
+ int ret;
+
+@@ -209,12 +213,13 @@ uvc_video_encode_isoc(struct usb_request
+
+ req->length = video->req_size - len;
+
+- if (buf->bytesused == video->queue.buf_used) {
++ if (buf->bytesused == video->queue.buf_used ||
++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE) {
+ video->queue.buf_used = 0;
+ buf->state = UVC_BUF_STATE_DONE;
+ list_del(&buf->queue);
+- uvcg_complete_buffer(&video->queue, buf);
+ video->fid ^= UVC_STREAM_FID;
++ ureq->last_buf = buf;
+ }
+ }
+
+@@ -255,6 +260,11 @@ uvc_video_complete(struct usb_ep *ep, st
+ case 0:
+ break;
+
++ case -EXDEV:
++ uvcg_dbg(&video->uvc->func, "VS request missed xfer.\n");
++ queue->flags |= UVC_QUEUE_DROP_INCOMPLETE;
++ break;
++
+ case -ESHUTDOWN: /* disconnect from host. */
+ uvcg_dbg(&video->uvc->func, "VS request cancelled.\n");
+ uvcg_queue_cancel(queue, 1);
--- /dev/null
+From 19905240aef0181d1e6944070eb85fce75f75bcd Mon Sep 17 00:00:00 2001
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Date: Tue, 18 Oct 2022 00:11:41 +0200
+Subject: usb: gadget: uvc: limit isoc_sg to super speed gadgets
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+commit 19905240aef0181d1e6944070eb85fce75f75bcd upstream.
+
+The overhead of preparing sg data is high for transfers with limited
+payload. When transferring isoc over high-speed usb the maximum payload
+is rather small which is a good argument no to use sg. This patch is
+changing the uvc_video_encode_isoc_sg encode function only to be used
+for super speed gadgets.
+
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20221017221141.3134818-1-m.grzeschik@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_queue.c | 9 +++------
+ drivers/usb/gadget/function/uvc_video.c | 9 +++++++--
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/gadget/function/uvc_queue.c
++++ b/drivers/usb/gadget/function/uvc_queue.c
+@@ -84,12 +84,9 @@ static int uvc_buffer_prepare(struct vb2
+ return -ENODEV;
+
+ buf->state = UVC_BUF_STATE_QUEUED;
+- if (queue->use_sg) {
+- buf->sgt = vb2_dma_sg_plane_desc(vb, 0);
+- buf->sg = buf->sgt->sgl;
+- } else {
+- buf->mem = vb2_plane_vaddr(vb, 0);
+- }
++ buf->sgt = vb2_dma_sg_plane_desc(vb, 0);
++ buf->sg = buf->sgt->sgl;
++ buf->mem = vb2_plane_vaddr(vb, 0);
+ buf->length = vb2_plane_size(vb, 0);
+ if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+ buf->bytesused = 0;
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -448,6 +448,9 @@ static void uvcg_video_pump(struct work_
+ */
+ int uvcg_video_enable(struct uvc_video *video, int enable)
+ {
++ struct uvc_device *uvc = video->uvc;
++ struct usb_composite_dev *cdev = uvc->func.config->cdev;
++ struct usb_gadget *gadget = cdev->gadget;
+ unsigned int i;
+ int ret;
+
+@@ -479,9 +482,11 @@ int uvcg_video_enable(struct uvc_video *
+ if (video->max_payload_size) {
+ video->encode = uvc_video_encode_bulk;
+ video->payload_size = 0;
+- } else
+- video->encode = video->queue.use_sg ?
++ } else {
++ video->encode = (video->queue.use_sg &&
++ !(gadget->speed <= USB_SPEED_HIGH)) ?
+ uvc_video_encode_isoc_sg : uvc_video_encode_isoc;
++ }
+
+ video->req_int_count = 0;
+
--- /dev/null
+From 4e3a50293c2b21961f02e1afa2f17d3a1a90c7c8 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Fri, 7 Oct 2022 13:09:51 +0300
+Subject: usb: typec: ucsi: acpi: Implement resume callback
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 4e3a50293c2b21961f02e1afa2f17d3a1a90c7c8 upstream.
+
+The ACPI driver needs to resume the interface by calling
+ucsi_resume(). Otherwise we may fail to detect connections
+and disconnections that happen while the system is
+suspended.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=210425
+Fixes: a94ecde41f7e ("usb: typec: ucsi: ccg: enable runtime pm support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20221007100951.43798-3-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi_acpi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
+@@ -185,6 +185,15 @@ static int ucsi_acpi_remove(struct platf
+ return 0;
+ }
+
++static int ucsi_acpi_resume(struct device *dev)
++{
++ struct ucsi_acpi *ua = dev_get_drvdata(dev);
++
++ return ucsi_resume(ua->ucsi);
++}
++
++static DEFINE_SIMPLE_DEV_PM_OPS(ucsi_acpi_pm_ops, NULL, ucsi_acpi_resume);
++
+ static const struct acpi_device_id ucsi_acpi_match[] = {
+ { "PNP0CA0", 0 },
+ { },
+@@ -194,6 +203,7 @@ MODULE_DEVICE_TABLE(acpi, ucsi_acpi_matc
+ static struct platform_driver ucsi_acpi_platform_driver = {
+ .driver = {
+ .name = "ucsi_acpi",
++ .pm = pm_ptr(&ucsi_acpi_pm_ops),
+ .acpi_match_table = ACPI_PTR(ucsi_acpi_match),
+ },
+ .probe = ucsi_acpi_probe,
--- /dev/null
+From 99f6d43611135bd6f211dec9e88bb41e4167e304 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Fri, 7 Oct 2022 13:09:50 +0300
+Subject: usb: typec: ucsi: Check the connection on resume
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 99f6d43611135bd6f211dec9e88bb41e4167e304 upstream.
+
+Checking the connection status of every port on resume. This
+fixes an issue where the partner device is not unregistered
+properly after resume if it was unplugged while the system
+was suspended.
+
+The function ucsi_check_connection() is also modified so
+that it can be used also for registering the connection on
+top of unregistering it.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=210425
+Fixes: a94ecde41f7e ("usb: typec: ucsi: ccg: enable runtime pm support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20221007100951.43798-2-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 42 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -183,16 +183,6 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(ucsi_send_command);
+
+-int ucsi_resume(struct ucsi *ucsi)
+-{
+- u64 command;
+-
+- /* Restore UCSI notification enable mask after system resume */
+- command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy;
+-
+- return ucsi_send_command(ucsi, command, NULL, 0);
+-}
+-EXPORT_SYMBOL_GPL(ucsi_resume);
+ /* -------------------------------------------------------------------------- */
+
+ struct ucsi_work {
+@@ -744,6 +734,7 @@ static void ucsi_partner_change(struct u
+
+ static int ucsi_check_connection(struct ucsi_connector *con)
+ {
++ u8 prev_flags = con->status.flags;
+ u64 command;
+ int ret;
+
+@@ -754,10 +745,13 @@ static int ucsi_check_connection(struct
+ return ret;
+ }
+
++ if (con->status.flags == prev_flags)
++ return 0;
++
+ if (con->status.flags & UCSI_CONSTAT_CONNECTED) {
+- if (UCSI_CONSTAT_PWR_OPMODE(con->status.flags) ==
+- UCSI_CONSTAT_PWR_OPMODE_PD)
+- ucsi_partner_task(con, ucsi_check_altmodes, 30, 0);
++ ucsi_register_partner(con);
++ ucsi_pwr_opmode_change(con);
++ ucsi_partner_change(con);
+ } else {
+ ucsi_partner_change(con);
+ ucsi_port_psy_changed(con);
+@@ -1276,6 +1270,28 @@ err:
+ return ret;
+ }
+
++int ucsi_resume(struct ucsi *ucsi)
++{
++ struct ucsi_connector *con;
++ u64 command;
++ int ret;
++
++ /* Restore UCSI notification enable mask after system resume */
++ command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy;
++ ret = ucsi_send_command(ucsi, command, NULL, 0);
++ if (ret < 0)
++ return ret;
++
++ for (con = ucsi->connector; con->port; con++) {
++ mutex_lock(&con->lock);
++ ucsi_check_connection(con);
++ mutex_unlock(&con->lock);
++ }
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(ucsi_resume);
++
+ static void ucsi_init_work(struct work_struct *work)
+ {
+ struct ucsi *ucsi = container_of(work, struct ucsi, work.work);
--- /dev/null
+From 4f547472380136718b56064ea5689a61e135f904 Mon Sep 17 00:00:00 2001
+From: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
+Date: Mon, 24 Oct 2022 17:27:17 +0300
+Subject: usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
+
+From: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
+
+commit 4f547472380136718b56064ea5689a61e135f904 upstream.
+
+This appears to fix the error:
+"xhci_hcd <address>; ERROR Transfer event TRB DMA ptr not part of
+current TD ep_index 2 comp_code 13" that appear spuriously (or pretty
+often) when using a r8152 USB3 ethernet adapter with integrated hub.
+
+ASM1042 reports as a 0.96 controller, but appears to behave more like 1.0
+
+Inspired by this email thread: https://markmail.org/thread/7vzqbe7t6du6qsw3
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20221024142720.4122053-2-mathias.nyman@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-pci.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -306,8 +306,14 @@ static void xhci_pci_quirks(struct devic
+ }
+
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) {
++ /*
++ * try to tame the ASMedia 1042 controller which reports 0.96
++ * but appears to behave more like 1.0
++ */
++ xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ xhci->quirks |= XHCI_BROKEN_STREAMS;
++ }
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) {
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
projects / thirdparty / kernel / stable-queue.git / commitdiff
