--- /dev/null
+From 0d4867a185460397af56b9afe3e2243d3e610e37 Mon Sep 17 00:00:00 2001
+From: Alexander Monakov <amonakov@ispras.ru>
+Date: Wed, 21 Jul 2021 20:01:41 +0300
+Subject: ALSA: hda/realtek: add mic quirk for Acer SF314-42
+
+From: Alexander Monakov <amonakov@ispras.ru>
+
+commit 0d4867a185460397af56b9afe3e2243d3e610e37 upstream.
+
+The Acer Swift SF314-42 laptop is using Realtek ALC255 codec. Add a
+quirk so microphone in a headset connected via the right-hand side jack
+is usable.
+
+Signed-off-by: Alexander Monakov <amonakov@ispras.ru>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210721170141.24807-1-amonakov@ispras.ru
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8217,6 +8217,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
--- /dev/null
+From 35171fbfc0d94aa31b009bb475d156ad1941ab50 Mon Sep 17 00:00:00 2001
+From: Nikos Liolios <liolios.nk@gmail.com>
+Date: Tue, 27 Jul 2021 06:05:10 +0300
+Subject: ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256)
+
+From: Nikos Liolios <liolios.nk@gmail.com>
+
+commit 35171fbfc0d94aa31b009bb475d156ad1941ab50 upstream.
+
+The issue on Acer SWIFT SF314-56 is that headset microphone doesn't work.
+The following quirk fixed headset microphone issue. The fixup was found by trial and error.
+Note that the fixup of SF314-54/55 (ALC256_FIXUP_ACER_HEADSET_MIC) was not successful on my SF314-56.
+
+Signed-off-by: Nikos Liolios <liolios.nk@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210727030510.36292-1-liolios.nk@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8214,6 +8214,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x129c, "Acer SWIFT SF314-55", ALC256_FIXUP_ACER_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x1300, "Acer SWIFT SF314-56", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
--- /dev/null
+From 852a8a97776a153be2e6c803218eced45f37a19c Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Fri, 30 Jul 2021 11:02:54 +0200
+Subject: ALSA: pcm - fix mmap capability check for the snd-dummy driver
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 852a8a97776a153be2e6c803218eced45f37a19c upstream.
+
+The snd-dummy driver (fake_buffer configuration) uses the ops->page
+callback for the mmap operations. Allow mmap for this case, too.
+
+Cc: <stable@vger.kernel.org>
+Fixes: c4824ae7db41 ("ALSA: pcm: Fix mmap capability check")
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20210730090254.612478-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/pcm_native.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -246,7 +246,7 @@ static bool hw_support_mmap(struct snd_p
+ if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_MMAP))
+ return false;
+
+- if (substream->ops->mmap)
++ if (substream->ops->mmap || substream->ops->page)
+ return true;
+
+ switch (substream->dma_buffer.dev.type) {
--- /dev/null
+From 4b0556b96e1fe7723629bd40e3813a30cd632faf Mon Sep 17 00:00:00 2001
+From: Alexander Tsoy <alexander@tsoy.me>
+Date: Tue, 27 Jul 2021 12:33:26 +0300
+Subject: ALSA: usb-audio: Add registration quirk for JBL Quantum 600
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+commit 4b0556b96e1fe7723629bd40e3813a30cd632faf upstream.
+
+Apparently JBL Quantum 600 has multiple hardware revisions. Apply
+registration quirk to another device id as well.
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210727093326.1153366-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1899,6 +1899,7 @@ static const struct registration_quirk r
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
+ { 0 } /* terminator */
+ };
--- /dev/null
+From 8dde723fcde4479f256441da03793e37181d9f21 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 29 Jul 2021 20:51:26 +0200
+Subject: ALSA: usb-audio: Avoid unnecessary or invalid connector selection at resume
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8dde723fcde4479f256441da03793e37181d9f21 upstream.
+
+The recent fix for the resume on Lenovo machines seems causing a
+regression on others. It's because the change always triggers the
+connector selection no matter which widget node type is.
+
+This patch addresses the regression by setting the resume callback
+selectively only for the connector widget.
+
+Fixes: 44609fc01f28 ("ALSA: usb-audio: Check connector value on resume")
+Cc: <stable@vger.kernel.org>
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213897
+Link: https://lore.kernel.org/r/20210729185126.24432-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer.c | 35 ++++++++++++++++++++---------------
+ 1 file changed, 20 insertions(+), 15 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1816,6 +1816,15 @@ static void get_connector_control_name(s
+ strlcat(name, " - Output Jack", name_size);
+ }
+
++/* get connector value to "wake up" the USB audio */
++static int connector_mixer_resume(struct usb_mixer_elem_list *list)
++{
++ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
++
++ get_connector_value(cval, NULL, NULL);
++ return 0;
++}
++
+ /* Build a mixer control for a UAC connector control (jack-detect) */
+ static void build_connector_control(struct usb_mixer_interface *mixer,
+ const struct usbmix_name_map *imap,
+@@ -1833,6 +1842,10 @@ static void build_connector_control(stru
+ if (!cval)
+ return;
+ snd_usb_mixer_elem_init_std(&cval->head, mixer, term->id);
++
++ /* set up a specific resume callback */
++ cval->head.resume = connector_mixer_resume;
++
+ /*
+ * UAC2: The first byte from reading the UAC2_TE_CONNECTOR control returns the
+ * number of channels connected.
+@@ -3642,23 +3655,15 @@ static int restore_mixer_value(struct us
+ return 0;
+ }
+
+-static int default_mixer_resume(struct usb_mixer_elem_list *list)
+-{
+- struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
+-
+- /* get connector value to "wake up" the USB audio */
+- if (cval->val_type == USB_MIXER_BOOLEAN && cval->channels == 1)
+- get_connector_value(cval, NULL, NULL);
+-
+- return 0;
+-}
+-
+ static int default_mixer_reset_resume(struct usb_mixer_elem_list *list)
+ {
+- int err = default_mixer_resume(list);
++ int err;
+
+- if (err < 0)
+- return err;
++ if (list->resume) {
++ err = list->resume(list);
++ if (err < 0)
++ return err;
++ }
+ return restore_mixer_value(list);
+ }
+
+@@ -3697,7 +3702,7 @@ void snd_usb_mixer_elem_init_std(struct
+ list->id = unitid;
+ list->dump = snd_usb_mixer_dump_cval;
+ #ifdef CONFIG_PM
+- list->resume = default_mixer_resume;
++ list->resume = NULL;
+ list->reset_resume = default_mixer_reset_resume;
+ #endif
+ }
--- /dev/null
+From 66291b6adb66dd3bc96b0f594d88c2ff1300d95f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 26 Jul 2021 08:26:56 +0200
+Subject: ALSA: usb-audio: Fix superfluous autosuspend recovery
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 66291b6adb66dd3bc96b0f594d88c2ff1300d95f upstream.
+
+The change to restore the autosuspend from the disabled state uses a
+wrong check: namely, it should have been the exact comparison of the
+quirk_type instead of the bitwise and (&). Otherwise it matches
+wrongly with the other quirk types.
+
+Although re-enabling the autosuspend for the already enabled device
+shouldn't matter much, it's better to fix the unbalanced call.
+
+Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/s5hr1flh9ov.wl-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -907,7 +907,7 @@ static void usb_audio_disconnect(struct
+ }
+ }
+
+- if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND)
++ if (chip->quirk_type == QUIRK_SETUP_DISABLE_AUTOSUSPEND)
+ usb_enable_autosuspend(interface_to_usbdev(intf));
+
+ chip->num_interfaces--;
firmware_loader-fix-use-after-free-in-firmware_fallback_sysfs.patch
drm-amdgpu-fix-checking-pmops-when-pm_sleep-is-not-enabled.patch
drm-amdgpu-display-fix-dmub-firmware-version-info.patch
+alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch
+alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch
+alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch
+alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch
+alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch
+alsa-usb-audio-avoid-unnecessary-or-invalid-connector-selection-at-resume.patch
+usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch
+usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch
+usb-gadget-remove-leaked-entry-from-udc-driver-list.patch
+usb-cdns3-fixed-incorrect-gadget-state.patch
+usb-cdnsp-fixed-issue-with-zlp.patch
+usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch
+usb-gadget-f_hid-fixed-null-pointer-dereference.patch
+usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch
+usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch
+usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch
+usb-otg-fsm-fix-hrtimer-list-corruption.patch
--- /dev/null
+From aa35772f61752d4c636d46be51a4f7ca6c029ee6 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Wed, 23 Jun 2021 09:02:47 +0200
+Subject: usb: cdns3: Fixed incorrect gadget state
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit aa35772f61752d4c636d46be51a4f7ca6c029ee6 upstream.
+
+For delayed status phase, the usb_gadget->state was set
+to USB_STATE_ADDRESS and it has never been updated to
+USB_STATE_CONFIGURED.
+Patch updates the gadget state to correct USB_STATE_CONFIGURED.
+As a result of this bug the controller was not able to enter to
+Test Mode while using MSC function.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Link: https://lore.kernel.org/r/20210623070247.46151-1-pawell@gli-login.cadence.com
+Signed-off-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdns3-ep0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/cdns3/cdns3-ep0.c
++++ b/drivers/usb/cdns3/cdns3-ep0.c
+@@ -731,6 +731,7 @@ static int cdns3_gadget_ep0_queue(struct
+ request->actual = 0;
+ priv_dev->status_completion_no_call = true;
+ priv_dev->pending_status_request = request;
++ usb_gadget_set_state(&priv_dev->gadget, USB_STATE_CONFIGURED);
+ spin_unlock_irqrestore(&priv_dev->lock, flags);
+
+ /*
--- /dev/null
+From e913aada06830338633fb8524733b0ad3d38a7c1 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Wed, 23 Jun 2021 09:27:28 +0200
+Subject: usb: cdnsp: Fixed issue with ZLP
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit e913aada06830338633fb8524733b0ad3d38a7c1 upstream.
+
+The condition "if (need_zero_pkt && zero_len_trb)" was always false
+and it caused that TRB for ZLP was not prepared.
+
+Fix causes that after preparing last TRB in TD, the driver prepares
+additional TD with ZLP when a ZLP is required.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Link: https://lore.kernel.org/r/20210623072728.41275-1-pawell@gli-login.cadence.com
+Signed-off-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdnsp-ring.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/cdns3/cdnsp-ring.c
++++ b/drivers/usb/cdns3/cdnsp-ring.c
+@@ -1932,15 +1932,13 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev
+ }
+
+ if (enqd_len + trb_buff_len >= full_len) {
+- if (need_zero_pkt && zero_len_trb) {
+- zero_len_trb = true;
+- } else {
+- field &= ~TRB_CHAIN;
+- field |= TRB_IOC;
+- more_trbs_coming = false;
+- need_zero_pkt = false;
+- preq->td.last_trb = ring->enqueue;
+- }
++ if (need_zero_pkt)
++ zero_len_trb = !zero_len_trb;
++
++ field &= ~TRB_CHAIN;
++ field |= TRB_IOC;
++ more_trbs_coming = false;
++ preq->td.last_trb = ring->enqueue;
+ }
+
+ /* Only set interrupt on short packet for OUT endpoints. */
+@@ -1955,7 +1953,7 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev
+ length_field = TRB_LEN(trb_buff_len) | TRB_TD_SIZE(remainder) |
+ TRB_INTR_TARGET(0);
+
+- cdnsp_queue_trb(pdev, ring, more_trbs_coming | need_zero_pkt,
++ cdnsp_queue_trb(pdev, ring, more_trbs_coming | zero_len_trb,
+ lower_32_bits(send_addr),
+ upper_32_bits(send_addr),
+ length_field,
--- /dev/null
+From cb10f68ad8150f243964b19391711aaac5e8ff42 Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <wcheng@codeaurora.org>
+Date: Tue, 3 Aug 2021 23:24:05 -0700
+Subject: usb: dwc3: gadget: Avoid runtime resume if disabling pullup
+
+From: Wesley Cheng <wcheng@codeaurora.org>
+
+commit cb10f68ad8150f243964b19391711aaac5e8ff42 upstream.
+
+If the device is already in the runtime suspended state, any call to
+the pullup routine will issue a runtime resume on the DWC3 core
+device. If the USB gadget is disabling the pullup, then avoid having
+to issue a runtime resume, as DWC3 gadget has already been
+halted/stopped.
+
+This fixes an issue where the following condition occurs:
+
+usb_gadget_remove_driver()
+-->usb_gadget_disconnect()
+ -->dwc3_gadget_pullup(0)
+ -->pm_runtime_get_sync() -> ret = 0
+ -->pm_runtime_put() [async]
+-->usb_gadget_udc_stop()
+ -->dwc3_gadget_stop()
+ -->dwc->gadget_driver = NULL
+...
+
+dwc3_suspend_common()
+-->dwc3_gadget_suspend()
+ -->DWC3 halt/stop routine skipped, driver_data == NULL
+
+This leads to a situation where the DWC3 gadget is not properly
+stopped, as the runtime resume would have re-enabled EP0 and event
+interrupts, and since we avoided the DWC3 gadget suspend, these
+resources were never disabled.
+
+Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
+Link: https://lore.kernel.org/r/1628058245-30692-1-git-send-email-wcheng@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2257,6 +2257,17 @@ static int dwc3_gadget_pullup(struct usb
+ }
+
+ /*
++ * Avoid issuing a runtime resume if the device is already in the
++ * suspended state during gadget disconnect. DWC3 gadget was already
++ * halted/stopped during runtime suspend.
++ */
++ if (!is_on) {
++ pm_runtime_barrier(dwc->dev);
++ if (pm_runtime_suspended(dwc->dev))
++ return 0;
++ }
++
++ /*
+ * Check the return value for successful resume, or error. For a
+ * successful resume, the DWC3 runtime PM resume routine will handle
+ * the run stop sequence, so avoid duplicate operations here.
--- /dev/null
+From d25d85061bd856d6be221626605319154f9b5043 Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <wcheng@codeaurora.org>
+Date: Thu, 29 Jul 2021 00:33:14 -0700
+Subject: usb: dwc3: gadget: Use list_replace_init() before traversing lists
+
+From: Wesley Cheng <wcheng@codeaurora.org>
+
+commit d25d85061bd856d6be221626605319154f9b5043 upstream.
+
+The list_for_each_entry_safe() macro saves the current item (n) and
+the item after (n+1), so that n can be safely removed without
+corrupting the list. However, when traversing the list and removing
+items using gadget giveback, the DWC3 lock is briefly released,
+allowing other routines to execute. There is a situation where, while
+items are being removed from the cancelled_list using
+dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable
+routine is running in parallel (due to UDC unbind). As the cleanup
+routine removes n, and the pullup disable removes n+1, once the
+cleanup retakes the DWC3 lock, it references a request who was already
+removed/handled. With list debug enabled, this leads to a panic.
+Ensure all instances of the macro are replaced where gadget giveback
+is used.
+
+Example call stack:
+
+Thread#1:
+__dwc3_gadget_ep_set_halt() - CLEAR HALT
+ -> dwc3_gadget_ep_cleanup_cancelled_requests()
+ ->list_for_each_entry_safe()
+ ->dwc3_gadget_giveback(n)
+ ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list]
+ ->spin_unlock
+ ->Thread#2 executes
+ ...
+ ->dwc3_gadget_giveback(n+1)
+ ->Already removed!
+
+Thread#2:
+dwc3_gadget_pullup()
+ ->waiting for dwc3 spin_lock
+ ...
+ ->Thread#1 released lock
+ ->dwc3_stop_active_transfers()
+ ->dwc3_remove_requests()
+ ->fetches n+1 item from cancelled_list (n removed by Thread#1)
+ ->dwc3_gadget_giveback()
+ ->dwc3_gadget_del_and_unmap_request()- n+1
+deleted[cancelled_list]
+ ->spin_unlock
+
+Fix this condition by utilizing list_replace_init(), and traversing
+through a local copy of the current elements in the endpoint lists.
+This will also set the parent list as empty, so if another thread is
+also looping through the list, it will be empty on the next iteration.
+
+Fixes: d4f1afe5e896 ("usb: dwc3: gadget: move requests to cancelled_list")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
+Link: https://lore.kernel.org/r/1627543994-20327-1-git-send-email-wcheng@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1741,9 +1741,13 @@ static void dwc3_gadget_ep_cleanup_cance
+ {
+ struct dwc3_request *req;
+ struct dwc3_request *tmp;
++ struct list_head local;
+ struct dwc3 *dwc = dep->dwc;
+
+- list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) {
++restart:
++ list_replace_init(&dep->cancelled_list, &local);
++
++ list_for_each_entry_safe(req, tmp, &local, list) {
+ dwc3_gadget_ep_skip_trbs(dep, req);
+ switch (req->status) {
+ case DWC3_REQUEST_STATUS_DISCONNECTED:
+@@ -1761,6 +1765,9 @@ static void dwc3_gadget_ep_cleanup_cance
+ break;
+ }
+ }
++
++ if (!list_empty(&dep->cancelled_list))
++ goto restart;
+ }
+
+ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+@@ -2945,8 +2952,12 @@ static void dwc3_gadget_ep_cleanup_compl
+ {
+ struct dwc3_request *req;
+ struct dwc3_request *tmp;
++ struct list_head local;
+
+- list_for_each_entry_safe(req, tmp, &dep->started_list, list) {
++restart:
++ list_replace_init(&dep->started_list, &local);
++
++ list_for_each_entry_safe(req, tmp, &local, list) {
+ int ret;
+
+ ret = dwc3_gadget_ep_cleanup_completed_request(dep, event,
+@@ -2954,6 +2965,9 @@ static void dwc3_gadget_ep_cleanup_compl
+ if (ret)
+ break;
+ }
++
++ if (!list_empty(&dep->started_list))
++ goto restart;
+ }
+
+ static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep)
--- /dev/null
+From afcff6dc690e24d636a41fd4bee6057e7c70eebd Mon Sep 17 00:00:00 2001
+From: Maxim Devaev <mdevaev@gmail.com>
+Date: Wed, 21 Jul 2021 21:03:51 +0300
+Subject: usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
+
+From: Maxim Devaev <mdevaev@gmail.com>
+
+commit afcff6dc690e24d636a41fd4bee6057e7c70eebd upstream.
+
+The USB HID standard declares mandatory support for GET_IDLE and SET_IDLE
+requests for Boot Keyboard. Most hosts can handle their absence, but others
+like some old/strange UEFIs and BIOSes consider this a critical error
+and refuse to work with f_hid.
+
+This primitive implementation of saving and returning idle is sufficient
+to meet the requirements of the standard and these devices.
+
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+Link: https://lore.kernel.org/r/20210721180351.129450-1-mdevaev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -41,6 +41,7 @@ struct f_hidg {
+ unsigned char bInterfaceSubClass;
+ unsigned char bInterfaceProtocol;
+ unsigned char protocol;
++ unsigned char idle;
+ unsigned short report_desc_length;
+ char *report_desc;
+ unsigned short report_length;
+@@ -523,6 +524,14 @@ static int hidg_setup(struct usb_functio
+ goto respond;
+ break;
+
++ case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
++ | HID_REQ_GET_IDLE):
++ VDBG(cdev, "get_idle\n");
++ length = min_t(unsigned int, length, 1);
++ ((u8 *) req->buf)[0] = hidg->idle;
++ goto respond;
++ break;
++
+ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
+ | HID_REQ_SET_REPORT):
+ VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength);
+@@ -546,6 +555,14 @@ static int hidg_setup(struct usb_functio
+ goto stall;
+ break;
+
++ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
++ | HID_REQ_SET_IDLE):
++ VDBG(cdev, "set_idle\n");
++ length = 0;
++ hidg->idle = value;
++ goto respond;
++ break;
++
+ case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8
+ | USB_REQ_GET_DESCRIPTOR):
+ switch (value >> 8) {
+@@ -773,6 +790,7 @@ static int hidg_bind(struct usb_configur
+ hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass;
+ hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol;
+ hidg->protocol = HID_REPORT_PROTOCOL;
++ hidg->idle = 1;
+ hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
+ hidg_ss_in_comp_desc.wBytesPerInterval =
+ cpu_to_le16(hidg->report_length);
--- /dev/null
+From 2867652e4766360adf14dfda3832455e04964f2a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 23 Jul 2021 18:59:30 +0300
+Subject: usb: gadget: f_hid: fixed NULL pointer dereference
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+commit 2867652e4766360adf14dfda3832455e04964f2a upstream.
+
+Disconnecting and reconnecting the USB cable can lead to crashes
+and a variety of kernel log spam.
+
+The problem was found and reproduced on the Raspberry Pi [1]
+and the original fix was created in Raspberry's own fork [2].
+
+Link: https://github.com/raspberrypi/linux/issues/3870 [1]
+Link: https://github.com/raspberrypi/linux/commit/a6e47d5f4efbd2ea6a0b6565cd2f9b7bb217ded5 [2]
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210723155928.210019-1-mdevaev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -339,6 +339,11 @@ static ssize_t f_hidg_write(struct file
+
+ spin_lock_irqsave(&hidg->write_spinlock, flags);
+
++ if (!hidg->req) {
++ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
++ return -ESHUTDOWN;
++ }
++
+ #define WRITE_COND (!hidg->write_pending)
+ try_again:
+ /* write queue */
+@@ -359,8 +364,14 @@ try_again:
+ count = min_t(unsigned, count, hidg->report_length);
+
+ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+- status = copy_from_user(req->buf, buffer, count);
+
++ if (!req) {
++ ERROR(hidg->func.config->cdev, "hidg->req is NULL\n");
++ status = -ESHUTDOWN;
++ goto release_write_pending;
++ }
++
++ status = copy_from_user(req->buf, buffer, count);
+ if (status != 0) {
+ ERROR(hidg->func.config->cdev,
+ "copy_from_user error\n");
+@@ -388,14 +399,17 @@ try_again:
+
+ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+
++ if (!hidg->in_ep->enabled) {
++ ERROR(hidg->func.config->cdev, "in_ep is disabled\n");
++ status = -ESHUTDOWN;
++ goto release_write_pending;
++ }
++
+ status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
+- if (status < 0) {
+- ERROR(hidg->func.config->cdev,
+- "usb_ep_queue error on int endpoint %zd\n", status);
++ if (status < 0)
+ goto release_write_pending;
+- } else {
++ else
+ status = count;
+- }
+
+ return status;
+ release_write_pending:
--- /dev/null
+From fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 Mon Sep 17 00:00:00 2001
+From: Maxim Devaev <mdevaev@gmail.com>
+Date: Tue, 27 Jul 2021 21:58:00 +0300
+Subject: usb: gadget: f_hid: idle uses the highest byte for duration
+
+From: Maxim Devaev <mdevaev@gmail.com>
+
+commit fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 upstream.
+
+SET_IDLE value must be shifted 8 bits to the right to get duration.
+This confirmed by USBCV test.
+
+Fixes: afcff6dc690e ("usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+Link: https://lore.kernel.org/r/20210727185800.43796-1-mdevaev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -573,7 +573,7 @@ static int hidg_setup(struct usb_functio
+ | HID_REQ_SET_IDLE):
+ VDBG(cdev, "set_idle\n");
+ length = 0;
+- hidg->idle = value;
++ hidg->idle = value >> 8;
+ goto respond;
+ break;
+
--- /dev/null
+From fa4a8dcfd51b911f101ebc461dfe22230b74dd64 Mon Sep 17 00:00:00 2001
+From: Zhang Qilong <zhangqilong3@huawei.com>
+Date: Tue, 27 Jul 2021 15:31:42 +0800
+Subject: usb: gadget: remove leaked entry from udc driver list
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+commit fa4a8dcfd51b911f101ebc461dfe22230b74dd64 upstream.
+
+The usb_add_gadget_udc will add a new gadget to the udc class
+driver list. Not calling usb_del_gadget_udc in error branch
+will result in residual gadget entry in the udc driver list.
+We fix it by calling usb_del_gadget_udc to clean it when error
+return.
+
+Fixes: 48ba02b2e2b1 ("usb: gadget: add udc driver for max3420")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20210727073142.84666-1-zhangqilong3@huawei.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/max3420_udc.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/udc/max3420_udc.c
++++ b/drivers/usb/gadget/udc/max3420_udc.c
+@@ -1260,12 +1260,14 @@ static int max3420_probe(struct spi_devi
+ err = devm_request_irq(&spi->dev, irq, max3420_irq_handler, 0,
+ "max3420", udc);
+ if (err < 0)
+- return err;
++ goto del_gadget;
+
+ udc->thread_task = kthread_create(max3420_thread, udc,
+ "max3420-thread");
+- if (IS_ERR(udc->thread_task))
+- return PTR_ERR(udc->thread_task);
++ if (IS_ERR(udc->thread_task)) {
++ err = PTR_ERR(udc->thread_task);
++ goto del_gadget;
++ }
+
+ irq = of_irq_get_byname(spi->dev.of_node, "vbus");
+ if (irq <= 0) { /* no vbus irq implies self-powered design */
+@@ -1285,10 +1287,14 @@ static int max3420_probe(struct spi_devi
+ err = devm_request_irq(&spi->dev, irq,
+ max3420_vbus_handler, 0, "vbus", udc);
+ if (err < 0)
+- return err;
++ goto del_gadget;
+ }
+
+ return 0;
++
++del_gadget:
++ usb_del_gadget_udc(&udc->gadget);
++ return err;
+ }
+
+ static int max3420_remove(struct spi_device *spi)
--- /dev/null
+From 00de6a572f30ee93cad7e0704ec4232e5e72bda8 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Wed, 21 Jul 2021 16:29:05 +0300
+Subject: usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+commit 00de6a572f30ee93cad7e0704ec4232e5e72bda8 upstream.
+
+On SAMA7G5 suspending ports will cut the access to OHCI registers and
+any subsequent access to them will lead to CPU being blocked trying to
+access that memory. Same thing happens on resume: if OHCI memory is
+accessed before resuming ports the CPU will block on that access. The
+OCHI memory is accessed on suspend/resume though
+ohci_suspend()/ohci_resume().
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210721132905.1970713-1-claudiu.beznea@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ohci-at91.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -611,8 +611,6 @@ ohci_hcd_at91_drv_suspend(struct device
+ if (ohci_at91->wakeup)
+ enable_irq_wake(hcd->irq);
+
+- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1);
+-
+ ret = ohci_suspend(hcd, ohci_at91->wakeup);
+ if (ret) {
+ if (ohci_at91->wakeup)
+@@ -632,7 +630,10 @@ ohci_hcd_at91_drv_suspend(struct device
+ /* flush the writes */
+ (void) ohci_readl (ohci, &ohci->regs->control);
+ msleep(1);
++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1);
+ at91_stop_clock(ohci_at91);
++ } else {
++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1);
+ }
+
+ return ret;
+@@ -644,6 +645,8 @@ ohci_hcd_at91_drv_resume(struct device *
+ struct usb_hcd *hcd = dev_get_drvdata(dev);
+ struct ohci_at91_priv *ohci_at91 = hcd_to_ohci_at91_priv(hcd);
+
++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0);
++
+ if (ohci_at91->wakeup)
+ disable_irq_wake(hcd->irq);
+ else
+@@ -651,8 +654,6 @@ ohci_hcd_at91_drv_resume(struct device *
+
+ ohci_resume(hcd, false);
+
+- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0);
+-
+ return 0;
+ }
+
--- /dev/null
+From bf88fef0b6f1488abeca594d377991171c00e52a Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Sat, 17 Jul 2021 21:21:27 +0300
+Subject: usb: otg-fsm: Fix hrtimer list corruption
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit bf88fef0b6f1488abeca594d377991171c00e52a upstream.
+
+The HNP work can be re-scheduled while it's still in-fly. This results in
+re-initialization of the busy work, resetting the hrtimer's list node of
+the work and crashing kernel with null dereference within kernel/timer
+once work's timer is expired. It's very easy to trigger this problem by
+re-plugging USB cable quickly. Initialize HNP work only once to fix this
+trouble.
+
+ Unable to handle kernel NULL pointer dereference at virtual address 00000126)
+ ...
+ PC is at __run_timers.part.0+0x150/0x228
+ LR is at __next_timer_interrupt+0x51/0x9c
+ ...
+ (__run_timers.part.0) from [<c0187a2b>] (run_timer_softirq+0x2f/0x50)
+ (run_timer_softirq) from [<c01013ad>] (__do_softirq+0xd5/0x2f0)
+ (__do_softirq) from [<c012589b>] (irq_exit+0xab/0xb8)
+ (irq_exit) from [<c0170341>] (handle_domain_irq+0x45/0x60)
+ (handle_domain_irq) from [<c04c4a43>] (gic_handle_irq+0x6b/0x7c)
+ (gic_handle_irq) from [<c0100b65>] (__irq_svc+0x65/0xac)
+
+Cc: stable@vger.kernel.org
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/common/usb-otg-fsm.c | 6 +++++-
+ include/linux/usb/otg-fsm.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -193,7 +193,11 @@ static void otg_start_hnp_polling(struct
+ if (!fsm->host_req_flag)
+ return;
+
+- INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work);
++ if (!fsm->hnp_work_inited) {
++ INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work);
++ fsm->hnp_work_inited = true;
++ }
++
+ schedule_delayed_work(&fsm->hnp_polling_work,
+ msecs_to_jiffies(T_HOST_REQ_POLL));
+ }
+--- a/include/linux/usb/otg-fsm.h
++++ b/include/linux/usb/otg-fsm.h
+@@ -196,6 +196,7 @@ struct otg_fsm {
+ struct mutex lock;
+ u8 *host_req_flag;
+ struct delayed_work hnp_polling_work;
++ bool hnp_work_inited;
+ bool state_changed;
+ };
+
--- /dev/null
+From 43ad944cd73f2360ec8ff31d29ea44830b3119af Mon Sep 17 00:00:00 2001
+From: Kyle Tso <kyletso@google.com>
+Date: Tue, 3 Aug 2021 17:13:14 +0800
+Subject: usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events
+
+From: Kyle Tso <kyletso@google.com>
+
+commit 43ad944cd73f2360ec8ff31d29ea44830b3119af upstream.
+
+When receiving FRS and Sourcing_Vbus events from low-level drivers, keep
+other events which come a bit earlier so that they will not be ignored
+in the event handler.
+
+Fixes: 8dc4bd073663 ("usb: typec: tcpm: Add support for Sink Fast Role SWAP(FRS)")
+Cc: stable <stable@vger.kernel.org>
+Cc: Badhri Jagan Sridharan <badhri@google.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
+Signed-off-by: Kyle Tso <kyletso@google.com>
+Link: https://lore.kernel.org/r/20210803091314.3051302-1-kyletso@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -5355,7 +5355,7 @@ EXPORT_SYMBOL_GPL(tcpm_pd_hard_reset);
+ void tcpm_sink_frs(struct tcpm_port *port)
+ {
+ spin_lock(&port->pd_event_lock);
+- port->pd_events = TCPM_FRS_EVENT;
++ port->pd_events |= TCPM_FRS_EVENT;
+ spin_unlock(&port->pd_event_lock);
+ kthread_queue_work(port->wq, &port->event_work);
+ }
+@@ -5364,7 +5364,7 @@ EXPORT_SYMBOL_GPL(tcpm_sink_frs);
+ void tcpm_sourcing_vbus(struct tcpm_port *port)
+ {
+ spin_lock(&port->pd_event_lock);
+- port->pd_events = TCPM_SOURCING_VBUS;
++ port->pd_events |= TCPM_SOURCING_VBUS;
+ spin_unlock(&port->pd_event_lock);
+ kthread_queue_work(port->wq, &port->event_work);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
