--- /dev/null
+From cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:27 +0200
+Subject: can: kvaser_usb: Fix use of uninitialized completion
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 upstream.
+
+flush_comp is initialized when CMD_FLUSH_QUEUE is sent to the device and
+completed when the device sends CMD_FLUSH_QUEUE_RESP.
+
+This causes completion of uninitialized completion if the device sends
+CMD_FLUSH_QUEUE_RESP before CMD_FLUSH_QUEUE is ever sent (e.g. as a
+response to a flush by a previously bound driver, or a misbehaving
+device).
+
+Fix that by initializing flush_comp in kvaser_usb_init_one() like the
+other completions.
+
+This issue is only triggerable after RX URBs have been set up, i.e. the
+interface has been opened at least once.
+
+Cc: stable@vger.kernel.org
+Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-3-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 +
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -717,6 +717,7 @@ static int kvaser_usb_init_one(struct kv
+ init_usb_anchor(&priv->tx_submitted);
+ init_completion(&priv->start_comp);
+ init_completion(&priv->stop_comp);
++ init_completion(&priv->flush_comp);
+ priv->can.ctrlmode_supported = 0;
+
+ priv->dev = dev;
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1914,7 +1914,7 @@ static int kvaser_usb_hydra_flush_queue(
+ {
+ int err;
+
+- init_completion(&priv->flush_comp);
++ reinit_completion(&priv->flush_comp);
+
+ err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_FLUSH_QUEUE,
+ priv->channel);
--- /dev/null
+From 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:29 +0200
+Subject: can: kvaser_usb_leaf: Fix CAN state after restart
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 upstream.
+
+can_restart() expects CMD_START_CHIP to set the error state to
+ERROR_ACTIVE as it calls netif_carrier_on() immediately afterwards.
+
+Otherwise the user may immediately trigger restart again and hit a
+BUG_ON() in can_restart().
+
+Fix kvaser_usb_leaf set_mode(CMD_START_CHIP) to set the expected state.
+
+Cc: stable@vger.kernel.org
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-5-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1435,6 +1435,8 @@ static int kvaser_usb_leaf_set_mode(stru
+ err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP);
+ if (err)
+ return err;
++
++ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ break;
+ default:
+ return -EOPNOTSUPP;
--- /dev/null
+From 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:26 +0200
+Subject: can: kvaser_usb_leaf: Fix overread with an invalid command
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream.
+
+For command events read from the device,
+kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not
+exceed the size of the received data, but the actual kvaser_cmd handlers
+will happily read any kvaser_cmd fields without checking for cmd->len.
+
+This can cause an overread if the last cmd in the buffer is shorter than
+expected for the command type (with cmd->len showing the actual short
+size).
+
+Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of
+which are delivered to userspace as-is.
+
+Fix that by verifying the length of command before handling it.
+
+This issue can only occur after RX URBs have been set up, i.e. the
+interface has been opened at least once.
+
+Cc: stable@vger.kernel.org
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-2-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 +++++++++++++++++++++++
+ 1 file changed, 75 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -309,6 +309,38 @@ struct kvaser_cmd {
+ } u;
+ } __packed;
+
++#define CMD_SIZE_ANY 0xff
++#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field)
++
++static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = {
++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.leaf.softinfo),
++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
++ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message),
++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event),
++ /* ignored events: */
++ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY,
++};
++
++static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = {
++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.usbcan.softinfo),
++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event),
++ /* ignored events: */
++ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY,
++};
++
+ /* Summary of a kvaser error event, for a unified Leaf/Usbcan error
+ * handling. Some discrepancies between the two families exist:
+ *
+@@ -396,6 +428,43 @@ static const struct kvaser_usb_dev_cfg k
+ .bittiming_const = &kvaser_usb_flexc_bittiming_const,
+ };
+
++static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev,
++ const struct kvaser_cmd *cmd)
++{
++ /* buffer size >= cmd->len ensured by caller */
++ u8 min_size = 0;
++
++ switch (dev->driver_info->family) {
++ case KVASER_LEAF:
++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf))
++ min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id];
++ break;
++ case KVASER_USBCAN:
++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan))
++ min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id];
++ break;
++ }
++
++ if (min_size == CMD_SIZE_ANY)
++ return 0;
++
++ if (min_size) {
++ min_size += CMD_HEADER_LEN;
++ if (cmd->len >= min_size)
++ return 0;
++
++ dev_err_ratelimited(&dev->intf->dev,
++ "Received command %u too short (size %u, needed %u)",
++ cmd->id, cmd->len, min_size);
++ return -EIO;
++ }
++
++ dev_warn_ratelimited(&dev->intf->dev,
++ "Unhandled command (%d, size %d)\n",
++ cmd->id, cmd->len);
++ return -EINVAL;
++}
++
+ static void *
+ kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv,
+ const struct sk_buff *skb, int *frame_len,
+@@ -503,6 +572,9 @@ static int kvaser_usb_leaf_wait_cmd(cons
+ end:
+ kfree(buf);
+
++ if (err == 0)
++ err = kvaser_usb_leaf_verify_size(dev, cmd);
++
+ return err;
+ }
+
+@@ -1137,6 +1209,9 @@ static void kvaser_usb_leaf_stop_chip_re
+ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
+ const struct kvaser_cmd *cmd)
+ {
++ if (kvaser_usb_leaf_verify_size(dev, cmd) < 0)
++ return;
++
+ switch (cmd->id) {
+ case CMD_START_CHIP_REPLY:
+ kvaser_usb_leaf_start_chip_reply(dev, cmd);
--- /dev/null
+From 455561fb618fde40558776b5b8435f9420f335db Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:28 +0200
+Subject: can: kvaser_usb_leaf: Fix TX queue out of sync after restart
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 455561fb618fde40558776b5b8435f9420f335db upstream.
+
+The TX queue seems to be implicitly flushed by the hardware during
+bus-off or bus-off recovery, but the driver does not reset the TX
+bookkeeping.
+
+Despite not resetting TX bookkeeping the driver still re-enables TX
+queue unconditionally, leading to "cannot find free context" /
+NETDEV_TX_BUSY errors if the TX queue was full at bus-off time.
+
+Fix that by resetting TX bookkeeping on CAN restart.
+
+Tested with 0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778.
+
+Cc: stable@vger.kernel.org
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-4-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 ++
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 +-
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+@@ -178,6 +178,8 @@ struct kvaser_usb_dev_cfg {
+ extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops;
+ extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops;
+
++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv);
++
+ int kvaser_usb_recv_cmd(const struct kvaser_usb *dev, void *cmd, int len,
+ int *actual_len);
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -480,7 +480,7 @@ static void kvaser_usb_reset_tx_urb_cont
+ /* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+ {
+ usb_kill_anchored_urbs(&priv->tx_submitted);
+ kvaser_usb_reset_tx_urb_contexts(priv);
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1430,6 +1430,8 @@ static int kvaser_usb_leaf_set_mode(stru
+
+ switch (mode) {
+ case CAN_MODE_START:
++ kvaser_usb_unlink_tx_urbs(priv);
++
+ err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP);
+ if (err)
+ return err;
--- /dev/null
+From bb44c31cdcac107344dd2fcc3bd0504a53575c51 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Tue, 20 Sep 2022 14:32:02 +1000
+Subject: cifs: destage dirty pages before re-reading them for cache=none
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+commit bb44c31cdcac107344dd2fcc3bd0504a53575c51 upstream.
+
+This is the opposite case of kernel bugzilla 216301.
+If we mmap a file using cache=none and then proceed to update the mmapped
+area these updates are not reflected in a later pread() of that part of the
+file.
+To fix this we must first destage any dirty pages in the range before
+we allow the pread() to proceed.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/file.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -4015,6 +4015,15 @@ static ssize_t __cifs_readv(
+ len = ctx->len;
+ }
+
++ if (direct) {
++ rc = filemap_write_and_wait_range(file->f_inode->i_mapping,
++ offset, offset + len - 1);
++ if (rc) {
++ kref_put(&ctx->refcount, cifs_aio_ctx_release);
++ return -EAGAIN;
++ }
++ }
++
+ /* grab a lock here due to read response handlers can access ctx */
+ mutex_lock(&ctx->aio_mutex);
+
--- /dev/null
+From e98ecc6e94f4e6d21c06660b0f336df02836694f Mon Sep 17 00:00:00 2001
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Date: Mon, 26 Sep 2022 11:36:29 +0800
+Subject: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+commit e98ecc6e94f4e6d21c06660b0f336df02836694f upstream.
+
+Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
+extend the dialects from 3 to 4, but forget to decrease the extended
+length when specific the dialect, then the message length is larger
+than expected.
+
+This maybe leak some info through network because not initialize the
+message body.
+
+After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is
+reduced from 28 bytes to 26 bytes.
+
+Fixes: d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Cc: <stable@vger.kernel.org>
+Acked-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Tom Talpey <tom@talpey.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/smb2pdu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1137,9 +1137,9 @@ int smb3_validate_negotiate(const unsign
+ pneg_inbuf->Dialects[0] =
+ cpu_to_le16(server->vals->protocol_id);
+ pneg_inbuf->DialectCount = cpu_to_le16(1);
+- /* structure is big enough for 3 dialects, sending only 1 */
++ /* structure is big enough for 4 dialects, sending only 1 */
+ inbuflen = sizeof(*pneg_inbuf) -
+- sizeof(pneg_inbuf->Dialects[0]) * 2;
++ sizeof(pneg_inbuf->Dialects[0]) * 3;
+ }
+
+ rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
--- /dev/null
+From 365e1ececb2905f94cc10a5817c5b644a32a3ae2 Mon Sep 17 00:00:00 2001
+From: Gaurav Kohli <gauravkohli@linux.microsoft.com>
+Date: Wed, 5 Oct 2022 22:52:59 -0700
+Subject: hv_netvsc: Fix race between VF offering and VF association message from host
+
+From: Gaurav Kohli <gauravkohli@linux.microsoft.com>
+
+commit 365e1ececb2905f94cc10a5817c5b644a32a3ae2 upstream.
+
+During vm boot, there might be possibility that vf registration
+call comes before the vf association from host to vm.
+
+And this might break netvsc vf path, To prevent the same block
+vf registration until vf bind message comes from host.
+
+Cc: stable@vger.kernel.org
+Fixes: 00d7ddba11436 ("hv_netvsc: pair VF based on serial number")
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Gaurav Kohli <gauravkohli@linux.microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hyperv/hyperv_net.h | 3 ++-
+ drivers/net/hyperv/netvsc.c | 4 ++++
+ drivers/net/hyperv/netvsc_drv.c | 19 +++++++++++++++++++
+ 3 files changed, 25 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -1037,7 +1037,8 @@ struct net_device_context {
+ u32 vf_alloc;
+ /* Serial number of the VF to team with */
+ u32 vf_serial;
+-
++ /* completion variable to confirm vf association */
++ struct completion vf_add;
+ /* Is the current data path through the VF NIC? */
+ bool data_path_is_vf;
+
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1450,6 +1450,10 @@ static void netvsc_send_vf(struct net_de
+
+ net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
+ net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
++
++ if (net_device_ctx->vf_alloc)
++ complete(&net_device_ctx->vf_add);
++
+ netdev_info(ndev, "VF slot %u %s\n",
+ net_device_ctx->vf_serial,
+ net_device_ctx->vf_alloc ? "added" : "removed");
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -2336,6 +2336,18 @@ static struct net_device *get_netvsc_bys
+
+ }
+
++ /* Fallback path to check synthetic vf with
++ * help of mac addr
++ */
++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
++ ndev = hv_get_drvdata(ndev_ctx->device_ctx);
++ if (ether_addr_equal(vf_netdev->perm_addr, ndev->perm_addr)) {
++ netdev_notice(vf_netdev,
++ "falling back to mac addr based matching\n");
++ return ndev;
++ }
++ }
++
+ netdev_notice(vf_netdev,
+ "no netdev found for vf serial:%u\n", serial);
+ return NULL;
+@@ -2432,6 +2444,11 @@ static int netvsc_vf_changed(struct net_
+ if (net_device_ctx->data_path_is_vf == vf_is_up)
+ return NOTIFY_OK;
+
++ if (vf_is_up && !net_device_ctx->vf_alloc) {
++ netdev_info(ndev, "Waiting for the VF association from host\n");
++ wait_for_completion(&net_device_ctx->vf_add);
++ }
++
+ ret = netvsc_switch_datapath(ndev, vf_is_up);
+
+ if (ret) {
+@@ -2463,6 +2480,7 @@ static int netvsc_unregister_vf(struct n
+
+ netvsc_vf_setxdp(vf_netdev, NULL);
+
++ reinit_completion(&net_device_ctx->vf_add);
+ netdev_rx_handler_unregister(vf_netdev);
+ netdev_upper_dev_unlink(vf_netdev, ndev);
+ RCU_INIT_POINTER(net_device_ctx->vf_netdev, NULL);
+@@ -2502,6 +2520,7 @@ static int netvsc_probe(struct hv_device
+
+ INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
+
++ init_completion(&net_device_ctx->vf_add);
+ spin_lock_init(&net_device_ctx->lock);
+ INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
+ INIT_DELAYED_WORK(&net_device_ctx->vf_takeover, netvsc_vf_setup);
--- /dev/null
+From 301c8f5c32c8fb79c67539bc23972dc3ef48024c Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Tue, 27 Sep 2022 16:56:44 +0300
+Subject: i2c: designware: Fix handling of real but unexpected device interrupts
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit 301c8f5c32c8fb79c67539bc23972dc3ef48024c upstream.
+
+Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI
+IDs") caused a regression on certain Gigabyte motherboards for Intel
+Alder Lake-S where system crashes to NULL pointer dereference in
+i2c_dw_xfer_msg() when system resumes from S3 sleep state ("deep").
+
+I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made
+following notes:
+
+- Issue happens when resuming from S3 but not when resuming from
+ "s2idle"
+- PCI device 00:15.0 == i2c_designware.0 is already in D0 state when
+ system enters into pci_pm_resume_noirq() while all other i2c_designware
+ PCI devices are in D3. Devices were runtime suspended and in D3 prior
+ entering into suspend
+- Interrupt comes after pci_pm_resume_noirq() when device interrupts are
+ re-enabled
+- According to register dump the interrupt really comes from the
+ i2c_designware.0. Controller is enabled, I2C target address register
+ points to a one detectable I2C device address 0x60 and the
+ DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and
+ TX_EMPTY bits are set indicating completed I2C transaction.
+
+My guess is that the firmware uses this controller to communicate with
+an on-board I2C device during resume but does not disable the controller
+before giving control to an operating system.
+
+I was told the UEFI update fixes this but never the less it revealed the
+driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device
+is supposed to be idle and state variables are not set (especially the
+dev->msgs pointer which may point to NULL or stale old data).
+
+Introduce a new software status flag STATUS_ACTIVE indicating when the
+controller is active in driver point of view. Now treat all interrupts
+that occur when is not set as unexpected and mask all interrupts from
+the controller.
+
+Fixes: c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs")
+Reported-by: Samuel Clark <slc2015@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215907
+Cc: stable@vger.kernel.org # v5.12+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-designware-core.h | 7 +++++--
+ drivers/i2c/busses/i2c-designware-master.c | 13 +++++++++++++
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -126,8 +126,9 @@
+ * status codes
+ */
+ #define STATUS_IDLE 0x0
+-#define STATUS_WRITE_IN_PROGRESS 0x1
+-#define STATUS_READ_IN_PROGRESS 0x2
++#define STATUS_ACTIVE 0x1
++#define STATUS_WRITE_IN_PROGRESS 0x2
++#define STATUS_READ_IN_PROGRESS 0x4
+
+ /*
+ * operation modes
+@@ -322,12 +323,14 @@ void i2c_dw_disable_int(struct dw_i2c_de
+
+ static inline void __i2c_dw_enable(struct dw_i2c_dev *dev)
+ {
++ dev->status |= STATUS_ACTIVE;
+ regmap_write(dev->map, DW_IC_ENABLE, 1);
+ }
+
+ static inline void __i2c_dw_disable_nowait(struct dw_i2c_dev *dev)
+ {
+ regmap_write(dev->map, DW_IC_ENABLE, 0);
++ dev->status &= ~STATUS_ACTIVE;
+ }
+
+ void __i2c_dw_disable(struct dw_i2c_dev *dev);
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -720,6 +720,19 @@ static int i2c_dw_irq_handler_master(str
+ u32 stat;
+
+ stat = i2c_dw_read_clear_intrbits(dev);
++
++ if (!(dev->status & STATUS_ACTIVE)) {
++ /*
++ * Unexpected interrupt in driver point of view. State
++ * variables are either unset or stale so acknowledge and
++ * disable interrupts for suppressing further interrupts if
++ * interrupt really came from this HW (E.g. firmware has left
++ * the HW active).
++ */
++ regmap_write(dev->map, DW_IC_INTR_MASK, 0);
++ return 0;
++ }
++
+ if (stat & DW_IC_INTR_TX_ABRT) {
+ dev->cmd_err |= DW_IC_ERR_TX_ABRT;
+ dev->status = STATUS_IDLE;
--- /dev/null
+From f4f43f01cff2f29779343ade755191afd2581c77 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
+Date: Mon, 12 Sep 2022 10:12:21 +0200
+Subject: iio: adc: ad7923: fix channel readings for some variants
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+commit f4f43f01cff2f29779343ade755191afd2581c77 upstream.
+
+Some of the supported devices have 4 or 2 LSB trailing bits that should
+not be taken into account. Hence we need to shift these bits out which
+fits perfectly on the scan type shift property. This change fixes both
+raw and buffered reads.
+
+Fixes: f2f7a449707e ("iio:adc:ad7923: Add support for the ad7904/ad7914/ad7924")
+Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928")
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20220912081223.173584-2-nuno.sa@analog.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7923.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ad7923.c
++++ b/drivers/iio/adc/ad7923.c
+@@ -93,6 +93,7 @@ enum ad7923_id {
+ .sign = 'u', \
+ .realbits = (bits), \
+ .storagebits = 16, \
++ .shift = 12 - (bits), \
+ .endianness = IIO_BE, \
+ }, \
+ }
+@@ -268,7 +269,8 @@ static int ad7923_read_raw(struct iio_de
+ return ret;
+
+ if (chan->address == EXTRACT(ret, 12, 4))
+- *val = EXTRACT(ret, 0, 12);
++ *val = EXTRACT(ret, chan->scan_type.shift,
++ chan->scan_type.realbits);
+ else
+ return -EIO;
+
--- /dev/null
+From 558a25f903b4af6361b7fbeea08a6446a0745653 Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Tue, 13 Sep 2022 09:34:12 +0200
+Subject: iio: dac: ad5593r: Fix i2c read protocol requirements
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+commit 558a25f903b4af6361b7fbeea08a6446a0745653 upstream.
+
+For reliable operation across the full range of supported
+interface rates, the AD5593R needs a STOP condition between
+address write, and data read (like show in the datasheet Figure 40)
+so in turn i2c_smbus_read_word_swapped cannot be used.
+
+While at it, a simple helper was added to make the code simpler.
+
+Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs")
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220913073413.140475-2-nuno.sa@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5593r.c | 46 +++++++++++++++++++++++++++-------------------
+ 1 file changed, 27 insertions(+), 19 deletions(-)
+
+--- a/drivers/iio/dac/ad5593r.c
++++ b/drivers/iio/dac/ad5593r.c
+@@ -13,6 +13,8 @@
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+
++#include <asm/unaligned.h>
++
+ #define AD5593R_MODE_CONF (0 << 4)
+ #define AD5593R_MODE_DAC_WRITE (1 << 4)
+ #define AD5593R_MODE_ADC_READBACK (4 << 4)
+@@ -20,6 +22,24 @@
+ #define AD5593R_MODE_GPIO_READBACK (6 << 4)
+ #define AD5593R_MODE_REG_READBACK (7 << 4)
+
++static int ad5593r_read_word(struct i2c_client *i2c, u8 reg, u16 *value)
++{
++ int ret;
++ u8 buf[2];
++
++ ret = i2c_smbus_write_byte(i2c, reg);
++ if (ret < 0)
++ return ret;
++
++ ret = i2c_master_recv(i2c, buf, sizeof(buf));
++ if (ret < 0)
++ return ret;
++
++ *value = get_unaligned_be16(buf);
++
++ return 0;
++}
++
+ static int ad5593r_write_dac(struct ad5592r_state *st, unsigned chan, u16 value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+@@ -38,13 +58,7 @@ static int ad5593r_read_adc(struct ad559
+ if (val < 0)
+ return (int) val;
+
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_ADC_READBACK);
+- if (val < 0)
+- return (int) val;
+-
+- *value = (u16) val;
+-
+- return 0;
++ return ad5593r_read_word(i2c, AD5593R_MODE_ADC_READBACK, value);
+ }
+
+ static int ad5593r_reg_write(struct ad5592r_state *st, u8 reg, u16 value)
+@@ -58,25 +72,19 @@ static int ad5593r_reg_write(struct ad55
+ static int ad5593r_reg_read(struct ad5592r_state *st, u8 reg, u16 *value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+- s32 val;
+-
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_REG_READBACK | reg);
+- if (val < 0)
+- return (int) val;
+
+- *value = (u16) val;
+-
+- return 0;
++ return ad5593r_read_word(i2c, AD5593R_MODE_REG_READBACK | reg, value);
+ }
+
+ static int ad5593r_gpio_read(struct ad5592r_state *st, u8 *value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+- s32 val;
++ u16 val;
++ int ret;
+
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_GPIO_READBACK);
+- if (val < 0)
+- return (int) val;
++ ret = ad5593r_read_word(i2c, AD5593R_MODE_GPIO_READBACK, &val);
++ if (ret)
++ return ret;
+
+ *value = (u8) val;
+
--- /dev/null
+From 7f4f1096d5921f5d90547596f9ce80e0b924f887 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Mon, 15 Aug 2022 09:16:47 +0000
+Subject: iio: ltc2497: Fix reading conversion results
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 7f4f1096d5921f5d90547596f9ce80e0b924f887 upstream.
+
+After the result of the previous conversion is read the chip
+automatically starts a new conversion and doesn't accept new i2c
+transfers until this conversion is completed which makes the function
+return failure.
+
+So add an early return iff the programming of the new address isn't
+needed. Note this will not fix the problem in general, but all cases
+that are currently used. Once this changes we get the failure back, but
+this can be addressed when the need arises.
+
+Fixes: 69548b7c2c4f ("iio: adc: ltc2497: split protocol independent part in a separate module ")
+Reported-by: Meng Li <Meng.Li@windriver.com>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Tested-by: Denys Zagorui <dzagorui@cisco.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220815091647.1523532-1-dzagorui@cisco.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ltc2497.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/iio/adc/ltc2497.c
++++ b/drivers/iio/adc/ltc2497.c
+@@ -41,6 +41,19 @@ static int ltc2497_result_and_measure(st
+ }
+
+ *val = (be32_to_cpu(st->buf) >> 14) - (1 << 17);
++
++ /*
++ * The part started a new conversion at the end of the above i2c
++ * transfer, so if the address didn't change since the last call
++ * everything is fine and we can return early.
++ * If not (which should only happen when some sort of bulk
++ * conversion is implemented) we have to program the new
++ * address. Note that this probably fails as the conversion that
++ * was triggered above is like not complete yet and the two
++ * operations have to be done in a single transfer.
++ */
++ if (ddata->addr_prev == address)
++ return 0;
+ }
+
+ ret = i2c_smbus_write_byte(st->client,
--- /dev/null
+From c2329717bdd3fa62f8a2f3d8d85ad0bee4556bd7 Mon Sep 17 00:00:00 2001
+From: Eddie James <eajames@linux.ibm.com>
+Date: Thu, 15 Sep 2022 14:57:18 -0500
+Subject: iio: pressure: dps310: Refactor startup procedure
+
+From: Eddie James <eajames@linux.ibm.com>
+
+commit c2329717bdd3fa62f8a2f3d8d85ad0bee4556bd7 upstream.
+
+Move the startup procedure into a function, and correct a missing
+check on the return code for writing the PRS_CFG register.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20220915195719.136812-2-eajames@linux.ibm.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/dps310.c | 188 ++++++++++++++++++++++--------------------
+ 1 file changed, 99 insertions(+), 89 deletions(-)
+
+--- a/drivers/iio/pressure/dps310.c
++++ b/drivers/iio/pressure/dps310.c
+@@ -159,6 +159,102 @@ static int dps310_get_coefs(struct dps31
+ return 0;
+ }
+
++/*
++ * Some versions of the chip will read temperatures in the ~60C range when
++ * it's actually ~20C. This is the manufacturer recommended workaround
++ * to correct the issue. The registers used below are undocumented.
++ */
++static int dps310_temp_workaround(struct dps310_data *data)
++{
++ int rc;
++ int reg;
++
++ rc = regmap_read(data->regmap, 0x32, ®);
++ if (rc)
++ return rc;
++
++ /*
++ * If bit 1 is set then the device is okay, and the workaround does not
++ * need to be applied
++ */
++ if (reg & BIT(1))
++ return 0;
++
++ rc = regmap_write(data->regmap, 0x0e, 0xA5);
++ if (rc)
++ return rc;
++
++ rc = regmap_write(data->regmap, 0x0f, 0x96);
++ if (rc)
++ return rc;
++
++ rc = regmap_write(data->regmap, 0x62, 0x02);
++ if (rc)
++ return rc;
++
++ rc = regmap_write(data->regmap, 0x0e, 0x00);
++ if (rc)
++ return rc;
++
++ return regmap_write(data->regmap, 0x0f, 0x00);
++}
++
++static int dps310_startup(struct dps310_data *data)
++{
++ int rc;
++ int ready;
++
++ /*
++ * Set up pressure sensor in single sample, one measurement per second
++ * mode
++ */
++ rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0);
++ if (rc)
++ return rc;
++
++ /*
++ * Set up external (MEMS) temperature sensor in single sample, one
++ * measurement per second mode
++ */
++ rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT);
++ if (rc)
++ return rc;
++
++ /* Temp and pressure shifts are disabled when PRC <= 8 */
++ rc = regmap_write_bits(data->regmap, DPS310_CFG_REG,
++ DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0);
++ if (rc)
++ return rc;
++
++ /* MEAS_CFG doesn't update correctly unless first written with 0 */
++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
++ DPS310_MEAS_CTRL_BITS, 0);
++ if (rc)
++ return rc;
++
++ /* Turn on temperature and pressure measurement in the background */
++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
++ DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN |
++ DPS310_TEMP_EN | DPS310_BACKGROUND);
++ if (rc)
++ return rc;
++
++ /*
++ * Calibration coefficients required for reporting temperature.
++ * They are available 40ms after the device has started
++ */
++ rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
++ ready & DPS310_COEF_RDY, 10000, 40000);
++ if (rc)
++ return rc;
++
++ rc = dps310_get_coefs(data);
++ if (rc)
++ return rc;
++
++ return dps310_temp_workaround(data);
++}
++
+ static int dps310_get_pres_precision(struct dps310_data *data)
+ {
+ int rc;
+@@ -677,52 +773,12 @@ static const struct iio_info dps310_info
+ .write_raw = dps310_write_raw,
+ };
+
+-/*
+- * Some verions of chip will read temperatures in the ~60C range when
+- * its actually ~20C. This is the manufacturer recommended workaround
+- * to correct the issue. The registers used below are undocumented.
+- */
+-static int dps310_temp_workaround(struct dps310_data *data)
+-{
+- int rc;
+- int reg;
+-
+- rc = regmap_read(data->regmap, 0x32, ®);
+- if (rc < 0)
+- return rc;
+-
+- /*
+- * If bit 1 is set then the device is okay, and the workaround does not
+- * need to be applied
+- */
+- if (reg & BIT(1))
+- return 0;
+-
+- rc = regmap_write(data->regmap, 0x0e, 0xA5);
+- if (rc < 0)
+- return rc;
+-
+- rc = regmap_write(data->regmap, 0x0f, 0x96);
+- if (rc < 0)
+- return rc;
+-
+- rc = regmap_write(data->regmap, 0x62, 0x02);
+- if (rc < 0)
+- return rc;
+-
+- rc = regmap_write(data->regmap, 0x0e, 0x00);
+- if (rc < 0)
+- return rc;
+-
+- return regmap_write(data->regmap, 0x0f, 0x00);
+-}
+-
+ static int dps310_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+ struct dps310_data *data;
+ struct iio_dev *iio;
+- int rc, ready;
++ int rc;
+
+ iio = devm_iio_device_alloc(&client->dev, sizeof(*data));
+ if (!iio)
+@@ -747,54 +803,8 @@ static int dps310_probe(struct i2c_clien
+ if (rc)
+ return rc;
+
+- /*
+- * Set up pressure sensor in single sample, one measurement per second
+- * mode
+- */
+- rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0);
+-
+- /*
+- * Set up external (MEMS) temperature sensor in single sample, one
+- * measurement per second mode
+- */
+- rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT);
+- if (rc < 0)
+- return rc;
+-
+- /* Temp and pressure shifts are disabled when PRC <= 8 */
+- rc = regmap_write_bits(data->regmap, DPS310_CFG_REG,
+- DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0);
+- if (rc < 0)
+- return rc;
+-
+- /* MEAS_CFG doesn't update correctly unless first written with 0 */
+- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
+- DPS310_MEAS_CTRL_BITS, 0);
+- if (rc < 0)
+- return rc;
+-
+- /* Turn on temperature and pressure measurement in the background */
+- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
+- DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN |
+- DPS310_TEMP_EN | DPS310_BACKGROUND);
+- if (rc < 0)
+- return rc;
+-
+- /*
+- * Calibration coefficients required for reporting temperature.
+- * They are available 40ms after the device has started
+- */
+- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
+- ready & DPS310_COEF_RDY, 10000, 40000);
+- if (rc < 0)
+- return rc;
+-
+- rc = dps310_get_coefs(data);
+- if (rc < 0)
+- return rc;
+-
+- rc = dps310_temp_workaround(data);
+- if (rc < 0)
++ rc = dps310_startup(data);
++ if (rc)
+ return rc;
+
+ rc = devm_iio_device_register(&client->dev, iio);
--- /dev/null
+From 7b4ab4abcea4c0c10b25187bf2569e5a07e9a20c Mon Sep 17 00:00:00 2001
+From: Eddie James <eajames@linux.ibm.com>
+Date: Thu, 15 Sep 2022 14:57:19 -0500
+Subject: iio: pressure: dps310: Reset chip after timeout
+
+From: Eddie James <eajames@linux.ibm.com>
+
+commit 7b4ab4abcea4c0c10b25187bf2569e5a07e9a20c upstream.
+
+The DPS310 chip has been observed to get "stuck" such that pressure
+and temperature measurements are never indicated as "ready" in the
+MEAS_CFG register. The only solution is to reset the device and try
+again. In order to avoid continual failures, use a boolean flag to
+only try the reset after timeout once if errors persist.
+
+Fixes: ba6ec48e76bc ("iio: Add driver for Infineon DPS310")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20220915195719.136812-3-eajames@linux.ibm.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/dps310.c | 74 ++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 64 insertions(+), 10 deletions(-)
+
+--- a/drivers/iio/pressure/dps310.c
++++ b/drivers/iio/pressure/dps310.c
+@@ -89,6 +89,7 @@ struct dps310_data {
+ s32 c00, c10, c20, c30, c01, c11, c21;
+ s32 pressure_raw;
+ s32 temp_raw;
++ bool timeout_recovery_failed;
+ };
+
+ static const struct iio_chan_spec dps310_channels[] = {
+@@ -393,11 +394,69 @@ static int dps310_get_temp_k(struct dps3
+ return scale_factors[ilog2(rc)];
+ }
+
++static int dps310_reset_wait(struct dps310_data *data)
++{
++ int rc;
++
++ rc = regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC);
++ if (rc)
++ return rc;
++
++ /* Wait for device chip access: 2.5ms in specification */
++ usleep_range(2500, 12000);
++ return 0;
++}
++
++static int dps310_reset_reinit(struct dps310_data *data)
++{
++ int rc;
++
++ rc = dps310_reset_wait(data);
++ if (rc)
++ return rc;
++
++ return dps310_startup(data);
++}
++
++static int dps310_ready_status(struct dps310_data *data, int ready_bit, int timeout)
++{
++ int sleep = DPS310_POLL_SLEEP_US(timeout);
++ int ready;
++
++ return regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, ready & ready_bit,
++ sleep, timeout);
++}
++
++static int dps310_ready(struct dps310_data *data, int ready_bit, int timeout)
++{
++ int rc;
++
++ rc = dps310_ready_status(data, ready_bit, timeout);
++ if (rc) {
++ if (rc == -ETIMEDOUT && !data->timeout_recovery_failed) {
++ /* Reset and reinitialize the chip. */
++ if (dps310_reset_reinit(data)) {
++ data->timeout_recovery_failed = true;
++ } else {
++ /* Try again to get sensor ready status. */
++ if (dps310_ready_status(data, ready_bit, timeout))
++ data->timeout_recovery_failed = true;
++ else
++ return 0;
++ }
++ }
++
++ return rc;
++ }
++
++ data->timeout_recovery_failed = false;
++ return 0;
++}
++
+ static int dps310_read_pres_raw(struct dps310_data *data)
+ {
+ int rc;
+ int rate;
+- int ready;
+ int timeout;
+ s32 raw;
+ u8 val[3];
+@@ -409,9 +468,7 @@ static int dps310_read_pres_raw(struct d
+ timeout = DPS310_POLL_TIMEOUT_US(rate);
+
+ /* Poll for sensor readiness; base the timeout upon the sample rate. */
+- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
+- ready & DPS310_PRS_RDY,
+- DPS310_POLL_SLEEP_US(timeout), timeout);
++ rc = dps310_ready(data, DPS310_PRS_RDY, timeout);
+ if (rc)
+ goto done;
+
+@@ -448,7 +505,6 @@ static int dps310_read_temp_raw(struct d
+ {
+ int rc;
+ int rate;
+- int ready;
+ int timeout;
+
+ if (mutex_lock_interruptible(&data->lock))
+@@ -458,10 +514,8 @@ static int dps310_read_temp_raw(struct d
+ timeout = DPS310_POLL_TIMEOUT_US(rate);
+
+ /* Poll for sensor readiness; base the timeout upon the sample rate. */
+- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
+- ready & DPS310_TMP_RDY,
+- DPS310_POLL_SLEEP_US(timeout), timeout);
+- if (rc < 0)
++ rc = dps310_ready(data, DPS310_TMP_RDY, timeout);
++ if (rc)
+ goto done;
+
+ rc = dps310_read_temp_ready(data);
+@@ -756,7 +810,7 @@ static void dps310_reset(void *action_da
+ {
+ struct dps310_data *data = action_data;
+
+- regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC);
++ dps310_reset_wait(data);
+ }
+
+ static const struct regmap_config dps310_regmap_config = {
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
-@@ -4763,7 +4763,8 @@ static int io_setup_async_msg(struct io_
+@@ -4762,7 +4762,8 @@ static int io_setup_async_msg(struct io_
async_msg = req->async_data;
req->flags |= REQ_F_NEED_CLEANUP;
memcpy(async_msg, kmsg, sizeof(*kmsg));
+++ /dev/null
-From bf68b5b34311ee57ed40749a1257a30b46127556 Mon Sep 17 00:00:00 2001
-From: Pavel Begunkov <asml.silence@gmail.com>
-Date: Tue, 27 Sep 2022 00:44:39 +0100
-Subject: io_uring/rw: fix unexpected link breakage
-
-From: Pavel Begunkov <asml.silence@gmail.com>
-
-commit bf68b5b34311ee57ed40749a1257a30b46127556 upstream.
-
-req->cqe.res is set in io_read() to the amount of bytes left to be done,
-which is used to figure out whether to fail a read or not. However,
-io_read() may do another without returning, and we stash the previous
-value into ->bytes_done but forget to update cqe.res. Then we ask a read
-to do strictly less than cqe.res but expect the return to be exactly
-cqe.res.
-
-Fix the bug by updating cqe.res for retries.
-
-Cc: stable@vger.kernel.org
-Reported-and-Tested-by: Beld Zhang <beldzhang@gmail.com>
-Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
-Link: https://lore.kernel.org/r/3a1088440c7be98e5800267af922a67da0ef9f13.1664235732.git.asml.silence@gmail.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- fs/io_uring.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/fs/io_uring.c
-+++ b/fs/io_uring.c
-@@ -3600,6 +3600,7 @@ static int io_read(struct io_kiocb *req,
- return -EAGAIN;
- }
-
-+ req->cqe.res = iov_iter_count(&s->iter);
- /*
- * Now retry read with the IOCB_WAITQ parts set in the iocb. If
- * we get -EIOCBQUEUED, then we'll get a notification when the
--- /dev/null
+From 6e141772e6465f937458b35ddcfd0a981b6f5280 Mon Sep 17 00:00:00 2001
+From: Wenchao Chen <wenchao.chen@unisoc.com>
+Date: Tue, 11 Oct 2022 18:49:35 +0800
+Subject: mmc: sdhci-sprd: Fix minimum clock limit
+
+From: Wenchao Chen <wenchao.chen@unisoc.com>
+
+commit 6e141772e6465f937458b35ddcfd0a981b6f5280 upstream.
+
+The Spreadtrum controller supports 100KHz minimal clock rate, which means
+that the current value 400KHz is wrong.
+
+Unfortunately this has also lead to fail to initialize some cards, which
+are allowed to require 100KHz to work. So, let's fix the problem by
+changing the minimal supported clock rate to 100KHz.
+
+Signed-off-by: Wenchao Chen <wenchao.chen@unisoc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20221011104935.10980-1-wenchao.chen666@gmail.com
+[Ulf: Clarified to commit-message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-sprd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-sprd.c
++++ b/drivers/mmc/host/sdhci-sprd.c
+@@ -296,7 +296,7 @@ static unsigned int sdhci_sprd_get_max_c
+
+ static unsigned int sdhci_sprd_get_min_clock(struct sdhci_host *host)
+ {
+- return 400000;
++ return 100000;
+ }
+
+ static void sdhci_sprd_set_uhs_signaling(struct sdhci_host *host,
alsa-hda-realtek-add-quirk-for-asus-gv601r-laptop.patch
alsa-hda-realtek-add-intel-reference-ssid-to-support-headset-keys.patch
mtd-rawnand-atmel-unmap-streaming-dma-mappings.patch
-io_uring-rw-fix-unexpected-link-breakage.patch
io_uring-net-don-t-update-msg_name-if-not-provided.patch
+hv_netvsc-fix-race-between-vf-offering-and-vf-association-message-from-host.patch
+cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch
+cifs-fix-the-error-length-of-validate_negotiate_info-message.patch
+iio-dac-ad5593r-fix-i2c-read-protocol-requirements.patch
+iio-ltc2497-fix-reading-conversion-results.patch
+iio-adc-ad7923-fix-channel-readings-for-some-variants.patch
+iio-pressure-dps310-refactor-startup-procedure.patch
+iio-pressure-dps310-reset-chip-after-timeout.patch
+xhci-dbc-fix-memory-leak-in-xhci_alloc_dbc.patch
+usb-add-quirks-for-lenovo-onelink-dock.patch
+can-kvaser_usb-fix-use-of-uninitialized-completion.patch
+can-kvaser_usb_leaf-fix-overread-with-an-invalid-command.patch
+can-kvaser_usb_leaf-fix-tx-queue-out-of-sync-after-restart.patch
+can-kvaser_usb_leaf-fix-can-state-after-restart.patch
+mmc-sdhci-sprd-fix-minimum-clock-limit.patch
+i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch
--- /dev/null
+From 37d49519b41405b08748392c6a7f193d9f77ecd2 Mon Sep 17 00:00:00 2001
+From: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+Date: Tue, 27 Sep 2022 09:34:07 +0200
+Subject: usb: add quirks for Lenovo OneLink+ Dock
+
+From: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+
+commit 37d49519b41405b08748392c6a7f193d9f77ecd2 upstream.
+
+The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers:
+17ef:1018 upstream
+17ef:1019 downstream
+
+These hubs suffer from two separate problems:
+
+1) After the host system was suspended and woken up, the hubs appear to
+ be in a random state. Some downstream ports (both internal to the
+ built-in audio and network controllers, and external to USB sockets)
+ may no longer be functional. The exact list of disabled ports (if
+ any) changes from wakeup to wakeup. Ports remain in that state until
+ the dock is power-cycled, or until the laptop is rebooted.
+
+ Wakeup sources connected to the hubs (keyboard, WoL on the integrated
+ gigabit controller) will wake the system up from suspend, but they
+ may no longer work after wakeup (and in that case will no longer work
+ as wakeup source in a subsequent suspend-wakeup cycle).
+
+ This issue appears in the logs with messages such as:
+
+ usb 1-6.1-port4: cannot disable (err = -71)
+ usb 1-6-port2: cannot disable (err = -71)
+ usb 1-6.1: clear tt 1 (80c0) error -71
+ usb 1-6-port4: cannot disable (err = -71)
+ usb 1-6.4: PM: dpm_run_callback(): usb_dev_resume+0x0/0x10 [usbcore] returns -71
+ usb 1-6.4: PM: failed to resume async: error -71
+ usb 1-7: reset full-speed USB device number 5 using xhci_hcd
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
+ usb 1-6.1-port1: cannot disable (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
+ usb 1-6.1-port1: cannot disable (err = -71)
+
+2) Some USB devices cannot be enumerated properly. So far I have only
+ seen the issue with USB 3.0 devices. The same devices work without
+ problem directly connected to the host system, to other systems or to
+ other hubs (even when those hubs are connected to the OneLink+ dock).
+
+ One very reliable reproducer is this USB 3.0 HDD enclosure:
+ 152d:9561 JMicron Technology Corp. / JMicron USA Technology Corp. Mobius
+
+ I have seen it happen sporadically with other USB 3.0 enclosures,
+ with controllers from different manufacturers, all self-powered.
+
+ Typical messages in the logs:
+
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 6, error -62
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 7, error -62
+ usb 2-1-port4: attempt power cycle
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 8, error -62
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 9, error -62
+ usb 2-1-port4: unable to enumerate USB device
+
+Through trial and error, I found that the USB_QUIRK_RESET_RESUME solved
+the second issue. Further testing then uncovered the first issue. Test
+results are summarized in this table:
+
+=======================================================================================
+Settings USB2 hotplug USB3 hotplug State after waking up
+---------------------------------------------------------------------------------------
+
+power/control=auto works fails broken
+
+usbcore.autosuspend=-1 works works broken
+OR power/control=on
+
+power/control=auto works (1) works (1) works
+and USB_QUIRK_RESET_RESUME
+
+power/control=on works works works
+and USB_QUIRK_RESET_RESUME
+
+HUB_QUIRK_DISABLE_AUTOSUSPEND works works works
+and USB_QUIRK_RESET_RESUME
+
+=======================================================================================
+
+In those results, the power/control settings are applied to both hubs,
+both on the USB2 and USB3 side, before each test.
+
+From those results, USB_QUIRK_RESET_RESUME is required to reset the hubs
+properly after a suspend-wakeup cycle, and the hubs must not autosuspend
+to work around the USB3 issue.
+
+A secondary effect of USB_QUIRK_RESET_RESUME is to prevent the hubs'
+upstream links from suspending (the downstream ports can still suspend).
+This secondary effect is used in results (1). It is enough to solve the
+USB3 problem.
+
+Setting USB_QUIRK_RESET_RESUME on those hubs is the smallest patch that
+solves both issues.
+
+Prior to creating this patch, I have used the USB_QUIRK_RESET_RESUME via
+the kernel command line for over a year without noticing any side
+effect.
+
+Thanks to Oliver Neukum @Suse for explanations of the operations of
+USB_QUIRK_RESET_RESUME, and requesting more testing.
+
+Signed-off-by: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220927073407.5672-1-jflf_kernel@gmx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -437,6 +437,10 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */
++ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */
+ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
+
--- /dev/null
+From d591b32e519603524a35b172156db71df9116902 Mon Sep 17 00:00:00 2001
+From: Rafael Mendonca <rafaelmendsr@gmail.com>
+Date: Wed, 21 Sep 2022 15:34:46 +0300
+Subject: xhci: dbc: Fix memory leak in xhci_alloc_dbc()
+
+From: Rafael Mendonca <rafaelmendsr@gmail.com>
+
+commit d591b32e519603524a35b172156db71df9116902 upstream.
+
+If DbC is already in use, then the allocated memory for the xhci_dbc struct
+doesn't get freed before returning NULL, which leads to a memleak.
+
+Fixes: 534675942e90 ("xhci: dbc: refactor xhci_dbc_init()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20220921123450.671459-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -988,7 +988,7 @@ xhci_alloc_dbc(struct device *dev, void
+ dbc->driver = driver;
+
+ if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE)
+- return NULL;
++ goto err;
+
+ INIT_DELAYED_WORK(&dbc->event_work, xhci_dbc_handle_events);
+ spin_lock_init(&dbc->lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
