--- /dev/null
+From ecc1ff532b499d20304a4f682247137025814c34 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Thu, 15 Oct 2020 20:20:41 +0200
+Subject: ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit ecc1ff532b499d20304a4f682247137025814c34 upstream.
+
+On Odroid XU board the USB3-0 port is a microUSB and USB3-1 port is USB
+type A (host). The roles were copied from Odroid XU3 (Exynos5422)
+design which has it reversed.
+
+Fixes: 8149afe4dbf9 ("ARM: dts: exynos: Add initial support for Odroid XU board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201015182044.480562-1-krzk@kernel.org
+Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5410-odroidxu.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+@@ -637,11 +637,11 @@
+ };
+
+ &usbdrd_dwc3_0 {
+- dr_mode = "host";
++ dr_mode = "peripheral";
+ };
+
+ &usbdrd_dwc3_1 {
+- dr_mode = "peripheral";
++ dr_mode = "host";
+ };
+
+ &usbdrd3_0 {
--- /dev/null
+From bd7e7ff56feea7810df900fb09c9741d259861d9 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Thu, 15 Oct 2020 20:20:43 +0200
+Subject: ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit bd7e7ff56feea7810df900fb09c9741d259861d9 upstream.
+
+On Odroid XU LDO12 and LDO15 supplies the power to USB 3.0 blocks but
+the GPK GPIO pins are supplied by LDO7 (VDDQ_LCD). LDO7 also supplies
+GPJ GPIO pins.
+
+The Exynos pinctrl driver does not take any supplies, so to have entire
+GPIO block always available, make the regulator always on.
+
+Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201015182044.480562-3-krzk@kernel.org
+Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5410-odroidxu.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+@@ -327,6 +327,8 @@
+ regulator-name = "vddq_lcd";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ /* Supplies also GPK and GPJ */
++ regulator-always-on;
+ };
+
+ ldo8_reg: LDO8 {
--- /dev/null
+From 3d992fd8f4e0f09c980726308d2f2725587b32d6 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Thu, 15 Oct 2020 20:20:42 +0200
+Subject: ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 3d992fd8f4e0f09c980726308d2f2725587b32d6 upstream.
+
+The VBUS control (PWREN) and over-current pins of USB 3.0 DWC3
+controllers are on Exynos5410 regular GPIOs. This is different than for
+example on Exynos5422 where these are special ETC pins with proper reset
+values (pulls, functions).
+
+Therefore these pins should be configured to enable proper USB 3.0
+peripheral and host modes. This also fixes over-current warning:
+
+ [ 6.024658] usb usb4-port1: over-current condition
+ [ 6.028271] usb usb3-port1: over-current condition
+
+Fixes: cb0896562228 ("ARM: dts: exynos: Add USB to Exynos5410")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201015182044.480562-2-krzk@kernel.org
+Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 ++++++++++++++++++++++++++++
+ arch/arm/boot/dts/exynos5410.dtsi | 4 ++++
+ 2 files changed, 32 insertions(+)
+
+--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
++++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
+@@ -560,6 +560,34 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
++
++ usb3_1_oc: usb3-1-oc {
++ samsung,pins = "gpk2-4", "gpk2-5";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_1_vbusctrl: usb3-1-vbusctrl {
++ samsung,pins = "gpk2-6", "gpk2-7";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_0_oc: usb3-0-oc {
++ samsung,pins = "gpk3-0", "gpk3-1";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_0_vbusctrl: usb3-0-vbusctrl {
++ samsung,pins = "gpk3-2", "gpk3-3";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
+ };
+
+ &pinctrl_2 {
+--- a/arch/arm/boot/dts/exynos5410.dtsi
++++ b/arch/arm/boot/dts/exynos5410.dtsi
+@@ -398,6 +398,8 @@
+ &usbdrd3_0 {
+ clocks = <&clock CLK_USBD300>;
+ clock-names = "usbdrd30";
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>;
+ };
+
+ &usbdrd_phy0 {
+@@ -409,6 +411,8 @@
+ &usbdrd3_1 {
+ clocks = <&clock CLK_USBD301>;
+ clock-names = "usbdrd30";
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>;
+ };
+
+ &usbdrd_dwc3_1 {
--- /dev/null
+From 22b2beaa7f166f550424cbb3b988aeaa7ef0425a Mon Sep 17 00:00:00 2001
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Date: Fri, 27 Nov 2020 10:52:51 -0700
+Subject: coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf()
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+commit 22b2beaa7f166f550424cbb3b988aeaa7ef0425a upstream.
+
+There was a report of NULL pointer dereference in ETF enable
+path for perf CS mode with PID monitoring. It is almost 100%
+reproducible when the process to monitor is something very
+active such as chrome and with ETF as the sink, not ETR.
+
+But code path shows that ETB has a similar path as ETF, so
+there could be possible NULL pointer dereference crash in
+ETB as well. Currently in a bid to find the pid, the owner
+is dereferenced via task_pid_nr() call in etb_enable_perf()
+and with owner being NULL, we can get a NULL pointer
+dereference, so have a similar fix as ETF where we cache PID
+in alloc_buffer() callback which is called as the part of
+etm_setup_aux().
+
+Fixes: 75d7dbd38824 ("coresight: etb10: Add support for CPU-wide trace scenarios")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-11-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-etb10.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -176,6 +176,7 @@ static int etb_enable_perf(struct coresi
+ unsigned long flags;
+ struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+ struct perf_output_handle *handle = data;
++ struct cs_buffers *buf = etm_perf_sink_config(handle);
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+
+@@ -186,7 +187,7 @@ static int etb_enable_perf(struct coresi
+ }
+
+ /* Get a handle on the pid of the process to monitor */
+- pid = task_pid_nr(handle->event->owner);
++ pid = buf->pid;
+
+ if (drvdata->pid != -1 && drvdata->pid != pid) {
+ ret = -EBUSY;
+@@ -383,6 +384,7 @@ static void *etb_alloc_buffer(struct cor
+ if (!buf)
+ return NULL;
+
++ buf->pid = task_pid_nr(event->owner);
+ buf->snapshot = overwrite;
+ buf->nr_pages = nr_pages;
+ buf->data_pages = pages;
--- /dev/null
+From 868663dd5d69fef05bfb004f91da5c30e9b93461 Mon Sep 17 00:00:00 2001
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Date: Fri, 27 Nov 2020 10:52:50 -0700
+Subject: coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+commit 868663dd5d69fef05bfb004f91da5c30e9b93461 upstream.
+
+There was a report of NULL pointer dereference in ETF enable
+path for perf CS mode with PID monitoring. It is almost 100%
+reproducible when the process to monitor is something very
+active such as chrome and with ETF as the sink and not ETR.
+Currently in a bid to find the pid, the owner is dereferenced
+via task_pid_nr() call in tmc_enable_etf_sink_perf() and with
+owner being NULL, we get a NULL pointer dereference.
+
+Looking at the ETR and other places in the kernel, ETF and the
+ETB are the only places trying to dereference the task(owner)
+in tmc_enable_etf_sink_perf() which is also called from the
+sched_in path as in the call trace. Owner(task) is NULL even
+in the case of ETR in tmc_enable_etr_sink_perf(), but since we
+cache the PID in alloc_buffer() callback and it is done as part
+of etm_setup_aux() when allocating buffer for ETR sink, we never
+dereference this NULL pointer and we are safe. So lets do the
+same thing with ETF and cache the PID to which the cs_buffer
+belongs in tmc_alloc_etf_buffer() as done for ETR. This will
+also remove the unnecessary function calls(task_pid_nr()) since
+we are caching the PID.
+
+Easily reproducible running below:
+
+ perf record -e cs_etm/@tmc_etf0/ -N -p <pid>
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548
+Mem abort info:
+ ESR = 0x96000006
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+Data abort info:
+ ISV = 0, ISS = 0x00000006
+ CM = 0, WnR = 0
+<snip>...
+Call trace:
+ tmc_enable_etf_sink+0xe4/0x280
+ coresight_enable_path+0x168/0x1fc
+ etm_event_start+0x8c/0xf8
+ etm_event_add+0x38/0x54
+ event_sched_in+0x194/0x2ac
+ group_sched_in+0x54/0x12c
+ flexible_sched_in+0xd8/0x120
+ visit_groups_merge+0x100/0x16c
+ ctx_flexible_sched_in+0x50/0x74
+ ctx_sched_in+0xa4/0xa8
+ perf_event_sched_in+0x60/0x6c
+ perf_event_context_sched_in+0x98/0xe0
+ __perf_event_task_sched_in+0x5c/0xd8
+ finish_task_switch+0x184/0x1cc
+ schedule_tail+0x20/0xec
+ ret_from_fork+0x4/0x18
+
+Fixes: 880af782c6e8 ("coresight: tmc-etf: Add support for CPU-wide trace scenarios")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-10-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-priv.h | 2 ++
+ drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 +++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-priv.h
++++ b/drivers/hwtracing/coresight/coresight-priv.h
+@@ -86,6 +86,7 @@ enum cs_mode {
+ * struct cs_buffer - keep track of a recording session' specifics
+ * @cur: index of the current buffer
+ * @nr_pages: max number of pages granted to us
++ * @pid: PID this cs_buffer belongs to
+ * @offset: offset within the current buffer
+ * @data_size: how much we collected in this run
+ * @snapshot: is this run in snapshot mode
+@@ -94,6 +95,7 @@ enum cs_mode {
+ struct cs_buffers {
+ unsigned int cur;
+ unsigned int nr_pages;
++ pid_t pid;
+ unsigned long offset;
+ local_t data_size;
+ bool snapshot;
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -227,6 +227,7 @@ static int tmc_enable_etf_sink_perf(stru
+ unsigned long flags;
+ struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+ struct perf_output_handle *handle = data;
++ struct cs_buffers *buf = etm_perf_sink_config(handle);
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+ do {
+@@ -243,7 +244,7 @@ static int tmc_enable_etf_sink_perf(stru
+ }
+
+ /* Get a handle on the pid of the process to monitor */
+- pid = task_pid_nr(handle->event->owner);
++ pid = buf->pid;
+
+ if (drvdata->pid != -1 && drvdata->pid != pid) {
+ ret = -EBUSY;
+@@ -399,6 +400,7 @@ static void *tmc_alloc_etf_buffer(struct
+ if (!buf)
+ return NULL;
+
++ buf->pid = task_pid_nr(event->owner);
+ buf->snapshot = overwrite;
+ buf->nr_pages = nr_pages;
+ buf->data_pages = pages;
--- /dev/null
+From 1cc573d5754e92372a7e30e35468644f8811e1a4 Mon Sep 17 00:00:00 2001
+From: Mao Jinlong <jinlmao@codeaurora.org>
+Date: Fri, 27 Nov 2020 10:52:53 -0700
+Subject: coresight: tmc-etr: Check if page is valid before dma_map_page()
+
+From: Mao Jinlong <jinlmao@codeaurora.org>
+
+commit 1cc573d5754e92372a7e30e35468644f8811e1a4 upstream.
+
+alloc_pages_node() return should be checked before calling
+dma_map_page() to make sure that valid page is mapped or
+else it can lead to aborts as below:
+
+ Unable to handle kernel paging request at virtual address ffffffc008000000
+ Mem abort info:
+ <snip>...
+ pc : __dma_inv_area+0x40/0x58
+ lr : dma_direct_map_page+0xd8/0x1c8
+
+ Call trace:
+ __dma_inv_area
+ tmc_pages_alloc
+ tmc_alloc_data_pages
+ tmc_alloc_sg_table
+ tmc_init_etr_sg_table
+ tmc_alloc_etr_buf
+ tmc_enable_etr_sink_sysfs
+ tmc_enable_etr_sink
+ coresight_enable_path
+ coresight_enable
+ enable_source_store
+ dev_attr_store
+ sysfs_kf_write
+
+Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework")
+Cc: stable@vger.kernel.org
+Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mao Jinlong <jinlmao@codeaurora.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-13-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -217,6 +217,8 @@ static int tmc_pages_alloc(struct tmc_pa
+ } else {
+ page = alloc_pages_node(node,
+ GFP_KERNEL | __GFP_ZERO, 0);
++ if (!page)
++ goto err;
+ }
+ paddr = dma_map_page(real_dev, page, 0, PAGE_SIZE, dir);
+ if (dma_mapping_error(real_dev, paddr))
--- /dev/null
+From 83be0b84fe846edf0c722fefe225482d5f0d7395 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Tue, 8 Dec 2020 11:26:49 -0700
+Subject: coresight: tmc-etr: Fix barrier packet insertion for perf buffer
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit 83be0b84fe846edf0c722fefe225482d5f0d7395 upstream.
+
+When the ETR is used in perf mode with a larger buffer (configured
+via sysfs or the default size of 1M) than the perf aux buffer size,
+we end up inserting the barrier packet at the wrong offset, while
+moving the offset forward. i.e, instead of the "new moved offset",
+we insert it at the current hardware buffer offset. These packets
+will not be visible as they are never copied and could lead to
+corruption in the trace decoding side, as the decoder is not aware
+that it needs to reset the decoding.
+
+Fixes: ec13c78d7b45 ("coresight: tmc-etr: Add barrier packets when moving offset forward")
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: stable@vger.kernel.org
+Reported-by: Al Grant <al.grant@arm.com>
+Tested-by: Mike Leach <mike.leach@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201208182651.1597945-2-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -1535,7 +1535,7 @@ tmc_update_etr_buffer(struct coresight_d
+
+ /* Insert barrier packets at the beginning, if there was an overflow */
+ if (lost)
+- tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset);
++ tmc_etr_buf_insert_barrier_packet(etr_buf, offset);
+ tmc_etr_sync_perf_buffer(etr_perf, offset, size);
+
+ /*
drm-amd-display-init-clock-value-by-current-vbios-cl.patch
perf-x86-intel-check-pebs-status-correctly.patch
kbuild-avoid-split-lines-in-.mod-files.patch
+soc-tegra-fuse-fix-index-bug-in-get_process_id.patch
+usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch
+usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch
+usb-gadget-f_acm-add-support-for-superspeed-plus.patch
+usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch
+usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch
+usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch
+usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch
+arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch
+arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch
+arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch
+coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch
+coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch
+coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch
+coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch
--- /dev/null
+From b9ce9b0f83b536a4ac7de7567a265d28d13e5bea Mon Sep 17 00:00:00 2001
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+Date: Wed, 18 Nov 2020 20:44:57 -0800
+Subject: soc/tegra: fuse: Fix index bug in get_process_id
+
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+
+commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream.
+
+This patch simply fixes a bug of referencing speedos[num] in every
+for-loop iteration in get_process_id function.
+
+Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
++++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
+@@ -94,7 +94,7 @@ static int get_process_id(int value, con
+ unsigned int i;
+
+ for (i = 0; i < num; i++)
+- if (value < speedos[num])
++ if (value < speedos[i])
+ return i;
+
+ return -EINVAL;
--- /dev/null
+From c7721e15f434920145c376e8fe77e1c079fc3726 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Mon, 7 Dec 2020 10:09:09 +0800
+Subject: usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream.
+
+According to the i.MX6UL Errata document:
+https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf
+
+ERR007881 also affects i.MX6UL, so pass the
+CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue.
+
+Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -57,7 +57,8 @@ static const struct ci_hdrc_imx_platform
+
+ static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = {
+ .flags = CI_HDRC_SUPPORTS_RUNTIME_PM |
+- CI_HDRC_TURN_VBUS_EARLY_ON,
++ CI_HDRC_TURN_VBUS_EARLY_ON |
++ CI_HDRC_DISABLE_DEVICE_STREAMING,
+ };
+
+ static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {
--- /dev/null
+From 3ee05c20656782387aa9eb010fdb9bb16982ac3f Mon Sep 17 00:00:00 2001
+From: "taehyun.cho" <taehyun.cho@samsung.com>
+Date: Fri, 27 Nov 2020 15:05:56 +0100
+Subject: USB: gadget: f_acm: add support for SuperSpeed Plus
+
+From: taehyun.cho <taehyun.cho@samsung.com>
+
+commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream.
+
+Setup the SuperSpeed Plus descriptors for f_acm. This allows the gadget
+to work properly without crashing at SuperSpeed rates.
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: taehyun.cho <taehyun.cho@samsung.com>
+Signed-off-by: Will McVicker <willmcvicker@google.com>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201127140559.381351-3-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_acm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_acm.c
++++ b/drivers/usb/gadget/function/f_acm.c
+@@ -684,7 +684,7 @@ acm_bind(struct usb_configuration *c, st
+ acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
+- acm_ss_function, NULL);
++ acm_ss_function, acm_ss_function);
+ if (status)
+ goto fail;
+
--- /dev/null
+From a353397b0d5dfa3c99b372505db3378fc919c6c6 Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Tue, 27 Oct 2020 16:07:31 -0700
+Subject: usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit a353397b0d5dfa3c99b372505db3378fc919c6c6 upstream.
+
+In many cases a function that supports SuperSpeed can very well
+operate in SuperSpeedPlus, if a gadget controller supports it,
+as the endpoint descriptors (and companion descriptors) are
+generally identical and can be re-used. This is true for two
+commonly used functions: Android's ADB and MTP. So we can simply
+assign the usb_function's ssp_descriptors array to point to its
+ss_descriptors, if available. Similarly, we need to allow an
+epfile's ioctl for FUNCTIONFS_ENDPOINT_DESC to correctly
+return the corresponding SuperSpeed endpoint descriptor in case
+the connected speed is SuperSpeedPlus as well.
+
+The only exception is if a function wants to implement an
+Isochronous endpoint capable of transferring more than 48KB per
+service interval when operating at greater than USB 3.1 Gen1
+speed, in which case it would require an additional SuperSpeedPlus
+Isochronous Endpoint Companion descriptor to be returned as part
+of the Configuration Descriptor. Support for that would need
+to be separately added to the userspace-facing FunctionFS API
+which may not be a trivial task--likely a new descriptor format
+(v3?) may need to be devised to allow for separate SS and SSP
+descriptors to be supplied.
+
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201027230731.9073-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1332,6 +1332,7 @@ static long ffs_epfile_ioctl(struct file
+
+ switch (epfile->ffs->gadget->speed) {
+ case USB_SPEED_SUPER:
++ case USB_SPEED_SUPER_PLUS:
+ desc_idx = 2;
+ break;
+ case USB_SPEED_HIGH:
+@@ -3193,7 +3194,8 @@ static int _ffs_func_bind(struct usb_con
+ }
+
+ if (likely(super)) {
+- func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
++ func->function.ss_descriptors = func->function.ssp_descriptors =
++ vla_ptr(vlabuf, d, ss_descs);
+ ss_len = ffs_do_descs(ffs->ss_descs_count,
+ vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
+ d_raw_descs__sz - fs_len - hs_len,
+@@ -3603,6 +3605,7 @@ static void ffs_func_unbind(struct usb_c
+ func->function.fs_descriptors = NULL;
+ func->function.hs_descriptors = NULL;
+ func->function.ss_descriptors = NULL;
++ func->function.ssp_descriptors = NULL;
+ func->interfaces_nums = NULL;
+
+ ffs_event_add(ffs, FUNCTIONFS_UNBIND);
--- /dev/null
+From 457a902ba1a73b7720666b21ca038cd19764db18 Mon Sep 17 00:00:00 2001
+From: Will McVicker <willmcvicker@google.com>
+Date: Fri, 27 Nov 2020 15:05:57 +0100
+Subject: USB: gadget: f_midi: setup SuperSpeed Plus descriptors
+
+From: Will McVicker <willmcvicker@google.com>
+
+commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream.
+
+Needed for SuperSpeed Plus support for f_midi. This allows the
+gadget to work properly without crashing at SuperSpeed rates.
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Will McVicker <willmcvicker@google.com>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_midi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_midi.c
++++ b/drivers/usb/gadget/function/f_midi.c
+@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config
+ f->ss_descriptors = usb_copy_descriptors(midi_function);
+ if (!f->ss_descriptors)
+ goto fail_f_midi;
++
++ if (gadget_is_superspeed_plus(c->cdev->gadget)) {
++ f->ssp_descriptors = usb_copy_descriptors(midi_function);
++ if (!f->ssp_descriptors)
++ goto fail_f_midi;
++ }
+ }
+
+ kfree(midi_function);
--- /dev/null
+From b00f444f9add39b64d1943fa75538a1ebd54a290 Mon Sep 17 00:00:00 2001
+From: Will McVicker <willmcvicker@google.com>
+Date: Fri, 27 Nov 2020 15:05:55 +0100
+Subject: USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
+
+From: Will McVicker <willmcvicker@google.com>
+
+commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream.
+
+Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate
+defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors
+for CDC NCM").
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: EJ Hsu <ejh@nvidia.com>
+Cc: Peter Chen <peter.chen@nxp.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Will McVicker <willmcvicker@google.com>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_rndis.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_rndis.c
++++ b/drivers/usb/gadget/function/f_rndis.c
+@@ -87,8 +87,10 @@ static inline struct f_rndis *func_to_rn
+ /* peak (theoretical) bulk transfer rate in bits-per-second */
+ static unsigned int bitrate(struct usb_gadget *g)
+ {
++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
++ return 4250000000U;
+ if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
+- return 13 * 1024 * 8 * 1000 * 8;
++ return 3750000000U;
+ else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+ return 13 * 512 * 8 * 1000 * 8;
+ else
--- /dev/null
+From 3f6f6343a29d9ea7429306b83b18e66dc1331d5c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 3 Dec 2020 11:41:13 +0300
+Subject: usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3f6f6343a29d9ea7429306b83b18e66dc1331d5c upstream.
+
+This code is using the wrong sizeof() so it does not allocate enough
+memory. It allocates 32 bytes but 72 are required. That will lead to
+memory corruption.
+
+Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X8ikqc4Mo2/0G72j@mwanda
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/mtu3/mtu3_debugfs.c
++++ b/drivers/usb/mtu3/mtu3_debugfs.c
+@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct m
+ struct debugfs_regset32 *regset;
+ struct mtu3_regset *mregs;
+
+- mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
++ mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
+ if (!mregs)
+ return;
+
--- /dev/null
+From a251963f76fa0226d0fdf0c4f989496f18d9ae7f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 9 Dec 2020 11:42:21 +0100
+Subject: USB: serial: option: add interface-number sanity check to flag handling
+
+From: Johan Hovold <johan@kernel.org>
+
+commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream.
+
+Add an interface-number sanity check before testing the device flags to
+avoid relying on undefined behaviour when left shifting in case a device
+uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64
+or 32).
+
+Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
+Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking")
+Cc: stable@vger.kernel.org
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -563,6 +563,9 @@ static void option_instat_callback(struc
+
+ /* Device flags */
+
++/* Highest interface number which can be used with NCTRL() and RSVD() */
++#define FLAG_IFNUM_MAX 7
++
+ /* Interface does not support modem-control requests */
+ #define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8)
+
+@@ -2101,6 +2104,14 @@ static struct usb_serial_driver * const
+
+ module_usb_serial_driver(serial_drivers, option_ids);
+
++static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
++{
++ if (ifnum > FLAG_IFNUM_MAX)
++ return false;
++
++ return device_flags & RSVD(ifnum);
++}
++
+ static int option_probe(struct usb_serial *serial,
+ const struct usb_device_id *id)
+ {
+@@ -2117,7 +2128,7 @@ static int option_probe(struct usb_seria
+ * the same class/subclass/protocol as the serial interfaces. Look at
+ * the Windows driver .INF files for reserved interface numbers.
+ */
+- if (device_flags & RSVD(iface_desc->bInterfaceNumber))
++ if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
+ return -ENODEV;
+
+ /*
+@@ -2133,6 +2144,14 @@ static int option_probe(struct usb_seria
+ return 0;
+ }
+
++static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
++{
++ if (ifnum > FLAG_IFNUM_MAX)
++ return false;
++
++ return device_flags & NCTRL(ifnum);
++}
++
+ static int option_attach(struct usb_serial *serial)
+ {
+ struct usb_interface_descriptor *iface_desc;
+@@ -2148,7 +2167,7 @@ static int option_attach(struct usb_seri
+
+ iface_desc = &serial->interface->cur_altsetting->desc;
+
+- if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
++ if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
+ data->use_send_setup = 1;
+
+ if (device_flags & ZLP)
projects / thirdparty / kernel / stable-queue.git / commitdiff
