--- /dev/null
+From c5e58c4545a69677d078b4c813b5d10d3481be9c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 5 Jul 2022 17:23:36 +0200
+Subject: ALSA: cs46xx: Fix missing snd_card_free() call at probe error
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c5e58c4545a69677d078b4c813b5d10d3481be9c upstream.
+
+The previous cleanup with devres may lead to the incorrect release
+orders at the probe error handling due to the devres's nature. Until
+we register the card, snd_card_free() has to be called at first for
+releasing the stuff properly when the driver tries to manage and
+release the stuff via card->private_free().
+
+This patch fixes it by calling snd_card_free() manually on the error
+from the probe callback.
+
+Fixes: 5bff69b3645d ("ALSA: cs46xx: Allocate resources with device-managed APIs")
+Cc: <stable@vger.kernel.org>
+Reported-and-tested-by: Jan Engelhardt <jengelh@inai.de>
+Link: https://lore.kernel.org/r/p2p1s96o-746-74p4-s95-61qo1p7782pn@vanv.qr
+Link: https://lore.kernel.org/r/20220705152336.350-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/cs46xx/cs46xx.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+--- a/sound/pci/cs46xx/cs46xx.c
++++ b/sound/pci/cs46xx/cs46xx.c
+@@ -74,36 +74,36 @@ static int snd_card_cs46xx_probe(struct
+ err = snd_cs46xx_create(card, pci,
+ external_amp[dev], thinkpad[dev]);
+ if (err < 0)
+- return err;
++ goto error;
+ card->private_data = chip;
+ chip->accept_valid = mmap_valid[dev];
+ err = snd_cs46xx_pcm(chip, 0);
+ if (err < 0)
+- return err;
++ goto error;
+ #ifdef CONFIG_SND_CS46XX_NEW_DSP
+ err = snd_cs46xx_pcm_rear(chip, 1);
+ if (err < 0)
+- return err;
++ goto error;
+ err = snd_cs46xx_pcm_iec958(chip, 2);
+ if (err < 0)
+- return err;
++ goto error;
+ #endif
+ err = snd_cs46xx_mixer(chip, 2);
+ if (err < 0)
+- return err;
++ goto error;
+ #ifdef CONFIG_SND_CS46XX_NEW_DSP
+ if (chip->nr_ac97_codecs ==2) {
+ err = snd_cs46xx_pcm_center_lfe(chip, 3);
+ if (err < 0)
+- return err;
++ goto error;
+ }
+ #endif
+ err = snd_cs46xx_midi(chip, 0);
+ if (err < 0)
+- return err;
++ goto error;
+ err = snd_cs46xx_start_dsp(chip);
+ if (err < 0)
+- return err;
++ goto error;
+
+ snd_cs46xx_gameport(chip);
+
+@@ -117,11 +117,15 @@ static int snd_card_cs46xx_probe(struct
+
+ err = snd_card_register(card);
+ if (err < 0)
+- return err;
++ goto error;
+
+ pci_set_drvdata(pci, card);
+ dev++;
+ return 0;
++
++ error:
++ snd_card_free(card);
++ return err;
+ }
+
+ static struct pci_driver cs46xx_driver = {
--- /dev/null
+From 11bea26929a1a3a9dd1a287b60c2f471701bf706 Mon Sep 17 00:00:00 2001
+From: Tim Crawford <tcrawford@system76.com>
+Date: Fri, 24 Jun 2022 08:41:09 -0600
+Subject: ALSA: hda/realtek: Add quirk for Clevo L140PU
+
+From: Tim Crawford <tcrawford@system76.com>
+
+commit 11bea26929a1a3a9dd1a287b60c2f471701bf706 upstream.
+
+Fixes headset detection on Clevo L140PU.
+
+Signed-off-by: Tim Crawford <tcrawford@system76.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220624144109.3957-1-tcrawford@system76.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9001,6 +9001,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1558, 0x70f4, "Clevo NH77EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70f6, "Clevo NH77DPQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x7716, "Clevo NS50PU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x7718, "Clevo L140PU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
--- /dev/null
+From ae8b1631561a3634cc09d0c62bbdd938eade05ec Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 24 Jun 2022 12:11:32 +0200
+Subject: ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ae8b1631561a3634cc09d0c62bbdd938eade05ec upstream.
+
+Both Behringer UMC 202 HD and 404 HD need explicit quirks to enable
+the implicit feedback mode and start the playback stream primarily.
+The former seems fixing the stuttering and the latter is required for
+a playback-only case.
+
+Note that the "clock source 41 is not valid" error message still
+appears even after this fix, but it should be only once at probe.
+The reason of the error is still unknown, but this seems to be mostly
+harmless as it's a one-off error and the driver retires the clock
+setup and it succeeds afterwards.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215934
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220624101132.14528-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1842,6 +1842,10 @@ static const struct usb_audio_quirk_flag
+ QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
+ DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */
+ QUIRK_FLAG_GET_SAMPLE_RATE),
++ DEVICE_FLG(0x1397, 0x0508, /* Behringer UMC204HD */
++ QUIRK_FLAG_PLAYBACK_FIRST | QUIRK_FLAG_GENERIC_IMPLICIT_FB),
++ DEVICE_FLG(0x1397, 0x0509, /* Behringer UMC404HD */
++ QUIRK_FLAG_PLAYBACK_FIRST | QUIRK_FLAG_GENERIC_IMPLICIT_FB),
+ DEVICE_FLG(0x13e5, 0x0001, /* Serato Phono */
+ QUIRK_FLAG_IGNORE_CTL_ERROR),
+ DEVICE_FLG(0x154e, 0x1002, /* Denon DCD-1500RE */
--- /dev/null
+From f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Fri, 20 May 2022 20:32:39 +0200
+Subject: can: bcm: use call_rcu() instead of costly synchronize_rcu()
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 upstream.
+
+In commit d5f9023fa61e ("can: bcm: delay release of struct bcm_op
+after synchronize_rcu()") Thadeu Lima de Souza Cascardo introduced two
+synchronize_rcu() calls in bcm_release() (only once at socket close)
+and in bcm_delete_rx_op() (called on removal of each single bcm_op).
+
+Unfortunately this slow removal of the bcm_op's affects user space
+applications like cansniffer where the modification of a filter
+removes 2048 bcm_op's which blocks the cansniffer application for
+40(!) seconds.
+
+In commit 181d4447905d ("can: gw: use call_rcu() instead of costly
+synchronize_rcu()") Eric Dumazet replaced the synchronize_rcu() calls
+with several call_rcu()'s to safely remove the data structures after
+the removal of CAN ID subscriptions with can_rx_unregister() calls.
+
+This patch adopts Erics approach for the can-bcm which should be
+applicable since the removal of tasklet_kill() in bcm_remove_op() and
+the introduction of the HRTIMER_MODE_SOFT timer handling in Linux 5.4.
+
+Fixes: d5f9023fa61e ("can: bcm: delay release of struct bcm_op after synchronize_rcu()") # >= 5.4
+Link: https://lore.kernel.org/all/20220520183239.19111-1-socketcan@hartkopp.net
+Cc: stable@vger.kernel.org
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Norbert Slusarek <nslusarek@gmx.net>
+Cc: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/bcm.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -100,6 +100,7 @@ static inline u64 get_u64(const struct c
+
+ struct bcm_op {
+ struct list_head list;
++ struct rcu_head rcu;
+ int ifindex;
+ canid_t can_id;
+ u32 flags;
+@@ -718,10 +719,9 @@ static struct bcm_op *bcm_find_op(struct
+ return NULL;
+ }
+
+-static void bcm_remove_op(struct bcm_op *op)
++static void bcm_free_op_rcu(struct rcu_head *rcu_head)
+ {
+- hrtimer_cancel(&op->timer);
+- hrtimer_cancel(&op->thrtimer);
++ struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
+
+ if ((op->frames) && (op->frames != &op->sframe))
+ kfree(op->frames);
+@@ -732,6 +732,14 @@ static void bcm_remove_op(struct bcm_op
+ kfree(op);
+ }
+
++static void bcm_remove_op(struct bcm_op *op)
++{
++ hrtimer_cancel(&op->timer);
++ hrtimer_cancel(&op->thrtimer);
++
++ call_rcu(&op->rcu, bcm_free_op_rcu);
++}
++
+ static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)
+ {
+ if (op->rx_reg_dev == dev) {
+@@ -757,6 +765,9 @@ static int bcm_delete_rx_op(struct list_
+ if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
+ (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME)) {
+
++ /* disable automatic timer on frame reception */
++ op->flags |= RX_NO_AUTOTIMER;
++
+ /*
+ * Don't care if we're bound or not (due to netdev
+ * problems) can_rx_unregister() is always a save
+@@ -785,7 +796,6 @@ static int bcm_delete_rx_op(struct list_
+ bcm_rx_handler, op);
+
+ list_del(&op->list);
+- synchronize_rcu();
+ bcm_remove_op(op);
+ return 1; /* done */
+ }
--- /dev/null
+From 562fed945ea482833667f85496eeda766d511386 Mon Sep 17 00:00:00 2001
+From: Liang He <windhl@126.com>
+Date: Sun, 19 Jun 2022 15:02:57 +0800
+Subject: can: grcan: grcan_probe(): remove extra of_node_get()
+
+From: Liang He <windhl@126.com>
+
+commit 562fed945ea482833667f85496eeda766d511386 upstream.
+
+In grcan_probe(), of_find_node_by_path() has already increased the
+refcount. There is no need to call of_node_get() again, so remove it.
+
+Link: https://lore.kernel.org/all/20220619070257.4067022-1-windhl@126.com
+Fixes: 1e93ed26acf0 ("can: grcan: grcan_probe(): fix broken system id check for errata workaround needs")
+Cc: stable@vger.kernel.org # v5.18
+Cc: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Liang He <windhl@126.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/grcan.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/can/grcan.c
++++ b/drivers/net/can/grcan.c
+@@ -1659,7 +1659,6 @@ static int grcan_probe(struct platform_d
+ */
+ sysid_parent = of_find_node_by_path("/ambapp0");
+ if (sysid_parent) {
+- of_node_get(sysid_parent);
+ err = of_property_read_u32(sysid_parent, "systemid", &sysid);
+ if (!err && ((sysid & GRLIB_VERSION_MASK) >=
+ GRCAN_TXBUG_SAFE_GRLIB_VERSION))
--- /dev/null
+From 2bda24ef95c0311ab93bda00db40486acf30bd0a Mon Sep 17 00:00:00 2001
+From: Rhett Aultman <rhett.aultman@samsara.com>
+Date: Sun, 3 Jul 2022 19:33:06 +0200
+Subject: can: gs_usb: gs_usb_open/close(): fix memory leak
+
+From: Rhett Aultman <rhett.aultman@samsara.com>
+
+commit 2bda24ef95c0311ab93bda00db40486acf30bd0a upstream.
+
+The gs_usb driver appears to suffer from a malady common to many USB
+CAN adapter drivers in that it performs usb_alloc_coherent() to
+allocate a number of USB request blocks (URBs) for RX, and then later
+relies on usb_kill_anchored_urbs() to free them, but this doesn't
+actually free them. As a result, this may be leaking DMA memory that's
+been used by the driver.
+
+This commit is an adaptation of the techniques found in the esd_usb2
+driver where a similar design pattern led to a memory leak. It
+explicitly frees the RX URBs and their DMA memory via a call to
+usb_free_coherent(). Since the RX URBs were allocated in the
+gs_can_open(), we remove them in gs_can_close() rather than in the
+disconnect function as was done in esd_usb2.
+
+For more information, see the 928150fad41b ("can: esd_usb2: fix memory
+leak").
+
+Link: https://lore.kernel.org/all/alpine.DEB.2.22.394.2206031547001.1630869@thelappy
+Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rhett Aultman <rhett.aultman@samsara.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/gs_usb.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -185,6 +185,8 @@ struct gs_can {
+
+ struct usb_anchor tx_submitted;
+ atomic_t active_tx_urbs;
++ void *rxbuf[GS_MAX_RX_URBS];
++ dma_addr_t rxbuf_dma[GS_MAX_RX_URBS];
+ };
+
+ /* usb interface struct */
+@@ -594,6 +596,7 @@ static int gs_can_open(struct net_device
+ for (i = 0; i < GS_MAX_RX_URBS; i++) {
+ struct urb *urb;
+ u8 *buf;
++ dma_addr_t buf_dma;
+
+ /* alloc rx urb */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -604,7 +607,7 @@ static int gs_can_open(struct net_device
+ buf = usb_alloc_coherent(dev->udev,
+ sizeof(struct gs_host_frame),
+ GFP_KERNEL,
+- &urb->transfer_dma);
++ &buf_dma);
+ if (!buf) {
+ netdev_err(netdev,
+ "No memory left for USB buffer\n");
+@@ -612,6 +615,8 @@ static int gs_can_open(struct net_device
+ return -ENOMEM;
+ }
+
++ urb->transfer_dma = buf_dma;
++
+ /* fill, anchor, and submit rx urb */
+ usb_fill_bulk_urb(urb,
+ dev->udev,
+@@ -635,10 +640,17 @@ static int gs_can_open(struct net_device
+ rc);
+
+ usb_unanchor_urb(urb);
++ usb_free_coherent(dev->udev,
++ sizeof(struct gs_host_frame),
++ buf,
++ buf_dma);
+ usb_free_urb(urb);
+ break;
+ }
+
++ dev->rxbuf[i] = buf;
++ dev->rxbuf_dma[i] = buf_dma;
++
+ /* Drop reference,
+ * USB core will take care of freeing it
+ */
+@@ -703,13 +715,20 @@ static int gs_can_close(struct net_devic
+ int rc;
+ struct gs_can *dev = netdev_priv(netdev);
+ struct gs_usb *parent = dev->parent;
++ unsigned int i;
+
+ netif_stop_queue(netdev);
+
+ /* Stop polling */
+ parent->active_channels--;
+- if (!parent->active_channels)
++ if (!parent->active_channels) {
+ usb_kill_anchored_urbs(&parent->rx_submitted);
++ for (i = 0; i < GS_MAX_RX_URBS; i++)
++ usb_free_coherent(dev->udev,
++ sizeof(struct gs_host_frame),
++ dev->rxbuf[i],
++ dev->rxbuf_dma[i]);
++ }
+
+ /* Stop sending URBs */
+ usb_kill_anchored_urbs(&dev->tx_submitted);
--- /dev/null
+From 4c3333693f07313f5f0145a922f14a7d3c0f4f21 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Mon, 30 May 2022 19:30:28 +0200
+Subject: can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 4c3333693f07313f5f0145a922f14a7d3c0f4f21 upstream.
+
+In commit 1be37d3b0414 ("can: m_can: fix periph RX path: use
+rx-offload to ensure skbs are sent from softirq context") the RX path
+for peripheral devices was switched to RX-offload.
+
+Received CAN frames are pushed to RX-offload together with a
+timestamp. RX-offload is designed to handle overflows of the timestamp
+correctly, if 32 bit timestamps are provided.
+
+The timestamps of m_can core are only 16 bits wide. So this patch
+shifts them to full 32 bit before passing them to RX-offload.
+
+Link: https://lore.kernel.org/all/20220612211410.4081390-1-mkl@pengutronix.de
+Fixes: 1be37d3b0414 ("can: m_can: fix periph RX path: use rx-offload to ensure skbs are sent from softirq context")
+Cc: <stable@vger.kernel.org> # 5.13
+Cc: Torin Cooper-Bennun <torin@maxiluxsystems.com>
+Reviewed-by: Chandrasekar Ramakrishnan <rcsekar@samsung.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -532,7 +532,7 @@ static int m_can_read_fifo(struct net_de
+ stats->rx_packets++;
+ stats->rx_bytes += cf->len;
+
+- timestamp = FIELD_GET(RX_BUF_RXTS_MASK, fifo_header.dlc);
++ timestamp = FIELD_GET(RX_BUF_RXTS_MASK, fifo_header.dlc) << 16;
+
+ m_can_receive_skb(cdev, skb, timestamp);
+
+@@ -1043,7 +1043,7 @@ static int m_can_echo_tx_event(struct ne
+ }
+
+ msg_mark = FIELD_GET(TX_EVENT_MM_MASK, txe);
+- timestamp = FIELD_GET(TX_EVENT_TXTS_MASK, txe);
++ timestamp = FIELD_GET(TX_EVENT_TXTS_MASK, txe) << 16;
+
+ /* ack txe element */
+ m_can_write(cdev, M_CAN_TXEFA, FIELD_PREP(TXEFA_EFAI_MASK,
--- /dev/null
+From 5b12933de4e76ec164031c18ce8e0904abf530d7 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Mon, 23 May 2022 17:18:33 +0200
+Subject: can: m_can: m_can_chip_config(): actually enable internal timestamping
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 5b12933de4e76ec164031c18ce8e0904abf530d7 upstream.
+
+In commit df06fd678260 ("can: m_can: m_can_chip_config(): enable and
+configure internal timestamps") the timestamping in the m_can core
+should be enabled. In peripheral mode, the RX'ed CAN frames, TX
+compete frames and error events are sorted by the timestamp.
+
+The above mentioned commit however forgot to enable the timestamping.
+Add the missing bits to enable the timestamp counter to the write of
+the Timestamp Counter Configuration register.
+
+Link: https://lore.kernel.org/all/20220612212708.4081756-1-mkl@pengutronix.de
+Fixes: df06fd678260 ("can: m_can: m_can_chip_config(): enable and configure internal timestamps")
+Cc: <stable@vger.kernel.org> # 5.13
+Cc: Torin Cooper-Bennun <torin@maxiluxsystems.com>
+Reviewed-by: Chandrasekar Ramakrishnan <rcsekar@samsung.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1367,7 +1367,9 @@ static void m_can_chip_config(struct net
+ /* enable internal timestamp generation, with a prescalar of 16. The
+ * prescalar is applied to the nominal bit timing
+ */
+- m_can_write(cdev, M_CAN_TSCC, FIELD_PREP(TSCC_TCP_MASK, 0xf));
++ m_can_write(cdev, M_CAN_TSCC,
++ FIELD_PREP(TSCC_TCP_MASK, 0xf) |
++ FIELD_PREP(TSCC_TSS_MASK, TSCC_TSS_INTERNAL));
+
+ m_can_config_endisable(cdev, false);
+
--- /dev/null
+From 406cc9cdb3e8d644b15e8028948f091b82abdbca Mon Sep 17 00:00:00 2001
+From: Thomas Kopp <thomas.kopp@microchip.com>
+Date: Tue, 21 Dec 2021 22:24:52 +0000
+Subject: can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd
+
+From: Thomas Kopp <thomas.kopp@microchip.com>
+
+commit 406cc9cdb3e8d644b15e8028948f091b82abdbca upstream.
+
+The mcp251xfd compatible chips have an erratum ([1], [2]), where the
+received CRC doesn't match the calculated CRC. In commit
+c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work
+around broken CRC on TBC register") the following workaround was
+implementierend.
+
+- If a CRC read error on the TBC register is detected and the first
+ byte is 0x00 or 0x80, the most significant bit of the first byte is
+ flipped and the CRC is calculated again.
+- If the CRC now matches, the _original_ data is passed to the reader.
+ For now we assume transferred data was OK.
+
+Measurements on the mcp2517fd show that the workaround is applicable
+not only of the lowest byte is 0x00 or 0x80, but also if 3 least
+significant bits are set.
+
+Update check on 1st data byte and workaround description accordingly.
+
+[1] mcp2517fd: DS80000792C: "Incorrect CRC for certain READ_CRC commands"
+[2] mcp2518fd: DS80000789C: "Incorrect CRC for certain READ_CRC commands"
+
+Link: https://lore.kernel.org/all/DM4PR11MB53901D49578FE265B239E55AFB7C9@DM4PR11MB5390.namprd11.prod.outlook.com
+Fixes: c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work around broken CRC on TBC register")
+Cc: stable@vger.kernel.org
+Reported-by: Pavel Modilaynen <pavel.modilaynen@volvocars.com>
+Signed-off-by: Thomas Kopp <thomas.kopp@microchip.com>
+[mkl: split into 2 patches, update patch description and documentation]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
+@@ -325,10 +325,12 @@ mcp251xfd_regmap_crc_read(void *context,
+ * register. It increments once per SYS clock tick,
+ * which is 20 or 40 MHz.
+ *
+- * Observation shows that if the lowest byte (which is
+- * transferred first on the SPI bus) of that register
+- * is 0x00 or 0x80 the calculated CRC doesn't always
+- * match the transferred one.
++ * Observation on the mcp2518fd shows that if the
++ * lowest byte (which is transferred first on the SPI
++ * bus) of that register is 0x00 or 0x80 the
++ * calculated CRC doesn't always match the transferred
++ * one. On the mcp2517fd this problem is not limited
++ * to the first byte being 0x00 or 0x80.
+ *
+ * If the highest bit in the lowest byte is flipped
+ * the transferred CRC matches the calculated one. We
+@@ -337,7 +339,8 @@ mcp251xfd_regmap_crc_read(void *context,
+ * correct.
+ */
+ if (reg == MCP251XFD_REG_TBC &&
+- (buf_rx->data[0] == 0x0 || buf_rx->data[0] == 0x80)) {
++ ((buf_rx->data[0] & 0xf8) == 0x0 ||
++ (buf_rx->data[0] & 0xf8) == 0x80)) {
+ /* Flip highest bit in lowest byte of le32 */
+ buf_rx->data[0] ^= 0x80;
+
--- /dev/null
+From e3d4ee7d5f7f5256dfe89219afcc7a2d553b731f Mon Sep 17 00:00:00 2001
+From: Thomas Kopp <thomas.kopp@microchip.com>
+Date: Tue, 21 Dec 2021 22:24:52 +0000
+Subject: can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register
+
+From: Thomas Kopp <thomas.kopp@microchip.com>
+
+commit e3d4ee7d5f7f5256dfe89219afcc7a2d553b731f upstream.
+
+The mcp251xfd compatible chips have an erratum ([1], [2]), where the
+received CRC doesn't match the calculated CRC. In commit
+c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work
+around broken CRC on TBC register") the following workaround was
+implementierend.
+
+- If a CRC read error on the TBC register is detected and the first
+ byte is 0x00 or 0x80, the most significant bit of the first byte is
+ flipped and the CRC is calculated again.
+- If the CRC now matches, the _original_ data is passed to the reader.
+ For now we assume transferred data was OK.
+
+New investigations and simulations indicate that the CRC send by the
+device is calculated on correct data, and the data is incorrectly
+received by the SPI host controller.
+
+Use flipped instead of original data and update workaround description
+in mcp251xfd_regmap_crc_read().
+
+[1] mcp2517fd: DS80000792C: "Incorrect CRC for certain READ_CRC commands"
+[2] mcp2518fd: DS80000789C: "Incorrect CRC for certain READ_CRC commands"
+
+Link: https://lore.kernel.org/all/DM4PR11MB53901D49578FE265B239E55AFB7C9@DM4PR11MB5390.namprd11.prod.outlook.com
+Fixes: c7eb923c3caf ("can: mcp251xfd: mcp251xfd_regmap_crc_read(): work around broken CRC on TBC register")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Kopp <thomas.kopp@microchip.com>
+[mkl: split into 2 patches, update patch description and documentation]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
+@@ -334,9 +334,8 @@ mcp251xfd_regmap_crc_read(void *context,
+ *
+ * If the highest bit in the lowest byte is flipped
+ * the transferred CRC matches the calculated one. We
+- * assume for now the CRC calculation in the chip
+- * works on wrong data and the transferred data is
+- * correct.
++ * assume for now the CRC operates on the correct
++ * data.
+ */
+ if (reg == MCP251XFD_REG_TBC &&
+ ((buf_rx->data[0] & 0xf8) == 0x0 ||
+@@ -350,10 +349,8 @@ mcp251xfd_regmap_crc_read(void *context,
+ val_len);
+ if (!err) {
+ /* If CRC is now correct, assume
+- * transferred data was OK, flip bit
+- * back to original value.
++ * flipped data is OK.
+ */
+- buf_rx->data[0] ^= 0x80;
+ goto out;
+ }
+ }
mm-slub-add-missing-tid-updates-on-slab-deactivation.patch
mm-filemap-fix-uaf-in-find_lock_entries.patch
revert-selftests-bpf-add-test-for-bpf_timer-overwriting-crash.patch
+alsa-usb-audio-workarounds-for-behringer-umc-204-404-hd.patch
+alsa-hda-realtek-add-quirk-for-clevo-l140pu.patch
+alsa-cs46xx-fix-missing-snd_card_free-call-at-probe-error.patch
+can-bcm-use-call_rcu-instead-of-costly-synchronize_rcu.patch
+can-grcan-grcan_probe-remove-extra-of_node_get.patch
+can-gs_usb-gs_usb_open-close-fix-memory-leak.patch
+can-m_can-m_can_chip_config-actually-enable-internal-timestamping.patch
+can-m_can-m_can_-read_fifo-echo_tx_event-shift-timestamp-to-full-32-bits.patch
+can-mcp251xfd-mcp251xfd_regmap_crc_read-improve-workaround-handling-for-mcp2517fd.patch
+can-mcp251xfd-mcp251xfd_regmap_crc_read-update-workaround-broken-crc-on-tbc-register.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
