--- /dev/null
+From 8512fbb64b0e599412da661412d10d4ba1cb003c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michal=20Vok=C3=A1=C4=8D?= <michal.vokac@ysoft.com>
+Date: Tue, 23 Jul 2024 16:25:19 +0200
+Subject: ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Vokáč <michal.vokac@ysoft.com>
+
+commit 8512fbb64b0e599412da661412d10d4ba1cb003c upstream.
+
+On the imx6dl-yapp4 revision based boards, the RGB LED is not driven
+directly by the LP5562 driver but through FET transistors. Hence the LED
+current is not determined by the driver but by the LED series resistors.
+
+On the imx6dl-yapp43 revision based boards, we removed the FET transistors
+to drive the LED directly from the LP5562 but forgot to tune the output
+current to match the previous HW design.
+
+Set the LED current on imx6dl-yapp43 based boards to the same values
+measured on the imx6dl-yapp4 boards and limit the maximum current to 20mA.
+
+Fixes: 7da4734751e0 ("ARM: dts: imx6dl-yapp43: Add support for new HW revision of the IOTA board")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi
+@@ -274,24 +274,24 @@
+
+ led@0 {
+ chan-name = "R";
+- led-cur = /bits/ 8 <0x20>;
+- max-cur = /bits/ 8 <0x60>;
++ led-cur = /bits/ 8 <0x6e>;
++ max-cur = /bits/ 8 <0xc8>;
+ reg = <0>;
+ color = <LED_COLOR_ID_RED>;
+ };
+
+ led@1 {
+ chan-name = "G";
+- led-cur = /bits/ 8 <0x20>;
+- max-cur = /bits/ 8 <0x60>;
++ led-cur = /bits/ 8 <0xbe>;
++ max-cur = /bits/ 8 <0xc8>;
+ reg = <1>;
+ color = <LED_COLOR_ID_GREEN>;
+ };
+
+ led@2 {
+ chan-name = "B";
+- led-cur = /bits/ 8 <0x20>;
+- max-cur = /bits/ 8 <0x60>;
++ led-cur = /bits/ 8 <0xbe>;
++ max-cur = /bits/ 8 <0xc8>;
+ reg = <2>;
+ color = <LED_COLOR_ID_BLUE>;
+ };
--- /dev/null
+From 98abf2fbd179017833c38edc9f3b587c69d07e2a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 22 Jul 2024 11:42:44 +0200
+Subject: arm64: dts: qcom: x1e80100: add missing PCIe minimum OPP
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 98abf2fbd179017833c38edc9f3b587c69d07e2a upstream.
+
+Add the missing PCIe CX performance level votes to avoid relying on
+other drivers (e.g. USB) to maintain the nominal performance level
+required for Gen3 speeds.
+
+Fixes: 5eb83fc10289 ("arm64: dts: qcom: x1e80100: Add PCIe nodes")
+Cc: stable@vger.kernel.org # 6.9
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240722094249.26471-4-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
++++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+@@ -2814,6 +2814,7 @@
+ "link_down";
+
+ power-domains = <&gcc GCC_PCIE_6A_GDSC>;
++ required-opps = <&rpmhpd_opp_nom>;
+
+ phys = <&pcie6a_phy>;
+ phy-names = "pciephy";
+@@ -2935,6 +2936,7 @@
+ "link_down";
+
+ power-domains = <&gcc GCC_PCIE_4_GDSC>;
++ required-opps = <&rpmhpd_opp_nom>;
+
+ phys = <&pcie4_phy>;
+ phy-names = "pciephy";
--- /dev/null
+From 30f593fa0088b89f479f7358640687b3cbca93d4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 22 Jul 2024 11:42:42 +0200
+Subject: arm64: dts: qcom: x1e80100-crd: fix PCIe4 PHY supply
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 30f593fa0088b89f479f7358640687b3cbca93d4 upstream.
+
+The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j).
+
+Fixes: d7e03cce0400 ("arm64: dts: qcom: x1e80100-crd: Enable more support")
+Cc: stable@vger.kernel.org # 6.9
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240722094249.26471-2-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/x1e80100-crd.dts
++++ b/arch/arm64/boot/dts/qcom/x1e80100-crd.dts
+@@ -648,7 +648,7 @@
+ };
+
+ &pcie4_phy {
+- vdda-phy-supply = <&vreg_l3j_0p8>;
++ vdda-phy-supply = <&vreg_l3i_0p8>;
+ vdda-pll-supply = <&vreg_l3e_1p2>;
+
+ status = "okay";
--- /dev/null
+From f8fa1f2f6412bffa71972f9506b72992d0e6e485 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 22 Jul 2024 11:42:43 +0200
+Subject: arm64: dts: qcom: x1e80100: fix PCIe domain numbers
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit f8fa1f2f6412bffa71972f9506b72992d0e6e485 upstream.
+
+The current PCIe domain numbers are off by one and do not match the
+numbers that the UEFI firmware (and Windows) uses.
+
+Fixes: 5eb83fc10289 ("arm64: dts: qcom: x1e80100: Add PCIe nodes")
+Cc: stable@vger.kernel.org # 6.9
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20240722094249.26471-3-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/x1e80100.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
++++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+@@ -2756,7 +2756,7 @@
+
+ dma-coherent;
+
+- linux,pci-domain = <7>;
++ linux,pci-domain = <6>;
+ num-lanes = <2>;
+
+ interrupts = <GIC_SPI 773 IRQ_TYPE_LEVEL_HIGH>,
+@@ -2878,7 +2878,7 @@
+
+ dma-coherent;
+
+- linux,pci-domain = <5>;
++ linux,pci-domain = <4>;
+ num-lanes = <2>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
--- /dev/null
+From f03dd49f884f428ba71efe23383ff842f4f15e0e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 22 Jul 2024 11:54:48 +0200
+Subject: arm64: dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit f03dd49f884f428ba71efe23383ff842f4f15e0e upstream.
+
+The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j) on the CRD so assume
+the same applies to the QCP.
+
+Fixes: f9a9c11471da ("arm64: dts: qcom: x1e80100-qcp: Enable more support")
+Cc: stable@vger.kernel.org # 6.9
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240722095459.27437-2-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
++++ b/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
+@@ -459,7 +459,7 @@
+ };
+
+ &pcie4_phy {
+- vdda-phy-supply = <&vreg_l3j_0p8>;
++ vdda-phy-supply = <&vreg_l3i_0p8>;
+ vdda-pll-supply = <&vreg_l3e_1p2>;
+
+ status = "okay";
--- /dev/null
+From 0b00583ecacb0b51712a5ecd34cf7e6684307c67 Mon Sep 17 00:00:00 2001
+From: Ian Ray <ian.ray@gehealthcare.com>
+Date: Wed, 14 Aug 2024 10:29:05 +0300
+Subject: cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
+
+From: Ian Ray <ian.ray@gehealthcare.com>
+
+commit 0b00583ecacb0b51712a5ecd34cf7e6684307c67 upstream.
+
+USB_DEVICE(0x1901, 0x0006) may send data before cdc_acm is ready, which
+may be misinterpreted in the default N_TTY line discipline.
+
+Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
+Acked-by: Oliver Neuku <oneukum@suse.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20240814072905.2501-1-ian.ray@gehealthcare.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1761,6 +1761,9 @@ static const struct usb_device_id acm_id
+ { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */
+ .driver_info = SINGLE_RX_URB,
+ },
++ { USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
++ .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
++ },
+ { USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
--- /dev/null
+From 5b235693ed2a1e4963625717a1598becf97759cc Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Thu, 15 Aug 2024 13:31:31 +0200
+Subject: dt-bindings: usb: microchip,usb2514: Fix reference USB device schema
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+commit 5b235693ed2a1e4963625717a1598becf97759cc upstream.
+
+An USB hub is not a HCD, but an USB device. Fix the referenced schema
+accordingly.
+
+Fixes: bfbf2e4b77e2 ("dt-bindings: usb: Document the Microchip USB2514 hub")
+Cc: stable@vger.kernel.org
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20240815113132.372542-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/usb/microchip,usb2514.yaml | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/usb/microchip,usb2514.yaml
++++ b/Documentation/devicetree/bindings/usb/microchip,usb2514.yaml
+@@ -10,7 +10,7 @@ maintainers:
+ - Fabio Estevam <festevam@gmail.com>
+
+ allOf:
+- - $ref: usb-hcd.yaml#
++ - $ref: usb-device.yaml#
+
+ properties:
+ compatible:
+@@ -35,6 +35,13 @@ required:
+ - compatible
+ - reg
+
++patternProperties:
++ "^.*@[0-9a-f]{1,2}$":
++ description: The hard wired USB devices
++ type: object
++ $ref: /schemas/usb/usb-device.yaml
++ additionalProperties: true
++
+ unevaluatedProperties: false
+
+ examples:
--- /dev/null
+From 9960085a3a82c58d3323c1c20b991db6045063b0 Mon Sep 17 00:00:00 2001
+From: Murali Nalajala <quic_mnalajal@quicinc.com>
+Date: Wed, 14 Aug 2024 15:32:44 -0700
+Subject: firmware: qcom: scm: Mark get_wq_ctx() as atomic call
+
+From: Murali Nalajala <quic_mnalajal@quicinc.com>
+
+commit 9960085a3a82c58d3323c1c20b991db6045063b0 upstream.
+
+Currently get_wq_ctx() is wrongly configured as a standard call. When two
+SMC calls are in sleep and one SMC wakes up, it calls get_wq_ctx() to
+resume the corresponding sleeping thread. But if get_wq_ctx() is
+interrupted, goes to sleep and another SMC call is waiting to be allocated
+a waitq context, it leads to a deadlock.
+
+To avoid this get_wq_ctx() must be an atomic call and can't be a standard
+SMC call. Hence mark get_wq_ctx() as a fast call.
+
+Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Murali Nalajala <quic_mnalajal@quicinc.com>
+Signed-off-by: Unnathi Chalicheemala <quic_uchalich@quicinc.com>
+Reviewed-by: Elliot Berman <quic_eberman@quicinc.com>
+Link: https://lore.kernel.org/r/20240814223244.40081-1-quic_uchalich@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/qcom/qcom_scm-smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firmware/qcom/qcom_scm-smc.c
++++ b/drivers/firmware/qcom/qcom_scm-smc.c
+@@ -71,7 +71,7 @@ int scm_get_wq_ctx(u32 *wq_ctx, u32 *fla
+ struct arm_smccc_res get_wq_res;
+ struct arm_smccc_args get_wq_ctx = {0};
+
+- get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL,
++ get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,
+ ARM_SMCCC_SMC_64, ARM_SMCCC_OWNER_SIP,
+ SCM_SMC_FNID(QCOM_SCM_SVC_WAITQ, QCOM_SCM_WAITQ_GET_WQ_CTX));
+
--- /dev/null
+From 4f9eedfa27ae5806ed10906bcceee7bae49c8941 Mon Sep 17 00:00:00 2001
+From: Yihang Li <liyihang9@huawei.com>
+Date: Mon, 19 Aug 2024 17:09:34 +0800
+Subject: scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress
+
+From: Yihang Li <liyihang9@huawei.com>
+
+commit 4f9eedfa27ae5806ed10906bcceee7bae49c8941 upstream.
+
+If formatting a suspended disk (such as formatting with different DIF
+type), the disk will be resuming first, and then the format command will
+submit to the disk through SG_IO ioctl.
+
+When the disk is processing the format command, the system does not
+submit other commands to the disk. Therefore, the system attempts to
+suspend the disk again and sends the SYNCHRONIZE CACHE command. However,
+the SYNCHRONIZE CACHE command will fail because the disk is in the
+formatting process. This will cause the runtime_status of the disk to
+error and it is difficult for user to recover it. Error info like:
+
+[ 669.925325] sd 6:0:6:0: [sdg] Synchronizing SCSI cache
+[ 670.202371] sd 6:0:6:0: [sdg] Synchronize Cache(10) failed: Result: hostbyte=0x00 driverbyte=DRIVER_OK
+[ 670.216300] sd 6:0:6:0: [sdg] Sense Key : 0x2 [current]
+[ 670.221860] sd 6:0:6:0: [sdg] ASC=0x4 ASCQ=0x4
+
+To solve the issue, ignore the error and return success/0 when format is
+in progress.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Link: https://lore.kernel.org/r/20240819090934.2130592-1-liyihang9@huawei.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sd.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1711,13 +1711,15 @@ static int sd_sync_cache(struct scsi_dis
+ (sshdr.asc == 0x74 && sshdr.ascq == 0x71)) /* drive is password locked */
+ /* this is no error here */
+ return 0;
++
+ /*
+- * This drive doesn't support sync and there's not much
+- * we can do because this is called during shutdown
+- * or suspend so just return success so those operations
+- * can proceed.
++ * If a format is in progress or if the drive does not
++ * support sync, there is not much we can do because
++ * this is called during shutdown or suspend so just
++ * return success so those operations can proceed.
+ */
+- if (sshdr.sense_key == ILLEGAL_REQUEST)
++ if ((sshdr.asc == 0x04 && sshdr.ascq == 0x04) ||
++ sshdr.sense_key == ILLEGAL_REQUEST)
+ return 0;
+ }
+
nfc-pn533-add-poll-mod-list-filling-check.patch
drm-xe-hwmon-fix-write_i1-param-from-u32-to-u16.patch
io_uring-kbuf-return-correct-iovec-count-from-classi.patch
+soc-qcom-cmd-db-map-shared-memory-as-wc-not-wb.patch
+soc-qcom-pmic_glink-actually-communicate-when-remote-goes-down.patch
+soc-qcom-pmic_glink-fix-race-during-initialization.patch
+cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch
+usb-typec-fsa4480-relax-chip_id-check.patch
+firmware-qcom-scm-mark-get_wq_ctx-as-atomic-call.patch
+scsi-sd-ignore-command-synchronize-cache-error-if-format-in-progress.patch
+dt-bindings-usb-microchip-usb2514-fix-reference-usb-device-schema.patch
+usb-serial-option-add-meig-smart-srm825l.patch
+usb-gadget-uvc-queue-pump-work-in-uvcg_video_enable.patch
+arm64-dts-qcom-x1e80100-crd-fix-pcie4-phy-supply.patch
+arm64-dts-qcom-x1e80100-qcp-fix-pcie4-phy-supply.patch
+arm64-dts-qcom-x1e80100-add-missing-pcie-minimum-opp.patch
+arm64-dts-qcom-x1e80100-fix-pcie-domain-numbers.patch
+arm-dts-imx6dl-yapp43-increase-led-current-to-match-the-yapp4-hw-design.patch
+usb-dwc3-ep0-don-t-reset-resource-alloc-flag-including-ep0.patch
+usb-dwc3-xilinx-add-missing-depopulate-in-probe-error-path.patch
+usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch
+usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch
+usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch
+usb-dwc3-st-add-missing-depopulate-in-probe-error-path.patch
+usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch
+usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch
+usb-cdnsp-fix-for-link-trb-with-tc.patch
+usb-typec-ucsi-move-unregister-out-of-atomic-section.patch
--- /dev/null
+From f9bb896eab221618927ae6a2f1d566567999839d Mon Sep 17 00:00:00 2001
+From: Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
+Date: Thu, 18 Jul 2024 11:33:23 +0530
+Subject: soc: qcom: cmd-db: Map shared memory as WC, not WB
+
+From: Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
+
+commit f9bb896eab221618927ae6a2f1d566567999839d upstream.
+
+Linux does not write into cmd-db region. This region of memory is write
+protected by XPU. XPU may sometime falsely detect clean cache eviction
+as "write" into the write protected region leading to secure interrupt
+which causes an endless loop somewhere in Trust Zone.
+
+The only reason it is working right now is because Qualcomm Hypervisor
+maps the same region as Non-Cacheable memory in Stage 2 translation
+tables. The issue manifests if we want to use another hypervisor (like
+Xen or KVM), which does not know anything about those specific mappings.
+
+Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC
+removes dependency on correct mappings in Stage 2 tables. This patch
+fixes the issue by updating the mapping to MEMREMAP_WC.
+
+I tested this on SA8155P with Xen.
+
+Fixes: 312416d9171a ("drivers: qcom: add command DB driver")
+Cc: stable@vger.kernel.org # 5.4+
+Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
+Tested-by: Nikita Travkin <nikita@trvn.ru> # sc7180 WoA in EL2
+Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
+Tested-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
+Reviewed-by: Caleb Connolly <caleb.connolly@linaro.org>
+Link: https://lore.kernel.org/r/20240718-cmd_db_uncached-v2-1-f6cf53164c90@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/cmd-db.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/qcom/cmd-db.c
++++ b/drivers/soc/qcom/cmd-db.c
+@@ -349,7 +349,7 @@ static int cmd_db_dev_probe(struct platf
+ return -EINVAL;
+ }
+
+- cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WB);
++ cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WC);
+ if (!cmd_db_header) {
+ ret = -ENOMEM;
+ cmd_db_header = NULL;
--- /dev/null
+From ad51126037a43c05f5f4af5eb262734e3e88ca59 Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+Date: Tue, 20 Aug 2024 13:29:32 -0700
+Subject: soc: qcom: pmic_glink: Actually communicate when remote goes down
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+commit ad51126037a43c05f5f4af5eb262734e3e88ca59 upstream.
+
+When the pmic_glink state is UP and we either receive a protection-
+domain (PD) notification indicating that the PD is going down, or that
+the whole remoteproc is going down, it's expected that the pmic_glink
+client instances are notified that their function has gone DOWN.
+
+This is not what the code does, which results in the client state either
+not updating, or being wrong in many cases. So let's fix the conditions.
+
+Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Amit Pundir <amit.pundir@linaro.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-3-eec53c750a04@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/pmic_glink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/qcom/pmic_glink.c
++++ b/drivers/soc/qcom/pmic_glink.c
+@@ -175,7 +175,7 @@ static void pmic_glink_state_notify_clie
+ if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept)
+ new_state = SERVREG_SERVICE_STATE_UP;
+ } else {
+- if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept)
++ if (pg->pdr_state == SERVREG_SERVICE_STATE_DOWN || !pg->ept)
+ new_state = SERVREG_SERVICE_STATE_DOWN;
+ }
+
--- /dev/null
+From 3568affcddd68743e25aa3ec1647d9b82797757b Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+Date: Tue, 20 Aug 2024 13:29:30 -0700
+Subject: soc: qcom: pmic_glink: Fix race during initialization
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+commit 3568affcddd68743e25aa3ec1647d9b82797757b upstream.
+
+As pointed out by Stephen Boyd it is possible that during initialization
+of the pmic_glink child drivers, the protection-domain notifiers fires,
+and the associated work is scheduled, before the client registration
+returns and as a result the local "client" pointer has been initialized.
+
+The outcome of this is a NULL pointer dereference as the "client"
+pointer is blindly dereferenced.
+
+Timeline provided by Stephen:
+ CPU0 CPU1
+ ---- ----
+ ucsi->client = NULL;
+ devm_pmic_glink_register_client()
+ client->pdr_notify(client->priv, pg->client_state)
+ pmic_glink_ucsi_pdr_notify()
+ schedule_work(&ucsi->register_work)
+ <schedule away>
+ pmic_glink_ucsi_register()
+ ucsi_register()
+ pmic_glink_ucsi_read_version()
+ pmic_glink_ucsi_read()
+ pmic_glink_ucsi_read()
+ pmic_glink_send(ucsi->client)
+ <client is NULL BAD>
+ ucsi->client = client // Too late!
+
+This code is identical across the altmode, battery manager and usci
+child drivers.
+
+Resolve this by splitting the allocation of the "client" object and the
+registration thereof into two operations.
+
+This only happens if the protection domain registry is populated at the
+time of registration, which by the introduction of commit '1ebcde047c54
+("soc: qcom: add pd-mapper implementation")' became much more likely.
+
+Reported-by: Amit Pundir <amit.pundir@linaro.org>
+Closes: https://lore.kernel.org/all/CAMi1Hd2_a7TjA7J9ShrAbNOd_CoZ3D87twmO5t+nZxC9sX18tA@mail.gmail.com/
+Reported-by: Johan Hovold <johan@kernel.org>
+Closes: https://lore.kernel.org/all/ZqiyLvP0gkBnuekL@hovoldconsulting.com/
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Closes: https://lore.kernel.org/all/CAE-0n52JgfCBWiFQyQWPji8cq_rCsviBpW-m72YitgNfdaEhQg@mail.gmail.com/
+Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Tested-by: Amit Pundir <amit.pundir@linaro.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-1-eec53c750a04@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 16 ++++++++++------
+ drivers/soc/qcom/pmic_glink.c | 28 ++++++++++++++++++----------
+ drivers/soc/qcom/pmic_glink_altmode.c | 17 +++++++++++------
+ drivers/usb/typec/ucsi/ucsi_glink.c | 16 ++++++++++------
+ include/linux/soc/qcom/pmic_glink.h | 11 ++++++-----
+ 5 files changed, 55 insertions(+), 33 deletions(-)
+
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -1384,12 +1384,16 @@ static int qcom_battmgr_probe(struct aux
+ "failed to register wireless charing power supply\n");
+ }
+
+- battmgr->client = devm_pmic_glink_register_client(dev,
+- PMIC_GLINK_OWNER_BATTMGR,
+- qcom_battmgr_callback,
+- qcom_battmgr_pdr_notify,
+- battmgr);
+- return PTR_ERR_OR_ZERO(battmgr->client);
++ battmgr->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_BATTMGR,
++ qcom_battmgr_callback,
++ qcom_battmgr_pdr_notify,
++ battmgr);
++ if (IS_ERR(battmgr->client))
++ return PTR_ERR(battmgr->client);
++
++ pmic_glink_client_register(battmgr->client);
++
++ return 0;
+ }
+
+ static const struct auxiliary_device_id qcom_battmgr_id_table[] = {
+--- a/drivers/soc/qcom/pmic_glink.c
++++ b/drivers/soc/qcom/pmic_glink.c
+@@ -66,15 +66,14 @@ static void _devm_pmic_glink_release_cli
+ spin_unlock_irqrestore(&pg->client_lock, flags);
+ }
+
+-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev,
+- unsigned int id,
+- void (*cb)(const void *, size_t, void *),
+- void (*pdr)(void *, int),
+- void *priv)
++struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev,
++ unsigned int id,
++ void (*cb)(const void *, size_t, void *),
++ void (*pdr)(void *, int),
++ void *priv)
+ {
+ struct pmic_glink_client *client;
+ struct pmic_glink *pg = dev_get_drvdata(dev->parent);
+- unsigned long flags;
+
+ client = devres_alloc(_devm_pmic_glink_release_client, sizeof(*client), GFP_KERNEL);
+ if (!client)
+@@ -85,6 +84,18 @@ struct pmic_glink_client *devm_pmic_glin
+ client->cb = cb;
+ client->pdr_notify = pdr;
+ client->priv = priv;
++ INIT_LIST_HEAD(&client->node);
++
++ devres_add(dev, client);
++
++ return client;
++}
++EXPORT_SYMBOL_GPL(devm_pmic_glink_client_alloc);
++
++void pmic_glink_client_register(struct pmic_glink_client *client)
++{
++ struct pmic_glink *pg = client->pg;
++ unsigned long flags;
+
+ mutex_lock(&pg->state_lock);
+ spin_lock_irqsave(&pg->client_lock, flags);
+@@ -95,11 +106,8 @@ struct pmic_glink_client *devm_pmic_glin
+ spin_unlock_irqrestore(&pg->client_lock, flags);
+ mutex_unlock(&pg->state_lock);
+
+- devres_add(dev, client);
+-
+- return client;
+ }
+-EXPORT_SYMBOL_GPL(devm_pmic_glink_register_client);
++EXPORT_SYMBOL_GPL(pmic_glink_client_register);
+
+ int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len)
+ {
+--- a/drivers/soc/qcom/pmic_glink_altmode.c
++++ b/drivers/soc/qcom/pmic_glink_altmode.c
+@@ -520,12 +520,17 @@ static int pmic_glink_altmode_probe(stru
+ return ret;
+ }
+
+- altmode->client = devm_pmic_glink_register_client(dev,
+- altmode->owner_id,
+- pmic_glink_altmode_callback,
+- pmic_glink_altmode_pdr_notify,
+- altmode);
+- return PTR_ERR_OR_ZERO(altmode->client);
++ altmode->client = devm_pmic_glink_client_alloc(dev,
++ altmode->owner_id,
++ pmic_glink_altmode_callback,
++ pmic_glink_altmode_pdr_notify,
++ altmode);
++ if (IS_ERR(altmode->client))
++ return PTR_ERR(altmode->client);
++
++ pmic_glink_client_register(altmode->client);
++
++ return 0;
+ }
+
+ static const struct auxiliary_device_id pmic_glink_altmode_id_table[] = {
+--- a/drivers/usb/typec/ucsi/ucsi_glink.c
++++ b/drivers/usb/typec/ucsi/ucsi_glink.c
+@@ -395,12 +395,16 @@ static int pmic_glink_ucsi_probe(struct
+ ucsi->port_orientation[port] = desc;
+ }
+
+- ucsi->client = devm_pmic_glink_register_client(dev,
+- PMIC_GLINK_OWNER_USBC,
+- pmic_glink_ucsi_callback,
+- pmic_glink_ucsi_pdr_notify,
+- ucsi);
+- return PTR_ERR_OR_ZERO(ucsi->client);
++ ucsi->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_USBC,
++ pmic_glink_ucsi_callback,
++ pmic_glink_ucsi_pdr_notify,
++ ucsi);
++ if (IS_ERR(ucsi->client))
++ return PTR_ERR(ucsi->client);
++
++ pmic_glink_client_register(ucsi->client);
++
++ return 0;
+ }
+
+ static void pmic_glink_ucsi_remove(struct auxiliary_device *adev)
+--- a/include/linux/soc/qcom/pmic_glink.h
++++ b/include/linux/soc/qcom/pmic_glink.h
+@@ -23,10 +23,11 @@ struct pmic_glink_hdr {
+
+ int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len);
+
+-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev,
+- unsigned int id,
+- void (*cb)(const void *, size_t, void *),
+- void (*pdr)(void *, int),
+- void *priv);
++struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev,
++ unsigned int id,
++ void (*cb)(const void *, size_t, void *),
++ void (*pdr)(void *, int),
++ void *priv);
++void pmic_glink_client_register(struct pmic_glink_client *client);
+
+ #endif
--- /dev/null
+From 740f2e2791b98e47288b3814c83a3f566518fed2 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Wed, 21 Aug 2024 06:07:42 +0000
+Subject: usb: cdnsp: fix for Link TRB with TC
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit 740f2e2791b98e47288b3814c83a3f566518fed2 upstream.
+
+Stop Endpoint command on LINK TRB with TC bit set to 1 causes that
+internal cycle bit can have incorrect state after command complete.
+In consequence empty transfer ring can be incorrectly detected
+when EP is resumed.
+NOP TRB before LINK TRB avoid such scenario. Stop Endpoint command
+is then on NOP TRB and internal cycle bit is not changed and have
+correct value.
+
+Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
+cc: <stable@vger.kernel.org>
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Reviewed-by: Peter Chen <peter.chen@kernel.org>
+Link: https://lore.kernel.org/r/PH7PR07MB953878279F375CCCE6C6F40FDD8E2@PH7PR07MB9538.namprd07.prod.outlook.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.h | 3 +++
+ drivers/usb/cdns3/cdnsp-ring.c | 28 ++++++++++++++++++++++++++++
+ 2 files changed, 31 insertions(+)
+
+--- a/drivers/usb/cdns3/cdnsp-gadget.h
++++ b/drivers/usb/cdns3/cdnsp-gadget.h
+@@ -811,6 +811,7 @@ struct cdnsp_stream_info {
+ * generate Missed Service Error Event.
+ * Set skip flag when receive a Missed Service Error Event and
+ * process the missed tds on the endpoint ring.
++ * @wa1_nop_trb: hold pointer to NOP trb.
+ */
+ struct cdnsp_ep {
+ struct usb_ep endpoint;
+@@ -838,6 +839,8 @@ struct cdnsp_ep {
+ #define EP_UNCONFIGURED BIT(7)
+
+ bool skip;
++ union cdnsp_trb *wa1_nop_trb;
++
+ };
+
+ /**
+--- a/drivers/usb/cdns3/cdnsp-ring.c
++++ b/drivers/usb/cdns3/cdnsp-ring.c
+@@ -1905,6 +1905,23 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev
+ return ret;
+
+ /*
++ * workaround 1: STOP EP command on LINK TRB with TC bit set to 1
++ * causes that internal cycle bit can have incorrect state after
++ * command complete. In consequence empty transfer ring can be
++ * incorrectly detected when EP is resumed.
++ * NOP TRB before LINK TRB avoid such scenario. STOP EP command is
++ * then on NOP TRB and internal cycle bit is not changed and have
++ * correct value.
++ */
++ if (pep->wa1_nop_trb) {
++ field = le32_to_cpu(pep->wa1_nop_trb->trans_event.flags);
++ field ^= TRB_CYCLE;
++
++ pep->wa1_nop_trb->trans_event.flags = cpu_to_le32(field);
++ pep->wa1_nop_trb = NULL;
++ }
++
++ /*
+ * Don't give the first TRB to the hardware (by toggling the cycle bit)
+ * until we've finished creating all the other TRBs. The ring's cycle
+ * state may change as we enqueue the other TRBs, so save it too.
+@@ -1999,6 +2016,17 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev
+ send_addr = addr;
+ }
+
++ if (cdnsp_trb_is_link(ring->enqueue + 1)) {
++ field = TRB_TYPE(TRB_TR_NOOP) | TRB_IOC;
++ if (!ring->cycle_state)
++ field |= TRB_CYCLE;
++
++ pep->wa1_nop_trb = ring->enqueue;
++
++ cdnsp_queue_trb(pdev, ring, 0, 0x0, 0x0,
++ TRB_INTR_TARGET(0), field);
++ }
++
+ cdnsp_check_trb_math(preq, enqd_len);
+ ret = cdnsp_giveback_first_trb(pdev, pep, preq->request.stream_id,
+ start_cycle, start_trb);
--- /dev/null
+From 0497a356d3c498221eb0c1edc1e8985816092f12 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Tue, 20 Aug 2024 08:21:19 +0000
+Subject: usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit 0497a356d3c498221eb0c1edc1e8985816092f12 upstream.
+
+Patch fixes the incorrect "stream_id" table index instead of
+"ep_index" used in cdnsp_get_hw_deq function.
+
+Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
+cc: stable@vger.kernel.org
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Reviewed-by: Peter Chen <peter.chen@kernel.org>
+Link: https://lore.kernel.org/r/PH7PR07MB95381F2182688811D5C711CEDD8D2@PH7PR07MB9538.namprd07.prod.outlook.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdnsp-ring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c
+index 02f297f5637d..a60c0cb991cd 100644
+--- a/drivers/usb/cdns3/cdnsp-ring.c
++++ b/drivers/usb/cdns3/cdnsp-ring.c
+@@ -402,7 +402,7 @@ static u64 cdnsp_get_hw_deq(struct cdnsp_device *pdev,
+ struct cdnsp_stream_ctx *st_ctx;
+ struct cdnsp_ep *pep;
+
+- pep = &pdev->eps[stream_id];
++ pep = &pdev->eps[ep_index];
+
+ if (pep->ep_state & EP_HAS_STREAMS) {
+ st_ctx = &pep->stream_info.stream_ctx_array[stream_id];
+--
+2.46.0
+
--- /dev/null
+From 3a8839bbb86da7968a792123ed2296d063871a52 Mon Sep 17 00:00:00 2001
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+Date: Tue, 20 Aug 2024 19:01:27 +0800
+Subject: usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+commit 3a8839bbb86da7968a792123ed2296d063871a52 upstream.
+
+Device attribute group @usb3_hardware_lpm_attr_group is merged by
+add_power_attributes(), but it is not unmerged explicitly, fixed by
+unmerging it in remove_power_attributes().
+
+Fixes: 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Link: https://lore.kernel.org/r/20240820-sysfs_fix-v2-1-a9441487077e@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -670,6 +670,7 @@ static int add_power_attributes(struct d
+
+ static void remove_power_attributes(struct device *dev)
+ {
++ sysfs_unmerge_group(&dev->kobj, &usb3_hardware_lpm_attr_group);
+ sysfs_unmerge_group(&dev->kobj, &usb2_hardware_lpm_attr_group);
+ sysfs_unmerge_group(&dev->kobj, &power_attr_group);
+ }
--- /dev/null
+From 14e497183df28c006603cc67fd3797a537eef7b9 Mon Sep 17 00:00:00 2001
+From: Selvarasu Ganesan <selvarasu.g@samsung.com>
+Date: Thu, 15 Aug 2024 12:18:31 +0530
+Subject: usb: dwc3: core: Prevent USB core invalid event buffer address access
+
+From: Selvarasu Ganesan <selvarasu.g@samsung.com>
+
+commit 14e497183df28c006603cc67fd3797a537eef7b9 upstream.
+
+This commit addresses an issue where the USB core could access an
+invalid event buffer address during runtime suspend, potentially causing
+SMMU faults and other memory issues in Exynos platforms. The problem
+arises from the following sequence.
+ 1. In dwc3_gadget_suspend, there is a chance of a timeout when
+ moving the USB core to the halt state after clearing the
+ run/stop bit by software.
+ 2. In dwc3_core_exit, the event buffer is cleared regardless of
+ the USB core's status, which may lead to an SMMU faults and
+ other memory issues. if the USB core tries to access the event
+ buffer address.
+
+To prevent this hardware quirk on Exynos platforms, this commit ensures
+that the event buffer address is not cleared by software when the USB
+core is active during runtime suspend by checking its status before
+clearing the buffer address.
+
+Cc: stable <stable@kernel.org>
+Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/20240815064836.1491-1-selvarasu.g@samsung.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -559,9 +559,17 @@ int dwc3_event_buffers_setup(struct dwc3
+ void dwc3_event_buffers_cleanup(struct dwc3 *dwc)
+ {
+ struct dwc3_event_buffer *evt;
++ u32 reg;
+
+ if (!dwc->ev_buf)
+ return;
++ /*
++ * Exynos platforms may not be able to access event buffer if the
++ * controller failed to halt on dwc3_core_exit().
++ */
++ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
++ if (!(reg & DWC3_DSTS_DEVCTRLHLT))
++ return;
+
+ evt = dwc->ev_buf;
+
--- /dev/null
+From 72fca8371f205d654f95b09cd023a71fd5307041 Mon Sep 17 00:00:00 2001
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Date: Thu, 15 Aug 2024 08:40:29 +0200
+Subject: usb: dwc3: ep0: Don't reset resource alloc flag (including ep0)
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+commit 72fca8371f205d654f95b09cd023a71fd5307041 upstream.
+
+The DWC3_EP_RESOURCE_ALLOCATED flag ensures that the resource of an
+endpoint is only assigned once. Unless the endpoint is reset, don't
+clear this flag. Otherwise we may set endpoint resource again, which
+prevents the driver from initiate transfer after handling a STALL or
+endpoint halt to the control endpoint.
+
+Commit f2e0eee47038 ("usb: dwc3: ep0: Don't reset resource alloc flag")
+was fixing the initial issue, but did this only for physical ep1. Since
+the function dwc3_ep0_stall_and_restart is resetting the flags for both
+physical endpoints, this also has to be done for ep0.
+
+Cc: stable@vger.kernel.org
+Fixes: b311048c174d ("usb: dwc3: gadget: Rewrite endpoint allocation flow")
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Link: https://lore.kernel.org/r/20240814-dwc3hwep0reset-v2-1-29e1d7d923ea@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/ep0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index d96ffbe52039..c9533a99e47c 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -232,7 +232,8 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
+ /* stall is always issued on EP0 */
+ dep = dwc->eps[0];
+ __dwc3_gadget_ep_set_halt(dep, 1, false);
+- dep->flags = DWC3_EP_ENABLED;
++ dep->flags &= DWC3_EP_RESOURCE_ALLOCATED;
++ dep->flags |= DWC3_EP_ENABLED;
+ dwc->delayed_status = false;
+
+ if (!list_empty(&dep->pending_list)) {
+--
+2.46.0
+
--- /dev/null
+From 2aa765a43817ec8add990f83c8e54a9a5d87aa9c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 16 Aug 2024 09:54:08 +0200
+Subject: usb: dwc3: omap: add missing depopulate in probe error path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 2aa765a43817ec8add990f83c8e54a9a5d87aa9c upstream.
+
+Depopulate device in probe error paths to fix leak of children
+resources.
+
+Fixes: ee249b455494 ("usb: dwc3: omap: remove IRQ_NOAUTOEN used with shared irq")
+Cc: stable@vger.kernel.org
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/20240816075409.23080-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-omap.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-omap.c
++++ b/drivers/usb/dwc3/dwc3-omap.c
+@@ -522,11 +522,13 @@ static int dwc3_omap_probe(struct platfo
+ if (ret) {
+ dev_err(dev, "failed to request IRQ #%d --> %d\n",
+ omap->irq, ret);
+- goto err1;
++ goto err2;
+ }
+ dwc3_omap_enable_irqs(omap);
+ return 0;
+
++err2:
++ of_platform_depopulate(dev);
+ err1:
+ pm_runtime_put_sync(dev);
+ pm_runtime_disable(dev);
--- /dev/null
+From cd4897bfd14f6a5388b21ba45a066541a0425199 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Wed, 14 Aug 2024 11:39:57 +0200
+Subject: usb: dwc3: st: add missing depopulate in probe error path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit cd4897bfd14f6a5388b21ba45a066541a0425199 upstream.
+
+Depopulate device in probe error paths to fix leak of children
+resources.
+
+Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/20240814093957.37940-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-st.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-st.c
++++ b/drivers/usb/dwc3/dwc3-st.c
+@@ -266,7 +266,7 @@ static int st_dwc3_probe(struct platform
+ if (!child_pdev) {
+ dev_err(dev, "failed to find dwc3 core device\n");
+ ret = -ENODEV;
+- goto err_node_put;
++ goto depopulate;
+ }
+
+ dwc3_data->dr_mode = usb_get_dr_mode(&child_pdev->dev);
+@@ -282,6 +282,7 @@ static int st_dwc3_probe(struct platform
+ ret = st_dwc3_drd_init(dwc3_data);
+ if (ret) {
+ dev_err(dev, "drd initialisation failed\n");
++ of_platform_depopulate(dev);
+ goto undo_softreset;
+ }
+
+@@ -291,6 +292,8 @@ static int st_dwc3_probe(struct platform
+ platform_set_drvdata(pdev, dwc3_data);
+ return 0;
+
++depopulate:
++ of_platform_depopulate(dev);
+ err_node_put:
+ of_node_put(child);
+ undo_softreset:
--- /dev/null
+From ddfcfeba891064b88bb844208b43bef2ef970f0c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Wed, 14 Aug 2024 11:39:56 +0200
+Subject: usb: dwc3: st: fix probed platform device ref count on probe error path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit ddfcfeba891064b88bb844208b43bef2ef970f0c upstream.
+
+The probe function never performs any paltform device allocation, thus
+error path "undo_platform_dev_alloc" is entirely bogus. It drops the
+reference count from the platform device being probed. If error path is
+triggered, this will lead to unbalanced device reference counts and
+premature release of device resources, thus possible use-after-free when
+releasing remaining devm-managed resources.
+
+Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-st.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/dwc3/dwc3-st.c
++++ b/drivers/usb/dwc3/dwc3-st.c
+@@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform
+ dwc3_data->regmap = regmap;
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg");
+- if (!res) {
+- ret = -ENXIO;
+- goto undo_platform_dev_alloc;
+- }
++ if (!res)
++ return -ENXIO;
+
+ dwc3_data->syscfg_reg_off = res->start;
+
+@@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform
+ devm_reset_control_get_exclusive(dev, "powerdown");
+ if (IS_ERR(dwc3_data->rstc_pwrdn)) {
+ dev_err(&pdev->dev, "could not get power controller\n");
+- ret = PTR_ERR(dwc3_data->rstc_pwrdn);
+- goto undo_platform_dev_alloc;
++ return PTR_ERR(dwc3_data->rstc_pwrdn);
+ }
+
+ /* Manage PowerDown */
+@@ -300,8 +297,6 @@ undo_softreset:
+ reset_control_assert(dwc3_data->rstc_rst);
+ undo_powerdown:
+ reset_control_assert(dwc3_data->rstc_pwrdn);
+-undo_platform_dev_alloc:
+- platform_device_put(pdev);
+ return ret;
+ }
+
--- /dev/null
+From 16f2a21d9d7e48e1af02654fe3d926c0ce6cb3e5 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 16 Aug 2024 09:54:09 +0200
+Subject: usb: dwc3: xilinx: add missing depopulate in probe error path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 16f2a21d9d7e48e1af02654fe3d926c0ce6cb3e5 upstream.
+
+Depopulate device in probe error paths to fix leak of children
+resources.
+
+Fixes: 53b5ff83d893 ("usb: dwc3: xilinx: improve error handling for PM APIs")
+Cc: stable@vger.kernel.org
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/20240816075409.23080-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-xilinx.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-xilinx.c
++++ b/drivers/usb/dwc3/dwc3-xilinx.c
+@@ -298,9 +298,14 @@ static int dwc3_xlnx_probe(struct platfo
+ goto err_pm_set_suspended;
+
+ pm_suspend_ignore_children(dev, false);
+- return pm_runtime_resume_and_get(dev);
++ ret = pm_runtime_resume_and_get(dev);
++ if (ret < 0)
++ goto err_pm_set_suspended;
++
++ return 0;
+
+ err_pm_set_suspended:
++ of_platform_depopulate(dev);
+ pm_runtime_set_suspended(dev);
+
+ err_clk_put:
--- /dev/null
+From b52a07e07dead777517af3cbda851bb2cc157c9d Mon Sep 17 00:00:00 2001
+From: Xu Yang <xu.yang_2@nxp.com>
+Date: Wed, 14 Aug 2024 19:25:37 +0800
+Subject: usb: gadget: uvc: queue pump work in uvcg_video_enable()
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+commit b52a07e07dead777517af3cbda851bb2cc157c9d upstream.
+
+Since commit "6acba0345b68 usb:gadget:uvc Do not use worker thread to pump
+isoc usb requests", pump work could only be queued in uvc_video_complete()
+and uvc_v4l2_qbuf(). If VIDIOC_QBUF is executed before VIDIOC_STREAMON,
+we can only depend on uvc_video_complete() to queue pump work. However,
+this requires some free requests in req_ready list. If req_ready list is
+empty all the time, pump work will never be queued and video datas will
+never be pumped to usb controller. Actually, this situation could happen
+when run uvc-gadget with static image:
+
+$ ./uvc-gadget -i 1080p.jpg uvc.0
+
+When capture image from this device, the user app will always block there.
+
+The issue is uvc driver has queued video buffer before streamon, but the
+req_ready list is empty all the time after streamon. This will queue pump
+work in uvcg_video_enable() to fill some request to req_ready list so the
+uvc device could work properly.
+
+Fixes: 6acba0345b68 ("usb:gadget:uvc Do not use worker thread to pump isoc usb requests")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Link: https://lore.kernel.org/r/20240814112537.2608949-1-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -753,6 +753,7 @@ int uvcg_video_enable(struct uvc_video *
+ video->req_int_count = 0;
+
+ uvc_video_ep_queue_initial_requests(video);
++ queue_work(video->async_wq, &video->pump);
+
+ return ret;
+ }
--- /dev/null
+From 9a471de516c35219d1722c13367191ce1f120fe9 Mon Sep 17 00:00:00 2001
+From: ZHANG Yuntian <yt@radxa.com>
+Date: Sat, 3 Aug 2024 15:46:07 +0800
+Subject: USB: serial: option: add MeiG Smart SRM825L
+
+From: ZHANG Yuntian <yt@radxa.com>
+
+commit 9a471de516c35219d1722c13367191ce1f120fe9 upstream.
+
+Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip.
+
+T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=2dee ProdID=4d22 Rev= 4.14
+S: Manufacturer=MEIG
+S: Product=LTE-A Module
+S: SerialNumber=6f345e48
+C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+Signed-off-by: ZHANG Yuntian <yt@radxa.com>
+Link: https://lore.kernel.org/0041DFA5200EFB1B+20240803074619.563116-1-yt@radxa.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -619,6 +619,8 @@ static void option_instat_callback(struc
+
+ /* MeiG Smart Technology products */
+ #define MEIGSMART_VENDOR_ID 0x2dee
++/* MeiG Smart SRM825L based on Qualcomm 315 */
++#define MEIGSMART_PRODUCT_SRM825L 0x4d22
+ /* MeiG Smart SLM320 based on UNISOC UIS8910 */
+ #define MEIGSMART_PRODUCT_SLM320 0x4d41
+
+@@ -2366,6 +2368,9 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
--- /dev/null
+From 4f83cae0edb2b13aabb82e8a4852092844d320aa Mon Sep 17 00:00:00 2001
+From: Luca Weiss <luca.weiss@fairphone.com>
+Date: Sun, 18 Aug 2024 22:21:01 +0200
+Subject: usb: typec: fsa4480: Relax CHIP_ID check
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+commit 4f83cae0edb2b13aabb82e8a4852092844d320aa upstream.
+
+Some FSA4480-compatible chips like the OCP96011 used on Fairphone 5
+return 0x00 from the CHIP_ID register. Handle that gracefully and only
+fail probe when the I2C read has failed.
+
+With this the dev_dbg will print 0 but otherwise continue working.
+
+ [ 0.251581] fsa4480 1-0042: Found FSA4480 v0.0 (Vendor ID = 0)
+
+Cc: stable@vger.kernel.org
+Fixes: e885f5f1f2b4 ("usb: typec: fsa4480: Check if the chip is really there")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20240818-fsa4480-chipid-fix-v1-1-17c239435cf7@fairphone.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/mux/fsa4480.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/typec/mux/fsa4480.c b/drivers/usb/typec/mux/fsa4480.c
+index cd235339834b..f71dba8bf07c 100644
+--- a/drivers/usb/typec/mux/fsa4480.c
++++ b/drivers/usb/typec/mux/fsa4480.c
+@@ -274,7 +274,7 @@ static int fsa4480_probe(struct i2c_client *client)
+ return dev_err_probe(dev, PTR_ERR(fsa->regmap), "failed to initialize regmap\n");
+
+ ret = regmap_read(fsa->regmap, FSA4480_DEVICE_ID, &val);
+- if (ret || !val)
++ if (ret)
+ return dev_err_probe(dev, -ENODEV, "FSA4480 not found\n");
+
+ dev_dbg(dev, "Found FSA4480 v%lu.%lu (Vendor ID = %lu)\n",
+--
+2.46.0
+
--- /dev/null
+From 11bb2ffb679399f99041540cf662409905179e3a Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+Date: Tue, 20 Aug 2024 13:29:31 -0700
+Subject: usb: typec: ucsi: Move unregister out of atomic section
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+commit 11bb2ffb679399f99041540cf662409905179e3a upstream.
+
+Commit '9329933699b3 ("soc: qcom: pmic_glink: Make client-lock
+non-sleeping")' moved the pmic_glink client list under a spinlock, as it
+is accessed by the rpmsg/glink callback, which in turn is invoked from
+IRQ context.
+
+This means that ucsi_unregister() is now called from atomic context,
+which isn't feasible as it's expecting a sleepable context. An effort is
+under way to get GLINK to invoke its callbacks in a sleepable context,
+but until then lets schedule the unregistration.
+
+A side effect of this is that ucsi_unregister() can now happen
+after the remote processor, and thereby the communication link with it, is
+gone. pmic_glink_send() is amended with a check to avoid the resulting NULL
+pointer dereference.
+This does however result in the user being informed about this error by
+the following entry in the kernel log:
+
+ ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI write request: -5
+
+Fixes: 9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping")
+Cc: stable@vger.kernel.org
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Amit Pundir <amit.pundir@linaro.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-2-eec53c750a04@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/pmic_glink.c | 10 +++++++++-
+ drivers/usb/typec/ucsi/ucsi_glink.c | 27 ++++++++++++++++++++++-----
+ 2 files changed, 31 insertions(+), 6 deletions(-)
+
+--- a/drivers/soc/qcom/pmic_glink.c
++++ b/drivers/soc/qcom/pmic_glink.c
+@@ -112,8 +112,16 @@ EXPORT_SYMBOL_GPL(pmic_glink_client_regi
+ int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len)
+ {
+ struct pmic_glink *pg = client->pg;
++ int ret;
+
+- return rpmsg_send(pg->ept, data, len);
++ mutex_lock(&pg->state_lock);
++ if (!pg->ept)
++ ret = -ECONNRESET;
++ else
++ ret = rpmsg_send(pg->ept, data, len);
++ mutex_unlock(&pg->state_lock);
++
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(pmic_glink_send);
+
+--- a/drivers/usb/typec/ucsi/ucsi_glink.c
++++ b/drivers/usb/typec/ucsi/ucsi_glink.c
+@@ -72,6 +72,9 @@ struct pmic_glink_ucsi {
+
+ struct work_struct notify_work;
+ struct work_struct register_work;
++ spinlock_t state_lock;
++ bool ucsi_registered;
++ bool pd_running;
+
+ u8 read_buf[UCSI_BUF_SIZE];
+ };
+@@ -271,8 +274,20 @@ static void pmic_glink_ucsi_notify(struc
+ static void pmic_glink_ucsi_register(struct work_struct *work)
+ {
+ struct pmic_glink_ucsi *ucsi = container_of(work, struct pmic_glink_ucsi, register_work);
++ unsigned long flags;
++ bool pd_running;
+
+- ucsi_register(ucsi->ucsi);
++ spin_lock_irqsave(&ucsi->state_lock, flags);
++ pd_running = ucsi->pd_running;
++ spin_unlock_irqrestore(&ucsi->state_lock, flags);
++
++ if (!ucsi->ucsi_registered && pd_running) {
++ ucsi_register(ucsi->ucsi);
++ ucsi->ucsi_registered = true;
++ } else if (ucsi->ucsi_registered && !pd_running) {
++ ucsi_unregister(ucsi->ucsi);
++ ucsi->ucsi_registered = false;
++ }
+ }
+
+ static void pmic_glink_ucsi_callback(const void *data, size_t len, void *priv)
+@@ -296,11 +311,12 @@ static void pmic_glink_ucsi_callback(con
+ static void pmic_glink_ucsi_pdr_notify(void *priv, int state)
+ {
+ struct pmic_glink_ucsi *ucsi = priv;
++ unsigned long flags;
+
+- if (state == SERVREG_SERVICE_STATE_UP)
+- schedule_work(&ucsi->register_work);
+- else if (state == SERVREG_SERVICE_STATE_DOWN)
+- ucsi_unregister(ucsi->ucsi);
++ spin_lock_irqsave(&ucsi->state_lock, flags);
++ ucsi->pd_running = (state == SERVREG_SERVICE_STATE_UP);
++ spin_unlock_irqrestore(&ucsi->state_lock, flags);
++ schedule_work(&ucsi->register_work);
+ }
+
+ static void pmic_glink_ucsi_destroy(void *data)
+@@ -348,6 +364,7 @@ static int pmic_glink_ucsi_probe(struct
+ init_completion(&ucsi->read_ack);
+ init_completion(&ucsi->write_ack);
+ init_completion(&ucsi->sync_ack);
++ spin_lock_init(&ucsi->state_lock);
+ mutex_init(&ucsi->lock);
+
+ ucsi->ucsi = ucsi_create(dev, &pmic_glink_ucsi_ops);
projects / thirdparty / kernel / stable-queue.git / commitdiff
