--- /dev/null
+From e7585db1b0b5b4e4eb1967bb1472df308f7ffcbf Mon Sep 17 00:00:00 2001
+From: Laurence Tratt <laurie@tratt.net>
+Date: Fri, 12 Jun 2020 12:18:07 +0100
+Subject: ALSA: usb-audio: Add implicit feedback quirk for SSL2+.
+
+From: Laurence Tratt <laurie@tratt.net>
+
+commit e7585db1b0b5b4e4eb1967bb1472df308f7ffcbf upstream.
+
+This uses the same quirk as the Motu M2 and M4 to ensure the driver uses the
+audio interface's clock. Tested on an SSL2+.
+
+Signed-off-by: Laurence Tratt <laurie@tratt.net>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200612111807.dgnig6rwhmsl2bod@overdrive.tratt.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -367,6 +367,7 @@ static int set_sync_ep_implicit_fb_quirk
+ ifnum = 0;
+ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++ case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */
+ ep = 0x81;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
--- /dev/null
+From c9808bbfed3cfc911ecb60fe8e80c0c27876c657 Mon Sep 17 00:00:00 2001
+From: "Yick W. Tse" <y_w_tse@yahoo.com.hk>
+Date: Sat, 13 Jun 2020 11:40:06 +0000
+Subject: ALSA: usb-audio: add quirk for Denon DCD-1500RE
+
+From: Yick W. Tse <y_w_tse@yahoo.com.hk>
+
+commit c9808bbfed3cfc911ecb60fe8e80c0c27876c657 upstream.
+
+fix error "clock source 41 is not valid, cannot use"
+
+[] New USB device found, idVendor=154e, idProduct=1002, bcdDevice= 1.00
+[] New USB device strings: Mfr=1, Product=2, SerialNumber=0
+[] Product: DCD-1500RE
+[] Manufacturer: D & M Holdings Inc.
+[]
+[] clock source 41 is not valid, cannot use
+[] usbcore: registered new interface driver snd-usb-audio
+
+Signed-off-by: Yick W. Tse <y_w_tse@yahoo.com.hk>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1373857985.210365.1592048406997@mail.yahoo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1505,6 +1505,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ static bool is_itf_usb_dsd_dac(unsigned int id)
+ {
+ switch (id) {
++ case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */
+ case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
+ case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
+ case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
--- /dev/null
+From a32a1fc99807244d920d274adc46ba04b538cc8a Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Tue, 23 Jun 2020 19:03:23 +0800
+Subject: ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG)
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+commit a32a1fc99807244d920d274adc46ba04b538cc8a upstream.
+
+We've found Samsung USBC Headset (AKG) (VID: 0x04e8, PID: 0xa051)
+need a tiny delay after each class compliant request.
+Otherwise the device might not be able to be recognized each times.
+
+Signed-off-by: Chihhao Chen <chihhao.chen@mediatek.com>
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1592910203-24035-1-git-send-email-macpaul.lin@mediatek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1647,6 +1647,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ usleep_range(1000, 2000);
++
++ /*
++ * Samsung USBC Headset (AKG) need a tiny delay after each
++ * class compliant request. (Model number: AAM625R or AAM627R)
++ */
++ if (chip->usb_id == USB_ID(0x04e8, 0xa051) &&
++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ usleep_range(5000, 6000);
+ }
+
+ /*
--- /dev/null
+From 73094608b8e214952444fb104651704c98a37aeb Mon Sep 17 00:00:00 2001
+From: Christoffer Nielsen <cn@obviux.dk>
+Date: Fri, 19 Jun 2020 13:48:22 +0200
+Subject: ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S
+
+From: Christoffer Nielsen <cn@obviux.dk>
+
+commit 73094608b8e214952444fb104651704c98a37aeb upstream.
+
+Similar to the Kingston HyperX AMP, the Kingston HyperX Cloud
+Alpha S (0951:0x16ea) uses two interfaces, but only the second
+interface contains the capture stream. This patch delays the
+registration until the second interface appears.
+
+Signed-off-by: Christoffer Nielsen <cn@obviux.dk>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/CAOtG2YHOM3zy+ed9KS-J4HkZo_QGzcUG9MigSp4e4_-13r6B=Q@mail.gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1844,6 +1844,7 @@ struct registration_quirk {
+ static const struct registration_quirk registration_quirks[] = {
+ REG_QUIRK_ENTRY(0x0951, 0x16d8, 2), /* Kingston HyperX AMP */
+ REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */
++ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
+ { 0 } /* terminator */
+ };
+
--- /dev/null
+From 220345e98f1cdc768eeb6e3364a0fa7ab9647fe7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 24 Jun 2020 14:23:40 +0200
+Subject: ALSA: usb-audio: Fix OOB access of mixer element list
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 220345e98f1cdc768eeb6e3364a0fa7ab9647fe7 upstream.
+
+The USB-audio mixer code holds a linked list of usb_mixer_elem_list,
+and several operations are performed for each mixer element. A few of
+them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2())
+assume each mixer element being a usb_mixer_elem_info object that is a
+subclass of usb_mixer_elem_list, cast via container_of() and access it
+members. This may result in an out-of-bound access when a
+non-standard list element has been added, as spotted by syzkaller
+recently.
+
+This patch adds a new field, is_std_info, in usb_mixer_elem_list to
+indicate that the element is the usb_mixer_elem_info type or not, and
+skip the access to such an element if needed.
+
+Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com
+Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer.c | 15 +++++++++++----
+ sound/usb/mixer.h | 9 +++++++--
+ sound/usb/mixer_quirks.c | 3 ++-
+ 3 files changed, 20 insertions(+), 7 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -581,8 +581,9 @@ static int check_matrix_bitmap(unsigned
+ * if failed, give up and free the control instance.
+ */
+
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+- struct snd_kcontrol *kctl)
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++ struct snd_kcontrol *kctl,
++ bool is_std_info)
+ {
+ struct usb_mixer_interface *mixer = list->mixer;
+ int err;
+@@ -596,6 +597,7 @@ int snd_usb_mixer_add_control(struct usb
+ return err;
+ }
+ list->kctl = kctl;
++ list->is_std_info = is_std_info;
+ list->next_id_elem = mixer->id_elems[list->id];
+ mixer->id_elems[list->id] = list;
+ return 0;
+@@ -3234,8 +3236,11 @@ void snd_usb_mixer_notify_id(struct usb_
+ unitid = delegate_notify(mixer, unitid, NULL, NULL);
+
+ for_each_mixer_elem(list, mixer, unitid) {
+- struct usb_mixer_elem_info *info =
+- mixer_elem_list_to_info(list);
++ struct usb_mixer_elem_info *info;
++
++ if (!list->is_std_info)
++ continue;
++ info = mixer_elem_list_to_info(list);
+ /* invalidate cache, so the value is read from the device */
+ info->cached = 0;
+ snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+@@ -3315,6 +3320,8 @@ static void snd_usb_mixer_interrupt_v2(s
+
+ if (!list->kctl)
+ continue;
++ if (!list->is_std_info)
++ continue;
+
+ info = mixer_elem_list_to_info(list);
+ if (count > 1 && info->control != control)
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -66,6 +66,7 @@ struct usb_mixer_elem_list {
+ struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */
+ struct snd_kcontrol *kctl;
+ unsigned int id;
++ bool is_std_info;
+ usb_mixer_elem_dump_func_t dump;
+ usb_mixer_elem_resume_func_t resume;
+ };
+@@ -103,8 +104,12 @@ void snd_usb_mixer_notify_id(struct usb_
+ int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
+ int request, int validx, int value_set);
+
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+- struct snd_kcontrol *kctl);
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++ struct snd_kcontrol *kctl,
++ bool is_std_info);
++
++#define snd_usb_mixer_add_control(list, kctl) \
++ snd_usb_mixer_add_list(list, kctl, true)
+
+ void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list,
+ struct usb_mixer_interface *mixer,
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -158,7 +158,8 @@ static int add_single_ctl_with_resume(st
+ return -ENOMEM;
+ }
+ kctl->private_free = snd_usb_mixer_elem_free;
+- return snd_usb_mixer_add_control(list, kctl);
++ /* don't use snd_usb_mixer_add_control() here, this is a special list element */
++ return snd_usb_mixer_add_list(list, kctl, false);
+ }
+
+ /*
--- /dev/null
+From 8abf41dcd1bcdda0d09905fb59d18f45c035c752 Mon Sep 17 00:00:00 2001
+From: Christopher Swenson <swenson@swenson.io>
+Date: Sun, 14 Jun 2020 17:11:47 -0700
+Subject: ALSA: usb-audio: Set 48 kHz rate for Rodecaster
+
+From: Christopher Swenson <swenson@swenson.io>
+
+commit 8abf41dcd1bcdda0d09905fb59d18f45c035c752 upstream.
+
+Like the Line6 devices, the Rode Rodecaster Pro does not support
+UAC2_CS_RANGE and only supports a sample rate of 48 kHz.
+
+Tested against a Rode Rodecaster Pro.
+
+Tested-by: Christopher Swenson <swenson@swenson.io>
+Signed-off-by: Christopher Swenson <swenson@swenson.io>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/ebdb9e72-9649-0b5e-b9b9-d757dbf26927@swenson.io
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/format.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -394,8 +394,9 @@ skip_rate:
+ return nr_rates;
+ }
+
+-/* Line6 Helix series don't support the UAC2_CS_RANGE usb function
+- * call. Return a static table of known clock rates.
++/* Line6 Helix series and the Rode Rodecaster Pro don't support the
++ * UAC2_CS_RANGE usb function call. Return a static table of known
++ * clock rates.
+ */
+ static int line6_parse_audio_format_rates_quirk(struct snd_usb_audio *chip,
+ struct audioformat *fp)
+@@ -408,6 +409,7 @@ static int line6_parse_audio_format_rate
+ case USB_ID(0x0e41, 0x4248): /* Line6 Helix >= fw 2.82 */
+ case USB_ID(0x0e41, 0x4249): /* Line6 Helix Rack >= fw 2.82 */
+ case USB_ID(0x0e41, 0x424a): /* Line6 Helix LT >= fw 2.82 */
++ case USB_ID(0x19f7, 0x0011): /* Rode Rodecaster Pro */
+ return set_fixed_rate(fp, 48000, SNDRV_PCM_RATE_48000);
+ }
+
--- /dev/null
+From d35d3660e065b69fdb8bf512f3d899f350afce52 Mon Sep 17 00:00:00 2001
+From: Todd Kjos <tkjos@google.com>
+Date: Mon, 22 Jun 2020 13:07:15 -0700
+Subject: binder: fix null deref of proc->context
+
+From: Todd Kjos <tkjos@google.com>
+
+commit d35d3660e065b69fdb8bf512f3d899f350afce52 upstream.
+
+The binder driver makes the assumption proc->context pointer is invariant after
+initialization (as documented in the kerneldoc header for struct proc).
+However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
+proc->context is set to NULL during binder_deferred_release().
+
+Another proc was in the middle of setting up a transaction to the dying
+process and crashed on a NULL pointer deref on "context" which is a local
+set to &proc->context:
+
+ new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
+
+Here's the stack:
+
+[ 5237.855435] Call trace:
+[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec
+[ 5237.855446] binder_inc_ref_for_node+0x140/0x280
+[ 5237.855451] binder_translate_binder+0x1d0/0x388
+[ 5237.855456] binder_transaction+0x2228/0x3730
+[ 5237.855461] binder_thread_write+0x640/0x25bc
+[ 5237.855466] binder_ioctl_write_read+0xb0/0x464
+[ 5237.855471] binder_ioctl+0x30c/0x96c
+[ 5237.855477] do_vfs_ioctl+0x3e0/0x700
+[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4
+[ 5237.855488] el0_svc_common+0xb4/0x194
+[ 5237.855493] el0_svc_handler+0x74/0x98
+[ 5237.855497] el0_svc+0x8/0xc
+
+The fix is to move the kfree of the binder_device to binder_free_proc()
+so the binder_device is freed when we know there are no references
+remaining on the binder_proc.
+
+Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Todd Kjos <tkjos@google.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200622200715.114382-1-tkjos@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/android/binder.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4686,8 +4686,15 @@ static struct binder_thread *binder_get_
+
+ static void binder_free_proc(struct binder_proc *proc)
+ {
++ struct binder_device *device;
++
+ BUG_ON(!list_empty(&proc->todo));
+ BUG_ON(!list_empty(&proc->delivered_death));
++ device = container_of(proc->context, struct binder_device, context);
++ if (refcount_dec_and_test(&device->ref)) {
++ kfree(proc->context->name);
++ kfree(device);
++ }
+ binder_alloc_deferred_release(&proc->alloc);
+ put_task_struct(proc->tsk);
+ binder_stats_deleted(BINDER_STAT_PROC);
+@@ -5406,7 +5413,6 @@ static int binder_node_release(struct bi
+ static void binder_deferred_release(struct binder_proc *proc)
+ {
+ struct binder_context *context = proc->context;
+- struct binder_device *device;
+ struct rb_node *n;
+ int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
+
+@@ -5423,12 +5429,6 @@ static void binder_deferred_release(stru
+ context->binder_context_mgr_node = NULL;
+ }
+ mutex_unlock(&context->context_mgr_node_lock);
+- device = container_of(proc->context, struct binder_device, context);
+- if (refcount_dec_and_test(&device->ref)) {
+- kfree(context->name);
+- kfree(device);
+- }
+- proc->context = NULL;
+ binder_inner_proc_lock(proc);
+ /*
+ * Make sure proc stays alive after we
--- /dev/null
+From 8c289ea064165237891a7b4be77b74d5cba8fa99 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Fri, 19 Jun 2020 19:51:21 +0300
+Subject: mei: me: add tiger lake point device ids for H platforms.
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 8c289ea064165237891a7b4be77b74d5cba8fa99 upstream.
+
+Add Tiger Lake device ids H for HECI1.
+TGH_H is also used in Tatlow SPS platform we need to
+disable the mei interface there.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20200619165121.2145330-7-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me-regs.h | 1 +
+ drivers/misc/mei/hw-me.c | 10 ++++++++++
+ drivers/misc/mei/hw-me.h | 4 ++++
+ drivers/misc/mei/pci-me.c | 1 +
+ 4 files changed, 16 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -94,6 +94,7 @@
+ #define MEI_DEV_ID_JSP_N 0x4DE0 /* Jasper Lake Point N */
+
+ #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
++#define MEI_DEV_ID_TGP_H 0x43E0 /* Tiger Lake Point H */
+
+ #define MEI_DEV_ID_MCC 0x4B70 /* Mule Creek Canyon (EHL) */
+ #define MEI_DEV_ID_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -1526,6 +1526,15 @@ static const struct mei_cfg mei_me_pch15
+ MEI_CFG_TRC,
+ };
+
++/* Tiger Lake with quirk for SPS 5.0 and newer Firmware exclusion */
++static const struct mei_cfg mei_me_pch15_sps_cfg = {
++ MEI_CFG_PCH8_HFS,
++ MEI_CFG_FW_VER_SUPP,
++ MEI_CFG_DMA_128,
++ MEI_CFG_TRC,
++ MEI_CFG_FW_SPS,
++};
++
+ /*
+ * mei_cfg_list - A list of platform platform specific configurations.
+ * Note: has to be synchronized with enum mei_cfg_idx.
+@@ -1544,6 +1553,7 @@ static const struct mei_cfg *const mei_c
+ [MEI_ME_PCH12_SPS_CFG] = &mei_me_pch12_sps_cfg,
+ [MEI_ME_PCH12_SPS_NODMA_CFG] = &mei_me_pch12_nodma_sps_cfg,
+ [MEI_ME_PCH15_CFG] = &mei_me_pch15_cfg,
++ [MEI_ME_PCH15_SPS_CFG] = &mei_me_pch15_sps_cfg,
+ };
+
+ const struct mei_cfg *mei_me_get_cfg(kernel_ulong_t idx)
+--- a/drivers/misc/mei/hw-me.h
++++ b/drivers/misc/mei/hw-me.h
+@@ -87,6 +87,9 @@ struct mei_me_hw {
+ * servers platforms with quirk for
+ * SPS firmware exclusion.
+ * @MEI_ME_PCH15_CFG: Platform Controller Hub Gen15 and newer
++ * @MEI_ME_PCH15_SPS_CFG: Platform Controller Hub Gen15 and newer
++ * servers platforms with quirk for
++ * SPS firmware exclusion.
+ * @MEI_ME_NUM_CFG: Upper Sentinel.
+ */
+ enum mei_cfg_idx {
+@@ -103,6 +106,7 @@ enum mei_cfg_idx {
+ MEI_ME_PCH12_SPS_CFG,
+ MEI_ME_PCH12_SPS_NODMA_CFG,
+ MEI_ME_PCH15_CFG,
++ MEI_ME_PCH15_SPS_CFG,
+ MEI_ME_NUM_CFG,
+ };
+
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -96,6 +96,7 @@ static const struct pci_device_id mei_me
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH15_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_H, MEI_ME_PCH15_SPS_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_JSP_N, MEI_ME_PCH15_CFG)},
+
--- /dev/null
+From f76d77f50b343bc7f7d01e4c2771d43fb074f617 Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Fri, 19 Jun 2020 19:51:15 +0300
+Subject: mei: me: disable mei interface on Mehlow server platforms
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit f76d77f50b343bc7f7d01e4c2771d43fb074f617 upstream.
+
+For SPS firmware versions 5.0 and newer the way detection has changed.
+The detection is done now via PCI_CFG_HFS_3 register.
+To prevent conflict the previous method will get sps_4 suffix
+Disable both CNP_H and CNP_H_3 interfaces. CNP_H_3 requires
+a separate configuration as it doesn't support DMA.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20200619165121.2145330-1-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me-regs.h | 2 +
+ drivers/misc/mei/hw-me.c | 60 +++++++++++++++++++++++++++++++++++++-----
+ drivers/misc/mei/hw-me.h | 13 ++++++---
+ drivers/misc/mei/pci-me.c | 16 +++++------
+ 4 files changed, 73 insertions(+), 18 deletions(-)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -107,6 +107,8 @@
+ # define PCI_CFG_HFS_1_D0I3_MSK 0x80000000
+ #define PCI_CFG_HFS_2 0x48
+ #define PCI_CFG_HFS_3 0x60
++# define PCI_CFG_HFS_3_FW_SKU_MSK 0x00000070
++# define PCI_CFG_HFS_3_FW_SKU_SPS 0x00000060
+ #define PCI_CFG_HFS_4 0x64
+ #define PCI_CFG_HFS_5 0x68
+ #define PCI_CFG_HFS_6 0x6C
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -1366,7 +1366,7 @@ static bool mei_me_fw_type_nm(struct pci
+ #define MEI_CFG_FW_NM \
+ .quirk_probe = mei_me_fw_type_nm
+
+-static bool mei_me_fw_type_sps(struct pci_dev *pdev)
++static bool mei_me_fw_type_sps_4(struct pci_dev *pdev)
+ {
+ u32 reg;
+ unsigned int devfn;
+@@ -1382,7 +1382,36 @@ static bool mei_me_fw_type_sps(struct pc
+ return (reg & 0xf0000) == 0xf0000;
+ }
+
+-#define MEI_CFG_FW_SPS \
++#define MEI_CFG_FW_SPS_4 \
++ .quirk_probe = mei_me_fw_type_sps_4
++
++/**
++ * mei_me_fw_sku_sps() - check for sps sku
++ *
++ * Read ME FW Status register to check for SPS Firmware.
++ * The SPS FW is only signaled in pci function 0
++ *
++ * @pdev: pci device
++ *
++ * Return: true in case of SPS firmware
++ */
++static bool mei_me_fw_type_sps(struct pci_dev *pdev)
++{
++ u32 reg;
++ u32 fw_type;
++ unsigned int devfn;
++
++ devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
++ pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_3, ®);
++ trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_3", PCI_CFG_HFS_3, reg);
++ fw_type = (reg & PCI_CFG_HFS_3_FW_SKU_MSK);
++
++ dev_dbg(&pdev->dev, "fw type is %d\n", fw_type);
++
++ return fw_type == PCI_CFG_HFS_3_FW_SKU_SPS;
++}
++
++#define MEI_CFG_FW_SPS \
+ .quirk_probe = mei_me_fw_type_sps
+
+ #define MEI_CFG_FW_VER_SUPP \
+@@ -1452,10 +1481,17 @@ static const struct mei_cfg mei_me_pch8_
+ };
+
+ /* PCH8 Lynx Point with quirk for SPS Firmware exclusion */
+-static const struct mei_cfg mei_me_pch8_sps_cfg = {
++static const struct mei_cfg mei_me_pch8_sps_4_cfg = {
+ MEI_CFG_PCH8_HFS,
+ MEI_CFG_FW_VER_SUPP,
+- MEI_CFG_FW_SPS,
++ MEI_CFG_FW_SPS_4,
++};
++
++/* LBG with quirk for SPS (4.0) Firmware exclusion */
++static const struct mei_cfg mei_me_pch12_sps_4_cfg = {
++ MEI_CFG_PCH8_HFS,
++ MEI_CFG_FW_VER_SUPP,
++ MEI_CFG_FW_SPS_4,
+ };
+
+ /* Cannon Lake and newer devices */
+@@ -1465,10 +1501,20 @@ static const struct mei_cfg mei_me_pch12
+ MEI_CFG_DMA_128,
+ };
+
+-/* LBG with quirk for SPS Firmware exclusion */
++/* Cannon Lake with quirk for SPS 5.0 and newer Firmware exclusion */
+ static const struct mei_cfg mei_me_pch12_sps_cfg = {
+ MEI_CFG_PCH8_HFS,
+ MEI_CFG_FW_VER_SUPP,
++ MEI_CFG_DMA_128,
++ MEI_CFG_FW_SPS,
++};
++
++/* Cannon Lake with quirk for SPS 5.0 and newer Firmware exclusion
++ * w/o DMA support
++ */
++static const struct mei_cfg mei_me_pch12_nodma_sps_cfg = {
++ MEI_CFG_PCH8_HFS,
++ MEI_CFG_FW_VER_SUPP,
+ MEI_CFG_FW_SPS,
+ };
+
+@@ -1492,9 +1538,11 @@ static const struct mei_cfg *const mei_c
+ [MEI_ME_PCH7_CFG] = &mei_me_pch7_cfg,
+ [MEI_ME_PCH_CPT_PBG_CFG] = &mei_me_pch_cpt_pbg_cfg,
+ [MEI_ME_PCH8_CFG] = &mei_me_pch8_cfg,
+- [MEI_ME_PCH8_SPS_CFG] = &mei_me_pch8_sps_cfg,
++ [MEI_ME_PCH8_SPS_4_CFG] = &mei_me_pch8_sps_4_cfg,
+ [MEI_ME_PCH12_CFG] = &mei_me_pch12_cfg,
++ [MEI_ME_PCH12_SPS_4_CFG] = &mei_me_pch12_sps_4_cfg,
+ [MEI_ME_PCH12_SPS_CFG] = &mei_me_pch12_sps_cfg,
++ [MEI_ME_PCH12_SPS_NODMA_CFG] = &mei_me_pch12_nodma_sps_cfg,
+ [MEI_ME_PCH15_CFG] = &mei_me_pch15_cfg,
+ };
+
+--- a/drivers/misc/mei/hw-me.h
++++ b/drivers/misc/mei/hw-me.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ /*
+- * Copyright (c) 2012-2019, Intel Corporation. All rights reserved.
++ * Copyright (c) 2012-2020, Intel Corporation. All rights reserved.
+ * Intel Management Engine Interface (Intel MEI) Linux driver
+ */
+
+@@ -76,11 +76,14 @@ struct mei_me_hw {
+ * with quirk for Node Manager exclusion.
+ * @MEI_ME_PCH8_CFG: Platform Controller Hub Gen8 and newer
+ * client platforms.
+- * @MEI_ME_PCH8_SPS_CFG: Platform Controller Hub Gen8 and newer
++ * @MEI_ME_PCH8_SPS_4_CFG: Platform Controller Hub Gen8 and newer
+ * servers platforms with quirk for
+ * SPS firmware exclusion.
+ * @MEI_ME_PCH12_CFG: Platform Controller Hub Gen12 and newer
+- * @MEI_ME_PCH12_SPS_CFG: Platform Controller Hub Gen12 and newer
++ * @MEI_ME_PCH12_SPS_4_CFG:Platform Controller Hub Gen12 up to 4.0
++ * servers platforms with quirk for
++ * SPS firmware exclusion.
++ * @MEI_ME_PCH12_SPS_CFG: Platform Controller Hub Gen12 5.0 and newer
+ * servers platforms with quirk for
+ * SPS firmware exclusion.
+ * @MEI_ME_PCH15_CFG: Platform Controller Hub Gen15 and newer
+@@ -94,9 +97,11 @@ enum mei_cfg_idx {
+ MEI_ME_PCH7_CFG,
+ MEI_ME_PCH_CPT_PBG_CFG,
+ MEI_ME_PCH8_CFG,
+- MEI_ME_PCH8_SPS_CFG,
++ MEI_ME_PCH8_SPS_4_CFG,
+ MEI_ME_PCH12_CFG,
++ MEI_ME_PCH12_SPS_4_CFG,
+ MEI_ME_PCH12_SPS_CFG,
++ MEI_ME_PCH12_SPS_NODMA_CFG,
+ MEI_ME_PCH15_CFG,
+ MEI_ME_NUM_CFG,
+ };
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -59,18 +59,18 @@ static const struct pci_device_id mei_me
+ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH7_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH7_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH7_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_4_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_4_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_LP, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_HR, MEI_ME_PCH8_SPS_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_HR, MEI_ME_PCH8_SPS_4_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP_2, MEI_ME_PCH8_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_SPS_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_4_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_4_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_SPS_4_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+@@ -84,8 +84,8 @@ static const struct pci_device_id mei_me
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH12_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_3, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_3, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_SPS_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_3, MEI_ME_PCH12_SPS_NODMA_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)},
--- /dev/null
+From ad38beb373a14e082f4e64b68c0b6e6b09764680 Mon Sep 17 00:00:00 2001
+From: Anand Moon <linux.amoon@gmail.com>
+Date: Tue, 23 Jun 2020 07:46:37 +0000
+Subject: Revert "usb: dwc3: exynos: Add support for Exynos5422 suspend clk"
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+commit ad38beb373a14e082f4e64b68c0b6e6b09764680 upstream.
+
+This reverts commit 07f6842341abe978e6375078f84506ec3280ece5.
+
+Since SCLK_SCLK_USBD300 suspend clock need to be configured
+for phy module, I wrongly mapped this clock to DWC3 code.
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Fixes: 07f6842341ab ("usb: dwc3: exynos: Add support for Exynos5422 suspend clk")
+Link: https://lore.kernel.org/r/20200623074637.756-1-linux.amoon@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/dwc3-exynos.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/usb/dwc3/dwc3-exynos.c
++++ b/drivers/usb/dwc3/dwc3-exynos.c
+@@ -162,12 +162,6 @@ static const struct dwc3_exynos_driverda
+ .suspend_clk_idx = -1,
+ };
+
+-static const struct dwc3_exynos_driverdata exynos5420_drvdata = {
+- .clk_names = { "usbdrd30", "usbdrd30_susp_clk"},
+- .num_clks = 2,
+- .suspend_clk_idx = 1,
+-};
+-
+ static const struct dwc3_exynos_driverdata exynos5433_drvdata = {
+ .clk_names = { "aclk", "susp_clk", "pipe_pclk", "phyclk" },
+ .num_clks = 4,
+@@ -185,9 +179,6 @@ static const struct of_device_id exynos_
+ .compatible = "samsung,exynos5250-dwusb3",
+ .data = &exynos5250_drvdata,
+ }, {
+- .compatible = "samsung,exynos5420-dwusb3",
+- .data = &exynos5420_drvdata,
+- }, {
+ .compatible = "samsung,exynos5433-dwusb3",
+ .data = &exynos5433_drvdata,
+ }, {
alsa-usb-audio-fix-potential-use-after-free-of-strea.patch
revert-i2c-tegra-fix-suspending-in-active-runtime-pm.patch
btrfs-fix-a-block-group-ref-counter-leak-after-failu.patch
+binder-fix-null-deref-of-proc-context.patch
+mei-me-disable-mei-interface-on-mehlow-server-platforms.patch
+mei-me-add-tiger-lake-point-device-ids-for-h-platforms.patch
+revert-usb-dwc3-exynos-add-support-for-exynos5422-suspend-clk.patch
+usb-ohci-sm501-add-missed-iounmap-in-remove.patch
+usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch
+usb-add-usb_quirk_delay_init-for-logitech-c922.patch
+usb-ehci-reopen-solution-for-synopsys-hc-bug.patch
+usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch
+xhci-poll-for-u0-after-disabling-usb2-lpm.patch
+usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch
+usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch
+usb-typec-mux-intel_pmc_mux-fix-dp-alternate-mode-entry.patch
+alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch
+alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch
+alsa-usb-audio-set-48-khz-rate-for-rodecaster.patch
+alsa-usb-audio-add-registration-quirk-for-kingston-hyperx-cloud-flight-s.patch
+alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch
+alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch
+usb-cdns3-trace-using-correct-dir-value.patch
+usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch
+usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch
--- /dev/null
+From 5d8021923e8a8cc37a421a64e27c7221f0fee33c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomasz=20Meresi=C5=84ski?= <tomasz@meresinski.eu>
+Date: Wed, 3 Jun 2020 22:33:46 +0200
+Subject: usb: add USB_QUIRK_DELAY_INIT for Logitech C922
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Meresiński <tomasz@meresinski.eu>
+
+commit 5d8021923e8a8cc37a421a64e27c7221f0fee33c upstream.
+
+The Logitech C922, just like other Logitech webcams,
+needs the USB_QUIRK_DELAY_INIT or it will randomly
+not respond after device connection
+
+Signed-off-by: Tomasz Meresiński <tomasz@meresinski.eu>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200603203347.7792-1-tomasz@meresinski.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -218,11 +218,12 @@ static const struct usb_device_id usb_qu
+ /* Logitech HD Webcam C270 */
+ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
++ /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT },
+
+ /* Logitech ConferenceCam CC3000e */
+ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
--- /dev/null
+From 2587a029fa2a877d0a8dda955ef1b24c94b4bd0e Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 23 Jun 2020 11:09:18 +0800
+Subject: usb: cdns3: ep0: add spinlock for cdns3_check_new_setup
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 2587a029fa2a877d0a8dda955ef1b24c94b4bd0e upstream.
+
+The other thread may access other endpoints when the cdns3_check_new_setup
+is handling, add spinlock to protect it.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Reviewed-by: Pawel Laszczak <pawell@cadence.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/ep0.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/cdns3/ep0.c
++++ b/drivers/usb/cdns3/ep0.c
+@@ -712,15 +712,17 @@ static int cdns3_gadget_ep0_queue(struct
+ int ret = 0;
+ u8 zlp = 0;
+
++ spin_lock_irqsave(&priv_dev->lock, flags);
+ trace_cdns3_ep0_queue(priv_dev, request);
+
+ /* cancel the request if controller receive new SETUP packet. */
+- if (cdns3_check_new_setup(priv_dev))
++ if (cdns3_check_new_setup(priv_dev)) {
++ spin_unlock_irqrestore(&priv_dev->lock, flags);
+ return -ECONNRESET;
++ }
+
+ /* send STATUS stage. Should be called only for SET_CONFIGURATION */
+ if (priv_dev->ep0_stage == CDNS3_STATUS_STAGE) {
+- spin_lock_irqsave(&priv_dev->lock, flags);
+ cdns3_select_ep(priv_dev, 0x00);
+
+ erdy_sent = !priv_dev->hw_configured_flag;
+@@ -745,7 +747,6 @@ static int cdns3_gadget_ep0_queue(struct
+ return 0;
+ }
+
+- spin_lock_irqsave(&priv_dev->lock, flags);
+ if (!list_empty(&priv_ep->pending_req_list)) {
+ dev_err(priv_dev->dev,
+ "can't handle multiple requests for ep0\n");
--- /dev/null
+From b51e1cf64f93acebb6d8afbacd648a6ecefc39b4 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 23 Jun 2020 11:09:16 +0800
+Subject: usb: cdns3: ep0: fix the test mode set incorrectly
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit b51e1cf64f93acebb6d8afbacd648a6ecefc39b4 upstream.
+
+The 'tmode' is ctrl->wIndex, changing it as the real test
+mode value for register assignment.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Reviewed-by: Jun Li <jun.li@nxp.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/ep0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/cdns3/ep0.c
++++ b/drivers/usb/cdns3/ep0.c
+@@ -327,7 +327,8 @@ static int cdns3_ep0_feature_handle_devi
+ if (!set || (tmode & 0xff) != 0)
+ return -EINVAL;
+
+- switch (tmode >> 8) {
++ tmode >>= 8;
++ switch (tmode) {
+ case TEST_J:
+ case TEST_K:
+ case TEST_SE0_NAK:
--- /dev/null
+From ba3a80fe0fb67d8790f62b7bc60df97406d89871 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 23 Jun 2020 11:09:17 +0800
+Subject: usb: cdns3: trace: using correct dir value
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit ba3a80fe0fb67d8790f62b7bc60df97406d89871 upstream.
+
+It should use the correct direction value from register, not depends
+on previous software setting. It fixed the EP number wrong issue at
+trace when the TRBERR interrupt occurs for EP0IN.
+
+When the EP0IN IOC has finished, software prepares the setup packet
+request, the expected direction is OUT, but at that time, the TRBERR
+for EP0IN may occur since it is DMULT mode, the DMA does not stop
+until TRBERR has met.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Reviewed-by: Pawel Laszczak <pawell@cadence.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/cdns3/trace.h
++++ b/drivers/usb/cdns3/trace.h
+@@ -156,7 +156,7 @@ DECLARE_EVENT_CLASS(cdns3_log_ep0_irq,
+ __dynamic_array(char, str, CDNS3_MSG_MAX)
+ ),
+ TP_fast_assign(
+- __entry->ep_dir = priv_dev->ep0_data_dir;
++ __entry->ep_dir = priv_dev->selected_ep;
+ __entry->ep_sts = ep_sts;
+ ),
+ TP_printk("%s", cdns3_decode_ep0_irq(__get_str(str),
--- /dev/null
+From 207324a321a866401b098cadf19e4a2dd6584622 Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Date: Tue, 9 Jun 2020 12:28:11 +0400
+Subject: usb: dwc2: Postponed gadget registration to the udc class driver
+
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+
+commit 207324a321a866401b098cadf19e4a2dd6584622 upstream.
+
+During dwc2 driver probe, after gadget registration to the udc class
+driver, if exist any builtin function driver it immediately bound to
+dwc2 and after init host side (dwc2_hcd_init()) stucked in host mode.
+Patch postpone gadget registration after host side initialization done.
+
+Fixes: 117777b2c3bb9 ("usb: dwc2: Move gadget probe function into platform code")
+Reported-by: kbuild test robot <lkp@intel.com>
+Tested-by: Marek Vasut <marex@denx.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Link: https://lore.kernel.org/r/f21cb38fecc72a230b86155d94c7e60c9cb66f58.1591690938.git.hminas@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc2/gadget.c | 6 ------
+ drivers/usb/dwc2/platform.c | 11 +++++++++++
+ 2 files changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4920,12 +4920,6 @@ int dwc2_gadget_init(struct dwc2_hsotg *
+ epnum, 0);
+ }
+
+- ret = usb_add_gadget_udc(dev, &hsotg->gadget);
+- if (ret) {
+- dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
+- hsotg->ctrl_req);
+- return ret;
+- }
+ dwc2_hsotg_dump(hsotg);
+
+ return 0;
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -536,6 +536,17 @@ static int dwc2_driver_probe(struct plat
+ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL)
+ dwc2_lowlevel_hw_disable(hsotg);
+
++#if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \
++ IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE)
++ /* Postponed adding a new gadget to the udc class driver list */
++ if (hsotg->gadget_enabled) {
++ retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
++ if (retval) {
++ dwc2_hsotg_remove(hsotg);
++ goto error_init;
++ }
++ }
++#endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */
+ return 0;
+
+ error_init:
--- /dev/null
+From 1ddcb71a3edf0e1682b6e056158e4c4b00325f66 Mon Sep 17 00:00:00 2001
+From: Longfang Liu <liulongfang@huawei.com>
+Date: Mon, 8 Jun 2020 11:46:59 +0800
+Subject: USB: ehci: reopen solution for Synopsys HC bug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+commit 1ddcb71a3edf0e1682b6e056158e4c4b00325f66 upstream.
+
+A Synopsys USB2.0 core used in Huawei Kunpeng920 SoC has a bug which
+might cause the host controller not issuing ping.
+
+Bug description:
+After indicating an Interrupt on Async Advance, the software uses the
+doorbell mechanism to delete the Next Link queue head of the last
+executed queue head. At this time, the host controller still references
+the removed queue head(the queue head is NULL). NULL reference causes
+the host controller to lose the USB device.
+
+Solution:
+After deleting the Next Link queue head, when has_synopsys_hc_bug set
+to 1，the software can write one of the valid queue head addresses to
+the ASYNCLISTADDR register to allow the host controller to get
+the valid queue head. in order to solve that problem, this patch set
+the flag for Huawei Kunpeng920
+
+There are detailed instructions and solutions in this patch:
+commit 2f7ac6c19997 ("USB: ehci: add workaround for Synopsys HC bug")
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/1591588019-44284-1-git-send-email-liulongfang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-pci.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -216,6 +216,13 @@ static int ehci_pci_setup(struct usb_hcd
+ ehci_info(ehci, "applying MosChip frame-index workaround\n");
+ ehci->frame_index_bug = 1;
+ break;
++ case PCI_VENDOR_ID_HUAWEI:
++ /* Synopsys HC bug */
++ if (pdev->device == 0xa239) {
++ ehci_info(ehci, "applying Synopsys HC workaround\n");
++ ehci->has_synopsys_hc_bug = 1;
++ }
++ break;
+ }
+
+ /* optional debug port, normally in the first BAR */
--- /dev/null
+From 44ed240d62736ad29943ec01e41e194b96f7c5e9 Mon Sep 17 00:00:00 2001
+From: Tang Bin <tangbin@cmss.chinamobile.com>
+Date: Tue, 2 Jun 2020 19:47:08 +0800
+Subject: usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
+
+From: Tang Bin <tangbin@cmss.chinamobile.com>
+
+commit 44ed240d62736ad29943ec01e41e194b96f7c5e9 upstream.
+
+If the function platform_get_irq() failed, the negative value
+returned will not be detected here. So fix error handling in
+exynos_ehci_probe(). And when get irq failed, the function
+platform_get_irq() logs an error message, so remove redundant
+message here.
+
+Fixes: 1bcc5aa87f04 ("USB: Add initial S5P EHCI driver")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
+Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20200602114708.28620-1-tangbin@cmss.chinamobile.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-exynos.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/ehci-exynos.c
++++ b/drivers/usb/host/ehci-exynos.c
+@@ -203,9 +203,8 @@ static int exynos_ehci_probe(struct plat
+ hcd->rsrc_len = resource_size(res);
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- dev_err(&pdev->dev, "Failed to get IRQ\n");
+- err = -ENODEV;
++ if (irq < 0) {
++ err = irq;
+ goto fail_io;
+ }
+
--- /dev/null
+From a24d5072e87457a14023ee1dd3fc8b1e76f899ef Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Wed, 24 Jun 2020 16:59:47 +0300
+Subject: usb: host: xhci-mtk: avoid runtime suspend when removing hcd
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+commit a24d5072e87457a14023ee1dd3fc8b1e76f899ef upstream.
+
+When runtime suspend was enabled, runtime suspend might happen
+when xhci is removing hcd. This might cause kernel panic when hcd
+has been freed but runtime pm suspend related handle need to
+reference it.
+
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Reviewed-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200624135949.22611-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mtk.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -587,6 +587,9 @@ static int xhci_mtk_remove(struct platfo
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
++ pm_runtime_put_noidle(&dev->dev);
++ pm_runtime_disable(&dev->dev);
++
+ usb_remove_hcd(shared_hcd);
+ xhci->shared_hcd = NULL;
+ device_init_wakeup(&dev->dev, false);
+@@ -597,8 +600,6 @@ static int xhci_mtk_remove(struct platfo
+ xhci_mtk_sch_exit(mtk);
+ xhci_mtk_clks_disable(mtk);
+ xhci_mtk_ldos_disable(mtk);
+- pm_runtime_put_sync(&dev->dev);
+- pm_runtime_disable(&dev->dev);
+
+ return 0;
+ }
--- /dev/null
+From 07c112fb09c86c0231f6ff0061a000ffe91c8eb9 Mon Sep 17 00:00:00 2001
+From: Chuhong Yuan <hslester96@gmail.com>
+Date: Wed, 10 Jun 2020 10:48:44 +0800
+Subject: USB: ohci-sm501: Add missed iounmap() in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+commit 07c112fb09c86c0231f6ff0061a000ffe91c8eb9 upstream.
+
+This driver misses calling iounmap() in remove to undo the ioremap()
+called in probe.
+Add the missed call to fix it.
+
+Fixes: f54aab6ebcec ("usb: ohci-sm501 driver")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20200610024844.3628408-1-hslester96@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ohci-sm501.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/ohci-sm501.c
++++ b/drivers/usb/host/ohci-sm501.c
+@@ -191,6 +191,7 @@ static int ohci_hcd_sm501_drv_remove(str
+ struct resource *mem;
+
+ usb_remove_hcd(hcd);
++ iounmap(hcd->regs);
+ release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ usb_put_hcd(hcd);
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
--- /dev/null
+From 130206a88683d859f63ed6d4a56ab5c2b4930c8e Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Fri, 29 May 2020 16:17:53 +0300
+Subject: usb: typec: mux: intel_pmc_mux: Fix DP alternate mode entry
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 130206a88683d859f63ed6d4a56ab5c2b4930c8e upstream.
+
+The PMC needs to be notified separately about HPD (hotplug
+detected) signal being high after mode entry. There is a bit
+"HPD High" in the Alternate Mode Request that the driver
+already sets, but that bit is only valid when the
+DisplayPort Alternate Mode is directly entered from
+disconnected state.
+
+Fixes: 5c4edcdbcd97 ("usb: typec: mux: intel: Fix DP_HPD_LVL bit field")
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Cc: stable <stable@vger.kernel.org>
+Tested-by: Prashant Malani <pmalani@chromium.org>
+Link: https://lore.kernel.org/r/20200529131753.15587-1-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -129,7 +129,8 @@ pmc_usb_mux_dp_hpd(struct pmc_usb_port *
+ msg[0] = PMC_USB_DP_HPD;
+ msg[0] |= port->usb3_port << PMC_USB_MSG_USB3_PORT_SHIFT;
+
+- msg[1] = PMC_USB_DP_HPD_IRQ;
++ if (data->status & DP_STATUS_IRQ_HPD)
++ msg[1] = PMC_USB_DP_HPD_IRQ;
+
+ if (data->status & DP_STATUS_HPD_STATE)
+ msg[1] |= PMC_USB_DP_HPD_LVL;
+@@ -142,6 +143,7 @@ pmc_usb_mux_dp(struct pmc_usb_port *port
+ {
+ struct typec_displayport_data *data = state->data;
+ struct altmode_req req = { };
++ int ret;
+
+ if (data->status & DP_STATUS_IRQ_HPD)
+ return pmc_usb_mux_dp_hpd(port, state);
+@@ -161,7 +163,14 @@ pmc_usb_mux_dp(struct pmc_usb_port *port
+ if (data->status & DP_STATUS_HPD_STATE)
+ req.mode_data |= PMC_USB_ALTMODE_HPD_HIGH;
+
+- return pmc_usb_command(port, (void *)&req, sizeof(req));
++ ret = pmc_usb_command(port, (void *)&req, sizeof(req));
++ if (ret)
++ return ret;
++
++ if (data->status & DP_STATUS_HPD_STATE)
++ return pmc_usb_mux_dp_hpd(port, state);
++
++ return 0;
+ }
+
+ static int
--- /dev/null
+From 302c570bf36e997d55ad0d60628a2feec76954a4 Mon Sep 17 00:00:00 2001
+From: Li Jun <jun.li@nxp.com>
+Date: Thu, 4 Jun 2020 19:21:18 +0800
+Subject: usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs
+
+From: Li Jun <jun.li@nxp.com>
+
+commit 302c570bf36e997d55ad0d60628a2feec76954a4 upstream.
+
+John reported screaming irq caused by rt1711h when system boot[1],
+this is because irq request is done before tcpci_register_port(),
+so the chip->tcpci has not been setup, irq handler is entered but
+can't do anything, this patch is to address this by moving the irq
+request after tcpci_register_port().
+
+[1] https://lore.kernel.org/linux-usb/20200530040157.31038-1-john.stultz@linaro.org
+
+Fixes: ce08eaeb6388 ("staging: typec: rt1711h typec chip driver")
+Cc: stable <stable@vger.kernel.org> # v4.18+
+Cc: John Stultz <john.stultz@linaro.org>
+Reported-and-tested-by: John Stultz <john.stultz@linaro.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Link: https://lore.kernel.org/r/20200604112118.38062-1-jun.li@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/tcpm/tcpci_rt1711h.c | 31 ++++++++++---------------------
+ 1 file changed, 10 insertions(+), 21 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c
++++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c
+@@ -179,26 +179,6 @@ out:
+ return tcpci_irq(chip->tcpci);
+ }
+
+-static int rt1711h_init_alert(struct rt1711h_chip *chip,
+- struct i2c_client *client)
+-{
+- int ret;
+-
+- /* Disable chip interrupts before requesting irq */
+- ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0);
+- if (ret < 0)
+- return ret;
+-
+- ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
+- rt1711h_irq,
+- IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+- dev_name(chip->dev), chip);
+- if (ret < 0)
+- return ret;
+- enable_irq_wake(client->irq);
+- return 0;
+-}
+-
+ static int rt1711h_sw_reset(struct rt1711h_chip *chip)
+ {
+ int ret;
+@@ -260,7 +240,8 @@ static int rt1711h_probe(struct i2c_clie
+ if (ret < 0)
+ return ret;
+
+- ret = rt1711h_init_alert(chip, client);
++ /* Disable chip interrupts before requesting irq */
++ ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0);
+ if (ret < 0)
+ return ret;
+
+@@ -271,6 +252,14 @@ static int rt1711h_probe(struct i2c_clie
+ if (IS_ERR_OR_NULL(chip->tcpci))
+ return PTR_ERR(chip->tcpci);
+
++ ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
++ rt1711h_irq,
++ IRQF_ONESHOT | IRQF_TRIGGER_LOW,
++ dev_name(chip->dev), chip);
++ if (ret < 0)
++ return ret;
++ enable_irq_wake(client->irq);
++
+ return 0;
+ }
+
--- /dev/null
+From b3d71abd135e6919ca0b6cab463738472653ddfb Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Wed, 24 Jun 2020 16:59:49 +0300
+Subject: xhci: Poll for U0 after disabling USB2 LPM
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit b3d71abd135e6919ca0b6cab463738472653ddfb upstream.
+
+USB2 devices with LPM enabled may interrupt the system suspend:
+[ 932.510475] usb 1-7: usb suspend, wakeup 0
+[ 932.510549] hub 1-0:1.0: hub_suspend
+[ 932.510581] usb usb1: bus suspend, wakeup 0
+[ 932.510590] xhci_hcd 0000:00:14.0: port 9 not suspended
+[ 932.510593] xhci_hcd 0000:00:14.0: port 8 not suspended
+..
+[ 932.520323] xhci_hcd 0000:00:14.0: Port change event, 1-7, id 7, portsc: 0x400e03
+..
+[ 932.591405] PM: pci_pm_suspend(): hcd_pci_suspend+0x0/0x30 returns -16
+[ 932.591414] PM: dpm_run_callback(): pci_pm_suspend+0x0/0x160 returns -16
+[ 932.591418] PM: Device 0000:00:14.0 failed to suspend async: error -16
+
+During system suspend, USB core will let HC suspends the device if it
+doesn't have remote wakeup enabled and doesn't have any children.
+However, from the log above we can see that the usb 1-7 doesn't get bus
+suspended due to not in U0. After a while the port finished U2 -> U0
+transition, interrupts the suspend process.
+
+The observation is that after disabling LPM, port doesn't transit to U0
+immediately and can linger in U2. xHCI spec 4.23.5.2 states that the
+maximum exit latency for USB2 LPM should be BESL + 10us. The BESL for
+the affected device is advertised as 400us, which is still not enough
+based on my testing result.
+
+So let's use the maximum permitted latency, 10000, to poll for U0
+status to solve the issue.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200624135949.22611-6-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4471,6 +4471,9 @@ static int xhci_set_usb2_hardware_lpm(st
+ mutex_lock(hcd->bandwidth_mutex);
+ xhci_change_max_exit_latency(xhci, udev, 0);
+ mutex_unlock(hcd->bandwidth_mutex);
++ readl_poll_timeout(ports[port_num]->addr, pm_val,
++ (pm_val & PORT_PLS_MASK) == XDEV_U0,
++ 100, 10000);
+ return 0;
+ }
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
