--- /dev/null
+From cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:27 +0200
+Subject: can: kvaser_usb: Fix use of uninitialized completion
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 upstream.
+
+flush_comp is initialized when CMD_FLUSH_QUEUE is sent to the device and
+completed when the device sends CMD_FLUSH_QUEUE_RESP.
+
+This causes completion of uninitialized completion if the device sends
+CMD_FLUSH_QUEUE_RESP before CMD_FLUSH_QUEUE is ever sent (e.g. as a
+response to a flush by a previously bound driver, or a misbehaving
+device).
+
+Fix that by initializing flush_comp in kvaser_usb_init_one() like the
+other completions.
+
+This issue is only triggerable after RX URBs have been set up, i.e. the
+interface has been opened at least once.
+
+Cc: stable@vger.kernel.org
+Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-3-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 +
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -729,6 +729,7 @@ static int kvaser_usb_init_one(struct kv
+ init_usb_anchor(&priv->tx_submitted);
+ init_completion(&priv->start_comp);
+ init_completion(&priv->stop_comp);
++ init_completion(&priv->flush_comp);
+ priv->can.ctrlmode_supported = 0;
+
+ priv->dev = dev;
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1916,7 +1916,7 @@ static int kvaser_usb_hydra_flush_queue(
+ {
+ int err;
+
+- init_completion(&priv->flush_comp);
++ reinit_completion(&priv->flush_comp);
+
+ err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_FLUSH_QUEUE,
+ priv->channel);
--- /dev/null
+From 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:29 +0200
+Subject: can: kvaser_usb_leaf: Fix CAN state after restart
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 upstream.
+
+can_restart() expects CMD_START_CHIP to set the error state to
+ERROR_ACTIVE as it calls netif_carrier_on() immediately afterwards.
+
+Otherwise the user may immediately trigger restart again and hit a
+BUG_ON() in can_restart().
+
+Fix kvaser_usb_leaf set_mode(CMD_START_CHIP) to set the expected state.
+
+Cc: stable@vger.kernel.org
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-5-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1431,6 +1431,8 @@ static int kvaser_usb_leaf_set_mode(stru
+ err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP);
+ if (err)
+ return err;
++
++ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ break;
+ default:
+ return -EOPNOTSUPP;
--- /dev/null
+From 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:26 +0200
+Subject: can: kvaser_usb_leaf: Fix overread with an invalid command
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream.
+
+For command events read from the device,
+kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not
+exceed the size of the received data, but the actual kvaser_cmd handlers
+will happily read any kvaser_cmd fields without checking for cmd->len.
+
+This can cause an overread if the last cmd in the buffer is shorter than
+expected for the command type (with cmd->len showing the actual short
+size).
+
+Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of
+which are delivered to userspace as-is.
+
+Fix that by verifying the length of command before handling it.
+
+This issue can only occur after RX URBs have been set up, i.e. the
+interface has been opened at least once.
+
+Cc: stable@vger.kernel.org
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-2-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 +++++++++++++++++++++++
+ 1 file changed, 75 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -310,6 +310,38 @@ struct kvaser_cmd {
+ } u;
+ } __packed;
+
++#define CMD_SIZE_ANY 0xff
++#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field)
++
++static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = {
++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.leaf.softinfo),
++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
++ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message),
++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event),
++ /* ignored events: */
++ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY,
++};
++
++static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = {
++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.usbcan.softinfo),
++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event),
++ /* ignored events: */
++ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY,
++};
++
+ /* Summary of a kvaser error event, for a unified Leaf/Usbcan error
+ * handling. Some discrepancies between the two families exist:
+ *
+@@ -397,6 +429,43 @@ static const struct kvaser_usb_dev_cfg k
+ .bittiming_const = &kvaser_usb_flexc_bittiming_const,
+ };
+
++static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev,
++ const struct kvaser_cmd *cmd)
++{
++ /* buffer size >= cmd->len ensured by caller */
++ u8 min_size = 0;
++
++ switch (dev->driver_info->family) {
++ case KVASER_LEAF:
++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf))
++ min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id];
++ break;
++ case KVASER_USBCAN:
++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan))
++ min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id];
++ break;
++ }
++
++ if (min_size == CMD_SIZE_ANY)
++ return 0;
++
++ if (min_size) {
++ min_size += CMD_HEADER_LEN;
++ if (cmd->len >= min_size)
++ return 0;
++
++ dev_err_ratelimited(&dev->intf->dev,
++ "Received command %u too short (size %u, needed %u)",
++ cmd->id, cmd->len, min_size);
++ return -EIO;
++ }
++
++ dev_warn_ratelimited(&dev->intf->dev,
++ "Unhandled command (%d, size %d)\n",
++ cmd->id, cmd->len);
++ return -EINVAL;
++}
++
+ static void *
+ kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv,
+ const struct sk_buff *skb, int *cmd_len,
+@@ -502,6 +571,9 @@ static int kvaser_usb_leaf_wait_cmd(cons
+ end:
+ kfree(buf);
+
++ if (err == 0)
++ err = kvaser_usb_leaf_verify_size(dev, cmd);
++
+ return err;
+ }
+
+@@ -1133,6 +1205,9 @@ static void kvaser_usb_leaf_stop_chip_re
+ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
+ const struct kvaser_cmd *cmd)
+ {
++ if (kvaser_usb_leaf_verify_size(dev, cmd) < 0)
++ return;
++
+ switch (cmd->id) {
+ case CMD_START_CHIP_REPLY:
+ kvaser_usb_leaf_start_chip_reply(dev, cmd);
--- /dev/null
+From 455561fb618fde40558776b5b8435f9420f335db Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 17:08:28 +0200
+Subject: can: kvaser_usb_leaf: Fix TX queue out of sync after restart
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 455561fb618fde40558776b5b8435f9420f335db upstream.
+
+The TX queue seems to be implicitly flushed by the hardware during
+bus-off or bus-off recovery, but the driver does not reset the TX
+bookkeeping.
+
+Despite not resetting TX bookkeeping the driver still re-enables TX
+queue unconditionally, leading to "cannot find free context" /
+NETDEV_TX_BUSY errors if the TX queue was full at bus-off time.
+
+Fix that by resetting TX bookkeeping on CAN restart.
+
+Tested with 0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778.
+
+Cc: stable@vger.kernel.org
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010150829.199676-4-extja@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 ++
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 +-
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+@@ -178,6 +178,8 @@ struct kvaser_usb_dev_cfg {
+ extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops;
+ extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops;
+
++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv);
++
+ int kvaser_usb_recv_cmd(const struct kvaser_usb *dev, void *cmd, int len,
+ int *actual_len);
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -477,7 +477,7 @@ static void kvaser_usb_reset_tx_urb_cont
+ /* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+ {
+ usb_kill_anchored_urbs(&priv->tx_submitted);
+ kvaser_usb_reset_tx_urb_contexts(priv);
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1426,6 +1426,8 @@ static int kvaser_usb_leaf_set_mode(stru
+
+ switch (mode) {
+ case CAN_MODE_START:
++ kvaser_usb_unlink_tx_urbs(priv);
++
+ err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP);
+ if (err)
+ return err;
--- /dev/null
+From bb44c31cdcac107344dd2fcc3bd0504a53575c51 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Tue, 20 Sep 2022 14:32:02 +1000
+Subject: cifs: destage dirty pages before re-reading them for cache=none
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+commit bb44c31cdcac107344dd2fcc3bd0504a53575c51 upstream.
+
+This is the opposite case of kernel bugzilla 216301.
+If we mmap a file using cache=none and then proceed to update the mmapped
+area these updates are not reflected in a later pread() of that part of the
+file.
+To fix this we must first destage any dirty pages in the range before
+we allow the pread() to proceed.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/file.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -4271,6 +4271,15 @@ static ssize_t __cifs_readv(
+ len = ctx->len;
+ }
+
++ if (direct) {
++ rc = filemap_write_and_wait_range(file->f_inode->i_mapping,
++ offset, offset + len - 1);
++ if (rc) {
++ kref_put(&ctx->refcount, cifs_aio_ctx_release);
++ return -EAGAIN;
++ }
++ }
++
+ /* grab a lock here due to read response handlers can access ctx */
+ mutex_lock(&ctx->aio_mutex);
+
--- /dev/null
+From e98ecc6e94f4e6d21c06660b0f336df02836694f Mon Sep 17 00:00:00 2001
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Date: Mon, 26 Sep 2022 11:36:29 +0800
+Subject: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+commit e98ecc6e94f4e6d21c06660b0f336df02836694f upstream.
+
+Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
+extend the dialects from 3 to 4, but forget to decrease the extended
+length when specific the dialect, then the message length is larger
+than expected.
+
+This maybe leak some info through network because not initialize the
+message body.
+
+After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is
+reduced from 28 bytes to 26 bytes.
+
+Fixes: d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Cc: <stable@vger.kernel.org>
+Acked-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Tom Talpey <tom@talpey.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/smb2pdu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1169,9 +1169,9 @@ int smb3_validate_negotiate(const unsign
+ pneg_inbuf->Dialects[0] =
+ cpu_to_le16(server->vals->protocol_id);
+ pneg_inbuf->DialectCount = cpu_to_le16(1);
+- /* structure is big enough for 3 dialects, sending only 1 */
++ /* structure is big enough for 4 dialects, sending only 1 */
+ inbuflen = sizeof(*pneg_inbuf) -
+- sizeof(pneg_inbuf->Dialects[0]) * 2;
++ sizeof(pneg_inbuf->Dialects[0]) * 3;
+ }
+
+ rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
--- /dev/null
+From 365e1ececb2905f94cc10a5817c5b644a32a3ae2 Mon Sep 17 00:00:00 2001
+From: Gaurav Kohli <gauravkohli@linux.microsoft.com>
+Date: Wed, 5 Oct 2022 22:52:59 -0700
+Subject: hv_netvsc: Fix race between VF offering and VF association message from host
+
+From: Gaurav Kohli <gauravkohli@linux.microsoft.com>
+
+commit 365e1ececb2905f94cc10a5817c5b644a32a3ae2 upstream.
+
+During vm boot, there might be possibility that vf registration
+call comes before the vf association from host to vm.
+
+And this might break netvsc vf path, To prevent the same block
+vf registration until vf bind message comes from host.
+
+Cc: stable@vger.kernel.org
+Fixes: 00d7ddba11436 ("hv_netvsc: pair VF based on serial number")
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Gaurav Kohli <gauravkohli@linux.microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hyperv/hyperv_net.h | 3 ++-
+ drivers/net/hyperv/netvsc.c | 4 ++++
+ drivers/net/hyperv/netvsc_drv.c | 19 +++++++++++++++++++
+ 3 files changed, 25 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -1051,7 +1051,8 @@ struct net_device_context {
+ u32 vf_alloc;
+ /* Serial number of the VF to team with */
+ u32 vf_serial;
+-
++ /* completion variable to confirm vf association */
++ struct completion vf_add;
+ /* Is the current data path through the VF NIC? */
+ bool data_path_is_vf;
+
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1580,6 +1580,10 @@ static void netvsc_send_vf(struct net_de
+
+ net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
+ net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
++
++ if (net_device_ctx->vf_alloc)
++ complete(&net_device_ctx->vf_add);
++
+ netdev_info(ndev, "VF slot %u %s\n",
+ net_device_ctx->vf_serial,
+ net_device_ctx->vf_alloc ? "added" : "removed");
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -2313,6 +2313,18 @@ static struct net_device *get_netvsc_bys
+
+ }
+
++ /* Fallback path to check synthetic vf with
++ * help of mac addr
++ */
++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
++ ndev = hv_get_drvdata(ndev_ctx->device_ctx);
++ if (ether_addr_equal(vf_netdev->perm_addr, ndev->perm_addr)) {
++ netdev_notice(vf_netdev,
++ "falling back to mac addr based matching\n");
++ return ndev;
++ }
++ }
++
+ netdev_notice(vf_netdev,
+ "no netdev found for vf serial:%u\n", serial);
+ return NULL;
+@@ -2409,6 +2421,11 @@ static int netvsc_vf_changed(struct net_
+ if (net_device_ctx->data_path_is_vf == vf_is_up)
+ return NOTIFY_OK;
+
++ if (vf_is_up && !net_device_ctx->vf_alloc) {
++ netdev_info(ndev, "Waiting for the VF association from host\n");
++ wait_for_completion(&net_device_ctx->vf_add);
++ }
++
+ ret = netvsc_switch_datapath(ndev, vf_is_up);
+
+ if (ret) {
+@@ -2440,6 +2457,7 @@ static int netvsc_unregister_vf(struct n
+
+ netvsc_vf_setxdp(vf_netdev, NULL);
+
++ reinit_completion(&net_device_ctx->vf_add);
+ netdev_rx_handler_unregister(vf_netdev);
+ netdev_upper_dev_unlink(vf_netdev, ndev);
+ RCU_INIT_POINTER(net_device_ctx->vf_netdev, NULL);
+@@ -2479,6 +2497,7 @@ static int netvsc_probe(struct hv_device
+
+ INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
+
++ init_completion(&net_device_ctx->vf_add);
+ spin_lock_init(&net_device_ctx->lock);
+ INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
+ INIT_DELAYED_WORK(&net_device_ctx->vf_takeover, netvsc_vf_setup);
--- /dev/null
+From 301c8f5c32c8fb79c67539bc23972dc3ef48024c Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Tue, 27 Sep 2022 16:56:44 +0300
+Subject: i2c: designware: Fix handling of real but unexpected device interrupts
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit 301c8f5c32c8fb79c67539bc23972dc3ef48024c upstream.
+
+Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI
+IDs") caused a regression on certain Gigabyte motherboards for Intel
+Alder Lake-S where system crashes to NULL pointer dereference in
+i2c_dw_xfer_msg() when system resumes from S3 sleep state ("deep").
+
+I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made
+following notes:
+
+- Issue happens when resuming from S3 but not when resuming from
+ "s2idle"
+- PCI device 00:15.0 == i2c_designware.0 is already in D0 state when
+ system enters into pci_pm_resume_noirq() while all other i2c_designware
+ PCI devices are in D3. Devices were runtime suspended and in D3 prior
+ entering into suspend
+- Interrupt comes after pci_pm_resume_noirq() when device interrupts are
+ re-enabled
+- According to register dump the interrupt really comes from the
+ i2c_designware.0. Controller is enabled, I2C target address register
+ points to a one detectable I2C device address 0x60 and the
+ DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and
+ TX_EMPTY bits are set indicating completed I2C transaction.
+
+My guess is that the firmware uses this controller to communicate with
+an on-board I2C device during resume but does not disable the controller
+before giving control to an operating system.
+
+I was told the UEFI update fixes this but never the less it revealed the
+driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device
+is supposed to be idle and state variables are not set (especially the
+dev->msgs pointer which may point to NULL or stale old data).
+
+Introduce a new software status flag STATUS_ACTIVE indicating when the
+controller is active in driver point of view. Now treat all interrupts
+that occur when is not set as unexpected and mask all interrupts from
+the controller.
+
+Fixes: c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs")
+Reported-by: Samuel Clark <slc2015@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215907
+Cc: stable@vger.kernel.org # v5.12+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-designware-core.h | 7 +++++--
+ drivers/i2c/busses/i2c-designware-master.c | 13 +++++++++++++
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -126,8 +126,9 @@
+ * status codes
+ */
+ #define STATUS_IDLE 0x0
+-#define STATUS_WRITE_IN_PROGRESS 0x1
+-#define STATUS_READ_IN_PROGRESS 0x2
++#define STATUS_ACTIVE 0x1
++#define STATUS_WRITE_IN_PROGRESS 0x2
++#define STATUS_READ_IN_PROGRESS 0x4
+
+ /*
+ * operation modes
+@@ -334,12 +335,14 @@ void i2c_dw_disable_int(struct dw_i2c_de
+
+ static inline void __i2c_dw_enable(struct dw_i2c_dev *dev)
+ {
++ dev->status |= STATUS_ACTIVE;
+ regmap_write(dev->map, DW_IC_ENABLE, 1);
+ }
+
+ static inline void __i2c_dw_disable_nowait(struct dw_i2c_dev *dev)
+ {
+ regmap_write(dev->map, DW_IC_ENABLE, 0);
++ dev->status &= ~STATUS_ACTIVE;
+ }
+
+ void __i2c_dw_disable(struct dw_i2c_dev *dev);
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -716,6 +716,19 @@ static int i2c_dw_irq_handler_master(str
+ u32 stat;
+
+ stat = i2c_dw_read_clear_intrbits(dev);
++
++ if (!(dev->status & STATUS_ACTIVE)) {
++ /*
++ * Unexpected interrupt in driver point of view. State
++ * variables are either unset or stale so acknowledge and
++ * disable interrupts for suppressing further interrupts if
++ * interrupt really came from this HW (E.g. firmware has left
++ * the HW active).
++ */
++ regmap_write(dev->map, DW_IC_INTR_MASK, 0);
++ return 0;
++ }
++
+ if (stat & DW_IC_INTR_TX_ABRT) {
+ dev->cmd_err |= DW_IC_ERR_TX_ABRT;
+ dev->status = STATUS_IDLE;
--- /dev/null
+From f4f43f01cff2f29779343ade755191afd2581c77 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
+Date: Mon, 12 Sep 2022 10:12:21 +0200
+Subject: iio: adc: ad7923: fix channel readings for some variants
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+commit f4f43f01cff2f29779343ade755191afd2581c77 upstream.
+
+Some of the supported devices have 4 or 2 LSB trailing bits that should
+not be taken into account. Hence we need to shift these bits out which
+fits perfectly on the scan type shift property. This change fixes both
+raw and buffered reads.
+
+Fixes: f2f7a449707e ("iio:adc:ad7923: Add support for the ad7904/ad7914/ad7924")
+Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928")
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20220912081223.173584-2-nuno.sa@analog.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7923.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ad7923.c
++++ b/drivers/iio/adc/ad7923.c
+@@ -93,6 +93,7 @@ enum ad7923_id {
+ .sign = 'u', \
+ .realbits = (bits), \
+ .storagebits = 16, \
++ .shift = 12 - (bits), \
+ .endianness = IIO_BE, \
+ }, \
+ }
+@@ -268,7 +269,8 @@ static int ad7923_read_raw(struct iio_de
+ return ret;
+
+ if (chan->address == EXTRACT(ret, 12, 4))
+- *val = EXTRACT(ret, 0, 12);
++ *val = EXTRACT(ret, chan->scan_type.shift,
++ chan->scan_type.realbits);
+ else
+ return -EIO;
+
--- /dev/null
+From 558a25f903b4af6361b7fbeea08a6446a0745653 Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Tue, 13 Sep 2022 09:34:12 +0200
+Subject: iio: dac: ad5593r: Fix i2c read protocol requirements
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+commit 558a25f903b4af6361b7fbeea08a6446a0745653 upstream.
+
+For reliable operation across the full range of supported
+interface rates, the AD5593R needs a STOP condition between
+address write, and data read (like show in the datasheet Figure 40)
+so in turn i2c_smbus_read_word_swapped cannot be used.
+
+While at it, a simple helper was added to make the code simpler.
+
+Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs")
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220913073413.140475-2-nuno.sa@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5593r.c | 46 +++++++++++++++++++++++++++-------------------
+ 1 file changed, 27 insertions(+), 19 deletions(-)
+
+--- a/drivers/iio/dac/ad5593r.c
++++ b/drivers/iio/dac/ad5593r.c
+@@ -13,6 +13,8 @@
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+
++#include <asm/unaligned.h>
++
+ #define AD5593R_MODE_CONF (0 << 4)
+ #define AD5593R_MODE_DAC_WRITE (1 << 4)
+ #define AD5593R_MODE_ADC_READBACK (4 << 4)
+@@ -20,6 +22,24 @@
+ #define AD5593R_MODE_GPIO_READBACK (6 << 4)
+ #define AD5593R_MODE_REG_READBACK (7 << 4)
+
++static int ad5593r_read_word(struct i2c_client *i2c, u8 reg, u16 *value)
++{
++ int ret;
++ u8 buf[2];
++
++ ret = i2c_smbus_write_byte(i2c, reg);
++ if (ret < 0)
++ return ret;
++
++ ret = i2c_master_recv(i2c, buf, sizeof(buf));
++ if (ret < 0)
++ return ret;
++
++ *value = get_unaligned_be16(buf);
++
++ return 0;
++}
++
+ static int ad5593r_write_dac(struct ad5592r_state *st, unsigned chan, u16 value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+@@ -38,13 +58,7 @@ static int ad5593r_read_adc(struct ad559
+ if (val < 0)
+ return (int) val;
+
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_ADC_READBACK);
+- if (val < 0)
+- return (int) val;
+-
+- *value = (u16) val;
+-
+- return 0;
++ return ad5593r_read_word(i2c, AD5593R_MODE_ADC_READBACK, value);
+ }
+
+ static int ad5593r_reg_write(struct ad5592r_state *st, u8 reg, u16 value)
+@@ -58,25 +72,19 @@ static int ad5593r_reg_write(struct ad55
+ static int ad5593r_reg_read(struct ad5592r_state *st, u8 reg, u16 *value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+- s32 val;
+-
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_REG_READBACK | reg);
+- if (val < 0)
+- return (int) val;
+
+- *value = (u16) val;
+-
+- return 0;
++ return ad5593r_read_word(i2c, AD5593R_MODE_REG_READBACK | reg, value);
+ }
+
+ static int ad5593r_gpio_read(struct ad5592r_state *st, u8 *value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+- s32 val;
++ u16 val;
++ int ret;
+
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_GPIO_READBACK);
+- if (val < 0)
+- return (int) val;
++ ret = ad5593r_read_word(i2c, AD5593R_MODE_GPIO_READBACK, &val);
++ if (ret)
++ return ret;
+
+ *value = (u8) val;
+
--- /dev/null
+From 7f4f1096d5921f5d90547596f9ce80e0b924f887 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Mon, 15 Aug 2022 09:16:47 +0000
+Subject: iio: ltc2497: Fix reading conversion results
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 7f4f1096d5921f5d90547596f9ce80e0b924f887 upstream.
+
+After the result of the previous conversion is read the chip
+automatically starts a new conversion and doesn't accept new i2c
+transfers until this conversion is completed which makes the function
+return failure.
+
+So add an early return iff the programming of the new address isn't
+needed. Note this will not fix the problem in general, but all cases
+that are currently used. Once this changes we get the failure back, but
+this can be addressed when the need arises.
+
+Fixes: 69548b7c2c4f ("iio: adc: ltc2497: split protocol independent part in a separate module ")
+Reported-by: Meng Li <Meng.Li@windriver.com>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Tested-by: Denys Zagorui <dzagorui@cisco.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220815091647.1523532-1-dzagorui@cisco.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ltc2497.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/iio/adc/ltc2497.c
++++ b/drivers/iio/adc/ltc2497.c
+@@ -41,6 +41,19 @@ static int ltc2497_result_and_measure(st
+ }
+
+ *val = (be32_to_cpu(st->buf) >> 14) - (1 << 17);
++
++ /*
++ * The part started a new conversion at the end of the above i2c
++ * transfer, so if the address didn't change since the last call
++ * everything is fine and we can return early.
++ * If not (which should only happen when some sort of bulk
++ * conversion is implemented) we have to program the new
++ * address. Note that this probably fails as the conversion that
++ * was triggered above is like not complete yet and the two
++ * operations have to be done in a single transfer.
++ */
++ if (ddata->addr_prev == address)
++ return 0;
+ }
+
+ ret = i2c_smbus_write_byte(st->client,
--- /dev/null
+From c2329717bdd3fa62f8a2f3d8d85ad0bee4556bd7 Mon Sep 17 00:00:00 2001
+From: Eddie James <eajames@linux.ibm.com>
+Date: Thu, 15 Sep 2022 14:57:18 -0500
+Subject: iio: pressure: dps310: Refactor startup procedure
+
+From: Eddie James <eajames@linux.ibm.com>
+
+commit c2329717bdd3fa62f8a2f3d8d85ad0bee4556bd7 upstream.
+
+Move the startup procedure into a function, and correct a missing
+check on the return code for writing the PRS_CFG register.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20220915195719.136812-2-eajames@linux.ibm.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/dps310.c | 188 ++++++++++++++++++++++--------------------
+ 1 file changed, 99 insertions(+), 89 deletions(-)
+
+--- a/drivers/iio/pressure/dps310.c
++++ b/drivers/iio/pressure/dps310.c
+@@ -159,6 +159,102 @@ static int dps310_get_coefs(struct dps31
+ return 0;
+ }
+
++/*
++ * Some versions of the chip will read temperatures in the ~60C range when
++ * it's actually ~20C. This is the manufacturer recommended workaround
++ * to correct the issue. The registers used below are undocumented.
++ */
++static int dps310_temp_workaround(struct dps310_data *data)
++{
++ int rc;
++ int reg;
++
++ rc = regmap_read(data->regmap, 0x32, ®);
++ if (rc)
++ return rc;
++
++ /*
++ * If bit 1 is set then the device is okay, and the workaround does not
++ * need to be applied
++ */
++ if (reg & BIT(1))
++ return 0;
++
++ rc = regmap_write(data->regmap, 0x0e, 0xA5);
++ if (rc)
++ return rc;
++
++ rc = regmap_write(data->regmap, 0x0f, 0x96);
++ if (rc)
++ return rc;
++
++ rc = regmap_write(data->regmap, 0x62, 0x02);
++ if (rc)
++ return rc;
++
++ rc = regmap_write(data->regmap, 0x0e, 0x00);
++ if (rc)
++ return rc;
++
++ return regmap_write(data->regmap, 0x0f, 0x00);
++}
++
++static int dps310_startup(struct dps310_data *data)
++{
++ int rc;
++ int ready;
++
++ /*
++ * Set up pressure sensor in single sample, one measurement per second
++ * mode
++ */
++ rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0);
++ if (rc)
++ return rc;
++
++ /*
++ * Set up external (MEMS) temperature sensor in single sample, one
++ * measurement per second mode
++ */
++ rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT);
++ if (rc)
++ return rc;
++
++ /* Temp and pressure shifts are disabled when PRC <= 8 */
++ rc = regmap_write_bits(data->regmap, DPS310_CFG_REG,
++ DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0);
++ if (rc)
++ return rc;
++
++ /* MEAS_CFG doesn't update correctly unless first written with 0 */
++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
++ DPS310_MEAS_CTRL_BITS, 0);
++ if (rc)
++ return rc;
++
++ /* Turn on temperature and pressure measurement in the background */
++ rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
++ DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN |
++ DPS310_TEMP_EN | DPS310_BACKGROUND);
++ if (rc)
++ return rc;
++
++ /*
++ * Calibration coefficients required for reporting temperature.
++ * They are available 40ms after the device has started
++ */
++ rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
++ ready & DPS310_COEF_RDY, 10000, 40000);
++ if (rc)
++ return rc;
++
++ rc = dps310_get_coefs(data);
++ if (rc)
++ return rc;
++
++ return dps310_temp_workaround(data);
++}
++
+ static int dps310_get_pres_precision(struct dps310_data *data)
+ {
+ int rc;
+@@ -677,52 +773,12 @@ static const struct iio_info dps310_info
+ .write_raw = dps310_write_raw,
+ };
+
+-/*
+- * Some verions of chip will read temperatures in the ~60C range when
+- * its actually ~20C. This is the manufacturer recommended workaround
+- * to correct the issue. The registers used below are undocumented.
+- */
+-static int dps310_temp_workaround(struct dps310_data *data)
+-{
+- int rc;
+- int reg;
+-
+- rc = regmap_read(data->regmap, 0x32, ®);
+- if (rc < 0)
+- return rc;
+-
+- /*
+- * If bit 1 is set then the device is okay, and the workaround does not
+- * need to be applied
+- */
+- if (reg & BIT(1))
+- return 0;
+-
+- rc = regmap_write(data->regmap, 0x0e, 0xA5);
+- if (rc < 0)
+- return rc;
+-
+- rc = regmap_write(data->regmap, 0x0f, 0x96);
+- if (rc < 0)
+- return rc;
+-
+- rc = regmap_write(data->regmap, 0x62, 0x02);
+- if (rc < 0)
+- return rc;
+-
+- rc = regmap_write(data->regmap, 0x0e, 0x00);
+- if (rc < 0)
+- return rc;
+-
+- return regmap_write(data->regmap, 0x0f, 0x00);
+-}
+-
+ static int dps310_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+ struct dps310_data *data;
+ struct iio_dev *iio;
+- int rc, ready;
++ int rc;
+
+ iio = devm_iio_device_alloc(&client->dev, sizeof(*data));
+ if (!iio)
+@@ -747,54 +803,8 @@ static int dps310_probe(struct i2c_clien
+ if (rc)
+ return rc;
+
+- /*
+- * Set up pressure sensor in single sample, one measurement per second
+- * mode
+- */
+- rc = regmap_write(data->regmap, DPS310_PRS_CFG, 0);
+-
+- /*
+- * Set up external (MEMS) temperature sensor in single sample, one
+- * measurement per second mode
+- */
+- rc = regmap_write(data->regmap, DPS310_TMP_CFG, DPS310_TMP_EXT);
+- if (rc < 0)
+- return rc;
+-
+- /* Temp and pressure shifts are disabled when PRC <= 8 */
+- rc = regmap_write_bits(data->regmap, DPS310_CFG_REG,
+- DPS310_PRS_SHIFT_EN | DPS310_TMP_SHIFT_EN, 0);
+- if (rc < 0)
+- return rc;
+-
+- /* MEAS_CFG doesn't update correctly unless first written with 0 */
+- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
+- DPS310_MEAS_CTRL_BITS, 0);
+- if (rc < 0)
+- return rc;
+-
+- /* Turn on temperature and pressure measurement in the background */
+- rc = regmap_write_bits(data->regmap, DPS310_MEAS_CFG,
+- DPS310_MEAS_CTRL_BITS, DPS310_PRS_EN |
+- DPS310_TEMP_EN | DPS310_BACKGROUND);
+- if (rc < 0)
+- return rc;
+-
+- /*
+- * Calibration coefficients required for reporting temperature.
+- * They are available 40ms after the device has started
+- */
+- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
+- ready & DPS310_COEF_RDY, 10000, 40000);
+- if (rc < 0)
+- return rc;
+-
+- rc = dps310_get_coefs(data);
+- if (rc < 0)
+- return rc;
+-
+- rc = dps310_temp_workaround(data);
+- if (rc < 0)
++ rc = dps310_startup(data);
++ if (rc)
+ return rc;
+
+ rc = devm_iio_device_register(&client->dev, iio);
--- /dev/null
+From 7b4ab4abcea4c0c10b25187bf2569e5a07e9a20c Mon Sep 17 00:00:00 2001
+From: Eddie James <eajames@linux.ibm.com>
+Date: Thu, 15 Sep 2022 14:57:19 -0500
+Subject: iio: pressure: dps310: Reset chip after timeout
+
+From: Eddie James <eajames@linux.ibm.com>
+
+commit 7b4ab4abcea4c0c10b25187bf2569e5a07e9a20c upstream.
+
+The DPS310 chip has been observed to get "stuck" such that pressure
+and temperature measurements are never indicated as "ready" in the
+MEAS_CFG register. The only solution is to reset the device and try
+again. In order to avoid continual failures, use a boolean flag to
+only try the reset after timeout once if errors persist.
+
+Fixes: ba6ec48e76bc ("iio: Add driver for Infineon DPS310")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20220915195719.136812-3-eajames@linux.ibm.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/dps310.c | 74 ++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 64 insertions(+), 10 deletions(-)
+
+--- a/drivers/iio/pressure/dps310.c
++++ b/drivers/iio/pressure/dps310.c
+@@ -89,6 +89,7 @@ struct dps310_data {
+ s32 c00, c10, c20, c30, c01, c11, c21;
+ s32 pressure_raw;
+ s32 temp_raw;
++ bool timeout_recovery_failed;
+ };
+
+ static const struct iio_chan_spec dps310_channels[] = {
+@@ -393,11 +394,69 @@ static int dps310_get_temp_k(struct dps3
+ return scale_factors[ilog2(rc)];
+ }
+
++static int dps310_reset_wait(struct dps310_data *data)
++{
++ int rc;
++
++ rc = regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC);
++ if (rc)
++ return rc;
++
++ /* Wait for device chip access: 2.5ms in specification */
++ usleep_range(2500, 12000);
++ return 0;
++}
++
++static int dps310_reset_reinit(struct dps310_data *data)
++{
++ int rc;
++
++ rc = dps310_reset_wait(data);
++ if (rc)
++ return rc;
++
++ return dps310_startup(data);
++}
++
++static int dps310_ready_status(struct dps310_data *data, int ready_bit, int timeout)
++{
++ int sleep = DPS310_POLL_SLEEP_US(timeout);
++ int ready;
++
++ return regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready, ready & ready_bit,
++ sleep, timeout);
++}
++
++static int dps310_ready(struct dps310_data *data, int ready_bit, int timeout)
++{
++ int rc;
++
++ rc = dps310_ready_status(data, ready_bit, timeout);
++ if (rc) {
++ if (rc == -ETIMEDOUT && !data->timeout_recovery_failed) {
++ /* Reset and reinitialize the chip. */
++ if (dps310_reset_reinit(data)) {
++ data->timeout_recovery_failed = true;
++ } else {
++ /* Try again to get sensor ready status. */
++ if (dps310_ready_status(data, ready_bit, timeout))
++ data->timeout_recovery_failed = true;
++ else
++ return 0;
++ }
++ }
++
++ return rc;
++ }
++
++ data->timeout_recovery_failed = false;
++ return 0;
++}
++
+ static int dps310_read_pres_raw(struct dps310_data *data)
+ {
+ int rc;
+ int rate;
+- int ready;
+ int timeout;
+ s32 raw;
+ u8 val[3];
+@@ -409,9 +468,7 @@ static int dps310_read_pres_raw(struct d
+ timeout = DPS310_POLL_TIMEOUT_US(rate);
+
+ /* Poll for sensor readiness; base the timeout upon the sample rate. */
+- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
+- ready & DPS310_PRS_RDY,
+- DPS310_POLL_SLEEP_US(timeout), timeout);
++ rc = dps310_ready(data, DPS310_PRS_RDY, timeout);
+ if (rc)
+ goto done;
+
+@@ -448,7 +505,6 @@ static int dps310_read_temp_raw(struct d
+ {
+ int rc;
+ int rate;
+- int ready;
+ int timeout;
+
+ if (mutex_lock_interruptible(&data->lock))
+@@ -458,10 +514,8 @@ static int dps310_read_temp_raw(struct d
+ timeout = DPS310_POLL_TIMEOUT_US(rate);
+
+ /* Poll for sensor readiness; base the timeout upon the sample rate. */
+- rc = regmap_read_poll_timeout(data->regmap, DPS310_MEAS_CFG, ready,
+- ready & DPS310_TMP_RDY,
+- DPS310_POLL_SLEEP_US(timeout), timeout);
+- if (rc < 0)
++ rc = dps310_ready(data, DPS310_TMP_RDY, timeout);
++ if (rc)
+ goto done;
+
+ rc = dps310_read_temp_ready(data);
+@@ -756,7 +810,7 @@ static void dps310_reset(void *action_da
+ {
+ struct dps310_data *data = action_data;
+
+- regmap_write(data->regmap, DPS310_RESET, DPS310_RESET_MAGIC);
++ dps310_reset_wait(data);
+ }
+
+ static const struct regmap_config dps310_regmap_config = {
+++ /dev/null
-From 5693bcce892d7b8b15a7a92b011d3d40a023b53c Mon Sep 17 00:00:00 2001
-From: Pavel Begunkov <asml.silence@gmail.com>
-Date: Wed, 21 Sep 2022 12:17:49 +0100
-Subject: io_uring/net: don't lose partial send_zc on fail
-
-From: Pavel Begunkov <asml.silence@gmail.com>
-
-commit 5693bcce892d7b8b15a7a92b011d3d40a023b53c upstream.
-
-Partial zc send may end up in io_req_complete_failed(), which not only
-would return invalid result but also mask out the notification leading
-to lifetime issues.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
-Link: https://lore.kernel.org/r/5673285b5e83e6ceca323727b4ddaa584b5cc91e.1663668091.git.asml.silence@gmail.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- io_uring/net.c | 16 ++++++++++++++++
- io_uring/net.h | 1 +
- io_uring/opdef.c | 1 +
- 3 files changed, 18 insertions(+)
-
---- a/io_uring/net.c
-+++ b/io_uring/net.c
-@@ -1097,6 +1097,22 @@ void io_sendrecv_fail(struct io_kiocb *r
- io_req_set_res(req, res, req->cqe.flags);
- }
-
-+void io_send_zc_fail(struct io_kiocb *req)
-+{
-+ struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
-+ int res = req->cqe.res;
-+
-+ if (req->flags & REQ_F_PARTIAL_IO) {
-+ if (req->flags & REQ_F_NEED_CLEANUP) {
-+ io_notif_flush(sr->notif);
-+ sr->notif = NULL;
-+ req->flags &= ~REQ_F_NEED_CLEANUP;
-+ }
-+ res = sr->done_io;
-+ }
-+ io_req_set_res(req, res, req->cqe.flags);
-+}
-+
- int io_accept_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
- {
- struct io_accept *accept = io_kiocb_to_cmd(req, struct io_accept);
---- a/io_uring/net.h
-+++ b/io_uring/net.h
-@@ -58,6 +58,7 @@ int io_connect(struct io_kiocb *req, uns
- int io_sendzc(struct io_kiocb *req, unsigned int issue_flags);
- int io_sendzc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe);
- void io_sendzc_cleanup(struct io_kiocb *req);
-+void io_send_zc_fail(struct io_kiocb *req);
-
- void io_netmsg_cache_free(struct io_cache_entry *entry);
- #else
---- a/io_uring/opdef.c
-+++ b/io_uring/opdef.c
-@@ -494,6 +494,7 @@ const struct io_op_def io_op_defs[] = {
- .issue = io_sendzc,
- .prep_async = io_sendzc_prep_async,
- .cleanup = io_sendzc_cleanup,
-+ .fail = io_send_zc_fail,
- #else
- .prep = io_eopnotsupp_prep,
- #endif
};
struct io_sr_msg {
-@@ -1279,6 +1280,7 @@ int io_connect_prep(struct io_kiocb *req
+@@ -1263,6 +1264,7 @@ int io_connect_prep(struct io_kiocb *req
conn->addr = u64_to_user_ptr(READ_ONCE(sqe->addr));
conn->addr_len = READ_ONCE(sqe->addr2);
return 0;
}
-@@ -1290,6 +1292,16 @@ int io_connect(struct io_kiocb *req, uns
+@@ -1274,6 +1276,16 @@ int io_connect(struct io_kiocb *req, uns
int ret;
bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
if (req_has_async_data(req)) {
io = req->async_data;
} else {
-@@ -1306,13 +1318,17 @@ int io_connect(struct io_kiocb *req, uns
+@@ -1290,13 +1302,17 @@ int io_connect(struct io_kiocb *req, uns
ret = __sys_connect_file(req->file, &io->address,
connect->addr_len, file_flags);
if ((ret == -EAGAIN || ret == -EINPROGRESS) && force_nonblock) {
--- /dev/null
+From 07d2872bf4c864eb83d034263c155746a2fb7a3b Mon Sep 17 00:00:00 2001
+From: Avri Altman <avri.altman@wdc.com>
+Date: Wed, 28 Sep 2022 12:57:44 +0300
+Subject: mmc: core: Add SD card quirk for broken discard
+
+From: Avri Altman <avri.altman@wdc.com>
+
+commit 07d2872bf4c864eb83d034263c155746a2fb7a3b upstream.
+
+Some SD-cards from Sandisk that are SDA-6.0 compliant reports they supports
+discard, while they actually don't. This might cause mk2fs to fail while
+trying to format the card and revert it to a read-only mode.
+
+To fix this problem, let's add a card quirk (MMC_QUIRK_BROKEN_SD_DISCARD)
+to indicate that we shall fall-back to use the legacy erase command
+instead.
+
+Signed-off-by: Avri Altman <avri.altman@wdc.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220928095744.16455-1-avri.altman@wdc.com
+[Ulf: Updated the commit message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/block.c | 6 +++++-
+ drivers/mmc/core/card.h | 6 ++++++
+ drivers/mmc/core/quirks.h | 6 ++++++
+ include/linux/mmc/card.h | 1 +
+ 4 files changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1140,8 +1140,12 @@ static void mmc_blk_issue_discard_rq(str
+ {
+ struct mmc_blk_data *md = mq->blkdata;
+ struct mmc_card *card = md->queue.card;
++ unsigned int arg = card->erase_arg;
+
+- mmc_blk_issue_erase_rq(mq, req, MMC_BLK_DISCARD, card->erase_arg);
++ if (mmc_card_broken_sd_discard(card))
++ arg = SD_ERASE_ARG;
++
++ mmc_blk_issue_erase_rq(mq, req, MMC_BLK_DISCARD, arg);
+ }
+
+ static void mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -73,6 +73,7 @@ struct mmc_fixup {
+ #define EXT_CSD_REV_ANY (-1u)
+
+ #define CID_MANFID_SANDISK 0x2
++#define CID_MANFID_SANDISK_SD 0x3
+ #define CID_MANFID_ATP 0x9
+ #define CID_MANFID_TOSHIBA 0x11
+ #define CID_MANFID_MICRON 0x13
+@@ -258,4 +259,9 @@ static inline int mmc_card_broken_hpi(co
+ return c->quirks & MMC_QUIRK_BROKEN_HPI;
+ }
+
++static inline int mmc_card_broken_sd_discard(const struct mmc_card *c)
++{
++ return c->quirks & MMC_QUIRK_BROKEN_SD_DISCARD;
++}
++
+ #endif
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -100,6 +100,12 @@ static const struct mmc_fixup __maybe_un
+ MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc,
+ MMC_QUIRK_TRIM_BROKEN),
+
++ /*
++ * Some SD cards reports discard support while they don't
++ */
++ MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
++ MMC_QUIRK_BROKEN_SD_DISCARD),
++
+ END_FIXUP
+ };
+
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -293,6 +293,7 @@ struct mmc_card {
+ #define MMC_QUIRK_BROKEN_IRQ_POLLING (1<<11) /* Polling SDIO_CCCR_INTx could create a fake interrupt */
+ #define MMC_QUIRK_TRIM_BROKEN (1<<12) /* Skip trim */
+ #define MMC_QUIRK_BROKEN_HPI (1<<13) /* Disable broken HPI support */
++#define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */
+
+ bool reenable_cmdq; /* Re-enable Command Queue */
+
--- /dev/null
+From f0c00454bf78975925eccc9737faaa4d4951edbf Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Wed, 28 Sep 2022 12:07:55 +0100
+Subject: mmc: renesas_sdhi: Fix rounding errors
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit f0c00454bf78975925eccc9737faaa4d4951edbf upstream.
+
+Due to clk rounding errors on RZ/G2L platforms, it selects a clock source
+with a lower clock rate compared to a higher one.
+For eg: The rounding error (533333333 Hz / 4 * 4 = 533333332 Hz < 5333333
+33 Hz) selects a clk source of 400 MHz instead of 533.333333 MHz.
+
+This patch fixes this issue by adding a margin of (1/1024) higher to
+the clock rate.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Fixes: bb6d3fa98a41 ("clk: renesas: rcar-gen3: Switch to new SD clock handling")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220928110755.849275-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -128,6 +128,7 @@ static unsigned int renesas_sdhi_clk_upd
+ struct clk *ref_clk = priv->clk;
+ unsigned int freq, diff, best_freq = 0, diff_min = ~0;
+ unsigned int new_clock, clkh_shift = 0;
++ unsigned int new_upper_limit;
+ int i;
+
+ /*
+@@ -153,13 +154,20 @@ static unsigned int renesas_sdhi_clk_upd
+ * greater than, new_clock. As we can divide by 1 << i for
+ * any i in [0, 9] we want the input clock to be as close as
+ * possible, but no greater than, new_clock << i.
++ *
++ * Add an upper limit of 1/1024 rate higher to the clock rate to fix
++ * clk rate jumping to lower rate due to rounding error (eg: RZ/G2L has
++ * 3 clk sources 533.333333 MHz, 400 MHz and 266.666666 MHz. The request
++ * for 533.333333 MHz will selects a slower 400 MHz due to rounding
++ * error (533333333 Hz / 4 * 4 = 533333332 Hz < 533333333 Hz)).
+ */
+ for (i = min(9, ilog2(UINT_MAX / new_clock)); i >= 0; i--) {
+ freq = clk_round_rate(ref_clk, new_clock << i);
+- if (freq > (new_clock << i)) {
++ new_upper_limit = (new_clock << i) + ((new_clock << i) >> 10);
++ if (freq > new_upper_limit) {
+ /* Too fast; look for a slightly slower option */
+ freq = clk_round_rate(ref_clk, (new_clock << i) / 4 * 3);
+- if (freq > (new_clock << i))
++ if (freq > new_upper_limit)
+ continue;
+ }
+
+@@ -181,6 +189,7 @@ static unsigned int renesas_sdhi_clk_upd
+ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ unsigned int new_clock)
+ {
++ unsigned int clk_margin;
+ u32 clk = 0, clock;
+
+ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN &
+@@ -194,7 +203,13 @@ static void renesas_sdhi_set_clock(struc
+ host->mmc->actual_clock = renesas_sdhi_clk_update(host, new_clock);
+ clock = host->mmc->actual_clock / 512;
+
+- for (clk = 0x80000080; new_clock >= (clock << 1); clk >>= 1)
++ /*
++ * Add a margin of 1/1024 rate higher to the clock rate in order
++ * to avoid clk variable setting a value of 0 due to the margin
++ * provided for actual_clock in renesas_sdhi_clk_update().
++ */
++ clk_margin = new_clock >> 10;
++ for (clk = 0x80000080; new_clock + clk_margin >= (clock << 1); clk >>= 1)
+ clock <<= 1;
+
+ /* 1/1 clock is option */
--- /dev/null
+From 6e141772e6465f937458b35ddcfd0a981b6f5280 Mon Sep 17 00:00:00 2001
+From: Wenchao Chen <wenchao.chen@unisoc.com>
+Date: Tue, 11 Oct 2022 18:49:35 +0800
+Subject: mmc: sdhci-sprd: Fix minimum clock limit
+
+From: Wenchao Chen <wenchao.chen@unisoc.com>
+
+commit 6e141772e6465f937458b35ddcfd0a981b6f5280 upstream.
+
+The Spreadtrum controller supports 100KHz minimal clock rate, which means
+that the current value 400KHz is wrong.
+
+Unfortunately this has also lead to fail to initialize some cards, which
+are allowed to require 100KHz to work. So, let's fix the problem by
+changing the minimal supported clock rate to 100KHz.
+
+Signed-off-by: Wenchao Chen <wenchao.chen@unisoc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20221011104935.10980-1-wenchao.chen666@gmail.com
+[Ulf: Clarified to commit-message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-sprd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-sprd.c
++++ b/drivers/mmc/host/sdhci-sprd.c
+@@ -309,7 +309,7 @@ static unsigned int sdhci_sprd_get_max_c
+
+ static unsigned int sdhci_sprd_get_min_clock(struct sdhci_host *host)
+ {
+- return 400000;
++ return 100000;
+ }
+
+ static void sdhci_sprd_set_uhs_signaling(struct sdhci_host *host,
--- /dev/null
+From b78870e7f41534cc719c295d1f8809aca93aeeab Mon Sep 17 00:00:00 2001
+From: Prathamesh Shete <pshete@nvidia.com>
+Date: Thu, 6 Oct 2022 18:36:22 +0530
+Subject: mmc: sdhci-tegra: Use actual clock rate for SW tuning correction
+
+From: Prathamesh Shete <pshete@nvidia.com>
+
+commit b78870e7f41534cc719c295d1f8809aca93aeeab upstream.
+
+Ensure tegra_host member "curr_clk_rate" holds the actual clock rate
+instead of requested clock rate for proper use during tuning correction
+algorithm. Actual clk rate may not be the same as the requested clk
+frequency depending on the parent clock source set. Tuning correction
+algorithm depends on certain parameters which are sensitive to current
+clk rate. If the host clk is selected instead of the actual clock rate,
+tuning correction algorithm may end up applying invalid correction,
+which could result in errors
+
+Fixes: ea8fc5953e8b ("mmc: tegra: update hw tuning process")
+Signed-off-by: Aniruddha TVS Rao <anrao@nvidia.com>
+Signed-off-by: Prathamesh Shete <pshete@nvidia.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20221006130622.22900-4-pshete@nvidia.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -773,7 +773,7 @@ static void tegra_sdhci_set_clock(struct
+ dev_err(dev, "failed to set clk rate to %luHz: %d\n",
+ host_clk, err);
+
+- tegra_host->curr_clk_rate = host_clk;
++ tegra_host->curr_clk_rate = clk_get_rate(pltfm_host->clk);
+ if (tegra_host->ddr_signaling)
+ host->max_clk = host_clk;
+ else
io_uring-add-custom-opcode-hooks-on-fail.patch
io_uring-rw-don-t-lose-partial-io-result-on-fail.patch
io_uring-net-don-t-lose-partial-send-recv-on-fail.patch
-io_uring-net-don-t-lose-partial-send_zc-on-fail.patch
io_uring-rw-fix-unexpected-link-breakage.patch
io_uring-rw-don-t-lose-short-results-on-io_setup_async_rw.patch
io_uring-net-fix-fast_iov-assignment-in-io_setup_async_msg.patch
io_uring-net-handle-einprogress-correct-for-ioring_op_connect.patch
io_uring-af_unix-defer-registered-files-gc-to-io_uring-release.patch
io_uring-correct-pinned_vm-accounting.patch
+hv_netvsc-fix-race-between-vf-offering-and-vf-association-message-from-host.patch
+cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch
+cifs-fix-the-error-length-of-validate_negotiate_info-message.patch
+iio-dac-ad5593r-fix-i2c-read-protocol-requirements.patch
+iio-ltc2497-fix-reading-conversion-results.patch
+iio-adc-ad7923-fix-channel-readings-for-some-variants.patch
+iio-pressure-dps310-refactor-startup-procedure.patch
+iio-pressure-dps310-reset-chip-after-timeout.patch
+xhci-dbc-fix-memory-leak-in-xhci_alloc_dbc.patch
+usb-gadget-uvc-fix-argument-to-sizeof-in-uvc_register_video.patch
+usb-add-quirks-for-lenovo-onelink-dock.patch
+mmc-core-add-sd-card-quirk-for-broken-discard.patch
+can-kvaser_usb-fix-use-of-uninitialized-completion.patch
+can-kvaser_usb_leaf-fix-overread-with-an-invalid-command.patch
+can-kvaser_usb_leaf-fix-tx-queue-out-of-sync-after-restart.patch
+can-kvaser_usb_leaf-fix-can-state-after-restart.patch
+mmc-renesas_sdhi-fix-rounding-errors.patch
+mmc-sdhci-tegra-use-actual-clock-rate-for-sw-tuning-correction.patch
+mmc-sdhci-sprd-fix-minimum-clock-limit.patch
+i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch
--- /dev/null
+From 37d49519b41405b08748392c6a7f193d9f77ecd2 Mon Sep 17 00:00:00 2001
+From: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+Date: Tue, 27 Sep 2022 09:34:07 +0200
+Subject: usb: add quirks for Lenovo OneLink+ Dock
+
+From: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+
+commit 37d49519b41405b08748392c6a7f193d9f77ecd2 upstream.
+
+The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers:
+17ef:1018 upstream
+17ef:1019 downstream
+
+These hubs suffer from two separate problems:
+
+1) After the host system was suspended and woken up, the hubs appear to
+ be in a random state. Some downstream ports (both internal to the
+ built-in audio and network controllers, and external to USB sockets)
+ may no longer be functional. The exact list of disabled ports (if
+ any) changes from wakeup to wakeup. Ports remain in that state until
+ the dock is power-cycled, or until the laptop is rebooted.
+
+ Wakeup sources connected to the hubs (keyboard, WoL on the integrated
+ gigabit controller) will wake the system up from suspend, but they
+ may no longer work after wakeup (and in that case will no longer work
+ as wakeup source in a subsequent suspend-wakeup cycle).
+
+ This issue appears in the logs with messages such as:
+
+ usb 1-6.1-port4: cannot disable (err = -71)
+ usb 1-6-port2: cannot disable (err = -71)
+ usb 1-6.1: clear tt 1 (80c0) error -71
+ usb 1-6-port4: cannot disable (err = -71)
+ usb 1-6.4: PM: dpm_run_callback(): usb_dev_resume+0x0/0x10 [usbcore] returns -71
+ usb 1-6.4: PM: failed to resume async: error -71
+ usb 1-7: reset full-speed USB device number 5 using xhci_hcd
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
+ usb 1-6.1-port1: cannot disable (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: cannot reset (err = -71)
+ usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
+ usb 1-6.1-port1: cannot disable (err = -71)
+
+2) Some USB devices cannot be enumerated properly. So far I have only
+ seen the issue with USB 3.0 devices. The same devices work without
+ problem directly connected to the host system, to other systems or to
+ other hubs (even when those hubs are connected to the OneLink+ dock).
+
+ One very reliable reproducer is this USB 3.0 HDD enclosure:
+ 152d:9561 JMicron Technology Corp. / JMicron USA Technology Corp. Mobius
+
+ I have seen it happen sporadically with other USB 3.0 enclosures,
+ with controllers from different manufacturers, all self-powered.
+
+ Typical messages in the logs:
+
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 6, error -62
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 7, error -62
+ usb 2-1-port4: attempt power cycle
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 8, error -62
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
+ usb 2-1.4: device not accepting address 9, error -62
+ usb 2-1-port4: unable to enumerate USB device
+
+Through trial and error, I found that the USB_QUIRK_RESET_RESUME solved
+the second issue. Further testing then uncovered the first issue. Test
+results are summarized in this table:
+
+=======================================================================================
+Settings USB2 hotplug USB3 hotplug State after waking up
+---------------------------------------------------------------------------------------
+
+power/control=auto works fails broken
+
+usbcore.autosuspend=-1 works works broken
+OR power/control=on
+
+power/control=auto works (1) works (1) works
+and USB_QUIRK_RESET_RESUME
+
+power/control=on works works works
+and USB_QUIRK_RESET_RESUME
+
+HUB_QUIRK_DISABLE_AUTOSUSPEND works works works
+and USB_QUIRK_RESET_RESUME
+
+=======================================================================================
+
+In those results, the power/control settings are applied to both hubs,
+both on the USB2 and USB3 side, before each test.
+
+From those results, USB_QUIRK_RESET_RESUME is required to reset the hubs
+properly after a suspend-wakeup cycle, and the hubs must not autosuspend
+to work around the USB3 issue.
+
+A secondary effect of USB_QUIRK_RESET_RESUME is to prevent the hubs'
+upstream links from suspending (the downstream ports can still suspend).
+This secondary effect is used in results (1). It is enough to solve the
+USB3 problem.
+
+Setting USB_QUIRK_RESET_RESUME on those hubs is the smallest patch that
+solves both issues.
+
+Prior to creating this patch, I have used the USB_QUIRK_RESET_RESUME via
+the kernel command line for over a year without noticing any side
+effect.
+
+Thanks to Oliver Neukum @Suse for explanations of the operations of
+USB_QUIRK_RESET_RESUME, and requesting more testing.
+
+Signed-off-by: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220927073407.5672-1-jflf_kernel@gmx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -437,6 +437,10 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */
++ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */
+ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
+
--- /dev/null
+From a15e17acce5aaae54243f55a7349c2225450b9bc Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Wed, 28 Sep 2022 13:19:21 -0700
+Subject: usb: gadget: uvc: Fix argument to sizeof() in uvc_register_video()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit a15e17acce5aaae54243f55a7349c2225450b9bc upstream.
+
+When building s390 allmodconfig after commit 9b91a6523078 ("usb: gadget:
+uvc: increase worker prio to WQ_HIGHPRI"), the following error occurs:
+
+ In file included from ../include/linux/string.h:253,
+ from ../include/linux/bitmap.h:11,
+ from ../include/linux/cpumask.h:12,
+ from ../include/linux/smp.h:13,
+ from ../include/linux/lockdep.h:14,
+ from ../include/linux/rcupdate.h:29,
+ from ../include/linux/rculist.h:11,
+ from ../include/linux/pid.h:5,
+ from ../include/linux/sched.h:14,
+ from ../include/linux/ratelimit.h:6,
+ from ../include/linux/dev_printk.h:16,
+ from ../include/linux/device.h:15,
+ from ../drivers/usb/gadget/function/f_uvc.c:9:
+ In function ‘fortify_memset_chk’,
+ inlined from ‘uvc_register_video’ at ../drivers/usb/gadget/function/f_uvc.c:424:2:
+ ../include/linux/fortify-string.h:301:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
+ 301 | __write_overflow_field(p_size_field, size);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This points to the memset() in uvc_register_video(). It is clear that
+the argument to sizeof() is incorrect, as uvc->vdev (a 'struct
+video_device') is being zeroed out but the size of uvc->video (a 'struct
+uvc_video') is being used as the third arugment to memset().
+
+pahole shows that prior to commit 9b91a6523078 ("usb: gadget: uvc:
+increase worker prio to WQ_HIGHPRI"), 'struct video_device' and
+'struct ucv_video' had the same size, meaning that the argument to
+sizeof() is incorrect semantically but there is no visible issue:
+
+ $ pahole -s build/drivers/usb/gadget/function/f_uvc.o | grep -E "(uvc_video|video_device)\s+"
+ video_device 1400 4
+ uvc_video 1400 3
+
+After that change, uvc_video becomes slightly larger, meaning that the
+memset() will overwrite by 8 bytes:
+
+ $ pahole -s build/drivers/usb/gadget/function/f_uvc.o | grep -E "(uvc_video|video_device)\s+"
+ video_device 1400 4
+ uvc_video 1408 3
+
+Fix the arugment to sizeof() so that there is no overwrite.
+
+Cc: stable@vger.kernel.org
+Fixes: e4ce9ed835bc ("usb: gadget: uvc: ensure the vdev is unset")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20220928201921.3152163-1-nathan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_uvc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_uvc.c
++++ b/drivers/usb/gadget/function/f_uvc.c
+@@ -421,7 +421,7 @@ uvc_register_video(struct uvc_device *uv
+ int ret;
+
+ /* TODO reference counting. */
+- memset(&uvc->vdev, 0, sizeof(uvc->video));
++ memset(&uvc->vdev, 0, sizeof(uvc->vdev));
+ uvc->vdev.v4l2_dev = &uvc->v4l2_dev;
+ uvc->vdev.v4l2_dev->dev = &cdev->gadget->dev;
+ uvc->vdev.fops = &uvc_v4l2_fops;
--- /dev/null
+From d591b32e519603524a35b172156db71df9116902 Mon Sep 17 00:00:00 2001
+From: Rafael Mendonca <rafaelmendsr@gmail.com>
+Date: Wed, 21 Sep 2022 15:34:46 +0300
+Subject: xhci: dbc: Fix memory leak in xhci_alloc_dbc()
+
+From: Rafael Mendonca <rafaelmendsr@gmail.com>
+
+commit d591b32e519603524a35b172156db71df9116902 upstream.
+
+If DbC is already in use, then the allocated memory for the xhci_dbc struct
+doesn't get freed before returning NULL, which leads to a memleak.
+
+Fixes: 534675942e90 ("xhci: dbc: refactor xhci_dbc_init()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20220921123450.671459-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -988,7 +988,7 @@ xhci_alloc_dbc(struct device *dev, void
+ dbc->driver = driver;
+
+ if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE)
+- return NULL;
++ goto err;
+
+ INIT_DELAYED_WORK(&dbc->event_work, xhci_dbc_handle_events);
+ spin_lock_init(&dbc->lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
