From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 05:43:26 +0000 (+0100) Subject: 6.0-stable patches X-Git-Tag: v4.19.263~84 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0362b40fca1af38d075f7c00e909d4f410856be9;p=thirdparty%2Fkernel%2Fstable-queue.git 6.0-stable patches added patches: alsa-ac97-use-snd_ctl_rename-to-rename-a-control.patch alsa-au88x0-use-explicitly-signed-char.patch alsa-ca0106-use-snd_ctl_rename-to-rename-a-control.patch alsa-control-add-snd_ctl_rename.patch alsa-emu10k1-use-snd_ctl_rename-to-rename-a-control.patch alsa-hda-realtek-add-another-hp-zbook-g9-model-quirks.patch alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch alsa-hda-realtek-use-snd_ctl_rename-to-rename-a-control.patch alsa-rme9652-use-explicitly-signed-char.patch alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch alsa-usb-audio-use-snd_ctl_rename-to-rename-a-control.patch alsa-use-del_timer_sync-before-freeing-timer.patch can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch can-kvaser_usb-fix-possible-completions-during-init_completion.patch can-rcar_canfd-fix-channel-specific-irq-handling-for-rz-g2l.patch can-rcar_canfd-rcar_canfd_handle_global_receive-fix-irq-storm-on-global-fifo-receive.patch mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch mtd-rawnand-tegra-fix-pm-disable-depth-imbalance-in-probe.patch mtd-spi-nor-core-ignore-enotsupp-in-spi_nor_init.patch revert-usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch squashfs-fix-buffer-release-race-condition-in-readahead-code.patch squashfs-fix-extending-readahead-beyond-end-of-file.patch squashfs-fix-read-regression-introduced-in-readahead-code.patch usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch usb-bdc-change-state-when-port-disconnected.patch usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch usb-dwc3-gadget-force-sending-delayed-status-during-soft-disconnect.patch usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch usb-dwc3-st-rely-on-child-s-compatible-instead-of-name.patch usb-gadget-aspeed-fix-probe-regression.patch usb-gadget-uvc-fix-dropped-frame-after-missed-isoc.patch usb-gadget-uvc-fix-sg-handling-during-video-encode.patch usb-gadget-uvc-fix-sg-handling-in-error-case.patch usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch usb-typec-ucsi-acpi-implement-resume-callback.patch usb-typec-ucsi-check-the-connection-on-resume.patch usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch --- diff --git a/queue-6.0/alsa-ac97-use-snd_ctl_rename-to-rename-a-control.patch b/queue-6.0/alsa-ac97-use-snd_ctl_rename-to-rename-a-control.patch new file mode 100644 index 00000000000..0b142ebf64d --- /dev/null +++ b/queue-6.0/alsa-ac97-use-snd_ctl_rename-to-rename-a-control.patch @@ -0,0 +1,88 @@ +From 52d256cc71f546f67037100c64eb4fa3ae5e4704 Mon Sep 17 00:00:00 2001 +From: "Maciej S. Szmigiero" +Date: Thu, 20 Oct 2022 22:46:26 +0200 +Subject: ALSA: ac97: Use snd_ctl_rename() to rename a control + +From: Maciej S. Szmigiero + +commit 52d256cc71f546f67037100c64eb4fa3ae5e4704 upstream. + +With the recent addition of hashed controls lookup it's not enough to just +update the control name field, the hash entries for the modified control +have to be updated too. + +snd_ctl_rename() takes care of that, so use it instead of directly +modifying the control name. + +While we are at it, check also that the new control name doesn't +accidentally overwrite the available buffer space. + +Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej S. Szmigiero +Link: https://lore.kernel.org/r/adb68bfa0885ba4a2583794b828f8e20d23f67c7.1666296963.git.maciej.szmigiero@oracle.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/ac97/ac97_codec.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -2655,11 +2655,18 @@ EXPORT_SYMBOL(snd_ac97_resume); + */ + static void set_ctl_name(char *dst, const char *src, const char *suffix) + { +- if (suffix) +- sprintf(dst, "%s %s", src, suffix); +- else +- strcpy(dst, src); +-} ++ const size_t msize = SNDRV_CTL_ELEM_ID_NAME_MAXLEN; ++ ++ if (suffix) { ++ if (snprintf(dst, msize, "%s %s", src, suffix) >= msize) ++ pr_warn("ALSA: AC97 control name '%s %s' truncated to '%s'\n", ++ src, suffix, dst); ++ } else { ++ if (strscpy(dst, src, msize) < 0) ++ pr_warn("ALSA: AC97 control name '%s' truncated to '%s'\n", ++ src, dst); ++ } ++} + + /* remove the control with the given name and optional suffix */ + static int snd_ac97_remove_ctl(struct snd_ac97 *ac97, const char *name, +@@ -2686,8 +2693,11 @@ static int snd_ac97_rename_ctl(struct sn + const char *dst, const char *suffix) + { + struct snd_kcontrol *kctl = ctl_find(ac97, src, suffix); ++ char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN]; ++ + if (kctl) { +- set_ctl_name(kctl->id.name, dst, suffix); ++ set_ctl_name(name, dst, suffix); ++ snd_ctl_rename(ac97->bus->card, kctl, name); + return 0; + } + return -ENOENT; +@@ -2706,11 +2716,17 @@ static int snd_ac97_swap_ctl(struct snd_ + const char *s2, const char *suffix) + { + struct snd_kcontrol *kctl1, *kctl2; ++ char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN]; ++ + kctl1 = ctl_find(ac97, s1, suffix); + kctl2 = ctl_find(ac97, s2, suffix); + if (kctl1 && kctl2) { +- set_ctl_name(kctl1->id.name, s2, suffix); +- set_ctl_name(kctl2->id.name, s1, suffix); ++ set_ctl_name(name, s2, suffix); ++ snd_ctl_rename(ac97->bus->card, kctl1, name); ++ ++ set_ctl_name(name, s1, suffix); ++ snd_ctl_rename(ac97->bus->card, kctl2, name); ++ + return 0; + } + return -ENOENT; diff --git a/queue-6.0/alsa-au88x0-use-explicitly-signed-char.patch b/queue-6.0/alsa-au88x0-use-explicitly-signed-char.patch new file mode 100644 index 00000000000..b76609d70e1 --- /dev/null +++ b/queue-6.0/alsa-au88x0-use-explicitly-signed-char.patch @@ -0,0 +1,64 @@ +From ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 24 Oct 2022 18:29:29 +0200 +Subject: ALSA: au88x0: use explicitly signed char + +From: Jason A. Donenfeld + +commit ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 upstream. + +With char becoming unsigned by default, and with `char` alone being +ambiguous and based on architecture, signed chars need to be marked +explicitly as such. This fixes warnings like: + +sound/pci/au88x0/au88x0_core.c:2029 vortex_adb_checkinout() warn: signedness bug returning '(-22)' +sound/pci/au88x0/au88x0_core.c:2046 vortex_adb_checkinout() warn: signedness bug returning '(-12)' +sound/pci/au88x0/au88x0_core.c:2125 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, (0), en, 0)' is unsigned +sound/pci/au88x0/au88x0_core.c:2170 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, stream->resources, en, 4)' is unsigned + +As well, since one function returns errnos, return an `int` rather than +a `signed char`. + +Signed-off-by: Jason A. Donenfeld +Cc: +Link: https://lore.kernel.org/r/20221024162929.536004-1-Jason@zx2c4.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/au88x0/au88x0.h | 6 +++--- + sound/pci/au88x0/au88x0_core.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/pci/au88x0/au88x0.h ++++ b/sound/pci/au88x0/au88x0.h +@@ -141,7 +141,7 @@ struct snd_vortex { + #ifndef CHIP_AU8810 + stream_t dma_wt[NR_WT]; + wt_voice_t wt_voice[NR_WT]; /* WT register cache. */ +- char mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ ++ s8 mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ + #endif + + /* Global resources */ +@@ -235,8 +235,8 @@ static int vortex_alsafmt_aspfmt(snd_pcm + static void vortex_connect_default(vortex_t * vortex, int en); + static int vortex_adb_allocroute(vortex_t * vortex, int dma, int nr_ch, + int dir, int type, int subdev); +-static char vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, +- int restype); ++static int vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, ++ int restype); + #ifndef CHIP_AU8810 + static int vortex_wt_allocroute(vortex_t * vortex, int dma, int nr_ch); + static void vortex_wt_connect(vortex_t * vortex, int en); +--- a/sound/pci/au88x0/au88x0_core.c ++++ b/sound/pci/au88x0/au88x0_core.c +@@ -1998,7 +1998,7 @@ static const int resnum[VORTEX_RESOURCE_ + out: Mean checkout if != 0. Else mean Checkin resource. + restype: Indicates type of resource to be checked in or out. + */ +-static char ++static int + vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, int restype) + { + int i, qty = resnum[restype], resinuse = 0; diff --git a/queue-6.0/alsa-ca0106-use-snd_ctl_rename-to-rename-a-control.patch b/queue-6.0/alsa-ca0106-use-snd_ctl_rename-to-rename-a-control.patch new file mode 100644 index 00000000000..508f0e259d7 --- /dev/null +++ b/queue-6.0/alsa-ca0106-use-snd_ctl_rename-to-rename-a-control.patch @@ -0,0 +1,42 @@ +From 957ccc434c398a88a332ae92d70790c186a18a1c Mon Sep 17 00:00:00 2001 +From: "Maciej S. Szmigiero" +Date: Thu, 20 Oct 2022 22:46:25 +0200 +Subject: ALSA: ca0106: Use snd_ctl_rename() to rename a control + +From: Maciej S. Szmigiero + +commit 957ccc434c398a88a332ae92d70790c186a18a1c upstream. + +With the recent addition of hashed controls lookup it's not enough to just +update the control name field, the hash entries for the modified control +have to be updated too. + +snd_ctl_rename() takes care of that, so use it instead of directly +modifying the control name. + +Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej S. Szmigiero +Link: https://lore.kernel.org/r/bffee980a420f9b0eee5681d2f48d34a70cec0ce.1666296963.git.maciej.szmigiero@oracle.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/ca0106/ca0106_mixer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ca0106/ca0106_mixer.c b/sound/pci/ca0106/ca0106_mixer.c +index 05f56015ddd8..f6381c098d4f 100644 +--- a/sound/pci/ca0106/ca0106_mixer.c ++++ b/sound/pci/ca0106/ca0106_mixer.c +@@ -720,7 +720,7 @@ static int rename_ctl(struct snd_card *card, const char *src, const char *dst) + { + struct snd_kcontrol *kctl = ctl_find(card, src); + if (kctl) { +- strcpy(kctl->id.name, dst); ++ snd_ctl_rename(card, kctl, dst); + return 0; + } + return -ENOENT; +-- +2.38.1 + diff --git a/queue-6.0/alsa-control-add-snd_ctl_rename.patch b/queue-6.0/alsa-control-add-snd_ctl_rename.patch new file mode 100644 index 00000000000..ff353d29038 --- /dev/null +++ b/queue-6.0/alsa-control-add-snd_ctl_rename.patch @@ -0,0 +1,74 @@ +From 966f015fe4329199cc49084ee2886cfb626b34d3 Mon Sep 17 00:00:00 2001 +From: "Maciej S. Szmigiero" +Date: Thu, 20 Oct 2022 22:46:21 +0200 +Subject: ALSA: control: add snd_ctl_rename() + +From: Maciej S. Szmigiero + +commit 966f015fe4329199cc49084ee2886cfb626b34d3 upstream. + +Add a snd_ctl_rename() function that takes care of updating the control +hash entries for callers that already have the relevant struct snd_kcontrol +at hand and hold the control write lock (or simply haven't registered the +card yet). + +Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej S. Szmigiero +Link: https://lore.kernel.org/r/4170b71117ea81357a4f7eb8410f7cde20836c70.1666296963.git.maciej.szmigiero@oracle.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + include/sound/control.h | 1 + + sound/core/control.c | 23 +++++++++++++++++++++++ + 2 files changed, 24 insertions(+) + +diff --git a/include/sound/control.h b/include/sound/control.h +index eae443ba79ba..cc3dcc6cfb0f 100644 +--- a/include/sound/control.h ++++ b/include/sound/control.h +@@ -138,6 +138,7 @@ int snd_ctl_remove(struct snd_card * card, struct snd_kcontrol * kcontrol); + int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol, bool add_on_replace); + int snd_ctl_remove_id(struct snd_card * card, struct snd_ctl_elem_id *id); + int snd_ctl_rename_id(struct snd_card * card, struct snd_ctl_elem_id *src_id, struct snd_ctl_elem_id *dst_id); ++void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl, const char *name); + int snd_ctl_activate_id(struct snd_card *card, struct snd_ctl_elem_id *id, int active); + struct snd_kcontrol *snd_ctl_find_numid(struct snd_card * card, unsigned int numid); + struct snd_kcontrol *snd_ctl_find_id(struct snd_card * card, struct snd_ctl_elem_id *id); +diff --git a/sound/core/control.c b/sound/core/control.c +index a7271927d875..50e7ba66f187 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -753,6 +753,29 @@ int snd_ctl_rename_id(struct snd_card *card, struct snd_ctl_elem_id *src_id, + } + EXPORT_SYMBOL(snd_ctl_rename_id); + ++/** ++ * snd_ctl_rename - rename the control on the card ++ * @card: the card instance ++ * @kctl: the control to rename ++ * @name: the new name ++ * ++ * Renames the specified control on the card to the new name. ++ * ++ * Make sure to take the control write lock - down_write(&card->controls_rwsem). ++ */ ++void snd_ctl_rename(struct snd_card *card, struct snd_kcontrol *kctl, ++ const char *name) ++{ ++ remove_hash_entries(card, kctl); ++ ++ if (strscpy(kctl->id.name, name, sizeof(kctl->id.name)) < 0) ++ pr_warn("ALSA: Renamed control new name '%s' truncated to '%s'\n", ++ name, kctl->id.name); ++ ++ add_hash_entries(card, kctl); ++} ++EXPORT_SYMBOL(snd_ctl_rename); ++ + #ifndef CONFIG_SND_CTL_FAST_LOOKUP + static struct snd_kcontrol * + snd_ctl_find_numid_slow(struct snd_card *card, unsigned int numid) +-- +2.38.1 + diff --git a/queue-6.0/alsa-emu10k1-use-snd_ctl_rename-to-rename-a-control.patch b/queue-6.0/alsa-emu10k1-use-snd_ctl_rename-to-rename-a-control.patch new file mode 100644 index 00000000000..5b3c881f443 --- /dev/null +++ b/queue-6.0/alsa-emu10k1-use-snd_ctl_rename-to-rename-a-control.patch @@ -0,0 +1,42 @@ +From 36476b81b2b5db1de5adb8ced1f71b8972a9d4dd Mon Sep 17 00:00:00 2001 +From: "Maciej S. Szmigiero" +Date: Thu, 20 Oct 2022 22:46:24 +0200 +Subject: ALSA: emu10k1: Use snd_ctl_rename() to rename a control + +From: Maciej S. Szmigiero + +commit 36476b81b2b5db1de5adb8ced1f71b8972a9d4dd upstream. + +With the recent addition of hashed controls lookup it's not enough to just +update the control name field, the hash entries for the modified control +have to be updated too. + +snd_ctl_rename() takes care of that, so use it instead of directly +modifying the control name. + +Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej S. Szmigiero +Link: https://lore.kernel.org/r/38b19f019f95ee78a6e4e59d39afb9e2c3379413.1666296963.git.maciej.szmigiero@oracle.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/emu10k1/emumixer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/emu10k1/emumixer.c b/sound/pci/emu10k1/emumixer.c +index e9c0fe3b8446..3c115f8ab96c 100644 +--- a/sound/pci/emu10k1/emumixer.c ++++ b/sound/pci/emu10k1/emumixer.c +@@ -1767,7 +1767,7 @@ static int rename_ctl(struct snd_card *card, const char *src, const char *dst) + { + struct snd_kcontrol *kctl = ctl_find(card, src); + if (kctl) { +- strcpy(kctl->id.name, dst); ++ snd_ctl_rename(card, kctl, dst); + return 0; + } + return -ENOENT; +-- +2.38.1 + diff --git a/queue-6.0/alsa-hda-realtek-add-another-hp-zbook-g9-model-quirks.patch b/queue-6.0/alsa-hda-realtek-add-another-hp-zbook-g9-model-quirks.patch new file mode 100644 index 00000000000..6a1e5e5e757 --- /dev/null +++ b/queue-6.0/alsa-hda-realtek-add-another-hp-zbook-g9-model-quirks.patch @@ -0,0 +1,39 @@ +From f86bfeb689f2c4ebe12782ef0578ef778fb1a050 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 22 Oct 2022 09:21:07 +0200 +Subject: ALSA: hda/realtek: Add another HP ZBook G9 model quirks + +From: Takashi Iwai + +commit f86bfeb689f2c4ebe12782ef0578ef778fb1a050 upstream. + +HP ZBook Firefly 16 G9 (103c:896d) and HP ZBook Power 15.6 G9 +(103c:89c0) require the same quirk for enabling CS35L41 speaker amps. + +Signed-off-by: Takashi Iwai +Cc: +Link: https://lore.kernel.org/r/20221022072107.3401-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9333,6 +9333,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED), ++ SND_PCI_QUIRK(0x103c, 0x896d, "HP ZBook Firefly 16 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x896e, "HP EliteBook x360 830 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8971, "HP EliteBook 830 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8972, "HP EliteBook 840 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), +@@ -9351,6 +9352,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x89aa, "HP EliteBook 630 G9", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x89ac, "HP EliteBook 640 G9", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x89ae, "HP EliteBook 650 G9", ALC236_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x89c0, "HP ZBook Power 15.6 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x89c3, "Zbook Studio G9", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x89c6, "Zbook Fury 17 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x89ca, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), diff --git a/queue-6.0/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch b/queue-6.0/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch new file mode 100644 index 00000000000..d9c9ff89788 --- /dev/null +++ b/queue-6.0/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch @@ -0,0 +1,31 @@ +From 491a4ccd8a0258392900c80c6b2b622c7115fc23 Mon Sep 17 00:00:00 2001 +From: Stefan Binding +Date: Tue, 18 Oct 2022 13:15:06 +0100 +Subject: ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 + +From: Stefan Binding + +commit 491a4ccd8a0258392900c80c6b2b622c7115fc23 upstream. + +This Asus Zenbook laptop use Realtek HDA codec combined with +2xCS35L41 Amplifiers using SPI with External Boost. + +Signed-off-by: Stefan Binding +Cc: +Link: https://lore.kernel.org/r/20221018121506.2561397-1-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9405,6 +9405,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), ++ SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS), diff --git a/queue-6.0/alsa-hda-realtek-use-snd_ctl_rename-to-rename-a-control.patch b/queue-6.0/alsa-hda-realtek-use-snd_ctl_rename-to-rename-a-control.patch new file mode 100644 index 00000000000..764795ac02c --- /dev/null +++ b/queue-6.0/alsa-hda-realtek-use-snd_ctl_rename-to-rename-a-control.patch @@ -0,0 +1,37 @@ +From b51c225376a684d02fb58b49cf0ce3d693b6f14b Mon Sep 17 00:00:00 2001 +From: "Maciej S. Szmigiero" +Date: Thu, 20 Oct 2022 22:46:23 +0200 +Subject: ALSA: hda/realtek: Use snd_ctl_rename() to rename a control + +From: Maciej S. Szmigiero + +commit b51c225376a684d02fb58b49cf0ce3d693b6f14b upstream. + +With the recent addition of hashed controls lookup it's not enough to just +update the control name field, the hash entries for the modified control +have to be updated too. + +snd_ctl_rename() takes care of that, so use it instead of directly +modifying the control name. + +Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej S. Szmigiero +Link: https://lore.kernel.org/r/37496bd80f91f373268148f877fd735917d97287.1666296963.git.maciej.szmigiero@oracle.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2141,7 +2141,7 @@ static void rename_ctl(struct hda_codec + + kctl = snd_hda_find_mixer_ctl(codec, oldname); + if (kctl) +- strcpy(kctl->id.name, newname); ++ snd_ctl_rename(codec->card, kctl, newname); + } + + static void alc1220_fixup_gb_dual_codecs(struct hda_codec *codec, diff --git a/queue-6.0/alsa-rme9652-use-explicitly-signed-char.patch b/queue-6.0/alsa-rme9652-use-explicitly-signed-char.patch new file mode 100644 index 00000000000..93daf1811fd --- /dev/null +++ b/queue-6.0/alsa-rme9652-use-explicitly-signed-char.patch @@ -0,0 +1,244 @@ +From 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Tue, 25 Oct 2022 02:03:13 +0200 +Subject: ALSA: rme9652: use explicitly signed char + +From: Jason A. Donenfeld + +commit 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 upstream. + +With char becoming unsigned by default, and with `char` alone being +ambiguous and based on architecture, signed chars need to be marked +explicitly as such. This fixes warnings like: + +sound/pci/rme9652/hdsp.c:3953 hdsp_channel_buffer_location() warn: 'hdsp->channel_map[channel]' is unsigned +sound/pci/rme9652/hdsp.c:4153 snd_hdsp_channel_info() warn: impossible condition '(hdsp->channel_map[channel] < 0) => (0-255 < 0)' +sound/pci/rme9652/rme9652.c:1833 rme9652_channel_buffer_location() warn: 'rme9652->channel_map[channel]' is unsigned + +Signed-off-by: Jason A. Donenfeld +Cc: +Link: https://lore.kernel.org/r/20221025000313.546261-1-Jason@zx2c4.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/rme9652/hdsp.c | 26 +++++++++++++------------- + sound/pci/rme9652/rme9652.c | 22 +++++++++++----------- + 2 files changed, 24 insertions(+), 24 deletions(-) + +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -433,7 +433,7 @@ struct hdsp_midi { + struct snd_rawmidi *rmidi; + struct snd_rawmidi_substream *input; + struct snd_rawmidi_substream *output; +- char istimer; /* timer in use */ ++ signed char istimer; /* timer in use */ + struct timer_list timer; + spinlock_t lock; + int pending; +@@ -480,7 +480,7 @@ struct hdsp { + pid_t playback_pid; + int running; + int system_sample_rate; +- const char *channel_map; ++ const signed char *channel_map; + int dev; + int irq; + unsigned long port; +@@ -502,7 +502,7 @@ struct hdsp { + where the data for that channel can be read/written from/to. + */ + +-static const char channel_map_df_ss[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_df_ss[HDSP_MAX_CHANNELS] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, + 18, 19, 20, 21, 22, 23, 24, 25 + }; +@@ -517,7 +517,7 @@ static const char channel_map_mf_ss[HDSP + -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_ds[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_ds[HDSP_MAX_CHANNELS] = { + /* ADAT channels are remapped */ + 1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, + /* channels 12 and 13 are S/PDIF */ +@@ -526,7 +526,7 @@ static const char channel_map_ds[HDSP_MA + -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = { + /* ADAT channels */ + 0, 1, 2, 3, 4, 5, 6, 7, + /* SPDIF */ +@@ -540,7 +540,7 @@ static const char channel_map_H9632_ss[H + -1, -1 + }; + +-static const char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = { + /* ADAT */ + 1, 3, 5, 7, + /* SPDIF */ +@@ -554,7 +554,7 @@ static const char channel_map_H9632_ds[H + -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = { + /* ADAT is disabled in this mode */ + /* SPDIF */ + 8, 9, +@@ -3939,7 +3939,7 @@ static snd_pcm_uframes_t snd_hdsp_hw_poi + return hdsp_hw_pointer(hdsp); + } + +-static char *hdsp_channel_buffer_location(struct hdsp *hdsp, ++static signed char *hdsp_channel_buffer_location(struct hdsp *hdsp, + int stream, + int channel) + +@@ -3964,7 +3964,7 @@ static int snd_hdsp_playback_copy(struct + void __user *src, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -3982,7 +3982,7 @@ static int snd_hdsp_playback_copy_kernel + void *src, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel); + if (snd_BUG_ON(!channel_buf)) +@@ -3996,7 +3996,7 @@ static int snd_hdsp_capture_copy(struct + void __user *dst, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -4014,7 +4014,7 @@ static int snd_hdsp_capture_copy_kernel( + void *dst, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel); + if (snd_BUG_ON(!channel_buf)) +@@ -4028,7 +4028,7 @@ static int snd_hdsp_hw_silence(struct sn + unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = hdsp_channel_buffer_location (hdsp, substream->pstr->stream, channel); + if (snd_BUG_ON(!channel_buf)) +--- a/sound/pci/rme9652/rme9652.c ++++ b/sound/pci/rme9652/rme9652.c +@@ -230,7 +230,7 @@ struct snd_rme9652 { + int last_spdif_sample_rate; /* so that we can catch externally ... */ + int last_adat_sample_rate; /* ... induced rate changes */ + +- const char *channel_map; ++ const signed char *channel_map; + + struct snd_card *card; + struct snd_pcm *pcm; +@@ -247,12 +247,12 @@ struct snd_rme9652 { + where the data for that channel can be read/written from/to. + */ + +-static const char channel_map_9652_ss[26] = { ++static const signed char channel_map_9652_ss[26] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, + 18, 19, 20, 21, 22, 23, 24, 25 + }; + +-static const char channel_map_9636_ss[26] = { ++static const signed char channel_map_9636_ss[26] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, + /* channels 16 and 17 are S/PDIF */ + 24, 25, +@@ -260,7 +260,7 @@ static const char channel_map_9636_ss[26 + -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_9652_ds[26] = { ++static const signed char channel_map_9652_ds[26] = { + /* ADAT channels are remapped */ + 1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, + /* channels 12 and 13 are S/PDIF */ +@@ -269,7 +269,7 @@ static const char channel_map_9652_ds[26 + -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_9636_ds[26] = { ++static const signed char channel_map_9636_ds[26] = { + /* ADAT channels are remapped */ + 1, 3, 5, 7, 9, 11, 13, 15, + /* channels 8 and 9 are S/PDIF */ +@@ -1819,7 +1819,7 @@ static snd_pcm_uframes_t snd_rme9652_hw_ + return rme9652_hw_pointer(rme9652); + } + +-static char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652, ++static signed char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652, + int stream, + int channel) + +@@ -1847,7 +1847,7 @@ static int snd_rme9652_playback_copy(str + void __user *src, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -1867,7 +1867,7 @@ static int snd_rme9652_playback_copy_ker + void *src, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = rme9652_channel_buffer_location(rme9652, + substream->pstr->stream, +@@ -1883,7 +1883,7 @@ static int snd_rme9652_capture_copy(stru + void __user *dst, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -1903,7 +1903,7 @@ static int snd_rme9652_capture_copy_kern + void *dst, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = rme9652_channel_buffer_location(rme9652, + substream->pstr->stream, +@@ -1919,7 +1919,7 @@ static int snd_rme9652_hw_silence(struct + unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = rme9652_channel_buffer_location (rme9652, + substream->pstr->stream, diff --git a/queue-6.0/alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch b/queue-6.0/alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch new file mode 100644 index 00000000000..f3ebdfd3c72 --- /dev/null +++ b/queue-6.0/alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch @@ -0,0 +1,33 @@ +From 794814529384721ce8f4d34228dc599cc010353d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 21 Oct 2022 14:27:22 +0200 +Subject: ALSA: usb-audio: Add quirks for M-Audio Fast Track C400/600 + +From: Takashi Iwai + +commit 794814529384721ce8f4d34228dc599cc010353d upstream. + +M-Audio Fast Track C400 and C600 devices (0763:2030 and 0763:2031, +respectively) seem requiring the explicit setup for the implicit +feedback mode. This patch adds the quirk entries for those. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214817 +Cc: +Link: https://lore.kernel.org/r/20221021122722.24784-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/implicit.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -47,6 +47,8 @@ struct snd_usb_implicit_fb_match { + static const struct snd_usb_implicit_fb_match playback_implicit_fb_quirks[] = { + /* Fixed EP */ + /* FIXME: check the availability of generic matching */ ++ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2030, 0x81, 3), /* M-Audio Fast Track C400 */ ++ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2031, 0x81, 3), /* M-Audio Fast Track C600 */ + IMPLICIT_FB_FIXED_DEV(0x0763, 0x2080, 0x81, 2), /* M-Audio FastTrack Ultra */ + IMPLICIT_FB_FIXED_DEV(0x0763, 0x2081, 0x81, 2), /* M-Audio FastTrack Ultra */ + IMPLICIT_FB_FIXED_DEV(0x2466, 0x8010, 0x81, 2), /* Fractal Audio Axe-Fx III */ diff --git a/queue-6.0/alsa-usb-audio-use-snd_ctl_rename-to-rename-a-control.patch b/queue-6.0/alsa-usb-audio-use-snd_ctl_rename-to-rename-a-control.patch new file mode 100644 index 00000000000..b4a178a370a --- /dev/null +++ b/queue-6.0/alsa-usb-audio-use-snd_ctl_rename-to-rename-a-control.patch @@ -0,0 +1,42 @@ +From 0b4f0debb34754002cee295441c9ca89ba8cdfcc Mon Sep 17 00:00:00 2001 +From: "Maciej S. Szmigiero" +Date: Thu, 20 Oct 2022 22:46:22 +0200 +Subject: ALSA: usb-audio: Use snd_ctl_rename() to rename a control + +From: Maciej S. Szmigiero + +commit 0b4f0debb34754002cee295441c9ca89ba8cdfcc upstream. + +With the recent addition of hashed controls lookup it's not enough to just +update the control name field, the hash entries for the modified control +have to be updated too. + +snd_ctl_rename() takes care of that, so use it instead of directly +modifying the control name. + +Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej S. Szmigiero +Link: https://lore.kernel.org/r/723877882e3a56bb42a2a2214cfc85f347d36e19.1666296963.git.maciej.szmigiero@oracle.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index a5641956ef10..9105ec623120 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1631,7 +1631,7 @@ static void check_no_speaker_on_headset(struct snd_kcontrol *kctl, + if (!found) + return; + +- strscpy(kctl->id.name, "Headphone", sizeof(kctl->id.name)); ++ snd_ctl_rename(card, kctl, "Headphone"); + } + + static const struct usb_feature_control_info *get_feature_control_info(int control) +-- +2.38.1 + diff --git a/queue-6.0/alsa-use-del_timer_sync-before-freeing-timer.patch b/queue-6.0/alsa-use-del_timer_sync-before-freeing-timer.patch new file mode 100644 index 00000000000..e483f629fa6 --- /dev/null +++ b/queue-6.0/alsa-use-del_timer_sync-before-freeing-timer.patch @@ -0,0 +1,64 @@ +From f0a868788fcbf63cdab51f5adcf73b271ede8164 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Wed, 26 Oct 2022 23:12:36 -0400 +Subject: ALSA: Use del_timer_sync() before freeing timer + +From: Steven Rostedt (Google) + +commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream. + +The current code for freeing the emux timer is extremely dangerous: + + CPU0 CPU1 + ---- ---- +snd_emux_timer_callback() + snd_emux_free() + spin_lock(&emu->voice_lock) + del_timer(&emu->tlist); <-- returns immediately + spin_unlock(&emu->voice_lock); + [..] + kfree(emu); + + spin_lock(&emu->voice_lock); + + [BOOM!] + +Instead just use del_timer_sync() which will wait for the timer to finish +before continuing. No need to check if the timer is active or not when +doing so. + +This doesn't fix the race of a possible re-arming of the timer, but at +least it won't use the data that has just been freed. + +[ Fixed unused variable warning by tiwai ] + +Cc: stable@vger.kernel.org +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Steven Rostedt (Google) +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20221026231236.6834b551@gandalf.local.home +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/synth/emux/emux.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/sound/synth/emux/emux.c ++++ b/sound/synth/emux/emux.c +@@ -126,15 +126,10 @@ EXPORT_SYMBOL(snd_emux_register); + */ + int snd_emux_free(struct snd_emux *emu) + { +- unsigned long flags; +- + if (! emu) + return -EINVAL; + +- spin_lock_irqsave(&emu->voice_lock, flags); +- if (emu->timer_active) +- del_timer(&emu->tlist); +- spin_unlock_irqrestore(&emu->voice_lock, flags); ++ del_timer_sync(&emu->tlist); + + snd_emux_proc_free(emu); + snd_emux_delete_virmidi(emu); diff --git a/queue-6.0/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch b/queue-6.0/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch new file mode 100644 index 00000000000..c230cdf5676 --- /dev/null +++ b/queue-6.0/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch @@ -0,0 +1,41 @@ +From c3c06c61890da80494bb196f75d89b791adda87f Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 27 Oct 2022 17:12:37 +0800 +Subject: can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() + +From: Yang Yingliang + +commit c3c06c61890da80494bb196f75d89b791adda87f upstream. + +It is not allowed to call kfree_skb() from hardware interrupt context +or with interrupts being disabled. The skb is unlinked from the queue, +so it can be freed after spin_unlock_irqrestore(). + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Signed-off-by: Yang Yingliang +Acked-by: Oleksij Rempel +Link: https://lore.kernel.org/all/20221027091237.2290111-1-yangyingliang@huawei.com +Cc: stable@vger.kernel.org +[mkl: adjust subject] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -342,10 +342,12 @@ static void j1939_session_skb_drop_old(s + __skb_unlink(do_skb, &session->skb_queue); + /* drop ref taken in j1939_session_skb_queue() */ + skb_unref(do_skb); ++ spin_unlock_irqrestore(&session->skb_queue.lock, flags); + + kfree_skb(do_skb); ++ } else { ++ spin_unlock_irqrestore(&session->skb_queue.lock, flags); + } +- spin_unlock_irqrestore(&session->skb_queue.lock, flags); + } + + void j1939_session_skb_queue(struct j1939_session *session, diff --git a/queue-6.0/can-kvaser_usb-fix-possible-completions-during-init_completion.patch b/queue-6.0/can-kvaser_usb-fix-possible-completions-during-init_completion.patch new file mode 100644 index 00000000000..4a29d78390e --- /dev/null +++ b/queue-6.0/can-kvaser_usb-fix-possible-completions-during-init_completion.patch @@ -0,0 +1,79 @@ +From 2871edb32f4622c3a25ce4b3977bad9050b91974 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 20:52:27 +0200 +Subject: can: kvaser_usb: Fix possible completions during init_completion + +From: Anssi Hannula + +commit 2871edb32f4622c3a25ce4b3977bad9050b91974 upstream. + +kvaser_usb uses completions to signal when a response event is received +for outgoing commands. + +However, it uses init_completion() to reinitialize the start_comp and +stop_comp completions before sending the start/stop commands. + +In case the device sends the corresponding response just before the +actual command is sent, complete() may be called concurrently with +init_completion() which is not safe. + +This might be triggerable even with a properly functioning device by +stopping the interface (CMD_STOP_CHIP) just after it goes bus-off (which +also causes the driver to send CMD_STOP_CHIP when restart-ms is off), +but that was not tested. + +Fix the issue by using reinit_completion() instead. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-2-extja@kvaser.com +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 ++-- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1875,7 +1875,7 @@ static int kvaser_usb_hydra_start_chip(s + { + int err; + +- init_completion(&priv->start_comp); ++ reinit_completion(&priv->start_comp); + + err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_START_CHIP_REQ, + priv->channel); +@@ -1893,7 +1893,7 @@ static int kvaser_usb_hydra_stop_chip(st + { + int err; + +- init_completion(&priv->stop_comp); ++ reinit_completion(&priv->stop_comp); + + /* Make sure we do not report invalid BUS_OFF from CMD_CHIP_STATE_EVENT + * see comment in kvaser_usb_hydra_update_state() +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1320,7 +1320,7 @@ static int kvaser_usb_leaf_start_chip(st + { + int err; + +- init_completion(&priv->start_comp); ++ reinit_completion(&priv->start_comp); + + err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_START_CHIP, + priv->channel); +@@ -1338,7 +1338,7 @@ static int kvaser_usb_leaf_stop_chip(str + { + int err; + +- init_completion(&priv->stop_comp); ++ reinit_completion(&priv->stop_comp); + + err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP, + priv->channel); diff --git a/queue-6.0/can-rcar_canfd-fix-channel-specific-irq-handling-for-rz-g2l.patch b/queue-6.0/can-rcar_canfd-fix-channel-specific-irq-handling-for-rz-g2l.patch new file mode 100644 index 00000000000..6ed489a480b --- /dev/null +++ b/queue-6.0/can-rcar_canfd-fix-channel-specific-irq-handling-for-rz-g2l.patch @@ -0,0 +1,92 @@ +From d887087c896881715c1a82f1d4f71fbfe5344ffd Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Tue, 25 Oct 2022 16:56:56 +0100 +Subject: can: rcar_canfd: fix channel specific IRQ handling for RZ/G2L + +From: Biju Das + +commit d887087c896881715c1a82f1d4f71fbfe5344ffd upstream. + +RZ/G2L has separate channel specific IRQs for transmit and error +interrupts. But the IRQ handler processes both channels, even if there +no interrupt occurred on one of the channels. + +This patch fixes the issue by passing a channel specific context +parameter instead of global one for the IRQ register and the IRQ +handler, it just handles the channel which is triggered the interrupt. + +Fixes: 76e9353a80e9 ("can: rcar_canfd: Add support for RZ/G2L family") +Signed-off-by: Biju Das +Link: https://lore.kernel.org/all/20221025155657.1426948-3-biju.das.jz@bp.renesas.com +Cc: stable@vger.kernel.org +[mkl: adjust commit message] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/rcar/rcar_canfd.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -1246,11 +1246,9 @@ static void rcar_canfd_handle_channel_tx + + static irqreturn_t rcar_canfd_channel_tx_interrupt(int irq, void *dev_id) + { +- struct rcar_canfd_global *gpriv = dev_id; +- u32 ch; ++ struct rcar_canfd_channel *priv = dev_id; + +- for_each_set_bit(ch, &gpriv->channels_mask, gpriv->max_channels) +- rcar_canfd_handle_channel_tx(gpriv, ch); ++ rcar_canfd_handle_channel_tx(priv->gpriv, priv->channel); + + return IRQ_HANDLED; + } +@@ -1278,11 +1276,9 @@ static void rcar_canfd_handle_channel_er + + static irqreturn_t rcar_canfd_channel_err_interrupt(int irq, void *dev_id) + { +- struct rcar_canfd_global *gpriv = dev_id; +- u32 ch; ++ struct rcar_canfd_channel *priv = dev_id; + +- for_each_set_bit(ch, &gpriv->channels_mask, gpriv->max_channels) +- rcar_canfd_handle_channel_err(gpriv, ch); ++ rcar_canfd_handle_channel_err(priv->gpriv, priv->channel); + + return IRQ_HANDLED; + } +@@ -1723,6 +1719,7 @@ static int rcar_canfd_channel_probe(stru + priv->ndev = ndev; + priv->base = gpriv->base; + priv->channel = ch; ++ priv->gpriv = gpriv; + priv->can.clock.freq = fcan_freq; + dev_info(&pdev->dev, "can_clk rate is %u\n", priv->can.clock.freq); + +@@ -1751,7 +1748,7 @@ static int rcar_canfd_channel_probe(stru + } + err = devm_request_irq(&pdev->dev, err_irq, + rcar_canfd_channel_err_interrupt, 0, +- irq_name, gpriv); ++ irq_name, priv); + if (err) { + dev_err(&pdev->dev, "devm_request_irq CH Err(%d) failed, error %d\n", + err_irq, err); +@@ -1765,7 +1762,7 @@ static int rcar_canfd_channel_probe(stru + } + err = devm_request_irq(&pdev->dev, tx_irq, + rcar_canfd_channel_tx_interrupt, 0, +- irq_name, gpriv); ++ irq_name, priv); + if (err) { + dev_err(&pdev->dev, "devm_request_irq Tx (%d) failed, error %d\n", + tx_irq, err); +@@ -1791,7 +1788,6 @@ static int rcar_canfd_channel_probe(stru + + priv->can.do_set_mode = rcar_canfd_do_set_mode; + priv->can.do_get_berr_counter = rcar_canfd_get_berr_counter; +- priv->gpriv = gpriv; + SET_NETDEV_DEV(ndev, &pdev->dev); + + netif_napi_add_weight(ndev, &priv->napi, rcar_canfd_rx_poll, diff --git a/queue-6.0/can-rcar_canfd-rcar_canfd_handle_global_receive-fix-irq-storm-on-global-fifo-receive.patch b/queue-6.0/can-rcar_canfd-rcar_canfd_handle_global_receive-fix-irq-storm-on-global-fifo-receive.patch new file mode 100644 index 00000000000..d66efbc58fb --- /dev/null +++ b/queue-6.0/can-rcar_canfd-rcar_canfd_handle_global_receive-fix-irq-storm-on-global-fifo-receive.patch @@ -0,0 +1,59 @@ +From 702de2c21eed04c67cefaaedc248ef16e5f6b293 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Tue, 25 Oct 2022 16:56:55 +0100 +Subject: can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive + +From: Biju Das + +commit 702de2c21eed04c67cefaaedc248ef16e5f6b293 upstream. + +We are seeing an IRQ storm on the global receive IRQ line under heavy +CAN bus load conditions with both CAN channels enabled. + +Conditions: + +The global receive IRQ line is shared between can0 and can1, either of +the channels can trigger interrupt while the other channel's IRQ line +is disabled (RFIE). + +When global a receive IRQ interrupt occurs, we mask the interrupt in +the IRQ handler. Clearing and unmasking of the interrupt is happening +in rx_poll(). There is a race condition where rx_poll() unmasks the +interrupt, but the next IRQ handler does not mask the IRQ due to +NAPIF_STATE_MISSED flag (e.g.: can0 RX FIFO interrupt is disabled and +can1 is triggering RX interrupt, the delay in rx_poll() processing +results in setting NAPIF_STATE_MISSED flag) leading to an IRQ storm. + +This patch fixes the issue by checking IRQ active and enabled before +handling the IRQ on a particular channel. + +Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver") +Suggested-by: Marc Kleine-Budde +Signed-off-by: Biju Das +Link: https://lore.kernel.org/all/20221025155657.1426948-2-biju.das.jz@bp.renesas.com +Cc: stable@vger.kernel.org +[mkl: adjust commit message] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/rcar/rcar_canfd.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -1157,11 +1157,13 @@ static void rcar_canfd_handle_global_rec + { + struct rcar_canfd_channel *priv = gpriv->ch[ch]; + u32 ridx = ch + RCANFD_RFFIFO_IDX; +- u32 sts; ++ u32 sts, cc; + + /* Handle Rx interrupts */ + sts = rcar_canfd_read(priv->base, RCANFD_RFSTS(gpriv, ridx)); +- if (likely(sts & RCANFD_RFSTS_RFIF)) { ++ cc = rcar_canfd_read(priv->base, RCANFD_RFCC(gpriv, ridx)); ++ if (likely(sts & RCANFD_RFSTS_RFIF && ++ cc & RCANFD_RFCC_RFIE)) { + if (napi_schedule_prep(&priv->napi)) { + /* Disable Rx FIFO interrupts */ + rcar_canfd_clear_bit(priv->base, diff --git a/queue-6.0/mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch b/queue-6.0/mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch new file mode 100644 index 00000000000..852b7120e2b --- /dev/null +++ b/queue-6.0/mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch @@ -0,0 +1,52 @@ +From 05e258c6ec669d6d18c494ea03d35962d6f5b545 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Tue, 18 Oct 2022 11:11:29 +0200 +Subject: mtd: parsers: bcm47xxpart: Fix halfblock reads +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Walleij + +commit 05e258c6ec669d6d18c494ea03d35962d6f5b545 upstream. + +There is some code in the parser that tries to read 0x8000 +bytes into a block to "read in the middle" of the block. Well +that only works if the block is also 0x10000 bytes all the time, +else we get these parse errors as we reach the end of the flash: + +spi-nor spi0.0: mx25l1606e (2048 Kbytes) +mtd_read error while parsing (offset: 0x200000): -22 +mtd_read error while parsing (offset: 0x201000): -22 +(...) + +Fix the code to do what I think was intended. + +Cc: stable@vger.kernel.org +Fixes: f0501e81fbaa ("mtd: bcm47xxpart: alternative MAGIC for board_data partition") +Cc: Rafał Miłecki +Cc: Florian Fainelli +Signed-off-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221018091129.280026-1-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/parsers/bcm47xxpart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/parsers/bcm47xxpart.c ++++ b/drivers/mtd/parsers/bcm47xxpart.c +@@ -233,11 +233,11 @@ static int bcm47xxpart_parse(struct mtd_ + } + + /* Read middle of the block */ +- err = mtd_read(master, offset + 0x8000, 0x4, &bytes_read, ++ err = mtd_read(master, offset + (blocksize / 2), 0x4, &bytes_read, + (uint8_t *)buf); + if (err && !mtd_is_bitflip(err)) { + pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", +- offset + 0x8000, err); ++ offset + (blocksize / 2), err); + continue; + } + diff --git a/queue-6.0/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch b/queue-6.0/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch new file mode 100644 index 00000000000..83713883bdd --- /dev/null +++ b/queue-6.0/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch @@ -0,0 +1,39 @@ +From ce107713b722af57c4b7f2477594d445b496420e Mon Sep 17 00:00:00 2001 +From: Tony O'Brien +Date: Tue, 27 Sep 2022 15:47:28 +1300 +Subject: mtd: rawnand: marvell: Use correct logic for nand-keep-config + +From: Tony O'Brien + +commit ce107713b722af57c4b7f2477594d445b496420e upstream. + +Originally the absence of the marvell,nand-keep-config property caused +the setup_data_interface function to be provided. However when +setup_data_interface was moved into nand_controller_ops the logic was +unintentionally inverted. Update the logic so that only if the +marvell,nand-keep-config property is present the bootloader NAND config +kept. + +Cc: stable@vger.kernel.org +Fixes: 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops") +Signed-off-by: Tony O'Brien +Signed-off-by: Chris Packham +Reviewed-by: Boris Brezillon +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220927024728.28447-1-chris.packham@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/marvell_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -2672,7 +2672,7 @@ static int marvell_nand_chip_init(struct + chip->controller = &nfc->controller; + nand_set_flash_node(chip, np); + +- if (!of_property_read_bool(np, "marvell,nand-keep-config")) ++ if (of_property_read_bool(np, "marvell,nand-keep-config")) + chip->options |= NAND_KEEP_TIMINGS; + + mtd = nand_to_mtd(chip); diff --git a/queue-6.0/mtd-rawnand-tegra-fix-pm-disable-depth-imbalance-in-probe.patch b/queue-6.0/mtd-rawnand-tegra-fix-pm-disable-depth-imbalance-in-probe.patch new file mode 100644 index 00000000000..bfdbfd5665e --- /dev/null +++ b/queue-6.0/mtd-rawnand-tegra-fix-pm-disable-depth-imbalance-in-probe.patch @@ -0,0 +1,43 @@ +From 3ada71310d2c68eebb57772df6bb1f5f033ae802 Mon Sep 17 00:00:00 2001 +From: Zhang Qilong +Date: Mon, 26 Sep 2022 16:44:56 +0800 +Subject: mtd: rawnand: tegra: Fix PM disable depth imbalance in probe + +From: Zhang Qilong + +commit 3ada71310d2c68eebb57772df6bb1f5f033ae802 upstream. + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. + +Cc: stable@vger.kernel.org +Fixes: d7d9f8ec77fe9 ("mtd: rawnand: add NVIDIA Tegra NAND Flash controller driver") +Signed-off-by: Zhang Qilong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220926084456.98160-1-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/tegra_nand.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/tegra_nand.c ++++ b/drivers/mtd/nand/raw/tegra_nand.c +@@ -1181,7 +1181,7 @@ static int tegra_nand_probe(struct platf + pm_runtime_enable(&pdev->dev); + err = pm_runtime_resume_and_get(&pdev->dev); + if (err) +- return err; ++ goto err_dis_pm; + + err = reset_control_reset(rst); + if (err) { +@@ -1215,6 +1215,8 @@ static int tegra_nand_probe(struct platf + err_put_pm: + pm_runtime_put_sync_suspend(ctrl->dev); + pm_runtime_force_suspend(ctrl->dev); ++err_dis_pm: ++ pm_runtime_disable(&pdev->dev); + return err; + } + diff --git a/queue-6.0/mtd-spi-nor-core-ignore-enotsupp-in-spi_nor_init.patch b/queue-6.0/mtd-spi-nor-core-ignore-enotsupp-in-spi_nor_init.patch new file mode 100644 index 00000000000..d06b4e066a2 --- /dev/null +++ b/queue-6.0/mtd-spi-nor-core-ignore-enotsupp-in-spi_nor_init.patch @@ -0,0 +1,46 @@ +From 69d04ca999499bccb6ca849fa2bfc5e6448f7233 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Fri, 23 Sep 2022 12:34:41 +0300 +Subject: mtd: spi-nor: core: Ignore -ENOTSUPP in spi_nor_init() + +From: Mika Westerberg + +commit 69d04ca999499bccb6ca849fa2bfc5e6448f7233 upstream. + +The Intel SPI-NOR controller does not support the 4-byte address opcode +so ->set_4byte_addr_mode() ends up returning -ENOTSUPP and the SPI flash +chip probe fail like this: + + [ 12.291082] spi-nor: probe of spi0.0 failed with error -524 + +Whereas previously before commit 08412e72afba ("mtd: spi-nor: core: +Return error code from set_4byte_addr_mode()") it worked just fine. + +Fix this by ignoring -ENOTSUPP in spi_nor_init(). + +Fixes: 08412e72afba ("mtd: spi-nor: core: Return error code from set_4byte_addr_mode()") +Cc: stable@vger.kernel.org +Reported-by: Hongyu Ning +Signed-off-by: Mika Westerberg +Reviewed-by: Michael Walle +Acked-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220923093441.3178-1-mika.westerberg@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/spi-nor/core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -2724,7 +2724,9 @@ static int spi_nor_init(struct spi_nor * + */ + WARN_ONCE(nor->flags & SNOR_F_BROKEN_RESET, + "enabling reset hack; may not recover from unexpected reboots\n"); +- return nor->params->set_4byte_addr_mode(nor, true); ++ err = nor->params->set_4byte_addr_mode(nor, true); ++ if (err && err != -ENOTSUPP) ++ return err; + } + + return 0; diff --git a/queue-6.0/revert-usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch b/queue-6.0/revert-usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch new file mode 100644 index 00000000000..bb92d218d88 --- /dev/null +++ b/queue-6.0/revert-usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch @@ -0,0 +1,67 @@ +From 88c8e05ed5c0f05a637e654bbe4e49a1ebe7013c Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Wed, 26 Oct 2022 14:09:06 +0200 +Subject: Revert "usb: gadget: uvc: limit isoc_sg to super speed gadgets" + +From: Greg Kroah-Hartman + +commit 88c8e05ed5c0f05a637e654bbe4e49a1ebe7013c upstream. + +This reverts commit 19905240aef0181d1e6944070eb85fce75f75bcd. + +It was a new feature, and it doesn't even work properly yet, so revert +it from this branch as it is not needed for 6.1-final. + +Cc: Michael Grzeschik +Cc: stable +Fixes: 19905240aef0 ("usb: gadget: uvc: limit isoc_sg to super speed gadgets") +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_queue.c | 9 ++++++--- + drivers/usb/gadget/function/uvc_video.c | 9 ++------- + 2 files changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -84,9 +84,12 @@ static int uvc_buffer_prepare(struct vb2 + return -ENODEV; + + buf->state = UVC_BUF_STATE_QUEUED; +- buf->sgt = vb2_dma_sg_plane_desc(vb, 0); +- buf->sg = buf->sgt->sgl; +- buf->mem = vb2_plane_vaddr(vb, 0); ++ if (queue->use_sg) { ++ buf->sgt = vb2_dma_sg_plane_desc(vb, 0); ++ buf->sg = buf->sgt->sgl; ++ } else { ++ buf->mem = vb2_plane_vaddr(vb, 0); ++ } + buf->length = vb2_plane_size(vb, 0); + if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) + buf->bytesused = 0; +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -448,9 +448,6 @@ static void uvcg_video_pump(struct work_ + */ + int uvcg_video_enable(struct uvc_video *video, int enable) + { +- struct uvc_device *uvc = video->uvc; +- struct usb_composite_dev *cdev = uvc->func.config->cdev; +- struct usb_gadget *gadget = cdev->gadget; + unsigned int i; + int ret; + +@@ -482,11 +479,9 @@ int uvcg_video_enable(struct uvc_video * + if (video->max_payload_size) { + video->encode = uvc_video_encode_bulk; + video->payload_size = 0; +- } else { +- video->encode = (video->queue.use_sg && +- !(gadget->speed <= USB_SPEED_HIGH)) ? ++ } else ++ video->encode = video->queue.use_sg ? + uvc_video_encode_isoc_sg : uvc_video_encode_isoc; +- } + + video->req_int_count = 0; + diff --git a/queue-6.0/series b/queue-6.0/series index c7496345ef7..529a5a107b6 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -1 +1,41 @@ platform-x86-amd-pmc-remove-config_debug_fs-checks.patch +can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch +can-kvaser_usb-fix-possible-completions-during-init_completion.patch +can-rcar_canfd-rcar_canfd_handle_global_receive-fix-irq-storm-on-global-fifo-receive.patch +can-rcar_canfd-fix-channel-specific-irq-handling-for-rz-g2l.patch +alsa-use-del_timer_sync-before-freeing-timer.patch +alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch +alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch +alsa-hda-realtek-add-another-hp-zbook-g9-model-quirks.patch +alsa-control-add-snd_ctl_rename.patch +alsa-hda-realtek-use-snd_ctl_rename-to-rename-a-control.patch +alsa-emu10k1-use-snd_ctl_rename-to-rename-a-control.patch +alsa-ac97-use-snd_ctl_rename-to-rename-a-control.patch +alsa-usb-audio-use-snd_ctl_rename-to-rename-a-control.patch +alsa-ca0106-use-snd_ctl_rename-to-rename-a-control.patch +alsa-au88x0-use-explicitly-signed-char.patch +alsa-rme9652-use-explicitly-signed-char.patch +usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch +usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch +revert-usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch +usb-gadget-uvc-fix-dropped-frame-after-missed-isoc.patch +usb-gadget-uvc-fix-sg-handling-in-error-case.patch +usb-gadget-uvc-fix-sg-handling-during-video-encode.patch +usb-gadget-aspeed-fix-probe-regression.patch +usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch +usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch +usb-dwc3-gadget-force-sending-delayed-status-during-soft-disconnect.patch +usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch +usb-typec-ucsi-check-the-connection-on-resume.patch +usb-typec-ucsi-acpi-implement-resume-callback.patch +usb-dwc3-st-rely-on-child-s-compatible-instead-of-name.patch +usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch +usb-bdc-change-state-when-port-disconnected.patch +usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch +mtd-rawnand-tegra-fix-pm-disable-depth-imbalance-in-probe.patch +mtd-spi-nor-core-ignore-enotsupp-in-spi_nor_init.patch +mtd-parsers-bcm47xxpart-fix-halfblock-reads.patch +mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch +squashfs-fix-read-regression-introduced-in-readahead-code.patch +squashfs-fix-extending-readahead-beyond-end-of-file.patch +squashfs-fix-buffer-release-race-condition-in-readahead-code.patch diff --git a/queue-6.0/squashfs-fix-buffer-release-race-condition-in-readahead-code.patch b/queue-6.0/squashfs-fix-buffer-release-race-condition-in-readahead-code.patch new file mode 100644 index 00000000000..5df2ae05f18 --- /dev/null +++ b/queue-6.0/squashfs-fix-buffer-release-race-condition-in-readahead-code.patch @@ -0,0 +1,56 @@ +From e11c4e088be4c39d17f304fcf331670891905f42 Mon Sep 17 00:00:00 2001 +From: Phillip Lougher +Date: Thu, 20 Oct 2022 23:36:16 +0100 +Subject: squashfs: fix buffer release race condition in readahead code + +From: Phillip Lougher + +commit e11c4e088be4c39d17f304fcf331670891905f42 upstream. + +Fix a buffer release race condition, where the error value was used after +release. + +Link: https://lkml.kernel.org/r/20221020223616.7571-4-phillip@squashfs.org.uk +Fixes: b09a7a036d20 ("squashfs: support reading fragments in readahead call") +Signed-off-by: Phillip Lougher +Tested-by: Bagas Sanjaya +Reported-by: Marc Miltenberger +Cc: Dimitri John Ledkov +Cc: Hsin-Yi Wang +Cc: Mirsad Goran Todorovac +Cc: Slade Watkins +Cc: Thorsten Leemhuis +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/squashfs/file.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c +index f0afd4d6fd30..8ba8c4c50770 100644 +--- a/fs/squashfs/file.c ++++ b/fs/squashfs/file.c +@@ -506,8 +506,9 @@ static int squashfs_readahead_fragment(struct page **page, + squashfs_i(inode)->fragment_size); + struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info; + unsigned int n, mask = (1 << (msblk->block_log - PAGE_SHIFT)) - 1; ++ int error = buffer->error; + +- if (buffer->error) ++ if (error) + goto out; + + expected += squashfs_i(inode)->fragment_offset; +@@ -529,7 +530,7 @@ static int squashfs_readahead_fragment(struct page **page, + + out: + squashfs_cache_put(buffer); +- return buffer->error; ++ return error; + } + + static void squashfs_readahead(struct readahead_control *ractl) +-- +2.38.1 + diff --git a/queue-6.0/squashfs-fix-extending-readahead-beyond-end-of-file.patch b/queue-6.0/squashfs-fix-extending-readahead-beyond-end-of-file.patch new file mode 100644 index 00000000000..b6e9bfe1d30 --- /dev/null +++ b/queue-6.0/squashfs-fix-extending-readahead-beyond-end-of-file.patch @@ -0,0 +1,71 @@ +From c9199de82bad03bceb94ec3c5195c879d7e11911 Mon Sep 17 00:00:00 2001 +From: Phillip Lougher +Date: Thu, 20 Oct 2022 23:36:15 +0100 +Subject: squashfs: fix extending readahead beyond end of file + +From: Phillip Lougher + +commit c9199de82bad03bceb94ec3c5195c879d7e11911 upstream. + +The readahead code will try to extend readahead to the entire size of the +Squashfs data block. + +But, it didn't take into account that the last block at the end of the +file may not be a whole block. In this case, the code would extend +readahead to beyond the end of the file, leaving trailing pages. + +Fix this by only requesting the expected number of pages. + +Link: https://lkml.kernel.org/r/20221020223616.7571-3-phillip@squashfs.org.uk +Fixes: 8fc78b6fe24c ("squashfs: implement readahead") +Signed-off-by: Phillip Lougher +Tested-by: Bagas Sanjaya +Reported-by: Marc Miltenberger +Cc: Dimitri John Ledkov +Cc: Hsin-Yi Wang +Cc: Mirsad Goran Todorovac +Cc: Slade Watkins +Cc: Thorsten Leemhuis +Cc: +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Andrew Morton +--- + fs/squashfs/file.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c +index e526eb7a1658..f0afd4d6fd30 100644 +--- a/fs/squashfs/file.c ++++ b/fs/squashfs/file.c +@@ -559,6 +559,12 @@ static void squashfs_readahead(struct readahead_control *ractl) + unsigned int expected; + struct page *last_page; + ++ expected = start >> msblk->block_log == file_end ? ++ (i_size_read(inode) & (msblk->block_size - 1)) : ++ msblk->block_size; ++ ++ max_pages = (expected + PAGE_SIZE - 1) >> PAGE_SHIFT; ++ + nr_pages = __readahead_batch(ractl, pages, max_pages); + if (!nr_pages) + break; +@@ -567,13 +573,10 @@ static void squashfs_readahead(struct readahead_control *ractl) + goto skip_pages; + + index = pages[0]->index >> shift; ++ + if ((pages[nr_pages - 1]->index >> shift) != index) + goto skip_pages; + +- expected = index == file_end ? +- (i_size_read(inode) & (msblk->block_size - 1)) : +- msblk->block_size; +- + if (index == file_end && squashfs_i(inode)->fragment_block != + SQUASHFS_INVALID_BLK) { + res = squashfs_readahead_fragment(pages, nr_pages, +-- +2.38.1 + diff --git a/queue-6.0/squashfs-fix-read-regression-introduced-in-readahead-code.patch b/queue-6.0/squashfs-fix-read-regression-introduced-in-readahead-code.patch new file mode 100644 index 00000000000..9674a0d6865 --- /dev/null +++ b/queue-6.0/squashfs-fix-read-regression-introduced-in-readahead-code.patch @@ -0,0 +1,137 @@ +From 9ef8eb6104527bfe9ed31f7a4ffa721390adf9a8 Mon Sep 17 00:00:00 2001 +From: Phillip Lougher +Date: Thu, 20 Oct 2022 23:36:14 +0100 +Subject: squashfs: fix read regression introduced in readahead code + +From: Phillip Lougher + +commit 9ef8eb6104527bfe9ed31f7a4ffa721390adf9a8 upstream. + +Patch series "squashfs: fix some regressions introduced in the readahead +code". + +This patchset fixes 3 regressions introduced by the recent readahead code +changes. The first regression is causing "snaps" to randomly fail after a +couple of hours or days, which how the regression came to light. + + +This patch (of 3): + +If a file isn't a whole multiple of the page size, the last page will have +trailing bytes unfilled. + +There was a mistake in the readahead code which did this. In particular +it incorrectly assumed that the last page in the readahead page array +(page[nr_pages - 1]) will always contain the last page in the block, which +if we're at file end, will be the page that needs to be zero filled. + +But the readahead code may not return the last page in the block, which +means it is unmapped and will be skipped by the decompressors (a temporary +buffer used). + +In this case the zero filling code will zero out the wrong page, leading +to data corruption. + +Fix this by by extending the "page actor" to return the last page if +present, or NULL if a temporary buffer was used. + +Link: https://lkml.kernel.org/r/20221020223616.7571-1-phillip@squashfs.org.uk +Link: https://lkml.kernel.org/r/20221020223616.7571-2-phillip@squashfs.org.uk +Fixes: 8fc78b6fe24c ("squashfs: implement readahead") +Link: https://lore.kernel.org/lkml/b0c258c3-6dcf-aade-efc4-d62a8b3a1ce2@alu.unizg.hr/ +Signed-off-by: Phillip Lougher +Reported-by: Mirsad Goran Todorovac +Tested-by: Mirsad Goran Todorovac +Tested-by: Slade Watkins +Tested-by: Bagas Sanjaya +Reported-by: Marc Miltenberger +Cc: Dimitri John Ledkov +Cc: Hsin-Yi Wang +Cc: Thorsten Leemhuis +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/squashfs/file.c | 7 ++++--- + fs/squashfs/page_actor.c | 3 +++ + fs/squashfs/page_actor.h | 6 +++++- + 3 files changed, 12 insertions(+), 4 deletions(-) + +--- a/fs/squashfs/file.c ++++ b/fs/squashfs/file.c +@@ -557,6 +557,7 @@ static void squashfs_readahead(struct re + int res, bsize; + u64 block = 0; + unsigned int expected; ++ struct page *last_page; + + nr_pages = __readahead_batch(ractl, pages, max_pages); + if (!nr_pages) +@@ -593,15 +594,15 @@ static void squashfs_readahead(struct re + + res = squashfs_read_data(inode->i_sb, block, bsize, NULL, actor); + +- squashfs_page_actor_free(actor); ++ last_page = squashfs_page_actor_free(actor); + + if (res == expected) { + int bytes; + + /* Last page (if present) may have trailing bytes not filled */ + bytes = res % PAGE_SIZE; +- if (pages[nr_pages - 1]->index == file_end && bytes) +- memzero_page(pages[nr_pages - 1], bytes, ++ if (index == file_end && bytes && last_page) ++ memzero_page(last_page, bytes, + PAGE_SIZE - bytes); + + for (i = 0; i < nr_pages; i++) { +--- a/fs/squashfs/page_actor.c ++++ b/fs/squashfs/page_actor.c +@@ -71,11 +71,13 @@ static void *handle_next_page(struct squ + (actor->next_index != actor->page[actor->next_page]->index)) { + actor->next_index++; + actor->returned_pages++; ++ actor->last_page = NULL; + return actor->alloc_buffer ? actor->tmp_buffer : ERR_PTR(-ENOMEM); + } + + actor->next_index++; + actor->returned_pages++; ++ actor->last_page = actor->page[actor->next_page]; + return actor->pageaddr = kmap_local_page(actor->page[actor->next_page++]); + } + +@@ -125,6 +127,7 @@ struct squashfs_page_actor *squashfs_pag + actor->returned_pages = 0; + actor->next_index = page[0]->index & ~((1 << (msblk->block_log - PAGE_SHIFT)) - 1); + actor->pageaddr = NULL; ++ actor->last_page = NULL; + actor->alloc_buffer = msblk->decompressor->alloc_buffer; + actor->squashfs_first_page = direct_first_page; + actor->squashfs_next_page = direct_next_page; +--- a/fs/squashfs/page_actor.h ++++ b/fs/squashfs/page_actor.h +@@ -16,6 +16,7 @@ struct squashfs_page_actor { + void *(*squashfs_first_page)(struct squashfs_page_actor *); + void *(*squashfs_next_page)(struct squashfs_page_actor *); + void (*squashfs_finish_page)(struct squashfs_page_actor *); ++ struct page *last_page; + int pages; + int length; + int next_page; +@@ -29,10 +30,13 @@ extern struct squashfs_page_actor *squas + extern struct squashfs_page_actor *squashfs_page_actor_init_special( + struct squashfs_sb_info *msblk, + struct page **page, int pages, int length); +-static inline void squashfs_page_actor_free(struct squashfs_page_actor *actor) ++static inline struct page *squashfs_page_actor_free(struct squashfs_page_actor *actor) + { ++ struct page *last_page = actor->last_page; ++ + kfree(actor->tmp_buffer); + kfree(actor); ++ return last_page; + } + static inline void *squashfs_first_page(struct squashfs_page_actor *actor) + { diff --git a/queue-6.0/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch b/queue-6.0/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch new file mode 100644 index 00000000000..ff87baeda05 --- /dev/null +++ b/queue-6.0/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch @@ -0,0 +1,53 @@ +From fc4ade55c617dc73c7e9756b57f3230b4ff24540 Mon Sep 17 00:00:00 2001 +From: Hannu Hartikainen +Date: Mon, 19 Sep 2022 20:16:10 +0300 +Subject: USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM + +From: Hannu Hartikainen + +commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 upstream. + +NVIDIA Jetson devices in Force Recovery mode (RCM) do not support +suspending, ie. flashing fails if the device has been suspended. The +devices are still visible in lsusb and seem to work otherwise, making +the issue hard to debug. This has been discovered in various forum +posts, eg. [1]. + +The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding +all the Jetson models listed in [2] on the assumption that they all +behave similarly. + +[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365 +[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html + +Signed-off-by: Hannu Hartikainen +Cc: stable # after 6.1-rc3 +Link: https://lore.kernel.org/r/20220919171610.30484-1-hannu@hrtk.in +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index f99a65a64588..11b27953ccd0 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -388,6 +388,15 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Kingston DataTraveler 3.0 */ + { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* NVIDIA Jetson devices in Force Recovery mode */ ++ { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + +-- +2.38.1 + diff --git a/queue-6.0/usb-bdc-change-state-when-port-disconnected.patch b/queue-6.0/usb-bdc-change-state-when-port-disconnected.patch new file mode 100644 index 00000000000..5997b2505dc --- /dev/null +++ b/queue-6.0/usb-bdc-change-state-when-port-disconnected.patch @@ -0,0 +1,33 @@ +From fb8f60dd1b67520e0e0d7978ef17d015690acfc1 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 5 Oct 2022 12:13:55 -0700 +Subject: usb: bdc: change state when port disconnected + +From: Justin Chen + +commit fb8f60dd1b67520e0e0d7978ef17d015690acfc1 upstream. + +When port is connected and then disconnected, the state stays as +configured. Which is incorrect as the port is no longer configured, +but in a not attached state. + +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC") +Cc: stable +Link: https://lore.kernel.org/r/1664997235-18198-1-git-send-email-justinpopo6@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/bdc/bdc_udc.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c +@@ -151,6 +151,7 @@ static void bdc_uspc_disconnected(struct + bdc->delayed_status = false; + bdc->reinit = reinit; + bdc->test_mode = false; ++ usb_gadget_set_state(&bdc->gadget, USB_STATE_NOTATTACHED); + } + + /* TNotify wkaeup timer */ diff --git a/queue-6.0/usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch b/queue-6.0/usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch new file mode 100644 index 00000000000..5a41bcb9a65 --- /dev/null +++ b/queue-6.0/usb-dwc3-don-t-switch-otg-peripheral-if-extcon-is-present.patch @@ -0,0 +1,180 @@ +From d182c2e1bc92084c038b44c618f29589a4de9f66 Mon Sep 17 00:00:00 2001 +From: Andrey Smirnov +Date: Tue, 18 Oct 2022 02:35:10 +0300 +Subject: usb: dwc3: Don't switch OTG -> peripheral if extcon is present + +From: Andrey Smirnov + +commit d182c2e1bc92084c038b44c618f29589a4de9f66 upstream. + +If the extcon device exists, get the mode from the extcon device. If +the controller is DRD and the driver is unable to determine the mode, +only then default the dr_mode to USB_DR_MODE_PERIPHERAL. + +Reported-by: Steev Klimaszewski +Fixes: 7a84e7353e23 ("Revert "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"") +Cc: stable +Reviewed-by: Thinh Nguyen +Signed-off-by: Andrey Smirnov +Signed-off-by: Andy Shevchenko +Tested-by: Steev Klimaszewski +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20221017233510.53336-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++- + drivers/usb/dwc3/drd.c | 50 ------------------------------------------------ + 2 files changed, 48 insertions(+), 51 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -85,7 +86,7 @@ static int dwc3_get_dr_mode(struct dwc3 + * mode. If the controller supports DRD but the dr_mode is not + * specified or set to OTG, then set the mode to peripheral. + */ +- if (mode == USB_DR_MODE_OTG && ++ if (mode == USB_DR_MODE_OTG && !dwc->edev && + (!IS_ENABLED(CONFIG_USB_ROLE_SWITCH) || + !device_property_read_bool(dwc->dev, "usb-role-switch")) && + !DWC3_VER_IS_PRIOR(DWC3, 330A)) +@@ -1690,6 +1691,46 @@ static void dwc3_check_params(struct dwc + } + } + ++static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc) ++{ ++ struct device *dev = dwc->dev; ++ struct device_node *np_phy; ++ struct extcon_dev *edev = NULL; ++ const char *name; ++ ++ if (device_property_read_bool(dev, "extcon")) ++ return extcon_get_edev_by_phandle(dev, 0); ++ ++ /* ++ * Device tree platforms should get extcon via phandle. ++ * On ACPI platforms, we get the name from a device property. ++ * This device property is for kernel internal use only and ++ * is expected to be set by the glue code. ++ */ ++ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) ++ return extcon_get_extcon_dev(name); ++ ++ /* ++ * Try to get an extcon device from the USB PHY controller's "port" ++ * node. Check if it has the "port" node first, to avoid printing the ++ * error message from underlying code, as it's a valid case: extcon ++ * device (and "port" node) may be missing in case of "usb-role-switch" ++ * or OTG mode. ++ */ ++ np_phy = of_parse_phandle(dev->of_node, "phys", 0); ++ if (of_graph_is_present(np_phy)) { ++ struct device_node *np_conn; ++ ++ np_conn = of_graph_get_remote_node(np_phy, -1, -1); ++ if (np_conn) ++ edev = extcon_find_edev_by_node(np_conn); ++ of_node_put(np_conn); ++ } ++ of_node_put(np_phy); ++ ++ return edev; ++} ++ + static int dwc3_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1840,6 +1881,12 @@ static int dwc3_probe(struct platform_de + goto err2; + } + ++ dwc->edev = dwc3_get_extcon(dwc); ++ if (IS_ERR(dwc->edev)) { ++ ret = dev_err_probe(dwc->dev, PTR_ERR(dwc->edev), "failed to get extcon\n"); ++ goto err3; ++ } ++ + ret = dwc3_get_dr_mode(dwc); + if (ret) + goto err3; +--- a/drivers/usb/dwc3/drd.c ++++ b/drivers/usb/dwc3/drd.c +@@ -8,7 +8,6 @@ + */ + + #include +-#include + #include + #include + #include +@@ -439,51 +438,6 @@ static int dwc3_drd_notifier(struct noti + return NOTIFY_DONE; + } + +-static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc) +-{ +- struct device *dev = dwc->dev; +- struct device_node *np_phy; +- struct extcon_dev *edev = NULL; +- const char *name; +- +- if (device_property_read_bool(dev, "extcon")) +- return extcon_get_edev_by_phandle(dev, 0); +- +- /* +- * Device tree platforms should get extcon via phandle. +- * On ACPI platforms, we get the name from a device property. +- * This device property is for kernel internal use only and +- * is expected to be set by the glue code. +- */ +- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) { +- edev = extcon_get_extcon_dev(name); +- if (!edev) +- return ERR_PTR(-EPROBE_DEFER); +- +- return edev; +- } +- +- /* +- * Try to get an extcon device from the USB PHY controller's "port" +- * node. Check if it has the "port" node first, to avoid printing the +- * error message from underlying code, as it's a valid case: extcon +- * device (and "port" node) may be missing in case of "usb-role-switch" +- * or OTG mode. +- */ +- np_phy = of_parse_phandle(dev->of_node, "phys", 0); +- if (of_graph_is_present(np_phy)) { +- struct device_node *np_conn; +- +- np_conn = of_graph_get_remote_node(np_phy, -1, -1); +- if (np_conn) +- edev = extcon_find_edev_by_node(np_conn); +- of_node_put(np_conn); +- } +- of_node_put(np_phy); +- +- return edev; +-} +- + #if IS_ENABLED(CONFIG_USB_ROLE_SWITCH) + #define ROLE_SWITCH 1 + static int dwc3_usb_role_switch_set(struct usb_role_switch *sw, +@@ -588,10 +542,6 @@ int dwc3_drd_init(struct dwc3 *dwc) + device_property_read_bool(dwc->dev, "usb-role-switch")) + return dwc3_setup_role_switch(dwc); + +- dwc->edev = dwc3_get_extcon(dwc); +- if (IS_ERR(dwc->edev)) +- return PTR_ERR(dwc->edev); +- + if (dwc->edev) { + dwc->edev_nb.notifier_call = dwc3_drd_notifier; + ret = extcon_register_notifier(dwc->edev, EXTCON_USB_HOST, diff --git a/queue-6.0/usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch b/queue-6.0/usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch new file mode 100644 index 00000000000..bc80a46b242 --- /dev/null +++ b/queue-6.0/usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch @@ -0,0 +1,55 @@ +From 4db0fbb601361767144e712beb96704b966339f5 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 18 Oct 2022 19:39:01 -0700 +Subject: usb: dwc3: gadget: Don't delay End Transfer on delayed_status + +From: Thinh Nguyen + +commit 4db0fbb601361767144e712beb96704b966339f5 upstream. + +The gadget driver may wait on the request completion when it sets the +USB_GADGET_DELAYED_STATUS. Make sure that the End Transfer command can +go through if the dwc->delayed_status is set so that the request can +complete. When the delayed_status is set, the Setup packet is already +processed, and the next phase should be either Data or Status. It's +unlikely that the host would cancel the control transfer and send a new +Setup packet during End Transfer command. But if that's the case, we can +try again when ep0state returns to EP0_SETUP_PHASE. + +Fixes: e1ee843488d5 ("usb: dwc3: gadget: Force sending delayed status during soft disconnect") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/3f9f59e5d74efcbaee444cf4b30ef639cc7b124e.1666146954.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1683,6 +1683,16 @@ static int __dwc3_stop_active_transfer(s + cmd |= DWC3_DEPCMD_PARAM(dep->resource_index); + memset(¶ms, 0, sizeof(params)); + ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms); ++ /* ++ * If the End Transfer command was timed out while the device is ++ * not in SETUP phase, it's possible that an incoming Setup packet ++ * may prevent the command's completion. Let's retry when the ++ * ep0state returns to EP0_SETUP_PHASE. ++ */ ++ if (ret == -ETIMEDOUT && dep->dwc->ep0state != EP0_SETUP_PHASE) { ++ dep->flags |= DWC3_EP_DELAY_STOP; ++ return 0; ++ } + WARN_ON_ONCE(ret); + dep->resource_index = 0; + +@@ -3702,7 +3712,7 @@ void dwc3_stop_active_transfer(struct dw + * timeout. Delay issuing the End Transfer command until the Setup TRB is + * prepared. + */ +- if (dwc->ep0state != EP0_SETUP_PHASE) { ++ if (dwc->ep0state != EP0_SETUP_PHASE && !dwc->delayed_status) { + dep->flags |= DWC3_EP_DELAY_STOP; + return; + } diff --git a/queue-6.0/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch b/queue-6.0/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch new file mode 100644 index 00000000000..71d318d50e7 --- /dev/null +++ b/queue-6.0/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch @@ -0,0 +1,39 @@ +From 308c316d16cbad99bb834767382baa693ac42169 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 25 Oct 2022 15:10:20 -0700 +Subject: usb: dwc3: gadget: Don't set IMI for no_interrupt + +From: Thinh Nguyen + +commit 308c316d16cbad99bb834767382baa693ac42169 upstream. + +The gadget driver may have a certain expectation of how the request +completion flow should be from to its configuration. Make sure the +controller driver respect that. That is, don't set IMI (Interrupt on +Missed Isoc) when usb_request->no_interrupt is set. Also, the driver +should only set IMI to the last TRB of a chain. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Reviewed-by: Jeff Vanhoof +Tested-by: Jeff Vanhoof +Link: https://lore.kernel.org/r/ced336c84434571340c07994e3667a0ee284fefe.1666735451.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1277,8 +1277,8 @@ static void dwc3_prepare_one_trb(struct + trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS; + } + +- /* always enable Interrupt on Missed ISOC */ +- trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; ++ if (!no_interrupt && !chain) ++ trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; + break; + + case USB_ENDPOINT_XFER_BULK: diff --git a/queue-6.0/usb-dwc3-gadget-force-sending-delayed-status-during-soft-disconnect.patch b/queue-6.0/usb-dwc3-gadget-force-sending-delayed-status-during-soft-disconnect.patch new file mode 100644 index 00000000000..eaf972ccbcb --- /dev/null +++ b/queue-6.0/usb-dwc3-gadget-force-sending-delayed-status-during-soft-disconnect.patch @@ -0,0 +1,48 @@ +From e1ee843488d58099a89979627ef85d5bd6c5cacd Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Wed, 17 Aug 2022 11:23:52 -0700 +Subject: usb: dwc3: gadget: Force sending delayed status during soft disconnect + +From: Wesley Cheng + +commit e1ee843488d58099a89979627ef85d5bd6c5cacd upstream. + +If any function drivers request for a delayed status phase, this leads to a +SETUP transfer timeout error, since the function may take longer to process +the DATA stage. This eventually results in end transfer timeouts, as there +is a pending SETUP transaction. + +In addition, allow the DWC3_EP_DELAY_STOP to be set for if there is a +delayed status requested. Ocasionally, a host may abort the current SETUP +transaction, by issuing a subsequent SETUP token. In those situations, it +would result in an endxfer timeout as well. + +Reviewed-by: Thinh Nguyen +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/20220817182359.13550-3-quic_wcheng@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2501,6 +2501,9 @@ static int dwc3_gadget_soft_disconnect(s + if (dwc->ep0state != EP0_SETUP_PHASE) { + int ret; + ++ if (dwc->delayed_status) ++ dwc3_ep0_send_delayed_status(dwc); ++ + reinit_completion(&dwc->ep0_in_setup); + + spin_unlock_irqrestore(&dwc->lock, flags); +@@ -3699,7 +3702,7 @@ void dwc3_stop_active_transfer(struct dw + * timeout. Delay issuing the End Transfer command until the Setup TRB is + * prepared. + */ +- if (dwc->ep0state != EP0_SETUP_PHASE && !dwc->delayed_status) { ++ if (dwc->ep0state != EP0_SETUP_PHASE) { + dep->flags |= DWC3_EP_DELAY_STOP; + return; + } diff --git a/queue-6.0/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch b/queue-6.0/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch new file mode 100644 index 00000000000..12469007db2 --- /dev/null +++ b/queue-6.0/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch @@ -0,0 +1,46 @@ +From f78961f8380b940e0cfc7e549336c21a2ad44f4d Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 25 Oct 2022 15:10:14 -0700 +Subject: usb: dwc3: gadget: Stop processing more requests on IMI + +From: Thinh Nguyen + +commit f78961f8380b940e0cfc7e549336c21a2ad44f4d upstream. + +When servicing a transfer completion event, the dwc3 driver will reclaim +TRBs of started requests up to the request associated with the interrupt +event. Currently we don't check for interrupt due to missed isoc, and +the driver may attempt to reclaim TRBs beyond the associated event. This +causes invalid memory access when the hardware still owns the TRB. If +there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure +to stop servicing further. + +Note that only the last TRB of chained TRBs has its status updated with +missed isoc. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable@vger.kernel.org +Reported-by: Jeff Vanhoof +Reported-by: Dan Vacura +Signed-off-by: Thinh Nguyen +Reviewed-by: Jeff Vanhoof +Tested-by: Jeff Vanhoof +Link: https://lore.kernel.org/r/b29acbeab531b666095dfdafd8cb5c7654fbb3e1.1666735451.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3215,6 +3215,10 @@ static int dwc3_gadget_ep_reclaim_comple + if (event->status & DEPEVT_STATUS_SHORT && !chain) + return 1; + ++ if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) && ++ DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC) ++ return 1; ++ + if ((trb->ctrl & DWC3_TRB_CTRL_IOC) || + (trb->ctrl & DWC3_TRB_CTRL_LST)) + return 1; diff --git a/queue-6.0/usb-dwc3-st-rely-on-child-s-compatible-instead-of-name.patch b/queue-6.0/usb-dwc3-st-rely-on-child-s-compatible-instead-of-name.patch new file mode 100644 index 00000000000..6910158b9fc --- /dev/null +++ b/queue-6.0/usb-dwc3-st-rely-on-child-s-compatible-instead-of-name.patch @@ -0,0 +1,34 @@ +From 3f53c329b31d53b2a2e7992819242fc0d4f883e0 Mon Sep 17 00:00:00 2001 +From: Patrice Chotard +Date: Fri, 30 Sep 2022 16:20:18 +0200 +Subject: usb: dwc3: st: Rely on child's compatible instead of name + +From: Patrice Chotard + +commit 3f53c329b31d53b2a2e7992819242fc0d4f883e0 upstream. + +To ensure that child node is found, don't rely on child's node name +which can take different value, but on child's compatible name. + +Fixes: f5c5936d6b4d ("usb: dwc3: st: Fix node's child name") +Cc: stable +Cc: Jerome Audu +Reported-by: Felipe Balbi +Signed-off-by: Patrice Chotard +Link: https://lore.kernel.org/r/20220930142018.890535-1-patrice.chotard@foss.st.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-st.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-st.c ++++ b/drivers/usb/dwc3/dwc3-st.c +@@ -251,7 +251,7 @@ static int st_dwc3_probe(struct platform + /* Manage SoftReset */ + reset_control_deassert(dwc3_data->rstc_rst); + +- child = of_get_child_by_name(node, "usb"); ++ child = of_get_compatible_child(node, "snps,dwc3"); + if (!child) { + dev_err(&pdev->dev, "failed to find dwc3 core node\n"); + ret = -ENODEV; diff --git a/queue-6.0/usb-gadget-aspeed-fix-probe-regression.patch b/queue-6.0/usb-gadget-aspeed-fix-probe-regression.patch new file mode 100644 index 00000000000..98e14ec8d82 --- /dev/null +++ b/queue-6.0/usb-gadget-aspeed-fix-probe-regression.patch @@ -0,0 +1,46 @@ +From 48ed32482c4100069d0c0eebdc6b198c6ae5f71f Mon Sep 17 00:00:00 2001 +From: Joel Stanley +Date: Mon, 17 Oct 2022 16:00:06 +1030 +Subject: usb: gadget: aspeed: Fix probe regression + +From: Joel Stanley + +commit 48ed32482c4100069d0c0eebdc6b198c6ae5f71f upstream. + +Since commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets"), +the gadget devices are proper driver core devices, which caused each +device to request pinmux settings: + + aspeed_vhub 1e6a0000.usb-vhub: Initialized virtual hub in USB2 mode + aspeed-g5-pinctrl 1e6e2080.pinctrl: pin A7 already requested by 1e6a0000.usb-vhub; cannot claim for gadget.0 + aspeed-g5-pinctrl 1e6e2080.pinctrl: pin-232 (gadget.0) status -22 + aspeed-g5-pinctrl 1e6e2080.pinctrl: could not request pin 232 (A7) from group USB2AD on device aspeed-g5-pinctrl + g_mass_storage gadget.0: Error applying setting, reverse things back + +The vhub driver has already claimed the pins, so prevent the gadgets +from requesting them too by setting the magic of_node_reused flag. This +causes the driver core to skip the mux request. + +Reported-by: Zev Weiss +Reported-by: Jae Hyun Yoo +Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") +Cc: stable@vger.kernel.org +Signed-off-by: Joel Stanley +Tested-by: Zev Weiss +Tested-by: Jae Hyun Yoo +Link: https://lore.kernel.org/r/20221017053006.358520-1-joel@jms.id.au +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/aspeed-vhub/dev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/aspeed-vhub/dev.c ++++ b/drivers/usb/gadget/udc/aspeed-vhub/dev.c +@@ -591,6 +591,7 @@ int ast_vhub_init_dev(struct ast_vhub *v + d->gadget.max_speed = USB_SPEED_HIGH; + d->gadget.speed = USB_SPEED_UNKNOWN; + d->gadget.dev.of_node = vhub->pdev->dev.of_node; ++ d->gadget.dev.of_node_reused = true; + + rc = usb_add_gadget_udc(d->port_dev, &d->gadget); + if (rc != 0) diff --git a/queue-6.0/usb-gadget-uvc-fix-dropped-frame-after-missed-isoc.patch b/queue-6.0/usb-gadget-uvc-fix-dropped-frame-after-missed-isoc.patch new file mode 100644 index 00000000000..5a53d187aef --- /dev/null +++ b/queue-6.0/usb-gadget-uvc-fix-dropped-frame-after-missed-isoc.patch @@ -0,0 +1,36 @@ +From 8e8e923a49967b798e7d69f1ce9eff1dd2533547 Mon Sep 17 00:00:00 2001 +From: Dan Vacura +Date: Tue, 18 Oct 2022 16:50:37 -0500 +Subject: usb: gadget: uvc: fix dropped frame after missed isoc + +From: Dan Vacura + +commit 8e8e923a49967b798e7d69f1ce9eff1dd2533547 upstream. + +With the re-use of the previous completion status in 0d1c407b1a749 +("usb: dwc3: gadget: Return proper request status") it could be possible +that the next frame would also get dropped if the current frame has a +missed isoc error. Ensure that an interrupt is requested for the start +of a new frame. + +Fixes: fc78941d8169 ("usb: gadget: uvc: decrease the interrupt load to a quarter") +Cc: +Signed-off-by: Dan Vacura +Link: https://lore.kernel.org/r/20221018215044.765044-2-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_video.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -431,7 +431,8 @@ static void uvcg_video_pump(struct work_ + + /* Endpoint now owns the request */ + req = NULL; +- video->req_int_count++; ++ if (buf->state != UVC_BUF_STATE_DONE) ++ video->req_int_count++; + } + + if (!req) diff --git a/queue-6.0/usb-gadget-uvc-fix-sg-handling-during-video-encode.patch b/queue-6.0/usb-gadget-uvc-fix-sg-handling-during-video-encode.patch new file mode 100644 index 00000000000..a06e84b58eb --- /dev/null +++ b/queue-6.0/usb-gadget-uvc-fix-sg-handling-during-video-encode.patch @@ -0,0 +1,40 @@ +From b57b08e6f431348363adffa5b6643fe3ec9dc7fe Mon Sep 17 00:00:00 2001 +From: Jeff Vanhoof +Date: Tue, 18 Oct 2022 16:50:40 -0500 +Subject: usb: gadget: uvc: fix sg handling during video encode + +From: Jeff Vanhoof + +commit b57b08e6f431348363adffa5b6643fe3ec9dc7fe upstream. + +In uvc_video_encode_isoc_sg, the uvc_request's sg list is +incorrectly being populated leading to corrupt video being +received by the remote end. When building the sg list the +usage of buf->sg's 'dma_length' field is not correct and +instead its 'length' field should be used. + +Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support") +Cc: +Signed-off-by: Jeff Vanhoof +Signed-off-by: Dan Vacura +Link: https://lore.kernel.org/r/20221018215044.765044-5-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_video.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -157,10 +157,10 @@ uvc_video_encode_isoc_sg(struct usb_requ + sg = sg_next(sg); + + for_each_sg(sg, iter, ureq->sgt.nents - 1, i) { +- if (!len || !buf->sg || !sg_dma_len(buf->sg)) ++ if (!len || !buf->sg || !buf->sg->length) + break; + +- sg_left = sg_dma_len(buf->sg) - buf->offset; ++ sg_left = buf->sg->length - buf->offset; + part = min_t(unsigned int, len, sg_left); + + sg_set_page(iter, sg_page(buf->sg), part, buf->offset); diff --git a/queue-6.0/usb-gadget-uvc-fix-sg-handling-in-error-case.patch b/queue-6.0/usb-gadget-uvc-fix-sg-handling-in-error-case.patch new file mode 100644 index 00000000000..703868d5cca --- /dev/null +++ b/queue-6.0/usb-gadget-uvc-fix-sg-handling-in-error-case.patch @@ -0,0 +1,123 @@ +From 0a0a2760b04814428800d48281a447a7522470ad Mon Sep 17 00:00:00 2001 +From: Dan Vacura +Date: Tue, 18 Oct 2022 16:50:39 -0500 +Subject: usb: gadget: uvc: fix sg handling in error case + +From: Dan Vacura + +commit 0a0a2760b04814428800d48281a447a7522470ad upstream. + +If there is a transmission error the buffer will be returned too early, +causing a memory fault as subsequent requests for that buffer are still +queued up to be sent. Refactor the error handling to wait for the final +request to come in before reporting back the buffer to userspace for all +transfer types (bulk/isoc/isoc_sg). This ensures userspace knows if the +frame was successfully sent. + +Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support") +Cc: +Signed-off-by: Dan Vacura +Link: https://lore.kernel.org/r/20221018215044.765044-4-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_queue.c | 8 +++++--- + drivers/usb/gadget/function/uvc_video.c | 18 ++++++++++++++---- + 2 files changed, 19 insertions(+), 7 deletions(-) + +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -304,6 +304,7 @@ int uvcg_queue_enable(struct uvc_video_q + + queue->sequence = 0; + queue->buf_used = 0; ++ queue->flags &= ~UVC_QUEUE_DROP_INCOMPLETE; + } else { + ret = vb2_streamoff(&queue->queue, queue->queue.type); + if (ret < 0) +@@ -329,10 +330,11 @@ int uvcg_queue_enable(struct uvc_video_q + void uvcg_complete_buffer(struct uvc_video_queue *queue, + struct uvc_buffer *buf) + { +- if ((queue->flags & UVC_QUEUE_DROP_INCOMPLETE) && +- buf->length != buf->bytesused) { +- buf->state = UVC_BUF_STATE_QUEUED; ++ if (queue->flags & UVC_QUEUE_DROP_INCOMPLETE) { ++ queue->flags &= ~UVC_QUEUE_DROP_INCOMPLETE; ++ buf->state = UVC_BUF_STATE_ERROR; + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, 0); ++ vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); + return; + } + +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -88,6 +88,7 @@ uvc_video_encode_bulk(struct usb_request + struct uvc_buffer *buf) + { + void *mem = req->buf; ++ struct uvc_request *ureq = req->context; + int len = video->req_size; + int ret; + +@@ -113,13 +114,14 @@ uvc_video_encode_bulk(struct usb_request + video->queue.buf_used = 0; + buf->state = UVC_BUF_STATE_DONE; + list_del(&buf->queue); +- uvcg_complete_buffer(&video->queue, buf); + video->fid ^= UVC_STREAM_FID; ++ ureq->last_buf = buf; + + video->payload_size = 0; + } + + if (video->payload_size == video->max_payload_size || ++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE || + buf->bytesused == video->queue.buf_used) + video->payload_size = 0; + } +@@ -180,7 +182,8 @@ uvc_video_encode_isoc_sg(struct usb_requ + req->length -= len; + video->queue.buf_used += req->length - header_len; + +- if (buf->bytesused == video->queue.buf_used || !buf->sg) { ++ if (buf->bytesused == video->queue.buf_used || !buf->sg || ++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE) { + video->queue.buf_used = 0; + buf->state = UVC_BUF_STATE_DONE; + buf->offset = 0; +@@ -195,6 +198,7 @@ uvc_video_encode_isoc(struct usb_request + struct uvc_buffer *buf) + { + void *mem = req->buf; ++ struct uvc_request *ureq = req->context; + int len = video->req_size; + int ret; + +@@ -209,12 +213,13 @@ uvc_video_encode_isoc(struct usb_request + + req->length = video->req_size - len; + +- if (buf->bytesused == video->queue.buf_used) { ++ if (buf->bytesused == video->queue.buf_used || ++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE) { + video->queue.buf_used = 0; + buf->state = UVC_BUF_STATE_DONE; + list_del(&buf->queue); +- uvcg_complete_buffer(&video->queue, buf); + video->fid ^= UVC_STREAM_FID; ++ ureq->last_buf = buf; + } + } + +@@ -255,6 +260,11 @@ uvc_video_complete(struct usb_ep *ep, st + case 0: + break; + ++ case -EXDEV: ++ uvcg_dbg(&video->uvc->func, "VS request missed xfer.\n"); ++ queue->flags |= UVC_QUEUE_DROP_INCOMPLETE; ++ break; ++ + case -ESHUTDOWN: /* disconnect from host. */ + uvcg_dbg(&video->uvc->func, "VS request cancelled.\n"); + uvcg_queue_cancel(queue, 1); diff --git a/queue-6.0/usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch b/queue-6.0/usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch new file mode 100644 index 00000000000..db3898ab728 --- /dev/null +++ b/queue-6.0/usb-gadget-uvc-limit-isoc_sg-to-super-speed-gadgets.patch @@ -0,0 +1,68 @@ +From 19905240aef0181d1e6944070eb85fce75f75bcd Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Tue, 18 Oct 2022 00:11:41 +0200 +Subject: usb: gadget: uvc: limit isoc_sg to super speed gadgets + +From: Michael Grzeschik + +commit 19905240aef0181d1e6944070eb85fce75f75bcd upstream. + +The overhead of preparing sg data is high for transfers with limited +payload. When transferring isoc over high-speed usb the maximum payload +is rather small which is a good argument no to use sg. This patch is +changing the uvc_video_encode_isoc_sg encode function only to be used +for super speed gadgets. + +Signed-off-by: Michael Grzeschik +Cc: stable +Link: https://lore.kernel.org/r/20221017221141.3134818-1-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_queue.c | 9 +++------ + drivers/usb/gadget/function/uvc_video.c | 9 +++++++-- + 2 files changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -84,12 +84,9 @@ static int uvc_buffer_prepare(struct vb2 + return -ENODEV; + + buf->state = UVC_BUF_STATE_QUEUED; +- if (queue->use_sg) { +- buf->sgt = vb2_dma_sg_plane_desc(vb, 0); +- buf->sg = buf->sgt->sgl; +- } else { +- buf->mem = vb2_plane_vaddr(vb, 0); +- } ++ buf->sgt = vb2_dma_sg_plane_desc(vb, 0); ++ buf->sg = buf->sgt->sgl; ++ buf->mem = vb2_plane_vaddr(vb, 0); + buf->length = vb2_plane_size(vb, 0); + if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) + buf->bytesused = 0; +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -448,6 +448,9 @@ static void uvcg_video_pump(struct work_ + */ + int uvcg_video_enable(struct uvc_video *video, int enable) + { ++ struct uvc_device *uvc = video->uvc; ++ struct usb_composite_dev *cdev = uvc->func.config->cdev; ++ struct usb_gadget *gadget = cdev->gadget; + unsigned int i; + int ret; + +@@ -479,9 +482,11 @@ int uvcg_video_enable(struct uvc_video * + if (video->max_payload_size) { + video->encode = uvc_video_encode_bulk; + video->payload_size = 0; +- } else +- video->encode = video->queue.use_sg ? ++ } else { ++ video->encode = (video->queue.use_sg && ++ !(gadget->speed <= USB_SPEED_HIGH)) ? + uvc_video_encode_isoc_sg : uvc_video_encode_isoc; ++ } + + video->req_int_count = 0; + diff --git a/queue-6.0/usb-typec-ucsi-acpi-implement-resume-callback.patch b/queue-6.0/usb-typec-ucsi-acpi-implement-resume-callback.patch new file mode 100644 index 00000000000..cd71fbe3d14 --- /dev/null +++ b/queue-6.0/usb-typec-ucsi-acpi-implement-resume-callback.patch @@ -0,0 +1,50 @@ +From 4e3a50293c2b21961f02e1afa2f17d3a1a90c7c8 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Fri, 7 Oct 2022 13:09:51 +0300 +Subject: usb: typec: ucsi: acpi: Implement resume callback + +From: Heikki Krogerus + +commit 4e3a50293c2b21961f02e1afa2f17d3a1a90c7c8 upstream. + +The ACPI driver needs to resume the interface by calling +ucsi_resume(). Otherwise we may fail to detect connections +and disconnections that happen while the system is +suspended. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=210425 +Fixes: a94ecde41f7e ("usb: typec: ucsi: ccg: enable runtime pm support") +Cc: +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20221007100951.43798-3-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/usb/typec/ucsi/ucsi_acpi.c ++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c +@@ -185,6 +185,15 @@ static int ucsi_acpi_remove(struct platf + return 0; + } + ++static int ucsi_acpi_resume(struct device *dev) ++{ ++ struct ucsi_acpi *ua = dev_get_drvdata(dev); ++ ++ return ucsi_resume(ua->ucsi); ++} ++ ++static DEFINE_SIMPLE_DEV_PM_OPS(ucsi_acpi_pm_ops, NULL, ucsi_acpi_resume); ++ + static const struct acpi_device_id ucsi_acpi_match[] = { + { "PNP0CA0", 0 }, + { }, +@@ -194,6 +203,7 @@ MODULE_DEVICE_TABLE(acpi, ucsi_acpi_matc + static struct platform_driver ucsi_acpi_platform_driver = { + .driver = { + .name = "ucsi_acpi", ++ .pm = pm_ptr(&ucsi_acpi_pm_ops), + .acpi_match_table = ACPI_PTR(ucsi_acpi_match), + }, + .probe = ucsi_acpi_probe, diff --git a/queue-6.0/usb-typec-ucsi-check-the-connection-on-resume.patch b/queue-6.0/usb-typec-ucsi-check-the-connection-on-resume.patch new file mode 100644 index 00000000000..c1c5fc9abb2 --- /dev/null +++ b/queue-6.0/usb-typec-ucsi-check-the-connection-on-resume.patch @@ -0,0 +1,101 @@ +From 99f6d43611135bd6f211dec9e88bb41e4167e304 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Fri, 7 Oct 2022 13:09:50 +0300 +Subject: usb: typec: ucsi: Check the connection on resume + +From: Heikki Krogerus + +commit 99f6d43611135bd6f211dec9e88bb41e4167e304 upstream. + +Checking the connection status of every port on resume. This +fixes an issue where the partner device is not unregistered +properly after resume if it was unplugged while the system +was suspended. + +The function ucsi_check_connection() is also modified so +that it can be used also for registering the connection on +top of unregistering it. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=210425 +Fixes: a94ecde41f7e ("usb: typec: ucsi: ccg: enable runtime pm support") +Cc: +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20221007100951.43798-2-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 42 +++++++++++++++++++++++++++++------------- + 1 file changed, 29 insertions(+), 13 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -183,16 +183,6 @@ out: + } + EXPORT_SYMBOL_GPL(ucsi_send_command); + +-int ucsi_resume(struct ucsi *ucsi) +-{ +- u64 command; +- +- /* Restore UCSI notification enable mask after system resume */ +- command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy; +- +- return ucsi_send_command(ucsi, command, NULL, 0); +-} +-EXPORT_SYMBOL_GPL(ucsi_resume); + /* -------------------------------------------------------------------------- */ + + struct ucsi_work { +@@ -744,6 +734,7 @@ static void ucsi_partner_change(struct u + + static int ucsi_check_connection(struct ucsi_connector *con) + { ++ u8 prev_flags = con->status.flags; + u64 command; + int ret; + +@@ -754,10 +745,13 @@ static int ucsi_check_connection(struct + return ret; + } + ++ if (con->status.flags == prev_flags) ++ return 0; ++ + if (con->status.flags & UCSI_CONSTAT_CONNECTED) { +- if (UCSI_CONSTAT_PWR_OPMODE(con->status.flags) == +- UCSI_CONSTAT_PWR_OPMODE_PD) +- ucsi_partner_task(con, ucsi_check_altmodes, 30, 0); ++ ucsi_register_partner(con); ++ ucsi_pwr_opmode_change(con); ++ ucsi_partner_change(con); + } else { + ucsi_partner_change(con); + ucsi_port_psy_changed(con); +@@ -1276,6 +1270,28 @@ err: + return ret; + } + ++int ucsi_resume(struct ucsi *ucsi) ++{ ++ struct ucsi_connector *con; ++ u64 command; ++ int ret; ++ ++ /* Restore UCSI notification enable mask after system resume */ ++ command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy; ++ ret = ucsi_send_command(ucsi, command, NULL, 0); ++ if (ret < 0) ++ return ret; ++ ++ for (con = ucsi->connector; con->port; con++) { ++ mutex_lock(&con->lock); ++ ucsi_check_connection(con); ++ mutex_unlock(&con->lock); ++ } ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(ucsi_resume); ++ + static void ucsi_init_work(struct work_struct *work) + { + struct ucsi *ucsi = container_of(work, struct ucsi, work.work); diff --git a/queue-6.0/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch b/queue-6.0/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch new file mode 100644 index 00000000000..286f9dab308 --- /dev/null +++ b/queue-6.0/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch @@ -0,0 +1,45 @@ +From 4f547472380136718b56064ea5689a61e135f904 Mon Sep 17 00:00:00 2001 +From: Jens Glathe +Date: Mon, 24 Oct 2022 17:27:17 +0300 +Subject: usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller + +From: Jens Glathe + +commit 4f547472380136718b56064ea5689a61e135f904 upstream. + +This appears to fix the error: +"xhci_hcd
; ERROR Transfer event TRB DMA ptr not part of +current TD ep_index 2 comp_code 13" that appear spuriously (or pretty +often) when using a r8152 USB3 ethernet adapter with integrated hub. + +ASM1042 reports as a 0.96 controller, but appears to behave more like 1.0 + +Inspired by this email thread: https://markmail.org/thread/7vzqbe7t6du6qsw3 + +Cc: stable@vger.kernel.org +Signed-off-by: Jens Glathe +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221024142720.4122053-2-mathias.nyman@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -306,8 +306,14 @@ static void xhci_pci_quirks(struct devic + } + + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) ++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) { ++ /* ++ * try to tame the ASMedia 1042 controller which reports 0.96 ++ * but appears to behave more like 1.0 ++ */ ++ xhci->quirks |= XHCI_SPURIOUS_SUCCESS; + xhci->quirks |= XHCI_BROKEN_STREAMS; ++ } + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && + pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) { + xhci->quirks |= XHCI_TRUST_TX_LENGTH;