--- /dev/null
+From ecc1ff532b499d20304a4f682247137025814c34 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Thu, 15 Oct 2020 20:20:41 +0200
+Subject: ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit ecc1ff532b499d20304a4f682247137025814c34 upstream.
+
+On Odroid XU board the USB3-0 port is a microUSB and USB3-1 port is USB
+type A (host). The roles were copied from Odroid XU3 (Exynos5422)
+design which has it reversed.
+
+Fixes: 8149afe4dbf9 ("ARM: dts: exynos: Add initial support for Odroid XU board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201015182044.480562-1-krzk@kernel.org
+Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5410-odroidxu.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+@@ -637,11 +637,11 @@
+ };
+
+ &usbdrd_dwc3_0 {
+- dr_mode = "host";
++ dr_mode = "peripheral";
+ };
+
+ &usbdrd_dwc3_1 {
+- dr_mode = "peripheral";
++ dr_mode = "host";
+ };
+
+ &usbdrd3_0 {
--- /dev/null
+From bd7e7ff56feea7810df900fb09c9741d259861d9 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Thu, 15 Oct 2020 20:20:43 +0200
+Subject: ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit bd7e7ff56feea7810df900fb09c9741d259861d9 upstream.
+
+On Odroid XU LDO12 and LDO15 supplies the power to USB 3.0 blocks but
+the GPK GPIO pins are supplied by LDO7 (VDDQ_LCD). LDO7 also supplies
+GPJ GPIO pins.
+
+The Exynos pinctrl driver does not take any supplies, so to have entire
+GPIO block always available, make the regulator always on.
+
+Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201015182044.480562-3-krzk@kernel.org
+Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5410-odroidxu.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+@@ -327,6 +327,8 @@
+ regulator-name = "vddq_lcd";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ /* Supplies also GPK and GPJ */
++ regulator-always-on;
+ };
+
+ ldo8_reg: LDO8 {
--- /dev/null
+From 3d992fd8f4e0f09c980726308d2f2725587b32d6 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Thu, 15 Oct 2020 20:20:42 +0200
+Subject: ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 3d992fd8f4e0f09c980726308d2f2725587b32d6 upstream.
+
+The VBUS control (PWREN) and over-current pins of USB 3.0 DWC3
+controllers are on Exynos5410 regular GPIOs. This is different than for
+example on Exynos5422 where these are special ETC pins with proper reset
+values (pulls, functions).
+
+Therefore these pins should be configured to enable proper USB 3.0
+peripheral and host modes. This also fixes over-current warning:
+
+ [ 6.024658] usb usb4-port1: over-current condition
+ [ 6.028271] usb usb3-port1: over-current condition
+
+Fixes: cb0896562228 ("ARM: dts: exynos: Add USB to Exynos5410")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201015182044.480562-2-krzk@kernel.org
+Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 ++++++++++++++++++++++++++++
+ arch/arm/boot/dts/exynos5410.dtsi | 4 ++++
+ 2 files changed, 32 insertions(+)
+
+--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
++++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
+@@ -560,6 +560,34 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
++
++ usb3_1_oc: usb3-1-oc {
++ samsung,pins = "gpk2-4", "gpk2-5";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_1_vbusctrl: usb3-1-vbusctrl {
++ samsung,pins = "gpk2-6", "gpk2-7";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_0_oc: usb3-0-oc {
++ samsung,pins = "gpk3-0", "gpk3-1";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_0_vbusctrl: usb3-0-vbusctrl {
++ samsung,pins = "gpk3-2", "gpk3-3";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
+ };
+
+ &pinctrl_2 {
+--- a/arch/arm/boot/dts/exynos5410.dtsi
++++ b/arch/arm/boot/dts/exynos5410.dtsi
+@@ -390,6 +390,8 @@
+ &usbdrd3_0 {
+ clocks = <&clock CLK_USBD300>;
+ clock-names = "usbdrd30";
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>;
+ };
+
+ &usbdrd_phy0 {
+@@ -401,6 +403,8 @@
+ &usbdrd3_1 {
+ clocks = <&clock CLK_USBD301>;
+ clock-names = "usbdrd30";
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>;
+ };
+
+ &usbdrd_dwc3_1 {
--- /dev/null
+From 22b2beaa7f166f550424cbb3b988aeaa7ef0425a Mon Sep 17 00:00:00 2001
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Date: Fri, 27 Nov 2020 10:52:51 -0700
+Subject: coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf()
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+commit 22b2beaa7f166f550424cbb3b988aeaa7ef0425a upstream.
+
+There was a report of NULL pointer dereference in ETF enable
+path for perf CS mode with PID monitoring. It is almost 100%
+reproducible when the process to monitor is something very
+active such as chrome and with ETF as the sink, not ETR.
+
+But code path shows that ETB has a similar path as ETF, so
+there could be possible NULL pointer dereference crash in
+ETB as well. Currently in a bid to find the pid, the owner
+is dereferenced via task_pid_nr() call in etb_enable_perf()
+and with owner being NULL, we can get a NULL pointer
+dereference, so have a similar fix as ETF where we cache PID
+in alloc_buffer() callback which is called as the part of
+etm_setup_aux().
+
+Fixes: 75d7dbd38824 ("coresight: etb10: Add support for CPU-wide trace scenarios")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-11-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-etb10.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -176,6 +176,7 @@ static int etb_enable_perf(struct coresi
+ unsigned long flags;
+ struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+ struct perf_output_handle *handle = data;
++ struct cs_buffers *buf = etm_perf_sink_config(handle);
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+
+@@ -186,7 +187,7 @@ static int etb_enable_perf(struct coresi
+ }
+
+ /* Get a handle on the pid of the process to monitor */
+- pid = task_pid_nr(handle->event->owner);
++ pid = buf->pid;
+
+ if (drvdata->pid != -1 && drvdata->pid != pid) {
+ ret = -EBUSY;
+@@ -383,6 +384,7 @@ static void *etb_alloc_buffer(struct cor
+ if (!buf)
+ return NULL;
+
++ buf->pid = task_pid_nr(event->owner);
+ buf->snapshot = overwrite;
+ buf->nr_pages = nr_pages;
+ buf->data_pages = pages;
--- /dev/null
+From f2603b22e3d2dcffd8b0736e5c68df497af6bc84 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Fri, 27 Nov 2020 10:52:45 -0700
+Subject: coresight: etm4x: Fix accesses to TRCCIDCTLR1
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit f2603b22e3d2dcffd8b0736e5c68df497af6bc84 upstream.
+
+The TRCCIDCTLR1 is only implemented if TRCIDR4.NUMCIDC > 4.
+Don't touch the register if it is not implemented.
+
+Cc: stable@vger.kernel.org
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-5-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -187,7 +187,8 @@ static int etm4_enable_hw(struct etmv4_d
+ writeq_relaxed(config->ctxid_pid[i],
+ drvdata->base + TRCCIDCVRn(i));
+ writel_relaxed(config->ctxid_mask0, drvdata->base + TRCCIDCCTLR0);
+- writel_relaxed(config->ctxid_mask1, drvdata->base + TRCCIDCCTLR1);
++ if (drvdata->numcidc > 4)
++ writel_relaxed(config->ctxid_mask1, drvdata->base + TRCCIDCCTLR1);
+
+ for (i = 0; i < drvdata->numvmidc; i++)
+ writeq_relaxed(config->vmid_val[i],
+@@ -1241,7 +1242,8 @@ static int etm4_cpu_save(struct etmv4_dr
+ state->trcvmidcvr[i] = readq(drvdata->base + TRCVMIDCVRn(i));
+
+ state->trccidcctlr0 = readl(drvdata->base + TRCCIDCCTLR0);
+- state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1);
++ if (drvdata->numcidc > 4)
++ state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1);
+
+ state->trcvmidcctlr0 = readl(drvdata->base + TRCVMIDCCTLR0);
+ if (drvdata->numvmidc > 4)
+@@ -1352,7 +1354,8 @@ static void etm4_cpu_restore(struct etmv
+ drvdata->base + TRCVMIDCVRn(i));
+
+ writel_relaxed(state->trccidcctlr0, drvdata->base + TRCCIDCCTLR0);
+- writel_relaxed(state->trccidcctlr1, drvdata->base + TRCCIDCCTLR1);
++ if (drvdata->numcidc > 4)
++ writel_relaxed(state->trccidcctlr1, drvdata->base + TRCCIDCCTLR1);
+
+ writel_relaxed(state->trcvmidcctlr0, drvdata->base + TRCVMIDCCTLR0);
+ if (drvdata->numvmidc > 4)
--- /dev/null
+From 6288b4ceca868eac4bf729532f8d845e3ecbed98 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Fri, 27 Nov 2020 10:52:47 -0700
+Subject: coresight: etm4x: Fix accesses to TRCPROCSELR
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit 6288b4ceca868eac4bf729532f8d845e3ecbed98 upstream.
+
+TRCPROCSELR is not implemented if the TRCIDR3.NUMPROC == 0. Skip
+accessing the register in such cases.
+
+Cc: stable@vger.kernel.org
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-7-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -124,8 +124,8 @@ static int etm4_enable_hw(struct etmv4_d
+ if (coresight_timeout(drvdata->base, TRCSTATR, TRCSTATR_IDLE_BIT, 1))
+ dev_err(etm_dev,
+ "timeout while waiting for Idle Trace Status\n");
+-
+- writel_relaxed(config->pe_sel, drvdata->base + TRCPROCSELR);
++ if (drvdata->nr_pe)
++ writel_relaxed(config->pe_sel, drvdata->base + TRCPROCSELR);
+ writel_relaxed(config->cfg, drvdata->base + TRCCONFIGR);
+ /* nothing specific implemented */
+ writel_relaxed(0x0, drvdata->base + TRCAUXCTLR);
+@@ -1180,7 +1180,8 @@ static int etm4_cpu_save(struct etmv4_dr
+ state = drvdata->save_state;
+
+ state->trcprgctlr = readl(drvdata->base + TRCPRGCTLR);
+- state->trcprocselr = readl(drvdata->base + TRCPROCSELR);
++ if (drvdata->nr_pe)
++ state->trcprocselr = readl(drvdata->base + TRCPROCSELR);
+ state->trcconfigr = readl(drvdata->base + TRCCONFIGR);
+ state->trcauxctlr = readl(drvdata->base + TRCAUXCTLR);
+ state->trceventctl0r = readl(drvdata->base + TRCEVENTCTL0R);
+@@ -1287,7 +1288,8 @@ static void etm4_cpu_restore(struct etmv
+ writel_relaxed(state->trcclaimset, drvdata->base + TRCCLAIMSET);
+
+ writel_relaxed(state->trcprgctlr, drvdata->base + TRCPRGCTLR);
+- writel_relaxed(state->trcprocselr, drvdata->base + TRCPROCSELR);
++ if (drvdata->nr_pe)
++ writel_relaxed(state->trcprocselr, drvdata->base + TRCPROCSELR);
+ writel_relaxed(state->trcconfigr, drvdata->base + TRCCONFIGR);
+ writel_relaxed(state->trcauxctlr, drvdata->base + TRCAUXCTLR);
+ writel_relaxed(state->trceventctl0r, drvdata->base + TRCEVENTCTL0R);
--- /dev/null
+From 93dd64404cbe63b0afba371acd8db36e84b286c7 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Fri, 27 Nov 2020 10:52:44 -0700
+Subject: coresight: etm4x: Fix accesses to TRCVMIDCTLR1
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit 93dd64404cbe63b0afba371acd8db36e84b286c7 upstream.
+
+TRCVMIDCTRL1 is only implemented only if the TRCIDR4.NUMVMIDC > 4.
+We must not touch the register otherwise.
+
+Cc: stable@vger.kernel.org
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-4-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -193,7 +193,8 @@ static int etm4_enable_hw(struct etmv4_d
+ writeq_relaxed(config->vmid_val[i],
+ drvdata->base + TRCVMIDCVRn(i));
+ writel_relaxed(config->vmid_mask0, drvdata->base + TRCVMIDCCTLR0);
+- writel_relaxed(config->vmid_mask1, drvdata->base + TRCVMIDCCTLR1);
++ if (drvdata->numvmidc > 4)
++ writel_relaxed(config->vmid_mask1, drvdata->base + TRCVMIDCCTLR1);
+
+ if (!drvdata->skip_power_up) {
+ /*
+@@ -1243,7 +1244,8 @@ static int etm4_cpu_save(struct etmv4_dr
+ state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1);
+
+ state->trcvmidcctlr0 = readl(drvdata->base + TRCVMIDCCTLR0);
+- state->trcvmidcctlr1 = readl(drvdata->base + TRCVMIDCCTLR1);
++ if (drvdata->numvmidc > 4)
++ state->trcvmidcctlr1 = readl(drvdata->base + TRCVMIDCCTLR1);
+
+ state->trcclaimset = readl(drvdata->base + TRCCLAIMCLR);
+
+@@ -1353,7 +1355,8 @@ static void etm4_cpu_restore(struct etmv
+ writel_relaxed(state->trccidcctlr1, drvdata->base + TRCCIDCCTLR1);
+
+ writel_relaxed(state->trcvmidcctlr0, drvdata->base + TRCVMIDCCTLR0);
+- writel_relaxed(state->trcvmidcctlr1, drvdata->base + TRCVMIDCCTLR1);
++ if (drvdata->numvmidc > 4)
++ writel_relaxed(state->trcvmidcctlr1, drvdata->base + TRCVMIDCCTLR1);
+
+ writel_relaxed(state->trcclaimset, drvdata->base + TRCCLAIMSET);
+
--- /dev/null
+From 60c519c5d3629c21ba356782434d5b612d312de4 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Fri, 27 Nov 2020 10:52:48 -0700
+Subject: coresight: etm4x: Handle TRCVIPCSSCTLR accesses
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit 60c519c5d3629c21ba356782434d5b612d312de4 upstream.
+
+TRCVIPCSSCTLR is not present if the TRCIDR4.NUMPC > 0. Thus we
+should only access the register if it is present, preventing
+any undesired behavior.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-8-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -141,8 +141,9 @@ static int etm4_enable_hw(struct etmv4_d
+ writel_relaxed(config->viiectlr, drvdata->base + TRCVIIECTLR);
+ writel_relaxed(config->vissctlr,
+ drvdata->base + TRCVISSCTLR);
+- writel_relaxed(config->vipcssctlr,
+- drvdata->base + TRCVIPCSSCTLR);
++ if (drvdata->nr_pe_cmp)
++ writel_relaxed(config->vipcssctlr,
++ drvdata->base + TRCVIPCSSCTLR);
+ for (i = 0; i < drvdata->nrseqstate - 1; i++)
+ writel_relaxed(config->seq_ctrl[i],
+ drvdata->base + TRCSEQEVRn(i));
+@@ -1197,7 +1198,8 @@ static int etm4_cpu_save(struct etmv4_dr
+ state->trcvictlr = readl(drvdata->base + TRCVICTLR);
+ state->trcviiectlr = readl(drvdata->base + TRCVIIECTLR);
+ state->trcvissctlr = readl(drvdata->base + TRCVISSCTLR);
+- state->trcvipcssctlr = readl(drvdata->base + TRCVIPCSSCTLR);
++ if (drvdata->nr_pe_cmp)
++ state->trcvipcssctlr = readl(drvdata->base + TRCVIPCSSCTLR);
+ state->trcvdctlr = readl(drvdata->base + TRCVDCTLR);
+ state->trcvdsacctlr = readl(drvdata->base + TRCVDSACCTLR);
+ state->trcvdarcctlr = readl(drvdata->base + TRCVDARCCTLR);
+@@ -1305,7 +1307,8 @@ static void etm4_cpu_restore(struct etmv
+ writel_relaxed(state->trcvictlr, drvdata->base + TRCVICTLR);
+ writel_relaxed(state->trcviiectlr, drvdata->base + TRCVIIECTLR);
+ writel_relaxed(state->trcvissctlr, drvdata->base + TRCVISSCTLR);
+- writel_relaxed(state->trcvipcssctlr, drvdata->base + TRCVIPCSSCTLR);
++ if (drvdata->nr_pe_cmp)
++ writel_relaxed(state->trcvipcssctlr, drvdata->base + TRCVIPCSSCTLR);
+ writel_relaxed(state->trcvdctlr, drvdata->base + TRCVDCTLR);
+ writel_relaxed(state->trcvdsacctlr, drvdata->base + TRCVDSACCTLR);
+ writel_relaxed(state->trcvdarcctlr, drvdata->base + TRCVDARCCTLR);
--- /dev/null
+From ac0f82b1b4956e348a6b2de8104308144ffb6ef7 Mon Sep 17 00:00:00 2001
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Date: Fri, 27 Nov 2020 10:52:42 -0700
+Subject: coresight: etm4x: Skip setting LPOVERRIDE bit for qcom, skip-power-up
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+commit ac0f82b1b4956e348a6b2de8104308144ffb6ef7 upstream.
+
+There is a bug on the systems supporting to skip power up
+(qcom,skip-power-up) where setting LPOVERRIDE bit(low-power
+state override behaviour) will result in CPU hangs/lockups
+even on the implementations which supports it. So skip
+setting the LPOVERRIDE bit for such platforms.
+
+Fixes: 02510a5aa78d ("coresight: etm4x: Add support to skip trace unit power up")
+Cc: stable@vger.kernel.org
+Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-2-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -779,7 +779,7 @@ static void etm4_init_arch_data(void *in
+ * LPOVERRIDE, bit[23] implementation supports
+ * low-power state override
+ */
+- if (BMVAL(etmidr5, 23, 23))
++ if (BMVAL(etmidr5, 23, 23) && (!drvdata->skip_power_up))
+ drvdata->lpoverride = true;
+ else
+ drvdata->lpoverride = false;
--- /dev/null
+From 868663dd5d69fef05bfb004f91da5c30e9b93461 Mon Sep 17 00:00:00 2001
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Date: Fri, 27 Nov 2020 10:52:50 -0700
+Subject: coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+commit 868663dd5d69fef05bfb004f91da5c30e9b93461 upstream.
+
+There was a report of NULL pointer dereference in ETF enable
+path for perf CS mode with PID monitoring. It is almost 100%
+reproducible when the process to monitor is something very
+active such as chrome and with ETF as the sink and not ETR.
+Currently in a bid to find the pid, the owner is dereferenced
+via task_pid_nr() call in tmc_enable_etf_sink_perf() and with
+owner being NULL, we get a NULL pointer dereference.
+
+Looking at the ETR and other places in the kernel, ETF and the
+ETB are the only places trying to dereference the task(owner)
+in tmc_enable_etf_sink_perf() which is also called from the
+sched_in path as in the call trace. Owner(task) is NULL even
+in the case of ETR in tmc_enable_etr_sink_perf(), but since we
+cache the PID in alloc_buffer() callback and it is done as part
+of etm_setup_aux() when allocating buffer for ETR sink, we never
+dereference this NULL pointer and we are safe. So lets do the
+same thing with ETF and cache the PID to which the cs_buffer
+belongs in tmc_alloc_etf_buffer() as done for ETR. This will
+also remove the unnecessary function calls(task_pid_nr()) since
+we are caching the PID.
+
+Easily reproducible running below:
+
+ perf record -e cs_etm/@tmc_etf0/ -N -p <pid>
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548
+Mem abort info:
+ ESR = 0x96000006
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+Data abort info:
+ ISV = 0, ISS = 0x00000006
+ CM = 0, WnR = 0
+<snip>...
+Call trace:
+ tmc_enable_etf_sink+0xe4/0x280
+ coresight_enable_path+0x168/0x1fc
+ etm_event_start+0x8c/0xf8
+ etm_event_add+0x38/0x54
+ event_sched_in+0x194/0x2ac
+ group_sched_in+0x54/0x12c
+ flexible_sched_in+0xd8/0x120
+ visit_groups_merge+0x100/0x16c
+ ctx_flexible_sched_in+0x50/0x74
+ ctx_sched_in+0xa4/0xa8
+ perf_event_sched_in+0x60/0x6c
+ perf_event_context_sched_in+0x98/0xe0
+ __perf_event_task_sched_in+0x5c/0xd8
+ finish_task_switch+0x184/0x1cc
+ schedule_tail+0x20/0xec
+ ret_from_fork+0x4/0x18
+
+Fixes: 880af782c6e8 ("coresight: tmc-etf: Add support for CPU-wide trace scenarios")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-10-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-priv.h | 2 ++
+ drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 +++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-priv.h
++++ b/drivers/hwtracing/coresight/coresight-priv.h
+@@ -87,6 +87,7 @@ enum cs_mode {
+ * struct cs_buffer - keep track of a recording session' specifics
+ * @cur: index of the current buffer
+ * @nr_pages: max number of pages granted to us
++ * @pid: PID this cs_buffer belongs to
+ * @offset: offset within the current buffer
+ * @data_size: how much we collected in this run
+ * @snapshot: is this run in snapshot mode
+@@ -95,6 +96,7 @@ enum cs_mode {
+ struct cs_buffers {
+ unsigned int cur;
+ unsigned int nr_pages;
++ pid_t pid;
+ unsigned long offset;
+ local_t data_size;
+ bool snapshot;
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -227,6 +227,7 @@ static int tmc_enable_etf_sink_perf(stru
+ unsigned long flags;
+ struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+ struct perf_output_handle *handle = data;
++ struct cs_buffers *buf = etm_perf_sink_config(handle);
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+ do {
+@@ -243,7 +244,7 @@ static int tmc_enable_etf_sink_perf(stru
+ }
+
+ /* Get a handle on the pid of the process to monitor */
+- pid = task_pid_nr(handle->event->owner);
++ pid = buf->pid;
+
+ if (drvdata->pid != -1 && drvdata->pid != pid) {
+ ret = -EBUSY;
+@@ -399,6 +400,7 @@ static void *tmc_alloc_etf_buffer(struct
+ if (!buf)
+ return NULL;
+
++ buf->pid = task_pid_nr(event->owner);
+ buf->snapshot = overwrite;
+ buf->nr_pages = nr_pages;
+ buf->data_pages = pages;
--- /dev/null
+From 1cc573d5754e92372a7e30e35468644f8811e1a4 Mon Sep 17 00:00:00 2001
+From: Mao Jinlong <jinlmao@codeaurora.org>
+Date: Fri, 27 Nov 2020 10:52:53 -0700
+Subject: coresight: tmc-etr: Check if page is valid before dma_map_page()
+
+From: Mao Jinlong <jinlmao@codeaurora.org>
+
+commit 1cc573d5754e92372a7e30e35468644f8811e1a4 upstream.
+
+alloc_pages_node() return should be checked before calling
+dma_map_page() to make sure that valid page is mapped or
+else it can lead to aborts as below:
+
+ Unable to handle kernel paging request at virtual address ffffffc008000000
+ Mem abort info:
+ <snip>...
+ pc : __dma_inv_area+0x40/0x58
+ lr : dma_direct_map_page+0xd8/0x1c8
+
+ Call trace:
+ __dma_inv_area
+ tmc_pages_alloc
+ tmc_alloc_data_pages
+ tmc_alloc_sg_table
+ tmc_init_etr_sg_table
+ tmc_alloc_etr_buf
+ tmc_enable_etr_sink_sysfs
+ tmc_enable_etr_sink
+ coresight_enable_path
+ coresight_enable
+ enable_source_store
+ dev_attr_store
+ sysfs_kf_write
+
+Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework")
+Cc: stable@vger.kernel.org
+Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mao Jinlong <jinlmao@codeaurora.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201127175256.1092685-13-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -217,6 +217,8 @@ static int tmc_pages_alloc(struct tmc_pa
+ } else {
+ page = alloc_pages_node(node,
+ GFP_KERNEL | __GFP_ZERO, 0);
++ if (!page)
++ goto err;
+ }
+ paddr = dma_map_page(real_dev, page, 0, PAGE_SIZE, dir);
+ if (dma_mapping_error(real_dev, paddr))
--- /dev/null
+From 83be0b84fe846edf0c722fefe225482d5f0d7395 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Tue, 8 Dec 2020 11:26:49 -0700
+Subject: coresight: tmc-etr: Fix barrier packet insertion for perf buffer
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+commit 83be0b84fe846edf0c722fefe225482d5f0d7395 upstream.
+
+When the ETR is used in perf mode with a larger buffer (configured
+via sysfs or the default size of 1M) than the perf aux buffer size,
+we end up inserting the barrier packet at the wrong offset, while
+moving the offset forward. i.e, instead of the "new moved offset",
+we insert it at the current hardware buffer offset. These packets
+will not be visible as they are never copied and could lead to
+corruption in the trace decoding side, as the decoder is not aware
+that it needs to reset the decoding.
+
+Fixes: ec13c78d7b45 ("coresight: tmc-etr: Add barrier packets when moving offset forward")
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: stable@vger.kernel.org
+Reported-by: Al Grant <al.grant@arm.com>
+Tested-by: Mike Leach <mike.leach@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201208182651.1597945-2-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -1552,7 +1552,7 @@ tmc_update_etr_buffer(struct coresight_d
+
+ /* Insert barrier packets at the beginning, if there was an overflow */
+ if (lost)
+- tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset);
++ tmc_etr_buf_insert_barrier_packet(etr_buf, offset);
+ tmc_etr_sync_perf_buffer(etr_perf, offset, size);
+
+ /*
--- /dev/null
+From 9eb78c25327548b905598975aa3ded4ef244b94a Mon Sep 17 00:00:00 2001
+From: Artem Labazov <123321artyom@gmail.com>
+Date: Mon, 7 Dec 2020 09:04:36 +0900
+Subject: exfat: Avoid allocating upcase table using kcalloc()
+
+From: Artem Labazov <123321artyom@gmail.com>
+
+commit 9eb78c25327548b905598975aa3ded4ef244b94a upstream.
+
+The table for Unicode upcase conversion requires an order-5 allocation,
+which may fail on a highly-fragmented system:
+
+ pool-udisksd: page allocation failure: order:5,
+ mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),
+ cpuset=/,mems_allowed=0
+ CPU: 4 PID: 3756880 Comm: pool-udisksd Tainted: G U
+ 5.8.10-200.fc32.x86_64 #1
+ Hardware name: Dell Inc. XPS 13 9360/0PVG6D, BIOS 2.13.0 11/14/2019
+ Call Trace:
+ dump_stack+0x6b/0x88
+ warn_alloc.cold+0x75/0xd9
+ ? _cond_resched+0x16/0x40
+ ? __alloc_pages_direct_compact+0x144/0x150
+ __alloc_pages_slowpath.constprop.0+0xcfa/0xd30
+ ? __schedule+0x28a/0x840
+ ? __wait_on_bit_lock+0x92/0xa0
+ __alloc_pages_nodemask+0x2df/0x320
+ kmalloc_order+0x1b/0x80
+ kmalloc_order_trace+0x1d/0xa0
+ exfat_create_upcase_table+0x115/0x390 [exfat]
+ exfat_fill_super+0x3ef/0x7f0 [exfat]
+ ? sget_fc+0x1d0/0x240
+ ? exfat_init_fs_context+0x120/0x120 [exfat]
+ get_tree_bdev+0x15c/0x250
+ vfs_get_tree+0x25/0xb0
+ do_mount+0x7c3/0xaf0
+ ? copy_mount_options+0xab/0x180
+ __x64_sys_mount+0x8e/0xd0
+ do_syscall_64+0x4d/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Make the driver use kvcalloc() to eliminate the issue.
+
+Fixes: 370e812b3ec1 ("exfat: add nls operations")
+Cc: stable@vger.kernel.org #v5.7+
+Signed-off-by: Artem Labazov <123321artyom@gmail.com>
+Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/exfat/nls.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/exfat/nls.c
++++ b/fs/exfat/nls.c
+@@ -659,7 +659,7 @@ static int exfat_load_upcase_table(struc
+ unsigned char skip = false;
+ unsigned short *upcase_table;
+
+- upcase_table = kcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL);
++ upcase_table = kvcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL);
+ if (!upcase_table)
+ return -ENOMEM;
+
+@@ -715,7 +715,7 @@ static int exfat_load_default_upcase_tab
+ unsigned short uni = 0, *upcase_table;
+ unsigned int index = 0;
+
+- upcase_table = kcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL);
++ upcase_table = kvcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL);
+ if (!upcase_table)
+ return -ENOMEM;
+
+@@ -803,5 +803,5 @@ load_default:
+
+ void exfat_free_upcase_table(struct exfat_sb_info *sbi)
+ {
+- kfree(sbi->vol_utbl);
++ kvfree(sbi->vol_utbl);
+ }
net-ipconfig-avoid-spurious-blank-lines-in-boot-log.patch
+x86-split-lock-avoid-returning-with-interrupts-enabled.patch
+exfat-avoid-allocating-upcase-table-using-kcalloc.patch
+soc-tegra-fuse-fix-index-bug-in-get_process_id.patch
+usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch
+usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch
+usb-gadget-f_acm-add-support-for-superspeed-plus.patch
+usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch
+usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch
+usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch
+usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch
+arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch
+arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch
+arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch
+coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch
+coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch
+coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch
+coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch
+coresight-etm4x-skip-setting-lpoverride-bit-for-qcom-skip-power-up.patch
+coresight-etm4x-fix-accesses-to-trcvmidctlr1.patch
+coresight-etm4x-fix-accesses-to-trccidctlr1.patch
+coresight-etm4x-fix-accesses-to-trcprocselr.patch
+coresight-etm4x-handle-trcvipcssctlr-accesses.patch
--- /dev/null
+From b9ce9b0f83b536a4ac7de7567a265d28d13e5bea Mon Sep 17 00:00:00 2001
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+Date: Wed, 18 Nov 2020 20:44:57 -0800
+Subject: soc/tegra: fuse: Fix index bug in get_process_id
+
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+
+commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream.
+
+This patch simply fixes a bug of referencing speedos[num] in every
+for-loop iteration in get_process_id function.
+
+Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
++++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
+@@ -94,7 +94,7 @@ static int get_process_id(int value, con
+ unsigned int i;
+
+ for (i = 0; i < num; i++)
+- if (value < speedos[num])
++ if (value < speedos[i])
+ return i;
+
+ return -EINVAL;
--- /dev/null
+From c7721e15f434920145c376e8fe77e1c079fc3726 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Mon, 7 Dec 2020 10:09:09 +0800
+Subject: usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream.
+
+According to the i.MX6UL Errata document:
+https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf
+
+ERR007881 also affects i.MX6UL, so pass the
+CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue.
+
+Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -57,7 +57,8 @@ static const struct ci_hdrc_imx_platform
+
+ static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = {
+ .flags = CI_HDRC_SUPPORTS_RUNTIME_PM |
+- CI_HDRC_TURN_VBUS_EARLY_ON,
++ CI_HDRC_TURN_VBUS_EARLY_ON |
++ CI_HDRC_DISABLE_DEVICE_STREAMING,
+ };
+
+ static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {
--- /dev/null
+From 3ee05c20656782387aa9eb010fdb9bb16982ac3f Mon Sep 17 00:00:00 2001
+From: "taehyun.cho" <taehyun.cho@samsung.com>
+Date: Fri, 27 Nov 2020 15:05:56 +0100
+Subject: USB: gadget: f_acm: add support for SuperSpeed Plus
+
+From: taehyun.cho <taehyun.cho@samsung.com>
+
+commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream.
+
+Setup the SuperSpeed Plus descriptors for f_acm. This allows the gadget
+to work properly without crashing at SuperSpeed rates.
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: taehyun.cho <taehyun.cho@samsung.com>
+Signed-off-by: Will McVicker <willmcvicker@google.com>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201127140559.381351-3-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_acm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_acm.c
++++ b/drivers/usb/gadget/function/f_acm.c
+@@ -686,7 +686,7 @@ acm_bind(struct usb_configuration *c, st
+ acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
+- acm_ss_function, NULL);
++ acm_ss_function, acm_ss_function);
+ if (status)
+ goto fail;
+
--- /dev/null
+From a353397b0d5dfa3c99b372505db3378fc919c6c6 Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Tue, 27 Oct 2020 16:07:31 -0700
+Subject: usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit a353397b0d5dfa3c99b372505db3378fc919c6c6 upstream.
+
+In many cases a function that supports SuperSpeed can very well
+operate in SuperSpeedPlus, if a gadget controller supports it,
+as the endpoint descriptors (and companion descriptors) are
+generally identical and can be re-used. This is true for two
+commonly used functions: Android's ADB and MTP. So we can simply
+assign the usb_function's ssp_descriptors array to point to its
+ss_descriptors, if available. Similarly, we need to allow an
+epfile's ioctl for FUNCTIONFS_ENDPOINT_DESC to correctly
+return the corresponding SuperSpeed endpoint descriptor in case
+the connected speed is SuperSpeedPlus as well.
+
+The only exception is if a function wants to implement an
+Isochronous endpoint capable of transferring more than 48KB per
+service interval when operating at greater than USB 3.1 Gen1
+speed, in which case it would require an additional SuperSpeedPlus
+Isochronous Endpoint Companion descriptor to be returned as part
+of the Configuration Descriptor. Support for that would need
+to be separately added to the userspace-facing FunctionFS API
+which may not be a trivial task--likely a new descriptor format
+(v3?) may need to be devised to allow for separate SS and SSP
+descriptors to be supplied.
+
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201027230731.9073-1-jackp@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1328,6 +1328,7 @@ static long ffs_epfile_ioctl(struct file
+
+ switch (epfile->ffs->gadget->speed) {
+ case USB_SPEED_SUPER:
++ case USB_SPEED_SUPER_PLUS:
+ desc_idx = 2;
+ break;
+ case USB_SPEED_HIGH:
+@@ -3174,7 +3175,8 @@ static int _ffs_func_bind(struct usb_con
+ }
+
+ if (likely(super)) {
+- func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
++ func->function.ss_descriptors = func->function.ssp_descriptors =
++ vla_ptr(vlabuf, d, ss_descs);
+ ss_len = ffs_do_descs(ffs->ss_descs_count,
+ vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
+ d_raw_descs__sz - fs_len - hs_len,
+@@ -3584,6 +3586,7 @@ static void ffs_func_unbind(struct usb_c
+ func->function.fs_descriptors = NULL;
+ func->function.hs_descriptors = NULL;
+ func->function.ss_descriptors = NULL;
++ func->function.ssp_descriptors = NULL;
+ func->interfaces_nums = NULL;
+
+ ffs_event_add(ffs, FUNCTIONFS_UNBIND);
--- /dev/null
+From 457a902ba1a73b7720666b21ca038cd19764db18 Mon Sep 17 00:00:00 2001
+From: Will McVicker <willmcvicker@google.com>
+Date: Fri, 27 Nov 2020 15:05:57 +0100
+Subject: USB: gadget: f_midi: setup SuperSpeed Plus descriptors
+
+From: Will McVicker <willmcvicker@google.com>
+
+commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream.
+
+Needed for SuperSpeed Plus support for f_midi. This allows the
+gadget to work properly without crashing at SuperSpeed rates.
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Will McVicker <willmcvicker@google.com>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_midi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_midi.c
++++ b/drivers/usb/gadget/function/f_midi.c
+@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config
+ f->ss_descriptors = usb_copy_descriptors(midi_function);
+ if (!f->ss_descriptors)
+ goto fail_f_midi;
++
++ if (gadget_is_superspeed_plus(c->cdev->gadget)) {
++ f->ssp_descriptors = usb_copy_descriptors(midi_function);
++ if (!f->ssp_descriptors)
++ goto fail_f_midi;
++ }
+ }
+
+ kfree(midi_function);
--- /dev/null
+From b00f444f9add39b64d1943fa75538a1ebd54a290 Mon Sep 17 00:00:00 2001
+From: Will McVicker <willmcvicker@google.com>
+Date: Fri, 27 Nov 2020 15:05:55 +0100
+Subject: USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
+
+From: Will McVicker <willmcvicker@google.com>
+
+commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream.
+
+Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate
+defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors
+for CDC NCM").
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: EJ Hsu <ejh@nvidia.com>
+Cc: Peter Chen <peter.chen@nxp.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Will McVicker <willmcvicker@google.com>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_rndis.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_rndis.c
++++ b/drivers/usb/gadget/function/f_rndis.c
+@@ -87,8 +87,10 @@ static inline struct f_rndis *func_to_rn
+ /* peak (theoretical) bulk transfer rate in bits-per-second */
+ static unsigned int bitrate(struct usb_gadget *g)
+ {
++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
++ return 4250000000U;
+ if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
+- return 13 * 1024 * 8 * 1000 * 8;
++ return 3750000000U;
+ else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+ return 13 * 512 * 8 * 1000 * 8;
+ else
--- /dev/null
+From 3f6f6343a29d9ea7429306b83b18e66dc1331d5c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 3 Dec 2020 11:41:13 +0300
+Subject: usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3f6f6343a29d9ea7429306b83b18e66dc1331d5c upstream.
+
+This code is using the wrong sizeof() so it does not allocate enough
+memory. It allocates 32 bytes but 72 are required. That will lead to
+memory corruption.
+
+Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X8ikqc4Mo2/0G72j@mwanda
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/mtu3/mtu3_debugfs.c
++++ b/drivers/usb/mtu3/mtu3_debugfs.c
+@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct m
+ struct debugfs_regset32 *regset;
+ struct mtu3_regset *mregs;
+
+- mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
++ mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
+ if (!mregs)
+ return;
+
--- /dev/null
+From a251963f76fa0226d0fdf0c4f989496f18d9ae7f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 9 Dec 2020 11:42:21 +0100
+Subject: USB: serial: option: add interface-number sanity check to flag handling
+
+From: Johan Hovold <johan@kernel.org>
+
+commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream.
+
+Add an interface-number sanity check before testing the device flags to
+avoid relying on undefined behaviour when left shifting in case a device
+uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64
+or 32).
+
+Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
+Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking")
+Cc: stable@vger.kernel.org
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -563,6 +563,9 @@ static void option_instat_callback(struc
+
+ /* Device flags */
+
++/* Highest interface number which can be used with NCTRL() and RSVD() */
++#define FLAG_IFNUM_MAX 7
++
+ /* Interface does not support modem-control requests */
+ #define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8)
+
+@@ -2101,6 +2104,14 @@ static struct usb_serial_driver * const
+
+ module_usb_serial_driver(serial_drivers, option_ids);
+
++static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
++{
++ if (ifnum > FLAG_IFNUM_MAX)
++ return false;
++
++ return device_flags & RSVD(ifnum);
++}
++
+ static int option_probe(struct usb_serial *serial,
+ const struct usb_device_id *id)
+ {
+@@ -2117,7 +2128,7 @@ static int option_probe(struct usb_seria
+ * the same class/subclass/protocol as the serial interfaces. Look at
+ * the Windows driver .INF files for reserved interface numbers.
+ */
+- if (device_flags & RSVD(iface_desc->bInterfaceNumber))
++ if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
+ return -ENODEV;
+
+ /*
+@@ -2133,6 +2144,14 @@ static int option_probe(struct usb_seria
+ return 0;
+ }
+
++static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
++{
++ if (ifnum > FLAG_IFNUM_MAX)
++ return false;
++
++ return device_flags & NCTRL(ifnum);
++}
++
+ static int option_attach(struct usb_serial *serial)
+ {
+ struct usb_interface_descriptor *iface_desc;
+@@ -2148,7 +2167,7 @@ static int option_attach(struct usb_seri
+
+ iface_desc = &serial->interface->cur_altsetting->desc;
+
+- if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
++ if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
+ data->use_send_setup = 1;
+
+ if (device_flags & ZLP)
--- /dev/null
+From e14fd4ba8fb47fcf5f244366ec01ae94490cd86a Mon Sep 17 00:00:00 2001
+From: Andi Kleen <ak@linux.intel.com>
+Date: Tue, 22 Dec 2020 09:40:10 -0800
+Subject: x86/split-lock: Avoid returning with interrupts enabled
+
+From: Andi Kleen <ak@linux.intel.com>
+
+commit e14fd4ba8fb47fcf5f244366ec01ae94490cd86a upstream.
+
+When a split lock is detected always make sure to disable interrupts
+before returning from the trap handler.
+
+The kernel exit code assumes that all exits run with interrupts
+disabled, otherwise the SWAPGS sequence can race against interrupts and
+cause recursing page faults and later panics.
+
+The problem will only happen on CPUs with split lock disable
+functionality, so Icelake Server, Tiger Lake, Snow Ridge, Jacobsville.
+
+Fixes: ca4c6a9858c2 ("x86/traps: Make interrupt enable/disable symmetric in C code")
+Fixes: bce9b042ec73 ("x86/traps: Disable interrupts in exc_aligment_check()") # v5.8+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/traps.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -299,11 +299,12 @@ DEFINE_IDTENTRY_ERRORCODE(exc_alignment_
+ local_irq_enable();
+
+ if (handle_user_split_lock(regs, error_code))
+- return;
++ goto out;
+
+ do_trap(X86_TRAP_AC, SIGBUS, "alignment check", regs,
+ error_code, BUS_ADRALN, NULL);
+
++out:
+ local_irq_disable();
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
