--- /dev/null
+From 0d4867a185460397af56b9afe3e2243d3e610e37 Mon Sep 17 00:00:00 2001
+From: Alexander Monakov <amonakov@ispras.ru>
+Date: Wed, 21 Jul 2021 20:01:41 +0300
+Subject: ALSA: hda/realtek: add mic quirk for Acer SF314-42
+
+From: Alexander Monakov <amonakov@ispras.ru>
+
+commit 0d4867a185460397af56b9afe3e2243d3e610e37 upstream.
+
+The Acer Swift SF314-42 laptop is using Realtek ALC255 codec. Add a
+quirk so microphone in a headset connected via the right-hand side jack
+is usable.
+
+Signed-off-by: Alexander Monakov <amonakov@ispras.ru>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210721170141.24807-1-amonakov@ispras.ru
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8203,6 +8203,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
--- /dev/null
+From 35171fbfc0d94aa31b009bb475d156ad1941ab50 Mon Sep 17 00:00:00 2001
+From: Nikos Liolios <liolios.nk@gmail.com>
+Date: Tue, 27 Jul 2021 06:05:10 +0300
+Subject: ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256)
+
+From: Nikos Liolios <liolios.nk@gmail.com>
+
+commit 35171fbfc0d94aa31b009bb475d156ad1941ab50 upstream.
+
+The issue on Acer SWIFT SF314-56 is that headset microphone doesn't work.
+The following quirk fixed headset microphone issue. The fixup was found by trial and error.
+Note that the fixup of SF314-54/55 (ALC256_FIXUP_ACER_HEADSET_MIC) was not successful on my SF314-56.
+
+Signed-off-by: Nikos Liolios <liolios.nk@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210727030510.36292-1-liolios.nk@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8200,6 +8200,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x129c, "Acer SWIFT SF314-55", ALC256_FIXUP_ACER_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x1300, "Acer SWIFT SF314-56", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
--- /dev/null
+From 852a8a97776a153be2e6c803218eced45f37a19c Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Fri, 30 Jul 2021 11:02:54 +0200
+Subject: ALSA: pcm - fix mmap capability check for the snd-dummy driver
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 852a8a97776a153be2e6c803218eced45f37a19c upstream.
+
+The snd-dummy driver (fake_buffer configuration) uses the ops->page
+callback for the mmap operations. Allow mmap for this case, too.
+
+Cc: <stable@vger.kernel.org>
+Fixes: c4824ae7db41 ("ALSA: pcm: Fix mmap capability check")
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20210730090254.612478-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/pcm_native.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -246,7 +246,7 @@ static bool hw_support_mmap(struct snd_p
+ if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_MMAP))
+ return false;
+
+- if (substream->ops->mmap)
++ if (substream->ops->mmap || substream->ops->page)
+ return true;
+
+ switch (substream->dma_buffer.dev.type) {
--- /dev/null
+From 4b0556b96e1fe7723629bd40e3813a30cd632faf Mon Sep 17 00:00:00 2001
+From: Alexander Tsoy <alexander@tsoy.me>
+Date: Tue, 27 Jul 2021 12:33:26 +0300
+Subject: ALSA: usb-audio: Add registration quirk for JBL Quantum 600
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+commit 4b0556b96e1fe7723629bd40e3813a30cd632faf upstream.
+
+Apparently JBL Quantum 600 has multiple hardware revisions. Apply
+registration quirk to another device id as well.
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210727093326.1153366-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1897,6 +1897,7 @@ static const struct registration_quirk r
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
+ { 0 } /* terminator */
+ };
--- /dev/null
+From 66291b6adb66dd3bc96b0f594d88c2ff1300d95f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 26 Jul 2021 08:26:56 +0200
+Subject: ALSA: usb-audio: Fix superfluous autosuspend recovery
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 66291b6adb66dd3bc96b0f594d88c2ff1300d95f upstream.
+
+The change to restore the autosuspend from the disabled state uses a
+wrong check: namely, it should have been the exact comparison of the
+quirk_type instead of the bitwise and (&). Otherwise it matches
+wrongly with the other quirk types.
+
+Although re-enabling the autosuspend for the already enabled device
+shouldn't matter much, it's better to fix the unbalanced call.
+
+Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/s5hr1flh9ov.wl-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -907,7 +907,7 @@ static void usb_audio_disconnect(struct
+ }
+ }
+
+- if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND)
++ if (chip->quirk_type == QUIRK_SETUP_DISABLE_AUTOSUSPEND)
+ usb_enable_autosuspend(interface_to_usbdev(intf));
+
+ chip->num_interfaces--;
firmware_loader-use-etimedout-instead-of-eagain-in-fw_load_sysfs_fallback.patch
firmware_loader-fix-use-after-free-in-firmware_fallback_sysfs.patch
drm-amdgpu-display-fix-dmub-firmware-version-info.patch
+alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch
+alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch
+alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch
+alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch
+alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch
+usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch
+usb-gadget-remove-leaked-entry-from-udc-driver-list.patch
+usb-cdns3-fixed-incorrect-gadget-state.patch
+usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch
+usb-gadget-f_hid-fixed-null-pointer-dereference.patch
+usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch
+usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch
+usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch
+usb-otg-fsm-fix-hrtimer-list-corruption.patch
--- /dev/null
+From aa35772f61752d4c636d46be51a4f7ca6c029ee6 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Wed, 23 Jun 2021 09:02:47 +0200
+Subject: usb: cdns3: Fixed incorrect gadget state
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit aa35772f61752d4c636d46be51a4f7ca6c029ee6 upstream.
+
+For delayed status phase, the usb_gadget->state was set
+to USB_STATE_ADDRESS and it has never been updated to
+USB_STATE_CONFIGURED.
+Patch updates the gadget state to correct USB_STATE_CONFIGURED.
+As a result of this bug the controller was not able to enter to
+Test Mode while using MSC function.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Link: https://lore.kernel.org/r/20210623070247.46151-1-pawell@gli-login.cadence.com
+Signed-off-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/ep0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/cdns3/ep0.c
++++ b/drivers/usb/cdns3/ep0.c
+@@ -731,6 +731,7 @@ static int cdns3_gadget_ep0_queue(struct
+ request->actual = 0;
+ priv_dev->status_completion_no_call = true;
+ priv_dev->pending_status_request = request;
++ usb_gadget_set_state(&priv_dev->gadget, USB_STATE_CONFIGURED);
+ spin_unlock_irqrestore(&priv_dev->lock, flags);
+
+ /*
--- /dev/null
+From cb10f68ad8150f243964b19391711aaac5e8ff42 Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <wcheng@codeaurora.org>
+Date: Tue, 3 Aug 2021 23:24:05 -0700
+Subject: usb: dwc3: gadget: Avoid runtime resume if disabling pullup
+
+From: Wesley Cheng <wcheng@codeaurora.org>
+
+commit cb10f68ad8150f243964b19391711aaac5e8ff42 upstream.
+
+If the device is already in the runtime suspended state, any call to
+the pullup routine will issue a runtime resume on the DWC3 core
+device. If the USB gadget is disabling the pullup, then avoid having
+to issue a runtime resume, as DWC3 gadget has already been
+halted/stopped.
+
+This fixes an issue where the following condition occurs:
+
+usb_gadget_remove_driver()
+-->usb_gadget_disconnect()
+ -->dwc3_gadget_pullup(0)
+ -->pm_runtime_get_sync() -> ret = 0
+ -->pm_runtime_put() [async]
+-->usb_gadget_udc_stop()
+ -->dwc3_gadget_stop()
+ -->dwc->gadget_driver = NULL
+...
+
+dwc3_suspend_common()
+-->dwc3_gadget_suspend()
+ -->DWC3 halt/stop routine skipped, driver_data == NULL
+
+This leads to a situation where the DWC3 gadget is not properly
+stopped, as the runtime resume would have re-enabled EP0 and event
+interrupts, and since we avoided the DWC3 gadget suspend, these
+resources were never disabled.
+
+Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
+Link: https://lore.kernel.org/r/1628058245-30692-1-git-send-email-wcheng@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2132,6 +2132,17 @@ static int dwc3_gadget_pullup(struct usb
+ }
+
+ /*
++ * Avoid issuing a runtime resume if the device is already in the
++ * suspended state during gadget disconnect. DWC3 gadget was already
++ * halted/stopped during runtime suspend.
++ */
++ if (!is_on) {
++ pm_runtime_barrier(dwc->dev);
++ if (pm_runtime_suspended(dwc->dev))
++ return 0;
++ }
++
++ /*
+ * Check the return value for successful resume, or error. For a
+ * successful resume, the DWC3 runtime PM resume routine will handle
+ * the run stop sequence, so avoid duplicate operations here.
--- /dev/null
+From afcff6dc690e24d636a41fd4bee6057e7c70eebd Mon Sep 17 00:00:00 2001
+From: Maxim Devaev <mdevaev@gmail.com>
+Date: Wed, 21 Jul 2021 21:03:51 +0300
+Subject: usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
+
+From: Maxim Devaev <mdevaev@gmail.com>
+
+commit afcff6dc690e24d636a41fd4bee6057e7c70eebd upstream.
+
+The USB HID standard declares mandatory support for GET_IDLE and SET_IDLE
+requests for Boot Keyboard. Most hosts can handle their absence, but others
+like some old/strange UEFIs and BIOSes consider this a critical error
+and refuse to work with f_hid.
+
+This primitive implementation of saving and returning idle is sufficient
+to meet the requirements of the standard and these devices.
+
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+Link: https://lore.kernel.org/r/20210721180351.129450-1-mdevaev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -41,6 +41,7 @@ struct f_hidg {
+ unsigned char bInterfaceSubClass;
+ unsigned char bInterfaceProtocol;
+ unsigned char protocol;
++ unsigned char idle;
+ unsigned short report_desc_length;
+ char *report_desc;
+ unsigned short report_length;
+@@ -523,6 +524,14 @@ static int hidg_setup(struct usb_functio
+ goto respond;
+ break;
+
++ case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
++ | HID_REQ_GET_IDLE):
++ VDBG(cdev, "get_idle\n");
++ length = min_t(unsigned int, length, 1);
++ ((u8 *) req->buf)[0] = hidg->idle;
++ goto respond;
++ break;
++
+ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
+ | HID_REQ_SET_REPORT):
+ VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength);
+@@ -546,6 +555,14 @@ static int hidg_setup(struct usb_functio
+ goto stall;
+ break;
+
++ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
++ | HID_REQ_SET_IDLE):
++ VDBG(cdev, "set_idle\n");
++ length = 0;
++ hidg->idle = value;
++ goto respond;
++ break;
++
+ case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8
+ | USB_REQ_GET_DESCRIPTOR):
+ switch (value >> 8) {
+@@ -773,6 +790,7 @@ static int hidg_bind(struct usb_configur
+ hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass;
+ hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol;
+ hidg->protocol = HID_REPORT_PROTOCOL;
++ hidg->idle = 1;
+ hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
+ hidg_ss_in_comp_desc.wBytesPerInterval =
+ cpu_to_le16(hidg->report_length);
--- /dev/null
+From 2867652e4766360adf14dfda3832455e04964f2a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 23 Jul 2021 18:59:30 +0300
+Subject: usb: gadget: f_hid: fixed NULL pointer dereference
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+commit 2867652e4766360adf14dfda3832455e04964f2a upstream.
+
+Disconnecting and reconnecting the USB cable can lead to crashes
+and a variety of kernel log spam.
+
+The problem was found and reproduced on the Raspberry Pi [1]
+and the original fix was created in Raspberry's own fork [2].
+
+Link: https://github.com/raspberrypi/linux/issues/3870 [1]
+Link: https://github.com/raspberrypi/linux/commit/a6e47d5f4efbd2ea6a0b6565cd2f9b7bb217ded5 [2]
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210723155928.210019-1-mdevaev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -339,6 +339,11 @@ static ssize_t f_hidg_write(struct file
+
+ spin_lock_irqsave(&hidg->write_spinlock, flags);
+
++ if (!hidg->req) {
++ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
++ return -ESHUTDOWN;
++ }
++
+ #define WRITE_COND (!hidg->write_pending)
+ try_again:
+ /* write queue */
+@@ -359,8 +364,14 @@ try_again:
+ count = min_t(unsigned, count, hidg->report_length);
+
+ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+- status = copy_from_user(req->buf, buffer, count);
+
++ if (!req) {
++ ERROR(hidg->func.config->cdev, "hidg->req is NULL\n");
++ status = -ESHUTDOWN;
++ goto release_write_pending;
++ }
++
++ status = copy_from_user(req->buf, buffer, count);
+ if (status != 0) {
+ ERROR(hidg->func.config->cdev,
+ "copy_from_user error\n");
+@@ -388,14 +399,17 @@ try_again:
+
+ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+
++ if (!hidg->in_ep->enabled) {
++ ERROR(hidg->func.config->cdev, "in_ep is disabled\n");
++ status = -ESHUTDOWN;
++ goto release_write_pending;
++ }
++
+ status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
+- if (status < 0) {
+- ERROR(hidg->func.config->cdev,
+- "usb_ep_queue error on int endpoint %zd\n", status);
++ if (status < 0)
+ goto release_write_pending;
+- } else {
++ else
+ status = count;
+- }
+
+ return status;
+ release_write_pending:
--- /dev/null
+From fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 Mon Sep 17 00:00:00 2001
+From: Maxim Devaev <mdevaev@gmail.com>
+Date: Tue, 27 Jul 2021 21:58:00 +0300
+Subject: usb: gadget: f_hid: idle uses the highest byte for duration
+
+From: Maxim Devaev <mdevaev@gmail.com>
+
+commit fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 upstream.
+
+SET_IDLE value must be shifted 8 bits to the right to get duration.
+This confirmed by USBCV test.
+
+Fixes: afcff6dc690e ("usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
+Link: https://lore.kernel.org/r/20210727185800.43796-1-mdevaev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -573,7 +573,7 @@ static int hidg_setup(struct usb_functio
+ | HID_REQ_SET_IDLE):
+ VDBG(cdev, "set_idle\n");
+ length = 0;
+- hidg->idle = value;
++ hidg->idle = value >> 8;
+ goto respond;
+ break;
+
--- /dev/null
+From fa4a8dcfd51b911f101ebc461dfe22230b74dd64 Mon Sep 17 00:00:00 2001
+From: Zhang Qilong <zhangqilong3@huawei.com>
+Date: Tue, 27 Jul 2021 15:31:42 +0800
+Subject: usb: gadget: remove leaked entry from udc driver list
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+commit fa4a8dcfd51b911f101ebc461dfe22230b74dd64 upstream.
+
+The usb_add_gadget_udc will add a new gadget to the udc class
+driver list. Not calling usb_del_gadget_udc in error branch
+will result in residual gadget entry in the udc driver list.
+We fix it by calling usb_del_gadget_udc to clean it when error
+return.
+
+Fixes: 48ba02b2e2b1 ("usb: gadget: add udc driver for max3420")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20210727073142.84666-1-zhangqilong3@huawei.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/max3420_udc.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/udc/max3420_udc.c
++++ b/drivers/usb/gadget/udc/max3420_udc.c
+@@ -1260,12 +1260,14 @@ static int max3420_probe(struct spi_devi
+ err = devm_request_irq(&spi->dev, irq, max3420_irq_handler, 0,
+ "max3420", udc);
+ if (err < 0)
+- return err;
++ goto del_gadget;
+
+ udc->thread_task = kthread_create(max3420_thread, udc,
+ "max3420-thread");
+- if (IS_ERR(udc->thread_task))
+- return PTR_ERR(udc->thread_task);
++ if (IS_ERR(udc->thread_task)) {
++ err = PTR_ERR(udc->thread_task);
++ goto del_gadget;
++ }
+
+ irq = of_irq_get_byname(spi->dev.of_node, "vbus");
+ if (irq <= 0) { /* no vbus irq implies self-powered design */
+@@ -1285,10 +1287,14 @@ static int max3420_probe(struct spi_devi
+ err = devm_request_irq(&spi->dev, irq,
+ max3420_vbus_handler, 0, "vbus", udc);
+ if (err < 0)
+- return err;
++ goto del_gadget;
+ }
+
+ return 0;
++
++del_gadget:
++ usb_del_gadget_udc(&udc->gadget);
++ return err;
+ }
+
+ static int max3420_remove(struct spi_device *spi)
--- /dev/null
+From 00de6a572f30ee93cad7e0704ec4232e5e72bda8 Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+Date: Wed, 21 Jul 2021 16:29:05 +0300
+Subject: usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+commit 00de6a572f30ee93cad7e0704ec4232e5e72bda8 upstream.
+
+On SAMA7G5 suspending ports will cut the access to OHCI registers and
+any subsequent access to them will lead to CPU being blocked trying to
+access that memory. Same thing happens on resume: if OHCI memory is
+accessed before resuming ports the CPU will block on that access. The
+OCHI memory is accessed on suspend/resume though
+ohci_suspend()/ohci_resume().
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210721132905.1970713-1-claudiu.beznea@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ohci-at91.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -606,8 +606,6 @@ ohci_hcd_at91_drv_suspend(struct device
+ if (ohci_at91->wakeup)
+ enable_irq_wake(hcd->irq);
+
+- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1);
+-
+ ret = ohci_suspend(hcd, ohci_at91->wakeup);
+ if (ret) {
+ if (ohci_at91->wakeup)
+@@ -627,7 +625,10 @@ ohci_hcd_at91_drv_suspend(struct device
+ /* flush the writes */
+ (void) ohci_readl (ohci, &ohci->regs->control);
+ msleep(1);
++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1);
+ at91_stop_clock(ohci_at91);
++ } else {
++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1);
+ }
+
+ return ret;
+@@ -639,6 +640,8 @@ ohci_hcd_at91_drv_resume(struct device *
+ struct usb_hcd *hcd = dev_get_drvdata(dev);
+ struct ohci_at91_priv *ohci_at91 = hcd_to_ohci_at91_priv(hcd);
+
++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0);
++
+ if (ohci_at91->wakeup)
+ disable_irq_wake(hcd->irq);
+ else
+@@ -646,8 +649,6 @@ ohci_hcd_at91_drv_resume(struct device *
+
+ ohci_resume(hcd, false);
+
+- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0);
+-
+ return 0;
+ }
+
--- /dev/null
+From bf88fef0b6f1488abeca594d377991171c00e52a Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Sat, 17 Jul 2021 21:21:27 +0300
+Subject: usb: otg-fsm: Fix hrtimer list corruption
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit bf88fef0b6f1488abeca594d377991171c00e52a upstream.
+
+The HNP work can be re-scheduled while it's still in-fly. This results in
+re-initialization of the busy work, resetting the hrtimer's list node of
+the work and crashing kernel with null dereference within kernel/timer
+once work's timer is expired. It's very easy to trigger this problem by
+re-plugging USB cable quickly. Initialize HNP work only once to fix this
+trouble.
+
+ Unable to handle kernel NULL pointer dereference at virtual address 00000126)
+ ...
+ PC is at __run_timers.part.0+0x150/0x228
+ LR is at __next_timer_interrupt+0x51/0x9c
+ ...
+ (__run_timers.part.0) from [<c0187a2b>] (run_timer_softirq+0x2f/0x50)
+ (run_timer_softirq) from [<c01013ad>] (__do_softirq+0xd5/0x2f0)
+ (__do_softirq) from [<c012589b>] (irq_exit+0xab/0xb8)
+ (irq_exit) from [<c0170341>] (handle_domain_irq+0x45/0x60)
+ (handle_domain_irq) from [<c04c4a43>] (gic_handle_irq+0x6b/0x7c)
+ (gic_handle_irq) from [<c0100b65>] (__irq_svc+0x65/0xac)
+
+Cc: stable@vger.kernel.org
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/common/usb-otg-fsm.c | 6 +++++-
+ include/linux/usb/otg-fsm.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -193,7 +193,11 @@ static void otg_start_hnp_polling(struct
+ if (!fsm->host_req_flag)
+ return;
+
+- INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work);
++ if (!fsm->hnp_work_inited) {
++ INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work);
++ fsm->hnp_work_inited = true;
++ }
++
+ schedule_delayed_work(&fsm->hnp_polling_work,
+ msecs_to_jiffies(T_HOST_REQ_POLL));
+ }
+--- a/include/linux/usb/otg-fsm.h
++++ b/include/linux/usb/otg-fsm.h
+@@ -196,6 +196,7 @@ struct otg_fsm {
+ struct mutex lock;
+ u8 *host_req_flag;
+ struct delayed_work hnp_polling_work;
++ bool hnp_work_inited;
+ bool state_changed;
+ };
+
--- /dev/null
+From 43ad944cd73f2360ec8ff31d29ea44830b3119af Mon Sep 17 00:00:00 2001
+From: Kyle Tso <kyletso@google.com>
+Date: Tue, 3 Aug 2021 17:13:14 +0800
+Subject: usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events
+
+From: Kyle Tso <kyletso@google.com>
+
+commit 43ad944cd73f2360ec8ff31d29ea44830b3119af upstream.
+
+When receiving FRS and Sourcing_Vbus events from low-level drivers, keep
+other events which come a bit earlier so that they will not be ignored
+in the event handler.
+
+Fixes: 8dc4bd073663 ("usb: typec: tcpm: Add support for Sink Fast Role SWAP(FRS)")
+Cc: stable <stable@vger.kernel.org>
+Cc: Badhri Jagan Sridharan <badhri@google.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
+Signed-off-by: Kyle Tso <kyletso@google.com>
+Link: https://lore.kernel.org/r/20210803091314.3051302-1-kyletso@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -4314,7 +4314,7 @@ EXPORT_SYMBOL_GPL(tcpm_pd_hard_reset);
+ void tcpm_sink_frs(struct tcpm_port *port)
+ {
+ spin_lock(&port->pd_event_lock);
+- port->pd_events = TCPM_FRS_EVENT;
++ port->pd_events |= TCPM_FRS_EVENT;
+ spin_unlock(&port->pd_event_lock);
+ kthread_queue_work(port->wq, &port->event_work);
+ }
+@@ -4323,7 +4323,7 @@ EXPORT_SYMBOL_GPL(tcpm_sink_frs);
+ void tcpm_sourcing_vbus(struct tcpm_port *port)
+ {
+ spin_lock(&port->pd_event_lock);
+- port->pd_events = TCPM_SOURCING_VBUS;
++ port->pd_events |= TCPM_SOURCING_VBUS;
+ spin_unlock(&port->pd_event_lock);
+ kthread_queue_work(port->wq, &port->event_work);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
