--- /dev/null
+From 03894573f2913181ee5aae0089f333b2131f2d4b Mon Sep 17 00:00:00 2001
+From: Joakim Tjernlund <joakim.tjernlund@infinera.com>
+Date: Fri, 5 Jun 2020 12:54:18 +0200
+Subject: cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
+
+From: Joakim Tjernlund <joakim.tjernlund@infinera.com>
+
+commit 03894573f2913181ee5aae0089f333b2131f2d4b upstream.
+
+USB_DEVICE(0x0424, 0x274e) can send data before cdc_acm is ready,
+causing garbage chars on the TTY causing stray input to the shell
+and/or login prompt.
+
+Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
+Cc: stable@vger.kernel.org
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20200605105418.22263-1-joakim.tjernlund@infinera.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1689,6 +1689,8 @@ static int acm_pre_reset(struct usb_inte
+
+ static const struct usb_device_id acm_ids[] = {
+ /* quirky and broken devices */
++ { USB_DEVICE(0x0424, 0x274e), /* Microchip Technology, Inc. (formerly SMSC) */
++ .driver_info = DISABLE_ECHO, }, /* DISABLE ECHO in termios flag */
+ { USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */
+ .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
+ { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
--- /dev/null
+From 77577de64167aa0643d47ffbaacf3642632b321b Mon Sep 17 00:00:00 2001
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Date: Sat, 13 Jun 2020 20:27:09 +0800
+Subject: cifs: Fix cached_fid refcnt leak in open_shroot
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+commit 77577de64167aa0643d47ffbaacf3642632b321b upstream.
+
+open_shroot() invokes kref_get(), which increases the refcount of the
+"tcon->crfid" object. When open_shroot() returns not zero, it means the
+open operation failed and close_shroot() will not be called to decrement
+the refcount of the "tcon->crfid".
+
+The reference counting issue happens in one normal path of
+open_shroot(). When the cached root have been opened successfully in a
+concurrent process, the function increases the refcount and jump to
+"oshr_free" to return. However the current return value "rc" may not
+equal to 0, thus the increased refcount will not be balanced outside the
+function, causing a refcnt leak.
+
+Fix this issue by setting the value of "rc" to 0 before jumping to
+"oshr_free" label.
+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -736,6 +736,7 @@ int open_shroot(unsigned int xid, struct
+ /* close extra handle outside of crit sec */
+ SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
+ }
++ rc = 0;
+ goto oshr_free;
+ }
+
--- /dev/null
+From acc91c2d8de4ef46ed751c5f9df99ed9a109b100 Mon Sep 17 00:00:00 2001
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Date: Tue, 23 Jun 2020 07:31:53 -0400
+Subject: cifs/smb3: Fix data inconsistent when punch hole
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+commit acc91c2d8de4ef46ed751c5f9df99ed9a109b100 upstream.
+
+When punch hole success, we also can read old data from file:
+ # strace -e trace=pread64,fallocate xfs_io -f -c "pread 20 40" \
+ -c "fpunch 20 40" -c"pread 20 40" file
+ pread64(3, " version 5.8.0-rc1+"..., 40, 20) = 40
+ fallocate(3, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 20, 40) = 0
+ pread64(3, " version 5.8.0-rc1+"..., 40, 20) = 40
+
+CIFS implements the fallocate(FALLOCATE_FL_PUNCH_HOLE) with send SMB
+ioctl(FSCTL_SET_ZERO_DATA) to server. It just set the range of the
+remote file to zero, but local page caches not updated, then the
+local page caches inconsistent with server.
+
+Also can be found by xfstests generic/316.
+
+So, we need to remove the page caches before send the SMB
+ioctl(FSCTL_SET_ZERO_DATA) to server.
+
+Fixes: 31742c5a33176 ("enable fallocate punch hole ("fallocate -p") for SMB3")
+Suggested-by: Pavel Shilovsky <pshilov@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Cc: stable@vger.kernel.org # v3.17
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -3036,6 +3036,12 @@ static long smb3_punch_hole(struct file
+ return rc;
+ }
+
++ /*
++ * We implement the punch hole through ioctl, so we need remove the page
++ * caches first, otherwise the data may be inconsistent with the server.
++ */
++ truncate_pagecache_range(inode, offset, offset + len - 1);
++
+ cifs_dbg(FYI, "Offset %lld len %lld\n", offset, len);
+
+ fsctl_buf.FileOffset = cpu_to_le64(offset);
--- /dev/null
+From 6b69040247e14b43419a520f841f2b3052833df9 Mon Sep 17 00:00:00 2001
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Date: Tue, 23 Jun 2020 07:31:54 -0400
+Subject: cifs/smb3: Fix data inconsistent when zero file range
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+commit 6b69040247e14b43419a520f841f2b3052833df9 upstream.
+
+CIFS implements the fallocate(FALLOC_FL_ZERO_RANGE) with send SMB
+ioctl(FSCTL_SET_ZERO_DATA) to server. It just set the range of the
+remote file to zero, but local page cache not update, then the data
+inconsistent with server, which leads the xfstest generic/008 failed.
+
+So we need to remove the local page caches before send SMB
+ioctl(FSCTL_SET_ZERO_DATA) to server. After next read, it will
+re-cache it.
+
+Fixes: 30175628bf7f5 ("[SMB3] Enable fallocate -z support for SMB3 mounts")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Cc: stable@vger.kernel.org # v3.17
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2970,6 +2970,11 @@ static long smb3_zero_range(struct file
+ trace_smb3_zero_enter(xid, cfile->fid.persistent_fid, tcon->tid,
+ ses->Suid, offset, len);
+
++ /*
++ * We zero the range through ioctl, so we need remove the page caches
++ * first, otherwise the data may be inconsistent with the server.
++ */
++ truncate_pagecache_range(inode, offset, offset + len - 1);
+
+ /* if file not oplocked can't be sure whether asking to extend size */
+ if (!CIFS_CACHE_READ(cifsi))
--- /dev/null
+From 632f24f09d5b7c8a2f94932c3391ca957ae76cc4 Mon Sep 17 00:00:00 2001
+From: Roman Bolshakov <r.bolshakov@yadro.com>
+Date: Fri, 5 Jun 2020 17:44:37 +0300
+Subject: scsi: qla2xxx: Keep initiator ports after RSCN
+
+From: Roman Bolshakov <r.bolshakov@yadro.com>
+
+commit 632f24f09d5b7c8a2f94932c3391ca957ae76cc4 upstream.
+
+The driver performs SCR (state change registration) in all modes including
+pure target mode.
+
+For each RSCN, scan_needed flag is set in qla2x00_handle_rscn() for the
+port mentioned in the RSCN and fabric rescan is scheduled. During the
+rescan, GNN_FT handler, qla24xx_async_gnnft_done() deletes session of the
+port that caused the RSCN.
+
+In target mode, the session deletion has an impact on ATIO handler,
+qlt_24xx_atio_pkt(). Target responds with SAM STATUS BUSY to I/O incoming
+from the deleted session. qlt_handle_cmd_for_atio() and
+qlt_handle_task_mgmt() return -EFAULT if they are not able to find session
+of the command/TMF, and that results in invocation of qlt_send_busy():
+
+ qlt_24xx_atio_pkt_all_vps: qla_target(0): type 6 ox_id 0014
+ qla_target(0): Unable to send command to target, sending BUSY status
+
+Such response causes command timeout on the initiator. Error handler thread
+on the initiator will be spawned to abort the commands:
+
+ scsi 23:0:0:0: tag#0 abort scheduled
+ scsi 23:0:0:0: tag#0 aborting command
+ qla2xxx [0000:af:00.0]-188c:23: Entered qla24xx_abort_command.
+ qla2xxx [0000:af:00.0]-801c:23: Abort command issued nexus=23:0:0 -- 0 2003.
+
+Command abort is rejected by target and fails (2003), error handler then
+tries to perform DEVICE RESET and TARGET RESET but they're also doomed to
+fail because TMFs are ignored for the deleted sessions.
+
+Then initiator makes BUS RESET that resets the link via
+qla2x00_full_login_lip(). BUS RESET succeeds and brings initiator port up,
+SAN switch detects that and sends RSCN to the target port and it fails
+again the same way as described above. It never goes out of the loop.
+
+The change breaks the RSCN loop by keeping initiator sessions mentioned in
+RSCN payload in all modes, including dual and pure target mode.
+
+Link: https://lore.kernel.org/r/20200605144435.27023-1-r.bolshakov@yadro.com
+Fixes: 2037ce49d30a ("scsi: qla2xxx: Fix stale session")
+Cc: Quinn Tran <qutran@marvell.com>
+Cc: Arun Easi <aeasi@marvell.com>
+Cc: Nilesh Javali <njavali@marvell.com>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Daniel Wagner <dwagner@suse.de>
+Cc: Himanshu Madhani <himanshu.madhani@oracle.com>
+Cc: Martin Wilck <mwilck@suse.com>
+Cc: stable@vger.kernel.org # v5.4+
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Shyam Sundar <ssundar@marvell.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3638,7 +3638,9 @@ void qla24xx_async_gnnft_done(scsi_qla_h
+ qla2x00_clear_loop_id(fcport);
+ fcport->flags |= FCF_FABRIC_DEVICE;
+ } else if (fcport->d_id.b24 != rp->id.b24 ||
+- fcport->scan_needed) {
++ (fcport->scan_needed &&
++ fcport->port_type != FCT_INITIATOR &&
++ fcport->port_type != FCT_NVME_INITIATOR)) {
+ qlt_schedule_sess_for_deletion(fcport);
+ }
+ fcport->d_id.b24 = rp->id.b24;
--- /dev/null
+From 936e6b85da0476dd2edac7c51c68072da9fb4ba2 Mon Sep 17 00:00:00 2001
+From: Steffen Maier <maier@linux.ibm.com>
+Date: Tue, 23 Jun 2020 16:02:42 +0200
+Subject: scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action
+
+From: Steffen Maier <maier@linux.ibm.com>
+
+commit 936e6b85da0476dd2edac7c51c68072da9fb4ba2 upstream.
+
+Suppose that, for unrelated reasons, FSF requests on behalf of recovery are
+very slow and can run into the ERP timeout.
+
+In the case at hand, we did adapter recovery to a large degree. However
+due to the slowness a LUN open is pending so the corresponding fc_rport
+remains blocked. After fast_io_fail_tmo we trigger close physical port
+recovery for the port under which the LUN should have been opened. The new
+higher order port recovery dismisses the pending LUN open ERP action and
+dismisses the pending LUN open FSF request. Such dismissal decouples the
+ERP action from the pending corresponding FSF request by setting
+zfcp_fsf_req->erp_action to NULL (among other things)
+[zfcp_erp_strategy_check_fsfreq()].
+
+If now the ERP timeout for the pending open LUN request runs out, we must
+not use zfcp_fsf_req->erp_action in the ERP timeout handler. This is a
+problem since v4.15 commit 75492a51568b ("s390/scsi: Convert timers to use
+timer_setup()"). Before that we intentionally only passed zfcp_erp_action
+as context argument to zfcp_erp_timeout_handler().
+
+Note: The lifetime of the corresponding zfcp_fsf_req object continues until
+a (late) response or an (unrelated) adapter recovery.
+
+Just like the regular response path ignores dismissed requests
+[zfcp_fsf_req_complete() => zfcp_fsf_protstatus_eval() => return early] the
+ERP timeout handler now needs to ignore dismissed requests. So simply
+return early in the ERP timeout handler if the FSF request is marked as
+dismissed in its status flags. To protect against the race where
+zfcp_erp_strategy_check_fsfreq() dismisses and sets
+zfcp_fsf_req->erp_action to NULL after our previous status flag check,
+return early if zfcp_fsf_req->erp_action is NULL. After all, the former
+ERP action does not need to be woken up as that was already done as part of
+the dismissal above [zfcp_erp_action_dismiss()].
+
+This fixes the following panic due to kernel page fault in IRQ context:
+
+Unable to handle kernel pointer dereference in virtual kernel address space
+Failing address: 0000000000000000 TEID: 0000000000000483
+Fault in home space mode while using kernel ASCE.
+AS:000009859238c00b R2:00000e3e7ffd000b R3:00000e3e7ffcc007 S:00000e3e7ffd7000 P:000000000000013d
+Oops: 0004 ilc:2 [#1] SMP
+Modules linked in: ...
+CPU: 82 PID: 311273 Comm: stress Kdump: loaded Tainted: G E X ...
+Hardware name: IBM 8561 T01 701 (LPAR)
+Krnl PSW : 0404c00180000000 001fffff80549be0 (zfcp_erp_notify+0x40/0xc0 [zfcp])
+ R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3
+Krnl GPRS: 0000000000000080 00000e3d00000000 00000000000000f0 0000000000030000
+ 000000010028e700 000000000400a39c 000000010028e700 00000e3e7cf87e02
+ 0000000010000000 0700098591cb67f0 0000000000000000 0000000000000000
+ 0000033840e9a000 0000000000000000 001fffe008d6bc18 001fffe008d6bbc8
+Krnl Code: 001fffff80549bd4: a7180000 lhi %r1,0
+ 001fffff80549bd8: 4120a0f0 la %r2,240(%r10)
+ #001fffff80549bdc: a53e0003 llilh %r3,3
+ >001fffff80549be0: ba132000 cs %r1,%r3,0(%r2)
+ 001fffff80549be4: a7740037 brc 7,1fffff80549c52
+ 001fffff80549be8: e320b0180004 lg %r2,24(%r11)
+ 001fffff80549bee: e31020e00004 lg %r1,224(%r2)
+ 001fffff80549bf4: 412020e0 la %r2,224(%r2)
+Call Trace:
+ [<001fffff80549be0>] zfcp_erp_notify+0x40/0xc0 [zfcp]
+ [<00000985915e26f0>] call_timer_fn+0x38/0x190
+ [<00000985915e2944>] expire_timers+0xfc/0x190
+ [<00000985915e2ac4>] run_timer_softirq+0xec/0x218
+ [<0000098591ca7c4c>] __do_softirq+0x144/0x398
+ [<00000985915110aa>] do_softirq_own_stack+0x72/0x88
+ [<0000098591551b58>] irq_exit+0xb0/0xb8
+ [<0000098591510c6a>] do_IRQ+0x82/0xb0
+ [<0000098591ca7140>] ext_int_handler+0x128/0x12c
+ [<0000098591722d98>] clear_subpage.constprop.13+0x38/0x60
+([<000009859172ae4c>] clear_huge_page+0xec/0x250)
+ [<000009859177e7a2>] do_huge_pmd_anonymous_page+0x32a/0x768
+ [<000009859172a712>] __handle_mm_fault+0x88a/0x900
+ [<000009859172a860>] handle_mm_fault+0xd8/0x1b0
+ [<0000098591529ef6>] do_dat_exception+0x136/0x3e8
+ [<0000098591ca6d34>] pgm_check_handler+0x1c8/0x220
+Last Breaking-Event-Address:
+ [<001fffff80549c88>] zfcp_erp_timeout_handler+0x10/0x18 [zfcp]
+Kernel panic - not syncing: Fatal exception in interrupt
+
+Link: https://lore.kernel.org/r/20200623140242.98864-1-maier@linux.ibm.com
+Fixes: 75492a51568b ("s390/scsi: Convert timers to use timer_setup()")
+Cc: <stable@vger.kernel.org> #4.15+
+Reviewed-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/scsi/zfcp_erp.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -576,7 +576,10 @@ static void zfcp_erp_strategy_check_fsfr
+ ZFCP_STATUS_ERP_TIMEDOUT)) {
+ req->status |= ZFCP_STATUS_FSFREQ_DISMISSED;
+ zfcp_dbf_rec_run("erscf_1", act);
+- req->erp_action = NULL;
++ /* lock-free concurrent access with
++ * zfcp_erp_timeout_handler()
++ */
++ WRITE_ONCE(req->erp_action, NULL);
+ }
+ if (act->status & ZFCP_STATUS_ERP_TIMEDOUT)
+ zfcp_dbf_rec_run("erscf_2", act);
+@@ -612,8 +615,14 @@ void zfcp_erp_notify(struct zfcp_erp_act
+ void zfcp_erp_timeout_handler(struct timer_list *t)
+ {
+ struct zfcp_fsf_req *fsf_req = from_timer(fsf_req, t, timer);
+- struct zfcp_erp_action *act = fsf_req->erp_action;
++ struct zfcp_erp_action *act;
+
++ if (fsf_req->status & ZFCP_STATUS_FSFREQ_DISMISSED)
++ return;
++ /* lock-free concurrent access with zfcp_erp_strategy_check_fsfreq() */
++ act = READ_ONCE(fsf_req->erp_action);
++ if (!act)
++ return;
+ zfcp_erp_notify(act, ZFCP_STATUS_ERP_TIMEDOUT);
+ }
+
usb-cdns3-trace-using-correct-dir-value.patch
usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch
usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch
+scsi-qla2xxx-keep-initiator-ports-after-rscn.patch
+scsi-zfcp-fix-panic-on-erp-timeout-for-previously-dismissed-erp-action.patch
+cifs-fix-cached_fid-refcnt-leak-in-open_shroot.patch
+cifs-smb3-fix-data-inconsistent-when-punch-hole.patch
+cifs-smb3-fix-data-inconsistent-when-zero-file-range.patch
+xhci-fix-incorrect-ep_state_mask.patch
+xhci-fix-enumeration-issue-when-setting-max-packet-size-for-fs-devices.patch
+xhci-return-if-xhci-doesn-t-support-lpm.patch
+cdc-acm-add-disable_echo-quirk-for-microchip-smsc-chip.patch
--- /dev/null
+From a73d9d9cfc3cfceabd91fb0b0c13e4062b6dbcd7 Mon Sep 17 00:00:00 2001
+From: Al Cooper <alcooperx@gmail.com>
+Date: Wed, 24 Jun 2020 16:59:46 +0300
+Subject: xhci: Fix enumeration issue when setting max packet size for FS devices.
+
+From: Al Cooper <alcooperx@gmail.com>
+
+commit a73d9d9cfc3cfceabd91fb0b0c13e4062b6dbcd7 upstream.
+
+Unable to complete the enumeration of a USB TV Tuner device.
+
+Per XHCI spec (4.6.5), the EP state field of the input context shall
+be cleared for a set address command. In the special case of an FS
+device that has "MaxPacketSize0 = 8", the Linux XHCI driver does
+not do this before evaluating the context. With an XHCI controller
+that checks the EP state field for parameter context error this
+causes a problem in cases such as the device getting reset again
+after enumeration.
+
+When that field is cleared, the problem does not occur.
+
+This was found and fixed by Sasi Kumar.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Al Cooper <alcooperx@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200624135949.22611-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1430,6 +1430,7 @@ static int xhci_check_maxpacket(struct x
+ xhci->devs[slot_id]->out_ctx, ep_index);
+
+ ep_ctx = xhci_get_ep_ctx(xhci, command->in_ctx, ep_index);
++ ep_ctx->ep_info &= cpu_to_le32(~EP_STATE_MASK);/* must clear */
+ ep_ctx->ep_info2 &= cpu_to_le32(~MAX_PACKET_MASK);
+ ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet_size));
+
--- /dev/null
+From dceea67058fe22075db3aed62d5cb62092be5053 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Wed, 24 Jun 2020 16:59:45 +0300
+Subject: xhci: Fix incorrect EP_STATE_MASK
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit dceea67058fe22075db3aed62d5cb62092be5053 upstream.
+
+EP_STATE_MASK should be 0x7 instead of 0xf
+
+xhci spec 6.2.3 shows that the EP state field in the endpoint context data
+structure consist of bits [2:0].
+The old value included a bit from the next field which fortunately is a
+ RsvdZ region. So hopefully this hasn't caused too much harm
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200624135949.22611-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -716,7 +716,7 @@ struct xhci_ep_ctx {
+ * 4 - TRB error
+ * 5-7 - reserved
+ */
+-#define EP_STATE_MASK (0xf)
++#define EP_STATE_MASK (0x7)
+ #define EP_STATE_DISABLED 0
+ #define EP_STATE_RUNNING 1
+ #define EP_STATE_HALTED 2
--- /dev/null
+From f0c472a6da51f9fac15e80fe2fd9c83b68754cff Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Wed, 24 Jun 2020 16:59:48 +0300
+Subject: xhci: Return if xHCI doesn't support LPM
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit f0c472a6da51f9fac15e80fe2fd9c83b68754cff upstream.
+
+Just return if xHCI is quirked to disable LPM. We can save some time
+from reading registers and doing spinlocks.
+
+Add stable tag as we want this patch together with the next one,
+"Poll for U0 after disabling USB2 LPM" which fixes a suspend issue
+for some USB2 LPM devices
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200624135949.22611-5-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4391,6 +4391,9 @@ static int xhci_set_usb2_hardware_lpm(st
+ int hird, exit_latency;
+ int ret;
+
++ if (xhci->quirks & XHCI_HW_LPM_DISABLE)
++ return -EPERM;
++
+ if (hcd->speed >= HCD_USB3 || !xhci->hw_lpm_support ||
+ !udev->lpm_capable)
+ return -EPERM;
+@@ -4413,7 +4416,7 @@ static int xhci_set_usb2_hardware_lpm(st
+ xhci_dbg(xhci, "%s port %d USB2 hardware LPM\n",
+ enable ? "enable" : "disable", port_num + 1);
+
+- if (enable && !(xhci->quirks & XHCI_HW_LPM_DISABLE)) {
++ if (enable) {
+ /* Host supports BESL timeout instead of HIRD */
+ if (udev->usb2_hw_lpm_besl_capable) {
+ /* if device doesn't have a preferred BESL value use a
projects / thirdparty / kernel / stable-queue.git / commitdiff
