--- /dev/null
+From 3d1cf435e201d1fd63e4346b141881aed086effd Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Fri, 15 Jan 2021 19:30:51 +0100
+Subject: driver core: Extend device_is_dependent()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 3d1cf435e201d1fd63e4346b141881aed086effd upstream.
+
+If the device passed as the target (second argument) to
+device_is_dependent() is not completely registered (that is, it has
+been initialized, but not added yet), but the parent pointer of it
+is set, it may be missing from the list of the parent's children
+and device_for_each_child() called by device_is_dependent() cannot
+be relied on to catch that dependency.
+
+For this reason, modify device_is_dependent() to check the ancestors
+of the target device by following its parent pointer in addition to
+the device_for_each_child() walk.
+
+Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
+Reported-by: Stephan Gerhold <stephan@gerhold.net>
+Tested-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Saravana Kannan <saravanak@google.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/17705994.d592GUb2YH@kreacher
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/core.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -93,6 +93,16 @@ void device_links_read_unlock(int not_us
+ }
+ #endif /* !CONFIG_SRCU */
+
++static bool device_is_ancestor(struct device *dev, struct device *target)
++{
++ while (target->parent) {
++ target = target->parent;
++ if (dev == target)
++ return true;
++ }
++ return false;
++}
++
+ /**
+ * device_is_dependent - Check if one device depends on another one
+ * @dev: Device to check dependencies for.
+@@ -106,7 +116,12 @@ static int device_is_dependent(struct de
+ struct device_link *link;
+ int ret;
+
+- if (dev == target)
++ /*
++ * The "ancestors" check is needed to catch the case when the target
++ * device has not been completely initialized yet and it is still
++ * missing from the list of children of its parent device.
++ */
++ if (dev == target || device_is_ancestor(dev, target))
+ return 1;
+
+ ret = device_for_each_child(dev, target, device_is_dependent);
--- /dev/null
+From 280a9045bb18833db921b316a5527d2b565e9f2e Mon Sep 17 00:00:00 2001
+From: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+Date: Sun, 10 Jan 2021 20:36:09 +0300
+Subject: ehci: fix EHCI host controller initialization sequence
+
+From: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+
+commit 280a9045bb18833db921b316a5527d2b565e9f2e upstream.
+
+According to EHCI spec, EHCI HC clears USBSTS.HCHalted whenever
+USBCMD.RS=1.
+
+However, it is a good practice to wait some time after setting USBCMD.RS
+(approximately 100ms) until USBSTS.HCHalted become zero.
+
+Without this waiting, VirtualBox's EHCI virtual HC accidentally hangs
+(see BugLink).
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211095
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210110173609.GA17313@himera.home
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hcd.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -574,6 +574,7 @@ static int ehci_run (struct usb_hcd *hcd
+ struct ehci_hcd *ehci = hcd_to_ehci (hcd);
+ u32 temp;
+ u32 hcc_params;
++ int rc;
+
+ hcd->uses_new_polling = 1;
+
+@@ -629,9 +630,20 @@ static int ehci_run (struct usb_hcd *hcd
+ down_write(&ehci_cf_port_reset_rwsem);
+ ehci->rh_state = EHCI_RH_RUNNING;
+ ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
++
++ /* Wait until HC become operational */
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+ msleep(5);
++ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
++
+ up_write(&ehci_cf_port_reset_rwsem);
++
++ if (rc) {
++ ehci_err(ehci, "USB %x.%x, controller refused to start: %d\n",
++ ((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f), rc);
++ return rc;
++ }
++
+ ehci->last_periodic_enable = ktime_get_real();
+
+ temp = HC_VERSION(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
--- /dev/null
+From efd597b2839a9895e8a98fcb0b76d2f545802cd4 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 9 Dec 2020 11:46:49 +0100
+Subject: iio: ad5504: Fix setting power-down state
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit efd597b2839a9895e8a98fcb0b76d2f545802cd4 upstream.
+
+The power-down mask of the ad5504 is actually a power-up mask. Meaning if
+a bit is set the corresponding channel is powered up and if it is not set
+the channel is powered down.
+
+The driver currently has this the wrong way around, resulting in the
+channel being powered up when requested to be powered down and vice versa.
+
+Fixes: 3bbbf150ffde ("staging:iio:dac:ad5504: Use strtobool for boolean values")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Link: https://lore.kernel.org/r/20201209104649.5794-1-lars@metafoo.de
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/dac/ad5504.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/dac/ad5504.c
++++ b/drivers/iio/dac/ad5504.c
+@@ -189,9 +189,9 @@ static ssize_t ad5504_write_dac_powerdow
+ return ret;
+
+ if (pwr_down)
+- st->pwr_down_mask |= (1 << chan->channel);
+- else
+ st->pwr_down_mask &= ~(1 << chan->channel);
++ else
++ st->pwr_down_mask |= (1 << chan->channel);
+
+ ret = ad5504_spi_write(st, AD5504_ADDR_CTRL,
+ AD5504_DAC_PWRDWN_MODE(st->pwr_down_mode) |
--- /dev/null
+From cb5c681ab9037e25fcca20689c82cf034566d610 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 15 Jan 2021 22:59:17 +0300
+Subject: intel_th: pci: Add Alder Lake-P support
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit cb5c681ab9037e25fcca20689c82cf034566d610 upstream.
+
+This adds support for the Trace Hub in Alder Lake-P.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115195917.3184-3-alexander.shishkin@linux.intel.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -231,6 +231,11 @@ static const struct pci_device_id intel_
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
+ {
++ /* Alder Lake-P */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x51a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
+ /* Emmitsburg PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1bcc),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
--- /dev/null
+From 599b3063adf4bf041a87a69244ee36aded0d878f Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Thu, 7 Jan 2021 22:36:03 +0100
+Subject: irqchip/mips-cpu: Set IPI domain parent chip
+
+From: Mathias Kresin <dev@kresin.me>
+
+commit 599b3063adf4bf041a87a69244ee36aded0d878f upstream.
+
+Since commit 55567976629e ("genirq/irqdomain: Allow partial trimming of
+irq_data hierarchy") the irq_data chain is valided.
+
+The irq_domain_trim_hierarchy() function doesn't consider the irq + ipi
+domain hierarchy as valid, since the ipi domain has the irq domain set
+as parent, but the parent domain has no chip set. Hence the boot ends in
+a kernel panic.
+
+Set the chip for the parent domain as it is done in the mips gic irq
+driver, to have a valid irq_data chain.
+
+Fixes: 3838a547fda2 ("irqchip: mips-cpu: Introduce IPI IRQ domain support")
+Cc: <stable@vger.kernel.org> # v5.10+
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210107213603.1637781-1-dev@kresin.me
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-mips-cpu.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/irqchip/irq-mips-cpu.c
++++ b/drivers/irqchip/irq-mips-cpu.c
+@@ -201,6 +201,13 @@ static int mips_cpu_ipi_alloc(struct irq
+ if (ret)
+ return ret;
+
++ ret = irq_domain_set_hwirq_and_chip(domain->parent, virq + i, hwirq,
++ &mips_mt_cpu_irq_controller,
++ NULL);
++
++ if (ret)
++ return ret;
++
+ ret = irq_set_irq_type(virq + i, IRQ_TYPE_LEVEL_HIGH);
+ if (ret)
+ return ret;
--- /dev/null
+From 54ca955b5a4024e2ce0f206b03adb7109bc4da26 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Wed, 23 Dec 2020 20:19:31 +0100
+Subject: serial: mvebu-uart: fix tx lost characters at power off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+commit 54ca955b5a4024e2ce0f206b03adb7109bc4da26 upstream.
+
+Commit c685af1108d7 ("serial: mvebu-uart: fix tx lost characters") fixed tx
+lost characters at low baud rates but started causing tx lost characters
+when kernel is going to power off or reboot.
+
+TX_EMP tells us when transmit queue is empty therefore all characters were
+transmitted. TX_RDY tells us when CPU can send a new character.
+
+Therefore we need to use different check prior transmitting new character
+and different check after all characters were sent.
+
+This patch splits polling code into two functions: wait_for_xmitr() which
+waits for TX_RDY and wait_for_xmite() which waits for TX_EMP.
+
+When rebooting A3720 platform without this patch on UART is print only:
+[ 42.699�
+
+And with this patch on UART is full output:
+[ 39.530216] reboot: Restarting system
+
+Fixes: c685af1108d7 ("serial: mvebu-uart: fix tx lost characters")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201223191931.18343-1-pali@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/mvebu-uart.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -637,6 +637,14 @@ static void wait_for_xmitr(struct uart_p
+ (val & STAT_TX_RDY(port)), 1, 10000);
+ }
+
++static void wait_for_xmite(struct uart_port *port)
++{
++ u32 val;
++
++ readl_poll_timeout_atomic(port->membase + UART_STAT, val,
++ (val & STAT_TX_EMP), 1, 10000);
++}
++
+ static void mvebu_uart_console_putchar(struct uart_port *port, int ch)
+ {
+ wait_for_xmitr(port);
+@@ -664,7 +672,7 @@ static void mvebu_uart_console_write(str
+
+ uart_console_write(port, s, count, mvebu_uart_console_putchar);
+
+- wait_for_xmitr(port);
++ wait_for_xmite(port);
+
+ if (ier)
+ writel(ier, port->membase + UART_CTRL(port));
can-dev-can_restart-fix-use-after-free-bug.patch
can-vxcan-vxcan_xmit-fix-use-after-free-bug.patch
can-peak_usb-fix-use-after-free-bugs.patch
+iio-ad5504-fix-setting-power-down-state.patch
+irqchip-mips-cpu-set-ipi-domain-parent-chip.patch
+intel_th-pci-add-alder-lake-p-support.patch
+stm-class-fix-module-init-return-on-allocation-failure.patch
+serial-mvebu-uart-fix-tx-lost-characters-at-power-off.patch
+ehci-fix-ehci-host-controller-initialization-sequence.patch
+usb-ehci-fix-an-interrupt-calltrace-error.patch
+usb-gadget-aspeed-fix-stop-dma-register-setting.patch
+usb-udc-core-use-lock-when-write-to-soft_connect.patch
+usb-bdc-make-bdc-pci-driver-depend-on-broken.patch
+xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch
+xhci-tegra-delay-for-disabling-lfps-detector.patch
+driver-core-extend-device_is_dependent.patch
--- /dev/null
+From 927633a6d20af319d986f3e42c3ef9f6d7835008 Mon Sep 17 00:00:00 2001
+From: Wang Hui <john.wanghui@huawei.com>
+Date: Fri, 15 Jan 2021 22:59:16 +0300
+Subject: stm class: Fix module init return on allocation failure
+
+From: Wang Hui <john.wanghui@huawei.com>
+
+commit 927633a6d20af319d986f3e42c3ef9f6d7835008 upstream.
+
+In stm_heartbeat_init(): return value gets reset after the first
+iteration by stm_source_register_device(), so allocation failures
+after that will, after a clean up, return success. Fix that.
+
+Fixes: 119291853038 ("stm class: Add heartbeat stm source device")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hui <john.wanghui@huawei.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115195917.3184-2-alexander.shishkin@linux.intel.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/heartbeat.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwtracing/stm/heartbeat.c
++++ b/drivers/hwtracing/stm/heartbeat.c
+@@ -64,7 +64,7 @@ static void stm_heartbeat_unlink(struct
+
+ static int stm_heartbeat_init(void)
+ {
+- int i, ret = -ENOMEM;
++ int i, ret;
+
+ if (nr_devs < 0 || nr_devs > STM_HEARTBEAT_MAX)
+ return -EINVAL;
+@@ -72,8 +72,10 @@ static int stm_heartbeat_init(void)
+ for (i = 0; i < nr_devs; i++) {
+ stm_heartbeat[i].data.name =
+ kasprintf(GFP_KERNEL, "heartbeat.%d", i);
+- if (!stm_heartbeat[i].data.name)
++ if (!stm_heartbeat[i].data.name) {
++ ret = -ENOMEM;
+ goto fail_unregister;
++ }
+
+ stm_heartbeat[i].data.nr_chans = 1;
+ stm_heartbeat[i].data.link = stm_heartbeat_link;
--- /dev/null
+From ef02684c4e67d8c35ac83083564135bc7b1d3445 Mon Sep 17 00:00:00 2001
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Date: Mon, 18 Jan 2021 21:36:15 +0100
+Subject: usb: bdc: Make bdc pci driver depend on BROKEN
+
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+
+commit ef02684c4e67d8c35ac83083564135bc7b1d3445 upstream.
+
+The bdc pci driver is going to be removed due to it not existing in the
+wild. This patch turns off compilation of the driver so that stable
+kernels can also pick up the change. This helps the out-of-tree
+facetimehd webcam driver as the pci id conflicts with bdc.
+
+Cc: Al Cooper <alcooperx@gmail.com>
+Cc: <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://lore.kernel.org/r/20210118203615.13995-1-patrik.r.jakobsson@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/bdc/Kconfig
++++ b/drivers/usb/gadget/udc/bdc/Kconfig
+@@ -15,7 +15,7 @@ if USB_BDC_UDC
+ comment "Platform Support"
+ config USB_BDC_PCI
+ tristate "BDC support for PCIe based platforms"
+- depends on USB_PCI
++ depends on USB_PCI && BROKEN
+ default USB_BDC_UDC
+ help
+ Enable support for platforms which have BDC connected through PCIe, such as Lego3 FPGA platform.
--- /dev/null
+From 643a4df7fe3f6831d14536fd692be85f92670a52 Mon Sep 17 00:00:00 2001
+From: Longfang Liu <liulongfang@huawei.com>
+Date: Tue, 12 Jan 2021 09:57:27 +0800
+Subject: USB: ehci: fix an interrupt calltrace error
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+commit 643a4df7fe3f6831d14536fd692be85f92670a52 upstream.
+
+The system that use Synopsys USB host controllers goes to suspend
+when using USB audio player. This causes the USB host controller
+continuous send interrupt signal to system, When the number of
+interrupts exceeds 100000, the system will forcibly close the
+interrupts and output a calltrace error.
+
+When the system goes to suspend, the last interrupt is reported to
+the driver. At this time, the system has set the state to suspend.
+This causes the last interrupt to not be processed by the system and
+not clear the interrupt flag. This uncleared interrupt flag constantly
+triggers new interrupt event. This causing the driver to receive more
+than 100,000 interrupts, which causes the system to forcibly close the
+interrupt report and report the calltrace error.
+
+so, when the driver goes to sleep and changes the system state to
+suspend, the interrupt flag needs to be cleared.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/1610416647-45774-1-git-send-email-liulongfang@huawei.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hub.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -345,6 +345,9 @@ static int ehci_bus_suspend (struct usb_
+
+ unlink_empty_async_suspended(ehci);
+
++ /* Some Synopsys controllers mistakenly leave IAA turned on */
++ ehci_writel(ehci, STS_IAA, &ehci->regs->status);
++
+ /* Any IAA cycle that started before the suspend is now invalid */
+ end_iaa_cycle(ehci);
+ ehci_handle_start_intr_unlinks(ehci);
--- /dev/null
+From 4e0dcf62ab4cf917d0cbe751b8bf229a065248d4 Mon Sep 17 00:00:00 2001
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+Date: Fri, 8 Jan 2021 16:12:38 +0800
+Subject: usb: gadget: aspeed: fix stop dma register setting.
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+commit 4e0dcf62ab4cf917d0cbe751b8bf229a065248d4 upstream.
+
+The vhub engine has two dma mode, one is descriptor list, another
+is single stage DMA. Each mode has different stop register setting.
+Descriptor list operation (bit2) : 0 disable reset, 1: enable reset
+Single mode operation (bit0) : 0 : disable, 1: enable
+
+Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Acked-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://lore.kernel.org/r/20210108081238.10199-2-ryan_chen@aspeedtech.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+@@ -420,7 +420,10 @@ static void ast_vhub_stop_active_req(str
+ u32 state, reg, loops;
+
+ /* Stop DMA activity */
+- writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
++ if (ep->epn.desc_mode)
++ writel(VHUB_EP_DMA_CTRL_RESET, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
++ else
++ writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
+
+ /* Wait for it to complete */
+ for (loops = 0; loops < 1000; loops++) {
--- /dev/null
+From c28095bc99073ddda65e4f31f6ae0d908d4d5cd8 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Thu, 14 Jan 2021 00:09:51 -0800
+Subject: usb: udc: core: Use lock when write to soft_connect
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit c28095bc99073ddda65e4f31f6ae0d908d4d5cd8 upstream.
+
+Use lock to guard against concurrent access for soft-connect/disconnect
+operations when writing to soft_connect sysfs.
+
+Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class")
+Cc: stable@vger.kernel.org
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/338ea01fbd69b1985ef58f0f59af02c805ddf189.1610611437.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/core.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1471,10 +1471,13 @@ static ssize_t soft_connect_store(struct
+ struct device_attribute *attr, const char *buf, size_t n)
+ {
+ struct usb_udc *udc = container_of(dev, struct usb_udc, dev);
++ ssize_t ret;
+
++ mutex_lock(&udc_lock);
+ if (!udc->driver) {
+ dev_err(dev, "soft-connect without a gadget driver\n");
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto out;
+ }
+
+ if (sysfs_streq(buf, "connect")) {
+@@ -1486,10 +1489,14 @@ static ssize_t soft_connect_store(struct
+ usb_gadget_udc_stop(udc);
+ } else {
+ dev_err(dev, "unsupported command '%s'\n", buf);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+
+- return n;
++ ret = n;
++out:
++ mutex_unlock(&udc_lock);
++ return ret;
+ }
+ static DEVICE_ATTR_WO(soft_connect);
+
--- /dev/null
+From 576667bad341516edc4e18eb85acb0a2b4c9c9d9 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 15 Jan 2021 18:19:06 +0200
+Subject: xhci: make sure TRB is fully written before giving it to the controller
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 576667bad341516edc4e18eb85acb0a2b4c9c9d9 upstream.
+
+Once the command ring doorbell is rung the xHC controller will parse all
+command TRBs on the command ring that have the cycle bit set properly.
+
+If the driver just started writing the next command TRB to the ring when
+hardware finished the previous TRB, then HW might fetch an incomplete TRB
+as long as its cycle bit set correctly.
+
+A command TRB is 16 bytes (128 bits) long.
+Driver writes the command TRB in four 32 bit chunks, with the chunk
+containing the cycle bit last. This does however not guarantee that
+chunks actually get written in that order.
+
+This was detected in stress testing when canceling URBs with several
+connected USB devices.
+Two consecutive "Set TR Dequeue pointer" commands got queued right
+after each other, and the second one was only partially written when
+the controller parsed it, causing the dequeue pointer to be set
+to bogus values. This was seen as error messages:
+
+"Mismatch between completed Set TR Deq Ptr command & xHCI internal state"
+
+Solution is to add a write memory barrier before writing the cycle bit.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Ross Zwisler <zwisler@google.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115161907.2875631-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2835,6 +2835,8 @@ static void queue_trb(struct xhci_hcd *x
+ trb->field[0] = cpu_to_le32(field1);
+ trb->field[1] = cpu_to_le32(field2);
+ trb->field[2] = cpu_to_le32(field3);
++ /* make sure TRB is fully written before giving it to the controller */
++ wmb();
+ trb->field[3] = cpu_to_le32(field4);
+
+ trace_xhci_queue_trb(ring, trb);
--- /dev/null
+From da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb Mon Sep 17 00:00:00 2001
+From: JC Kuo <jckuo@nvidia.com>
+Date: Fri, 15 Jan 2021 18:19:07 +0200
+Subject: xhci: tegra: Delay for disabling LFPS detector
+
+From: JC Kuo <jckuo@nvidia.com>
+
+commit da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb upstream.
+
+Occasionally, we are seeing some SuperSpeed devices resumes right after
+being directed to U3. This commits add 500us delay to ensure LFPS
+detector is disabled before sending ACK to firmware.
+
+[ 16.099363] tegra-xusb 70090000.usb: entering ELPG
+[ 16.104343] tegra-xusb 70090000.usb: 2-1 isn't suspended: 0x0c001203
+[ 16.114576] tegra-xusb 70090000.usb: not all ports suspended: -16
+[ 16.120789] tegra-xusb 70090000.usb: entering ELPG failed
+
+The register write passes through a few flop stages of 32KHz clock domain.
+NVIDIA ASIC designer reviewed RTL and suggests 500us delay.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: JC Kuo <jckuo@nvidia.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115161907.2875631-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-tegra.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -578,6 +578,13 @@ static void tegra_xusb_mbox_handle(struc
+ enable);
+ if (err < 0)
+ break;
++
++ /*
++ * wait 500us for LFPS detector to be disabled before
++ * sending ACK
++ */
++ if (!enable)
++ usleep_range(500, 1000);
+ }
+
+ if (err < 0) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
