-usb-dwc3-qcom-add-helper-functions-to-enable-disable.patch
-usb-dwc3-qcom-configure-wakeup-interrupts-during-sus.patch
-usb-dwc3-qcom-fix-use-after-free-on-runtime-pm-wakeu.patch
drm-i915-extract-intel_edp_fixup_vbt_bpp.patch
drm-i915-pps-split-pps_init_delays-into-distinct-par.patch
drm-i915-bios-split-parse_driver_features-into-two-p.patch
revert-usb-add-quirks-for-lenovo-onelink-dock.patch
revert-usb-gadget-udc-xilinx-replace-memcpy-with-mem.patch
xfrm-fix-xfrma_lastused-comment.patch
-usb-dwc3-qcom-fix-gadget-only-builds.patch
-usb-dwc3-qcom-fix-runtime-pm-wakeup.patch
-usb-dwc3-qcom-fix-peripheral-and-otg-suspend.patch
block-remove-queue_flag_dead.patch
block-stop-setting-the-nomerges-flags-in-blk_cleanup.patch
block-simplify-disk-shutdown.patch
+++ /dev/null
-From 78f61759ac383ddf34cd93009ea6eae1a75c234f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Jun 2022 10:00:52 +0530
-Subject: usb: dwc3: qcom: Add helper functions to enable,disable wake irqs
-
-From: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
-
-[ Upstream commit 360e8230516de94d74d30c64f0cdcf228b8e8b67 ]
-
-Adding helper functions to enable,disable wake irqs to make
-the code simple and readable.
-
-Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
-Reviewed-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
-Signed-off-by: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
-Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
-Link: https://lore.kernel.org/r/1655094654-24052-4-git-send-email-quic_kriskura@quicinc.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Stable-dep-of: a872ab303d5d ("usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/dwc3-qcom.c | 58 ++++++++++++++++--------------------
- 1 file changed, 26 insertions(+), 32 deletions(-)
-
-diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
-index 3582fd6dfa14..27ff18aeea26 100644
---- a/drivers/usb/dwc3/dwc3-qcom.c
-+++ b/drivers/usb/dwc3/dwc3-qcom.c
-@@ -296,50 +296,44 @@ static void dwc3_qcom_interconnect_exit(struct dwc3_qcom *qcom)
- icc_put(qcom->icc_path_apps);
- }
-
-+static void dwc3_qcom_enable_wakeup_irq(int irq)
-+{
-+ if (!irq)
-+ return;
-+
-+ enable_irq(irq);
-+ enable_irq_wake(irq);
-+}
-+
-+static void dwc3_qcom_disable_wakeup_irq(int irq)
-+{
-+ if (!irq)
-+ return;
-+
-+ disable_irq_wake(irq);
-+ disable_irq_nosync(irq);
-+}
-+
- static void dwc3_qcom_disable_interrupts(struct dwc3_qcom *qcom)
- {
-- if (qcom->hs_phy_irq) {
-- disable_irq_wake(qcom->hs_phy_irq);
-- disable_irq_nosync(qcom->hs_phy_irq);
-- }
-+ dwc3_qcom_disable_wakeup_irq(qcom->hs_phy_irq);
-
-- if (qcom->dp_hs_phy_irq) {
-- disable_irq_wake(qcom->dp_hs_phy_irq);
-- disable_irq_nosync(qcom->dp_hs_phy_irq);
-- }
-+ dwc3_qcom_disable_wakeup_irq(qcom->dp_hs_phy_irq);
-
-- if (qcom->dm_hs_phy_irq) {
-- disable_irq_wake(qcom->dm_hs_phy_irq);
-- disable_irq_nosync(qcom->dm_hs_phy_irq);
-- }
-+ dwc3_qcom_disable_wakeup_irq(qcom->dm_hs_phy_irq);
-
-- if (qcom->ss_phy_irq) {
-- disable_irq_wake(qcom->ss_phy_irq);
-- disable_irq_nosync(qcom->ss_phy_irq);
-- }
-+ dwc3_qcom_disable_wakeup_irq(qcom->ss_phy_irq);
- }
-
- static void dwc3_qcom_enable_interrupts(struct dwc3_qcom *qcom)
- {
-- if (qcom->hs_phy_irq) {
-- enable_irq(qcom->hs_phy_irq);
-- enable_irq_wake(qcom->hs_phy_irq);
-- }
-+ dwc3_qcom_enable_wakeup_irq(qcom->hs_phy_irq);
-
-- if (qcom->dp_hs_phy_irq) {
-- enable_irq(qcom->dp_hs_phy_irq);
-- enable_irq_wake(qcom->dp_hs_phy_irq);
-- }
-+ dwc3_qcom_enable_wakeup_irq(qcom->dp_hs_phy_irq);
-
-- if (qcom->dm_hs_phy_irq) {
-- enable_irq(qcom->dm_hs_phy_irq);
-- enable_irq_wake(qcom->dm_hs_phy_irq);
-- }
-+ dwc3_qcom_enable_wakeup_irq(qcom->dm_hs_phy_irq);
-
-- if (qcom->ss_phy_irq) {
-- enable_irq(qcom->ss_phy_irq);
-- enable_irq_wake(qcom->ss_phy_irq);
-- }
-+ dwc3_qcom_enable_wakeup_irq(qcom->ss_phy_irq);
- }
-
- static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
---
-2.35.1
-
+++ /dev/null
-From 920c841d0403e84b90d9027060cdfa180d9dc5d2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Jun 2022 10:00:53 +0530
-Subject: usb: dwc3: qcom: Configure wakeup interrupts during suspend
-
-From: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
-
-[ Upstream commit 6895ea55c385c9afdd2aec1eef27ec24917a112f ]
-
-Configure DP/DM line interrupts based on the USB2 device attached to
-the root hub port. When HS/FS device is connected, configure the DP line
-as falling edge to detect both disconnect and remote wakeup scenarios. When
-LS device is connected, configure DM line as falling edge to detect both
-disconnect and remote wakeup. When no device is connected, configure both
-DP and DM lines as rising edge to detect HS/HS/LS device connect scenario.
-
-Reviewed-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
-Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
-Signed-off-by: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
-Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
-Link: https://lore.kernel.org/r/1655094654-24052-5-git-send-email-quic_kriskura@quicinc.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Stable-dep-of: a872ab303d5d ("usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/dwc3-qcom.c | 72 +++++++++++++++++++++++++++++++-----
- 1 file changed, 62 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
-index 27ff18aeea26..be2e3dd36440 100644
---- a/drivers/usb/dwc3/dwc3-qcom.c
-+++ b/drivers/usb/dwc3/dwc3-qcom.c
-@@ -20,7 +20,8 @@
- #include <linux/usb/of.h>
- #include <linux/reset.h>
- #include <linux/iopoll.h>
--
-+#include <linux/usb/hcd.h>
-+#include <linux/usb.h>
- #include "core.h"
-
- /* USB QSCRATCH Hardware registers */
-@@ -76,6 +77,7 @@ struct dwc3_qcom {
- int dp_hs_phy_irq;
- int dm_hs_phy_irq;
- int ss_phy_irq;
-+ enum usb_device_speed usb2_speed;
-
- struct extcon_dev *edev;
- struct extcon_dev *host_edev;
-@@ -296,11 +298,34 @@ static void dwc3_qcom_interconnect_exit(struct dwc3_qcom *qcom)
- icc_put(qcom->icc_path_apps);
- }
-
--static void dwc3_qcom_enable_wakeup_irq(int irq)
-+static enum usb_device_speed dwc3_qcom_read_usb2_speed(struct dwc3_qcom *qcom)
-+{
-+ struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
-+ struct usb_hcd *hcd = platform_get_drvdata(dwc->xhci);
-+ struct usb_device *udev;
-+
-+ /*
-+ * It is possible to query the speed of all children of
-+ * USB2.0 root hub via usb_hub_for_each_child(). DWC3 code
-+ * currently supports only 1 port per controller. So
-+ * this is sufficient.
-+ */
-+ udev = usb_hub_find_child(hcd->self.root_hub, 1);
-+
-+ if (!udev)
-+ return USB_SPEED_UNKNOWN;
-+
-+ return udev->speed;
-+}
-+
-+static void dwc3_qcom_enable_wakeup_irq(int irq, unsigned int polarity)
- {
- if (!irq)
- return;
-
-+ if (polarity)
-+ irq_set_irq_type(irq, polarity);
-+
- enable_irq(irq);
- enable_irq_wake(irq);
- }
-@@ -318,22 +343,47 @@ static void dwc3_qcom_disable_interrupts(struct dwc3_qcom *qcom)
- {
- dwc3_qcom_disable_wakeup_irq(qcom->hs_phy_irq);
-
-- dwc3_qcom_disable_wakeup_irq(qcom->dp_hs_phy_irq);
--
-- dwc3_qcom_disable_wakeup_irq(qcom->dm_hs_phy_irq);
-+ if (qcom->usb2_speed == USB_SPEED_LOW) {
-+ dwc3_qcom_disable_wakeup_irq(qcom->dm_hs_phy_irq);
-+ } else if ((qcom->usb2_speed == USB_SPEED_HIGH) ||
-+ (qcom->usb2_speed == USB_SPEED_FULL)) {
-+ dwc3_qcom_disable_wakeup_irq(qcom->dp_hs_phy_irq);
-+ } else {
-+ dwc3_qcom_disable_wakeup_irq(qcom->dp_hs_phy_irq);
-+ dwc3_qcom_disable_wakeup_irq(qcom->dm_hs_phy_irq);
-+ }
-
- dwc3_qcom_disable_wakeup_irq(qcom->ss_phy_irq);
- }
-
- static void dwc3_qcom_enable_interrupts(struct dwc3_qcom *qcom)
- {
-- dwc3_qcom_enable_wakeup_irq(qcom->hs_phy_irq);
-+ dwc3_qcom_enable_wakeup_irq(qcom->hs_phy_irq, 0);
-
-- dwc3_qcom_enable_wakeup_irq(qcom->dp_hs_phy_irq);
-+ /*
-+ * Configure DP/DM line interrupts based on the USB2 device attached to
-+ * the root hub port. When HS/FS device is connected, configure the DP line
-+ * as falling edge to detect both disconnect and remote wakeup scenarios. When
-+ * LS device is connected, configure DM line as falling edge to detect both
-+ * disconnect and remote wakeup. When no device is connected, configure both
-+ * DP and DM lines as rising edge to detect HS/HS/LS device connect scenario.
-+ */
-
-- dwc3_qcom_enable_wakeup_irq(qcom->dm_hs_phy_irq);
-+ if (qcom->usb2_speed == USB_SPEED_LOW) {
-+ dwc3_qcom_enable_wakeup_irq(qcom->dm_hs_phy_irq,
-+ IRQ_TYPE_EDGE_FALLING);
-+ } else if ((qcom->usb2_speed == USB_SPEED_HIGH) ||
-+ (qcom->usb2_speed == USB_SPEED_FULL)) {
-+ dwc3_qcom_enable_wakeup_irq(qcom->dp_hs_phy_irq,
-+ IRQ_TYPE_EDGE_FALLING);
-+ } else {
-+ dwc3_qcom_enable_wakeup_irq(qcom->dp_hs_phy_irq,
-+ IRQ_TYPE_EDGE_RISING);
-+ dwc3_qcom_enable_wakeup_irq(qcom->dm_hs_phy_irq,
-+ IRQ_TYPE_EDGE_RISING);
-+ }
-
-- dwc3_qcom_enable_wakeup_irq(qcom->ss_phy_irq);
-+ dwc3_qcom_enable_wakeup_irq(qcom->ss_phy_irq, 0);
- }
-
- static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
-@@ -355,8 +405,10 @@ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
- if (ret)
- dev_warn(qcom->dev, "failed to disable interconnect: %d\n", ret);
-
-- if (device_may_wakeup(qcom->dev))
-+ if (device_may_wakeup(qcom->dev)) {
-+ qcom->usb2_speed = dwc3_qcom_read_usb2_speed(qcom);
- dwc3_qcom_enable_interrupts(qcom);
-+ }
-
- qcom->is_suspended = true;
-
---
-2.35.1
-
+++ /dev/null
-From 0a5869f3029e815c934296d794467722ed4f533d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Aug 2022 17:09:55 +0200
-Subject: usb: dwc3: qcom: fix gadget-only builds
-
-From: Johan Hovold <johan+linaro@kernel.org>
-
-[ Upstream commit c06795f114a6c4a423b11c9d9bbeb77ecbfbaa8b ]
-
-A recent change added a dependency to the USB host stack and broke
-gadget-only builds of the driver.
-
-Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
-Reported-by: Randy Dunlap <rdunlap@infradead.org>
-Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
-Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
-Link: https://lore.kernel.org/r/20220804151001.23612-4-johan+linaro@kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/dwc3-qcom.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
-index b0ae73b0b1a1..6884026b9fad 100644
---- a/drivers/usb/dwc3/dwc3-qcom.c
-+++ b/drivers/usb/dwc3/dwc3-qcom.c
-@@ -318,8 +318,11 @@ static enum usb_device_speed dwc3_qcom_read_usb2_speed(struct dwc3_qcom *qcom)
- * currently supports only 1 port per controller. So
- * this is sufficient.
- */
-+#ifdef CONFIG_USB
- udev = usb_hub_find_child(hcd->self.root_hub, 1);
--
-+#else
-+ udev = NULL;
-+#endif
- if (!udev)
- return USB_SPEED_UNKNOWN;
-
---
-2.35.1
-
+++ /dev/null
-From a989a972abf4ae3f79bbff2d9dc9956eda25e2f0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Aug 2022 17:09:58 +0200
-Subject: usb: dwc3: qcom: fix peripheral and OTG suspend
-
-From: Johan Hovold <johan+linaro@kernel.org>
-
-[ Upstream commit c5f14abeb52b0177b940fd734133d383da3521d8 ]
-
-A recent commit implementing wakeup support in host mode instead broke
-suspend for peripheral and OTG mode.
-
-The hack that was added in the suspend path to determine the speed of
-any device connected to the USB2 bus not only accesses internal driver
-data for a child device, but also dereferences a NULL pointer or
-accesses freed data when the controller is not acting as host.
-
-There's no quick fix to the layering violation, but since reverting
-would leave us with broken suspend in host mode with wakeup triggering
-immediately, let's keep the hack for now.
-
-Fix the immediate issues by only checking the host bus speed and
-enabling wakeup interrupts when acting as host.
-
-Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
-Link: https://lore.kernel.org/r/20220804151001.23612-7-johan+linaro@kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/dwc3-qcom.c | 15 ++++++++++++---
- 1 file changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
-index 05b4666fde14..6ae0b7fc4e2c 100644
---- a/drivers/usb/dwc3/dwc3-qcom.c
-+++ b/drivers/usb/dwc3/dwc3-qcom.c
-@@ -309,8 +309,13 @@ static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)
- static enum usb_device_speed dwc3_qcom_read_usb2_speed(struct dwc3_qcom *qcom)
- {
- struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
-- struct usb_hcd *hcd = platform_get_drvdata(dwc->xhci);
- struct usb_device *udev;
-+ struct usb_hcd *hcd;
-+
-+ /*
-+ * FIXME: Fix this layering violation.
-+ */
-+ hcd = platform_get_drvdata(dwc->xhci);
-
- /*
- * It is possible to query the speed of all children of
-@@ -416,7 +421,11 @@ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom, bool wakeup)
- if (ret)
- dev_warn(qcom->dev, "failed to disable interconnect: %d\n", ret);
-
-- if (wakeup) {
-+ /*
-+ * The role is stable during suspend as role switching is done from a
-+ * freezable workqueue.
-+ */
-+ if (dwc3_qcom_is_host(qcom) && wakeup) {
- qcom->usb2_speed = dwc3_qcom_read_usb2_speed(qcom);
- dwc3_qcom_enable_interrupts(qcom);
- }
-@@ -434,7 +443,7 @@ static int dwc3_qcom_resume(struct dwc3_qcom *qcom, bool wakeup)
- if (!qcom->is_suspended)
- return 0;
-
-- if (wakeup)
-+ if (dwc3_qcom_is_host(qcom) && wakeup)
- dwc3_qcom_disable_interrupts(qcom);
-
- for (i = 0; i < qcom->num_clocks; i++) {
---
-2.35.1
-
+++ /dev/null
-From f9697a17ff2d5fe5d3a0052b6482c955060dec07 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Aug 2022 17:09:57 +0200
-Subject: usb: dwc3: qcom: fix runtime PM wakeup
-
-From: Johan Hovold <johan+linaro@kernel.org>
-
-[ Upstream commit 6498a96c8c9ce8ae4078e586a607851491e29a33 ]
-
-A device must enable wakeups during runtime suspend regardless of
-whether it is capable and allowed to wake the system up from system
-suspend.
-
-Fixes: 2664deb09306 ("usb: dwc3: qcom: Honor wakeup enabled/disabled state")
-Tested-by: Matthias Kaehlcke <mka@chromium.org>
-Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
-Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
-Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
-Link: https://lore.kernel.org/r/20220804151001.23612-6-johan+linaro@kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/dwc3-qcom.c | 19 +++++++++++--------
- 1 file changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
-index 6884026b9fad..05b4666fde14 100644
---- a/drivers/usb/dwc3/dwc3-qcom.c
-+++ b/drivers/usb/dwc3/dwc3-qcom.c
-@@ -397,7 +397,7 @@ static void dwc3_qcom_enable_interrupts(struct dwc3_qcom *qcom)
- dwc3_qcom_enable_wakeup_irq(qcom->ss_phy_irq, 0);
- }
-
--static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
-+static int dwc3_qcom_suspend(struct dwc3_qcom *qcom, bool wakeup)
- {
- u32 val;
- int i, ret;
-@@ -416,7 +416,7 @@ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
- if (ret)
- dev_warn(qcom->dev, "failed to disable interconnect: %d\n", ret);
-
-- if (device_may_wakeup(qcom->dev)) {
-+ if (wakeup) {
- qcom->usb2_speed = dwc3_qcom_read_usb2_speed(qcom);
- dwc3_qcom_enable_interrupts(qcom);
- }
-@@ -426,7 +426,7 @@ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
- return 0;
- }
-
--static int dwc3_qcom_resume(struct dwc3_qcom *qcom)
-+static int dwc3_qcom_resume(struct dwc3_qcom *qcom, bool wakeup)
- {
- int ret;
- int i;
-@@ -434,7 +434,7 @@ static int dwc3_qcom_resume(struct dwc3_qcom *qcom)
- if (!qcom->is_suspended)
- return 0;
-
-- if (device_may_wakeup(qcom->dev))
-+ if (wakeup)
- dwc3_qcom_disable_interrupts(qcom);
-
- for (i = 0; i < qcom->num_clocks; i++) {
-@@ -945,9 +945,11 @@ static int dwc3_qcom_remove(struct platform_device *pdev)
- static int __maybe_unused dwc3_qcom_pm_suspend(struct device *dev)
- {
- struct dwc3_qcom *qcom = dev_get_drvdata(dev);
-+ bool wakeup = device_may_wakeup(dev);
- int ret = 0;
-
-- ret = dwc3_qcom_suspend(qcom);
-+
-+ ret = dwc3_qcom_suspend(qcom, wakeup);
- if (!ret)
- qcom->pm_suspended = true;
-
-@@ -957,9 +959,10 @@ static int __maybe_unused dwc3_qcom_pm_suspend(struct device *dev)
- static int __maybe_unused dwc3_qcom_pm_resume(struct device *dev)
- {
- struct dwc3_qcom *qcom = dev_get_drvdata(dev);
-+ bool wakeup = device_may_wakeup(dev);
- int ret;
-
-- ret = dwc3_qcom_resume(qcom);
-+ ret = dwc3_qcom_resume(qcom, wakeup);
- if (!ret)
- qcom->pm_suspended = false;
-
-@@ -970,14 +973,14 @@ static int __maybe_unused dwc3_qcom_runtime_suspend(struct device *dev)
- {
- struct dwc3_qcom *qcom = dev_get_drvdata(dev);
-
-- return dwc3_qcom_suspend(qcom);
-+ return dwc3_qcom_suspend(qcom, true);
- }
-
- static int __maybe_unused dwc3_qcom_runtime_resume(struct device *dev)
- {
- struct dwc3_qcom *qcom = dev_get_drvdata(dev);
-
-- return dwc3_qcom_resume(qcom);
-+ return dwc3_qcom_resume(qcom, true);
- }
-
- static const struct dev_pm_ops dwc3_qcom_dev_pm_ops = {
---
-2.35.1
-
+++ /dev/null
-From 8dbc16b2e11c068a35bba2575b9c8e61b82ac2c0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Aug 2022 17:09:56 +0200
-Subject: usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
-
-From: Johan Hovold <johan+linaro@kernel.org>
-
-[ Upstream commit a872ab303d5ddd4c965f9cd868677781a33ce35a ]
-
-The Qualcomm dwc3 runtime-PM implementation checks the xhci
-platform-device pointer in the wakeup-interrupt handler to determine
-whether the controller is in host mode and if so triggers a resume.
-
-After a role switch in OTG mode the xhci platform-device would have been
-freed and the next wakeup from runtime suspend would access the freed
-memory.
-
-Note that role switching is executed from a freezable workqueue, which
-guarantees that the pointer is stable during suspend.
-
-Also note that runtime PM has been broken since commit 2664deb09306
-("usb: dwc3: qcom: Honor wakeup enabled/disabled state"), which
-incidentally also prevents this issue from being triggered.
-
-Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
-Cc: stable@vger.kernel.org # 4.18
-Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
-Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
-Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
-Link: https://lore.kernel.org/r/20220804151001.23612-5-johan+linaro@kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/dwc3-qcom.c | 14 +++++++++++++-
- drivers/usb/dwc3/host.c | 1 +
- 2 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
-index be2e3dd36440..b0ae73b0b1a1 100644
---- a/drivers/usb/dwc3/dwc3-qcom.c
-+++ b/drivers/usb/dwc3/dwc3-qcom.c
-@@ -298,6 +298,14 @@ static void dwc3_qcom_interconnect_exit(struct dwc3_qcom *qcom)
- icc_put(qcom->icc_path_apps);
- }
-
-+/* Only usable in contexts where the role can not change. */
-+static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)
-+{
-+ struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
-+
-+ return dwc->xhci;
-+}
-+
- static enum usb_device_speed dwc3_qcom_read_usb2_speed(struct dwc3_qcom *qcom)
- {
- struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
-@@ -457,7 +465,11 @@ static irqreturn_t qcom_dwc3_resume_irq(int irq, void *data)
- if (qcom->pm_suspended)
- return IRQ_HANDLED;
-
-- if (dwc->xhci)
-+ /*
-+ * This is safe as role switching is done from a freezable workqueue
-+ * and the wakeup interrupts are disabled as part of resume.
-+ */
-+ if (dwc3_qcom_is_host(qcom))
- pm_runtime_resume(&dwc->xhci->dev);
-
- return IRQ_HANDLED;
-diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
-index 06b3d988fbf3..a7154fe8206d 100644
---- a/drivers/usb/dwc3/host.c
-+++ b/drivers/usb/dwc3/host.c
-@@ -145,4 +145,5 @@ int dwc3_host_init(struct dwc3 *dwc)
- void dwc3_host_exit(struct dwc3 *dwc)
- {
- platform_device_unregister(dwc->xhci);
-+ dwc->xhci = NULL;
- }
---
-2.35.1
-
projects / thirdparty / kernel / stable-queue.git / commitdiff
