--- /dev/null
+From c8b177b6e3a005bd8fb0395a4bc5db3470301c28 Mon Sep 17 00:00:00 2001
+From: Alexander Tsoy <alexander@tsoy.me>
+Date: Tue, 31 Aug 2021 03:25:31 +0300
+Subject: ALSA: usb-audio: Add registration quirk for JBL Quantum 800
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+commit c8b177b6e3a005bd8fb0395a4bc5db3470301c28 upstream.
+
+Add another device ID for JBL Quantum 800. It requires the same quirk as
+other JBL Quantum devices.
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210831002531.116957-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1898,6 +1898,7 @@ static const struct registration_quirk r
+ REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
--- /dev/null
+From 6eefec4a0b668de9bbb33bd3e7acfbcc794162b0 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 4 Aug 2021 09:50:33 -0500
+Subject: Bluetooth: Add additional Bluetooth part for Realtek 8852AE
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 6eefec4a0b668de9bbb33bd3e7acfbcc794162b0 upstream.
+
+This Realtek device has both wifi and BT components. The latter reports
+a USB ID of 04ca:4006, which is not in the table.
+
+The portion of /sys/kernel/debug/usb/devices pertaining to this device is
+
+T: Bus=02 Lev=01 Prnt=01 Port=12 Cnt=04 Dev#= 4 Spd=12 MxCh= 0
+D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=04ca ProdID=4006 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=Bluetooth Radio
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Stable <stable@vger.kernel.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -452,6 +452,10 @@ static const struct usb_device_id blackl
+ /* Additional Realtek 8822CE Bluetooth devices */
+ { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ /* Bluetooth component of Realtek 8852AE device */
++ { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
++
+ { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
--- /dev/null
+From f4292e2faf522f899b642d2040a2edbcbd455b9f Mon Sep 17 00:00:00 2001
+From: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
+Date: Sat, 17 Jul 2021 01:21:43 +0200
+Subject: Bluetooth: btusb: Make the CSR clone chip force-suspend workaround more generic
+
+From: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
+
+commit f4292e2faf522f899b642d2040a2edbcbd455b9f upstream.
+
+Turns out Hans de Goede completed the work I started last year trying to
+improve Chinese-clone detection of CSR controller chips. Quirk after quirk
+these Bluetooth dongles are more usable now.
+
+Even after a few BlueZ regressions; these clones are so fickle that some
+days they stop working altogether. Except on Windows, they work fine.
+
+But this force-suspend initialization quirk seems to mostly do the trick,
+after a lot of testing Bluetooth now seems to work *all* the time.
+
+The only problem is that the solution ended up being masked under a very
+stringent check; when there are probably hundreds of fake dongle
+models out there that benefit from a good reset. Make it so.
+
+Fixes: 81cac64ba258a ("Bluetooth: Deal with USB devices that are faking CSR vendor")
+Fixes: cde1a8a992875 ("Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers")
+Fixes: d74e0ae7e0303 ("Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134")
+Fixes: 0671c0662383e ("Bluetooth: btusb: Add workaround for remote-wakeup issues with Barrot 8041a02 fake CSR controllers")
+
+Cc: stable@vger.kernel.org
+Cc: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
+Signed-off-by: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 63 ++++++++++++++++++++++++----------------------
+ 1 file changed, 34 insertions(+), 29 deletions(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1899,7 +1899,7 @@ static int btusb_setup_csr(struct hci_de
+ is_fake = true;
+
+ if (is_fake) {
+- bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds...");
++ bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once...");
+
+ /* Generally these clones have big discrepancies between
+ * advertised features and what's actually supported.
+@@ -1916,41 +1916,46 @@ static int btusb_setup_csr(struct hci_de
+ clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
+
+ /*
+- * Special workaround for clones with a Barrot 8041a02 chip,
+- * these clones are really messed-up:
+- * 1. Their bulk rx endpoint will never report any data unless
+- * the device was suspended at least once (yes really).
++ * Special workaround for these BT 4.0 chip clones, and potentially more:
++ *
++ * - 0x0134: a Barrot 8041a02 (HCI rev: 0x1012 sub: 0x0810)
++ * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709)
++ *
++ * These controllers are really messed-up.
++ *
++ * 1. Their bulk RX endpoint will never report any data unless
++ * the device was suspended at least once (yes, really).
+ * 2. They will not wakeup when autosuspended and receiving data
+- * on their bulk rx endpoint from e.g. a keyboard or mouse
++ * on their bulk RX endpoint from e.g. a keyboard or mouse
+ * (IOW remote-wakeup support is broken for the bulk endpoint).
+ *
+ * To fix 1. enable runtime-suspend, force-suspend the
+- * hci and then wake-it up by disabling runtime-suspend.
++ * HCI and then wake-it up by disabling runtime-suspend.
+ *
+- * To fix 2. clear the hci's can_wake flag, this way the hci
++ * To fix 2. clear the HCI's can_wake flag, this way the HCI
+ * will still be autosuspended when it is not open.
++ *
++ * --
++ *
++ * Because these are widespread problems we prefer generic solutions; so
++ * apply this initialization quirk to every controller that gets here,
++ * it should be harmless. The alternative is to not work at all.
+ */
+- if (bcdDevice == 0x8891 &&
+- le16_to_cpu(rp->lmp_subver) == 0x1012 &&
+- le16_to_cpu(rp->hci_rev) == 0x0810 &&
+- le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_4_0) {
+- bt_dev_warn(hdev, "CSR: detected a fake CSR dongle using a Barrot 8041a02 chip, this chip is very buggy and may have issues");
+-
+- pm_runtime_allow(&data->udev->dev);
+-
+- ret = pm_runtime_suspend(&data->udev->dev);
+- if (ret >= 0)
+- msleep(200);
+- else
+- bt_dev_err(hdev, "Failed to suspend the device for Barrot 8041a02 receive-issue workaround");
+-
+- pm_runtime_forbid(&data->udev->dev);
+-
+- device_set_wakeup_capable(&data->udev->dev, false);
+- /* Re-enable autosuspend if this was requested */
+- if (enable_autosuspend)
+- usb_enable_autosuspend(data->udev);
+- }
++ pm_runtime_allow(&data->udev->dev);
++
++ ret = pm_runtime_suspend(&data->udev->dev);
++ if (ret >= 0)
++ msleep(200);
++ else
++ bt_dev_err(hdev, "CSR: Failed to suspend the device for our Barrot 8041a02 receive-issue workaround");
++
++ pm_runtime_forbid(&data->udev->dev);
++
++ device_set_wakeup_capable(&data->udev->dev, false);
++
++ /* Re-enable autosuspend if this was requested */
++ if (enable_autosuspend)
++ usb_enable_autosuspend(data->udev);
+ }
+
+ kfree_skb(skb);
--- /dev/null
+From a7bfaad54b8b9cf06041528988d6b75b4b921546 Mon Sep 17 00:00:00 2001
+From: Alison Schofield <alison.schofield@intel.com>
+Date: Fri, 3 Sep 2021 19:20:39 -0700
+Subject: cxl/acpi: Do not add DSDT disabled ACPI0016 host bridge ports
+
+From: Alison Schofield <alison.schofield@intel.com>
+
+commit a7bfaad54b8b9cf06041528988d6b75b4b921546 upstream.
+
+During CXL ACPI probe, host bridge ports are discovered by scanning
+the ACPI0017 root port for ACPI0016 host bridge devices. The scan
+matches on the hardware id of "ACPI0016". An issue occurs when an
+ACPI0016 device is defined in the DSDT yet disabled on the platform.
+Attempts by the cxl_acpi driver to add host bridge ports using a
+disabled device fails, and the entire cxl_acpi probe fails.
+
+The DSDT table includes an _STA method that sets the status and the
+ACPI subsystem has checks available to examine it. One such check is
+in the acpi_pci_find_root() path. Move the call to acpi_pci_find_root()
+to the matching function to prevent this issue when adding either
+upstream or downstream ports.
+
+Suggested-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/163072203957.2250120.2178685721061002124.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/acpi.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/cxl/acpi.c
++++ b/drivers/cxl/acpi.c
+@@ -243,6 +243,9 @@ static struct acpi_device *to_cxl_host_b
+ {
+ struct acpi_device *adev = to_acpi_device(dev);
+
++ if (!acpi_pci_find_root(adev->handle))
++ return NULL;
++
+ if (strcmp(acpi_device_hid(adev), "ACPI0016") == 0)
+ return adev;
+ return NULL;
+@@ -266,10 +269,6 @@ static int add_host_bridge_uport(struct
+ if (!bridge)
+ return 0;
+
+- pci_root = acpi_pci_find_root(bridge->handle);
+- if (!pci_root)
+- return -ENXIO;
+-
+ dport = find_dport_by_dev(root_port, match);
+ if (!dport) {
+ dev_dbg(host, "host bridge expected and not found\n");
+@@ -282,6 +281,11 @@ static int add_host_bridge_uport(struct
+ return PTR_ERR(port);
+ dev_dbg(host, "%s: add: %s\n", dev_name(match), dev_name(&port->dev));
+
++ /*
++ * Note that this lookup already succeeded in
++ * to_cxl_host_bridge(), so no need to check for failure here
++ */
++ pci_root = acpi_pci_find_root(bridge->handle);
+ ctx = (struct cxl_walk_context){
+ .dev = host,
+ .root = pci_root->bus,
--- /dev/null
+From da582aa5ad5787c46e3f475ab3f4602ec84c1617 Mon Sep 17 00:00:00 2001
+From: "Li Qiang (Johnny Li)" <johnny.li@montage-tech.com>
+Date: Fri, 3 Sep 2021 19:20:50 -0700
+Subject: cxl/pci: Fix debug message in cxl_probe_regs()
+
+From: Li Qiang (Johnny Li) <johnny.li@montage-tech.com>
+
+commit da582aa5ad5787c46e3f475ab3f4602ec84c1617 upstream.
+
+Indicator string for mbox and memdev register set to status
+incorrectly in error message.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 30af97296f48 ("cxl/pci: Map registers based on capabilities")
+Signed-off-by: Li Qiang (Johnny Li) <johnny.li@montage-tech.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/163072205089.2250120.8103605864156687395.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/cxl/pci.c
++++ b/drivers/cxl/pci.c
+@@ -1022,8 +1022,8 @@ static int cxl_probe_regs(struct cxl_mem
+ !dev_map->memdev.valid) {
+ dev_err(dev, "registers not found: %s%s%s\n",
+ !dev_map->status.valid ? "status " : "",
+- !dev_map->mbox.valid ? "status " : "",
+- !dev_map->memdev.valid ? "status " : "");
++ !dev_map->mbox.valid ? "mbox " : "",
++ !dev_map->memdev.valid ? "memdev " : "");
+ return -ENXIO;
+ }
+
--- /dev/null
+From 9e56614c44b994b78fc9fcb2070bcbe3f5df0d7b Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 3 Sep 2021 19:20:45 -0700
+Subject: cxl/pci: Fix lockdown level
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 9e56614c44b994b78fc9fcb2070bcbe3f5df0d7b upstream.
+
+A proposed rework of security_locked_down() users identified that the
+cxl_pci driver was passing the wrong lockdown_reason. Update
+cxl_mem_raw_command_allowed() to fail raw command access when raw pci
+access is also disabled.
+
+Fixes: 13237183c735 ("cxl/mem: Add a "RAW" send command")
+Cc: Ben Widawsky <ben.widawsky@intel.com>
+Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: <stable@vger.kernel.org>
+Cc: Ondrej Mosnacek <omosnace@redhat.com>
+Cc: Paul Moore <paul@paul-moore.com>
+Link: https://lore.kernel.org/r/163072204525.2250120.16615792476976546735.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cxl/pci.c
++++ b/drivers/cxl/pci.c
+@@ -568,7 +568,7 @@ static bool cxl_mem_raw_command_allowed(
+ if (!IS_ENABLED(CONFIG_CXL_MEM_RAW_COMMANDS))
+ return false;
+
+- if (security_locked_down(LOCKDOWN_NONE))
++ if (security_locked_down(LOCKDOWN_PCI_ACCESS))
+ return false;
+
+ if (cxl_raw_allow_all)
--- /dev/null
+From b8da302e2955fe4d41eb9d48199242674d77dbe0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
+Date: Thu, 24 Jun 2021 19:14:17 +0200
+Subject: PCI: Call Max Payload Size-related fixup quirks early
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+commit b8da302e2955fe4d41eb9d48199242674d77dbe0 upstream.
+
+pci_device_add() calls HEADER fixups after pci_configure_device(), which
+configures Max Payload Size.
+
+Convert MPS-related fixups to EARLY fixups so pci_configure_mps() takes
+them into account.
+
+Fixes: 27d868b5e6cfa ("PCI: Set MPS to match upstream bridge")
+Link: https://lore.kernel.org/r/20210624171418.27194-1-kabel@kernel.org
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/quirks.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3235,12 +3235,12 @@ static void fixup_mpss_256(struct pci_de
+ {
+ dev->pcie_mpss = 1; /* 256 bytes */
+ }
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
+
+ /*
+ * Intel 5000 and 5100 Memory controllers have an erratum with read completion
can-c_can-fix-null-ptr-deref-on-ioctl.patch
igmp-add-ip_mc_list-lock-in-ip_check_mc_rcu.patch
revert-r8169-avoid-link-up-interrupt-issue-on-rtl8106e-if-user-enables-aspm.patch
+alsa-usb-audio-add-registration-quirk-for-jbl-quantum-800.patch
+bluetooth-add-additional-bluetooth-part-for-realtek-8852ae.patch
+bluetooth-btusb-make-the-csr-clone-chip-force-suspend-workaround-more-generic.patch
+usb-host-xhci-rcar-don-t-reload-firmware-after-the-completion.patch
+usb-xhci-mtk-fix-issue-of-out-of-bounds-array-access.patch
+usb-cdnsp-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch
+usb-gadget-tegra-xudc-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch
+usb-mtu3-restore-hs-function-when-set-ss-ssp.patch
+usb-mtu3-use-mult-for-hs-isoc-or-intr.patch
+usb-mtu3-fix-the-wrong-hs-mult-value.patch
+xhci-fix-even-more-unsafe-memory-usage-in-xhci-tracing.patch
+xhci-fix-unsafe-memory-usage-in-xhci-tracing.patch
+xhci-fix-failure-to-give-back-some-cached-cancelled-urbs.patch
+staging-mt7621-pci-fix-hang-when-nothing-is-connected-to-pcie-ports.patch
+x86-reboot-limit-dell-optiplex-990-quirk-to-early-bios-versions.patch
+pci-call-max-payload-size-related-fixup-quirks-early.patch
+cxl-pci-fix-debug-message-in-cxl_probe_regs.patch
+cxl-pci-fix-lockdown-level.patch
+cxl-acpi-do-not-add-dsdt-disabled-acpi0016-host-bridge-ports.patch
--- /dev/null
+From 7d761b084b3c785e1fbbe707fbdf7baba905c6ad Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Mon, 23 Aug 2021 19:08:03 +0200
+Subject: staging: mt7621-pci: fix hang when nothing is connected to pcie ports
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+commit 7d761b084b3c785e1fbbe707fbdf7baba905c6ad upstream.
+
+When nothing is connected to pcie ports, each port is set to reset state.
+When this occurs, next access result in a hang on boot as follows:
+
+mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK)
+mt7621-pci 1e140000.pcie: pcie1 no card, disable it (RST & CLK)
+mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
+[ HANGS HERE ]
+
+Fix this just detecting 'nothing is connected state' to avoid next accesses
+to pcie port related configuration registers.
+
+Fixes: b99cc3a2b6b6 ("staging: mt7621-pci: avoid custom 'map_irq' function")
+Cc: stable <stable@vger.kernel.org>
+Reported-by: DENG Qingfang <dqfext@gmail.com>
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20210823170803.2108-1-sergio.paracuellos@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/mt7621-pci/pci-mt7621.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/mt7621-pci/pci-mt7621.c
++++ b/drivers/staging/mt7621-pci/pci-mt7621.c
+@@ -56,6 +56,7 @@
+ #define PCIE_BAR_ENABLE BIT(0)
+ #define PCIE_PORT_INT_EN(x) BIT(20 + (x))
+ #define PCIE_PORT_LINKUP BIT(0)
++#define PCIE_PORT_CNT 3
+
+ #define PERST_DELAY_MS 100
+
+@@ -388,10 +389,11 @@ static void mt7621_pcie_reset_ep_deasser
+ msleep(PERST_DELAY_MS);
+ }
+
+-static void mt7621_pcie_init_ports(struct mt7621_pcie *pcie)
++static int mt7621_pcie_init_ports(struct mt7621_pcie *pcie)
+ {
+ struct device *dev = pcie->dev;
+ struct mt7621_pcie_port *port, *tmp;
++ u8 num_disabled = 0;
+ int err;
+
+ mt7621_pcie_reset_assert(pcie);
+@@ -423,6 +425,7 @@ static void mt7621_pcie_init_ports(struc
+ slot);
+ mt7621_control_assert(port);
+ port->enabled = false;
++ num_disabled++;
+
+ if (slot == 0) {
+ tmp = port;
+@@ -433,6 +436,8 @@ static void mt7621_pcie_init_ports(struc
+ phy_power_off(tmp->phy);
+ }
+ }
++
++ return (num_disabled != PCIE_PORT_CNT) ? 0 : -ENODEV;
+ }
+
+ static void mt7621_pcie_enable_port(struct mt7621_pcie_port *port)
+@@ -540,7 +545,11 @@ static int mt7621_pci_probe(struct platf
+ return err;
+ }
+
+- mt7621_pcie_init_ports(pcie);
++ err = mt7621_pcie_init_ports(pcie);
++ if (err) {
++ dev_err(dev, "Nothing connected in virtual bridges\n");
++ return 0;
++ }
+
+ err = mt7621_pcie_enable_ports(bridge);
+ if (err) {
--- /dev/null
+From e9ab75f26eb9354dfc03aea3401b8cfb42cd6718 Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 13 Aug 2021 14:30:50 +0800
+Subject: usb: cdnsp: fix the wrong mult value for HS isoc or intr
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit e9ab75f26eb9354dfc03aea3401b8cfb42cd6718 upstream.
+
+usb_endpoint_maxp() only returns the bit[10:0] of wMaxPacketSize
+of endpoint descriptor, not include bit[12:11] anymore, so use
+usb_endpoint_maxp_mult() instead.
+
+Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
+Cc: stable@vger.kernel.org
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1628836253-7432-4-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdnsp-mem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/cdns3/cdnsp-mem.c
++++ b/drivers/usb/cdns3/cdnsp-mem.c
+@@ -882,7 +882,7 @@ static u32 cdnsp_get_endpoint_max_burst(
+ if (g->speed == USB_SPEED_HIGH &&
+ (usb_endpoint_xfer_isoc(pep->endpoint.desc) ||
+ usb_endpoint_xfer_int(pep->endpoint.desc)))
+- return (usb_endpoint_maxp(pep->endpoint.desc) & 0x1800) >> 11;
++ return usb_endpoint_maxp_mult(pep->endpoint.desc) - 1;
+
+ return 0;
+ }
--- /dev/null
+From eeb0cfb6b2b6b731902e68af641e30bd31be3c7b Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 13 Aug 2021 14:30:51 +0800
+Subject: usb: gadget: tegra-xudc: fix the wrong mult value for HS isoc or intr
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit eeb0cfb6b2b6b731902e68af641e30bd31be3c7b upstream.
+
+usb_endpoint_maxp() only returns the bit[10:0] of wMaxPacketSize
+of endpoint descriptor, not includes bit[12:11] anymore, so use
+usb_endpoint_maxp_mult() instead.
+Meanwhile no need AND 0x7ff when get maxp, remove it.
+
+Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller")
+Cc: stable@vger.kernel.org
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1628836253-7432-5-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/tegra-xudc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/udc/tegra-xudc.c
++++ b/drivers/usb/gadget/udc/tegra-xudc.c
+@@ -1610,7 +1610,7 @@ static void tegra_xudc_ep_context_setup(
+ u16 maxpacket, maxburst = 0, esit = 0;
+ u32 val;
+
+- maxpacket = usb_endpoint_maxp(desc) & 0x7ff;
++ maxpacket = usb_endpoint_maxp(desc);
+ if (xudc->gadget.speed == USB_SPEED_SUPER) {
+ if (!usb_endpoint_xfer_control(desc))
+ maxburst = comp_desc->bMaxBurst;
+@@ -1621,7 +1621,7 @@ static void tegra_xudc_ep_context_setup(
+ (usb_endpoint_xfer_int(desc) ||
+ usb_endpoint_xfer_isoc(desc))) {
+ if (xudc->gadget.speed == USB_SPEED_HIGH) {
+- maxburst = (usb_endpoint_maxp(desc) >> 11) & 0x3;
++ maxburst = usb_endpoint_maxp_mult(desc) - 1;
+ if (maxburst == 0x3) {
+ dev_warn(xudc->dev,
+ "invalid endpoint maxburst\n");
--- /dev/null
+From 57f3ffdc11143f56f1314972fe86fe17a0dcde85 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 27 Aug 2021 15:32:27 +0900
+Subject: usb: host: xhci-rcar: Don't reload firmware after the completion
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 57f3ffdc11143f56f1314972fe86fe17a0dcde85 upstream.
+
+According to the datasheet, "Upon the completion of FW Download,
+there is no need to write or reload FW.". Otherwise, it's possible
+to cause unexpected behaviors. So, adds such a condition.
+
+Fixes: 4ac8918f3a73 ("usb: host: xhci-plat: add support for the R-Car H2 and M2 xHCI controllers")
+Cc: stable@vger.kernel.org # v3.17+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20210827063227.81990-1-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-rcar.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -134,6 +134,13 @@ static int xhci_rcar_download_firmware(s
+ const struct soc_device_attribute *attr;
+ const char *firmware_name;
+
++ /*
++ * According to the datasheet, "Upon the completion of FW Download,
++ * there is no need to write or reload FW".
++ */
++ if (readl(regs + RCAR_USB3_DL_CTRL) & RCAR_USB3_DL_CTRL_FW_SUCCESS)
++ return 0;
++
+ attr = soc_device_match(rcar_quirks_match);
+ if (attr)
+ quirks = (uintptr_t)attr->data;
--- /dev/null
+From 44e4439d8f9f8d0e9da767d1f31e7c211081feca Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 13 Aug 2021 14:30:49 +0800
+Subject: usb: mtu3: fix the wrong HS mult value
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit 44e4439d8f9f8d0e9da767d1f31e7c211081feca upstream.
+
+usb_endpoint_maxp() returns actual max packet size, @mult will
+always be zero, fix it by using usb_endpoint_maxp_mult() instead
+to get mult.
+
+Fixes: 4d79e042ed8b ("usb: mtu3: add support for usb3.1 IP")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1628836253-7432-3-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/mtu3/mtu3_gadget.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -64,14 +64,12 @@ static int mtu3_ep_enable(struct mtu3_ep
+ u32 interval = 0;
+ u32 mult = 0;
+ u32 burst = 0;
+- int max_packet;
+ int ret;
+
+ desc = mep->desc;
+ comp_desc = mep->comp_desc;
+ mep->type = usb_endpoint_type(desc);
+- max_packet = usb_endpoint_maxp(desc);
+- mep->maxp = max_packet & GENMASK(10, 0);
++ mep->maxp = usb_endpoint_maxp(desc);
+
+ switch (mtu->g.speed) {
+ case USB_SPEED_SUPER:
+@@ -92,7 +90,7 @@ static int mtu3_ep_enable(struct mtu3_ep
+ usb_endpoint_xfer_int(desc)) {
+ interval = desc->bInterval;
+ interval = clamp_val(interval, 1, 16) - 1;
+- mult = (max_packet & GENMASK(12, 11)) >> 11;
++ mult = usb_endpoint_maxp_mult(desc) - 1;
+ }
+ break;
+ default:
--- /dev/null
+From e88f28514065a6c48aadc367efb0ef6378a01543 Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 13 Aug 2021 14:30:47 +0800
+Subject: usb: mtu3: restore HS function when set SS/SSP
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit e88f28514065a6c48aadc367efb0ef6378a01543 upstream.
+
+Due to HS function is disabled when set as FS, need restore
+it when set as SS/SSP.
+
+Fixes: dc4c1aa7eae9 ("usb: mtu3: add ->udc_set_speed()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1628836253-7432-1-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/mtu3/mtu3_core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -227,11 +227,13 @@ static void mtu3_set_speed(struct mtu3 *
+ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE);
+ break;
+ case USB_SPEED_SUPER:
++ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE);
+ mtu3_clrbits(mtu->ippc_base, SSUSB_U3_CTRL(0),
+ SSUSB_U3_PORT_SSP_SPEED);
+ break;
+ case USB_SPEED_SUPER_PLUS:
+- mtu3_setbits(mtu->ippc_base, SSUSB_U3_CTRL(0),
++ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE);
++ mtu3_setbits(mtu->ippc_base, SSUSB_U3_CTRL(0),
+ SSUSB_U3_PORT_SSP_SPEED);
+ break;
+ default:
--- /dev/null
+From fd7cb394ec7efccc3985feb0978cee4d352e1817 Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 13 Aug 2021 14:30:48 +0800
+Subject: usb: mtu3: use @mult for HS isoc or intr
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit fd7cb394ec7efccc3985feb0978cee4d352e1817 upstream.
+
+For HS isoc or intr, should use @mult but not @burst
+to save mult value.
+
+Fixes: 4d79e042ed8b ("usb: mtu3: add support for usb3.1 IP")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1628836253-7432-2-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/mtu3/mtu3_gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -92,7 +92,7 @@ static int mtu3_ep_enable(struct mtu3_ep
+ usb_endpoint_xfer_int(desc)) {
+ interval = desc->bInterval;
+ interval = clamp_val(interval, 1, 16) - 1;
+- burst = (max_packet & GENMASK(12, 11)) >> 11;
++ mult = (max_packet & GENMASK(12, 11)) >> 11;
+ }
+ break;
+ default:
--- /dev/null
+From de5107f473190538a65aac7edea85209cd5c1a8f Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Tue, 17 Aug 2021 16:36:25 +0800
+Subject: usb: xhci-mtk: fix issue of out-of-bounds array access
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit de5107f473190538a65aac7edea85209cd5c1a8f upstream.
+
+Bus bandwidth array access is based on esit, increase one
+will cause out-of-bounds issue; for example, when esit is
+XHCI_MTK_MAX_ESIT, will overstep boundary.
+
+Fixes: 7c986fbc16ae ("usb: xhci-mtk: get the microframe boundary for ESIT")
+Cc: <stable@vger.kernel.org>
+Reported-by: Stan Lu <stan.lu@mediatek.com>
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1629189389-18779-5-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-mtk-sch.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -575,10 +575,12 @@ static u32 get_esit_boundary(struct mu3h
+ u32 boundary = sch_ep->esit;
+
+ if (sch_ep->sch_tt) { /* LS/FS with TT */
+- /* tune for CS */
+- if (sch_ep->ep_type != ISOC_OUT_EP)
+- boundary++;
+- else if (boundary > 1) /* normally esit >= 8 for FS/LS */
++ /*
++ * tune for CS, normally esit >= 8 for FS/LS,
++ * not add one for other types to avoid access array
++ * out of boundary
++ */
++ if (sch_ep->ep_type == ISOC_OUT_EP && boundary > 1)
+ boundary--;
+ }
+
--- /dev/null
+From a729691b541f6e63043beae72e635635abe5dc09 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Sun, 30 May 2021 12:24:47 -0400
+Subject: x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
+
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+commit a729691b541f6e63043beae72e635635abe5dc09 upstream.
+
+When this platform was relatively new in November 2011, with early BIOS
+revisions, a reboot quirk was added in commit 6be30bb7d750 ("x86/reboot:
+Blacklist Dell OptiPlex 990 known to require PCI reboot")
+
+However, this quirk (and several others) are open-ended to all BIOS
+versions and left no automatic expiry if/when the system BIOS fixed the
+issue, meaning that nobody is likely to come along and re-test.
+
+What is really problematic with using PCI reboot as this quirk does, is
+that it causes this platform to do a full power down, wait one second,
+and then power back on. This is less than ideal if one is using it for
+boot testing and/or bisecting kernels when legacy rotating hard disks
+are installed.
+
+It was only by chance that the quirk was noticed in dmesg - and when
+disabled it turned out that it wasn't required anymore (BIOS A24), and a
+default reboot would work fine without the "harshness" of power cycling the
+machine (and disks) down and up like the PCI reboot does.
+
+Doing a bit more research, it seems that the "newest" BIOS for which the
+issue was reported[1] was version A06, however Dell[2] seemed to suggest
+only up to and including version A05, with the A06 having a large number of
+fixes[3] listed.
+
+As is typical with a new platform, the initial BIOS updates come frequently
+and then taper off (and in this case, with a revival for CPU CVEs); a
+search for O990-A<ver>.exe reveals the following dates:
+
+ A02 16 Mar 2011
+ A03 11 May 2011
+ A06 14 Sep 2011
+ A07 24 Oct 2011
+ A10 08 Dec 2011
+ A14 06 Sep 2012
+ A16 15 Oct 2012
+ A18 30 Sep 2013
+ A19 23 Sep 2015
+ A20 02 Jun 2017
+ A23 07 Mar 2018
+ A24 21 Aug 2018
+
+While it's overkill to flash and test each of the above, it would seem
+likely that the issue was contained within A0x BIOS versions, given the
+dates above and the dates of issue reports[4] from distros. So rather than
+just throw out the quirk entirely, limit the scope to just those early BIOS
+versions, in case people are still running systems from 2011 with the
+original as-shipped early A0x BIOS versions.
+
+[1] https://lore.kernel.org/lkml/1320373471-3942-1-git-send-email-trenn@suse.de/
+[2] https://www.dell.com/support/kbdoc/en-ca/000131908/linux-based-operating-systems-stall-upon-reboot-on-optiplex-390-790-990-systems
+[3] https://www.dell.com/support/home/en-ca/drivers/driversdetails?driverid=85j10
+[4] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/768039
+
+Fixes: 6be30bb7d750 ("x86/reboot: Blacklist Dell OptiPlex 990 known to require PCI reboot")
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20210530162447.996461-4-paul.gortmaker@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/reboot.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -388,10 +388,11 @@ static const struct dmi_system_id reboot
+ },
+ { /* Handle problems with rebooting on the OptiPlex 990. */
+ .callback = set_pci_reboot,
+- .ident = "Dell OptiPlex 990",
++ .ident = "Dell OptiPlex 990 BIOS A0x",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
++ DMI_MATCH(DMI_BIOS_VERSION, "A0"),
+ },
+ },
+ { /* Handle problems with rebooting on Dell 300's */
--- /dev/null
+From 4843b4b5ec64b875a5e334f280508f1f75e7d3e4 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 20 Aug 2021 15:34:59 +0300
+Subject: xhci: fix even more unsafe memory usage in xhci tracing
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 4843b4b5ec64b875a5e334f280508f1f75e7d3e4 upstream.
+
+Removes static char buffer usage in the following decode functions:
+ xhci_decode_ctrl_ctx()
+ xhci_decode_slot_context()
+ xhci_decode_usbsts()
+ xhci_decode_doorbell()
+ xhci_decode_ep_context()
+
+Caller must provide a buffer to use.
+In tracing use __get_str() as recommended to pass buffer.
+
+Minor changes are needed in other xhci code as these functions are also
+used elsewhere
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210820123503.2605901-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-debugfs.c | 8 ++++++--
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ drivers/usb/host/xhci-trace.h | 18 +++++++++++-------
+ drivers/usb/host/xhci.h | 21 ++++++++-------------
+ 4 files changed, 27 insertions(+), 23 deletions(-)
+
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -260,11 +260,13 @@ static int xhci_slot_context_show(struct
+ struct xhci_slot_ctx *slot_ctx;
+ struct xhci_slot_priv *priv = s->private;
+ struct xhci_virt_device *dev = priv->dev;
++ char str[XHCI_MSG_MAX];
+
+ xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
+ slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx);
+ seq_printf(s, "%pad: %s\n", &dev->out_ctx->dma,
+- xhci_decode_slot_context(le32_to_cpu(slot_ctx->dev_info),
++ xhci_decode_slot_context(str,
++ le32_to_cpu(slot_ctx->dev_info),
+ le32_to_cpu(slot_ctx->dev_info2),
+ le32_to_cpu(slot_ctx->tt_info),
+ le32_to_cpu(slot_ctx->dev_state)));
+@@ -280,6 +282,7 @@ static int xhci_endpoint_context_show(st
+ struct xhci_ep_ctx *ep_ctx;
+ struct xhci_slot_priv *priv = s->private;
+ struct xhci_virt_device *dev = priv->dev;
++ char str[XHCI_MSG_MAX];
+
+ xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
+
+@@ -287,7 +290,8 @@ static int xhci_endpoint_context_show(st
+ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
+ dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params);
+ seq_printf(s, "%pad: %s\n", &dma,
+- xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info),
++ xhci_decode_ep_context(str,
++ le32_to_cpu(ep_ctx->ep_info),
+ le32_to_cpu(ep_ctx->ep_info2),
+ le64_to_cpu(ep_ctx->deq),
+ le32_to_cpu(ep_ctx->tx_info)));
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1212,6 +1212,7 @@ void xhci_stop_endpoint_command_watchdog
+ struct xhci_hcd *xhci = ep->xhci;
+ unsigned long flags;
+ u32 usbsts;
++ char str[XHCI_MSG_MAX];
+
+ spin_lock_irqsave(&xhci->lock, flags);
+
+@@ -1225,7 +1226,7 @@ void xhci_stop_endpoint_command_watchdog
+ usbsts = readl(&xhci->op_regs->status);
+
+ xhci_warn(xhci, "xHCI host not responding to stop endpoint command.\n");
+- xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(usbsts));
++ xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(str, usbsts));
+
+ ep->ep_state &= ~EP_STOP_CMD_PENDING;
+
+--- a/drivers/usb/host/xhci-trace.h
++++ b/drivers/usb/host/xhci-trace.h
+@@ -323,6 +323,7 @@ DECLARE_EVENT_CLASS(xhci_log_ep_ctx,
+ __field(u32, info2)
+ __field(u64, deq)
+ __field(u32, tx_info)
++ __dynamic_array(char, str, XHCI_MSG_MAX)
+ ),
+ TP_fast_assign(
+ __entry->info = le32_to_cpu(ctx->ep_info);
+@@ -330,8 +331,8 @@ DECLARE_EVENT_CLASS(xhci_log_ep_ctx,
+ __entry->deq = le64_to_cpu(ctx->deq);
+ __entry->tx_info = le32_to_cpu(ctx->tx_info);
+ ),
+- TP_printk("%s", xhci_decode_ep_context(__entry->info,
+- __entry->info2, __entry->deq, __entry->tx_info)
++ TP_printk("%s", xhci_decode_ep_context(__get_str(str),
++ __entry->info, __entry->info2, __entry->deq, __entry->tx_info)
+ )
+ );
+
+@@ -368,6 +369,7 @@ DECLARE_EVENT_CLASS(xhci_log_slot_ctx,
+ __field(u32, info2)
+ __field(u32, tt_info)
+ __field(u32, state)
++ __dynamic_array(char, str, XHCI_MSG_MAX)
+ ),
+ TP_fast_assign(
+ __entry->info = le32_to_cpu(ctx->dev_info);
+@@ -375,9 +377,9 @@ DECLARE_EVENT_CLASS(xhci_log_slot_ctx,
+ __entry->tt_info = le64_to_cpu(ctx->tt_info);
+ __entry->state = le32_to_cpu(ctx->dev_state);
+ ),
+- TP_printk("%s", xhci_decode_slot_context(__entry->info,
+- __entry->info2, __entry->tt_info,
+- __entry->state)
++ TP_printk("%s", xhci_decode_slot_context(__get_str(str),
++ __entry->info, __entry->info2,
++ __entry->tt_info, __entry->state)
+ )
+ );
+
+@@ -432,12 +434,13 @@ DECLARE_EVENT_CLASS(xhci_log_ctrl_ctx,
+ TP_STRUCT__entry(
+ __field(u32, drop)
+ __field(u32, add)
++ __dynamic_array(char, str, XHCI_MSG_MAX)
+ ),
+ TP_fast_assign(
+ __entry->drop = le32_to_cpu(ctrl_ctx->drop_flags);
+ __entry->add = le32_to_cpu(ctrl_ctx->add_flags);
+ ),
+- TP_printk("%s", xhci_decode_ctrl_ctx(__entry->drop, __entry->add)
++ TP_printk("%s", xhci_decode_ctrl_ctx(__get_str(str), __entry->drop, __entry->add)
+ )
+ );
+
+@@ -555,13 +558,14 @@ DECLARE_EVENT_CLASS(xhci_log_doorbell,
+ TP_STRUCT__entry(
+ __field(u32, slot)
+ __field(u32, doorbell)
++ __dynamic_array(char, str, XHCI_MSG_MAX)
+ ),
+ TP_fast_assign(
+ __entry->slot = slot;
+ __entry->doorbell = doorbell;
+ ),
+ TP_printk("Ring doorbell for %s",
+- xhci_decode_doorbell(__entry->slot, __entry->doorbell)
++ xhci_decode_doorbell(__get_str(str), __entry->slot, __entry->doorbell)
+ )
+ );
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -2455,10 +2455,9 @@ static inline const char *xhci_decode_tr
+ return str;
+ }
+
+-static inline const char *xhci_decode_ctrl_ctx(unsigned long drop,
+- unsigned long add)
++static inline const char *xhci_decode_ctrl_ctx(char *str,
++ unsigned long drop, unsigned long add)
+ {
+- static char str[1024];
+ unsigned int bit;
+ int ret = 0;
+
+@@ -2484,10 +2483,9 @@ static inline const char *xhci_decode_ct
+ return str;
+ }
+
+-static inline const char *xhci_decode_slot_context(u32 info, u32 info2,
+- u32 tt_info, u32 state)
++static inline const char *xhci_decode_slot_context(char *str,
++ u32 info, u32 info2, u32 tt_info, u32 state)
+ {
+- static char str[1024];
+ u32 speed;
+ u32 hub;
+ u32 mtt;
+@@ -2617,9 +2615,8 @@ static inline const char *xhci_decode_po
+ return str;
+ }
+
+-static inline const char *xhci_decode_usbsts(u32 usbsts)
++static inline const char *xhci_decode_usbsts(char *str, u32 usbsts)
+ {
+- static char str[256];
+ int ret = 0;
+
+ if (usbsts == ~(u32)0)
+@@ -2646,9 +2643,8 @@ static inline const char *xhci_decode_us
+ return str;
+ }
+
+-static inline const char *xhci_decode_doorbell(u32 slot, u32 doorbell)
++static inline const char *xhci_decode_doorbell(char *str, u32 slot, u32 doorbell)
+ {
+- static char str[256];
+ u8 ep;
+ u16 stream;
+ int ret;
+@@ -2715,10 +2711,9 @@ static inline const char *xhci_ep_type_s
+ }
+ }
+
+-static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
+- u32 tx_info)
++static inline const char *xhci_decode_ep_context(char *str, u32 info,
++ u32 info2, u64 deq, u32 tx_info)
+ {
+- static char str[1024];
+ int ret;
+
+ u32 esit;
--- /dev/null
+From 94f339147fc3eb9edef7ee4ef6e39c569c073753 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 20 Aug 2021 15:35:00 +0300
+Subject: xhci: Fix failure to give back some cached cancelled URBs.
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 94f339147fc3eb9edef7ee4ef6e39c569c073753 upstream.
+
+Only TDs with status TD_CLEARING_CACHE will be given back after
+cache is cleared with a set TR deq command.
+
+xhci_invalidate_cached_td() failed to set the TD_CLEARING_CACHE status
+for some cancelled TDs as it assumed an endpoint only needs to clear the
+TD it stopped on.
+
+This isn't always true. For example with streams enabled an endpoint may
+have several stream rings, each stopping on a different TDs.
+
+Note that if an endpoint has several stream rings, the current code
+will still only clear the cache of the stream pointed to by the last
+cancelled TD in the cancel list.
+
+This patch only focus on making sure all canceled TDs are given back,
+avoiding hung task after device removal.
+Another fix to solve clearing the caches of all stream rings with
+cancelled TDs is needed, but not as urgent.
+
+This issue was simultanously discovered and debugged by
+by Tao Wang, with a slightly different fix proposal.
+
+Fixes: 674f8438c121 ("xhci: split handling halted endpoints into two steps")
+Cc: <stable@vger.kernel.org> #5.12
+Reported-by: Tao Wang <wat@codeaurora.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210820123503.2605901-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-ring.c | 40 +++++++++++++++++++++++++---------------
+ 1 file changed, 25 insertions(+), 15 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -942,17 +942,21 @@ static int xhci_invalidate_cancelled_tds
+ td->urb->stream_id);
+ hw_deq &= ~0xf;
+
+- if (td->cancel_status == TD_HALTED) {
+- cached_td = td;
+- } else if (trb_in_td(xhci, td->start_seg, td->first_trb,
+- td->last_trb, hw_deq, false)) {
++ if (td->cancel_status == TD_HALTED ||
++ trb_in_td(xhci, td->start_seg, td->first_trb, td->last_trb, hw_deq, false)) {
+ switch (td->cancel_status) {
+ case TD_CLEARED: /* TD is already no-op */
+ case TD_CLEARING_CACHE: /* set TR deq command already queued */
+ break;
+ case TD_DIRTY: /* TD is cached, clear it */
+ case TD_HALTED:
+- /* FIXME stream case, several stopped rings */
++ td->cancel_status = TD_CLEARING_CACHE;
++ if (cached_td)
++ /* FIXME stream case, several stopped rings */
++ xhci_dbg(xhci,
++ "Move dq past stream %u URB %p instead of stream %u URB %p\n",
++ td->urb->stream_id, td->urb,
++ cached_td->urb->stream_id, cached_td->urb);
+ cached_td = td;
+ break;
+ }
+@@ -961,18 +965,24 @@ static int xhci_invalidate_cancelled_tds
+ td->cancel_status = TD_CLEARED;
+ }
+ }
+- if (cached_td) {
+- cached_td->cancel_status = TD_CLEARING_CACHE;
+
+- err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index,
+- cached_td->urb->stream_id,
+- cached_td);
+- /* Failed to move past cached td, try just setting it noop */
+- if (err) {
+- td_to_noop(xhci, ring, cached_td, false);
+- cached_td->cancel_status = TD_CLEARED;
++ /* If there's no need to move the dequeue pointer then we're done */
++ if (!cached_td)
++ return 0;
++
++ err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index,
++ cached_td->urb->stream_id,
++ cached_td);
++ if (err) {
++ /* Failed to move past cached td, just set cached TDs to no-op */
++ list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) {
++ if (td->cancel_status != TD_CLEARING_CACHE)
++ continue;
++ xhci_dbg(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n",
++ td->urb);
++ td_to_noop(xhci, ring, td, false);
++ td->cancel_status = TD_CLEARED;
+ }
+- cached_td = NULL;
+ }
+ return 0;
+ }
--- /dev/null
+From cbf286e8ef8337308c259ff5b9ce2e74d403be5a Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 20 Aug 2021 15:34:58 +0300
+Subject: xhci: fix unsafe memory usage in xhci tracing
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit cbf286e8ef8337308c259ff5b9ce2e74d403be5a upstream.
+
+Removes static char buffer usage in the following decode functions:
+ xhci_decode_trb()
+ xhci_decode_ptortsc()
+
+Caller must provide a buffer to use.
+In tracing use __get_str() as recommended to pass buffer.
+
+Minor chanes are needed in xhci debugfs code as these functions are also
+used there. Changes include moving XHCI_MSG_MAX definititon from
+xhci-trace.h to xhci.h
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210820123503.2605901-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-debugfs.c | 6 +++-
+ drivers/usb/host/xhci-trace.h | 8 +++---
+ drivers/usb/host/xhci.h | 52 +++++++++++++++++++++-------------------
+ 3 files changed, 36 insertions(+), 30 deletions(-)
+
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -198,12 +198,13 @@ static void xhci_ring_dump_segment(struc
+ int i;
+ dma_addr_t dma;
+ union xhci_trb *trb;
++ char str[XHCI_MSG_MAX];
+
+ for (i = 0; i < TRBS_PER_SEGMENT; i++) {
+ trb = &seg->trbs[i];
+ dma = seg->dma + i * sizeof(*trb);
+ seq_printf(s, "%pad: %s\n", &dma,
+- xhci_decode_trb(le32_to_cpu(trb->generic.field[0]),
++ xhci_decode_trb(str, XHCI_MSG_MAX, le32_to_cpu(trb->generic.field[0]),
+ le32_to_cpu(trb->generic.field[1]),
+ le32_to_cpu(trb->generic.field[2]),
+ le32_to_cpu(trb->generic.field[3])));
+@@ -345,9 +346,10 @@ static int xhci_portsc_show(struct seq_f
+ {
+ struct xhci_port *port = s->private;
+ u32 portsc;
++ char str[XHCI_MSG_MAX];
+
+ portsc = readl(port->addr);
+- seq_printf(s, "%s\n", xhci_decode_portsc(portsc));
++ seq_printf(s, "%s\n", xhci_decode_portsc(str, portsc));
+
+ return 0;
+ }
+--- a/drivers/usb/host/xhci-trace.h
++++ b/drivers/usb/host/xhci-trace.h
+@@ -25,8 +25,6 @@
+ #include "xhci.h"
+ #include "xhci-dbgcap.h"
+
+-#define XHCI_MSG_MAX 500
+-
+ DECLARE_EVENT_CLASS(xhci_log_msg,
+ TP_PROTO(struct va_format *vaf),
+ TP_ARGS(vaf),
+@@ -122,6 +120,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb,
+ __field(u32, field1)
+ __field(u32, field2)
+ __field(u32, field3)
++ __dynamic_array(char, str, XHCI_MSG_MAX)
+ ),
+ TP_fast_assign(
+ __entry->type = ring->type;
+@@ -131,7 +130,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb,
+ __entry->field3 = le32_to_cpu(trb->field[3]);
+ ),
+ TP_printk("%s: %s", xhci_ring_type_string(__entry->type),
+- xhci_decode_trb(__entry->field0, __entry->field1,
++ xhci_decode_trb(__get_str(str), XHCI_MSG_MAX, __entry->field0, __entry->field1,
+ __entry->field2, __entry->field3)
+ )
+ );
+@@ -526,6 +525,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc,
+ TP_STRUCT__entry(
+ __field(u32, portnum)
+ __field(u32, portsc)
++ __dynamic_array(char, str, XHCI_MSG_MAX)
+ ),
+ TP_fast_assign(
+ __entry->portnum = portnum;
+@@ -533,7 +533,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc,
+ ),
+ TP_printk("port-%d: %s",
+ __entry->portnum,
+- xhci_decode_portsc(__entry->portsc)
++ xhci_decode_portsc(__get_str(str), __entry->portsc)
+ )
+ );
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -22,6 +22,9 @@
+ #include "xhci-ext-caps.h"
+ #include "pci-quirks.h"
+
++/* max buffer size for trace and debug messages */
++#define XHCI_MSG_MAX 500
++
+ /* xHCI PCI Configuration Registers */
+ #define XHCI_SBRN_OFFSET (0x60)
+
+@@ -2235,15 +2238,14 @@ static inline char *xhci_slot_state_stri
+ }
+ }
+
+-static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
+- u32 field3)
++static inline const char *xhci_decode_trb(char *str, size_t size,
++ u32 field0, u32 field1, u32 field2, u32 field3)
+ {
+- static char str[256];
+ int type = TRB_FIELD_TO_TYPE(field3);
+
+ switch (type) {
+ case TRB_LINK:
+- sprintf(str,
++ snprintf(str, size,
+ "LINK %08x%08x intr %d type '%s' flags %c:%c:%c:%c",
+ field1, field0, GET_INTR_TARGET(field2),
+ xhci_trb_type_string(type),
+@@ -2260,7 +2262,7 @@ static inline const char *xhci_decode_tr
+ case TRB_HC_EVENT:
+ case TRB_DEV_NOTE:
+ case TRB_MFINDEX_WRAP:
+- sprintf(str,
++ snprintf(str, size,
+ "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c",
+ field1, field0,
+ xhci_trb_comp_code_string(GET_COMP_CODE(field2)),
+@@ -2273,7 +2275,8 @@ static inline const char *xhci_decode_tr
+
+ break;
+ case TRB_SETUP:
+- sprintf(str, "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c",
++ snprintf(str, size,
++ "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c",
+ field0 & 0xff,
+ (field0 & 0xff00) >> 8,
+ (field0 & 0xff000000) >> 24,
+@@ -2290,7 +2293,8 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_DATA:
+- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c",
++ snprintf(str, size,
++ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c",
+ field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2),
+ GET_INTR_TARGET(field2),
+ xhci_trb_type_string(type),
+@@ -2303,7 +2307,8 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_STATUS:
+- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c",
++ snprintf(str, size,
++ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c",
+ field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2),
+ GET_INTR_TARGET(field2),
+ xhci_trb_type_string(type),
+@@ -2316,7 +2321,7 @@ static inline const char *xhci_decode_tr
+ case TRB_ISOC:
+ case TRB_EVENT_DATA:
+ case TRB_TR_NOOP:
+- sprintf(str,
++ snprintf(str, size,
+ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c",
+ field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2),
+ GET_INTR_TARGET(field2),
+@@ -2333,21 +2338,21 @@ static inline const char *xhci_decode_tr
+
+ case TRB_CMD_NOOP:
+ case TRB_ENABLE_SLOT:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: flags %c",
+ xhci_trb_type_string(type),
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_DISABLE_SLOT:
+ case TRB_NEG_BANDWIDTH:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: slot %d flags %c",
+ xhci_trb_type_string(type),
+ TRB_TO_SLOT_ID(field3),
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_ADDR_DEV:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: ctx %08x%08x slot %d flags %c:%c",
+ xhci_trb_type_string(type),
+ field1, field0,
+@@ -2356,7 +2361,7 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_CONFIG_EP:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: ctx %08x%08x slot %d flags %c:%c",
+ xhci_trb_type_string(type),
+ field1, field0,
+@@ -2365,7 +2370,7 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_EVAL_CONTEXT:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: ctx %08x%08x slot %d flags %c",
+ xhci_trb_type_string(type),
+ field1, field0,
+@@ -2373,7 +2378,7 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_RESET_EP:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: ctx %08x%08x slot %d ep %d flags %c:%c",
+ xhci_trb_type_string(type),
+ field1, field0,
+@@ -2394,7 +2399,7 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_SET_DEQ:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: deq %08x%08x stream %d slot %d ep %d flags %c",
+ xhci_trb_type_string(type),
+ field1, field0,
+@@ -2405,14 +2410,14 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_RESET_DEV:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: slot %d flags %c",
+ xhci_trb_type_string(type),
+ TRB_TO_SLOT_ID(field3),
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_FORCE_EVENT:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: event %08x%08x vf intr %d vf id %d flags %c",
+ xhci_trb_type_string(type),
+ field1, field0,
+@@ -2421,14 +2426,14 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_SET_LT:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: belt %d flags %c",
+ xhci_trb_type_string(type),
+ TRB_TO_BELT(field3),
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_GET_BW:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: ctx %08x%08x slot %d speed %d flags %c",
+ xhci_trb_type_string(type),
+ field1, field0,
+@@ -2437,7 +2442,7 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ case TRB_FORCE_HEADER:
+- sprintf(str,
++ snprintf(str, size,
+ "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c",
+ xhci_trb_type_string(type),
+ field2, field1, field0 & 0xffffffe0,
+@@ -2446,7 +2451,7 @@ static inline const char *xhci_decode_tr
+ field3 & TRB_CYCLE ? 'C' : 'c');
+ break;
+ default:
+- sprintf(str,
++ snprintf(str, size,
+ "type '%s' -> raw %08x %08x %08x %08x",
+ xhci_trb_type_string(type),
+ field0, field1, field2, field3);
+@@ -2569,9 +2574,8 @@ static inline const char *xhci_portsc_li
+ return "Unknown";
+ }
+
+-static inline const char *xhci_decode_portsc(u32 portsc)
++static inline const char *xhci_decode_portsc(char *str, u32 portsc)
+ {
+- static char str[256];
+ int ret;
+
+ ret = sprintf(str, "%s %s %s Link:%s PortSpeed:%d ",
projects / thirdparty / kernel / stable-queue.git / commitdiff
