--- /dev/null
+From 280a9045bb18833db921b316a5527d2b565e9f2e Mon Sep 17 00:00:00 2001
+From: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+Date: Sun, 10 Jan 2021 20:36:09 +0300
+Subject: ehci: fix EHCI host controller initialization sequence
+
+From: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+
+commit 280a9045bb18833db921b316a5527d2b565e9f2e upstream.
+
+According to EHCI spec, EHCI HC clears USBSTS.HCHalted whenever
+USBCMD.RS=1.
+
+However, it is a good practice to wait some time after setting USBCMD.RS
+(approximately 100ms) until USBSTS.HCHalted become zero.
+
+Without this waiting, VirtualBox's EHCI virtual HC accidentally hangs
+(see BugLink).
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211095
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210110173609.GA17313@himera.home
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hcd.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -575,6 +575,7 @@ static int ehci_run (struct usb_hcd *hcd
+ struct ehci_hcd *ehci = hcd_to_ehci (hcd);
+ u32 temp;
+ u32 hcc_params;
++ int rc;
+
+ hcd->uses_new_polling = 1;
+
+@@ -630,9 +631,20 @@ static int ehci_run (struct usb_hcd *hcd
+ down_write(&ehci_cf_port_reset_rwsem);
+ ehci->rh_state = EHCI_RH_RUNNING;
+ ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
++
++ /* Wait until HC become operational */
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+ msleep(5);
++ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
++
+ up_write(&ehci_cf_port_reset_rwsem);
++
++ if (rc) {
++ ehci_err(ehci, "USB %x.%x, controller refused to start: %d\n",
++ ((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f), rc);
++ return rc;
++ }
++
+ ehci->last_periodic_enable = ktime_get_real();
+
+ temp = HC_VERSION(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
--- /dev/null
+From efd597b2839a9895e8a98fcb0b76d2f545802cd4 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 9 Dec 2020 11:46:49 +0100
+Subject: iio: ad5504: Fix setting power-down state
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit efd597b2839a9895e8a98fcb0b76d2f545802cd4 upstream.
+
+The power-down mask of the ad5504 is actually a power-up mask. Meaning if
+a bit is set the corresponding channel is powered up and if it is not set
+the channel is powered down.
+
+The driver currently has this the wrong way around, resulting in the
+channel being powered up when requested to be powered down and vice versa.
+
+Fixes: 3bbbf150ffde ("staging:iio:dac:ad5504: Use strtobool for boolean values")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Link: https://lore.kernel.org/r/20201209104649.5794-1-lars@metafoo.de
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/dac/ad5504.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/dac/ad5504.c
++++ b/drivers/iio/dac/ad5504.c
+@@ -189,9 +189,9 @@ static ssize_t ad5504_write_dac_powerdow
+ return ret;
+
+ if (pwr_down)
+- st->pwr_down_mask |= (1 << chan->channel);
+- else
+ st->pwr_down_mask &= ~(1 << chan->channel);
++ else
++ st->pwr_down_mask |= (1 << chan->channel);
+
+ ret = ad5504_spi_write(st, AD5504_ADDR_CTRL,
+ AD5504_DAC_PWRDWN_MODE(st->pwr_down_mode) |
drm-nouveau-bios-fix-issue-shadowing-expansion-roms.patch
drm-nouveau-i2c-gm200-increase-width-of-aux-semaphor.patch
can-dev-can_restart-fix-use-after-free-bug.patch
+iio-ad5504-fix-setting-power-down-state.patch
+ehci-fix-ehci-host-controller-initialization-sequence.patch
+usb-bdc-make-bdc-pci-driver-depend-on-broken.patch
+xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch
--- /dev/null
+From ef02684c4e67d8c35ac83083564135bc7b1d3445 Mon Sep 17 00:00:00 2001
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Date: Mon, 18 Jan 2021 21:36:15 +0100
+Subject: usb: bdc: Make bdc pci driver depend on BROKEN
+
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+
+commit ef02684c4e67d8c35ac83083564135bc7b1d3445 upstream.
+
+The bdc pci driver is going to be removed due to it not existing in the
+wild. This patch turns off compilation of the driver so that stable
+kernels can also pick up the change. This helps the out-of-tree
+facetimehd webcam driver as the pci id conflicts with bdc.
+
+Cc: Al Cooper <alcooperx@gmail.com>
+Cc: <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://lore.kernel.org/r/20210118203615.13995-1-patrik.r.jakobsson@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/bdc/Kconfig
++++ b/drivers/usb/gadget/udc/bdc/Kconfig
+@@ -14,7 +14,7 @@ if USB_BDC_UDC
+ comment "Platform Support"
+ config USB_BDC_PCI
+ tristate "BDC support for PCIe based platforms"
+- depends on PCI
++ depends on PCI && BROKEN
+ default USB_BDC_UDC
+ help
+ Enable support for platforms which have BDC connected through PCIe, such as Lego3 FPGA platform.
--- /dev/null
+From 576667bad341516edc4e18eb85acb0a2b4c9c9d9 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 15 Jan 2021 18:19:06 +0200
+Subject: xhci: make sure TRB is fully written before giving it to the controller
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 576667bad341516edc4e18eb85acb0a2b4c9c9d9 upstream.
+
+Once the command ring doorbell is rung the xHC controller will parse all
+command TRBs on the command ring that have the cycle bit set properly.
+
+If the driver just started writing the next command TRB to the ring when
+hardware finished the previous TRB, then HW might fetch an incomplete TRB
+as long as its cycle bit set correctly.
+
+A command TRB is 16 bytes (128 bits) long.
+Driver writes the command TRB in four 32 bit chunks, with the chunk
+containing the cycle bit last. This does however not guarantee that
+chunks actually get written in that order.
+
+This was detected in stress testing when canceling URBs with several
+connected USB devices.
+Two consecutive "Set TR Dequeue pointer" commands got queued right
+after each other, and the second one was only partially written when
+the controller parsed it, causing the dequeue pointer to be set
+to bogus values. This was seen as error messages:
+
+"Mismatch between completed Set TR Deq Ptr command & xHCI internal state"
+
+Solution is to add a write memory barrier before writing the cycle bit.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Ross Zwisler <zwisler@google.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115161907.2875631-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2840,6 +2840,8 @@ static void queue_trb(struct xhci_hcd *x
+ trb->field[0] = cpu_to_le32(field1);
+ trb->field[1] = cpu_to_le32(field2);
+ trb->field[2] = cpu_to_le32(field3);
++ /* make sure TRB is fully written before giving it to the controller */
++ wmb();
+ trb->field[3] = cpu_to_le32(field4);
+ inc_enq(xhci, ring, more_trbs_coming);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
