From: Greg Kroah-Hartman Date: Fri, 10 Sep 2021 07:13:52 +0000 (+0200) Subject: 5.14-stable patches X-Git-Tag: v5.4.145~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=90fa7582f0be190a63a9f930fb6837e4fe23f393;p=thirdparty%2Fkernel%2Fstable-queue.git 5.14-stable patches added patches: alsa-usb-audio-add-registration-quirk-for-jbl-quantum-800.patch bluetooth-add-additional-bluetooth-part-for-realtek-8852ae.patch bluetooth-btusb-make-the-csr-clone-chip-force-suspend-workaround-more-generic.patch cxl-acpi-do-not-add-dsdt-disabled-acpi0016-host-bridge-ports.patch cxl-pci-fix-debug-message-in-cxl_probe_regs.patch cxl-pci-fix-lockdown-level.patch pci-call-max-payload-size-related-fixup-quirks-early.patch staging-mt7621-pci-fix-hang-when-nothing-is-connected-to-pcie-ports.patch usb-cdnsp-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch usb-gadget-tegra-xudc-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch usb-host-xhci-rcar-don-t-reload-firmware-after-the-completion.patch usb-mtu3-fix-the-wrong-hs-mult-value.patch usb-mtu3-restore-hs-function-when-set-ss-ssp.patch usb-mtu3-use-mult-for-hs-isoc-or-intr.patch usb-xhci-mtk-fix-issue-of-out-of-bounds-array-access.patch x86-reboot-limit-dell-optiplex-990-quirk-to-early-bios-versions.patch xhci-fix-even-more-unsafe-memory-usage-in-xhci-tracing.patch xhci-fix-failure-to-give-back-some-cached-cancelled-urbs.patch xhci-fix-unsafe-memory-usage-in-xhci-tracing.patch --- diff --git a/queue-5.14/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-800.patch b/queue-5.14/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-800.patch new file mode 100644 index 00000000000..ebc6b6abe84 --- /dev/null +++ b/queue-5.14/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-800.patch @@ -0,0 +1,31 @@ +From c8b177b6e3a005bd8fb0395a4bc5db3470301c28 Mon Sep 17 00:00:00 2001 +From: Alexander Tsoy +Date: Tue, 31 Aug 2021 03:25:31 +0300 +Subject: ALSA: usb-audio: Add registration quirk for JBL Quantum 800 + +From: Alexander Tsoy + +commit c8b177b6e3a005bd8fb0395a4bc5db3470301c28 upstream. + +Add another device ID for JBL Quantum 800. It requires the same quirk as +other JBL Quantum devices. + +Signed-off-by: Alexander Tsoy +Cc: +Link: https://lore.kernel.org/r/20210831002531.116957-1-alexander@tsoy.me +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1898,6 +1898,7 @@ static const struct registration_quirk r + REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */ + REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ + REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ ++ REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */ + REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ + REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ + REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ diff --git a/queue-5.14/bluetooth-add-additional-bluetooth-part-for-realtek-8852ae.patch b/queue-5.14/bluetooth-add-additional-bluetooth-part-for-realtek-8852ae.patch new file mode 100644 index 00000000000..3e66b840477 --- /dev/null +++ b/queue-5.14/bluetooth-add-additional-bluetooth-part-for-realtek-8852ae.patch @@ -0,0 +1,65 @@ +From 6eefec4a0b668de9bbb33bd3e7acfbcc794162b0 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Wed, 4 Aug 2021 09:50:33 -0500 +Subject: Bluetooth: Add additional Bluetooth part for Realtek 8852AE + +From: Larry Finger + +commit 6eefec4a0b668de9bbb33bd3e7acfbcc794162b0 upstream. + +This Realtek device has both wifi and BT components. The latter reports +a USB ID of 04ca:4006, which is not in the table. + +The portion of /sys/kernel/debug/usb/devices pertaining to this device is + +T: Bus=02 Lev=01 Prnt=01 Port=12 Cnt=04 Dev#= 4 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04ca ProdID=4006 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Larry Finger +Cc: Stable +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -452,6 +452,10 @@ static const struct usb_device_id blackl + /* Additional Realtek 8822CE Bluetooth devices */ + { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ /* Bluetooth component of Realtek 8852AE device */ ++ { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, ++ + { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK | diff --git a/queue-5.14/bluetooth-btusb-make-the-csr-clone-chip-force-suspend-workaround-more-generic.patch b/queue-5.14/bluetooth-btusb-make-the-csr-clone-chip-force-suspend-workaround-more-generic.patch new file mode 100644 index 00000000000..bf4700484b4 --- /dev/null +++ b/queue-5.14/bluetooth-btusb-make-the-csr-clone-chip-force-suspend-workaround-more-generic.patch @@ -0,0 +1,125 @@ +From f4292e2faf522f899b642d2040a2edbcbd455b9f Mon Sep 17 00:00:00 2001 +From: Ismael Ferreras Morezuelas +Date: Sat, 17 Jul 2021 01:21:43 +0200 +Subject: Bluetooth: btusb: Make the CSR clone chip force-suspend workaround more generic + +From: Ismael Ferreras Morezuelas + +commit f4292e2faf522f899b642d2040a2edbcbd455b9f upstream. + +Turns out Hans de Goede completed the work I started last year trying to +improve Chinese-clone detection of CSR controller chips. Quirk after quirk +these Bluetooth dongles are more usable now. + +Even after a few BlueZ regressions; these clones are so fickle that some +days they stop working altogether. Except on Windows, they work fine. + +But this force-suspend initialization quirk seems to mostly do the trick, +after a lot of testing Bluetooth now seems to work *all* the time. + +The only problem is that the solution ended up being masked under a very +stringent check; when there are probably hundreds of fake dongle +models out there that benefit from a good reset. Make it so. + +Fixes: 81cac64ba258a ("Bluetooth: Deal with USB devices that are faking CSR vendor") +Fixes: cde1a8a992875 ("Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers") +Fixes: d74e0ae7e0303 ("Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134") +Fixes: 0671c0662383e ("Bluetooth: btusb: Add workaround for remote-wakeup issues with Barrot 8041a02 fake CSR controllers") + +Cc: stable@vger.kernel.org +Cc: Hans de Goede +Tested-by: Ismael Ferreras Morezuelas +Signed-off-by: Ismael Ferreras Morezuelas +Reviewed-by: Hans de Goede +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 63 ++++++++++++++++++++++++---------------------- + 1 file changed, 34 insertions(+), 29 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1899,7 +1899,7 @@ static int btusb_setup_csr(struct hci_de + is_fake = true; + + if (is_fake) { +- bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds..."); ++ bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once..."); + + /* Generally these clones have big discrepancies between + * advertised features and what's actually supported. +@@ -1916,41 +1916,46 @@ static int btusb_setup_csr(struct hci_de + clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); + + /* +- * Special workaround for clones with a Barrot 8041a02 chip, +- * these clones are really messed-up: +- * 1. Their bulk rx endpoint will never report any data unless +- * the device was suspended at least once (yes really). ++ * Special workaround for these BT 4.0 chip clones, and potentially more: ++ * ++ * - 0x0134: a Barrot 8041a02 (HCI rev: 0x1012 sub: 0x0810) ++ * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709) ++ * ++ * These controllers are really messed-up. ++ * ++ * 1. Their bulk RX endpoint will never report any data unless ++ * the device was suspended at least once (yes, really). + * 2. They will not wakeup when autosuspended and receiving data +- * on their bulk rx endpoint from e.g. a keyboard or mouse ++ * on their bulk RX endpoint from e.g. a keyboard or mouse + * (IOW remote-wakeup support is broken for the bulk endpoint). + * + * To fix 1. enable runtime-suspend, force-suspend the +- * hci and then wake-it up by disabling runtime-suspend. ++ * HCI and then wake-it up by disabling runtime-suspend. + * +- * To fix 2. clear the hci's can_wake flag, this way the hci ++ * To fix 2. clear the HCI's can_wake flag, this way the HCI + * will still be autosuspended when it is not open. ++ * ++ * -- ++ * ++ * Because these are widespread problems we prefer generic solutions; so ++ * apply this initialization quirk to every controller that gets here, ++ * it should be harmless. The alternative is to not work at all. + */ +- if (bcdDevice == 0x8891 && +- le16_to_cpu(rp->lmp_subver) == 0x1012 && +- le16_to_cpu(rp->hci_rev) == 0x0810 && +- le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_4_0) { +- bt_dev_warn(hdev, "CSR: detected a fake CSR dongle using a Barrot 8041a02 chip, this chip is very buggy and may have issues"); +- +- pm_runtime_allow(&data->udev->dev); +- +- ret = pm_runtime_suspend(&data->udev->dev); +- if (ret >= 0) +- msleep(200); +- else +- bt_dev_err(hdev, "Failed to suspend the device for Barrot 8041a02 receive-issue workaround"); +- +- pm_runtime_forbid(&data->udev->dev); +- +- device_set_wakeup_capable(&data->udev->dev, false); +- /* Re-enable autosuspend if this was requested */ +- if (enable_autosuspend) +- usb_enable_autosuspend(data->udev); +- } ++ pm_runtime_allow(&data->udev->dev); ++ ++ ret = pm_runtime_suspend(&data->udev->dev); ++ if (ret >= 0) ++ msleep(200); ++ else ++ bt_dev_err(hdev, "CSR: Failed to suspend the device for our Barrot 8041a02 receive-issue workaround"); ++ ++ pm_runtime_forbid(&data->udev->dev); ++ ++ device_set_wakeup_capable(&data->udev->dev, false); ++ ++ /* Re-enable autosuspend if this was requested */ ++ if (enable_autosuspend) ++ usb_enable_autosuspend(data->udev); + } + + kfree_skb(skb); diff --git a/queue-5.14/cxl-acpi-do-not-add-dsdt-disabled-acpi0016-host-bridge-ports.patch b/queue-5.14/cxl-acpi-do-not-add-dsdt-disabled-acpi0016-host-bridge-ports.patch new file mode 100644 index 00000000000..9dc2dbc0208 --- /dev/null +++ b/queue-5.14/cxl-acpi-do-not-add-dsdt-disabled-acpi0016-host-bridge-ports.patch @@ -0,0 +1,69 @@ +From a7bfaad54b8b9cf06041528988d6b75b4b921546 Mon Sep 17 00:00:00 2001 +From: Alison Schofield +Date: Fri, 3 Sep 2021 19:20:39 -0700 +Subject: cxl/acpi: Do not add DSDT disabled ACPI0016 host bridge ports + +From: Alison Schofield + +commit a7bfaad54b8b9cf06041528988d6b75b4b921546 upstream. + +During CXL ACPI probe, host bridge ports are discovered by scanning +the ACPI0017 root port for ACPI0016 host bridge devices. The scan +matches on the hardware id of "ACPI0016". An issue occurs when an +ACPI0016 device is defined in the DSDT yet disabled on the platform. +Attempts by the cxl_acpi driver to add host bridge ports using a +disabled device fails, and the entire cxl_acpi probe fails. + +The DSDT table includes an _STA method that sets the status and the +ACPI subsystem has checks available to examine it. One such check is +in the acpi_pci_find_root() path. Move the call to acpi_pci_find_root() +to the matching function to prevent this issue when adding either +upstream or downstream ports. + +Suggested-by: Dan Williams +Signed-off-by: Alison Schofield +Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances") +Cc: +Reviewed-by: Jonathan Cameron +Link: https://lore.kernel.org/r/163072203957.2250120.2178685721061002124.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cxl/acpi.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/cxl/acpi.c ++++ b/drivers/cxl/acpi.c +@@ -243,6 +243,9 @@ static struct acpi_device *to_cxl_host_b + { + struct acpi_device *adev = to_acpi_device(dev); + ++ if (!acpi_pci_find_root(adev->handle)) ++ return NULL; ++ + if (strcmp(acpi_device_hid(adev), "ACPI0016") == 0) + return adev; + return NULL; +@@ -266,10 +269,6 @@ static int add_host_bridge_uport(struct + if (!bridge) + return 0; + +- pci_root = acpi_pci_find_root(bridge->handle); +- if (!pci_root) +- return -ENXIO; +- + dport = find_dport_by_dev(root_port, match); + if (!dport) { + dev_dbg(host, "host bridge expected and not found\n"); +@@ -282,6 +281,11 @@ static int add_host_bridge_uport(struct + return PTR_ERR(port); + dev_dbg(host, "%s: add: %s\n", dev_name(match), dev_name(&port->dev)); + ++ /* ++ * Note that this lookup already succeeded in ++ * to_cxl_host_bridge(), so no need to check for failure here ++ */ ++ pci_root = acpi_pci_find_root(bridge->handle); + ctx = (struct cxl_walk_context){ + .dev = host, + .root = pci_root->bus, diff --git a/queue-5.14/cxl-pci-fix-debug-message-in-cxl_probe_regs.patch b/queue-5.14/cxl-pci-fix-debug-message-in-cxl_probe_regs.patch new file mode 100644 index 00000000000..2dfd9222ceb --- /dev/null +++ b/queue-5.14/cxl-pci-fix-debug-message-in-cxl_probe_regs.patch @@ -0,0 +1,36 @@ +From da582aa5ad5787c46e3f475ab3f4602ec84c1617 Mon Sep 17 00:00:00 2001 +From: "Li Qiang (Johnny Li)" +Date: Fri, 3 Sep 2021 19:20:50 -0700 +Subject: cxl/pci: Fix debug message in cxl_probe_regs() + +From: Li Qiang (Johnny Li) + +commit da582aa5ad5787c46e3f475ab3f4602ec84c1617 upstream. + +Indicator string for mbox and memdev register set to status +incorrectly in error message. + +Cc: +Fixes: 30af97296f48 ("cxl/pci: Map registers based on capabilities") +Signed-off-by: Li Qiang (Johnny Li) +Reviewed-by: Jonathan Cameron +Link: https://lore.kernel.org/r/163072205089.2250120.8103605864156687395.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cxl/pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/cxl/pci.c ++++ b/drivers/cxl/pci.c +@@ -1022,8 +1022,8 @@ static int cxl_probe_regs(struct cxl_mem + !dev_map->memdev.valid) { + dev_err(dev, "registers not found: %s%s%s\n", + !dev_map->status.valid ? "status " : "", +- !dev_map->mbox.valid ? "status " : "", +- !dev_map->memdev.valid ? "status " : ""); ++ !dev_map->mbox.valid ? "mbox " : "", ++ !dev_map->memdev.valid ? "memdev " : ""); + return -ENXIO; + } + diff --git a/queue-5.14/cxl-pci-fix-lockdown-level.patch b/queue-5.14/cxl-pci-fix-lockdown-level.patch new file mode 100644 index 00000000000..c9e8831b45d --- /dev/null +++ b/queue-5.14/cxl-pci-fix-lockdown-level.patch @@ -0,0 +1,38 @@ +From 9e56614c44b994b78fc9fcb2070bcbe3f5df0d7b Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Fri, 3 Sep 2021 19:20:45 -0700 +Subject: cxl/pci: Fix lockdown level + +From: Dan Williams + +commit 9e56614c44b994b78fc9fcb2070bcbe3f5df0d7b upstream. + +A proposed rework of security_locked_down() users identified that the +cxl_pci driver was passing the wrong lockdown_reason. Update +cxl_mem_raw_command_allowed() to fail raw command access when raw pci +access is also disabled. + +Fixes: 13237183c735 ("cxl/mem: Add a "RAW" send command") +Cc: Ben Widawsky +Cc: Jonathan Cameron +Cc: +Cc: Ondrej Mosnacek +Cc: Paul Moore +Link: https://lore.kernel.org/r/163072204525.2250120.16615792476976546735.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cxl/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cxl/pci.c ++++ b/drivers/cxl/pci.c +@@ -568,7 +568,7 @@ static bool cxl_mem_raw_command_allowed( + if (!IS_ENABLED(CONFIG_CXL_MEM_RAW_COMMANDS)) + return false; + +- if (security_locked_down(LOCKDOWN_NONE)) ++ if (security_locked_down(LOCKDOWN_PCI_ACCESS)) + return false; + + if (cxl_raw_allow_all) diff --git a/queue-5.14/pci-call-max-payload-size-related-fixup-quirks-early.patch b/queue-5.14/pci-call-max-payload-size-related-fixup-quirks-early.patch new file mode 100644 index 00000000000..89d0dd00220 --- /dev/null +++ b/queue-5.14/pci-call-max-payload-size-related-fixup-quirks-early.patch @@ -0,0 +1,49 @@ +From b8da302e2955fe4d41eb9d48199242674d77dbe0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Beh=C3=BAn?= +Date: Thu, 24 Jun 2021 19:14:17 +0200 +Subject: PCI: Call Max Payload Size-related fixup quirks early +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +commit b8da302e2955fe4d41eb9d48199242674d77dbe0 upstream. + +pci_device_add() calls HEADER fixups after pci_configure_device(), which +configures Max Payload Size. + +Convert MPS-related fixups to EARLY fixups so pci_configure_mps() takes +them into account. + +Fixes: 27d868b5e6cfa ("PCI: Set MPS to match upstream bridge") +Link: https://lore.kernel.org/r/20210624171418.27194-1-kabel@kernel.org +Signed-off-by: Marek Behún +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3235,12 +3235,12 @@ static void fixup_mpss_256(struct pci_de + { + dev->pcie_mpss = 1; /* 256 bytes */ + } +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, +- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, +- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, +- PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, ++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, ++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, ++ PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); + + /* + * Intel 5000 and 5100 Memory controllers have an erratum with read completion diff --git a/queue-5.14/series b/queue-5.14/series index bbec9b27497..e5ed36a5153 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -2,3 +2,22 @@ firmware-dmi-move-product_sku-info-to-the-end-of-the-modalias.patch can-c_can-fix-null-ptr-deref-on-ioctl.patch igmp-add-ip_mc_list-lock-in-ip_check_mc_rcu.patch revert-r8169-avoid-link-up-interrupt-issue-on-rtl8106e-if-user-enables-aspm.patch +alsa-usb-audio-add-registration-quirk-for-jbl-quantum-800.patch +bluetooth-add-additional-bluetooth-part-for-realtek-8852ae.patch +bluetooth-btusb-make-the-csr-clone-chip-force-suspend-workaround-more-generic.patch +usb-host-xhci-rcar-don-t-reload-firmware-after-the-completion.patch +usb-xhci-mtk-fix-issue-of-out-of-bounds-array-access.patch +usb-cdnsp-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch +usb-gadget-tegra-xudc-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch +usb-mtu3-restore-hs-function-when-set-ss-ssp.patch +usb-mtu3-use-mult-for-hs-isoc-or-intr.patch +usb-mtu3-fix-the-wrong-hs-mult-value.patch +xhci-fix-even-more-unsafe-memory-usage-in-xhci-tracing.patch +xhci-fix-unsafe-memory-usage-in-xhci-tracing.patch +xhci-fix-failure-to-give-back-some-cached-cancelled-urbs.patch +staging-mt7621-pci-fix-hang-when-nothing-is-connected-to-pcie-ports.patch +x86-reboot-limit-dell-optiplex-990-quirk-to-early-bios-versions.patch +pci-call-max-payload-size-related-fixup-quirks-early.patch +cxl-pci-fix-debug-message-in-cxl_probe_regs.patch +cxl-pci-fix-lockdown-level.patch +cxl-acpi-do-not-add-dsdt-disabled-acpi0016-host-bridge-ports.patch diff --git a/queue-5.14/staging-mt7621-pci-fix-hang-when-nothing-is-connected-to-pcie-ports.patch b/queue-5.14/staging-mt7621-pci-fix-hang-when-nothing-is-connected-to-pcie-ports.patch new file mode 100644 index 00000000000..8a3856b6202 --- /dev/null +++ b/queue-5.14/staging-mt7621-pci-fix-hang-when-nothing-is-connected-to-pcie-ports.patch @@ -0,0 +1,83 @@ +From 7d761b084b3c785e1fbbe707fbdf7baba905c6ad Mon Sep 17 00:00:00 2001 +From: Sergio Paracuellos +Date: Mon, 23 Aug 2021 19:08:03 +0200 +Subject: staging: mt7621-pci: fix hang when nothing is connected to pcie ports + +From: Sergio Paracuellos + +commit 7d761b084b3c785e1fbbe707fbdf7baba905c6ad upstream. + +When nothing is connected to pcie ports, each port is set to reset state. +When this occurs, next access result in a hang on boot as follows: + +mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK) +mt7621-pci 1e140000.pcie: pcie1 no card, disable it (RST & CLK) +mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK) +[ HANGS HERE ] + +Fix this just detecting 'nothing is connected state' to avoid next accesses +to pcie port related configuration registers. + +Fixes: b99cc3a2b6b6 ("staging: mt7621-pci: avoid custom 'map_irq' function") +Cc: stable +Reported-by: DENG Qingfang +Signed-off-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20210823170803.2108-1-sergio.paracuellos@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/mt7621-pci/pci-mt7621.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/staging/mt7621-pci/pci-mt7621.c ++++ b/drivers/staging/mt7621-pci/pci-mt7621.c +@@ -56,6 +56,7 @@ + #define PCIE_BAR_ENABLE BIT(0) + #define PCIE_PORT_INT_EN(x) BIT(20 + (x)) + #define PCIE_PORT_LINKUP BIT(0) ++#define PCIE_PORT_CNT 3 + + #define PERST_DELAY_MS 100 + +@@ -388,10 +389,11 @@ static void mt7621_pcie_reset_ep_deasser + msleep(PERST_DELAY_MS); + } + +-static void mt7621_pcie_init_ports(struct mt7621_pcie *pcie) ++static int mt7621_pcie_init_ports(struct mt7621_pcie *pcie) + { + struct device *dev = pcie->dev; + struct mt7621_pcie_port *port, *tmp; ++ u8 num_disabled = 0; + int err; + + mt7621_pcie_reset_assert(pcie); +@@ -423,6 +425,7 @@ static void mt7621_pcie_init_ports(struc + slot); + mt7621_control_assert(port); + port->enabled = false; ++ num_disabled++; + + if (slot == 0) { + tmp = port; +@@ -433,6 +436,8 @@ static void mt7621_pcie_init_ports(struc + phy_power_off(tmp->phy); + } + } ++ ++ return (num_disabled != PCIE_PORT_CNT) ? 0 : -ENODEV; + } + + static void mt7621_pcie_enable_port(struct mt7621_pcie_port *port) +@@ -540,7 +545,11 @@ static int mt7621_pci_probe(struct platf + return err; + } + +- mt7621_pcie_init_ports(pcie); ++ err = mt7621_pcie_init_ports(pcie); ++ if (err) { ++ dev_err(dev, "Nothing connected in virtual bridges\n"); ++ return 0; ++ } + + err = mt7621_pcie_enable_ports(bridge); + if (err) { diff --git a/queue-5.14/usb-cdnsp-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch b/queue-5.14/usb-cdnsp-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch new file mode 100644 index 00000000000..0a8fc28e66f --- /dev/null +++ b/queue-5.14/usb-cdnsp-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch @@ -0,0 +1,34 @@ +From e9ab75f26eb9354dfc03aea3401b8cfb42cd6718 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Fri, 13 Aug 2021 14:30:50 +0800 +Subject: usb: cdnsp: fix the wrong mult value for HS isoc or intr + +From: Chunfeng Yun + +commit e9ab75f26eb9354dfc03aea3401b8cfb42cd6718 upstream. + +usb_endpoint_maxp() only returns the bit[10:0] of wMaxPacketSize +of endpoint descriptor, not include bit[12:11] anymore, so use +usb_endpoint_maxp_mult() instead. + +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +Cc: stable@vger.kernel.org +Acked-by: Felipe Balbi +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1628836253-7432-4-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdnsp-mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/cdns3/cdnsp-mem.c ++++ b/drivers/usb/cdns3/cdnsp-mem.c +@@ -882,7 +882,7 @@ static u32 cdnsp_get_endpoint_max_burst( + if (g->speed == USB_SPEED_HIGH && + (usb_endpoint_xfer_isoc(pep->endpoint.desc) || + usb_endpoint_xfer_int(pep->endpoint.desc))) +- return (usb_endpoint_maxp(pep->endpoint.desc) & 0x1800) >> 11; ++ return usb_endpoint_maxp_mult(pep->endpoint.desc) - 1; + + return 0; + } diff --git a/queue-5.14/usb-gadget-tegra-xudc-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch b/queue-5.14/usb-gadget-tegra-xudc-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch new file mode 100644 index 00000000000..d1bed4743bc --- /dev/null +++ b/queue-5.14/usb-gadget-tegra-xudc-fix-the-wrong-mult-value-for-hs-isoc-or-intr.patch @@ -0,0 +1,44 @@ +From eeb0cfb6b2b6b731902e68af641e30bd31be3c7b Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Fri, 13 Aug 2021 14:30:51 +0800 +Subject: usb: gadget: tegra-xudc: fix the wrong mult value for HS isoc or intr + +From: Chunfeng Yun + +commit eeb0cfb6b2b6b731902e68af641e30bd31be3c7b upstream. + +usb_endpoint_maxp() only returns the bit[10:0] of wMaxPacketSize +of endpoint descriptor, not includes bit[12:11] anymore, so use +usb_endpoint_maxp_mult() instead. +Meanwhile no need AND 0x7ff when get maxp, remove it. + +Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller") +Cc: stable@vger.kernel.org +Acked-by: Felipe Balbi +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1628836253-7432-5-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/tegra-xudc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -1610,7 +1610,7 @@ static void tegra_xudc_ep_context_setup( + u16 maxpacket, maxburst = 0, esit = 0; + u32 val; + +- maxpacket = usb_endpoint_maxp(desc) & 0x7ff; ++ maxpacket = usb_endpoint_maxp(desc); + if (xudc->gadget.speed == USB_SPEED_SUPER) { + if (!usb_endpoint_xfer_control(desc)) + maxburst = comp_desc->bMaxBurst; +@@ -1621,7 +1621,7 @@ static void tegra_xudc_ep_context_setup( + (usb_endpoint_xfer_int(desc) || + usb_endpoint_xfer_isoc(desc))) { + if (xudc->gadget.speed == USB_SPEED_HIGH) { +- maxburst = (usb_endpoint_maxp(desc) >> 11) & 0x3; ++ maxburst = usb_endpoint_maxp_mult(desc) - 1; + if (maxburst == 0x3) { + dev_warn(xudc->dev, + "invalid endpoint maxburst\n"); diff --git a/queue-5.14/usb-host-xhci-rcar-don-t-reload-firmware-after-the-completion.patch b/queue-5.14/usb-host-xhci-rcar-don-t-reload-firmware-after-the-completion.patch new file mode 100644 index 00000000000..3068ce8b37d --- /dev/null +++ b/queue-5.14/usb-host-xhci-rcar-don-t-reload-firmware-after-the-completion.patch @@ -0,0 +1,38 @@ +From 57f3ffdc11143f56f1314972fe86fe17a0dcde85 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Fri, 27 Aug 2021 15:32:27 +0900 +Subject: usb: host: xhci-rcar: Don't reload firmware after the completion + +From: Yoshihiro Shimoda + +commit 57f3ffdc11143f56f1314972fe86fe17a0dcde85 upstream. + +According to the datasheet, "Upon the completion of FW Download, +there is no need to write or reload FW.". Otherwise, it's possible +to cause unexpected behaviors. So, adds such a condition. + +Fixes: 4ac8918f3a73 ("usb: host: xhci-plat: add support for the R-Car H2 and M2 xHCI controllers") +Cc: stable@vger.kernel.org # v3.17+ +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20210827063227.81990-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-rcar.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -134,6 +134,13 @@ static int xhci_rcar_download_firmware(s + const struct soc_device_attribute *attr; + const char *firmware_name; + ++ /* ++ * According to the datasheet, "Upon the completion of FW Download, ++ * there is no need to write or reload FW". ++ */ ++ if (readl(regs + RCAR_USB3_DL_CTRL) & RCAR_USB3_DL_CTRL_FW_SUCCESS) ++ return 0; ++ + attr = soc_device_match(rcar_quirks_match); + if (attr) + quirks = (uintptr_t)attr->data; diff --git a/queue-5.14/usb-mtu3-fix-the-wrong-hs-mult-value.patch b/queue-5.14/usb-mtu3-fix-the-wrong-hs-mult-value.patch new file mode 100644 index 00000000000..06de9044fa0 --- /dev/null +++ b/queue-5.14/usb-mtu3-fix-the-wrong-hs-mult-value.patch @@ -0,0 +1,49 @@ +From 44e4439d8f9f8d0e9da767d1f31e7c211081feca Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Fri, 13 Aug 2021 14:30:49 +0800 +Subject: usb: mtu3: fix the wrong HS mult value + +From: Chunfeng Yun + +commit 44e4439d8f9f8d0e9da767d1f31e7c211081feca upstream. + +usb_endpoint_maxp() returns actual max packet size, @mult will +always be zero, fix it by using usb_endpoint_maxp_mult() instead +to get mult. + +Fixes: 4d79e042ed8b ("usb: mtu3: add support for usb3.1 IP") +Cc: stable@vger.kernel.org +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1628836253-7432-3-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/mtu3/mtu3_gadget.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -64,14 +64,12 @@ static int mtu3_ep_enable(struct mtu3_ep + u32 interval = 0; + u32 mult = 0; + u32 burst = 0; +- int max_packet; + int ret; + + desc = mep->desc; + comp_desc = mep->comp_desc; + mep->type = usb_endpoint_type(desc); +- max_packet = usb_endpoint_maxp(desc); +- mep->maxp = max_packet & GENMASK(10, 0); ++ mep->maxp = usb_endpoint_maxp(desc); + + switch (mtu->g.speed) { + case USB_SPEED_SUPER: +@@ -92,7 +90,7 @@ static int mtu3_ep_enable(struct mtu3_ep + usb_endpoint_xfer_int(desc)) { + interval = desc->bInterval; + interval = clamp_val(interval, 1, 16) - 1; +- mult = (max_packet & GENMASK(12, 11)) >> 11; ++ mult = usb_endpoint_maxp_mult(desc) - 1; + } + break; + default: diff --git a/queue-5.14/usb-mtu3-restore-hs-function-when-set-ss-ssp.patch b/queue-5.14/usb-mtu3-restore-hs-function-when-set-ss-ssp.patch new file mode 100644 index 00000000000..eee54935602 --- /dev/null +++ b/queue-5.14/usb-mtu3-restore-hs-function-when-set-ss-ssp.patch @@ -0,0 +1,38 @@ +From e88f28514065a6c48aadc367efb0ef6378a01543 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Fri, 13 Aug 2021 14:30:47 +0800 +Subject: usb: mtu3: restore HS function when set SS/SSP + +From: Chunfeng Yun + +commit e88f28514065a6c48aadc367efb0ef6378a01543 upstream. + +Due to HS function is disabled when set as FS, need restore +it when set as SS/SSP. + +Fixes: dc4c1aa7eae9 ("usb: mtu3: add ->udc_set_speed()") +Cc: stable@vger.kernel.org +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1628836253-7432-1-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/mtu3/mtu3_core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/mtu3/mtu3_core.c ++++ b/drivers/usb/mtu3/mtu3_core.c +@@ -227,11 +227,13 @@ static void mtu3_set_speed(struct mtu3 * + mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE); + break; + case USB_SPEED_SUPER: ++ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE); + mtu3_clrbits(mtu->ippc_base, SSUSB_U3_CTRL(0), + SSUSB_U3_PORT_SSP_SPEED); + break; + case USB_SPEED_SUPER_PLUS: +- mtu3_setbits(mtu->ippc_base, SSUSB_U3_CTRL(0), ++ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE); ++ mtu3_setbits(mtu->ippc_base, SSUSB_U3_CTRL(0), + SSUSB_U3_PORT_SSP_SPEED); + break; + default: diff --git a/queue-5.14/usb-mtu3-use-mult-for-hs-isoc-or-intr.patch b/queue-5.14/usb-mtu3-use-mult-for-hs-isoc-or-intr.patch new file mode 100644 index 00000000000..3da4f04b8f8 --- /dev/null +++ b/queue-5.14/usb-mtu3-use-mult-for-hs-isoc-or-intr.patch @@ -0,0 +1,32 @@ +From fd7cb394ec7efccc3985feb0978cee4d352e1817 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Fri, 13 Aug 2021 14:30:48 +0800 +Subject: usb: mtu3: use @mult for HS isoc or intr + +From: Chunfeng Yun + +commit fd7cb394ec7efccc3985feb0978cee4d352e1817 upstream. + +For HS isoc or intr, should use @mult but not @burst +to save mult value. + +Fixes: 4d79e042ed8b ("usb: mtu3: add support for usb3.1 IP") +Cc: stable@vger.kernel.org +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1628836253-7432-2-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/mtu3/mtu3_gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -92,7 +92,7 @@ static int mtu3_ep_enable(struct mtu3_ep + usb_endpoint_xfer_int(desc)) { + interval = desc->bInterval; + interval = clamp_val(interval, 1, 16) - 1; +- burst = (max_packet & GENMASK(12, 11)) >> 11; ++ mult = (max_packet & GENMASK(12, 11)) >> 11; + } + break; + default: diff --git a/queue-5.14/usb-xhci-mtk-fix-issue-of-out-of-bounds-array-access.patch b/queue-5.14/usb-xhci-mtk-fix-issue-of-out-of-bounds-array-access.patch new file mode 100644 index 00000000000..9fc23e4fbfc --- /dev/null +++ b/queue-5.14/usb-xhci-mtk-fix-issue-of-out-of-bounds-array-access.patch @@ -0,0 +1,42 @@ +From de5107f473190538a65aac7edea85209cd5c1a8f Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Tue, 17 Aug 2021 16:36:25 +0800 +Subject: usb: xhci-mtk: fix issue of out-of-bounds array access + +From: Chunfeng Yun + +commit de5107f473190538a65aac7edea85209cd5c1a8f upstream. + +Bus bandwidth array access is based on esit, increase one +will cause out-of-bounds issue; for example, when esit is +XHCI_MTK_MAX_ESIT, will overstep boundary. + +Fixes: 7c986fbc16ae ("usb: xhci-mtk: get the microframe boundary for ESIT") +Cc: +Reported-by: Stan Lu +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1629189389-18779-5-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mtk-sch.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/xhci-mtk-sch.c ++++ b/drivers/usb/host/xhci-mtk-sch.c +@@ -575,10 +575,12 @@ static u32 get_esit_boundary(struct mu3h + u32 boundary = sch_ep->esit; + + if (sch_ep->sch_tt) { /* LS/FS with TT */ +- /* tune for CS */ +- if (sch_ep->ep_type != ISOC_OUT_EP) +- boundary++; +- else if (boundary > 1) /* normally esit >= 8 for FS/LS */ ++ /* ++ * tune for CS, normally esit >= 8 for FS/LS, ++ * not add one for other types to avoid access array ++ * out of boundary ++ */ ++ if (sch_ep->ep_type == ISOC_OUT_EP && boundary > 1) + boundary--; + } + diff --git a/queue-5.14/x86-reboot-limit-dell-optiplex-990-quirk-to-early-bios-versions.patch b/queue-5.14/x86-reboot-limit-dell-optiplex-990-quirk-to-early-bios-versions.patch new file mode 100644 index 00000000000..bfce2f72bb4 --- /dev/null +++ b/queue-5.14/x86-reboot-limit-dell-optiplex-990-quirk-to-early-bios-versions.patch @@ -0,0 +1,87 @@ +From a729691b541f6e63043beae72e635635abe5dc09 Mon Sep 17 00:00:00 2001 +From: Paul Gortmaker +Date: Sun, 30 May 2021 12:24:47 -0400 +Subject: x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions + +From: Paul Gortmaker + +commit a729691b541f6e63043beae72e635635abe5dc09 upstream. + +When this platform was relatively new in November 2011, with early BIOS +revisions, a reboot quirk was added in commit 6be30bb7d750 ("x86/reboot: +Blacklist Dell OptiPlex 990 known to require PCI reboot") + +However, this quirk (and several others) are open-ended to all BIOS +versions and left no automatic expiry if/when the system BIOS fixed the +issue, meaning that nobody is likely to come along and re-test. + +What is really problematic with using PCI reboot as this quirk does, is +that it causes this platform to do a full power down, wait one second, +and then power back on. This is less than ideal if one is using it for +boot testing and/or bisecting kernels when legacy rotating hard disks +are installed. + +It was only by chance that the quirk was noticed in dmesg - and when +disabled it turned out that it wasn't required anymore (BIOS A24), and a +default reboot would work fine without the "harshness" of power cycling the +machine (and disks) down and up like the PCI reboot does. + +Doing a bit more research, it seems that the "newest" BIOS for which the +issue was reported[1] was version A06, however Dell[2] seemed to suggest +only up to and including version A05, with the A06 having a large number of +fixes[3] listed. + +As is typical with a new platform, the initial BIOS updates come frequently +and then taper off (and in this case, with a revival for CPU CVEs); a +search for O990-A.exe reveals the following dates: + + A02 16 Mar 2011 + A03 11 May 2011 + A06 14 Sep 2011 + A07 24 Oct 2011 + A10 08 Dec 2011 + A14 06 Sep 2012 + A16 15 Oct 2012 + A18 30 Sep 2013 + A19 23 Sep 2015 + A20 02 Jun 2017 + A23 07 Mar 2018 + A24 21 Aug 2018 + +While it's overkill to flash and test each of the above, it would seem +likely that the issue was contained within A0x BIOS versions, given the +dates above and the dates of issue reports[4] from distros. So rather than +just throw out the quirk entirely, limit the scope to just those early BIOS +versions, in case people are still running systems from 2011 with the +original as-shipped early A0x BIOS versions. + +[1] https://lore.kernel.org/lkml/1320373471-3942-1-git-send-email-trenn@suse.de/ +[2] https://www.dell.com/support/kbdoc/en-ca/000131908/linux-based-operating-systems-stall-upon-reboot-on-optiplex-390-790-990-systems +[3] https://www.dell.com/support/home/en-ca/drivers/driversdetails?driverid=85j10 +[4] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/768039 + +Fixes: 6be30bb7d750 ("x86/reboot: Blacklist Dell OptiPlex 990 known to require PCI reboot") +Signed-off-by: Paul Gortmaker +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210530162447.996461-4-paul.gortmaker@windriver.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/reboot.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -388,10 +388,11 @@ static const struct dmi_system_id reboot + }, + { /* Handle problems with rebooting on the OptiPlex 990. */ + .callback = set_pci_reboot, +- .ident = "Dell OptiPlex 990", ++ .ident = "Dell OptiPlex 990 BIOS A0x", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"), ++ DMI_MATCH(DMI_BIOS_VERSION, "A0"), + }, + }, + { /* Handle problems with rebooting on Dell 300's */ diff --git a/queue-5.14/xhci-fix-even-more-unsafe-memory-usage-in-xhci-tracing.patch b/queue-5.14/xhci-fix-even-more-unsafe-memory-usage-in-xhci-tracing.patch new file mode 100644 index 00000000000..e21597c7748 --- /dev/null +++ b/queue-5.14/xhci-fix-even-more-unsafe-memory-usage-in-xhci-tracing.patch @@ -0,0 +1,223 @@ +From 4843b4b5ec64b875a5e334f280508f1f75e7d3e4 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 20 Aug 2021 15:34:59 +0300 +Subject: xhci: fix even more unsafe memory usage in xhci tracing + +From: Mathias Nyman + +commit 4843b4b5ec64b875a5e334f280508f1f75e7d3e4 upstream. + +Removes static char buffer usage in the following decode functions: + xhci_decode_ctrl_ctx() + xhci_decode_slot_context() + xhci_decode_usbsts() + xhci_decode_doorbell() + xhci_decode_ep_context() + +Caller must provide a buffer to use. +In tracing use __get_str() as recommended to pass buffer. + +Minor changes are needed in other xhci code as these functions are also +used elsewhere + +Cc: +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210820123503.2605901-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-debugfs.c | 8 ++++++-- + drivers/usb/host/xhci-ring.c | 3 ++- + drivers/usb/host/xhci-trace.h | 18 +++++++++++------- + drivers/usb/host/xhci.h | 21 ++++++++------------- + 4 files changed, 27 insertions(+), 23 deletions(-) + +--- a/drivers/usb/host/xhci-debugfs.c ++++ b/drivers/usb/host/xhci-debugfs.c +@@ -260,11 +260,13 @@ static int xhci_slot_context_show(struct + struct xhci_slot_ctx *slot_ctx; + struct xhci_slot_priv *priv = s->private; + struct xhci_virt_device *dev = priv->dev; ++ char str[XHCI_MSG_MAX]; + + xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus)); + slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx); + seq_printf(s, "%pad: %s\n", &dev->out_ctx->dma, +- xhci_decode_slot_context(le32_to_cpu(slot_ctx->dev_info), ++ xhci_decode_slot_context(str, ++ le32_to_cpu(slot_ctx->dev_info), + le32_to_cpu(slot_ctx->dev_info2), + le32_to_cpu(slot_ctx->tt_info), + le32_to_cpu(slot_ctx->dev_state))); +@@ -280,6 +282,7 @@ static int xhci_endpoint_context_show(st + struct xhci_ep_ctx *ep_ctx; + struct xhci_slot_priv *priv = s->private; + struct xhci_virt_device *dev = priv->dev; ++ char str[XHCI_MSG_MAX]; + + xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus)); + +@@ -287,7 +290,8 @@ static int xhci_endpoint_context_show(st + ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index); + dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params); + seq_printf(s, "%pad: %s\n", &dma, +- xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info), ++ xhci_decode_ep_context(str, ++ le32_to_cpu(ep_ctx->ep_info), + le32_to_cpu(ep_ctx->ep_info2), + le64_to_cpu(ep_ctx->deq), + le32_to_cpu(ep_ctx->tx_info))); +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1212,6 +1212,7 @@ void xhci_stop_endpoint_command_watchdog + struct xhci_hcd *xhci = ep->xhci; + unsigned long flags; + u32 usbsts; ++ char str[XHCI_MSG_MAX]; + + spin_lock_irqsave(&xhci->lock, flags); + +@@ -1225,7 +1226,7 @@ void xhci_stop_endpoint_command_watchdog + usbsts = readl(&xhci->op_regs->status); + + xhci_warn(xhci, "xHCI host not responding to stop endpoint command.\n"); +- xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(usbsts)); ++ xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(str, usbsts)); + + ep->ep_state &= ~EP_STOP_CMD_PENDING; + +--- a/drivers/usb/host/xhci-trace.h ++++ b/drivers/usb/host/xhci-trace.h +@@ -323,6 +323,7 @@ DECLARE_EVENT_CLASS(xhci_log_ep_ctx, + __field(u32, info2) + __field(u64, deq) + __field(u32, tx_info) ++ __dynamic_array(char, str, XHCI_MSG_MAX) + ), + TP_fast_assign( + __entry->info = le32_to_cpu(ctx->ep_info); +@@ -330,8 +331,8 @@ DECLARE_EVENT_CLASS(xhci_log_ep_ctx, + __entry->deq = le64_to_cpu(ctx->deq); + __entry->tx_info = le32_to_cpu(ctx->tx_info); + ), +- TP_printk("%s", xhci_decode_ep_context(__entry->info, +- __entry->info2, __entry->deq, __entry->tx_info) ++ TP_printk("%s", xhci_decode_ep_context(__get_str(str), ++ __entry->info, __entry->info2, __entry->deq, __entry->tx_info) + ) + ); + +@@ -368,6 +369,7 @@ DECLARE_EVENT_CLASS(xhci_log_slot_ctx, + __field(u32, info2) + __field(u32, tt_info) + __field(u32, state) ++ __dynamic_array(char, str, XHCI_MSG_MAX) + ), + TP_fast_assign( + __entry->info = le32_to_cpu(ctx->dev_info); +@@ -375,9 +377,9 @@ DECLARE_EVENT_CLASS(xhci_log_slot_ctx, + __entry->tt_info = le64_to_cpu(ctx->tt_info); + __entry->state = le32_to_cpu(ctx->dev_state); + ), +- TP_printk("%s", xhci_decode_slot_context(__entry->info, +- __entry->info2, __entry->tt_info, +- __entry->state) ++ TP_printk("%s", xhci_decode_slot_context(__get_str(str), ++ __entry->info, __entry->info2, ++ __entry->tt_info, __entry->state) + ) + ); + +@@ -432,12 +434,13 @@ DECLARE_EVENT_CLASS(xhci_log_ctrl_ctx, + TP_STRUCT__entry( + __field(u32, drop) + __field(u32, add) ++ __dynamic_array(char, str, XHCI_MSG_MAX) + ), + TP_fast_assign( + __entry->drop = le32_to_cpu(ctrl_ctx->drop_flags); + __entry->add = le32_to_cpu(ctrl_ctx->add_flags); + ), +- TP_printk("%s", xhci_decode_ctrl_ctx(__entry->drop, __entry->add) ++ TP_printk("%s", xhci_decode_ctrl_ctx(__get_str(str), __entry->drop, __entry->add) + ) + ); + +@@ -555,13 +558,14 @@ DECLARE_EVENT_CLASS(xhci_log_doorbell, + TP_STRUCT__entry( + __field(u32, slot) + __field(u32, doorbell) ++ __dynamic_array(char, str, XHCI_MSG_MAX) + ), + TP_fast_assign( + __entry->slot = slot; + __entry->doorbell = doorbell; + ), + TP_printk("Ring doorbell for %s", +- xhci_decode_doorbell(__entry->slot, __entry->doorbell) ++ xhci_decode_doorbell(__get_str(str), __entry->slot, __entry->doorbell) + ) + ); + +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2455,10 +2455,9 @@ static inline const char *xhci_decode_tr + return str; + } + +-static inline const char *xhci_decode_ctrl_ctx(unsigned long drop, +- unsigned long add) ++static inline const char *xhci_decode_ctrl_ctx(char *str, ++ unsigned long drop, unsigned long add) + { +- static char str[1024]; + unsigned int bit; + int ret = 0; + +@@ -2484,10 +2483,9 @@ static inline const char *xhci_decode_ct + return str; + } + +-static inline const char *xhci_decode_slot_context(u32 info, u32 info2, +- u32 tt_info, u32 state) ++static inline const char *xhci_decode_slot_context(char *str, ++ u32 info, u32 info2, u32 tt_info, u32 state) + { +- static char str[1024]; + u32 speed; + u32 hub; + u32 mtt; +@@ -2617,9 +2615,8 @@ static inline const char *xhci_decode_po + return str; + } + +-static inline const char *xhci_decode_usbsts(u32 usbsts) ++static inline const char *xhci_decode_usbsts(char *str, u32 usbsts) + { +- static char str[256]; + int ret = 0; + + if (usbsts == ~(u32)0) +@@ -2646,9 +2643,8 @@ static inline const char *xhci_decode_us + return str; + } + +-static inline const char *xhci_decode_doorbell(u32 slot, u32 doorbell) ++static inline const char *xhci_decode_doorbell(char *str, u32 slot, u32 doorbell) + { +- static char str[256]; + u8 ep; + u16 stream; + int ret; +@@ -2715,10 +2711,9 @@ static inline const char *xhci_ep_type_s + } + } + +-static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq, +- u32 tx_info) ++static inline const char *xhci_decode_ep_context(char *str, u32 info, ++ u32 info2, u64 deq, u32 tx_info) + { +- static char str[1024]; + int ret; + + u32 esit; diff --git a/queue-5.14/xhci-fix-failure-to-give-back-some-cached-cancelled-urbs.patch b/queue-5.14/xhci-fix-failure-to-give-back-some-cached-cancelled-urbs.patch new file mode 100644 index 00000000000..895b5f2f706 --- /dev/null +++ b/queue-5.14/xhci-fix-failure-to-give-back-some-cached-cancelled-urbs.patch @@ -0,0 +1,105 @@ +From 94f339147fc3eb9edef7ee4ef6e39c569c073753 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 20 Aug 2021 15:35:00 +0300 +Subject: xhci: Fix failure to give back some cached cancelled URBs. + +From: Mathias Nyman + +commit 94f339147fc3eb9edef7ee4ef6e39c569c073753 upstream. + +Only TDs with status TD_CLEARING_CACHE will be given back after +cache is cleared with a set TR deq command. + +xhci_invalidate_cached_td() failed to set the TD_CLEARING_CACHE status +for some cancelled TDs as it assumed an endpoint only needs to clear the +TD it stopped on. + +This isn't always true. For example with streams enabled an endpoint may +have several stream rings, each stopping on a different TDs. + +Note that if an endpoint has several stream rings, the current code +will still only clear the cache of the stream pointed to by the last +cancelled TD in the cancel list. + +This patch only focus on making sure all canceled TDs are given back, +avoiding hung task after device removal. +Another fix to solve clearing the caches of all stream rings with +cancelled TDs is needed, but not as urgent. + +This issue was simultanously discovered and debugged by +by Tao Wang, with a slightly different fix proposal. + +Fixes: 674f8438c121 ("xhci: split handling halted endpoints into two steps") +Cc: #5.12 +Reported-by: Tao Wang +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210820123503.2605901-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-ring.c | 40 +++++++++++++++++++++++++--------------- + 1 file changed, 25 insertions(+), 15 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -942,17 +942,21 @@ static int xhci_invalidate_cancelled_tds + td->urb->stream_id); + hw_deq &= ~0xf; + +- if (td->cancel_status == TD_HALTED) { +- cached_td = td; +- } else if (trb_in_td(xhci, td->start_seg, td->first_trb, +- td->last_trb, hw_deq, false)) { ++ if (td->cancel_status == TD_HALTED || ++ trb_in_td(xhci, td->start_seg, td->first_trb, td->last_trb, hw_deq, false)) { + switch (td->cancel_status) { + case TD_CLEARED: /* TD is already no-op */ + case TD_CLEARING_CACHE: /* set TR deq command already queued */ + break; + case TD_DIRTY: /* TD is cached, clear it */ + case TD_HALTED: +- /* FIXME stream case, several stopped rings */ ++ td->cancel_status = TD_CLEARING_CACHE; ++ if (cached_td) ++ /* FIXME stream case, several stopped rings */ ++ xhci_dbg(xhci, ++ "Move dq past stream %u URB %p instead of stream %u URB %p\n", ++ td->urb->stream_id, td->urb, ++ cached_td->urb->stream_id, cached_td->urb); + cached_td = td; + break; + } +@@ -961,18 +965,24 @@ static int xhci_invalidate_cancelled_tds + td->cancel_status = TD_CLEARED; + } + } +- if (cached_td) { +- cached_td->cancel_status = TD_CLEARING_CACHE; + +- err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index, +- cached_td->urb->stream_id, +- cached_td); +- /* Failed to move past cached td, try just setting it noop */ +- if (err) { +- td_to_noop(xhci, ring, cached_td, false); +- cached_td->cancel_status = TD_CLEARED; ++ /* If there's no need to move the dequeue pointer then we're done */ ++ if (!cached_td) ++ return 0; ++ ++ err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index, ++ cached_td->urb->stream_id, ++ cached_td); ++ if (err) { ++ /* Failed to move past cached td, just set cached TDs to no-op */ ++ list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) { ++ if (td->cancel_status != TD_CLEARING_CACHE) ++ continue; ++ xhci_dbg(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n", ++ td->urb); ++ td_to_noop(xhci, ring, td, false); ++ td->cancel_status = TD_CLEARED; + } +- cached_td = NULL; + } + return 0; + } diff --git a/queue-5.14/xhci-fix-unsafe-memory-usage-in-xhci-tracing.patch b/queue-5.14/xhci-fix-unsafe-memory-usage-in-xhci-tracing.patch new file mode 100644 index 00000000000..906adb6526a --- /dev/null +++ b/queue-5.14/xhci-fix-unsafe-memory-usage-in-xhci-tracing.patch @@ -0,0 +1,307 @@ +From cbf286e8ef8337308c259ff5b9ce2e74d403be5a Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 20 Aug 2021 15:34:58 +0300 +Subject: xhci: fix unsafe memory usage in xhci tracing + +From: Mathias Nyman + +commit cbf286e8ef8337308c259ff5b9ce2e74d403be5a upstream. + +Removes static char buffer usage in the following decode functions: + xhci_decode_trb() + xhci_decode_ptortsc() + +Caller must provide a buffer to use. +In tracing use __get_str() as recommended to pass buffer. + +Minor chanes are needed in xhci debugfs code as these functions are also +used there. Changes include moving XHCI_MSG_MAX definititon from +xhci-trace.h to xhci.h + +Cc: +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210820123503.2605901-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-debugfs.c | 6 +++- + drivers/usb/host/xhci-trace.h | 8 +++--- + drivers/usb/host/xhci.h | 52 +++++++++++++++++++++------------------- + 3 files changed, 36 insertions(+), 30 deletions(-) + +--- a/drivers/usb/host/xhci-debugfs.c ++++ b/drivers/usb/host/xhci-debugfs.c +@@ -198,12 +198,13 @@ static void xhci_ring_dump_segment(struc + int i; + dma_addr_t dma; + union xhci_trb *trb; ++ char str[XHCI_MSG_MAX]; + + for (i = 0; i < TRBS_PER_SEGMENT; i++) { + trb = &seg->trbs[i]; + dma = seg->dma + i * sizeof(*trb); + seq_printf(s, "%pad: %s\n", &dma, +- xhci_decode_trb(le32_to_cpu(trb->generic.field[0]), ++ xhci_decode_trb(str, XHCI_MSG_MAX, le32_to_cpu(trb->generic.field[0]), + le32_to_cpu(trb->generic.field[1]), + le32_to_cpu(trb->generic.field[2]), + le32_to_cpu(trb->generic.field[3]))); +@@ -345,9 +346,10 @@ static int xhci_portsc_show(struct seq_f + { + struct xhci_port *port = s->private; + u32 portsc; ++ char str[XHCI_MSG_MAX]; + + portsc = readl(port->addr); +- seq_printf(s, "%s\n", xhci_decode_portsc(portsc)); ++ seq_printf(s, "%s\n", xhci_decode_portsc(str, portsc)); + + return 0; + } +--- a/drivers/usb/host/xhci-trace.h ++++ b/drivers/usb/host/xhci-trace.h +@@ -25,8 +25,6 @@ + #include "xhci.h" + #include "xhci-dbgcap.h" + +-#define XHCI_MSG_MAX 500 +- + DECLARE_EVENT_CLASS(xhci_log_msg, + TP_PROTO(struct va_format *vaf), + TP_ARGS(vaf), +@@ -122,6 +120,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb, + __field(u32, field1) + __field(u32, field2) + __field(u32, field3) ++ __dynamic_array(char, str, XHCI_MSG_MAX) + ), + TP_fast_assign( + __entry->type = ring->type; +@@ -131,7 +130,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb, + __entry->field3 = le32_to_cpu(trb->field[3]); + ), + TP_printk("%s: %s", xhci_ring_type_string(__entry->type), +- xhci_decode_trb(__entry->field0, __entry->field1, ++ xhci_decode_trb(__get_str(str), XHCI_MSG_MAX, __entry->field0, __entry->field1, + __entry->field2, __entry->field3) + ) + ); +@@ -526,6 +525,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc, + TP_STRUCT__entry( + __field(u32, portnum) + __field(u32, portsc) ++ __dynamic_array(char, str, XHCI_MSG_MAX) + ), + TP_fast_assign( + __entry->portnum = portnum; +@@ -533,7 +533,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc, + ), + TP_printk("port-%d: %s", + __entry->portnum, +- xhci_decode_portsc(__entry->portsc) ++ xhci_decode_portsc(__get_str(str), __entry->portsc) + ) + ); + +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -22,6 +22,9 @@ + #include "xhci-ext-caps.h" + #include "pci-quirks.h" + ++/* max buffer size for trace and debug messages */ ++#define XHCI_MSG_MAX 500 ++ + /* xHCI PCI Configuration Registers */ + #define XHCI_SBRN_OFFSET (0x60) + +@@ -2235,15 +2238,14 @@ static inline char *xhci_slot_state_stri + } + } + +-static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, +- u32 field3) ++static inline const char *xhci_decode_trb(char *str, size_t size, ++ u32 field0, u32 field1, u32 field2, u32 field3) + { +- static char str[256]; + int type = TRB_FIELD_TO_TYPE(field3); + + switch (type) { + case TRB_LINK: +- sprintf(str, ++ snprintf(str, size, + "LINK %08x%08x intr %d type '%s' flags %c:%c:%c:%c", + field1, field0, GET_INTR_TARGET(field2), + xhci_trb_type_string(type), +@@ -2260,7 +2262,7 @@ static inline const char *xhci_decode_tr + case TRB_HC_EVENT: + case TRB_DEV_NOTE: + case TRB_MFINDEX_WRAP: +- sprintf(str, ++ snprintf(str, size, + "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", + field1, field0, + xhci_trb_comp_code_string(GET_COMP_CODE(field2)), +@@ -2273,7 +2275,8 @@ static inline const char *xhci_decode_tr + + break; + case TRB_SETUP: +- sprintf(str, "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", ++ snprintf(str, size, ++ "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", + field0 & 0xff, + (field0 & 0xff00) >> 8, + (field0 & 0xff000000) >> 24, +@@ -2290,7 +2293,8 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_DATA: +- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", ++ snprintf(str, size, ++ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", + field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), + GET_INTR_TARGET(field2), + xhci_trb_type_string(type), +@@ -2303,7 +2307,8 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_STATUS: +- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", ++ snprintf(str, size, ++ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", + field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), + GET_INTR_TARGET(field2), + xhci_trb_type_string(type), +@@ -2316,7 +2321,7 @@ static inline const char *xhci_decode_tr + case TRB_ISOC: + case TRB_EVENT_DATA: + case TRB_TR_NOOP: +- sprintf(str, ++ snprintf(str, size, + "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", + field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), + GET_INTR_TARGET(field2), +@@ -2333,21 +2338,21 @@ static inline const char *xhci_decode_tr + + case TRB_CMD_NOOP: + case TRB_ENABLE_SLOT: +- sprintf(str, ++ snprintf(str, size, + "%s: flags %c", + xhci_trb_type_string(type), + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_DISABLE_SLOT: + case TRB_NEG_BANDWIDTH: +- sprintf(str, ++ snprintf(str, size, + "%s: slot %d flags %c", + xhci_trb_type_string(type), + TRB_TO_SLOT_ID(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_ADDR_DEV: +- sprintf(str, ++ snprintf(str, size, + "%s: ctx %08x%08x slot %d flags %c:%c", + xhci_trb_type_string(type), + field1, field0, +@@ -2356,7 +2361,7 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_CONFIG_EP: +- sprintf(str, ++ snprintf(str, size, + "%s: ctx %08x%08x slot %d flags %c:%c", + xhci_trb_type_string(type), + field1, field0, +@@ -2365,7 +2370,7 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_EVAL_CONTEXT: +- sprintf(str, ++ snprintf(str, size, + "%s: ctx %08x%08x slot %d flags %c", + xhci_trb_type_string(type), + field1, field0, +@@ -2373,7 +2378,7 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_RESET_EP: +- sprintf(str, ++ snprintf(str, size, + "%s: ctx %08x%08x slot %d ep %d flags %c:%c", + xhci_trb_type_string(type), + field1, field0, +@@ -2394,7 +2399,7 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_SET_DEQ: +- sprintf(str, ++ snprintf(str, size, + "%s: deq %08x%08x stream %d slot %d ep %d flags %c", + xhci_trb_type_string(type), + field1, field0, +@@ -2405,14 +2410,14 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_RESET_DEV: +- sprintf(str, ++ snprintf(str, size, + "%s: slot %d flags %c", + xhci_trb_type_string(type), + TRB_TO_SLOT_ID(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_FORCE_EVENT: +- sprintf(str, ++ snprintf(str, size, + "%s: event %08x%08x vf intr %d vf id %d flags %c", + xhci_trb_type_string(type), + field1, field0, +@@ -2421,14 +2426,14 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_SET_LT: +- sprintf(str, ++ snprintf(str, size, + "%s: belt %d flags %c", + xhci_trb_type_string(type), + TRB_TO_BELT(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_GET_BW: +- sprintf(str, ++ snprintf(str, size, + "%s: ctx %08x%08x slot %d speed %d flags %c", + xhci_trb_type_string(type), + field1, field0, +@@ -2437,7 +2442,7 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_FORCE_HEADER: +- sprintf(str, ++ snprintf(str, size, + "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", + xhci_trb_type_string(type), + field2, field1, field0 & 0xffffffe0, +@@ -2446,7 +2451,7 @@ static inline const char *xhci_decode_tr + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + default: +- sprintf(str, ++ snprintf(str, size, + "type '%s' -> raw %08x %08x %08x %08x", + xhci_trb_type_string(type), + field0, field1, field2, field3); +@@ -2569,9 +2574,8 @@ static inline const char *xhci_portsc_li + return "Unknown"; + } + +-static inline const char *xhci_decode_portsc(u32 portsc) ++static inline const char *xhci_decode_portsc(char *str, u32 portsc) + { +- static char str[256]; + int ret; + + ret = sprintf(str, "%s %s %s Link:%s PortSpeed:%d ",