]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 31 Oct 2022 05:52:28 +0000 (06:52 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 31 Oct 2022 05:52:28 +0000 (06:52 +0100)
added patches:
alsa-au88x0-use-explicitly-signed-char.patch
alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch
alsa-rme9652-use-explicitly-signed-char.patch
alsa-use-del_timer_sync-before-freeing-timer.patch
can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch
can-kvaser_usb-fix-possible-completions-during-init_completion.patch
mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch
usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch
usb-bdc-change-state-when-port-disconnected.patch
usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch
usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch
usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch
xhci-add-quirk-to-reset-host-back-to-default-state-at-shutdown.patch
xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch

15 files changed:
queue-5.10/alsa-au88x0-use-explicitly-signed-char.patch [new file with mode: 0644]
queue-5.10/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch [new file with mode: 0644]
queue-5.10/alsa-rme9652-use-explicitly-signed-char.patch [new file with mode: 0644]
queue-5.10/alsa-use-del_timer_sync-before-freeing-timer.patch [new file with mode: 0644]
queue-5.10/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch [new file with mode: 0644]
queue-5.10/can-kvaser_usb-fix-possible-completions-during-init_completion.patch [new file with mode: 0644]
queue-5.10/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch [new file with mode: 0644]
queue-5.10/series [new file with mode: 0644]
queue-5.10/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch [new file with mode: 0644]
queue-5.10/usb-bdc-change-state-when-port-disconnected.patch [new file with mode: 0644]
queue-5.10/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch [new file with mode: 0644]
queue-5.10/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch [new file with mode: 0644]
queue-5.10/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch [new file with mode: 0644]
queue-5.10/xhci-add-quirk-to-reset-host-back-to-default-state-at-shutdown.patch [new file with mode: 0644]
queue-5.10/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch [new file with mode: 0644]

diff --git a/queue-5.10/alsa-au88x0-use-explicitly-signed-char.patch b/queue-5.10/alsa-au88x0-use-explicitly-signed-char.patch
new file mode 100644 (file)
index 0000000..b76609d
--- /dev/null
@@ -0,0 +1,64 @@
+From ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Mon, 24 Oct 2022 18:29:29 +0200
+Subject: ALSA: au88x0: use explicitly signed char
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 upstream.
+
+With char becoming unsigned by default, and with `char` alone being
+ambiguous and based on architecture, signed chars need to be marked
+explicitly as such. This fixes warnings like:
+
+sound/pci/au88x0/au88x0_core.c:2029 vortex_adb_checkinout() warn: signedness bug returning '(-22)'
+sound/pci/au88x0/au88x0_core.c:2046 vortex_adb_checkinout() warn: signedness bug returning '(-12)'
+sound/pci/au88x0/au88x0_core.c:2125 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, (0), en, 0)' is unsigned
+sound/pci/au88x0/au88x0_core.c:2170 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, stream->resources, en, 4)' is unsigned
+
+As well, since one function returns errnos, return an `int` rather than
+a `signed char`.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221024162929.536004-1-Jason@zx2c4.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/au88x0/au88x0.h      |    6 +++---
+ sound/pci/au88x0/au88x0_core.c |    2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/au88x0/au88x0.h
++++ b/sound/pci/au88x0/au88x0.h
+@@ -141,7 +141,7 @@ struct snd_vortex {
+ #ifndef CHIP_AU8810
+       stream_t dma_wt[NR_WT];
+       wt_voice_t wt_voice[NR_WT];     /* WT register cache. */
+-      char mixwt[(NR_WT / NR_WTPB) * 6];      /* WT mixin objects */
++      s8 mixwt[(NR_WT / NR_WTPB) * 6];        /* WT mixin objects */
+ #endif
+       /* Global resources */
+@@ -235,8 +235,8 @@ static int vortex_alsafmt_aspfmt(snd_pcm
+ static void vortex_connect_default(vortex_t * vortex, int en);
+ static int vortex_adb_allocroute(vortex_t * vortex, int dma, int nr_ch,
+                                int dir, int type, int subdev);
+-static char vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out,
+-                                int restype);
++static int vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out,
++                               int restype);
+ #ifndef CHIP_AU8810
+ static int vortex_wt_allocroute(vortex_t * vortex, int dma, int nr_ch);
+ static void vortex_wt_connect(vortex_t * vortex, int en);
+--- a/sound/pci/au88x0/au88x0_core.c
++++ b/sound/pci/au88x0/au88x0_core.c
+@@ -1998,7 +1998,7 @@ static const int resnum[VORTEX_RESOURCE_
+  out: Mean checkout if != 0. Else mean Checkin resource.
+  restype: Indicates type of resource to be checked in or out.
+ */
+-static char
++static int
+ vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, int restype)
+ {
+       int i, qty = resnum[restype], resinuse = 0;
diff --git a/queue-5.10/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch b/queue-5.10/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch
new file mode 100644 (file)
index 0000000..cabef4d
--- /dev/null
@@ -0,0 +1,31 @@
+From 491a4ccd8a0258392900c80c6b2b622c7115fc23 Mon Sep 17 00:00:00 2001
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+Date: Tue, 18 Oct 2022 13:15:06 +0100
+Subject: ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+commit 491a4ccd8a0258392900c80c6b2b622c7115fc23 upstream.
+
+This Asus Zenbook laptop use Realtek HDA codec combined with
+2xCS35L41 Amplifiers using SPI with External Boost.
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221018121506.2561397-1-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8958,6 +8958,7 @@ static const struct snd_pci_quirk alc269
+       SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+       SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401),
+       SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
++      SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402", ALC245_FIXUP_CS35L41_SPI_2),
+       SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+       SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
+       SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS),
diff --git a/queue-5.10/alsa-rme9652-use-explicitly-signed-char.patch b/queue-5.10/alsa-rme9652-use-explicitly-signed-char.patch
new file mode 100644 (file)
index 0000000..e976df0
--- /dev/null
@@ -0,0 +1,244 @@
+From 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Tue, 25 Oct 2022 02:03:13 +0200
+Subject: ALSA: rme9652: use explicitly signed char
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 upstream.
+
+With char becoming unsigned by default, and with `char` alone being
+ambiguous and based on architecture, signed chars need to be marked
+explicitly as such. This fixes warnings like:
+
+sound/pci/rme9652/hdsp.c:3953 hdsp_channel_buffer_location() warn: 'hdsp->channel_map[channel]' is unsigned
+sound/pci/rme9652/hdsp.c:4153 snd_hdsp_channel_info() warn: impossible condition '(hdsp->channel_map[channel] < 0) => (0-255 < 0)'
+sound/pci/rme9652/rme9652.c:1833 rme9652_channel_buffer_location() warn: 'rme9652->channel_map[channel]' is unsigned
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221025000313.546261-1-Jason@zx2c4.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/rme9652/hdsp.c    |   26 +++++++++++++-------------
+ sound/pci/rme9652/rme9652.c |   22 +++++++++++-----------
+ 2 files changed, 24 insertions(+), 24 deletions(-)
+
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -436,7 +436,7 @@ struct hdsp_midi {
+     struct snd_rawmidi           *rmidi;
+     struct snd_rawmidi_substream *input;
+     struct snd_rawmidi_substream *output;
+-    char                     istimer; /* timer in use */
++    signed char                    istimer; /* timer in use */
+     struct timer_list      timer;
+     spinlock_t               lock;
+     int                            pending;
+@@ -479,7 +479,7 @@ struct hdsp {
+       pid_t                 playback_pid;
+       int                   running;
+       int                   system_sample_rate;
+-      const char           *channel_map;
++      const signed char    *channel_map;
+       int                   dev;
+       int                   irq;
+       unsigned long         port;
+@@ -501,7 +501,7 @@ struct hdsp {
+    where the data for that channel can be read/written from/to.
+ */
+-static const char channel_map_df_ss[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_df_ss[HDSP_MAX_CHANNELS] = {
+       0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17,
+       18, 19, 20, 21, 22, 23, 24, 25
+ };
+@@ -516,7 +516,7 @@ static const char channel_map_mf_ss[HDSP
+       -1, -1, -1, -1, -1, -1, -1, -1
+ };
+-static const char channel_map_ds[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_ds[HDSP_MAX_CHANNELS] = {
+       /* ADAT channels are remapped */
+       1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23,
+       /* channels 12 and 13 are S/PDIF */
+@@ -525,7 +525,7 @@ static const char channel_map_ds[HDSP_MA
+       -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+ };
+-static const char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = {
+       /* ADAT channels */
+       0, 1, 2, 3, 4, 5, 6, 7,
+       /* SPDIF */
+@@ -539,7 +539,7 @@ static const char channel_map_H9632_ss[H
+       -1, -1
+ };
+-static const char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = {
+       /* ADAT */
+       1, 3, 5, 7,
+       /* SPDIF */
+@@ -553,7 +553,7 @@ static const char channel_map_H9632_ds[H
+       -1, -1, -1, -1, -1, -1
+ };
+-static const char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = {
++static const signed char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = {
+       /* ADAT is disabled in this mode */
+       /* SPDIF */
+       8, 9,
+@@ -3869,7 +3869,7 @@ static snd_pcm_uframes_t snd_hdsp_hw_poi
+       return hdsp_hw_pointer(hdsp);
+ }
+-static char *hdsp_channel_buffer_location(struct hdsp *hdsp,
++static signed char *hdsp_channel_buffer_location(struct hdsp *hdsp,
+                                            int stream,
+                                            int channel)
+@@ -3893,7 +3893,7 @@ static int snd_hdsp_playback_copy(struct
+                                 void __user *src, unsigned long count)
+ {
+       struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES))
+               return -EINVAL;
+@@ -3911,7 +3911,7 @@ static int snd_hdsp_playback_copy_kernel
+                                        void *src, unsigned long count)
+ {
+       struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel);
+       if (snd_BUG_ON(!channel_buf))
+@@ -3925,7 +3925,7 @@ static int snd_hdsp_capture_copy(struct
+                                void __user *dst, unsigned long count)
+ {
+       struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES))
+               return -EINVAL;
+@@ -3943,7 +3943,7 @@ static int snd_hdsp_capture_copy_kernel(
+                                       void *dst, unsigned long count)
+ {
+       struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel);
+       if (snd_BUG_ON(!channel_buf))
+@@ -3957,7 +3957,7 @@ static int snd_hdsp_hw_silence(struct sn
+                              unsigned long count)
+ {
+       struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       channel_buf = hdsp_channel_buffer_location (hdsp, substream->pstr->stream, channel);
+       if (snd_BUG_ON(!channel_buf))
+--- a/sound/pci/rme9652/rme9652.c
++++ b/sound/pci/rme9652/rme9652.c
+@@ -229,7 +229,7 @@ struct snd_rme9652 {
+       int last_spdif_sample_rate;     /* so that we can catch externally ... */
+       int last_adat_sample_rate;      /* ... induced rate changes            */
+-      const char *channel_map;
++      const signed char *channel_map;
+       struct snd_card *card;
+       struct snd_pcm *pcm;
+@@ -246,12 +246,12 @@ struct snd_rme9652 {
+    where the data for that channel can be read/written from/to.
+ */
+-static const char channel_map_9652_ss[26] = {
++static const signed char channel_map_9652_ss[26] = {
+       0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17,
+       18, 19, 20, 21, 22, 23, 24, 25
+ };
+-static const char channel_map_9636_ss[26] = {
++static const signed char channel_map_9636_ss[26] = {
+       0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 
+       /* channels 16 and 17 are S/PDIF */
+       24, 25,
+@@ -259,7 +259,7 @@ static const char channel_map_9636_ss[26
+       -1, -1, -1, -1, -1, -1, -1, -1
+ };
+-static const char channel_map_9652_ds[26] = {
++static const signed char channel_map_9652_ds[26] = {
+       /* ADAT channels are remapped */
+       1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23,
+       /* channels 12 and 13 are S/PDIF */
+@@ -268,7 +268,7 @@ static const char channel_map_9652_ds[26
+       -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+ };
+-static const char channel_map_9636_ds[26] = {
++static const signed char channel_map_9636_ds[26] = {
+       /* ADAT channels are remapped */
+       1, 3, 5, 7, 9, 11, 13, 15,
+       /* channels 8 and 9 are S/PDIF */
+@@ -1841,7 +1841,7 @@ static snd_pcm_uframes_t snd_rme9652_hw_
+       return rme9652_hw_pointer(rme9652);
+ }
+-static char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652,
++static signed char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652,
+                                            int stream,
+                                            int channel)
+@@ -1869,7 +1869,7 @@ static int snd_rme9652_playback_copy(str
+                                    void __user *src, unsigned long count)
+ {
+       struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES))
+               return -EINVAL;
+@@ -1889,7 +1889,7 @@ static int snd_rme9652_playback_copy_ker
+                                           void *src, unsigned long count)
+ {
+       struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       channel_buf = rme9652_channel_buffer_location(rme9652,
+                                                     substream->pstr->stream,
+@@ -1905,7 +1905,7 @@ static int snd_rme9652_capture_copy(stru
+                                   void __user *dst, unsigned long count)
+ {
+       struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES))
+               return -EINVAL;
+@@ -1925,7 +1925,7 @@ static int snd_rme9652_capture_copy_kern
+                                          void *dst, unsigned long count)
+ {
+       struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       channel_buf = rme9652_channel_buffer_location(rme9652,
+                                                     substream->pstr->stream,
+@@ -1941,7 +1941,7 @@ static int snd_rme9652_hw_silence(struct
+                                 unsigned long count)
+ {
+       struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream);
+-      char *channel_buf;
++      signed char *channel_buf;
+       channel_buf = rme9652_channel_buffer_location (rme9652,
+                                                      substream->pstr->stream,
diff --git a/queue-5.10/alsa-use-del_timer_sync-before-freeing-timer.patch b/queue-5.10/alsa-use-del_timer_sync-before-freeing-timer.patch
new file mode 100644 (file)
index 0000000..1e25adf
--- /dev/null
@@ -0,0 +1,64 @@
+From f0a868788fcbf63cdab51f5adcf73b271ede8164 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Wed, 26 Oct 2022 23:12:36 -0400
+Subject: ALSA: Use del_timer_sync() before freeing timer
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream.
+
+The current code for freeing the emux timer is extremely dangerous:
+
+  CPU0                         CPU1
+  ----                         ----
+snd_emux_timer_callback()
+                           snd_emux_free()
+                             spin_lock(&emu->voice_lock)
+                             del_timer(&emu->tlist); <-- returns immediately
+                             spin_unlock(&emu->voice_lock);
+                             [..]
+                             kfree(emu);
+
+  spin_lock(&emu->voice_lock);
+
+ [BOOM!]
+
+Instead just use del_timer_sync() which will wait for the timer to finish
+before continuing. No need to check if the timer is active or not when
+doing so.
+
+This doesn't fix the race of a possible re-arming of the timer, but at
+least it won't use the data that has just been freed.
+
+[ Fixed unused variable warning by tiwai ]
+
+Cc: stable@vger.kernel.org
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20221026231236.6834b551@gandalf.local.home
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/synth/emux/emux.c |    7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/sound/synth/emux/emux.c
++++ b/sound/synth/emux/emux.c
+@@ -125,15 +125,10 @@ EXPORT_SYMBOL(snd_emux_register);
+  */
+ int snd_emux_free(struct snd_emux *emu)
+ {
+-      unsigned long flags;
+-
+       if (! emu)
+               return -EINVAL;
+-      spin_lock_irqsave(&emu->voice_lock, flags);
+-      if (emu->timer_active)
+-              del_timer(&emu->tlist);
+-      spin_unlock_irqrestore(&emu->voice_lock, flags);
++      del_timer_sync(&emu->tlist);
+       snd_emux_proc_free(emu);
+       snd_emux_delete_virmidi(emu);
diff --git a/queue-5.10/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch b/queue-5.10/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch
new file mode 100644 (file)
index 0000000..941e81b
--- /dev/null
@@ -0,0 +1,41 @@
+From c3c06c61890da80494bb196f75d89b791adda87f Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Thu, 27 Oct 2022 17:12:37 +0800
+Subject: can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit c3c06c61890da80494bb196f75d89b791adda87f upstream.
+
+It is not allowed to call kfree_skb() from hardware interrupt context
+or with interrupts being disabled. The skb is unlinked from the queue,
+so it can be freed after spin_unlock_irqrestore().
+
+Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/all/20221027091237.2290111-1-yangyingliang@huawei.com
+Cc: stable@vger.kernel.org
+[mkl: adjust subject]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/j1939/transport.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -338,10 +338,12 @@ static void j1939_session_skb_drop_old(s
+               __skb_unlink(do_skb, &session->skb_queue);
+               /* drop ref taken in j1939_session_skb_queue() */
+               skb_unref(do_skb);
++              spin_unlock_irqrestore(&session->skb_queue.lock, flags);
+               kfree_skb(do_skb);
++      } else {
++              spin_unlock_irqrestore(&session->skb_queue.lock, flags);
+       }
+-      spin_unlock_irqrestore(&session->skb_queue.lock, flags);
+ }
+ void j1939_session_skb_queue(struct j1939_session *session,
diff --git a/queue-5.10/can-kvaser_usb-fix-possible-completions-during-init_completion.patch b/queue-5.10/can-kvaser_usb-fix-possible-completions-during-init_completion.patch
new file mode 100644 (file)
index 0000000..b951441
--- /dev/null
@@ -0,0 +1,79 @@
+From 2871edb32f4622c3a25ce4b3977bad9050b91974 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Mon, 10 Oct 2022 20:52:27 +0200
+Subject: can: kvaser_usb: Fix possible completions during init_completion
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 2871edb32f4622c3a25ce4b3977bad9050b91974 upstream.
+
+kvaser_usb uses completions to signal when a response event is received
+for outgoing commands.
+
+However, it uses init_completion() to reinitialize the start_comp and
+stop_comp completions before sending the start/stop commands.
+
+In case the device sends the corresponding response just before the
+actual command is sent, complete() may be called concurrently with
+init_completion() which is not safe.
+
+This might be triggerable even with a properly functioning device by
+stopping the interface (CMD_STOP_CHIP) just after it goes bus-off (which
+also causes the driver to send CMD_STOP_CHIP when restart-ms is off),
+but that was not tested.
+
+Fix the issue by using reinit_completion() instead.
+
+Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/all/20221010185237.319219-2-extja@kvaser.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c |    4 ++--
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c  |    4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1845,7 +1845,7 @@ static int kvaser_usb_hydra_start_chip(s
+ {
+       int err;
+-      init_completion(&priv->start_comp);
++      reinit_completion(&priv->start_comp);
+       err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_START_CHIP_REQ,
+                                              priv->channel);
+@@ -1863,7 +1863,7 @@ static int kvaser_usb_hydra_stop_chip(st
+ {
+       int err;
+-      init_completion(&priv->stop_comp);
++      reinit_completion(&priv->stop_comp);
+       /* Make sure we do not report invalid BUS_OFF from CMD_CHIP_STATE_EVENT
+        * see comment in kvaser_usb_hydra_update_state()
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1324,7 +1324,7 @@ static int kvaser_usb_leaf_start_chip(st
+ {
+       int err;
+-      init_completion(&priv->start_comp);
++      reinit_completion(&priv->start_comp);
+       err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_START_CHIP,
+                                             priv->channel);
+@@ -1342,7 +1342,7 @@ static int kvaser_usb_leaf_stop_chip(str
+ {
+       int err;
+-      init_completion(&priv->stop_comp);
++      reinit_completion(&priv->stop_comp);
+       err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP,
+                                             priv->channel);
diff --git a/queue-5.10/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch b/queue-5.10/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch
new file mode 100644 (file)
index 0000000..8371388
--- /dev/null
@@ -0,0 +1,39 @@
+From ce107713b722af57c4b7f2477594d445b496420e Mon Sep 17 00:00:00 2001
+From: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
+Date: Tue, 27 Sep 2022 15:47:28 +1300
+Subject: mtd: rawnand: marvell: Use correct logic for nand-keep-config
+
+From: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
+
+commit ce107713b722af57c4b7f2477594d445b496420e upstream.
+
+Originally the absence of the marvell,nand-keep-config property caused
+the setup_data_interface function to be provided. However when
+setup_data_interface was moved into nand_controller_ops the logic was
+unintentionally inverted. Update the logic so that only if the
+marvell,nand-keep-config property is present the bootloader NAND config
+kept.
+
+Cc: stable@vger.kernel.org
+Fixes: 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops")
+Signed-off-by: Tony O'Brien <tony.obrien@alliedtelesis.co.nz>
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220927024728.28447-1-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/marvell_nand.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -2672,7 +2672,7 @@ static int marvell_nand_chip_init(struct
+       chip->controller = &nfc->controller;
+       nand_set_flash_node(chip, np);
+-      if (!of_property_read_bool(np, "marvell,nand-keep-config"))
++      if (of_property_read_bool(np, "marvell,nand-keep-config"))
+               chip->options |= NAND_KEEP_TIMINGS;
+       mtd = nand_to_mtd(chip);
diff --git a/queue-5.10/series b/queue-5.10/series
new file mode 100644 (file)
index 0000000..8d65b3d
--- /dev/null
@@ -0,0 +1,14 @@
+can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch
+can-kvaser_usb-fix-possible-completions-during-init_completion.patch
+alsa-use-del_timer_sync-before-freeing-timer.patch
+alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch
+alsa-au88x0-use-explicitly-signed-char.patch
+alsa-rme9652-use-explicitly-signed-char.patch
+usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch
+usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch
+usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch
+usb-bdc-change-state-when-port-disconnected.patch
+usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch
+mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch
+xhci-add-quirk-to-reset-host-back-to-default-state-at-shutdown.patch
+xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch
diff --git a/queue-5.10/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch b/queue-5.10/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch
new file mode 100644 (file)
index 0000000..bb1e751
--- /dev/null
@@ -0,0 +1,48 @@
+From fc4ade55c617dc73c7e9756b57f3230b4ff24540 Mon Sep 17 00:00:00 2001
+From: Hannu Hartikainen <hannu@hrtk.in>
+Date: Mon, 19 Sep 2022 20:16:10 +0300
+Subject: USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
+
+From: Hannu Hartikainen <hannu@hrtk.in>
+
+commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 upstream.
+
+NVIDIA Jetson devices in Force Recovery mode (RCM) do not support
+suspending, ie. flashing fails if the device has been suspended. The
+devices are still visible in lsusb and seem to work otherwise, making
+the issue hard to debug. This has been discovered in various forum
+posts, eg. [1].
+
+The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding
+all the Jetson models listed in [2] on the assumption that they all
+behave similarly.
+
+[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365
+[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html
+
+Signed-off-by: Hannu Hartikainen <hannu@hrtk.in>
+Cc: stable <stable@kernel.org>  # after 6.1-rc3
+Link: https://lore.kernel.org/r/20220919171610.30484-1-hannu@hrtk.in
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -388,6 +388,15 @@ static const struct usb_device_id usb_qu
+       /* Kingston DataTraveler 3.0 */
+       { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
++      /* NVIDIA Jetson devices in Force Recovery mode */
++      { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME },
++      { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME },
++      { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME },
++      { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME },
++      { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME },
++      { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME },
++      { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME },
++
+       /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+       { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
diff --git a/queue-5.10/usb-bdc-change-state-when-port-disconnected.patch b/queue-5.10/usb-bdc-change-state-when-port-disconnected.patch
new file mode 100644 (file)
index 0000000..5997b25
--- /dev/null
@@ -0,0 +1,33 @@
+From fb8f60dd1b67520e0e0d7978ef17d015690acfc1 Mon Sep 17 00:00:00 2001
+From: Justin Chen <justinpopo6@gmail.com>
+Date: Wed, 5 Oct 2022 12:13:55 -0700
+Subject: usb: bdc: change state when port disconnected
+
+From: Justin Chen <justinpopo6@gmail.com>
+
+commit fb8f60dd1b67520e0e0d7978ef17d015690acfc1 upstream.
+
+When port is connected and then disconnected, the state stays as
+configured. Which is incorrect as the port is no longer configured,
+but in a not attached state.
+
+Signed-off-by: Justin Chen <justinpopo6@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC")
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/1664997235-18198-1-git-send-email-justinpopo6@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/bdc/bdc_udc.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/udc/bdc/bdc_udc.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c
+@@ -151,6 +151,7 @@ static void bdc_uspc_disconnected(struct
+       bdc->delayed_status = false;
+       bdc->reinit = reinit;
+       bdc->test_mode = false;
++      usb_gadget_set_state(&bdc->gadget, USB_STATE_NOTATTACHED);
+ }
+ /* TNotify wkaeup timer */
diff --git a/queue-5.10/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch b/queue-5.10/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch
new file mode 100644 (file)
index 0000000..0c83364
--- /dev/null
@@ -0,0 +1,39 @@
+From 308c316d16cbad99bb834767382baa693ac42169 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Tue, 25 Oct 2022 15:10:20 -0700
+Subject: usb: dwc3: gadget: Don't set IMI for no_interrupt
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 308c316d16cbad99bb834767382baa693ac42169 upstream.
+
+The gadget driver may have a certain expectation of how the request
+completion flow should be from to its configuration. Make sure the
+controller driver respect that. That is, don't set IMI (Interrupt on
+Missed Isoc) when usb_request->no_interrupt is set. Also, the driver
+should only set IMI to the last TRB of a chain.
+
+Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Reviewed-by: Jeff Vanhoof <jdv1029@gmail.com>
+Tested-by: Jeff Vanhoof <jdv1029@gmail.com>
+Link: https://lore.kernel.org/r/ced336c84434571340c07994e3667a0ee284fefe.1666735451.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1064,8 +1064,8 @@ static void dwc3_prepare_one_trb(struct
+                       trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS;
+               }
+-              /* always enable Interrupt on Missed ISOC */
+-              trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
++              if (!no_interrupt && !chain)
++                      trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
+               break;
+       case USB_ENDPOINT_XFER_BULK:
diff --git a/queue-5.10/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch b/queue-5.10/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch
new file mode 100644 (file)
index 0000000..356fba6
--- /dev/null
@@ -0,0 +1,46 @@
+From f78961f8380b940e0cfc7e549336c21a2ad44f4d Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Tue, 25 Oct 2022 15:10:14 -0700
+Subject: usb: dwc3: gadget: Stop processing more requests on IMI
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit f78961f8380b940e0cfc7e549336c21a2ad44f4d upstream.
+
+When servicing a transfer completion event, the dwc3 driver will reclaim
+TRBs of started requests up to the request associated with the interrupt
+event. Currently we don't check for interrupt due to missed isoc, and
+the driver may attempt to reclaim TRBs beyond the associated event. This
+causes invalid memory access when the hardware still owns the TRB. If
+there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure
+to stop servicing further.
+
+Note that only the last TRB of chained TRBs has its status updated with
+missed isoc.
+
+Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
+Cc: stable@vger.kernel.org
+Reported-by: Jeff Vanhoof <jdv1029@gmail.com>
+Reported-by: Dan Vacura <w36195@motorola.com>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Reviewed-by: Jeff Vanhoof <jdv1029@gmail.com>
+Tested-by: Jeff Vanhoof <jdv1029@gmail.com>
+Link: https://lore.kernel.org/r/b29acbeab531b666095dfdafd8cb5c7654fbb3e1.1666735451.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2800,6 +2800,10 @@ static int dwc3_gadget_ep_reclaim_comple
+       if (event->status & DEPEVT_STATUS_SHORT && !chain)
+               return 1;
++      if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) &&
++          DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC)
++              return 1;
++
+       if ((trb->ctrl & DWC3_TRB_CTRL_IOC) ||
+           (trb->ctrl & DWC3_TRB_CTRL_LST))
+               return 1;
diff --git a/queue-5.10/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch b/queue-5.10/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch
new file mode 100644 (file)
index 0000000..404028b
--- /dev/null
@@ -0,0 +1,45 @@
+From 4f547472380136718b56064ea5689a61e135f904 Mon Sep 17 00:00:00 2001
+From: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
+Date: Mon, 24 Oct 2022 17:27:17 +0300
+Subject: usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
+
+From: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
+
+commit 4f547472380136718b56064ea5689a61e135f904 upstream.
+
+This appears to fix the error:
+"xhci_hcd <address>; ERROR Transfer event TRB DMA ptr not part of
+current TD ep_index 2 comp_code 13" that appear spuriously (or pretty
+often) when using a r8152 USB3 ethernet adapter with integrated hub.
+
+ASM1042 reports as a 0.96 controller, but appears to behave more like 1.0
+
+Inspired by this email thread: https://markmail.org/thread/7vzqbe7t6du6qsw3
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20221024142720.4122053-2-mathias.nyman@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-pci.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -302,8 +302,14 @@ static void xhci_pci_quirks(struct devic
+       }
+       if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+-              pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
++              pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) {
++              /*
++               * try to tame the ASMedia 1042 controller which reports 0.96
++               * but appears to behave more like 1.0
++               */
++              xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+               xhci->quirks |= XHCI_BROKEN_STREAMS;
++      }
+       if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+               pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) {
+               xhci->quirks |= XHCI_TRUST_TX_LENGTH;
diff --git a/queue-5.10/xhci-add-quirk-to-reset-host-back-to-default-state-at-shutdown.patch b/queue-5.10/xhci-add-quirk-to-reset-host-back-to-default-state-at-shutdown.patch
new file mode 100644 (file)
index 0000000..bbddb07
--- /dev/null
@@ -0,0 +1,75 @@
+From 34cd2db408d591bc15771cbcc90939ade0a99a21 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Mon, 24 Oct 2022 17:27:18 +0300
+Subject: xhci: Add quirk to reset host back to default state at shutdown
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 34cd2db408d591bc15771cbcc90939ade0a99a21 upstream.
+
+Systems based on Alder Lake P see significant boot time delay if
+boot firmware tries to control usb ports in unexpected link states.
+
+This is seen with self-powered usb devices that survive in U3 link
+suspended state over S5.
+
+A more generic solution to power off ports at shutdown was attempted in
+commit 83810f84ecf1 ("xhci: turn off port power in shutdown")
+but it caused regression.
+
+Add host specific XHCI_RESET_TO_DEFAULT quirk which will reset host and
+ports back to default state in shutdown.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20221024142720.4122053-3-mathias.nyman@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-pci.c |    4 ++++
+ drivers/usb/host/xhci.c     |   10 ++++++++--
+ drivers/usb/host/xhci.h     |    1 +
+ 3 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -254,6 +254,10 @@ static void xhci_pci_quirks(struct devic
+               xhci->quirks |= XHCI_MISSING_CAS;
+       if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
++          pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI)
++              xhci->quirks |= XHCI_RESET_TO_DEFAULT;
++
++      if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+           (pdev->device == PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_2C_XHCI ||
+            pdev->device == PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_4C_XHCI ||
+            pdev->device == PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_LP_XHCI ||
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -794,9 +794,15 @@ void xhci_shutdown(struct usb_hcd *hcd)
+       spin_lock_irq(&xhci->lock);
+       xhci_halt(xhci);
+-      /* Workaround for spurious wakeups at shutdown with HSW */
+-      if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
++
++      /*
++       * Workaround for spurious wakeps at shutdown with HSW, and for boot
++       * firmware delay in ADL-P PCH if port are left in U3 at shutdown
++       */
++      if (xhci->quirks & XHCI_SPURIOUS_WAKEUP ||
++          xhci->quirks & XHCI_RESET_TO_DEFAULT)
+               xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
++
+       spin_unlock_irq(&xhci->lock);
+       xhci_cleanup_msix(xhci);
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1889,6 +1889,7 @@ struct xhci_hcd {
+ #define XHCI_NO_SOFT_RETRY    BIT_ULL(40)
+ #define XHCI_EP_CTX_BROKEN_DCS        BIT_ULL(42)
+ #define XHCI_SUSPEND_RESUME_CLKS      BIT_ULL(43)
++#define XHCI_RESET_TO_DEFAULT BIT_ULL(44)
+       unsigned int            num_active_eps;
+       unsigned int            limit_active_eps;
diff --git a/queue-5.10/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch b/queue-5.10/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch
new file mode 100644 (file)
index 0000000..0818696
--- /dev/null
@@ -0,0 +1,69 @@
+From 5aed5b7c2430ce318a8e62f752f181e66f0d1053 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Mon, 24 Oct 2022 17:27:20 +0300
+Subject: xhci: Remove device endpoints from bandwidth list when freeing the device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 5aed5b7c2430ce318a8e62f752f181e66f0d1053 upstream.
+
+Endpoints are normally deleted from the bandwidth list when they are
+dropped, before the virt device is freed.
+
+If xHC host is dying or being removed then the endpoints aren't dropped
+cleanly due to functions returning early to avoid interacting with a
+non-accessible host controller.
+
+So check and delete endpoints that are still on the bandwidth list when
+freeing the virt device.
+
+Solves a list_del corruption kernel crash when unbinding xhci-pci,
+caused by xhci_mem_cleanup() when it later tried to delete already freed
+endpoints from the bandwidth list.
+
+This only affects hosts that use software bandwidth checking, which
+currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)
+
+Cc: stable@vger.kernel.org
+Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20221024142720.4122053-5-mathias.nyman@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-mem.c |   20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -915,15 +915,19 @@ void xhci_free_virt_device(struct xhci_h
+               if (dev->eps[i].stream_info)
+                       xhci_free_stream_info(xhci,
+                                       dev->eps[i].stream_info);
+-              /* Endpoints on the TT/root port lists should have been removed
+-               * when usb_disable_device() was called for the device.
+-               * We can't drop them anyway, because the udev might have gone
+-               * away by this point, and we can't tell what speed it was.
++              /*
++               * Endpoints are normally deleted from the bandwidth list when
++               * endpoints are dropped, before device is freed.
++               * If host is dying or being removed then endpoints aren't
++               * dropped cleanly, so delete the endpoint from list here.
++               * Only applicable for hosts with software bandwidth checking.
+                */
+-              if (!list_empty(&dev->eps[i].bw_endpoint_list))
+-                      xhci_warn(xhci, "Slot %u endpoint %u "
+-                                      "not removed from BW list!\n",
+-                                      slot_id, i);
++
++              if (!list_empty(&dev->eps[i].bw_endpoint_list)) {
++                      list_del_init(&dev->eps[i].bw_endpoint_list);
++                      xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n",
++                               slot_id, i);
++              }
+       }
+       /* If this is a hub, free the TT(s) from the TT list */
+       xhci_free_tt_info(xhci, dev, slot_id);