--- /dev/null
+From 1b94e59d30afecf18254ad413e953e7587645a20 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 12 May 2020 09:32:03 +0200
+Subject: ALSA: hda/realtek - Add COEF workaround for ASUS ZenBook UX431DA
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1b94e59d30afecf18254ad413e953e7587645a20 upstream.
+
+ASUS ZenBook UX431DA requires an additional COEF setup when booted
+from the recent Windows 10, otherwise it produces the noisy output.
+The quirk turns on COEF 0x1b bit 10 that has been cleared supposedly
+due to the pop noise reduction.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207553
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20200512073203.14091-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5978,6 +5978,7 @@ enum {
+ ALC294_FIXUP_ASUS_DUAL_SPK,
+ ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+ ALC294_FIXUP_ASUS_HPE,
++ ALC294_FIXUP_ASUS_COEF_1B,
+ ALC285_FIXUP_HP_GPIO_LED,
+ };
+
+@@ -7112,6 +7113,17 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
+ },
++ [ALC294_FIXUP_ASUS_COEF_1B] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Set bit 10 to correct noisy output after reboot from
++ * Windows 10 (due to pop noise reduction?)
++ */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x1b },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x4e4b },
++ { }
++ },
++ },
+ [ALC285_FIXUP_HP_GPIO_LED] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_gpio_led,
+@@ -7283,6 +7295,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B),
+ SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From b590b38ca305d6d7902ec7c4f7e273e0069f3bcc Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 14 May 2020 18:05:33 +0200
+Subject: ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b590b38ca305d6d7902ec7c4f7e273e0069f3bcc upstream.
+
+Lenovo Thinkpad T530 seems to have a sensitive internal mic capture
+that needs to limit the mic boost like a few other Thinkpad models.
+Although we may change the quirk for ALC269_FIXUP_LENOVO_DOCK, this
+hits way too many other laptop models, so let's add a new fixup model
+that limits the internal mic boost on top of the existing quirk and
+apply to only T530.
+
+BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1171293
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200514160533.10337-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5856,6 +5856,7 @@ enum {
+ ALC269_FIXUP_HP_LINE1_MIC1_LED,
+ ALC269_FIXUP_INV_DMIC,
+ ALC269_FIXUP_LENOVO_DOCK,
++ ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST,
+ ALC269_FIXUP_NO_SHUTUP,
+ ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
+ ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
+@@ -6175,6 +6176,12 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT
+ },
++ [ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc269_fixup_limit_int_mic_boost,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_LENOVO_DOCK,
++ },
+ [ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+@@ -7317,7 +7324,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
+- SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
+@@ -7456,6 +7463,7 @@ static const struct hda_model_fixup alc2
+ {.id = ALC269_FIXUP_HEADSET_MODE, .name = "headset-mode"},
+ {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"},
+ {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
++ {.id = ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, .name = "lenovo-dock-limit-boost"},
+ {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
+ {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"},
+ {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
--- /dev/null
+From c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 7 May 2020 13:44:56 +0200
+Subject: ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d upstream.
+
+The rawmidi core allows user to resize the runtime buffer via ioctl,
+and this may lead to UAF when performed during concurrent reads or
+writes: the read/write functions unlock the runtime lock temporarily
+during copying form/to user-space, and that's the race window.
+
+This patch fixes the hole by introducing a reference counter for the
+runtime buffer read/write access and returns -EBUSY error when the
+resize is performed concurrently against read/write.
+
+Note that the ref count field is a simple integer instead of
+refcount_t here, since the all contexts accessing the buffer is
+basically protected with a spinlock, hence we need no expensive atomic
+ops. Also, note that this busy check is needed only against read /
+write functions, and not in receive/transmit callbacks; the race can
+happen only at the spinlock hole mentioned in the above, while the
+whole function is protected for receive / transmit callbacks.
+
+Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWrfg@mail.gmail.com
+Link: https://lore.kernel.org/r/s5heerw3r5z.wl-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/rawmidi.h | 1 +
+ sound/core/rawmidi.c | 31 +++++++++++++++++++++++++++----
+ 2 files changed, 28 insertions(+), 4 deletions(-)
+
+--- a/include/sound/rawmidi.h
++++ b/include/sound/rawmidi.h
+@@ -61,6 +61,7 @@ struct snd_rawmidi_runtime {
+ size_t avail_min; /* min avail for wakeup */
+ size_t avail; /* max used buffer for wakeup */
+ size_t xruns; /* over/underruns counter */
++ int buffer_ref; /* buffer reference count */
+ /* misc */
+ spinlock_t lock;
+ wait_queue_head_t sleep;
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -120,6 +120,17 @@ static void snd_rawmidi_input_event_work
+ runtime->event(runtime->substream);
+ }
+
++/* buffer refcount management: call with runtime->lock held */
++static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime)
++{
++ runtime->buffer_ref++;
++}
++
++static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime)
++{
++ runtime->buffer_ref--;
++}
++
+ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
+ {
+ struct snd_rawmidi_runtime *runtime;
+@@ -669,6 +680,11 @@ static int resize_runtime_buffer(struct
+ if (!newbuf)
+ return -ENOMEM;
+ spin_lock_irq(&runtime->lock);
++ if (runtime->buffer_ref) {
++ spin_unlock_irq(&runtime->lock);
++ kvfree(newbuf);
++ return -EBUSY;
++ }
+ oldbuf = runtime->buffer;
+ runtime->buffer = newbuf;
+ runtime->buffer_size = params->buffer_size;
+@@ -1019,8 +1035,10 @@ static long snd_rawmidi_kernel_read1(str
+ long result = 0, count1;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
+ unsigned long appl_ptr;
++ int err = 0;
+
+ spin_lock_irqsave(&runtime->lock, flags);
++ snd_rawmidi_buffer_ref(runtime);
+ while (count > 0 && runtime->avail) {
+ count1 = runtime->buffer_size - runtime->appl_ptr;
+ if (count1 > count)
+@@ -1039,16 +1057,19 @@ static long snd_rawmidi_kernel_read1(str
+ if (userbuf) {
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ if (copy_to_user(userbuf + result,
+- runtime->buffer + appl_ptr, count1)) {
+- return result > 0 ? result : -EFAULT;
+- }
++ runtime->buffer + appl_ptr, count1))
++ err = -EFAULT;
+ spin_lock_irqsave(&runtime->lock, flags);
++ if (err)
++ goto out;
+ }
+ result += count1;
+ count -= count1;
+ }
++ out:
++ snd_rawmidi_buffer_unref(runtime);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+- return result;
++ return result > 0 ? result : err;
+ }
+
+ long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream,
+@@ -1342,6 +1363,7 @@ static long snd_rawmidi_kernel_write1(st
+ return -EAGAIN;
+ }
+ }
++ snd_rawmidi_buffer_ref(runtime);
+ while (count > 0 && runtime->avail > 0) {
+ count1 = runtime->buffer_size - runtime->appl_ptr;
+ if (count1 > count)
+@@ -1373,6 +1395,7 @@ static long snd_rawmidi_kernel_write1(st
+ }
+ __end:
+ count1 = runtime->avail < runtime->buffer_size;
++ snd_rawmidi_buffer_unref(runtime);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ if (count1)
+ snd_rawmidi_output_trigger(substream, 1);
--- /dev/null
+From 073919e09ca445d4486968e3f851372ff44cf2b5 Mon Sep 17 00:00:00 2001
+From: Jesus Ramos <jesus-ramos@live.com>
+Date: Mon, 27 Apr 2020 06:21:39 -0700
+Subject: ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
+
+From: Jesus Ramos <jesus-ramos@live.com>
+
+commit 073919e09ca445d4486968e3f851372ff44cf2b5 upstream.
+
+Kingston HyperX headset with 0951:16ad also needs the same quirk for
+delaying the frequency controls.
+
+Signed-off-by: Jesus Ramos <jesus-ramos@live.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/BY5PR19MB3634BA68C7CCA23D8DF428E796AF0@BY5PR19MB3634.namprd19.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1592,13 +1592,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
+- /* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here,
+- * otherwise requests like get/set frequency return as failed despite
+- * actually succeeding.
++ /* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny
++ * delay here, otherwise requests like get/set frequency return as
++ * failed despite actually succeeding.
+ */
+ if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+ chip->usb_id == USB_ID(0x046d, 0x0a46) ||
+- chip->usb_id == USB_ID(0x0b0e, 0x0349)) &&
++ chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
++ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ usleep_range(1000, 2000);
+ }
bootconfig-fix-to-prevent-warning-message-if-no-bootconfig-option.patch
usb-usbfs-correct-kernel-user-page-attribute-mismatch.patch
usb-usbfs-fix-mmap-dma-mismatch.patch
+alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch
+alsa-hda-realtek-add-coef-workaround-for-asus-zenbook-ux431da.patch
+alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch
+alsa-usb-audio-add-control-message-quirk-delay-for-kingston-hyperx-headset.patch
+usb-core-hub-limit-hub_quirk_disable_autosuspend-to-usb5534b.patch
+usb-host-xhci-plat-keep-runtime-active-when-removing-host.patch
+usb-cdns3-gadget-prev_req-trb-is-null-for-ep0.patch
--- /dev/null
+From 95cd7dc47abd71d1a0c9c43594ff2fa32552f46c Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Thu, 30 Apr 2020 15:07:13 +0800
+Subject: usb: cdns3: gadget: prev_req->trb is NULL for ep0
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 95cd7dc47abd71d1a0c9c43594ff2fa32552f46c upstream.
+
+And there are no multiple TRBs on EP0 and WA1 workaround,
+so it doesn't need to change TRB for EP0. It fixes below oops.
+
+configfs-gadget gadget: high-speed config #1: b
+android_work: sent uevent USB_STATE=CONFIGURED
+Unable to handle kernel read from unreadable memory at virtual address 0000000000000008
+Mem abort info:
+android_work: sent uevent USB_STATE=DISCONNECTED
+ ESR = 0x96000004
+ EC = 0x25: DABT (current EL), IL = 32 bits
+
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+Data abort info:
+ ISV = 0, ISS = 0x00000004
+ CM = 0, WnR = 0
+user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b5bb7000
+[0000000000000008] pgd=0000000000000000
+Internal error: Oops: 96000004 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 2 PID: 430 Comm: HwBinder:401_1 Not tainted 5.4.24-06071-g6fa8921409c1-dirty #77
+Hardware name: Freescale i.MX8QXP MEK (DT)
+pstate: 60400085 (nZCv daIf +PAN -UAO)
+pc : cdns3_gadget_ep_dequeue+0x1d4/0x270
+lr : cdns3_gadget_ep_dequeue+0x48/0x270
+sp : ffff800012763ba0
+x29: ffff800012763ba0 x28: ffff00082c653c00
+x27: 0000000000000000 x26: ffff000068fa7b00
+x25: ffff0000699b2000 x24: ffff00082c6ac000
+x23: ffff000834f0a480 x22: ffff000834e87b9c
+x21: 0000000000000000 x20: ffff000834e87800
+x19: ffff000069eddc00 x18: 0000000000000000
+x17: 0000000000000000 x16: 0000000000000000
+x15: 0000000000000000 x14: 0000000000000000
+x13: 0000000000000000 x12: 0000000000000001
+x11: ffff80001180fbe8 x10: 0000000000000001
+x9 : ffff800012101558 x8 : 0000000000000001
+x7 : 0000000000000006 x6 : ffff000835d9c668
+x5 : ffff000834f0a4c8 x4 : 0000000096000000
+x3 : 0000000000001810 x2 : 0000000000000000
+x1 : ffff800024bd001c x0 : 0000000000000001
+Call trace:
+ cdns3_gadget_ep_dequeue+0x1d4/0x270
+ usb_ep_dequeue+0x34/0xf8
+ composite_dev_cleanup+0x154/0x170
+ configfs_composite_unbind+0x6c/0xa8
+ usb_gadget_remove_driver+0x44/0x70
+ usb_gadget_unregister_driver+0x74/0xe0
+ unregister_gadget+0x28/0x58
+ gadget_dev_desc_UDC_store+0x80/0x110
+ configfs_write_file+0x1e0/0x2a0
+ __vfs_write+0x48/0x90
+ vfs_write+0xe4/0x1c8
+ ksys_write+0x78/0x100
+ __arm64_sys_write+0x24/0x30
+ el0_svc_common.constprop.0+0x74/0x168
+ el0_svc_handler+0x34/0xa0
+ el0_svc+0x8/0xc
+Code: 52830203 b9407660 f94042e4 11000400 (b9400841)
+---[ end trace 1574516e4c1772ca ]---
+Kernel panic - not syncing: Fatal exception
+SMP: stopping secondary CPUs
+Kernel Offset: disabled
+CPU features: 0x0002,20002008
+Memory Limit: none
+Rebooting in 5 seconds..
+
+Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/cdns3/gadget.c
++++ b/drivers/usb/cdns3/gadget.c
+@@ -2548,7 +2548,7 @@ found:
+ link_trb = priv_req->trb;
+
+ /* Update ring only if removed request is on pending_req_list list */
+- if (req_on_hw_ring) {
++ if (req_on_hw_ring && link_trb) {
+ link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma +
+ ((priv_req->end_trb + 1) * TRB_SIZE));
+ link_trb->control = (link_trb->control & TRB_CYCLE) |
--- /dev/null
+From 76e1ef1d81a4129d7e2fb8c48c83b166d1c8e040 Mon Sep 17 00:00:00 2001
+From: Eugeniu Rosca <erosca@de.adit-jv.com>
+Date: Fri, 15 May 2020 00:02:46 +0200
+Subject: usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
+
+From: Eugeniu Rosca <erosca@de.adit-jv.com>
+
+commit 76e1ef1d81a4129d7e2fb8c48c83b166d1c8e040 upstream.
+
+On Tue, May 12, 2020 at 09:36:07PM +0800, Kai-Heng Feng wrote [1]:
+> This patch prevents my Raven Ridge xHCI from getting runtime suspend.
+
+The problem described in v5.6 commit 1208f9e1d758c9 ("USB: hub: Fix the
+broken detection of USB3 device in SMSC hub") applies solely to the
+USB5534B hub [2] present on the Kingfisher Infotainment Carrier Board,
+manufactured by Shimafuji Electric Inc [3].
+
+Despite that, the aforementioned commit applied the quirk to _all_ hubs
+carrying vendor ID 0x424 (i.e. SMSC), of which there are more [4] than
+initially expected. Consequently, the quirk is now enabled on platforms
+carrying SMSC/Microchip hub models which potentially don't exhibit the
+original issue.
+
+To avoid reports like [1], further limit the quirk's scope to
+USB5534B [2], by employing both Vendor and Product ID checks.
+
+Tested on H3ULCB + Kingfisher rev. M05.
+
+[1] https://lore.kernel.org/linux-renesas-soc/73933975-6F0E-40F5-9584-D2B8F615C0F3@canonical.com/
+[2] https://www.microchip.com/wwwproducts/en/USB5534B
+[3] http://www.shimafuji.co.jp/wp/wp-content/uploads/2018/08/SBEV-RCAR-KF-M06Board_HWSpecificationEN_Rev130.pdf
+[4] https://devicehunt.com/search/type/usb/vendor/0424/device/any
+
+Fixes: 1208f9e1d758c9 ("USB: hub: Fix the broken detection of USB3 device in SMSC hub")
+Cc: stable@vger.kernel.org # v4.14+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Hardik Gajjar <hgajjar@de.adit-jv.com>
+Cc: linux-renesas-soc@vger.kernel.org
+Cc: linux-usb@vger.kernel.org
+Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20200514220246.13290-1-erosca@de.adit-jv.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -39,6 +39,7 @@
+
+ #define USB_VENDOR_GENESYS_LOGIC 0x05e3
+ #define USB_VENDOR_SMSC 0x0424
++#define USB_PRODUCT_USB5534B 0x5534
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
+ #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
+
+@@ -5621,8 +5622,11 @@ out_hdev_lock:
+ }
+
+ static const struct usb_device_id hub_id_table[] = {
+- { .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_CLASS,
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT
++ | USB_DEVICE_ID_MATCH_INT_CLASS,
+ .idVendor = USB_VENDOR_SMSC,
++ .idProduct = USB_PRODUCT_USB5534B,
+ .bInterfaceClass = USB_CLASS_HUB,
+ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
--- /dev/null
+From 1449cb2c2253d37d998c3714aa9b95416d16d379 Mon Sep 17 00:00:00 2001
+From: Li Jun <jun.li@nxp.com>
+Date: Thu, 14 May 2020 14:04:32 +0300
+Subject: usb: host: xhci-plat: keep runtime active when removing host
+
+From: Li Jun <jun.li@nxp.com>
+
+commit 1449cb2c2253d37d998c3714aa9b95416d16d379 upstream.
+
+While removing the host (e.g. for USB role switch from host to device),
+if runtime pm is enabled by user, below oops occurs on dwc3 and cdns3
+platforms.
+Keeping the xhci-plat device active during host removal, and disabling
+runtime pm before calling pm_runtime_set_suspended() fixes them.
+
+oops1:
+Unable to handle kernel NULL pointer dereference at virtual address
+0000000000000240
+Internal error: Oops: 96000004 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.4.3-00107-g64d454a-dirty
+Hardware name: FSL i.MX8MP EVK (DT)
+Workqueue: pm pm_runtime_work
+pstate: 60000005 (nZCv daif -PAN -UAO)
+pc : xhci_suspend+0x34/0x698
+lr : xhci_plat_runtime_suspend+0x2c/0x38
+sp : ffff800011ddbbc0
+Call trace:
+ xhci_suspend+0x34/0x698
+ xhci_plat_runtime_suspend+0x2c/0x38
+ pm_generic_runtime_suspend+0x28/0x40
+ __rpm_callback+0xd8/0x138
+ rpm_callback+0x24/0x98
+ rpm_suspend+0xe0/0x448
+ rpm_idle+0x124/0x140
+ pm_runtime_work+0xa0/0xf8
+ process_one_work+0x1dc/0x370
+ worker_thread+0x48/0x468
+ kthread+0xf0/0x120
+ ret_from_fork+0x10/0x1c
+
+oops2:
+usb 2-1: USB disconnect, device number 2
+xhci-hcd xhci-hcd.1.auto: remove, state 4
+usb usb2: USB disconnect, device number 1
+xhci-hcd xhci-hcd.1.auto: USB bus 2 deregistered
+xhci-hcd xhci-hcd.1.auto: remove, state 4
+usb usb1: USB disconnect, device number 1
+Unable to handle kernel NULL pointer dereference at virtual address
+0000000000000138
+Internal error: Oops: 96000004 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 2 PID: 7 Comm: kworker/u8:0 Not tainted 5.6.0-rc4-next-20200304-03578
+Hardware name: Freescale i.MX8QXP MEK (DT)
+Workqueue: 1-0050 tcpm_state_machine_work
+pstate: 20000005 (nzCv daif -PAN -UAO)
+pc : xhci_free_dev+0x214/0x270
+lr : xhci_plat_runtime_resume+0x78/0x88
+sp : ffff80001006b5b0
+Call trace:
+ xhci_free_dev+0x214/0x270
+ xhci_plat_runtime_resume+0x78/0x88
+ pm_generic_runtime_resume+0x30/0x48
+ __rpm_callback+0x90/0x148
+ rpm_callback+0x28/0x88
+ rpm_resume+0x568/0x758
+ rpm_resume+0x260/0x758
+ rpm_resume+0x260/0x758
+ __pm_runtime_resume+0x40/0x88
+ device_release_driver_internal+0xa0/0x1c8
+ device_release_driver+0x1c/0x28
+ bus_remove_device+0xd4/0x158
+ device_del+0x15c/0x3a0
+ usb_disable_device+0xb0/0x268
+ usb_disconnect+0xcc/0x300
+ usb_remove_hcd+0xf4/0x1dc
+ xhci_plat_remove+0x78/0xe0
+ platform_drv_remove+0x30/0x50
+ device_release_driver_internal+0xfc/0x1c8
+ device_release_driver+0x1c/0x28
+ bus_remove_device+0xd4/0x158
+ device_del+0x15c/0x3a0
+ platform_device_del.part.0+0x20/0x90
+ platform_device_unregister+0x28/0x40
+ cdns3_host_exit+0x20/0x40
+ cdns3_role_stop+0x60/0x90
+ cdns3_role_set+0x64/0xd8
+ usb_role_switch_set_role.part.0+0x3c/0x68
+ usb_role_switch_set_role+0x20/0x30
+ tcpm_mux_set+0x60/0xf8
+ tcpm_reset_port+0xa4/0xf0
+ tcpm_detach.part.0+0x28/0x50
+ tcpm_state_machine_work+0x12ac/0x2360
+ process_one_work+0x1c8/0x470
+ worker_thread+0x50/0x428
+ kthread+0xfc/0x128
+ ret_from_fork+0x10/0x18
+Code: c8037c02 35ffffa3 17ffe7c3 f9800011 (c85f7c01)
+---[ end trace 45b1a173d2679e44 ]---
+
+[minor commit message cleanup -Mathias]
+Cc: Baolin Wang <baolin.wang@linaro.org>
+Cc: <stable@vger.kernel.org>
+Fixes: b0c69b4bace3 ("usb: host: plat: Enable xHCI plat runtime PM")
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Tested-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200514110432.25564-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-plat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -363,6 +363,7 @@ static int xhci_plat_remove(struct platf
+ struct clk *reg_clk = xhci->reg_clk;
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
++ pm_runtime_get_sync(&dev->dev);
+ xhci->xhc_state |= XHCI_STATE_REMOVING;
+
+ usb_remove_hcd(shared_hcd);
+@@ -376,8 +377,9 @@ static int xhci_plat_remove(struct platf
+ clk_disable_unprepare(reg_clk);
+ usb_put_hcd(hcd);
+
+- pm_runtime_set_suspended(&dev->dev);
+ pm_runtime_disable(&dev->dev);
++ pm_runtime_put_noidle(&dev->dev);
++ pm_runtime_set_suspended(&dev->dev);
+
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
