--- /dev/null
+From e7585db1b0b5b4e4eb1967bb1472df308f7ffcbf Mon Sep 17 00:00:00 2001
+From: Laurence Tratt <laurie@tratt.net>
+Date: Fri, 12 Jun 2020 12:18:07 +0100
+Subject: ALSA: usb-audio: Add implicit feedback quirk for SSL2+.
+
+From: Laurence Tratt <laurie@tratt.net>
+
+commit e7585db1b0b5b4e4eb1967bb1472df308f7ffcbf upstream.
+
+This uses the same quirk as the Motu M2 and M4 to ensure the driver uses the
+audio interface's clock. Tested on an SSL2+.
+
+Signed-off-by: Laurence Tratt <laurie@tratt.net>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200612111807.dgnig6rwhmsl2bod@overdrive.tratt.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -349,6 +349,7 @@ static int set_sync_ep_implicit_fb_quirk
+ ifnum = 0;
+ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++ case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */
+ ep = 0x81;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
--- /dev/null
+From c9808bbfed3cfc911ecb60fe8e80c0c27876c657 Mon Sep 17 00:00:00 2001
+From: "Yick W. Tse" <y_w_tse@yahoo.com.hk>
+Date: Sat, 13 Jun 2020 11:40:06 +0000
+Subject: ALSA: usb-audio: add quirk for Denon DCD-1500RE
+
+From: Yick W. Tse <y_w_tse@yahoo.com.hk>
+
+commit c9808bbfed3cfc911ecb60fe8e80c0c27876c657 upstream.
+
+fix error "clock source 41 is not valid, cannot use"
+
+[] New USB device found, idVendor=154e, idProduct=1002, bcdDevice= 1.00
+[] New USB device strings: Mfr=1, Product=2, SerialNumber=0
+[] Product: DCD-1500RE
+[] Manufacturer: D & M Holdings Inc.
+[]
+[] clock source 41 is not valid, cannot use
+[] usbcore: registered new interface driver snd-usb-audio
+
+Signed-off-by: Yick W. Tse <y_w_tse@yahoo.com.hk>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1373857985.210365.1592048406997@mail.yahoo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1461,6 +1461,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ static bool is_itf_usb_dsd_dac(unsigned int id)
+ {
+ switch (id) {
++ case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */
+ case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
+ case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
+ case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
--- /dev/null
+From a32a1fc99807244d920d274adc46ba04b538cc8a Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Tue, 23 Jun 2020 19:03:23 +0800
+Subject: ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG)
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+commit a32a1fc99807244d920d274adc46ba04b538cc8a upstream.
+
+We've found Samsung USBC Headset (AKG) (VID: 0x04e8, PID: 0xa051)
+need a tiny delay after each class compliant request.
+Otherwise the device might not be able to be recognized each times.
+
+Signed-off-by: Chihhao Chen <chihhao.chen@mediatek.com>
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1592910203-24035-1-git-send-email-macpaul.lin@mediatek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1603,6 +1603,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ usleep_range(1000, 2000);
++
++ /*
++ * Samsung USBC Headset (AKG) need a tiny delay after each
++ * class compliant request. (Model number: AAM625R or AAM627R)
++ */
++ if (chip->usb_id == USB_ID(0x04e8, 0xa051) &&
++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ usleep_range(5000, 6000);
+ }
+
+ /*
--- /dev/null
+From 220345e98f1cdc768eeb6e3364a0fa7ab9647fe7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 24 Jun 2020 14:23:40 +0200
+Subject: ALSA: usb-audio: Fix OOB access of mixer element list
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 220345e98f1cdc768eeb6e3364a0fa7ab9647fe7 upstream.
+
+The USB-audio mixer code holds a linked list of usb_mixer_elem_list,
+and several operations are performed for each mixer element. A few of
+them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2())
+assume each mixer element being a usb_mixer_elem_info object that is a
+subclass of usb_mixer_elem_list, cast via container_of() and access it
+members. This may result in an out-of-bound access when a
+non-standard list element has been added, as spotted by syzkaller
+recently.
+
+This patch adds a new field, is_std_info, in usb_mixer_elem_list to
+indicate that the element is the usb_mixer_elem_info type or not, and
+skip the access to such an element if needed.
+
+Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com
+Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer.c | 15 +++++++++++----
+ sound/usb/mixer.h | 9 +++++++--
+ sound/usb/mixer_quirks.c | 3 ++-
+ 3 files changed, 20 insertions(+), 7 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -576,8 +576,9 @@ static int check_matrix_bitmap(unsigned
+ * if failed, give up and free the control instance.
+ */
+
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+- struct snd_kcontrol *kctl)
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++ struct snd_kcontrol *kctl,
++ bool is_std_info)
+ {
+ struct usb_mixer_interface *mixer = list->mixer;
+ int err;
+@@ -591,6 +592,7 @@ int snd_usb_mixer_add_control(struct usb
+ return err;
+ }
+ list->kctl = kctl;
++ list->is_std_info = is_std_info;
+ list->next_id_elem = mixer->id_elems[list->id];
+ mixer->id_elems[list->id] = list;
+ return 0;
+@@ -3213,8 +3215,11 @@ void snd_usb_mixer_notify_id(struct usb_
+ unitid = delegate_notify(mixer, unitid, NULL, NULL);
+
+ for_each_mixer_elem(list, mixer, unitid) {
+- struct usb_mixer_elem_info *info =
+- mixer_elem_list_to_info(list);
++ struct usb_mixer_elem_info *info;
++
++ if (!list->is_std_info)
++ continue;
++ info = mixer_elem_list_to_info(list);
+ /* invalidate cache, so the value is read from the device */
+ info->cached = 0;
+ snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+@@ -3294,6 +3299,8 @@ static void snd_usb_mixer_interrupt_v2(s
+
+ if (!list->kctl)
+ continue;
++ if (!list->is_std_info)
++ continue;
+
+ info = mixer_elem_list_to_info(list);
+ if (count > 1 && info->control != control)
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -66,6 +66,7 @@ struct usb_mixer_elem_list {
+ struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */
+ struct snd_kcontrol *kctl;
+ unsigned int id;
++ bool is_std_info;
+ usb_mixer_elem_dump_func_t dump;
+ usb_mixer_elem_resume_func_t resume;
+ };
+@@ -103,8 +104,12 @@ void snd_usb_mixer_notify_id(struct usb_
+ int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
+ int request, int validx, int value_set);
+
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+- struct snd_kcontrol *kctl);
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++ struct snd_kcontrol *kctl,
++ bool is_std_info);
++
++#define snd_usb_mixer_add_control(list, kctl) \
++ snd_usb_mixer_add_list(list, kctl, true)
+
+ void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list,
+ struct usb_mixer_interface *mixer,
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -157,7 +157,8 @@ static int add_single_ctl_with_resume(st
+ return -ENOMEM;
+ }
+ kctl->private_free = snd_usb_mixer_elem_free;
+- return snd_usb_mixer_add_control(list, kctl);
++ /* don't use snd_usb_mixer_add_control() here, this is a special list element */
++ return snd_usb_mixer_add_list(list, kctl, false);
+ }
+
+ /*
--- /dev/null
+From d35d3660e065b69fdb8bf512f3d899f350afce52 Mon Sep 17 00:00:00 2001
+From: Todd Kjos <tkjos@google.com>
+Date: Mon, 22 Jun 2020 13:07:15 -0700
+Subject: binder: fix null deref of proc->context
+
+From: Todd Kjos <tkjos@google.com>
+
+commit d35d3660e065b69fdb8bf512f3d899f350afce52 upstream.
+
+The binder driver makes the assumption proc->context pointer is invariant after
+initialization (as documented in the kerneldoc header for struct proc).
+However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
+proc->context is set to NULL during binder_deferred_release().
+
+Another proc was in the middle of setting up a transaction to the dying
+process and crashed on a NULL pointer deref on "context" which is a local
+set to &proc->context:
+
+ new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
+
+Here's the stack:
+
+[ 5237.855435] Call trace:
+[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec
+[ 5237.855446] binder_inc_ref_for_node+0x140/0x280
+[ 5237.855451] binder_translate_binder+0x1d0/0x388
+[ 5237.855456] binder_transaction+0x2228/0x3730
+[ 5237.855461] binder_thread_write+0x640/0x25bc
+[ 5237.855466] binder_ioctl_write_read+0xb0/0x464
+[ 5237.855471] binder_ioctl+0x30c/0x96c
+[ 5237.855477] do_vfs_ioctl+0x3e0/0x700
+[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4
+[ 5237.855488] el0_svc_common+0xb4/0x194
+[ 5237.855493] el0_svc_handler+0x74/0x98
+[ 5237.855497] el0_svc+0x8/0xc
+
+The fix is to move the kfree of the binder_device to binder_free_proc()
+so the binder_device is freed when we know there are no references
+remaining on the binder_proc.
+
+Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Todd Kjos <tkjos@google.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200622200715.114382-1-tkjos@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/android/binder.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4688,8 +4688,15 @@ static struct binder_thread *binder_get_
+
+ static void binder_free_proc(struct binder_proc *proc)
+ {
++ struct binder_device *device;
++
+ BUG_ON(!list_empty(&proc->todo));
+ BUG_ON(!list_empty(&proc->delivered_death));
++ device = container_of(proc->context, struct binder_device, context);
++ if (refcount_dec_and_test(&device->ref)) {
++ kfree(proc->context->name);
++ kfree(device);
++ }
+ binder_alloc_deferred_release(&proc->alloc);
+ put_task_struct(proc->tsk);
+ binder_stats_deleted(BINDER_STAT_PROC);
+@@ -5408,7 +5415,6 @@ static int binder_node_release(struct bi
+ static void binder_deferred_release(struct binder_proc *proc)
+ {
+ struct binder_context *context = proc->context;
+- struct binder_device *device;
+ struct rb_node *n;
+ int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
+
+@@ -5425,12 +5431,6 @@ static void binder_deferred_release(stru
+ context->binder_context_mgr_node = NULL;
+ }
+ mutex_unlock(&context->context_mgr_node_lock);
+- device = container_of(proc->context, struct binder_device, context);
+- if (refcount_dec_and_test(&device->ref)) {
+- kfree(context->name);
+- kfree(device);
+- }
+- proc->context = NULL;
+ binder_inner_proc_lock(proc);
+ /*
+ * Make sure proc stays alive after we
net-sched-export-__netdev_watchdog_up.patch
fix-a-braino-in-sparc32-fix-register-window-handling.patch
alsa-usb-audio-fix-potential-use-after-free-of-strea.patch
+binder-fix-null-deref-of-proc-context.patch
+usb-ohci-sm501-add-missed-iounmap-in-remove.patch
+usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch
+usb-add-usb_quirk_delay_init-for-logitech-c922.patch
+usb-ehci-reopen-solution-for-synopsys-hc-bug.patch
+usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch
+xhci-poll-for-u0-after-disabling-usb2-lpm.patch
+usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch
+usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch
+alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch
+alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch
+alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch
+alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch
+usb-cdns3-trace-using-correct-dir-value.patch
+usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch
+usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch
--- /dev/null
+From 5d8021923e8a8cc37a421a64e27c7221f0fee33c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomasz=20Meresi=C5=84ski?= <tomasz@meresinski.eu>
+Date: Wed, 3 Jun 2020 22:33:46 +0200
+Subject: usb: add USB_QUIRK_DELAY_INIT for Logitech C922
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Meresiński <tomasz@meresinski.eu>
+
+commit 5d8021923e8a8cc37a421a64e27c7221f0fee33c upstream.
+
+The Logitech C922, just like other Logitech webcams,
+needs the USB_QUIRK_DELAY_INIT or it will randomly
+not respond after device connection
+
+Signed-off-by: Tomasz Meresiński <tomasz@meresinski.eu>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200603203347.7792-1-tomasz@meresinski.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -218,11 +218,12 @@ static const struct usb_device_id usb_qu
+ /* Logitech HD Webcam C270 */
+ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
++ /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT },
+
+ /* Logitech ConferenceCam CC3000e */
+ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
--- /dev/null
+From 2587a029fa2a877d0a8dda955ef1b24c94b4bd0e Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 23 Jun 2020 11:09:18 +0800
+Subject: usb: cdns3: ep0: add spinlock for cdns3_check_new_setup
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 2587a029fa2a877d0a8dda955ef1b24c94b4bd0e upstream.
+
+The other thread may access other endpoints when the cdns3_check_new_setup
+is handling, add spinlock to protect it.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Reviewed-by: Pawel Laszczak <pawell@cadence.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/ep0.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/cdns3/ep0.c
++++ b/drivers/usb/cdns3/ep0.c
+@@ -712,15 +712,17 @@ static int cdns3_gadget_ep0_queue(struct
+ int ret = 0;
+ u8 zlp = 0;
+
++ spin_lock_irqsave(&priv_dev->lock, flags);
+ trace_cdns3_ep0_queue(priv_dev, request);
+
+ /* cancel the request if controller receive new SETUP packet. */
+- if (cdns3_check_new_setup(priv_dev))
++ if (cdns3_check_new_setup(priv_dev)) {
++ spin_unlock_irqrestore(&priv_dev->lock, flags);
+ return -ECONNRESET;
++ }
+
+ /* send STATUS stage. Should be called only for SET_CONFIGURATION */
+ if (priv_dev->ep0_stage == CDNS3_STATUS_STAGE) {
+- spin_lock_irqsave(&priv_dev->lock, flags);
+ cdns3_select_ep(priv_dev, 0x00);
+
+ erdy_sent = !priv_dev->hw_configured_flag;
+@@ -745,7 +747,6 @@ static int cdns3_gadget_ep0_queue(struct
+ return 0;
+ }
+
+- spin_lock_irqsave(&priv_dev->lock, flags);
+ if (!list_empty(&priv_ep->pending_req_list)) {
+ dev_err(priv_dev->dev,
+ "can't handle multiple requests for ep0\n");
--- /dev/null
+From b51e1cf64f93acebb6d8afbacd648a6ecefc39b4 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 23 Jun 2020 11:09:16 +0800
+Subject: usb: cdns3: ep0: fix the test mode set incorrectly
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit b51e1cf64f93acebb6d8afbacd648a6ecefc39b4 upstream.
+
+The 'tmode' is ctrl->wIndex, changing it as the real test
+mode value for register assignment.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Reviewed-by: Jun Li <jun.li@nxp.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/ep0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/cdns3/ep0.c
++++ b/drivers/usb/cdns3/ep0.c
+@@ -327,7 +327,8 @@ static int cdns3_ep0_feature_handle_devi
+ if (!set || (tmode & 0xff) != 0)
+ return -EINVAL;
+
+- switch (tmode >> 8) {
++ tmode >>= 8;
++ switch (tmode) {
+ case TEST_J:
+ case TEST_K:
+ case TEST_SE0_NAK:
--- /dev/null
+From ba3a80fe0fb67d8790f62b7bc60df97406d89871 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 23 Jun 2020 11:09:17 +0800
+Subject: usb: cdns3: trace: using correct dir value
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit ba3a80fe0fb67d8790f62b7bc60df97406d89871 upstream.
+
+It should use the correct direction value from register, not depends
+on previous software setting. It fixed the EP number wrong issue at
+trace when the TRBERR interrupt occurs for EP0IN.
+
+When the EP0IN IOC has finished, software prepares the setup packet
+request, the expected direction is OUT, but at that time, the TRBERR
+for EP0IN may occur since it is DMULT mode, the DMA does not stop
+until TRBERR has met.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Reviewed-by: Pawel Laszczak <pawell@cadence.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/cdns3/trace.h
++++ b/drivers/usb/cdns3/trace.h
+@@ -150,7 +150,7 @@ DECLARE_EVENT_CLASS(cdns3_log_ep0_irq,
+ __dynamic_array(char, str, CDNS3_MSG_MAX)
+ ),
+ TP_fast_assign(
+- __entry->ep_dir = priv_dev->ep0_data_dir;
++ __entry->ep_dir = priv_dev->selected_ep;
+ __entry->ep_sts = ep_sts;
+ ),
+ TP_printk("%s", cdns3_decode_ep0_irq(__get_str(str),
--- /dev/null
+From 207324a321a866401b098cadf19e4a2dd6584622 Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Date: Tue, 9 Jun 2020 12:28:11 +0400
+Subject: usb: dwc2: Postponed gadget registration to the udc class driver
+
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+
+commit 207324a321a866401b098cadf19e4a2dd6584622 upstream.
+
+During dwc2 driver probe, after gadget registration to the udc class
+driver, if exist any builtin function driver it immediately bound to
+dwc2 and after init host side (dwc2_hcd_init()) stucked in host mode.
+Patch postpone gadget registration after host side initialization done.
+
+Fixes: 117777b2c3bb9 ("usb: dwc2: Move gadget probe function into platform code")
+Reported-by: kbuild test robot <lkp@intel.com>
+Tested-by: Marek Vasut <marex@denx.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Link: https://lore.kernel.org/r/f21cb38fecc72a230b86155d94c7e60c9cb66f58.1591690938.git.hminas@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc2/gadget.c | 6 ------
+ drivers/usb/dwc2/platform.c | 11 +++++++++++
+ 2 files changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4886,12 +4886,6 @@ int dwc2_gadget_init(struct dwc2_hsotg *
+ epnum, 0);
+ }
+
+- ret = usb_add_gadget_udc(dev, &hsotg->gadget);
+- if (ret) {
+- dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
+- hsotg->ctrl_req);
+- return ret;
+- }
+ dwc2_hsotg_dump(hsotg);
+
+ return 0;
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -507,6 +507,17 @@ static int dwc2_driver_probe(struct plat
+ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL)
+ dwc2_lowlevel_hw_disable(hsotg);
+
++#if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \
++ IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE)
++ /* Postponed adding a new gadget to the udc class driver list */
++ if (hsotg->gadget_enabled) {
++ retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
++ if (retval) {
++ dwc2_hsotg_remove(hsotg);
++ goto error;
++ }
++ }
++#endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */
+ return 0;
+
+ error:
--- /dev/null
+From 1ddcb71a3edf0e1682b6e056158e4c4b00325f66 Mon Sep 17 00:00:00 2001
+From: Longfang Liu <liulongfang@huawei.com>
+Date: Mon, 8 Jun 2020 11:46:59 +0800
+Subject: USB: ehci: reopen solution for Synopsys HC bug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+commit 1ddcb71a3edf0e1682b6e056158e4c4b00325f66 upstream.
+
+A Synopsys USB2.0 core used in Huawei Kunpeng920 SoC has a bug which
+might cause the host controller not issuing ping.
+
+Bug description:
+After indicating an Interrupt on Async Advance, the software uses the
+doorbell mechanism to delete the Next Link queue head of the last
+executed queue head. At this time, the host controller still references
+the removed queue head(the queue head is NULL). NULL reference causes
+the host controller to lose the USB device.
+
+Solution:
+After deleting the Next Link queue head, when has_synopsys_hc_bug set
+to 1，the software can write one of the valid queue head addresses to
+the ASYNCLISTADDR register to allow the host controller to get
+the valid queue head. in order to solve that problem, this patch set
+the flag for Huawei Kunpeng920
+
+There are detailed instructions and solutions in this patch:
+commit 2f7ac6c19997 ("USB: ehci: add workaround for Synopsys HC bug")
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/1591588019-44284-1-git-send-email-liulongfang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-pci.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -216,6 +216,13 @@ static int ehci_pci_setup(struct usb_hcd
+ ehci_info(ehci, "applying MosChip frame-index workaround\n");
+ ehci->frame_index_bug = 1;
+ break;
++ case PCI_VENDOR_ID_HUAWEI:
++ /* Synopsys HC bug */
++ if (pdev->device == 0xa239) {
++ ehci_info(ehci, "applying Synopsys HC workaround\n");
++ ehci->has_synopsys_hc_bug = 1;
++ }
++ break;
+ }
+
+ /* optional debug port, normally in the first BAR */
--- /dev/null
+From 44ed240d62736ad29943ec01e41e194b96f7c5e9 Mon Sep 17 00:00:00 2001
+From: Tang Bin <tangbin@cmss.chinamobile.com>
+Date: Tue, 2 Jun 2020 19:47:08 +0800
+Subject: usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
+
+From: Tang Bin <tangbin@cmss.chinamobile.com>
+
+commit 44ed240d62736ad29943ec01e41e194b96f7c5e9 upstream.
+
+If the function platform_get_irq() failed, the negative value
+returned will not be detected here. So fix error handling in
+exynos_ehci_probe(). And when get irq failed, the function
+platform_get_irq() logs an error message, so remove redundant
+message here.
+
+Fixes: 1bcc5aa87f04 ("USB: Add initial S5P EHCI driver")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
+Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20200602114708.28620-1-tangbin@cmss.chinamobile.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-exynos.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/ehci-exynos.c
++++ b/drivers/usb/host/ehci-exynos.c
+@@ -203,9 +203,8 @@ static int exynos_ehci_probe(struct plat
+ hcd->rsrc_len = resource_size(res);
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- dev_err(&pdev->dev, "Failed to get IRQ\n");
+- err = -ENODEV;
++ if (irq < 0) {
++ err = irq;
+ goto fail_io;
+ }
+
--- /dev/null
+From a24d5072e87457a14023ee1dd3fc8b1e76f899ef Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Wed, 24 Jun 2020 16:59:47 +0300
+Subject: usb: host: xhci-mtk: avoid runtime suspend when removing hcd
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+commit a24d5072e87457a14023ee1dd3fc8b1e76f899ef upstream.
+
+When runtime suspend was enabled, runtime suspend might happen
+when xhci is removing hcd. This might cause kernel panic when hcd
+has been freed but runtime pm suspend related handle need to
+reference it.
+
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Reviewed-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200624135949.22611-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mtk.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -592,6 +592,9 @@ static int xhci_mtk_remove(struct platfo
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
++ pm_runtime_put_noidle(&dev->dev);
++ pm_runtime_disable(&dev->dev);
++
+ usb_remove_hcd(shared_hcd);
+ xhci->shared_hcd = NULL;
+ device_init_wakeup(&dev->dev, false);
+@@ -602,8 +605,6 @@ static int xhci_mtk_remove(struct platfo
+ xhci_mtk_sch_exit(mtk);
+ xhci_mtk_clks_disable(mtk);
+ xhci_mtk_ldos_disable(mtk);
+- pm_runtime_put_sync(&dev->dev);
+- pm_runtime_disable(&dev->dev);
+
+ return 0;
+ }
--- /dev/null
+From 07c112fb09c86c0231f6ff0061a000ffe91c8eb9 Mon Sep 17 00:00:00 2001
+From: Chuhong Yuan <hslester96@gmail.com>
+Date: Wed, 10 Jun 2020 10:48:44 +0800
+Subject: USB: ohci-sm501: Add missed iounmap() in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+commit 07c112fb09c86c0231f6ff0061a000ffe91c8eb9 upstream.
+
+This driver misses calling iounmap() in remove to undo the ioremap()
+called in probe.
+Add the missed call to fix it.
+
+Fixes: f54aab6ebcec ("usb: ohci-sm501 driver")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20200610024844.3628408-1-hslester96@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ohci-sm501.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/ohci-sm501.c
++++ b/drivers/usb/host/ohci-sm501.c
+@@ -191,6 +191,7 @@ static int ohci_hcd_sm501_drv_remove(str
+ struct resource *mem;
+
+ usb_remove_hcd(hcd);
++ iounmap(hcd->regs);
+ release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ usb_put_hcd(hcd);
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
--- /dev/null
+From 302c570bf36e997d55ad0d60628a2feec76954a4 Mon Sep 17 00:00:00 2001
+From: Li Jun <jun.li@nxp.com>
+Date: Thu, 4 Jun 2020 19:21:18 +0800
+Subject: usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs
+
+From: Li Jun <jun.li@nxp.com>
+
+commit 302c570bf36e997d55ad0d60628a2feec76954a4 upstream.
+
+John reported screaming irq caused by rt1711h when system boot[1],
+this is because irq request is done before tcpci_register_port(),
+so the chip->tcpci has not been setup, irq handler is entered but
+can't do anything, this patch is to address this by moving the irq
+request after tcpci_register_port().
+
+[1] https://lore.kernel.org/linux-usb/20200530040157.31038-1-john.stultz@linaro.org
+
+Fixes: ce08eaeb6388 ("staging: typec: rt1711h typec chip driver")
+Cc: stable <stable@vger.kernel.org> # v4.18+
+Cc: John Stultz <john.stultz@linaro.org>
+Reported-and-tested-by: John Stultz <john.stultz@linaro.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Link: https://lore.kernel.org/r/20200604112118.38062-1-jun.li@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/tcpm/tcpci_rt1711h.c | 31 ++++++++++---------------------
+ 1 file changed, 10 insertions(+), 21 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c
++++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c
+@@ -179,26 +179,6 @@ out:
+ return tcpci_irq(chip->tcpci);
+ }
+
+-static int rt1711h_init_alert(struct rt1711h_chip *chip,
+- struct i2c_client *client)
+-{
+- int ret;
+-
+- /* Disable chip interrupts before requesting irq */
+- ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0);
+- if (ret < 0)
+- return ret;
+-
+- ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
+- rt1711h_irq,
+- IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+- dev_name(chip->dev), chip);
+- if (ret < 0)
+- return ret;
+- enable_irq_wake(client->irq);
+- return 0;
+-}
+-
+ static int rt1711h_sw_reset(struct rt1711h_chip *chip)
+ {
+ int ret;
+@@ -260,7 +240,8 @@ static int rt1711h_probe(struct i2c_clie
+ if (ret < 0)
+ return ret;
+
+- ret = rt1711h_init_alert(chip, client);
++ /* Disable chip interrupts before requesting irq */
++ ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0);
+ if (ret < 0)
+ return ret;
+
+@@ -271,6 +252,14 @@ static int rt1711h_probe(struct i2c_clie
+ if (IS_ERR_OR_NULL(chip->tcpci))
+ return PTR_ERR(chip->tcpci);
+
++ ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
++ rt1711h_irq,
++ IRQF_ONESHOT | IRQF_TRIGGER_LOW,
++ dev_name(chip->dev), chip);
++ if (ret < 0)
++ return ret;
++ enable_irq_wake(client->irq);
++
+ return 0;
+ }
+
--- /dev/null
+From b3d71abd135e6919ca0b6cab463738472653ddfb Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Wed, 24 Jun 2020 16:59:49 +0300
+Subject: xhci: Poll for U0 after disabling USB2 LPM
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit b3d71abd135e6919ca0b6cab463738472653ddfb upstream.
+
+USB2 devices with LPM enabled may interrupt the system suspend:
+[ 932.510475] usb 1-7: usb suspend, wakeup 0
+[ 932.510549] hub 1-0:1.0: hub_suspend
+[ 932.510581] usb usb1: bus suspend, wakeup 0
+[ 932.510590] xhci_hcd 0000:00:14.0: port 9 not suspended
+[ 932.510593] xhci_hcd 0000:00:14.0: port 8 not suspended
+..
+[ 932.520323] xhci_hcd 0000:00:14.0: Port change event, 1-7, id 7, portsc: 0x400e03
+..
+[ 932.591405] PM: pci_pm_suspend(): hcd_pci_suspend+0x0/0x30 returns -16
+[ 932.591414] PM: dpm_run_callback(): pci_pm_suspend+0x0/0x160 returns -16
+[ 932.591418] PM: Device 0000:00:14.0 failed to suspend async: error -16
+
+During system suspend, USB core will let HC suspends the device if it
+doesn't have remote wakeup enabled and doesn't have any children.
+However, from the log above we can see that the usb 1-7 doesn't get bus
+suspended due to not in U0. After a while the port finished U2 -> U0
+transition, interrupts the suspend process.
+
+The observation is that after disabling LPM, port doesn't transit to U0
+immediately and can linger in U2. xHCI spec 4.23.5.2 states that the
+maximum exit latency for USB2 LPM should be BESL + 10us. The BESL for
+the affected device is advertised as 400us, which is still not enough
+based on my testing result.
+
+So let's use the maximum permitted latency, 10000, to poll for U0
+status to solve the issue.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200624135949.22611-6-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4471,6 +4471,9 @@ static int xhci_set_usb2_hardware_lpm(st
+ mutex_lock(hcd->bandwidth_mutex);
+ xhci_change_max_exit_latency(xhci, udev, 0);
+ mutex_unlock(hcd->bandwidth_mutex);
++ readl_poll_timeout(ports[port_num]->addr, pm_val,
++ (pm_val & PORT_PLS_MASK) == XDEV_U0,
++ 100, 10000);
+ return 0;
+ }
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
