From: Greg Kroah-Hartman Date: Mon, 9 Aug 2021 08:55:26 +0000 (+0200) Subject: 5.13-stable patches X-Git-Tag: v4.4.280~54 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=16aa6869e47496526c0858d0319ce37dd72bad62;p=thirdparty%2Fkernel%2Fstable-queue.git 5.13-stable patches added patches: alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch alsa-usb-audio-avoid-unnecessary-or-invalid-connector-selection-at-resume.patch alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch usb-cdns3-fixed-incorrect-gadget-state.patch usb-cdnsp-fixed-issue-with-zlp.patch usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch usb-gadget-f_hid-fixed-null-pointer-dereference.patch usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch usb-gadget-remove-leaked-entry-from-udc-driver-list.patch usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch usb-otg-fsm-fix-hrtimer-list-corruption.patch usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch --- diff --git a/queue-5.13/alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch b/queue-5.13/alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch new file mode 100644 index 00000000000..998a77d775d --- /dev/null +++ b/queue-5.13/alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch @@ -0,0 +1,32 @@ +From 0d4867a185460397af56b9afe3e2243d3e610e37 Mon Sep 17 00:00:00 2001 +From: Alexander Monakov +Date: Wed, 21 Jul 2021 20:01:41 +0300 +Subject: ALSA: hda/realtek: add mic quirk for Acer SF314-42 + +From: Alexander Monakov + +commit 0d4867a185460397af56b9afe3e2243d3e610e37 upstream. + +The Acer Swift SF314-42 laptop is using Realtek ALC255 codec. Add a +quirk so microphone in a headset connected via the right-hand side jack +is usable. + +Signed-off-by: Alexander Monakov +Cc: +Link: https://lore.kernel.org/r/20210721170141.24807-1-amonakov@ispras.ru +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8217,6 +8217,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), diff --git a/queue-5.13/alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch b/queue-5.13/alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch new file mode 100644 index 00000000000..27770acac44 --- /dev/null +++ b/queue-5.13/alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch @@ -0,0 +1,32 @@ +From 35171fbfc0d94aa31b009bb475d156ad1941ab50 Mon Sep 17 00:00:00 2001 +From: Nikos Liolios +Date: Tue, 27 Jul 2021 06:05:10 +0300 +Subject: ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) + +From: Nikos Liolios + +commit 35171fbfc0d94aa31b009bb475d156ad1941ab50 upstream. + +The issue on Acer SWIFT SF314-56 is that headset microphone doesn't work. +The following quirk fixed headset microphone issue. The fixup was found by trial and error. +Note that the fixup of SF314-54/55 (ALC256_FIXUP_ACER_HEADSET_MIC) was not successful on my SF314-56. + +Signed-off-by: Nikos Liolios +Cc: +Link: https://lore.kernel.org/r/20210727030510.36292-1-liolios.nk@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8214,6 +8214,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x129c, "Acer SWIFT SF314-55", ALC256_FIXUP_ACER_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1300, "Acer SWIFT SF314-56", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), diff --git a/queue-5.13/alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch b/queue-5.13/alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch new file mode 100644 index 00000000000..4ba9cfff4d9 --- /dev/null +++ b/queue-5.13/alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch @@ -0,0 +1,33 @@ +From 852a8a97776a153be2e6c803218eced45f37a19c Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Fri, 30 Jul 2021 11:02:54 +0200 +Subject: ALSA: pcm - fix mmap capability check for the snd-dummy driver + +From: Jaroslav Kysela + +commit 852a8a97776a153be2e6c803218eced45f37a19c upstream. + +The snd-dummy driver (fake_buffer configuration) uses the ops->page +callback for the mmap operations. Allow mmap for this case, too. + +Cc: +Fixes: c4824ae7db41 ("ALSA: pcm: Fix mmap capability check") +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20210730090254.612478-1-perex@perex.cz +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/pcm_native.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -246,7 +246,7 @@ static bool hw_support_mmap(struct snd_p + if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_MMAP)) + return false; + +- if (substream->ops->mmap) ++ if (substream->ops->mmap || substream->ops->page) + return true; + + switch (substream->dma_buffer.dev.type) { diff --git a/queue-5.13/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch b/queue-5.13/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch new file mode 100644 index 00000000000..8b0ed83adc9 --- /dev/null +++ b/queue-5.13/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch @@ -0,0 +1,31 @@ +From 4b0556b96e1fe7723629bd40e3813a30cd632faf Mon Sep 17 00:00:00 2001 +From: Alexander Tsoy +Date: Tue, 27 Jul 2021 12:33:26 +0300 +Subject: ALSA: usb-audio: Add registration quirk for JBL Quantum 600 + +From: Alexander Tsoy + +commit 4b0556b96e1fe7723629bd40e3813a30cd632faf upstream. + +Apparently JBL Quantum 600 has multiple hardware revisions. Apply +registration quirk to another device id as well. + +Signed-off-by: Alexander Tsoy +Cc: +Link: https://lore.kernel.org/r/20210727093326.1153366-1-alexander@tsoy.me +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1899,6 +1899,7 @@ static const struct registration_quirk r + REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ + REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ + REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ ++ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ + REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ + { 0 } /* terminator */ + }; diff --git a/queue-5.13/alsa-usb-audio-avoid-unnecessary-or-invalid-connector-selection-at-resume.patch b/queue-5.13/alsa-usb-audio-avoid-unnecessary-or-invalid-connector-selection-at-resume.patch new file mode 100644 index 00000000000..90061a062d0 --- /dev/null +++ b/queue-5.13/alsa-usb-audio-avoid-unnecessary-or-invalid-connector-selection-at-resume.patch @@ -0,0 +1,94 @@ +From 8dde723fcde4479f256441da03793e37181d9f21 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 29 Jul 2021 20:51:26 +0200 +Subject: ALSA: usb-audio: Avoid unnecessary or invalid connector selection at resume + +From: Takashi Iwai + +commit 8dde723fcde4479f256441da03793e37181d9f21 upstream. + +The recent fix for the resume on Lenovo machines seems causing a +regression on others. It's because the change always triggers the +connector selection no matter which widget node type is. + +This patch addresses the regression by setting the resume callback +selectively only for the connector widget. + +Fixes: 44609fc01f28 ("ALSA: usb-audio: Check connector value on resume") +Cc: +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213897 +Link: https://lore.kernel.org/r/20210729185126.24432-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer.c | 35 ++++++++++++++++++++--------------- + 1 file changed, 20 insertions(+), 15 deletions(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1816,6 +1816,15 @@ static void get_connector_control_name(s + strlcat(name, " - Output Jack", name_size); + } + ++/* get connector value to "wake up" the USB audio */ ++static int connector_mixer_resume(struct usb_mixer_elem_list *list) ++{ ++ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list); ++ ++ get_connector_value(cval, NULL, NULL); ++ return 0; ++} ++ + /* Build a mixer control for a UAC connector control (jack-detect) */ + static void build_connector_control(struct usb_mixer_interface *mixer, + const struct usbmix_name_map *imap, +@@ -1833,6 +1842,10 @@ static void build_connector_control(stru + if (!cval) + return; + snd_usb_mixer_elem_init_std(&cval->head, mixer, term->id); ++ ++ /* set up a specific resume callback */ ++ cval->head.resume = connector_mixer_resume; ++ + /* + * UAC2: The first byte from reading the UAC2_TE_CONNECTOR control returns the + * number of channels connected. +@@ -3642,23 +3655,15 @@ static int restore_mixer_value(struct us + return 0; + } + +-static int default_mixer_resume(struct usb_mixer_elem_list *list) +-{ +- struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list); +- +- /* get connector value to "wake up" the USB audio */ +- if (cval->val_type == USB_MIXER_BOOLEAN && cval->channels == 1) +- get_connector_value(cval, NULL, NULL); +- +- return 0; +-} +- + static int default_mixer_reset_resume(struct usb_mixer_elem_list *list) + { +- int err = default_mixer_resume(list); ++ int err; + +- if (err < 0) +- return err; ++ if (list->resume) { ++ err = list->resume(list); ++ if (err < 0) ++ return err; ++ } + return restore_mixer_value(list); + } + +@@ -3697,7 +3702,7 @@ void snd_usb_mixer_elem_init_std(struct + list->id = unitid; + list->dump = snd_usb_mixer_dump_cval; + #ifdef CONFIG_PM +- list->resume = default_mixer_resume; ++ list->resume = NULL; + list->reset_resume = default_mixer_reset_resume; + #endif + } diff --git a/queue-5.13/alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch b/queue-5.13/alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch new file mode 100644 index 00000000000..d6bf2276d5e --- /dev/null +++ b/queue-5.13/alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch @@ -0,0 +1,37 @@ +From 66291b6adb66dd3bc96b0f594d88c2ff1300d95f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 26 Jul 2021 08:26:56 +0200 +Subject: ALSA: usb-audio: Fix superfluous autosuspend recovery + +From: Takashi Iwai + +commit 66291b6adb66dd3bc96b0f594d88c2ff1300d95f upstream. + +The change to restore the autosuspend from the disabled state uses a +wrong check: namely, it should have been the exact comparison of the +quirk_type instead of the bitwise and (&). Otherwise it matches +wrongly with the other quirk types. + +Although re-enabling the autosuspend for the already enabled device +shouldn't matter much, it's better to fix the unbalanced call. + +Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()") +Cc: +Link: https://lore.kernel.org/r/s5hr1flh9ov.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -907,7 +907,7 @@ static void usb_audio_disconnect(struct + } + } + +- if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND) ++ if (chip->quirk_type == QUIRK_SETUP_DISABLE_AUTOSUSPEND) + usb_enable_autosuspend(interface_to_usbdev(intf)); + + chip->num_interfaces--; diff --git a/queue-5.13/series b/queue-5.13/series index 9e0b8fba4ed..cd9f3e4a6fa 100644 --- a/queue-5.13/series +++ b/queue-5.13/series @@ -80,3 +80,20 @@ firmware_loader-use-etimedout-instead-of-eagain-in-fw_load_sysfs_fallback.patch firmware_loader-fix-use-after-free-in-firmware_fallback_sysfs.patch drm-amdgpu-fix-checking-pmops-when-pm_sleep-is-not-enabled.patch drm-amdgpu-display-fix-dmub-firmware-version-info.patch +alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch +alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch +alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch +alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch +alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch +alsa-usb-audio-avoid-unnecessary-or-invalid-connector-selection-at-resume.patch +usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch +usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch +usb-gadget-remove-leaked-entry-from-udc-driver-list.patch +usb-cdns3-fixed-incorrect-gadget-state.patch +usb-cdnsp-fixed-issue-with-zlp.patch +usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch +usb-gadget-f_hid-fixed-null-pointer-dereference.patch +usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch +usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch +usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch +usb-otg-fsm-fix-hrtimer-list-corruption.patch diff --git a/queue-5.13/usb-cdns3-fixed-incorrect-gadget-state.patch b/queue-5.13/usb-cdns3-fixed-incorrect-gadget-state.patch new file mode 100644 index 00000000000..a03bfe93424 --- /dev/null +++ b/queue-5.13/usb-cdns3-fixed-incorrect-gadget-state.patch @@ -0,0 +1,36 @@ +From aa35772f61752d4c636d46be51a4f7ca6c029ee6 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Wed, 23 Jun 2021 09:02:47 +0200 +Subject: usb: cdns3: Fixed incorrect gadget state + +From: Pawel Laszczak + +commit aa35772f61752d4c636d46be51a4f7ca6c029ee6 upstream. + +For delayed status phase, the usb_gadget->state was set +to USB_STATE_ADDRESS and it has never been updated to +USB_STATE_CONFIGURED. +Patch updates the gadget state to correct USB_STATE_CONFIGURED. +As a result of this bug the controller was not able to enter to +Test Mode while using MSC function. + +Cc: +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20210623070247.46151-1-pawell@gli-login.cadence.com +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-ep0.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/cdns3/cdns3-ep0.c ++++ b/drivers/usb/cdns3/cdns3-ep0.c +@@ -731,6 +731,7 @@ static int cdns3_gadget_ep0_queue(struct + request->actual = 0; + priv_dev->status_completion_no_call = true; + priv_dev->pending_status_request = request; ++ usb_gadget_set_state(&priv_dev->gadget, USB_STATE_CONFIGURED); + spin_unlock_irqrestore(&priv_dev->lock, flags); + + /* diff --git a/queue-5.13/usb-cdnsp-fixed-issue-with-zlp.patch b/queue-5.13/usb-cdnsp-fixed-issue-with-zlp.patch new file mode 100644 index 00000000000..e41d92a6f6f --- /dev/null +++ b/queue-5.13/usb-cdnsp-fixed-issue-with-zlp.patch @@ -0,0 +1,59 @@ +From e913aada06830338633fb8524733b0ad3d38a7c1 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Wed, 23 Jun 2021 09:27:28 +0200 +Subject: usb: cdnsp: Fixed issue with ZLP + +From: Pawel Laszczak + +commit e913aada06830338633fb8524733b0ad3d38a7c1 upstream. + +The condition "if (need_zero_pkt && zero_len_trb)" was always false +and it caused that TRB for ZLP was not prepared. + +Fix causes that after preparing last TRB in TD, the driver prepares +additional TD with ZLP when a ZLP is required. + +Cc: +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20210623072728.41275-1-pawell@gli-login.cadence.com +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdnsp-ring.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/usb/cdns3/cdnsp-ring.c ++++ b/drivers/usb/cdns3/cdnsp-ring.c +@@ -1932,15 +1932,13 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev + } + + if (enqd_len + trb_buff_len >= full_len) { +- if (need_zero_pkt && zero_len_trb) { +- zero_len_trb = true; +- } else { +- field &= ~TRB_CHAIN; +- field |= TRB_IOC; +- more_trbs_coming = false; +- need_zero_pkt = false; +- preq->td.last_trb = ring->enqueue; +- } ++ if (need_zero_pkt) ++ zero_len_trb = !zero_len_trb; ++ ++ field &= ~TRB_CHAIN; ++ field |= TRB_IOC; ++ more_trbs_coming = false; ++ preq->td.last_trb = ring->enqueue; + } + + /* Only set interrupt on short packet for OUT endpoints. */ +@@ -1955,7 +1953,7 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev + length_field = TRB_LEN(trb_buff_len) | TRB_TD_SIZE(remainder) | + TRB_INTR_TARGET(0); + +- cdnsp_queue_trb(pdev, ring, more_trbs_coming | need_zero_pkt, ++ cdnsp_queue_trb(pdev, ring, more_trbs_coming | zero_len_trb, + lower_32_bits(send_addr), + upper_32_bits(send_addr), + length_field, diff --git a/queue-5.13/usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch b/queue-5.13/usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch new file mode 100644 index 00000000000..ec873375d84 --- /dev/null +++ b/queue-5.13/usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch @@ -0,0 +1,66 @@ +From cb10f68ad8150f243964b19391711aaac5e8ff42 Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Tue, 3 Aug 2021 23:24:05 -0700 +Subject: usb: dwc3: gadget: Avoid runtime resume if disabling pullup + +From: Wesley Cheng + +commit cb10f68ad8150f243964b19391711aaac5e8ff42 upstream. + +If the device is already in the runtime suspended state, any call to +the pullup routine will issue a runtime resume on the DWC3 core +device. If the USB gadget is disabling the pullup, then avoid having +to issue a runtime resume, as DWC3 gadget has already been +halted/stopped. + +This fixes an issue where the following condition occurs: + +usb_gadget_remove_driver() +-->usb_gadget_disconnect() + -->dwc3_gadget_pullup(0) + -->pm_runtime_get_sync() -> ret = 0 + -->pm_runtime_put() [async] +-->usb_gadget_udc_stop() + -->dwc3_gadget_stop() + -->dwc->gadget_driver = NULL +... + +dwc3_suspend_common() +-->dwc3_gadget_suspend() + -->DWC3 halt/stop routine skipped, driver_data == NULL + +This leads to a situation where the DWC3 gadget is not properly +stopped, as the runtime resume would have re-enabled EP0 and event +interrupts, and since we avoided the DWC3 gadget suspend, these +resources were never disabled. + +Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") +Cc: stable +Acked-by: Felipe Balbi +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/1628058245-30692-1-git-send-email-wcheng@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2257,6 +2257,17 @@ static int dwc3_gadget_pullup(struct usb + } + + /* ++ * Avoid issuing a runtime resume if the device is already in the ++ * suspended state during gadget disconnect. DWC3 gadget was already ++ * halted/stopped during runtime suspend. ++ */ ++ if (!is_on) { ++ pm_runtime_barrier(dwc->dev); ++ if (pm_runtime_suspended(dwc->dev)) ++ return 0; ++ } ++ ++ /* + * Check the return value for successful resume, or error. For a + * successful resume, the DWC3 runtime PM resume routine will handle + * the run stop sequence, so avoid duplicate operations here. diff --git a/queue-5.13/usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch b/queue-5.13/usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch new file mode 100644 index 00000000000..f5a2a0c3d9a --- /dev/null +++ b/queue-5.13/usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch @@ -0,0 +1,116 @@ +From d25d85061bd856d6be221626605319154f9b5043 Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Thu, 29 Jul 2021 00:33:14 -0700 +Subject: usb: dwc3: gadget: Use list_replace_init() before traversing lists + +From: Wesley Cheng + +commit d25d85061bd856d6be221626605319154f9b5043 upstream. + +The list_for_each_entry_safe() macro saves the current item (n) and +the item after (n+1), so that n can be safely removed without +corrupting the list. However, when traversing the list and removing +items using gadget giveback, the DWC3 lock is briefly released, +allowing other routines to execute. There is a situation where, while +items are being removed from the cancelled_list using +dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable +routine is running in parallel (due to UDC unbind). As the cleanup +routine removes n, and the pullup disable removes n+1, once the +cleanup retakes the DWC3 lock, it references a request who was already +removed/handled. With list debug enabled, this leads to a panic. +Ensure all instances of the macro are replaced where gadget giveback +is used. + +Example call stack: + +Thread#1: +__dwc3_gadget_ep_set_halt() - CLEAR HALT + -> dwc3_gadget_ep_cleanup_cancelled_requests() + ->list_for_each_entry_safe() + ->dwc3_gadget_giveback(n) + ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list] + ->spin_unlock + ->Thread#2 executes + ... + ->dwc3_gadget_giveback(n+1) + ->Already removed! + +Thread#2: +dwc3_gadget_pullup() + ->waiting for dwc3 spin_lock + ... + ->Thread#1 released lock + ->dwc3_stop_active_transfers() + ->dwc3_remove_requests() + ->fetches n+1 item from cancelled_list (n removed by Thread#1) + ->dwc3_gadget_giveback() + ->dwc3_gadget_del_and_unmap_request()- n+1 +deleted[cancelled_list] + ->spin_unlock + +Fix this condition by utilizing list_replace_init(), and traversing +through a local copy of the current elements in the endpoint lists. +This will also set the parent list as empty, so if another thread is +also looping through the list, it will be empty on the next iteration. + +Fixes: d4f1afe5e896 ("usb: dwc3: gadget: move requests to cancelled_list") +Cc: stable +Acked-by: Felipe Balbi +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/1627543994-20327-1-git-send-email-wcheng@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1741,9 +1741,13 @@ static void dwc3_gadget_ep_cleanup_cance + { + struct dwc3_request *req; + struct dwc3_request *tmp; ++ struct list_head local; + struct dwc3 *dwc = dep->dwc; + +- list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) { ++restart: ++ list_replace_init(&dep->cancelled_list, &local); ++ ++ list_for_each_entry_safe(req, tmp, &local, list) { + dwc3_gadget_ep_skip_trbs(dep, req); + switch (req->status) { + case DWC3_REQUEST_STATUS_DISCONNECTED: +@@ -1761,6 +1765,9 @@ static void dwc3_gadget_ep_cleanup_cance + break; + } + } ++ ++ if (!list_empty(&dep->cancelled_list)) ++ goto restart; + } + + static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, +@@ -2945,8 +2952,12 @@ static void dwc3_gadget_ep_cleanup_compl + { + struct dwc3_request *req; + struct dwc3_request *tmp; ++ struct list_head local; + +- list_for_each_entry_safe(req, tmp, &dep->started_list, list) { ++restart: ++ list_replace_init(&dep->started_list, &local); ++ ++ list_for_each_entry_safe(req, tmp, &local, list) { + int ret; + + ret = dwc3_gadget_ep_cleanup_completed_request(dep, event, +@@ -2954,6 +2965,9 @@ static void dwc3_gadget_ep_cleanup_compl + if (ret) + break; + } ++ ++ if (!list_empty(&dep->started_list)) ++ goto restart; + } + + static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep) diff --git a/queue-5.13/usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch b/queue-5.13/usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch new file mode 100644 index 00000000000..bb0ac6a8260 --- /dev/null +++ b/queue-5.13/usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch @@ -0,0 +1,74 @@ +From afcff6dc690e24d636a41fd4bee6057e7c70eebd Mon Sep 17 00:00:00 2001 +From: Maxim Devaev +Date: Wed, 21 Jul 2021 21:03:51 +0300 +Subject: usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers + +From: Maxim Devaev + +commit afcff6dc690e24d636a41fd4bee6057e7c70eebd upstream. + +The USB HID standard declares mandatory support for GET_IDLE and SET_IDLE +requests for Boot Keyboard. Most hosts can handle their absence, but others +like some old/strange UEFIs and BIOSes consider this a critical error +and refuse to work with f_hid. + +This primitive implementation of saving and returning idle is sufficient +to meet the requirements of the standard and these devices. + +Acked-by: Felipe Balbi +Cc: stable +Signed-off-by: Maxim Devaev +Link: https://lore.kernel.org/r/20210721180351.129450-1-mdevaev@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_hid.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -41,6 +41,7 @@ struct f_hidg { + unsigned char bInterfaceSubClass; + unsigned char bInterfaceProtocol; + unsigned char protocol; ++ unsigned char idle; + unsigned short report_desc_length; + char *report_desc; + unsigned short report_length; +@@ -523,6 +524,14 @@ static int hidg_setup(struct usb_functio + goto respond; + break; + ++ case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 ++ | HID_REQ_GET_IDLE): ++ VDBG(cdev, "get_idle\n"); ++ length = min_t(unsigned int, length, 1); ++ ((u8 *) req->buf)[0] = hidg->idle; ++ goto respond; ++ break; ++ + case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 + | HID_REQ_SET_REPORT): + VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength); +@@ -546,6 +555,14 @@ static int hidg_setup(struct usb_functio + goto stall; + break; + ++ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 ++ | HID_REQ_SET_IDLE): ++ VDBG(cdev, "set_idle\n"); ++ length = 0; ++ hidg->idle = value; ++ goto respond; ++ break; ++ + case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8 + | USB_REQ_GET_DESCRIPTOR): + switch (value >> 8) { +@@ -773,6 +790,7 @@ static int hidg_bind(struct usb_configur + hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass; + hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol; + hidg->protocol = HID_REPORT_PROTOCOL; ++ hidg->idle = 1; + hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); + hidg_ss_in_comp_desc.wBytesPerInterval = + cpu_to_le16(hidg->report_length); diff --git a/queue-5.13/usb-gadget-f_hid-fixed-null-pointer-dereference.patch b/queue-5.13/usb-gadget-f_hid-fixed-null-pointer-dereference.patch new file mode 100644 index 00000000000..86aa202c239 --- /dev/null +++ b/queue-5.13/usb-gadget-f_hid-fixed-null-pointer-dereference.patch @@ -0,0 +1,79 @@ +From 2867652e4766360adf14dfda3832455e04964f2a Mon Sep 17 00:00:00 2001 +From: Phil Elwell +Date: Fri, 23 Jul 2021 18:59:30 +0300 +Subject: usb: gadget: f_hid: fixed NULL pointer dereference + +From: Phil Elwell + +commit 2867652e4766360adf14dfda3832455e04964f2a upstream. + +Disconnecting and reconnecting the USB cable can lead to crashes +and a variety of kernel log spam. + +The problem was found and reproduced on the Raspberry Pi [1] +and the original fix was created in Raspberry's own fork [2]. + +Link: https://github.com/raspberrypi/linux/issues/3870 [1] +Link: https://github.com/raspberrypi/linux/commit/a6e47d5f4efbd2ea6a0b6565cd2f9b7bb217ded5 [2] +Signed-off-by: Maxim Devaev +Signed-off-by: Phil Elwell +Cc: stable +Link: https://lore.kernel.org/r/20210723155928.210019-1-mdevaev@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_hid.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -339,6 +339,11 @@ static ssize_t f_hidg_write(struct file + + spin_lock_irqsave(&hidg->write_spinlock, flags); + ++ if (!hidg->req) { ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); ++ return -ESHUTDOWN; ++ } ++ + #define WRITE_COND (!hidg->write_pending) + try_again: + /* write queue */ +@@ -359,8 +364,14 @@ try_again: + count = min_t(unsigned, count, hidg->report_length); + + spin_unlock_irqrestore(&hidg->write_spinlock, flags); +- status = copy_from_user(req->buf, buffer, count); + ++ if (!req) { ++ ERROR(hidg->func.config->cdev, "hidg->req is NULL\n"); ++ status = -ESHUTDOWN; ++ goto release_write_pending; ++ } ++ ++ status = copy_from_user(req->buf, buffer, count); + if (status != 0) { + ERROR(hidg->func.config->cdev, + "copy_from_user error\n"); +@@ -388,14 +399,17 @@ try_again: + + spin_unlock_irqrestore(&hidg->write_spinlock, flags); + ++ if (!hidg->in_ep->enabled) { ++ ERROR(hidg->func.config->cdev, "in_ep is disabled\n"); ++ status = -ESHUTDOWN; ++ goto release_write_pending; ++ } ++ + status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC); +- if (status < 0) { +- ERROR(hidg->func.config->cdev, +- "usb_ep_queue error on int endpoint %zd\n", status); ++ if (status < 0) + goto release_write_pending; +- } else { ++ else + status = count; +- } + + return status; + release_write_pending: diff --git a/queue-5.13/usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch b/queue-5.13/usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch new file mode 100644 index 00000000000..25644e56999 --- /dev/null +++ b/queue-5.13/usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch @@ -0,0 +1,32 @@ +From fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 Mon Sep 17 00:00:00 2001 +From: Maxim Devaev +Date: Tue, 27 Jul 2021 21:58:00 +0300 +Subject: usb: gadget: f_hid: idle uses the highest byte for duration + +From: Maxim Devaev + +commit fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 upstream. + +SET_IDLE value must be shifted 8 bits to the right to get duration. +This confirmed by USBCV test. + +Fixes: afcff6dc690e ("usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers") +Cc: stable +Signed-off-by: Maxim Devaev +Link: https://lore.kernel.org/r/20210727185800.43796-1-mdevaev@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_hid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -573,7 +573,7 @@ static int hidg_setup(struct usb_functio + | HID_REQ_SET_IDLE): + VDBG(cdev, "set_idle\n"); + length = 0; +- hidg->idle = value; ++ hidg->idle = value >> 8; + goto respond; + break; + diff --git a/queue-5.13/usb-gadget-remove-leaked-entry-from-udc-driver-list.patch b/queue-5.13/usb-gadget-remove-leaked-entry-from-udc-driver-list.patch new file mode 100644 index 00000000000..cf86efa3d5d --- /dev/null +++ b/queue-5.13/usb-gadget-remove-leaked-entry-from-udc-driver-list.patch @@ -0,0 +1,61 @@ +From fa4a8dcfd51b911f101ebc461dfe22230b74dd64 Mon Sep 17 00:00:00 2001 +From: Zhang Qilong +Date: Tue, 27 Jul 2021 15:31:42 +0800 +Subject: usb: gadget: remove leaked entry from udc driver list + +From: Zhang Qilong + +commit fa4a8dcfd51b911f101ebc461dfe22230b74dd64 upstream. + +The usb_add_gadget_udc will add a new gadget to the udc class +driver list. Not calling usb_del_gadget_udc in error branch +will result in residual gadget entry in the udc driver list. +We fix it by calling usb_del_gadget_udc to clean it when error +return. + +Fixes: 48ba02b2e2b1 ("usb: gadget: add udc driver for max3420") +Acked-by: Felipe Balbi +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20210727073142.84666-1-zhangqilong3@huawei.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/max3420_udc.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/udc/max3420_udc.c ++++ b/drivers/usb/gadget/udc/max3420_udc.c +@@ -1260,12 +1260,14 @@ static int max3420_probe(struct spi_devi + err = devm_request_irq(&spi->dev, irq, max3420_irq_handler, 0, + "max3420", udc); + if (err < 0) +- return err; ++ goto del_gadget; + + udc->thread_task = kthread_create(max3420_thread, udc, + "max3420-thread"); +- if (IS_ERR(udc->thread_task)) +- return PTR_ERR(udc->thread_task); ++ if (IS_ERR(udc->thread_task)) { ++ err = PTR_ERR(udc->thread_task); ++ goto del_gadget; ++ } + + irq = of_irq_get_byname(spi->dev.of_node, "vbus"); + if (irq <= 0) { /* no vbus irq implies self-powered design */ +@@ -1285,10 +1287,14 @@ static int max3420_probe(struct spi_devi + err = devm_request_irq(&spi->dev, irq, + max3420_vbus_handler, 0, "vbus", udc); + if (err < 0) +- return err; ++ goto del_gadget; + } + + return 0; ++ ++del_gadget: ++ usb_del_gadget_udc(&udc->gadget); ++ return err; + } + + static int max3420_remove(struct spi_device *spi) diff --git a/queue-5.13/usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch b/queue-5.13/usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch new file mode 100644 index 00000000000..793a3ea7190 --- /dev/null +++ b/queue-5.13/usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch @@ -0,0 +1,65 @@ +From 00de6a572f30ee93cad7e0704ec4232e5e72bda8 Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Wed, 21 Jul 2021 16:29:05 +0300 +Subject: usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses + +From: Claudiu Beznea + +commit 00de6a572f30ee93cad7e0704ec4232e5e72bda8 upstream. + +On SAMA7G5 suspending ports will cut the access to OHCI registers and +any subsequent access to them will lead to CPU being blocked trying to +access that memory. Same thing happens on resume: if OHCI memory is +accessed before resuming ports the CPU will block on that access. The +OCHI memory is accessed on suspend/resume though +ohci_suspend()/ohci_resume(). + +Acked-by: Alan Stern +Signed-off-by: Claudiu Beznea +Cc: stable +Link: https://lore.kernel.org/r/20210721132905.1970713-1-claudiu.beznea@microchip.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ohci-at91.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ohci-at91.c ++++ b/drivers/usb/host/ohci-at91.c +@@ -611,8 +611,6 @@ ohci_hcd_at91_drv_suspend(struct device + if (ohci_at91->wakeup) + enable_irq_wake(hcd->irq); + +- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1); +- + ret = ohci_suspend(hcd, ohci_at91->wakeup); + if (ret) { + if (ohci_at91->wakeup) +@@ -632,7 +630,10 @@ ohci_hcd_at91_drv_suspend(struct device + /* flush the writes */ + (void) ohci_readl (ohci, &ohci->regs->control); + msleep(1); ++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1); + at91_stop_clock(ohci_at91); ++ } else { ++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1); + } + + return ret; +@@ -644,6 +645,8 @@ ohci_hcd_at91_drv_resume(struct device * + struct usb_hcd *hcd = dev_get_drvdata(dev); + struct ohci_at91_priv *ohci_at91 = hcd_to_ohci_at91_priv(hcd); + ++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0); ++ + if (ohci_at91->wakeup) + disable_irq_wake(hcd->irq); + else +@@ -651,8 +654,6 @@ ohci_hcd_at91_drv_resume(struct device * + + ohci_resume(hcd, false); + +- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0); +- + return 0; + } + diff --git a/queue-5.13/usb-otg-fsm-fix-hrtimer-list-corruption.patch b/queue-5.13/usb-otg-fsm-fix-hrtimer-list-corruption.patch new file mode 100644 index 00000000000..41ddaf4009a --- /dev/null +++ b/queue-5.13/usb-otg-fsm-fix-hrtimer-list-corruption.patch @@ -0,0 +1,64 @@ +From bf88fef0b6f1488abeca594d377991171c00e52a Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sat, 17 Jul 2021 21:21:27 +0300 +Subject: usb: otg-fsm: Fix hrtimer list corruption + +From: Dmitry Osipenko + +commit bf88fef0b6f1488abeca594d377991171c00e52a upstream. + +The HNP work can be re-scheduled while it's still in-fly. This results in +re-initialization of the busy work, resetting the hrtimer's list node of +the work and crashing kernel with null dereference within kernel/timer +once work's timer is expired. It's very easy to trigger this problem by +re-plugging USB cable quickly. Initialize HNP work only once to fix this +trouble. + + Unable to handle kernel NULL pointer dereference at virtual address 00000126) + ... + PC is at __run_timers.part.0+0x150/0x228 + LR is at __next_timer_interrupt+0x51/0x9c + ... + (__run_timers.part.0) from [] (run_timer_softirq+0x2f/0x50) + (run_timer_softirq) from [] (__do_softirq+0xd5/0x2f0) + (__do_softirq) from [] (irq_exit+0xab/0xb8) + (irq_exit) from [] (handle_domain_irq+0x45/0x60) + (handle_domain_irq) from [] (gic_handle_irq+0x6b/0x7c) + (gic_handle_irq) from [] (__irq_svc+0x65/0xac) + +Cc: stable@vger.kernel.org +Acked-by: Peter Chen +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/usb-otg-fsm.c | 6 +++++- + include/linux/usb/otg-fsm.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/common/usb-otg-fsm.c ++++ b/drivers/usb/common/usb-otg-fsm.c +@@ -193,7 +193,11 @@ static void otg_start_hnp_polling(struct + if (!fsm->host_req_flag) + return; + +- INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ if (!fsm->hnp_work_inited) { ++ INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ fsm->hnp_work_inited = true; ++ } ++ + schedule_delayed_work(&fsm->hnp_polling_work, + msecs_to_jiffies(T_HOST_REQ_POLL)); + } +--- a/include/linux/usb/otg-fsm.h ++++ b/include/linux/usb/otg-fsm.h +@@ -196,6 +196,7 @@ struct otg_fsm { + struct mutex lock; + u8 *host_req_flag; + struct delayed_work hnp_polling_work; ++ bool hnp_work_inited; + bool state_changed; + }; + diff --git a/queue-5.13/usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch b/queue-5.13/usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch new file mode 100644 index 00000000000..80998e052b8 --- /dev/null +++ b/queue-5.13/usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch @@ -0,0 +1,45 @@ +From 43ad944cd73f2360ec8ff31d29ea44830b3119af Mon Sep 17 00:00:00 2001 +From: Kyle Tso +Date: Tue, 3 Aug 2021 17:13:14 +0800 +Subject: usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events + +From: Kyle Tso + +commit 43ad944cd73f2360ec8ff31d29ea44830b3119af upstream. + +When receiving FRS and Sourcing_Vbus events from low-level drivers, keep +other events which come a bit earlier so that they will not be ignored +in the event handler. + +Fixes: 8dc4bd073663 ("usb: typec: tcpm: Add support for Sink Fast Role SWAP(FRS)") +Cc: stable +Cc: Badhri Jagan Sridharan +Reviewed-by: Guenter Roeck +Reviewed-by: Badhri Jagan Sridharan +Signed-off-by: Kyle Tso +Link: https://lore.kernel.org/r/20210803091314.3051302-1-kyletso@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -5355,7 +5355,7 @@ EXPORT_SYMBOL_GPL(tcpm_pd_hard_reset); + void tcpm_sink_frs(struct tcpm_port *port) + { + spin_lock(&port->pd_event_lock); +- port->pd_events = TCPM_FRS_EVENT; ++ port->pd_events |= TCPM_FRS_EVENT; + spin_unlock(&port->pd_event_lock); + kthread_queue_work(port->wq, &port->event_work); + } +@@ -5364,7 +5364,7 @@ EXPORT_SYMBOL_GPL(tcpm_sink_frs); + void tcpm_sourcing_vbus(struct tcpm_port *port) + { + spin_lock(&port->pd_event_lock); +- port->pd_events = TCPM_SOURCING_VBUS; ++ port->pd_events |= TCPM_SOURCING_VBUS; + spin_unlock(&port->pd_event_lock); + kthread_queue_work(port->wq, &port->event_work); + }