From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 05:44:11 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v4.19.263~83 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2409b05cb85b16f5e8e8ca06c2025c241c595b42;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: alsa-au88x0-use-explicitly-signed-char.patch alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch alsa-rme9652-use-explicitly-signed-char.patch alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch alsa-use-del_timer_sync-before-freeing-timer.patch can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch can-kvaser_usb-fix-possible-completions-during-init_completion.patch mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch usb-bdc-change-state-when-port-disconnected.patch usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch usb-gadget-uvc-fix-sg-handling-during-video-encode.patch usb-gadget-uvc-fix-sg-handling-in-error-case.patch usb-typec-ucsi-acpi-implement-resume-callback.patch usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch --- diff --git a/queue-5.15/alsa-au88x0-use-explicitly-signed-char.patch b/queue-5.15/alsa-au88x0-use-explicitly-signed-char.patch new file mode 100644 index 00000000000..b76609d70e1 --- /dev/null +++ b/queue-5.15/alsa-au88x0-use-explicitly-signed-char.patch @@ -0,0 +1,64 @@ +From ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 24 Oct 2022 18:29:29 +0200 +Subject: ALSA: au88x0: use explicitly signed char + +From: Jason A. Donenfeld + +commit ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 upstream. + +With char becoming unsigned by default, and with `char` alone being +ambiguous and based on architecture, signed chars need to be marked +explicitly as such. This fixes warnings like: + +sound/pci/au88x0/au88x0_core.c:2029 vortex_adb_checkinout() warn: signedness bug returning '(-22)' +sound/pci/au88x0/au88x0_core.c:2046 vortex_adb_checkinout() warn: signedness bug returning '(-12)' +sound/pci/au88x0/au88x0_core.c:2125 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, (0), en, 0)' is unsigned +sound/pci/au88x0/au88x0_core.c:2170 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, stream->resources, en, 4)' is unsigned + +As well, since one function returns errnos, return an `int` rather than +a `signed char`. + +Signed-off-by: Jason A. Donenfeld +Cc: +Link: https://lore.kernel.org/r/20221024162929.536004-1-Jason@zx2c4.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/au88x0/au88x0.h | 6 +++--- + sound/pci/au88x0/au88x0_core.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/pci/au88x0/au88x0.h ++++ b/sound/pci/au88x0/au88x0.h +@@ -141,7 +141,7 @@ struct snd_vortex { + #ifndef CHIP_AU8810 + stream_t dma_wt[NR_WT]; + wt_voice_t wt_voice[NR_WT]; /* WT register cache. */ +- char mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ ++ s8 mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ + #endif + + /* Global resources */ +@@ -235,8 +235,8 @@ static int vortex_alsafmt_aspfmt(snd_pcm + static void vortex_connect_default(vortex_t * vortex, int en); + static int vortex_adb_allocroute(vortex_t * vortex, int dma, int nr_ch, + int dir, int type, int subdev); +-static char vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, +- int restype); ++static int vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, ++ int restype); + #ifndef CHIP_AU8810 + static int vortex_wt_allocroute(vortex_t * vortex, int dma, int nr_ch); + static void vortex_wt_connect(vortex_t * vortex, int en); +--- a/sound/pci/au88x0/au88x0_core.c ++++ b/sound/pci/au88x0/au88x0_core.c +@@ -1998,7 +1998,7 @@ static const int resnum[VORTEX_RESOURCE_ + out: Mean checkout if != 0. Else mean Checkin resource. + restype: Indicates type of resource to be checked in or out. + */ +-static char ++static int + vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, int restype) + { + int i, qty = resnum[restype], resinuse = 0; diff --git a/queue-5.15/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch b/queue-5.15/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch new file mode 100644 index 00000000000..493747d1942 --- /dev/null +++ b/queue-5.15/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch @@ -0,0 +1,31 @@ +From 491a4ccd8a0258392900c80c6b2b622c7115fc23 Mon Sep 17 00:00:00 2001 +From: Stefan Binding +Date: Tue, 18 Oct 2022 13:15:06 +0100 +Subject: ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 + +From: Stefan Binding + +commit 491a4ccd8a0258392900c80c6b2b622c7115fc23 upstream. + +This Asus Zenbook laptop use Realtek HDA codec combined with +2xCS35L41 Amplifiers using SPI with External Boost. + +Signed-off-by: Stefan Binding +Cc: +Link: https://lore.kernel.org/r/20221018121506.2561397-1-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9041,6 +9041,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), ++ SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS), diff --git a/queue-5.15/alsa-rme9652-use-explicitly-signed-char.patch b/queue-5.15/alsa-rme9652-use-explicitly-signed-char.patch new file mode 100644 index 00000000000..93daf1811fd --- /dev/null +++ b/queue-5.15/alsa-rme9652-use-explicitly-signed-char.patch @@ -0,0 +1,244 @@ +From 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Tue, 25 Oct 2022 02:03:13 +0200 +Subject: ALSA: rme9652: use explicitly signed char + +From: Jason A. Donenfeld + +commit 50895a55bcfde8ac6f22a37c6bc8cff506b3c7c6 upstream. + +With char becoming unsigned by default, and with `char` alone being +ambiguous and based on architecture, signed chars need to be marked +explicitly as such. This fixes warnings like: + +sound/pci/rme9652/hdsp.c:3953 hdsp_channel_buffer_location() warn: 'hdsp->channel_map[channel]' is unsigned +sound/pci/rme9652/hdsp.c:4153 snd_hdsp_channel_info() warn: impossible condition '(hdsp->channel_map[channel] < 0) => (0-255 < 0)' +sound/pci/rme9652/rme9652.c:1833 rme9652_channel_buffer_location() warn: 'rme9652->channel_map[channel]' is unsigned + +Signed-off-by: Jason A. Donenfeld +Cc: +Link: https://lore.kernel.org/r/20221025000313.546261-1-Jason@zx2c4.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/rme9652/hdsp.c | 26 +++++++++++++------------- + sound/pci/rme9652/rme9652.c | 22 +++++++++++----------- + 2 files changed, 24 insertions(+), 24 deletions(-) + +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -433,7 +433,7 @@ struct hdsp_midi { + struct snd_rawmidi *rmidi; + struct snd_rawmidi_substream *input; + struct snd_rawmidi_substream *output; +- char istimer; /* timer in use */ ++ signed char istimer; /* timer in use */ + struct timer_list timer; + spinlock_t lock; + int pending; +@@ -480,7 +480,7 @@ struct hdsp { + pid_t playback_pid; + int running; + int system_sample_rate; +- const char *channel_map; ++ const signed char *channel_map; + int dev; + int irq; + unsigned long port; +@@ -502,7 +502,7 @@ struct hdsp { + where the data for that channel can be read/written from/to. + */ + +-static const char channel_map_df_ss[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_df_ss[HDSP_MAX_CHANNELS] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, + 18, 19, 20, 21, 22, 23, 24, 25 + }; +@@ -517,7 +517,7 @@ static const char channel_map_mf_ss[HDSP + -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_ds[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_ds[HDSP_MAX_CHANNELS] = { + /* ADAT channels are remapped */ + 1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, + /* channels 12 and 13 are S/PDIF */ +@@ -526,7 +526,7 @@ static const char channel_map_ds[HDSP_MA + -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_H9632_ss[HDSP_MAX_CHANNELS] = { + /* ADAT channels */ + 0, 1, 2, 3, 4, 5, 6, 7, + /* SPDIF */ +@@ -540,7 +540,7 @@ static const char channel_map_H9632_ss[H + -1, -1 + }; + +-static const char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_H9632_ds[HDSP_MAX_CHANNELS] = { + /* ADAT */ + 1, 3, 5, 7, + /* SPDIF */ +@@ -554,7 +554,7 @@ static const char channel_map_H9632_ds[H + -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = { ++static const signed char channel_map_H9632_qs[HDSP_MAX_CHANNELS] = { + /* ADAT is disabled in this mode */ + /* SPDIF */ + 8, 9, +@@ -3939,7 +3939,7 @@ static snd_pcm_uframes_t snd_hdsp_hw_poi + return hdsp_hw_pointer(hdsp); + } + +-static char *hdsp_channel_buffer_location(struct hdsp *hdsp, ++static signed char *hdsp_channel_buffer_location(struct hdsp *hdsp, + int stream, + int channel) + +@@ -3964,7 +3964,7 @@ static int snd_hdsp_playback_copy(struct + void __user *src, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -3982,7 +3982,7 @@ static int snd_hdsp_playback_copy_kernel + void *src, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel); + if (snd_BUG_ON(!channel_buf)) +@@ -3996,7 +3996,7 @@ static int snd_hdsp_capture_copy(struct + void __user *dst, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > HDSP_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -4014,7 +4014,7 @@ static int snd_hdsp_capture_copy_kernel( + void *dst, unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = hdsp_channel_buffer_location(hdsp, substream->pstr->stream, channel); + if (snd_BUG_ON(!channel_buf)) +@@ -4028,7 +4028,7 @@ static int snd_hdsp_hw_silence(struct sn + unsigned long count) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = hdsp_channel_buffer_location (hdsp, substream->pstr->stream, channel); + if (snd_BUG_ON(!channel_buf)) +--- a/sound/pci/rme9652/rme9652.c ++++ b/sound/pci/rme9652/rme9652.c +@@ -230,7 +230,7 @@ struct snd_rme9652 { + int last_spdif_sample_rate; /* so that we can catch externally ... */ + int last_adat_sample_rate; /* ... induced rate changes */ + +- const char *channel_map; ++ const signed char *channel_map; + + struct snd_card *card; + struct snd_pcm *pcm; +@@ -247,12 +247,12 @@ struct snd_rme9652 { + where the data for that channel can be read/written from/to. + */ + +-static const char channel_map_9652_ss[26] = { ++static const signed char channel_map_9652_ss[26] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, + 18, 19, 20, 21, 22, 23, 24, 25 + }; + +-static const char channel_map_9636_ss[26] = { ++static const signed char channel_map_9636_ss[26] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, + /* channels 16 and 17 are S/PDIF */ + 24, 25, +@@ -260,7 +260,7 @@ static const char channel_map_9636_ss[26 + -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_9652_ds[26] = { ++static const signed char channel_map_9652_ds[26] = { + /* ADAT channels are remapped */ + 1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, + /* channels 12 and 13 are S/PDIF */ +@@ -269,7 +269,7 @@ static const char channel_map_9652_ds[26 + -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 + }; + +-static const char channel_map_9636_ds[26] = { ++static const signed char channel_map_9636_ds[26] = { + /* ADAT channels are remapped */ + 1, 3, 5, 7, 9, 11, 13, 15, + /* channels 8 and 9 are S/PDIF */ +@@ -1819,7 +1819,7 @@ static snd_pcm_uframes_t snd_rme9652_hw_ + return rme9652_hw_pointer(rme9652); + } + +-static char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652, ++static signed char *rme9652_channel_buffer_location(struct snd_rme9652 *rme9652, + int stream, + int channel) + +@@ -1847,7 +1847,7 @@ static int snd_rme9652_playback_copy(str + void __user *src, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -1867,7 +1867,7 @@ static int snd_rme9652_playback_copy_ker + void *src, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = rme9652_channel_buffer_location(rme9652, + substream->pstr->stream, +@@ -1883,7 +1883,7 @@ static int snd_rme9652_capture_copy(stru + void __user *dst, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + if (snd_BUG_ON(pos + count > RME9652_CHANNEL_BUFFER_BYTES)) + return -EINVAL; +@@ -1903,7 +1903,7 @@ static int snd_rme9652_capture_copy_kern + void *dst, unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = rme9652_channel_buffer_location(rme9652, + substream->pstr->stream, +@@ -1919,7 +1919,7 @@ static int snd_rme9652_hw_silence(struct + unsigned long count) + { + struct snd_rme9652 *rme9652 = snd_pcm_substream_chip(substream); +- char *channel_buf; ++ signed char *channel_buf; + + channel_buf = rme9652_channel_buffer_location (rme9652, + substream->pstr->stream, diff --git a/queue-5.15/alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch b/queue-5.15/alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch new file mode 100644 index 00000000000..f3ebdfd3c72 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch @@ -0,0 +1,33 @@ +From 794814529384721ce8f4d34228dc599cc010353d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 21 Oct 2022 14:27:22 +0200 +Subject: ALSA: usb-audio: Add quirks for M-Audio Fast Track C400/600 + +From: Takashi Iwai + +commit 794814529384721ce8f4d34228dc599cc010353d upstream. + +M-Audio Fast Track C400 and C600 devices (0763:2030 and 0763:2031, +respectively) seem requiring the explicit setup for the implicit +feedback mode. This patch adds the quirk entries for those. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214817 +Cc: +Link: https://lore.kernel.org/r/20221021122722.24784-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/implicit.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -47,6 +47,8 @@ struct snd_usb_implicit_fb_match { + static const struct snd_usb_implicit_fb_match playback_implicit_fb_quirks[] = { + /* Fixed EP */ + /* FIXME: check the availability of generic matching */ ++ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2030, 0x81, 3), /* M-Audio Fast Track C400 */ ++ IMPLICIT_FB_FIXED_DEV(0x0763, 0x2031, 0x81, 3), /* M-Audio Fast Track C600 */ + IMPLICIT_FB_FIXED_DEV(0x0763, 0x2080, 0x81, 2), /* M-Audio FastTrack Ultra */ + IMPLICIT_FB_FIXED_DEV(0x0763, 0x2081, 0x81, 2), /* M-Audio FastTrack Ultra */ + IMPLICIT_FB_FIXED_DEV(0x2466, 0x8010, 0x81, 2), /* Fractal Audio Axe-Fx III */ diff --git a/queue-5.15/alsa-use-del_timer_sync-before-freeing-timer.patch b/queue-5.15/alsa-use-del_timer_sync-before-freeing-timer.patch new file mode 100644 index 00000000000..e483f629fa6 --- /dev/null +++ b/queue-5.15/alsa-use-del_timer_sync-before-freeing-timer.patch @@ -0,0 +1,64 @@ +From f0a868788fcbf63cdab51f5adcf73b271ede8164 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Wed, 26 Oct 2022 23:12:36 -0400 +Subject: ALSA: Use del_timer_sync() before freeing timer + +From: Steven Rostedt (Google) + +commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream. + +The current code for freeing the emux timer is extremely dangerous: + + CPU0 CPU1 + ---- ---- +snd_emux_timer_callback() + snd_emux_free() + spin_lock(&emu->voice_lock) + del_timer(&emu->tlist); <-- returns immediately + spin_unlock(&emu->voice_lock); + [..] + kfree(emu); + + spin_lock(&emu->voice_lock); + + [BOOM!] + +Instead just use del_timer_sync() which will wait for the timer to finish +before continuing. No need to check if the timer is active or not when +doing so. + +This doesn't fix the race of a possible re-arming of the timer, but at +least it won't use the data that has just been freed. + +[ Fixed unused variable warning by tiwai ] + +Cc: stable@vger.kernel.org +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Steven Rostedt (Google) +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20221026231236.6834b551@gandalf.local.home +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/synth/emux/emux.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/sound/synth/emux/emux.c ++++ b/sound/synth/emux/emux.c +@@ -126,15 +126,10 @@ EXPORT_SYMBOL(snd_emux_register); + */ + int snd_emux_free(struct snd_emux *emu) + { +- unsigned long flags; +- + if (! emu) + return -EINVAL; + +- spin_lock_irqsave(&emu->voice_lock, flags); +- if (emu->timer_active) +- del_timer(&emu->tlist); +- spin_unlock_irqrestore(&emu->voice_lock, flags); ++ del_timer_sync(&emu->tlist); + + snd_emux_proc_free(emu); + snd_emux_delete_virmidi(emu); diff --git a/queue-5.15/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch b/queue-5.15/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch new file mode 100644 index 00000000000..c230cdf5676 --- /dev/null +++ b/queue-5.15/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch @@ -0,0 +1,41 @@ +From c3c06c61890da80494bb196f75d89b791adda87f Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 27 Oct 2022 17:12:37 +0800 +Subject: can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() + +From: Yang Yingliang + +commit c3c06c61890da80494bb196f75d89b791adda87f upstream. + +It is not allowed to call kfree_skb() from hardware interrupt context +or with interrupts being disabled. The skb is unlinked from the queue, +so it can be freed after spin_unlock_irqrestore(). + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Signed-off-by: Yang Yingliang +Acked-by: Oleksij Rempel +Link: https://lore.kernel.org/all/20221027091237.2290111-1-yangyingliang@huawei.com +Cc: stable@vger.kernel.org +[mkl: adjust subject] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -342,10 +342,12 @@ static void j1939_session_skb_drop_old(s + __skb_unlink(do_skb, &session->skb_queue); + /* drop ref taken in j1939_session_skb_queue() */ + skb_unref(do_skb); ++ spin_unlock_irqrestore(&session->skb_queue.lock, flags); + + kfree_skb(do_skb); ++ } else { ++ spin_unlock_irqrestore(&session->skb_queue.lock, flags); + } +- spin_unlock_irqrestore(&session->skb_queue.lock, flags); + } + + void j1939_session_skb_queue(struct j1939_session *session, diff --git a/queue-5.15/can-kvaser_usb-fix-possible-completions-during-init_completion.patch b/queue-5.15/can-kvaser_usb-fix-possible-completions-during-init_completion.patch new file mode 100644 index 00000000000..c109b30357f --- /dev/null +++ b/queue-5.15/can-kvaser_usb-fix-possible-completions-during-init_completion.patch @@ -0,0 +1,79 @@ +From 2871edb32f4622c3a25ce4b3977bad9050b91974 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 20:52:27 +0200 +Subject: can: kvaser_usb: Fix possible completions during init_completion + +From: Anssi Hannula + +commit 2871edb32f4622c3a25ce4b3977bad9050b91974 upstream. + +kvaser_usb uses completions to signal when a response event is received +for outgoing commands. + +However, it uses init_completion() to reinitialize the start_comp and +stop_comp completions before sending the start/stop commands. + +In case the device sends the corresponding response just before the +actual command is sent, complete() may be called concurrently with +init_completion() which is not safe. + +This might be triggerable even with a properly functioning device by +stopping the interface (CMD_STOP_CHIP) just after it goes bus-off (which +also causes the driver to send CMD_STOP_CHIP when restart-ms is off), +but that was not tested. + +Fix the issue by using reinit_completion() instead. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-2-extja@kvaser.com +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 ++-- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1873,7 +1873,7 @@ static int kvaser_usb_hydra_start_chip(s + { + int err; + +- init_completion(&priv->start_comp); ++ reinit_completion(&priv->start_comp); + + err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_START_CHIP_REQ, + priv->channel); +@@ -1891,7 +1891,7 @@ static int kvaser_usb_hydra_stop_chip(st + { + int err; + +- init_completion(&priv->stop_comp); ++ reinit_completion(&priv->stop_comp); + + /* Make sure we do not report invalid BUS_OFF from CMD_CHIP_STATE_EVENT + * see comment in kvaser_usb_hydra_update_state() +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1324,7 +1324,7 @@ static int kvaser_usb_leaf_start_chip(st + { + int err; + +- init_completion(&priv->start_comp); ++ reinit_completion(&priv->start_comp); + + err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_START_CHIP, + priv->channel); +@@ -1342,7 +1342,7 @@ static int kvaser_usb_leaf_stop_chip(str + { + int err; + +- init_completion(&priv->stop_comp); ++ reinit_completion(&priv->stop_comp); + + err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP, + priv->channel); diff --git a/queue-5.15/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch b/queue-5.15/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch new file mode 100644 index 00000000000..83713883bdd --- /dev/null +++ b/queue-5.15/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch @@ -0,0 +1,39 @@ +From ce107713b722af57c4b7f2477594d445b496420e Mon Sep 17 00:00:00 2001 +From: Tony O'Brien +Date: Tue, 27 Sep 2022 15:47:28 +1300 +Subject: mtd: rawnand: marvell: Use correct logic for nand-keep-config + +From: Tony O'Brien + +commit ce107713b722af57c4b7f2477594d445b496420e upstream. + +Originally the absence of the marvell,nand-keep-config property caused +the setup_data_interface function to be provided. However when +setup_data_interface was moved into nand_controller_ops the logic was +unintentionally inverted. Update the logic so that only if the +marvell,nand-keep-config property is present the bootloader NAND config +kept. + +Cc: stable@vger.kernel.org +Fixes: 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops") +Signed-off-by: Tony O'Brien +Signed-off-by: Chris Packham +Reviewed-by: Boris Brezillon +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220927024728.28447-1-chris.packham@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/marvell_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -2672,7 +2672,7 @@ static int marvell_nand_chip_init(struct + chip->controller = &nfc->controller; + nand_set_flash_node(chip, np); + +- if (!of_property_read_bool(np, "marvell,nand-keep-config")) ++ if (of_property_read_bool(np, "marvell,nand-keep-config")) + chip->options |= NAND_KEEP_TIMINGS; + + mtd = nand_to_mtd(chip); diff --git a/queue-5.15/series b/queue-5.15/series index d7df0c3f025..f3cf0b6a60e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -1,2 +1,18 @@ nfsv4-fix-free-of-uninitialized-nfs4_label-on-referral-lookup.patch nfsv4-add-an-fattr-allocation-to-_nfs4_discover_trunking.patch +can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch +can-kvaser_usb-fix-possible-completions-during-init_completion.patch +alsa-use-del_timer_sync-before-freeing-timer.patch +alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch +alsa-usb-audio-add-quirks-for-m-audio-fast-track-c400-600.patch +alsa-au88x0-use-explicitly-signed-char.patch +alsa-rme9652-use-explicitly-signed-char.patch +usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch +usb-gadget-uvc-fix-sg-handling-in-error-case.patch +usb-gadget-uvc-fix-sg-handling-during-video-encode.patch +usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch +usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch +usb-typec-ucsi-acpi-implement-resume-callback.patch +usb-bdc-change-state-when-port-disconnected.patch +usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch +mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch diff --git a/queue-5.15/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch b/queue-5.15/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch new file mode 100644 index 00000000000..bb1e751fcec --- /dev/null +++ b/queue-5.15/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch @@ -0,0 +1,48 @@ +From fc4ade55c617dc73c7e9756b57f3230b4ff24540 Mon Sep 17 00:00:00 2001 +From: Hannu Hartikainen +Date: Mon, 19 Sep 2022 20:16:10 +0300 +Subject: USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM + +From: Hannu Hartikainen + +commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 upstream. + +NVIDIA Jetson devices in Force Recovery mode (RCM) do not support +suspending, ie. flashing fails if the device has been suspended. The +devices are still visible in lsusb and seem to work otherwise, making +the issue hard to debug. This has been discovered in various forum +posts, eg. [1]. + +The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding +all the Jetson models listed in [2] on the assumption that they all +behave similarly. + +[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365 +[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html + +Signed-off-by: Hannu Hartikainen +Cc: stable # after 6.1-rc3 +Link: https://lore.kernel.org/r/20220919171610.30484-1-hannu@hrtk.in +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -388,6 +388,15 @@ static const struct usb_device_id usb_qu + /* Kingston DataTraveler 3.0 */ + { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* NVIDIA Jetson devices in Force Recovery mode */ ++ { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + diff --git a/queue-5.15/usb-bdc-change-state-when-port-disconnected.patch b/queue-5.15/usb-bdc-change-state-when-port-disconnected.patch new file mode 100644 index 00000000000..5997b2505dc --- /dev/null +++ b/queue-5.15/usb-bdc-change-state-when-port-disconnected.patch @@ -0,0 +1,33 @@ +From fb8f60dd1b67520e0e0d7978ef17d015690acfc1 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 5 Oct 2022 12:13:55 -0700 +Subject: usb: bdc: change state when port disconnected + +From: Justin Chen + +commit fb8f60dd1b67520e0e0d7978ef17d015690acfc1 upstream. + +When port is connected and then disconnected, the state stays as +configured. Which is incorrect as the port is no longer configured, +but in a not attached state. + +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC") +Cc: stable +Link: https://lore.kernel.org/r/1664997235-18198-1-git-send-email-justinpopo6@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/bdc/bdc_udc.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c +@@ -151,6 +151,7 @@ static void bdc_uspc_disconnected(struct + bdc->delayed_status = false; + bdc->reinit = reinit; + bdc->test_mode = false; ++ usb_gadget_set_state(&bdc->gadget, USB_STATE_NOTATTACHED); + } + + /* TNotify wkaeup timer */ diff --git a/queue-5.15/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch b/queue-5.15/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch new file mode 100644 index 00000000000..d1c187468dd --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch @@ -0,0 +1,39 @@ +From 308c316d16cbad99bb834767382baa693ac42169 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 25 Oct 2022 15:10:20 -0700 +Subject: usb: dwc3: gadget: Don't set IMI for no_interrupt + +From: Thinh Nguyen + +commit 308c316d16cbad99bb834767382baa693ac42169 upstream. + +The gadget driver may have a certain expectation of how the request +completion flow should be from to its configuration. Make sure the +controller driver respect that. That is, don't set IMI (Interrupt on +Missed Isoc) when usb_request->no_interrupt is set. Also, the driver +should only set IMI to the last TRB of a chain. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Reviewed-by: Jeff Vanhoof +Tested-by: Jeff Vanhoof +Link: https://lore.kernel.org/r/ced336c84434571340c07994e3667a0ee284fefe.1666735451.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1263,8 +1263,8 @@ static void dwc3_prepare_one_trb(struct + trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS; + } + +- /* always enable Interrupt on Missed ISOC */ +- trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; ++ if (!no_interrupt && !chain) ++ trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; + break; + + case USB_ENDPOINT_XFER_BULK: diff --git a/queue-5.15/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch b/queue-5.15/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch new file mode 100644 index 00000000000..b5a1b3d55fb --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch @@ -0,0 +1,46 @@ +From f78961f8380b940e0cfc7e549336c21a2ad44f4d Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 25 Oct 2022 15:10:14 -0700 +Subject: usb: dwc3: gadget: Stop processing more requests on IMI + +From: Thinh Nguyen + +commit f78961f8380b940e0cfc7e549336c21a2ad44f4d upstream. + +When servicing a transfer completion event, the dwc3 driver will reclaim +TRBs of started requests up to the request associated with the interrupt +event. Currently we don't check for interrupt due to missed isoc, and +the driver may attempt to reclaim TRBs beyond the associated event. This +causes invalid memory access when the hardware still owns the TRB. If +there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure +to stop servicing further. + +Note that only the last TRB of chained TRBs has its status updated with +missed isoc. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable@vger.kernel.org +Reported-by: Jeff Vanhoof +Reported-by: Dan Vacura +Signed-off-by: Thinh Nguyen +Reviewed-by: Jeff Vanhoof +Tested-by: Jeff Vanhoof +Link: https://lore.kernel.org/r/b29acbeab531b666095dfdafd8cb5c7654fbb3e1.1666735451.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3146,6 +3146,10 @@ static int dwc3_gadget_ep_reclaim_comple + if (event->status & DEPEVT_STATUS_SHORT && !chain) + return 1; + ++ if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) && ++ DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC) ++ return 1; ++ + if ((trb->ctrl & DWC3_TRB_CTRL_IOC) || + (trb->ctrl & DWC3_TRB_CTRL_LST)) + return 1; diff --git a/queue-5.15/usb-gadget-uvc-fix-sg-handling-during-video-encode.patch b/queue-5.15/usb-gadget-uvc-fix-sg-handling-during-video-encode.patch new file mode 100644 index 00000000000..375d9a27557 --- /dev/null +++ b/queue-5.15/usb-gadget-uvc-fix-sg-handling-during-video-encode.patch @@ -0,0 +1,40 @@ +From b57b08e6f431348363adffa5b6643fe3ec9dc7fe Mon Sep 17 00:00:00 2001 +From: Jeff Vanhoof +Date: Tue, 18 Oct 2022 16:50:40 -0500 +Subject: usb: gadget: uvc: fix sg handling during video encode + +From: Jeff Vanhoof + +commit b57b08e6f431348363adffa5b6643fe3ec9dc7fe upstream. + +In uvc_video_encode_isoc_sg, the uvc_request's sg list is +incorrectly being populated leading to corrupt video being +received by the remote end. When building the sg list the +usage of buf->sg's 'dma_length' field is not correct and +instead its 'length' field should be used. + +Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support") +Cc: +Signed-off-by: Jeff Vanhoof +Signed-off-by: Dan Vacura +Link: https://lore.kernel.org/r/20221018215044.765044-5-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_video.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -128,10 +128,10 @@ uvc_video_encode_isoc_sg(struct usb_requ + sg = sg_next(sg); + + for_each_sg(sg, iter, ureq->sgt.nents - 1, i) { +- if (!len || !buf->sg || !sg_dma_len(buf->sg)) ++ if (!len || !buf->sg || !buf->sg->length) + break; + +- sg_left = sg_dma_len(buf->sg) - buf->offset; ++ sg_left = buf->sg->length - buf->offset; + part = min_t(unsigned int, len, sg_left); + + sg_set_page(iter, sg_page(buf->sg), part, buf->offset); diff --git a/queue-5.15/usb-gadget-uvc-fix-sg-handling-in-error-case.patch b/queue-5.15/usb-gadget-uvc-fix-sg-handling-in-error-case.patch new file mode 100644 index 00000000000..15a716e16df --- /dev/null +++ b/queue-5.15/usb-gadget-uvc-fix-sg-handling-in-error-case.patch @@ -0,0 +1,123 @@ +From 0a0a2760b04814428800d48281a447a7522470ad Mon Sep 17 00:00:00 2001 +From: Dan Vacura +Date: Tue, 18 Oct 2022 16:50:39 -0500 +Subject: usb: gadget: uvc: fix sg handling in error case + +From: Dan Vacura + +commit 0a0a2760b04814428800d48281a447a7522470ad upstream. + +If there is a transmission error the buffer will be returned too early, +causing a memory fault as subsequent requests for that buffer are still +queued up to be sent. Refactor the error handling to wait for the final +request to come in before reporting back the buffer to userspace for all +transfer types (bulk/isoc/isoc_sg). This ensures userspace knows if the +frame was successfully sent. + +Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support") +Cc: +Signed-off-by: Dan Vacura +Link: https://lore.kernel.org/r/20221018215044.765044-4-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_queue.c | 8 +++++--- + drivers/usb/gadget/function/uvc_video.c | 18 ++++++++++++++---- + 2 files changed, 19 insertions(+), 7 deletions(-) + +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -313,6 +313,7 @@ int uvcg_queue_enable(struct uvc_video_q + + queue->sequence = 0; + queue->buf_used = 0; ++ queue->flags &= ~UVC_QUEUE_DROP_INCOMPLETE; + } else { + ret = vb2_streamoff(&queue->queue, queue->queue.type); + if (ret < 0) +@@ -338,10 +339,11 @@ int uvcg_queue_enable(struct uvc_video_q + void uvcg_complete_buffer(struct uvc_video_queue *queue, + struct uvc_buffer *buf) + { +- if ((queue->flags & UVC_QUEUE_DROP_INCOMPLETE) && +- buf->length != buf->bytesused) { +- buf->state = UVC_BUF_STATE_QUEUED; ++ if (queue->flags & UVC_QUEUE_DROP_INCOMPLETE) { ++ queue->flags &= ~UVC_QUEUE_DROP_INCOMPLETE; ++ buf->state = UVC_BUF_STATE_ERROR; + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, 0); ++ vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); + return; + } + +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -59,6 +59,7 @@ uvc_video_encode_bulk(struct usb_request + struct uvc_buffer *buf) + { + void *mem = req->buf; ++ struct uvc_request *ureq = req->context; + int len = video->req_size; + int ret; + +@@ -84,13 +85,14 @@ uvc_video_encode_bulk(struct usb_request + video->queue.buf_used = 0; + buf->state = UVC_BUF_STATE_DONE; + list_del(&buf->queue); +- uvcg_complete_buffer(&video->queue, buf); + video->fid ^= UVC_STREAM_FID; ++ ureq->last_buf = buf; + + video->payload_size = 0; + } + + if (video->payload_size == video->max_payload_size || ++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE || + buf->bytesused == video->queue.buf_used) + video->payload_size = 0; + } +@@ -151,7 +153,8 @@ uvc_video_encode_isoc_sg(struct usb_requ + req->length -= len; + video->queue.buf_used += req->length - header_len; + +- if (buf->bytesused == video->queue.buf_used || !buf->sg) { ++ if (buf->bytesused == video->queue.buf_used || !buf->sg || ++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE) { + video->queue.buf_used = 0; + buf->state = UVC_BUF_STATE_DONE; + buf->offset = 0; +@@ -166,6 +169,7 @@ uvc_video_encode_isoc(struct usb_request + struct uvc_buffer *buf) + { + void *mem = req->buf; ++ struct uvc_request *ureq = req->context; + int len = video->req_size; + int ret; + +@@ -180,12 +184,13 @@ uvc_video_encode_isoc(struct usb_request + + req->length = video->req_size - len; + +- if (buf->bytesused == video->queue.buf_used) { ++ if (buf->bytesused == video->queue.buf_used || ++ video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE) { + video->queue.buf_used = 0; + buf->state = UVC_BUF_STATE_DONE; + list_del(&buf->queue); +- uvcg_complete_buffer(&video->queue, buf); + video->fid ^= UVC_STREAM_FID; ++ ureq->last_buf = buf; + } + } + +@@ -222,6 +227,11 @@ uvc_video_complete(struct usb_ep *ep, st + case 0: + break; + ++ case -EXDEV: ++ uvcg_dbg(&video->uvc->func, "VS request missed xfer.\n"); ++ queue->flags |= UVC_QUEUE_DROP_INCOMPLETE; ++ break; ++ + case -ESHUTDOWN: /* disconnect from host. */ + uvcg_dbg(&video->uvc->func, "VS request cancelled.\n"); + uvcg_queue_cancel(queue, 1); diff --git a/queue-5.15/usb-typec-ucsi-acpi-implement-resume-callback.patch b/queue-5.15/usb-typec-ucsi-acpi-implement-resume-callback.patch new file mode 100644 index 00000000000..48d45bd90ff --- /dev/null +++ b/queue-5.15/usb-typec-ucsi-acpi-implement-resume-callback.patch @@ -0,0 +1,50 @@ +From 4e3a50293c2b21961f02e1afa2f17d3a1a90c7c8 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Fri, 7 Oct 2022 13:09:51 +0300 +Subject: usb: typec: ucsi: acpi: Implement resume callback + +From: Heikki Krogerus + +commit 4e3a50293c2b21961f02e1afa2f17d3a1a90c7c8 upstream. + +The ACPI driver needs to resume the interface by calling +ucsi_resume(). Otherwise we may fail to detect connections +and disconnections that happen while the system is +suspended. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=210425 +Fixes: a94ecde41f7e ("usb: typec: ucsi: ccg: enable runtime pm support") +Cc: +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20221007100951.43798-3-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/usb/typec/ucsi/ucsi_acpi.c ++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c +@@ -196,6 +196,15 @@ static int ucsi_acpi_remove(struct platf + return 0; + } + ++static int ucsi_acpi_resume(struct device *dev) ++{ ++ struct ucsi_acpi *ua = dev_get_drvdata(dev); ++ ++ return ucsi_resume(ua->ucsi); ++} ++ ++static DEFINE_SIMPLE_DEV_PM_OPS(ucsi_acpi_pm_ops, NULL, ucsi_acpi_resume); ++ + static const struct acpi_device_id ucsi_acpi_match[] = { + { "PNP0CA0", 0 }, + { }, +@@ -205,6 +214,7 @@ MODULE_DEVICE_TABLE(acpi, ucsi_acpi_matc + static struct platform_driver ucsi_acpi_platform_driver = { + .driver = { + .name = "ucsi_acpi", ++ .pm = pm_ptr(&ucsi_acpi_pm_ops), + .acpi_match_table = ACPI_PTR(ucsi_acpi_match), + }, + .probe = ucsi_acpi_probe, diff --git a/queue-5.15/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch b/queue-5.15/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch new file mode 100644 index 00000000000..8e6bbbac087 --- /dev/null +++ b/queue-5.15/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch @@ -0,0 +1,45 @@ +From 4f547472380136718b56064ea5689a61e135f904 Mon Sep 17 00:00:00 2001 +From: Jens Glathe +Date: Mon, 24 Oct 2022 17:27:17 +0300 +Subject: usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller + +From: Jens Glathe + +commit 4f547472380136718b56064ea5689a61e135f904 upstream. + +This appears to fix the error: +"xhci_hcd
; ERROR Transfer event TRB DMA ptr not part of +current TD ep_index 2 comp_code 13" that appear spuriously (or pretty +often) when using a r8152 USB3 ethernet adapter with integrated hub. + +ASM1042 reports as a 0.96 controller, but appears to behave more like 1.0 + +Inspired by this email thread: https://markmail.org/thread/7vzqbe7t6du6qsw3 + +Cc: stable@vger.kernel.org +Signed-off-by: Jens Glathe +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221024142720.4122053-2-mathias.nyman@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -307,8 +307,14 @@ static void xhci_pci_quirks(struct devic + } + + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) ++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) { ++ /* ++ * try to tame the ASMedia 1042 controller which reports 0.96 ++ * but appears to behave more like 1.0 ++ */ ++ xhci->quirks |= XHCI_SPURIOUS_SUCCESS; + xhci->quirks |= XHCI_BROKEN_STREAMS; ++ } + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && + pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) { + xhci->quirks |= XHCI_TRUST_TX_LENGTH;