From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 05:51:18 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.19.263~73 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cf0caefb8996fc7717668354f427a4fe9a972007;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: alsa-au88x0-use-explicitly-signed-char.patch alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch alsa-use-del_timer_sync-before-freeing-timer.patch can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch can-kvaser_usb-fix-possible-completions-during-init_completion.patch mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch usb-bdc-change-state-when-port-disconnected.patch usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch --- diff --git a/queue-5.4/alsa-au88x0-use-explicitly-signed-char.patch b/queue-5.4/alsa-au88x0-use-explicitly-signed-char.patch new file mode 100644 index 00000000000..18860327f13 --- /dev/null +++ b/queue-5.4/alsa-au88x0-use-explicitly-signed-char.patch @@ -0,0 +1,64 @@ +From ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 24 Oct 2022 18:29:29 +0200 +Subject: ALSA: au88x0: use explicitly signed char + +From: Jason A. Donenfeld + +commit ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 upstream. + +With char becoming unsigned by default, and with `char` alone being +ambiguous and based on architecture, signed chars need to be marked +explicitly as such. This fixes warnings like: + +sound/pci/au88x0/au88x0_core.c:2029 vortex_adb_checkinout() warn: signedness bug returning '(-22)' +sound/pci/au88x0/au88x0_core.c:2046 vortex_adb_checkinout() warn: signedness bug returning '(-12)' +sound/pci/au88x0/au88x0_core.c:2125 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, (0), en, 0)' is unsigned +sound/pci/au88x0/au88x0_core.c:2170 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, stream->resources, en, 4)' is unsigned + +As well, since one function returns errnos, return an `int` rather than +a `signed char`. + +Signed-off-by: Jason A. Donenfeld +Cc: +Link: https://lore.kernel.org/r/20221024162929.536004-1-Jason@zx2c4.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/au88x0/au88x0.h | 6 +++--- + sound/pci/au88x0/au88x0_core.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/pci/au88x0/au88x0.h ++++ b/sound/pci/au88x0/au88x0.h +@@ -141,7 +141,7 @@ struct snd_vortex { + #ifndef CHIP_AU8810 + stream_t dma_wt[NR_WT]; + wt_voice_t wt_voice[NR_WT]; /* WT register cache. */ +- char mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ ++ s8 mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ + #endif + + /* Global resources */ +@@ -235,8 +235,8 @@ static int vortex_alsafmt_aspfmt(snd_pcm + static void vortex_connect_default(vortex_t * vortex, int en); + static int vortex_adb_allocroute(vortex_t * vortex, int dma, int nr_ch, + int dir, int type, int subdev); +-static char vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, +- int restype); ++static int vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, ++ int restype); + #ifndef CHIP_AU8810 + static int vortex_wt_allocroute(vortex_t * vortex, int dma, int nr_ch); + static void vortex_wt_connect(vortex_t * vortex, int en); +--- a/sound/pci/au88x0/au88x0_core.c ++++ b/sound/pci/au88x0/au88x0_core.c +@@ -1998,7 +1998,7 @@ static int resnum[VORTEX_RESOURCE_LAST] + out: Mean checkout if != 0. Else mean Checkin resource. + restype: Indicates type of resource to be checked in or out. + */ +-static char ++static int + vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, int restype) + { + int i, qty = resnum[restype], resinuse = 0; diff --git a/queue-5.4/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch b/queue-5.4/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch new file mode 100644 index 00000000000..003c270ae2f --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch @@ -0,0 +1,31 @@ +From 491a4ccd8a0258392900c80c6b2b622c7115fc23 Mon Sep 17 00:00:00 2001 +From: Stefan Binding +Date: Tue, 18 Oct 2022 13:15:06 +0100 +Subject: ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 + +From: Stefan Binding + +commit 491a4ccd8a0258392900c80c6b2b622c7115fc23 upstream. + +This Asus Zenbook laptop use Realtek HDA codec combined with +2xCS35L41 Amplifiers using SPI with External Boost. + +Signed-off-by: Stefan Binding +Cc: +Link: https://lore.kernel.org/r/20221018121506.2561397-1-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8274,6 +8274,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), ++ SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS), diff --git a/queue-5.4/alsa-use-del_timer_sync-before-freeing-timer.patch b/queue-5.4/alsa-use-del_timer_sync-before-freeing-timer.patch new file mode 100644 index 00000000000..1e25adf240e --- /dev/null +++ b/queue-5.4/alsa-use-del_timer_sync-before-freeing-timer.patch @@ -0,0 +1,64 @@ +From f0a868788fcbf63cdab51f5adcf73b271ede8164 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Wed, 26 Oct 2022 23:12:36 -0400 +Subject: ALSA: Use del_timer_sync() before freeing timer + +From: Steven Rostedt (Google) + +commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream. + +The current code for freeing the emux timer is extremely dangerous: + + CPU0 CPU1 + ---- ---- +snd_emux_timer_callback() + snd_emux_free() + spin_lock(&emu->voice_lock) + del_timer(&emu->tlist); <-- returns immediately + spin_unlock(&emu->voice_lock); + [..] + kfree(emu); + + spin_lock(&emu->voice_lock); + + [BOOM!] + +Instead just use del_timer_sync() which will wait for the timer to finish +before continuing. No need to check if the timer is active or not when +doing so. + +This doesn't fix the race of a possible re-arming of the timer, but at +least it won't use the data that has just been freed. + +[ Fixed unused variable warning by tiwai ] + +Cc: stable@vger.kernel.org +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Steven Rostedt (Google) +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20221026231236.6834b551@gandalf.local.home +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/synth/emux/emux.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/sound/synth/emux/emux.c ++++ b/sound/synth/emux/emux.c +@@ -125,15 +125,10 @@ EXPORT_SYMBOL(snd_emux_register); + */ + int snd_emux_free(struct snd_emux *emu) + { +- unsigned long flags; +- + if (! emu) + return -EINVAL; + +- spin_lock_irqsave(&emu->voice_lock, flags); +- if (emu->timer_active) +- del_timer(&emu->tlist); +- spin_unlock_irqrestore(&emu->voice_lock, flags); ++ del_timer_sync(&emu->tlist); + + snd_emux_proc_free(emu); + snd_emux_delete_virmidi(emu); diff --git a/queue-5.4/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch b/queue-5.4/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch new file mode 100644 index 00000000000..941e81b36fc --- /dev/null +++ b/queue-5.4/can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch @@ -0,0 +1,41 @@ +From c3c06c61890da80494bb196f75d89b791adda87f Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 27 Oct 2022 17:12:37 +0800 +Subject: can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() + +From: Yang Yingliang + +commit c3c06c61890da80494bb196f75d89b791adda87f upstream. + +It is not allowed to call kfree_skb() from hardware interrupt context +or with interrupts being disabled. The skb is unlinked from the queue, +so it can be freed after spin_unlock_irqrestore(). + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Signed-off-by: Yang Yingliang +Acked-by: Oleksij Rempel +Link: https://lore.kernel.org/all/20221027091237.2290111-1-yangyingliang@huawei.com +Cc: stable@vger.kernel.org +[mkl: adjust subject] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -338,10 +338,12 @@ static void j1939_session_skb_drop_old(s + __skb_unlink(do_skb, &session->skb_queue); + /* drop ref taken in j1939_session_skb_queue() */ + skb_unref(do_skb); ++ spin_unlock_irqrestore(&session->skb_queue.lock, flags); + + kfree_skb(do_skb); ++ } else { ++ spin_unlock_irqrestore(&session->skb_queue.lock, flags); + } +- spin_unlock_irqrestore(&session->skb_queue.lock, flags); + } + + void j1939_session_skb_queue(struct j1939_session *session, diff --git a/queue-5.4/can-kvaser_usb-fix-possible-completions-during-init_completion.patch b/queue-5.4/can-kvaser_usb-fix-possible-completions-during-init_completion.patch new file mode 100644 index 00000000000..b9514417ba7 --- /dev/null +++ b/queue-5.4/can-kvaser_usb-fix-possible-completions-during-init_completion.patch @@ -0,0 +1,79 @@ +From 2871edb32f4622c3a25ce4b3977bad9050b91974 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 10 Oct 2022 20:52:27 +0200 +Subject: can: kvaser_usb: Fix possible completions during init_completion + +From: Anssi Hannula + +commit 2871edb32f4622c3a25ce4b3977bad9050b91974 upstream. + +kvaser_usb uses completions to signal when a response event is received +for outgoing commands. + +However, it uses init_completion() to reinitialize the start_comp and +stop_comp completions before sending the start/stop commands. + +In case the device sends the corresponding response just before the +actual command is sent, complete() may be called concurrently with +init_completion() which is not safe. + +This might be triggerable even with a properly functioning device by +stopping the interface (CMD_STOP_CHIP) just after it goes bus-off (which +also causes the driver to send CMD_STOP_CHIP when restart-ms is off), +but that was not tested. + +Fix the issue by using reinit_completion() instead. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-2-extja@kvaser.com +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 ++-- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1845,7 +1845,7 @@ static int kvaser_usb_hydra_start_chip(s + { + int err; + +- init_completion(&priv->start_comp); ++ reinit_completion(&priv->start_comp); + + err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_START_CHIP_REQ, + priv->channel); +@@ -1863,7 +1863,7 @@ static int kvaser_usb_hydra_stop_chip(st + { + int err; + +- init_completion(&priv->stop_comp); ++ reinit_completion(&priv->stop_comp); + + /* Make sure we do not report invalid BUS_OFF from CMD_CHIP_STATE_EVENT + * see comment in kvaser_usb_hydra_update_state() +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1324,7 +1324,7 @@ static int kvaser_usb_leaf_start_chip(st + { + int err; + +- init_completion(&priv->start_comp); ++ reinit_completion(&priv->start_comp); + + err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_START_CHIP, + priv->channel); +@@ -1342,7 +1342,7 @@ static int kvaser_usb_leaf_stop_chip(str + { + int err; + +- init_completion(&priv->stop_comp); ++ reinit_completion(&priv->stop_comp); + + err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP, + priv->channel); diff --git a/queue-5.4/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch b/queue-5.4/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch new file mode 100644 index 00000000000..d976f91410f --- /dev/null +++ b/queue-5.4/mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch @@ -0,0 +1,39 @@ +From ce107713b722af57c4b7f2477594d445b496420e Mon Sep 17 00:00:00 2001 +From: Tony O'Brien +Date: Tue, 27 Sep 2022 15:47:28 +1300 +Subject: mtd: rawnand: marvell: Use correct logic for nand-keep-config + +From: Tony O'Brien + +commit ce107713b722af57c4b7f2477594d445b496420e upstream. + +Originally the absence of the marvell,nand-keep-config property caused +the setup_data_interface function to be provided. However when +setup_data_interface was moved into nand_controller_ops the logic was +unintentionally inverted. Update the logic so that only if the +marvell,nand-keep-config property is present the bootloader NAND config +kept. + +Cc: stable@vger.kernel.org +Fixes: 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops") +Signed-off-by: Tony O'Brien +Signed-off-by: Chris Packham +Reviewed-by: Boris Brezillon +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220927024728.28447-1-chris.packham@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/marvell_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -2630,7 +2630,7 @@ static int marvell_nand_chip_init(struct + chip->controller = &nfc->controller; + nand_set_flash_node(chip, np); + +- if (!of_property_read_bool(np, "marvell,nand-keep-config")) ++ if (of_property_read_bool(np, "marvell,nand-keep-config")) + chip->options |= NAND_KEEP_TIMINGS; + + mtd = nand_to_mtd(chip); diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..390420a25bc --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,12 @@ +can-j1939-transport-j1939_session_skb_drop_old-spin_unlock_irqrestore-before-kfree_skb.patch +can-kvaser_usb-fix-possible-completions-during-init_completion.patch +alsa-use-del_timer_sync-before-freeing-timer.patch +alsa-hda-realtek-add-quirk-for-asus-zenbook-using-cs35l41.patch +alsa-au88x0-use-explicitly-signed-char.patch +usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch +usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch +usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch +usb-bdc-change-state-when-port-disconnected.patch +usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch +mtd-rawnand-marvell-use-correct-logic-for-nand-keep-config.patch +xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch diff --git a/queue-5.4/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch b/queue-5.4/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch new file mode 100644 index 00000000000..bb1e751fcec --- /dev/null +++ b/queue-5.4/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch @@ -0,0 +1,48 @@ +From fc4ade55c617dc73c7e9756b57f3230b4ff24540 Mon Sep 17 00:00:00 2001 +From: Hannu Hartikainen +Date: Mon, 19 Sep 2022 20:16:10 +0300 +Subject: USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM + +From: Hannu Hartikainen + +commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 upstream. + +NVIDIA Jetson devices in Force Recovery mode (RCM) do not support +suspending, ie. flashing fails if the device has been suspended. The +devices are still visible in lsusb and seem to work otherwise, making +the issue hard to debug. This has been discovered in various forum +posts, eg. [1]. + +The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding +all the Jetson models listed in [2] on the assumption that they all +behave similarly. + +[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365 +[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html + +Signed-off-by: Hannu Hartikainen +Cc: stable # after 6.1-rc3 +Link: https://lore.kernel.org/r/20220919171610.30484-1-hannu@hrtk.in +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -388,6 +388,15 @@ static const struct usb_device_id usb_qu + /* Kingston DataTraveler 3.0 */ + { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* NVIDIA Jetson devices in Force Recovery mode */ ++ { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + diff --git a/queue-5.4/usb-bdc-change-state-when-port-disconnected.patch b/queue-5.4/usb-bdc-change-state-when-port-disconnected.patch new file mode 100644 index 00000000000..5997b2505dc --- /dev/null +++ b/queue-5.4/usb-bdc-change-state-when-port-disconnected.patch @@ -0,0 +1,33 @@ +From fb8f60dd1b67520e0e0d7978ef17d015690acfc1 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 5 Oct 2022 12:13:55 -0700 +Subject: usb: bdc: change state when port disconnected + +From: Justin Chen + +commit fb8f60dd1b67520e0e0d7978ef17d015690acfc1 upstream. + +When port is connected and then disconnected, the state stays as +configured. Which is incorrect as the port is no longer configured, +but in a not attached state. + +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC") +Cc: stable +Link: https://lore.kernel.org/r/1664997235-18198-1-git-send-email-justinpopo6@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/bdc/bdc_udc.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c +@@ -151,6 +151,7 @@ static void bdc_uspc_disconnected(struct + bdc->delayed_status = false; + bdc->reinit = reinit; + bdc->test_mode = false; ++ usb_gadget_set_state(&bdc->gadget, USB_STATE_NOTATTACHED); + } + + /* TNotify wkaeup timer */ diff --git a/queue-5.4/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch b/queue-5.4/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch new file mode 100644 index 00000000000..c3f54db3e78 --- /dev/null +++ b/queue-5.4/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch @@ -0,0 +1,39 @@ +From 308c316d16cbad99bb834767382baa693ac42169 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 25 Oct 2022 15:10:20 -0700 +Subject: usb: dwc3: gadget: Don't set IMI for no_interrupt + +From: Thinh Nguyen + +commit 308c316d16cbad99bb834767382baa693ac42169 upstream. + +The gadget driver may have a certain expectation of how the request +completion flow should be from to its configuration. Make sure the +controller driver respect that. That is, don't set IMI (Interrupt on +Missed Isoc) when usb_request->no_interrupt is set. Also, the driver +should only set IMI to the last TRB of a chain. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Reviewed-by: Jeff Vanhoof +Tested-by: Jeff Vanhoof +Link: https://lore.kernel.org/r/ced336c84434571340c07994e3667a0ee284fefe.1666735451.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -981,8 +981,8 @@ static void __dwc3_prepare_one_trb(struc + trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS; + } + +- /* always enable Interrupt on Missed ISOC */ +- trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; ++ if (!no_interrupt && !chain) ++ trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; + break; + + case USB_ENDPOINT_XFER_BULK: diff --git a/queue-5.4/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch b/queue-5.4/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch new file mode 100644 index 00000000000..1753017bdf0 --- /dev/null +++ b/queue-5.4/usb-dwc3-gadget-stop-processing-more-requests-on-imi.patch @@ -0,0 +1,46 @@ +From f78961f8380b940e0cfc7e549336c21a2ad44f4d Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 25 Oct 2022 15:10:14 -0700 +Subject: usb: dwc3: gadget: Stop processing more requests on IMI + +From: Thinh Nguyen + +commit f78961f8380b940e0cfc7e549336c21a2ad44f4d upstream. + +When servicing a transfer completion event, the dwc3 driver will reclaim +TRBs of started requests up to the request associated with the interrupt +event. Currently we don't check for interrupt due to missed isoc, and +the driver may attempt to reclaim TRBs beyond the associated event. This +causes invalid memory access when the hardware still owns the TRB. If +there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure +to stop servicing further. + +Note that only the last TRB of chained TRBs has its status updated with +missed isoc. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable@vger.kernel.org +Reported-by: Jeff Vanhoof +Reported-by: Dan Vacura +Signed-off-by: Thinh Nguyen +Reviewed-by: Jeff Vanhoof +Tested-by: Jeff Vanhoof +Link: https://lore.kernel.org/r/b29acbeab531b666095dfdafd8cb5c7654fbb3e1.1666735451.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2681,6 +2681,10 @@ static int dwc3_gadget_ep_reclaim_comple + if (event->status & DEPEVT_STATUS_SHORT && !chain) + return 1; + ++ if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) && ++ DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC) ++ return 1; ++ + if ((trb->ctrl & DWC3_TRB_CTRL_IOC) || + (trb->ctrl & DWC3_TRB_CTRL_LST)) + return 1; diff --git a/queue-5.4/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch b/queue-5.4/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch new file mode 100644 index 00000000000..708b0c6c691 --- /dev/null +++ b/queue-5.4/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch @@ -0,0 +1,45 @@ +From 4f547472380136718b56064ea5689a61e135f904 Mon Sep 17 00:00:00 2001 +From: Jens Glathe +Date: Mon, 24 Oct 2022 17:27:17 +0300 +Subject: usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller + +From: Jens Glathe + +commit 4f547472380136718b56064ea5689a61e135f904 upstream. + +This appears to fix the error: +"xhci_hcd
; ERROR Transfer event TRB DMA ptr not part of +current TD ep_index 2 comp_code 13" that appear spuriously (or pretty +often) when using a r8152 USB3 ethernet adapter with integrated hub. + +ASM1042 reports as a 0.96 controller, but appears to behave more like 1.0 + +Inspired by this email thread: https://markmail.org/thread/7vzqbe7t6du6qsw3 + +Cc: stable@vger.kernel.org +Signed-off-by: Jens Glathe +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221024142720.4122053-2-mathias.nyman@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -272,8 +272,14 @@ static void xhci_pci_quirks(struct devic + xhci->quirks |= XHCI_BROKEN_STREAMS; + + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) ++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) { ++ /* ++ * try to tame the ASMedia 1042 controller which reports 0.96 ++ * but appears to behave more like 1.0 ++ */ ++ xhci->quirks |= XHCI_SPURIOUS_SUCCESS; + xhci->quirks |= XHCI_BROKEN_STREAMS; ++ } + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && + pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) { + xhci->quirks |= XHCI_TRUST_TX_LENGTH; diff --git a/queue-5.4/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch b/queue-5.4/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch new file mode 100644 index 00000000000..c275448f39b --- /dev/null +++ b/queue-5.4/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch @@ -0,0 +1,69 @@ +From 5aed5b7c2430ce318a8e62f752f181e66f0d1053 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 24 Oct 2022 17:27:20 +0300 +Subject: xhci: Remove device endpoints from bandwidth list when freeing the device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Nyman + +commit 5aed5b7c2430ce318a8e62f752f181e66f0d1053 upstream. + +Endpoints are normally deleted from the bandwidth list when they are +dropped, before the virt device is freed. + +If xHC host is dying or being removed then the endpoints aren't dropped +cleanly due to functions returning early to avoid interacting with a +non-accessible host controller. + +So check and delete endpoints that are still on the bandwidth list when +freeing the virt device. + +Solves a list_del corruption kernel crash when unbinding xhci-pci, +caused by xhci_mem_cleanup() when it later tried to delete already freed +endpoints from the bandwidth list. + +This only affects hosts that use software bandwidth checking, which +currenty is only the xHC in intel Panther Point PCH (Ivy Bridge) + +Cc: stable@vger.kernel.org +Reported-by: Marek Marczykowski-Górecki +Tested-by: Marek Marczykowski-Górecki +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221024142720.4122053-5-mathias.nyman@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mem.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -906,15 +906,19 @@ void xhci_free_virt_device(struct xhci_h + if (dev->eps[i].stream_info) + xhci_free_stream_info(xhci, + dev->eps[i].stream_info); +- /* Endpoints on the TT/root port lists should have been removed +- * when usb_disable_device() was called for the device. +- * We can't drop them anyway, because the udev might have gone +- * away by this point, and we can't tell what speed it was. ++ /* ++ * Endpoints are normally deleted from the bandwidth list when ++ * endpoints are dropped, before device is freed. ++ * If host is dying or being removed then endpoints aren't ++ * dropped cleanly, so delete the endpoint from list here. ++ * Only applicable for hosts with software bandwidth checking. + */ +- if (!list_empty(&dev->eps[i].bw_endpoint_list)) +- xhci_warn(xhci, "Slot %u endpoint %u " +- "not removed from BW list!\n", +- slot_id, i); ++ ++ if (!list_empty(&dev->eps[i].bw_endpoint_list)) { ++ list_del_init(&dev->eps[i].bw_endpoint_list); ++ xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n", ++ slot_id, i); ++ } + } + /* If this is a hub, free the TT(s) from the TT list */ + xhci_free_tt_info(xhci, dev, slot_id);