From c15b3509ebd4225882bd9802b22dd033e4807cae Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 28 Jun 2020 17:34:10 +0200 Subject: [PATCH] 5.7-stable patches added patches: alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch alsa-usb-audio-add-registration-quirk-for-kingston-hyperx-cloud-flight-s.patch alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch alsa-usb-audio-set-48-khz-rate-for-rodecaster.patch binder-fix-null-deref-of-proc-context.patch mei-me-add-tiger-lake-point-device-ids-for-h-platforms.patch mei-me-disable-mei-interface-on-mehlow-server-platforms.patch revert-usb-dwc3-exynos-add-support-for-exynos5422-suspend-clk.patch usb-add-usb_quirk_delay_init-for-logitech-c922.patch usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch usb-cdns3-trace-using-correct-dir-value.patch usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch usb-ehci-reopen-solution-for-synopsys-hc-bug.patch usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch usb-ohci-sm501-add-missed-iounmap-in-remove.patch usb-typec-mux-intel_pmc_mux-fix-dp-alternate-mode-entry.patch usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch xhci-poll-for-u0-after-disabling-usb2-lpm.patch --- ...add-implicit-feedback-quirk-for-ssl2.patch | 32 +++ ...audio-add-quirk-for-denon-dcd-1500re.patch | 39 ++++ ...d-quirk-for-samsung-usbc-headset-akg.patch | 41 ++++ ...k-for-kingston-hyperx-cloud-flight-s.patch | 34 +++ ...fix-oob-access-of-mixer-element-list.patch | 117 ++++++++++ ...audio-set-48-khz-rate-for-rodecaster.patch | 47 ++++ ...inder-fix-null-deref-of-proc-context.patch | 90 +++++++ ...ake-point-device-ids-for-h-platforms.patch | 92 ++++++++ ...interface-on-mehlow-server-platforms.patch | 220 ++++++++++++++++++ ...d-support-for-exynos5422-suspend-clk.patch | 51 ++++ queue-5.7/series | 22 ++ ...b_quirk_delay_init-for-logitech-c922.patch | 41 ++++ ...d-spinlock-for-cdns3_check_new_setup.patch | 53 +++++ ...p0-fix-the-test-mode-set-incorrectly.patch | 35 +++ ...-cdns3-trace-using-correct-dir-value.patch | 40 ++++ ...registration-to-the-udc-class-driver.patch | 62 +++++ ...-reopen-solution-for-synopsys-hc-bug.patch | 58 +++++ ...fix-error-check-in-exynos_ehci_probe.patch | 40 ++++ ...id-runtime-suspend-when-removing-hcd.patch | 46 ++++ ...i-sm501-add-missed-iounmap-in-remove.patch | 34 +++ ..._pmc_mux-fix-dp-alternate-mode-entry.patch | 63 +++++ ...oid-screaming-irq-causing-boot-hangs.patch | 85 +++++++ ...poll-for-u0-after-disabling-usb2-lpm.patch | 59 +++++ 23 files changed, 1401 insertions(+) create mode 100644 queue-5.7/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch create mode 100644 queue-5.7/alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch create mode 100644 queue-5.7/alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch create mode 100644 queue-5.7/alsa-usb-audio-add-registration-quirk-for-kingston-hyperx-cloud-flight-s.patch create mode 100644 queue-5.7/alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch create mode 100644 queue-5.7/alsa-usb-audio-set-48-khz-rate-for-rodecaster.patch create mode 100644 queue-5.7/binder-fix-null-deref-of-proc-context.patch create mode 100644 queue-5.7/mei-me-add-tiger-lake-point-device-ids-for-h-platforms.patch create mode 100644 queue-5.7/mei-me-disable-mei-interface-on-mehlow-server-platforms.patch create mode 100644 queue-5.7/revert-usb-dwc3-exynos-add-support-for-exynos5422-suspend-clk.patch create mode 100644 queue-5.7/usb-add-usb_quirk_delay_init-for-logitech-c922.patch create mode 100644 queue-5.7/usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch create mode 100644 queue-5.7/usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch create mode 100644 queue-5.7/usb-cdns3-trace-using-correct-dir-value.patch create mode 100644 queue-5.7/usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch create mode 100644 queue-5.7/usb-ehci-reopen-solution-for-synopsys-hc-bug.patch create mode 100644 queue-5.7/usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch create mode 100644 queue-5.7/usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch create mode 100644 queue-5.7/usb-ohci-sm501-add-missed-iounmap-in-remove.patch create mode 100644 queue-5.7/usb-typec-mux-intel_pmc_mux-fix-dp-alternate-mode-entry.patch create mode 100644 queue-5.7/usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch create mode 100644 queue-5.7/xhci-poll-for-u0-after-disabling-usb2-lpm.patch diff --git a/queue-5.7/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch b/queue-5.7/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch new file mode 100644 index 00000000000..92a27d0a35f --- /dev/null +++ b/queue-5.7/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch @@ -0,0 +1,32 @@ +From e7585db1b0b5b4e4eb1967bb1472df308f7ffcbf Mon Sep 17 00:00:00 2001 +From: Laurence Tratt +Date: Fri, 12 Jun 2020 12:18:07 +0100 +Subject: ALSA: usb-audio: Add implicit feedback quirk for SSL2+. + +From: Laurence Tratt + +commit e7585db1b0b5b4e4eb1967bb1472df308f7ffcbf upstream. + +This uses the same quirk as the Motu M2 and M4 to ensure the driver uses the +audio interface's clock. Tested on an SSL2+. + +Signed-off-by: Laurence Tratt +Cc: +Link: https://lore.kernel.org/r/20200612111807.dgnig6rwhmsl2bod@overdrive.tratt.net +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/pcm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -367,6 +367,7 @@ static int set_sync_ep_implicit_fb_quirk + ifnum = 0; + goto add_sync_ep_from_ifnum; + case USB_ID(0x07fd, 0x0008): /* MOTU M Series */ ++ case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */ + ep = 0x81; + ifnum = 2; + goto add_sync_ep_from_ifnum; diff --git a/queue-5.7/alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch b/queue-5.7/alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch new file mode 100644 index 00000000000..be68f977a92 --- /dev/null +++ b/queue-5.7/alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch @@ -0,0 +1,39 @@ +From c9808bbfed3cfc911ecb60fe8e80c0c27876c657 Mon Sep 17 00:00:00 2001 +From: "Yick W. Tse" +Date: Sat, 13 Jun 2020 11:40:06 +0000 +Subject: ALSA: usb-audio: add quirk for Denon DCD-1500RE + +From: Yick W. Tse + +commit c9808bbfed3cfc911ecb60fe8e80c0c27876c657 upstream. + +fix error "clock source 41 is not valid, cannot use" + +[] New USB device found, idVendor=154e, idProduct=1002, bcdDevice= 1.00 +[] New USB device strings: Mfr=1, Product=2, SerialNumber=0 +[] Product: DCD-1500RE +[] Manufacturer: D & M Holdings Inc. +[] +[] clock source 41 is not valid, cannot use +[] usbcore: registered new interface driver snd-usb-audio + +Signed-off-by: Yick W. Tse +Cc: +Link: https://lore.kernel.org/r/1373857985.210365.1592048406997@mail.yahoo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1505,6 +1505,7 @@ bool snd_usb_get_sample_rate_quirk(struc + static bool is_itf_usb_dsd_dac(unsigned int id) + { + switch (id) { ++ case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */ + case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */ + case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */ + case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */ diff --git a/queue-5.7/alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch b/queue-5.7/alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch new file mode 100644 index 00000000000..0aafcce161d --- /dev/null +++ b/queue-5.7/alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch @@ -0,0 +1,41 @@ +From a32a1fc99807244d920d274adc46ba04b538cc8a Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Tue, 23 Jun 2020 19:03:23 +0800 +Subject: ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG) + +From: Macpaul Lin + +commit a32a1fc99807244d920d274adc46ba04b538cc8a upstream. + +We've found Samsung USBC Headset (AKG) (VID: 0x04e8, PID: 0xa051) +need a tiny delay after each class compliant request. +Otherwise the device might not be able to be recognized each times. + +Signed-off-by: Chihhao Chen +Signed-off-by: Macpaul Lin +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1592910203-24035-1-git-send-email-macpaul.lin@mediatek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1647,6 +1647,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de + chip->usb_id == USB_ID(0x0951, 0x16ad)) && + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + usleep_range(1000, 2000); ++ ++ /* ++ * Samsung USBC Headset (AKG) need a tiny delay after each ++ * class compliant request. (Model number: AAM625R or AAM627R) ++ */ ++ if (chip->usb_id == USB_ID(0x04e8, 0xa051) && ++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) ++ usleep_range(5000, 6000); + } + + /* diff --git a/queue-5.7/alsa-usb-audio-add-registration-quirk-for-kingston-hyperx-cloud-flight-s.patch b/queue-5.7/alsa-usb-audio-add-registration-quirk-for-kingston-hyperx-cloud-flight-s.patch new file mode 100644 index 00000000000..8711aa70044 --- /dev/null +++ b/queue-5.7/alsa-usb-audio-add-registration-quirk-for-kingston-hyperx-cloud-flight-s.patch @@ -0,0 +1,34 @@ +From 73094608b8e214952444fb104651704c98a37aeb Mon Sep 17 00:00:00 2001 +From: Christoffer Nielsen +Date: Fri, 19 Jun 2020 13:48:22 +0200 +Subject: ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S + +From: Christoffer Nielsen + +commit 73094608b8e214952444fb104651704c98a37aeb upstream. + +Similar to the Kingston HyperX AMP, the Kingston HyperX Cloud +Alpha S (0951:0x16ea) uses two interfaces, but only the second +interface contains the capture stream. This patch delays the +registration until the second interface appears. + +Signed-off-by: Christoffer Nielsen +Cc: +Link: https://lore.kernel.org/r/CAOtG2YHOM3zy+ed9KS-J4HkZo_QGzcUG9MigSp4e4_-13r6B=Q@mail.gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1844,6 +1844,7 @@ struct registration_quirk { + static const struct registration_quirk registration_quirks[] = { + REG_QUIRK_ENTRY(0x0951, 0x16d8, 2), /* Kingston HyperX AMP */ + REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */ ++ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ + { 0 } /* terminator */ + }; + diff --git a/queue-5.7/alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch b/queue-5.7/alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch new file mode 100644 index 00000000000..193a10e0ae3 --- /dev/null +++ b/queue-5.7/alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch @@ -0,0 +1,117 @@ +From 220345e98f1cdc768eeb6e3364a0fa7ab9647fe7 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 24 Jun 2020 14:23:40 +0200 +Subject: ALSA: usb-audio: Fix OOB access of mixer element list + +From: Takashi Iwai + +commit 220345e98f1cdc768eeb6e3364a0fa7ab9647fe7 upstream. + +The USB-audio mixer code holds a linked list of usb_mixer_elem_list, +and several operations are performed for each mixer element. A few of +them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2()) +assume each mixer element being a usb_mixer_elem_info object that is a +subclass of usb_mixer_elem_list, cast via container_of() and access it +members. This may result in an out-of-bound access when a +non-standard list element has been added, as spotted by syzkaller +recently. + +This patch adds a new field, is_std_info, in usb_mixer_elem_list to +indicate that the element is the usb_mixer_elem_info type or not, and +skip the access to such an element if needed. + +Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com +Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 15 +++++++++++---- + sound/usb/mixer.h | 9 +++++++-- + sound/usb/mixer_quirks.c | 3 ++- + 3 files changed, 20 insertions(+), 7 deletions(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -581,8 +581,9 @@ static int check_matrix_bitmap(unsigned + * if failed, give up and free the control instance. + */ + +-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, +- struct snd_kcontrol *kctl) ++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, ++ struct snd_kcontrol *kctl, ++ bool is_std_info) + { + struct usb_mixer_interface *mixer = list->mixer; + int err; +@@ -596,6 +597,7 @@ int snd_usb_mixer_add_control(struct usb + return err; + } + list->kctl = kctl; ++ list->is_std_info = is_std_info; + list->next_id_elem = mixer->id_elems[list->id]; + mixer->id_elems[list->id] = list; + return 0; +@@ -3234,8 +3236,11 @@ void snd_usb_mixer_notify_id(struct usb_ + unitid = delegate_notify(mixer, unitid, NULL, NULL); + + for_each_mixer_elem(list, mixer, unitid) { +- struct usb_mixer_elem_info *info = +- mixer_elem_list_to_info(list); ++ struct usb_mixer_elem_info *info; ++ ++ if (!list->is_std_info) ++ continue; ++ info = mixer_elem_list_to_info(list); + /* invalidate cache, so the value is read from the device */ + info->cached = 0; + snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, +@@ -3315,6 +3320,8 @@ static void snd_usb_mixer_interrupt_v2(s + + if (!list->kctl) + continue; ++ if (!list->is_std_info) ++ continue; + + info = mixer_elem_list_to_info(list); + if (count > 1 && info->control != control) +--- a/sound/usb/mixer.h ++++ b/sound/usb/mixer.h +@@ -66,6 +66,7 @@ struct usb_mixer_elem_list { + struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */ + struct snd_kcontrol *kctl; + unsigned int id; ++ bool is_std_info; + usb_mixer_elem_dump_func_t dump; + usb_mixer_elem_resume_func_t resume; + }; +@@ -103,8 +104,12 @@ void snd_usb_mixer_notify_id(struct usb_ + int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval, + int request, int validx, int value_set); + +-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, +- struct snd_kcontrol *kctl); ++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, ++ struct snd_kcontrol *kctl, ++ bool is_std_info); ++ ++#define snd_usb_mixer_add_control(list, kctl) \ ++ snd_usb_mixer_add_list(list, kctl, true) + + void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list, + struct usb_mixer_interface *mixer, +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -158,7 +158,8 @@ static int add_single_ctl_with_resume(st + return -ENOMEM; + } + kctl->private_free = snd_usb_mixer_elem_free; +- return snd_usb_mixer_add_control(list, kctl); ++ /* don't use snd_usb_mixer_add_control() here, this is a special list element */ ++ return snd_usb_mixer_add_list(list, kctl, false); + } + + /* diff --git a/queue-5.7/alsa-usb-audio-set-48-khz-rate-for-rodecaster.patch b/queue-5.7/alsa-usb-audio-set-48-khz-rate-for-rodecaster.patch new file mode 100644 index 00000000000..efe944be860 --- /dev/null +++ b/queue-5.7/alsa-usb-audio-set-48-khz-rate-for-rodecaster.patch @@ -0,0 +1,47 @@ +From 8abf41dcd1bcdda0d09905fb59d18f45c035c752 Mon Sep 17 00:00:00 2001 +From: Christopher Swenson +Date: Sun, 14 Jun 2020 17:11:47 -0700 +Subject: ALSA: usb-audio: Set 48 kHz rate for Rodecaster + +From: Christopher Swenson + +commit 8abf41dcd1bcdda0d09905fb59d18f45c035c752 upstream. + +Like the Line6 devices, the Rode Rodecaster Pro does not support +UAC2_CS_RANGE and only supports a sample rate of 48 kHz. + +Tested against a Rode Rodecaster Pro. + +Tested-by: Christopher Swenson +Signed-off-by: Christopher Swenson +Cc: +Link: https://lore.kernel.org/r/ebdb9e72-9649-0b5e-b9b9-d757dbf26927@swenson.io +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/format.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -394,8 +394,9 @@ skip_rate: + return nr_rates; + } + +-/* Line6 Helix series don't support the UAC2_CS_RANGE usb function +- * call. Return a static table of known clock rates. ++/* Line6 Helix series and the Rode Rodecaster Pro don't support the ++ * UAC2_CS_RANGE usb function call. Return a static table of known ++ * clock rates. + */ + static int line6_parse_audio_format_rates_quirk(struct snd_usb_audio *chip, + struct audioformat *fp) +@@ -408,6 +409,7 @@ static int line6_parse_audio_format_rate + case USB_ID(0x0e41, 0x4248): /* Line6 Helix >= fw 2.82 */ + case USB_ID(0x0e41, 0x4249): /* Line6 Helix Rack >= fw 2.82 */ + case USB_ID(0x0e41, 0x424a): /* Line6 Helix LT >= fw 2.82 */ ++ case USB_ID(0x19f7, 0x0011): /* Rode Rodecaster Pro */ + return set_fixed_rate(fp, 48000, SNDRV_PCM_RATE_48000); + } + diff --git a/queue-5.7/binder-fix-null-deref-of-proc-context.patch b/queue-5.7/binder-fix-null-deref-of-proc-context.patch new file mode 100644 index 00000000000..b38ae686b11 --- /dev/null +++ b/queue-5.7/binder-fix-null-deref-of-proc-context.patch @@ -0,0 +1,90 @@ +From d35d3660e065b69fdb8bf512f3d899f350afce52 Mon Sep 17 00:00:00 2001 +From: Todd Kjos +Date: Mon, 22 Jun 2020 13:07:15 -0700 +Subject: binder: fix null deref of proc->context + +From: Todd Kjos + +commit d35d3660e065b69fdb8bf512f3d899f350afce52 upstream. + +The binder driver makes the assumption proc->context pointer is invariant after +initialization (as documented in the kerneldoc header for struct proc). +However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II") +proc->context is set to NULL during binder_deferred_release(). + +Another proc was in the middle of setting up a transaction to the dying +process and crashed on a NULL pointer deref on "context" which is a local +set to &proc->context: + + new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1; + +Here's the stack: + +[ 5237.855435] Call trace: +[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec +[ 5237.855446] binder_inc_ref_for_node+0x140/0x280 +[ 5237.855451] binder_translate_binder+0x1d0/0x388 +[ 5237.855456] binder_transaction+0x2228/0x3730 +[ 5237.855461] binder_thread_write+0x640/0x25bc +[ 5237.855466] binder_ioctl_write_read+0xb0/0x464 +[ 5237.855471] binder_ioctl+0x30c/0x96c +[ 5237.855477] do_vfs_ioctl+0x3e0/0x700 +[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4 +[ 5237.855488] el0_svc_common+0xb4/0x194 +[ 5237.855493] el0_svc_handler+0x74/0x98 +[ 5237.855497] el0_svc+0x8/0xc + +The fix is to move the kfree of the binder_device to binder_free_proc() +so the binder_device is freed when we know there are no references +remaining on the binder_proc. + +Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II") +Acked-by: Christian Brauner +Signed-off-by: Todd Kjos +Cc: stable +Link: https://lore.kernel.org/r/20200622200715.114382-1-tkjos@google.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/android/binder.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4686,8 +4686,15 @@ static struct binder_thread *binder_get_ + + static void binder_free_proc(struct binder_proc *proc) + { ++ struct binder_device *device; ++ + BUG_ON(!list_empty(&proc->todo)); + BUG_ON(!list_empty(&proc->delivered_death)); ++ device = container_of(proc->context, struct binder_device, context); ++ if (refcount_dec_and_test(&device->ref)) { ++ kfree(proc->context->name); ++ kfree(device); ++ } + binder_alloc_deferred_release(&proc->alloc); + put_task_struct(proc->tsk); + binder_stats_deleted(BINDER_STAT_PROC); +@@ -5406,7 +5413,6 @@ static int binder_node_release(struct bi + static void binder_deferred_release(struct binder_proc *proc) + { + struct binder_context *context = proc->context; +- struct binder_device *device; + struct rb_node *n; + int threads, nodes, incoming_refs, outgoing_refs, active_transactions; + +@@ -5423,12 +5429,6 @@ static void binder_deferred_release(stru + context->binder_context_mgr_node = NULL; + } + mutex_unlock(&context->context_mgr_node_lock); +- device = container_of(proc->context, struct binder_device, context); +- if (refcount_dec_and_test(&device->ref)) { +- kfree(context->name); +- kfree(device); +- } +- proc->context = NULL; + binder_inner_proc_lock(proc); + /* + * Make sure proc stays alive after we diff --git a/queue-5.7/mei-me-add-tiger-lake-point-device-ids-for-h-platforms.patch b/queue-5.7/mei-me-add-tiger-lake-point-device-ids-for-h-platforms.patch new file mode 100644 index 00000000000..ee29efcd58b --- /dev/null +++ b/queue-5.7/mei-me-add-tiger-lake-point-device-ids-for-h-platforms.patch @@ -0,0 +1,92 @@ +From 8c289ea064165237891a7b4be77b74d5cba8fa99 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Fri, 19 Jun 2020 19:51:21 +0300 +Subject: mei: me: add tiger lake point device ids for H platforms. + +From: Alexander Usyskin + +commit 8c289ea064165237891a7b4be77b74d5cba8fa99 upstream. + +Add Tiger Lake device ids H for HECI1. +TGH_H is also used in Tatlow SPS platform we need to +disable the mei interface there. + +Cc: +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20200619165121.2145330-7-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hw-me-regs.h | 1 + + drivers/misc/mei/hw-me.c | 10 ++++++++++ + drivers/misc/mei/hw-me.h | 4 ++++ + drivers/misc/mei/pci-me.c | 1 + + 4 files changed, 16 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -94,6 +94,7 @@ + #define MEI_DEV_ID_JSP_N 0x4DE0 /* Jasper Lake Point N */ + + #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */ ++#define MEI_DEV_ID_TGP_H 0x43E0 /* Tiger Lake Point H */ + + #define MEI_DEV_ID_MCC 0x4B70 /* Mule Creek Canyon (EHL) */ + #define MEI_DEV_ID_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */ +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -1526,6 +1526,15 @@ static const struct mei_cfg mei_me_pch15 + MEI_CFG_TRC, + }; + ++/* Tiger Lake with quirk for SPS 5.0 and newer Firmware exclusion */ ++static const struct mei_cfg mei_me_pch15_sps_cfg = { ++ MEI_CFG_PCH8_HFS, ++ MEI_CFG_FW_VER_SUPP, ++ MEI_CFG_DMA_128, ++ MEI_CFG_TRC, ++ MEI_CFG_FW_SPS, ++}; ++ + /* + * mei_cfg_list - A list of platform platform specific configurations. + * Note: has to be synchronized with enum mei_cfg_idx. +@@ -1544,6 +1553,7 @@ static const struct mei_cfg *const mei_c + [MEI_ME_PCH12_SPS_CFG] = &mei_me_pch12_sps_cfg, + [MEI_ME_PCH12_SPS_NODMA_CFG] = &mei_me_pch12_nodma_sps_cfg, + [MEI_ME_PCH15_CFG] = &mei_me_pch15_cfg, ++ [MEI_ME_PCH15_SPS_CFG] = &mei_me_pch15_sps_cfg, + }; + + const struct mei_cfg *mei_me_get_cfg(kernel_ulong_t idx) +--- a/drivers/misc/mei/hw-me.h ++++ b/drivers/misc/mei/hw-me.h +@@ -87,6 +87,9 @@ struct mei_me_hw { + * servers platforms with quirk for + * SPS firmware exclusion. + * @MEI_ME_PCH15_CFG: Platform Controller Hub Gen15 and newer ++ * @MEI_ME_PCH15_SPS_CFG: Platform Controller Hub Gen15 and newer ++ * servers platforms with quirk for ++ * SPS firmware exclusion. + * @MEI_ME_NUM_CFG: Upper Sentinel. + */ + enum mei_cfg_idx { +@@ -103,6 +106,7 @@ enum mei_cfg_idx { + MEI_ME_PCH12_SPS_CFG, + MEI_ME_PCH12_SPS_NODMA_CFG, + MEI_ME_PCH15_CFG, ++ MEI_ME_PCH15_SPS_CFG, + MEI_ME_NUM_CFG, + }; + +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -96,6 +96,7 @@ static const struct pci_device_id mei_me + {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH15_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_H, MEI_ME_PCH15_SPS_CFG)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_JSP_N, MEI_ME_PCH15_CFG)}, + diff --git a/queue-5.7/mei-me-disable-mei-interface-on-mehlow-server-platforms.patch b/queue-5.7/mei-me-disable-mei-interface-on-mehlow-server-platforms.patch new file mode 100644 index 00000000000..4b66cfbd18e --- /dev/null +++ b/queue-5.7/mei-me-disable-mei-interface-on-mehlow-server-platforms.patch @@ -0,0 +1,220 @@ +From f76d77f50b343bc7f7d01e4c2771d43fb074f617 Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Fri, 19 Jun 2020 19:51:15 +0300 +Subject: mei: me: disable mei interface on Mehlow server platforms + +From: Tomas Winkler + +commit f76d77f50b343bc7f7d01e4c2771d43fb074f617 upstream. + +For SPS firmware versions 5.0 and newer the way detection has changed. +The detection is done now via PCI_CFG_HFS_3 register. +To prevent conflict the previous method will get sps_4 suffix +Disable both CNP_H and CNP_H_3 interfaces. CNP_H_3 requires +a separate configuration as it doesn't support DMA. + +Cc: +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20200619165121.2145330-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hw-me-regs.h | 2 + + drivers/misc/mei/hw-me.c | 60 +++++++++++++++++++++++++++++++++++++----- + drivers/misc/mei/hw-me.h | 13 ++++++--- + drivers/misc/mei/pci-me.c | 16 +++++------ + 4 files changed, 73 insertions(+), 18 deletions(-) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -107,6 +107,8 @@ + # define PCI_CFG_HFS_1_D0I3_MSK 0x80000000 + #define PCI_CFG_HFS_2 0x48 + #define PCI_CFG_HFS_3 0x60 ++# define PCI_CFG_HFS_3_FW_SKU_MSK 0x00000070 ++# define PCI_CFG_HFS_3_FW_SKU_SPS 0x00000060 + #define PCI_CFG_HFS_4 0x64 + #define PCI_CFG_HFS_5 0x68 + #define PCI_CFG_HFS_6 0x6C +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -1366,7 +1366,7 @@ static bool mei_me_fw_type_nm(struct pci + #define MEI_CFG_FW_NM \ + .quirk_probe = mei_me_fw_type_nm + +-static bool mei_me_fw_type_sps(struct pci_dev *pdev) ++static bool mei_me_fw_type_sps_4(struct pci_dev *pdev) + { + u32 reg; + unsigned int devfn; +@@ -1382,7 +1382,36 @@ static bool mei_me_fw_type_sps(struct pc + return (reg & 0xf0000) == 0xf0000; + } + +-#define MEI_CFG_FW_SPS \ ++#define MEI_CFG_FW_SPS_4 \ ++ .quirk_probe = mei_me_fw_type_sps_4 ++ ++/** ++ * mei_me_fw_sku_sps() - check for sps sku ++ * ++ * Read ME FW Status register to check for SPS Firmware. ++ * The SPS FW is only signaled in pci function 0 ++ * ++ * @pdev: pci device ++ * ++ * Return: true in case of SPS firmware ++ */ ++static bool mei_me_fw_type_sps(struct pci_dev *pdev) ++{ ++ u32 reg; ++ u32 fw_type; ++ unsigned int devfn; ++ ++ devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0); ++ pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_3, ®); ++ trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_3", PCI_CFG_HFS_3, reg); ++ fw_type = (reg & PCI_CFG_HFS_3_FW_SKU_MSK); ++ ++ dev_dbg(&pdev->dev, "fw type is %d\n", fw_type); ++ ++ return fw_type == PCI_CFG_HFS_3_FW_SKU_SPS; ++} ++ ++#define MEI_CFG_FW_SPS \ + .quirk_probe = mei_me_fw_type_sps + + #define MEI_CFG_FW_VER_SUPP \ +@@ -1452,10 +1481,17 @@ static const struct mei_cfg mei_me_pch8_ + }; + + /* PCH8 Lynx Point with quirk for SPS Firmware exclusion */ +-static const struct mei_cfg mei_me_pch8_sps_cfg = { ++static const struct mei_cfg mei_me_pch8_sps_4_cfg = { + MEI_CFG_PCH8_HFS, + MEI_CFG_FW_VER_SUPP, +- MEI_CFG_FW_SPS, ++ MEI_CFG_FW_SPS_4, ++}; ++ ++/* LBG with quirk for SPS (4.0) Firmware exclusion */ ++static const struct mei_cfg mei_me_pch12_sps_4_cfg = { ++ MEI_CFG_PCH8_HFS, ++ MEI_CFG_FW_VER_SUPP, ++ MEI_CFG_FW_SPS_4, + }; + + /* Cannon Lake and newer devices */ +@@ -1465,10 +1501,20 @@ static const struct mei_cfg mei_me_pch12 + MEI_CFG_DMA_128, + }; + +-/* LBG with quirk for SPS Firmware exclusion */ ++/* Cannon Lake with quirk for SPS 5.0 and newer Firmware exclusion */ + static const struct mei_cfg mei_me_pch12_sps_cfg = { + MEI_CFG_PCH8_HFS, + MEI_CFG_FW_VER_SUPP, ++ MEI_CFG_DMA_128, ++ MEI_CFG_FW_SPS, ++}; ++ ++/* Cannon Lake with quirk for SPS 5.0 and newer Firmware exclusion ++ * w/o DMA support ++ */ ++static const struct mei_cfg mei_me_pch12_nodma_sps_cfg = { ++ MEI_CFG_PCH8_HFS, ++ MEI_CFG_FW_VER_SUPP, + MEI_CFG_FW_SPS, + }; + +@@ -1492,9 +1538,11 @@ static const struct mei_cfg *const mei_c + [MEI_ME_PCH7_CFG] = &mei_me_pch7_cfg, + [MEI_ME_PCH_CPT_PBG_CFG] = &mei_me_pch_cpt_pbg_cfg, + [MEI_ME_PCH8_CFG] = &mei_me_pch8_cfg, +- [MEI_ME_PCH8_SPS_CFG] = &mei_me_pch8_sps_cfg, ++ [MEI_ME_PCH8_SPS_4_CFG] = &mei_me_pch8_sps_4_cfg, + [MEI_ME_PCH12_CFG] = &mei_me_pch12_cfg, ++ [MEI_ME_PCH12_SPS_4_CFG] = &mei_me_pch12_sps_4_cfg, + [MEI_ME_PCH12_SPS_CFG] = &mei_me_pch12_sps_cfg, ++ [MEI_ME_PCH12_SPS_NODMA_CFG] = &mei_me_pch12_nodma_sps_cfg, + [MEI_ME_PCH15_CFG] = &mei_me_pch15_cfg, + }; + +--- a/drivers/misc/mei/hw-me.h ++++ b/drivers/misc/mei/hw-me.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + /* +- * Copyright (c) 2012-2019, Intel Corporation. All rights reserved. ++ * Copyright (c) 2012-2020, Intel Corporation. All rights reserved. + * Intel Management Engine Interface (Intel MEI) Linux driver + */ + +@@ -76,11 +76,14 @@ struct mei_me_hw { + * with quirk for Node Manager exclusion. + * @MEI_ME_PCH8_CFG: Platform Controller Hub Gen8 and newer + * client platforms. +- * @MEI_ME_PCH8_SPS_CFG: Platform Controller Hub Gen8 and newer ++ * @MEI_ME_PCH8_SPS_4_CFG: Platform Controller Hub Gen8 and newer + * servers platforms with quirk for + * SPS firmware exclusion. + * @MEI_ME_PCH12_CFG: Platform Controller Hub Gen12 and newer +- * @MEI_ME_PCH12_SPS_CFG: Platform Controller Hub Gen12 and newer ++ * @MEI_ME_PCH12_SPS_4_CFG:Platform Controller Hub Gen12 up to 4.0 ++ * servers platforms with quirk for ++ * SPS firmware exclusion. ++ * @MEI_ME_PCH12_SPS_CFG: Platform Controller Hub Gen12 5.0 and newer + * servers platforms with quirk for + * SPS firmware exclusion. + * @MEI_ME_PCH15_CFG: Platform Controller Hub Gen15 and newer +@@ -94,9 +97,11 @@ enum mei_cfg_idx { + MEI_ME_PCH7_CFG, + MEI_ME_PCH_CPT_PBG_CFG, + MEI_ME_PCH8_CFG, +- MEI_ME_PCH8_SPS_CFG, ++ MEI_ME_PCH8_SPS_4_CFG, + MEI_ME_PCH12_CFG, ++ MEI_ME_PCH12_SPS_4_CFG, + MEI_ME_PCH12_SPS_CFG, ++ MEI_ME_PCH12_SPS_NODMA_CFG, + MEI_ME_PCH15_CFG, + MEI_ME_NUM_CFG, + }; +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -59,18 +59,18 @@ static const struct pci_device_id mei_me + {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH7_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH7_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH7_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_4_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_4_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_LP, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_HR, MEI_ME_PCH8_SPS_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_HR, MEI_ME_PCH8_SPS_4_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP, MEI_ME_PCH8_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP_2, MEI_ME_PCH8_CFG)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, MEI_ME_PCH8_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_SPS_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_4_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_4_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_SPS_4_CFG)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)}, +@@ -84,8 +84,8 @@ static const struct pci_device_id mei_me + + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH12_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_3, MEI_ME_PCH8_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_3, MEI_ME_PCH8_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_SPS_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_3, MEI_ME_PCH12_SPS_NODMA_CFG)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)}, diff --git a/queue-5.7/revert-usb-dwc3-exynos-add-support-for-exynos5422-suspend-clk.patch b/queue-5.7/revert-usb-dwc3-exynos-add-support-for-exynos5422-suspend-clk.patch new file mode 100644 index 00000000000..e16126f31b0 --- /dev/null +++ b/queue-5.7/revert-usb-dwc3-exynos-add-support-for-exynos5422-suspend-clk.patch @@ -0,0 +1,51 @@ +From ad38beb373a14e082f4e64b68c0b6e6b09764680 Mon Sep 17 00:00:00 2001 +From: Anand Moon +Date: Tue, 23 Jun 2020 07:46:37 +0000 +Subject: Revert "usb: dwc3: exynos: Add support for Exynos5422 suspend clk" + +From: Anand Moon + +commit ad38beb373a14e082f4e64b68c0b6e6b09764680 upstream. + +This reverts commit 07f6842341abe978e6375078f84506ec3280ece5. + +Since SCLK_SCLK_USBD300 suspend clock need to be configured +for phy module, I wrongly mapped this clock to DWC3 code. + +Cc: Felipe Balbi +Cc: Greg Kroah-Hartman +Signed-off-by: Anand Moon +Cc: stable +Fixes: 07f6842341ab ("usb: dwc3: exynos: Add support for Exynos5422 suspend clk") +Link: https://lore.kernel.org/r/20200623074637.756-1-linux.amoon@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-exynos.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-exynos.c ++++ b/drivers/usb/dwc3/dwc3-exynos.c +@@ -162,12 +162,6 @@ static const struct dwc3_exynos_driverda + .suspend_clk_idx = -1, + }; + +-static const struct dwc3_exynos_driverdata exynos5420_drvdata = { +- .clk_names = { "usbdrd30", "usbdrd30_susp_clk"}, +- .num_clks = 2, +- .suspend_clk_idx = 1, +-}; +- + static const struct dwc3_exynos_driverdata exynos5433_drvdata = { + .clk_names = { "aclk", "susp_clk", "pipe_pclk", "phyclk" }, + .num_clks = 4, +@@ -185,9 +179,6 @@ static const struct of_device_id exynos_ + .compatible = "samsung,exynos5250-dwusb3", + .data = &exynos5250_drvdata, + }, { +- .compatible = "samsung,exynos5420-dwusb3", +- .data = &exynos5420_drvdata, +- }, { + .compatible = "samsung,exynos5433-dwusb3", + .data = &exynos5433_drvdata, + }, { diff --git a/queue-5.7/series b/queue-5.7/series index 433c6adeb3a..9b5ae8f1fde 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -56,3 +56,25 @@ fix-a-braino-in-sparc32-fix-register-window-handling.patch alsa-usb-audio-fix-potential-use-after-free-of-strea.patch revert-i2c-tegra-fix-suspending-in-active-runtime-pm.patch btrfs-fix-a-block-group-ref-counter-leak-after-failu.patch +binder-fix-null-deref-of-proc-context.patch +mei-me-disable-mei-interface-on-mehlow-server-platforms.patch +mei-me-add-tiger-lake-point-device-ids-for-h-platforms.patch +revert-usb-dwc3-exynos-add-support-for-exynos5422-suspend-clk.patch +usb-ohci-sm501-add-missed-iounmap-in-remove.patch +usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch +usb-add-usb_quirk_delay_init-for-logitech-c922.patch +usb-ehci-reopen-solution-for-synopsys-hc-bug.patch +usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch +xhci-poll-for-u0-after-disabling-usb2-lpm.patch +usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch +usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch +usb-typec-mux-intel_pmc_mux-fix-dp-alternate-mode-entry.patch +alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch +alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch +alsa-usb-audio-set-48-khz-rate-for-rodecaster.patch +alsa-usb-audio-add-registration-quirk-for-kingston-hyperx-cloud-flight-s.patch +alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch +alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch +usb-cdns3-trace-using-correct-dir-value.patch +usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch +usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch diff --git a/queue-5.7/usb-add-usb_quirk_delay_init-for-logitech-c922.patch b/queue-5.7/usb-add-usb_quirk_delay_init-for-logitech-c922.patch new file mode 100644 index 00000000000..b1db9374e6a --- /dev/null +++ b/queue-5.7/usb-add-usb_quirk_delay_init-for-logitech-c922.patch @@ -0,0 +1,41 @@ +From 5d8021923e8a8cc37a421a64e27c7221f0fee33c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tomasz=20Meresi=C5=84ski?= +Date: Wed, 3 Jun 2020 22:33:46 +0200 +Subject: usb: add USB_QUIRK_DELAY_INIT for Logitech C922 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Meresiński + +commit 5d8021923e8a8cc37a421a64e27c7221f0fee33c upstream. + +The Logitech C922, just like other Logitech webcams, +needs the USB_QUIRK_DELAY_INIT or it will randomly +not respond after device connection + +Signed-off-by: Tomasz Meresiński +Cc: stable +Link: https://lore.kernel.org/r/20200603203347.7792-1-tomasz@meresinski.eu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -218,11 +218,12 @@ static const struct usb_device_id usb_qu + /* Logitech HD Webcam C270 */ + { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ ++ /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */ + { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Logitech ConferenceCam CC3000e */ + { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, diff --git a/queue-5.7/usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch b/queue-5.7/usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch new file mode 100644 index 00000000000..20befc41f59 --- /dev/null +++ b/queue-5.7/usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch @@ -0,0 +1,53 @@ +From 2587a029fa2a877d0a8dda955ef1b24c94b4bd0e Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 23 Jun 2020 11:09:18 +0800 +Subject: usb: cdns3: ep0: add spinlock for cdns3_check_new_setup + +From: Peter Chen + +commit 2587a029fa2a877d0a8dda955ef1b24c94b4bd0e upstream. + +The other thread may access other endpoints when the cdns3_check_new_setup +is handling, add spinlock to protect it. + +Cc: +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Reviewed-by: Pawel Laszczak +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/cdns3/ep0.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/usb/cdns3/ep0.c ++++ b/drivers/usb/cdns3/ep0.c +@@ -712,15 +712,17 @@ static int cdns3_gadget_ep0_queue(struct + int ret = 0; + u8 zlp = 0; + ++ spin_lock_irqsave(&priv_dev->lock, flags); + trace_cdns3_ep0_queue(priv_dev, request); + + /* cancel the request if controller receive new SETUP packet. */ +- if (cdns3_check_new_setup(priv_dev)) ++ if (cdns3_check_new_setup(priv_dev)) { ++ spin_unlock_irqrestore(&priv_dev->lock, flags); + return -ECONNRESET; ++ } + + /* send STATUS stage. Should be called only for SET_CONFIGURATION */ + if (priv_dev->ep0_stage == CDNS3_STATUS_STAGE) { +- spin_lock_irqsave(&priv_dev->lock, flags); + cdns3_select_ep(priv_dev, 0x00); + + erdy_sent = !priv_dev->hw_configured_flag; +@@ -745,7 +747,6 @@ static int cdns3_gadget_ep0_queue(struct + return 0; + } + +- spin_lock_irqsave(&priv_dev->lock, flags); + if (!list_empty(&priv_ep->pending_req_list)) { + dev_err(priv_dev->dev, + "can't handle multiple requests for ep0\n"); diff --git a/queue-5.7/usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch b/queue-5.7/usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch new file mode 100644 index 00000000000..1d105ae64d9 --- /dev/null +++ b/queue-5.7/usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch @@ -0,0 +1,35 @@ +From b51e1cf64f93acebb6d8afbacd648a6ecefc39b4 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 23 Jun 2020 11:09:16 +0800 +Subject: usb: cdns3: ep0: fix the test mode set incorrectly + +From: Peter Chen + +commit b51e1cf64f93acebb6d8afbacd648a6ecefc39b4 upstream. + +The 'tmode' is ctrl->wIndex, changing it as the real test +mode value for register assignment. + +Cc: +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Reviewed-by: Jun Li +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/cdns3/ep0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/cdns3/ep0.c ++++ b/drivers/usb/cdns3/ep0.c +@@ -327,7 +327,8 @@ static int cdns3_ep0_feature_handle_devi + if (!set || (tmode & 0xff) != 0) + return -EINVAL; + +- switch (tmode >> 8) { ++ tmode >>= 8; ++ switch (tmode) { + case TEST_J: + case TEST_K: + case TEST_SE0_NAK: diff --git a/queue-5.7/usb-cdns3-trace-using-correct-dir-value.patch b/queue-5.7/usb-cdns3-trace-using-correct-dir-value.patch new file mode 100644 index 00000000000..13c685fe25c --- /dev/null +++ b/queue-5.7/usb-cdns3-trace-using-correct-dir-value.patch @@ -0,0 +1,40 @@ +From ba3a80fe0fb67d8790f62b7bc60df97406d89871 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 23 Jun 2020 11:09:17 +0800 +Subject: usb: cdns3: trace: using correct dir value + +From: Peter Chen + +commit ba3a80fe0fb67d8790f62b7bc60df97406d89871 upstream. + +It should use the correct direction value from register, not depends +on previous software setting. It fixed the EP number wrong issue at +trace when the TRBERR interrupt occurs for EP0IN. + +When the EP0IN IOC has finished, software prepares the setup packet +request, the expected direction is OUT, but at that time, the TRBERR +for EP0IN may occur since it is DMULT mode, the DMA does not stop +until TRBERR has met. + +Cc: +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Reviewed-by: Pawel Laszczak +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/cdns3/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/cdns3/trace.h ++++ b/drivers/usb/cdns3/trace.h +@@ -156,7 +156,7 @@ DECLARE_EVENT_CLASS(cdns3_log_ep0_irq, + __dynamic_array(char, str, CDNS3_MSG_MAX) + ), + TP_fast_assign( +- __entry->ep_dir = priv_dev->ep0_data_dir; ++ __entry->ep_dir = priv_dev->selected_ep; + __entry->ep_sts = ep_sts; + ), + TP_printk("%s", cdns3_decode_ep0_irq(__get_str(str), diff --git a/queue-5.7/usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch b/queue-5.7/usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch new file mode 100644 index 00000000000..44f683bcf56 --- /dev/null +++ b/queue-5.7/usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch @@ -0,0 +1,62 @@ +From 207324a321a866401b098cadf19e4a2dd6584622 Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Tue, 9 Jun 2020 12:28:11 +0400 +Subject: usb: dwc2: Postponed gadget registration to the udc class driver + +From: Minas Harutyunyan + +commit 207324a321a866401b098cadf19e4a2dd6584622 upstream. + +During dwc2 driver probe, after gadget registration to the udc class +driver, if exist any builtin function driver it immediately bound to +dwc2 and after init host side (dwc2_hcd_init()) stucked in host mode. +Patch postpone gadget registration after host side initialization done. + +Fixes: 117777b2c3bb9 ("usb: dwc2: Move gadget probe function into platform code") +Reported-by: kbuild test robot +Tested-by: Marek Vasut +Cc: stable +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/f21cb38fecc72a230b86155d94c7e60c9cb66f58.1591690938.git.hminas@synopsys.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/gadget.c | 6 ------ + drivers/usb/dwc2/platform.c | 11 +++++++++++ + 2 files changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4920,12 +4920,6 @@ int dwc2_gadget_init(struct dwc2_hsotg * + epnum, 0); + } + +- ret = usb_add_gadget_udc(dev, &hsotg->gadget); +- if (ret) { +- dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, +- hsotg->ctrl_req); +- return ret; +- } + dwc2_hsotg_dump(hsotg); + + return 0; +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -536,6 +536,17 @@ static int dwc2_driver_probe(struct plat + if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) + dwc2_lowlevel_hw_disable(hsotg); + ++#if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \ ++ IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE) ++ /* Postponed adding a new gadget to the udc class driver list */ ++ if (hsotg->gadget_enabled) { ++ retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget); ++ if (retval) { ++ dwc2_hsotg_remove(hsotg); ++ goto error_init; ++ } ++ } ++#endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */ + return 0; + + error_init: diff --git a/queue-5.7/usb-ehci-reopen-solution-for-synopsys-hc-bug.patch b/queue-5.7/usb-ehci-reopen-solution-for-synopsys-hc-bug.patch new file mode 100644 index 00000000000..c8862cd0632 --- /dev/null +++ b/queue-5.7/usb-ehci-reopen-solution-for-synopsys-hc-bug.patch @@ -0,0 +1,58 @@ +From 1ddcb71a3edf0e1682b6e056158e4c4b00325f66 Mon Sep 17 00:00:00 2001 +From: Longfang Liu +Date: Mon, 8 Jun 2020 11:46:59 +0800 +Subject: USB: ehci: reopen solution for Synopsys HC bug +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Longfang Liu + +commit 1ddcb71a3edf0e1682b6e056158e4c4b00325f66 upstream. + +A Synopsys USB2.0 core used in Huawei Kunpeng920 SoC has a bug which +might cause the host controller not issuing ping. + +Bug description: +After indicating an Interrupt on Async Advance, the software uses the +doorbell mechanism to delete the Next Link queue head of the last +executed queue head. At this time, the host controller still references +the removed queue head(the queue head is NULL). NULL reference causes +the host controller to lose the USB device. + +Solution: +After deleting the Next Link queue head, when has_synopsys_hc_bug set +to 1，the software can write one of the valid queue head addresses to +the ASYNCLISTADDR register to allow the host controller to get +the valid queue head. in order to solve that problem, this patch set +the flag for Huawei Kunpeng920 + +There are detailed instructions and solutions in this patch: +commit 2f7ac6c19997 ("USB: ehci: add workaround for Synopsys HC bug") + +Signed-off-by: Longfang Liu +Cc: stable +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/1591588019-44284-1-git-send-email-liulongfang@huawei.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-pci.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -216,6 +216,13 @@ static int ehci_pci_setup(struct usb_hcd + ehci_info(ehci, "applying MosChip frame-index workaround\n"); + ehci->frame_index_bug = 1; + break; ++ case PCI_VENDOR_ID_HUAWEI: ++ /* Synopsys HC bug */ ++ if (pdev->device == 0xa239) { ++ ehci_info(ehci, "applying Synopsys HC workaround\n"); ++ ehci->has_synopsys_hc_bug = 1; ++ } ++ break; + } + + /* optional debug port, normally in the first BAR */ diff --git a/queue-5.7/usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch b/queue-5.7/usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch new file mode 100644 index 00000000000..9718bc8e901 --- /dev/null +++ b/queue-5.7/usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch @@ -0,0 +1,40 @@ +From 44ed240d62736ad29943ec01e41e194b96f7c5e9 Mon Sep 17 00:00:00 2001 +From: Tang Bin +Date: Tue, 2 Jun 2020 19:47:08 +0800 +Subject: usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() + +From: Tang Bin + +commit 44ed240d62736ad29943ec01e41e194b96f7c5e9 upstream. + +If the function platform_get_irq() failed, the negative value +returned will not be detected here. So fix error handling in +exynos_ehci_probe(). And when get irq failed, the function +platform_get_irq() logs an error message, so remove redundant +message here. + +Fixes: 1bcc5aa87f04 ("USB: Add initial S5P EHCI driver") +Cc: stable +Signed-off-by: Zhang Shengju +Signed-off-by: Tang Bin +Link: https://lore.kernel.org/r/20200602114708.28620-1-tangbin@cmss.chinamobile.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-exynos.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/ehci-exynos.c ++++ b/drivers/usb/host/ehci-exynos.c +@@ -203,9 +203,8 @@ static int exynos_ehci_probe(struct plat + hcd->rsrc_len = resource_size(res); + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- dev_err(&pdev->dev, "Failed to get IRQ\n"); +- err = -ENODEV; ++ if (irq < 0) { ++ err = irq; + goto fail_io; + } + diff --git a/queue-5.7/usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch b/queue-5.7/usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch new file mode 100644 index 00000000000..6db1291a1dc --- /dev/null +++ b/queue-5.7/usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch @@ -0,0 +1,46 @@ +From a24d5072e87457a14023ee1dd3fc8b1e76f899ef Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Wed, 24 Jun 2020 16:59:47 +0300 +Subject: usb: host: xhci-mtk: avoid runtime suspend when removing hcd + +From: Macpaul Lin + +commit a24d5072e87457a14023ee1dd3fc8b1e76f899ef upstream. + +When runtime suspend was enabled, runtime suspend might happen +when xhci is removing hcd. This might cause kernel panic when hcd +has been freed but runtime pm suspend related handle need to +reference it. + +Signed-off-by: Macpaul Lin +Reviewed-by: Chunfeng Yun +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200624135949.22611-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mtk.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-mtk.c ++++ b/drivers/usb/host/xhci-mtk.c +@@ -587,6 +587,9 @@ static int xhci_mtk_remove(struct platfo + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + struct usb_hcd *shared_hcd = xhci->shared_hcd; + ++ pm_runtime_put_noidle(&dev->dev); ++ pm_runtime_disable(&dev->dev); ++ + usb_remove_hcd(shared_hcd); + xhci->shared_hcd = NULL; + device_init_wakeup(&dev->dev, false); +@@ -597,8 +600,6 @@ static int xhci_mtk_remove(struct platfo + xhci_mtk_sch_exit(mtk); + xhci_mtk_clks_disable(mtk); + xhci_mtk_ldos_disable(mtk); +- pm_runtime_put_sync(&dev->dev); +- pm_runtime_disable(&dev->dev); + + return 0; + } diff --git a/queue-5.7/usb-ohci-sm501-add-missed-iounmap-in-remove.patch b/queue-5.7/usb-ohci-sm501-add-missed-iounmap-in-remove.patch new file mode 100644 index 00000000000..38f7d1c4b08 --- /dev/null +++ b/queue-5.7/usb-ohci-sm501-add-missed-iounmap-in-remove.patch @@ -0,0 +1,34 @@ +From 07c112fb09c86c0231f6ff0061a000ffe91c8eb9 Mon Sep 17 00:00:00 2001 +From: Chuhong Yuan +Date: Wed, 10 Jun 2020 10:48:44 +0800 +Subject: USB: ohci-sm501: Add missed iounmap() in remove + +From: Chuhong Yuan + +commit 07c112fb09c86c0231f6ff0061a000ffe91c8eb9 upstream. + +This driver misses calling iounmap() in remove to undo the ioremap() +called in probe. +Add the missed call to fix it. + +Fixes: f54aab6ebcec ("usb: ohci-sm501 driver") +Cc: stable +Signed-off-by: Chuhong Yuan +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20200610024844.3628408-1-hslester96@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ohci-sm501.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/ohci-sm501.c ++++ b/drivers/usb/host/ohci-sm501.c +@@ -191,6 +191,7 @@ static int ohci_hcd_sm501_drv_remove(str + struct resource *mem; + + usb_remove_hcd(hcd); ++ iounmap(hcd->regs); + release_mem_region(hcd->rsrc_start, hcd->rsrc_len); + usb_put_hcd(hcd); + mem = platform_get_resource(pdev, IORESOURCE_MEM, 1); diff --git a/queue-5.7/usb-typec-mux-intel_pmc_mux-fix-dp-alternate-mode-entry.patch b/queue-5.7/usb-typec-mux-intel_pmc_mux-fix-dp-alternate-mode-entry.patch new file mode 100644 index 00000000000..13c6a557044 --- /dev/null +++ b/queue-5.7/usb-typec-mux-intel_pmc_mux-fix-dp-alternate-mode-entry.patch @@ -0,0 +1,63 @@ +From 130206a88683d859f63ed6d4a56ab5c2b4930c8e Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Fri, 29 May 2020 16:17:53 +0300 +Subject: usb: typec: mux: intel_pmc_mux: Fix DP alternate mode entry + +From: Heikki Krogerus + +commit 130206a88683d859f63ed6d4a56ab5c2b4930c8e upstream. + +The PMC needs to be notified separately about HPD (hotplug +detected) signal being high after mode entry. There is a bit +"HPD High" in the Alternate Mode Request that the driver +already sets, but that bit is only valid when the +DisplayPort Alternate Mode is directly entered from +disconnected state. + +Fixes: 5c4edcdbcd97 ("usb: typec: mux: intel: Fix DP_HPD_LVL bit field") +Signed-off-by: Heikki Krogerus +Cc: stable +Tested-by: Prashant Malani +Link: https://lore.kernel.org/r/20200529131753.15587-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/mux/intel_pmc_mux.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/mux/intel_pmc_mux.c ++++ b/drivers/usb/typec/mux/intel_pmc_mux.c +@@ -129,7 +129,8 @@ pmc_usb_mux_dp_hpd(struct pmc_usb_port * + msg[0] = PMC_USB_DP_HPD; + msg[0] |= port->usb3_port << PMC_USB_MSG_USB3_PORT_SHIFT; + +- msg[1] = PMC_USB_DP_HPD_IRQ; ++ if (data->status & DP_STATUS_IRQ_HPD) ++ msg[1] = PMC_USB_DP_HPD_IRQ; + + if (data->status & DP_STATUS_HPD_STATE) + msg[1] |= PMC_USB_DP_HPD_LVL; +@@ -142,6 +143,7 @@ pmc_usb_mux_dp(struct pmc_usb_port *port + { + struct typec_displayport_data *data = state->data; + struct altmode_req req = { }; ++ int ret; + + if (data->status & DP_STATUS_IRQ_HPD) + return pmc_usb_mux_dp_hpd(port, state); +@@ -161,7 +163,14 @@ pmc_usb_mux_dp(struct pmc_usb_port *port + if (data->status & DP_STATUS_HPD_STATE) + req.mode_data |= PMC_USB_ALTMODE_HPD_HIGH; + +- return pmc_usb_command(port, (void *)&req, sizeof(req)); ++ ret = pmc_usb_command(port, (void *)&req, sizeof(req)); ++ if (ret) ++ return ret; ++ ++ if (data->status & DP_STATUS_HPD_STATE) ++ return pmc_usb_mux_dp_hpd(port, state); ++ ++ return 0; + } + + static int diff --git a/queue-5.7/usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch b/queue-5.7/usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch new file mode 100644 index 00000000000..a113b24b83a --- /dev/null +++ b/queue-5.7/usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch @@ -0,0 +1,85 @@ +From 302c570bf36e997d55ad0d60628a2feec76954a4 Mon Sep 17 00:00:00 2001 +From: Li Jun +Date: Thu, 4 Jun 2020 19:21:18 +0800 +Subject: usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs + +From: Li Jun + +commit 302c570bf36e997d55ad0d60628a2feec76954a4 upstream. + +John reported screaming irq caused by rt1711h when system boot[1], +this is because irq request is done before tcpci_register_port(), +so the chip->tcpci has not been setup, irq handler is entered but +can't do anything, this patch is to address this by moving the irq +request after tcpci_register_port(). + +[1] https://lore.kernel.org/linux-usb/20200530040157.31038-1-john.stultz@linaro.org + +Fixes: ce08eaeb6388 ("staging: typec: rt1711h typec chip driver") +Cc: stable # v4.18+ +Cc: John Stultz +Reported-and-tested-by: John Stultz +Reviewed-by: Guenter Roeck +Reviewed-by: Heikki Krogerus +Signed-off-by: Li Jun +Link: https://lore.kernel.org/r/20200604112118.38062-1-jun.li@nxp.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/tcpm/tcpci_rt1711h.c | 31 ++++++++++--------------------- + 1 file changed, 10 insertions(+), 21 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c ++++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c +@@ -179,26 +179,6 @@ out: + return tcpci_irq(chip->tcpci); + } + +-static int rt1711h_init_alert(struct rt1711h_chip *chip, +- struct i2c_client *client) +-{ +- int ret; +- +- /* Disable chip interrupts before requesting irq */ +- ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0); +- if (ret < 0) +- return ret; +- +- ret = devm_request_threaded_irq(chip->dev, client->irq, NULL, +- rt1711h_irq, +- IRQF_ONESHOT | IRQF_TRIGGER_LOW, +- dev_name(chip->dev), chip); +- if (ret < 0) +- return ret; +- enable_irq_wake(client->irq); +- return 0; +-} +- + static int rt1711h_sw_reset(struct rt1711h_chip *chip) + { + int ret; +@@ -260,7 +240,8 @@ static int rt1711h_probe(struct i2c_clie + if (ret < 0) + return ret; + +- ret = rt1711h_init_alert(chip, client); ++ /* Disable chip interrupts before requesting irq */ ++ ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0); + if (ret < 0) + return ret; + +@@ -271,6 +252,14 @@ static int rt1711h_probe(struct i2c_clie + if (IS_ERR_OR_NULL(chip->tcpci)) + return PTR_ERR(chip->tcpci); + ++ ret = devm_request_threaded_irq(chip->dev, client->irq, NULL, ++ rt1711h_irq, ++ IRQF_ONESHOT | IRQF_TRIGGER_LOW, ++ dev_name(chip->dev), chip); ++ if (ret < 0) ++ return ret; ++ enable_irq_wake(client->irq); ++ + return 0; + } + diff --git a/queue-5.7/xhci-poll-for-u0-after-disabling-usb2-lpm.patch b/queue-5.7/xhci-poll-for-u0-after-disabling-usb2-lpm.patch new file mode 100644 index 00000000000..4249a8bddb2 --- /dev/null +++ b/queue-5.7/xhci-poll-for-u0-after-disabling-usb2-lpm.patch @@ -0,0 +1,59 @@ +From b3d71abd135e6919ca0b6cab463738472653ddfb Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Wed, 24 Jun 2020 16:59:49 +0300 +Subject: xhci: Poll for U0 after disabling USB2 LPM + +From: Kai-Heng Feng + +commit b3d71abd135e6919ca0b6cab463738472653ddfb upstream. + +USB2 devices with LPM enabled may interrupt the system suspend: +[ 932.510475] usb 1-7: usb suspend, wakeup 0 +[ 932.510549] hub 1-0:1.0: hub_suspend +[ 932.510581] usb usb1: bus suspend, wakeup 0 +[ 932.510590] xhci_hcd 0000:00:14.0: port 9 not suspended +[ 932.510593] xhci_hcd 0000:00:14.0: port 8 not suspended +.. +[ 932.520323] xhci_hcd 0000:00:14.0: Port change event, 1-7, id 7, portsc: 0x400e03 +.. +[ 932.591405] PM: pci_pm_suspend(): hcd_pci_suspend+0x0/0x30 returns -16 +[ 932.591414] PM: dpm_run_callback(): pci_pm_suspend+0x0/0x160 returns -16 +[ 932.591418] PM: Device 0000:00:14.0 failed to suspend async: error -16 + +During system suspend, USB core will let HC suspends the device if it +doesn't have remote wakeup enabled and doesn't have any children. +However, from the log above we can see that the usb 1-7 doesn't get bus +suspended due to not in U0. After a while the port finished U2 -> U0 +transition, interrupts the suspend process. + +The observation is that after disabling LPM, port doesn't transit to U0 +immediately and can linger in U2. xHCI spec 4.23.5.2 states that the +maximum exit latency for USB2 LPM should be BESL + 10us. The BESL for +the affected device is advertised as 400us, which is still not enough +based on my testing result. + +So let's use the maximum permitted latency, 10000, to poll for U0 +status to solve the issue. + +Cc: stable@vger.kernel.org +Signed-off-by: Kai-Heng Feng +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200624135949.22611-6-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4471,6 +4471,9 @@ static int xhci_set_usb2_hardware_lpm(st + mutex_lock(hcd->bandwidth_mutex); + xhci_change_max_exit_latency(xhci, udev, 0); + mutex_unlock(hcd->bandwidth_mutex); ++ readl_poll_timeout(ports[port_num]->addr, pm_val, ++ (pm_val & PORT_PLS_MASK) == XDEV_U0, ++ 100, 10000); + return 0; + } + } -- 2.47.3