1 |
commit: e5d55becdd2596999153da64a1d206971545d1f0 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sun Sep 12 14:36:51 2021 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Sep 12 14:36:51 2021 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e5d55bec |
7 |
|
8 |
Linux patch 5.13.16 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1015_linux-5.13.16.patch | 1015 ++++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 1019 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index 19f95ee..640800f 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -103,6 +103,10 @@ Patch: 1014_linux-5.13.15.patch |
21 |
From: http://www.kernel.org |
22 |
Desc: Linux 5.13.15 |
23 |
|
24 |
+Patch: 1015_linux-5.13.16.patch |
25 |
+From: http://www.kernel.org |
26 |
+Desc: Linux 5.13.16 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1015_linux-5.13.16.patch b/1015_linux-5.13.16.patch |
33 |
new file mode 100644 |
34 |
index 0000000..51bd586 |
35 |
--- /dev/null |
36 |
+++ b/1015_linux-5.13.16.patch |
37 |
@@ -0,0 +1,1015 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index d0ea05957da61..cbb2f35baedbc 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,7 +1,7 @@ |
43 |
+ # SPDX-License-Identifier: GPL-2.0 |
44 |
+ VERSION = 5 |
45 |
+ PATCHLEVEL = 13 |
46 |
+-SUBLEVEL = 15 |
47 |
++SUBLEVEL = 16 |
48 |
+ EXTRAVERSION = |
49 |
+ NAME = Opossums on Parade |
50 |
+ |
51 |
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c |
52 |
+index b29657b76e3fa..798a6f73f8946 100644 |
53 |
+--- a/arch/x86/kernel/reboot.c |
54 |
++++ b/arch/x86/kernel/reboot.c |
55 |
+@@ -388,10 +388,11 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = { |
56 |
+ }, |
57 |
+ { /* Handle problems with rebooting on the OptiPlex 990. */ |
58 |
+ .callback = set_pci_reboot, |
59 |
+- .ident = "Dell OptiPlex 990", |
60 |
++ .ident = "Dell OptiPlex 990 BIOS A0x", |
61 |
+ .matches = { |
62 |
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), |
63 |
+ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"), |
64 |
++ DMI_MATCH(DMI_BIOS_VERSION, "A0"), |
65 |
+ }, |
66 |
+ }, |
67 |
+ { /* Handle problems with rebooting on Dell 300's */ |
68 |
+diff --git a/block/blk-core.c b/block/blk-core.c |
69 |
+index ce0125efbaa76..9dce692e25a22 100644 |
70 |
+--- a/block/blk-core.c |
71 |
++++ b/block/blk-core.c |
72 |
+@@ -122,7 +122,6 @@ void blk_rq_init(struct request_queue *q, struct request *rq) |
73 |
+ rq->internal_tag = BLK_MQ_NO_TAG; |
74 |
+ rq->start_time_ns = ktime_get_ns(); |
75 |
+ rq->part = NULL; |
76 |
+- refcount_set(&rq->ref, 1); |
77 |
+ blk_crypto_rq_set_defaults(rq); |
78 |
+ } |
79 |
+ EXPORT_SYMBOL(blk_rq_init); |
80 |
+diff --git a/block/blk-flush.c b/block/blk-flush.c |
81 |
+index 1002f6c581816..4201728bf3a5a 100644 |
82 |
+--- a/block/blk-flush.c |
83 |
++++ b/block/blk-flush.c |
84 |
+@@ -262,6 +262,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) |
85 |
+ spin_unlock_irqrestore(&fq->mq_flush_lock, flags); |
86 |
+ } |
87 |
+ |
88 |
++bool is_flush_rq(struct request *rq) |
89 |
++{ |
90 |
++ return rq->end_io == flush_end_io; |
91 |
++} |
92 |
++ |
93 |
+ /** |
94 |
+ * blk_kick_flush - consider issuing flush request |
95 |
+ * @q: request_queue being kicked |
96 |
+@@ -329,6 +334,14 @@ static void blk_kick_flush(struct request_queue *q, struct blk_flush_queue *fq, |
97 |
+ flush_rq->rq_flags |= RQF_FLUSH_SEQ; |
98 |
+ flush_rq->rq_disk = first_rq->rq_disk; |
99 |
+ flush_rq->end_io = flush_end_io; |
100 |
++ /* |
101 |
++ * Order WRITE ->end_io and WRITE rq->ref, and its pair is the one |
102 |
++ * implied in refcount_inc_not_zero() called from |
103 |
++ * blk_mq_find_and_get_req(), which orders WRITE/READ flush_rq->ref |
104 |
++ * and READ flush_rq->end_io |
105 |
++ */ |
106 |
++ smp_wmb(); |
107 |
++ refcount_set(&flush_rq->ref, 1); |
108 |
+ |
109 |
+ blk_flush_queue_rq(flush_rq, false); |
110 |
+ } |
111 |
+diff --git a/block/blk-mq.c b/block/blk-mq.c |
112 |
+index 6dfa572ac1fc1..74fde07721e88 100644 |
113 |
+--- a/block/blk-mq.c |
114 |
++++ b/block/blk-mq.c |
115 |
+@@ -911,7 +911,7 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next) |
116 |
+ |
117 |
+ void blk_mq_put_rq_ref(struct request *rq) |
118 |
+ { |
119 |
+- if (is_flush_rq(rq, rq->mq_hctx)) |
120 |
++ if (is_flush_rq(rq)) |
121 |
+ rq->end_io(rq, 0); |
122 |
+ else if (refcount_dec_and_test(&rq->ref)) |
123 |
+ __blk_mq_free_request(rq); |
124 |
+@@ -2620,16 +2620,49 @@ static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) |
125 |
+ &hctx->cpuhp_dead); |
126 |
+ } |
127 |
+ |
128 |
++/* |
129 |
++ * Before freeing hw queue, clearing the flush request reference in |
130 |
++ * tags->rqs[] for avoiding potential UAF. |
131 |
++ */ |
132 |
++static void blk_mq_clear_flush_rq_mapping(struct blk_mq_tags *tags, |
133 |
++ unsigned int queue_depth, struct request *flush_rq) |
134 |
++{ |
135 |
++ int i; |
136 |
++ unsigned long flags; |
137 |
++ |
138 |
++ /* The hw queue may not be mapped yet */ |
139 |
++ if (!tags) |
140 |
++ return; |
141 |
++ |
142 |
++ WARN_ON_ONCE(refcount_read(&flush_rq->ref) != 0); |
143 |
++ |
144 |
++ for (i = 0; i < queue_depth; i++) |
145 |
++ cmpxchg(&tags->rqs[i], flush_rq, NULL); |
146 |
++ |
147 |
++ /* |
148 |
++ * Wait until all pending iteration is done. |
149 |
++ * |
150 |
++ * Request reference is cleared and it is guaranteed to be observed |
151 |
++ * after the ->lock is released. |
152 |
++ */ |
153 |
++ spin_lock_irqsave(&tags->lock, flags); |
154 |
++ spin_unlock_irqrestore(&tags->lock, flags); |
155 |
++} |
156 |
++ |
157 |
+ /* hctx->ctxs will be freed in queue's release handler */ |
158 |
+ static void blk_mq_exit_hctx(struct request_queue *q, |
159 |
+ struct blk_mq_tag_set *set, |
160 |
+ struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) |
161 |
+ { |
162 |
++ struct request *flush_rq = hctx->fq->flush_rq; |
163 |
++ |
164 |
+ if (blk_mq_hw_queue_mapped(hctx)) |
165 |
+ blk_mq_tag_idle(hctx); |
166 |
+ |
167 |
++ blk_mq_clear_flush_rq_mapping(set->tags[hctx_idx], |
168 |
++ set->queue_depth, flush_rq); |
169 |
+ if (set->ops->exit_request) |
170 |
+- set->ops->exit_request(set, hctx->fq->flush_rq, hctx_idx); |
171 |
++ set->ops->exit_request(set, flush_rq, hctx_idx); |
172 |
+ |
173 |
+ if (set->ops->exit_hctx) |
174 |
+ set->ops->exit_hctx(hctx, hctx_idx); |
175 |
+diff --git a/block/blk.h b/block/blk.h |
176 |
+index 8b3591aee0a5f..54d48987c21b2 100644 |
177 |
+--- a/block/blk.h |
178 |
++++ b/block/blk.h |
179 |
+@@ -44,11 +44,7 @@ static inline void __blk_get_queue(struct request_queue *q) |
180 |
+ kobject_get(&q->kobj); |
181 |
+ } |
182 |
+ |
183 |
+-static inline bool |
184 |
+-is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx) |
185 |
+-{ |
186 |
+- return hctx->fq->flush_rq == req; |
187 |
+-} |
188 |
++bool is_flush_rq(struct request *req); |
189 |
+ |
190 |
+ struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size, |
191 |
+ gfp_t flags); |
192 |
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c |
193 |
+index c6b48160343ab..9122f9cc97cbe 100644 |
194 |
+--- a/drivers/bluetooth/btusb.c |
195 |
++++ b/drivers/bluetooth/btusb.c |
196 |
+@@ -443,6 +443,10 @@ static const struct usb_device_id blacklist_table[] = { |
197 |
+ /* Additional Realtek 8822CE Bluetooth devices */ |
198 |
+ { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK | |
199 |
+ BTUSB_WIDEBAND_SPEECH }, |
200 |
++ /* Bluetooth component of Realtek 8852AE device */ |
201 |
++ { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK | |
202 |
++ BTUSB_WIDEBAND_SPEECH }, |
203 |
++ |
204 |
+ { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK | |
205 |
+ BTUSB_WIDEBAND_SPEECH }, |
206 |
+ { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK | |
207 |
+@@ -1886,7 +1890,7 @@ static int btusb_setup_csr(struct hci_dev *hdev) |
208 |
+ is_fake = true; |
209 |
+ |
210 |
+ if (is_fake) { |
211 |
+- bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds..."); |
212 |
++ bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once..."); |
213 |
+ |
214 |
+ /* Generally these clones have big discrepancies between |
215 |
+ * advertised features and what's actually supported. |
216 |
+@@ -1903,41 +1907,46 @@ static int btusb_setup_csr(struct hci_dev *hdev) |
217 |
+ clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); |
218 |
+ |
219 |
+ /* |
220 |
+- * Special workaround for clones with a Barrot 8041a02 chip, |
221 |
+- * these clones are really messed-up: |
222 |
+- * 1. Their bulk rx endpoint will never report any data unless |
223 |
+- * the device was suspended at least once (yes really). |
224 |
++ * Special workaround for these BT 4.0 chip clones, and potentially more: |
225 |
++ * |
226 |
++ * - 0x0134: a Barrot 8041a02 (HCI rev: 0x1012 sub: 0x0810) |
227 |
++ * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709) |
228 |
++ * |
229 |
++ * These controllers are really messed-up. |
230 |
++ * |
231 |
++ * 1. Their bulk RX endpoint will never report any data unless |
232 |
++ * the device was suspended at least once (yes, really). |
233 |
+ * 2. They will not wakeup when autosuspended and receiving data |
234 |
+- * on their bulk rx endpoint from e.g. a keyboard or mouse |
235 |
++ * on their bulk RX endpoint from e.g. a keyboard or mouse |
236 |
+ * (IOW remote-wakeup support is broken for the bulk endpoint). |
237 |
+ * |
238 |
+ * To fix 1. enable runtime-suspend, force-suspend the |
239 |
+- * hci and then wake-it up by disabling runtime-suspend. |
240 |
++ * HCI and then wake-it up by disabling runtime-suspend. |
241 |
+ * |
242 |
+- * To fix 2. clear the hci's can_wake flag, this way the hci |
243 |
++ * To fix 2. clear the HCI's can_wake flag, this way the HCI |
244 |
+ * will still be autosuspended when it is not open. |
245 |
++ * |
246 |
++ * -- |
247 |
++ * |
248 |
++ * Because these are widespread problems we prefer generic solutions; so |
249 |
++ * apply this initialization quirk to every controller that gets here, |
250 |
++ * it should be harmless. The alternative is to not work at all. |
251 |
+ */ |
252 |
+- if (bcdDevice == 0x8891 && |
253 |
+- le16_to_cpu(rp->lmp_subver) == 0x1012 && |
254 |
+- le16_to_cpu(rp->hci_rev) == 0x0810 && |
255 |
+- le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_4_0) { |
256 |
+- bt_dev_warn(hdev, "CSR: detected a fake CSR dongle using a Barrot 8041a02 chip, this chip is very buggy and may have issues"); |
257 |
++ pm_runtime_allow(&data->udev->dev); |
258 |
+ |
259 |
+- pm_runtime_allow(&data->udev->dev); |
260 |
++ ret = pm_runtime_suspend(&data->udev->dev); |
261 |
++ if (ret >= 0) |
262 |
++ msleep(200); |
263 |
++ else |
264 |
++ bt_dev_err(hdev, "CSR: Failed to suspend the device for our Barrot 8041a02 receive-issue workaround"); |
265 |
+ |
266 |
+- ret = pm_runtime_suspend(&data->udev->dev); |
267 |
+- if (ret >= 0) |
268 |
+- msleep(200); |
269 |
+- else |
270 |
+- bt_dev_err(hdev, "Failed to suspend the device for Barrot 8041a02 receive-issue workaround"); |
271 |
++ pm_runtime_forbid(&data->udev->dev); |
272 |
+ |
273 |
+- pm_runtime_forbid(&data->udev->dev); |
274 |
++ device_set_wakeup_capable(&data->udev->dev, false); |
275 |
+ |
276 |
+- device_set_wakeup_capable(&data->udev->dev, false); |
277 |
+- /* Re-enable autosuspend if this was requested */ |
278 |
+- if (enable_autosuspend) |
279 |
+- usb_enable_autosuspend(data->udev); |
280 |
+- } |
281 |
++ /* Re-enable autosuspend if this was requested */ |
282 |
++ if (enable_autosuspend) |
283 |
++ usb_enable_autosuspend(data->udev); |
284 |
+ } |
285 |
+ |
286 |
+ kfree_skb(skb); |
287 |
+diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c |
288 |
+index 4d5421d14a410..940ddf916202a 100644 |
289 |
+--- a/drivers/firmware/dmi-id.c |
290 |
++++ b/drivers/firmware/dmi-id.c |
291 |
+@@ -73,6 +73,10 @@ static void ascii_filter(char *d, const char *s) |
292 |
+ |
293 |
+ static ssize_t get_modalias(char *buffer, size_t buffer_size) |
294 |
+ { |
295 |
++ /* |
296 |
++ * Note new fields need to be added at the end to keep compatibility |
297 |
++ * with udev's hwdb which does matches on "`cat dmi/id/modalias`*". |
298 |
++ */ |
299 |
+ static const struct mafield { |
300 |
+ const char *prefix; |
301 |
+ int field; |
302 |
+@@ -85,13 +89,13 @@ static ssize_t get_modalias(char *buffer, size_t buffer_size) |
303 |
+ { "svn", DMI_SYS_VENDOR }, |
304 |
+ { "pn", DMI_PRODUCT_NAME }, |
305 |
+ { "pvr", DMI_PRODUCT_VERSION }, |
306 |
+- { "sku", DMI_PRODUCT_SKU }, |
307 |
+ { "rvn", DMI_BOARD_VENDOR }, |
308 |
+ { "rn", DMI_BOARD_NAME }, |
309 |
+ { "rvr", DMI_BOARD_VERSION }, |
310 |
+ { "cvn", DMI_CHASSIS_VENDOR }, |
311 |
+ { "ct", DMI_CHASSIS_TYPE }, |
312 |
+ { "cvr", DMI_CHASSIS_VERSION }, |
313 |
++ { "sku", DMI_PRODUCT_SKU }, |
314 |
+ { NULL, DMI_NONE } |
315 |
+ }; |
316 |
+ |
317 |
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c |
318 |
+index b8eb1b2a8de39..ffbae9b64dc5a 100644 |
319 |
+--- a/drivers/net/ethernet/realtek/r8169_main.c |
320 |
++++ b/drivers/net/ethernet/realtek/r8169_main.c |
321 |
+@@ -3510,6 +3510,7 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp) |
322 |
+ rtl_eri_write(tp, 0x1b0, ERIAR_MASK_0011, 0x0000); |
323 |
+ |
324 |
+ rtl_pcie_state_l2l3_disable(tp); |
325 |
++ rtl_hw_aspm_clkreq_enable(tp, true); |
326 |
+ } |
327 |
+ |
328 |
+ DECLARE_RTL_COND(rtl_mac_ocp_e00e_cond) |
329 |
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c |
330 |
+index 9a13953ea70fa..60a4f79b8fa19 100644 |
331 |
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c |
332 |
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c |
333 |
+@@ -942,10 +942,8 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) |
334 |
+ wmb(); |
335 |
+ lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */ |
336 |
+ |
337 |
+- if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) { |
338 |
+- netdev_info(ndev, "%s -> netif_stop_queue\n", __func__); |
339 |
++ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) |
340 |
+ netif_stop_queue(ndev); |
341 |
+- } |
342 |
+ |
343 |
+ return NETDEV_TX_OK; |
344 |
+ } |
345 |
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c |
346 |
+index ab3de1551b503..7b1c81b899cdf 100644 |
347 |
+--- a/drivers/pci/quirks.c |
348 |
++++ b/drivers/pci/quirks.c |
349 |
+@@ -3235,12 +3235,12 @@ static void fixup_mpss_256(struct pci_dev *dev) |
350 |
+ { |
351 |
+ dev->pcie_mpss = 1; /* 256 bytes */ |
352 |
+ } |
353 |
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, |
354 |
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); |
355 |
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, |
356 |
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); |
357 |
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, |
358 |
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); |
359 |
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, |
360 |
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); |
361 |
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, |
362 |
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); |
363 |
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, |
364 |
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); |
365 |
+ |
366 |
+ /* |
367 |
+ * Intel 5000 and 5100 Memory controllers have an erratum with read completion |
368 |
+diff --git a/drivers/usb/cdns3/cdnsp-mem.c b/drivers/usb/cdns3/cdnsp-mem.c |
369 |
+index 5d4c4bfe15b70..697a4e47c6427 100644 |
370 |
+--- a/drivers/usb/cdns3/cdnsp-mem.c |
371 |
++++ b/drivers/usb/cdns3/cdnsp-mem.c |
372 |
+@@ -882,7 +882,7 @@ static u32 cdnsp_get_endpoint_max_burst(struct usb_gadget *g, |
373 |
+ if (g->speed == USB_SPEED_HIGH && |
374 |
+ (usb_endpoint_xfer_isoc(pep->endpoint.desc) || |
375 |
+ usb_endpoint_xfer_int(pep->endpoint.desc))) |
376 |
+- return (usb_endpoint_maxp(pep->endpoint.desc) & 0x1800) >> 11; |
377 |
++ return usb_endpoint_maxp_mult(pep->endpoint.desc) - 1; |
378 |
+ |
379 |
+ return 0; |
380 |
+ } |
381 |
+diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c |
382 |
+index f3f112b08c9b1..57ee72fead45a 100644 |
383 |
+--- a/drivers/usb/gadget/udc/tegra-xudc.c |
384 |
++++ b/drivers/usb/gadget/udc/tegra-xudc.c |
385 |
+@@ -1610,7 +1610,7 @@ static void tegra_xudc_ep_context_setup(struct tegra_xudc_ep *ep) |
386 |
+ u16 maxpacket, maxburst = 0, esit = 0; |
387 |
+ u32 val; |
388 |
+ |
389 |
+- maxpacket = usb_endpoint_maxp(desc) & 0x7ff; |
390 |
++ maxpacket = usb_endpoint_maxp(desc); |
391 |
+ if (xudc->gadget.speed == USB_SPEED_SUPER) { |
392 |
+ if (!usb_endpoint_xfer_control(desc)) |
393 |
+ maxburst = comp_desc->bMaxBurst; |
394 |
+@@ -1621,7 +1621,7 @@ static void tegra_xudc_ep_context_setup(struct tegra_xudc_ep *ep) |
395 |
+ (usb_endpoint_xfer_int(desc) || |
396 |
+ usb_endpoint_xfer_isoc(desc))) { |
397 |
+ if (xudc->gadget.speed == USB_SPEED_HIGH) { |
398 |
+- maxburst = (usb_endpoint_maxp(desc) >> 11) & 0x3; |
399 |
++ maxburst = usb_endpoint_maxp_mult(desc) - 1; |
400 |
+ if (maxburst == 0x3) { |
401 |
+ dev_warn(xudc->dev, |
402 |
+ "invalid endpoint maxburst\n"); |
403 |
+diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c |
404 |
+index 2c0fda57869e4..dc832ddf7033f 100644 |
405 |
+--- a/drivers/usb/host/xhci-debugfs.c |
406 |
++++ b/drivers/usb/host/xhci-debugfs.c |
407 |
+@@ -198,12 +198,13 @@ static void xhci_ring_dump_segment(struct seq_file *s, |
408 |
+ int i; |
409 |
+ dma_addr_t dma; |
410 |
+ union xhci_trb *trb; |
411 |
++ char str[XHCI_MSG_MAX]; |
412 |
+ |
413 |
+ for (i = 0; i < TRBS_PER_SEGMENT; i++) { |
414 |
+ trb = &seg->trbs[i]; |
415 |
+ dma = seg->dma + i * sizeof(*trb); |
416 |
+ seq_printf(s, "%pad: %s\n", &dma, |
417 |
+- xhci_decode_trb(le32_to_cpu(trb->generic.field[0]), |
418 |
++ xhci_decode_trb(str, XHCI_MSG_MAX, le32_to_cpu(trb->generic.field[0]), |
419 |
+ le32_to_cpu(trb->generic.field[1]), |
420 |
+ le32_to_cpu(trb->generic.field[2]), |
421 |
+ le32_to_cpu(trb->generic.field[3]))); |
422 |
+@@ -260,11 +261,13 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused) |
423 |
+ struct xhci_slot_ctx *slot_ctx; |
424 |
+ struct xhci_slot_priv *priv = s->private; |
425 |
+ struct xhci_virt_device *dev = priv->dev; |
426 |
++ char str[XHCI_MSG_MAX]; |
427 |
+ |
428 |
+ xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus)); |
429 |
+ slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx); |
430 |
+ seq_printf(s, "%pad: %s\n", &dev->out_ctx->dma, |
431 |
+- xhci_decode_slot_context(le32_to_cpu(slot_ctx->dev_info), |
432 |
++ xhci_decode_slot_context(str, |
433 |
++ le32_to_cpu(slot_ctx->dev_info), |
434 |
+ le32_to_cpu(slot_ctx->dev_info2), |
435 |
+ le32_to_cpu(slot_ctx->tt_info), |
436 |
+ le32_to_cpu(slot_ctx->dev_state))); |
437 |
+@@ -280,6 +283,7 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused) |
438 |
+ struct xhci_ep_ctx *ep_ctx; |
439 |
+ struct xhci_slot_priv *priv = s->private; |
440 |
+ struct xhci_virt_device *dev = priv->dev; |
441 |
++ char str[XHCI_MSG_MAX]; |
442 |
+ |
443 |
+ xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus)); |
444 |
+ |
445 |
+@@ -287,7 +291,8 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused) |
446 |
+ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index); |
447 |
+ dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params); |
448 |
+ seq_printf(s, "%pad: %s\n", &dma, |
449 |
+- xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info), |
450 |
++ xhci_decode_ep_context(str, |
451 |
++ le32_to_cpu(ep_ctx->ep_info), |
452 |
+ le32_to_cpu(ep_ctx->ep_info2), |
453 |
+ le64_to_cpu(ep_ctx->deq), |
454 |
+ le32_to_cpu(ep_ctx->tx_info))); |
455 |
+@@ -341,9 +346,10 @@ static int xhci_portsc_show(struct seq_file *s, void *unused) |
456 |
+ { |
457 |
+ struct xhci_port *port = s->private; |
458 |
+ u32 portsc; |
459 |
++ char str[XHCI_MSG_MAX]; |
460 |
+ |
461 |
+ portsc = readl(port->addr); |
462 |
+- seq_printf(s, "%s\n", xhci_decode_portsc(portsc)); |
463 |
++ seq_printf(s, "%s\n", xhci_decode_portsc(str, portsc)); |
464 |
+ |
465 |
+ return 0; |
466 |
+ } |
467 |
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c |
468 |
+index 8b90da5a6ed19..5e003baabac91 100644 |
469 |
+--- a/drivers/usb/host/xhci-mtk-sch.c |
470 |
++++ b/drivers/usb/host/xhci-mtk-sch.c |
471 |
+@@ -590,10 +590,12 @@ static u32 get_esit_boundary(struct mu3h_sch_ep_info *sch_ep) |
472 |
+ u32 boundary = sch_ep->esit; |
473 |
+ |
474 |
+ if (sch_ep->sch_tt) { /* LS/FS with TT */ |
475 |
+- /* tune for CS */ |
476 |
+- if (sch_ep->ep_type != ISOC_OUT_EP) |
477 |
+- boundary++; |
478 |
+- else if (boundary > 1) /* normally esit >= 8 for FS/LS */ |
479 |
++ /* |
480 |
++ * tune for CS, normally esit >= 8 for FS/LS, |
481 |
++ * not add one for other types to avoid access array |
482 |
++ * out of boundary |
483 |
++ */ |
484 |
++ if (sch_ep->ep_type == ISOC_OUT_EP && boundary > 1) |
485 |
+ boundary--; |
486 |
+ } |
487 |
+ |
488 |
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c |
489 |
+index 1bc4fe7b8c756..9888ba7d85b6a 100644 |
490 |
+--- a/drivers/usb/host/xhci-rcar.c |
491 |
++++ b/drivers/usb/host/xhci-rcar.c |
492 |
+@@ -134,6 +134,13 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd) |
493 |
+ const struct soc_device_attribute *attr; |
494 |
+ const char *firmware_name; |
495 |
+ |
496 |
++ /* |
497 |
++ * According to the datasheet, "Upon the completion of FW Download, |
498 |
++ * there is no need to write or reload FW". |
499 |
++ */ |
500 |
++ if (readl(regs + RCAR_USB3_DL_CTRL) & RCAR_USB3_DL_CTRL_FW_SUCCESS) |
501 |
++ return 0; |
502 |
++ |
503 |
+ attr = soc_device_match(rcar_quirks_match); |
504 |
+ if (attr) |
505 |
+ quirks = (uintptr_t)attr->data; |
506 |
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c |
507 |
+index 6acd2329e08d4..5b54a3622c39c 100644 |
508 |
+--- a/drivers/usb/host/xhci-ring.c |
509 |
++++ b/drivers/usb/host/xhci-ring.c |
510 |
+@@ -942,17 +942,21 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep) |
511 |
+ td->urb->stream_id); |
512 |
+ hw_deq &= ~0xf; |
513 |
+ |
514 |
+- if (td->cancel_status == TD_HALTED) { |
515 |
+- cached_td = td; |
516 |
+- } else if (trb_in_td(xhci, td->start_seg, td->first_trb, |
517 |
+- td->last_trb, hw_deq, false)) { |
518 |
++ if (td->cancel_status == TD_HALTED || |
519 |
++ trb_in_td(xhci, td->start_seg, td->first_trb, td->last_trb, hw_deq, false)) { |
520 |
+ switch (td->cancel_status) { |
521 |
+ case TD_CLEARED: /* TD is already no-op */ |
522 |
+ case TD_CLEARING_CACHE: /* set TR deq command already queued */ |
523 |
+ break; |
524 |
+ case TD_DIRTY: /* TD is cached, clear it */ |
525 |
+ case TD_HALTED: |
526 |
+- /* FIXME stream case, several stopped rings */ |
527 |
++ td->cancel_status = TD_CLEARING_CACHE; |
528 |
++ if (cached_td) |
529 |
++ /* FIXME stream case, several stopped rings */ |
530 |
++ xhci_dbg(xhci, |
531 |
++ "Move dq past stream %u URB %p instead of stream %u URB %p\n", |
532 |
++ td->urb->stream_id, td->urb, |
533 |
++ cached_td->urb->stream_id, cached_td->urb); |
534 |
+ cached_td = td; |
535 |
+ break; |
536 |
+ } |
537 |
+@@ -961,18 +965,24 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep) |
538 |
+ td->cancel_status = TD_CLEARED; |
539 |
+ } |
540 |
+ } |
541 |
+- if (cached_td) { |
542 |
+- cached_td->cancel_status = TD_CLEARING_CACHE; |
543 |
+ |
544 |
+- err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index, |
545 |
+- cached_td->urb->stream_id, |
546 |
+- cached_td); |
547 |
+- /* Failed to move past cached td, try just setting it noop */ |
548 |
+- if (err) { |
549 |
+- td_to_noop(xhci, ring, cached_td, false); |
550 |
+- cached_td->cancel_status = TD_CLEARED; |
551 |
++ /* If there's no need to move the dequeue pointer then we're done */ |
552 |
++ if (!cached_td) |
553 |
++ return 0; |
554 |
++ |
555 |
++ err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index, |
556 |
++ cached_td->urb->stream_id, |
557 |
++ cached_td); |
558 |
++ if (err) { |
559 |
++ /* Failed to move past cached td, just set cached TDs to no-op */ |
560 |
++ list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) { |
561 |
++ if (td->cancel_status != TD_CLEARING_CACHE) |
562 |
++ continue; |
563 |
++ xhci_dbg(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n", |
564 |
++ td->urb); |
565 |
++ td_to_noop(xhci, ring, td, false); |
566 |
++ td->cancel_status = TD_CLEARED; |
567 |
+ } |
568 |
+- cached_td = NULL; |
569 |
+ } |
570 |
+ return 0; |
571 |
+ } |
572 |
+@@ -1212,6 +1222,7 @@ void xhci_stop_endpoint_command_watchdog(struct timer_list *t) |
573 |
+ struct xhci_hcd *xhci = ep->xhci; |
574 |
+ unsigned long flags; |
575 |
+ u32 usbsts; |
576 |
++ char str[XHCI_MSG_MAX]; |
577 |
+ |
578 |
+ spin_lock_irqsave(&xhci->lock, flags); |
579 |
+ |
580 |
+@@ -1225,7 +1236,7 @@ void xhci_stop_endpoint_command_watchdog(struct timer_list *t) |
581 |
+ usbsts = readl(&xhci->op_regs->status); |
582 |
+ |
583 |
+ xhci_warn(xhci, "xHCI host not responding to stop endpoint command.\n"); |
584 |
+- xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(usbsts)); |
585 |
++ xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(str, usbsts)); |
586 |
+ |
587 |
+ ep->ep_state &= ~EP_STOP_CMD_PENDING; |
588 |
+ |
589 |
+diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h |
590 |
+index 627abd236dbe1..a5da020772977 100644 |
591 |
+--- a/drivers/usb/host/xhci-trace.h |
592 |
++++ b/drivers/usb/host/xhci-trace.h |
593 |
+@@ -25,8 +25,6 @@ |
594 |
+ #include "xhci.h" |
595 |
+ #include "xhci-dbgcap.h" |
596 |
+ |
597 |
+-#define XHCI_MSG_MAX 500 |
598 |
+- |
599 |
+ DECLARE_EVENT_CLASS(xhci_log_msg, |
600 |
+ TP_PROTO(struct va_format *vaf), |
601 |
+ TP_ARGS(vaf), |
602 |
+@@ -122,6 +120,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb, |
603 |
+ __field(u32, field1) |
604 |
+ __field(u32, field2) |
605 |
+ __field(u32, field3) |
606 |
++ __dynamic_array(char, str, XHCI_MSG_MAX) |
607 |
+ ), |
608 |
+ TP_fast_assign( |
609 |
+ __entry->type = ring->type; |
610 |
+@@ -131,7 +130,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb, |
611 |
+ __entry->field3 = le32_to_cpu(trb->field[3]); |
612 |
+ ), |
613 |
+ TP_printk("%s: %s", xhci_ring_type_string(__entry->type), |
614 |
+- xhci_decode_trb(__entry->field0, __entry->field1, |
615 |
++ xhci_decode_trb(__get_str(str), XHCI_MSG_MAX, __entry->field0, __entry->field1, |
616 |
+ __entry->field2, __entry->field3) |
617 |
+ ) |
618 |
+ ); |
619 |
+@@ -323,6 +322,7 @@ DECLARE_EVENT_CLASS(xhci_log_ep_ctx, |
620 |
+ __field(u32, info2) |
621 |
+ __field(u64, deq) |
622 |
+ __field(u32, tx_info) |
623 |
++ __dynamic_array(char, str, XHCI_MSG_MAX) |
624 |
+ ), |
625 |
+ TP_fast_assign( |
626 |
+ __entry->info = le32_to_cpu(ctx->ep_info); |
627 |
+@@ -330,8 +330,8 @@ DECLARE_EVENT_CLASS(xhci_log_ep_ctx, |
628 |
+ __entry->deq = le64_to_cpu(ctx->deq); |
629 |
+ __entry->tx_info = le32_to_cpu(ctx->tx_info); |
630 |
+ ), |
631 |
+- TP_printk("%s", xhci_decode_ep_context(__entry->info, |
632 |
+- __entry->info2, __entry->deq, __entry->tx_info) |
633 |
++ TP_printk("%s", xhci_decode_ep_context(__get_str(str), |
634 |
++ __entry->info, __entry->info2, __entry->deq, __entry->tx_info) |
635 |
+ ) |
636 |
+ ); |
637 |
+ |
638 |
+@@ -368,6 +368,7 @@ DECLARE_EVENT_CLASS(xhci_log_slot_ctx, |
639 |
+ __field(u32, info2) |
640 |
+ __field(u32, tt_info) |
641 |
+ __field(u32, state) |
642 |
++ __dynamic_array(char, str, XHCI_MSG_MAX) |
643 |
+ ), |
644 |
+ TP_fast_assign( |
645 |
+ __entry->info = le32_to_cpu(ctx->dev_info); |
646 |
+@@ -375,9 +376,9 @@ DECLARE_EVENT_CLASS(xhci_log_slot_ctx, |
647 |
+ __entry->tt_info = le64_to_cpu(ctx->tt_info); |
648 |
+ __entry->state = le32_to_cpu(ctx->dev_state); |
649 |
+ ), |
650 |
+- TP_printk("%s", xhci_decode_slot_context(__entry->info, |
651 |
+- __entry->info2, __entry->tt_info, |
652 |
+- __entry->state) |
653 |
++ TP_printk("%s", xhci_decode_slot_context(__get_str(str), |
654 |
++ __entry->info, __entry->info2, |
655 |
++ __entry->tt_info, __entry->state) |
656 |
+ ) |
657 |
+ ); |
658 |
+ |
659 |
+@@ -432,12 +433,13 @@ DECLARE_EVENT_CLASS(xhci_log_ctrl_ctx, |
660 |
+ TP_STRUCT__entry( |
661 |
+ __field(u32, drop) |
662 |
+ __field(u32, add) |
663 |
++ __dynamic_array(char, str, XHCI_MSG_MAX) |
664 |
+ ), |
665 |
+ TP_fast_assign( |
666 |
+ __entry->drop = le32_to_cpu(ctrl_ctx->drop_flags); |
667 |
+ __entry->add = le32_to_cpu(ctrl_ctx->add_flags); |
668 |
+ ), |
669 |
+- TP_printk("%s", xhci_decode_ctrl_ctx(__entry->drop, __entry->add) |
670 |
++ TP_printk("%s", xhci_decode_ctrl_ctx(__get_str(str), __entry->drop, __entry->add) |
671 |
+ ) |
672 |
+ ); |
673 |
+ |
674 |
+@@ -523,6 +525,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc, |
675 |
+ TP_STRUCT__entry( |
676 |
+ __field(u32, portnum) |
677 |
+ __field(u32, portsc) |
678 |
++ __dynamic_array(char, str, XHCI_MSG_MAX) |
679 |
+ ), |
680 |
+ TP_fast_assign( |
681 |
+ __entry->portnum = portnum; |
682 |
+@@ -530,7 +533,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc, |
683 |
+ ), |
684 |
+ TP_printk("port-%d: %s", |
685 |
+ __entry->portnum, |
686 |
+- xhci_decode_portsc(__entry->portsc) |
687 |
++ xhci_decode_portsc(__get_str(str), __entry->portsc) |
688 |
+ ) |
689 |
+ ); |
690 |
+ |
691 |
+@@ -555,13 +558,14 @@ DECLARE_EVENT_CLASS(xhci_log_doorbell, |
692 |
+ TP_STRUCT__entry( |
693 |
+ __field(u32, slot) |
694 |
+ __field(u32, doorbell) |
695 |
++ __dynamic_array(char, str, XHCI_MSG_MAX) |
696 |
+ ), |
697 |
+ TP_fast_assign( |
698 |
+ __entry->slot = slot; |
699 |
+ __entry->doorbell = doorbell; |
700 |
+ ), |
701 |
+ TP_printk("Ring doorbell for %s", |
702 |
+- xhci_decode_doorbell(__entry->slot, __entry->doorbell) |
703 |
++ xhci_decode_doorbell(__get_str(str), __entry->slot, __entry->doorbell) |
704 |
+ ) |
705 |
+ ); |
706 |
+ |
707 |
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h |
708 |
+index e417f5ce13d18..528cdac532690 100644 |
709 |
+--- a/drivers/usb/host/xhci.h |
710 |
++++ b/drivers/usb/host/xhci.h |
711 |
+@@ -22,6 +22,9 @@ |
712 |
+ #include "xhci-ext-caps.h" |
713 |
+ #include "pci-quirks.h" |
714 |
+ |
715 |
++/* max buffer size for trace and debug messages */ |
716 |
++#define XHCI_MSG_MAX 500 |
717 |
++ |
718 |
+ /* xHCI PCI Configuration Registers */ |
719 |
+ #define XHCI_SBRN_OFFSET (0x60) |
720 |
+ |
721 |
+@@ -2232,15 +2235,14 @@ static inline char *xhci_slot_state_string(u32 state) |
722 |
+ } |
723 |
+ } |
724 |
+ |
725 |
+-static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
726 |
+- u32 field3) |
727 |
++static inline const char *xhci_decode_trb(char *str, size_t size, |
728 |
++ u32 field0, u32 field1, u32 field2, u32 field3) |
729 |
+ { |
730 |
+- static char str[256]; |
731 |
+ int type = TRB_FIELD_TO_TYPE(field3); |
732 |
+ |
733 |
+ switch (type) { |
734 |
+ case TRB_LINK: |
735 |
+- sprintf(str, |
736 |
++ snprintf(str, size, |
737 |
+ "LINK %08x%08x intr %d type '%s' flags %c:%c:%c:%c", |
738 |
+ field1, field0, GET_INTR_TARGET(field2), |
739 |
+ xhci_trb_type_string(type), |
740 |
+@@ -2257,7 +2259,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
741 |
+ case TRB_HC_EVENT: |
742 |
+ case TRB_DEV_NOTE: |
743 |
+ case TRB_MFINDEX_WRAP: |
744 |
+- sprintf(str, |
745 |
++ snprintf(str, size, |
746 |
+ "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", |
747 |
+ field1, field0, |
748 |
+ xhci_trb_comp_code_string(GET_COMP_CODE(field2)), |
749 |
+@@ -2270,7 +2272,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
750 |
+ |
751 |
+ break; |
752 |
+ case TRB_SETUP: |
753 |
+- sprintf(str, "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", |
754 |
++ snprintf(str, size, |
755 |
++ "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", |
756 |
+ field0 & 0xff, |
757 |
+ (field0 & 0xff00) >> 8, |
758 |
+ (field0 & 0xff000000) >> 24, |
759 |
+@@ -2287,7 +2290,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
760 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
761 |
+ break; |
762 |
+ case TRB_DATA: |
763 |
+- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", |
764 |
++ snprintf(str, size, |
765 |
++ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", |
766 |
+ field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), |
767 |
+ GET_INTR_TARGET(field2), |
768 |
+ xhci_trb_type_string(type), |
769 |
+@@ -2300,7 +2304,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
770 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
771 |
+ break; |
772 |
+ case TRB_STATUS: |
773 |
+- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", |
774 |
++ snprintf(str, size, |
775 |
++ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", |
776 |
+ field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), |
777 |
+ GET_INTR_TARGET(field2), |
778 |
+ xhci_trb_type_string(type), |
779 |
+@@ -2313,7 +2318,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
780 |
+ case TRB_ISOC: |
781 |
+ case TRB_EVENT_DATA: |
782 |
+ case TRB_TR_NOOP: |
783 |
+- sprintf(str, |
784 |
++ snprintf(str, size, |
785 |
+ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", |
786 |
+ field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), |
787 |
+ GET_INTR_TARGET(field2), |
788 |
+@@ -2330,21 +2335,21 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
789 |
+ |
790 |
+ case TRB_CMD_NOOP: |
791 |
+ case TRB_ENABLE_SLOT: |
792 |
+- sprintf(str, |
793 |
++ snprintf(str, size, |
794 |
+ "%s: flags %c", |
795 |
+ xhci_trb_type_string(type), |
796 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
797 |
+ break; |
798 |
+ case TRB_DISABLE_SLOT: |
799 |
+ case TRB_NEG_BANDWIDTH: |
800 |
+- sprintf(str, |
801 |
++ snprintf(str, size, |
802 |
+ "%s: slot %d flags %c", |
803 |
+ xhci_trb_type_string(type), |
804 |
+ TRB_TO_SLOT_ID(field3), |
805 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
806 |
+ break; |
807 |
+ case TRB_ADDR_DEV: |
808 |
+- sprintf(str, |
809 |
++ snprintf(str, size, |
810 |
+ "%s: ctx %08x%08x slot %d flags %c:%c", |
811 |
+ xhci_trb_type_string(type), |
812 |
+ field1, field0, |
813 |
+@@ -2353,7 +2358,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
814 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
815 |
+ break; |
816 |
+ case TRB_CONFIG_EP: |
817 |
+- sprintf(str, |
818 |
++ snprintf(str, size, |
819 |
+ "%s: ctx %08x%08x slot %d flags %c:%c", |
820 |
+ xhci_trb_type_string(type), |
821 |
+ field1, field0, |
822 |
+@@ -2362,7 +2367,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
823 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
824 |
+ break; |
825 |
+ case TRB_EVAL_CONTEXT: |
826 |
+- sprintf(str, |
827 |
++ snprintf(str, size, |
828 |
+ "%s: ctx %08x%08x slot %d flags %c", |
829 |
+ xhci_trb_type_string(type), |
830 |
+ field1, field0, |
831 |
+@@ -2370,7 +2375,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
832 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
833 |
+ break; |
834 |
+ case TRB_RESET_EP: |
835 |
+- sprintf(str, |
836 |
++ snprintf(str, size, |
837 |
+ "%s: ctx %08x%08x slot %d ep %d flags %c:%c", |
838 |
+ xhci_trb_type_string(type), |
839 |
+ field1, field0, |
840 |
+@@ -2391,7 +2396,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
841 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
842 |
+ break; |
843 |
+ case TRB_SET_DEQ: |
844 |
+- sprintf(str, |
845 |
++ snprintf(str, size, |
846 |
+ "%s: deq %08x%08x stream %d slot %d ep %d flags %c", |
847 |
+ xhci_trb_type_string(type), |
848 |
+ field1, field0, |
849 |
+@@ -2402,14 +2407,14 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
850 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
851 |
+ break; |
852 |
+ case TRB_RESET_DEV: |
853 |
+- sprintf(str, |
854 |
++ snprintf(str, size, |
855 |
+ "%s: slot %d flags %c", |
856 |
+ xhci_trb_type_string(type), |
857 |
+ TRB_TO_SLOT_ID(field3), |
858 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
859 |
+ break; |
860 |
+ case TRB_FORCE_EVENT: |
861 |
+- sprintf(str, |
862 |
++ snprintf(str, size, |
863 |
+ "%s: event %08x%08x vf intr %d vf id %d flags %c", |
864 |
+ xhci_trb_type_string(type), |
865 |
+ field1, field0, |
866 |
+@@ -2418,14 +2423,14 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
867 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
868 |
+ break; |
869 |
+ case TRB_SET_LT: |
870 |
+- sprintf(str, |
871 |
++ snprintf(str, size, |
872 |
+ "%s: belt %d flags %c", |
873 |
+ xhci_trb_type_string(type), |
874 |
+ TRB_TO_BELT(field3), |
875 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
876 |
+ break; |
877 |
+ case TRB_GET_BW: |
878 |
+- sprintf(str, |
879 |
++ snprintf(str, size, |
880 |
+ "%s: ctx %08x%08x slot %d speed %d flags %c", |
881 |
+ xhci_trb_type_string(type), |
882 |
+ field1, field0, |
883 |
+@@ -2434,7 +2439,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
884 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
885 |
+ break; |
886 |
+ case TRB_FORCE_HEADER: |
887 |
+- sprintf(str, |
888 |
++ snprintf(str, size, |
889 |
+ "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", |
890 |
+ xhci_trb_type_string(type), |
891 |
+ field2, field1, field0 & 0xffffffe0, |
892 |
+@@ -2443,7 +2448,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
893 |
+ field3 & TRB_CYCLE ? 'C' : 'c'); |
894 |
+ break; |
895 |
+ default: |
896 |
+- sprintf(str, |
897 |
++ snprintf(str, size, |
898 |
+ "type '%s' -> raw %08x %08x %08x %08x", |
899 |
+ xhci_trb_type_string(type), |
900 |
+ field0, field1, field2, field3); |
901 |
+@@ -2452,10 +2457,9 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, |
902 |
+ return str; |
903 |
+ } |
904 |
+ |
905 |
+-static inline const char *xhci_decode_ctrl_ctx(unsigned long drop, |
906 |
+- unsigned long add) |
907 |
++static inline const char *xhci_decode_ctrl_ctx(char *str, |
908 |
++ unsigned long drop, unsigned long add) |
909 |
+ { |
910 |
+- static char str[1024]; |
911 |
+ unsigned int bit; |
912 |
+ int ret = 0; |
913 |
+ |
914 |
+@@ -2481,10 +2485,9 @@ static inline const char *xhci_decode_ctrl_ctx(unsigned long drop, |
915 |
+ return str; |
916 |
+ } |
917 |
+ |
918 |
+-static inline const char *xhci_decode_slot_context(u32 info, u32 info2, |
919 |
+- u32 tt_info, u32 state) |
920 |
++static inline const char *xhci_decode_slot_context(char *str, |
921 |
++ u32 info, u32 info2, u32 tt_info, u32 state) |
922 |
+ { |
923 |
+- static char str[1024]; |
924 |
+ u32 speed; |
925 |
+ u32 hub; |
926 |
+ u32 mtt; |
927 |
+@@ -2568,9 +2571,8 @@ static inline const char *xhci_portsc_link_state_string(u32 portsc) |
928 |
+ return "Unknown"; |
929 |
+ } |
930 |
+ |
931 |
+-static inline const char *xhci_decode_portsc(u32 portsc) |
932 |
++static inline const char *xhci_decode_portsc(char *str, u32 portsc) |
933 |
+ { |
934 |
+- static char str[256]; |
935 |
+ int ret; |
936 |
+ |
937 |
+ ret = sprintf(str, "%s %s %s Link:%s PortSpeed:%d ", |
938 |
+@@ -2614,9 +2616,8 @@ static inline const char *xhci_decode_portsc(u32 portsc) |
939 |
+ return str; |
940 |
+ } |
941 |
+ |
942 |
+-static inline const char *xhci_decode_usbsts(u32 usbsts) |
943 |
++static inline const char *xhci_decode_usbsts(char *str, u32 usbsts) |
944 |
+ { |
945 |
+- static char str[256]; |
946 |
+ int ret = 0; |
947 |
+ |
948 |
+ if (usbsts == ~(u32)0) |
949 |
+@@ -2643,9 +2644,8 @@ static inline const char *xhci_decode_usbsts(u32 usbsts) |
950 |
+ return str; |
951 |
+ } |
952 |
+ |
953 |
+-static inline const char *xhci_decode_doorbell(u32 slot, u32 doorbell) |
954 |
++static inline const char *xhci_decode_doorbell(char *str, u32 slot, u32 doorbell) |
955 |
+ { |
956 |
+- static char str[256]; |
957 |
+ u8 ep; |
958 |
+ u16 stream; |
959 |
+ int ret; |
960 |
+@@ -2712,10 +2712,9 @@ static inline const char *xhci_ep_type_string(u8 type) |
961 |
+ } |
962 |
+ } |
963 |
+ |
964 |
+-static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq, |
965 |
+- u32 tx_info) |
966 |
++static inline const char *xhci_decode_ep_context(char *str, u32 info, |
967 |
++ u32 info2, u64 deq, u32 tx_info) |
968 |
+ { |
969 |
+- static char str[1024]; |
970 |
+ int ret; |
971 |
+ |
972 |
+ u32 esit; |
973 |
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c |
974 |
+index b3b4599375668..3d328dfdbb5ed 100644 |
975 |
+--- a/drivers/usb/mtu3/mtu3_core.c |
976 |
++++ b/drivers/usb/mtu3/mtu3_core.c |
977 |
+@@ -227,11 +227,13 @@ void mtu3_set_speed(struct mtu3 *mtu, enum usb_device_speed speed) |
978 |
+ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE); |
979 |
+ break; |
980 |
+ case USB_SPEED_SUPER: |
981 |
++ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE); |
982 |
+ mtu3_clrbits(mtu->ippc_base, SSUSB_U3_CTRL(0), |
983 |
+ SSUSB_U3_PORT_SSP_SPEED); |
984 |
+ break; |
985 |
+ case USB_SPEED_SUPER_PLUS: |
986 |
+- mtu3_setbits(mtu->ippc_base, SSUSB_U3_CTRL(0), |
987 |
++ mtu3_setbits(mbase, U3D_POWER_MANAGEMENT, HS_ENABLE); |
988 |
++ mtu3_setbits(mtu->ippc_base, SSUSB_U3_CTRL(0), |
989 |
+ SSUSB_U3_PORT_SSP_SPEED); |
990 |
+ break; |
991 |
+ default: |
992 |
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c |
993 |
+index 38f17d66d5bc1..0b3aa7c65857a 100644 |
994 |
+--- a/drivers/usb/mtu3/mtu3_gadget.c |
995 |
++++ b/drivers/usb/mtu3/mtu3_gadget.c |
996 |
+@@ -64,14 +64,12 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) |
997 |
+ u32 interval = 0; |
998 |
+ u32 mult = 0; |
999 |
+ u32 burst = 0; |
1000 |
+- int max_packet; |
1001 |
+ int ret; |
1002 |
+ |
1003 |
+ desc = mep->desc; |
1004 |
+ comp_desc = mep->comp_desc; |
1005 |
+ mep->type = usb_endpoint_type(desc); |
1006 |
+- max_packet = usb_endpoint_maxp(desc); |
1007 |
+- mep->maxp = max_packet & GENMASK(10, 0); |
1008 |
++ mep->maxp = usb_endpoint_maxp(desc); |
1009 |
+ |
1010 |
+ switch (mtu->g.speed) { |
1011 |
+ case USB_SPEED_SUPER: |
1012 |
+@@ -92,7 +90,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) |
1013 |
+ usb_endpoint_xfer_int(desc)) { |
1014 |
+ interval = desc->bInterval; |
1015 |
+ interval = clamp_val(interval, 1, 16) - 1; |
1016 |
+- burst = (max_packet & GENMASK(12, 11)) >> 11; |
1017 |
++ mult = usb_endpoint_maxp_mult(desc) - 1; |
1018 |
+ } |
1019 |
+ break; |
1020 |
+ default: |
1021 |
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c |
1022 |
+index 00576bae183d3..0c321996c6eb0 100644 |
1023 |
+--- a/net/ipv4/igmp.c |
1024 |
++++ b/net/ipv4/igmp.c |
1025 |
+@@ -2720,6 +2720,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u |
1026 |
+ rv = 1; |
1027 |
+ } else if (im) { |
1028 |
+ if (src_addr) { |
1029 |
++ spin_lock_bh(&im->lock); |
1030 |
+ for (psf = im->sources; psf; psf = psf->sf_next) { |
1031 |
+ if (psf->sf_inaddr == src_addr) |
1032 |
+ break; |
1033 |
+@@ -2730,6 +2731,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u |
1034 |
+ im->sfcount[MCAST_EXCLUDE]; |
1035 |
+ else |
1036 |
+ rv = im->sfcount[MCAST_EXCLUDE] != 0; |
1037 |
++ spin_unlock_bh(&im->lock); |
1038 |
+ } else |
1039 |
+ rv = 1; /* unspecified source; tentatively allow */ |
1040 |
+ } |
1041 |
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c |
1042 |
+index 326d1b0ea5e69..db65f77eb131f 100644 |
1043 |
+--- a/sound/usb/quirks.c |
1044 |
++++ b/sound/usb/quirks.c |
1045 |
+@@ -1898,6 +1898,7 @@ static const struct registration_quirk registration_quirks[] = { |
1046 |
+ REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */ |
1047 |
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ |
1048 |
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ |
1049 |
++ REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */ |
1050 |
+ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ |
1051 |
+ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ |
1052 |
+ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ |