--- /dev/null
+From d9da920233ec85af8b9c87154f2721a7dc4623f5 Mon Sep 17 00:00:00 2001
+From: Zenm Chen <zenmchen@gmail.com>
+Date: Wed, 21 May 2025 09:30:20 +0800
+Subject: Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+commit d9da920233ec85af8b9c87154f2721a7dc4623f5 upstream.
+
+Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano which is based on
+a Realtek RTL8851BU chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below:
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=3625 ProdID=010b Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=802.11ax WLAN Adapter
+S: SerialNumber=00e04c000001
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtl8851bu
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -508,6 +508,10 @@ static const struct usb_device_id quirks
+ { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
++ /* Realtek 8851BU Bluetooth devices */
++ { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
++
+ /* Realtek 8852AE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
--- /dev/null
+From 0d9cfc9b8cb17dbc29a98792d36ec39a1cf1395f Mon Sep 17 00:00:00 2001
+From: John Ernberg <john.ernberg@actia.se>
+Date: Wed, 23 Jul 2025 10:25:35 +0000
+Subject: net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
+
+From: John Ernberg <john.ernberg@actia.se>
+
+commit 0d9cfc9b8cb17dbc29a98792d36ec39a1cf1395f upstream.
+
+The Gemalto Cinterion PLS83-W modem (cdc_ether) is emitting confusing link
+up and down events when the WWAN interface is activated on the modem-side.
+
+Interrupt URBs will in consecutive polls grab:
+* Link Connected
+* Link Disconnected
+* Link Connected
+
+Where the last Connected is then a stable link state.
+
+When the system is under load this may cause the unlink_urbs() work in
+__handle_link_change() to not complete before the next usbnet_link_change()
+call turns the carrier on again, allowing rx_submit() to queue new SKBs.
+
+In that event the URB queue is filled faster than it can drain, ending up
+in a RCU stall:
+
+ rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 0-.... } 33108 jiffies s: 201 root: 0x1/.
+ rcu: blocking rcu_node structures (internal RCU debug):
+ Sending NMI from CPU 1 to CPUs 0:
+ NMI backtrace for cpu 0
+
+ Call trace:
+ arch_local_irq_enable+0x4/0x8
+ local_bh_enable+0x18/0x20
+ __netdev_alloc_skb+0x18c/0x1cc
+ rx_submit+0x68/0x1f8 [usbnet]
+ rx_alloc_submit+0x4c/0x74 [usbnet]
+ usbnet_bh+0x1d8/0x218 [usbnet]
+ usbnet_bh_tasklet+0x10/0x18 [usbnet]
+ tasklet_action_common+0xa8/0x110
+ tasklet_action+0x2c/0x34
+ handle_softirqs+0x2cc/0x3a0
+ __do_softirq+0x10/0x18
+ ____do_softirq+0xc/0x14
+ call_on_irq_stack+0x24/0x34
+ do_softirq_own_stack+0x18/0x20
+ __irq_exit_rcu+0xa8/0xb8
+ irq_exit_rcu+0xc/0x30
+ el1_interrupt+0x34/0x48
+ el1h_64_irq_handler+0x14/0x1c
+ el1h_64_irq+0x68/0x6c
+ _raw_spin_unlock_irqrestore+0x38/0x48
+ xhci_urb_dequeue+0x1ac/0x45c [xhci_hcd]
+ unlink1+0xd4/0xdc [usbcore]
+ usb_hcd_unlink_urb+0x70/0xb0 [usbcore]
+ usb_unlink_urb+0x24/0x44 [usbcore]
+ unlink_urbs.constprop.0.isra.0+0x64/0xa8 [usbnet]
+ __handle_link_change+0x34/0x70 [usbnet]
+ usbnet_deferred_kevent+0x1c0/0x320 [usbnet]
+ process_scheduled_works+0x2d0/0x48c
+ worker_thread+0x150/0x1dc
+ kthread+0xd8/0xe8
+ ret_from_fork+0x10/0x20
+
+Get around the problem by delaying the carrier on to the scheduled work.
+
+This needs a new flag to keep track of the necessary action.
+
+The carrier ok check cannot be removed as it remains required for the
+LINK_RESET event flow.
+
+Fixes: 4b49f58fff00 ("usbnet: handle link change")
+Cc: stable@vger.kernel.org
+Signed-off-by: John Ernberg <john.ernberg@actia.se>
+Link: https://patch.msgid.link/20250723102526.1305339-1-john.ernberg@actia.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/usbnet.c | 11 ++++++++---
+ include/linux/usb/usbnet.h | 1 +
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1122,6 +1122,9 @@ static void __handle_link_change(struct
+ * tx queue is stopped by netcore after link becomes off
+ */
+ } else {
++ if (test_and_clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags))
++ netif_carrier_on(dev->net);
++
+ /* submitting URBs for reading packets */
+ tasklet_schedule(&dev->bh);
+ }
+@@ -2015,10 +2018,12 @@ EXPORT_SYMBOL(usbnet_manage_power);
+ void usbnet_link_change(struct usbnet *dev, bool link, bool need_reset)
+ {
+ /* update link after link is reseted */
+- if (link && !need_reset)
+- netif_carrier_on(dev->net);
+- else
++ if (link && !need_reset) {
++ set_bit(EVENT_LINK_CARRIER_ON, &dev->flags);
++ } else {
++ clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags);
+ netif_carrier_off(dev->net);
++ }
+
+ if (need_reset && link)
+ usbnet_defer_kevent(dev, EVENT_LINK_RESET);
+--- a/include/linux/usb/usbnet.h
++++ b/include/linux/usb/usbnet.h
+@@ -76,6 +76,7 @@ struct usbnet {
+ # define EVENT_LINK_CHANGE 11
+ # define EVENT_SET_RX_MODE 12
+ # define EVENT_NO_IP_ALIGN 13
++# define EVENT_LINK_CARRIER_ON 14
+ /* This one is special, as it indicates that the device is going away
+ * there are cyclic dependencies between tasklet, timer and bh
+ * that must be broken
--- /dev/null
+From 8466d393700f9ccef68134d3349f4e0a087679b9 Mon Sep 17 00:00:00 2001
+From: Ammar Faizi <ammarfaizi2@gnuweeb.org>
+Date: Wed, 6 Aug 2025 07:31:05 +0700
+Subject: net: usbnet: Fix the wrong netif_carrier_on() call
+
+From: Ammar Faizi <ammarfaizi2@gnuweeb.org>
+
+commit 8466d393700f9ccef68134d3349f4e0a087679b9 upstream.
+
+The commit referenced in the Fixes tag causes usbnet to malfunction
+(identified via git bisect). Post-commit, my external RJ45 LAN cable
+fails to connect. Linus also reported the same issue after pulling that
+commit.
+
+The code has a logic error: netif_carrier_on() is only called when the
+link is already on. Fix this by moving the netif_carrier_on() call
+outside the if-statement entirely. This ensures it is always called
+when EVENT_LINK_CARRIER_ON is set and properly clears it regardless
+of the link state.
+
+Cc: stable@vger.kernel.org
+Cc: Armando Budianto <sprite@gnuweeb.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/all/CAHk-=wjqL4uF0MG_c8+xHX1Vv8==sPYQrtzbdA3kzi96284nuQ@mail.gmail.com
+Closes: https://lore.kernel.org/netdev/CAHk-=wjKh8X4PT_mU1kD4GQrbjivMfPn-_hXa6han_BTDcXddw@mail.gmail.com
+Closes: https://lore.kernel.org/netdev/0752dee6-43d6-4e1f-81d2-4248142cccd2@gnuweeb.org
+Fixes: 0d9cfc9b8cb1 ("net: usbnet: Avoid potential RCU stall on LINK_CHANGE event")
+Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/usbnet.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1113,6 +1113,9 @@ static void __handle_link_change(struct
+ if (!test_bit(EVENT_DEV_OPEN, &dev->flags))
+ return;
+
++ if (test_and_clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags))
++ netif_carrier_on(dev->net);
++
+ if (!netif_carrier_ok(dev->net)) {
+ /* kill URBs for reading packets to save bus bandwidth */
+ unlink_urbs(dev, &dev->rxq);
+@@ -1122,9 +1125,6 @@ static void __handle_link_change(struct
+ * tx queue is stopped by netcore after link becomes off
+ */
+ } else {
+- if (test_and_clear_bit(EVENT_LINK_CARRIER_ON, &dev->flags))
+- netif_carrier_on(dev->net);
+-
+ /* submitting URBs for reading packets */
+ tasklet_schedule(&dev->bh);
+ }
freezer-sched-do-not-restore-saved_state-of-a-thawed-task.patch
freezer-sched-clean-saved_state-when-restoring-it-during-thaw.patch
sched-freezer-remove-unnecessary-warning-in-__thaw_task.patch
+bluetooth-btusb-add-usb-id-3625-010b-for-tp-link-archer-tx10ub-nano.patch
+net-usbnet-avoid-potential-rcu-stall-on-link_change-event.patch
+net-usbnet-fix-the-wrong-netif_carrier_on-call.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
