--- /dev/null
+From 9054fc6d57e80c27c0b0632966416144f2092c2b Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Wed, 17 Nov 2021 20:07:34 +0200
+Subject: ACPI: Get acpi_device's parent from the parent field
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit 9054fc6d57e80c27c0b0632966416144f2092c2b upstream.
+
+Printk modifier %pfw is used to print the full path of the device name.
+This is obtained device by device until a device no longer has a parent.
+
+On ACPI getting the parent fwnode is done by calling acpi_get_parent()
+which tries to down() a semaphore. But local IRQs are now disabled in
+vprintk_store() before the mutex is acquired. This is obviously a problem.
+
+Luckily struct device, embedded in struct acpi_device, has a parent field
+already. Use that field to get the parent instead of relying on
+acpi_get_parent().
+
+Fixes: 3bd32d6a2ee6 ("lib/vsprintf: Add %pfw conversion specifier for printing fwnode names")
+Cc: 5.5+ <stable@vger.kernel.org> # 5.5+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/property.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -1110,15 +1110,10 @@ struct fwnode_handle *acpi_node_get_pare
+ /* All data nodes have parent pointer so just return that */
+ return to_acpi_data_node(fwnode)->parent;
+ } else if (is_acpi_device_node(fwnode)) {
+- acpi_handle handle, parent_handle;
++ struct device *dev = to_acpi_device_node(fwnode)->dev.parent;
+
+- handle = to_acpi_device_node(fwnode)->handle;
+- if (ACPI_SUCCESS(acpi_get_parent(handle, &parent_handle))) {
+- struct acpi_device *adev;
+-
+- if (!acpi_bus_get_device(parent_handle, &adev))
+- return acpi_fwnode_handle(adev);
+- }
++ if (dev)
++ return acpi_fwnode_handle(to_acpi_device(dev));
+ }
+
+ return NULL;
--- /dev/null
+From 1c743127cc54b112b155f434756bd4b5fa565a99 Mon Sep 17 00:00:00 2001
+From: Nikolay Aleksandrov <nikolay@nvidia.com>
+Date: Tue, 23 Nov 2021 12:27:19 +0200
+Subject: net: nexthop: fix null pointer dereference when IPv6 is not enabled
+
+From: Nikolay Aleksandrov <nikolay@nvidia.com>
+
+commit 1c743127cc54b112b155f434756bd4b5fa565a99 upstream.
+
+When we try to add an IPv6 nexthop and IPv6 is not enabled
+(!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the error path
+of nh_create_ipv6() due to calling ipv6_stub->fib6_nh_release. The bug
+has been present since the beginning of IPv6 nexthop gateway support.
+Commit 1aefd3de7bc6 ("ipv6: Add fib6_nh_init and release to stubs") tells
+us that only fib6_nh_init has a dummy stub because fib6_nh_release should
+not be called if fib6_nh_init returns an error, but the commit below added
+a call to ipv6_stub->fib6_nh_release in its error path. To fix it return
+the dummy stub's -EAFNOSUPPORT error directly without calling
+ipv6_stub->fib6_nh_release in nh_create_ipv6()'s error path.
+
+[1]
+ Output is a bit truncated, but it clearly shows the error.
+ BUG: kernel NULL pointer dereference, address: 000000000000000000
+ #PF: supervisor instruction fetch in kernel modede
+ #PF: error_code(0x0010) - not-present pagege
+ PGD 0 P4D 0
+ Oops: 0010 [#1] PREEMPT SMP NOPTI
+ CPU: 4 PID: 638 Comm: ip Kdump: loaded Not tainted 5.16.0-rc1+ #446
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014
+ RIP: 0010:0x0
+ Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
+ RSP: 0018:ffff888109f5b8f0 EFLAGS: 00010286^Ac
+ RAX: 0000000000000000 RBX: ffff888109f5ba28 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881008a2860
+ RBP: ffff888109f5b9d8 R08: 0000000000000000 R09: 0000000000000000
+ R10: ffff888109f5b978 R11: ffff888109f5b948 R12: 00000000ffffff9f
+ R13: ffff8881008a2a80 R14: ffff8881008a2860 R15: ffff8881008a2840
+ FS: 00007f98de70f100(0000) GS:ffff88822bf00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffffffffffffffd6 CR3: 0000000100efc000 CR4: 00000000000006e0
+ Call Trace:
+ <TASK>
+ nh_create_ipv6+0xed/0x10c
+ rtm_new_nexthop+0x6d7/0x13f3
+ ? check_preemption_disabled+0x3d/0xf2
+ ? lock_is_held_type+0xbe/0xfd
+ rtnetlink_rcv_msg+0x23f/0x26a
+ ? check_preemption_disabled+0x3d/0xf2
+ ? rtnl_calcit.isra.0+0x147/0x147
+ netlink_rcv_skb+0x61/0xb2
+ netlink_unicast+0x100/0x187
+ netlink_sendmsg+0x37f/0x3a0
+ ? netlink_unicast+0x187/0x187
+ sock_sendmsg_nosec+0x67/0x9b
+ ____sys_sendmsg+0x19d/0x1f9
+ ? copy_msghdr_from_user+0x4c/0x5e
+ ? rcu_read_lock_any_held+0x2a/0x78
+ ___sys_sendmsg+0x6c/0x8c
+ ? asm_sysvec_apic_timer_interrupt+0x12/0x20
+ ? lockdep_hardirqs_on+0xd9/0x102
+ ? sockfd_lookup_light+0x69/0x99
+ __sys_sendmsg+0x50/0x6e
+ do_syscall_64+0xcb/0xf2
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7f98dea28914
+ Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 48 8d 05 e9 5d 0c 00 8b 00 85 c0 75 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 41 89 d4 55 48 89 f5 53
+ RSP: 002b:00007fff859f5e68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e2e
+ RAX: ffffffffffffffda RBX: 00000000619cb810 RCX: 00007f98dea28914
+ RDX: 0000000000000000 RSI: 00007fff859f5ed0 RDI: 0000000000000003
+ RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000008
+ R10: fffffffffffffce6 R11: 0000000000000246 R12: 0000000000000001
+ R13: 000055c0097ae520 R14: 000055c0097957fd R15: 00007fff859f63a0
+ </TASK>
+ Modules linked in: bridge stp llc bonding virtio_net
+
+Cc: stable@vger.kernel.org
+Fixes: 53010f991a9f ("nexthop: Add support for IPv6 gateways")
+Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/nexthop.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -1355,11 +1355,15 @@ static int nh_create_ipv6(struct net *ne
+ /* sets nh_dev if successful */
+ err = ipv6_stub->fib6_nh_init(net, fib6_nh, &fib6_cfg, GFP_KERNEL,
+ extack);
+- if (err)
++ if (err) {
++ /* IPv6 is not enabled, don't call fib6_nh_release */
++ if (err == -EAFNOSUPPORT)
++ goto out;
+ ipv6_stub->fib6_nh_release(fib6_nh);
+- else
++ } else {
+ nh->nh_flags = fib6_nh->fib_nh_flags;
+-
++ }
++out:
+ return err;
+ }
+
bpf-fix-toctou-on-read-only-map-s-constant-scalar-tracking.patch
+acpi-get-acpi_device-s-parent-from-the-parent-field.patch
+usb-serial-option-add-telit-le910s1-0x9200-composition.patch
+usb-serial-option-add-fibocom-fm101-gl-variants.patch
+usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch
+usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch
+usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch
+usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch
+usb-dwc3-gadget-fix-null-pointer-exception.patch
+net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch
+usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch
+usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch
+usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch
+usb-hub-fix-locking-issues-with-address0_mutex.patch
--- /dev/null
+From d4d2e5329ae9dfd6742c84d79f7d143d10410f1b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 17 Nov 2021 10:49:23 +0300
+Subject: usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit d4d2e5329ae9dfd6742c84d79f7d143d10410f1b upstream.
+
+If the first call to devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0)
+fails with something other than -ENODEV then it leads to an error
+pointer dereference. For those errors we should just jump directly to
+the error handling.
+
+Fixes: 8253a34bfae3 ("usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20211117074923.GF5237@kili
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/ci_hdrc_imx.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -425,15 +425,15 @@ static int ci_hdrc_imx_probe(struct plat
+ data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0);
+ if (IS_ERR(data->phy)) {
+ ret = PTR_ERR(data->phy);
+- if (ret == -ENODEV) {
+- data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0);
+- if (IS_ERR(data->phy)) {
+- ret = PTR_ERR(data->phy);
+- if (ret == -ENODEV)
+- data->phy = NULL;
+- else
+- goto err_clk;
+- }
++ if (ret != -ENODEV)
++ goto err_clk;
++ data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0);
++ if (IS_ERR(data->phy)) {
++ ret = PTR_ERR(data->phy);
++ if (ret == -ENODEV)
++ data->phy = NULL;
++ else
++ goto err_clk;
+ }
+ }
+
--- /dev/null
+From 7ad4a0b1d46b2612f4429a72afd8f137d7efa9a9 Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Date: Thu, 4 Nov 2021 11:36:01 +0400
+Subject: usb: dwc2: gadget: Fix ISOC flow for elapsed frames
+
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+
+commit 7ad4a0b1d46b2612f4429a72afd8f137d7efa9a9 upstream.
+
+Added updating of request frame number for elapsed frames,
+otherwise frame number will remain as previous use of request.
+This will allow function driver to correctly track frames in
+case of Missed ISOC occurs.
+
+Added setting request actual length to 0 for elapsed frames.
+In Slave mode when pushing data to RxFIFO by dwords, request
+actual length incrementing accordingly. But before whole packet
+will be pushed into RxFIFO and send to host can occurs Missed
+ISOC and data will not send to host. So, in this case request
+actual length should be reset to 0.
+
+Fixes: 91bb163e1e4f ("usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: John Keeping <john@metanate.com>
+Signed-off-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Link: https://lore.kernel.org/r/c356baade6e9716d312d43df08d53ae557cb8037.1636011277.git.Minas.Harutyunyan@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/gadget.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -1198,6 +1198,8 @@ static void dwc2_hsotg_start_req(struct
+ }
+ ctrl |= DXEPCTL_CNAK;
+ } else {
++ hs_req->req.frame_number = hs_ep->target_frame;
++ hs_req->req.actual = 0;
+ dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA);
+ return;
+ }
+@@ -2856,9 +2858,12 @@ static void dwc2_gadget_handle_ep_disabl
+
+ do {
+ hs_req = get_ep_head(hs_ep);
+- if (hs_req)
++ if (hs_req) {
++ hs_req->req.frame_number = hs_ep->target_frame;
++ hs_req->req.actual = 0;
+ dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req,
+ -ENODATA);
++ }
+ dwc2_gadget_incr_frame_num(hs_ep);
+ /* Update current frame number value. */
+ hsotg->frame_number = dwc2_hsotg_read_frameno(hsotg);
+@@ -2911,8 +2916,11 @@ static void dwc2_gadget_handle_out_token
+
+ while (dwc2_gadget_target_frame_elapsed(ep)) {
+ hs_req = get_ep_head(ep);
+- if (hs_req)
++ if (hs_req) {
++ hs_req->req.frame_number = ep->target_frame;
++ hs_req->req.actual = 0;
+ dwc2_hsotg_complete_request(hsotg, ep, hs_req, -ENODATA);
++ }
+
+ dwc2_gadget_incr_frame_num(ep);
+ /* Update current frame number value. */
+@@ -3001,8 +3009,11 @@ static void dwc2_gadget_handle_nak(struc
+
+ while (dwc2_gadget_target_frame_elapsed(hs_ep)) {
+ hs_req = get_ep_head(hs_ep);
+- if (hs_req)
++ if (hs_req) {
++ hs_req->req.frame_number = hs_ep->target_frame;
++ hs_req->req.actual = 0;
+ dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA);
++ }
+
+ dwc2_gadget_incr_frame_num(hs_ep);
+ /* Update current frame number value. */
--- /dev/null
+From 310780e825f3ffd211b479b8f828885a6faedd63 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Fri, 5 Nov 2021 07:58:03 -0700
+Subject: usb: dwc2: hcd_queue: Fix use of floating point literal
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 310780e825f3ffd211b479b8f828885a6faedd63 upstream.
+
+A new commit in LLVM causes an error on the use of 'long double' when
+'-mno-x87' is used, which the kernel does through an alias,
+'-mno-80387' (see the LLVM commit below for more details around why it
+does this).
+
+ drivers/usb/dwc2/hcd_queue.c:1744:25: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it
+ delay = ktime_set(0, DWC2_RETRY_WAIT_DELAY);
+ ^
+ drivers/usb/dwc2/hcd_queue.c:62:34: note: expanded from macro 'DWC2_RETRY_WAIT_DELAY'
+ #define DWC2_RETRY_WAIT_DELAY (1 * 1E6L)
+ ^
+ 1 error generated.
+
+This happens due to the use of a 'long double' literal. The 'E6' part of
+'1E6L' causes the literal to be a 'double' then the 'L' suffix promotes
+it to 'long double'.
+
+There is no visible reason for a floating point value in this driver, as
+the value is only used as a parameter to a function that expects an
+integer type. Use NSEC_PER_MSEC, which is the same integer value as
+'1E6L', to avoid changing functionality but fix the error.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/1497
+Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36d1f0cadd7801d83
+Fixes: 6ed30a7d8ec2 ("usb: dwc2: host: use hrtimer for NAK retries")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: John Keeping <john@metanate.com>
+Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20211105145802.2520658-1-nathan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/hcd_queue.c
++++ b/drivers/usb/dwc2/hcd_queue.c
+@@ -59,7 +59,7 @@
+ #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5))
+
+ /* If we get a NAK, wait this long before retrying */
+-#define DWC2_RETRY_WAIT_DELAY 1*1E6L
++#define DWC2_RETRY_WAIT_DELAY (1 * NSEC_PER_MSEC)
+
+ /**
+ * dwc2_periodic_channel_available() - Checks that a channel is available for a
--- /dev/null
+From 63c4c320ccf77074ffe9019ac596603133c1b517 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Mon, 25 Oct 2021 16:35:06 -0700
+Subject: usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 63c4c320ccf77074ffe9019ac596603133c1b517 upstream.
+
+The programming guide noted that the driver needs to verify if the link
+state is in U0 before executing the Start Transfer command. If it's not
+in U0, the driver needs to perform remote wakeup. This is not accurate.
+If the link state is in U1/U2, then the controller will not respond to
+link recovery request from DCTL.ULSTCHNGREQ. The Start Transfer command
+will trigger a link recovery if it is in U1/U2. A clarification will be
+added to the programming guide for all controller versions.
+
+The current implementation shouldn't cause any functional issue. It may
+occasionally report an invalid time out warning from failed link
+recovery request. The driver will still go ahead with the Start Transfer
+command if the remote wakeup fails. The new change only initiates remote
+wakeup where it is needed, which is when the link state is in L1/L2/U3.
+
+Fixes: c36d8e947a56 ("usb: dwc3: gadget: put link to U0 before Start Transfer")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/05b4a5fbfbd0863fc9b1d7af934a366219e3d0b4.1635204761.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -310,13 +310,24 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
+ if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
+ int link_state;
+
++ /*
++ * Initiate remote wakeup if the link state is in U3 when
++ * operating in SS/SSP or L1/L2 when operating in HS/FS. If the
++ * link state is in U1/U2, no remote wakeup is needed. The Start
++ * Transfer command will initiate the link recovery.
++ */
+ link_state = dwc3_gadget_get_link_state(dwc);
+- if (link_state == DWC3_LINK_STATE_U1 ||
+- link_state == DWC3_LINK_STATE_U2 ||
+- link_state == DWC3_LINK_STATE_U3) {
++ switch (link_state) {
++ case DWC3_LINK_STATE_U2:
++ if (dwc->gadget->speed >= USB_SPEED_SUPER)
++ break;
++
++ fallthrough;
++ case DWC3_LINK_STATE_U3:
+ ret = __dwc3_gadget_wakeup(dwc);
+ dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n",
+ ret);
++ break;
+ }
+ }
+
--- /dev/null
+From 26288448120b28af1dfd85a6fa6b6d55a16c7f2f Mon Sep 17 00:00:00 2001
+From: Albert Wang <albertccwang@google.com>
+Date: Tue, 9 Nov 2021 17:26:42 +0800
+Subject: usb: dwc3: gadget: Fix null pointer exception
+
+From: Albert Wang <albertccwang@google.com>
+
+commit 26288448120b28af1dfd85a6fa6b6d55a16c7f2f upstream.
+
+In the endpoint interrupt functions
+dwc3_gadget_endpoint_transfer_in_progress() and
+dwc3_gadget_endpoint_trbs_complete() will dereference the endpoint
+descriptor. But it could be cleared in __dwc3_gadget_ep_disable()
+when accessory disconnected. So we need to check whether it is null
+or not before dereferencing it.
+
+Fixes: f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Jack Pham <quic_jackp@quicinc.com>
+Signed-off-by: Albert Wang <albertccwang@google.com>
+Link: https://lore.kernel.org/r/20211109092642.3507692-1-albertccwang@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2918,6 +2918,9 @@ static bool dwc3_gadget_endpoint_trbs_co
+ struct dwc3 *dwc = dep->dwc;
+ bool no_started_trb = true;
+
++ if (!dep->endpoint.desc)
++ return no_started_trb;
++
+ dwc3_gadget_ep_cleanup_completed_requests(dep, event, status);
+
+ if (dep->flags & DWC3_EP_END_TRANSFER_PENDING)
+@@ -2965,6 +2968,9 @@ static void dwc3_gadget_endpoint_transfe
+ {
+ int status = 0;
+
++ if (!dep->endpoint.desc)
++ return;
++
+ if (usb_endpoint_xfer_isoc(dep->endpoint.desc))
+ dwc3_gadget_endpoint_frame_from_event(dep, event);
+
--- /dev/null
+From d74dc3e9f58c28689cef1faccf918e06587367d3 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Mon, 25 Oct 2021 16:21:10 -0700
+Subject: usb: dwc3: gadget: Ignore NoStream after End Transfer
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit d74dc3e9f58c28689cef1faccf918e06587367d3 upstream.
+
+The End Transfer command from a stream endpoint will generate a NoStream
+event, and we should ignore it. Currently we set the flag
+DWC3_EP_IGNORE_NEXT_NOSTREAM to track this prior to sending the command,
+and it will be cleared on the next stream event. However, a stream event
+may be generated before the End Transfer command completion and
+prematurely clear the flag. Fix this by setting the flag on End Transfer
+completion instead.
+
+Fixes: 140ca4cfea8a ("usb: dwc3: gadget: Handle stream transfers")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/cee1253af4c3600edb878d11c9c08b040817ae23.1635203975.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3007,6 +3007,14 @@ static void dwc3_gadget_endpoint_command
+ if (cmd != DWC3_DEPCMD_ENDTRANSFER)
+ return;
+
++ /*
++ * The END_TRANSFER command will cause the controller to generate a
++ * NoStream Event, and it's not due to the host DP NoStream rejection.
++ * Ignore the next NoStream event.
++ */
++ if (dep->stream_capable)
++ dep->flags |= DWC3_EP_IGNORE_NEXT_NOSTREAM;
++
+ dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
+ dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
+ dwc3_gadget_ep_cleanup_cancelled_requests(dep);
+@@ -3229,14 +3237,6 @@ static void dwc3_stop_active_transfer(st
+ WARN_ON_ONCE(ret);
+ dep->resource_index = 0;
+
+- /*
+- * The END_TRANSFER command will cause the controller to generate a
+- * NoStream Event, and it's not due to the host DP NoStream rejection.
+- * Ignore the next NoStream event.
+- */
+- if (dep->stream_capable)
+- dep->flags |= DWC3_EP_IGNORE_NEXT_NOSTREAM;
+-
+ if (!interrupt)
+ dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
+ else
--- /dev/null
+From 6cca13de26eea6d32a98d96d916a048d16a12822 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 23 Nov 2021 12:16:56 +0200
+Subject: usb: hub: Fix locking issues with address0_mutex
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 6cca13de26eea6d32a98d96d916a048d16a12822 upstream.
+
+Fix the circular lock dependency and unbalanced unlock of addess0_mutex
+introduced when fixing an address0_mutex enumeration retry race in commit
+ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race")
+
+Make sure locking order between port_dev->status_lock and address0_mutex
+is correct, and that address0_mutex is not unlocked in hub_port_connect
+"done:" codepath which may be reached without locking address0_mutex
+
+Fixes: 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race")
+Cc: <stable@vger.kernel.org>
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20211123101656.1113518-1-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/hub.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5112,6 +5112,7 @@ static void hub_port_connect(struct usb_
+ struct usb_port *port_dev = hub->ports[port1 - 1];
+ struct usb_device *udev = port_dev->child;
+ static int unreliable_port = -1;
++ bool retry_locked;
+
+ /* Disconnect any existing devices under this port */
+ if (udev) {
+@@ -5168,10 +5169,10 @@ static void hub_port_connect(struct usb_
+
+ status = 0;
+
+- mutex_lock(hcd->address0_mutex);
+-
+ for (i = 0; i < PORT_INIT_TRIES; i++) {
+-
++ usb_lock_port(port_dev);
++ mutex_lock(hcd->address0_mutex);
++ retry_locked = true;
+ /* reallocate for each attempt, since references
+ * to the previous one can escape in various ways
+ */
+@@ -5179,6 +5180,8 @@ static void hub_port_connect(struct usb_
+ if (!udev) {
+ dev_err(&port_dev->dev,
+ "couldn't allocate usb_device\n");
++ mutex_unlock(hcd->address0_mutex);
++ usb_unlock_port(port_dev);
+ goto done;
+ }
+
+@@ -5200,13 +5203,13 @@ static void hub_port_connect(struct usb_
+ }
+
+ /* reset (non-USB 3.0 devices) and get descriptor */
+- usb_lock_port(port_dev);
+ status = hub_port_init(hub, udev, port1, i);
+- usb_unlock_port(port_dev);
+ if (status < 0)
+ goto loop;
+
+ mutex_unlock(hcd->address0_mutex);
++ usb_unlock_port(port_dev);
++ retry_locked = false;
+
+ if (udev->quirks & USB_QUIRK_DELAY_INIT)
+ msleep(2000);
+@@ -5296,11 +5299,14 @@ static void hub_port_connect(struct usb_
+
+ loop_disable:
+ hub_port_disable(hub, port1, 1);
+- mutex_lock(hcd->address0_mutex);
+ loop:
+ usb_ep0_reinit(udev);
+ release_devnum(udev);
+ hub_free_dev(udev);
++ if (retry_locked) {
++ mutex_unlock(hcd->address0_mutex);
++ usb_unlock_port(port_dev);
++ }
+ usb_put_dev(udev);
+ if ((status == -ENOTCONN) || (status == -ENOTSUPP))
+ break;
+@@ -5323,8 +5329,6 @@ loop:
+ }
+
+ done:
+- mutex_unlock(hcd->address0_mutex);
+-
+ hub_port_disable(hub, port1, 1);
+ if (hcd->driver->relinquish_port && !hub->hdev->parent) {
+ if (status != -ENOTCONN && status != -ENODEV)
--- /dev/null
+From 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 16 Nov 2021 00:16:30 +0200
+Subject: usb: hub: Fix usb enumeration issue due to address0 race
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b upstream.
+
+xHC hardware can only have one slot in default state with address 0
+waiting for a unique address at a time, otherwise "undefined behavior
+may occur" according to xhci spec 5.4.3.4
+
+The address0_mutex exists to prevent this across both xhci roothubs.
+
+If hub_port_init() fails, it may unlock the mutex and exit with a xhci
+slot in default state. If the other xhci roothub calls hub_port_init()
+at this point we end up with two slots in default state.
+
+Make sure the address0_mutex protects the slot default state across
+hub_port_init() retries, until slot is addressed or disabled.
+
+Note, one known minor case is not fixed by this patch.
+If device needs to be reset during resume, but fails all hub_port_init()
+retries in usb_reset_and_verify_device(), then it's possible the slot is
+still left in default state when address0_mutex is unlocked.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 638139eb95d2 ("usb: hub: allow to process more usb hub events in parallel")
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20211115221630.871204-1-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/hub.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4628,8 +4628,6 @@ hub_port_init(struct usb_hub *hub, struc
+ if (oldspeed == USB_SPEED_LOW)
+ delay = HUB_LONG_RESET_TIME;
+
+- mutex_lock(hcd->address0_mutex);
+-
+ /* Reset the device; full speed may morph to high speed */
+ /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */
+ retval = hub_port_reset(hub, port1, udev, delay, false);
+@@ -4940,7 +4938,6 @@ fail:
+ hub_port_disable(hub, port1, 0);
+ update_devnum(udev, devnum); /* for disconnect processing */
+ }
+- mutex_unlock(hcd->address0_mutex);
+ return retval;
+ }
+
+@@ -5170,6 +5167,9 @@ static void hub_port_connect(struct usb_
+ unit_load = 100;
+
+ status = 0;
++
++ mutex_lock(hcd->address0_mutex);
++
+ for (i = 0; i < PORT_INIT_TRIES; i++) {
+
+ /* reallocate for each attempt, since references
+@@ -5206,6 +5206,8 @@ static void hub_port_connect(struct usb_
+ if (status < 0)
+ goto loop;
+
++ mutex_unlock(hcd->address0_mutex);
++
+ if (udev->quirks & USB_QUIRK_DELAY_INIT)
+ msleep(2000);
+
+@@ -5294,6 +5296,7 @@ static void hub_port_connect(struct usb_
+
+ loop_disable:
+ hub_port_disable(hub, port1, 1);
++ mutex_lock(hcd->address0_mutex);
+ loop:
+ usb_ep0_reinit(udev);
+ release_devnum(udev);
+@@ -5320,6 +5323,8 @@ loop:
+ }
+
+ done:
++ mutex_unlock(hcd->address0_mutex);
++
+ hub_port_disable(hub, port1, 1);
+ if (hcd->driver->relinquish_port && !hub->hdev->parent) {
+ if (status != -ENOTCONN && status != -ENODEV)
+@@ -5839,6 +5844,8 @@ static int usb_reset_and_verify_device(s
+ bos = udev->bos;
+ udev->bos = NULL;
+
++ mutex_lock(hcd->address0_mutex);
++
+ for (i = 0; i < PORT_INIT_TRIES; ++i) {
+
+ /* ep0 maxpacket size may change; let the HCD know about it.
+@@ -5848,6 +5855,7 @@ static int usb_reset_and_verify_device(s
+ if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV)
+ break;
+ }
++ mutex_unlock(hcd->address0_mutex);
+
+ if (ret < 0)
+ goto re_enumerate;
--- /dev/null
+From 88459e3e42760abb2299bbf6cb1026491170e02a Mon Sep 17 00:00:00 2001
+From: Mingjie Zhang <superzmj@fibocom.com>
+Date: Tue, 23 Nov 2021 21:37:57 +0800
+Subject: USB: serial: option: add Fibocom FM101-GL variants
+
+From: Mingjie Zhang <superzmj@fibocom.com>
+
+commit 88459e3e42760abb2299bbf6cb1026491170e02a upstream.
+
+Update the USB serial option driver support for the Fibocom
+FM101-GL Cat.6
+LTE modules as there are actually several different variants.
+- VID:PID 2cb7:01a2, FM101-GL are laptop M.2 cards (with
+ MBIM interfaces for /Linux/Chrome OS)
+- VID:PID 2cb7:01a4, FM101-GL for laptop debug M.2 cards(with adb
+ interface for /Linux/Chrome OS)
+
+0x01a2: mbim, tty, tty, diag, gnss
+0x01a4: mbim, diag, tty, adb, gnss, gnss
+
+Here are the outputs of lsusb -v and usb-devices:
+
+T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 86 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=2cb7 ProdID=01a2 Rev= 5.04
+S: Manufacturer=Fibocom Wireless Inc.
+S: Product=Fibocom FM101-GL Module
+S: SerialNumber=673326ce
+C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA
+A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none)
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none)
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none)
+
+Bus 002 Device 084: ID 2cb7:01a2 Fibocom Wireless Inc. Fibocom FM101-GL Module
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 3.20
+ bDeviceClass 0
+ bDeviceSubClass 0
+ bDeviceProtocol 0
+ bMaxPacketSize0 9
+ idVendor 0x2cb7
+ idProduct 0x01a2
+ bcdDevice 5.04
+ iManufacturer 1 Fibocom Wireless Inc.
+ iProduct 2 Fibocom FM101-GL Module
+ iSerial 3 673326ce
+ bNumConfigurations 1
+ Configuration Descriptor:
+ bLength 9
+ bDescriptorType 2
+ wTotalLength 0x015d
+ bNumInterfaces 6
+ bConfigurationValue 1
+ iConfiguration 4 MBIM_DUN_DUN_DIAG_NMEA
+ bmAttributes 0xa0
+ (Bus Powered)
+ Remote Wakeup
+ MaxPower 896mA
+ Interface Association:
+ bLength 8
+ bDescriptorType 11
+ bFirstInterface 0
+ bInterfaceCount 2
+ bFunctionClass 2 Communications
+ bFunctionSubClass 14
+ bFunctionProtocol 0
+ iFunction 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 0
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 14
+ bInterfaceProtocol 0
+ iInterface 5 Fibocom FM101-GL LTE Modem
+ CDC Header:
+ bcdCDC 1.10
+ CDC Union:
+ bMasterInterface 0
+ bSlaveInterface 1
+ CDC MBIM:
+ bcdMBIMVersion 1.00
+ wMaxControlMessage 4096
+ bNumberFilters 32
+ bMaxFilterSize 128
+ wMaxSegmentSize 2048
+ bmNetworkCapabilities 0x20
+ 8-byte ntb input size
+ CDC MBIM Extended:
+ bcdMBIMExtendedVersion 1.00
+ bMaxOutstandingCommandMessages 64
+ wMTU 1500
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x81 EP 1 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0040 1x 64 bytes
+ bInterval 9
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 1
+ bAlternateSetting 0
+ bNumEndpoints 0
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0
+ bInterfaceProtocol 2
+ iInterface 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 1
+ bAlternateSetting 1
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0
+ bInterfaceProtocol 2
+ iInterface 6 MBIM Data
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x8e EP 14 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 6
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x0f EP 15 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 2
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 2
+ bAlternateSetting 0
+ bNumEndpoints 3
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 255 Vendor Specific Subclass
+ bInterfaceProtocol 64
+ iInterface 0
+ ** UNRECOGNIZED: 05 24 00 10 01
+ ** UNRECOGNIZED: 05 24 01 00 00
+ ** UNRECOGNIZED: 04 24 02 02
+ ** UNRECOGNIZED: 05 24 06 00 00
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x83 EP 3 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x000a 1x 10 bytes
+ bInterval 9
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x82 EP 2 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x01 EP 1 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 3
+ bAlternateSetting 0
+ bNumEndpoints 3
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 255 Vendor Specific Subclass
+ bInterfaceProtocol 64
+ iInterface 0
+ ** UNRECOGNIZED: 05 24 00 10 01
+ ** UNRECOGNIZED: 05 24 01 00 00
+ ** UNRECOGNIZED: 04 24 02 02
+ ** UNRECOGNIZED: 05 24 06 00 00
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x85 EP 5 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x000a 1x 10 bytes
+ bInterval 9
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x84 EP 4 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x02 EP 2 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 4
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 255 Vendor Specific Subclass
+ bInterfaceProtocol 48
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x03 EP 3 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x86 EP 6 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 5
+ bAlternateSetting 0
+ bNumEndpoints 3
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 0
+ bInterfaceProtocol 64
+ iInterface 0
+ ** UNRECOGNIZED: 05 24 00 10 01
+ ** UNRECOGNIZED: 05 24 01 00 00
+ ** UNRECOGNIZED: 04 24 02 02
+ ** UNRECOGNIZED: 05 24 06 00 00
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x88 EP 8 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x000a 1x 10 bytes
+ bInterval 9
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x87 EP 7 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x04 EP 4 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+
+T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 85 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=2cb7 ProdID=01a4 Rev= 5.04
+S: Manufacturer=Fibocom Wireless Inc.
+S: Product=Fibocom FM101-GL Module
+S: SerialNumber=673326ce
+C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA
+A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none)
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none)
+I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none)
+
+Bus 002 Device 085: ID 2cb7:01a4 Fibocom Wireless Inc. Fibocom FM101-GL Module
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 3.20
+ bDeviceClass 0
+ bDeviceSubClass 0
+ bDeviceProtocol 0
+ bMaxPacketSize0 9
+ idVendor 0x2cb7
+ idProduct 0x01a4
+ bcdDevice 5.04
+ iManufacturer 1 Fibocom Wireless Inc.
+ iProduct 2 Fibocom FM101-GL Module
+ iSerial 3 673326ce
+ bNumConfigurations 1
+ Configuration Descriptor:
+ bLength 9
+ bDescriptorType 2
+ wTotalLength 0x0180
+ bNumInterfaces 7
+ bConfigurationValue 1
+ iConfiguration 4 MBIM_DIAG_DUN_ADB_GNSS_GNSS
+ bmAttributes 0xa0
+ (Bus Powered)
+ Remote Wakeup
+ MaxPower 896mA
+ Interface Association:
+ bLength 8
+ bDescriptorType 11
+ bFirstInterface 0
+ bInterfaceCount 2
+ bFunctionClass 2 Communications
+ bFunctionSubClass 14
+ bFunctionProtocol 0
+ iFunction 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 0
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 14
+ bInterfaceProtocol 0
+ iInterface 5 Fibocom FM101-GL LTE Modem
+ CDC Header:
+ bcdCDC 1.10
+ CDC Union:
+ bMasterInterface 0
+ bSlaveInterface 1
+ CDC MBIM:
+ bcdMBIMVersion 1.00
+ wMaxControlMessage 4096
+ bNumberFilters 32
+ bMaxFilterSize 128
+ wMaxSegmentSize 2048
+ bmNetworkCapabilities 0x20
+ 8-byte ntb input size
+ CDC MBIM Extended:
+ bcdMBIMExtendedVersion 1.00
+ bMaxOutstandingCommandMessages 64
+ wMTU 1500
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x81 EP 1 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0040 1x 64 bytes
+ bInterval 9
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 1
+ bAlternateSetting 0
+ bNumEndpoints 0
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0
+ bInterfaceProtocol 2
+ iInterface 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 1
+ bAlternateSetting 1
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0
+ bInterfaceProtocol 2
+ iInterface 6 MBIM Data
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x8e EP 14 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 6
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x0f EP 15 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 2
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 2
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 255 Vendor Specific Subclass
+ bInterfaceProtocol 48
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x01 EP 1 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x82 EP 2 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 3
+ bAlternateSetting 0
+ bNumEndpoints 3
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 255 Vendor Specific Subclass
+ bInterfaceProtocol 64
+ iInterface 0
+ ** UNRECOGNIZED: 05 24 00 10 01
+ ** UNRECOGNIZED: 05 24 01 00 00
+ ** UNRECOGNIZED: 04 24 02 02
+ ** UNRECOGNIZED: 05 24 06 00 00
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x84 EP 4 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x000a 1x 10 bytes
+ bInterval 9
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x83 EP 3 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x02 EP 2 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 4
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 66
+ bInterfaceProtocol 1
+ iInterface 8 ADB Interface
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x03 EP 3 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x85 EP 5 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 5
+ bAlternateSetting 0
+ bNumEndpoints 3
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 0
+ bInterfaceProtocol 64
+ iInterface 0
+ ** UNRECOGNIZED: 05 24 00 10 01
+ ** UNRECOGNIZED: 05 24 01 00 00
+ ** UNRECOGNIZED: 04 24 02 02
+ ** UNRECOGNIZED: 05 24 06 00 00
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x87 EP 7 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x000a 1x 10 bytes
+ bInterval 9
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x86 EP 6 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x04 EP 4 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 6
+ bAlternateSetting 0
+ bNumEndpoints 3
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 0
+ bInterfaceProtocol 64
+ iInterface 0
+ ** UNRECOGNIZED: 05 24 00 10 01
+ ** UNRECOGNIZED: 05 24 01 00 00
+ ** UNRECOGNIZED: 04 24 02 02
+ ** UNRECOGNIZED: 05 24 06 00 00
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x89 EP 9 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x000a 1x 10 bytes
+ bInterval 9
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x88 EP 8 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x05 EP 5 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0400 1x 1024 bytes
+ bInterval 0
+ bMaxBurst 0
+
+Signed-off-by: Mingjie Zhang <superzmj@fibocom.com>
+Link: https://lore.kernel.org/r/20211123133757.37475-1-superzmj@fibocom.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2096,6 +2096,9 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */
++ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
--- /dev/null
+From e353f3e88720300c3d72f49a4bea54f42db1fa5e Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Fri, 19 Nov 2021 15:03:19 +0100
+Subject: USB: serial: option: add Telit LE910S1 0x9200 composition
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit e353f3e88720300c3d72f49a4bea54f42db1fa5e upstream.
+
+Add the following Telit LE910S1 composition:
+
+0x9200: tty
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Link: https://lore.kernel.org/r/20211119140319.10448-1-dnlplm@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1267,6 +1267,8 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
+ .driver_info = NCTRL(0) | ZLP },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */
++ .driver_info = NCTRL(0) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
--- /dev/null
+From 362468830dd5bea8bf6ad5203b2ea61f8a4e8288 Mon Sep 17 00:00:00 2001
+From: Ondrej Jirman <megous@megous.com>
+Date: Mon, 8 Nov 2021 11:28:32 +0100
+Subject: usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts
+
+From: Ondrej Jirman <megous@megous.com>
+
+commit 362468830dd5bea8bf6ad5203b2ea61f8a4e8288 upstream.
+
+The code that enables either BC_LVL or COMP_CHNG interrupt in tcpm_set_cc
+wrongly assumes that the interrupt is unmasked by writing 1 to the apropriate
+bit in the mask register. In fact, interrupts are enabled when the mask
+is 0, so the tcpm_set_cc enables interrupt for COMP_CHNG when it expects
+BC_LVL interrupt to be enabled.
+
+This causes inability of the driver to recognize cable unplug events
+in host mode (unplug is recognized only via a COMP_CHNG interrupt).
+
+In device mode this bug was masked by simultaneous triggering of the VBUS
+change interrupt, because of loss of VBUS when the port peer is providing
+power.
+
+Fixes: 48242e30532b ("usb: typec: fusb302: Revert "Resolve fixed power role contract setup"")
+Cc: stable <stable@vger.kernel.org>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Link: https://lore.kernel.org/r/20211108102833.2793803-1-megous@megous.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/fusb302.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/fusb302.c
++++ b/drivers/usb/typec/tcpm/fusb302.c
+@@ -669,25 +669,27 @@ static int tcpm_set_cc(struct tcpc_dev *
+ ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK,
+ FUSB_REG_MASK_BC_LVL |
+ FUSB_REG_MASK_COMP_CHNG,
+- FUSB_REG_MASK_COMP_CHNG);
++ FUSB_REG_MASK_BC_LVL);
+ if (ret < 0) {
+ fusb302_log(chip, "cannot set SRC interrupt, ret=%d",
+ ret);
+ goto done;
+ }
+ chip->intr_comp_chng = true;
++ chip->intr_bc_lvl = false;
+ break;
+ case TYPEC_CC_RD:
+ ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK,
+ FUSB_REG_MASK_BC_LVL |
+ FUSB_REG_MASK_COMP_CHNG,
+- FUSB_REG_MASK_BC_LVL);
++ FUSB_REG_MASK_COMP_CHNG);
+ if (ret < 0) {
+ fusb302_log(chip, "cannot set SRC interrupt, ret=%d",
+ ret);
+ goto done;
+ }
+ chip->intr_bc_lvl = true;
++ chip->intr_comp_chng = false;
+ break;
+ default:
+ break;
projects / thirdparty / kernel / stable-queue.git / commitdiff
