From: Greg Kroah-Hartman Date: Mon, 28 Feb 2022 06:49:23 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v4.9.304~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=31a469dc83e61c45d0efeaf53e2c3c0188a95307;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch driver-core-free-dma-range-map-when-device-is-released.patch iio-accel-fxls8962af-add-padding-to-regmap-for-spi.patch iio-adc-ad7124-fix-mask-used-for-setting-ain_bufp-ain_bufm-bits.patch iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch iio-adc-tsc2046-fix-memory-corruption-by-preventing-array-overflow.patch iio-fix-error-handling-for-pm.patch iio-imu-adis16480-fix-buffering-for-devices-with-no-burst-mode.patch iio-imu-st_lsm6dsx-wait-for-settling-time-in-st_lsm6dsx_read_oneshot.patch mtd-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch nvmem-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch sc16is7xx-fix-for-incorrect-data-being-transmitted.patch tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch tracing-have-traceon-and-traceoff-trigger-honor-the-instance.patch usb-dwc2-drd-fix-soft-connect-when-gadget-is-unconfigured.patch usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch usb-dwc3-pci-add-snps-dis_u2_susphy_quirk-for-intel-bay-trail.patch usb-dwc3-pci-fix-bay-trail-phy-gpio-mappings.patch usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch usb-gadget-validate-endpoint-index-for-xilinx-udc.patch usb-serial-option-add-support-for-dw5829e.patch usb-serial-option-add-telit-le910r1-compositions.patch xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch --- diff --git a/queue-5.15/ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch b/queue-5.15/ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch new file mode 100644 index 00000000000..109471856f7 --- /dev/null +++ b/queue-5.15/ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch @@ -0,0 +1,47 @@ +From 8d093e02e898b24c58788b0289e3202317a96d2a Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Sat, 19 Feb 2022 20:44:43 +0300 +Subject: ata: pata_hpt37x: disable primary channel on HPT371 + +From: Sergey Shtylyov + +commit 8d093e02e898b24c58788b0289e3202317a96d2a upstream. + +The HPT371 chip physically has only one channel, the secondary one, +however the primary channel registers do exist! Thus we have to +manually disable the non-existing channel if the BIOS hasn't done this +already. Similarly to the pata_hpt3x2n driver, always disable the +primary channel. + +Fixes: 669a5db411d8 ("[libata] Add a bunch of PATA drivers.") +Cc: stable@vger.kernel.org +Signed-off-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_hpt37x.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/ata/pata_hpt37x.c ++++ b/drivers/ata/pata_hpt37x.c +@@ -920,6 +920,20 @@ static int hpt37x_init_one(struct pci_de + pci_write_config_byte(dev, 0x5a, irqmask); + + /* ++ * HPT371 chips physically have only one channel, the secondary one, ++ * but the primary channel registers do exist! Go figure... ++ * So, we manually disable the non-existing channel here ++ * (if the BIOS hasn't done this already). ++ */ ++ if (dev->device == PCI_DEVICE_ID_TTI_HPT371) { ++ u8 mcr1; ++ ++ pci_read_config_byte(dev, 0x50, &mcr1); ++ mcr1 &= ~0x04; ++ pci_write_config_byte(dev, 0x50, mcr1); ++ } ++ ++ /* + * default to pci clock. make sure MA15/16 are set to output + * to prevent drives having problems with 40-pin cables. Needed + * for some drives such as IBM-DTLA which will not enter ready diff --git a/queue-5.15/driver-core-free-dma-range-map-when-device-is-released.patch b/queue-5.15/driver-core-free-dma-range-map-when-device-is-released.patch new file mode 100644 index 00000000000..6bcf0e0bb6c --- /dev/null +++ b/queue-5.15/driver-core-free-dma-range-map-when-device-is-released.patch @@ -0,0 +1,94 @@ +From d8f7a5484f2188e9af2d9e4e587587d724501b12 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?M=C3=A5rten=20Lindahl?= +Date: Wed, 16 Feb 2022 10:41:28 +0100 +Subject: driver core: Free DMA range map when device is released +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: MÃ¥rten Lindahl + +commit d8f7a5484f2188e9af2d9e4e587587d724501b12 upstream. + +When unbinding/binding a driver with DMA mapped memory, the DMA map is +not freed before the driver is reloaded. This leads to a memory leak +when the DMA map is overwritten when reprobing the driver. + +This can be reproduced with a platform driver having a dma-range: + +dummy { + ... + #address-cells = <0x2>; + #size-cells = <0x2>; + ranges; + dma-ranges = <...>; + ... +}; + +and then unbinding/binding it: + +~# echo soc:dummy >/sys/bus/platform/drivers//unbind + +DMA map object 0xffffff800b0ae540 still being held by &pdev->dev + +~# echo soc:dummy >/sys/bus/platform/drivers//bind +~# echo scan > /sys/kernel/debug/kmemleak +~# cat /sys/kernel/debug/kmemleak +unreferenced object 0xffffff800b0ae540 (size 64): + comm "sh", pid 833, jiffies 4295174550 (age 2535.352s) + hex dump (first 32 bytes): + 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 80 00 00 00 00 00 00 00 80 00 00 00 00 ................ + backtrace: + [] create_object.isra.0+0x108/0x344 + [] kmemleak_alloc+0x8c/0xd0 + [] __kmalloc+0x440/0x6f0 + [] of_dma_get_range+0x124/0x220 + [] of_dma_configure_id+0x40/0x2d0 + [] platform_dma_configure+0x5c/0xa4 + [] really_probe+0x8c/0x514 + [] __driver_probe_device+0x9c/0x19c + [] device_driver_attach+0x54/0xbc + [] bind_store+0xc4/0x120 + [] drv_attr_store+0x30/0x44 + [] sysfs_kf_write+0x50/0x60 + [] kernfs_fop_write_iter+0x124/0x1b4 + [] new_sync_write+0xdc/0x160 + [] vfs_write+0x23c/0x2a0 + [] ksys_write+0x64/0xec + +To prevent this we should free the dma_range_map when the device is +released. + +Fixes: e0d072782c73 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset") +Cc: stable +Suggested-by: Rob Herring +Reviewed-by: Rob Herring +Signed-off-by: MÃ¥rten Lindahl +Link: https://lore.kernel.org/r/20220216094128.4025861-1-marten.lindahl@axis.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/dd.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -629,6 +629,9 @@ re_probe: + drv->remove(dev); + + devres_release_all(dev); ++ arch_teardown_dma_ops(dev); ++ kfree(dev->dma_range_map); ++ dev->dma_range_map = NULL; + driver_sysfs_remove(dev); + dev->driver = NULL; + dev_set_drvdata(dev, NULL); +@@ -1208,6 +1211,8 @@ static void __device_release_driver(stru + + devres_release_all(dev); + arch_teardown_dma_ops(dev); ++ kfree(dev->dma_range_map); ++ dev->dma_range_map = NULL; + dev->driver = NULL; + dev_set_drvdata(dev, NULL); + if (dev->pm_domain && dev->pm_domain->dismiss) diff --git a/queue-5.15/iio-accel-fxls8962af-add-padding-to-regmap-for-spi.patch b/queue-5.15/iio-accel-fxls8962af-add-padding-to-regmap-for-spi.patch new file mode 100644 index 00000000000..f9d91d21712 --- /dev/null +++ b/queue-5.15/iio-accel-fxls8962af-add-padding-to-regmap-for-spi.patch @@ -0,0 +1,83 @@ +From ccbed9d8d2a5351d8238f2d3f0741c9a3176f752 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Mon, 20 Dec 2021 13:51:43 +0100 +Subject: iio: accel: fxls8962af: add padding to regmap for SPI + +From: Sean Nyekjaer + +commit ccbed9d8d2a5351d8238f2d3f0741c9a3176f752 upstream. + +Add missing don't care padding between address and +data for SPI transfers + +Fixes: a3e0b51884ee ("iio: accel: add support for FXLS8962AF/FXLS8964AF accelerometers") +Signed-off-by: Sean Nyekjaer +Link: https://lore.kernel.org/r/20211220125144.3630539-1-sean@geanix.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/fxls8962af-core.c | 12 ++++++++++-- + drivers/iio/accel/fxls8962af-i2c.c | 2 +- + drivers/iio/accel/fxls8962af-spi.c | 2 +- + drivers/iio/accel/fxls8962af.h | 3 ++- + 4 files changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/iio/accel/fxls8962af-core.c ++++ b/drivers/iio/accel/fxls8962af-core.c +@@ -154,12 +154,20 @@ struct fxls8962af_data { + u8 watermark; + }; + +-const struct regmap_config fxls8962af_regmap_conf = { ++const struct regmap_config fxls8962af_i2c_regmap_conf = { + .reg_bits = 8, + .val_bits = 8, + .max_register = FXLS8962AF_MAX_REG, + }; +-EXPORT_SYMBOL_GPL(fxls8962af_regmap_conf); ++EXPORT_SYMBOL_GPL(fxls8962af_i2c_regmap_conf); ++ ++const struct regmap_config fxls8962af_spi_regmap_conf = { ++ .reg_bits = 8, ++ .pad_bits = 8, ++ .val_bits = 8, ++ .max_register = FXLS8962AF_MAX_REG, ++}; ++EXPORT_SYMBOL_GPL(fxls8962af_spi_regmap_conf); + + enum { + fxls8962af_idx_x, +--- a/drivers/iio/accel/fxls8962af-i2c.c ++++ b/drivers/iio/accel/fxls8962af-i2c.c +@@ -18,7 +18,7 @@ static int fxls8962af_probe(struct i2c_c + { + struct regmap *regmap; + +- regmap = devm_regmap_init_i2c(client, &fxls8962af_regmap_conf); ++ regmap = devm_regmap_init_i2c(client, &fxls8962af_i2c_regmap_conf); + if (IS_ERR(regmap)) { + dev_err(&client->dev, "Failed to initialize i2c regmap\n"); + return PTR_ERR(regmap); +--- a/drivers/iio/accel/fxls8962af-spi.c ++++ b/drivers/iio/accel/fxls8962af-spi.c +@@ -18,7 +18,7 @@ static int fxls8962af_probe(struct spi_d + { + struct regmap *regmap; + +- regmap = devm_regmap_init_spi(spi, &fxls8962af_regmap_conf); ++ regmap = devm_regmap_init_spi(spi, &fxls8962af_spi_regmap_conf); + if (IS_ERR(regmap)) { + dev_err(&spi->dev, "Failed to initialize spi regmap\n"); + return PTR_ERR(regmap); +--- a/drivers/iio/accel/fxls8962af.h ++++ b/drivers/iio/accel/fxls8962af.h +@@ -17,6 +17,7 @@ int fxls8962af_core_probe(struct device + int fxls8962af_core_remove(struct device *dev); + + extern const struct dev_pm_ops fxls8962af_pm_ops; +-extern const struct regmap_config fxls8962af_regmap_conf; ++extern const struct regmap_config fxls8962af_i2c_regmap_conf; ++extern const struct regmap_config fxls8962af_spi_regmap_conf; + + #endif /* _FXLS8962AF_H_ */ diff --git a/queue-5.15/iio-adc-ad7124-fix-mask-used-for-setting-ain_bufp-ain_bufm-bits.patch b/queue-5.15/iio-adc-ad7124-fix-mask-used-for-setting-ain_bufp-ain_bufm-bits.patch new file mode 100644 index 00000000000..53131cec39e --- /dev/null +++ b/queue-5.15/iio-adc-ad7124-fix-mask-used-for-setting-ain_bufp-ain_bufm-bits.patch @@ -0,0 +1,37 @@ +From 0e33d15f1dce9e3a80a970ea7f0b27837168aeca Mon Sep 17 00:00:00 2001 +From: Cosmin Tanislav +Date: Wed, 12 Jan 2022 22:00:36 +0200 +Subject: iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits + +From: Cosmin Tanislav + +commit 0e33d15f1dce9e3a80a970ea7f0b27837168aeca upstream. + +According to page 90 of the datasheet [1], AIN_BUFP is bit 6 and +AIN_BUFM is bit 5 of the CONFIG_0 -> CONFIG_7 registers. + +Fix the mask used for setting these bits. + +[1]: https://www.analog.com/media/en/technical-documentation/data-sheets/ad7124-8.pdf + +Fixes: 0eaecea6e487 ("iio: adc: ad7124: Add buffered input support") +Signed-off-by: Cosmin Tanislav +Link: https://lore.kernel.org/r/20220112200036.694490-1-cosmin.tanislav@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7124.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7124.c ++++ b/drivers/iio/adc/ad7124.c +@@ -76,7 +76,7 @@ + #define AD7124_CONFIG_REF_SEL(x) FIELD_PREP(AD7124_CONFIG_REF_SEL_MSK, x) + #define AD7124_CONFIG_PGA_MSK GENMASK(2, 0) + #define AD7124_CONFIG_PGA(x) FIELD_PREP(AD7124_CONFIG_PGA_MSK, x) +-#define AD7124_CONFIG_IN_BUFF_MSK GENMASK(7, 6) ++#define AD7124_CONFIG_IN_BUFF_MSK GENMASK(6, 5) + #define AD7124_CONFIG_IN_BUFF(x) FIELD_PREP(AD7124_CONFIG_IN_BUFF_MSK, x) + + /* AD7124_FILTER_X */ diff --git a/queue-5.15/iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch b/queue-5.15/iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch new file mode 100644 index 00000000000..b8a828a49f8 --- /dev/null +++ b/queue-5.15/iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch @@ -0,0 +1,50 @@ +From e0a2e37f303828d030a83f33ffe14b36cb88d563 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 29 Jan 2022 09:32:47 +0100 +Subject: iio: adc: men_z188_adc: Fix a resource leak in an error handling path + +From: Christophe JAILLET + +commit e0a2e37f303828d030a83f33ffe14b36cb88d563 upstream. + +If iio_device_register() fails, a previous ioremap() is left unbalanced. + +Update the error handling path and add the missing iounmap() call, as +already done in the remove function. + +Fixes: 74aeac4da66f ("iio: adc: Add MEN 16z188 ADC driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/320fc777863880247c2aff4a9d1a54ba69abf080.1643445149.git.christophe.jaillet@wanadoo.fr +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/men_z188_adc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/men_z188_adc.c ++++ b/drivers/iio/adc/men_z188_adc.c +@@ -103,6 +103,7 @@ static int men_z188_probe(struct mcb_dev + struct z188_adc *adc; + struct iio_dev *indio_dev; + struct resource *mem; ++ int ret; + + indio_dev = devm_iio_device_alloc(&dev->dev, sizeof(struct z188_adc)); + if (!indio_dev) +@@ -128,8 +129,14 @@ static int men_z188_probe(struct mcb_dev + adc->mem = mem; + mcb_set_drvdata(dev, indio_dev); + +- return iio_device_register(indio_dev); ++ ret = iio_device_register(indio_dev); ++ if (ret) ++ goto err_unmap; + ++ return 0; ++ ++err_unmap: ++ iounmap(adc->base); + err: + mcb_release_mem(mem); + return -ENXIO; diff --git a/queue-5.15/iio-adc-tsc2046-fix-memory-corruption-by-preventing-array-overflow.patch b/queue-5.15/iio-adc-tsc2046-fix-memory-corruption-by-preventing-array-overflow.patch new file mode 100644 index 00000000000..0e3291a7e2d --- /dev/null +++ b/queue-5.15/iio-adc-tsc2046-fix-memory-corruption-by-preventing-array-overflow.patch @@ -0,0 +1,52 @@ +From b7a78a8adaa8849c02f174d707aead0f85dca0da Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Fri, 7 Jan 2022 09:14:01 +0100 +Subject: iio: adc: tsc2046: fix memory corruption by preventing array overflow + +From: Oleksij Rempel + +commit b7a78a8adaa8849c02f174d707aead0f85dca0da upstream. + +On one side we have indio_dev->num_channels includes all physical channels + +timestamp channel. On other side we have an array allocated only for +physical channels. So, fix memory corruption by ARRAY_SIZE() instead of +num_channels variable. + +Note the first case is a cleanup rather than a fix as the software +timestamp channel bit in active_scanmask is never set by the IIO core. + +Fixes: 9374e8f5a38d ("iio: adc: add ADC driver for the TI TSC2046 controller") +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20220107081401.2816357-1-o.rempel@pengutronix.de +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-tsc2046.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/adc/ti-tsc2046.c b/drivers/iio/adc/ti-tsc2046.c +index d84ae6b008c1..e8fc4d01f30b 100644 +--- a/drivers/iio/adc/ti-tsc2046.c ++++ b/drivers/iio/adc/ti-tsc2046.c +@@ -388,7 +388,7 @@ static int tsc2046_adc_update_scan_mode(struct iio_dev *indio_dev, + mutex_lock(&priv->slock); + + size = 0; +- for_each_set_bit(ch_idx, active_scan_mask, indio_dev->num_channels) { ++ for_each_set_bit(ch_idx, active_scan_mask, ARRAY_SIZE(priv->l)) { + size += tsc2046_adc_group_set_layout(priv, group, ch_idx); + tsc2046_adc_group_set_cmd(priv, group, ch_idx); + group++; +@@ -548,7 +548,7 @@ static int tsc2046_adc_setup_spi_msg(struct tsc2046_adc_priv *priv) + * enabled. + */ + size = 0; +- for (ch_idx = 0; ch_idx < priv->dcfg->num_channels; ch_idx++) ++ for (ch_idx = 0; ch_idx < ARRAY_SIZE(priv->l); ch_idx++) + size += tsc2046_adc_group_set_layout(priv, ch_idx, ch_idx); + + priv->tx = devm_kzalloc(&priv->spi->dev, size, GFP_KERNEL); +-- +2.35.1 + diff --git a/queue-5.15/iio-fix-error-handling-for-pm.patch b/queue-5.15/iio-fix-error-handling-for-pm.patch new file mode 100644 index 00000000000..d8be3178fa1 --- /dev/null +++ b/queue-5.15/iio-fix-error-handling-for-pm.patch @@ -0,0 +1,168 @@ +From 632fe0bb8c5b9c06ec961f575ee42a6fff5eceeb Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 6 Jan 2022 11:23:09 +0000 +Subject: iio: Fix error handling for PM + +From: Miaoqian Lin + +commit 632fe0bb8c5b9c06ec961f575ee42a6fff5eceeb upstream. + +The pm_runtime_enable will increase power disable depth. +If the probe fails, we should use pm_runtime_disable() to balance +pm_runtime_enable(). In the PM Runtime docs: + Drivers in ->remove() callback should undo the runtime PM changes done + in ->probe(). Usually this means calling pm_runtime_disable(), + pm_runtime_dont_use_autosuspend() etc. +We should do this in error handling. + +Fix this problem for the following drivers: bmc150, bmg160, kmx61, +kxcj-1013, mma9551, mma9553. + +Fixes: 7d0ead5c3f00 ("iio: Reconcile operation order between iio_register/unregister and pm functions") +Signed-off-by: Miaoqian Lin +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220106112309.16879-1-linmq006@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/bmc150-accel-core.c | 5 ++++- + drivers/iio/accel/kxcjk-1013.c | 5 ++++- + drivers/iio/accel/mma9551.c | 5 ++++- + drivers/iio/accel/mma9553.c | 5 ++++- + drivers/iio/gyro/bmg160_core.c | 5 ++++- + drivers/iio/imu/kmx61.c | 5 ++++- + drivers/iio/magnetometer/bmc150_magn.c | 5 +++-- + 7 files changed, 27 insertions(+), 8 deletions(-) + +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -1782,11 +1782,14 @@ int bmc150_accel_core_probe(struct devic + ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(dev, "Unable to register iio device\n"); +- goto err_trigger_unregister; ++ goto err_pm_cleanup; + } + + return 0; + ++err_pm_cleanup: ++ pm_runtime_dont_use_autosuspend(dev); ++ pm_runtime_disable(dev); + err_trigger_unregister: + bmc150_accel_unregister_triggers(data, BMC150_ACCEL_TRIGGERS - 1); + err_buffer_cleanup: +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -1589,11 +1589,14 @@ static int kxcjk1013_probe(struct i2c_cl + ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(&client->dev, "unable to register iio device\n"); +- goto err_buffer_cleanup; ++ goto err_pm_cleanup; + } + + return 0; + ++err_pm_cleanup: ++ pm_runtime_dont_use_autosuspend(&client->dev); ++ pm_runtime_disable(&client->dev); + err_buffer_cleanup: + iio_triggered_buffer_cleanup(indio_dev); + err_trigger_unregister: +--- a/drivers/iio/accel/mma9551.c ++++ b/drivers/iio/accel/mma9551.c +@@ -495,11 +495,14 @@ static int mma9551_probe(struct i2c_clie + ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(&client->dev, "unable to register iio device\n"); +- goto out_poweroff; ++ goto err_pm_cleanup; + } + + return 0; + ++err_pm_cleanup: ++ pm_runtime_dont_use_autosuspend(&client->dev); ++ pm_runtime_disable(&client->dev); + out_poweroff: + mma9551_set_device_state(client, false); + +--- a/drivers/iio/accel/mma9553.c ++++ b/drivers/iio/accel/mma9553.c +@@ -1134,12 +1134,15 @@ static int mma9553_probe(struct i2c_clie + ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(&client->dev, "unable to register iio device\n"); +- goto out_poweroff; ++ goto err_pm_cleanup; + } + + dev_dbg(&indio_dev->dev, "Registered device %s\n", name); + return 0; + ++err_pm_cleanup: ++ pm_runtime_dont_use_autosuspend(&client->dev); ++ pm_runtime_disable(&client->dev); + out_poweroff: + mma9551_set_device_state(client, false); + return ret; +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -1188,11 +1188,14 @@ int bmg160_core_probe(struct device *dev + ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(dev, "unable to register iio device\n"); +- goto err_buffer_cleanup; ++ goto err_pm_cleanup; + } + + return 0; + ++err_pm_cleanup: ++ pm_runtime_dont_use_autosuspend(dev); ++ pm_runtime_disable(dev); + err_buffer_cleanup: + iio_triggered_buffer_cleanup(indio_dev); + err_trigger_unregister: +--- a/drivers/iio/imu/kmx61.c ++++ b/drivers/iio/imu/kmx61.c +@@ -1385,7 +1385,7 @@ static int kmx61_probe(struct i2c_client + ret = iio_device_register(data->acc_indio_dev); + if (ret < 0) { + dev_err(&client->dev, "Failed to register acc iio device\n"); +- goto err_buffer_cleanup_mag; ++ goto err_pm_cleanup; + } + + ret = iio_device_register(data->mag_indio_dev); +@@ -1398,6 +1398,9 @@ static int kmx61_probe(struct i2c_client + + err_iio_unregister_acc: + iio_device_unregister(data->acc_indio_dev); ++err_pm_cleanup: ++ pm_runtime_dont_use_autosuspend(&client->dev); ++ pm_runtime_disable(&client->dev); + err_buffer_cleanup_mag: + if (client->irq > 0) + iio_triggered_buffer_cleanup(data->mag_indio_dev); +--- a/drivers/iio/magnetometer/bmc150_magn.c ++++ b/drivers/iio/magnetometer/bmc150_magn.c +@@ -962,13 +962,14 @@ int bmc150_magn_probe(struct device *dev + ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(dev, "unable to register iio device\n"); +- goto err_disable_runtime_pm; ++ goto err_pm_cleanup; + } + + dev_dbg(dev, "Registered device %s\n", name); + return 0; + +-err_disable_runtime_pm: ++err_pm_cleanup: ++ pm_runtime_dont_use_autosuspend(dev); + pm_runtime_disable(dev); + err_buffer_cleanup: + iio_triggered_buffer_cleanup(indio_dev); diff --git a/queue-5.15/iio-imu-adis16480-fix-buffering-for-devices-with-no-burst-mode.patch b/queue-5.15/iio-imu-adis16480-fix-buffering-for-devices-with-no-burst-mode.patch new file mode 100644 index 00000000000..20302a52d0d --- /dev/null +++ b/queue-5.15/iio-imu-adis16480-fix-buffering-for-devices-with-no-burst-mode.patch @@ -0,0 +1,56 @@ +From b0e85f95e30d4d2dc22ea123a30dba36406879a1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nuno=20S=C3=A1?= +Date: Fri, 14 Jan 2022 14:26:08 +0100 +Subject: iio:imu:adis16480: fix buffering for devices with no burst mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nuno Sá + +commit b0e85f95e30d4d2dc22ea123a30dba36406879a1 upstream. + +The trigger handler defined in the driver assumes that burst mode is +being used. Hence, for devices that do not support it, we have to use +the adis library default trigger implementation. + +Tested-by: Julia Pineda +Fixes: 941f130881fa9 ("iio: adis16480: support burst read function") +Signed-off-by: Nuno Sá +Link: https://lore.kernel.org/r/20220114132608.241-1-nuno.sa@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/adis16480.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c +index ed129321a14d..f9b4540db1f4 100644 +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -1403,6 +1403,7 @@ static int adis16480_probe(struct spi_device *spi) + { + const struct spi_device_id *id = spi_get_device_id(spi); + const struct adis_data *adis16480_data; ++ irq_handler_t trigger_handler = NULL; + struct iio_dev *indio_dev; + struct adis16480 *st; + int ret; +@@ -1474,8 +1475,12 @@ static int adis16480_probe(struct spi_device *spi) + st->clk_freq = st->chip_info->int_clk; + } + ++ /* Only use our trigger handler if burst mode is supported */ ++ if (adis16480_data->burst_len) ++ trigger_handler = adis16480_trigger_handler; ++ + ret = devm_adis_setup_buffer_and_trigger(&st->adis, indio_dev, +- adis16480_trigger_handler); ++ trigger_handler); + if (ret) + return ret; + +-- +2.35.1 + diff --git a/queue-5.15/iio-imu-st_lsm6dsx-wait-for-settling-time-in-st_lsm6dsx_read_oneshot.patch b/queue-5.15/iio-imu-st_lsm6dsx-wait-for-settling-time-in-st_lsm6dsx_read_oneshot.patch new file mode 100644 index 00000000000..db61b36c511 --- /dev/null +++ b/queue-5.15/iio-imu-st_lsm6dsx-wait-for-settling-time-in-st_lsm6dsx_read_oneshot.patch @@ -0,0 +1,40 @@ +From ea85bf906466191b58532bb19f4fbb4591f0a77e Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Sat, 5 Feb 2022 22:57:42 +0100 +Subject: iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot + +From: Lorenzo Bianconi + +commit ea85bf906466191b58532bb19f4fbb4591f0a77e upstream. + +We need to wait for sensor settling time (~ 3/ODR) before reading data +in st_lsm6dsx_read_oneshot routine in order to avoid corrupted samples. + +Fixes: 290a6ce11d93 ("iio: imu: add support to lsm6dsx driver") +Reported-by: Mario Tesi +Tested-by: Mario Tesi +Signed-off-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/b41ebda5535895298716c76d939f9f165fcd2d13.1644098120.git.lorenzo@kernel.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -1372,8 +1372,12 @@ static int st_lsm6dsx_read_oneshot(struc + if (err < 0) + return err; + ++ /* ++ * we need to wait for sensor settling time before ++ * reading data in order to avoid corrupted samples ++ */ + delay = 1000000000 / sensor->odr; +- usleep_range(delay, 2 * delay); ++ usleep_range(3 * delay, 4 * delay); + + err = st_lsm6dsx_read_locked(hw, addr, &data, sizeof(data)); + if (err < 0) diff --git a/queue-5.15/mtd-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch b/queue-5.15/mtd-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch new file mode 100644 index 00000000000..4ce04ead67e --- /dev/null +++ b/queue-5.15/mtd-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch @@ -0,0 +1,55 @@ +From 6c7621890995d089a56a06d11580d185ede7c2f8 Mon Sep 17 00:00:00 2001 +From: Christophe Kerello +Date: Sun, 20 Feb 2022 15:14:32 +0000 +Subject: mtd: core: Fix a conflict between MTD and NVMEM on wp-gpios property + +From: Christophe Kerello + +commit 6c7621890995d089a56a06d11580d185ede7c2f8 upstream. + +Wp-gpios property can be used on NVMEM nodes and the same property can +be also used on MTD NAND nodes. In case of the wp-gpios property is +defined at NAND level node, the GPIO management is done at NAND driver +level. Write protect is disabled when the driver is probed or resumed +and is enabled when the driver is released or suspended. + +When no partitions are defined in the NAND DT node, then the NAND DT node +will be passed to NVMEM framework. If wp-gpios property is defined in +this node, the GPIO resource is taken twice and the NAND controller +driver fails to probe. + +A new Boolean flag named ignore_wp has been added in nvmem_config. +In case ignore_wp is set, it means that the GPIO is handled by the +provider. Lets set this flag in MTD layer to avoid the conflict on +wp_gpios property. + +Fixes: 2a127da461a9 ("nvmem: add support for the write-protect pin") +Cc: stable@vger.kernel.org +Acked-by: Miquel Raynal +Signed-off-by: Christophe Kerello +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220220151432.16605-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/mtdcore.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -546,6 +546,7 @@ static int mtd_nvmem_add(struct mtd_info + config.stride = 1; + config.read_only = true; + config.root_only = true; ++ config.ignore_wp = true; + config.no_of_node = !of_device_is_compatible(node, "nvmem-cells"); + config.priv = mtd; + +@@ -830,6 +831,7 @@ static struct nvmem_device *mtd_otp_nvme + config.owner = THIS_MODULE; + config.type = NVMEM_TYPE_OTP; + config.root_only = true; ++ config.ignore_wp = true; + config.reg_read = reg_read; + config.size = size; + config.of_node = np; diff --git a/queue-5.15/nvmem-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch b/queue-5.15/nvmem-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch new file mode 100644 index 00000000000..b6735ca2298 --- /dev/null +++ b/queue-5.15/nvmem-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch @@ -0,0 +1,71 @@ +From f6c052afe6f802d87c74153b7a57c43b2e9faf07 Mon Sep 17 00:00:00 2001 +From: Christophe Kerello +Date: Sun, 20 Feb 2022 15:14:31 +0000 +Subject: nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property + +From: Christophe Kerello + +commit f6c052afe6f802d87c74153b7a57c43b2e9faf07 upstream. + +Wp-gpios property can be used on NVMEM nodes and the same property can +be also used on MTD NAND nodes. In case of the wp-gpios property is +defined at NAND level node, the GPIO management is done at NAND driver +level. Write protect is disabled when the driver is probed or resumed +and is enabled when the driver is released or suspended. + +When no partitions are defined in the NAND DT node, then the NAND DT node +will be passed to NVMEM framework. If wp-gpios property is defined in +this node, the GPIO resource is taken twice and the NAND controller +driver fails to probe. + +It would be possible to set config->wp_gpio at MTD level before calling +nvmem_register function but NVMEM framework will toggle this GPIO on +each write when this GPIO should only be controlled at NAND level driver +to ensure that the Write Protect has not been enabled. + +A way to fix this conflict is to add a new boolean flag in nvmem_config +named ignore_wp. In case ignore_wp is set, the GPIO resource will +be managed by the provider. + +Fixes: 2a127da461a9 ("nvmem: add support for the write-protect pin") +Cc: stable@vger.kernel.org +Signed-off-by: Christophe Kerello +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220220151432.16605-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 2 +- + include/linux/nvmem-provider.h | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -768,7 +768,7 @@ struct nvmem_device *nvmem_register(cons + + if (config->wp_gpio) + nvmem->wp_gpio = config->wp_gpio; +- else ++ else if (!config->ignore_wp) + nvmem->wp_gpio = gpiod_get_optional(config->dev, "wp", + GPIOD_OUT_HIGH); + if (IS_ERR(nvmem->wp_gpio)) { +--- a/include/linux/nvmem-provider.h ++++ b/include/linux/nvmem-provider.h +@@ -66,7 +66,8 @@ struct nvmem_keepout { + * @word_size: Minimum read/write access granularity. + * @stride: Minimum read/write access stride. + * @priv: User context passed to read/write callbacks. +- * @wp-gpio: Write protect pin ++ * @wp-gpio: Write protect pin ++ * @ignore_wp: Write Protect pin is managed by the provider. + * + * Note: A default "nvmem" name will be assigned to the device if + * no name is specified in its configuration. In such case "" is +@@ -88,6 +89,7 @@ struct nvmem_config { + enum nvmem_type type; + bool read_only; + bool root_only; ++ bool ignore_wp; + struct device_node *of_node; + bool no_of_node; + nvmem_reg_read_t reg_read; diff --git a/queue-5.15/revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch b/queue-5.15/revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch new file mode 100644 index 00000000000..f1c99f136f0 --- /dev/null +++ b/queue-5.15/revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch @@ -0,0 +1,37 @@ +From 198a7ebd5fa17b4d0be8cb70240ee1be885175c0 Mon Sep 17 00:00:00 2001 +From: Dmytro Bagrii +Date: Thu, 10 Feb 2022 18:41:37 +0200 +Subject: Revert "USB: serial: ch341: add new Product ID for CH341A" + +From: Dmytro Bagrii + +commit 198a7ebd5fa17b4d0be8cb70240ee1be885175c0 upstream. + +This reverts commit 46ee4abb10a07bd8f8ce910ee6b4ae6a947d7f63. + +CH341 has Product ID 0x5512 in EPP/MEM mode which is used for +I2C/SPI/GPIO interfaces. In asynchronous serial interface mode +CH341 has PID 0x5523 which is already in the table. + +Mode is selected by corresponding jumper setting. + +Signed-off-by: Dmytro Bagrii +Link: https://lore.kernel.org/r/20220210164137.4376-1-dimich.dmb@gmail.com +Link: https://lore.kernel.org/r/YJ0OCS/sh+1ifD/q@hovoldconsulting.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ch341.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -81,7 +81,6 @@ + #define CH341_QUIRK_SIMULATE_BREAK BIT(1) + + static const struct usb_device_id id_table[] = { +- { USB_DEVICE(0x1a86, 0x5512) }, + { USB_DEVICE(0x1a86, 0x5523) }, + { USB_DEVICE(0x1a86, 0x7522) }, + { USB_DEVICE(0x1a86, 0x7523) }, diff --git a/queue-5.15/sc16is7xx-fix-for-incorrect-data-being-transmitted.patch b/queue-5.15/sc16is7xx-fix-for-incorrect-data-being-transmitted.patch new file mode 100644 index 00000000000..ee29d17edb8 --- /dev/null +++ b/queue-5.15/sc16is7xx-fix-for-incorrect-data-being-transmitted.patch @@ -0,0 +1,55 @@ +From eebb0f4e894f1e9577a56b337693d1051dd6ebfd Mon Sep 17 00:00:00 2001 +From: Phil Elwell +Date: Wed, 16 Feb 2022 16:08:02 +0000 +Subject: sc16is7xx: Fix for incorrect data being transmitted + +From: Phil Elwell + +commit eebb0f4e894f1e9577a56b337693d1051dd6ebfd upstream. + +UART drivers are meant to use the port spinlock within certain +methods, to protect against reentrancy. The sc16is7xx driver does +very little locking, presumably because when added it triggers +"scheduling while atomic" errors. This is due to the use of mutexes +within the regmap abstraction layer, and the mutex implementation's +habit of sleeping the current thread while waiting for access. +Unfortunately this lack of interlocking can lead to corruption of +outbound data, which occurs when the buffer used for I2C transmission +is used simultaneously by two threads - a work queue thread running +sc16is7xx_tx_proc, and an IRQ thread in sc16is7xx_port_irq, both +of which can call sc16is7xx_handle_tx. + +An earlier patch added efr_lock, a mutex that controls access to the +EFR register. This mutex is already claimed in the IRQ handler, and +all that is required is to claim the same mutex in sc16is7xx_tx_proc. + +See: https://github.com/raspberrypi/linux/issues/4885 + +Fixes: 6393ff1c4435 ("sc16is7xx: Use threaded IRQ") +Cc: stable +Signed-off-by: Phil Elwell +Link: https://lore.kernel.org/r/20220216160802.1026013-1-phil@raspberrypi.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/sc16is7xx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -734,12 +734,15 @@ static irqreturn_t sc16is7xx_irq(int irq + static void sc16is7xx_tx_proc(struct kthread_work *ws) + { + struct uart_port *port = &(to_sc16is7xx_one(ws, tx_work)->port); ++ struct sc16is7xx_port *s = dev_get_drvdata(port->dev); + + if ((port->rs485.flags & SER_RS485_ENABLED) && + (port->rs485.delay_rts_before_send > 0)) + msleep(port->rs485.delay_rts_before_send); + ++ mutex_lock(&s->efr_lock); + sc16is7xx_handle_tx(port); ++ mutex_unlock(&s->efr_lock); + } + + static void sc16is7xx_reconf_rs485(struct uart_port *port) diff --git a/queue-5.15/series b/queue-5.15/series index a9c10cee538..12ac1262ba3 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -91,3 +91,29 @@ rdma-rtrs-clt-move-free_permit-from-free_clt-to-rtrs.patch bnxt_en-increase-firmware-message-response-dma-wait-.patch configfs-fix-a-race-in-configfs_-un-register_subsyst.patch rdma-ib_srp-fix-a-deadlock.patch +tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch +tracing-have-traceon-and-traceoff-trigger-honor-the-instance.patch +iio-imu-adis16480-fix-buffering-for-devices-with-no-burst-mode.patch +iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch +iio-adc-tsc2046-fix-memory-corruption-by-preventing-array-overflow.patch +iio-adc-ad7124-fix-mask-used-for-setting-ain_bufp-ain_bufm-bits.patch +iio-accel-fxls8962af-add-padding-to-regmap-for-spi.patch +iio-imu-st_lsm6dsx-wait-for-settling-time-in-st_lsm6dsx_read_oneshot.patch +iio-fix-error-handling-for-pm.patch +sc16is7xx-fix-for-incorrect-data-being-transmitted.patch +ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch +revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch +usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch +usb-gadget-validate-endpoint-index-for-xilinx-udc.patch +tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch +usb-serial-option-add-support-for-dw5829e.patch +usb-serial-option-add-telit-le910r1-compositions.patch +usb-dwc2-drd-fix-soft-connect-when-gadget-is-unconfigured.patch +usb-dwc3-pci-add-snps-dis_u2_susphy_quirk-for-intel-bay-trail.patch +usb-dwc3-pci-fix-bay-trail-phy-gpio-mappings.patch +usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch +xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch +xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch +nvmem-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch +mtd-core-fix-a-conflict-between-mtd-and-nvmem-on-wp-gpios-property.patch +driver-core-free-dma-range-map-when-device-is-released.patch diff --git a/queue-5.15/tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch b/queue-5.15/tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch new file mode 100644 index 00000000000..2b9dd7f9499 --- /dev/null +++ b/queue-5.15/tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch @@ -0,0 +1,50 @@ +From 851e99ebeec3f4a672bb5010cf1ece095acee447 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Fri, 25 Feb 2022 15:34:26 -0500 +Subject: tracefs: Set the group ownership in apply_options() not parse_options() + +From: Steven Rostedt (Google) + +commit 851e99ebeec3f4a672bb5010cf1ece095acee447 upstream. + +Al Viro brought it to my attention that the dentries may not be filled +when the parse_options() is called, causing the call to set_gid() to +possibly crash. It should only be called if parse_options() succeeds +totally anyway. + +He suggested the logical place to do the update is in apply_options(). + +Link: https://lore.kernel.org/all/20220225165219.737025658@goodmis.org/ +Link: https://lkml.kernel.org/r/20220225153426.1c4cab6b@gandalf.local.home + +Cc: stable@vger.kernel.org +Acked-by: Al Viro +Reported-by: Al Viro +Fixes: 48b27b6b5191 ("tracefs: Set all files to the same group ownership as the mount option") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + fs/tracefs/inode.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/tracefs/inode.c ++++ b/fs/tracefs/inode.c +@@ -264,7 +264,6 @@ static int tracefs_parse_options(char *d + if (!gid_valid(gid)) + return -EINVAL; + opts->gid = gid; +- set_gid(tracefs_mount->mnt_root, gid); + break; + case Opt_mode: + if (match_octal(&args[0], &option)) +@@ -291,7 +290,9 @@ static int tracefs_apply_options(struct + inode->i_mode |= opts->mode; + + inode->i_uid = opts->uid; +- inode->i_gid = opts->gid; ++ ++ /* Set all the group ids to the mount option */ ++ set_gid(sb->s_root, opts->gid); + + return 0; + } diff --git a/queue-5.15/tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch b/queue-5.15/tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch new file mode 100644 index 00000000000..c8064403140 --- /dev/null +++ b/queue-5.15/tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch @@ -0,0 +1,45 @@ +From ce33c845b030c9cf768370c951bc699470b09fa7 Mon Sep 17 00:00:00 2001 +From: Daniel Bristot de Oliveira +Date: Sun, 20 Feb 2022 23:49:57 +0100 +Subject: tracing: Dump stacktrace trigger to the corresponding instance + +From: Daniel Bristot de Oliveira + +commit ce33c845b030c9cf768370c951bc699470b09fa7 upstream. + +The stacktrace event trigger is not dumping the stacktrace to the instance +where it was enabled, but to the global "instance." + +Use the private_data, pointing to the trigger file, to figure out the +corresponding trace instance, and use it in the trigger action, like +snapshot_trigger does. + +Link: https://lkml.kernel.org/r/afbb0b4f18ba92c276865bc97204d438473f4ebc.1645396236.git.bristot@kernel.org + +Cc: stable@vger.kernel.org +Fixes: ae63b31e4d0e2 ("tracing: Separate out trace events from global variables") +Reviewed-by: Tom Zanussi +Tested-by: Tom Zanussi +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_trigger.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -1200,7 +1200,12 @@ stacktrace_trigger(struct event_trigger_ + struct trace_buffer *buffer, void *rec, + struct ring_buffer_event *event) + { +- trace_dump_stack(STACK_SKIP); ++ struct trace_event_file *file = data->private_data; ++ ++ if (file) ++ __trace_stack(file->tr, tracing_gen_ctx(), STACK_SKIP); ++ else ++ trace_dump_stack(STACK_SKIP); + } + + static void diff --git a/queue-5.15/tracing-have-traceon-and-traceoff-trigger-honor-the-instance.patch b/queue-5.15/tracing-have-traceon-and-traceoff-trigger-honor-the-instance.patch new file mode 100644 index 00000000000..fca5972037d --- /dev/null +++ b/queue-5.15/tracing-have-traceon-and-traceoff-trigger-honor-the-instance.patch @@ -0,0 +1,121 @@ +From 302e9edd54985f584cfc180098f3554774126969 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Wed, 23 Feb 2022 22:38:37 -0500 +Subject: tracing: Have traceon and traceoff trigger honor the instance + +From: Steven Rostedt (Google) + +commit 302e9edd54985f584cfc180098f3554774126969 upstream. + +If a trigger is set on an event to disable or enable tracing within an +instance, then tracing should be disabled or enabled in the instance and +not at the top level, which is confusing to users. + +Link: https://lkml.kernel.org/r/20220223223837.14f94ec3@rorschach.local.home + +Cc: stable@vger.kernel.org +Fixes: ae63b31e4d0e2 ("tracing: Separate out trace events from global variables") +Tested-by: Daniel Bristot de Oliveira +Reviewed-by: Tom Zanussi +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_trigger.c | 52 +++++++++++++++++++++++++++++++----- + 1 file changed, 46 insertions(+), 6 deletions(-) + +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -955,6 +955,16 @@ traceon_trigger(struct event_trigger_dat + struct trace_buffer *buffer, void *rec, + struct ring_buffer_event *event) + { ++ struct trace_event_file *file = data->private_data; ++ ++ if (file) { ++ if (tracer_tracing_is_on(file->tr)) ++ return; ++ ++ tracer_tracing_on(file->tr); ++ return; ++ } ++ + if (tracing_is_on()) + return; + +@@ -966,8 +976,15 @@ traceon_count_trigger(struct event_trigg + struct trace_buffer *buffer, void *rec, + struct ring_buffer_event *event) + { +- if (tracing_is_on()) +- return; ++ struct trace_event_file *file = data->private_data; ++ ++ if (file) { ++ if (tracer_tracing_is_on(file->tr)) ++ return; ++ } else { ++ if (tracing_is_on()) ++ return; ++ } + + if (!data->count) + return; +@@ -975,7 +992,10 @@ traceon_count_trigger(struct event_trigg + if (data->count != -1) + (data->count)--; + +- tracing_on(); ++ if (file) ++ tracer_tracing_on(file->tr); ++ else ++ tracing_on(); + } + + static void +@@ -983,6 +1003,16 @@ traceoff_trigger(struct event_trigger_da + struct trace_buffer *buffer, void *rec, + struct ring_buffer_event *event) + { ++ struct trace_event_file *file = data->private_data; ++ ++ if (file) { ++ if (!tracer_tracing_is_on(file->tr)) ++ return; ++ ++ tracer_tracing_off(file->tr); ++ return; ++ } ++ + if (!tracing_is_on()) + return; + +@@ -994,8 +1024,15 @@ traceoff_count_trigger(struct event_trig + struct trace_buffer *buffer, void *rec, + struct ring_buffer_event *event) + { +- if (!tracing_is_on()) +- return; ++ struct trace_event_file *file = data->private_data; ++ ++ if (file) { ++ if (!tracer_tracing_is_on(file->tr)) ++ return; ++ } else { ++ if (!tracing_is_on()) ++ return; ++ } + + if (!data->count) + return; +@@ -1003,7 +1040,10 @@ traceoff_count_trigger(struct event_trig + if (data->count != -1) + (data->count)--; + +- tracing_off(); ++ if (file) ++ tracer_tracing_off(file->tr); ++ else ++ tracing_off(); + } + + static int diff --git a/queue-5.15/usb-dwc2-drd-fix-soft-connect-when-gadget-is-unconfigured.patch b/queue-5.15/usb-dwc2-drd-fix-soft-connect-when-gadget-is-unconfigured.patch new file mode 100644 index 00000000000..33791778a9e --- /dev/null +++ b/queue-5.15/usb-dwc2-drd-fix-soft-connect-when-gadget-is-unconfigured.patch @@ -0,0 +1,68 @@ +From 32fde84362c40961726a5c91f35ad37355ccc0c6 Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Wed, 16 Feb 2022 09:12:15 +0100 +Subject: usb: dwc2: drd: fix soft connect when gadget is unconfigured + +From: Fabrice Gasnier + +commit 32fde84362c40961726a5c91f35ad37355ccc0c6 upstream. + +When the gadget driver hasn't been (yet) configured, and the cable is +connected to a HOST, the SFTDISCON gets cleared unconditionally, so the +HOST tries to enumerate it. +At the host side, this can result in a stuck USB port or worse. When +getting lucky, some dmesg can be observed at the host side: + new high-speed USB device number ... + device descriptor read/64, error -110 + +Fix it in drd, by checking the enabled flag before calling +dwc2_hsotg_core_connect(). It will be called later, once configured, +by the normal flow: +- udc_bind_to_driver + - usb_gadget_connect + - dwc2_hsotg_pullup + - dwc2_hsotg_core_connect + +Fixes: 17f934024e84 ("usb: dwc2: override PHY input signals with usb role switch support") +Cc: stable +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/1644999135-13478-1-git-send-email-fabrice.gasnier@foss.st.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/core.h | 2 ++ + drivers/usb/dwc2/drd.c | 6 ++++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -1417,6 +1417,7 @@ void dwc2_hsotg_core_connect(struct dwc2 + void dwc2_hsotg_disconnect(struct dwc2_hsotg *dwc2); + int dwc2_hsotg_set_test_mode(struct dwc2_hsotg *hsotg, int testmode); + #define dwc2_is_device_connected(hsotg) (hsotg->connected) ++#define dwc2_is_device_enabled(hsotg) (hsotg->enabled) + int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg); + int dwc2_restore_device_registers(struct dwc2_hsotg *hsotg, int remote_wakeup); + int dwc2_gadget_enter_hibernation(struct dwc2_hsotg *hsotg); +@@ -1453,6 +1454,7 @@ static inline int dwc2_hsotg_set_test_mo + int testmode) + { return 0; } + #define dwc2_is_device_connected(hsotg) (0) ++#define dwc2_is_device_enabled(hsotg) (0) + static inline int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg) + { return 0; } + static inline int dwc2_restore_device_registers(struct dwc2_hsotg *hsotg, +--- a/drivers/usb/dwc2/drd.c ++++ b/drivers/usb/dwc2/drd.c +@@ -109,8 +109,10 @@ static int dwc2_drd_role_sw_set(struct u + already = dwc2_ovr_avalid(hsotg, true); + } else if (role == USB_ROLE_DEVICE) { + already = dwc2_ovr_bvalid(hsotg, true); +- /* This clear DCTL.SFTDISCON bit */ +- dwc2_hsotg_core_connect(hsotg); ++ if (dwc2_is_device_enabled(hsotg)) { ++ /* This clear DCTL.SFTDISCON bit */ ++ dwc2_hsotg_core_connect(hsotg); ++ } + } else { + if (dwc2_is_device_mode(hsotg)) { + if (!dwc2_ovr_bvalid(hsotg, false)) diff --git a/queue-5.15/usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch b/queue-5.15/usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch new file mode 100644 index 00000000000..4cb672a6686 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch @@ -0,0 +1,57 @@ +From 84918a89d6efaff075de570b55642b6f4ceeac6d Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Fri, 18 Feb 2022 18:32:45 +0100 +Subject: usb: dwc3: gadget: Let the interrupt handler disable bottom halves. + +From: Sebastian Andrzej Siewior + +commit 84918a89d6efaff075de570b55642b6f4ceeac6d upstream. + +The interrupt service routine registered for the gadget is a primary +handler which mask the interrupt source and a threaded handler which +handles the source of the interrupt. Since the threaded handler is +voluntary threaded, the IRQ-core does not disable bottom halves before +invoke the handler like it does for the forced-threaded handler. + +Due to changes in networking it became visible that a network gadget's +completions handler may schedule a softirq which remains unprocessed. +The gadget's completion handler is usually invoked either in hard-IRQ or +soft-IRQ context. In this context it is enough to just raise the softirq +because the softirq itself will be handled once that context is left. +In the case of the voluntary threaded handler, there is nothing that +will process pending softirqs. Which means it remain queued until +another random interrupt (on this CPU) fires and handles it on its exit +path or another thread locks and unlocks a lock with the bh suffix. +Worst case is that the CPU goes idle and the NOHZ complains about +unhandled softirqs. + +Disable bottom halves before acquiring the lock (and disabling +interrupts) and enable them after dropping the lock. This ensures that +any pending softirqs will handled right away. + +Link: https://lkml.kernel.org/r/c2a64979-73d1-2c22-e048-c275c9f81558@samsung.com +Fixes: e5f68b4a3e7b0 ("Revert "usb: dwc3: gadget: remove unnecessary _irqsave()"") +Cc: stable +Reported-by: Marek Szyprowski +Tested-by: Marek Szyprowski +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/Yg/YPejVQH3KkRVd@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -4131,9 +4131,11 @@ static irqreturn_t dwc3_thread_interrupt + unsigned long flags; + irqreturn_t ret = IRQ_NONE; + ++ local_bh_disable(); + spin_lock_irqsave(&dwc->lock, flags); + ret = dwc3_process_event_buf(evt); + spin_unlock_irqrestore(&dwc->lock, flags); ++ local_bh_enable(); + + return ret; + } diff --git a/queue-5.15/usb-dwc3-pci-add-snps-dis_u2_susphy_quirk-for-intel-bay-trail.patch b/queue-5.15/usb-dwc3-pci-add-snps-dis_u2_susphy_quirk-for-intel-bay-trail.patch new file mode 100644 index 00000000000..279acf63a24 --- /dev/null +++ b/queue-5.15/usb-dwc3-pci-add-snps-dis_u2_susphy_quirk-for-intel-bay-trail.patch @@ -0,0 +1,73 @@ +From d7c93a903f33ff35aa0e6b5a8032eb9755b00826 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 13 Feb 2022 14:05:16 +0100 +Subject: usb: dwc3: pci: Add "snps,dis_u2_susphy_quirk" for Intel Bay Trail + +From: Hans de Goede + +commit d7c93a903f33ff35aa0e6b5a8032eb9755b00826 upstream. + +Commit e0082698b689 ("usb: dwc3: ulpi: conditionally resume ULPI PHY") +fixed an issue where ULPI transfers would timeout if any requests where +send to the phy sometime after init, giving it enough time to auto-suspend. + +Commit e5f4ca3fce90 ("usb: dwc3: ulpi: Fix USB2.0 HS/FS/LS PHY suspend +regression") changed the behavior to instead of clearing the +DWC3_GUSB2PHYCFG_SUSPHY bit, add an extra sleep when it is set. + +But on Bay Trail devices, when phy_set_mode() gets called during init, +this leads to errors like these: +[ 28.451522] tusb1210 dwc3.ulpi: error -110 writing val 0x01 to reg 0x0a +[ 28.464089] tusb1210 dwc3.ulpi: error -110 writing val 0x01 to reg 0x0a + +Add "snps,dis_u2_susphy_quirk" to the settings for Bay Trail devices to +fix this. This restores the old behavior for Bay Trail devices, since +previously the DWC3_GUSB2PHYCFG_SUSPHY bit would get cleared on the first +ulpi_read/_write() and then was never set again. + +Fixes: e5f4ca3fce90 ("usb: dwc3: ulpi: Fix USB2.0 HS/FS/LS PHY suspend regression") +Cc: stable@kernel.org +Cc: Serge Semin +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220213130524.18748-2-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -119,6 +119,13 @@ static const struct property_entry dwc3_ + {} + }; + ++static const struct property_entry dwc3_pci_intel_byt_properties[] = { ++ PROPERTY_ENTRY_STRING("dr_mode", "peripheral"), ++ PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"), ++ PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"), ++ {} ++}; ++ + static const struct property_entry dwc3_pci_mrfld_properties[] = { + PROPERTY_ENTRY_STRING("dr_mode", "otg"), + PROPERTY_ENTRY_STRING("linux,extcon-name", "mrfld_bcove_pwrsrc"), +@@ -161,6 +168,10 @@ static const struct software_node dwc3_p + .properties = dwc3_pci_intel_properties, + }; + ++static const struct software_node dwc3_pci_intel_byt_swnode = { ++ .properties = dwc3_pci_intel_byt_properties, ++}; ++ + static const struct software_node dwc3_pci_intel_mrfld_swnode = { + .properties = dwc3_pci_mrfld_properties, + }; +@@ -344,7 +355,7 @@ static const struct pci_device_id dwc3_p + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BYT), +- (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ (kernel_ulong_t) &dwc3_pci_intel_byt_swnode, }, + + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD), + (kernel_ulong_t) &dwc3_pci_intel_mrfld_swnode, }, diff --git a/queue-5.15/usb-dwc3-pci-fix-bay-trail-phy-gpio-mappings.patch b/queue-5.15/usb-dwc3-pci-fix-bay-trail-phy-gpio-mappings.patch new file mode 100644 index 00000000000..00990d67b04 --- /dev/null +++ b/queue-5.15/usb-dwc3-pci-fix-bay-trail-phy-gpio-mappings.patch @@ -0,0 +1,39 @@ +From 62e3f0afe246720f7646eb1b034a6897dac34405 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 13 Feb 2022 14:05:17 +0100 +Subject: usb: dwc3: pci: Fix Bay Trail phy GPIO mappings + +From: Hans de Goede + +commit 62e3f0afe246720f7646eb1b034a6897dac34405 upstream. + +When the Bay Trail phy GPIO mappings where added cs and reset were swapped, +this did not cause any issues sofar, because sofar they were always driven +high/low at the same time. + +Note the new mapping has been verified both in /sys/kernel/debug/gpio +output on Android factory images on multiple devices, as well as in +the schematics for some devices. + +Fixes: 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table on platforms without ACPI GPIO resources") +Cc: stable +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220213130524.18748-3-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -85,8 +85,8 @@ static const struct acpi_gpio_mapping ac + static struct gpiod_lookup_table platform_bytcr_gpios = { + .dev_id = "0000:00:16.0", + .table = { +- GPIO_LOOKUP("INT33FC:00", 54, "reset", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("INT33FC:02", 14, "cs", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("INT33FC:00", 54, "cs", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("INT33FC:02", 14, "reset", GPIO_ACTIVE_HIGH), + {} + }, + }; diff --git a/queue-5.15/usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch b/queue-5.15/usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch new file mode 100644 index 00000000000..1c57b390259 --- /dev/null +++ b/queue-5.15/usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch @@ -0,0 +1,103 @@ +From aaaba1c86d04dac8e49bf508b492f81506257da3 Mon Sep 17 00:00:00 2001 +From: Daehwan Jung +Date: Tue, 22 Feb 2022 14:29:28 +0900 +Subject: usb: gadget: rndis: add spinlock for rndis response list + +From: Daehwan Jung + +commit aaaba1c86d04dac8e49bf508b492f81506257da3 upstream. + +There's no lock for rndis response list. It could cause list corruption +if there're two different list_add at the same time like below. +It's better to add in rndis_add_response / rndis_free_response +/ rndis_get_next_response to prevent any race condition on response list. + +[ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. +next->prev should be prev (ffffff80651764d0), +but was ffffff883dc36f80. (next=ffffff80651764d0). + +[ 361.904380] [1: irq/191-dwc3:16979] Call trace: +[ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 +[ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 +[ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 +[ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 +[ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 +[ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 +[ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc +[ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc +[ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec +[ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c + +Fixes: f6281af9d62e ("usb: gadget: rndis: use list_for_each_entry_safe") +Cc: stable +Signed-off-by: Daehwan Jung +Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung@samsung.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/rndis.c | 8 ++++++++ + drivers/usb/gadget/function/rndis.h | 1 + + 2 files changed, 9 insertions(+) + +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -922,6 +922,7 @@ struct rndis_params *rndis_register(void + params->resp_avail = resp_avail; + params->v = v; + INIT_LIST_HEAD(¶ms->resp_queue); ++ spin_lock_init(¶ms->resp_lock); + pr_debug("%s: configNr = %d\n", __func__, i); + + return params; +@@ -1015,12 +1016,14 @@ void rndis_free_response(struct rndis_pa + { + rndis_resp_t *r, *n; + ++ spin_lock(¶ms->resp_lock); + list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { + if (r->buf == buf) { + list_del(&r->list); + kfree(r); + } + } ++ spin_unlock(¶ms->resp_lock); + } + EXPORT_SYMBOL_GPL(rndis_free_response); + +@@ -1030,14 +1033,17 @@ u8 *rndis_get_next_response(struct rndis + + if (!length) return NULL; + ++ spin_lock(¶ms->resp_lock); + list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { + if (!r->send) { + r->send = 1; + *length = r->length; ++ spin_unlock(¶ms->resp_lock); + return r->buf; + } + } + ++ spin_unlock(¶ms->resp_lock); + return NULL; + } + EXPORT_SYMBOL_GPL(rndis_get_next_response); +@@ -1054,7 +1060,9 @@ static rndis_resp_t *rndis_add_response( + r->length = length; + r->send = 0; + ++ spin_lock(¶ms->resp_lock); + list_add_tail(&r->list, ¶ms->resp_queue); ++ spin_unlock(¶ms->resp_lock); + return r; + } + +--- a/drivers/usb/gadget/function/rndis.h ++++ b/drivers/usb/gadget/function/rndis.h +@@ -174,6 +174,7 @@ typedef struct rndis_params { + void (*resp_avail)(void *v); + void *v; + struct list_head resp_queue; ++ spinlock_t resp_lock; + } rndis_params; + + /* RNDIS Message parser and other useless functions */ diff --git a/queue-5.15/usb-gadget-validate-endpoint-index-for-xilinx-udc.patch b/queue-5.15/usb-gadget-validate-endpoint-index-for-xilinx-udc.patch new file mode 100644 index 00000000000..52472d8f6ae --- /dev/null +++ b/queue-5.15/usb-gadget-validate-endpoint-index-for-xilinx-udc.patch @@ -0,0 +1,41 @@ +From 7f14c7227f342d9932f9b918893c8814f86d2a0d Mon Sep 17 00:00:00 2001 +From: Szymon Heidrich +Date: Mon, 21 Feb 2022 13:24:56 +0100 +Subject: USB: gadget: validate endpoint index for xilinx udc + +From: Szymon Heidrich + +commit 7f14c7227f342d9932f9b918893c8814f86d2a0d upstream. + +Assure that host may not manipulate the index to point +past endpoint array. + +Signed-off-by: Szymon Heidrich +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/udc-xilinx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/gadget/udc/udc-xilinx.c ++++ b/drivers/usb/gadget/udc/udc-xilinx.c +@@ -1612,6 +1612,8 @@ static void xudc_getstatus(struct xusb_u + break; + case USB_RECIP_ENDPOINT: + epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; ++ if (epnum >= XUSB_MAX_ENDPOINTS) ++ goto stall; + target_ep = &udc->ep[epnum]; + epcfgreg = udc->read_fn(udc->addr + target_ep->offset); + halt = epcfgreg & XUSB_EP_CFG_STALL_MASK; +@@ -1679,6 +1681,10 @@ static void xudc_set_clear_feature(struc + case USB_RECIP_ENDPOINT: + if (!udc->setup.wValue) { + endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; ++ if (endpoint >= XUSB_MAX_ENDPOINTS) { ++ xudc_ep0_stall(udc); ++ return; ++ } + target_ep = &udc->ep[endpoint]; + outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK; + outinbit = outinbit >> 7; diff --git a/queue-5.15/usb-serial-option-add-support-for-dw5829e.patch b/queue-5.15/usb-serial-option-add-support-for-dw5829e.patch new file mode 100644 index 00000000000..0af2cef3a08 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-support-for-dw5829e.patch @@ -0,0 +1,114 @@ +From 6ecb3f0b18b320320460a42e40d6fb603f6ded96 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Mon, 14 Feb 2022 10:14:01 +0800 +Subject: USB: serial: option: add support for DW5829e + +From: Slark Xiao + +commit 6ecb3f0b18b320320460a42e40d6fb603f6ded96 upstream. + +Dell DW5829e same as DW5821e except CAT level. +DW5821e supports CAT16 but DW5829e supports CAT9. +There are 2 types product of DW5829e: normal and eSIM. +So we will add 2 PID for DW5829e. +And for each PID, it support MBIM or RMNET. +Let's see test evidence as below: + +DW5829e MBIM mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 2 +P: Vendor=413c ProdID=81e6 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +DW5829e RMNET mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=413c ProdID=81e6 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option + +DW5829e-eSIM MBIM mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 6 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 2 +P: Vendor=413c ProdID=81e4 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e-eSIM Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +DW5829e-eSIM RMNET mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=413c ProdID=81e4 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e-eSIM Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option + +BTW, the interface 0x6 of MBIM mode is GNSS port, which not same as NMEA +port. So it's banned from serial option driver. +The remaining interfaces 0x2-0x5 are: MODEM, MODEM, NMEA, DIAG. + +Signed-off-by: Slark Xiao +Link: https://lore.kernel.org/r/20220214021401.6264-1-slark_xiao@163.com +[ johan: drop unnecessary reservation of interface 1 ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -198,6 +198,8 @@ static void option_instat_callback(struc + + #define DELL_PRODUCT_5821E 0x81d7 + #define DELL_PRODUCT_5821E_ESIM 0x81e0 ++#define DELL_PRODUCT_5829E_ESIM 0x81e4 ++#define DELL_PRODUCT_5829E 0x81e6 + + #define KYOCERA_VENDOR_ID 0x0c88 + #define KYOCERA_PRODUCT_KPC650 0x17da +@@ -1063,6 +1065,10 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM), + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, ++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E), ++ .driver_info = RSVD(0) | RSVD(6) }, ++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E_ESIM), ++ .driver_info = RSVD(0) | RSVD(6) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, diff --git a/queue-5.15/usb-serial-option-add-telit-le910r1-compositions.patch b/queue-5.15/usb-serial-option-add-telit-le910r1-compositions.patch new file mode 100644 index 00000000000..5e819810a32 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-telit-le910r1-compositions.patch @@ -0,0 +1,43 @@ +From cfc4442c642d568014474b6718ccf65dc7ca6099 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Fri, 18 Feb 2022 14:45:52 +0100 +Subject: USB: serial: option: add Telit LE910R1 compositions + +From: Daniele Palmas + +commit cfc4442c642d568014474b6718ccf65dc7ca6099 upstream. + +Add support for the following Telit LE910R1 compositions: + +0x701a: rndis, tty, tty, tty +0x701b: ecm, tty, tty, tty +0x9201: tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20220218134552.4051-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1279,10 +1279,16 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ + .driver_info = NCTRL(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701a, 0xff), /* Telit LE910R1 (RNDIS) */ ++ .driver_info = NCTRL(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */ ++ .driver_info = NCTRL(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ + .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ + .driver_info = NCTRL(0) | ZLP }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9201), /* Telit LE910R1 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, diff --git a/queue-5.15/xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch b/queue-5.15/xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch new file mode 100644 index 00000000000..c445fc7fc57 --- /dev/null +++ b/queue-5.15/xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch @@ -0,0 +1,58 @@ +From 243a1dd7ba48c120986dd9e66fee74bcb7751034 Mon Sep 17 00:00:00 2001 +From: Hongyu Xie +Date: Tue, 15 Feb 2022 14:33:20 +0200 +Subject: xhci: Prevent futile URB re-submissions due to incorrect return value. + +From: Hongyu Xie + +commit 243a1dd7ba48c120986dd9e66fee74bcb7751034 upstream. + +The -ENODEV return value from xhci_check_args() is incorrectly changed +to -EINVAL in a couple places before propagated further. + +xhci_check_args() returns 4 types of value, -ENODEV, -EINVAL, 1 and 0. +xhci_urb_enqueue and xhci_check_streams_endpoint return -EINVAL if +the return value of xhci_check_args <= 0. +This causes problems for example r8152_submit_rx, calling usb_submit_urb +in drivers/net/usb/r8152.c. +r8152_submit_rx will never get -ENODEV after submiting an urb when xHC +is halted because xhci_urb_enqueue returns -EINVAL in the very beginning. + +[commit message and header edit -Mathias] + +Fixes: 203a86613fb3 ("xhci: Avoid NULL pointer deref when host dies.") +Cc: stable@vger.kernel.org +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220215123320.1253947-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1611,9 +1611,12 @@ static int xhci_urb_enqueue(struct usb_h + struct urb_priv *urb_priv; + int num_tds; + +- if (!urb || xhci_check_args(hcd, urb->dev, urb->ep, +- true, true, __func__) <= 0) ++ if (!urb) + return -EINVAL; ++ ret = xhci_check_args(hcd, urb->dev, urb->ep, ++ true, true, __func__); ++ if (ret <= 0) ++ return ret ? ret : -EINVAL; + + slot_id = urb->dev->slot_id; + ep_index = xhci_get_endpoint_index(&urb->ep->desc); +@@ -3330,7 +3333,7 @@ static int xhci_check_streams_endpoint(s + return -EINVAL; + ret = xhci_check_args(xhci_to_hcd(xhci), udev, ep, 1, true, __func__); + if (ret <= 0) +- return -EINVAL; ++ return ret ? ret : -EINVAL; + if (usb_ss_max_streams(&ep->ss_ep_comp) == 0) { + xhci_warn(xhci, "WARN: SuperSpeed Endpoint Companion" + " descriptor for ep 0x%x does not support streams\n", diff --git a/queue-5.15/xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch b/queue-5.15/xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch new file mode 100644 index 00000000000..64400cbc12a --- /dev/null +++ b/queue-5.15/xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch @@ -0,0 +1,68 @@ +From 8b328f8002bcf29ef517ee4bf234e09aabec4d2e Mon Sep 17 00:00:00 2001 +From: Puma Hsu +Date: Tue, 15 Feb 2022 14:33:19 +0200 +Subject: xhci: re-initialize the HC during resume if HCE was set + +From: Puma Hsu + +commit 8b328f8002bcf29ef517ee4bf234e09aabec4d2e upstream. + +When HCE(Host Controller Error) is set, it means an internal +error condition has been detected. Software needs to re-initialize +the HC, so add this check in xhci resume. + +Cc: stable@vger.kernel.org +Signed-off-by: Puma Hsu +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220215123320.1253947-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1091,6 +1091,7 @@ int xhci_resume(struct xhci_hcd *xhci, b + int retval = 0; + bool comp_timer_running = false; + bool pending_portevent = false; ++ bool reinit_xhc = false; + + if (!hcd->state) + return 0; +@@ -1107,10 +1108,11 @@ int xhci_resume(struct xhci_hcd *xhci, b + set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); + + spin_lock_irq(&xhci->lock); +- if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend) +- hibernated = true; + +- if (!hibernated) { ++ if (hibernated || xhci->quirks & XHCI_RESET_ON_RESUME || xhci->broken_suspend) ++ reinit_xhc = true; ++ ++ if (!reinit_xhc) { + /* + * Some controllers might lose power during suspend, so wait + * for controller not ready bit to clear, just as in xHC init. +@@ -1143,12 +1145,17 @@ int xhci_resume(struct xhci_hcd *xhci, b + spin_unlock_irq(&xhci->lock); + return -ETIMEDOUT; + } +- temp = readl(&xhci->op_regs->status); + } + +- /* If restore operation fails, re-initialize the HC during resume */ +- if ((temp & STS_SRE) || hibernated) { ++ temp = readl(&xhci->op_regs->status); ++ ++ /* re-initialize the HC on Restore Error, or Host Controller Error */ ++ if (temp & (STS_SRE | STS_HCE)) { ++ reinit_xhc = true; ++ xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp); ++ } + ++ if (reinit_xhc) { + if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && + !(xhci_all_ports_seen_u0(xhci))) { + del_timer_sync(&xhci->comp_mode_recovery_timer);