From: Greg Kroah-Hartman Date: Sat, 27 Nov 2021 12:46:35 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v5.15.6~80 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9ba4cf97df7821050879e20cec7245fda77be925;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: acpi-cppc-add-null-pointer-check-to-cppc_get_perf.patch acpi-get-acpi_device-s-parent-from-the-parent-field.patch net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch net-usb-correct-phy-handling-of-smsc95xx.patch usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch usb-dwc3-core-revise-ghwparams9-offset.patch usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch usb-dwc3-gadget-fix-null-pointer-exception.patch usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch usb-dwc3-leave-default-dma-for-pci-devices.patch usb-hub-fix-locking-issues-with-address0_mutex.patch usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch usb-serial-option-add-fibocom-fm101-gl-variants.patch usb-serial-option-add-telit-le910s1-0x9200-composition.patch usb-serial-pl2303-fix-gc-type-detection.patch usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch usb-xhci-tegra-check-padctrl-interrupt-presence-in-device-tree.patch --- diff --git a/queue-5.15/acpi-cppc-add-null-pointer-check-to-cppc_get_perf.patch b/queue-5.15/acpi-cppc-add-null-pointer-check-to-cppc_get_perf.patch new file mode 100644 index 00000000000..d705e52db9f --- /dev/null +++ b/queue-5.15/acpi-cppc-add-null-pointer-check-to-cppc_get_perf.patch @@ -0,0 +1,40 @@ +From 935dff305da2be7957a5ce8f07f45d6c4c1c6984 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 18 Nov 2021 14:37:38 +0100 +Subject: ACPI: CPPC: Add NULL pointer check to cppc_get_perf() + +From: Rafael J. Wysocki + +commit 935dff305da2be7957a5ce8f07f45d6c4c1c6984 upstream. + +Check cpc_desc against NULL in cppc_get_perf(), so it doesn't crash +down the road if cpc_desc is NULL. + +Fixes: 0654cf05d17b ("ACPI: CPPC: Introduce cppc_get_nominal_perf()") +Reported-by: Kai-Heng Feng +Signed-off-by: Rafael J. Wysocki +Cc: 5.15+ # 5.15+ +Tested-by: Kai-Heng Feng +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/cppc_acpi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -1011,7 +1011,14 @@ static int cpc_write(int cpu, struct cpc + static int cppc_get_perf(int cpunum, enum cppc_regs reg_idx, u64 *perf) + { + struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpunum); +- struct cpc_register_resource *reg = &cpc_desc->cpc_regs[reg_idx]; ++ struct cpc_register_resource *reg; ++ ++ if (!cpc_desc) { ++ pr_debug("No CPC descriptor for CPU:%d\n", cpunum); ++ return -ENODEV; ++ } ++ ++ reg = &cpc_desc->cpc_regs[reg_idx]; + + if (CPC_IN_PCC(reg)) { + int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum); diff --git a/queue-5.15/acpi-get-acpi_device-s-parent-from-the-parent-field.patch b/queue-5.15/acpi-get-acpi_device-s-parent-from-the-parent-field.patch new file mode 100644 index 00000000000..33774493762 --- /dev/null +++ b/queue-5.15/acpi-get-acpi_device-s-parent-from-the-parent-field.patch @@ -0,0 +1,51 @@ +From 9054fc6d57e80c27c0b0632966416144f2092c2b Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 17 Nov 2021 20:07:34 +0200 +Subject: ACPI: Get acpi_device's parent from the parent field + +From: Sakari Ailus + +commit 9054fc6d57e80c27c0b0632966416144f2092c2b upstream. + +Printk modifier %pfw is used to print the full path of the device name. +This is obtained device by device until a device no longer has a parent. + +On ACPI getting the parent fwnode is done by calling acpi_get_parent() +which tries to down() a semaphore. But local IRQs are now disabled in +vprintk_store() before the mutex is acquired. This is obviously a problem. + +Luckily struct device, embedded in struct acpi_device, has a parent field +already. Use that field to get the parent instead of relying on +acpi_get_parent(). + +Fixes: 3bd32d6a2ee6 ("lib/vsprintf: Add %pfw conversion specifier for printing fwnode names") +Cc: 5.5+ # 5.5+ +Signed-off-by: Sakari Ailus +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/property.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1090,15 +1090,10 @@ struct fwnode_handle *acpi_node_get_pare + /* All data nodes have parent pointer so just return that */ + return to_acpi_data_node(fwnode)->parent; + } else if (is_acpi_device_node(fwnode)) { +- acpi_handle handle, parent_handle; ++ struct device *dev = to_acpi_device_node(fwnode)->dev.parent; + +- handle = to_acpi_device_node(fwnode)->handle; +- if (ACPI_SUCCESS(acpi_get_parent(handle, &parent_handle))) { +- struct acpi_device *adev; +- +- if (!acpi_bus_get_device(parent_handle, &adev)) +- return acpi_fwnode_handle(adev); +- } ++ if (dev) ++ return acpi_fwnode_handle(to_acpi_device(dev)); + } + + return NULL; diff --git a/queue-5.15/net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch b/queue-5.15/net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch new file mode 100644 index 00000000000..017bbe0cd3b --- /dev/null +++ b/queue-5.15/net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch @@ -0,0 +1,105 @@ +From 1c743127cc54b112b155f434756bd4b5fa565a99 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Tue, 23 Nov 2021 12:27:19 +0200 +Subject: net: nexthop: fix null pointer dereference when IPv6 is not enabled + +From: Nikolay Aleksandrov + +commit 1c743127cc54b112b155f434756bd4b5fa565a99 upstream. + +When we try to add an IPv6 nexthop and IPv6 is not enabled +(!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the error path +of nh_create_ipv6() due to calling ipv6_stub->fib6_nh_release. The bug +has been present since the beginning of IPv6 nexthop gateway support. +Commit 1aefd3de7bc6 ("ipv6: Add fib6_nh_init and release to stubs") tells +us that only fib6_nh_init has a dummy stub because fib6_nh_release should +not be called if fib6_nh_init returns an error, but the commit below added +a call to ipv6_stub->fib6_nh_release in its error path. To fix it return +the dummy stub's -EAFNOSUPPORT error directly without calling +ipv6_stub->fib6_nh_release in nh_create_ipv6()'s error path. + +[1] + Output is a bit truncated, but it clearly shows the error. + BUG: kernel NULL pointer dereference, address: 000000000000000000 + #PF: supervisor instruction fetch in kernel modede + #PF: error_code(0x0010) - not-present pagege + PGD 0 P4D 0 + Oops: 0010 [#1] PREEMPT SMP NOPTI + CPU: 4 PID: 638 Comm: ip Kdump: loaded Not tainted 5.16.0-rc1+ #446 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 + RIP: 0010:0x0 + Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. + RSP: 0018:ffff888109f5b8f0 EFLAGS: 00010286^Ac + RAX: 0000000000000000 RBX: ffff888109f5ba28 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881008a2860 + RBP: ffff888109f5b9d8 R08: 0000000000000000 R09: 0000000000000000 + R10: ffff888109f5b978 R11: ffff888109f5b948 R12: 00000000ffffff9f + R13: ffff8881008a2a80 R14: ffff8881008a2860 R15: ffff8881008a2840 + FS: 00007f98de70f100(0000) GS:ffff88822bf00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffffffffd6 CR3: 0000000100efc000 CR4: 00000000000006e0 + Call Trace: + + nh_create_ipv6+0xed/0x10c + rtm_new_nexthop+0x6d7/0x13f3 + ? check_preemption_disabled+0x3d/0xf2 + ? lock_is_held_type+0xbe/0xfd + rtnetlink_rcv_msg+0x23f/0x26a + ? check_preemption_disabled+0x3d/0xf2 + ? rtnl_calcit.isra.0+0x147/0x147 + netlink_rcv_skb+0x61/0xb2 + netlink_unicast+0x100/0x187 + netlink_sendmsg+0x37f/0x3a0 + ? netlink_unicast+0x187/0x187 + sock_sendmsg_nosec+0x67/0x9b + ____sys_sendmsg+0x19d/0x1f9 + ? copy_msghdr_from_user+0x4c/0x5e + ? rcu_read_lock_any_held+0x2a/0x78 + ___sys_sendmsg+0x6c/0x8c + ? asm_sysvec_apic_timer_interrupt+0x12/0x20 + ? lockdep_hardirqs_on+0xd9/0x102 + ? sockfd_lookup_light+0x69/0x99 + __sys_sendmsg+0x50/0x6e + do_syscall_64+0xcb/0xf2 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f98dea28914 + Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 48 8d 05 e9 5d 0c 00 8b 00 85 c0 75 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 41 89 d4 55 48 89 f5 53 + RSP: 002b:00007fff859f5e68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e2e + RAX: ffffffffffffffda RBX: 00000000619cb810 RCX: 00007f98dea28914 + RDX: 0000000000000000 RSI: 00007fff859f5ed0 RDI: 0000000000000003 + RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000008 + R10: fffffffffffffce6 R11: 0000000000000246 R12: 0000000000000001 + R13: 000055c0097ae520 R14: 000055c0097957fd R15: 00007fff859f63a0 + + Modules linked in: bridge stp llc bonding virtio_net + +Cc: stable@vger.kernel.org +Fixes: 53010f991a9f ("nexthop: Add support for IPv6 gateways") +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/nexthop.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -2544,11 +2544,15 @@ static int nh_create_ipv6(struct net *ne + /* sets nh_dev if successful */ + err = ipv6_stub->fib6_nh_init(net, fib6_nh, &fib6_cfg, GFP_KERNEL, + extack); +- if (err) ++ if (err) { ++ /* IPv6 is not enabled, don't call fib6_nh_release */ ++ if (err == -EAFNOSUPPORT) ++ goto out; + ipv6_stub->fib6_nh_release(fib6_nh); +- else ++ } else { + nh->nh_flags = fib6_nh->fib_nh_flags; +- ++ } ++out: + return err; + } + diff --git a/queue-5.15/net-usb-correct-phy-handling-of-smsc95xx.patch b/queue-5.15/net-usb-correct-phy-handling-of-smsc95xx.patch new file mode 100644 index 00000000000..a775a5b6dc0 --- /dev/null +++ b/queue-5.15/net-usb-correct-phy-handling-of-smsc95xx.patch @@ -0,0 +1,227 @@ +From a049a30fc27c1cb2e12889bbdbd463dbf750103a Mon Sep 17 00:00:00 2001 +From: Martyn Welch +Date: Mon, 22 Nov 2021 18:44:45 +0000 +Subject: net: usb: Correct PHY handling of smsc95xx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martyn Welch + +commit a049a30fc27c1cb2e12889bbdbd463dbf750103a upstream. + +The smsc95xx driver is dropping phy speed settings and causing a stack +trace at device unbind: + +[  536.379147] smsc95xx 2-1:1.0 eth1: unregister 'smsc95xx' usb-ci_hdrc.2-1, smsc95xx USB 2.0 Ethernet +[  536.425029] ------------[ cut here ]------------ +[  536.429650] WARNING: CPU: 0 PID: 439 at fs/kernfs/dir.c:1535 kernfs_remove_by_name_ns+0xb8/0xc0 +[  536.438416] kernfs: can not remove 'attached_dev', no directory +[  536.444363] Modules linked in: xts dm_crypt dm_mod atmel_mxt_ts smsc95xx usbnet +[  536.451748] CPU: 0 PID: 439 Comm: sh Tainted: G        W         5.15.0 #1 +[  536.458636] Hardware name: Freescale i.MX53 (Device Tree Support) +[  536.464735] Backtrace:  +[  536.467190] [<80b1c904>] (dump_backtrace) from [<80b1cb48>] (show_stack+0x20/0x24) +[  536.474787]  r7:000005ff r6:8035b294 r5:600f0013 r4:80d8af78 +[  536.480449] [<80b1cb28>] (show_stack) from [<80b1f764>] (dump_stack_lvl+0x48/0x54) +[  536.488035] [<80b1f71c>] (dump_stack_lvl) from [<80b1f788>] (dump_stack+0x18/0x1c) +[  536.495620]  r5:00000009 r4:80d9b820 +[  536.499198] [<80b1f770>] (dump_stack) from [<80124fac>] (__warn+0xfc/0x114) +[  536.506187] [<80124eb0>] (__warn) from [<80b1d21c>] (warn_slowpath_fmt+0xa8/0xdc) +[  536.513688]  r7:000005ff r6:80d9b820 r5:80d9b8e0 r4:83744000 +[  536.519349] [<80b1d178>] (warn_slowpath_fmt) from [<8035b294>] (kernfs_remove_by_name_ns+0xb8/0xc0) +[  536.528416]  r9:00000001 r8:00000000 r7:824926dc r6:00000000 r5:80df6c2c r4:00000000 +[  536.536162] [<8035b1dc>] (kernfs_remove_by_name_ns) from [<80b1f56c>] (sysfs_remove_link+0x4c/0x50) +[  536.545225]  r6:7f00f02c r5:80df6c2c r4:83306400 +[  536.549845] [<80b1f520>] (sysfs_remove_link) from [<806f9c8c>] (phy_detach+0xfc/0x11c) +[  536.557780]  r5:82492000 r4:83306400 +[  536.561359] [<806f9b90>] (phy_detach) from [<806f9cf8>] (phy_disconnect+0x4c/0x58) +[  536.568943]  r7:824926dc r6:7f00f02c r5:82492580 r4:83306400 +[  536.574604] [<806f9cac>] (phy_disconnect) from [<7f00a310>] (smsc95xx_disconnect_phy+0x30/0x38 [smsc95xx]) +[  536.584290]  r5:82492580 r4:82492580 +[  536.587868] [<7f00a2e0>] (smsc95xx_disconnect_phy [smsc95xx]) from [<7f001570>] (usbnet_stop+0x70/0x1a0 [usbnet]) +[  536.598161]  r5:82492580 r4:82492000 +[  536.601740] [<7f001500>] (usbnet_stop [usbnet]) from [<808baa70>] (__dev_close_many+0xb4/0x12c) +[  536.610466]  r8:83744000 r7:00000000 r6:83744000 r5:83745b74 r4:82492000 +[  536.617170] [<808ba9bc>] (__dev_close_many) from [<808bab78>] (dev_close_many+0x90/0x120) +[  536.625365]  r7:00000001 r6:83745b74 r5:83745b8c r4:82492000 +[  536.631026] [<808baae8>] (dev_close_many) from [<808bf408>] (unregister_netdevice_many+0x15c/0x704) +[  536.640094]  r9:00000001 r8:81130b98 r7:83745b74 r6:83745bc4 r5:83745b8c r4:82492000 +[  536.647840] [<808bf2ac>] (unregister_netdevice_many) from [<808bfa50>] (unregister_netdevice_queue+0xa0/0xe8) +[  536.657775]  r10:8112bcc0 r9:83306c00 r8:83306c80 r7:8291e420 r6:83744000 r5:00000000 +[  536.665608]  r4:82492000 +[  536.668143] [<808bf9b0>] (unregister_netdevice_queue) from [<808bfac0>] (unregister_netdev+0x28/0x30) +[  536.677381]  r6:7f01003c r5:82492000 r4:82492000 +[  536.682000] [<808bfa98>] (unregister_netdev) from [<7f000b40>] (usbnet_disconnect+0x64/0xdc [usbnet]) +[  536.691241]  r5:82492000 r4:82492580 +[  536.694819] [<7f000adc>] (usbnet_disconnect [usbnet]) from [<8076b958>] (usb_unbind_interface+0x80/0x248) +[  536.704406]  r5:7f01003c r4:83306c80 +[  536.707984] [<8076b8d8>] (usb_unbind_interface) from [<8061765c>] (device_release_driver_internal+0x1c4/0x1cc) +[  536.718005]  r10:8112bcc0 r9:80dff1dc r8:83306c80 r7:83744000 r6:7f01003c r5:00000000 +[  536.725838]  r4:8291e420 +[  536.728373] [<80617498>] (device_release_driver_internal) from [<80617684>] (device_release_driver+0x20/0x24) +[  536.738302]  r7:83744000 r6:810d4f4c r5:8291e420 r4:8176ae30 +[  536.743963] [<80617664>] (device_release_driver) from [<806156cc>] (bus_remove_device+0xf0/0x148) +[  536.752858] [<806155dc>] (bus_remove_device) from [<80610018>] (device_del+0x198/0x41c) +[  536.760880]  r7:83744000 r6:8116e2e4 r5:8291e464 r4:8291e420 +[  536.766542] [<8060fe80>] (device_del) from [<80768fe8>] (usb_disable_device+0xcc/0x1e0) +[  536.774576]  r10:8112bcc0 r9:80dff1dc r8:00000001 r7:8112bc48 r6:8291e400 r5:00000001 +[  536.782410]  r4:83306c00 +[  536.784945] [<80768f1c>] (usb_disable_device) from [<80769c30>] (usb_set_configuration+0x514/0x8dc) +[  536.794011]  r10:00000000 r9:00000000 r8:832c3600 r7:00000004 r6:810d5688 r5:00000000 +[  536.801844]  r4:83306c00 +[  536.804379] [<8076971c>] (usb_set_configuration) from [<80775fac>] (usb_generic_driver_disconnect+0x34/0x38) +[  536.814236]  r10:832c3610 r9:83745ef8 r8:832c3600 r7:00000004 r6:810d5688 r5:83306c00 +[  536.822069]  r4:83306c00 +[  536.824605] [<80775f78>] (usb_generic_driver_disconnect) from [<8076b850>] (usb_unbind_device+0x30/0x70) +[  536.834100]  r5:83306c00 r4:810d5688 +[  536.837678] [<8076b820>] (usb_unbind_device) from [<8061765c>] (device_release_driver_internal+0x1c4/0x1cc) +[  536.847432]  r5:822fb480 r4:83306c80 +[  536.851009] [<80617498>] (device_release_driver_internal) from [<806176a8>] (device_driver_detach+0x20/0x24) +[  536.860853]  r7:00000004 r6:810d4f4c r5:810d5688 r4:83306c80 +[  536.866515] [<80617688>] (device_driver_detach) from [<80614d98>] (unbind_store+0x70/0xe4) +[  536.874793] [<80614d28>] (unbind_store) from [<80614118>] (drv_attr_store+0x30/0x3c) +[  536.882554]  r7:00000000 r6:00000000 r5:83739200 r4:80614d28 +[  536.888217] [<806140e8>] (drv_attr_store) from [<8035cb68>] (sysfs_kf_write+0x48/0x54) +[  536.896154]  r5:83739200 r4:806140e8 +[  536.899732] [<8035cb20>] (sysfs_kf_write) from [<8035be84>] (kernfs_fop_write_iter+0x11c/0x1d4) +[  536.908446]  r5:83739200 r4:00000004 +[  536.912024] [<8035bd68>] (kernfs_fop_write_iter) from [<802b87fc>] (vfs_write+0x258/0x3e4) +[  536.920317]  r10:00000000 r9:83745f58 r8:83744000 r7:00000000 r6:00000004 r5:00000000 +[  536.928151]  r4:82adacc0 +[  536.930687] [<802b85a4>] (vfs_write) from [<802b8b0c>] (ksys_write+0x74/0xf4) +[  536.937842]  r10:00000004 r9:007767a0 r8:83744000 r7:00000000 r6:00000000 r5:82adacc0 +[  536.945676]  r4:82adacc0 +[  536.948213] [<802b8a98>] (ksys_write) from [<802b8ba4>] (sys_write+0x18/0x1c) +[  536.955367]  r10:00000004 r9:83744000 r8:80100244 r7:00000004 r6:76f47b58 r5:76fc0350 +[  536.963200]  r4:00000004 +[  536.965735] [<802b8b8c>] (sys_write) from [<80100060>] (ret_fast_syscall+0x0/0x48) +[  536.973320] Exception stack(0x83745fa8 to 0x83745ff0) +[  536.978383] 5fa0:                   00000004 76fc0350 00000001 007767a0 00000004 00000000 +[  536.986569] 5fc0: 00000004 76fc0350 76f47b58 00000004 76f47c7c 76f48114 00000000 7e87991c +[  536.994753] 5fe0: 00000498 7e879908 76e6dce8 76eca2e8 +[  536.999922] ---[ end trace 9b835d809816b435 ]--- + +The driver should not be connecting and disconnecting the PHY when the +device is opened and closed, it should be stopping and starting the PHY. The +phy should be connected as part of binding and disconnected during +unbinding. + +As this results in the PHY not being reset during open, link speed, etc. +settings set prior to the link coming up are now not being lost. + +It is necessary for phy_stop() to only be called when the phydev still +exists (resolving the above stack trace). When unbinding, ".unbind" will be +called prior to ".stop", with phy_disconnect() already having called +phy_stop() before the phydev becomes inaccessible. + +Signed-off-by: Martyn Welch +Cc: Steve Glendinning +Cc: UNGLinuxDriver@microchip.com +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: stable@kernel.org # v5.15 +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/smsc95xx.c | 55 +++++++++++++++++++++------------------------ + 1 file changed, 26 insertions(+), 29 deletions(-) + +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1049,6 +1049,14 @@ static const struct net_device_ops smsc9 + .ndo_set_features = smsc95xx_set_features, + }; + ++static void smsc95xx_handle_link_change(struct net_device *net) ++{ ++ struct usbnet *dev = netdev_priv(net); ++ ++ phy_print_status(net->phydev); ++ usbnet_defer_kevent(dev, EVENT_LINK_CHANGE); ++} ++ + static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + { + struct smsc95xx_priv *pdata; +@@ -1153,6 +1161,17 @@ static int smsc95xx_bind(struct usbnet * + dev->net->min_mtu = ETH_MIN_MTU; + dev->net->max_mtu = ETH_DATA_LEN; + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; ++ ++ ret = phy_connect_direct(dev->net, pdata->phydev, ++ &smsc95xx_handle_link_change, ++ PHY_INTERFACE_MODE_MII); ++ if (ret) { ++ netdev_err(dev->net, "can't attach PHY to %s\n", pdata->mdiobus->id); ++ goto unregister_mdio; ++ } ++ ++ phy_attached_info(dev->net->phydev); ++ + return 0; + + unregister_mdio: +@@ -1170,47 +1189,25 @@ static void smsc95xx_unbind(struct usbne + { + struct smsc95xx_priv *pdata = dev->driver_priv; + ++ phy_disconnect(dev->net->phydev); + mdiobus_unregister(pdata->mdiobus); + mdiobus_free(pdata->mdiobus); + netif_dbg(dev, ifdown, dev->net, "free pdata\n"); + kfree(pdata); + } + +-static void smsc95xx_handle_link_change(struct net_device *net) +-{ +- struct usbnet *dev = netdev_priv(net); +- +- phy_print_status(net->phydev); +- usbnet_defer_kevent(dev, EVENT_LINK_CHANGE); +-} +- + static int smsc95xx_start_phy(struct usbnet *dev) + { +- struct smsc95xx_priv *pdata = dev->driver_priv; +- struct net_device *net = dev->net; +- int ret; ++ phy_start(dev->net->phydev); + +- ret = smsc95xx_reset(dev); +- if (ret < 0) +- return ret; +- +- ret = phy_connect_direct(net, pdata->phydev, +- &smsc95xx_handle_link_change, +- PHY_INTERFACE_MODE_MII); +- if (ret) { +- netdev_err(net, "can't attach PHY to %s\n", pdata->mdiobus->id); +- return ret; +- } +- +- phy_attached_info(net->phydev); +- phy_start(net->phydev); + return 0; + } + +-static int smsc95xx_disconnect_phy(struct usbnet *dev) ++static int smsc95xx_stop(struct usbnet *dev) + { +- phy_stop(dev->net->phydev); +- phy_disconnect(dev->net->phydev); ++ if (dev->net->phydev) ++ phy_stop(dev->net->phydev); ++ + return 0; + } + +@@ -1965,7 +1962,7 @@ static const struct driver_info smsc95xx + .unbind = smsc95xx_unbind, + .link_reset = smsc95xx_link_reset, + .reset = smsc95xx_start_phy, +- .stop = smsc95xx_disconnect_phy, ++ .stop = smsc95xx_stop, + .rx_fixup = smsc95xx_rx_fixup, + .tx_fixup = smsc95xx_tx_fixup, + .status = smsc95xx_status, diff --git a/queue-5.15/series b/queue-5.15/series index b38aefcf03e..44829f0f583 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -1 +1,20 @@ scsi-sd-fix-sd_do_mode_sense-buffer-length-handling.patch +acpi-get-acpi_device-s-parent-from-the-parent-field.patch +acpi-cppc-add-null-pointer-check-to-cppc_get_perf.patch +usb-serial-pl2303-fix-gc-type-detection.patch +usb-serial-option-add-telit-le910s1-0x9200-composition.patch +usb-serial-option-add-fibocom-fm101-gl-variants.patch +usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch +usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch +usb-dwc3-leave-default-dma-for-pci-devices.patch +usb-dwc3-core-revise-ghwparams9-offset.patch +usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch +usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch +usb-dwc3-gadget-fix-null-pointer-exception.patch +net-usb-correct-phy-handling-of-smsc95xx.patch +net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch +usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch +usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch +usb-xhci-tegra-check-padctrl-interrupt-presence-in-device-tree.patch +usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch +usb-hub-fix-locking-issues-with-address0_mutex.patch diff --git a/queue-5.15/usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch b/queue-5.15/usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch new file mode 100644 index 00000000000..e0446395b68 --- /dev/null +++ b/queue-5.15/usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch @@ -0,0 +1,50 @@ +From d4d2e5329ae9dfd6742c84d79f7d143d10410f1b Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 17 Nov 2021 10:49:23 +0300 +Subject: usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe + +From: Dan Carpenter + +commit d4d2e5329ae9dfd6742c84d79f7d143d10410f1b upstream. + +If the first call to devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0) +fails with something other than -ENODEV then it leads to an error +pointer dereference. For those errors we should just jump directly to +the error handling. + +Fixes: 8253a34bfae3 ("usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle") +Cc: stable +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20211117074923.GF5237@kili +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -420,15 +420,15 @@ static int ci_hdrc_imx_probe(struct plat + data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0); + if (IS_ERR(data->phy)) { + ret = PTR_ERR(data->phy); +- if (ret == -ENODEV) { +- data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); +- if (IS_ERR(data->phy)) { +- ret = PTR_ERR(data->phy); +- if (ret == -ENODEV) +- data->phy = NULL; +- else +- goto err_clk; +- } ++ if (ret != -ENODEV) ++ goto err_clk; ++ data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); ++ if (IS_ERR(data->phy)) { ++ ret = PTR_ERR(data->phy); ++ if (ret == -ENODEV) ++ data->phy = NULL; ++ else ++ goto err_clk; + } + } + diff --git a/queue-5.15/usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch b/queue-5.15/usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch new file mode 100644 index 00000000000..e4e21213d56 --- /dev/null +++ b/queue-5.15/usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch @@ -0,0 +1,82 @@ +From 7ad4a0b1d46b2612f4429a72afd8f137d7efa9a9 Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Thu, 4 Nov 2021 11:36:01 +0400 +Subject: usb: dwc2: gadget: Fix ISOC flow for elapsed frames + +From: Minas Harutyunyan + +commit 7ad4a0b1d46b2612f4429a72afd8f137d7efa9a9 upstream. + +Added updating of request frame number for elapsed frames, +otherwise frame number will remain as previous use of request. +This will allow function driver to correctly track frames in +case of Missed ISOC occurs. + +Added setting request actual length to 0 for elapsed frames. +In Slave mode when pushing data to RxFIFO by dwords, request +actual length incrementing accordingly. But before whole packet +will be pushed into RxFIFO and send to host can occurs Missed +ISOC and data will not send to host. So, in this case request +actual length should be reset to 0. + +Fixes: 91bb163e1e4f ("usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave") +Cc: stable +Reviewed-by: John Keeping +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/c356baade6e9716d312d43df08d53ae557cb8037.1636011277.git.Minas.Harutyunyan@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -1198,6 +1198,8 @@ static void dwc2_hsotg_start_req(struct + } + ctrl |= DXEPCTL_CNAK; + } else { ++ hs_req->req.frame_number = hs_ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA); + return; + } +@@ -2857,9 +2859,12 @@ static void dwc2_gadget_handle_ep_disabl + + do { + hs_req = get_ep_head(hs_ep); +- if (hs_req) ++ if (hs_req) { ++ hs_req->req.frame_number = hs_ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, + -ENODATA); ++ } + dwc2_gadget_incr_frame_num(hs_ep); + /* Update current frame number value. */ + hsotg->frame_number = dwc2_hsotg_read_frameno(hsotg); +@@ -2912,8 +2917,11 @@ static void dwc2_gadget_handle_out_token + + while (dwc2_gadget_target_frame_elapsed(ep)) { + hs_req = get_ep_head(ep); +- if (hs_req) ++ if (hs_req) { ++ hs_req->req.frame_number = ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, ep, hs_req, -ENODATA); ++ } + + dwc2_gadget_incr_frame_num(ep); + /* Update current frame number value. */ +@@ -3002,8 +3010,11 @@ static void dwc2_gadget_handle_nak(struc + + while (dwc2_gadget_target_frame_elapsed(hs_ep)) { + hs_req = get_ep_head(hs_ep); +- if (hs_req) ++ if (hs_req) { ++ hs_req->req.frame_number = hs_ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA); ++ } + + dwc2_gadget_incr_frame_num(hs_ep); + /* Update current frame number value. */ diff --git a/queue-5.15/usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch b/queue-5.15/usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch new file mode 100644 index 00000000000..c4fbd9e12b7 --- /dev/null +++ b/queue-5.15/usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch @@ -0,0 +1,56 @@ +From 310780e825f3ffd211b479b8f828885a6faedd63 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 5 Nov 2021 07:58:03 -0700 +Subject: usb: dwc2: hcd_queue: Fix use of floating point literal + +From: Nathan Chancellor + +commit 310780e825f3ffd211b479b8f828885a6faedd63 upstream. + +A new commit in LLVM causes an error on the use of 'long double' when +'-mno-x87' is used, which the kernel does through an alias, +'-mno-80387' (see the LLVM commit below for more details around why it +does this). + + drivers/usb/dwc2/hcd_queue.c:1744:25: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it + delay = ktime_set(0, DWC2_RETRY_WAIT_DELAY); + ^ + drivers/usb/dwc2/hcd_queue.c:62:34: note: expanded from macro 'DWC2_RETRY_WAIT_DELAY' + #define DWC2_RETRY_WAIT_DELAY (1 * 1E6L) + ^ + 1 error generated. + +This happens due to the use of a 'long double' literal. The 'E6' part of +'1E6L' causes the literal to be a 'double' then the 'L' suffix promotes +it to 'long double'. + +There is no visible reason for a floating point value in this driver, as +the value is only used as a parameter to a function that expects an +integer type. Use NSEC_PER_MSEC, which is the same integer value as +'1E6L', to avoid changing functionality but fix the error. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1497 +Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36d1f0cadd7801d83 +Fixes: 6ed30a7d8ec2 ("usb: dwc2: host: use hrtimer for NAK retries") +Cc: stable +Reviewed-by: Nick Desaulniers +Reviewed-by: John Keeping +Acked-by: Minas Harutyunyan +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20211105145802.2520658-1-nathan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd_queue.c ++++ b/drivers/usb/dwc2/hcd_queue.c +@@ -59,7 +59,7 @@ + #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5)) + + /* If we get a NAK, wait this long before retrying */ +-#define DWC2_RETRY_WAIT_DELAY (1 * 1E6L) ++#define DWC2_RETRY_WAIT_DELAY (1 * NSEC_PER_MSEC) + + /** + * dwc2_periodic_channel_available() - Checks that a channel is available for a diff --git a/queue-5.15/usb-dwc3-core-revise-ghwparams9-offset.patch b/queue-5.15/usb-dwc3-core-revise-ghwparams9-offset.patch new file mode 100644 index 00000000000..ff8c9435586 --- /dev/null +++ b/queue-5.15/usb-dwc3-core-revise-ghwparams9-offset.patch @@ -0,0 +1,33 @@ +From 250fdabec6ffcaf895c5e0dedca62706ef10d8f6 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 25 Oct 2021 16:15:32 -0700 +Subject: usb: dwc3: core: Revise GHWPARAMS9 offset + +From: Thinh Nguyen + +commit 250fdabec6ffcaf895c5e0dedca62706ef10d8f6 upstream. + +During our predesign phase for DWC_usb32, the GHWPARAMS9 register offset +was 0xc680. We revised our final design, and the GHWPARAMS9 offset is +now moved to 0xc6e8 on release. + +Fixes: 16710380d3aa ("usb: dwc3: Capture new capability register GHWPARAMS9") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/1541737108266a97208ff827805be1f32852590c.1635202893.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -143,7 +143,7 @@ + #define DWC3_GHWPARAMS8 0xc600 + #define DWC3_GUCTL3 0xc60c + #define DWC3_GFLADJ 0xc630 +-#define DWC3_GHWPARAMS9 0xc680 ++#define DWC3_GHWPARAMS9 0xc6e0 + + /* Device Registers */ + #define DWC3_DCFG 0xc700 diff --git a/queue-5.15/usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch b/queue-5.15/usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch new file mode 100644 index 00000000000..538e6ec324a --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch @@ -0,0 +1,62 @@ +From 63c4c320ccf77074ffe9019ac596603133c1b517 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 25 Oct 2021 16:35:06 -0700 +Subject: usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer + +From: Thinh Nguyen + +commit 63c4c320ccf77074ffe9019ac596603133c1b517 upstream. + +The programming guide noted that the driver needs to verify if the link +state is in U0 before executing the Start Transfer command. If it's not +in U0, the driver needs to perform remote wakeup. This is not accurate. +If the link state is in U1/U2, then the controller will not respond to +link recovery request from DCTL.ULSTCHNGREQ. The Start Transfer command +will trigger a link recovery if it is in U1/U2. A clarification will be +added to the programming guide for all controller versions. + +The current implementation shouldn't cause any functional issue. It may +occasionally report an invalid time out warning from failed link +recovery request. The driver will still go ahead with the Start Transfer +command if the remote wakeup fails. The new change only initiates remote +wakeup where it is needed, which is when the link state is in L1/L2/U3. + +Fixes: c36d8e947a56 ("usb: dwc3: gadget: put link to U0 before Start Transfer") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/05b4a5fbfbd0863fc9b1d7af934a366219e3d0b4.1635204761.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -310,13 +310,24 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ + if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) { + int link_state; + ++ /* ++ * Initiate remote wakeup if the link state is in U3 when ++ * operating in SS/SSP or L1/L2 when operating in HS/FS. If the ++ * link state is in U1/U2, no remote wakeup is needed. The Start ++ * Transfer command will initiate the link recovery. ++ */ + link_state = dwc3_gadget_get_link_state(dwc); +- if (link_state == DWC3_LINK_STATE_U1 || +- link_state == DWC3_LINK_STATE_U2 || +- link_state == DWC3_LINK_STATE_U3) { ++ switch (link_state) { ++ case DWC3_LINK_STATE_U2: ++ if (dwc->gadget->speed >= USB_SPEED_SUPER) ++ break; ++ ++ fallthrough; ++ case DWC3_LINK_STATE_U3: + ret = __dwc3_gadget_wakeup(dwc); + dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n", + ret); ++ break; + } + } + diff --git a/queue-5.15/usb-dwc3-gadget-fix-null-pointer-exception.patch b/queue-5.15/usb-dwc3-gadget-fix-null-pointer-exception.patch new file mode 100644 index 00000000000..a7f0ebf27fa --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-fix-null-pointer-exception.patch @@ -0,0 +1,48 @@ +From 26288448120b28af1dfd85a6fa6b6d55a16c7f2f Mon Sep 17 00:00:00 2001 +From: Albert Wang +Date: Tue, 9 Nov 2021 17:26:42 +0800 +Subject: usb: dwc3: gadget: Fix null pointer exception + +From: Albert Wang + +commit 26288448120b28af1dfd85a6fa6b6d55a16c7f2f upstream. + +In the endpoint interrupt functions +dwc3_gadget_endpoint_transfer_in_progress() and +dwc3_gadget_endpoint_trbs_complete() will dereference the endpoint +descriptor. But it could be cleared in __dwc3_gadget_ep_disable() +when accessory disconnected. So we need to check whether it is null +or not before dereferencing it. + +Fixes: f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") +Cc: stable +Reviewed-by: Jack Pham +Signed-off-by: Albert Wang +Link: https://lore.kernel.org/r/20211109092642.3507692-1-albertccwang@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3263,6 +3263,9 @@ static bool dwc3_gadget_endpoint_trbs_co + struct dwc3 *dwc = dep->dwc; + bool no_started_trb = true; + ++ if (!dep->endpoint.desc) ++ return no_started_trb; ++ + dwc3_gadget_ep_cleanup_completed_requests(dep, event, status); + + if (dep->flags & DWC3_EP_END_TRANSFER_PENDING) +@@ -3310,6 +3313,9 @@ static void dwc3_gadget_endpoint_transfe + { + int status = 0; + ++ if (!dep->endpoint.desc) ++ return; ++ + if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) + dwc3_gadget_endpoint_frame_from_event(dep, event); + diff --git a/queue-5.15/usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch b/queue-5.15/usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch new file mode 100644 index 00000000000..d3f9c2308c3 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch @@ -0,0 +1,58 @@ +From d74dc3e9f58c28689cef1faccf918e06587367d3 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 25 Oct 2021 16:21:10 -0700 +Subject: usb: dwc3: gadget: Ignore NoStream after End Transfer + +From: Thinh Nguyen + +commit d74dc3e9f58c28689cef1faccf918e06587367d3 upstream. + +The End Transfer command from a stream endpoint will generate a NoStream +event, and we should ignore it. Currently we set the flag +DWC3_EP_IGNORE_NEXT_NOSTREAM to track this prior to sending the command, +and it will be cleared on the next stream event. However, a stream event +may be generated before the End Transfer command completion and +prematurely clear the flag. Fix this by setting the flag on End Transfer +completion instead. + +Fixes: 140ca4cfea8a ("usb: dwc3: gadget: Handle stream transfers") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/cee1253af4c3600edb878d11c9c08b040817ae23.1635203975.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3352,6 +3352,14 @@ static void dwc3_gadget_endpoint_command + if (cmd != DWC3_DEPCMD_ENDTRANSFER) + return; + ++ /* ++ * The END_TRANSFER command will cause the controller to generate a ++ * NoStream Event, and it's not due to the host DP NoStream rejection. ++ * Ignore the next NoStream event. ++ */ ++ if (dep->stream_capable) ++ dep->flags |= DWC3_EP_IGNORE_NEXT_NOSTREAM; ++ + dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + dwc3_gadget_ep_cleanup_cancelled_requests(dep); +@@ -3574,14 +3582,6 @@ static void dwc3_stop_active_transfer(st + WARN_ON_ONCE(ret); + dep->resource_index = 0; + +- /* +- * The END_TRANSFER command will cause the controller to generate a +- * NoStream Event, and it's not due to the host DP NoStream rejection. +- * Ignore the next NoStream event. +- */ +- if (dep->stream_capable) +- dep->flags |= DWC3_EP_IGNORE_NEXT_NOSTREAM; +- + if (!interrupt) + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + else diff --git a/queue-5.15/usb-dwc3-leave-default-dma-for-pci-devices.patch b/queue-5.15/usb-dwc3-leave-default-dma-for-pci-devices.patch new file mode 100644 index 00000000000..ee5342361f5 --- /dev/null +++ b/queue-5.15/usb-dwc3-leave-default-dma-for-pci-devices.patch @@ -0,0 +1,42 @@ +From 47ce45906ca9870cf5267261f155fb7c70307cf0 Mon Sep 17 00:00:00 2001 +From: Fabio Aiuto +Date: Sat, 13 Nov 2021 15:29:59 +0100 +Subject: usb: dwc3: leave default DMA for PCI devices + +From: Fabio Aiuto + +commit 47ce45906ca9870cf5267261f155fb7c70307cf0 upstream. + +in case of a PCI dwc3 controller, leave the default DMA +mask. Calling of a 64 bit DMA mask breaks the driver on +cherrytrail based tablets like Cyberbook T116. + +Fixes: 45d39448b4d0 ("usb: dwc3: support 64 bit DMA in platform driver") +Cc: stable +Reported-by: Hans De Goede +Tested-by: Fabio Aiuto +Tested-by: Hans de Goede +Signed-off-by: Fabio Aiuto +Link: https://lore.kernel.org/r/20211113142959.27191-1-fabioaiuto83@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1565,9 +1565,11 @@ static int dwc3_probe(struct platform_de + + dwc3_get_properties(dwc); + +- ret = dma_set_mask_and_coherent(dwc->sysdev, DMA_BIT_MASK(64)); +- if (ret) +- return ret; ++ if (!dwc->sysdev_is_parent) { ++ ret = dma_set_mask_and_coherent(dwc->sysdev, DMA_BIT_MASK(64)); ++ if (ret) ++ return ret; ++ } + + dwc->reset = devm_reset_control_array_get_optional_shared(dev); + if (IS_ERR(dwc->reset)) diff --git a/queue-5.15/usb-hub-fix-locking-issues-with-address0_mutex.patch b/queue-5.15/usb-hub-fix-locking-issues-with-address0_mutex.patch new file mode 100644 index 00000000000..678fda7130c --- /dev/null +++ b/queue-5.15/usb-hub-fix-locking-issues-with-address0_mutex.patch @@ -0,0 +1,104 @@ +From 6cca13de26eea6d32a98d96d916a048d16a12822 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 23 Nov 2021 12:16:56 +0200 +Subject: usb: hub: Fix locking issues with address0_mutex + +From: Mathias Nyman + +commit 6cca13de26eea6d32a98d96d916a048d16a12822 upstream. + +Fix the circular lock dependency and unbalanced unlock of addess0_mutex +introduced when fixing an address0_mutex enumeration retry race in commit +ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race") + +Make sure locking order between port_dev->status_lock and address0_mutex +is correct, and that address0_mutex is not unlocked in hub_port_connect +"done:" codepath which may be reached without locking address0_mutex + +Fixes: 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race") +Cc: +Reported-by: Marek Szyprowski +Tested-by: Hans de Goede +Tested-by: Marek Szyprowski +Acked-by: Hans de Goede +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20211123101656.1113518-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5188,6 +5188,7 @@ static void hub_port_connect(struct usb_ + struct usb_port *port_dev = hub->ports[port1 - 1]; + struct usb_device *udev = port_dev->child; + static int unreliable_port = -1; ++ bool retry_locked; + + /* Disconnect any existing devices under this port */ + if (udev) { +@@ -5244,10 +5245,10 @@ static void hub_port_connect(struct usb_ + + status = 0; + +- mutex_lock(hcd->address0_mutex); +- + for (i = 0; i < PORT_INIT_TRIES; i++) { +- ++ usb_lock_port(port_dev); ++ mutex_lock(hcd->address0_mutex); ++ retry_locked = true; + /* reallocate for each attempt, since references + * to the previous one can escape in various ways + */ +@@ -5255,6 +5256,8 @@ static void hub_port_connect(struct usb_ + if (!udev) { + dev_err(&port_dev->dev, + "couldn't allocate usb_device\n"); ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); + goto done; + } + +@@ -5276,13 +5279,13 @@ static void hub_port_connect(struct usb_ + } + + /* reset (non-USB 3.0 devices) and get descriptor */ +- usb_lock_port(port_dev); + status = hub_port_init(hub, udev, port1, i); +- usb_unlock_port(port_dev); + if (status < 0) + goto loop; + + mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ retry_locked = false; + + if (udev->quirks & USB_QUIRK_DELAY_INIT) + msleep(2000); +@@ -5372,11 +5375,14 @@ static void hub_port_connect(struct usb_ + + loop_disable: + hub_port_disable(hub, port1, 1); +- mutex_lock(hcd->address0_mutex); + loop: + usb_ep0_reinit(udev); + release_devnum(udev); + hub_free_dev(udev); ++ if (retry_locked) { ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ } + usb_put_dev(udev); + if ((status == -ENOTCONN) || (status == -ENOTSUPP)) + break; +@@ -5399,8 +5405,6 @@ loop: + } + + done: +- mutex_unlock(hcd->address0_mutex); +- + hub_port_disable(hub, port1, 1); + if (hcd->driver->relinquish_port && !hub->hdev->parent) { + if (status != -ENOTCONN && status != -ENODEV) diff --git a/queue-5.15/usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch b/queue-5.15/usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch new file mode 100644 index 00000000000..dd2c1304e00 --- /dev/null +++ b/queue-5.15/usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch @@ -0,0 +1,108 @@ +From 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 16 Nov 2021 00:16:30 +0200 +Subject: usb: hub: Fix usb enumeration issue due to address0 race + +From: Mathias Nyman + +commit 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b upstream. + +xHC hardware can only have one slot in default state with address 0 +waiting for a unique address at a time, otherwise "undefined behavior +may occur" according to xhci spec 5.4.3.4 + +The address0_mutex exists to prevent this across both xhci roothubs. + +If hub_port_init() fails, it may unlock the mutex and exit with a xhci +slot in default state. If the other xhci roothub calls hub_port_init() +at this point we end up with two slots in default state. + +Make sure the address0_mutex protects the slot default state across +hub_port_init() retries, until slot is addressed or disabled. + +Note, one known minor case is not fixed by this patch. +If device needs to be reset during resume, but fails all hub_port_init() +retries in usb_reset_and_verify_device(), then it's possible the slot is +still left in default state when address0_mutex is unlocked. + +Cc: +Fixes: 638139eb95d2 ("usb: hub: allow to process more usb hub events in parallel") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20211115221630.871204-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4700,8 +4700,6 @@ hub_port_init(struct usb_hub *hub, struc + if (oldspeed == USB_SPEED_LOW) + delay = HUB_LONG_RESET_TIME; + +- mutex_lock(hcd->address0_mutex); +- + /* Reset the device; full speed may morph to high speed */ + /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */ + retval = hub_port_reset(hub, port1, udev, delay, false); +@@ -5016,7 +5014,6 @@ fail: + hub_port_disable(hub, port1, 0); + update_devnum(udev, devnum); /* for disconnect processing */ + } +- mutex_unlock(hcd->address0_mutex); + return retval; + } + +@@ -5246,6 +5243,9 @@ static void hub_port_connect(struct usb_ + unit_load = 100; + + status = 0; ++ ++ mutex_lock(hcd->address0_mutex); ++ + for (i = 0; i < PORT_INIT_TRIES; i++) { + + /* reallocate for each attempt, since references +@@ -5282,6 +5282,8 @@ static void hub_port_connect(struct usb_ + if (status < 0) + goto loop; + ++ mutex_unlock(hcd->address0_mutex); ++ + if (udev->quirks & USB_QUIRK_DELAY_INIT) + msleep(2000); + +@@ -5370,6 +5372,7 @@ static void hub_port_connect(struct usb_ + + loop_disable: + hub_port_disable(hub, port1, 1); ++ mutex_lock(hcd->address0_mutex); + loop: + usb_ep0_reinit(udev); + release_devnum(udev); +@@ -5396,6 +5399,8 @@ loop: + } + + done: ++ mutex_unlock(hcd->address0_mutex); ++ + hub_port_disable(hub, port1, 1); + if (hcd->driver->relinquish_port && !hub->hdev->parent) { + if (status != -ENOTCONN && status != -ENODEV) +@@ -5915,6 +5920,8 @@ static int usb_reset_and_verify_device(s + bos = udev->bos; + udev->bos = NULL; + ++ mutex_lock(hcd->address0_mutex); ++ + for (i = 0; i < PORT_INIT_TRIES; ++i) { + + /* ep0 maxpacket size may change; let the HCD know about it. +@@ -5924,6 +5931,7 @@ static int usb_reset_and_verify_device(s + if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV) + break; + } ++ mutex_unlock(hcd->address0_mutex); + + if (ret < 0) + goto re_enumerate; diff --git a/queue-5.15/usb-serial-option-add-fibocom-fm101-gl-variants.patch b/queue-5.15/usb-serial-option-add-fibocom-fm101-gl-variants.patch new file mode 100644 index 00000000000..487cda57c28 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-fibocom-fm101-gl-variants.patch @@ -0,0 +1,688 @@ +From 88459e3e42760abb2299bbf6cb1026491170e02a Mon Sep 17 00:00:00 2001 +From: Mingjie Zhang +Date: Tue, 23 Nov 2021 21:37:57 +0800 +Subject: USB: serial: option: add Fibocom FM101-GL variants + +From: Mingjie Zhang + +commit 88459e3e42760abb2299bbf6cb1026491170e02a upstream. + +Update the USB serial option driver support for the Fibocom +FM101-GL Cat.6 +LTE modules as there are actually several different variants. +- VID:PID 2cb7:01a2, FM101-GL are laptop M.2 cards (with + MBIM interfaces for /Linux/Chrome OS) +- VID:PID 2cb7:01a4, FM101-GL for laptop debug M.2 cards(with adb + interface for /Linux/Chrome OS) + +0x01a2: mbim, tty, tty, diag, gnss +0x01a4: mbim, diag, tty, adb, gnss, gnss + +Here are the outputs of lsusb -v and usb-devices: + +T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 86 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=01a2 Rev= 5.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom FM101-GL Module +S: SerialNumber=673326ce +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none) +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none) +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none) + +Bus 002 Device 084: ID 2cb7:01a2 Fibocom Wireless Inc. Fibocom FM101-GL Module +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 3.20 + bDeviceClass 0 + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 9 + idVendor 0x2cb7 + idProduct 0x01a2 + bcdDevice 5.04 + iManufacturer 1 Fibocom Wireless Inc. + iProduct 2 Fibocom FM101-GL Module + iSerial 3 673326ce + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x015d + bNumInterfaces 6 + bConfigurationValue 1 + iConfiguration 4 MBIM_DUN_DUN_DIAG_NMEA + bmAttributes 0xa0 + (Bus Powered) + Remote Wakeup + MaxPower 896mA + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 0 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 14 + bFunctionProtocol 0 + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 14 + bInterfaceProtocol 0 + iInterface 5 Fibocom FM101-GL LTE Modem + CDC Header: + bcdCDC 1.10 + CDC Union: + bMasterInterface 0 + bSlaveInterface 1 + CDC MBIM: + bcdMBIMVersion 1.00 + wMaxControlMessage 4096 + bNumberFilters 32 + bMaxFilterSize 128 + wMaxSegmentSize 2048 + bmNetworkCapabilities 0x20 + 8-byte ntb input size + CDC MBIM Extended: + bcdMBIMExtendedVersion 1.00 + bMaxOutstandingCommandMessages 64 + wMTU 1500 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 9 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 0 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 1 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 6 MBIM Data + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x8e EP 14 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 6 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x0f EP 15 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 2 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 48 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 5 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x88 EP 8 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + +T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 85 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=01a4 Rev= 5.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom FM101-GL Module +S: SerialNumber=673326ce +C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none) +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none) +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none) + +Bus 002 Device 085: ID 2cb7:01a4 Fibocom Wireless Inc. Fibocom FM101-GL Module +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 3.20 + bDeviceClass 0 + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 9 + idVendor 0x2cb7 + idProduct 0x01a4 + bcdDevice 5.04 + iManufacturer 1 Fibocom Wireless Inc. + iProduct 2 Fibocom FM101-GL Module + iSerial 3 673326ce + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x0180 + bNumInterfaces 7 + bConfigurationValue 1 + iConfiguration 4 MBIM_DIAG_DUN_ADB_GNSS_GNSS + bmAttributes 0xa0 + (Bus Powered) + Remote Wakeup + MaxPower 896mA + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 0 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 14 + bFunctionProtocol 0 + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 14 + bInterfaceProtocol 0 + iInterface 5 Fibocom FM101-GL LTE Modem + CDC Header: + bcdCDC 1.10 + CDC Union: + bMasterInterface 0 + bSlaveInterface 1 + CDC MBIM: + bcdMBIMVersion 1.00 + wMaxControlMessage 4096 + bNumberFilters 32 + bMaxFilterSize 128 + wMaxSegmentSize 2048 + bmNetworkCapabilities 0x20 + 8-byte ntb input size + CDC MBIM Extended: + bcdMBIMExtendedVersion 1.00 + bMaxOutstandingCommandMessages 64 + wMTU 1500 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 9 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 0 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 1 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 6 MBIM Data + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x8e EP 14 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 6 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x0f EP 15 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 2 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 48 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 66 + bInterfaceProtocol 1 + iInterface 8 ADB Interface + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 5 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 6 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x89 EP 9 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x88 EP 8 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x05 EP 5 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + +Signed-off-by: Mingjie Zhang +Link: https://lore.kernel.org/r/20211123133757.37475-1-superzmj@fibocom.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2096,6 +2096,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ ++ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ diff --git a/queue-5.15/usb-serial-option-add-telit-le910s1-0x9200-composition.patch b/queue-5.15/usb-serial-option-add-telit-le910s1-0x9200-composition.patch new file mode 100644 index 00000000000..cca2b13598c --- /dev/null +++ b/queue-5.15/usb-serial-option-add-telit-le910s1-0x9200-composition.patch @@ -0,0 +1,33 @@ +From e353f3e88720300c3d72f49a4bea54f42db1fa5e Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Fri, 19 Nov 2021 15:03:19 +0100 +Subject: USB: serial: option: add Telit LE910S1 0x9200 composition + +From: Daniele Palmas + +commit e353f3e88720300c3d72f49a4bea54f42db1fa5e upstream. + +Add the following Telit LE910S1 composition: + +0x9200: tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20211119140319.10448-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1267,6 +1267,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ + .driver_info = NCTRL(0) | ZLP }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, diff --git a/queue-5.15/usb-serial-pl2303-fix-gc-type-detection.patch b/queue-5.15/usb-serial-pl2303-fix-gc-type-detection.patch new file mode 100644 index 00000000000..6fc06f61455 --- /dev/null +++ b/queue-5.15/usb-serial-pl2303-fix-gc-type-detection.patch @@ -0,0 +1,38 @@ +From aa5721a9e0c9fb8a4bdfe0c8751377cd537d6174 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 23 Nov 2021 10:10:17 +0100 +Subject: USB: serial: pl2303: fix GC type detection + +From: Johan Hovold + +commit aa5721a9e0c9fb8a4bdfe0c8751377cd537d6174 upstream. + +At least some PL2303GC have a bcdDevice of 0x105 instead of 0x100 as the +datasheet claims. Add it to the list of known release numbers for the +HXN (G) type. + +Note the chip type could only be determined indirectly based on its +package being of QFP type, which appears to only be available for +PL2303GC. + +Fixes: 894758d0571d ("USB: serial: pl2303: tighten type HXN (G) detection") +Cc: stable@vger.kernel.org # 5.13 +Reported-by: Anton Lundin +Link: https://lore.kernel.org/r/20211123071613.GZ108031@montezuma.acc.umu.se +Link: https://lore.kernel.org/r/20211123091017.30708-1-johan@kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/pl2303.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -432,6 +432,7 @@ static int pl2303_detect_type(struct usb + case 0x200: + switch (bcdDevice) { + case 0x100: ++ case 0x105: + case 0x305: + case 0x405: + /* diff --git a/queue-5.15/usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch b/queue-5.15/usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch new file mode 100644 index 00000000000..1a38011e4ea --- /dev/null +++ b/queue-5.15/usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch @@ -0,0 +1,66 @@ +From 362468830dd5bea8bf6ad5203b2ea61f8a4e8288 Mon Sep 17 00:00:00 2001 +From: Ondrej Jirman +Date: Mon, 8 Nov 2021 11:28:32 +0100 +Subject: usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts + +From: Ondrej Jirman + +commit 362468830dd5bea8bf6ad5203b2ea61f8a4e8288 upstream. + +The code that enables either BC_LVL or COMP_CHNG interrupt in tcpm_set_cc +wrongly assumes that the interrupt is unmasked by writing 1 to the apropriate +bit in the mask register. In fact, interrupts are enabled when the mask +is 0, so the tcpm_set_cc enables interrupt for COMP_CHNG when it expects +BC_LVL interrupt to be enabled. + +This causes inability of the driver to recognize cable unplug events +in host mode (unplug is recognized only via a COMP_CHNG interrupt). + +In device mode this bug was masked by simultaneous triggering of the VBUS +change interrupt, because of loss of VBUS when the port peer is providing +power. + +Fixes: 48242e30532b ("usb: typec: fusb302: Revert "Resolve fixed power role contract setup"") +Cc: stable +Cc: Hans de Goede +Reviewed-by: Hans de Goede +Acked-by: Heikki Krogerus +Signed-off-by: Ondrej Jirman +Link: https://lore.kernel.org/r/20211108102833.2793803-1-megous@megous.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/fusb302.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/tcpm/fusb302.c ++++ b/drivers/usb/typec/tcpm/fusb302.c +@@ -669,25 +669,27 @@ static int tcpm_set_cc(struct tcpc_dev * + ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK, + FUSB_REG_MASK_BC_LVL | + FUSB_REG_MASK_COMP_CHNG, +- FUSB_REG_MASK_COMP_CHNG); ++ FUSB_REG_MASK_BC_LVL); + if (ret < 0) { + fusb302_log(chip, "cannot set SRC interrupt, ret=%d", + ret); + goto done; + } + chip->intr_comp_chng = true; ++ chip->intr_bc_lvl = false; + break; + case TYPEC_CC_RD: + ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK, + FUSB_REG_MASK_BC_LVL | + FUSB_REG_MASK_COMP_CHNG, +- FUSB_REG_MASK_BC_LVL); ++ FUSB_REG_MASK_COMP_CHNG); + if (ret < 0) { + fusb302_log(chip, "cannot set SRC interrupt, ret=%d", + ret); + goto done; + } + chip->intr_bc_lvl = true; ++ chip->intr_comp_chng = false; + break; + default: + break; diff --git a/queue-5.15/usb-xhci-tegra-check-padctrl-interrupt-presence-in-device-tree.patch b/queue-5.15/usb-xhci-tegra-check-padctrl-interrupt-presence-in-device-tree.patch new file mode 100644 index 00000000000..ea886edcee1 --- /dev/null +++ b/queue-5.15/usb-xhci-tegra-check-padctrl-interrupt-presence-in-device-tree.patch @@ -0,0 +1,110 @@ +From 51f2246158f686c881859f4b620f831f06e296e1 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Mon, 8 Nov 2021 01:44:55 +0300 +Subject: usb: xhci: tegra: Check padctrl interrupt presence in device tree + +From: Dmitry Osipenko + +commit 51f2246158f686c881859f4b620f831f06e296e1 upstream. + +Older device-trees don't specify padctrl interrupt and xhci-tegra driver +now fails to probe with -EINVAL using those device-trees. Check interrupt +presence and keep runtime PM disabled if it's missing to fix the trouble. + +Fixes: 971ee247060d ("usb: xhci: tegra: Enable ELPG for runtime/system PM") +Cc: # 5.14+ +Reported-by: Nicolas Chauvet +Tested-by: Nicolas Chauvet # T124 TK1 +Tested-by: Thomas Graichen # T124 Nyan Big +Tested-by: Thierry Reding # Tegra CI +Acked-by: Thierry Reding +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20211107224455.10359-1-digetx@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-tegra.c | 41 +++++++++++++++++++++++++++++------------ + 1 file changed, 29 insertions(+), 12 deletions(-) + +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -1400,6 +1400,7 @@ static void tegra_xusb_deinit_usb_phy(st + + static int tegra_xusb_probe(struct platform_device *pdev) + { ++ struct of_phandle_args args; + struct tegra_xusb *tegra; + struct device_node *np; + struct resource *regs; +@@ -1454,10 +1455,17 @@ static int tegra_xusb_probe(struct platf + goto put_padctl; + } + +- tegra->padctl_irq = of_irq_get(np, 0); +- if (tegra->padctl_irq <= 0) { +- err = (tegra->padctl_irq == 0) ? -ENODEV : tegra->padctl_irq; +- goto put_padctl; ++ /* Older device-trees don't have padctrl interrupt */ ++ err = of_irq_parse_one(np, 0, &args); ++ if (!err) { ++ tegra->padctl_irq = of_irq_get(np, 0); ++ if (tegra->padctl_irq <= 0) { ++ err = (tegra->padctl_irq == 0) ? -ENODEV : tegra->padctl_irq; ++ goto put_padctl; ++ } ++ } else { ++ dev_dbg(&pdev->dev, ++ "%pOF is missing an interrupt, disabling PM support\n", np); + } + + tegra->host_clk = devm_clk_get(&pdev->dev, "xusb_host"); +@@ -1696,11 +1704,15 @@ static int tegra_xusb_probe(struct platf + goto remove_usb3; + } + +- err = devm_request_threaded_irq(&pdev->dev, tegra->padctl_irq, NULL, tegra_xusb_padctl_irq, +- IRQF_ONESHOT, dev_name(&pdev->dev), tegra); +- if (err < 0) { +- dev_err(&pdev->dev, "failed to request padctl IRQ: %d\n", err); +- goto remove_usb3; ++ if (tegra->padctl_irq) { ++ err = devm_request_threaded_irq(&pdev->dev, tegra->padctl_irq, ++ NULL, tegra_xusb_padctl_irq, ++ IRQF_ONESHOT, dev_name(&pdev->dev), ++ tegra); ++ if (err < 0) { ++ dev_err(&pdev->dev, "failed to request padctl IRQ: %d\n", err); ++ goto remove_usb3; ++ } + } + + err = tegra_xusb_enable_firmware_messages(tegra); +@@ -1718,13 +1730,16 @@ static int tegra_xusb_probe(struct platf + /* Enable wake for both USB 2.0 and USB 3.0 roothubs */ + device_init_wakeup(&tegra->hcd->self.root_hub->dev, true); + device_init_wakeup(&xhci->shared_hcd->self.root_hub->dev, true); +- device_init_wakeup(tegra->dev, true); + + pm_runtime_use_autosuspend(tegra->dev); + pm_runtime_set_autosuspend_delay(tegra->dev, 2000); + pm_runtime_mark_last_busy(tegra->dev); + pm_runtime_set_active(tegra->dev); +- pm_runtime_enable(tegra->dev); ++ ++ if (tegra->padctl_irq) { ++ device_init_wakeup(tegra->dev, true); ++ pm_runtime_enable(tegra->dev); ++ } + + return 0; + +@@ -1772,7 +1787,9 @@ static int tegra_xusb_remove(struct plat + dma_free_coherent(&pdev->dev, tegra->fw.size, tegra->fw.virt, + tegra->fw.phys); + +- pm_runtime_disable(&pdev->dev); ++ if (tegra->padctl_irq) ++ pm_runtime_disable(&pdev->dev); ++ + pm_runtime_put(&pdev->dev); + + tegra_xusb_powergate_partitions(tegra);