From: Greg Kroah-Hartman Date: Sun, 1 May 2022 16:35:10 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.192~68 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ada681e289f30d0aa18e56c198e47d4b84d3d619;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch iio-dac-ad5592r-fix-the-missing-return-value.patch iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch serial-imx-fix-overrun-interrupts-in-dma-mode.patch usb-dwc3-core-fix-tx-rx-threshold-settings.patch usb-dwc3-core-only-handle-soft-reset-in-dctl.patch usb-dwc3-gadget-return-proper-request-status.patch usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch usb-phy-generic-get-the-vbus-supply.patch usb-typec-ucsi-fix-role-swapping.patch --- diff --git a/queue-5.4/arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch b/queue-5.4/arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch new file mode 100644 index 00000000000..2630d4db12b --- /dev/null +++ b/queue-5.4/arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch @@ -0,0 +1,35 @@ +From 1dc9f1a66e1718479e1c4f95514e1750602a3cb9 Mon Sep 17 00:00:00 2001 +From: Wang Qing +Date: Sun, 10 Apr 2022 19:36:19 -0700 +Subject: arch_topology: Do not set llc_sibling if llc_id is invalid + +From: Wang Qing + +commit 1dc9f1a66e1718479e1c4f95514e1750602a3cb9 upstream. + +When ACPI is not enabled, cpuid_topo->llc_id = cpu_topo->llc_id = -1, which +will set llc_sibling 0xff(...), this is misleading. + +Don't set llc_sibling(default 0) if we don't know the cache topology. + +Reviewed-by: Sudeep Holla +Signed-off-by: Wang Qing +Fixes: 37c3ec2d810f ("arm64: topology: divorce MC scheduling domain from core_siblings") +Cc: stable +Link: https://lore.kernel.org/r/1649644580-54626-1-git-send-email-wangqing@vivo.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/arch_topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/arch_topology.c ++++ b/drivers/base/arch_topology.c +@@ -457,7 +457,7 @@ void update_siblings_masks(unsigned int + for_each_online_cpu(cpu) { + cpu_topo = &cpu_topology[cpu]; + +- if (cpuid_topo->llc_id == cpu_topo->llc_id) { ++ if (cpu_topo->llc_id != -1 && cpuid_topo->llc_id == cpu_topo->llc_id) { + cpumask_set_cpu(cpu, &cpuid_topo->llc_sibling); + cpumask_set_cpu(cpuid, &cpu_topo->llc_sibling); + } diff --git a/queue-5.4/iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch b/queue-5.4/iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch new file mode 100644 index 00000000000..d17cea37bb5 --- /dev/null +++ b/queue-5.4/iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch @@ -0,0 +1,36 @@ +From 89a01cd688d3c0ac983ef0b0e5f40018ab768317 Mon Sep 17 00:00:00 2001 +From: Michael Hennerich +Date: Wed, 6 Apr 2022 12:56:20 +0200 +Subject: iio: dac: ad5446: Fix read_raw not returning set value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Hennerich + +commit 89a01cd688d3c0ac983ef0b0e5f40018ab768317 upstream. + +read_raw should return the un-scaled value. + +Fixes: 5e06bdfb46e8b ("staging:iio:dac:ad5446: Return cached value for 'raw' attribute") +Signed-off-by: Michael Hennerich +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20220406105620.1171340-1-michael.hennerich@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5446.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -170,7 +170,7 @@ static int ad5446_read_raw(struct iio_de + + switch (m) { + case IIO_CHAN_INFO_RAW: +- *val = st->cached_val; ++ *val = st->cached_val >> chan->scan_type.shift; + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: + *val = st->vref_mv; diff --git a/queue-5.4/iio-dac-ad5592r-fix-the-missing-return-value.patch b/queue-5.4/iio-dac-ad5592r-fix-the-missing-return-value.patch new file mode 100644 index 00000000000..678ed89d4d0 --- /dev/null +++ b/queue-5.4/iio-dac-ad5592r-fix-the-missing-return-value.patch @@ -0,0 +1,34 @@ +From b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 Mon Sep 17 00:00:00 2001 +From: Zizhuang Deng +Date: Thu, 10 Mar 2022 20:54:50 +0800 +Subject: iio: dac: ad5592r: Fix the missing return value. + +From: Zizhuang Deng + +commit b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 upstream. + +The third call to `fwnode_property_read_u32` did not record +the return value, resulting in `channel_offstate` possibly +being assigned the wrong value. + +Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs") +Signed-off-by: Zizhuang Deng +Link: https://lore.kernel.org/r/20220310125450.4164164-1-sunsetdzz@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5592r-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5592r-base.c ++++ b/drivers/iio/dac/ad5592r-base.c +@@ -530,7 +530,7 @@ static int ad5592r_alloc_channels(struct + if (!ret) + st->channel_modes[reg] = tmp; + +- fwnode_property_read_u32(child, "adi,off-state", &tmp); ++ ret = fwnode_property_read_u32(child, "adi,off-state", &tmp); + if (!ret) + st->channel_offstate[reg] = tmp; + } diff --git a/queue-5.4/iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch b/queue-5.4/iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch new file mode 100644 index 00000000000..b8e07e91ac2 --- /dev/null +++ b/queue-5.4/iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch @@ -0,0 +1,42 @@ +From 3a26787dacf04257a68b16315c984eb2c340bc5e Mon Sep 17 00:00:00 2001 +From: Zheyu Ma +Date: Sat, 9 Apr 2022 11:48:49 +0800 +Subject: iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() + +From: Zheyu Ma + +commit 3a26787dacf04257a68b16315c984eb2c340bc5e upstream. + +When the driver fails to enable the regulator 'vid', we will get the +following splat: + +[ 79.955610] WARNING: CPU: 5 PID: 441 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0 +[ 79.959641] RIP: 0010:_regulator_put+0x3ec/0x4e0 +[ 79.967570] Call Trace: +[ 79.967773] +[ 79.967951] regulator_put+0x1f/0x30 +[ 79.968254] devres_release_group+0x319/0x3d0 +[ 79.968608] i2c_device_probe+0x766/0x940 + +Fix this by disabling the 'vdd' regulator when failing to enable 'vid' +regulator. + +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220409034849.3717231-2-zheyuma97@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/magnetometer/ak8975.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -391,6 +391,7 @@ static int ak8975_power_on(const struct + if (ret) { + dev_warn(&data->client->dev, + "Failed to enable specified Vid supply\n"); ++ regulator_disable(data->vdd); + return ret; + } + /* diff --git a/queue-5.4/serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch b/queue-5.4/serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch new file mode 100644 index 00000000000..89dbe796702 --- /dev/null +++ b/queue-5.4/serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch @@ -0,0 +1,36 @@ +From 6e6eebdf5e2455f089ccd000754a0deaeb79af82 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Mon, 18 Apr 2022 16:27:10 +0100 +Subject: serial: 8250: Also set sticky MCR bits in console restoration + +From: Maciej W. Rozycki + +commit 6e6eebdf5e2455f089ccd000754a0deaeb79af82 upstream. + +Sticky MCR bits are lost in console restoration if console suspending +has been disabled. This currently affects the AFE bit, which works in +combination with RTS which we set, so we want to make sure the UART +retains control of its FIFO where previously requested. Also specific +drivers may need other bits in the future. + +Signed-off-by: Maciej W. Rozycki +Fixes: 4516d50aabed ("serial: 8250: Use canary to restart console after suspend") +Cc: stable@vger.kernel.org # v4.0+ +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181518490.9383@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_port.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -3184,7 +3184,7 @@ static void serial8250_console_restore(s + + serial8250_set_divisor(port, baud, quot, frac); + serial_port_out(port, UART_LCR, up->lcr); +- serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS); ++ serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); + } + + /* diff --git a/queue-5.4/serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch b/queue-5.4/serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch new file mode 100644 index 00000000000..291be695b23 --- /dev/null +++ b/queue-5.4/serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch @@ -0,0 +1,63 @@ +From 637674fa40059cddcc3ad2212728965072f62ea3 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Mon, 18 Apr 2022 16:27:16 +0100 +Subject: serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device + +From: Maciej W. Rozycki + +commit 637674fa40059cddcc3ad2212728965072f62ea3 upstream. + +The EndRun PTP/1588 dual serial port device is based on the Oxford +Semiconductor OXPCIe952 UART device with the PCI vendor:device ID set +for EndRun Technologies and is therefore driven by a fixed 62.5MHz clock +input derived from the 100MHz PCI Express clock. The clock rate is +divided by the oversampling rate of 16 as it is supplied to the baud +rate generator, yielding the baud base of 3906250. + +Replace the incorrect baud base of 4000000 with the right value of +3906250 then, complementing commit 6cbe45d8ac93 ("serial: 8250: Correct +the clock for OxSemi PCIe devices"). + +Signed-off-by: Maciej W. Rozycki +Cc: stable +Fixes: 1bc8cde46a159 ("8250_pci: Added driver for Endrun Technologies PTP PCIe card.") +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181515270.9383@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_pci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -2907,7 +2907,7 @@ enum pci_board_num_t { + pbn_panacom2, + pbn_panacom4, + pbn_plx_romulus, +- pbn_endrun_2_4000000, ++ pbn_endrun_2_3906250, + pbn_oxsemi, + pbn_oxsemi_1_4000000, + pbn_oxsemi_2_4000000, +@@ -3434,10 +3434,10 @@ static struct pciserial_board pci_boards + * signal now many ports are available + * 2 port 952 Uart support + */ +- [pbn_endrun_2_4000000] = { ++ [pbn_endrun_2_3906250] = { + .flags = FL_BASE0, + .num_ports = 2, +- .base_baud = 4000000, ++ .base_baud = 3906250, + .uart_offset = 0x200, + .first_offset = 0x1000, + }, +@@ -4345,7 +4345,7 @@ static const struct pci_device_id serial + */ + { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_endrun_2_4000000 }, ++ pbn_endrun_2_3906250 }, + /* + * Quatech cards. These actually have configurable clocks but for + * now we just use the default. diff --git a/queue-5.4/serial-imx-fix-overrun-interrupts-in-dma-mode.patch b/queue-5.4/serial-imx-fix-overrun-interrupts-in-dma-mode.patch new file mode 100644 index 00000000000..b19ab1400e3 --- /dev/null +++ b/queue-5.4/serial-imx-fix-overrun-interrupts-in-dma-mode.patch @@ -0,0 +1,45 @@ +From 3ee82c6e41f3d2212647ce0bc5a05a0f69097824 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 11 Apr 2022 10:19:57 +0200 +Subject: serial: imx: fix overrun interrupts in DMA mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johan Hovold + +commit 3ee82c6e41f3d2212647ce0bc5a05a0f69097824 upstream. + +Commit 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is +off") accidentally enabled overrun interrupts unconditionally when +deferring DMA enable until after the receiver has been enabled during +startup. + +Fix this by using the DMA-initialised instead of DMA-enabled flag to +determine whether overrun interrupts should be enabled. + +Note that overrun interrupts are already accounted for in +imx_uart_clear_rx_errors() when using DMA since commit 41d98b5da92f +("serial: imx-serial - update RX error counters when DMA is used"). + +Fixes: 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is off") +Cc: stable@vger.kernel.org # 4.17 +Cc: Uwe Kleine-König +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220411081957.7846-1-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1401,7 +1401,7 @@ static int imx_uart_startup(struct uart_ + imx_uart_writel(sport, ucr1, UCR1); + + ucr4 = imx_uart_readl(sport, UCR4) & ~UCR4_OREN; +- if (!sport->dma_is_enabled) ++ if (!dma_is_inited) + ucr4 |= UCR4_OREN; + imx_uart_writel(sport, ucr4, UCR4); + diff --git a/queue-5.4/series b/queue-5.4/series index e09fd466415..6c143069ae4 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -11,3 +11,18 @@ usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch xhci-stop-polling-roothubs-after-shutdown.patch xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch +iio-dac-ad5592r-fix-the-missing-return-value.patch +iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch +iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch +usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch +usb-typec-ucsi-fix-role-swapping.patch +usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch +usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch +usb-dwc3-core-fix-tx-rx-threshold-settings.patch +usb-dwc3-core-only-handle-soft-reset-in-dctl.patch +usb-dwc3-gadget-return-proper-request-status.patch +usb-phy-generic-get-the-vbus-supply.patch +serial-imx-fix-overrun-interrupts-in-dma-mode.patch +serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch +serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch +arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch diff --git a/queue-5.4/usb-dwc3-core-fix-tx-rx-threshold-settings.patch b/queue-5.4/usb-dwc3-core-fix-tx-rx-threshold-settings.patch new file mode 100644 index 00000000000..8abae6893f8 --- /dev/null +++ b/queue-5.4/usb-dwc3-core-fix-tx-rx-threshold-settings.patch @@ -0,0 +1,40 @@ +From f28ad9069363dec7deb88032b70612755eed9ee6 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 11 Apr 2022 18:33:47 -0700 +Subject: usb: dwc3: core: Fix tx/rx threshold settings + +From: Thinh Nguyen + +commit f28ad9069363dec7deb88032b70612755eed9ee6 upstream. + +The current driver logic checks against 0 to determine whether the +periodic tx/rx threshold settings are set, but we may get bogus values +from uninitialized variables if no device property is set. Properly +default these variables to 0. + +Fixes: 938a5ad1d305 ("usb: dwc3: Check for ESS TX/RX threshold config") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/cccfce990b11b730b0dae42f9d217dc6fb988c90.1649727139.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1229,10 +1229,10 @@ static void dwc3_get_properties(struct d + u8 lpm_nyet_threshold; + u8 tx_de_emphasis; + u8 hird_threshold; +- u8 rx_thr_num_pkt_prd; +- u8 rx_max_burst_prd; +- u8 tx_thr_num_pkt_prd; +- u8 tx_max_burst_prd; ++ u8 rx_thr_num_pkt_prd = 0; ++ u8 rx_max_burst_prd = 0; ++ u8 tx_thr_num_pkt_prd = 0; ++ u8 tx_max_burst_prd = 0; + + /* default to highest possible threshold */ + lpm_nyet_threshold = 0xf; diff --git a/queue-5.4/usb-dwc3-core-only-handle-soft-reset-in-dctl.patch b/queue-5.4/usb-dwc3-core-only-handle-soft-reset-in-dctl.patch new file mode 100644 index 00000000000..2b34759adc7 --- /dev/null +++ b/queue-5.4/usb-dwc3-core-only-handle-soft-reset-in-dctl.patch @@ -0,0 +1,35 @@ +From f4fd84ae0765a80494b28c43b756a95100351a94 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 21 Apr 2022 19:33:56 -0700 +Subject: usb: dwc3: core: Only handle soft-reset in DCTL + +From: Thinh Nguyen + +commit f4fd84ae0765a80494b28c43b756a95100351a94 upstream. + +Make sure not to set run_stop bit or link state change request while +initiating soft-reset. Register read-modify-write operation may +unintentionally start the controller before the initialization completes +with its previous DCTL value, which can cause initialization failure. + +Fixes: f59dcab17629 ("usb: dwc3: core: improve reset sequence") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/6aecbd78328f102003d40ccf18ceeebd411d3703.1650594792.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -255,7 +255,8 @@ static int dwc3_core_soft_reset(struct d + + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + reg |= DWC3_DCTL_CSFTRST; +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ reg &= ~DWC3_DCTL_RUN_STOP; ++ dwc3_gadget_dctl_write_safe(dwc, reg); + + /* + * For DWC_usb31 controller 1.90a and later, the DCTL.CSFRST bit diff --git a/queue-5.4/usb-dwc3-gadget-return-proper-request-status.patch b/queue-5.4/usb-dwc3-gadget-return-proper-request-status.patch new file mode 100644 index 00000000000..79e39fa8b3c --- /dev/null +++ b/queue-5.4/usb-dwc3-gadget-return-proper-request-status.patch @@ -0,0 +1,74 @@ +From c7428dbddcf4ea1919e1c8e15f715b94ca359268 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Fri, 22 Apr 2022 17:36:28 -0700 +Subject: usb: dwc3: gadget: Return proper request status + +From: Thinh Nguyen + +commit c7428dbddcf4ea1919e1c8e15f715b94ca359268 upstream. + +If the user sets the usb_request's no_interrupt, then there will be no +completion event for the request. Currently the driver incorrectly uses +the event status of a different request to report the status for a +request with no_interrupt. The dwc3 driver needs to check the TRB status +associated with the request when reporting its status. + +Note: this is only applicable to missed_isoc TRB completion status, but +the other status are also listed for completeness/documentation. + +Fixes: 6d8a019614f3 ("usb: dwc3: gadget: check for Missed Isoc from event status") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/db2c80108286cfd108adb05bad52138b78d7c3a7.1650673655.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 31 ++++++++++++++++++++++++++++++- + 1 file changed, 30 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2728,6 +2728,7 @@ static int dwc3_gadget_ep_cleanup_comple + const struct dwc3_event_depevt *event, + struct dwc3_request *req, int status) + { ++ int request_status; + int ret; + + if (req->request.num_mapped_sgs) +@@ -2757,7 +2758,35 @@ static int dwc3_gadget_ep_cleanup_comple + req->needs_extra_trb = false; + } + +- dwc3_gadget_giveback(dep, req, status); ++ /* ++ * The event status only reflects the status of the TRB with IOC set. ++ * For the requests that don't set interrupt on completion, the driver ++ * needs to check and return the status of the completed TRBs associated ++ * with the request. Use the status of the last TRB of the request. ++ */ ++ if (req->request.no_interrupt) { ++ struct dwc3_trb *trb; ++ ++ trb = dwc3_ep_prev_trb(dep, dep->trb_dequeue); ++ switch (DWC3_TRB_SIZE_TRBSTS(trb->size)) { ++ case DWC3_TRBSTS_MISSED_ISOC: ++ /* Isoc endpoint only */ ++ request_status = -EXDEV; ++ break; ++ case DWC3_TRB_STS_XFER_IN_PROG: ++ /* Applicable when End Transfer with ForceRM=0 */ ++ case DWC3_TRBSTS_SETUP_PENDING: ++ /* Control endpoint only */ ++ case DWC3_TRBSTS_OK: ++ default: ++ request_status = 0; ++ break; ++ } ++ } else { ++ request_status = status; ++ } ++ ++ dwc3_gadget_giveback(dep, req, request_status); + + out: + return ret; diff --git a/queue-5.4/usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch b/queue-5.4/usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch new file mode 100644 index 00000000000..3fe2ca90545 --- /dev/null +++ b/queue-5.4/usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch @@ -0,0 +1,37 @@ +From bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 Mon Sep 17 00:00:00 2001 +From: Vijayavardhan Vennapusa +Date: Wed, 13 Apr 2022 16:10:38 -0500 +Subject: usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() + +From: Vijayavardhan Vennapusa + +commit bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 upstream. + +If any function like UVC is deactivating gadget as part of composition +switch which results in not calling pullup enablement, it is not getting +enabled after switch to new composition due to this deactivation flag +not cleared. This results in USB enumeration not happening after switch +to new USB composition. Hence clear deactivation flag inside gadget +structure in configfs_composite_unbind() before switch to new USB +composition. + +Signed-off-by: Vijayavardhan Vennapusa +Signed-off-by: Dan Vacura +Cc: stable +Link: https://lore.kernel.org/r/20220413211038.72797-1-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1412,6 +1412,8 @@ static void configfs_composite_unbind(st + usb_ep_autoconfig_reset(cdev->gadget); + spin_lock_irqsave(&gi->spinlock, flags); + cdev->gadget = NULL; ++ cdev->deactivations = 0; ++ gadget->deactivated = false; + set_gadget_data(gadget, NULL); + spin_unlock_irqrestore(&gi->spinlock, flags); + } diff --git a/queue-5.4/usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch b/queue-5.4/usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch new file mode 100644 index 00000000000..0e8d1a8d07e --- /dev/null +++ b/queue-5.4/usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch @@ -0,0 +1,58 @@ +From 71d471e3faf90c9674cadc7605ac719e82cb7fac Mon Sep 17 00:00:00 2001 +From: Dan Vacura +Date: Thu, 31 Mar 2022 13:40:23 -0500 +Subject: usb: gadget: uvc: Fix crash when encoding data for usb request + +From: Dan Vacura + +commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream. + +During the uvcg_video_pump() process, if an error occurs and +uvcg_queue_cancel() is called, the buffer queue will be cleared out, but +the current marker (queue->buf_used) of the active buffer (no longer +active) is not reset. On the next iteration of uvcg_video_pump() the +stale buf_used count will be used and the logic of min((unsigned +int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a +nbytes size, causing an invalid memory access. + +[80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed +with status -18. +[80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed +with status -18. +... +uvcg_queue_cancel() is called and the queue is cleared out, but the +marker queue->buf_used is not reset. +... +[80802.262328][ T8682] Unable to handle kernel paging request at virtual +address ffffffc03af9f000 +... +... +[80802.263138][ T8682] Call trace: +[80802.263146][ T8682] __memcpy+0x12c/0x180 +[80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 +[80802.263165][ T8682] process_one_work+0x2cc/0x568 +[80802.263173][ T8682] worker_thread+0x28c/0x518 +[80802.263181][ T8682] kthread+0x160/0x170 +[80802.263188][ T8682] ret_from_fork+0x10/0x18 +[80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 + +Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework") +Cc: +Signed-off-by: Dan Vacura +Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_queue.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -242,6 +242,8 @@ void uvcg_queue_cancel(struct uvc_video_ + buf->state = UVC_BUF_STATE_ERROR; + vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); + } ++ queue->buf_used = 0; ++ + /* This must be protected by the irqlock spinlock to avoid race + * conditions between uvc_queue_buffer and the disconnection event that + * could result in an interruptible wait in uvc_dequeue_buffer. Do not diff --git a/queue-5.4/usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch b/queue-5.4/usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch new file mode 100644 index 00000000000..814706ffbde --- /dev/null +++ b/queue-5.4/usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch @@ -0,0 +1,52 @@ +From 0a96fa640dc928da9eaa46a22c46521b037b78ad Mon Sep 17 00:00:00 2001 +From: Hangyu Hua +Date: Thu, 7 Apr 2022 10:40:01 +0800 +Subject: usb: misc: fix improper handling of refcount in uss720_probe() + +From: Hangyu Hua + +commit 0a96fa640dc928da9eaa46a22c46521b037b78ad upstream. + +usb_put_dev shouldn't be called when uss720_probe succeeds because of +priv->usbdev. At the same time, priv->usbdev shouldn't be set to NULL +before destroy_priv in uss720_disconnect because usb_put_dev is in +destroy_priv. + +Fix this by moving priv->usbdev = NULL after usb_put_dev. + +Fixes: dcb4b8ad6a44 ("misc/uss720: fix memory leak in uss720_probe") +Cc: stable +Reviewed-by: Dongliang Mu +Signed-off-by: Hangyu Hua +Link: https://lore.kernel.org/r/20220407024001.11761-1-hbh25y@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/uss720.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -71,6 +71,7 @@ static void destroy_priv(struct kref *kr + + dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n"); + usb_put_dev(priv->usbdev); ++ priv->usbdev = NULL; + kfree(priv); + } + +@@ -736,7 +737,6 @@ static int uss720_probe(struct usb_inter + parport_announce_port(pp); + + usb_set_intfdata(intf, pp); +- usb_put_dev(usbdev); + return 0; + + probe_abort: +@@ -754,7 +754,6 @@ static void uss720_disconnect(struct usb + usb_set_intfdata(intf, NULL); + if (pp) { + priv = pp->private_data; +- priv->usbdev = NULL; + priv->pp = NULL; + dev_dbg(&intf->dev, "parport_remove_port\n"); + parport_remove_port(pp); diff --git a/queue-5.4/usb-phy-generic-get-the-vbus-supply.patch b/queue-5.4/usb-phy-generic-get-the-vbus-supply.patch new file mode 100644 index 00000000000..e9cbc0576ba --- /dev/null +++ b/queue-5.4/usb-phy-generic-get-the-vbus-supply.patch @@ -0,0 +1,38 @@ +From 03e607cbb2931374db1825f371e9c7f28526d3f4 Mon Sep 17 00:00:00 2001 +From: Sean Anderson +Date: Mon, 25 Apr 2022 13:14:09 -0400 +Subject: usb: phy: generic: Get the vbus supply + +From: Sean Anderson + +commit 03e607cbb2931374db1825f371e9c7f28526d3f4 upstream. + +While support for working with a vbus was added, the regulator was never +actually gotten (despite what was documented). Fix this by actually +getting the supply from the device tree. + +Fixes: 7acc9973e3c4 ("usb: phy: generic: add vbus support") +Cc: stable +Signed-off-by: Sean Anderson +Link: https://lore.kernel.org/r/20220425171412.1188485-3-sean.anderson@seco.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/phy/phy-generic.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/phy/phy-generic.c ++++ b/drivers/usb/phy/phy-generic.c +@@ -283,6 +283,13 @@ int usb_phy_gen_create_phy(struct device + return -EPROBE_DEFER; + } + ++ nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus"); ++ if (PTR_ERR(nop->vbus_draw) == -ENODEV) ++ nop->vbus_draw = NULL; ++ if (IS_ERR(nop->vbus_draw)) ++ return dev_err_probe(dev, PTR_ERR(nop->vbus_draw), ++ "could not get vbus regulator\n"); ++ + nop->dev = dev; + nop->phy.dev = nop->dev; + nop->phy.label = "nop-xceiv"; diff --git a/queue-5.4/usb-typec-ucsi-fix-role-swapping.patch b/queue-5.4/usb-typec-ucsi-fix-role-swapping.patch new file mode 100644 index 00000000000..56fe119400e --- /dev/null +++ b/queue-5.4/usb-typec-ucsi-fix-role-swapping.patch @@ -0,0 +1,67 @@ +From eb5d7ff3cf0d55093c619b5ad107cd5c05ce8134 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Tue, 5 Apr 2022 16:48:24 +0300 +Subject: usb: typec: ucsi: Fix role swapping + +From: Heikki Krogerus + +commit eb5d7ff3cf0d55093c619b5ad107cd5c05ce8134 upstream. + +All attempts to swap the roles timed out because the +completion was done without releasing the port lock. Fixing +that by releasing the lock before starting to wait for the +completion. + +Link: https://lore.kernel.org/linux-usb/037de7ac-e210-bdf5-ec7a-8c0c88a0be20@gmail.com/ +Fixes: ad74b8649bea ("usb: typec: ucsi: Preliminary support for alternate modes") +Cc: stable@vger.kernel.org +Reported-and-tested-by: Jia-Ju Bai +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20220405134824.68067-3-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -748,14 +748,18 @@ ucsi_dr_swap(const struct typec_capabili + if (ret < 0) + goto out_unlock; + ++ mutex_unlock(&con->lock); ++ + if (!wait_for_completion_timeout(&con->complete, +- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) +- ret = -ETIMEDOUT; ++ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) ++ return -ETIMEDOUT; ++ ++ return 0; + + out_unlock: + mutex_unlock(&con->lock); + +- return ret < 0 ? ret : 0; ++ return ret; + } + + static int +@@ -780,11 +784,13 @@ ucsi_pr_swap(const struct typec_capabili + if (ret < 0) + goto out_unlock; + ++ mutex_unlock(&con->lock); ++ + if (!wait_for_completion_timeout(&con->complete, +- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) { +- ret = -ETIMEDOUT; +- goto out_unlock; +- } ++ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) ++ return -ETIMEDOUT; ++ ++ mutex_lock(&con->lock); + + /* Something has gone wrong while swapping the role */ + if (con->status.pwr_op_mode != UCSI_CONSTAT_PWR_OPMODE_PD) {