From: Greg Kroah-Hartman Date: Tue, 6 Sep 2022 11:32:20 +0000 (+0200) Subject: 5.19-stable patches X-Git-Tag: v5.10.142~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fc96538fc340728e19e44627cfea483a9bee6729;p=thirdparty%2Fkernel%2Fstable-queue.git 5.19-stable patches added patches: revert-usb-typec-ucsi-add-a-common-function-ucsi_unregister_connectors.patch s390-fix-nospec-table-alignments.patch s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch usb-cdns3-fix-incorrect-handling-trb_smm-flag-for-isoc-transfer.patch usb-cdns3-fix-issue-with-rearming-iso-out-endpoint.patch usb-core-prevent-nested-device-reset-calls.patch usb-dwc2-fix-wrong-order-of-phy_power_on-and-phy_init.patch usb-gadget-f_uac2-fix-superspeed-transfer.patch usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch usb-serial-ch341-fix-disabled-rx-timer-on-older-devices.patch usb-serial-ch341-fix-lost-character-on-lcr-updates.patch usb-serial-cp210x-add-decagon-uca-device-id.patch usb-serial-option-add-quectel-em060k-modem.patch usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch usb-serial-option-add-support-for-oppo-r11-diag-port.patch usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch usb-typec-altmodes-displayport-correct-pin-assignment-for-ufp-receptacles.patch usb-typec-intel_pmc_mux-add-new-acpi-id-for-meteor-lake-iom-device.patch usb-typec-tcpm-return-enotsupp-for-power-supply-prop-writes.patch usb-xhci-mtk-fix-bandwidth-release-issue.patch usb-xhci-mtk-relax-tt-periodic-bandwidth-allocation.patch --- diff --git a/queue-5.19/revert-usb-typec-ucsi-add-a-common-function-ucsi_unregister_connectors.patch b/queue-5.19/revert-usb-typec-ucsi-add-a-common-function-ucsi_unregister_connectors.patch new file mode 100644 index 00000000000..10879a878bb --- /dev/null +++ b/queue-5.19/revert-usb-typec-ucsi-add-a-common-function-ucsi_unregister_connectors.patch @@ -0,0 +1,128 @@ +From 5f73aa2cf8bef4a39baa1591c3144ede4788826e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 23 Aug 2022 08:54:55 +0200 +Subject: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" + +From: Takashi Iwai + +commit 5f73aa2cf8bef4a39baa1591c3144ede4788826e upstream. + +The recent commit 87d0e2f41b8c ("usb: typec: ucsi: add a common +function ucsi_unregister_connectors()") introduced a regression that +caused NULL dereference at reading the power supply sysfs. It's a +stale sysfs entry that should have been removed but remains with NULL +ops. The commit changed the error handling to skip the entries after +a NULL con->wq, and this leaves the power device unreleased. + +For addressing the regression, the straight revert is applied here. +Further code improvements can be done from the scratch again. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1202386 +Link: https://lore.kernel.org/r/87r11cmbx0.wl-tiwai@suse.de +Fixes: 87d0e2f41b8c ("usb: typec: ucsi: add a common function ucsi_unregister_connectors()") +Cc: +Acked-by: Heikki Krogerus +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20220823065455.32579-1-tiwai@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 53 +++++++++++++++++++----------------------- + 1 file changed, 24 insertions(+), 29 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1200,32 +1200,6 @@ out_unlock: + return ret; + } + +-static void ucsi_unregister_connectors(struct ucsi *ucsi) +-{ +- struct ucsi_connector *con; +- int i; +- +- if (!ucsi->connector) +- return; +- +- for (i = 0; i < ucsi->cap.num_connectors; i++) { +- con = &ucsi->connector[i]; +- +- if (!con->wq) +- break; +- +- cancel_work_sync(&con->work); +- ucsi_unregister_partner(con); +- ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); +- ucsi_unregister_port_psy(con); +- destroy_workqueue(con->wq); +- typec_unregister_port(con->port); +- } +- +- kfree(ucsi->connector); +- ucsi->connector = NULL; +-} +- + /** + * ucsi_init - Initialize UCSI interface + * @ucsi: UCSI to be initialized +@@ -1234,6 +1208,7 @@ static void ucsi_unregister_connectors(s + */ + static int ucsi_init(struct ucsi *ucsi) + { ++ struct ucsi_connector *con; + u64 command; + int ret; + int i; +@@ -1264,7 +1239,7 @@ static int ucsi_init(struct ucsi *ucsi) + } + + /* Allocate the connectors. Released in ucsi_unregister() */ +- ucsi->connector = kcalloc(ucsi->cap.num_connectors, ++ ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1, + sizeof(*ucsi->connector), GFP_KERNEL); + if (!ucsi->connector) { + ret = -ENOMEM; +@@ -1288,7 +1263,15 @@ static int ucsi_init(struct ucsi *ucsi) + return 0; + + err_unregister: +- ucsi_unregister_connectors(ucsi); ++ for (con = ucsi->connector; con->port; con++) { ++ ucsi_unregister_partner(con); ++ ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); ++ ucsi_unregister_port_psy(con); ++ if (con->wq) ++ destroy_workqueue(con->wq); ++ typec_unregister_port(con->port); ++ con->port = NULL; ++ } + + err_reset: + memset(&ucsi->cap, 0, sizeof(ucsi->cap)); +@@ -1402,6 +1385,7 @@ EXPORT_SYMBOL_GPL(ucsi_register); + void ucsi_unregister(struct ucsi *ucsi) + { + u64 cmd = UCSI_SET_NOTIFICATION_ENABLE; ++ int i; + + /* Make sure that we are not in the middle of driver initialization */ + cancel_delayed_work_sync(&ucsi->work); +@@ -1409,7 +1393,18 @@ void ucsi_unregister(struct ucsi *ucsi) + /* Disable notifications */ + ucsi->ops->async_write(ucsi, UCSI_CONTROL, &cmd, sizeof(cmd)); + +- ucsi_unregister_connectors(ucsi); ++ for (i = 0; i < ucsi->cap.num_connectors; i++) { ++ cancel_work_sync(&ucsi->connector[i].work); ++ ucsi_unregister_partner(&ucsi->connector[i]); ++ ucsi_unregister_altmodes(&ucsi->connector[i], ++ UCSI_RECIPIENT_CON); ++ ucsi_unregister_port_psy(&ucsi->connector[i]); ++ if (ucsi->connector[i].wq) ++ destroy_workqueue(ucsi->connector[i].wq); ++ typec_unregister_port(ucsi->connector[i].port); ++ } ++ ++ kfree(ucsi->connector); + } + EXPORT_SYMBOL_GPL(ucsi_unregister); + diff --git a/queue-5.19/s390-fix-nospec-table-alignments.patch b/queue-5.19/s390-fix-nospec-table-alignments.patch new file mode 100644 index 00000000000..f76a39b67a5 --- /dev/null +++ b/queue-5.19/s390-fix-nospec-table-alignments.patch @@ -0,0 +1,53 @@ +From c9305b6c1f52060377c72aebe3a701389e9f3172 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Fri, 26 Aug 2022 16:55:44 -0700 +Subject: s390: fix nospec table alignments + +From: Josh Poimboeuf + +commit c9305b6c1f52060377c72aebe3a701389e9f3172 upstream. + +Add proper alignment for .nospec_call_table and .nospec_return_table in +vmlinux. + +[hca@linux.ibm.com]: The problem with the missing alignment of the nospec +tables exist since a long time, however only since commit e6ed91fd0768 +("s390/alternatives: remove padding generation code") and with +CONFIG_RELOCATABLE=n the kernel may also crash at boot time. + +The above named commit reduced the size of struct alt_instr by one byte, +so its new size is 11 bytes. Therefore depending on the number of cpu +alternatives the size of the __alt_instructions array maybe odd, which +again also causes that the addresses of the nospec tables will be odd. + +If the address of __nospec_call_start is odd and the kernel is compiled +With CONFIG_RELOCATABLE=n the compiler may generate code that loads the +address of __nospec_call_start with a 'larl' instruction. + +This will generate incorrect code since the 'larl' instruction only works +with even addresses. In result the members of the nospec tables will be +accessed with an off-by-one offset, which subsequently may lead to +addressing exceptions within __nospec_revert(). + +Fixes: f19fbd5ed642 ("s390: introduce execute-trampolines for branches") +Signed-off-by: Josh Poimboeuf +Link: https://lore.kernel.org/r/8719bf1ce4a72ebdeb575200290094e9ce047bcc.1661557333.git.jpoimboe@kernel.org +Cc: # 4.16 +Reviewed-by: Heiko Carstens +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/vmlinux.lds.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -131,6 +131,7 @@ SECTIONS + /* + * Table with the patch locations to undo expolines + */ ++ . = ALIGN(4); + .nospec_call_table : { + __nospec_call_start = . ; + *(.s390_indirect*) diff --git a/queue-5.19/s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch b/queue-5.19/s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch new file mode 100644 index 00000000000..cdc8ac60b96 --- /dev/null +++ b/queue-5.19/s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch @@ -0,0 +1,45 @@ +From 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Fri, 19 Aug 2022 18:53:43 +0200 +Subject: s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages + +From: Gerald Schaefer + +commit 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c upstream. + +The alignment check in prepare_hugepage_range() is wrong for 2 GB +hugepages, it only checks for 1 MB hugepage alignment. + +This can result in kernel crash in __unmap_hugepage_range() at the +BUG_ON(start & ~huge_page_mask(h)) alignment check, for mappings +created with MAP_FIXED at unaligned address. + +Fix this by correctly handling multiple hugepage sizes, similar to the +generic version of prepare_hugepage_range(). + +Fixes: d08de8e2d867 ("s390/mm: add support for 2GB hugepages") +Cc: # 4.8+ +Acked-by: Alexander Gordeev +Signed-off-by: Gerald Schaefer +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/hugetlb.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/s390/include/asm/hugetlb.h ++++ b/arch/s390/include/asm/hugetlb.h +@@ -28,9 +28,11 @@ pte_t huge_ptep_get_and_clear(struct mm_ + static inline int prepare_hugepage_range(struct file *file, + unsigned long addr, unsigned long len) + { +- if (len & ~HPAGE_MASK) ++ struct hstate *h = hstate_file(file); ++ ++ if (len & ~huge_page_mask(h)) + return -EINVAL; +- if (addr & ~HPAGE_MASK) ++ if (addr & ~huge_page_mask(h)) + return -EINVAL; + return 0; + } diff --git a/queue-5.19/series b/queue-5.19/series index 1103bec953a..d4a3bf276aa 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -110,3 +110,25 @@ xhci-add-grace-period-after-xhc-start-to-prevent-premature-runtime-suspend.patch usb-dwc3-disable-usb-core-phy-management.patch usb-dwc3-gadget-avoid-duplicate-requests-to-enable-run-stop.patch usb-dwc3-fix-phy-disable-sequence.patch +usb-serial-ch341-fix-lost-character-on-lcr-updates.patch +usb-serial-ch341-fix-disabled-rx-timer-on-older-devices.patch +usb-serial-cp210x-add-decagon-uca-device-id.patch +usb-serial-option-add-support-for-oppo-r11-diag-port.patch +usb-serial-option-add-quectel-em060k-modem.patch +usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch +revert-usb-typec-ucsi-add-a-common-function-ucsi_unregister_connectors.patch +usb-typec-altmodes-displayport-correct-pin-assignment-for-ufp-receptacles.patch +usb-typec-intel_pmc_mux-add-new-acpi-id-for-meteor-lake-iom-device.patch +usb-typec-tcpm-return-enotsupp-for-power-supply-prop-writes.patch +usb-dwc2-fix-wrong-order-of-phy_power_on-and-phy_init.patch +usb-cdns3-fix-issue-with-rearming-iso-out-endpoint.patch +usb-cdns3-fix-incorrect-handling-trb_smm-flag-for-isoc-transfer.patch +usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch +usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch +s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch +s390-fix-nospec-table-alignments.patch +usb-core-prevent-nested-device-reset-calls.patch +usb-xhci-mtk-relax-tt-periodic-bandwidth-allocation.patch +usb-xhci-mtk-fix-bandwidth-release-issue.patch +usb-gadget-f_uac2-fix-superspeed-transfer.patch +usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch diff --git a/queue-5.19/usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch b/queue-5.19/usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch new file mode 100644 index 00000000000..a42127393ba --- /dev/null +++ b/queue-5.19/usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch @@ -0,0 +1,113 @@ +From a10bc71729b236fe36de0d8e4d35c959fd8dec3a Mon Sep 17 00:00:00 2001 +From: Thierry GUIBERT +Date: Fri, 19 Aug 2022 10:17:02 +0200 +Subject: USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) + +From: Thierry GUIBERT + +commit a10bc71729b236fe36de0d8e4d35c959fd8dec3a upstream. + +Supports for ICOM F3400 and ICOM F4400 PMR radios in CDC-ACM driver +enabling the AT serial port. +The Vendor Id is 0x0C26 +The Product ID is 0x0020 + +Output of lsusb : +Bus 001 Device 009: ID 0c26:0020 Prolific Technology Inc. ICOM Radio +Couldn't open device, some information will be missing +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 2 Communications + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 64 + idVendor 0x0c26 Prolific Technology Inc. + idProduct 0x0020 + bcdDevice 0.00 + iManufacturer 1 ICOM Inc. + iProduct 2 ICOM Radio + iSerial 3 *obfuscated* + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x0030 + bNumInterfaces 2 + bConfigurationValue 1 + iConfiguration 0 + bmAttributes 0xc0 + Self Powered + MaxPower 0mA + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 12 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + +Signed-off-by: Thierry GUIBERT +Cc: stable +Link: https://lore.kernel.org/r/20220819081702.84118-1-thierry.guibert@croix-rouge.fr +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1810,6 +1810,9 @@ static const struct usb_device_id acm_id + { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ + .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */ + }, ++ { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */ ++ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ ++ }, + { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ + .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ + }, diff --git a/queue-5.19/usb-cdns3-fix-incorrect-handling-trb_smm-flag-for-isoc-transfer.patch b/queue-5.19/usb-cdns3-fix-incorrect-handling-trb_smm-flag-for-isoc-transfer.patch new file mode 100644 index 00000000000..f2c9f736e0d --- /dev/null +++ b/queue-5.19/usb-cdns3-fix-incorrect-handling-trb_smm-flag-for-isoc-transfer.patch @@ -0,0 +1,44 @@ +From d5dcc33677d7415c5f23b3c052f9e80cbab9ea4e Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Thu, 25 Aug 2022 08:22:07 +0200 +Subject: usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pawel Laszczak + +commit d5dcc33677d7415c5f23b3c052f9e80cbab9ea4e upstream. + +The TRB_SMM flag indicates that DMA has completed the TD service with +this TRB. Usually it’s a last TRB in TD. In case of ISOC transfer for +bInterval > 1 each ISOC transfer contains more than one TD associated +with usb request (one TD per ITP). In such case the TRB_SMM flag will +be set in every TD and driver will recognize the end of transfer after +processing the first TD with TRB_SMM. In result driver stops updating +request->actual and returns incorrect actual length. +To fix this issue driver additionally must check TRB_CHAIN which is not +used for isochronous transfers. + +Fixes: 249f0a25e8be ("usb: cdns3: gadget: handle sg list use case at completion correctly") +cc: +Acked-by: Peter Chen +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20220825062207.5824-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -1530,7 +1530,8 @@ static void cdns3_transfer_completed(str + TRB_LEN(le32_to_cpu(trb->length)); + + if (priv_req->num_of_trb > 1 && +- le32_to_cpu(trb->control) & TRB_SMM) ++ le32_to_cpu(trb->control) & TRB_SMM && ++ le32_to_cpu(trb->control) & TRB_CHAIN) + transfer_end = true; + + cdns3_ep_inc_deq(priv_ep); diff --git a/queue-5.19/usb-cdns3-fix-issue-with-rearming-iso-out-endpoint.patch b/queue-5.19/usb-cdns3-fix-issue-with-rearming-iso-out-endpoint.patch new file mode 100644 index 00000000000..bf44dd77bdb --- /dev/null +++ b/queue-5.19/usb-cdns3-fix-issue-with-rearming-iso-out-endpoint.patch @@ -0,0 +1,36 @@ +From b46a6b09fa056042a302b181a1941f0056944603 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Thu, 25 Aug 2022 08:21:37 +0200 +Subject: usb: cdns3: fix issue with rearming ISO OUT endpoint + +From: Pawel Laszczak + +commit b46a6b09fa056042a302b181a1941f0056944603 upstream. + +ISO OUT endpoint is enabled during queuing first usb request +in transfer ring and disabled when TRBERR is reported by controller. +After TRBERR and before next transfer added to TR driver must again +reenable endpoint but does not. +To solve this issue during processing TRBERR event driver must +set the flag EP_UPDATE_EP_TRBADDR in priv_ep->flags field. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +cc: +Acked-by: Peter Chen +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20220825062137.5766-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -1690,6 +1690,7 @@ static int cdns3_check_ep_interrupt_proc + ep_cfg &= ~EP_CFG_ENABLE; + writel(ep_cfg, &priv_dev->regs->ep_cfg); + priv_ep->flags &= ~EP_QUIRK_ISO_OUT_EN; ++ priv_ep->flags |= EP_UPDATE_EP_TRBADDR; + } + cdns3_transfer_completed(priv_dev, priv_ep); + } else if (!(priv_ep->flags & EP_STALLED) && diff --git a/queue-5.19/usb-core-prevent-nested-device-reset-calls.patch b/queue-5.19/usb-core-prevent-nested-device-reset-calls.patch new file mode 100644 index 00000000000..140dc040d9d --- /dev/null +++ b/queue-5.19/usb-core-prevent-nested-device-reset-calls.patch @@ -0,0 +1,130 @@ +From 9c6d778800b921bde3bff3cff5003d1650f942d1 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 26 Aug 2022 15:31:32 -0400 +Subject: USB: core: Prevent nested device-reset calls + +From: Alan Stern + +commit 9c6d778800b921bde3bff3cff5003d1650f942d1 upstream. + +Automatic kernel fuzzing revealed a recursive locking violation in +usb-storage: + +============================================ +WARNING: possible recursive locking detected +5.18.0 #3 Not tainted +-------------------------------------------- +kworker/1:3/1205 is trying to acquire lock: +ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: +usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 + +but task is already holding lock: +ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: +usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 + +... + +stack backtrace: +CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +1.13.0-1ubuntu1.1 04/01/2014 +Workqueue: usb_hub_wq hub_event +Call Trace: + +__dump_stack lib/dump_stack.c:88 [inline] +dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 +print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] +check_deadlock kernel/locking/lockdep.c:3031 [inline] +validate_chain kernel/locking/lockdep.c:3816 [inline] +__lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053 +lock_acquire kernel/locking/lockdep.c:5665 [inline] +lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630 +__mutex_lock_common kernel/locking/mutex.c:603 [inline] +__mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747 +usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 +usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109 +r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622 +usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458 +device_remove drivers/base/dd.c:545 [inline] +device_remove+0x11f/0x170 drivers/base/dd.c:537 +__device_release_driver drivers/base/dd.c:1222 [inline] +device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248 +usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627 +usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118 +usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114 + +This turned out not to be an error in usb-storage but rather a nested +device reset attempt. That is, as the rtl8712 driver was being +unbound from a composite device in preparation for an unrelated USB +reset (that driver does not have pre_reset or post_reset callbacks), +its ->remove routine called usb_reset_device() -- thus nesting one +reset call within another. + +Performing a reset as part of disconnect processing is a questionable +practice at best. However, the bug report points out that the USB +core does not have any protection against nested resets. Adding a +reset_in_progress flag and testing it will prevent such errors in the +future. + +Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6keN==voRbP0g@mail.gmail.com/ +Cc: stable@vger.kernel.org +Reported-and-tested-by: Rondreis +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 10 ++++++++++ + include/linux/usb.h | 2 ++ + 2 files changed, 12 insertions(+) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -6048,6 +6048,11 @@ re_enumerate: + * the reset is over (using their post_reset method). + * + * Return: The same as for usb_reset_and_verify_device(). ++ * However, if a reset is already in progress (for instance, if a ++ * driver doesn't have pre_ or post_reset() callbacks, and while ++ * being unbound or re-bound during the ongoing reset its disconnect() ++ * or probe() routine tries to perform a second, nested reset), the ++ * routine returns -EINPROGRESS. + * + * Note: + * The caller must own the device lock. For example, it's safe to use +@@ -6081,6 +6086,10 @@ int usb_reset_device(struct usb_device * + return -EISDIR; + } + ++ if (udev->reset_in_progress) ++ return -EINPROGRESS; ++ udev->reset_in_progress = 1; ++ + port_dev = hub->ports[udev->portnum - 1]; + + /* +@@ -6145,6 +6154,7 @@ int usb_reset_device(struct usb_device * + + usb_autosuspend_device(udev); + memalloc_noio_restore(noio_flag); ++ udev->reset_in_progress = 0; + return ret; + } + EXPORT_SYMBOL_GPL(usb_reset_device); +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -575,6 +575,7 @@ struct usb3_lpm_parameters { + * @devaddr: device address, XHCI: assigned by HW, others: same as devnum + * @can_submit: URBs may be submitted + * @persist_enabled: USB_PERSIST enabled for this device ++ * @reset_in_progress: the device is being reset + * @have_langid: whether string_langid is valid + * @authorized: policy has said we can use it; + * (user space) policy determines if we authorize this device to be +@@ -661,6 +662,7 @@ struct usb_device { + + unsigned can_submit:1; + unsigned persist_enabled:1; ++ unsigned reset_in_progress:1; + unsigned have_langid:1; + unsigned authorized:1; + unsigned authenticated:1; diff --git a/queue-5.19/usb-dwc2-fix-wrong-order-of-phy_power_on-and-phy_init.patch b/queue-5.19/usb-dwc2-fix-wrong-order-of-phy_power_on-and-phy_init.patch new file mode 100644 index 00000000000..b4ac259c5f8 --- /dev/null +++ b/queue-5.19/usb-dwc2-fix-wrong-order-of-phy_power_on-and-phy_init.patch @@ -0,0 +1,52 @@ +From f9b995b49a07bd0d43b0e490f59be84415c745ae Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Tue, 23 Aug 2022 19:58:42 +0200 +Subject: usb: dwc2: fix wrong order of phy_power_on and phy_init + +From: Heiner Kallweit + +commit f9b995b49a07bd0d43b0e490f59be84415c745ae upstream. + +Since 1599069a62c6 ("phy: core: Warn when phy_power_on is called before +phy_init") the driver complains. In my case (Amlogic SoC) the warning +is: phy phy-fe03e000.phy.2: phy_power_on was called before phy_init +So change the order of the two calls. The same change has to be done +to the order of phy_exit() and phy_power_off(). + +Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c") +Cc: stable@vger.kernel.org +Acked-by: Minas Harutyunyan +Acked-by: Marek Szyprowski +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/dfcc6b40-2274-4e86-e73c-5c5e6aa3e046@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/platform.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -154,9 +154,9 @@ static int __dwc2_lowlevel_hw_enable(str + } else if (hsotg->plat && hsotg->plat->phy_init) { + ret = hsotg->plat->phy_init(pdev, hsotg->plat->phy_type); + } else { +- ret = phy_power_on(hsotg->phy); ++ ret = phy_init(hsotg->phy); + if (ret == 0) +- ret = phy_init(hsotg->phy); ++ ret = phy_power_on(hsotg->phy); + } + + return ret; +@@ -188,9 +188,9 @@ static int __dwc2_lowlevel_hw_disable(st + } else if (hsotg->plat && hsotg->plat->phy_exit) { + ret = hsotg->plat->phy_exit(pdev, hsotg->plat->phy_type); + } else { +- ret = phy_exit(hsotg->phy); ++ ret = phy_power_off(hsotg->phy); + if (ret == 0) +- ret = phy_power_off(hsotg->phy); ++ ret = phy_exit(hsotg->phy); + } + if (ret) + return ret; diff --git a/queue-5.19/usb-gadget-f_uac2-fix-superspeed-transfer.patch b/queue-5.19/usb-gadget-f_uac2-fix-superspeed-transfer.patch new file mode 100644 index 00000000000..879e7368133 --- /dev/null +++ b/queue-5.19/usb-gadget-f_uac2-fix-superspeed-transfer.patch @@ -0,0 +1,90 @@ +From f511aef2ebe5377d4c263842f2e0c0b8e274e8e5 Mon Sep 17 00:00:00 2001 +From: Jing Leng +Date: Wed, 20 Jul 2022 18:48:15 -0700 +Subject: usb: gadget: f_uac2: fix superspeed transfer + +From: Jing Leng + +commit f511aef2ebe5377d4c263842f2e0c0b8e274e8e5 upstream. + +On page 362 of the USB3.2 specification ( +https://usb.org/sites/default/files/usb_32_20210125.zip), +The 'SuperSpeed Endpoint Companion Descriptor' shall only be returned +by Enhanced SuperSpeed devices that are operating at Gen X speed. +Each endpoint described in an interface is followed by a 'SuperSpeed +Endpoint Companion Descriptor'. + +If users use SuperSpeed UDC, host can't recognize the device if endpoint +doesn't have 'SuperSpeed Endpoint Companion Descriptor' followed. + +Currently in the uac2 driver code: +1. ss_epout_desc_comp follows ss_epout_desc; +2. ss_epin_fback_desc_comp follows ss_epin_fback_desc; +3. ss_epin_desc_comp follows ss_epin_desc; +4. Only ss_ep_int_desc endpoint doesn't have 'SuperSpeed Endpoint +Companion Descriptor' followed, so we should add it. + +Fixes: eaf6cbe09920 ("usb: gadget: f_uac2: add volume and mute support") +Cc: stable +Signed-off-by: Jing Leng +Signed-off-by: Jack Pham +Link: https://lore.kernel.org/r/20220721014815.14453-1-quic_jackp@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_uac2.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -291,6 +291,12 @@ static struct usb_endpoint_descriptor ss + .bInterval = 4, + }; + ++static struct usb_ss_ep_comp_descriptor ss_ep_int_desc_comp = { ++ .bLength = sizeof(ss_ep_int_desc_comp), ++ .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, ++ .wBytesPerInterval = cpu_to_le16(6), ++}; ++ + /* Audio Streaming OUT Interface - Alt0 */ + static struct usb_interface_descriptor std_as_out_if0_desc = { + .bLength = sizeof std_as_out_if0_desc, +@@ -604,7 +610,8 @@ static struct usb_descriptor_header *ss_ + (struct usb_descriptor_header *)&in_feature_unit_desc, + (struct usb_descriptor_header *)&io_out_ot_desc, + +- (struct usb_descriptor_header *)&ss_ep_int_desc, ++ (struct usb_descriptor_header *)&ss_ep_int_desc, ++ (struct usb_descriptor_header *)&ss_ep_int_desc_comp, + + (struct usb_descriptor_header *)&std_as_out_if0_desc, + (struct usb_descriptor_header *)&std_as_out_if1_desc, +@@ -800,6 +807,7 @@ static void setup_headers(struct f_uac2_ + struct usb_ss_ep_comp_descriptor *epout_desc_comp = NULL; + struct usb_ss_ep_comp_descriptor *epin_desc_comp = NULL; + struct usb_ss_ep_comp_descriptor *epin_fback_desc_comp = NULL; ++ struct usb_ss_ep_comp_descriptor *ep_int_desc_comp = NULL; + struct usb_endpoint_descriptor *epout_desc; + struct usb_endpoint_descriptor *epin_desc; + struct usb_endpoint_descriptor *epin_fback_desc; +@@ -827,6 +835,7 @@ static void setup_headers(struct f_uac2_ + epin_fback_desc = &ss_epin_fback_desc; + epin_fback_desc_comp = &ss_epin_fback_desc_comp; + ep_int_desc = &ss_ep_int_desc; ++ ep_int_desc_comp = &ss_ep_int_desc_comp; + } + + i = 0; +@@ -855,8 +864,11 @@ static void setup_headers(struct f_uac2_ + if (EPOUT_EN(opts)) + headers[i++] = USBDHDR(&io_out_ot_desc); + +- if (FUOUT_EN(opts) || FUIN_EN(opts)) ++ if (FUOUT_EN(opts) || FUIN_EN(opts)) { + headers[i++] = USBDHDR(ep_int_desc); ++ if (ep_int_desc_comp) ++ headers[i++] = USBDHDR(ep_int_desc_comp); ++ } + + if (EPOUT_EN(opts)) { + headers[i++] = USBDHDR(&std_as_out_if0_desc); diff --git a/queue-5.19/usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch b/queue-5.19/usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch new file mode 100644 index 00000000000..61f37f98eda --- /dev/null +++ b/queue-5.19/usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch @@ -0,0 +1,48 @@ +From 9d4dc16ec71bd6368548e9743223e449b4377fc7 Mon Sep 17 00:00:00 2001 +From: Krishna Kurapati +Date: Sat, 27 Aug 2022 08:45:10 +0530 +Subject: usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS + +From: Krishna Kurapati + +commit 9d4dc16ec71bd6368548e9743223e449b4377fc7 upstream. + +During cdrom emulation, the response to read_toc command must contain +the cdrom address as the number of sectors (2048 byte sized blocks) +represented either as an absolute value (when MSF bit is '0') or in +terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of +cdrom, the fsg_lun_open call sets the sector size to 2048 bytes. + +When MAC OS sends a read_toc request with MSF set to '1', the +store_cdrom_address assumes that the address being provided is the +LUN size represented in 512 byte sized blocks instead of 2048. It +tries to modify the address further to convert it to 2048 byte sized +blocks and store it in MSF format. This results in data transfer +failures as the cdrom address being provided in the read_toc response +is incorrect. + +Fixes: 3f565a363cee ("usb: gadget: storage: adapt logic block size to bound block devices") +Cc: stable@vger.kernel.org +Acked-by: Alan Stern +Signed-off-by: Krishna Kurapati +Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kriskura@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/storage_common.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/storage_common.c ++++ b/drivers/usb/gadget/function/storage_common.c +@@ -294,8 +294,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub); + void store_cdrom_address(u8 *dest, int msf, u32 addr) + { + if (msf) { +- /* Convert to Minutes-Seconds-Frames */ +- addr >>= 2; /* Convert to 2048-byte frames */ ++ /* ++ * Convert to Minutes-Seconds-Frames. ++ * Sector size is already set to 2048 bytes. ++ */ + addr += 2*75; /* Lead-in occupies 2 seconds */ + dest[3] = addr % 75; /* Frames */ + addr /= 75; diff --git a/queue-5.19/usb-serial-ch341-fix-disabled-rx-timer-on-older-devices.patch b/queue-5.19/usb-serial-ch341-fix-disabled-rx-timer-on-older-devices.patch new file mode 100644 index 00000000000..9060ef5f860 --- /dev/null +++ b/queue-5.19/usb-serial-ch341-fix-disabled-rx-timer-on-older-devices.patch @@ -0,0 +1,43 @@ +From 41ca302a697b64a3dab4676e01d0d11bb184737d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 31 Aug 2022 10:15:25 +0200 +Subject: USB: serial: ch341: fix disabled rx timer on older devices + +From: Johan Hovold + +commit 41ca302a697b64a3dab4676e01d0d11bb184737d upstream. + +At least one older CH341 appears to have the RX timer enable bit +inverted so that setting it disables the RX timer and prevents the FIFO +from emptying until it is full. + +Only set the RX timer enable bit for devices with version newer than +0x27 (even though this probably affects all pre-0x30 devices). + +Reported-by: Jonathan Woithe +Tested-by: Jonathan Woithe +Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au +Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfiguration") +Cc: stable@vger.kernel.org # 4.10 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ch341.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -253,8 +253,12 @@ static int ch341_set_baudrate_lcr(struct + /* + * CH341A buffers data until a full endpoint-size packet (32 bytes) + * has been received unless bit 7 is set. ++ * ++ * At least one device with version 0x27 appears to have this bit ++ * inverted. + */ +- val |= BIT(7); ++ if (priv->version > 0x27) ++ val |= BIT(7); + + r = ch341_control_out(dev, CH341_REQ_WRITE_REG, + CH341_REG_DIVISOR << 8 | CH341_REG_PRESCALER, diff --git a/queue-5.19/usb-serial-ch341-fix-lost-character-on-lcr-updates.patch b/queue-5.19/usb-serial-ch341-fix-lost-character-on-lcr-updates.patch new file mode 100644 index 00000000000..d2ca459f31a --- /dev/null +++ b/queue-5.19/usb-serial-ch341-fix-lost-character-on-lcr-updates.patch @@ -0,0 +1,62 @@ +From 8e83622ae7ca481c76c8fd9579877f6abae64ca2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 31 Aug 2022 10:15:24 +0200 +Subject: USB: serial: ch341: fix lost character on LCR updates + +From: Johan Hovold + +commit 8e83622ae7ca481c76c8fd9579877f6abae64ca2 upstream. + +Disable LCR updates for pre-0x30 devices which use a different (unknown) +protocol for line control and where the current register write causes +the next received character to be lost. + +Note that updating LCR using the INIT command has no effect on these +devices either. + +Reported-by: Jonathan Woithe +Tested-by: Jonathan Woithe +Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au +Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfiguration") +Fixes: 55fa15b5987d ("USB: serial: ch341: fix baud rate and line-control handling") +Cc: stable@vger.kernel.org # 4.10 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ch341.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -97,7 +97,10 @@ struct ch341_private { + u8 mcr; + u8 msr; + u8 lcr; ++ + unsigned long quirks; ++ u8 version; ++ + unsigned long break_end; + }; + +@@ -265,6 +268,9 @@ static int ch341_set_baudrate_lcr(struct + * (stop bits, parity and word length). Version 0x30 and above use + * CH341_REG_LCR only and CH341_REG_LCR2 is always set to zero. + */ ++ if (priv->version < 0x30) ++ return 0; ++ + r = ch341_control_out(dev, CH341_REQ_WRITE_REG, + CH341_REG_LCR2 << 8 | CH341_REG_LCR, lcr); + if (r) +@@ -308,7 +314,9 @@ static int ch341_configure(struct usb_de + r = ch341_control_in(dev, CH341_REQ_READ_VERSION, 0, 0, buffer, size); + if (r) + return r; +- dev_dbg(&dev->dev, "Chip version: 0x%02x\n", buffer[0]); ++ ++ priv->version = buffer[0]; ++ dev_dbg(&dev->dev, "Chip version: 0x%02x\n", priv->version); + + r = ch341_control_out(dev, CH341_REQ_SERIAL_INIT, 0, 0); + if (r < 0) diff --git a/queue-5.19/usb-serial-cp210x-add-decagon-uca-device-id.patch b/queue-5.19/usb-serial-cp210x-add-decagon-uca-device-id.patch new file mode 100644 index 00000000000..35bc065b61a --- /dev/null +++ b/queue-5.19/usb-serial-cp210x-add-decagon-uca-device-id.patch @@ -0,0 +1,29 @@ +From ceb4038472a4803e7046ed488b03d11551991514 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 29 Aug 2022 16:25:50 +0200 +Subject: USB: serial: cp210x: add Decagon UCA device id + +From: Johan Hovold + +commit ceb4038472a4803e7046ed488b03d11551991514 upstream. + +Add the device id for Decagon Devices USB Cable Adapter. + +Link: https://lore.kernel.org/r/trinity-819f9db2-d3e1-40e9-a669-9c245817c046-1661523546680@msvc-mesg-web108 +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -130,6 +130,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */ + { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */ + { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ ++ { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */ + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ + { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ diff --git a/queue-5.19/usb-serial-option-add-quectel-em060k-modem.patch b/queue-5.19/usb-serial-option-add-quectel-em060k-modem.patch new file mode 100644 index 00000000000..6d5daa4decc --- /dev/null +++ b/queue-5.19/usb-serial-option-add-quectel-em060k-modem.patch @@ -0,0 +1,74 @@ +From f766f3abe6dbc9bf8b56a5d53c87e5a17942c154 Mon Sep 17 00:00:00 2001 +From: Yonglin Tan +Date: Tue, 19 Jul 2022 19:28:00 +0800 +Subject: USB: serial: option: add Quectel EM060K modem + +From: Yonglin Tan + +commit f766f3abe6dbc9bf8b56a5d53c87e5a17942c154 upstream. + +Add usb product id entry for the Quectel EM060K module. + +"MBIM mode": DIAG + NMEA + AT + MODEM + MBIM + QDSS + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=030b Rev= 5.04 +S: Manufacturer=Quectel +S: Product=EM060K-GL +S: SerialNumber=89fb57db +C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 8 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 9 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 9 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#=12 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Yonglin Tan +[ johan: mention QDSS port and sort entries ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -253,6 +253,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM05G 0x030a ++#define QUECTEL_PRODUCT_EM060K 0x030b + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 +@@ -1142,6 +1143,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), + .driver_info = RSVD(6) | ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, diff --git a/queue-5.19/usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch b/queue-5.19/usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch new file mode 100644 index 00000000000..f9088a34a73 --- /dev/null +++ b/queue-5.19/usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch @@ -0,0 +1,70 @@ +From 8ffe20d08f2c95d702c453020d03a4c568a988f0 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Wed, 10 Aug 2022 11:30:50 +0800 +Subject: USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode + +From: Slark Xiao + +commit 8ffe20d08f2c95d702c453020d03a4c568a988f0 upstream. + +We added PIDs for MV32-WA/WB MBIM mode before, now we need to add +support for RmNet mode. + +Test evidence as below: +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f3 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F3 USB Mobile Broadband +S: SerialNumber=d7b4be8d +C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 10 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f4 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F4 USB Mobile Broadband +S: SerialNumber=d095087d +C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +Signed-off-by: Slark Xiao +[ johan: sort entries ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -439,6 +439,8 @@ static void option_instat_callback(struc + #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9 + #define CINTERION_PRODUCT_MV32_WA 0x00f1 + #define CINTERION_PRODUCT_MV32_WB 0x00f2 ++#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3 ++#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -2001,8 +2003,12 @@ static const struct usb_device_id option + .driver_info = RSVD(0)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff), + .driver_info = RSVD(3)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA_RMNET, 0xff), ++ .driver_info = RSVD(0) }, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff), + .driver_info = RSVD(3)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB_RMNET, 0xff), ++ .driver_info = RSVD(0) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), + .driver_info = RSVD(4) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), diff --git a/queue-5.19/usb-serial-option-add-support-for-oppo-r11-diag-port.patch b/queue-5.19/usb-serial-option-add-support-for-oppo-r11-diag-port.patch new file mode 100644 index 00000000000..4826d7d5bce --- /dev/null +++ b/queue-5.19/usb-serial-option-add-support-for-oppo-r11-diag-port.patch @@ -0,0 +1,54 @@ +From 8d5fc280392735e4441b35de14f2f4860fa8d83c Mon Sep 17 00:00:00 2001 +From: Yan Xinyu +Date: Thu, 14 Jul 2022 18:20:37 +0800 +Subject: USB: serial: option: add support for OPPO R11 diag port + +From: Yan Xinyu + +commit 8d5fc280392735e4441b35de14f2f4860fa8d83c upstream. + +Add support for OPPO R11 USB diag serial port to option driver. This +phone uses Qualcomm Snapdragon 660 SoC. + +usb-devices output: +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=22d9 ProdID=276c Rev=04.04 +S: Manufacturer=OPPO +S: Product=SDM660-MTP _SN:09C6BCA7 +S: SerialNumber=beb2c403 +C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs + +Signed-off-by: Yan Xinyu +Link: https://lore.kernel.org/r/20220714102037.4113889-1-sdlyyxy@bupt.edu.cn +Link: https://lore.kernel.org/r/Yt1WfSZk03Plpnan@hovoldconsulting.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -573,6 +573,10 @@ static void option_instat_callback(struc + #define WETELECOM_PRODUCT_6802 0x6802 + #define WETELECOM_PRODUCT_WMD300 0x6803 + ++/* OPPO products */ ++#define OPPO_VENDOR_ID 0x22d9 ++#define OPPO_PRODUCT_R11 0x276c ++ + + /* Device flags */ + +@@ -2155,6 +2159,7 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ ++ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-5.19/usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch b/queue-5.19/usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch new file mode 100644 index 00000000000..cb3fbbdbd70 --- /dev/null +++ b/queue-5.19/usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch @@ -0,0 +1,40 @@ +From 2aa48857ad52236a9564c71183d6cc8893becd41 Mon Sep 17 00:00:00 2001 +From: Witold Lipieta +Date: Tue, 9 Aug 2022 13:29:11 +0200 +Subject: usb-storage: Add ignore-residue quirk for NXP PN7462AU + +From: Witold Lipieta + +commit 2aa48857ad52236a9564c71183d6cc8893becd41 upstream. + +This is USB mass storage primary boot loader for code download on +NXP PN7462AU. + +Without the quirk it is impossible to write whole memory at once as +device restarts during the write due to bogus residue values reported. + +Acked-by: Alan Stern +Cc: stable +Signed-off-by: Witold Lipieta +Link: https://lore.kernel.org/r/20220809112911.462776-1-witold.lipieta@thaumatec.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2294,6 +2294,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), + ++/* Reported by Witold Lipieta */ ++UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100, ++ "NXP Semiconductors", ++ "PN7462AU", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_IGNORE_RESIDUE ), ++ + /* Supplied with some Castlewood ORB removable drives */ + UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999, + "Double-H Technology", diff --git a/queue-5.19/usb-typec-altmodes-displayport-correct-pin-assignment-for-ufp-receptacles.patch b/queue-5.19/usb-typec-altmodes-displayport-correct-pin-assignment-for-ufp-receptacles.patch new file mode 100644 index 00000000000..6d9d74ec5a1 --- /dev/null +++ b/queue-5.19/usb-typec-altmodes-displayport-correct-pin-assignment-for-ufp-receptacles.patch @@ -0,0 +1,74 @@ +From c1e5c2f0cb8a22ec2e14af92afc7006491bebabb Mon Sep 17 00:00:00 2001 +From: Pablo Sun +Date: Thu, 4 Aug 2022 11:48:03 +0800 +Subject: usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles + +From: Pablo Sun + +commit c1e5c2f0cb8a22ec2e14af92afc7006491bebabb upstream. + +Fix incorrect pin assignment values when connecting to a monitor with +Type-C receptacle instead of a plug. + +According to specification, an UFP_D receptacle's pin assignment +should came from the UFP_D pin assignments field (bit 23:16), while +an UFP_D plug's assignments are described in the DFP_D pin assignments +(bit 15:8) during Mode Discovery. + +For example the LG 27 UL850-W is a monitor with Type-C receptacle. +The monitor responds to MODE DISCOVERY command with following +DisplayPort Capability flag: + + dp->alt->vdo=0x140045 + +The existing logic only take cares of UPF_D plug case, +and would take the bit 15:8 for this 0x140045 case. + +This results in an non-existing pin assignment 0x0 in +dp_altmode_configure. + +To fix this problem a new set of macros are introduced +to take plug/receptacle differences into consideration. + +Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") +Cc: stable@vger.kernel.org +Co-developed-by: Pablo Sun +Co-developed-by: Macpaul Lin +Reviewed-by: Guillaume Ranquet +Reviewed-by: Heikki Krogerus +Signed-off-by: Pablo Sun +Signed-off-by: Macpaul Lin +Link: https://lore.kernel.org/r/20220804034803.19486-1-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 4 ++-- + include/linux/usb/typec_dp.h | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -99,8 +99,8 @@ static int dp_altmode_configure(struct d + case DP_STATUS_CON_UFP_D: + case DP_STATUS_CON_BOTH: /* NOTE: First acting as DP source */ + conf |= DP_CONF_UFP_U_AS_UFP_D; +- pin_assign = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo) & +- DP_CAP_UFP_D_PIN_ASSIGN(dp->port->vdo); ++ pin_assign = DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo) & ++ DP_CAP_PIN_ASSIGN_DFP_D(dp->port->vdo); + break; + default: + break; +--- a/include/linux/usb/typec_dp.h ++++ b/include/linux/usb/typec_dp.h +@@ -73,6 +73,11 @@ enum { + #define DP_CAP_USB BIT(7) + #define DP_CAP_DFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(15, 8)) >> 8) + #define DP_CAP_UFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(23, 16)) >> 16) ++/* Get pin assignment taking plug & receptacle into consideration */ ++#define DP_CAP_PIN_ASSIGN_UFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \ ++ DP_CAP_UFP_D_PIN_ASSIGN(_cap_) : DP_CAP_DFP_D_PIN_ASSIGN(_cap_)) ++#define DP_CAP_PIN_ASSIGN_DFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \ ++ DP_CAP_DFP_D_PIN_ASSIGN(_cap_) : DP_CAP_UFP_D_PIN_ASSIGN(_cap_)) + + /* DisplayPort Status Update VDO bits */ + #define DP_STATUS_CONNECTION(_status_) ((_status_) & 3) diff --git a/queue-5.19/usb-typec-intel_pmc_mux-add-new-acpi-id-for-meteor-lake-iom-device.patch b/queue-5.19/usb-typec-intel_pmc_mux-add-new-acpi-id-for-meteor-lake-iom-device.patch new file mode 100644 index 00000000000..2e9f58b888e --- /dev/null +++ b/queue-5.19/usb-typec-intel_pmc_mux-add-new-acpi-id-for-meteor-lake-iom-device.patch @@ -0,0 +1,64 @@ +From 1b1b672cc1d4fb3065dac79efb8901bd6244ef69 Mon Sep 17 00:00:00 2001 +From: Utkarsh Patel +Date: Tue, 16 Aug 2022 13:16:24 +0300 +Subject: usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device + +From: Utkarsh Patel + +commit 1b1b672cc1d4fb3065dac79efb8901bd6244ef69 upstream. + +This adds the necessary ACPI ID for Intel Meteor Lake +IOM devices. + +The callback function is_memory() is modified so that it +also checks if the resource descriptor passed to it is a +memory type "Address Space Resource Descriptor". + +On Intel Meteor Lake the ACPI memory resource is not +described using the "32-bit Memory Range Descriptor" because +the memory is outside of the 32-bit address space. The +memory resource is described using the "Address Space +Resource Descriptor" instead. + +Intel Meteor Lake is the first platform to describe the +memory resource for this device with Address Space Resource +Descriptor, but it most likely will not be the last. +Therefore the change to the is_memory() callback function +is made generic. + +Signed-off-by: Utkarsh Patel +Cc: stable@vger.kernel.org +[ heikki: Rewrote the commit message. ] +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20220816101629.69054-2-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/mux/intel_pmc_mux.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/mux/intel_pmc_mux.c ++++ b/drivers/usb/typec/mux/intel_pmc_mux.c +@@ -571,9 +571,11 @@ err_unregister_switch: + + static int is_memory(struct acpi_resource *res, void *data) + { +- struct resource r; ++ struct resource_win win = {}; ++ struct resource *r = &win.res; + +- return !acpi_dev_resource_memory(res, &r); ++ return !(acpi_dev_resource_memory(res, r) || ++ acpi_dev_resource_address_space(res, &win)); + } + + /* IOM ACPI IDs and IOM_PORT_STATUS_OFFSET */ +@@ -583,6 +585,9 @@ static const struct acpi_device_id iom_a + + /* AlderLake */ + { "INTC1079", 0x160, }, ++ ++ /* Meteor Lake */ ++ { "INTC107A", 0x160, }, + {} + }; + diff --git a/queue-5.19/usb-typec-tcpm-return-enotsupp-for-power-supply-prop-writes.patch b/queue-5.19/usb-typec-tcpm-return-enotsupp-for-power-supply-prop-writes.patch new file mode 100644 index 00000000000..f5289fad881 --- /dev/null +++ b/queue-5.19/usb-typec-tcpm-return-enotsupp-for-power-supply-prop-writes.patch @@ -0,0 +1,45 @@ +From f2d38edc5e3375e56b4a30d5b66cefd385a2b38c Mon Sep 17 00:00:00 2001 +From: Badhri Jagan Sridharan +Date: Wed, 17 Aug 2022 14:54:10 -0700 +Subject: usb: typec: tcpm: Return ENOTSUPP for power supply prop writes + +From: Badhri Jagan Sridharan + +commit f2d38edc5e3375e56b4a30d5b66cefd385a2b38c upstream. + +When the port does not support USB PD, prevent transition to PD +only states when power supply property is written. In this case, +TCPM transitions to SNK_NEGOTIATE_CAPABILITIES +which should not be the case given that the port is not pd_capable. + +[ 84.308251] state change SNK_READY -> SNK_NEGOTIATE_CAPABILITIES [rev3 NONE_AMS] +[ 84.308335] Setting usb_comm capable false +[ 84.323367] set_auto_vbus_discharge_threshold mode:3 pps_active:n vbus:5000 ret:0 +[ 84.323376] state change SNK_NEGOTIATE_CAPABILITIES -> SNK_WAIT_CAPABILITIES [rev3 NONE_AMS] + +Fixes: e9e6e164ed8f6 ("usb: typec: tcpm: Support non-PD mode") +Cc: stable@vger.kernel.org +Reviewed-by: Heikki Krogerus +Signed-off-by: Badhri Jagan Sridharan +Link: https://lore.kernel.org/r/20220817215410.1807477-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -6191,6 +6191,13 @@ static int tcpm_psy_set_prop(struct powe + struct tcpm_port *port = power_supply_get_drvdata(psy); + int ret; + ++ /* ++ * All the properties below are related to USB PD. The check needs to be ++ * property specific when a non-pd related property is added. ++ */ ++ if (!port->pd_supported) ++ return -EOPNOTSUPP; ++ + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: + ret = tcpm_psy_set_online(port, val); diff --git a/queue-5.19/usb-xhci-mtk-fix-bandwidth-release-issue.patch b/queue-5.19/usb-xhci-mtk-fix-bandwidth-release-issue.patch new file mode 100644 index 00000000000..b204f090793 --- /dev/null +++ b/queue-5.19/usb-xhci-mtk-fix-bandwidth-release-issue.patch @@ -0,0 +1,51 @@ +From 6020f480004a80cdad4ae5ee180a231c4f65595b Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Fri, 19 Aug 2022 16:05:56 +0800 +Subject: usb: xhci-mtk: fix bandwidth release issue + +From: Chunfeng Yun + +commit 6020f480004a80cdad4ae5ee180a231c4f65595b upstream. + +This happens when @udev->reset_resume is set to true, when usb resume, +the flow as below: + - hub_resume + - usb_disable_interface + - usb_disable_endpoint + - usb_hcd_disable_endpoint + - xhci_endpoint_disable // it set @ep->hcpriv to NULL + +Then when reset usb device, it will drop allocated endpoints, +the flow as below: + - usb_reset_and_verify_device + - usb_hcd_alloc_bandwidth + - xhci_mtk_drop_ep + +but @ep->hcpriv is already set to NULL, the bandwidth will be not +released anymore. + +Due to the added endponts are stored in hash table, we can drop the check +of @ep->hcpriv. + +Fixes: 4ce186665e7c ("usb: xhci-mtk: Do not use xhci's virt_dev in drop_endpoint") +Cc: stable +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/20220819080556.32215-2-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mtk-sch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-mtk-sch.c ++++ b/drivers/usb/host/xhci-mtk-sch.c +@@ -764,8 +764,8 @@ int xhci_mtk_drop_ep(struct usb_hcd *hcd + if (ret) + return ret; + +- if (ep->hcpriv) +- drop_ep_quirk(hcd, udev, ep); ++ /* needn't check @ep->hcpriv, xhci_endpoint_disable set it NULL */ ++ drop_ep_quirk(hcd, udev, ep); + + return 0; + } diff --git a/queue-5.19/usb-xhci-mtk-relax-tt-periodic-bandwidth-allocation.patch b/queue-5.19/usb-xhci-mtk-relax-tt-periodic-bandwidth-allocation.patch new file mode 100644 index 00000000000..a5529ab04cb --- /dev/null +++ b/queue-5.19/usb-xhci-mtk-relax-tt-periodic-bandwidth-allocation.patch @@ -0,0 +1,58 @@ +From 8b13ea05117ffad4727b0971ed09122d5c91c4dc Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Fri, 19 Aug 2022 16:05:55 +0800 +Subject: usb: xhci-mtk: relax TT periodic bandwidth allocation + +From: Chunfeng Yun + +commit 8b13ea05117ffad4727b0971ed09122d5c91c4dc upstream. + +Currently uses the worst case byte budgets on FS/LS bus bandwidth, +for example, for an isochronos IN endpoint with 192 bytes budget, it +will consume the whole 5 uframes(188 * 5) while the actual FS bus +budget should be just 192 bytes. It cause that many usb audio headsets +with 3 interfaces (audio input, audio output, and HID) cannot be +configured. +To improve it, changes to use "approximate" best case budget for FS/LS +bandwidth management. For the same endpoint from the above example, +the approximate best case budget is now reduced to (188 * 2) bytes. + +Signed-off-by: Chunfeng Yun +Cc: stable +Link: https://lore.kernel.org/r/20220819080556.32215-1-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mtk-sch.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +--- a/drivers/usb/host/xhci-mtk-sch.c ++++ b/drivers/usb/host/xhci-mtk-sch.c +@@ -425,7 +425,6 @@ static int check_fs_bus_bw(struct mu3h_s + + static int check_sch_tt(struct mu3h_sch_ep_info *sch_ep, u32 offset) + { +- u32 extra_cs_count; + u32 start_ss, last_ss; + u32 start_cs, last_cs; + +@@ -461,18 +460,12 @@ static int check_sch_tt(struct mu3h_sch_ + if (last_cs > 7) + return -ESCH_CS_OVERFLOW; + +- if (sch_ep->ep_type == ISOC_IN_EP) +- extra_cs_count = (last_cs == 7) ? 1 : 2; +- else /* ep_type : INTR IN / INTR OUT */ +- extra_cs_count = 1; +- +- cs_count += extra_cs_count; + if (cs_count > 7) + cs_count = 7; /* HW limit */ + + sch_ep->cs_count = cs_count; +- /* one for ss, the other for idle */ +- sch_ep->num_budget_microframes = cs_count + 2; ++ /* ss, idle are ignored */ ++ sch_ep->num_budget_microframes = cs_count; + + /* + * if interval=1, maxp >752, num_budge_micoframe is larger