From 0d8c0d913b01076b3dfe3a229482e0bba444b174 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 28 Dec 2022 10:08:54 +0100 Subject: [PATCH] 5.15-stable patches added patches: alsa-hda-hdmi-add-hp-device-0x8711-to-force-connect-list.patch alsa-hda-realtek-add-quirk-for-lenovo-tianyi510pro-14iob.patch alsa-usb-audio-add-the-quirk-for-kt0206-device.patch arm64-dts-qcom-sm8250-fix-usb-dp-phy-registers.patch usb-cdnsp-fix-lack-of-zlp-for-ep0.patch usb-dwc3-core-defer-probe-on-ulpi_read_id-timeout.patch usb-dwc3-fix-race-between-dwc3_set_mode-and-__dwc3_set_mode.patch usb-xhci-mtk-fix-leakage-of-shared-hcd-when-fail-to-set-wakeup-irq.patch xhci-prevent-infinite-loop-in-transaction-errors-recovery-for-streams.patch --- ...-device-0x8711-to-force-connect-list.patch | 32 +++++ ...-quirk-for-lenovo-tianyi510pro-14iob.patch | 79 ++++++++++++ ...udio-add-the-quirk-for-kt0206-device.patch | 32 +++++ ...qcom-sm8250-fix-usb-dp-phy-registers.patch | 47 ++++++++ queue-5.15/series | 9 ++ .../usb-cdnsp-fix-lack-of-zlp-for-ep0.patch | 104 ++++++++++++++++ ...-defer-probe-on-ulpi_read_id-timeout.patch | 58 +++++++++ ...en-dwc3_set_mode-and-__dwc3_set_mode.patch | 112 ++++++++++++++++++ ...ared-hcd-when-fail-to-set-wakeup-irq.patch | 31 +++++ ...nsaction-errors-recovery-for-streams.patch | 83 +++++++++++++ 10 files changed, 587 insertions(+) create mode 100644 queue-5.15/alsa-hda-hdmi-add-hp-device-0x8711-to-force-connect-list.patch create mode 100644 queue-5.15/alsa-hda-realtek-add-quirk-for-lenovo-tianyi510pro-14iob.patch create mode 100644 queue-5.15/alsa-usb-audio-add-the-quirk-for-kt0206-device.patch create mode 100644 queue-5.15/arm64-dts-qcom-sm8250-fix-usb-dp-phy-registers.patch create mode 100644 queue-5.15/usb-cdnsp-fix-lack-of-zlp-for-ep0.patch create mode 100644 queue-5.15/usb-dwc3-core-defer-probe-on-ulpi_read_id-timeout.patch create mode 100644 queue-5.15/usb-dwc3-fix-race-between-dwc3_set_mode-and-__dwc3_set_mode.patch create mode 100644 queue-5.15/usb-xhci-mtk-fix-leakage-of-shared-hcd-when-fail-to-set-wakeup-irq.patch create mode 100644 queue-5.15/xhci-prevent-infinite-loop-in-transaction-errors-recovery-for-streams.patch diff --git a/queue-5.15/alsa-hda-hdmi-add-hp-device-0x8711-to-force-connect-list.patch b/queue-5.15/alsa-hda-hdmi-add-hp-device-0x8711-to-force-connect-list.patch new file mode 100644 index 00000000000..4597e363a08 --- /dev/null +++ b/queue-5.15/alsa-hda-hdmi-add-hp-device-0x8711-to-force-connect-list.patch @@ -0,0 +1,32 @@ +From 31b573946ea55e1ea0e08ae8e83bcf879b30f83a Mon Sep 17 00:00:00 2001 +From: Jiao Zhou +Date: Tue, 6 Dec 2022 13:53:11 -0500 +Subject: ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list + +From: Jiao Zhou + +commit 31b573946ea55e1ea0e08ae8e83bcf879b30f83a upstream. + +HDMI audio is not working on the HP EliteDesk 800 G6 because the pin is +unconnected. This issue can be resolved by using the 'hdajackretask' +tool to override the unconnected pin to force it to connect. + +Signed-off-by: Jiao Zhou +Cc: +Link: https://lore.kernel.org/r/20221206185311.3669950-1-jiaozhou@google.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1962,6 +1962,7 @@ static int hdmi_add_cvt(struct hda_codec + static const struct snd_pci_quirk force_connect_list[] = { + SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1), + SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1), ++ SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1), + SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1), + {} diff --git a/queue-5.15/alsa-hda-realtek-add-quirk-for-lenovo-tianyi510pro-14iob.patch b/queue-5.15/alsa-hda-realtek-add-quirk-for-lenovo-tianyi510pro-14iob.patch new file mode 100644 index 00000000000..e8d2de7d86a --- /dev/null +++ b/queue-5.15/alsa-hda-realtek-add-quirk-for-lenovo-tianyi510pro-14iob.patch @@ -0,0 +1,79 @@ +From 4bf5bf54476dffe60e6b6d8d539f67309ff599e2 Mon Sep 17 00:00:00 2001 +From: Edward Pacman +Date: Wed, 7 Dec 2022 21:32:18 +0800 +Subject: ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB + +From: Edward Pacman + +commit 4bf5bf54476dffe60e6b6d8d539f67309ff599e2 upstream. + +Lenovo TianYi510Pro-14IOB (17aa:3742) +require quirk for enabling headset-mic + +Signed-off-by: Edward Pacman +Cc: +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216756 +Link: https://lore.kernel.org/r/20221207133218.18989-1-edward@edward-p.xyz +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10593,6 +10593,17 @@ static void alc897_fixup_lenovo_headset_ + } + } + ++static void alc897_fixup_lenovo_headset_mode(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->parse_flags |= HDA_PINCFG_HEADSET_MIC; ++ spec->gen.hp_automute_hook = alc897_hp_automute_hook; ++ } ++} ++ + static const struct coef_fw alc668_coefs[] = { + WRITE_COEF(0x01, 0xbebe), WRITE_COEF(0x02, 0xaaaa), WRITE_COEF(0x03, 0x0), + WRITE_COEF(0x04, 0x0180), WRITE_COEF(0x06, 0x0), WRITE_COEF(0x07, 0x0f80), +@@ -10676,6 +10687,8 @@ enum { + ALC897_FIXUP_LENOVO_HEADSET_MIC, + ALC897_FIXUP_HEADSET_MIC_PIN, + ALC897_FIXUP_HP_HSMIC_VERB, ++ ALC897_FIXUP_LENOVO_HEADSET_MODE, ++ ALC897_FIXUP_HEADSET_MIC_PIN2, + }; + + static const struct hda_fixup alc662_fixups[] = { +@@ -11102,6 +11115,19 @@ static const struct hda_fixup alc662_fix + { } + }, + }, ++ [ALC897_FIXUP_LENOVO_HEADSET_MODE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc897_fixup_lenovo_headset_mode, ++ }, ++ [ALC897_FIXUP_HEADSET_MIC_PIN2] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1a, 0x01a11140 }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC897_FIXUP_LENOVO_HEADSET_MODE ++ }, + }; + + static const struct snd_pci_quirk alc662_fixup_tbl[] = { +@@ -11154,6 +11180,7 @@ static const struct snd_pci_quirk alc662 + SND_PCI_QUIRK(0x17aa, 0x32cb, "Lenovo ThinkCentre M70", ALC897_FIXUP_HEADSET_MIC_PIN), + SND_PCI_QUIRK(0x17aa, 0x32cf, "Lenovo ThinkCentre M950", ALC897_FIXUP_HEADSET_MIC_PIN), + SND_PCI_QUIRK(0x17aa, 0x32f7, "Lenovo ThinkCentre M90", ALC897_FIXUP_HEADSET_MIC_PIN), ++ SND_PCI_QUIRK(0x17aa, 0x3742, "Lenovo TianYi510Pro-14IOB", ALC897_FIXUP_HEADSET_MIC_PIN2), + SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD), + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD), + SND_PCI_QUIRK(0x1849, 0x5892, "ASRock B150M", ALC892_FIXUP_ASROCK_MOBO), diff --git a/queue-5.15/alsa-usb-audio-add-the-quirk-for-kt0206-device.patch b/queue-5.15/alsa-usb-audio-add-the-quirk-for-kt0206-device.patch new file mode 100644 index 00000000000..eb280130c6d --- /dev/null +++ b/queue-5.15/alsa-usb-audio-add-the-quirk-for-kt0206-device.patch @@ -0,0 +1,32 @@ +From 696b66ac26ef953aed5783ef26a252ec8f207013 Mon Sep 17 00:00:00 2001 +From: wangdicheng +Date: Wed, 7 Dec 2022 16:20:36 +0800 +Subject: ALSA: usb-audio: add the quirk for KT0206 device + +From: wangdicheng + +commit 696b66ac26ef953aed5783ef26a252ec8f207013 upstream. + +Add relevant information to the quirks-table.h file. +The test passes and the sound source file plays normally. + +Signed-off-by: wangdicheng +Cc: +Link: https://lore.kernel.org/r/SG2PR02MB587849631CB96809CF90DBED8A1A9@SG2PR02MB5878.apcprd02.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks-table.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -76,6 +76,8 @@ + { USB_DEVICE_VENDOR_SPEC(0x041e, 0x3f0a) }, + /* E-Mu 0204 USB */ + { USB_DEVICE_VENDOR_SPEC(0x041e, 0x3f19) }, ++/* Ktmicro Usb_audio device */ ++{ USB_DEVICE_VENDOR_SPEC(0x31b2, 0x0011) }, + + /* + * Creative Technology, Ltd Live! Cam Sync HD [VF0770] diff --git a/queue-5.15/arm64-dts-qcom-sm8250-fix-usb-dp-phy-registers.patch b/queue-5.15/arm64-dts-qcom-sm8250-fix-usb-dp-phy-registers.patch new file mode 100644 index 00000000000..d447a02704b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8250-fix-usb-dp-phy-registers.patch @@ -0,0 +1,47 @@ +From f8d8840c72b3df61b5252052b79020dabec01ab5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 11 Nov 2022 10:47:29 +0100 +Subject: arm64: dts: qcom: sm8250: fix USB-DP PHY registers + +From: Johan Hovold + +commit f8d8840c72b3df61b5252052b79020dabec01ab5 upstream. + +When adding support for the DisplayPort part of the QMP PHY the binding +(and devicetree parser) for the (USB) child node was simply reused and +this has lead to some confusion. + +The third DP register region is really the DP_PHY region, not "PCS" as +the binding claims, and lie at offset 0x2a00 (not 0x2c00). + +Similarly, there likely are no "RX", "RX2" or "PCS_MISC" regions as +there are for the USB part of the PHY (and in any case the Linux driver +does not use them). + +Note that the sixth "PCS_MISC" region is not even in the binding. + +Fixes: 5aa0d1becd5b ("arm64: dts: qcom: sm8250: switch usb1 qmp phy to USB3+DP mode") +Cc: stable@vger.kernel.org # 5.13 +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221111094729.11842-3-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2306,10 +2306,9 @@ + dp_phy: dp-phy@88ea200 { + reg = <0 0x088ea200 0 0x200>, + <0 0x088ea400 0 0x200>, +- <0 0x088eac00 0 0x400>, ++ <0 0x088eaa00 0 0x200>, + <0 0x088ea600 0 0x200>, +- <0 0x088ea800 0 0x200>, +- <0 0x088eaa00 0 0x100>; ++ <0 0x088ea800 0 0x200>; + #phy-cells = <0>; + #clock-cells = <1>; + }; diff --git a/queue-5.15/series b/queue-5.15/series index ed2c0e2e6dc..b5565240dcd 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -700,3 +700,12 @@ perf-debug-set-debug_peo_args-and-redirect_to_stderr.patch afs-fix-lost-servers_outstanding-count.patch pstore-make-sure-config_pstore_pmsg-selects-config_r.patch ima-simplify-ima_lsm_copy_rule.patch +alsa-usb-audio-add-the-quirk-for-kt0206-device.patch +alsa-hda-realtek-add-quirk-for-lenovo-tianyi510pro-14iob.patch +alsa-hda-hdmi-add-hp-device-0x8711-to-force-connect-list.patch +usb-cdnsp-fix-lack-of-zlp-for-ep0.patch +usb-xhci-mtk-fix-leakage-of-shared-hcd-when-fail-to-set-wakeup-irq.patch +arm64-dts-qcom-sm8250-fix-usb-dp-phy-registers.patch +usb-dwc3-fix-race-between-dwc3_set_mode-and-__dwc3_set_mode.patch +usb-dwc3-core-defer-probe-on-ulpi_read_id-timeout.patch +xhci-prevent-infinite-loop-in-transaction-errors-recovery-for-streams.patch diff --git a/queue-5.15/usb-cdnsp-fix-lack-of-zlp-for-ep0.patch b/queue-5.15/usb-cdnsp-fix-lack-of-zlp-for-ep0.patch new file mode 100644 index 00000000000..5329407afa2 --- /dev/null +++ b/queue-5.15/usb-cdnsp-fix-lack-of-zlp-for-ep0.patch @@ -0,0 +1,104 @@ +From ae423ef5d095e09970f52c08020fdbf7f9d87c22 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Tue, 22 Nov 2022 03:51:38 -0500 +Subject: usb: cdnsp: fix lack of ZLP for ep0 + +From: Pawel Laszczak + +commit ae423ef5d095e09970f52c08020fdbf7f9d87c22 upstream. + +Patch implements the handling of ZLP for control transfer. +To send the ZLP driver must prepare the extra TRB in TD with +length set to zero and TRB type to TRB_NORMAL. +The first TRB must have set TRB_CHAIN flag, TD_SIZE = 1 +and TRB type to TRB_DATA. + +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +cc: +Reviewed-by: Peter Chen +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20221122085138.332434-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdnsp-ring.c | 42 +++++++++++++++++++++++++++++++---------- + 1 file changed, 32 insertions(+), 10 deletions(-) + +--- a/drivers/usb/cdns3/cdnsp-ring.c ++++ b/drivers/usb/cdns3/cdnsp-ring.c +@@ -2006,10 +2006,11 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev + + int cdnsp_queue_ctrl_tx(struct cdnsp_device *pdev, struct cdnsp_request *preq) + { +- u32 field, length_field, remainder; ++ u32 field, length_field, zlp = 0; + struct cdnsp_ep *pep = preq->pep; + struct cdnsp_ring *ep_ring; + int num_trbs; ++ u32 maxp; + int ret; + + ep_ring = cdnsp_request_to_transfer_ring(pdev, preq); +@@ -2019,26 +2020,33 @@ int cdnsp_queue_ctrl_tx(struct cdnsp_dev + /* 1 TRB for data, 1 for status */ + num_trbs = (pdev->three_stage_setup) ? 2 : 1; + ++ maxp = usb_endpoint_maxp(pep->endpoint.desc); ++ ++ if (preq->request.zero && preq->request.length && ++ (preq->request.length % maxp == 0)) { ++ num_trbs++; ++ zlp = 1; ++ } ++ + ret = cdnsp_prepare_transfer(pdev, preq, num_trbs); + if (ret) + return ret; + + /* If there's data, queue data TRBs */ +- if (pdev->ep0_expect_in) +- field = TRB_TYPE(TRB_DATA) | TRB_IOC; +- else +- field = TRB_ISP | TRB_TYPE(TRB_DATA) | TRB_IOC; +- + if (preq->request.length > 0) { +- remainder = cdnsp_td_remainder(pdev, 0, preq->request.length, +- preq->request.length, preq, 1, 0); ++ field = TRB_TYPE(TRB_DATA); + +- length_field = TRB_LEN(preq->request.length) | +- TRB_TD_SIZE(remainder) | TRB_INTR_TARGET(0); ++ if (zlp) ++ field |= TRB_CHAIN; ++ else ++ field |= TRB_IOC | (pdev->ep0_expect_in ? 0 : TRB_ISP); + + if (pdev->ep0_expect_in) + field |= TRB_DIR_IN; + ++ length_field = TRB_LEN(preq->request.length) | ++ TRB_TD_SIZE(zlp) | TRB_INTR_TARGET(0); ++ + cdnsp_queue_trb(pdev, ep_ring, true, + lower_32_bits(preq->request.dma), + upper_32_bits(preq->request.dma), length_field, +@@ -2046,6 +2054,20 @@ int cdnsp_queue_ctrl_tx(struct cdnsp_dev + TRB_SETUPID(pdev->setup_id) | + pdev->setup_speed); + ++ if (zlp) { ++ field = TRB_TYPE(TRB_NORMAL) | TRB_IOC; ++ ++ if (!pdev->ep0_expect_in) ++ field = TRB_ISP; ++ ++ cdnsp_queue_trb(pdev, ep_ring, true, ++ lower_32_bits(preq->request.dma), ++ upper_32_bits(preq->request.dma), 0, ++ field | ep_ring->cycle_state | ++ TRB_SETUPID(pdev->setup_id) | ++ pdev->setup_speed); ++ } ++ + pdev->ep0_stage = CDNSP_DATA_STAGE; + } + diff --git a/queue-5.15/usb-dwc3-core-defer-probe-on-ulpi_read_id-timeout.patch b/queue-5.15/usb-dwc3-core-defer-probe-on-ulpi_read_id-timeout.patch new file mode 100644 index 00000000000..a200abe3c2c --- /dev/null +++ b/queue-5.15/usb-dwc3-core-defer-probe-on-ulpi_read_id-timeout.patch @@ -0,0 +1,58 @@ +From 63130462c919ece0ad0d9bb5a1f795ef8d79687e Mon Sep 17 00:00:00 2001 +From: Ferry Toth +Date: Mon, 5 Dec 2022 21:15:27 +0100 +Subject: usb: dwc3: core: defer probe on ulpi_read_id timeout + +From: Ferry Toth + +commit 63130462c919ece0ad0d9bb5a1f795ef8d79687e upstream. + +Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral +if extcon is present"), Dual Role support on Intel Merrifield platform +broke due to rearranging the call to dwc3_get_extcon(). + +It appears to be caused by ulpi_read_id() masking the timeout on the first +test write. In the past dwc3 probe continued by calling dwc3_core_soft_reset() +followed by dwc3_get_extcon() which happend to return -EPROBE_DEFER. +On deferred probe ulpi_read_id() finally succeeded. Due to above mentioned +rearranging -EPROBE_DEFER is not returned and probe completes without phy. + +On Intel Merrifield the timeout on the first test write issue is reproducible +but it is difficult to find the root cause. Using a mainline kernel and +rootfs with buildroot ulpi_read_id() succeeds. As soon as adding +ftrace / bootconfig to find out why, ulpi_read_id() fails and we can't +analyze the flow. Using another rootfs ulpi_read_id() fails even without +adding ftrace. We suspect the issue is some kind of timing / race, but +merely retrying ulpi_read_id() does not resolve the issue. + +As we now changed ulpi_read_id() to return -ETIMEDOUT in this case, we +need to handle the error by calling dwc3_core_soft_reset() and request +-EPROBE_DEFER. On deferred probe ulpi_read_id() is retried and succeeds. + +Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") +Cc: stable@vger.kernel.org +Acked-by: Thinh Nguyen +Signed-off-by: Ferry Toth +Link: https://lore.kernel.org/r/20221205201527.13525-3-ftoth@exalondelft.nl +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -963,8 +963,13 @@ static int dwc3_core_init(struct dwc3 *d + + if (!dwc->ulpi_ready) { + ret = dwc3_core_ulpi_init(dwc); +- if (ret) ++ if (ret) { ++ if (ret == -ETIMEDOUT) { ++ dwc3_core_soft_reset(dwc); ++ ret = -EPROBE_DEFER; ++ } + goto err0; ++ } + dwc->ulpi_ready = true; + } + diff --git a/queue-5.15/usb-dwc3-fix-race-between-dwc3_set_mode-and-__dwc3_set_mode.patch b/queue-5.15/usb-dwc3-fix-race-between-dwc3_set_mode-and-__dwc3_set_mode.patch new file mode 100644 index 00000000000..5d5d035aa3b --- /dev/null +++ b/queue-5.15/usb-dwc3-fix-race-between-dwc3_set_mode-and-__dwc3_set_mode.patch @@ -0,0 +1,112 @@ +From 62c73bfea048e66168df09da6d3e4510ecda40bb Mon Sep 17 00:00:00 2001 +From: Sven Peter +Date: Mon, 28 Nov 2022 17:15:26 +0100 +Subject: usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode + +From: Sven Peter + +commit 62c73bfea048e66168df09da6d3e4510ecda40bb upstream. + +dwc->desired_dr_role is changed by dwc3_set_mode inside a spinlock but +then read by __dwc3_set_mode outside of that lock. This can lead to a +race condition when very quick successive role switch events happen: + +CPU A + dwc3_set_mode(DWC3_GCTL_PRTCAP_HOST) // first role switch event + spin_lock_irqsave(&dwc->lock, flags); + dwc->desired_dr_role = mode; // DWC3_GCTL_PRTCAP_HOST + spin_unlock_irqrestore(&dwc->lock, flags); + queue_work(system_freezable_wq, &dwc->drd_work); + +CPU B + __dwc3_set_mode + // .... + spin_lock_irqsave(&dwc->lock, flags); + // desired_dr_role is DWC3_GCTL_PRTCAP_HOST + dwc3_set_prtcap(dwc, dwc->desired_dr_role); + spin_unlock_irqrestore(&dwc->lock, flags); + +CPU A + dwc3_set_mode(DWC3_GCTL_PRTCAP_DEVICE) // second event + spin_lock_irqsave(&dwc->lock, flags); + dwc->desired_dr_role = mode; // DWC3_GCTL_PRTCAP_DEVICE + spin_unlock_irqrestore(&dwc->lock, flags); + +CPU B (continues running __dwc3_set_mode) + switch (dwc->desired_dr_role) { // DWC3_GCTL_PRTCAP_DEVICE + // .... + case DWC3_GCTL_PRTCAP_DEVICE: + // .... + ret = dwc3_gadget_init(dwc); + +We then have DWC3_GCTL.DWC3_GCTL_PRTCAPDIR = DWC3_GCTL_PRTCAP_HOST and +dwc->current_dr_role = DWC3_GCTL_PRTCAP_HOST but initialized the +controller in device mode. It's also possible to get into a state +where both host and device are intialized at the same time. +Fix this race by creating a local copy of desired_dr_role inside +__dwc3_set_mode while holding dwc->lock. + +Fixes: 41ce1456e1db ("usb: dwc3: core: make dwc3_set_mode() work properly") +Cc: stable +Acked-by: Thinh Nguyen +Signed-off-by: Sven Peter +Link: https://lore.kernel.org/r/20221128161526.79730-1-sven@svenpeter.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -120,21 +120,25 @@ static void __dwc3_set_mode(struct work_ + unsigned long flags; + int ret; + u32 reg; ++ u32 desired_dr_role; + + mutex_lock(&dwc->mutex); ++ spin_lock_irqsave(&dwc->lock, flags); ++ desired_dr_role = dwc->desired_dr_role; ++ spin_unlock_irqrestore(&dwc->lock, flags); + + pm_runtime_get_sync(dwc->dev); + + if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_OTG) + dwc3_otg_update(dwc, 0); + +- if (!dwc->desired_dr_role) ++ if (!desired_dr_role) + goto out; + +- if (dwc->desired_dr_role == dwc->current_dr_role) ++ if (desired_dr_role == dwc->current_dr_role) + goto out; + +- if (dwc->desired_dr_role == DWC3_GCTL_PRTCAP_OTG && dwc->edev) ++ if (desired_dr_role == DWC3_GCTL_PRTCAP_OTG && dwc->edev) + goto out; + + switch (dwc->current_dr_role) { +@@ -162,7 +166,7 @@ static void __dwc3_set_mode(struct work_ + */ + if (dwc->current_dr_role && ((DWC3_IP_IS(DWC3) || + DWC3_VER_IS_PRIOR(DWC31, 190A)) && +- dwc->desired_dr_role != DWC3_GCTL_PRTCAP_OTG)) { ++ desired_dr_role != DWC3_GCTL_PRTCAP_OTG)) { + reg = dwc3_readl(dwc->regs, DWC3_GCTL); + reg |= DWC3_GCTL_CORESOFTRESET; + dwc3_writel(dwc->regs, DWC3_GCTL, reg); +@@ -182,11 +186,11 @@ static void __dwc3_set_mode(struct work_ + + spin_lock_irqsave(&dwc->lock, flags); + +- dwc3_set_prtcap(dwc, dwc->desired_dr_role); ++ dwc3_set_prtcap(dwc, desired_dr_role); + + spin_unlock_irqrestore(&dwc->lock, flags); + +- switch (dwc->desired_dr_role) { ++ switch (desired_dr_role) { + case DWC3_GCTL_PRTCAP_HOST: + ret = dwc3_host_init(dwc); + if (ret) { diff --git a/queue-5.15/usb-xhci-mtk-fix-leakage-of-shared-hcd-when-fail-to-set-wakeup-irq.patch b/queue-5.15/usb-xhci-mtk-fix-leakage-of-shared-hcd-when-fail-to-set-wakeup-irq.patch new file mode 100644 index 00000000000..b0032354661 --- /dev/null +++ b/queue-5.15/usb-xhci-mtk-fix-leakage-of-shared-hcd-when-fail-to-set-wakeup-irq.patch @@ -0,0 +1,31 @@ +From 03a88b0bafbe3f548729d970d8366f48718c9b19 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Mon, 28 Nov 2022 14:33:37 +0800 +Subject: usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq + +From: Chunfeng Yun + +commit 03a88b0bafbe3f548729d970d8366f48718c9b19 upstream. + +Can not set the @shared_hcd to NULL before decrease the usage count +by usb_put_hcd(), this will cause the shared hcd not released. + +Fixes: 04284eb74e0c ("usb: xhci-mtk: add support runtime PM") +Cc: +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/20221128063337.18124-1-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mtk.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/host/xhci-mtk.c ++++ b/drivers/usb/host/xhci-mtk.c +@@ -619,7 +619,6 @@ static int xhci_mtk_probe(struct platfor + + dealloc_usb3_hcd: + usb_remove_hcd(xhci->shared_hcd); +- xhci->shared_hcd = NULL; + + dealloc_usb2_hcd: + usb_remove_hcd(hcd); diff --git a/queue-5.15/xhci-prevent-infinite-loop-in-transaction-errors-recovery-for-streams.patch b/queue-5.15/xhci-prevent-infinite-loop-in-transaction-errors-recovery-for-streams.patch new file mode 100644 index 00000000000..f1ebc672a88 --- /dev/null +++ b/queue-5.15/xhci-prevent-infinite-loop-in-transaction-errors-recovery-for-streams.patch @@ -0,0 +1,83 @@ +From a1575120972ecd7baa6af6a69e4e7ea9213bde7c Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Wed, 30 Nov 2022 11:19:43 +0200 +Subject: xhci: Prevent infinite loop in transaction errors recovery for streams + +From: Mathias Nyman + +commit a1575120972ecd7baa6af6a69e4e7ea9213bde7c upstream. + +Make sure to also limit the amount of soft reset retries for transaction +errors on streams in cases where the transaction error event doesn't point +to any specific TRB. + +In these cases we don't know the TRB or stream ring, but we do know which +endpoint had the error. + +To keep error counting simple and functional, move the current err_count +from ring structure to endpoint structure. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221130091944.2171610-6-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-ring.c | 14 ++++++++++---- + drivers/usb/host/xhci.h | 2 +- + 2 files changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2524,7 +2524,7 @@ static int process_bulk_intr_td(struct x + + switch (trb_comp_code) { + case COMP_SUCCESS: +- ep_ring->err_count = 0; ++ ep->err_count = 0; + /* handle success with untransferred data as short packet */ + if (ep_trb != td->last_trb || remaining) { + xhci_warn(xhci, "WARN Successful completion on short TX\n"); +@@ -2550,7 +2550,7 @@ static int process_bulk_intr_td(struct x + break; + case COMP_USB_TRANSACTION_ERROR: + if (xhci->quirks & XHCI_NO_SOFT_RETRY || +- (ep_ring->err_count++ > MAX_SOFT_RETRY) || ++ (ep->err_count++ > MAX_SOFT_RETRY) || + le32_to_cpu(slot_ctx->tt_info) & TT_SLOT) + break; + +@@ -2631,8 +2631,14 @@ static int handle_tx_event(struct xhci_h + case COMP_USB_TRANSACTION_ERROR: + case COMP_INVALID_STREAM_TYPE_ERROR: + case COMP_INVALID_STREAM_ID_ERROR: +- xhci_handle_halted_endpoint(xhci, ep, 0, NULL, +- EP_SOFT_RESET); ++ xhci_dbg(xhci, "Stream transaction error ep %u no id\n", ++ ep_index); ++ if (ep->err_count++ > MAX_SOFT_RETRY) ++ xhci_handle_halted_endpoint(xhci, ep, 0, NULL, ++ EP_HARD_RESET); ++ else ++ xhci_handle_halted_endpoint(xhci, ep, 0, NULL, ++ EP_SOFT_RESET); + goto cleanup; + case COMP_RING_UNDERRUN: + case COMP_RING_OVERRUN: +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -933,6 +933,7 @@ struct xhci_virt_ep { + * have to restore the device state to the previous state + */ + struct xhci_ring *new_ring; ++ unsigned int err_count; + unsigned int ep_state; + #define SET_DEQ_PENDING (1 << 0) + #define EP_HALTED (1 << 1) /* For stall handling */ +@@ -1629,7 +1630,6 @@ struct xhci_ring { + * if we own the TRB (if we are the consumer). See section 4.9.1. + */ + u32 cycle_state; +- unsigned int err_count; + unsigned int stream_id; + unsigned int num_segs; + unsigned int num_trbs_free; -- 2.47.3