From 2390c3efcad0b50ea45e05741c365d35cd760cd4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 17 Sep 2025 10:00:28 +0200 Subject: [PATCH] 5.15-stable patches added patches: dmaengine-qcom-bam_dma-fix-dt-error-handling-for-num-channels-ees.patch phy-tegra-xusb-fix-device-and-of-node-leak-at-probe.patch phy-ti-pipe3-fix-device-leak-at-unbind.patch xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch --- ...-error-handling-for-num-channels-ees.patch | 65 ++++++++++++++ ...fix-device-and-of-node-leak-at-probe.patch | 54 ++++++++++++ ...y-ti-pipe3-fix-device-leak-at-unbind.patch | 58 +++++++++++++ queue-5.15/series | 4 + ...ansfer-ring-after-several-reconnects.patch | 86 +++++++++++++++++++ 5 files changed, 267 insertions(+) create mode 100644 queue-5.15/dmaengine-qcom-bam_dma-fix-dt-error-handling-for-num-channels-ees.patch create mode 100644 queue-5.15/phy-tegra-xusb-fix-device-and-of-node-leak-at-probe.patch create mode 100644 queue-5.15/phy-ti-pipe3-fix-device-leak-at-unbind.patch create mode 100644 queue-5.15/xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch diff --git a/queue-5.15/dmaengine-qcom-bam_dma-fix-dt-error-handling-for-num-channels-ees.patch b/queue-5.15/dmaengine-qcom-bam_dma-fix-dt-error-handling-for-num-channels-ees.patch new file mode 100644 index 0000000000..ccff91b17d --- /dev/null +++ b/queue-5.15/dmaengine-qcom-bam_dma-fix-dt-error-handling-for-num-channels-ees.patch @@ -0,0 +1,65 @@ +From 5068b5254812433e841a40886e695633148d362d Mon Sep 17 00:00:00 2001 +From: Stephan Gerhold +Date: Wed, 12 Feb 2025 18:03:54 +0100 +Subject: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees + +From: Stephan Gerhold + +commit 5068b5254812433e841a40886e695633148d362d upstream. + +When we don't have a clock specified in the device tree, we have no way to +ensure the BAM is on. This is often the case for remotely-controlled or +remotely-powered BAM instances. In this case, we need to read num-channels +from the DT to have all the necessary information to complete probing. + +However, at the moment invalid device trees without clock and without +num-channels still continue probing, because the error handling is missing +return statements. The driver will then later try to read the number of +channels from the registers. This is unsafe, because it relies on boot +firmware and lucky timing to succeed. Unfortunately, the lack of proper +error handling here has been abused for several Qualcomm SoCs upstream, +causing early boot crashes in several situations [1, 2]. + +Avoid these early crashes by erroring out when any of the required DT +properties are missing. Note that this will break some of the existing DTs +upstream (mainly BAM instances related to the crypto engine). However, +clearly these DTs have never been tested properly, since the error in the +kernel log was just ignored. It's safer to disable the crypto engine for +these broken DTBs. + +[1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/ +[2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/ + +Cc: stable@vger.kernel.org +Fixes: 48d163b1aa6e ("dmaengine: qcom: bam_dma: get num-channels and num-ees from dt") +Signed-off-by: Stephan Gerhold +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20250212-bam-dma-fixes-v1-8-f560889e65d8@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/qcom/bam_dma.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/dma/qcom/bam_dma.c ++++ b/drivers/dma/qcom/bam_dma.c +@@ -1253,13 +1253,17 @@ static int bam_dma_probe(struct platform + if (bdev->controlled_remotely) { + ret = of_property_read_u32(pdev->dev.of_node, "num-channels", + &bdev->num_channels); +- if (ret) ++ if (ret) { + dev_err(bdev->dev, "num-channels unspecified in dt\n"); ++ return ret; ++ } + + ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees", + &bdev->num_ees); +- if (ret) ++ if (ret) { + dev_err(bdev->dev, "num-ees unspecified in dt\n"); ++ return ret; ++ } + } + + if (bdev->controlled_remotely) diff --git a/queue-5.15/phy-tegra-xusb-fix-device-and-of-node-leak-at-probe.patch b/queue-5.15/phy-tegra-xusb-fix-device-and-of-node-leak-at-probe.patch new file mode 100644 index 0000000000..b6d31c6936 --- /dev/null +++ b/queue-5.15/phy-tegra-xusb-fix-device-and-of-node-leak-at-probe.patch @@ -0,0 +1,54 @@ +From bca065733afd1e3a89a02f05ffe14e966cd5f78e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 15:12:04 +0200 +Subject: phy: tegra: xusb: fix device and OF node leak at probe + +From: Johan Hovold + +commit bca065733afd1e3a89a02f05ffe14e966cd5f78e upstream. + +Make sure to drop the references taken to the PMC OF node and device by +of_parse_phandle() and of_find_device_by_node() during probe. + +Note the holding a reference to the PMC device does not prevent the +PMC regmap from going away (e.g. if the PMC driver is unbound) so there +is no need to keep the reference. + +Fixes: 2d1021487273 ("phy: tegra: xusb: Add wake/sleepwalk for Tegra210") +Cc: stable@vger.kernel.org # 5.14 +Cc: JC Kuo +Signed-off-by: Johan Hovold +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250724131206.2211-2-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb-tegra210.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/phy/tegra/xusb-tegra210.c ++++ b/drivers/phy/tegra/xusb-tegra210.c +@@ -3165,18 +3165,22 @@ tegra210_xusb_padctl_probe(struct device + } + + pdev = of_find_device_by_node(np); ++ of_node_put(np); + if (!pdev) { + dev_warn(dev, "PMC device is not available\n"); + goto out; + } + +- if (!platform_get_drvdata(pdev)) ++ if (!platform_get_drvdata(pdev)) { ++ put_device(&pdev->dev); + return ERR_PTR(-EPROBE_DEFER); ++ } + + padctl->regmap = dev_get_regmap(&pdev->dev, "usb_sleepwalk"); + if (!padctl->regmap) + dev_info(dev, "failed to find PMC regmap\n"); + ++ put_device(&pdev->dev); + out: + return &padctl->base; + } diff --git a/queue-5.15/phy-ti-pipe3-fix-device-leak-at-unbind.patch b/queue-5.15/phy-ti-pipe3-fix-device-leak-at-unbind.patch new file mode 100644 index 0000000000..407babeaa8 --- /dev/null +++ b/queue-5.15/phy-ti-pipe3-fix-device-leak-at-unbind.patch @@ -0,0 +1,58 @@ +From e19bcea99749ce8e8f1d359f68ae03210694ad56 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 15:12:06 +0200 +Subject: phy: ti-pipe3: fix device leak at unbind + +From: Johan Hovold + +commit e19bcea99749ce8e8f1d359f68ae03210694ad56 upstream. + +Make sure to drop the reference to the control device taken by +of_find_device_by_node() during probe when the driver is unbound. + +Fixes: 918ee0d21ba4 ("usb: phy: omap-usb3: Don't use omap_get_control_dev()") +Cc: stable@vger.kernel.org # 3.13 +Cc: Roger Quadros +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724131206.2211-4-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/ti/phy-ti-pipe3.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/phy/ti/phy-ti-pipe3.c ++++ b/drivers/phy/ti/phy-ti-pipe3.c +@@ -666,12 +666,20 @@ static int ti_pipe3_get_clk(struct ti_pi + return 0; + } + ++static void ti_pipe3_put_device(void *_dev) ++{ ++ struct device *dev = _dev; ++ ++ put_device(dev); ++} ++ + static int ti_pipe3_get_sysctrl(struct ti_pipe3 *phy) + { + struct device *dev = phy->dev; + struct device_node *node = dev->of_node; + struct device_node *control_node; + struct platform_device *control_pdev; ++ int ret; + + phy->phy_power_syscon = syscon_regmap_lookup_by_phandle(node, + "syscon-phy-power"); +@@ -702,6 +710,11 @@ static int ti_pipe3_get_sysctrl(struct t + } + + phy->control_dev = &control_pdev->dev; ++ ++ ret = devm_add_action_or_reset(dev, ti_pipe3_put_device, ++ phy->control_dev); ++ if (ret) ++ return ret; + } + + if (phy->mode == PIPE3_MODE_PCIE) { diff --git a/queue-5.15/series b/queue-5.15/series index 7f68f3d741..8828c88f16 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -55,3 +55,7 @@ regulator-sy7636a-fix-lifecycle-of-power-good-gpio.patch hrtimer-remove-unused-function.patch hrtimer-rename-__hrtimer_hres_active-to-hrtimer_hres.patch hrtimers-unconditionally-update-target-cpu-base-afte.patch +xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch +dmaengine-qcom-bam_dma-fix-dt-error-handling-for-num-channels-ees.patch +phy-tegra-xusb-fix-device-and-of-node-leak-at-probe.patch +phy-ti-pipe3-fix-device-leak-at-unbind.patch diff --git a/queue-5.15/xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch b/queue-5.15/xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch new file mode 100644 index 0000000000..228d493337 --- /dev/null +++ b/queue-5.15/xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch @@ -0,0 +1,86 @@ +From a5c98e8b1398534ae1feb6e95e2d3ee5215538ed Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 2 Sep 2025 13:53:05 +0300 +Subject: xhci: dbc: Fix full DbC transfer ring after several reconnects + +From: Mathias Nyman + +commit a5c98e8b1398534ae1feb6e95e2d3ee5215538ed upstream. + +Pending requests will be flushed on disconnect, and the corresponding +TRBs will be turned into No-op TRBs, which are ignored by the xHC +controller once it starts processing the ring. + +If the USB debug cable repeatedly disconnects before ring is started +then the ring will eventually be filled with No-op TRBs. +No new transfers can be queued when the ring is full, and driver will +print the following error message: + + "xhci_hcd 0000:00:14.0: failed to queue trbs" + +This is a normal case for 'in' transfers where TRBs are always enqueued +in advance, ready to take on incoming data. If no data arrives, and +device is disconnected, then ring dequeue will remain at beginning of +the ring while enqueue points to first free TRB after last cancelled +No-op TRB. +s +Solve this by reinitializing the rings when the debug cable disconnects +and DbC is leaving the configured state. +Clear the whole ring buffer and set enqueue and dequeue to the beginning +of ring, and set cycle bit to its initial state. + +Cc: stable@vger.kernel.org +Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250902105306.877476-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-dbgcap.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -421,6 +421,25 @@ dbc_alloc_ctx(struct device *dev, gfp_t + return ctx; + } + ++static int xhci_dbc_reinit_ep_rings(struct xhci_dbc *dbc) ++{ ++ struct xhci_ring *in_ring = dbc->eps[BULK_IN].ring; ++ struct xhci_ring *out_ring = dbc->eps[BULK_OUT].ring; ++ ++ if (!in_ring || !out_ring || !dbc->ctx) { ++ dev_warn(dbc->dev, "Can't re-init unallocated endpoints\n"); ++ return -ENODEV; ++ } ++ ++ xhci_dbc_ring_init(in_ring); ++ xhci_dbc_ring_init(out_ring); ++ ++ /* set ep context enqueue, dequeue, and cycle to initial values */ ++ xhci_dbc_init_ep_contexts(dbc); ++ ++ return 0; ++} ++ + static struct xhci_ring * + xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags) + { +@@ -850,7 +869,7 @@ static enum evtreturn xhci_dbc_do_handle + dev_info(dbc->dev, "DbC cable unplugged\n"); + dbc->state = DS_ENABLED; + xhci_dbc_flush_requests(dbc); +- ++ xhci_dbc_reinit_ep_rings(dbc); + return EVT_DISC; + } + +@@ -860,7 +879,7 @@ static enum evtreturn xhci_dbc_do_handle + writel(portsc, &dbc->regs->portsc); + dbc->state = DS_ENABLED; + xhci_dbc_flush_requests(dbc); +- ++ xhci_dbc_reinit_ep_rings(dbc); + return EVT_DISC; + } + -- 2.47.3