From 51062a375711ede0fe66bec39e4fc541429848dd Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 23 Sep 2022 12:54:10 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...ke-sure-to-init-common-ip-before-gmc.patch | 73 +++ ...ate-vf2pf-work-item-init-from-virt-d.patch | 133 +++++ ...correct-microchip-device-addr-proper.patch | 45 ++ ...switch-to-generic-firmware-propertie.patch | 69 +++ ...s-fix-memory-leak-when-using-debugfs.patch | 51 ++ ...as-fix-rtas-msr-hv-handling-for-cell.patch | 76 +++ ...e-rtas-entry-assembly-into-its-own-f.patch | 462 ++++++++++++++++++ ...b-add-quirks-for-lenovo-onelink-dock.patch | 43 ++ ...t-udc-xilinx-replace-memcpy-with-mem.patch | 96 ++++ queue-5.15/series | 19 + ...add-rosewill-usb-n150-nano-to-device.patch | 38 ++ ...remove-support-for-devices-with-8188.patch | 44 ++ ...b-add-quirks-for-lenovo-onelink-dock.patch | 51 ++ ...avoid-duplicate-requests-to-enable-r.patch | 57 +++ ...avoid-starting-dwc3-gadget-during-ud.patch | 90 ++++ ...et-don-t-modify-gevntcount-in-pullup.patch | 111 +++++ ...sb-dwc3-gadget-prevent-repeat-pullup.patch | 45 ++ .../usb-dwc3-gadget-refactor-pullup.patch | 115 +++++ ...ore-soft-reset-before-enabling-run-s.patch | 86 ++++ ...ilinx-replace-memcpy-with-memcpy_toi.patch | 156 ++++++ 20 files changed, 1860 insertions(+) create mode 100644 queue-5.15/drm-amdgpu-make-sure-to-init-common-ip-before-gmc.patch create mode 100644 queue-5.15/drm-amdgpu-separate-vf2pf-work-item-init-from-virt-d.patch create mode 100644 queue-5.15/iio-adc-mcp3911-correct-microchip-device-addr-proper.patch create mode 100644 queue-5.15/iio-adc-mcp3911-switch-to-generic-firmware-propertie.patch create mode 100644 queue-5.15/net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs.patch create mode 100644 queue-5.15/powerpc-rtas-fix-rtas-msr-hv-handling-for-cell.patch create mode 100644 queue-5.15/powerpc-rtas-move-rtas-entry-assembly-into-its-own-f.patch create mode 100644 queue-5.15/revert-usb-add-quirks-for-lenovo-onelink-dock.patch create mode 100644 queue-5.15/revert-usb-gadget-udc-xilinx-replace-memcpy-with-mem.patch create mode 100644 queue-5.15/series create mode 100644 queue-5.15/staging-r8188eu-add-rosewill-usb-n150-nano-to-device.patch create mode 100644 queue-5.15/staging-r8188eu-remove-support-for-devices-with-8188.patch create mode 100644 queue-5.15/usb-add-quirks-for-lenovo-onelink-dock.patch create mode 100644 queue-5.15/usb-dwc3-gadget-avoid-duplicate-requests-to-enable-r.patch create mode 100644 queue-5.15/usb-dwc3-gadget-avoid-starting-dwc3-gadget-during-ud.patch create mode 100644 queue-5.15/usb-dwc3-gadget-don-t-modify-gevntcount-in-pullup.patch create mode 100644 queue-5.15/usb-dwc3-gadget-prevent-repeat-pullup.patch create mode 100644 queue-5.15/usb-dwc3-gadget-refactor-pullup.patch create mode 100644 queue-5.15/usb-dwc3-issue-core-soft-reset-before-enabling-run-s.patch create mode 100644 queue-5.15/usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toi.patch diff --git a/queue-5.15/drm-amdgpu-make-sure-to-init-common-ip-before-gmc.patch b/queue-5.15/drm-amdgpu-make-sure-to-init-common-ip-before-gmc.patch new file mode 100644 index 00000000000..774f7301eae --- /dev/null +++ b/queue-5.15/drm-amdgpu-make-sure-to-init-common-ip-before-gmc.patch @@ -0,0 +1,73 @@ +From f2c929293b245e176cc845a5335a9e7f21214d93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 10:59:49 -0400 +Subject: drm/amdgpu: make sure to init common IP before gmc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit a8671493d2074950553da3cf07d1be43185ef6c6 ] + +Move common IP init before GMC init so that HDP gets +remapped before GMC init which uses it. + +This fixes the Unsupported Request error reported through +AER during driver load. The error happens as a write happens +to the remap offset before real remapping is done. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216373 + +The error was unnoticed before and got visible because of the commit +referenced below. This doesn't fix anything in the commit below, rather +fixes the issue in amdgpu exposed by the commit. The reference is only +to associate this commit with below one so that both go together. + +Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()") + +Acked-by: Christian König +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index f443b4630f9d..7450773821f4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2388,8 +2388,16 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + } + adev->ip_blocks[i].status.sw = true; + +- /* need to do gmc hw init early so we can allocate gpu mem */ +- if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) { ++ if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_COMMON) { ++ /* need to do common hw init early so everything is set up for gmc */ ++ r = adev->ip_blocks[i].version->funcs->hw_init((void *)adev); ++ if (r) { ++ DRM_ERROR("hw_init %d failed %d\n", i, r); ++ goto init_failed; ++ } ++ adev->ip_blocks[i].status.hw = true; ++ } else if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) { ++ /* need to do gmc hw init early so we can allocate gpu mem */ + /* Try to reserve bad pages early */ + if (amdgpu_sriov_vf(adev)) + amdgpu_virt_exchange_data(adev); +@@ -3037,8 +3045,8 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev) + int i, r; + + static enum amd_ip_block_type ip_order[] = { +- AMD_IP_BLOCK_TYPE_GMC, + AMD_IP_BLOCK_TYPE_COMMON, ++ AMD_IP_BLOCK_TYPE_GMC, + AMD_IP_BLOCK_TYPE_PSP, + AMD_IP_BLOCK_TYPE_IH, + }; +-- +2.35.1 + diff --git a/queue-5.15/drm-amdgpu-separate-vf2pf-work-item-init-from-virt-d.patch b/queue-5.15/drm-amdgpu-separate-vf2pf-work-item-init-from-virt-d.patch new file mode 100644 index 00000000000..40b4112cf89 --- /dev/null +++ b/queue-5.15/drm-amdgpu-separate-vf2pf-work-item-init-from-virt-d.patch @@ -0,0 +1,133 @@ +From 0899699a611e4319114607c3f68d3fb813496dbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Dec 2021 17:01:45 +0000 +Subject: drm/amdgpu: Separate vf2pf work item init from virt data exchange + +From: Victor Skvortsov + +[ Upstream commit 892deb48269c65376f3eeb5b4c032ff2c2979bd7 ] + +We want to be able to call virt data exchange conditionally +after gmc sw init to reserve bad pages as early as possible. +Since this is a conditional call, we will need +to call it again unconditionally later in the init sequence. + +Refactor the data exchange function so it can be +called multiple times without re-initializing the work item. + +v2: Cleaned up the code. Kept the original call to init_exchange_data() +inside early init to initialize the work item, afterwards call +exchange_data() when needed. + +Signed-off-by: Victor Skvortsov +Reviewed By: Shaoyun.liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +++- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 36 ++++++++++++++-------- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 1 + + 3 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d1af709cc7dc..f443b4630f9d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2390,6 +2390,10 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + + /* need to do gmc hw init early so we can allocate gpu mem */ + if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) { ++ /* Try to reserve bad pages early */ ++ if (amdgpu_sriov_vf(adev)) ++ amdgpu_virt_exchange_data(adev); ++ + r = amdgpu_device_vram_scratch_init(adev); + if (r) { + DRM_ERROR("amdgpu_vram_scratch_init failed %d\n", r); +@@ -2421,7 +2425,7 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + } + + if (amdgpu_sriov_vf(adev)) +- amdgpu_virt_init_data_exchange(adev); ++ amdgpu_virt_exchange_data(adev); + + r = amdgpu_ib_pool_init(adev); + if (r) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 16787c675f35..cce03aad5f0e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -614,17 +614,35 @@ void amdgpu_virt_fini_data_exchange(struct amdgpu_device *adev) + + void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev) + { +- uint64_t bp_block_offset = 0; +- uint32_t bp_block_size = 0; +- struct amd_sriov_msg_pf2vf_info *pf2vf_v2 = NULL; +- + adev->virt.fw_reserve.p_pf2vf = NULL; + adev->virt.fw_reserve.p_vf2pf = NULL; + adev->virt.vf2pf_update_interval_ms = 0; + +- if (adev->mman.fw_vram_usage_va != NULL) { ++ if (adev->bios != NULL) { + adev->virt.vf2pf_update_interval_ms = 2000; + ++ adev->virt.fw_reserve.p_pf2vf = ++ (struct amd_sriov_msg_pf2vf_info_header *) ++ (adev->bios + (AMD_SRIOV_MSG_PF2VF_OFFSET_KB << 10)); ++ ++ amdgpu_virt_read_pf2vf_data(adev); ++ } ++ ++ if (adev->virt.vf2pf_update_interval_ms != 0) { ++ INIT_DELAYED_WORK(&adev->virt.vf2pf_work, amdgpu_virt_update_vf2pf_work_item); ++ schedule_delayed_work(&(adev->virt.vf2pf_work), msecs_to_jiffies(adev->virt.vf2pf_update_interval_ms)); ++ } ++} ++ ++ ++void amdgpu_virt_exchange_data(struct amdgpu_device *adev) ++{ ++ uint64_t bp_block_offset = 0; ++ uint32_t bp_block_size = 0; ++ struct amd_sriov_msg_pf2vf_info *pf2vf_v2 = NULL; ++ ++ if (adev->mman.fw_vram_usage_va != NULL) { ++ + adev->virt.fw_reserve.p_pf2vf = + (struct amd_sriov_msg_pf2vf_info_header *) + (adev->mman.fw_vram_usage_va + (AMD_SRIOV_MSG_PF2VF_OFFSET_KB << 10)); +@@ -655,16 +673,10 @@ void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev) + (adev->bios + (AMD_SRIOV_MSG_PF2VF_OFFSET_KB << 10)); + + amdgpu_virt_read_pf2vf_data(adev); +- +- return; +- } +- +- if (adev->virt.vf2pf_update_interval_ms != 0) { +- INIT_DELAYED_WORK(&adev->virt.vf2pf_work, amdgpu_virt_update_vf2pf_work_item); +- schedule_delayed_work(&(adev->virt.vf2pf_work), adev->virt.vf2pf_update_interval_ms); + } + } + ++ + void amdgpu_detect_virtualization(struct amdgpu_device *adev) + { + uint32_t reg; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +index 8d4c20bb71c5..9adfb8d63280 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +@@ -308,6 +308,7 @@ int amdgpu_virt_alloc_mm_table(struct amdgpu_device *adev); + void amdgpu_virt_free_mm_table(struct amdgpu_device *adev); + void amdgpu_virt_release_ras_err_handler_data(struct amdgpu_device *adev); + void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev); ++void amdgpu_virt_exchange_data(struct amdgpu_device *adev); + void amdgpu_virt_fini_data_exchange(struct amdgpu_device *adev); + void amdgpu_detect_virtualization(struct amdgpu_device *adev); + +-- +2.35.1 + diff --git a/queue-5.15/iio-adc-mcp3911-correct-microchip-device-addr-proper.patch b/queue-5.15/iio-adc-mcp3911-correct-microchip-device-addr-proper.patch new file mode 100644 index 00000000000..24c9ddd8198 --- /dev/null +++ b/queue-5.15/iio-adc-mcp3911-correct-microchip-device-addr-proper.patch @@ -0,0 +1,45 @@ +From 2dd64f7c6962c18d86d7cf6702143ae4b984a426 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jul 2022 15:07:19 +0200 +Subject: iio: adc: mcp3911: correct "microchip,device-addr" property + +From: Marcus Folkesson + +[ Upstream commit cfbd76d5c9c449739bb74288d982bccf9ff822f4 ] + +Go for the right property name that is documented in the bindings. + +Fixes: 3a89b289df5d ("iio: adc: add support for mcp3911") +Signed-off-by: Marcus Folkesson +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220722130726.7627-3-marcus.folkesson@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/mcp3911.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c +index 608842632925..7eecbfd491a4 100644 +--- a/drivers/iio/adc/mcp3911.c ++++ b/drivers/iio/adc/mcp3911.c +@@ -217,7 +217,14 @@ static int mcp3911_config(struct mcp3911 *adc) + u32 configreg; + int ret; + +- device_property_read_u32(dev, "device-addr", &adc->dev_addr); ++ ret = device_property_read_u32(dev, "microchip,device-addr", &adc->dev_addr); ++ ++ /* ++ * Fallback to "device-addr" due to historical mismatch between ++ * dt-bindings and implementation ++ */ ++ if (ret) ++ device_property_read_u32(dev, "device-addr", &adc->dev_addr); + if (adc->dev_addr > 3) { + dev_err(&adc->spi->dev, + "invalid device address (%i). Must be in range 0-3.\n", +-- +2.35.1 + diff --git a/queue-5.15/iio-adc-mcp3911-switch-to-generic-firmware-propertie.patch b/queue-5.15/iio-adc-mcp3911-switch-to-generic-firmware-propertie.patch new file mode 100644 index 00000000000..e507fb8e7ad --- /dev/null +++ b/queue-5.15/iio-adc-mcp3911-switch-to-generic-firmware-propertie.patch @@ -0,0 +1,69 @@ +From 92871497273d9f3d3ef377073a6fb668e7ba461c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Dec 2021 17:01:36 +0000 +Subject: iio:adc:mcp3911: Switch to generic firmware properties. + +From: Jonathan Cameron + +[ Upstream commit 4efc1c614d334883cce09c38aa3fe74d3fb0bbf0 ] + +This allows use of the driver with other types of firmware such as ACPI +PRP0001 based probing. + +Also part of a general attempt to remove direct use of of_ specific +accessors from IIO. + +Added an include for mod_devicetable.h whilst here to cover the +struct of_device_id definition. + +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Cc: Kent Gustavsson +Reviewed-by: Marcus Folkesson +Stable-dep-of: cfbd76d5c9c4 ("iio: adc: mcp3911: correct "microchip,device-addr" property") +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/mcp3911.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c +index 65278270a75c..608842632925 100644 +--- a/drivers/iio/adc/mcp3911.c ++++ b/drivers/iio/adc/mcp3911.c +@@ -10,6 +10,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + +@@ -209,12 +211,13 @@ static const struct iio_info mcp3911_info = { + .write_raw = mcp3911_write_raw, + }; + +-static int mcp3911_config(struct mcp3911 *adc, struct device_node *of_node) ++static int mcp3911_config(struct mcp3911 *adc) + { ++ struct device *dev = &adc->spi->dev; + u32 configreg; + int ret; + +- of_property_read_u32(of_node, "device-addr", &adc->dev_addr); ++ device_property_read_u32(dev, "device-addr", &adc->dev_addr); + if (adc->dev_addr > 3) { + dev_err(&adc->spi->dev, + "invalid device address (%i). Must be in range 0-3.\n", +@@ -298,7 +301,7 @@ static int mcp3911_probe(struct spi_device *spi) + } + } + +- ret = mcp3911_config(adc, spi->dev.of_node); ++ ret = mcp3911_config(adc); + if (ret) + goto clk_disable; + +-- +2.35.1 + diff --git a/queue-5.15/net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs.patch b/queue-5.15/net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs.patch new file mode 100644 index 00000000000..d85b6a64a5a --- /dev/null +++ b/queue-5.15/net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs.patch @@ -0,0 +1,51 @@ +From 676abb5e750b97bb96bb428eade0927e86d33761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 15:41:11 +0200 +Subject: net: mvpp2: debugfs: fix memory leak when using debugfs_lookup() + +From: Greg Kroah-Hartman + +[ Upstream commit fe2c9c61f668cde28dac2b188028c5299cedcc1e ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. Fix this up to be much +simpler logic and only create the root debugfs directory once when the +driver is first accessed. That resolves the memory leak and makes +things more obvious as to what the intent is. + +Cc: Marcin Wojtas +Cc: Russell King +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: netdev@vger.kernel.org +Cc: stable +Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Parser") +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +index 4a3baa7e0142..0eec05d905eb 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +@@ -700,10 +700,10 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) + + void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) + { +- struct dentry *mvpp2_dir, *mvpp2_root; ++ static struct dentry *mvpp2_root; ++ struct dentry *mvpp2_dir; + int ret, i; + +- mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL); + if (!mvpp2_root) + mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); + +-- +2.35.1 + diff --git a/queue-5.15/powerpc-rtas-fix-rtas-msr-hv-handling-for-cell.patch b/queue-5.15/powerpc-rtas-fix-rtas-msr-hv-handling-for-cell.patch new file mode 100644 index 00000000000..55c0aa2575f --- /dev/null +++ b/queue-5.15/powerpc-rtas-fix-rtas-msr-hv-handling-for-cell.patch @@ -0,0 +1,76 @@ +From 8e583e1ed46f6b1ea3d883202240a4efc9c1ed3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 21:59:52 +1000 +Subject: powerpc/rtas: Fix RTAS MSR[HV] handling for Cell + +From: Michael Ellerman + +[ Upstream commit 91926d8b7e71aaf5f84f0cf208fc5a8b7a761050 ] + +The semi-recent changes to MSR handling when entering RTAS (firmware) +cause crashes on IBM Cell machines. An example trace: + + kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0) + BUG: Unable to handle kernel instruction fetch + Faulting instruction address: 0x2fff01a8 + Oops: Kernel access of bad area, sig: 11 [#1] + BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=4 NUMA Cell + Modules linked in: + CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.0.0-rc2-00433-gede0a8d3307a #207 + NIP: 000000002fff01a8 LR: 0000000000032608 CTR: 0000000000000000 + REGS: c0000000015236b0 TRAP: 0400 Tainted: G W (6.0.0-rc2-00433-gede0a8d3307a) + MSR: 0000000008001002 CR: 00000000 XER: 20000000 + ... + NIP 0x2fff01a8 + LR 0x32608 + Call Trace: + 0xc00000000143c5f8 (unreliable) + .rtas_call+0x224/0x320 + .rtas_get_boot_time+0x70/0x150 + .read_persistent_clock64+0x114/0x140 + .read_persistent_wall_and_boot_offset+0x24/0x80 + .timekeeping_init+0x40/0x29c + .start_kernel+0x674/0x8f0 + start_here_common+0x1c/0x50 + +Unlike PAPR platforms where RTAS is only used in guests, on the IBM Cell +machines Linux runs with MSR[HV] set but also uses RTAS, provided by +SLOF. + +Fix it by copying the MSR[HV] bit from the MSR value we've just read +using mfmsr into the value used for RTAS. + +It seems like we could also fix it using an #ifdef CELL to set MSR[HV], +but that doesn't work because it's possible to build a single kernel +image that runs on both Cell native and pseries. + +Fixes: b6b1c3ce06ca ("powerpc/rtas: Keep MSR[RI] set when calling RTAS") +Cc: stable@vger.kernel.org # v5.19+ +Signed-off-by: Michael Ellerman +Reviewed-by: Jordan Niethe +Link: https://lore.kernel.org/r/20220823115952.1203106-2-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas_entry.S | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/kernel/rtas_entry.S b/arch/powerpc/kernel/rtas_entry.S +index 9ae1ca3c6fca..69dd8dd36689 100644 +--- a/arch/powerpc/kernel/rtas_entry.S ++++ b/arch/powerpc/kernel/rtas_entry.S +@@ -125,8 +125,12 @@ __enter_rtas: + * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S] + * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if + * MSR[S] is set, it will remain when entering RTAS. ++ * If we're in HV mode, RTAS must also run in HV mode, so extract MSR_HV ++ * from the saved MSR value and insert into the value RTAS will use. + */ ++ extrdi r0, r6, 1, 63 - MSR_HV_LG + LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI) ++ insrdi r6, r0, 1, 63 - MSR_HV_LG + + li r0,0 + mtmsrd r0,1 /* disable RI before using SRR0/1 */ +-- +2.35.1 + diff --git a/queue-5.15/powerpc-rtas-move-rtas-entry-assembly-into-its-own-f.patch b/queue-5.15/powerpc-rtas-move-rtas-entry-assembly-into-its-own-f.patch new file mode 100644 index 00000000000..45406a9d712 --- /dev/null +++ b/queue-5.15/powerpc-rtas-move-rtas-entry-assembly-into-its-own-f.patch @@ -0,0 +1,462 @@ +From 32b7b58ac53edb647532407a053c45927ea69bfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 23:50:34 +1000 +Subject: powerpc/rtas: Move rtas entry assembly into its own file + +From: Nicholas Piggin + +[ Upstream commit 838ee286ecc9a3c76e6bd8f5aaad0c8c5c66b9ca ] + +This makes working on the code a bit easier. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220308135047.478297-2-npiggin@gmail.com +Stable-dep-of: 91926d8b7e71 ("powerpc/rtas: Fix RTAS MSR[HV] handling for Cell") +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/Makefile | 2 +- + arch/powerpc/kernel/entry_32.S | 49 -------- + arch/powerpc/kernel/entry_64.S | 150 ----------------------- + arch/powerpc/kernel/rtas_entry.S | 198 +++++++++++++++++++++++++++++++ + 4 files changed, 199 insertions(+), 200 deletions(-) + create mode 100644 arch/powerpc/kernel/rtas_entry.S + +diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile +index ed91d5b9ffc6..df1692020693 100644 +--- a/arch/powerpc/kernel/Makefile ++++ b/arch/powerpc/kernel/Makefile +@@ -69,7 +69,7 @@ obj-$(CONFIG_PPC_BOOK3S_IDLE) += idle_book3s.o + procfs-y := proc_powerpc.o + obj-$(CONFIG_PROC_FS) += $(procfs-y) + rtaspci-$(CONFIG_PPC64)-$(CONFIG_PCI) := rtas_pci.o +-obj-$(CONFIG_PPC_RTAS) += rtas.o rtas-rtc.o $(rtaspci-y-y) ++obj-$(CONFIG_PPC_RTAS) += rtas_entry.o rtas.o rtas-rtc.o $(rtaspci-y-y) + obj-$(CONFIG_PPC_RTAS_DAEMON) += rtasd.o + obj-$(CONFIG_RTAS_FLASH) += rtas_flash.o + obj-$(CONFIG_RTAS_PROC) += rtas-proc.o +diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S +index c62dd9815965..77b6b0e4b752 100644 +--- a/arch/powerpc/kernel/entry_32.S ++++ b/arch/powerpc/kernel/entry_32.S +@@ -526,52 +526,3 @@ ret_from_mcheck_exc: + _ASM_NOKPROBE_SYMBOL(ret_from_mcheck_exc) + #endif /* CONFIG_BOOKE */ + #endif /* !(CONFIG_4xx || CONFIG_BOOKE) */ +- +-/* +- * PROM code for specific machines follows. Put it +- * here so it's easy to add arch-specific sections later. +- * -- Cort +- */ +-#ifdef CONFIG_PPC_RTAS +-/* +- * On CHRP, the Run-Time Abstraction Services (RTAS) have to be +- * called with the MMU off. +- */ +-_GLOBAL(enter_rtas) +- stwu r1,-INT_FRAME_SIZE(r1) +- mflr r0 +- stw r0,INT_FRAME_SIZE+4(r1) +- LOAD_REG_ADDR(r4, rtas) +- lis r6,1f@ha /* physical return address for rtas */ +- addi r6,r6,1f@l +- tophys(r6,r6) +- lwz r8,RTASENTRY(r4) +- lwz r4,RTASBASE(r4) +- mfmsr r9 +- stw r9,8(r1) +- LOAD_REG_IMMEDIATE(r0,MSR_KERNEL) +- mtmsr r0 /* disable interrupts so SRR0/1 don't get trashed */ +- li r9,MSR_KERNEL & ~(MSR_IR|MSR_DR) +- mtlr r6 +- stw r1, THREAD + RTAS_SP(r2) +- mtspr SPRN_SRR0,r8 +- mtspr SPRN_SRR1,r9 +- rfi +-1: +- lis r8, 1f@h +- ori r8, r8, 1f@l +- LOAD_REG_IMMEDIATE(r9,MSR_KERNEL) +- mtspr SPRN_SRR0,r8 +- mtspr SPRN_SRR1,r9 +- rfi /* Reactivate MMU translation */ +-1: +- lwz r8,INT_FRAME_SIZE+4(r1) /* get return address */ +- lwz r9,8(r1) /* original msr value */ +- addi r1,r1,INT_FRAME_SIZE +- li r0,0 +- stw r0, THREAD + RTAS_SP(r2) +- mtlr r8 +- mtmsr r9 +- blr /* return to caller */ +-_ASM_NOKPROBE_SYMBOL(enter_rtas) +-#endif /* CONFIG_PPC_RTAS */ +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S +index 07a1448146e2..d1ec22fe59f6 100644 +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -264,156 +264,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) + addi r1,r1,SWITCH_FRAME_SIZE + blr + +-#ifdef CONFIG_PPC_RTAS +-/* +- * On CHRP, the Run-Time Abstraction Services (RTAS) have to be +- * called with the MMU off. +- * +- * In addition, we need to be in 32b mode, at least for now. +- * +- * Note: r3 is an input parameter to rtas, so don't trash it... +- */ +-_GLOBAL(enter_rtas) +- mflr r0 +- std r0,16(r1) +- stdu r1,-SWITCH_FRAME_SIZE(r1) /* Save SP and create stack space. */ +- +- /* Because RTAS is running in 32b mode, it clobbers the high order half +- * of all registers that it saves. We therefore save those registers +- * RTAS might touch to the stack. (r0, r3-r13 are caller saved) +- */ +- SAVE_GPR(2, r1) /* Save the TOC */ +- SAVE_GPR(13, r1) /* Save paca */ +- SAVE_NVGPRS(r1) /* Save the non-volatiles */ +- +- mfcr r4 +- std r4,_CCR(r1) +- mfctr r5 +- std r5,_CTR(r1) +- mfspr r6,SPRN_XER +- std r6,_XER(r1) +- mfdar r7 +- std r7,_DAR(r1) +- mfdsisr r8 +- std r8,_DSISR(r1) +- +- /* Temporary workaround to clear CR until RTAS can be modified to +- * ignore all bits. +- */ +- li r0,0 +- mtcr r0 +- +-#ifdef CONFIG_BUG +- /* There is no way it is acceptable to get here with interrupts enabled, +- * check it with the asm equivalent of WARN_ON +- */ +- lbz r0,PACAIRQSOFTMASK(r13) +-1: tdeqi r0,IRQS_ENABLED +- EMIT_WARN_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING +-#endif +- +- /* Hard-disable interrupts */ +- mfmsr r6 +- rldicl r7,r6,48,1 +- rotldi r7,r7,16 +- mtmsrd r7,1 +- +- /* Unfortunately, the stack pointer and the MSR are also clobbered, +- * so they are saved in the PACA which allows us to restore +- * our original state after RTAS returns. +- */ +- std r1,PACAR1(r13) +- std r6,PACASAVEDMSR(r13) +- +- /* Setup our real return addr */ +- LOAD_REG_ADDR(r4,rtas_return_loc) +- clrldi r4,r4,2 /* convert to realmode address */ +- mtlr r4 +- +-__enter_rtas: +- LOAD_REG_ADDR(r4, rtas) +- ld r5,RTASENTRY(r4) /* get the rtas->entry value */ +- ld r4,RTASBASE(r4) /* get the rtas->base value */ +- +- /* +- * RTAS runs in 32-bit big endian real mode, but leave MSR[RI] on as we +- * may hit NMI (SRESET or MCE) while in RTAS. RTAS should disable RI in +- * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S] +- * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if +- * MSR[S] is set, it will remain when entering RTAS. +- */ +- LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI) +- +- li r0,0 +- mtmsrd r0,1 /* disable RI before using SRR0/1 */ +- +- mtspr SPRN_SRR0,r5 +- mtspr SPRN_SRR1,r6 +- RFI_TO_KERNEL +- b . /* prevent speculative execution */ +- +-rtas_return_loc: +- FIXUP_ENDIAN +- +- /* +- * Clear RI and set SF before anything. +- */ +- mfmsr r6 +- li r0,MSR_RI +- andc r6,r6,r0 +- sldi r0,r0,(MSR_SF_LG - MSR_RI_LG) +- or r6,r6,r0 +- sync +- mtmsrd r6 +- +- /* relocation is off at this point */ +- GET_PACA(r4) +- clrldi r4,r4,2 /* convert to realmode address */ +- +- bcl 20,31,$+4 +-0: mflr r3 +- ld r3,(1f-0b)(r3) /* get &rtas_restore_regs */ +- +- ld r1,PACAR1(r4) /* Restore our SP */ +- ld r4,PACASAVEDMSR(r4) /* Restore our MSR */ +- +- mtspr SPRN_SRR0,r3 +- mtspr SPRN_SRR1,r4 +- RFI_TO_KERNEL +- b . /* prevent speculative execution */ +-_ASM_NOKPROBE_SYMBOL(__enter_rtas) +-_ASM_NOKPROBE_SYMBOL(rtas_return_loc) +- +- .align 3 +-1: .8byte rtas_restore_regs +- +-rtas_restore_regs: +- /* relocation is on at this point */ +- REST_GPR(2, r1) /* Restore the TOC */ +- REST_GPR(13, r1) /* Restore paca */ +- REST_NVGPRS(r1) /* Restore the non-volatiles */ +- +- GET_PACA(r13) +- +- ld r4,_CCR(r1) +- mtcr r4 +- ld r5,_CTR(r1) +- mtctr r5 +- ld r6,_XER(r1) +- mtspr SPRN_XER,r6 +- ld r7,_DAR(r1) +- mtdar r7 +- ld r8,_DSISR(r1) +- mtdsisr r8 +- +- addi r1,r1,SWITCH_FRAME_SIZE /* Unstack our frame */ +- ld r0,16(r1) /* get return address */ +- +- mtlr r0 +- blr /* return to caller */ +- +-#endif /* CONFIG_PPC_RTAS */ +- + _GLOBAL(enter_prom) + mflr r0 + std r0,16(r1) +diff --git a/arch/powerpc/kernel/rtas_entry.S b/arch/powerpc/kernel/rtas_entry.S +new file mode 100644 +index 000000000000..9ae1ca3c6fca +--- /dev/null ++++ b/arch/powerpc/kernel/rtas_entry.S +@@ -0,0 +1,198 @@ ++/* SPDX-License-Identifier: GPL-2.0-or-later */ ++ ++#include ++#include ++#include ++#include ++ ++/* ++ * RTAS is called with MSR IR, DR, EE disabled, and LR in the return address. ++ * ++ * Note: r3 is an input parameter to rtas, so don't trash it... ++ */ ++ ++#ifdef CONFIG_PPC32 ++_GLOBAL(enter_rtas) ++ stwu r1,-INT_FRAME_SIZE(r1) ++ mflr r0 ++ stw r0,INT_FRAME_SIZE+4(r1) ++ LOAD_REG_ADDR(r4, rtas) ++ lis r6,1f@ha /* physical return address for rtas */ ++ addi r6,r6,1f@l ++ tophys(r6,r6) ++ lwz r8,RTASENTRY(r4) ++ lwz r4,RTASBASE(r4) ++ mfmsr r9 ++ stw r9,8(r1) ++ LOAD_REG_IMMEDIATE(r0,MSR_KERNEL) ++ mtmsr r0 /* disable interrupts so SRR0/1 don't get trashed */ ++ li r9,MSR_KERNEL & ~(MSR_IR|MSR_DR) ++ mtlr r6 ++ stw r1, THREAD + RTAS_SP(r2) ++ mtspr SPRN_SRR0,r8 ++ mtspr SPRN_SRR1,r9 ++ rfi ++1: ++ lis r8, 1f@h ++ ori r8, r8, 1f@l ++ LOAD_REG_IMMEDIATE(r9,MSR_KERNEL) ++ mtspr SPRN_SRR0,r8 ++ mtspr SPRN_SRR1,r9 ++ rfi /* Reactivate MMU translation */ ++1: ++ lwz r8,INT_FRAME_SIZE+4(r1) /* get return address */ ++ lwz r9,8(r1) /* original msr value */ ++ addi r1,r1,INT_FRAME_SIZE ++ li r0,0 ++ stw r0, THREAD + RTAS_SP(r2) ++ mtlr r8 ++ mtmsr r9 ++ blr /* return to caller */ ++_ASM_NOKPROBE_SYMBOL(enter_rtas) ++ ++#else /* CONFIG_PPC32 */ ++#include ++ ++/* ++ * 32-bit rtas on 64-bit machines has the additional problem that RTAS may ++ * not preserve the upper parts of registers it uses. ++ */ ++_GLOBAL(enter_rtas) ++ mflr r0 ++ std r0,16(r1) ++ stdu r1,-SWITCH_FRAME_SIZE(r1) /* Save SP and create stack space. */ ++ ++ /* Because RTAS is running in 32b mode, it clobbers the high order half ++ * of all registers that it saves. We therefore save those registers ++ * RTAS might touch to the stack. (r0, r3-r13 are caller saved) ++ */ ++ SAVE_GPR(2, r1) /* Save the TOC */ ++ SAVE_GPR(13, r1) /* Save paca */ ++ SAVE_NVGPRS(r1) /* Save the non-volatiles */ ++ ++ mfcr r4 ++ std r4,_CCR(r1) ++ mfctr r5 ++ std r5,_CTR(r1) ++ mfspr r6,SPRN_XER ++ std r6,_XER(r1) ++ mfdar r7 ++ std r7,_DAR(r1) ++ mfdsisr r8 ++ std r8,_DSISR(r1) ++ ++ /* Temporary workaround to clear CR until RTAS can be modified to ++ * ignore all bits. ++ */ ++ li r0,0 ++ mtcr r0 ++ ++#ifdef CONFIG_BUG ++ /* There is no way it is acceptable to get here with interrupts enabled, ++ * check it with the asm equivalent of WARN_ON ++ */ ++ lbz r0,PACAIRQSOFTMASK(r13) ++1: tdeqi r0,IRQS_ENABLED ++ EMIT_WARN_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING ++#endif ++ ++ /* Hard-disable interrupts */ ++ mfmsr r6 ++ rldicl r7,r6,48,1 ++ rotldi r7,r7,16 ++ mtmsrd r7,1 ++ ++ /* Unfortunately, the stack pointer and the MSR are also clobbered, ++ * so they are saved in the PACA which allows us to restore ++ * our original state after RTAS returns. ++ */ ++ std r1,PACAR1(r13) ++ std r6,PACASAVEDMSR(r13) ++ ++ /* Setup our real return addr */ ++ LOAD_REG_ADDR(r4,rtas_return_loc) ++ clrldi r4,r4,2 /* convert to realmode address */ ++ mtlr r4 ++ ++__enter_rtas: ++ LOAD_REG_ADDR(r4, rtas) ++ ld r5,RTASENTRY(r4) /* get the rtas->entry value */ ++ ld r4,RTASBASE(r4) /* get the rtas->base value */ ++ ++ /* ++ * RTAS runs in 32-bit big endian real mode, but leave MSR[RI] on as we ++ * may hit NMI (SRESET or MCE) while in RTAS. RTAS should disable RI in ++ * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S] ++ * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if ++ * MSR[S] is set, it will remain when entering RTAS. ++ */ ++ LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI) ++ ++ li r0,0 ++ mtmsrd r0,1 /* disable RI before using SRR0/1 */ ++ ++ mtspr SPRN_SRR0,r5 ++ mtspr SPRN_SRR1,r6 ++ RFI_TO_KERNEL ++ b . /* prevent speculative execution */ ++rtas_return_loc: ++ FIXUP_ENDIAN ++ ++ /* ++ * Clear RI and set SF before anything. ++ */ ++ mfmsr r6 ++ li r0,MSR_RI ++ andc r6,r6,r0 ++ sldi r0,r0,(MSR_SF_LG - MSR_RI_LG) ++ or r6,r6,r0 ++ sync ++ mtmsrd r6 ++ ++ /* relocation is off at this point */ ++ GET_PACA(r4) ++ clrldi r4,r4,2 /* convert to realmode address */ ++ ++ bcl 20,31,$+4 ++0: mflr r3 ++ ld r3,(1f-0b)(r3) /* get &rtas_restore_regs */ ++ ++ ld r1,PACAR1(r4) /* Restore our SP */ ++ ld r4,PACASAVEDMSR(r4) /* Restore our MSR */ ++ ++ mtspr SPRN_SRR0,r3 ++ mtspr SPRN_SRR1,r4 ++ RFI_TO_KERNEL ++ b . /* prevent speculative execution */ ++_ASM_NOKPROBE_SYMBOL(__enter_rtas) ++_ASM_NOKPROBE_SYMBOL(rtas_return_loc) ++ ++ .align 3 ++1: .8byte rtas_restore_regs ++ ++rtas_restore_regs: ++ /* relocation is on at this point */ ++ REST_GPR(2, r1) /* Restore the TOC */ ++ REST_GPR(13, r1) /* Restore paca */ ++ REST_NVGPRS(r1) /* Restore the non-volatiles */ ++ ++ GET_PACA(r13) ++ ++ ld r4,_CCR(r1) ++ mtcr r4 ++ ld r5,_CTR(r1) ++ mtctr r5 ++ ld r6,_XER(r1) ++ mtspr SPRN_XER,r6 ++ ld r7,_DAR(r1) ++ mtdar r7 ++ ld r8,_DSISR(r1) ++ mtdsisr r8 ++ ++ addi r1,r1,SWITCH_FRAME_SIZE /* Unstack our frame */ ++ ld r0,16(r1) /* get return address */ ++ ++ mtlr r0 ++ blr /* return to caller */ ++ ++#endif /* CONFIG_PPC32 */ +-- +2.35.1 + diff --git a/queue-5.15/revert-usb-add-quirks-for-lenovo-onelink-dock.patch b/queue-5.15/revert-usb-add-quirks-for-lenovo-onelink-dock.patch new file mode 100644 index 00000000000..bc5ab1f5195 --- /dev/null +++ b/queue-5.15/revert-usb-add-quirks-for-lenovo-onelink-dock.patch @@ -0,0 +1,43 @@ +From 8ad8b88c00db4ec026c38004ee9325265617cff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 10:34:25 +0200 +Subject: Revert "usb: add quirks for Lenovo OneLink+ Dock" + +From: Greg Kroah-Hartman + +[ Upstream commit 58bfe7d8e31014d7ce246788df99c56e3cfe6c68 ] + +This reverts commit 3d5f70949f1b1168fbb17d06eb5c57e984c56c58. + +The quirk does not work properly, more work is needed to determine what +should be done here. + +Reported-by: Oliver Neukum +Cc: Jean-Francois Le Fillatre +Cc: stable +Fixes: 3d5f70949f1b ("usb: add quirks for Lenovo OneLink+ Dock") +Link: https://lore.kernel.org/r/9a17ea86-079f-510d-e919-01bc53a6d09f@gmx.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/quirks.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 999b7c9697fc..f99a65a64588 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -437,10 +437,6 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + +- /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */ +- { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME }, +- { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME }, +- + /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */ + { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM }, + +-- +2.35.1 + diff --git a/queue-5.15/revert-usb-gadget-udc-xilinx-replace-memcpy-with-mem.patch b/queue-5.15/revert-usb-gadget-udc-xilinx-replace-memcpy-with-mem.patch new file mode 100644 index 00000000000..58950a57dae --- /dev/null +++ b/queue-5.15/revert-usb-gadget-udc-xilinx-replace-memcpy-with-mem.patch @@ -0,0 +1,96 @@ +From 86e97617480fb94eeae93b7254402b57c4e7fdeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 09:10:08 +0200 +Subject: Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio" + +From: Greg Kroah-Hartman + +[ Upstream commit fe0a2ac7c627b064c479ad0c3b25e531d342e048 ] + +This reverts commit 8cb339f1c1f04baede9d54c1e40ac96247a6393b as it +throws up a bunch of sparse warnings as reported by the kernel test +robot. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/r/202209020044.CX2PfZzM-lkp@intel.com +Fixes: 8cb339f1c1f0 ("usb: gadget: udc-xilinx: replace memcpy with memcpy_toio") +Cc: stable@vger.kernel.org +Cc: Linus Walleij +Cc: Piyush Mehta +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/udc-xilinx.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c +index 218d9423807a..9cf43731bcd1 100644 +--- a/drivers/usb/gadget/udc/udc-xilinx.c ++++ b/drivers/usb/gadget/udc/udc-xilinx.c +@@ -496,11 +496,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req, + /* Get the Buffer address and copy the transmit data.*/ + eprambase = (u32 __force *)(udc->addr + ep->rambase); + if (ep->is_in) { +- memcpy_toio(eprambase, bufferptr, bytestosend); ++ memcpy(eprambase, bufferptr, bytestosend); + udc->write_fn(udc->addr, ep->offset + + XUSB_EP_BUF0COUNT_OFFSET, bufferlen); + } else { +- memcpy_toio(bufferptr, eprambase, bytestosend); ++ memcpy(bufferptr, eprambase, bytestosend); + } + /* + * Enable the buffer for transmission. +@@ -514,11 +514,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req, + eprambase = (u32 __force *)(udc->addr + ep->rambase + + ep->ep_usb.maxpacket); + if (ep->is_in) { +- memcpy_toio(eprambase, bufferptr, bytestosend); ++ memcpy(eprambase, bufferptr, bytestosend); + udc->write_fn(udc->addr, ep->offset + + XUSB_EP_BUF1COUNT_OFFSET, bufferlen); + } else { +- memcpy_toio(bufferptr, eprambase, bytestosend); ++ memcpy(bufferptr, eprambase, bytestosend); + } + /* + * Enable the buffer for transmission. +@@ -1020,7 +1020,7 @@ static int __xudc_ep0_queue(struct xusb_ep *ep0, struct xusb_req *req) + udc->addr); + length = req->usb_req.actual = min_t(u32, length, + EP0_MAX_PACKET); +- memcpy_toio(corebuf, req->usb_req.buf, length); ++ memcpy(corebuf, req->usb_req.buf, length); + udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, length); + udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1); + } else { +@@ -1746,7 +1746,7 @@ static void xudc_handle_setup(struct xusb_udc *udc) + + /* Load up the chapter 9 command buffer.*/ + ep0rambase = (u32 __force *) (udc->addr + XUSB_SETUP_PKT_ADDR_OFFSET); +- memcpy_toio(&setup, ep0rambase, 8); ++ memcpy(&setup, ep0rambase, 8); + + udc->setup = setup; + udc->setup.wValue = cpu_to_le16(setup.wValue); +@@ -1833,7 +1833,7 @@ static void xudc_ep0_out(struct xusb_udc *udc) + (ep0->rambase << 2)); + buffer = req->usb_req.buf + req->usb_req.actual; + req->usb_req.actual = req->usb_req.actual + bytes_to_rx; +- memcpy_toio(buffer, ep0rambase, bytes_to_rx); ++ memcpy(buffer, ep0rambase, bytes_to_rx); + + if (req->usb_req.length == req->usb_req.actual) { + /* Data transfer completed get ready for Status stage */ +@@ -1909,7 +1909,7 @@ static void xudc_ep0_in(struct xusb_udc *udc) + (ep0->rambase << 2)); + buffer = req->usb_req.buf + req->usb_req.actual; + req->usb_req.actual = req->usb_req.actual + length; +- memcpy_toio(ep0rambase, buffer, length); ++ memcpy(ep0rambase, buffer, length); + } + udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, count); + udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1); +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..bc33090cb5c --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,19 @@ +drm-amdgpu-separate-vf2pf-work-item-init-from-virt-d.patch +drm-amdgpu-make-sure-to-init-common-ip-before-gmc.patch +staging-r8188eu-remove-support-for-devices-with-8188.patch +staging-r8188eu-add-rosewill-usb-n150-nano-to-device.patch +usb-dwc3-gadget-avoid-starting-dwc3-gadget-during-ud.patch +usb-dwc3-issue-core-soft-reset-before-enabling-run-s.patch +usb-dwc3-gadget-prevent-repeat-pullup.patch +usb-dwc3-gadget-refactor-pullup.patch +usb-dwc3-gadget-don-t-modify-gevntcount-in-pullup.patch +usb-dwc3-gadget-avoid-duplicate-requests-to-enable-r.patch +iio-adc-mcp3911-switch-to-generic-firmware-propertie.patch +iio-adc-mcp3911-correct-microchip-device-addr-proper.patch +powerpc-rtas-move-rtas-entry-assembly-into-its-own-f.patch +powerpc-rtas-fix-rtas-msr-hv-handling-for-cell.patch +usb-add-quirks-for-lenovo-onelink-dock.patch +usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toi.patch +revert-usb-add-quirks-for-lenovo-onelink-dock.patch +revert-usb-gadget-udc-xilinx-replace-memcpy-with-mem.patch +net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs.patch diff --git a/queue-5.15/staging-r8188eu-add-rosewill-usb-n150-nano-to-device.patch b/queue-5.15/staging-r8188eu-add-rosewill-usb-n150-nano-to-device.patch new file mode 100644 index 00000000000..ddb84c266b3 --- /dev/null +++ b/queue-5.15/staging-r8188eu-add-rosewill-usb-n150-nano-to-device.patch @@ -0,0 +1,38 @@ +From 728b7a417be68e65b364c44fdc8077e429759bf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Aug 2022 12:50:27 -0500 +Subject: staging: r8188eu: Add Rosewill USB-N150 Nano to device tables + +From: Larry Finger + +[ Upstream commit e01f5c8d6af231b3b09e23c1fe8a4057cdcc4e42 ] + +This device is reported as using the RTL8188EUS chip. + +It has the improbable USB ID of 0bda:ffef, which normally would belong +to Realtek, but this ID works for the reporter. + +Signed-off-by: Larry Finger +Cc: stable +Link: https://lore.kernel.org/r/20220814175027.2689-1-Larry.Finger@lwfinger.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/r8188eu/os_dep/usb_intf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/r8188eu/os_dep/usb_intf.c b/drivers/staging/r8188eu/os_dep/usb_intf.c +index b6c6fa72de44..640f1ca2d985 100644 +--- a/drivers/staging/r8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/r8188eu/os_dep/usb_intf.c +@@ -30,6 +30,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + /*=== Realtek demoboard ===*/ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8179)}, /* 8188EUS */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */ ++ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill USB-N150 Nano */ + /*=== Customer ID ===*/ + /****** 8188EUS ********/ + {USB_DEVICE(0x07B8, 0x8179)}, /* Abocom - Abocom */ +-- +2.35.1 + diff --git a/queue-5.15/staging-r8188eu-remove-support-for-devices-with-8188.patch b/queue-5.15/staging-r8188eu-remove-support-for-devices-with-8188.patch new file mode 100644 index 00000000000..66d77df58f0 --- /dev/null +++ b/queue-5.15/staging-r8188eu-remove-support-for-devices-with-8188.patch @@ -0,0 +1,44 @@ +From 9e798b5047f50d53da77465f976d05077530ed4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 23:37:34 +0700 +Subject: staging: r8188eu: Remove support for devices with 8188FU chipset + (0bda:f179) + +From: Candy Febriyanto + +[ Upstream commit 6723b283c44a3fdf9f922ae9788aab38bd909211 ] + +The new r8188eu driver doesn't actually support devices with vendor ID 0bda +and product ID f179[0][1][2], remove the ID so owners of these devices +don't have to blacklist the staging driver. + +[0] https://github.com/lwfinger/rtl8188eu/issues/366#issuecomment-888511731 +[1] https://github.com/lwfinger/rtl8188eu/issues/385 +[2] https://github.com/lwfinger/rtl8188eu/issues/385#issuecomment-973013539 + +Cc: Larry Finger +CC: Phillip Potter +Signed-off-by: Candy Febriyanto +Link: https://lore.kernel.org/r/YZaBTq9vlMaJDFz2@mainframe.localdomain +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: e01f5c8d6af2 ("staging: r8188eu: Add Rosewill USB-N150 Nano to device tables") +Signed-off-by: Sasha Levin +--- + drivers/staging/r8188eu/os_dep/usb_intf.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/staging/r8188eu/os_dep/usb_intf.c b/drivers/staging/r8188eu/os_dep/usb_intf.c +index bb85ab77fd26..b6c6fa72de44 100644 +--- a/drivers/staging/r8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/r8188eu/os_dep/usb_intf.c +@@ -30,7 +30,6 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + /*=== Realtek demoboard ===*/ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8179)}, /* 8188EUS */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */ +- {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xf179)}, /* 8188FU */ + /*=== Customer ID ===*/ + /****** 8188EUS ********/ + {USB_DEVICE(0x07B8, 0x8179)}, /* Abocom - Abocom */ +-- +2.35.1 + diff --git a/queue-5.15/usb-add-quirks-for-lenovo-onelink-dock.patch b/queue-5.15/usb-add-quirks-for-lenovo-onelink-dock.patch new file mode 100644 index 00000000000..775628744ad --- /dev/null +++ b/queue-5.15/usb-add-quirks-for-lenovo-onelink-dock.patch @@ -0,0 +1,51 @@ +From ffa6dbaec4b45d345607abc9e961f9a0d9579d3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 21:13:21 +0200 +Subject: usb: add quirks for Lenovo OneLink+ Dock + +From: Jean-Francois Le Fillatre + +[ Upstream commit 3d5f70949f1b1168fbb17d06eb5c57e984c56c58 ] + +The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers: +17ef:1018 upstream +17ef:1019 downstream + +Those two controllers both have problems with some USB3.0 devices, +particularly self-powered ones. Typical error messages include: + + Timeout while waiting for setup device command + device not accepting address X, error -62 + unable to enumerate USB device + +By process of elimination the controllers themselves were identified as +the cause of the problem. Through trial and error the issue was solved +by using USB_QUIRK_RESET_RESUME for both chips. + +Signed-off-by: Jean-Francois Le Fillatre +Cc: stable +Link: https://lore.kernel.org/r/20220824191320.17883-1-jflf_kernel@gmx.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index f99a65a64588..999b7c9697fc 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -437,6 +437,10 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */ ++ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */ + { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM }, + +-- +2.35.1 + diff --git a/queue-5.15/usb-dwc3-gadget-avoid-duplicate-requests-to-enable-r.patch b/queue-5.15/usb-dwc3-gadget-avoid-duplicate-requests-to-enable-r.patch new file mode 100644 index 00000000000..805e906bf97 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-avoid-duplicate-requests-to-enable-r.patch @@ -0,0 +1,57 @@ +From 764b064fdc8f4b289941786711040ea65dc54118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 19:06:47 -0700 +Subject: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop + +From: Wesley Cheng + +[ Upstream commit 040f2dbd2010c43f33ad27249e6dac48456f4d99 ] + +Relocate the pullups_connected check until after it is ensured that there +are no runtime PM transitions. If another context triggered the DWC3 +core's runtime resume, it may have already enabled the Run/Stop. Do not +re-run the entire pullup sequence again, as it may issue a core soft +reset while Run/Stop is already set. + +This patch depends on + commit 69e131d1ac4e ("usb: dwc3: gadget: Prevent repeat pullup()") + +Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") +Cc: stable +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/20220728020647.9377-1-quic_wcheng@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 484b5e1d921a..14dcdb923f40 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2470,9 +2470,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + + is_on = !!is_on; + +- if (dwc->pullups_connected == is_on) +- return 0; +- + dwc->softconnect = is_on; + /* + * Per databook, when we want to stop the gadget, if a control transfer +@@ -2509,6 +2506,11 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + return 0; + } + ++ if (dwc->pullups_connected == is_on) { ++ pm_runtime_put(dwc->dev); ++ return 0; ++ } ++ + if (!is_on) { + ret = dwc3_gadget_soft_disconnect(dwc); + } else { +-- +2.35.1 + diff --git a/queue-5.15/usb-dwc3-gadget-avoid-starting-dwc3-gadget-during-ud.patch b/queue-5.15/usb-dwc3-gadget-avoid-starting-dwc3-gadget-during-ud.patch new file mode 100644 index 00000000000..bf1ae391a23 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-avoid-starting-dwc3-gadget-during-ud.patch @@ -0,0 +1,90 @@ +From ba4c266d299165a701d6c7ec5e9811eef9c37c39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 19:18:52 -0700 +Subject: usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind + +From: Wesley Cheng + +[ Upstream commit 8217f07a50236779880f13e87f99224cd9117f83 ] + +There is a race present where the DWC3 runtime resume runs in parallel +to the UDC unbind sequence. This will eventually lead to a possible +scenario where we are enabling the run/stop bit, without a valid +composition defined. + +Thread#1 (handling UDC unbind): +usb_gadget_remove_driver() +-->usb_gadget_disconnect() + -->dwc3_gadget_pullup(0) +--> continue UDC unbind sequence +-->Thread#2 is running in parallel here + +Thread#2 (handing next cable connect) +__dwc3_set_mode() + -->pm_runtime_get_sync() + -->dwc3_gadget_resume() + -->dwc->gadget_driver is NOT NULL yet + -->dwc3_gadget_run_stop(1) + --> _dwc3gadget_start() +... + +Fix this by tracking the pullup disable routine, and avoiding resuming +of the DWC3 gadget. Once the UDC is re-binded, that will trigger the +pullup enable routine, which would handle enabling the DWC3 gadget. + +Acked-by: Felipe Balbi +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/20210917021852.2037-1-wcheng@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.h | 2 ++ + drivers/usb/dwc3/gadget.c | 4 ++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index fd5d42ec5350..dbae57725f52 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -1028,6 +1028,7 @@ struct dwc3_scratchpad_array { + * @tx_fifo_resize_max_num: max number of fifos allocated during txfifo resize + * @hsphy_interface: "utmi" or "ulpi" + * @connected: true when we're connected to a host, false otherwise ++ * @softconnect: true when gadget connect is called, false when disconnect runs + * @delayed_status: true when gadget driver asks for delayed status + * @ep0_bounced: true when we used bounce buffer + * @ep0_expect_in: true when we expect a DATA IN transfer +@@ -1247,6 +1248,7 @@ struct dwc3 { + const char *hsphy_interface; + + unsigned connected:1; ++ unsigned softconnect:1; + unsigned delayed_status:1; + unsigned ep0_bounced:1; + unsigned ep0_expect_in:1; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 322754a7f91c..5f9a0ab09f4b 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2442,7 +2442,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + int ret; + + is_on = !!is_on; +- ++ dwc->softconnect = is_on; + /* + * Per databook, when we want to stop the gadget, if a control transfer + * is still in process, complete it and get the core into setup phase. +@@ -4421,7 +4421,7 @@ int dwc3_gadget_resume(struct dwc3 *dwc) + { + int ret; + +- if (!dwc->gadget_driver) ++ if (!dwc->gadget_driver || !dwc->softconnect) + return 0; + + ret = __dwc3_gadget_start(dwc); +-- +2.35.1 + diff --git a/queue-5.15/usb-dwc3-gadget-don-t-modify-gevntcount-in-pullup.patch b/queue-5.15/usb-dwc3-gadget-don-t-modify-gevntcount-in-pullup.patch new file mode 100644 index 00000000000..3ae915af36c --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-don-t-modify-gevntcount-in-pullup.patch @@ -0,0 +1,111 @@ +From 14604b0553494d9f3a6241c6778310bf88111675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 19:22:44 -0700 +Subject: usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup() + +From: Thinh Nguyen + +[ Upstream commit 8f8034f493b5eb1ad21ff392fd30c0cf9e71f73f ] + +If the GEVNTCOUNT indicates events in the event buffer, the driver needs +to acknowledge them before the controller can halt. Simply let the +interrupt handler acknowledges the remaining event generated by the +controller while polling for DSTS.DEVCTLHLT. This avoids disabling irq +and taking care of race condition between the interrupt handlers and +pullup(). + +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/ea306ec93c41ccafbdb5d16404ff3b6eca299613.1650593829.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 35 ++++++++--------------------------- + 1 file changed, 8 insertions(+), 27 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index cdc03ee439f8..484b5e1d921a 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2437,8 +2437,9 @@ static int __dwc3_gadget_start(struct dwc3 *dwc); + + static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc) + { +- u32 count; ++ unsigned long flags; + ++ spin_lock_irqsave(&dwc->lock, flags); + dwc->connected = false; + + /* +@@ -2450,29 +2451,21 @@ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc) + */ + dwc3_stop_active_transfers(dwc); + __dwc3_gadget_stop(dwc); ++ spin_unlock_irqrestore(&dwc->lock, flags); + + /* +- * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a +- * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the +- * "software needs to acknowledge the events that are generated +- * (by writing to GEVNTCOUNTn) while it is waiting for this bit +- * to be set to '1'." ++ * Note: if the GEVNTCOUNT indicates events in the event buffer, the ++ * driver needs to acknowledge them before the controller can halt. ++ * Simply let the interrupt handler acknowledges and handle the ++ * remaining event generated by the controller while polling for ++ * DSTS.DEVCTLHLT. + */ +- count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0)); +- count &= DWC3_GEVNTCOUNT_MASK; +- if (count > 0) { +- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count); +- dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) % +- dwc->ev_buf->length; +- } +- + return dwc3_gadget_run_stop(dwc, false, false); + } + + static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + { + struct dwc3 *dwc = gadget_to_dwc(g); +- unsigned long flags; + int ret; + + is_on = !!is_on; +@@ -2516,14 +2509,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + return 0; + } + +- /* +- * Synchronize and disable any further event handling while controller +- * is being enabled/disabled. +- */ +- disable_irq(dwc->irq_gadget); +- +- spin_lock_irqsave(&dwc->lock, flags); +- + if (!is_on) { + ret = dwc3_gadget_soft_disconnect(dwc); + } else { +@@ -2533,16 +2518,12 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + * device-initiated disconnect requires a core soft reset + * (DCTL.CSftRst) before enabling the run/stop bit. + */ +- spin_unlock_irqrestore(&dwc->lock, flags); + dwc3_core_soft_reset(dwc); +- spin_lock_irqsave(&dwc->lock, flags); + + dwc3_event_buffers_setup(dwc); + __dwc3_gadget_start(dwc); + ret = dwc3_gadget_run_stop(dwc, true, false); + } +- spin_unlock_irqrestore(&dwc->lock, flags); +- enable_irq(dwc->irq_gadget); + + pm_runtime_put(dwc->dev); + +-- +2.35.1 + diff --git a/queue-5.15/usb-dwc3-gadget-prevent-repeat-pullup.patch b/queue-5.15/usb-dwc3-gadget-prevent-repeat-pullup.patch new file mode 100644 index 00000000000..f5bd2ee6330 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-prevent-repeat-pullup.patch @@ -0,0 +1,45 @@ +From beb57089f4057802801d51973a5a8128d834edd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 19:22:31 -0700 +Subject: usb: dwc3: gadget: Prevent repeat pullup() + +From: Thinh Nguyen + +[ Upstream commit 69e131d1ac4e52a59ec181ab4f8aa8c48cd8fb64 ] + +Don't do soft-disconnect if it's previously done. Likewise, don't do +soft-connect if the device is currently connected and running. It would +break normal operation. + +Currently the caller of pullup() (udc's sysfs soft_connect) only checks +if it had initiated disconnect to prevent repeating soft-disconnect. It +doesn't check for soft-connect. To be safe, let's keep the check here +regardless whether the udc core is fixed. + +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/1c1345bd66c97a9d32f77d63aaadd04b7b037143.1650593829.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 761065336322..61499b657129 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2442,6 +2442,10 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + int ret; + + is_on = !!is_on; ++ ++ if (dwc->pullups_connected == is_on) ++ return 0; ++ + dwc->softconnect = is_on; + /* + * Per databook, when we want to stop the gadget, if a control transfer +-- +2.35.1 + diff --git a/queue-5.15/usb-dwc3-gadget-refactor-pullup.patch b/queue-5.15/usb-dwc3-gadget-refactor-pullup.patch new file mode 100644 index 00000000000..f9c25dd9a52 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-refactor-pullup.patch @@ -0,0 +1,115 @@ +From 585f2ac752c8631327ba1a3b646db35a2a2ae4bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 19:22:38 -0700 +Subject: usb: dwc3: gadget: Refactor pullup() + +From: Thinh Nguyen + +[ Upstream commit 861c010a2ee1bc4a66d23f0da4aa22e75d8eaa24 ] + +Move soft-disconnect sequence out of dwc3_gadget_pullup(). No +functional change here. + +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/4c0f259b17d95acaaa931f90276683a48a32fe22.1650593829.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 65 ++++++++++++++++++++++----------------- + 1 file changed, 36 insertions(+), 29 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 61499b657129..cdc03ee439f8 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2435,6 +2435,40 @@ static void dwc3_gadget_disable_irq(struct dwc3 *dwc); + static void __dwc3_gadget_stop(struct dwc3 *dwc); + static int __dwc3_gadget_start(struct dwc3 *dwc); + ++static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc) ++{ ++ u32 count; ++ ++ dwc->connected = false; ++ ++ /* ++ * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a ++ * Section 4.1.8 Table 4-7, it states that for a device-initiated ++ * disconnect, the SW needs to ensure that it sends "a DEPENDXFER ++ * command for any active transfers" before clearing the RunStop ++ * bit. ++ */ ++ dwc3_stop_active_transfers(dwc); ++ __dwc3_gadget_stop(dwc); ++ ++ /* ++ * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a ++ * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the ++ * "software needs to acknowledge the events that are generated ++ * (by writing to GEVNTCOUNTn) while it is waiting for this bit ++ * to be set to '1'." ++ */ ++ count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0)); ++ count &= DWC3_GEVNTCOUNT_MASK; ++ if (count > 0) { ++ dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count); ++ dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) % ++ dwc->ev_buf->length; ++ } ++ ++ return dwc3_gadget_run_stop(dwc, false, false); ++} ++ + static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + { + struct dwc3 *dwc = gadget_to_dwc(g); +@@ -2491,33 +2525,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + spin_lock_irqsave(&dwc->lock, flags); + + if (!is_on) { +- u32 count; +- +- dwc->connected = false; +- /* +- * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a +- * Section 4.1.8 Table 4-7, it states that for a device-initiated +- * disconnect, the SW needs to ensure that it sends "a DEPENDXFER +- * command for any active transfers" before clearing the RunStop +- * bit. +- */ +- dwc3_stop_active_transfers(dwc); +- __dwc3_gadget_stop(dwc); +- +- /* +- * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a +- * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the +- * "software needs to acknowledge the events that are generated +- * (by writing to GEVNTCOUNTn) while it is waiting for this bit +- * to be set to '1'." +- */ +- count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0)); +- count &= DWC3_GEVNTCOUNT_MASK; +- if (count > 0) { +- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count); +- dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) % +- dwc->ev_buf->length; +- } ++ ret = dwc3_gadget_soft_disconnect(dwc); + } else { + /* + * In the Synopsys DWC_usb31 1.90a programming guide section +@@ -2531,9 +2539,8 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + + dwc3_event_buffers_setup(dwc); + __dwc3_gadget_start(dwc); ++ ret = dwc3_gadget_run_stop(dwc, true, false); + } +- +- ret = dwc3_gadget_run_stop(dwc, is_on, false); + spin_unlock_irqrestore(&dwc->lock, flags); + enable_irq(dwc->irq_gadget); + +-- +2.35.1 + diff --git a/queue-5.15/usb-dwc3-issue-core-soft-reset-before-enabling-run-s.patch b/queue-5.15/usb-dwc3-issue-core-soft-reset-before-enabling-run-s.patch new file mode 100644 index 00000000000..da39fa51699 --- /dev/null +++ b/queue-5.15/usb-dwc3-issue-core-soft-reset-before-enabling-run-s.patch @@ -0,0 +1,86 @@ +From cc4e79fd0f0484d928e71747873faf32fca649c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 18:13:58 -0700 +Subject: usb: dwc3: Issue core soft reset before enabling run/stop + +From: Wesley Cheng + +[ Upstream commit 0066472de157439d58454f4a55786f1045ea5681 ] + +It is recommended by the Synopsis databook to issue a DCTL.CSftReset +when reconnecting from a device-initiated disconnect routine. This +resolves issues with enumeration during fast composition switching +cases, which result in an unknown device on the host. + +Reviewed-by: Thinh Nguyen +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/20220316011358.3057-1-quic_wcheng@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 4 +--- + drivers/usb/dwc3/core.h | 2 ++ + drivers/usb/dwc3/gadget.c | 11 +++++++++++ + 3 files changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 9c24cf46b9a0..b2ea4c2448d4 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -114,8 +114,6 @@ void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode) + dwc->current_dr_role = mode; + } + +-static int dwc3_core_soft_reset(struct dwc3 *dwc); +- + static void __dwc3_set_mode(struct work_struct *work) + { + struct dwc3 *dwc = work_to_dwc(work); +@@ -265,7 +263,7 @@ u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type) + * dwc3_core_soft_reset - Issues core soft reset and PHY reset + * @dwc: pointer to our context structure + */ +-static int dwc3_core_soft_reset(struct dwc3 *dwc) ++int dwc3_core_soft_reset(struct dwc3 *dwc) + { + u32 reg; + int retries = 1000; +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index dbae57725f52..077d03a33388 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -1510,6 +1510,8 @@ bool dwc3_has_imod(struct dwc3 *dwc); + int dwc3_event_buffers_setup(struct dwc3 *dwc); + void dwc3_event_buffers_cleanup(struct dwc3 *dwc); + ++int dwc3_core_soft_reset(struct dwc3 *dwc); ++ + #if IS_ENABLED(CONFIG_USB_DWC3_HOST) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE) + int dwc3_host_init(struct dwc3 *dwc); + void dwc3_host_exit(struct dwc3 *dwc); +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 5f9a0ab09f4b..761065336322 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2515,6 +2515,17 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + dwc->ev_buf->length; + } + } else { ++ /* ++ * In the Synopsys DWC_usb31 1.90a programming guide section ++ * 4.1.9, it specifies that for a reconnect after a ++ * device-initiated disconnect requires a core soft reset ++ * (DCTL.CSftRst) before enabling the run/stop bit. ++ */ ++ spin_unlock_irqrestore(&dwc->lock, flags); ++ dwc3_core_soft_reset(dwc); ++ spin_lock_irqsave(&dwc->lock, flags); ++ ++ dwc3_event_buffers_setup(dwc); + __dwc3_gadget_start(dwc); + } + +-- +2.35.1 + diff --git a/queue-5.15/usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toi.patch b/queue-5.15/usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toi.patch new file mode 100644 index 00000000000..b4d8e1da6b4 --- /dev/null +++ b/queue-5.15/usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toi.patch @@ -0,0 +1,156 @@ +From f4665a360f153d508d020082f574f9a634d88111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 12:42:53 +0530 +Subject: usb: gadget: udc-xilinx: replace memcpy with memcpy_toio + +From: Piyush Mehta + +[ Upstream commit 8cb339f1c1f04baede9d54c1e40ac96247a6393b ] + +For ARM processor, unaligned access to device memory is not allowed. +Method memcpy does not take care of alignment. + +USB detection failure with the unaligned address of memory access, with +below kernel crash. To fix the unaligned address the kernel panic issue, +replace memcpy with memcpy_toio method. + +Kernel crash: +Unable to handle kernel paging request at virtual address ffff80000c05008a +Mem abort info: + ESR = 0x96000061 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x21: alignment fault +Data abort info: + ISV = 0, ISS = 0x00000061 + CM = 0, WnR = 1 +swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000000143b000 +[ffff80000c05008a] pgd=100000087ffff003, p4d=100000087ffff003, +pud=100000087fffe003, pmd=1000000800bcc003, pte=00680000a0010713 +Internal error: Oops: 96000061 [#1] SMP +Modules linked in: +CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.19-xilinx-v2022.1 #1 +Hardware name: ZynqMP ZCU102 Rev1.0 (DT) +pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : __memcpy+0x30/0x260 +lr : __xudc_ep0_queue+0xf0/0x110 +sp : ffff800008003d00 +x29: ffff800008003d00 x28: ffff800009474e80 x27: 00000000000000a0 +x26: 0000000000000100 x25: 0000000000000012 x24: ffff000800bc8080 +x23: 0000000000000001 x22: 0000000000000012 x21: ffff000800bc8080 +x20: 0000000000000012 x19: ffff000800bc8080 x18: 0000000000000000 +x17: ffff800876482000 x16: ffff800008004000 x15: 0000000000004000 +x14: 00001f09785d0400 x13: 0103020101005567 x12: 0781400000000200 +x11: 00000000c5672a10 x10: 00000000000008d0 x9 : ffff800009463cf0 +x8 : ffff8000094757b0 x7 : 0201010055670781 x6 : 4000000002000112 +x5 : ffff80000c05009a x4 : ffff000800a15012 x3 : ffff00080362ad80 +x2 : 0000000000000012 x1 : ffff000800a15000 x0 : ffff80000c050088 +Call trace: + __memcpy+0x30/0x260 + xudc_ep0_queue+0x3c/0x60 + usb_ep_queue+0x38/0x44 + composite_ep0_queue.constprop.0+0x2c/0xc0 + composite_setup+0x8d0/0x185c + configfs_composite_setup+0x74/0xb0 + xudc_irq+0x570/0xa40 + __handle_irq_event_percpu+0x58/0x170 + handle_irq_event+0x60/0x120 + handle_fasteoi_irq+0xc0/0x220 + handle_domain_irq+0x60/0x90 + gic_handle_irq+0x74/0xa0 + call_on_irq_stack+0x2c/0x60 + do_interrupt_handler+0x54/0x60 + el1_interrupt+0x30/0x50 + el1h_64_irq_handler+0x18/0x24 + el1h_64_irq+0x78/0x7c + arch_cpu_idle+0x18/0x2c + do_idle+0xdc/0x15c + cpu_startup_entry+0x28/0x60 + rest_init+0xc8/0xe0 + arch_call_rest_init+0x10/0x1c + start_kernel+0x694/0x6d4 + __primary_switched+0xa4/0xac + +Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: Piyush Mehta +Link: https://lore.kernel.org/r/20220824071253.1261096-1-piyush.mehta@amd.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/udc-xilinx.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c +index 9cf43731bcd1..218d9423807a 100644 +--- a/drivers/usb/gadget/udc/udc-xilinx.c ++++ b/drivers/usb/gadget/udc/udc-xilinx.c +@@ -496,11 +496,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req, + /* Get the Buffer address and copy the transmit data.*/ + eprambase = (u32 __force *)(udc->addr + ep->rambase); + if (ep->is_in) { +- memcpy(eprambase, bufferptr, bytestosend); ++ memcpy_toio(eprambase, bufferptr, bytestosend); + udc->write_fn(udc->addr, ep->offset + + XUSB_EP_BUF0COUNT_OFFSET, bufferlen); + } else { +- memcpy(bufferptr, eprambase, bytestosend); ++ memcpy_toio(bufferptr, eprambase, bytestosend); + } + /* + * Enable the buffer for transmission. +@@ -514,11 +514,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req, + eprambase = (u32 __force *)(udc->addr + ep->rambase + + ep->ep_usb.maxpacket); + if (ep->is_in) { +- memcpy(eprambase, bufferptr, bytestosend); ++ memcpy_toio(eprambase, bufferptr, bytestosend); + udc->write_fn(udc->addr, ep->offset + + XUSB_EP_BUF1COUNT_OFFSET, bufferlen); + } else { +- memcpy(bufferptr, eprambase, bytestosend); ++ memcpy_toio(bufferptr, eprambase, bytestosend); + } + /* + * Enable the buffer for transmission. +@@ -1020,7 +1020,7 @@ static int __xudc_ep0_queue(struct xusb_ep *ep0, struct xusb_req *req) + udc->addr); + length = req->usb_req.actual = min_t(u32, length, + EP0_MAX_PACKET); +- memcpy(corebuf, req->usb_req.buf, length); ++ memcpy_toio(corebuf, req->usb_req.buf, length); + udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, length); + udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1); + } else { +@@ -1746,7 +1746,7 @@ static void xudc_handle_setup(struct xusb_udc *udc) + + /* Load up the chapter 9 command buffer.*/ + ep0rambase = (u32 __force *) (udc->addr + XUSB_SETUP_PKT_ADDR_OFFSET); +- memcpy(&setup, ep0rambase, 8); ++ memcpy_toio(&setup, ep0rambase, 8); + + udc->setup = setup; + udc->setup.wValue = cpu_to_le16(setup.wValue); +@@ -1833,7 +1833,7 @@ static void xudc_ep0_out(struct xusb_udc *udc) + (ep0->rambase << 2)); + buffer = req->usb_req.buf + req->usb_req.actual; + req->usb_req.actual = req->usb_req.actual + bytes_to_rx; +- memcpy(buffer, ep0rambase, bytes_to_rx); ++ memcpy_toio(buffer, ep0rambase, bytes_to_rx); + + if (req->usb_req.length == req->usb_req.actual) { + /* Data transfer completed get ready for Status stage */ +@@ -1909,7 +1909,7 @@ static void xudc_ep0_in(struct xusb_udc *udc) + (ep0->rambase << 2)); + buffer = req->usb_req.buf + req->usb_req.actual; + req->usb_req.actual = req->usb_req.actual + length; +- memcpy(ep0rambase, buffer, length); ++ memcpy_toio(ep0rambase, buffer, length); + } + udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, count); + udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1); +-- +2.35.1 + -- 2.47.3