From fd891835f288182fdfac7a55b4bc937847874cbc Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 4 Feb 2025 15:08:45 +0100 Subject: [PATCH] 6.6-stable patches added patches: alsa-usb-audio-add-delay-quirk-for-ibasso-dc07-pro.patch drivers-card_reader-rtsx_usb-restore-interrupt-based-detection.patch kbuild-switch-from-lz4c-to-lz4-for-compression.patch ktest.pl-check-kernelrelease-return-in-get_version.patch net-usb-rtl8150-enable-basic-endpoint-checking.patch netfilter-nf_tables-reject-mismatching-sum-of-field_len-with-set-key-length.patch revert-sunrpc-reduce-thread-wake-up-rate-when-receiving-large-rpc-messages.patch selftests-rseq-fix-handling-of-glibc-without-rseq-support.patch usb-dwc3-am62-fix-an-of-node-leak-in-phy_syscon_pll_refclk.patch usb-dwc3-core-defer-the-probe-until-usb-power-supply-ready.patch usb-gadget-f_tcm-fix-get-setinterface-return-value.patch usb-typec-tcpci-prevent-sink-disconnection-before-vppsshutdown-in-spr-pps.patch usb-typec-tcpm-set-src_send_capabilities-timeout-to-pd_t_sender_response.patch usb-xhci-fix-null-pointer-dereference-on-certain-command-aborts.patch --- ...-add-delay-quirk-for-ibasso-dc07-pro.patch | 38 +++++ ...sb-restore-interrupt-based-detection.patch | 59 +++++++ ...tch-from-lz4c-to-lz4-for-compression.patch | 72 +++++++++ ...-kernelrelease-return-in-get_version.patch | 40 +++++ ...l8150-enable-basic-endpoint-checking.patch | 116 ++++++++++++++ ...sum-of-field_len-with-set-key-length.patch | 55 +++++++ ...te-when-receiving-large-rpc-messages.patch | 67 ++++++++ ...ndling-of-glibc-without-rseq-support.patch | 145 ++++++++++++++++++ queue-6.6/series | 14 ++ ...f-node-leak-in-phy_syscon_pll_refclk.patch | 32 ++++ ...e-probe-until-usb-power-supply-ready.patch | 87 +++++++++++ ...cm-fix-get-setinterface-return-value.patch | 50 ++++++ ...ction-before-vppsshutdown-in-spr-pps.patch | 100 ++++++++++++ ...ties-timeout-to-pd_t_sender_response.patch | 36 +++++ ...ereference-on-certain-command-aborts.patch | 51 ++++++ 15 files changed, 962 insertions(+) create mode 100644 queue-6.6/alsa-usb-audio-add-delay-quirk-for-ibasso-dc07-pro.patch create mode 100644 queue-6.6/drivers-card_reader-rtsx_usb-restore-interrupt-based-detection.patch create mode 100644 queue-6.6/kbuild-switch-from-lz4c-to-lz4-for-compression.patch create mode 100644 queue-6.6/ktest.pl-check-kernelrelease-return-in-get_version.patch create mode 100644 queue-6.6/net-usb-rtl8150-enable-basic-endpoint-checking.patch create mode 100644 queue-6.6/netfilter-nf_tables-reject-mismatching-sum-of-field_len-with-set-key-length.patch create mode 100644 queue-6.6/revert-sunrpc-reduce-thread-wake-up-rate-when-receiving-large-rpc-messages.patch create mode 100644 queue-6.6/selftests-rseq-fix-handling-of-glibc-without-rseq-support.patch create mode 100644 queue-6.6/usb-dwc3-am62-fix-an-of-node-leak-in-phy_syscon_pll_refclk.patch create mode 100644 queue-6.6/usb-dwc3-core-defer-the-probe-until-usb-power-supply-ready.patch create mode 100644 queue-6.6/usb-gadget-f_tcm-fix-get-setinterface-return-value.patch create mode 100644 queue-6.6/usb-typec-tcpci-prevent-sink-disconnection-before-vppsshutdown-in-spr-pps.patch create mode 100644 queue-6.6/usb-typec-tcpm-set-src_send_capabilities-timeout-to-pd_t_sender_response.patch create mode 100644 queue-6.6/usb-xhci-fix-null-pointer-dereference-on-certain-command-aborts.patch diff --git a/queue-6.6/alsa-usb-audio-add-delay-quirk-for-ibasso-dc07-pro.patch b/queue-6.6/alsa-usb-audio-add-delay-quirk-for-ibasso-dc07-pro.patch new file mode 100644 index 0000000000..a680fea077 --- /dev/null +++ b/queue-6.6/alsa-usb-audio-add-delay-quirk-for-ibasso-dc07-pro.patch @@ -0,0 +1,38 @@ +From d85fc52cbb9a719c8335d93a28d6a79d7acd419f Mon Sep 17 00:00:00 2001 +From: Lianqin Hu +Date: Sun, 26 Jan 2025 03:51:11 +0000 +Subject: ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro + +From: Lianqin Hu + +commit d85fc52cbb9a719c8335d93a28d6a79d7acd419f upstream. + +Audio control requests that sets sampling frequency sometimes fail on +this card. Adding delay between control messages eliminates that problem. + +usb 1-1: New USB device found, idVendor=2fc6, idProduct=f0b7 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +usb 1-1: Product: iBasso DC07 Pro +usb 1-1: Manufacturer: iBasso +usb 1-1: SerialNumber: CTUA171130B + +Signed-off-by: Lianqin Hu +Cc: +Link: https://patch.msgid.link/TYUPR06MB62174A48D04E09A37996DF84D2ED2@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2243,6 +2243,8 @@ static const struct usb_audio_quirk_flag + QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x2d95, 0x8021, /* VIVO USB-C-XE710 HEADSET */ + QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x2fc6, 0xf0b7, /* iBasso DC07 Pro */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x413c, 0xa506, /* Dell AE515 sound bar */ diff --git a/queue-6.6/drivers-card_reader-rtsx_usb-restore-interrupt-based-detection.patch b/queue-6.6/drivers-card_reader-rtsx_usb-restore-interrupt-based-detection.patch new file mode 100644 index 0000000000..d3d02a870a --- /dev/null +++ b/queue-6.6/drivers-card_reader-rtsx_usb-restore-interrupt-based-detection.patch @@ -0,0 +1,59 @@ +From 235b630eda072d7e7b102ab346d6b8a2c028a772 Mon Sep 17 00:00:00 2001 +From: Sean Rhodes +Date: Tue, 19 Nov 2024 08:58:15 +0000 +Subject: drivers/card_reader/rtsx_usb: Restore interrupt based detection + +From: Sean Rhodes + +commit 235b630eda072d7e7b102ab346d6b8a2c028a772 upstream. + +This commit reintroduces interrupt-based card detection previously +used in the rts5139 driver. This functionality was removed in commit +00d8521dcd23 ("staging: remove rts5139 driver code"). + +Reintroducing this mechanism fixes presence detection for certain card +readers, which with the current driver, will taken approximately 20 +seconds to enter S3 as `mmc_rescan` has to be frozen. + +Fixes: 00d8521dcd23 ("staging: remove rts5139 driver code") +Cc: stable@vger.kernel.org +Cc: Arnd Bergmann +Cc: Greg Kroah-Hartman +Signed-off-by: Sean Rhodes +Link: https://lore.kernel.org/r/20241119085815.11769-1-sean@starlabs.systems +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/cardreader/rtsx_usb.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/misc/cardreader/rtsx_usb.c ++++ b/drivers/misc/cardreader/rtsx_usb.c +@@ -286,6 +286,7 @@ static int rtsx_usb_get_status_with_bulk + int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status) + { + int ret; ++ u8 interrupt_val = 0; + u16 *buf; + + if (!status) +@@ -308,6 +309,20 @@ int rtsx_usb_get_card_status(struct rtsx + ret = rtsx_usb_get_status_with_bulk(ucr, status); + } + ++ rtsx_usb_read_register(ucr, CARD_INT_PEND, &interrupt_val); ++ /* Cross check presence with interrupts */ ++ if (*status & XD_CD) ++ if (!(interrupt_val & XD_INT)) ++ *status &= ~XD_CD; ++ ++ if (*status & SD_CD) ++ if (!(interrupt_val & SD_INT)) ++ *status &= ~SD_CD; ++ ++ if (*status & MS_CD) ++ if (!(interrupt_val & MS_INT)) ++ *status &= ~MS_CD; ++ + /* usb_control_msg may return positive when success */ + if (ret < 0) + return ret; diff --git a/queue-6.6/kbuild-switch-from-lz4c-to-lz4-for-compression.patch b/queue-6.6/kbuild-switch-from-lz4c-to-lz4-for-compression.patch new file mode 100644 index 0000000000..c37cc072f0 --- /dev/null +++ b/queue-6.6/kbuild-switch-from-lz4c-to-lz4-for-compression.patch @@ -0,0 +1,72 @@ +From e397a603e49cc7c7c113fad9f55a09637f290c34 Mon Sep 17 00:00:00 2001 +From: Parth Pancholi +Date: Thu, 14 Nov 2024 15:56:44 +0100 +Subject: kbuild: switch from lz4c to lz4 for compression + +From: Parth Pancholi + +commit e397a603e49cc7c7c113fad9f55a09637f290c34 upstream. + +Replace lz4c with lz4 for kernel image compression. +Although lz4 and lz4c are functionally similar, lz4c has been deprecated +upstream since 2018. Since as early as Ubuntu 16.04 and Fedora 25, lz4 +and lz4c have been packaged together, making it safe to update the +requirement from lz4c to lz4. + +Consequently, some distributions and build systems, such as OpenEmbedded, +have fully transitioned to using lz4. OpenEmbedded core adopted this +change in commit fe167e082cbd ("bitbake.conf: require lz4 instead of +lz4c"), causing compatibility issues when building the mainline kernel +in the latest OpenEmbedded environment, as seen in the errors below. + +This change also updates the LZ4 compression commands to make it backward +compatible by replacing stdin and stdout with the '-' option, due to some +unclear reason, the stdout keyword does not work for lz4 and '-' works for +both. In addition, this modifies the legacy '-c1' with '-9' which is also +compatible with both. This fixes the mainline kernel build failures with +the latest master OpenEmbedded builds associated with the mentioned +compatibility issues. + +LZ4 arch/arm/boot/compressed/piggy_data +/bin/sh: 1: lz4c: not found +... +... +ERROR: oe_runmake failed + +Link: https://github.com/lz4/lz4/pull/553 +Suggested-by: Francesco Dolcini +Signed-off-by: Parth Pancholi +Signed-off-by: Masahiro Yamada +Cc: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + Makefile | 2 +- + scripts/Makefile.lib | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/Makefile ++++ b/Makefile +@@ -518,7 +518,7 @@ KGZIP = gzip + KBZIP2 = bzip2 + KLZOP = lzop + LZMA = lzma +-LZ4 = lz4c ++LZ4 = lz4 + XZ = xz + ZSTD = zstd + +--- a/scripts/Makefile.lib ++++ b/scripts/Makefile.lib +@@ -472,10 +472,10 @@ quiet_cmd_lzo_with_size = LZO $@ + cmd_lzo_with_size = { cat $(real-prereqs) | $(KLZOP) -9; $(size_append); } > $@ + + quiet_cmd_lz4 = LZ4 $@ +- cmd_lz4 = cat $(real-prereqs) | $(LZ4) -l -c1 stdin stdout > $@ ++ cmd_lz4 = cat $(real-prereqs) | $(LZ4) -l -9 - - > $@ + + quiet_cmd_lz4_with_size = LZ4 $@ +- cmd_lz4_with_size = { cat $(real-prereqs) | $(LZ4) -l -c1 stdin stdout; \ ++ cmd_lz4_with_size = { cat $(real-prereqs) | $(LZ4) -l -9 - -; \ + $(size_append); } > $@ + + # U-Boot mkimage diff --git a/queue-6.6/ktest.pl-check-kernelrelease-return-in-get_version.patch b/queue-6.6/ktest.pl-check-kernelrelease-return-in-get_version.patch new file mode 100644 index 0000000000..6620a69a1b --- /dev/null +++ b/queue-6.6/ktest.pl-check-kernelrelease-return-in-get_version.patch @@ -0,0 +1,40 @@ +From a4e17a8f239a545c463f8ec27db4ed6e74b31841 Mon Sep 17 00:00:00 2001 +From: "Ricardo B. Marliere" +Date: Thu, 5 Dec 2024 17:50:35 -0300 +Subject: ktest.pl: Check kernelrelease return in get_version + +From: Ricardo B. Marliere + +commit a4e17a8f239a545c463f8ec27db4ed6e74b31841 upstream. + +In the case of a test that uses the special option ${KERNEL_VERSION} in one +of its settings but has no configuration available in ${OUTPUT_DIR}, for +example if it's a new empty directory, then the `make kernelrelease` call +will fail and the subroutine will chomp an empty string, silently. Fix that +by adding an empty configuration and retrying. + +Cc: stable@vger.kernel.org +Cc: John Hawley +Fixes: 5f9b6ced04a4e ("ktest: Bisecting, install modules, add logging") +Link: https://lore.kernel.org/20241205-ktest_kver_fallback-v2-1-869dae4c7777@suse.com +Signed-off-by: Ricardo B. Marliere +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/ktest/ktest.pl | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -2406,6 +2406,11 @@ sub get_version { + return if ($have_version); + doprint "$make kernelrelease ... "; + $version = `$make -s kernelrelease | tail -1`; ++ if (!length($version)) { ++ run_command "$make allnoconfig" or return 0; ++ doprint "$make kernelrelease ... "; ++ $version = `$make -s kernelrelease | tail -1`; ++ } + chomp($version); + doprint "$version\n"; + $have_version = 1; diff --git a/queue-6.6/net-usb-rtl8150-enable-basic-endpoint-checking.patch b/queue-6.6/net-usb-rtl8150-enable-basic-endpoint-checking.patch new file mode 100644 index 0000000000..de5c994fd2 --- /dev/null +++ b/queue-6.6/net-usb-rtl8150-enable-basic-endpoint-checking.patch @@ -0,0 +1,116 @@ +From 90b7f2961798793275b4844348619b622f983907 Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Fri, 24 Jan 2025 01:30:20 -0800 +Subject: net: usb: rtl8150: enable basic endpoint checking + +From: Nikita Zhandarovich + +commit 90b7f2961798793275b4844348619b622f983907 upstream. + +Syzkaller reports [1] encountering a common issue of utilizing a wrong +usb endpoint type during URB submitting stage. This, in turn, triggers +a warning shown below. + +For now, enable simple endpoint checking (specifically, bulk and +interrupt eps, testing control one is not essential) to mitigate +the issue with a view to do other related cosmetic changes later, +if they are necessary. + +[1] Syzkaller report: +usb 1-1: BOGUS urb xfer, pipe 3 != type 1 +WARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv> +Modules linked in: +CPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617> +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 +RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 +Code: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8> +RSP: 0018:ffffc9000441f740 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9 +RDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001 +RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 +R13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c +FS: 00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733 + __dev_open+0x2d4/0x4e0 net/core/dev.c:1474 + __dev_change_flags+0x561/0x720 net/core/dev.c:8838 + dev_change_flags+0x8f/0x160 net/core/dev.c:8910 + devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177 + inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003 + sock_do_ioctl+0x116/0x280 net/socket.c:1222 + sock_ioctl+0x22e/0x6c0 net/socket.c:1341 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:907 [inline] + __se_sys_ioctl fs/ioctl.c:893 [inline] + __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7fc04ef73d49 +... + +This change has not been tested on real hardware. + +Reported-and-tested-by: syzbot+d7e968426f644b567e31@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d7e968426f644b567e31 +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Nikita Zhandarovich +Link: https://patch.msgid.link/20250124093020.234642-1-n.zhandarovich@fintech.ru +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/rtl8150.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -71,6 +71,14 @@ + #define MSR_SPEED (1<<3) + #define MSR_LINK (1<<2) + ++/* USB endpoints */ ++enum rtl8150_usb_ep { ++ RTL8150_USB_EP_CONTROL = 0, ++ RTL8150_USB_EP_BULK_IN = 1, ++ RTL8150_USB_EP_BULK_OUT = 2, ++ RTL8150_USB_EP_INT_IN = 3, ++}; ++ + /* Interrupt pipe data */ + #define INT_TSR 0x00 + #define INT_RSR 0x01 +@@ -867,6 +875,13 @@ static int rtl8150_probe(struct usb_inte + struct usb_device *udev = interface_to_usbdev(intf); + rtl8150_t *dev; + struct net_device *netdev; ++ static const u8 bulk_ep_addr[] = { ++ RTL8150_USB_EP_BULK_IN | USB_DIR_IN, ++ RTL8150_USB_EP_BULK_OUT | USB_DIR_OUT, ++ 0}; ++ static const u8 int_ep_addr[] = { ++ RTL8150_USB_EP_INT_IN | USB_DIR_IN, ++ 0}; + + netdev = alloc_etherdev(sizeof(rtl8150_t)); + if (!netdev) +@@ -880,6 +895,13 @@ static int rtl8150_probe(struct usb_inte + return -ENOMEM; + } + ++ /* Verify that all required endpoints are present */ ++ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || ++ !usb_check_int_endpoints(intf, int_ep_addr)) { ++ dev_err(&intf->dev, "couldn't find required endpoints\n"); ++ goto out; ++ } ++ + tasklet_setup(&dev->tl, rx_fixup); + spin_lock_init(&dev->rx_pool_lock); + diff --git a/queue-6.6/netfilter-nf_tables-reject-mismatching-sum-of-field_len-with-set-key-length.patch b/queue-6.6/netfilter-nf_tables-reject-mismatching-sum-of-field_len-with-set-key-length.patch new file mode 100644 index 0000000000..2c89b9faf2 --- /dev/null +++ b/queue-6.6/netfilter-nf_tables-reject-mismatching-sum-of-field_len-with-set-key-length.patch @@ -0,0 +1,55 @@ +From 1b9335a8000fb70742f7db10af314104b6ace220 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 28 Jan 2025 12:26:33 +0100 +Subject: netfilter: nf_tables: reject mismatching sum of field_len with set key length + +From: Pablo Neira Ayuso + +commit 1b9335a8000fb70742f7db10af314104b6ace220 upstream. + +The field length description provides the length of each separated key +field in the concatenation, each field gets rounded up to 32-bits to +calculate the pipapo rule width from pipapo_init(). The set key length +provides the total size of the key aligned to 32-bits. + +Register-based arithmetics still allows for combining mismatching set +key length and field length description, eg. set key length 10 and field +description [ 5, 4 ] leading to pipapo width of 12. + +Cc: stable@vger.kernel.org +Fixes: 3ce67e3793f4 ("netfilter: nf_tables: do not allow mismatch field size and set key length") +Reported-by: Noam Rathaus +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4875,7 +4875,7 @@ static int nft_set_desc_concat_parse(con + static int nft_set_desc_concat(struct nft_set_desc *desc, + const struct nlattr *nla) + { +- u32 num_regs = 0, key_num_regs = 0; ++ u32 len = 0, num_regs; + struct nlattr *attr; + int rem, err, i; + +@@ -4889,12 +4889,12 @@ static int nft_set_desc_concat(struct nf + } + + for (i = 0; i < desc->field_count; i++) +- num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); ++ len += round_up(desc->field_len[i], sizeof(u32)); + +- key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); +- if (key_num_regs != num_regs) ++ if (len != desc->klen) + return -EINVAL; + ++ num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); + if (num_regs > NFT_REG32_COUNT) + return -E2BIG; + diff --git a/queue-6.6/revert-sunrpc-reduce-thread-wake-up-rate-when-receiving-large-rpc-messages.patch b/queue-6.6/revert-sunrpc-reduce-thread-wake-up-rate-when-receiving-large-rpc-messages.patch new file mode 100644 index 0000000000..7e9bbdc392 --- /dev/null +++ b/queue-6.6/revert-sunrpc-reduce-thread-wake-up-rate-when-receiving-large-rpc-messages.patch @@ -0,0 +1,67 @@ +From 966a675da844f1a764bb44557c21561cc3d09840 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 2 Jan 2025 20:00:01 -0500 +Subject: Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC messages" + +From: Chuck Lever + +commit 966a675da844f1a764bb44557c21561cc3d09840 upstream. + +I noticed that a handful of NFSv3 fstests were taking an +unexpectedly long time to run. Troubleshooting showed that the +server's TCP window closed and never re-opened, which caused the +client to trigger an RPC retransmit timeout after 180 seconds. + +The client's recovery action was to establish a fresh connection +and retransmit the timed-out requests. This worked, but it adds a +long delay. + +I tracked the problem to the commit that attempted to reduce the +rate at which the network layer delivers TCP socket data_ready +callbacks. Under most circumstances this change worked as expected, +but for NFSv3, which has no session or other type of throttling, it +can overwhelm the receiver on occasion. + +I'm sure I could tweak the lowat settings, but the small benefit +doesn't seem worth the bother. Just revert it. + +Fixes: 2b877fc53e97 ("SUNRPC: Reduce thread wake-up rate when receiving large RPC messages") +Cc: Jakub Kicinski +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/svcsock.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -1093,9 +1093,6 @@ static void svc_tcp_fragment_received(st + /* If we have more data, signal svc_xprt_enqueue() to try again */ + svsk->sk_tcplen = 0; + svsk->sk_marker = xdr_zero; +- +- smp_wmb(); +- tcp_set_rcvlowat(svsk->sk_sk, 1); + } + + /** +@@ -1185,17 +1182,10 @@ err_incomplete: + goto err_delete; + if (len == want) + svc_tcp_fragment_received(svsk); +- else { +- /* Avoid more ->sk_data_ready() calls until the rest +- * of the message has arrived. This reduces service +- * thread wake-ups on large incoming messages. */ +- tcp_set_rcvlowat(svsk->sk_sk, +- svc_sock_reclen(svsk) - svsk->sk_tcplen); +- ++ else + trace_svcsock_tcp_recv_short(&svsk->sk_xprt, + svc_sock_reclen(svsk), + svsk->sk_tcplen - sizeof(rpc_fraghdr)); +- } + goto err_noclose; + error: + if (len != -EAGAIN) diff --git a/queue-6.6/selftests-rseq-fix-handling-of-glibc-without-rseq-support.patch b/queue-6.6/selftests-rseq-fix-handling-of-glibc-without-rseq-support.patch new file mode 100644 index 0000000000..4ccb611e57 --- /dev/null +++ b/queue-6.6/selftests-rseq-fix-handling-of-glibc-without-rseq-support.patch @@ -0,0 +1,145 @@ +From 336d02bc4c6bec5c3d933e5d470a94970f830957 Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers +Date: Tue, 14 Jan 2025 09:51:32 -0500 +Subject: selftests/rseq: Fix handling of glibc without rseq support + +From: Mathieu Desnoyers + +commit 336d02bc4c6bec5c3d933e5d470a94970f830957 upstream. + +When porting librseq commit: + +commit c7b45750fa85 ("Adapt to glibc __rseq_size feature detection") + +from librseq to the kernel selftests, the following line was missed +at the end of rseq_init(): + + rseq_size = get_rseq_kernel_feature_size(); + +which effectively leaves rseq_size initialized to -1U when glibc does not +have rseq support. glibc supports rseq from version 2.35 onwards. + +In a following librseq commit + +commit c67d198627c2 ("Only set 'rseq_size' on first thread registration") + +to mimic the libc behavior, a new approach is taken: don't set the +feature size in 'rseq_size' until at least one thread has successfully +registered. This allows using 'rseq_size' in fast-paths to test for both +registration status and available features. The caveat is that on libc +either all threads are registered or none are, while with bare librseq +it is the responsability of the user to register all threads using rseq. + +This combines the changes from the following librseq git commits: + +commit c7b45750fa85 ("Adapt to glibc __rseq_size feature detection") +commit c67d198627c2 ("Only set 'rseq_size' on first thread registration") + +Fixes: a0cc649353bb ("selftests/rseq: Fix mm_cid test failure") +Reported-by: Raghavendra Rao Ananta +Signed-off-by: Mathieu Desnoyers +Cc: Raghavendra Rao Ananta +Cc: Shuah Khan +Cc: Peter Zijlstra +Cc: Boqun Feng +Cc: "Paul E. McKenney" +Cc: Carlos O'Donell +Cc: Florian Weimer +Cc: Michael Jeanson +Cc: linux-kselftest@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/rseq/rseq.c | 32 ++++++++++++++++++++++------- + tools/testing/selftests/rseq/rseq.h | 9 +++++++- + 2 files changed, 33 insertions(+), 8 deletions(-) + +diff --git a/tools/testing/selftests/rseq/rseq.c b/tools/testing/selftests/rseq/rseq.c +index 5b9772cdf265..f6156790c3b4 100644 +--- a/tools/testing/selftests/rseq/rseq.c ++++ b/tools/testing/selftests/rseq/rseq.c +@@ -61,7 +61,6 @@ unsigned int rseq_size = -1U; + unsigned int rseq_flags; + + static int rseq_ownership; +-static int rseq_reg_success; /* At least one rseq registration has succeded. */ + + /* Allocate a large area for the TLS. */ + #define RSEQ_THREAD_AREA_ALLOC_SIZE 1024 +@@ -152,14 +151,27 @@ int rseq_register_current_thread(void) + } + rc = sys_rseq(&__rseq_abi, get_rseq_min_alloc_size(), 0, RSEQ_SIG); + if (rc) { +- if (RSEQ_READ_ONCE(rseq_reg_success)) { ++ /* ++ * After at least one thread has registered successfully ++ * (rseq_size > 0), the registration of other threads should ++ * never fail. ++ */ ++ if (RSEQ_READ_ONCE(rseq_size) > 0) { + /* Incoherent success/failure within process. */ + abort(); + } + return -1; + } + assert(rseq_current_cpu_raw() >= 0); +- RSEQ_WRITE_ONCE(rseq_reg_success, 1); ++ ++ /* ++ * The first thread to register sets the rseq_size to mimic the libc ++ * behavior. ++ */ ++ if (RSEQ_READ_ONCE(rseq_size) == 0) { ++ RSEQ_WRITE_ONCE(rseq_size, get_rseq_kernel_feature_size()); ++ } ++ + return 0; + } + +@@ -235,12 +247,18 @@ void rseq_init(void) + return; + } + rseq_ownership = 1; +- if (!rseq_available()) { +- rseq_size = 0; +- return; +- } ++ ++ /* Calculate the offset of the rseq area from the thread pointer. */ + rseq_offset = (void *)&__rseq_abi - rseq_thread_pointer(); ++ ++ /* rseq flags are deprecated, always set to 0. */ + rseq_flags = 0; ++ ++ /* ++ * Set the size to 0 until at least one thread registers to mimic the ++ * libc behavior. ++ */ ++ rseq_size = 0; + } + + static __attribute__((destructor)) +diff --git a/tools/testing/selftests/rseq/rseq.h b/tools/testing/selftests/rseq/rseq.h +index 4e217b620e0c..062d10925a10 100644 +--- a/tools/testing/selftests/rseq/rseq.h ++++ b/tools/testing/selftests/rseq/rseq.h +@@ -60,7 +60,14 @@ + extern ptrdiff_t rseq_offset; + + /* +- * Size of the registered rseq area. 0 if the registration was ++ * The rseq ABI is composed of extensible feature fields. The extensions ++ * are done by appending additional fields at the end of the structure. ++ * The rseq_size defines the size of the active feature set which can be ++ * used by the application for the current rseq registration. Features ++ * starting at offset >= rseq_size are inactive and should not be used. ++ * ++ * The rseq_size is the intersection between the available allocation ++ * size for the rseq area and the feature size supported by the kernel. + * unsuccessful. + */ + extern unsigned int rseq_size; +-- +2.48.1 + diff --git a/queue-6.6/series b/queue-6.6/series index 9dd46aa0e8..64565eaf7e 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -372,3 +372,17 @@ hexagon-fix-using-plain-integer-as-null-pointer-warn.patch hexagon-fix-unbalanced-spinlock-in-die.patch f2fs-introduce-linear-search-for-dentries.patch nfsd-reset-cb_seq_status-after-nfs4err_delay.patch +revert-sunrpc-reduce-thread-wake-up-rate-when-receiving-large-rpc-messages.patch +kbuild-switch-from-lz4c-to-lz4-for-compression.patch +netfilter-nf_tables-reject-mismatching-sum-of-field_len-with-set-key-length.patch +selftests-rseq-fix-handling-of-glibc-without-rseq-support.patch +ktest.pl-check-kernelrelease-return-in-get_version.patch +alsa-usb-audio-add-delay-quirk-for-ibasso-dc07-pro.patch +net-usb-rtl8150-enable-basic-endpoint-checking.patch +usb-xhci-fix-null-pointer-dereference-on-certain-command-aborts.patch +drivers-card_reader-rtsx_usb-restore-interrupt-based-detection.patch +usb-gadget-f_tcm-fix-get-setinterface-return-value.patch +usb-dwc3-am62-fix-an-of-node-leak-in-phy_syscon_pll_refclk.patch +usb-dwc3-core-defer-the-probe-until-usb-power-supply-ready.patch +usb-typec-tcpm-set-src_send_capabilities-timeout-to-pd_t_sender_response.patch +usb-typec-tcpci-prevent-sink-disconnection-before-vppsshutdown-in-spr-pps.patch diff --git a/queue-6.6/usb-dwc3-am62-fix-an-of-node-leak-in-phy_syscon_pll_refclk.patch b/queue-6.6/usb-dwc3-am62-fix-an-of-node-leak-in-phy_syscon_pll_refclk.patch new file mode 100644 index 0000000000..3ddee003c9 --- /dev/null +++ b/queue-6.6/usb-dwc3-am62-fix-an-of-node-leak-in-phy_syscon_pll_refclk.patch @@ -0,0 +1,32 @@ +From a266462b937beba065e934a563efe13dd246a164 Mon Sep 17 00:00:00 2001 +From: Joe Hattori +Date: Thu, 9 Jan 2025 09:16:38 +0900 +Subject: usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk() + +From: Joe Hattori + +commit a266462b937beba065e934a563efe13dd246a164 upstream. + +phy_syscon_pll_refclk() leaks an OF node obtained by +of_parse_phandle_with_fixed_args(), thus add an of_node_put() call. + +Cc: stable +Fixes: e8784c0aec03 ("drivers: usb: dwc3: Add AM62 USB wrapper driver") +Signed-off-by: Joe Hattori +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20250109001638.70033-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-am62.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/dwc3/dwc3-am62.c ++++ b/drivers/usb/dwc3/dwc3-am62.c +@@ -160,6 +160,7 @@ static int phy_syscon_pll_refclk(struct + if (ret) + return ret; + ++ of_node_put(args.np); + am62->offset = args.args[0]; + + ret = regmap_update_bits(am62->syscon, am62->offset, PHY_PLL_REFCLK_MASK, am62->rate_code); diff --git a/queue-6.6/usb-dwc3-core-defer-the-probe-until-usb-power-supply-ready.patch b/queue-6.6/usb-dwc3-core-defer-the-probe-until-usb-power-supply-ready.patch new file mode 100644 index 0000000000..822949a0a7 --- /dev/null +++ b/queue-6.6/usb-dwc3-core-defer-the-probe-until-usb-power-supply-ready.patch @@ -0,0 +1,87 @@ +From 66e0ea341a2a78d14336117f19763bd9be26d45d Mon Sep 17 00:00:00 2001 +From: Kyle Tso +Date: Wed, 15 Jan 2025 12:45:48 +0800 +Subject: usb: dwc3: core: Defer the probe until USB power supply ready + +From: Kyle Tso + +commit 66e0ea341a2a78d14336117f19763bd9be26d45d upstream. + +Currently, DWC3 driver attempts to acquire the USB power supply only +once during the probe. If the USB power supply is not ready at that +time, the driver simply ignores the failure and continues the probe, +leading to permanent non-functioning of the gadget vbus_draw callback. + +Address this problem by delaying the dwc3 driver initialization until +the USB power supply is registered. + +Fixes: 6f0764b5adea ("usb: dwc3: add a power supply for current control") +Cc: stable +Signed-off-by: Kyle Tso +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20250115044548.2701138-1-kyletso@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 30 +++++++++++++++++++++--------- + 1 file changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1505,8 +1505,6 @@ static void dwc3_get_properties(struct d + u8 tx_thr_num_pkt_prd = 0; + u8 tx_max_burst_prd = 0; + u8 tx_fifo_resize_max_num; +- const char *usb_psy_name; +- int ret; + + /* default to highest possible threshold */ + lpm_nyet_threshold = 0xf; +@@ -1541,13 +1539,6 @@ static void dwc3_get_properties(struct d + + dwc->sys_wakeup = device_may_wakeup(dwc->sysdev); + +- ret = device_property_read_string(dev, "usb-psy-name", &usb_psy_name); +- if (ret >= 0) { +- dwc->usb_psy = power_supply_get_by_name(usb_psy_name); +- if (!dwc->usb_psy) +- dev_err(dev, "couldn't get usb power supply\n"); +- } +- + dwc->has_lpm_erratum = device_property_read_bool(dev, + "snps,has-lpm-erratum"); + device_property_read_u8(dev, "snps,lpm-nyet-threshold", +@@ -1887,6 +1878,23 @@ static int dwc3_get_clocks(struct dwc3 * + return 0; + } + ++static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc) ++{ ++ struct power_supply *usb_psy; ++ const char *usb_psy_name; ++ int ret; ++ ++ ret = device_property_read_string(dwc->dev, "usb-psy-name", &usb_psy_name); ++ if (ret < 0) ++ return NULL; ++ ++ usb_psy = power_supply_get_by_name(usb_psy_name); ++ if (!usb_psy) ++ return ERR_PTR(-EPROBE_DEFER); ++ ++ return usb_psy; ++} ++ + static int dwc3_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1940,6 +1948,10 @@ static int dwc3_probe(struct platform_de + + dwc3_get_properties(dwc); + ++ dwc->usb_psy = dwc3_get_usb_power_supply(dwc); ++ if (IS_ERR(dwc->usb_psy)) ++ return dev_err_probe(dev, PTR_ERR(dwc->usb_psy), "couldn't get usb power supply\n"); ++ + dwc->reset = devm_reset_control_array_get_optional_shared(dev); + if (IS_ERR(dwc->reset)) { + ret = PTR_ERR(dwc->reset); diff --git a/queue-6.6/usb-gadget-f_tcm-fix-get-setinterface-return-value.patch b/queue-6.6/usb-gadget-f_tcm-fix-get-setinterface-return-value.patch new file mode 100644 index 0000000000..e617064494 --- /dev/null +++ b/queue-6.6/usb-gadget-f_tcm-fix-get-setinterface-return-value.patch @@ -0,0 +1,50 @@ +From 3b997089903b909684114aca6f79d683e5c64a0e Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Wed, 11 Dec 2024 00:31:55 +0000 +Subject: usb: gadget: f_tcm: Fix Get/SetInterface return value + +From: Thinh Nguyen + +commit 3b997089903b909684114aca6f79d683e5c64a0e upstream. + +Check to make sure that the GetInterface and SetInterface are for valid +interface. Return proper alternate setting number on GetInterface. + +Fixes: 0b8b1a1fede0 ("usb: gadget: f_tcm: Provide support to get alternate setting in tcm function") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/ffd91b4640945ea4d3b4f4091cf1abbdbd9cf4fc.1733876548.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_tcm.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_tcm.c ++++ b/drivers/usb/gadget/function/f_tcm.c +@@ -2048,9 +2048,14 @@ static void tcm_delayed_set_alt(struct w + + static int tcm_get_alt(struct usb_function *f, unsigned intf) + { +- if (intf == bot_intf_desc.bInterfaceNumber) ++ struct f_uas *fu = to_f_uas(f); ++ ++ if (fu->iface != intf) ++ return -EOPNOTSUPP; ++ ++ if (fu->flags & USBG_IS_BOT) + return USB_G_ALT_INT_BBB; +- if (intf == uasp_intf_desc.bInterfaceNumber) ++ else if (fu->flags & USBG_IS_UAS) + return USB_G_ALT_INT_UAS; + + return -EOPNOTSUPP; +@@ -2060,6 +2065,9 @@ static int tcm_set_alt(struct usb_functi + { + struct f_uas *fu = to_f_uas(f); + ++ if (fu->iface != intf) ++ return -EOPNOTSUPP; ++ + if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) { + struct guas_setup_wq *work; + diff --git a/queue-6.6/usb-typec-tcpci-prevent-sink-disconnection-before-vppsshutdown-in-spr-pps.patch b/queue-6.6/usb-typec-tcpci-prevent-sink-disconnection-before-vppsshutdown-in-spr-pps.patch new file mode 100644 index 0000000000..ffde354d6d --- /dev/null +++ b/queue-6.6/usb-typec-tcpci-prevent-sink-disconnection-before-vppsshutdown-in-spr-pps.patch @@ -0,0 +1,100 @@ +From 4d27afbf256028a1f54363367f30efc8854433c3 Mon Sep 17 00:00:00 2001 +From: Kyle Tso +Date: Tue, 14 Jan 2025 22:24:35 +0800 +Subject: usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS + +From: Kyle Tso + +commit 4d27afbf256028a1f54363367f30efc8854433c3 upstream. + +The Source can drop its output voltage to the minimum of the requested +PPS APDO voltage range when it is in Current Limit Mode. If this voltage +falls within the range of vPpsShutdown, the Source initiates a Hard +Reset and discharges Vbus. However, currently the Sink may disconnect +before the voltage reaches vPpsShutdown, leading to unexpected behavior. + +Prevent premature disconnection by setting the Sink's disconnect +threshold to the minimum vPpsShutdown value. Additionally, consider the +voltage drop due to IR drop when calculating the appropriate threshold. +This ensures a robust and reliable interaction between the Source and +Sink during SPR PPS Current Limit Mode operation. + +Fixes: 4288debeaa4e ("usb: typec: tcpci: Fix up sink disconnect thresholds for PD") +Cc: stable +Signed-off-by: Kyle Tso +Reviewed-by: Heikki Krogerus +Reviewed-by: Badhri Jagan Sridharan +Link: https://lore.kernel.org/r/20250114142435.2093857-1-kyletso@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpci.c | 13 +++++++++---- + drivers/usb/typec/tcpm/tcpm.c | 8 +++++--- + include/linux/usb/tcpm.h | 3 ++- + 3 files changed, 16 insertions(+), 8 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -26,6 +26,7 @@ + #define VPPS_NEW_MIN_PERCENT 95 + #define VPPS_VALID_MIN_MV 100 + #define VSINKDISCONNECT_PD_MIN_PERCENT 90 ++#define VPPS_SHUTDOWN_MIN_PERCENT 85 + + struct tcpci { + struct device *dev; +@@ -337,7 +338,8 @@ static int tcpci_enable_auto_vbus_discha + } + + static int tcpci_set_auto_vbus_discharge_threshold(struct tcpc_dev *dev, enum typec_pwr_opmode mode, +- bool pps_active, u32 requested_vbus_voltage_mv) ++ bool pps_active, u32 requested_vbus_voltage_mv, ++ u32 apdo_min_voltage_mv) + { + struct tcpci *tcpci = tcpc_to_tcpci(dev); + unsigned int pwr_ctrl, threshold = 0; +@@ -359,9 +361,12 @@ static int tcpci_set_auto_vbus_discharge + threshold = AUTO_DISCHARGE_DEFAULT_THRESHOLD_MV; + } else if (mode == TYPEC_PWR_MODE_PD) { + if (pps_active) +- threshold = ((VPPS_NEW_MIN_PERCENT * requested_vbus_voltage_mv / 100) - +- VSINKPD_MIN_IR_DROP_MV - VPPS_VALID_MIN_MV) * +- VSINKDISCONNECT_PD_MIN_PERCENT / 100; ++ /* ++ * To prevent disconnect when the source is in Current Limit Mode. ++ * Set the threshold to the lowest possible voltage vPpsShutdown (min) ++ */ ++ threshold = VPPS_SHUTDOWN_MIN_PERCENT * apdo_min_voltage_mv / 100 - ++ VSINKPD_MIN_IR_DROP_MV; + else + threshold = ((VSRC_NEW_MIN_PERCENT * requested_vbus_voltage_mv / 100) - + VSINKPD_MIN_IR_DROP_MV - VSRC_VALID_MIN_MV) * +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -2326,10 +2326,12 @@ static int tcpm_set_auto_vbus_discharge_ + return 0; + + ret = port->tcpc->set_auto_vbus_discharge_threshold(port->tcpc, mode, pps_active, +- requested_vbus_voltage); ++ requested_vbus_voltage, ++ port->pps_data.min_volt); + tcpm_log_force(port, +- "set_auto_vbus_discharge_threshold mode:%d pps_active:%c vbus:%u ret:%d", +- mode, pps_active ? 'y' : 'n', requested_vbus_voltage, ret); ++ "set_auto_vbus_discharge_threshold mode:%d pps_active:%c vbus:%u pps_apdo_min_volt:%u ret:%d", ++ mode, pps_active ? 'y' : 'n', requested_vbus_voltage, ++ port->pps_data.min_volt, ret); + + return ret; + } +--- a/include/linux/usb/tcpm.h ++++ b/include/linux/usb/tcpm.h +@@ -150,7 +150,8 @@ struct tcpc_dev { + void (*frs_sourcing_vbus)(struct tcpc_dev *dev); + int (*enable_auto_vbus_discharge)(struct tcpc_dev *dev, bool enable); + int (*set_auto_vbus_discharge_threshold)(struct tcpc_dev *dev, enum typec_pwr_opmode mode, +- bool pps_active, u32 requested_vbus_voltage); ++ bool pps_active, u32 requested_vbus_voltage, ++ u32 pps_apdo_min_voltage); + bool (*is_vbus_vsafe0v)(struct tcpc_dev *dev); + void (*set_partner_usb_comm_capable)(struct tcpc_dev *dev, bool enable); + void (*check_contaminant)(struct tcpc_dev *dev); diff --git a/queue-6.6/usb-typec-tcpm-set-src_send_capabilities-timeout-to-pd_t_sender_response.patch b/queue-6.6/usb-typec-tcpm-set-src_send_capabilities-timeout-to-pd_t_sender_response.patch new file mode 100644 index 0000000000..334d7658da --- /dev/null +++ b/queue-6.6/usb-typec-tcpm-set-src_send_capabilities-timeout-to-pd_t_sender_response.patch @@ -0,0 +1,36 @@ +From 2eb3da037c2c20fa30bc502bc092479b2a1aaae2 Mon Sep 17 00:00:00 2001 +From: Jos Wang +Date: Sun, 5 Jan 2025 21:52:45 +0800 +Subject: usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE + +From: Jos Wang + +commit 2eb3da037c2c20fa30bc502bc092479b2a1aaae2 upstream. + +As PD2.0 spec ("8.3.3.2.3 PE_SRC_Send_Capabilities state"), after the +Source receives the GoodCRC Message from the Sink in response to the +Source_Capabilities message, it should start the SenderResponseTimer, +after the timer times out, the state machine transitions to the +HARD_RESET state. + +Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") +Cc: stable@vger.kernel.org +Signed-off-by: Jos Wang +Reviewed-by: Badhri Jagan Sridharan +Link: https://lore.kernel.org/r/20250105135245.7493-1-joswang1221@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4065,7 +4065,7 @@ static void run_state_machine(struct tcp + port->caps_count = 0; + port->pd_capable = true; + tcpm_set_state_cond(port, SRC_SEND_CAPABILITIES_TIMEOUT, +- PD_T_SEND_SOURCE_CAP); ++ PD_T_SENDER_RESPONSE); + } + break; + case SRC_SEND_CAPABILITIES_TIMEOUT: diff --git a/queue-6.6/usb-xhci-fix-null-pointer-dereference-on-certain-command-aborts.patch b/queue-6.6/usb-xhci-fix-null-pointer-dereference-on-certain-command-aborts.patch new file mode 100644 index 0000000000..861a9aa495 --- /dev/null +++ b/queue-6.6/usb-xhci-fix-null-pointer-dereference-on-certain-command-aborts.patch @@ -0,0 +1,51 @@ +From 1e0a19912adb68a4b2b74fd77001c96cd83eb073 Mon Sep 17 00:00:00 2001 +From: Michal Pecio +Date: Fri, 27 Dec 2024 14:01:40 +0200 +Subject: usb: xhci: Fix NULL pointer dereference on certain command aborts + +From: Michal Pecio + +commit 1e0a19912adb68a4b2b74fd77001c96cd83eb073 upstream. + +If a command is queued to the final usable TRB of a ring segment, the +enqueue pointer is advanced to the subsequent link TRB and no further. +If the command is later aborted, when the abort completion is handled +the dequeue pointer is advanced to the first TRB of the next segment. + +If no further commands are queued, xhci_handle_stopped_cmd_ring() sees +the ring pointers unequal and assumes that there is a pending command, +so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL. + +Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell +ring likely is unnecessary too, but it's harmless. Leave it alone. + +This is probably Bug 219532, but no confirmation has been received. + +The issue has been independently reproduced and confirmed fixed using +a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever. +Everything continued working normally after several prevented crashes. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219532 +Fixes: c311e391a7ef ("xhci: rework command timeout and cancellation,") +CC: stable@vger.kernel.org +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20241227120142.1035206-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-ring.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -420,7 +420,8 @@ static void xhci_handle_stopped_cmd_ring + if ((xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue) && + !(xhci->xhc_state & XHCI_STATE_DYING)) { + xhci->current_cmd = cur_cmd; +- xhci_mod_cmd_timer(xhci); ++ if (cur_cmd) ++ xhci_mod_cmd_timer(xhci); + xhci_ring_cmd_db(xhci); + } + } -- 2.47.2