From: Sasha Levin Date: Mon, 14 Jul 2025 17:18:54 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v5.4.296~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=315ac7194b8b6bfc084092975b8c7293c07e5ff9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/atm-idt77252-add-missing-dma_map_error.patch b/queue-5.10/atm-idt77252-add-missing-dma_map_error.patch new file mode 100644 index 0000000000..c6eb9fbd8f --- /dev/null +++ b/queue-5.10/atm-idt77252-add-missing-dma_map_error.patch @@ -0,0 +1,53 @@ +From e3c113ddf34912a235a7721896324f0e1b1da2a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 08:41:47 +0200 +Subject: atm: idt77252: Add missing `dma_map_error()` + +From: Thomas Fourier + +[ Upstream commit c4890963350dcf4e9a909bae23665921fba4ad27 ] + +The DMA map functions can fail and should be tested for errors. + +Signed-off-by: Thomas Fourier +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250624064148.12815-3-fourier.thomas@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/atm/idt77252.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index 25fd73fafb371..89b0ed8e51430 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -852,6 +852,8 @@ queue_skb(struct idt77252_dev *card, struct vc_map *vc, + + IDT77252_PRV_PADDR(skb) = dma_map_single(&card->pcidev->dev, skb->data, + skb->len, DMA_TO_DEVICE); ++ if (dma_mapping_error(&card->pcidev->dev, IDT77252_PRV_PADDR(skb))) ++ return -ENOMEM; + + error = -EINVAL; + +@@ -1863,6 +1865,8 @@ add_rx_skb(struct idt77252_dev *card, int queue, + paddr = dma_map_single(&card->pcidev->dev, skb->data, + skb_end_pointer(skb) - skb->data, + DMA_FROM_DEVICE); ++ if (dma_mapping_error(&card->pcidev->dev, paddr)) ++ goto outpoolrm; + IDT77252_PRV_PADDR(skb) = paddr; + + if (push_rx_skb(card, skb, queue)) { +@@ -1877,6 +1881,7 @@ add_rx_skb(struct idt77252_dev *card, int queue, + dma_unmap_single(&card->pcidev->dev, IDT77252_PRV_PADDR(skb), + skb_end_pointer(skb) - skb->data, DMA_FROM_DEVICE); + ++outpoolrm: + handle = IDT77252_PRV_POOL(skb); + card->sbpool[POOL_QUEUE(handle)].skb[POOL_INDEX(handle)] = NULL; + +-- +2.39.5 + diff --git a/queue-5.10/bluetooth-hci-set-extended-advertising-data-synchron.patch b/queue-5.10/bluetooth-hci-set-extended-advertising-data-synchron.patch new file mode 100644 index 0000000000..a790c88638 --- /dev/null +++ b/queue-5.10/bluetooth-hci-set-extended-advertising-data-synchron.patch @@ -0,0 +1,97 @@ +From 8766e406adb9b3c4bd8c0506a71bbbf99a43906d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jul 2025 02:08:03 -0400 +Subject: Bluetooth: HCI: Set extended advertising data synchronously + +From: Christian Eggers + +[ Upstream commit 89fb8acc38852116d38d721ad394aad7f2871670 ] + +Currently, for controllers with extended advertising, the advertising +data is set in the asynchronous response handler for extended +adverstising params. As most advertising settings are performed in a +synchronous context, the (asynchronous) setting of the advertising data +is done too late (after enabling the advertising). + +Move setting of adverstising data from asynchronous response handler +into synchronous context to fix ordering of HCI commands. + +Signed-off-by: Christian Eggers +Fixes: a0fb3726ba55 ("Bluetooth: Use Set ext adv/scan rsp data if controller supports") +Cc: stable@vger.kernel.org +v2: https://lore.kernel.org/linux-bluetooth/20250626115209.17839-1-ceggers@arri.de/ +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 33 --------------------------------- + net/bluetooth/hci_request.c | 3 +++ + 2 files changed, 3 insertions(+), 33 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 7f26c1aab9a06..2cc4aaba09abe 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -1726,36 +1726,6 @@ static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb) + hci_dev_unlock(hdev); + } + +-static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb) +-{ +- struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data; +- struct hci_cp_le_set_ext_adv_params *cp; +- struct adv_info *adv_instance; +- +- BT_DBG("%s status 0x%2.2x", hdev->name, rp->status); +- +- if (rp->status) +- return; +- +- cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS); +- if (!cp) +- return; +- +- hci_dev_lock(hdev); +- hdev->adv_addr_type = cp->own_addr_type; +- if (!hdev->cur_adv_instance) { +- /* Store in hdev for instance 0 */ +- hdev->adv_tx_power = rp->tx_power; +- } else { +- adv_instance = hci_find_adv_instance(hdev, +- hdev->cur_adv_instance); +- if (adv_instance) +- adv_instance->tx_power = rp->tx_power; +- } +- /* Update adv data as tx power is known now */ +- hci_req_update_adv_data(hdev, hdev->cur_adv_instance); +- hci_dev_unlock(hdev); +-} + + static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb) + { +@@ -3601,9 +3571,6 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb, + hci_cc_le_read_num_adv_sets(hdev, skb); + break; + +- case HCI_OP_LE_SET_EXT_ADV_PARAMS: +- hci_cc_set_ext_adv_param(hdev, skb); +- break; + + case HCI_OP_LE_SET_EXT_ADV_ENABLE: + hci_cc_le_set_ext_adv_enable(hdev, skb); +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 7ce6db1ac558a..743ba58941f8b 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -2179,6 +2179,9 @@ int __hci_req_setup_ext_adv_instance(struct hci_request *req, u8 instance) + + hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp); + ++ /* Update adv data after setting ext adv params */ ++ __hci_req_update_adv_data(req, instance); ++ + if (own_addr_type == ADDR_LE_DEV_RANDOM && + bacmp(&random_addr, BDADDR_ANY)) { + struct hci_cp_le_set_adv_set_rand_addr cp; +-- +2.39.5 + diff --git a/queue-5.10/bnxt_en-fix-dcb-ets-validation.patch b/queue-5.10/bnxt_en-fix-dcb-ets-validation.patch new file mode 100644 index 0000000000..9165674c82 --- /dev/null +++ b/queue-5.10/bnxt_en-fix-dcb-ets-validation.patch @@ -0,0 +1,49 @@ +From 5c6deec90728c840b2129b4fe316c38fc3efe6b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jul 2025 14:39:36 -0700 +Subject: bnxt_en: Fix DCB ETS validation + +From: Shravya KN + +[ Upstream commit b74c2a2e9cc471e847abd87e50a2354c07e02040 ] + +In bnxt_ets_validate(), the code incorrectly loops over all possible +traffic classes to check and add the ETS settings. Fix it to loop +over the configured traffic classes only. + +The unconfigured traffic classes will default to TSA_ETS with 0 +bandwidth. Looping over these unconfigured traffic classes may +cause the validation to fail and trigger this error message: + +"rejecting ETS config starving a TC\n" + +The .ieee_setets() will then fail. + +Fixes: 7df4ae9fe855 ("bnxt_en: Implement DCBNL to support host-based DCBX.") +Reviewed-by: Sreekanth Reddy +Signed-off-by: Shravya KN +Signed-off-by: Michael Chan +Link: https://patch.msgid.link/20250710213938.1959625-2-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c +index 8e90224c43a21..6464de38c82e2 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c +@@ -447,7 +447,9 @@ static int bnxt_ets_validate(struct bnxt *bp, struct ieee_ets *ets, u8 *tc) + + if ((ets->tc_tx_bw[i] || ets->tc_tsa[i]) && i > bp->max_tc) + return -EINVAL; ++ } + ++ for (i = 0; i < max_tc; i++) { + switch (ets->tc_tsa[i]) { + case IEEE_8021QAZ_TSA_STRICT: + break; +-- +2.39.5 + diff --git a/queue-5.10/bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch b/queue-5.10/bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch new file mode 100644 index 0000000000..d38022fbf4 --- /dev/null +++ b/queue-5.10/bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch @@ -0,0 +1,72 @@ +From 6bd53da597f85c952ce40ceba674a010b3d3becd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jul 2025 14:39:38 -0700 +Subject: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT + +From: Somnath Kotur + +[ Upstream commit 3cdf199d4755d477972ee87110b2aebc88b3cfad ] + +When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() +with the proper length instead of 0. This bug triggers this warning +on a system with IOMMU enabled: + +WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 +RIP: 0010:__iommu_dma_unmap+0x159/0x170 +Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 +b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 +RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 +RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 +R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 +R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 +FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 +PKRU: 55555554 +Call Trace: + +? show_regs+0x6d/0x80 +? __warn+0x89/0x160 +? __iommu_dma_unmap+0x159/0x170 +? report_bug+0x17e/0x1b0 +? handle_bug+0x46/0x90 +? exc_invalid_op+0x18/0x80 +? asm_exc_invalid_op+0x1b/0x20 +? __iommu_dma_unmap+0x159/0x170 +? __iommu_dma_unmap+0xb3/0x170 +iommu_dma_unmap_page+0x4f/0x100 +dma_unmap_page_attrs+0x52/0x220 +? srso_alias_return_thunk+0x5/0xfbef5 +? xdp_return_frame+0x2e/0xd0 +bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] +__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] +bnxt_poll+0xd3/0x1e0 [bnxt_en] + +Fixes: f18c2b77b2e4 ("bnxt_en: optimized XDP_REDIRECT support") +Signed-off-by: Somnath Kotur +Signed-off-by: Michael Chan +Link: https://patch.msgid.link/20250710213938.1959625-4-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index fcc262064766a..dc9afaa14da8f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -65,7 +65,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp, + tx_buf->action = XDP_REDIRECT; + tx_buf->xdpf = xdpf; + dma_unmap_addr_set(tx_buf, mapping, mapping); +- dma_unmap_len_set(tx_buf, len, 0); ++ dma_unmap_len_set(tx_buf, len, len); + } + + void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) +-- +2.39.5 + diff --git a/queue-5.10/btrfs-fix-inode-lookup-error-handling-during-log-rep.patch b/queue-5.10/btrfs-fix-inode-lookup-error-handling-during-log-rep.patch new file mode 100644 index 0000000000..962c53a9e2 --- /dev/null +++ b/queue-5.10/btrfs-fix-inode-lookup-error-handling-during-log-rep.patch @@ -0,0 +1,340 @@ +From e15b371eabf4c0fe7cff14155cb392813ab5709a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jun 2025 15:58:31 +0100 +Subject: btrfs: fix inode lookup error handling during log replay + +From: Filipe Manana + +[ Upstream commit 5f61b961599acbd2bed028d3089105a1f7d224b8 ] + +When replaying log trees we use read_one_inode() to get an inode, which is +just a wrapper around btrfs_iget_logging(), which in turn is a wrapper for +btrfs_iget(). But read_one_inode() always returns NULL for any error +that btrfs_iget_logging() / btrfs_iget() may return and this is a problem +because: + +1) In many callers of read_one_inode() we convert the NULL into -EIO, + which is not accurate since btrfs_iget() may return -ENOMEM and -ENOENT + for example, besides -EIO and other errors. So during log replay we + may end up reporting a false -EIO, which is confusing since we may + not have had any IO error at all; + +2) When replaying directory deletes, at replay_dir_deletes(), we assume + the NULL returned from read_one_inode() means that the inode doesn't + exist and then proceed as if no error had happened. This is wrong + because unless btrfs_iget() returned ERR_PTR(-ENOENT), we had an + actual error and the target inode may exist in the target subvolume + root - this may later result in the log replay code failing at a + later stage (if we are "lucky") or succeed but leaving some + inconsistency in the filesystem. + +So fix this by not ignoring errors from btrfs_iget_logging() and as +a consequence remove the read_one_inode() wrapper and just use +btrfs_iget_logging() directly. Also since btrfs_iget_logging() is +supposed to be called only against subvolume roots, just like +read_one_inode() which had a comment about it, add an assertion to +btrfs_iget_logging() to check that the target root corresponds to a +subvolume root. + +Fixes: 5d4f98a28c7d ("Btrfs: Mixed back reference (FORWARD ROLLING FORMAT CHANGE)") +Reviewed-by: Johannes Thumshirn +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/tree-log.c | 153 ++++++++++++++++++++++++-------------------- + 1 file changed, 84 insertions(+), 69 deletions(-) + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index dd1c40019412c..503be060fa8f3 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -4,10 +4,12 @@ + */ + + #include ++#include + #include + #include + #include + #include ++#include + #include "misc.h" + #include "ctree.h" + #include "tree-log.h" +@@ -129,6 +131,27 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans, + * and once to do all the other items. + */ + ++static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root) ++{ ++ unsigned int nofs_flag; ++ struct inode *inode; ++ ++ /* Only meant to be called for subvolume roots and not for log roots. */ ++ ASSERT(is_fstree(root->root_key.objectid)); ++ ++ /* ++ * We're holding a transaction handle whether we are logging or ++ * replaying a log tree, so we must make sure NOFS semantics apply ++ * because btrfs_alloc_inode() may be triggered and it uses GFP_KERNEL ++ * to allocate an inode, which can recurse back into the filesystem and ++ * attempt a transaction commit, resulting in a deadlock. ++ */ ++ nofs_flag = memalloc_nofs_save(); ++ inode = btrfs_iget(root->fs_info->sb, objectid, root); ++ memalloc_nofs_restore(nofs_flag); ++ ++ return inode; ++} + /* + * start a sub transaction and setup the log tree + * this increments the log tree writer count to make the people +@@ -543,20 +566,6 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans, + return 0; + } + +-/* +- * simple helper to read an inode off the disk from a given root +- * This can only be called for subvolume roots and not for the log +- */ +-static noinline struct inode *read_one_inode(struct btrfs_root *root, +- u64 objectid) +-{ +- struct inode *inode; +- +- inode = btrfs_iget(root->fs_info->sb, objectid, root); +- if (IS_ERR(inode)) +- inode = NULL; +- return inode; +-} + + /* replays a single extent in 'eb' at 'slot' with 'key' into the + * subvolume 'root'. path is released on entry and should be released +@@ -610,11 +619,9 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans, + goto out; + } + +- inode = read_one_inode(root, key->objectid); +- if (!inode) { +- ret = -EIO; +- goto out; +- } ++ inode = btrfs_iget_logging(key->objectid, root); ++ if (IS_ERR(inode)) ++ return PTR_ERR(inode); + + /* + * first check to see if we already have this extent in the +@@ -871,9 +878,10 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans, + read_extent_buffer(leaf, name, (unsigned long)(di + 1), name_len); + btrfs_release_path(path); + +- inode = read_one_inode(root, location.objectid); +- if (!inode) { +- ret = -EIO; ++ inode = btrfs_iget_logging(location.objectid, root); ++ if (IS_ERR(inode)) { ++ ret = PTR_ERR(inode); ++ inode = NULL; + goto out; + } + +@@ -1115,10 +1123,10 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, + kfree(victim_name); + return ret; + } else if (!ret) { +- ret = -ENOENT; +- victim_parent = read_one_inode(root, +- parent_objectid); +- if (victim_parent) { ++ victim_parent = btrfs_iget_logging(parent_objectid, root); ++ if (IS_ERR(victim_parent)) { ++ ret = PTR_ERR(victim_parent); ++ } else { + inc_nlink(&inode->vfs_inode); + btrfs_release_path(path); + +@@ -1278,9 +1286,9 @@ static int unlink_old_inode_refs(struct btrfs_trans_handle *trans, + struct inode *dir; + + btrfs_release_path(path); +- dir = read_one_inode(root, parent_id); +- if (!dir) { +- ret = -ENOENT; ++ dir = btrfs_iget_logging(parent_id, root); ++ if (IS_ERR(dir)) { ++ ret = PTR_ERR(dir); + kfree(name); + goto out; + } +@@ -1386,9 +1394,9 @@ static int add_link(struct btrfs_trans_handle *trans, struct btrfs_root *root, + */ + btrfs_dir_item_key_to_cpu(path->nodes[0], dir_item, &key); + btrfs_release_path(path); +- other_inode = read_one_inode(root, key.objectid); +- if (!other_inode) { +- ret = -ENOENT; ++ other_inode = btrfs_iget_logging(key.objectid, root); ++ if (IS_ERR(other_inode)) { ++ ret = PTR_ERR(other_inode); + goto out; + } + ret = btrfs_unlink_inode(trans, root, BTRFS_I(dir), BTRFS_I(other_inode), +@@ -1464,15 +1472,17 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, + * copy the back ref in. The link count fixup code will take + * care of the rest + */ +- dir = read_one_inode(root, parent_objectid); +- if (!dir) { +- ret = -ENOENT; ++ dir = btrfs_iget_logging(parent_objectid, root); ++ if (IS_ERR(dir)) { ++ ret = PTR_ERR(dir); ++ dir = NULL; + goto out; + } + +- inode = read_one_inode(root, inode_objectid); +- if (!inode) { +- ret = -EIO; ++ inode = btrfs_iget_logging(inode_objectid, root); ++ if (IS_ERR(inode)) { ++ ret = PTR_ERR(inode); ++ inode = NULL; + goto out; + } + +@@ -1484,11 +1494,13 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, + * parent object can change from one array + * item to another. + */ +- if (!dir) +- dir = read_one_inode(root, parent_objectid); + if (!dir) { +- ret = -ENOENT; +- goto out; ++ dir = btrfs_iget_logging(parent_objectid, root); ++ if (IS_ERR(dir)) { ++ ret = PTR_ERR(dir); ++ dir = NULL; ++ goto out; ++ } + } + } else { + ret = ref_get_fields(eb, ref_ptr, &namelen, &name, +@@ -1807,9 +1819,9 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans, + break; + + btrfs_release_path(path); +- inode = read_one_inode(root, key.offset); +- if (!inode) { +- ret = -EIO; ++ inode = btrfs_iget_logging(key.offset, root); ++ if (IS_ERR(inode)) { ++ ret = PTR_ERR(inode); + break; + } + +@@ -1844,9 +1856,9 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, + int ret = 0; + struct inode *inode; + +- inode = read_one_inode(root, objectid); +- if (!inode) +- return -EIO; ++ inode = btrfs_iget_logging(objectid, root); ++ if (IS_ERR(inode)) ++ return PTR_ERR(inode); + + key.objectid = BTRFS_TREE_LOG_FIXUP_OBJECTID; + key.type = BTRFS_ORPHAN_ITEM_KEY; +@@ -1884,14 +1896,14 @@ static noinline int insert_one_name(struct btrfs_trans_handle *trans, + struct inode *dir; + int ret; + +- inode = read_one_inode(root, location->objectid); +- if (!inode) +- return -ENOENT; ++ inode = btrfs_iget_logging(location->objectid, root); ++ if (IS_ERR(inode)) ++ return PTR_ERR(inode); + +- dir = read_one_inode(root, dirid); +- if (!dir) { ++ dir = btrfs_iget_logging(dirid, root); ++ if (IS_ERR(dir)) { + iput(inode); +- return -EIO; ++ return PTR_ERR(dir); + } + + ret = btrfs_add_link(trans, BTRFS_I(dir), BTRFS_I(inode), name, +@@ -1939,9 +1951,9 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans, + bool update_size = (key->type == BTRFS_DIR_INDEX_KEY); + bool name_added = false; + +- dir = read_one_inode(root, key->objectid); +- if (!dir) +- return -EIO; ++ dir = btrfs_iget_logging(key->objectid, root); ++ if (IS_ERR(dir)) ++ return PTR_ERR(dir); + + name_len = btrfs_dir_name_len(eb, di); + name = kmalloc(name_len, GFP_NOFS); +@@ -2287,10 +2299,10 @@ static noinline int check_item_in_log(struct btrfs_trans_handle *trans, + btrfs_dir_item_key_to_cpu(eb, di, &location); + btrfs_release_path(path); + btrfs_release_path(log_path); +- inode = read_one_inode(root, location.objectid); +- if (!inode) { ++ inode = btrfs_iget_logging(location.objectid, root); ++ if (IS_ERR(inode)) { + kfree(name); +- return -EIO; ++ return PTR_ERR(inode); + } + + ret = link_to_fixup_dir(trans, root, +@@ -2466,14 +2478,17 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans, + if (!log_path) + return -ENOMEM; + +- dir = read_one_inode(root, dirid); +- /* it isn't an error if the inode isn't there, that can happen +- * because we replay the deletes before we copy in the inode item +- * from the log ++ dir = btrfs_iget_logging(dirid, root); ++ /* ++ * It isn't an error if the inode isn't there, that can happen because ++ * we replay the deletes before we copy in the inode item from the log. + */ +- if (!dir) { ++ if (IS_ERR(dir)) { + btrfs_free_path(log_path); +- return 0; ++ ret = PTR_ERR(dir); ++ if (ret == -ENOENT) ++ ret = 0; ++ return ret; + } + again: + range_start = 0; +@@ -2633,9 +2648,9 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb, + struct inode *inode; + u64 from; + +- inode = read_one_inode(root, key.objectid); +- if (!inode) { +- ret = -EIO; ++ inode = btrfs_iget_logging(key.objectid, root); ++ if (IS_ERR(inode)) { ++ ret = PTR_ERR(inode); + break; + } + from = ALIGN(i_size_read(inode), +-- +2.39.5 + diff --git a/queue-5.10/can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch b/queue-5.10/can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch new file mode 100644 index 0000000000..c719d540a4 --- /dev/null +++ b/queue-5.10/can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch @@ -0,0 +1,40 @@ +From a3ed381977879099c27cd9763d6710e276226997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jul 2025 12:12:02 +0200 +Subject: can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message + to debug level + +From: Sean Nyekjaer + +[ Upstream commit 58805e9cbc6f6a28f35d90e740956e983a0e036e ] + +Downgrade the "msg lost in rx" message to debug level, to prevent +flooding the kernel log with error messages. + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Reviewed-by: Vincent Mailhol +Signed-off-by: Sean Nyekjaer +Link: https://patch.msgid.link/20250711-mcan_ratelimit-v3-1-7413e8e21b84@geanix.com +[mkl: enhance commit message] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 6181ac277b62f..1c8a7c65530fd 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -522,7 +522,7 @@ static int m_can_handle_lost_msg(struct net_device *dev) + struct sk_buff *skb; + struct can_frame *frame; + +- netdev_err(dev, "msg lost in rxf0\n"); ++ netdev_dbg(dev, "msg lost in rxf0\n"); + + stats->rx_errors++; + stats->rx_over_errors++; +-- +2.39.5 + diff --git a/queue-5.10/dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch b/queue-5.10/dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch new file mode 100644 index 0000000000..08ff787799 --- /dev/null +++ b/queue-5.10/dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch @@ -0,0 +1,51 @@ +From d3d2e9809ed0669a89ed7f3a1b3f191479cd54bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jul 2025 05:23:25 -0400 +Subject: dma-buf: fix timeout handling in dma_resv_wait_timeout v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 2b95a7db6e0f75587bffddbb490399cbb87e4985 ] + +Even the kerneldoc says that with a zero timeout the function should not +wait for anything, but still return 1 to indicate that the fences are +signaled now. + +Unfortunately that isn't what was implemented, instead of only returning +1 we also waited for at least one jiffies. + +Fix that by adjusting the handling to what the function is actually +documented to do. + +v2: improve code readability + +Reported-by: Marek Olšák +Reported-by: Lucas Stach +Signed-off-by: Christian König +Reviewed-by: Lucas Stach +Cc: +Link: https://lore.kernel.org/r/20250129105841.1806-1-christian.koenig@amd.com +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/dma-resv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c +index 1187e5e80eded..539cb4e043386 100644 +--- a/drivers/dma-buf/dma-resv.c ++++ b/drivers/dma-buf/dma-resv.c +@@ -591,7 +591,7 @@ long dma_resv_wait_timeout_rcu(struct dma_resv *obj, + goto retry; + } + +- ret = dma_fence_wait_timeout(fence, intr, ret); ++ ret = dma_fence_wait_timeout(fence, intr, timeout); + dma_fence_put(fence); + if (ret > 0 && wait_all && (i + 1 < shared_count)) + goto retry; +-- +2.39.5 + diff --git a/queue-5.10/hid-add-ignore-quirk-for-smartlinktechnology.patch b/queue-5.10/hid-add-ignore-quirk-for-smartlinktechnology.patch new file mode 100644 index 0000000000..c4406565f7 --- /dev/null +++ b/queue-5.10/hid-add-ignore-quirk-for-smartlinktechnology.patch @@ -0,0 +1,65 @@ +From 4084e76a559275262d85abb62d895f982a453d41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 15:29:59 +0800 +Subject: HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY + +From: Zhang Heng + +[ Upstream commit 1a8953f4f7746c6a515989774fe03047c522c613 ] + +MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an +audio device is requested to get specific report id, the following error +may occur. + +[ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd +[ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00 +[ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +[ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device +[ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology +[ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001 +[ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35 +[ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2 +[ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint +[ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) + +Ignore HID interface. The device is working properly. + +Signed-off-by: Zhang Heng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 4b8f8e0ce8ca2..981ff6b233a40 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1360,4 +1360,7 @@ + #define USB_VENDOR_ID_SIGNOTEC 0x2133 + #define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 + ++#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a ++#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155 ++ + #endif +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index b3e7ede8f398e..423d18a77b9e8 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -873,6 +873,7 @@ static const struct hid_device_id hid_ignore_list[] = { + #endif + { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) }, + { } + }; + +-- +2.39.5 + diff --git a/queue-5.10/hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch b/queue-5.10/hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch new file mode 100644 index 0000000000..a158ee56a7 --- /dev/null +++ b/queue-5.10/hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch @@ -0,0 +1,54 @@ +From 9be15ff5cf9d8412343b57276a1d261f7c31ed42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 13:50:15 +0800 +Subject: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 54bae4c17c11688339eb73a04fd24203bb6e7494 ] + +The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) +report a HID sensor interface that is not actually implemented. +Attempting to access this non-functional sensor via iio_info causes +system hangs as runtime PM tries to wake up an unresponsive sensor. + +Add these 2 devices to the HID ignore list since the sensor interface is +non-functional by design and should not be exposed to userspace. + +Signed-off-by: Chia-Lin Kao (AceLan) +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 2 ++ + drivers/hid/hid-quirks.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 981ff6b233a40..8bfa90e37ea17 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -278,6 +278,8 @@ + #define USB_DEVICE_ID_ASUS_AK1D 0x1125 + #define USB_DEVICE_ID_CHICONY_TOSHIBA_WT10A 0x1408 + #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421 ++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824 ++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c + + #define USB_VENDOR_ID_CHUNGHWAT 0x2247 + #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 423d18a77b9e8..9c1c65612adb7 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -726,6 +726,8 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) }, + { HID_USB_DEVICE(USB_VENDOR_ID_AXENTIA, USB_DEVICE_ID_AXENTIA_FM_RADIO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) }, +-- +2.39.5 + diff --git a/queue-5.10/input-xpad-add-support-for-amazon-game-controller.patch b/queue-5.10/input-xpad-add-support-for-amazon-game-controller.patch new file mode 100644 index 0000000000..9cce5422e4 --- /dev/null +++ b/queue-5.10/input-xpad-add-support-for-amazon-game-controller.patch @@ -0,0 +1,45 @@ +From 1cf53b15fa149f21890c10b2fa5ee490ac70a92b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 15:29:37 -0700 +Subject: Input: xpad - add support for Amazon Game Controller + +From: Matt Reynolds + +[ Upstream commit 05665cef4b745cb46b1d1b8e96deaa25464092d3 ] + +The Amazon Luna controller (product name "Amazon Game Controller") behaves +like an Xbox 360 controller when connected over USB. + +Signed-off-by: Matt Reynolds +Reviewed-by: Harry Cutts +Link: https://lore.kernel.org/r/20210429103548.1.If5f9a44cb81e25b9350f7c6c0b3c88b4ecd81166@changeid +Signed-off-by: Dmitry Torokhov +Stable-dep-of: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller") +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 00b973e0f79ff..fb714004641b7 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -275,6 +275,7 @@ static const struct xpad_device { + { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, ++ { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, +@@ -462,6 +463,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOX360_VENDOR(0x15e4), /* Numark X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ ++ XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA Controllers */ + XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA Controllers */ +-- +2.39.5 + diff --git a/queue-5.10/input-xpad-add-vid-for-turtle-beach-controllers.patch b/queue-5.10/input-xpad-add-vid-for-turtle-beach-controllers.patch new file mode 100644 index 0000000000..b287604d29 --- /dev/null +++ b/queue-5.10/input-xpad-add-vid-for-turtle-beach-controllers.patch @@ -0,0 +1,35 @@ +From 0ef43de3d337ee7771413345e28423cd23318350 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 18:32:43 -0700 +Subject: Input: xpad - add VID for Turtle Beach controllers + +From: Vicki Pfau + +[ Upstream commit 1999a6b12a3b5c8953fc9ec74863ebc75a1b851d ] + +This adds support for the Turtle Beach REACT-R and Recon Xbox controllers + +Signed-off-by: Vicki Pfau +Link: https://lore.kernel.org/r/20230225012147.276489-4-vi@endrift.com +Signed-off-by: Dmitry Torokhov +Stable-dep-of: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller") +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index fb714004641b7..21a4bf8b1f58e 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -452,6 +452,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ + XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ + XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */ ++ XPAD_XBOXONE_VENDOR(0x10f5), /* Turtle Beach Controllers */ + XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ + XPAD_XBOX360_VENDOR(0x11ff), /* PXN V900 */ + XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */ +-- +2.39.5 + diff --git a/queue-5.10/input-xpad-support-acer-ngr-200-controller.patch b/queue-5.10/input-xpad-support-acer-ngr-200-controller.patch new file mode 100644 index 0000000000..4c58d13e96 --- /dev/null +++ b/queue-5.10/input-xpad-support-acer-ngr-200-controller.patch @@ -0,0 +1,43 @@ +From 4383bb0329bae55f32fa680dbdebd4b2fcf35df7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 16:29:40 -0700 +Subject: Input: xpad - support Acer NGR 200 Controller + +From: Nilton Perim Neto + +[ Upstream commit 22c69d786ef8fb789c61ca75492a272774221324 ] + +Add the NGR 200 Xbox 360 to the list of recognized controllers. + +Signed-off-by: Nilton Perim Neto +Link: https://lore.kernel.org/r/20250608060517.14967-1-niltonperimneto@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 21a4bf8b1f58e..a0362201b5d35 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -147,6 +147,7 @@ static const struct xpad_device { + { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, + { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, + { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, ++ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX }, + { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, + { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, + { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, +@@ -440,6 +441,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */ + XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */ + XPAD_XBOX360_VENDOR(0x046d), /* Logitech X-Box 360 style controllers */ ++ XPAD_XBOX360_VENDOR(0x0502), /* Acer Inc. Xbox 360 style controllers */ + XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */ + XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */ + XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz X-Box 360 controllers */ +-- +2.39.5 + diff --git a/queue-5.10/md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch b/queue-5.10/md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch new file mode 100644 index 0000000000..bb6226225f --- /dev/null +++ b/queue-5.10/md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch @@ -0,0 +1,80 @@ +From f736d49ca3a637ed4da1a0e26e37bd3e7b84bde5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jun 2025 19:28:40 +0800 +Subject: md/raid1: Fix stack memory use after return in raid1_reshape + +From: Wang Jinchao + +[ Upstream commit d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 ] + +In the raid1_reshape function, newpool is +allocated on the stack and assigned to conf->r1bio_pool. +This results in conf->r1bio_pool.wait.head pointing +to a stack address. +Accessing this address later can lead to a kernel panic. + +Example access path: + +raid1_reshape() +{ + // newpool is on the stack + mempool_t newpool, oldpool; + // initialize newpool.wait.head to stack address + mempool_init(&newpool, ...); + conf->r1bio_pool = newpool; +} + +raid1_read_request() or raid1_write_request() +{ + alloc_r1bio() + { + mempool_alloc() + { + // if pool->alloc fails + remove_element() + { + --pool->curr_nr; + } + } + } +} + +mempool_free() +{ + if (pool->curr_nr < pool->min_nr) { + // pool->wait.head is a stack address + // wake_up() will try to access this invalid address + // which leads to a kernel panic + return; + wake_up(&pool->wait); + } +} + +Fix: +reinit conf->r1bio_pool.wait after assigning newpool. + +Fixes: afeee514ce7f ("md: convert to bioset_init()/mempool_init()") +Signed-off-by: Wang Jinchao +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/linux-raid/20250612112901.3023950-1-wangjinchao600@gmail.com +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index dada9b2258a61..51e05ea3f1373 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -3290,6 +3290,7 @@ static int raid1_reshape(struct mddev *mddev) + /* ok, everything is stopped */ + oldpool = conf->r1bio_pool; + conf->r1bio_pool = newpool; ++ init_waitqueue_head(&conf->r1bio_pool.wait); + + for (d = d2 = 0; d < conf->raid_disks; d++) { + struct md_rdev *rdev = conf->mirrors[d].rdev; +-- +2.39.5 + diff --git a/queue-5.10/net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch b/queue-5.10/net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch new file mode 100644 index 0000000000..2cd08476a5 --- /dev/null +++ b/queue-5.10/net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch @@ -0,0 +1,38 @@ +From 3a06f9ec2cd899f612001c57426c620d2b9c6667 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 03:52:51 +0000 +Subject: net: appletalk: Fix device refcount leak in atrtr_create() + +From: Kito Xu + +[ Upstream commit 711c80f7d8b163d3ecd463cd96f07230f488e750 ] + +When updating an existing route entry in atrtr_create(), the old device +reference was not being released before assigning the new device, +leading to a device refcount leak. Fix this by calling dev_put() to +release the old device reference before holding the new one. + +Fixes: c7f905f0f6d4 ("[ATALK]: Add missing dev_hold() to atrtr_create().") +Signed-off-by: Kito Xu +Link: https://patch.msgid.link/tencent_E1A26771CDAB389A0396D1681A90A49E5D09@qq.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/appletalk/ddp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index 46adb8cefccf2..c9edfca153c99 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -563,6 +563,7 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint) + + /* Fill in the routing entry */ + rt->target = ta->sat_addr; ++ dev_put(rt->dev); /* Release old device */ + dev_hold(devhint); + rt->dev = devhint; + rt->flags = r->rt_flags; +-- +2.39.5 + diff --git a/queue-5.10/net-ll_temac-fix-missing-tx_pending-check-in-ethtool.patch b/queue-5.10/net-ll_temac-fix-missing-tx_pending-check-in-ethtool.patch new file mode 100644 index 0000000000..d889faec1b --- /dev/null +++ b/queue-5.10/net-ll_temac-fix-missing-tx_pending-check-in-ethtool.patch @@ -0,0 +1,45 @@ +From b4cb0d37e18c8a09bb666195164538869aaec464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jul 2025 11:06:17 -0700 +Subject: net: ll_temac: Fix missing tx_pending check in + ethtools_set_ringparam() + +From: Alok Tiwari + +[ Upstream commit e81750b4e3826fedce7362dad839cb40384d60ae ] + +The function ll_temac_ethtools_set_ringparam() incorrectly checked +rx_pending twice, once correctly for RX and once mistakenly in place +of tx_pending. This caused tx_pending to be left unchecked against +TX_BD_NUM_MAX. +As a result, invalid TX ring sizes may have been accepted or valid +ones wrongly rejected based on the RX limit, leading to potential +misconfiguration or unexpected results. + +This patch corrects the condition to properly validate tx_pending. + +Fixes: f7b261bfc35e ("net: ll_temac: Make RX/TX ring sizes configurable") +Signed-off-by: Alok Tiwari +Link: https://patch.msgid.link/20250710180621.2383000-1-alok.a.tiwari@oracle.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c +index e50b59efe188b..5ace1a4905d7e 100644 +--- a/drivers/net/ethernet/xilinx/ll_temac_main.c ++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c +@@ -1299,7 +1299,7 @@ static int ll_temac_ethtools_set_ringparam(struct net_device *ndev, + if (ering->rx_pending > RX_BD_NUM_MAX || + ering->rx_mini_pending || + ering->rx_jumbo_pending || +- ering->rx_pending > TX_BD_NUM_MAX) ++ ering->tx_pending > TX_BD_NUM_MAX) + return -EINVAL; + + if (netif_running(ndev)) +-- +2.39.5 + diff --git a/queue-5.10/net-phy-microchip-limit-100m-workaround-to-link-down.patch b/queue-5.10/net-phy-microchip-limit-100m-workaround-to-link-down.patch new file mode 100644 index 0000000000..8dcc0d2010 --- /dev/null +++ b/queue-5.10/net-phy-microchip-limit-100m-workaround-to-link-down.patch @@ -0,0 +1,60 @@ +From ca9970b98c86ebcb20a46d4ea1c36492cf7df334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 15:07:53 +0200 +Subject: net: phy: microchip: limit 100M workaround to link-down events on + LAN88xx + +From: Oleksij Rempel + +[ Upstream commit dd4360c0e8504f2f7639c7f5d07c93cfd6a98333 ] + +Restrict the 100Mbit forced-mode workaround to link-down transitions +only, to prevent repeated link reset cycles in certain configurations. + +The workaround was originally introduced to improve signal reliability +when switching cables between long and short distances. It temporarily +forces the PHY into 10 Mbps before returning to 100 Mbps. + +However, when used with autonegotiating link partners (e.g., Intel i350), +executing this workaround on every link change can confuse the partner +and cause constant renegotiation loops. This results in repeated link +down/up transitions and the PHY never reaching a stable state. + +Limit the workaround to only run during the PHY_NOLINK state. This ensures +it is triggered only once per link drop, avoiding disruptive toggling +while still preserving its intended effect. + +Note: I am not able to reproduce the original issue that this workaround +addresses. I can only confirm that 100 Mbit mode works correctly in my +test setup. Based on code inspection, I assume the workaround aims to +reset some internal state machine or signal block by toggling speeds. +However, a PHY reset is already performed earlier in the function via +phy_init_hw(), which may achieve a similar effect. Without a reproducer, +I conservatively keep the workaround but restrict its conditions. + +Fixes: e57cf3639c32 ("net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver") +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250709130753.3994461-3-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/microchip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c +index 375bbd60b38af..e6ad7d29a0559 100644 +--- a/drivers/net/phy/microchip.c ++++ b/drivers/net/phy/microchip.c +@@ -335,7 +335,7 @@ static void lan88xx_link_change_notify(struct phy_device *phydev) + * As workaround, set to 10 before setting to 100 + * at forced 100 F/H mode. + */ +- if (!phydev->autoneg && phydev->speed == 100) { ++ if (phydev->state == PHY_NOLINK && !phydev->autoneg && phydev->speed == 100) { + /* disable phy interrupt */ + temp = phy_read(phydev, LAN88XX_INT_MASK); + temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_; +-- +2.39.5 + diff --git a/queue-5.10/net-usb-qmi_wwan-add-simcom-8230c-composition.patch b/queue-5.10/net-usb-qmi_wwan-add-simcom-8230c-composition.patch new file mode 100644 index 0000000000..cb2b1cd111 --- /dev/null +++ b/queue-5.10/net-usb-qmi_wwan-add-simcom-8230c-composition.patch @@ -0,0 +1,63 @@ +From a28db74869491120dde6462fd2a9e7751064b32c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jun 2025 10:27:02 +0800 +Subject: net: usb: qmi_wwan: add SIMCom 8230C composition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaowei Li + +[ Upstream commit 0b39b055b5b48cbbdf5746a1ca6e3f6b0221e537 ] + +Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip. +0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet +T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1e0e ProdID=9071 Rev= 5.15 +S: Manufacturer=SIMCOM +S: Product=SDXBAAGHA-IDP _SN:D744C4C5 +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=none +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Xiaowei Li +Acked-by: Bjørn Mork +Link: https://patch.msgid.link/tencent_21D781FAA4969FEACA6ABB460362B52C9409@qq.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 3ab7b27b6bac3..9f493d504d20f 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1360,6 +1360,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ + {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ + {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */ ++ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9071, 3)}, /* SIMCom 8230C ++ */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ +-- +2.39.5 + diff --git a/queue-5.10/revert-usb-host-xhci-mvebu-make-usb-3.0-phy-optional.patch b/queue-5.10/revert-usb-host-xhci-mvebu-make-usb-3.0-phy-optional.patch new file mode 100644 index 0000000000..c5332d9a4b --- /dev/null +++ b/queue-5.10/revert-usb-host-xhci-mvebu-make-usb-3.0-phy-optional.patch @@ -0,0 +1,184 @@ +From 720a670541807bcc58302ef5309baead96c5b16f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 22:44:43 +0100 +Subject: Revert "usb: host: xhci: mvebu: make USB 3.0 PHY optional for Armada + 3720" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 8e10548f7f4814e530857d2049d6af6bc78add53 ] + +This reverts commit 3241929b67d28c83945d3191c6816a3271fd6b85. + +Armada 3720 phy driver (phy-mvebu-a3700-comphy.c) does not return +-EOPNOTSUPP from phy_power_on() callback anymore. + +So remove XHCI_SKIP_PHY_INIT flag from xhci_mvebu_a3700_plat_setup() and +then also whole xhci_mvebu_a3700_plat_setup() function which is there just +to handle -EOPNOTSUPP for XHCI_SKIP_PHY_INIT. + +xhci plat_setup callback is not used by any other xhci plat driver, so +remove this callback completely. + +Signed-off-by: Pali Rohár +Signed-off-by: Marek Behún +Acked-by: Miquel Raynal +Acked-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20220203214444.1508-5-kabel@kernel.org +Signed-off-by: Vinod Koul +Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mvebu.c | 42 ----------------------------------- + drivers/usb/host/xhci-mvebu.h | 6 ----- + drivers/usb/host/xhci-plat.c | 20 +---------------- + drivers/usb/host/xhci-plat.h | 1 - + 4 files changed, 1 insertion(+), 68 deletions(-) + +diff --git a/drivers/usb/host/xhci-mvebu.c b/drivers/usb/host/xhci-mvebu.c +index eabccf25796b2..87f1597a0e5ab 100644 +--- a/drivers/usb/host/xhci-mvebu.c ++++ b/drivers/usb/host/xhci-mvebu.c +@@ -8,7 +8,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -75,47 +74,6 @@ int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd) + return 0; + } + +-int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd) +-{ +- struct xhci_hcd *xhci = hcd_to_xhci(hcd); +- struct device *dev = hcd->self.controller; +- struct phy *phy; +- int ret; +- +- /* Old bindings miss the PHY handle */ +- phy = of_phy_get(dev->of_node, "usb3-phy"); +- if (IS_ERR(phy) && PTR_ERR(phy) == -EPROBE_DEFER) +- return -EPROBE_DEFER; +- else if (IS_ERR(phy)) +- goto phy_out; +- +- ret = phy_init(phy); +- if (ret) +- goto phy_put; +- +- ret = phy_set_mode(phy, PHY_MODE_USB_HOST_SS); +- if (ret) +- goto phy_exit; +- +- ret = phy_power_on(phy); +- if (ret == -EOPNOTSUPP) { +- /* Skip initializatin of XHCI PHY when it is unsupported by firmware */ +- dev_warn(dev, "PHY unsupported by firmware\n"); +- xhci->quirks |= XHCI_SKIP_PHY_INIT; +- } +- if (ret) +- goto phy_exit; +- +- phy_power_off(phy); +-phy_exit: +- phy_exit(phy); +-phy_put: +- of_phy_put(phy); +-phy_out: +- +- return 0; +-} +- + int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); +diff --git a/drivers/usb/host/xhci-mvebu.h b/drivers/usb/host/xhci-mvebu.h +index 01bf3fcb3eca5..3be021793cc8b 100644 +--- a/drivers/usb/host/xhci-mvebu.h ++++ b/drivers/usb/host/xhci-mvebu.h +@@ -12,7 +12,6 @@ struct usb_hcd; + + #if IS_ENABLED(CONFIG_USB_XHCI_MVEBU) + int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd); +-int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd); + int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd); + #else + static inline int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd) +@@ -20,11 +19,6 @@ static inline int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd) + return 0; + } + +-static inline int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd) +-{ +- return 0; +-} +- + static inline int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd) + { + return 0; +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 83c7dffa945c3..ae67985178b02 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -44,16 +44,6 @@ static void xhci_priv_plat_start(struct usb_hcd *hcd) + priv->plat_start(hcd); + } + +-static int xhci_priv_plat_setup(struct usb_hcd *hcd) +-{ +- struct xhci_plat_priv *priv = hcd_to_xhci_priv(hcd); +- +- if (!priv->plat_setup) +- return 0; +- +- return priv->plat_setup(hcd); +-} +- + static int xhci_priv_init_quirk(struct usb_hcd *hcd) + { + struct xhci_plat_priv *priv = hcd_to_xhci_priv(hcd); +@@ -121,7 +111,6 @@ static const struct xhci_plat_priv xhci_plat_marvell_armada = { + }; + + static const struct xhci_plat_priv xhci_plat_marvell_armada3700 = { +- .plat_setup = xhci_mvebu_a3700_plat_setup, + .init_quirk = xhci_mvebu_a3700_init_quirk, + }; + +@@ -344,14 +333,7 @@ static int xhci_plat_probe(struct platform_device *pdev) + + hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node); + xhci->shared_hcd->tpl_support = hcd->tpl_support; +- +- if (priv) { +- ret = xhci_priv_plat_setup(hcd); +- if (ret) +- goto disable_usb_phy; +- } +- +- if ((xhci->quirks & XHCI_SKIP_PHY_INIT) || (priv && (priv->quirks & XHCI_SKIP_PHY_INIT))) ++ if (priv && (priv->quirks & XHCI_SKIP_PHY_INIT)) + hcd->skip_phy_initialization = 1; + + if (priv && (priv->quirks & XHCI_SG_TRB_CACHE_SIZE_QUIRK)) +diff --git a/drivers/usb/host/xhci-plat.h b/drivers/usb/host/xhci-plat.h +index 29f15298e315f..f3abce238207e 100644 +--- a/drivers/usb/host/xhci-plat.h ++++ b/drivers/usb/host/xhci-plat.h +@@ -15,7 +15,6 @@ struct usb_hcd; + struct xhci_plat_priv { + const char *firmware_name; + unsigned long long quirks; +- int (*plat_setup)(struct usb_hcd *); + void (*plat_start)(struct usb_hcd *); + int (*init_quirk)(struct usb_hcd *); + int (*suspend_quirk)(struct usb_hcd *); +-- +2.39.5 + diff --git a/queue-5.10/series b/queue-5.10/series index 347c40e394..e45be8ba42 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -180,3 +180,37 @@ rtc-lib_test-add-module_license.patch pwm-mediatek-ensure-to-disable-clocks-in-error-path.patch netlink-fix-rmem-check-in-netlink_broadcast_deliver.patch netlink-make-sure-we-allow-at-least-one-dump-skb.patch +bluetooth-hci-set-extended-advertising-data-synchron.patch +btrfs-fix-inode-lookup-error-handling-during-log-rep.patch +xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch +usb-xhci-init-root-hub-ssp-rate.patch +xhci-add-bus-number-to-some-debug-messages.patch +revert-usb-host-xhci-mvebu-make-usb-3.0-phy-optional.patch +xhci-factor-out-parts-of-xhci_gen_setup.patch +xhci-prepare-for-operation-w-o-shared-hcd.patch +usb-host-xhci-plat-create-shared-hcd-after-having-ad.patch +usb-host-xhci-plat-prepare-operation-w-o-shared-hcd.patch +xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch +input-xpad-add-support-for-amazon-game-controller.patch +input-xpad-add-vid-for-turtle-beach-controllers.patch +input-xpad-support-acer-ngr-200-controller.patch +usb-dwc3-clean-up-probe-declarations.patch +usb-xhci-move-extcaps-related-macros-to-respective-h.patch +usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch +smb-client-fix-readdir-returning-wrong-type-with-pos.patch +dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch +usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch +wifi-zd1211rw-fix-potential-null-pointer-dereference.patch +md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch +net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch +net-phy-microchip-limit-100m-workaround-to-link-down.patch +can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch +net-ll_temac-fix-missing-tx_pending-check-in-ethtool.patch +bnxt_en-fix-dcb-ets-validation.patch +bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch +atm-idt77252-add-missing-dma_map_error.patch +um-vector-reduce-stack-usage-in-vector_eth_configure.patch +net-usb-qmi_wwan-add-simcom-8230c-composition.patch +vt-add-missing-notification-when-switching-back-to-t.patch +hid-add-ignore-quirk-for-smartlinktechnology.patch +hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch diff --git a/queue-5.10/smb-client-fix-readdir-returning-wrong-type-with-pos.patch b/queue-5.10/smb-client-fix-readdir-returning-wrong-type-with-pos.patch new file mode 100644 index 0000000000..14f221f749 --- /dev/null +++ b/queue-5.10/smb-client-fix-readdir-returning-wrong-type-with-pos.patch @@ -0,0 +1,58 @@ +From 31fa9af762eed42996a29d41a1927a98bd6fb5df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Jun 2025 19:05:05 +0200 +Subject: smb: client: fix readdir returning wrong type with POSIX extensions + +From: Philipp Kerling + +[ Upstream commit b8f89cb723b9e66f5dbd7199e4036fee34fb0de0 ] + +When SMB 3.1.1 POSIX Extensions are negotiated, userspace applications +using readdir() or getdents() calls without stat() on each individual file +(such as a simple "ls" or "find") would misidentify file types and exhibit +strange behavior such as not descending into directories. The reason for +this behavior is an oversight in the cifs_posix_to_fattr conversion +function. Instead of extracting the entry type for cf_dtype from the +properly converted cf_mode field, it tries to extract the type from the +PDU. While the wire representation of the entry mode is similar in +structure to POSIX stat(), the assignments of the entry types are +different. Applying the S_DT macro to cf_mode instead yields the correct +result. This is also what the equivalent function +smb311_posix_info_to_fattr in inode.c already does for stat() etc.; which +is why "ls -l" would give the correct file type but "ls" would not (as +identified by the colors). + +Cc: stable@vger.kernel.org +Signed-off-by: Philipp Kerling +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/readdir.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index 9e62d75f24651..2691785cee700 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -276,7 +276,6 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, + + if (fattr->cf_cifsattrs & ATTR_DIRECTORY) { + fattr->cf_mode |= S_IFDIR; +- fattr->cf_dtype = DT_DIR; + } else { + /* + * mark anything that is not a dir as regular +@@ -284,8 +283,9 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, + * attribute and will be marked as needing revaluation + */ + fattr->cf_mode |= S_IFREG; +- fattr->cf_dtype = DT_REG; + } ++ /* Use S_DT to extract file type from cf_mode for cf_dtype */ ++ fattr->cf_dtype = S_DT(fattr->cf_mode); + + if (reparse_file_needs_reval(fattr)) + fattr->cf_flags |= CIFS_FATTR_NEED_REVAL; +-- +2.39.5 + diff --git a/queue-5.10/um-vector-reduce-stack-usage-in-vector_eth_configure.patch b/queue-5.10/um-vector-reduce-stack-usage-in-vector_eth_configure.patch new file mode 100644 index 0000000000..16c147a302 --- /dev/null +++ b/queue-5.10/um-vector-reduce-stack-usage-in-vector_eth_configure.patch @@ -0,0 +1,93 @@ +From 43f4cd8db37ba7128077df842126fe7ac868f8da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jun 2025 19:08:29 +0800 +Subject: um: vector: Reduce stack usage in vector_eth_configure() + +From: Tiwei Bie + +[ Upstream commit 2d65fc13be85c336c56af7077f08ccd3a3a15a4a ] + +When compiling with clang (19.1.7), initializing *vp using a compound +literal may result in excessive stack usage. Fix it by initializing the +required fields of *vp individually. + +Without this patch: + +$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0 +... +0x0000000000000540 vector_eth_configure [vector_kern.o]:1472 +... + +With this patch: + +$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0 +... +0x0000000000000540 vector_eth_configure [vector_kern.o]:208 +... + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202506221017.WtB7Usua-lkp@intel.com/ +Signed-off-by: Tiwei Bie +Link: https://patch.msgid.link/20250623110829.314864-1-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/drivers/vector_kern.c | 42 +++++++++++------------------------ + 1 file changed, 13 insertions(+), 29 deletions(-) + +diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c +index da05bfdaeb1db..a37007e42265a 100644 +--- a/arch/um/drivers/vector_kern.c ++++ b/arch/um/drivers/vector_kern.c +@@ -1600,35 +1600,19 @@ static void vector_eth_configure( + + device->dev = dev; + +- *vp = ((struct vector_private) +- { +- .list = LIST_HEAD_INIT(vp->list), +- .dev = dev, +- .unit = n, +- .options = get_transport_options(def), +- .rx_irq = 0, +- .tx_irq = 0, +- .parsed = def, +- .max_packet = get_mtu(def) + ETH_HEADER_OTHER, +- /* TODO - we need to calculate headroom so that ip header +- * is 16 byte aligned all the time +- */ +- .headroom = get_headroom(def), +- .form_header = NULL, +- .verify_header = NULL, +- .header_rxbuffer = NULL, +- .header_txbuffer = NULL, +- .header_size = 0, +- .rx_header_size = 0, +- .rexmit_scheduled = false, +- .opened = false, +- .transport_data = NULL, +- .in_write_poll = false, +- .coalesce = 2, +- .req_size = get_req_size(def), +- .in_error = false, +- .bpf = NULL +- }); ++ INIT_LIST_HEAD(&vp->list); ++ vp->dev = dev; ++ vp->unit = n; ++ vp->options = get_transport_options(def); ++ vp->parsed = def; ++ vp->max_packet = get_mtu(def) + ETH_HEADER_OTHER; ++ /* ++ * TODO - we need to calculate headroom so that ip header ++ * is 16 byte aligned all the time ++ */ ++ vp->headroom = get_headroom(def); ++ vp->coalesce = 2; ++ vp->req_size = get_req_size(def); + + dev->features = dev->hw_features = (NETIF_F_SG | NETIF_F_FRAGLIST); + tasklet_init(&vp->tx_poll, vector_tx_poll, (unsigned long)vp); +-- +2.39.5 + diff --git a/queue-5.10/usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch b/queue-5.10/usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch new file mode 100644 index 0000000000..a5e178f8a1 --- /dev/null +++ b/queue-5.10/usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch @@ -0,0 +1,152 @@ +From 28907062b07677367be1e4229fe70a0990bedef9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jul 2025 04:38:08 -0400 +Subject: usb: dwc3: Abort suspend on soft disconnect failure + +From: Kuen-Han Tsai + +[ Upstream commit 630a1dec3b0eba2a695b9063f1c205d585cbfec9 ] + +When dwc3_gadget_soft_disconnect() fails, dwc3_suspend_common() keeps +going with the suspend, resulting in a period where the power domain is +off, but the gadget driver remains connected. Within this time frame, +invoking vbus_event_work() will cause an error as it attempts to access +DWC3 registers for endpoint disabling after the power domain has been +completely shut down. + +Abort the suspend sequence when dwc3_gadget_suspend() cannot halt the +controller and proceeds with a soft connect. + +Fixes: 9f8a67b65a49 ("usb: dwc3: gadget: fix gadget suspend/resume") +Cc: stable +Acked-by: Thinh Nguyen +Signed-off-by: Kuen-Han Tsai +Link: https://lore.kernel.org/r/20250528100315.2162699-1-khtsai@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 34 +++++++++++++++++++++++++++------- + drivers/usb/dwc3/core.h | 2 ++ + drivers/usb/dwc3/gadget.c | 25 ++++++++++++++++++++++--- + 3 files changed, 51 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 3537afd17a26e..102ad4d2d4ebc 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1733,16 +1733,29 @@ static int dwc3_core_init_for_resume(struct dwc3 *dwc) + + static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + { +- unsigned long flags; + u32 reg; ++ int ret; ++ ++ if (!pm_runtime_suspended(dwc->dev) && !PMSG_IS_AUTO(msg)) { ++ dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) & ++ DWC3_GUSB2PHYCFG_SUSPHY) || ++ (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) & ++ DWC3_GUSB3PIPECTL_SUSPHY); ++ /* ++ * TI AM62 platform requires SUSPHY to be ++ * enabled for system suspend to work. ++ */ ++ if (!dwc->susphy_state) ++ dwc3_enable_susphy(dwc, true); ++ } + + switch (dwc->current_dr_role) { + case DWC3_GCTL_PRTCAP_DEVICE: + if (pm_runtime_suspended(dwc->dev)) + break; +- spin_lock_irqsave(&dwc->lock, flags); +- dwc3_gadget_suspend(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); ++ ret = dwc3_gadget_suspend(dwc); ++ if (ret) ++ return ret; + synchronize_irq(dwc->irq_gadget); + dwc3_core_exit(dwc); + break; +@@ -1773,9 +1786,9 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + break; + + if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { +- spin_lock_irqsave(&dwc->lock, flags); +- dwc3_gadget_suspend(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); ++ ret = dwc3_gadget_suspend(dwc); ++ if (ret) ++ return ret; + synchronize_irq(dwc->irq_gadget); + } + +@@ -1986,6 +1999,13 @@ static void dwc3_complete(struct device *dev) + reg |= DWC3_GUCTL3_SPLITDISABLE; + dwc3_writel(dwc->regs, DWC3_GUCTL3, reg); + } ++ ++ /* ++ * Restore SUSPHY state to the original setting ++ * if it was cleared during suspend ++ */ ++ if (!dwc->susphy_state) ++ dwc3_enable_susphy(dwc, false); + } + #else + #define dwc3_complete NULL +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 4ccbd2dc1bf81..97d361ab3e86f 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -1269,6 +1269,8 @@ struct dwc3 { + unsigned dis_split_quirk:1; + + u16 imod_interval; ++ ++ unsigned susphy_state:1; + }; + + #define INCRX_BURST_MODE 0 +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index f3103baa74590..422efb4e61434 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -4106,12 +4106,31 @@ void dwc3_gadget_exit(struct dwc3 *dwc) + + int dwc3_gadget_suspend(struct dwc3 *dwc) + { ++ unsigned long flags; ++ int ret; ++ + if (!dwc->gadget_driver) + return 0; + +- dwc3_gadget_run_stop(dwc, false, false); +- dwc3_disconnect_gadget(dwc); +- __dwc3_gadget_stop(dwc); ++ ret = dwc3_gadget_soft_disconnect(dwc); ++ /* ++ * Attempt to reset the controller's state. Likely no ++ * communication can be established until the host ++ * performs a port reset. ++ */ ++ if (ret && dwc->softconnect) { ++ /* Soft connect logic - similar to pullup when is_on is true */ ++ dwc3_core_soft_reset(dwc); ++ dwc3_event_buffers_setup(dwc); ++ __dwc3_gadget_start(dwc); ++ dwc3_gadget_run_stop(dwc, true, false); ++ return -EAGAIN; ++ } ++ ++ spin_lock_irqsave(&dwc->lock, flags); ++ if (dwc->gadget_driver) ++ dwc3_disconnect_gadget(dwc); ++ spin_unlock_irqrestore(&dwc->lock, flags); + + return 0; + } +-- +2.39.5 + diff --git a/queue-5.10/usb-dwc3-clean-up-probe-declarations.patch b/queue-5.10/usb-dwc3-clean-up-probe-declarations.patch new file mode 100644 index 0000000000..cdec588007 --- /dev/null +++ b/queue-5.10/usb-dwc3-clean-up-probe-declarations.patch @@ -0,0 +1,42 @@ +From 2aa5523414e8be871a769f12dd0570ae2e0017bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 09:25:24 +0200 +Subject: USB: dwc3: clean up probe declarations + +From: Johan Hovold + +[ Upstream commit 9a4d7dd1990383df8ffa09d6879cecb0534405e1 ] + +Clean up the probe variable declarations by removing the stray newlines. + +Acked-by: Thinh Nguyen +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230404072524.19014-12-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 630a1dec3b0e ("usb: dwc3: Abort suspend on soft disconnect failure") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 1264683d45f20..3537afd17a26e 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1526,12 +1526,10 @@ static int dwc3_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct resource *res, dwc_res; ++ void __iomem *regs; + struct dwc3 *dwc; +- + int ret; + +- void __iomem *regs; +- + dwc = devm_kzalloc(dev, sizeof(*dwc), GFP_KERNEL); + if (!dwc) + return -ENOMEM; +-- +2.39.5 + diff --git a/queue-5.10/usb-host-xhci-plat-create-shared-hcd-after-having-ad.patch b/queue-5.10/usb-host-xhci-plat-create-shared-hcd-after-having-ad.patch new file mode 100644 index 0000000000..b7085c3bc1 --- /dev/null +++ b/queue-5.10/usb-host-xhci-plat-create-shared-hcd-after-having-ad.patch @@ -0,0 +1,107 @@ +From d77936304f8496621ce7b5796f3cf35a88e667ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 01:04:44 +0300 +Subject: usb: host: xhci-plat: create shared hcd after having added main hcd + +From: Heiner Kallweit + +[ Upstream commit 0cf1ea040a7e2cae4776216d16d33d3898ea58de ] + +This patch is in preparation of an extension where in case of a +root hub with no ports no shared hcd will be created. +Whether one of the root hubs has no ports we figure our in +usb_add_hcd() for the primary hcd. Therefore create the shared hcd +only after this call. + +Signed-off-by: Heiner Kallweit +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220511220450.85367-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-plat.c | 29 ++++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index ae67985178b02..b363063edab91 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -290,12 +290,6 @@ static int xhci_plat_probe(struct platform_device *pdev) + device_set_wakeup_capable(&pdev->dev, true); + + xhci->main_hcd = hcd; +- xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev, +- dev_name(&pdev->dev), hcd); +- if (!xhci->shared_hcd) { +- ret = -ENOMEM; +- goto disable_clk; +- } + + /* imod_interval is the interrupt moderation value in nanoseconds. */ + xhci->imod_interval = 40000; +@@ -323,16 +317,16 @@ static int xhci_plat_probe(struct platform_device *pdev) + if (IS_ERR(hcd->usb_phy)) { + ret = PTR_ERR(hcd->usb_phy); + if (ret == -EPROBE_DEFER) +- goto put_usb3_hcd; ++ goto disable_clk; + hcd->usb_phy = NULL; + } else { + ret = usb_phy_init(hcd->usb_phy); + if (ret) +- goto put_usb3_hcd; ++ goto disable_clk; + } + + hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node); +- xhci->shared_hcd->tpl_support = hcd->tpl_support; ++ + if (priv && (priv->quirks & XHCI_SKIP_PHY_INIT)) + hcd->skip_phy_initialization = 1; + +@@ -343,12 +337,21 @@ static int xhci_plat_probe(struct platform_device *pdev) + if (ret) + goto disable_usb_phy; + ++ xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev, ++ dev_name(&pdev->dev), hcd); ++ if (!xhci->shared_hcd) { ++ ret = -ENOMEM; ++ goto dealloc_usb2_hcd; ++ } ++ ++ xhci->shared_hcd->tpl_support = hcd->tpl_support; ++ + if (HCC_MAX_PSA(xhci->hcc_params) >= 4) + xhci->shared_hcd->can_do_streams = 1; + + ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); + if (ret) +- goto dealloc_usb2_hcd; ++ goto put_usb3_hcd; + + device_enable_async_suspend(&pdev->dev); + pm_runtime_put_noidle(&pdev->dev); +@@ -362,15 +365,15 @@ static int xhci_plat_probe(struct platform_device *pdev) + return 0; + + ++put_usb3_hcd: ++ usb_put_hcd(xhci->shared_hcd); ++ + dealloc_usb2_hcd: + usb_remove_hcd(hcd); + + disable_usb_phy: + usb_phy_shutdown(hcd->usb_phy); + +-put_usb3_hcd: +- usb_put_hcd(xhci->shared_hcd); +- + disable_clk: + clk_disable_unprepare(xhci->clk); + +-- +2.39.5 + diff --git a/queue-5.10/usb-host-xhci-plat-prepare-operation-w-o-shared-hcd.patch b/queue-5.10/usb-host-xhci-plat-prepare-operation-w-o-shared-hcd.patch new file mode 100644 index 0000000000..4c7e019e41 --- /dev/null +++ b/queue-5.10/usb-host-xhci-plat-prepare-operation-w-o-shared-hcd.patch @@ -0,0 +1,78 @@ +From ccc922bf9c9e3149575629e8328d7cf3612aaef1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 01:04:45 +0300 +Subject: usb: host: xhci-plat: prepare operation w/o shared hcd + +From: Heiner Kallweit + +[ Upstream commit e0fe986972f5b6b12086c73569206dd29c520be9 ] + +This patch prepares xhci-plat for the following scenario +- If either of the root hubs has no ports, then omit shared hcd +- Main hcd can be USB3 if there are no USB2 ports + +Signed-off-by: Heiner Kallweit +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220511220450.85367-5-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-plat.c | 31 ++++++++++++++++++------------- + 1 file changed, 18 insertions(+), 13 deletions(-) + +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index b363063edab91..c7fe96c9ba6a4 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -180,7 +180,7 @@ static int xhci_plat_probe(struct platform_device *pdev) + struct device *sysdev, *tmpdev; + struct xhci_hcd *xhci; + struct resource *res; +- struct usb_hcd *hcd; ++ struct usb_hcd *hcd, *usb3_hcd; + int ret; + int irq; + struct xhci_plat_priv *priv = NULL; +@@ -337,21 +337,26 @@ static int xhci_plat_probe(struct platform_device *pdev) + if (ret) + goto disable_usb_phy; + +- xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev, +- dev_name(&pdev->dev), hcd); +- if (!xhci->shared_hcd) { +- ret = -ENOMEM; +- goto dealloc_usb2_hcd; +- } ++ if (!xhci_has_one_roothub(xhci)) { ++ xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev, ++ dev_name(&pdev->dev), hcd); ++ if (!xhci->shared_hcd) { ++ ret = -ENOMEM; ++ goto dealloc_usb2_hcd; ++ } + +- xhci->shared_hcd->tpl_support = hcd->tpl_support; ++ xhci->shared_hcd->tpl_support = hcd->tpl_support; ++ } + +- if (HCC_MAX_PSA(xhci->hcc_params) >= 4) +- xhci->shared_hcd->can_do_streams = 1; ++ usb3_hcd = xhci_get_usb3_hcd(xhci); ++ if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4) ++ usb3_hcd->can_do_streams = 1; + +- ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); +- if (ret) +- goto put_usb3_hcd; ++ if (xhci->shared_hcd) { ++ ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); ++ if (ret) ++ goto put_usb3_hcd; ++ } + + device_enable_async_suspend(&pdev->dev); + pm_runtime_put_noidle(&pdev->dev); +-- +2.39.5 + diff --git a/queue-5.10/usb-xhci-init-root-hub-ssp-rate.patch b/queue-5.10/usb-xhci-init-root-hub-ssp-rate.patch new file mode 100644 index 0000000000..311c082076 --- /dev/null +++ b/queue-5.10/usb-xhci-init-root-hub-ssp-rate.patch @@ -0,0 +1,41 @@ +From fab985a4bbc03ee869aff52710282024fc1c2a6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 19:43:15 -0800 +Subject: usb: xhci: Init root hub SSP rate + +From: Thinh Nguyen + +[ Upstream commit cd8d66cfae4989ed4b99c98b0c24d0eecba7005f ] + +Initialize USB 3.x root hub SuperSpeed Plus rate. + +Acked-by: Mathias Nyman +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/f1698a96d5f9dfaefb857b95e5db6135ae0c9e93.1615432770.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 908445cff24f8..e45353286e1b9 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -5272,10 +5272,12 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; + hcd->self.root_hub->rx_lanes = 2; + hcd->self.root_hub->tx_lanes = 2; ++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x2; + break; + case 1: + hcd->speed = HCD_USB31; + hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; ++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x1; + break; + } + xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n", +-- +2.39.5 + diff --git a/queue-5.10/usb-xhci-move-extcaps-related-macros-to-respective-h.patch b/queue-5.10/usb-xhci-move-extcaps-related-macros-to-respective-h.patch new file mode 100644 index 0000000000..4d7c38158e --- /dev/null +++ b/queue-5.10/usb-xhci-move-extcaps-related-macros-to-respective-h.patch @@ -0,0 +1,104 @@ +From 404887679202c521a4a732b5ae58a85c0933e981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Aug 2023 19:00:23 +0530 +Subject: usb: xhci: Move extcaps related macros to respective header file + +From: Krishna Kurapati + +[ Upstream commit 60958b3abacc4eeea21236aa61bfacd1c3520168 ] + +DWC3 driver needs access to XHCI Extended Capabilities registers to +read number of usb2 ports and usb3 ports present on multiport controller. +Since the extcaps header is sufficient to parse this info, move port_count +related macros and structure from xhci.h to xhci-ext-caps.h. + +Signed-off-by: Krishna Kurapati +Link: https://lore.kernel.org/r/20230828133033.11988-4-quic_kriskura@quicinc.com +Acked-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 630a1dec3b0e ("usb: dwc3: Abort suspend on soft disconnect failure") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ext-caps.h | 27 +++++++++++++++++++++++++++ + drivers/usb/host/xhci.h | 27 --------------------------- + 2 files changed, 27 insertions(+), 27 deletions(-) + +diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h +index e8af0a125f84b..96eb36a587382 100644 +--- a/drivers/usb/host/xhci-ext-caps.h ++++ b/drivers/usb/host/xhci-ext-caps.h +@@ -79,6 +79,33 @@ + /* true: Controller Not Ready to accept doorbell or op reg writes after reset */ + #define XHCI_STS_CNR (1 << 11) + ++/** ++ * struct xhci_protocol_caps ++ * @revision: major revision, minor revision, capability ID, ++ * and next capability pointer. ++ * @name_string: Four ASCII characters to say which spec this xHC ++ * follows, typically "USB ". ++ * @port_info: Port offset, count, and protocol-defined information. ++ */ ++struct xhci_protocol_caps { ++ u32 revision; ++ u32 name_string; ++ u32 port_info; ++}; ++ ++#define XHCI_EXT_PORT_MAJOR(x) (((x) >> 24) & 0xff) ++#define XHCI_EXT_PORT_MINOR(x) (((x) >> 16) & 0xff) ++#define XHCI_EXT_PORT_PSIC(x) (((x) >> 28) & 0x0f) ++#define XHCI_EXT_PORT_OFF(x) ((x) & 0xff) ++#define XHCI_EXT_PORT_COUNT(x) (((x) >> 8) & 0xff) ++ ++#define XHCI_EXT_PORT_PSIV(x) (((x) >> 0) & 0x0f) ++#define XHCI_EXT_PORT_PSIE(x) (((x) >> 4) & 0x03) ++#define XHCI_EXT_PORT_PLT(x) (((x) >> 6) & 0x03) ++#define XHCI_EXT_PORT_PFD(x) (((x) >> 8) & 0x01) ++#define XHCI_EXT_PORT_LP(x) (((x) >> 14) & 0x03) ++#define XHCI_EXT_PORT_PSIM(x) (((x) >> 16) & 0xffff) ++ + #include + + /** +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 166978caa6db3..bf3798ce716f3 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -555,33 +555,6 @@ struct xhci_doorbell_array { + #define DB_VALUE(ep, stream) ((((ep) + 1) & 0xff) | ((stream) << 16)) + #define DB_VALUE_HOST 0x00000000 + +-/** +- * struct xhci_protocol_caps +- * @revision: major revision, minor revision, capability ID, +- * and next capability pointer. +- * @name_string: Four ASCII characters to say which spec this xHC +- * follows, typically "USB ". +- * @port_info: Port offset, count, and protocol-defined information. +- */ +-struct xhci_protocol_caps { +- u32 revision; +- u32 name_string; +- u32 port_info; +-}; +- +-#define XHCI_EXT_PORT_MAJOR(x) (((x) >> 24) & 0xff) +-#define XHCI_EXT_PORT_MINOR(x) (((x) >> 16) & 0xff) +-#define XHCI_EXT_PORT_PSIC(x) (((x) >> 28) & 0x0f) +-#define XHCI_EXT_PORT_OFF(x) ((x) & 0xff) +-#define XHCI_EXT_PORT_COUNT(x) (((x) >> 8) & 0xff) +- +-#define XHCI_EXT_PORT_PSIV(x) (((x) >> 0) & 0x0f) +-#define XHCI_EXT_PORT_PSIE(x) (((x) >> 4) & 0x03) +-#define XHCI_EXT_PORT_PLT(x) (((x) >> 6) & 0x03) +-#define XHCI_EXT_PORT_PFD(x) (((x) >> 8) & 0x01) +-#define XHCI_EXT_PORT_LP(x) (((x) >> 14) & 0x03) +-#define XHCI_EXT_PORT_PSIM(x) (((x) >> 16) & 0xffff) +- + #define PLT_MASK (0x03 << 6) + #define PLT_SYM (0x00 << 6) + #define PLT_ASYM_RX (0x02 << 6) +-- +2.39.5 + diff --git a/queue-5.10/usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch b/queue-5.10/usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch new file mode 100644 index 0000000000..c3938aab5c --- /dev/null +++ b/queue-5.10/usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch @@ -0,0 +1,120 @@ +From 7ddf51a70191e6b03869cd20216ed1fd91823335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 17:41:19 +0300 +Subject: usb: xhci: quirk for data loss in ISOC transfers + +From: Raju Rangoju + +[ Upstream commit cbc889ab0122366f6cdbe3c28d477c683ebcebc2 ] + +During the High-Speed Isochronous Audio transfers, xHCI +controller on certain AMD platforms experiences momentary data +loss. This results in Missed Service Errors (MSE) being +generated by the xHCI. + +The root cause of the MSE is attributed to the ISOC OUT endpoint +being omitted from scheduling. This can happen when an IN +endpoint with a 64ms service interval either is pre-scheduled +prior to the ISOC OUT endpoint or the interval of the ISOC OUT +endpoint is shorter than that of the IN endpoint. Consequently, +the OUT service is neglected when an IN endpoint with a service +interval exceeding 32ms is scheduled concurrently (every 64ms in +this scenario). + +This issue is particularly seen on certain older AMD platforms. +To mitigate this problem, it is recommended to adjust the service +interval of the IN endpoint to not exceed 32ms (interval 8). This +adjustment ensures that the OUT endpoint will not be bypassed, +even if a smaller interval value is utilized. + +Cc: stable +Signed-off-by: Raju Rangoju +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250627144127.3889714-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mem.c | 4 ++++ + drivers/usb/host/xhci-pci.c | 26 ++++++++++++++++++++++++++ + drivers/usb/host/xhci.h | 1 + + 3 files changed, 31 insertions(+) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 0891f0d21af16..5b1aa82f7701d 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1480,6 +1480,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, + /* Periodic endpoint bInterval limit quirk */ + if (usb_endpoint_xfer_int(&ep->desc) || + usb_endpoint_xfer_isoc(&ep->desc)) { ++ if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_9) && ++ interval >= 9) { ++ interval = 8; ++ } + if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_7) && + udev->speed >= USB_SPEED_HIGH && + interval >= 7) { +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 202c176eb894a..4153bed4062c9 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -64,11 +64,22 @@ + #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed + #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_PCH_XHCI 0x54ed + ++#define PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI 0x13ed ++#define PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI 0x13ee ++#define PCI_DEVICE_ID_AMD_STARSHIP_XHCI 0x148c ++#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI 0x15d4 ++#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI 0x15d5 ++#define PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI 0x15e0 ++#define PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI 0x15e1 ++#define PCI_DEVICE_ID_AMD_RAVEN2_XHCI 0x15e5 ++#define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba + #define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb + #define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc + ++#define PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI 0x7316 ++ + #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042 + #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 + #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242 +@@ -163,6 +174,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_NEC) + xhci->quirks |= XHCI_NEC_HOST; + ++ if (pdev->vendor == PCI_VENDOR_ID_AMD && ++ (pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_STARSHIP_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN2_XHCI)) ++ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9; ++ ++ if (pdev->vendor == PCI_VENDOR_ID_ATI && ++ pdev->device == PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI) ++ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9; ++ + if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version == 0x96) + xhci->quirks |= XHCI_AMD_0x96_HOST; + +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index bf3798ce716f3..18b89c1576388 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1877,6 +1877,7 @@ struct xhci_hcd { + #define XHCI_RESET_TO_DEFAULT BIT_ULL(44) + #define XHCI_TRB_OVERFETCH BIT_ULL(45) + #define XHCI_ZHAOXIN_HOST BIT_ULL(46) ++#define XHCI_LIMIT_ENDPOINT_INTERVAL_9 BIT_ULL(47) + + unsigned int num_active_eps; + unsigned int limit_active_eps; +-- +2.39.5 + diff --git a/queue-5.10/vt-add-missing-notification-when-switching-back-to-t.patch b/queue-5.10/vt-add-missing-notification-when-switching-back-to-t.patch new file mode 100644 index 0000000000..9cbc05427b --- /dev/null +++ b/queue-5.10/vt-add-missing-notification-when-switching-back-to-t.patch @@ -0,0 +1,35 @@ +From 85576fcbf9448c6dd9e942819fd71dd59e03b9aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 21:41:44 -0400 +Subject: vt: add missing notification when switching back to text mode + +From: Nicolas Pitre + +[ Upstream commit ff78538e07fa284ce08cbbcb0730daa91ed16722 ] + +Programs using poll() on /dev/vcsa to be notified when VT changes occur +were missing one case: the switch from gfx to text mode. + +Signed-off-by: Nicolas Pitre +Link: https://lore.kernel.org/r/9o5ro928-0pp4-05rq-70p4-ro385n21n723@onlyvoer.pbz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/vt/vt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 5d9de3a53548b..98ca54330d771 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -4452,6 +4452,7 @@ void do_unblank_screen(int leaving_gfx) + set_palette(vc); + set_cursor(vc); + vt_event_post(VT_EVENT_UNBLANK, vc->vc_num, vc->vc_num); ++ notify_update(vc); + } + EXPORT_SYMBOL(do_unblank_screen); + +-- +2.39.5 + diff --git a/queue-5.10/wifi-zd1211rw-fix-potential-null-pointer-dereference.patch b/queue-5.10/wifi-zd1211rw-fix-potential-null-pointer-dereference.patch new file mode 100644 index 0000000000..b2ff3ce490 --- /dev/null +++ b/queue-5.10/wifi-zd1211rw-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,68 @@ +From e1cda43acf37ec7f52939b19f0997133c74a684f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jun 2025 14:46:19 +0300 +Subject: wifi: zd1211rw: Fix potential NULL pointer dereference in + zd_mac_tx_to_dev() + +From: Daniil Dulov + +[ Upstream commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 ] + +There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For +example, the following is possible: + + T0 T1 +zd_mac_tx_to_dev() + /* len == skb_queue_len(q) */ + while (len > ZD_MAC_MAX_ACK_WAITERS) { + + filter_ack() + spin_lock_irqsave(&q->lock, flags); + /* position == skb_queue_len(q) */ + for (i=1; itype == NL80211_IFTYPE_AP) + skb = __skb_dequeue(q); + spin_unlock_irqrestore(&q->lock, flags); + + skb_dequeue() -> NULL + +Since there is a small gap between checking skb queue length and skb being +unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL. +Then the pointer is passed to zd_mac_tx_status() where it is dereferenced. + +In order to avoid potential NULL pointer dereference due to situations like +above, check if skb is not NULL before passing it to zd_mac_tx_status(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 459c51ad6e1f ("zd1211rw: port to mac80211") +Signed-off-by: Daniil Dulov +Link: https://patch.msgid.link/20250626114619.172631-1-d.dulov@aladdin.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/zydas/zd1211rw/zd_mac.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c +index 3ef8533205f91..0a7f368f0d99c 100644 +--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c ++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c +@@ -583,7 +583,11 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error) + + skb_queue_tail(q, skb); + while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) { +- zd_mac_tx_status(hw, skb_dequeue(q), ++ skb = skb_dequeue(q); ++ if (!skb) ++ break; ++ ++ zd_mac_tx_status(hw, skb, + mac->ack_pending ? mac->ack_signal : 0, + NULL); + mac->ack_pending = 0; +-- +2.39.5 + diff --git a/queue-5.10/xhci-add-bus-number-to-some-debug-messages.patch b/queue-5.10/xhci-add-bus-number-to-some-debug-messages.patch new file mode 100644 index 0000000000..e096274c14 --- /dev/null +++ b/queue-5.10/xhci-add-bus-number-to-some-debug-messages.patch @@ -0,0 +1,89 @@ +From 18e1d600069cb425c0766c63485544ecc2554b6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 15:35:03 +0300 +Subject: xhci: Add bus number to some debug messages + +From: Mathias Nyman + +[ Upstream commit 669bc5a188b40a4edc9c2a42e5b32f19182767d9 ] + +As we register two usb buses for each xHC, and systems with several +hosts are more and more common it is getting hard to follow the +flow of debug messages without knowing which bus they belong to + +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210820123503.2605901-7-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 6 ++++-- + drivers/usb/host/xhci-ring.c | 3 ++- + drivers/usb/host/xhci.c | 6 ++++-- + 3 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index e92f920256b2e..ab28e0971e4a0 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1597,7 +1597,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + status = 1; + } + if (!status && !reset_change) { +- xhci_dbg(xhci, "%s: stopping port polling.\n", __func__); ++ xhci_dbg(xhci, "%s: stopping usb%d port polling\n", ++ __func__, hcd->self.busnum); + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + } + spin_unlock_irqrestore(&xhci->lock, flags); +@@ -1629,7 +1630,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + if (bus_state->resuming_ports || /* USB2 */ + bus_state->port_remote_wakeup) { /* USB3 */ + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_dbg(xhci, "suspend failed because a port is resuming\n"); ++ xhci_dbg(xhci, "usb%d bus suspend to fail because a port is resuming\n", ++ hcd->self.busnum); + return -EBUSY; + } + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 954cd962e113c..6cf1688c39d4a 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1929,7 +1929,8 @@ static void handle_port_status(struct xhci_hcd *xhci, + * bits are still set. When an event occurs, switch over to + * polling to avoid losing status changes. + */ +- xhci_dbg(xhci, "%s: starting port polling.\n", __func__); ++ xhci_dbg(xhci, "%s: starting usb%d port polling.\n", ++ __func__, hcd->self.busnum); + set_bit(HCD_FLAG_POLL_RH, &hcd->flags); + spin_unlock(&xhci->lock); + /* Pass this up to the core */ +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index e45353286e1b9..26ee29e684c5d 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1017,7 +1017,8 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + xhci_dbc_suspend(xhci); + + /* Don't poll the roothubs on bus suspend. */ +- xhci_dbg(xhci, "%s: stopping port polling.\n", __func__); ++ xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", ++ __func__, hcd->self.busnum); + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + del_timer_sync(&hcd->rh_timer); + clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); +@@ -1289,7 +1290,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + usb_asmedia_modifyflowcontrol(to_pci_dev(hcd->self.controller)); + + /* Re-enable port polling. */ +- xhci_dbg(xhci, "%s: starting port polling.\n", __func__); ++ xhci_dbg(xhci, "%s: starting usb%d port polling.\n", ++ __func__, hcd->self.busnum); + set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); + usb_hcd_poll_rh_status(xhci->shared_hcd); + set_bit(HCD_FLAG_POLL_RH, &hcd->flags); +-- +2.39.5 + diff --git a/queue-5.10/xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch b/queue-5.10/xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch new file mode 100644 index 0000000000..017de187fa --- /dev/null +++ b/queue-5.10/xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch @@ -0,0 +1,46 @@ +From 147b99ebb9b28be96ae25773e60c53ab43d898aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 11:13:27 +0530 +Subject: xhci: Allow RPM on the USB controller (1022:43f7) by default + +From: Basavaraj Natikar + +[ Upstream commit 28cbed496059fe1868203b76e9e0ef285733524d ] + +Enable runtime PM by default for older AMD 1022:43f7 xHCI 1.1 host as it +is proven to work. +Driver enables runtime PM by default for newer xHCI 1.2 host. + +Link: https://lore.kernel.org/all/12335218.O9o76ZdvQC@natalenko.name/ +Cc: Mario Limonciello +Tested-by: Oleksandr Natalenko +Signed-off-by: Basavaraj Natikar +Acked-by: Mathias Nyman +Link: https://lore.kernel.org/r/20240304054327.2564500-1-Basavaraj.Natikar@amd.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cbc889ab0122 ("usb: xhci: quirk for data loss in ISOC transfers") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-pci.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 2be84d5e9261d..202c176eb894a 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -186,8 +186,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_RESET_ON_RESUME; + } + +- if (pdev->vendor == PCI_VENDOR_ID_AMD) ++ if (pdev->vendor == PCI_VENDOR_ID_AMD) { + xhci->quirks |= XHCI_TRUST_TX_LENGTH; ++ if (pdev->device == 0x43f7) ++ xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; ++ } + + if ((pdev->vendor == PCI_VENDOR_ID_AMD) && + ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) || +-- +2.39.5 + diff --git a/queue-5.10/xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch b/queue-5.10/xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch new file mode 100644 index 0000000000..80cc5306bf --- /dev/null +++ b/queue-5.10/xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch @@ -0,0 +1,39 @@ +From 12b3dffca6f9d80893e84ecfef4bb5fd9b77f853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 17:41:20 +0300 +Subject: xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS + +From: Hongyu Xie + +[ Upstream commit cd65ee81240e8bc3c3119b46db7f60c80864b90b ] + +Disable stream for platform xHC controller with broken stream. + +Fixes: 14aec589327a6 ("storage: accept some UAS devices if streams are unavailable") +Cc: stable +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250627144127.3889714-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-plat.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index c7fe96c9ba6a4..06c303c1e353a 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -349,7 +349,8 @@ static int xhci_plat_probe(struct platform_device *pdev) + } + + usb3_hcd = xhci_get_usb3_hcd(xhci); +- if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4) ++ if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4 && ++ !(xhci->quirks & XHCI_BROKEN_STREAMS)) + usb3_hcd->can_do_streams = 1; + + if (xhci->shared_hcd) { +-- +2.39.5 + diff --git a/queue-5.10/xhci-factor-out-parts-of-xhci_gen_setup.patch b/queue-5.10/xhci-factor-out-parts-of-xhci_gen_setup.patch new file mode 100644 index 0000000000..8298ad2037 --- /dev/null +++ b/queue-5.10/xhci-factor-out-parts-of-xhci_gen_setup.patch @@ -0,0 +1,162 @@ +From 85016548b24f809655c16c15da229c898e2721b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 01:04:42 +0300 +Subject: xhci: factor out parts of xhci_gen_setup() + +From: Heiner Kallweit + +[ Upstream commit 57f23cd0bf2f56d339f810a913a9c0c5abfcfc7e ] + +Factoring out parts of xhci_gen_setup() has two motivations: +- When adding functionaliy to omit shared hcd if not needed in a + subsequent patch, we'll have to call xhci_hcd_init_usb3_data() + from two places. +- It reduces size of xhci_gen_setup() and makes it better readable. + +Signed-off-by: Heiner Kallweit +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220511220450.85367-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 104 +++++++++++++++++++++------------------- + 1 file changed, 54 insertions(+), 50 deletions(-) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 26ee29e684c5d..f2e868089ec1e 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -5217,6 +5217,57 @@ static int xhci_get_frame(struct usb_hcd *hcd) + return readl(&xhci->run_regs->microframe_index) >> 3; + } + ++static void xhci_hcd_init_usb2_data(struct xhci_hcd *xhci, struct usb_hcd *hcd) ++{ ++ xhci->usb2_rhub.hcd = hcd; ++ hcd->speed = HCD_USB2; ++ hcd->self.root_hub->speed = USB_SPEED_HIGH; ++ /* ++ * USB 2.0 roothub under xHCI has an integrated TT, ++ * (rate matching hub) as opposed to having an OHCI/UHCI ++ * companion controller. ++ */ ++ hcd->has_tt = 1; ++} ++ ++static void xhci_hcd_init_usb3_data(struct xhci_hcd *xhci, struct usb_hcd *hcd) ++{ ++ unsigned int minor_rev; ++ ++ /* ++ * Early xHCI 1.1 spec did not mention USB 3.1 capable hosts ++ * should return 0x31 for sbrn, or that the minor revision ++ * is a two digit BCD containig minor and sub-minor numbers. ++ * This was later clarified in xHCI 1.2. ++ * ++ * Some USB 3.1 capable hosts therefore have sbrn 0x30, and ++ * minor revision set to 0x1 instead of 0x10. ++ */ ++ if (xhci->usb3_rhub.min_rev == 0x1) ++ minor_rev = 1; ++ else ++ minor_rev = xhci->usb3_rhub.min_rev / 0x10; ++ ++ switch (minor_rev) { ++ case 2: ++ hcd->speed = HCD_USB32; ++ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; ++ hcd->self.root_hub->rx_lanes = 2; ++ hcd->self.root_hub->tx_lanes = 2; ++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x2; ++ break; ++ case 1: ++ hcd->speed = HCD_USB31; ++ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; ++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x1; ++ break; ++ } ++ xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n", ++ minor_rev, minor_rev ? "Enhanced " : ""); ++ ++ xhci->usb3_rhub.hcd = hcd; ++} ++ + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + { + struct xhci_hcd *xhci; +@@ -5225,7 +5276,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + * quirks + */ + struct device *dev = hcd->self.sysdev; +- unsigned int minor_rev; + int retval; + + /* Accept arbitrarily long scatter-gather lists */ +@@ -5240,60 +5290,14 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + xhci = hcd_to_xhci(hcd); + + if (usb_hcd_is_primary_hcd(hcd)) { +- xhci->main_hcd = hcd; +- xhci->usb2_rhub.hcd = hcd; +- /* Mark the first roothub as being USB 2.0. +- * The xHCI driver will register the USB 3.0 roothub. +- */ +- hcd->speed = HCD_USB2; +- hcd->self.root_hub->speed = USB_SPEED_HIGH; +- /* +- * USB 2.0 roothub under xHCI has an integrated TT, +- * (rate matching hub) as opposed to having an OHCI/UHCI +- * companion controller. +- */ +- hcd->has_tt = 1; ++ xhci_hcd_init_usb2_data(xhci, hcd); + } else { +- /* +- * Early xHCI 1.1 spec did not mention USB 3.1 capable hosts +- * should return 0x31 for sbrn, or that the minor revision +- * is a two digit BCD containig minor and sub-minor numbers. +- * This was later clarified in xHCI 1.2. +- * +- * Some USB 3.1 capable hosts therefore have sbrn 0x30, and +- * minor revision set to 0x1 instead of 0x10. +- */ +- if (xhci->usb3_rhub.min_rev == 0x1) +- minor_rev = 1; +- else +- minor_rev = xhci->usb3_rhub.min_rev / 0x10; +- +- switch (minor_rev) { +- case 2: +- hcd->speed = HCD_USB32; +- hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; +- hcd->self.root_hub->rx_lanes = 2; +- hcd->self.root_hub->tx_lanes = 2; +- hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x2; +- break; +- case 1: +- hcd->speed = HCD_USB31; +- hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; +- hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x1; +- break; +- } +- xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n", +- minor_rev, +- minor_rev ? "Enhanced " : ""); +- +- xhci->usb3_rhub.hcd = hcd; +- /* xHCI private pointer was set in xhci_pci_probe for the second +- * registered roothub. +- */ ++ xhci_hcd_init_usb3_data(xhci, hcd); + return 0; + } + + mutex_init(&xhci->mutex); ++ xhci->main_hcd = hcd; + xhci->cap_regs = hcd->regs; + xhci->op_regs = hcd->regs + + HC_LENGTH(readl(&xhci->cap_regs->hc_capbase)); +-- +2.39.5 + diff --git a/queue-5.10/xhci-prepare-for-operation-w-o-shared-hcd.patch b/queue-5.10/xhci-prepare-for-operation-w-o-shared-hcd.patch new file mode 100644 index 0000000000..e375b8d5ae --- /dev/null +++ b/queue-5.10/xhci-prepare-for-operation-w-o-shared-hcd.patch @@ -0,0 +1,293 @@ +From 047d50cb07e81cd5241655702b2da260b1a42ae9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 01:04:43 +0300 +Subject: xhci: prepare for operation w/o shared hcd + +From: Heiner Kallweit + +[ Upstream commit 873f323618c202cd0675324a1027dcecc7745d0b ] + +This patch prepares xhci for the following scenario: +- If either of the root hubs has no ports, then omit shared hcd +- Main hcd can be USB3 if there are no USB2 ports + +Signed-off-by: Heiner Kallweit +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220511220450.85367-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 3 ++- + drivers/usb/host/xhci-mem.c | 11 ++++---- + drivers/usb/host/xhci.c | 53 ++++++++++++++++++++++++------------- + drivers/usb/host/xhci.h | 26 ++++++++++++++++++ + 4 files changed, 68 insertions(+), 25 deletions(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index ab28e0971e4a0..3e165d4050873 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -621,6 +621,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci, + u16 test_mode, u16 wIndex, unsigned long *flags) + __must_hold(&xhci->lock) + { ++ struct usb_hcd *usb3_hcd = xhci_get_usb3_hcd(xhci); + int i, retval; + + /* Disable all Device Slots */ +@@ -641,7 +642,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci, + xhci_dbg(xhci, "Disable all port (PP = 0)\n"); + /* Power off USB3 ports*/ + for (i = 0; i < xhci->usb3_rhub.num_ports; i++) +- xhci_set_port_power(xhci, xhci->shared_hcd, i, false, flags); ++ xhci_set_port_power(xhci, usb3_hcd, i, false, flags); + /* Power off USB2 ports*/ + for (i = 0; i < xhci->usb2_rhub.num_ports; i++) + xhci_set_port_power(xhci, xhci->main_hcd, i, false, flags); +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 5b0e009783229..0891f0d21af16 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1099,7 +1099,7 @@ static u32 xhci_find_real_port_number(struct xhci_hcd *xhci, + struct usb_hcd *hcd; + + if (udev->speed >= USB_SPEED_SUPER) +- hcd = xhci->shared_hcd; ++ hcd = xhci_get_usb3_hcd(xhci); + else + hcd = xhci->main_hcd; + +@@ -2415,10 +2415,11 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) + xhci->usb2_rhub.num_ports = USB_MAXCHILDREN; + } + +- /* +- * Note we could have all USB 3.0 ports, or all USB 2.0 ports. +- * Not sure how the USB core will handle a hub with no ports... +- */ ++ if (!xhci->usb2_rhub.num_ports) ++ xhci_info(xhci, "USB2 root hub has no ports\n"); ++ ++ if (!xhci->usb3_rhub.num_ports) ++ xhci_info(xhci, "USB3 root hub has no ports\n"); + + xhci_create_rhub_port_array(xhci, &xhci->usb2_rhub, flags); + xhci_create_rhub_port_array(xhci, &xhci->usb3_rhub, flags); +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index f2e868089ec1e..9ba1825dcbcc3 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -490,6 +490,10 @@ static void compliance_mode_recovery(struct timer_list *t) + + xhci = from_timer(xhci, t, comp_mode_recovery_timer); + rhub = &xhci->usb3_rhub; ++ hcd = rhub->hcd; ++ ++ if (!hcd) ++ return; + + for (i = 0; i < rhub->num_ports; i++) { + temp = readl(rhub->ports[i]->addr); +@@ -503,7 +507,6 @@ static void compliance_mode_recovery(struct timer_list *t) + i + 1); + xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, + "Attempting compliance mode recovery"); +- hcd = xhci->shared_hcd; + + if (hcd->state == HC_STATE_SUSPENDED) + usb_hcd_resume_root_hub(hcd); +@@ -616,14 +619,11 @@ static int xhci_run_finished(struct xhci_hcd *xhci) + xhci_halt(xhci); + return -ENODEV; + } +- xhci->shared_hcd->state = HC_STATE_RUNNING; + xhci->cmd_ring_state = CMD_RING_STATE_RUNNING; + + if (xhci->quirks & XHCI_NEC_HOST) + xhci_ring_cmd_db(xhci); + +- xhci_dbg_trace(xhci, trace_xhci_dbg_init, +- "Finished xhci_run for USB3 roothub"); + return 0; + } + +@@ -698,7 +698,7 @@ int xhci_run(struct usb_hcd *hcd) + xhci_free_command(xhci, command); + } + xhci_dbg_trace(xhci, trace_xhci_dbg_init, +- "Finished xhci_run for USB2 roothub"); ++ "Finished %s for main hcd", __func__); + + set_bit(HCD_FLAG_DEFER_RH_REGISTER, &hcd->flags); + +@@ -706,6 +706,9 @@ int xhci_run(struct usb_hcd *hcd) + + xhci_debugfs_init(xhci); + ++ if (xhci_has_one_roothub(xhci)) ++ return xhci_run_finished(xhci); ++ + return 0; + } + EXPORT_SYMBOL_GPL(xhci_run); +@@ -1004,7 +1007,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + return 0; + + if (hcd->state != HC_STATE_SUSPENDED || +- xhci->shared_hcd->state != HC_STATE_SUSPENDED) ++ (xhci->shared_hcd && xhci->shared_hcd->state != HC_STATE_SUSPENDED)) + return -EINVAL; + + /* Clear root port wake on bits if wakeup not allowed. */ +@@ -1021,15 +1024,18 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + __func__, hcd->self.busnum); + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + del_timer_sync(&hcd->rh_timer); +- clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); +- del_timer_sync(&xhci->shared_hcd->rh_timer); ++ if (xhci->shared_hcd) { ++ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); ++ del_timer_sync(&xhci->shared_hcd->rh_timer); ++ } + + if (xhci->quirks & XHCI_SUSPEND_DELAY) + usleep_range(1000, 1500); + + spin_lock_irq(&xhci->lock); + clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); +- clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); ++ if (xhci->shared_hcd) ++ clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); + /* step 1: stop endpoint */ + /* skipped assuming that port suspend has done */ + +@@ -1129,7 +1135,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + msleep(100); + + set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); +- set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); ++ if (xhci->shared_hcd) ++ set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); + + spin_lock_irq(&xhci->lock); + +@@ -1190,7 +1197,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + + /* Let the USB core know _both_ roothubs lost power. */ + usb_root_hub_lost_power(xhci->main_hcd->self.root_hub); +- usb_root_hub_lost_power(xhci->shared_hcd->self.root_hub); ++ if (xhci->shared_hcd) ++ usb_root_hub_lost_power(xhci->shared_hcd->self.root_hub); + + xhci_dbg(xhci, "Stop HCD\n"); + xhci_halt(xhci); +@@ -1230,12 +1238,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + + xhci_dbg(xhci, "Start the primary HCD\n"); + retval = xhci_run(hcd->primary_hcd); +- if (!retval) { ++ if (!retval && secondary_hcd) { + xhci_dbg(xhci, "Start the secondary HCD\n"); + retval = xhci_run(secondary_hcd); + } + hcd->state = HC_STATE_SUSPENDED; +- xhci->shared_hcd->state = HC_STATE_SUSPENDED; ++ if (xhci->shared_hcd) ++ xhci->shared_hcd->state = HC_STATE_SUSPENDED; + goto done; + } + +@@ -1273,7 +1282,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + } + + if (pending_portevent) { +- usb_hcd_resume_root_hub(xhci->shared_hcd); ++ if (xhci->shared_hcd) ++ usb_hcd_resume_root_hub(xhci->shared_hcd); + usb_hcd_resume_root_hub(hcd); + } + } +@@ -1292,8 +1302,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + /* Re-enable port polling. */ + xhci_dbg(xhci, "%s: starting usb%d port polling.\n", + __func__, hcd->self.busnum); +- set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); +- usb_hcd_poll_rh_status(xhci->shared_hcd); ++ if (xhci->shared_hcd) { ++ set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); ++ usb_hcd_poll_rh_status(xhci->shared_hcd); ++ } + set_bit(HCD_FLAG_POLL_RH, &hcd->flags); + usb_hcd_poll_rh_status(hcd); + +@@ -5289,9 +5301,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + + xhci = hcd_to_xhci(hcd); + +- if (usb_hcd_is_primary_hcd(hcd)) { +- xhci_hcd_init_usb2_data(xhci, hcd); +- } else { ++ if (!usb_hcd_is_primary_hcd(hcd)) { + xhci_hcd_init_usb3_data(xhci, hcd); + return 0; + } +@@ -5373,6 +5383,11 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + return retval; + xhci_dbg(xhci, "Called HCD init\n"); + ++ if (xhci_hcd_is_usb3(hcd)) ++ xhci_hcd_init_usb3_data(xhci, hcd); ++ else ++ xhci_hcd_init_usb2_data(xhci, hcd); ++ + xhci_info(xhci, "hcc params 0x%08x hci version 0x%x quirks 0x%016llx\n", + xhci->hcc_params, xhci->hci_version, xhci->quirks); + +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 2d2e9c59add62..166978caa6db3 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1914,6 +1914,8 @@ struct xhci_hcd { + unsigned hw_lpm_support:1; + /* Broken Suspend flag for SNPS Suspend resume issue */ + unsigned broken_suspend:1; ++ /* Indicates that omitting hcd is supported if root hub has no ports */ ++ unsigned allow_single_roothub:1; + /* cached usb2 extened protocol capabilites */ + u32 *ext_caps; + unsigned int num_ext_caps; +@@ -1967,6 +1969,30 @@ static inline struct usb_hcd *xhci_to_hcd(struct xhci_hcd *xhci) + return xhci->main_hcd; + } + ++static inline struct usb_hcd *xhci_get_usb3_hcd(struct xhci_hcd *xhci) ++{ ++ if (xhci->shared_hcd) ++ return xhci->shared_hcd; ++ ++ if (!xhci->usb2_rhub.num_ports) ++ return xhci->main_hcd; ++ ++ return NULL; ++} ++ ++static inline bool xhci_hcd_is_usb3(struct usb_hcd *hcd) ++{ ++ struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ ++ return hcd == xhci_get_usb3_hcd(xhci); ++} ++ ++static inline bool xhci_has_one_roothub(struct xhci_hcd *xhci) ++{ ++ return xhci->allow_single_roothub && ++ (!xhci->usb2_rhub.num_ports || !xhci->usb3_rhub.num_ports); ++} ++ + #define xhci_dbg(xhci, fmt, args...) \ + dev_dbg(xhci_to_hcd(xhci)->self.controller , fmt , ## args) + #define xhci_err(xhci, fmt, args...) \ +-- +2.39.5 +