From: Sasha Levin Date: Mon, 14 Jul 2025 17:18:56 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.4.296~31 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3c1395f76e216442292feb990cff88d3c09ae6a6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/atm-idt77252-add-missing-dma_map_error.patch b/queue-5.4/atm-idt77252-add-missing-dma_map_error.patch new file mode 100644 index 0000000000..98327cc592 --- /dev/null +++ b/queue-5.4/atm-idt77252-add-missing-dma_map_error.patch @@ -0,0 +1,53 @@ +From 30726b517e261fd91ca2cb6f0da1ef3753c97251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 08:41:47 +0200 +Subject: atm: idt77252: Add missing `dma_map_error()` + +From: Thomas Fourier + +[ Upstream commit c4890963350dcf4e9a909bae23665921fba4ad27 ] + +The DMA map functions can fail and should be tested for errors. + +Signed-off-by: Thomas Fourier +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250624064148.12815-3-fourier.thomas@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/atm/idt77252.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c +index 06e2fea1ffa92..03b3b9c7c8b5c 100644 +--- a/drivers/atm/idt77252.c ++++ b/drivers/atm/idt77252.c +@@ -849,6 +849,8 @@ queue_skb(struct idt77252_dev *card, struct vc_map *vc, + + IDT77252_PRV_PADDR(skb) = dma_map_single(&card->pcidev->dev, skb->data, + skb->len, DMA_TO_DEVICE); ++ if (dma_mapping_error(&card->pcidev->dev, IDT77252_PRV_PADDR(skb))) ++ return -ENOMEM; + + error = -EINVAL; + +@@ -1862,6 +1864,8 @@ add_rx_skb(struct idt77252_dev *card, int queue, + paddr = dma_map_single(&card->pcidev->dev, skb->data, + skb_end_pointer(skb) - skb->data, + DMA_FROM_DEVICE); ++ if (dma_mapping_error(&card->pcidev->dev, paddr)) ++ goto outpoolrm; + IDT77252_PRV_PADDR(skb) = paddr; + + if (push_rx_skb(card, skb, queue)) { +@@ -1876,6 +1880,7 @@ add_rx_skb(struct idt77252_dev *card, int queue, + dma_unmap_single(&card->pcidev->dev, IDT77252_PRV_PADDR(skb), + skb_end_pointer(skb) - skb->data, DMA_FROM_DEVICE); + ++outpoolrm: + handle = IDT77252_PRV_POOL(skb); + card->sbpool[POOL_QUEUE(handle)].skb[POOL_INDEX(handle)] = NULL; + +-- +2.39.5 + diff --git a/queue-5.4/bnxt_en-fix-dcb-ets-validation.patch b/queue-5.4/bnxt_en-fix-dcb-ets-validation.patch new file mode 100644 index 0000000000..d8b358b7ec --- /dev/null +++ b/queue-5.4/bnxt_en-fix-dcb-ets-validation.patch @@ -0,0 +1,49 @@ +From db1a9c9a56d1cced6f9232ce7b218fcd35648074 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jul 2025 14:39:36 -0700 +Subject: bnxt_en: Fix DCB ETS validation + +From: Shravya KN + +[ Upstream commit b74c2a2e9cc471e847abd87e50a2354c07e02040 ] + +In bnxt_ets_validate(), the code incorrectly loops over all possible +traffic classes to check and add the ETS settings. Fix it to loop +over the configured traffic classes only. + +The unconfigured traffic classes will default to TSA_ETS with 0 +bandwidth. Looping over these unconfigured traffic classes may +cause the validation to fail and trigger this error message: + +"rejecting ETS config starving a TC\n" + +The .ieee_setets() will then fail. + +Fixes: 7df4ae9fe855 ("bnxt_en: Implement DCBNL to support host-based DCBX.") +Reviewed-by: Sreekanth Reddy +Signed-off-by: Shravya KN +Signed-off-by: Michael Chan +Link: https://patch.msgid.link/20250710213938.1959625-2-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c +index b1511bcffb1bb..5e6305f8220f6 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c +@@ -454,7 +454,9 @@ static int bnxt_ets_validate(struct bnxt *bp, struct ieee_ets *ets, u8 *tc) + + if ((ets->tc_tx_bw[i] || ets->tc_tsa[i]) && i > bp->max_tc) + return -EINVAL; ++ } + ++ for (i = 0; i < max_tc; i++) { + switch (ets->tc_tsa[i]) { + case IEEE_8021QAZ_TSA_STRICT: + break; +-- +2.39.5 + diff --git a/queue-5.4/bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch b/queue-5.4/bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch new file mode 100644 index 0000000000..966f9afefd --- /dev/null +++ b/queue-5.4/bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch @@ -0,0 +1,72 @@ +From f0b6c9cbbb24d605f77d18b876513caa9e6d85cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jul 2025 14:39:38 -0700 +Subject: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT + +From: Somnath Kotur + +[ Upstream commit 3cdf199d4755d477972ee87110b2aebc88b3cfad ] + +When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() +with the proper length instead of 0. This bug triggers this warning +on a system with IOMMU enabled: + +WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 +RIP: 0010:__iommu_dma_unmap+0x159/0x170 +Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 +b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 +RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 +RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 +R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 +R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 +FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 +PKRU: 55555554 +Call Trace: + +? show_regs+0x6d/0x80 +? __warn+0x89/0x160 +? __iommu_dma_unmap+0x159/0x170 +? report_bug+0x17e/0x1b0 +? handle_bug+0x46/0x90 +? exc_invalid_op+0x18/0x80 +? asm_exc_invalid_op+0x1b/0x20 +? __iommu_dma_unmap+0x159/0x170 +? __iommu_dma_unmap+0xb3/0x170 +iommu_dma_unmap_page+0x4f/0x100 +dma_unmap_page_attrs+0x52/0x220 +? srso_alias_return_thunk+0x5/0xfbef5 +? xdp_return_frame+0x2e/0xd0 +bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] +__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] +bnxt_poll+0xd3/0x1e0 [bnxt_en] + +Fixes: f18c2b77b2e4 ("bnxt_en: optimized XDP_REDIRECT support") +Signed-off-by: Somnath Kotur +Signed-off-by: Michael Chan +Link: https://patch.msgid.link/20250710213938.1959625-4-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +index c6f6f20338803..837d292c06fa6 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +@@ -65,7 +65,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp, + tx_buf->action = XDP_REDIRECT; + tx_buf->xdpf = xdpf; + dma_unmap_addr_set(tx_buf, mapping, mapping); +- dma_unmap_len_set(tx_buf, len, 0); ++ dma_unmap_len_set(tx_buf, len, len); + } + + void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) +-- +2.39.5 + diff --git a/queue-5.4/can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch b/queue-5.4/can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch new file mode 100644 index 0000000000..b8f988ffef --- /dev/null +++ b/queue-5.4/can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch @@ -0,0 +1,40 @@ +From 5b9e13ca6127ff70ab3a61eb4847eea3d3e09ae5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jul 2025 12:12:02 +0200 +Subject: can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message + to debug level + +From: Sean Nyekjaer + +[ Upstream commit 58805e9cbc6f6a28f35d90e740956e983a0e036e ] + +Downgrade the "msg lost in rx" message to debug level, to prevent +flooding the kernel log with error messages. + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Reviewed-by: Vincent Mailhol +Signed-off-by: Sean Nyekjaer +Link: https://patch.msgid.link/20250711-mcan_ratelimit-v3-1-7413e8e21b84@geanix.com +[mkl: enhance commit message] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 26f721664e761..123c87196a368 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -520,7 +520,7 @@ static int m_can_handle_lost_msg(struct net_device *dev) + struct sk_buff *skb; + struct can_frame *frame; + +- netdev_err(dev, "msg lost in rxf0\n"); ++ netdev_dbg(dev, "msg lost in rxf0\n"); + + stats->rx_errors++; + stats->rx_over_errors++; +-- +2.39.5 + diff --git a/queue-5.4/dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch b/queue-5.4/dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch new file mode 100644 index 0000000000..95f5a64a40 --- /dev/null +++ b/queue-5.4/dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch @@ -0,0 +1,57 @@ +From c4236398e4d288a085702b4a0ed15ffdd64e8792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 10:47:48 +0100 +Subject: dma-buf: fix timeout handling in dma_resv_wait_timeout v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 2b95a7db6e0f75587bffddbb490399cbb87e4985 ] + +Even the kerneldoc says that with a zero timeout the function should not +wait for anything, but still return 1 to indicate that the fences are +signaled now. + +Unfortunately that isn't what was implemented, instead of only returning +1 we also waited for at least one jiffies. + +Fix that by adjusting the handling to what the function is actually +documented to do. + +v2: improve code readability + +Reported-by: Marek Olšák +Reported-by: Lucas Stach +Signed-off-by: Christian König +Reviewed-by: Lucas Stach +Cc: +Link: https://lore.kernel.org/r/20250129105841.1806-1-christian.koenig@amd.com +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/dma-resv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c +index 242a9ec295cf8..f00ecbaa7868b 100644 +--- a/drivers/dma-buf/dma-resv.c ++++ b/drivers/dma-buf/dma-resv.c +@@ -558,10 +558,13 @@ long dma_resv_wait_timeout_rcu(struct dma_resv *obj, + goto retry; + } + +- ret = dma_fence_wait_timeout(fence, intr, ret); ++ ret = dma_fence_wait_timeout(fence, intr, timeout); + dma_fence_put(fence); + if (ret > 0 && wait_all && (i + 1 < shared_count)) + goto retry; ++ /* Even for zero timeout the return value is 1 */ ++ if (ret > 0 && timeout == 0) ++ ret = 1; + } + return ret; + +-- +2.39.5 + diff --git a/queue-5.4/flexfiles-pnfs-update-stats-on-nfs4err_delay-for-v4..patch b/queue-5.4/flexfiles-pnfs-update-stats-on-nfs4err_delay-for-v4..patch new file mode 100644 index 0000000000..1f0c0e6be4 --- /dev/null +++ b/queue-5.4/flexfiles-pnfs-update-stats-on-nfs4err_delay-for-v4..patch @@ -0,0 +1,36 @@ +From 25d6dcb7feb3f4b3a7796170791256b436ed7c0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 21:04:15 +0200 +Subject: flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes + +From: Tigran Mkrtchyan + +[ Upstream commit e3e3775392f3f0f3e3044f8c162bf47858e01759 ] + +On NFS4ERR_DELAY nfs slient updates its stats, but misses for +flexfiles v4.1 DSes. + +Signed-off-by: Tigran Mkrtchyan +Signed-off-by: Anna Schumaker +Stable-dep-of: 38074de35b01 ("NFSv4/flexfiles: Fix handling of NFS level errors in I/O") +Signed-off-by: Sasha Levin +--- + fs/nfs/flexfilelayout/flexfilelayout.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 3b4f93dcf3239..87e8b869d9696 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -1153,6 +1153,8 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + nfs4_schedule_session_recovery(clp->cl_session, task->tk_status); + break; + case -NFS4ERR_DELAY: ++ nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY); ++ fallthrough; + case -NFS4ERR_GRACE: + rpc_delay(task, FF_LAYOUT_POLL_RETRY_MAX); + break; +-- +2.39.5 + diff --git a/queue-5.4/hid-add-ignore-quirk-for-smartlinktechnology.patch b/queue-5.4/hid-add-ignore-quirk-for-smartlinktechnology.patch new file mode 100644 index 0000000000..fb9b3a25b5 --- /dev/null +++ b/queue-5.4/hid-add-ignore-quirk-for-smartlinktechnology.patch @@ -0,0 +1,65 @@ +From a8942a90f684568fdd533690f8988fec383e4b47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 15:29:59 +0800 +Subject: HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY + +From: Zhang Heng + +[ Upstream commit 1a8953f4f7746c6a515989774fe03047c522c613 ] + +MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an +audio device is requested to get specific report id, the following error +may occur. + +[ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd +[ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00 +[ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 +[ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device +[ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology +[ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001 +[ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35 +[ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2 +[ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint +[ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) +[ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) + +Ignore HID interface. The device is working properly. + +Signed-off-by: Zhang Heng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 356916608cc49..3787bd508b616 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1347,4 +1347,7 @@ + #define USB_VENDOR_ID_SIGNOTEC 0x2133 + #define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 + ++#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a ++#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155 ++ + #endif +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index ff1a9d142cddf..2cf58e3016e7b 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -879,6 +879,7 @@ static const struct hid_device_id hid_ignore_list[] = { + #endif + { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) }, + { } + }; + +-- +2.39.5 + diff --git a/queue-5.4/hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch b/queue-5.4/hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch new file mode 100644 index 0000000000..b14c417015 --- /dev/null +++ b/queue-5.4/hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch @@ -0,0 +1,54 @@ +From 901956ad1059edf51953e3fd4a65bdc2a08f71d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 13:50:15 +0800 +Subject: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 54bae4c17c11688339eb73a04fd24203bb6e7494 ] + +The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) +report a HID sensor interface that is not actually implemented. +Attempting to access this non-functional sensor via iio_info causes +system hangs as runtime PM tries to wake up an unresponsive sensor. + +Add these 2 devices to the HID ignore list since the sensor interface is +non-functional by design and should not be exposed to userspace. + +Signed-off-by: Chia-Lin Kao (AceLan) +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 2 ++ + drivers/hid/hid-quirks.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 3787bd508b616..d2e355a9744a0 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -280,6 +280,8 @@ + #define USB_DEVICE_ID_ASUS_AK1D 0x1125 + #define USB_DEVICE_ID_CHICONY_TOSHIBA_WT10A 0x1408 + #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421 ++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824 ++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c + + #define USB_VENDOR_ID_CHUNGHWAT 0x2247 + #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 2cf58e3016e7b..d1cfd45f2585a 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -732,6 +732,8 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) }, + { HID_USB_DEVICE(USB_VENDOR_ID_AXENTIA, USB_DEVICE_ID_AXENTIA_FM_RADIO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) }, +-- +2.39.5 + diff --git a/queue-5.4/input-xpad-add-support-for-amazon-game-controller.patch b/queue-5.4/input-xpad-add-support-for-amazon-game-controller.patch new file mode 100644 index 0000000000..cb1ee13908 --- /dev/null +++ b/queue-5.4/input-xpad-add-support-for-amazon-game-controller.patch @@ -0,0 +1,45 @@ +From 160bb0ec613cc7b8f5b6e03b0ba14aeee660b398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 15:29:37 -0700 +Subject: Input: xpad - add support for Amazon Game Controller + +From: Matt Reynolds + +[ Upstream commit 05665cef4b745cb46b1d1b8e96deaa25464092d3 ] + +The Amazon Luna controller (product name "Amazon Game Controller") behaves +like an Xbox 360 controller when connected over USB. + +Signed-off-by: Matt Reynolds +Reviewed-by: Harry Cutts +Link: https://lore.kernel.org/r/20210429103548.1.If5f9a44cb81e25b9350f7c6c0b3c88b4ecd81166@changeid +Signed-off-by: Dmitry Torokhov +Stable-dep-of: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller") +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 00b973e0f79ff..fb714004641b7 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -275,6 +275,7 @@ static const struct xpad_device { + { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, ++ { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, +@@ -462,6 +463,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOX360_VENDOR(0x15e4), /* Numark X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ ++ XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA Controllers */ + XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA Controllers */ +-- +2.39.5 + diff --git a/queue-5.4/input-xpad-add-vid-for-turtle-beach-controllers.patch b/queue-5.4/input-xpad-add-vid-for-turtle-beach-controllers.patch new file mode 100644 index 0000000000..8c93d43dc2 --- /dev/null +++ b/queue-5.4/input-xpad-add-vid-for-turtle-beach-controllers.patch @@ -0,0 +1,35 @@ +From 3aeb6a5a189a8596376057c4fe78c3bcd40abc15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 18:32:43 -0700 +Subject: Input: xpad - add VID for Turtle Beach controllers + +From: Vicki Pfau + +[ Upstream commit 1999a6b12a3b5c8953fc9ec74863ebc75a1b851d ] + +This adds support for the Turtle Beach REACT-R and Recon Xbox controllers + +Signed-off-by: Vicki Pfau +Link: https://lore.kernel.org/r/20230225012147.276489-4-vi@endrift.com +Signed-off-by: Dmitry Torokhov +Stable-dep-of: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller") +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index fb714004641b7..21a4bf8b1f58e 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -452,6 +452,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ + XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ + XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */ ++ XPAD_XBOXONE_VENDOR(0x10f5), /* Turtle Beach Controllers */ + XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ + XPAD_XBOX360_VENDOR(0x11ff), /* PXN V900 */ + XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */ +-- +2.39.5 + diff --git a/queue-5.4/input-xpad-support-acer-ngr-200-controller.patch b/queue-5.4/input-xpad-support-acer-ngr-200-controller.patch new file mode 100644 index 0000000000..f972986bf1 --- /dev/null +++ b/queue-5.4/input-xpad-support-acer-ngr-200-controller.patch @@ -0,0 +1,43 @@ +From 795e517849039efbccb80204c163502a421a8cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 16:29:40 -0700 +Subject: Input: xpad - support Acer NGR 200 Controller + +From: Nilton Perim Neto + +[ Upstream commit 22c69d786ef8fb789c61ca75492a272774221324 ] + +Add the NGR 200 Xbox 360 to the list of recognized controllers. + +Signed-off-by: Nilton Perim Neto +Link: https://lore.kernel.org/r/20250608060517.14967-1-niltonperimneto@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 21a4bf8b1f58e..a0362201b5d35 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -147,6 +147,7 @@ static const struct xpad_device { + { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, + { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, + { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, ++ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX }, + { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, + { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, + { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, +@@ -440,6 +441,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */ + XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */ + XPAD_XBOX360_VENDOR(0x046d), /* Logitech X-Box 360 style controllers */ ++ XPAD_XBOX360_VENDOR(0x0502), /* Acer Inc. Xbox 360 style controllers */ + XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */ + XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */ + XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz X-Box 360 controllers */ +-- +2.39.5 + diff --git a/queue-5.4/md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch b/queue-5.4/md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch new file mode 100644 index 0000000000..2e3c0f5c2a --- /dev/null +++ b/queue-5.4/md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch @@ -0,0 +1,80 @@ +From db4ff3c53a01e5b11088439abaad276c4f4506c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jun 2025 19:28:40 +0800 +Subject: md/raid1: Fix stack memory use after return in raid1_reshape + +From: Wang Jinchao + +[ Upstream commit d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 ] + +In the raid1_reshape function, newpool is +allocated on the stack and assigned to conf->r1bio_pool. +This results in conf->r1bio_pool.wait.head pointing +to a stack address. +Accessing this address later can lead to a kernel panic. + +Example access path: + +raid1_reshape() +{ + // newpool is on the stack + mempool_t newpool, oldpool; + // initialize newpool.wait.head to stack address + mempool_init(&newpool, ...); + conf->r1bio_pool = newpool; +} + +raid1_read_request() or raid1_write_request() +{ + alloc_r1bio() + { + mempool_alloc() + { + // if pool->alloc fails + remove_element() + { + --pool->curr_nr; + } + } + } +} + +mempool_free() +{ + if (pool->curr_nr < pool->min_nr) { + // pool->wait.head is a stack address + // wake_up() will try to access this invalid address + // which leads to a kernel panic + return; + wake_up(&pool->wait); + } +} + +Fix: +reinit conf->r1bio_pool.wait after assigning newpool. + +Fixes: afeee514ce7f ("md: convert to bioset_init()/mempool_init()") +Signed-off-by: Wang Jinchao +Reviewed-by: Yu Kuai +Link: https://lore.kernel.org/linux-raid/20250612112901.3023950-1-wangjinchao600@gmail.com +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 395a279e2c885..dccf62e5b4978 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -3307,6 +3307,7 @@ static int raid1_reshape(struct mddev *mddev) + /* ok, everything is stopped */ + oldpool = conf->r1bio_pool; + conf->r1bio_pool = newpool; ++ init_waitqueue_head(&conf->r1bio_pool.wait); + + for (d = d2 = 0; d < conf->raid_disks; d++) { + struct md_rdev *rdev = conf->mirrors[d].rdev; +-- +2.39.5 + diff --git a/queue-5.4/net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch b/queue-5.4/net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch new file mode 100644 index 0000000000..311483ba92 --- /dev/null +++ b/queue-5.4/net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch @@ -0,0 +1,38 @@ +From 08879bd7c5d2fc295eff98c149ad98e16b273f44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 03:52:51 +0000 +Subject: net: appletalk: Fix device refcount leak in atrtr_create() + +From: Kito Xu + +[ Upstream commit 711c80f7d8b163d3ecd463cd96f07230f488e750 ] + +When updating an existing route entry in atrtr_create(), the old device +reference was not being released before assigning the new device, +leading to a device refcount leak. Fix this by calling dev_put() to +release the old device reference before holding the new one. + +Fixes: c7f905f0f6d4 ("[ATALK]: Add missing dev_hold() to atrtr_create().") +Signed-off-by: Kito Xu +Link: https://patch.msgid.link/tencent_E1A26771CDAB389A0396D1681A90A49E5D09@qq.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/appletalk/ddp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index 70cd5f55628d3..46ca0f1354fde 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -562,6 +562,7 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint) + + /* Fill in the routing entry */ + rt->target = ta->sat_addr; ++ dev_put(rt->dev); /* Release old device */ + dev_hold(devhint); + rt->dev = devhint; + rt->flags = r->rt_flags; +-- +2.39.5 + diff --git a/queue-5.4/net-phy-microchip-limit-100m-workaround-to-link-down.patch b/queue-5.4/net-phy-microchip-limit-100m-workaround-to-link-down.patch new file mode 100644 index 0000000000..a0c416aa68 --- /dev/null +++ b/queue-5.4/net-phy-microchip-limit-100m-workaround-to-link-down.patch @@ -0,0 +1,60 @@ +From 0b30dbe1d67482c63af1aca6bb2653944b004f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 15:07:53 +0200 +Subject: net: phy: microchip: limit 100M workaround to link-down events on + LAN88xx + +From: Oleksij Rempel + +[ Upstream commit dd4360c0e8504f2f7639c7f5d07c93cfd6a98333 ] + +Restrict the 100Mbit forced-mode workaround to link-down transitions +only, to prevent repeated link reset cycles in certain configurations. + +The workaround was originally introduced to improve signal reliability +when switching cables between long and short distances. It temporarily +forces the PHY into 10 Mbps before returning to 100 Mbps. + +However, when used with autonegotiating link partners (e.g., Intel i350), +executing this workaround on every link change can confuse the partner +and cause constant renegotiation loops. This results in repeated link +down/up transitions and the PHY never reaching a stable state. + +Limit the workaround to only run during the PHY_NOLINK state. This ensures +it is triggered only once per link drop, avoiding disruptive toggling +while still preserving its intended effect. + +Note: I am not able to reproduce the original issue that this workaround +addresses. I can only confirm that 100 Mbit mode works correctly in my +test setup. Based on code inspection, I assume the workaround aims to +reset some internal state machine or signal block by toggling speeds. +However, a PHY reset is already performed earlier in the function via +phy_init_hw(), which may achieve a similar effect. Without a reproducer, +I conservatively keep the workaround but restrict its conditions. + +Fixes: e57cf3639c32 ("net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver") +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250709130753.3994461-3-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/microchip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c +index 375bbd60b38af..e6ad7d29a0559 100644 +--- a/drivers/net/phy/microchip.c ++++ b/drivers/net/phy/microchip.c +@@ -335,7 +335,7 @@ static void lan88xx_link_change_notify(struct phy_device *phydev) + * As workaround, set to 10 before setting to 100 + * at forced 100 F/H mode. + */ +- if (!phydev->autoneg && phydev->speed == 100) { ++ if (phydev->state == PHY_NOLINK && !phydev->autoneg && phydev->speed == 100) { + /* disable phy interrupt */ + temp = phy_read(phydev, LAN88XX_INT_MASK); + temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_; +-- +2.39.5 + diff --git a/queue-5.4/net-usb-qmi_wwan-add-simcom-8230c-composition.patch b/queue-5.4/net-usb-qmi_wwan-add-simcom-8230c-composition.patch new file mode 100644 index 0000000000..80e4d112e5 --- /dev/null +++ b/queue-5.4/net-usb-qmi_wwan-add-simcom-8230c-composition.patch @@ -0,0 +1,63 @@ +From 770ccd969202d4eceb86cdfc602521051361876a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jun 2025 10:27:02 +0800 +Subject: net: usb: qmi_wwan: add SIMCom 8230C composition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaowei Li + +[ Upstream commit 0b39b055b5b48cbbdf5746a1ca6e3f6b0221e537 ] + +Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip. +0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet +T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1e0e ProdID=9071 Rev= 5.15 +S: Manufacturer=SIMCOM +S: Product=SDXBAAGHA-IDP _SN:D744C4C5 +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=none +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Xiaowei Li +Acked-by: Bjørn Mork +Link: https://patch.msgid.link/tencent_21D781FAA4969FEACA6ABB460362B52C9409@qq.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index d0032db3e9f40..496cff5f3d0a3 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1382,6 +1382,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ + {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ + {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */ ++ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9071, 3)}, /* SIMCom 8230C ++ */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ +-- +2.39.5 + diff --git a/queue-5.4/nfsv4-flexfiles-fix-handling-of-nfs-level-errors-in-.patch b/queue-5.4/nfsv4-flexfiles-fix-handling-of-nfs-level-errors-in-.patch new file mode 100644 index 0000000000..55a7647933 --- /dev/null +++ b/queue-5.4/nfsv4-flexfiles-fix-handling-of-nfs-level-errors-in-.patch @@ -0,0 +1,285 @@ +From 2abc94f0f82e052963cb3468a3ceb0691c982b03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jun 2025 15:16:11 -0400 +Subject: NFSv4/flexfiles: Fix handling of NFS level errors in I/O + +From: Trond Myklebust + +[ Upstream commit 38074de35b015df5623f524d6f2b49a0cd395c40 ] + +Allow the flexfiles error handling to recognise NFS level errors (as +opposed to RPC level errors) and handle them separately. The main +motivator is the NFSERR_PERM errors that get returned if the NFS client +connects to the data server through a port number that is lower than +1024. In that case, the client should disconnect and retry a READ on a +different data server, or it should retry a WRITE after reconnecting. + +Reviewed-by: Tigran Mkrtchyan +Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/flexfilelayout/flexfilelayout.c | 142 ++++++++++++++++++------- + 1 file changed, 104 insertions(+), 38 deletions(-) + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 87e8b869d9696..31ae042f5a758 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -1129,6 +1129,7 @@ static void ff_layout_reset_read(struct nfs_pgio_header *hdr) + } + + static int ff_layout_async_handle_error_v4(struct rpc_task *task, ++ u32 op_status, + struct nfs4_state *state, + struct nfs_client *clp, + struct pnfs_layout_segment *lseg, +@@ -1139,34 +1140,42 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); + struct nfs4_slot_table *tbl = &clp->cl_session->fc_slot_table; + +- switch (task->tk_status) { +- case -NFS4ERR_BADSESSION: +- case -NFS4ERR_BADSLOT: +- case -NFS4ERR_BAD_HIGH_SLOT: +- case -NFS4ERR_DEADSESSION: +- case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION: +- case -NFS4ERR_SEQ_FALSE_RETRY: +- case -NFS4ERR_SEQ_MISORDERED: ++ switch (op_status) { ++ case NFS4_OK: ++ case NFS4ERR_NXIO: ++ break; ++ case NFSERR_PERM: ++ if (!task->tk_xprt) ++ break; ++ xprt_force_disconnect(task->tk_xprt); ++ goto out_retry; ++ case NFS4ERR_BADSESSION: ++ case NFS4ERR_BADSLOT: ++ case NFS4ERR_BAD_HIGH_SLOT: ++ case NFS4ERR_DEADSESSION: ++ case NFS4ERR_CONN_NOT_BOUND_TO_SESSION: ++ case NFS4ERR_SEQ_FALSE_RETRY: ++ case NFS4ERR_SEQ_MISORDERED: + dprintk("%s ERROR %d, Reset session. Exchangeid " + "flags 0x%x\n", __func__, task->tk_status, + clp->cl_exchange_flags); + nfs4_schedule_session_recovery(clp->cl_session, task->tk_status); +- break; +- case -NFS4ERR_DELAY: ++ goto out_retry; ++ case NFS4ERR_DELAY: + nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY); + fallthrough; +- case -NFS4ERR_GRACE: ++ case NFS4ERR_GRACE: + rpc_delay(task, FF_LAYOUT_POLL_RETRY_MAX); +- break; +- case -NFS4ERR_RETRY_UNCACHED_REP: +- break; ++ goto out_retry; ++ case NFS4ERR_RETRY_UNCACHED_REP: ++ goto out_retry; + /* Invalidate Layout errors */ +- case -NFS4ERR_PNFS_NO_LAYOUT: +- case -ESTALE: /* mapped NFS4ERR_STALE */ +- case -EBADHANDLE: /* mapped NFS4ERR_BADHANDLE */ +- case -EISDIR: /* mapped NFS4ERR_ISDIR */ +- case -NFS4ERR_FHEXPIRED: +- case -NFS4ERR_WRONG_TYPE: ++ case NFS4ERR_PNFS_NO_LAYOUT: ++ case NFS4ERR_STALE: ++ case NFS4ERR_BADHANDLE: ++ case NFS4ERR_ISDIR: ++ case NFS4ERR_FHEXPIRED: ++ case NFS4ERR_WRONG_TYPE: + dprintk("%s Invalid layout error %d\n", __func__, + task->tk_status); + /* +@@ -1179,6 +1188,11 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + pnfs_destroy_layout(NFS_I(inode)); + rpc_wake_up(&tbl->slot_tbl_waitq); + goto reset; ++ default: ++ break; ++ } ++ ++ switch (task->tk_status) { + /* RPC connection errors */ + case -ECONNREFUSED: + case -EHOSTDOWN: +@@ -1192,26 +1206,56 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + nfs4_delete_deviceid(devid->ld, devid->nfs_client, + &devid->deviceid); + rpc_wake_up(&tbl->slot_tbl_waitq); +- /* fall through */ ++ break; + default: +- if (ff_layout_avoid_mds_available_ds(lseg)) +- return -NFS4ERR_RESET_TO_PNFS; +-reset: +- dprintk("%s Retry through MDS. Error %d\n", __func__, +- task->tk_status); +- return -NFS4ERR_RESET_TO_MDS; ++ break; + } ++ ++ if (ff_layout_avoid_mds_available_ds(lseg)) ++ return -NFS4ERR_RESET_TO_PNFS; ++reset: ++ dprintk("%s Retry through MDS. Error %d\n", __func__, ++ task->tk_status); ++ return -NFS4ERR_RESET_TO_MDS; ++ ++out_retry: + task->tk_status = 0; + return -EAGAIN; + } + + /* Retry all errors through either pNFS or MDS except for -EJUKEBOX */ + static int ff_layout_async_handle_error_v3(struct rpc_task *task, ++ u32 op_status, ++ struct nfs_client *clp, + struct pnfs_layout_segment *lseg, + int idx) + { + struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); + ++ switch (op_status) { ++ case NFS_OK: ++ case NFSERR_NXIO: ++ break; ++ case NFSERR_PERM: ++ if (!task->tk_xprt) ++ break; ++ xprt_force_disconnect(task->tk_xprt); ++ goto out_retry; ++ case NFSERR_ACCES: ++ case NFSERR_BADHANDLE: ++ case NFSERR_FBIG: ++ case NFSERR_IO: ++ case NFSERR_NOSPC: ++ case NFSERR_ROFS: ++ case NFSERR_STALE: ++ goto out_reset_to_pnfs; ++ case NFSERR_JUKEBOX: ++ nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY); ++ goto out_retry; ++ default: ++ break; ++ } ++ + switch (task->tk_status) { + /* File access problems. Don't mark the device as unavailable */ + case -EACCES: +@@ -1230,6 +1274,7 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, + nfs4_delete_deviceid(devid->ld, devid->nfs_client, + &devid->deviceid); + } ++out_reset_to_pnfs: + /* FIXME: Need to prevent infinite looping here. */ + return -NFS4ERR_RESET_TO_PNFS; + out_retry: +@@ -1240,6 +1285,7 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, + } + + static int ff_layout_async_handle_error(struct rpc_task *task, ++ u32 op_status, + struct nfs4_state *state, + struct nfs_client *clp, + struct pnfs_layout_segment *lseg, +@@ -1258,10 +1304,11 @@ static int ff_layout_async_handle_error(struct rpc_task *task, + + switch (vers) { + case 3: +- return ff_layout_async_handle_error_v3(task, lseg, idx); +- case 4: +- return ff_layout_async_handle_error_v4(task, state, clp, ++ return ff_layout_async_handle_error_v3(task, op_status, clp, + lseg, idx); ++ case 4: ++ return ff_layout_async_handle_error_v4(task, op_status, state, ++ clp, lseg, idx); + default: + /* should never happen */ + WARN_ON_ONCE(1); +@@ -1306,7 +1353,17 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg, + switch (status) { + case NFS4ERR_DELAY: + case NFS4ERR_GRACE: +- return; ++ case NFS4ERR_PERM: ++ break; ++ case NFS4ERR_NXIO: ++ ff_layout_mark_ds_unreachable(lseg, idx); ++ /* ++ * Don't return the layout if this is a read and we still ++ * have layouts to try ++ */ ++ if (opnum == OP_READ) ++ break; ++ fallthrough; + default: + break; + } +@@ -1329,12 +1386,15 @@ static int ff_layout_read_done_cb(struct rpc_task *task, + int err; + + trace_nfs4_pnfs_read(hdr, task->tk_status); +- if (task->tk_status < 0) ++ if (task->tk_status < 0) { + ff_layout_io_track_ds_error(hdr->lseg, hdr->pgio_mirror_idx, + hdr->args.offset, hdr->args.count, + hdr->res.op_status, OP_READ, + task->tk_status); +- err = ff_layout_async_handle_error(task, hdr->args.context->state, ++ } ++ ++ err = ff_layout_async_handle_error(task, hdr->res.op_status, ++ hdr->args.context->state, + hdr->ds_clp, hdr->lseg, + hdr->pgio_mirror_idx); + +@@ -1502,12 +1562,15 @@ static int ff_layout_write_done_cb(struct rpc_task *task, + int err; + + trace_nfs4_pnfs_write(hdr, task->tk_status); +- if (task->tk_status < 0) ++ if (task->tk_status < 0) { + ff_layout_io_track_ds_error(hdr->lseg, hdr->pgio_mirror_idx, + hdr->args.offset, hdr->args.count, + hdr->res.op_status, OP_WRITE, + task->tk_status); +- err = ff_layout_async_handle_error(task, hdr->args.context->state, ++ } ++ ++ err = ff_layout_async_handle_error(task, hdr->res.op_status, ++ hdr->args.context->state, + hdr->ds_clp, hdr->lseg, + hdr->pgio_mirror_idx); + +@@ -1545,13 +1608,16 @@ static int ff_layout_commit_done_cb(struct rpc_task *task, + int err; + + trace_nfs4_pnfs_commit_ds(data, task->tk_status); +- if (task->tk_status < 0) ++ if (task->tk_status < 0) { + ff_layout_io_track_ds_error(data->lseg, data->ds_commit_index, + data->args.offset, data->args.count, + data->res.op_status, OP_COMMIT, + task->tk_status); +- err = ff_layout_async_handle_error(task, NULL, data->ds_clp, +- data->lseg, data->ds_commit_index); ++ } ++ ++ err = ff_layout_async_handle_error(task, data->res.op_status, ++ NULL, data->ds_clp, data->lseg, ++ data->ds_commit_index); + + switch (err) { + case -NFS4ERR_RESET_TO_PNFS: +-- +2.39.5 + diff --git a/queue-5.4/rdma-mlx5-fix-vport-loopback-for-mpv-device.patch b/queue-5.4/rdma-mlx5-fix-vport-loopback-for-mpv-device.patch new file mode 100644 index 0000000000..1440118550 --- /dev/null +++ b/queue-5.4/rdma-mlx5-fix-vport-loopback-for-mpv-device.patch @@ -0,0 +1,87 @@ +From d03518e5a1b595ed6c3e4ec8928f798a5a9f2d32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jul 2025 04:37:18 -0400 +Subject: RDMA/mlx5: Fix vport loopback for MPV device + +From: Patrisious Haddad + +[ Upstream commit a9a9e68954f29b1e197663f76289db4879fd51bb ] + +Always enable vport loopback for both MPV devices on driver start. + +Previously in some cases related to MPV RoCE, packets weren't correctly +executing loopback check at vport in FW, since it was disabled. +Due to complexity of identifying such cases for MPV always enable vport +loopback for both GVMIs when binding the slave to the master port. + +Fixes: 0042f9e458a5 ("RDMA/mlx5: Enable vport loopback when user context or QP mandate") +Signed-off-by: Patrisious Haddad +Reviewed-by: Mark Bloch +Link: https://patch.msgid.link/d4298f5ebb2197459e9e7221c51ecd6a34699847.1750064969.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 33 +++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 1b880b555412f..84b8588f6dada 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1686,6 +1686,33 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, + mlx5_cmd_free_uar(dev->mdev, bfregi->sys_pages[i]); + } + ++static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, ++ struct mlx5_core_dev *slave) ++{ ++ int err; ++ ++ err = mlx5_nic_vport_update_local_lb(master, true); ++ if (err) ++ return err; ++ ++ err = mlx5_nic_vport_update_local_lb(slave, true); ++ if (err) ++ goto out; ++ ++ return 0; ++ ++out: ++ mlx5_nic_vport_update_local_lb(master, false); ++ return err; ++} ++ ++static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, ++ struct mlx5_core_dev *slave) ++{ ++ mlx5_nic_vport_update_local_lb(slave, false); ++ mlx5_nic_vport_update_local_lb(master, false); ++} ++ + int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { + int err = 0; +@@ -5839,6 +5866,8 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + lockdep_assert_held(&mlx5_ib_multiport_mutex); + ++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); ++ + mlx5_ib_cleanup_cong_debugfs(ibdev, port_num); + + spin_lock(&port->mp.mpi_lock); +@@ -5927,6 +5956,10 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, + + mlx5_ib_init_cong_debugfs(ibdev, port_num); + ++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); ++ if (err) ++ goto unbind; ++ + return true; + + unbind: +-- +2.39.5 + diff --git a/queue-5.4/series b/queue-5.4/series index 341ab8c09d..d8350d2758 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -124,3 +124,29 @@ revert-acpi-battery-negate-current-when-discharging.patch pwm-mediatek-ensure-to-disable-clocks-in-error-path.patch netlink-make-sure-we-allow-at-least-one-dump-skb.patch netlink-fix-rmem-check-in-netlink_broadcast_deliver.patch +rdma-mlx5-fix-vport-loopback-for-mpv-device.patch +flexfiles-pnfs-update-stats-on-nfs4err_delay-for-v4..patch +nfsv4-flexfiles-fix-handling-of-nfs-level-errors-in-.patch +xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch +usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch +xhci-dbc-flush-queued-requests-before-stopping-dbc.patch +xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch +input-xpad-add-support-for-amazon-game-controller.patch +input-xpad-add-vid-for-turtle-beach-controllers.patch +input-xpad-support-acer-ngr-200-controller.patch +usb-dwc3-clean-up-probe-declarations.patch +usb-xhci-move-extcaps-related-macros-to-respective-h.patch +usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch +dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch +wifi-zd1211rw-fix-potential-null-pointer-dereference.patch +md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch +net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch +net-phy-microchip-limit-100m-workaround-to-link-down.patch +can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch +bnxt_en-fix-dcb-ets-validation.patch +bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch +atm-idt77252-add-missing-dma_map_error.patch +net-usb-qmi_wwan-add-simcom-8230c-composition.patch +vt-add-missing-notification-when-switching-back-to-t.patch +hid-add-ignore-quirk-for-smartlinktechnology.patch +hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch diff --git a/queue-5.4/usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch b/queue-5.4/usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch new file mode 100644 index 0000000000..050e4ded3a --- /dev/null +++ b/queue-5.4/usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch @@ -0,0 +1,96 @@ +From ee2ad558af36166f1920ac2ce9762145b4ccbfde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 May 2025 18:03:11 +0800 +Subject: usb: dwc3: Abort suspend on soft disconnect failure + +From: Kuen-Han Tsai + +[ Upstream commit 630a1dec3b0eba2a695b9063f1c205d585cbfec9 ] + +When dwc3_gadget_soft_disconnect() fails, dwc3_suspend_common() keeps +going with the suspend, resulting in a period where the power domain is +off, but the gadget driver remains connected. Within this time frame, +invoking vbus_event_work() will cause an error as it attempts to access +DWC3 registers for endpoint disabling after the power domain has been +completely shut down. + +Abort the suspend sequence when dwc3_gadget_suspend() cannot halt the +controller and proceeds with a soft connect. + +Fixes: 9f8a67b65a49 ("usb: dwc3: gadget: fix gadget suspend/resume") +Cc: stable +Acked-by: Thinh Nguyen +Signed-off-by: Kuen-Han Tsai +Link: https://lore.kernel.org/r/20250528100315.2162699-1-khtsai@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 9 +++++++-- + drivers/usb/dwc3/gadget.c | 15 ++++++++++++++- + 2 files changed, 21 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 36499f7054a28..71efeb4f3a774 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1642,12 +1642,15 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + { + unsigned long flags; + u32 reg; ++ int ret; + + switch (dwc->current_dr_role) { + case DWC3_GCTL_PRTCAP_DEVICE: + spin_lock_irqsave(&dwc->lock, flags); +- dwc3_gadget_suspend(dwc); ++ ret = dwc3_gadget_suspend(dwc); + spin_unlock_irqrestore(&dwc->lock, flags); ++ if (ret) ++ return ret; + synchronize_irq(dwc->irq_gadget); + dwc3_core_exit(dwc); + break; +@@ -1679,8 +1682,10 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + + if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { + spin_lock_irqsave(&dwc->lock, flags); +- dwc3_gadget_suspend(dwc); ++ ret = dwc3_gadget_suspend(dwc); + spin_unlock_irqrestore(&dwc->lock, flags); ++ if (ret) ++ return ret; + synchronize_irq(dwc->irq_gadget); + } + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 76316205483b9..a1da478f29724 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3838,10 +3838,23 @@ void dwc3_gadget_exit(struct dwc3 *dwc) + + int dwc3_gadget_suspend(struct dwc3 *dwc) + { ++ int ret; ++ + if (!dwc->gadget_driver) + return 0; + +- dwc3_gadget_run_stop(dwc, false, false); ++ ret = dwc3_gadget_run_stop(dwc, false, false); ++ if (ret) { ++ /* ++ * Attempt to reset the controller's state. Likely no ++ * communication can be established until the host ++ * performs a port reset. ++ */ ++ if (dwc->softconnect) ++ dwc3_gadget_run_stop(dwc, true, false); ++ return -EAGAIN; ++ } ++ + dwc3_disconnect_gadget(dwc); + __dwc3_gadget_stop(dwc); + +-- +2.39.5 + diff --git a/queue-5.4/usb-dwc3-clean-up-probe-declarations.patch b/queue-5.4/usb-dwc3-clean-up-probe-declarations.patch new file mode 100644 index 0000000000..03c7feed09 --- /dev/null +++ b/queue-5.4/usb-dwc3-clean-up-probe-declarations.patch @@ -0,0 +1,42 @@ +From f0782cffd61c6756da33dd9ba69e6d7e38da492e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 09:25:24 +0200 +Subject: USB: dwc3: clean up probe declarations + +From: Johan Hovold + +[ Upstream commit 9a4d7dd1990383df8ffa09d6879cecb0534405e1 ] + +Clean up the probe variable declarations by removing the stray newlines. + +Acked-by: Thinh Nguyen +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20230404072524.19014-12-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 630a1dec3b0e ("usb: dwc3: Abort suspend on soft disconnect failure") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 1a420c00d6ca1..36499f7054a28 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1430,12 +1430,10 @@ static int dwc3_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct resource *res, dwc_res; ++ void __iomem *regs; + struct dwc3 *dwc; +- + int ret; + +- void __iomem *regs; +- + dwc = devm_kzalloc(dev, sizeof(*dwc), GFP_KERNEL); + if (!dwc) + return -ENOMEM; +-- +2.39.5 + diff --git a/queue-5.4/usb-xhci-move-extcaps-related-macros-to-respective-h.patch b/queue-5.4/usb-xhci-move-extcaps-related-macros-to-respective-h.patch new file mode 100644 index 0000000000..46aa250c30 --- /dev/null +++ b/queue-5.4/usb-xhci-move-extcaps-related-macros-to-respective-h.patch @@ -0,0 +1,104 @@ +From 5cec18ba66257c64a30383007a7f9df565649dd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Aug 2023 19:00:23 +0530 +Subject: usb: xhci: Move extcaps related macros to respective header file + +From: Krishna Kurapati + +[ Upstream commit 60958b3abacc4eeea21236aa61bfacd1c3520168 ] + +DWC3 driver needs access to XHCI Extended Capabilities registers to +read number of usb2 ports and usb3 ports present on multiport controller. +Since the extcaps header is sufficient to parse this info, move port_count +related macros and structure from xhci.h to xhci-ext-caps.h. + +Signed-off-by: Krishna Kurapati +Link: https://lore.kernel.org/r/20230828133033.11988-4-quic_kriskura@quicinc.com +Acked-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 630a1dec3b0e ("usb: dwc3: Abort suspend on soft disconnect failure") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ext-caps.h | 27 +++++++++++++++++++++++++++ + drivers/usb/host/xhci.h | 27 --------------------------- + 2 files changed, 27 insertions(+), 27 deletions(-) + +diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h +index 2208fa6c74109..615b4562184bb 100644 +--- a/drivers/usb/host/xhci-ext-caps.h ++++ b/drivers/usb/host/xhci-ext-caps.h +@@ -79,6 +79,33 @@ + /* true: Controller Not Ready to accept doorbell or op reg writes after reset */ + #define XHCI_STS_CNR (1 << 11) + ++/** ++ * struct xhci_protocol_caps ++ * @revision: major revision, minor revision, capability ID, ++ * and next capability pointer. ++ * @name_string: Four ASCII characters to say which spec this xHC ++ * follows, typically "USB ". ++ * @port_info: Port offset, count, and protocol-defined information. ++ */ ++struct xhci_protocol_caps { ++ u32 revision; ++ u32 name_string; ++ u32 port_info; ++}; ++ ++#define XHCI_EXT_PORT_MAJOR(x) (((x) >> 24) & 0xff) ++#define XHCI_EXT_PORT_MINOR(x) (((x) >> 16) & 0xff) ++#define XHCI_EXT_PORT_PSIC(x) (((x) >> 28) & 0x0f) ++#define XHCI_EXT_PORT_OFF(x) ((x) & 0xff) ++#define XHCI_EXT_PORT_COUNT(x) (((x) >> 8) & 0xff) ++ ++#define XHCI_EXT_PORT_PSIV(x) (((x) >> 0) & 0x0f) ++#define XHCI_EXT_PORT_PSIE(x) (((x) >> 4) & 0x03) ++#define XHCI_EXT_PORT_PLT(x) (((x) >> 6) & 0x03) ++#define XHCI_EXT_PORT_PFD(x) (((x) >> 8) & 0x01) ++#define XHCI_EXT_PORT_LP(x) (((x) >> 14) & 0x03) ++#define XHCI_EXT_PORT_PSIM(x) (((x) >> 16) & 0xffff) ++ + #include + + /** +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 748a823b23dbb..3a2ff1ff32676 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -555,33 +555,6 @@ struct xhci_doorbell_array { + #define DB_VALUE(ep, stream) ((((ep) + 1) & 0xff) | ((stream) << 16)) + #define DB_VALUE_HOST 0x00000000 + +-/** +- * struct xhci_protocol_caps +- * @revision: major revision, minor revision, capability ID, +- * and next capability pointer. +- * @name_string: Four ASCII characters to say which spec this xHC +- * follows, typically "USB ". +- * @port_info: Port offset, count, and protocol-defined information. +- */ +-struct xhci_protocol_caps { +- u32 revision; +- u32 name_string; +- u32 port_info; +-}; +- +-#define XHCI_EXT_PORT_MAJOR(x) (((x) >> 24) & 0xff) +-#define XHCI_EXT_PORT_MINOR(x) (((x) >> 16) & 0xff) +-#define XHCI_EXT_PORT_PSIC(x) (((x) >> 28) & 0x0f) +-#define XHCI_EXT_PORT_OFF(x) ((x) & 0xff) +-#define XHCI_EXT_PORT_COUNT(x) (((x) >> 8) & 0xff) +- +-#define XHCI_EXT_PORT_PSIV(x) (((x) >> 0) & 0x0f) +-#define XHCI_EXT_PORT_PSIE(x) (((x) >> 4) & 0x03) +-#define XHCI_EXT_PORT_PLT(x) (((x) >> 6) & 0x03) +-#define XHCI_EXT_PORT_PFD(x) (((x) >> 8) & 0x01) +-#define XHCI_EXT_PORT_LP(x) (((x) >> 14) & 0x03) +-#define XHCI_EXT_PORT_PSIM(x) (((x) >> 16) & 0xffff) +- + #define PLT_MASK (0x03 << 6) + #define PLT_SYM (0x00 << 6) + #define PLT_ASYM_RX (0x02 << 6) +-- +2.39.5 + diff --git a/queue-5.4/usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch b/queue-5.4/usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch new file mode 100644 index 0000000000..78a04d1ba8 --- /dev/null +++ b/queue-5.4/usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch @@ -0,0 +1,122 @@ +From 1656177ef51979f78eb53c9abe7ccfe15f456ad7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jul 2025 05:34:20 -0400 +Subject: usb: xhci: quirk for data loss in ISOC transfers + +From: Raju Rangoju + +[ Upstream commit cbc889ab0122366f6cdbe3c28d477c683ebcebc2 ] + +During the High-Speed Isochronous Audio transfers, xHCI +controller on certain AMD platforms experiences momentary data +loss. This results in Missed Service Errors (MSE) being +generated by the xHCI. + +The root cause of the MSE is attributed to the ISOC OUT endpoint +being omitted from scheduling. This can happen when an IN +endpoint with a 64ms service interval either is pre-scheduled +prior to the ISOC OUT endpoint or the interval of the ISOC OUT +endpoint is shorter than that of the IN endpoint. Consequently, +the OUT service is neglected when an IN endpoint with a service +interval exceeding 32ms is scheduled concurrently (every 64ms in +this scenario). + +This issue is particularly seen on certain older AMD platforms. +To mitigate this problem, it is recommended to adjust the service +interval of the IN endpoint to not exceed 32ms (interval 8). This +adjustment ensures that the OUT endpoint will not be bypassed, +even if a smaller interval value is utilized. + +Cc: stable +Signed-off-by: Raju Rangoju +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250627144127.3889714-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mem.c | 4 ++++ + drivers/usb/host/xhci-pci.c | 26 ++++++++++++++++++++++++++ + drivers/usb/host/xhci.h | 1 + + 3 files changed, 31 insertions(+) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 610190bf62da4..ac7684c74df7a 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1467,6 +1467,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, + /* Periodic endpoint bInterval limit quirk */ + if (usb_endpoint_xfer_int(&ep->desc) || + usb_endpoint_xfer_isoc(&ep->desc)) { ++ if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_9) && ++ interval >= 9) { ++ interval = 8; ++ } + if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_7) && + udev->speed >= USB_SPEED_HIGH && + interval >= 7) { +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 64a46db07af86..5ff03b0ce2d02 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -56,6 +56,15 @@ + #define PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI 0x8a13 + #define PCI_DEVICE_ID_INTEL_CML_XHCI 0xa3af + ++#define PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI 0x13ed ++#define PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI 0x13ee ++#define PCI_DEVICE_ID_AMD_STARSHIP_XHCI 0x148c ++#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI 0x15d4 ++#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI 0x15d5 ++#define PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI 0x15e0 ++#define PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI 0x15e1 ++#define PCI_DEVICE_ID_AMD_RAVEN2_XHCI 0x15e5 ++#define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba + #define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb +@@ -69,6 +78,8 @@ + #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_7 0x161c + #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_8 0x161f + ++#define PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI 0x7316 ++ + #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042 + #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 + #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242 +@@ -154,6 +165,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_NEC) + xhci->quirks |= XHCI_NEC_HOST; + ++ if (pdev->vendor == PCI_VENDOR_ID_AMD && ++ (pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_STARSHIP_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI || ++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN2_XHCI)) ++ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9; ++ ++ if (pdev->vendor == PCI_VENDOR_ID_ATI && ++ pdev->device == PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI) ++ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9; ++ + if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version == 0x96) + xhci->quirks |= XHCI_AMD_0x96_HOST; + +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index d27b08d43e398..748a823b23dbb 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1889,6 +1889,7 @@ struct xhci_hcd { + #define XHCI_SKIP_PHY_INIT BIT_ULL(37) + #define XHCI_DISABLE_SPARSE BIT_ULL(38) + #define XHCI_NO_SOFT_RETRY BIT_ULL(40) ++#define XHCI_LIMIT_ENDPOINT_INTERVAL_9 BIT_ULL(41) + + unsigned int num_active_eps; + unsigned int limit_active_eps; +-- +2.39.5 + diff --git a/queue-5.4/vt-add-missing-notification-when-switching-back-to-t.patch b/queue-5.4/vt-add-missing-notification-when-switching-back-to-t.patch new file mode 100644 index 0000000000..656d3754c5 --- /dev/null +++ b/queue-5.4/vt-add-missing-notification-when-switching-back-to-t.patch @@ -0,0 +1,35 @@ +From 93ca5f569e0ff1e1356db11fe6e32236cfe7afa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jun 2025 21:41:44 -0400 +Subject: vt: add missing notification when switching back to text mode + +From: Nicolas Pitre + +[ Upstream commit ff78538e07fa284ce08cbbcb0730daa91ed16722 ] + +Programs using poll() on /dev/vcsa to be notified when VT changes occur +were missing one case: the switch from gfx to text mode. + +Signed-off-by: Nicolas Pitre +Link: https://lore.kernel.org/r/9o5ro928-0pp4-05rq-70p4-ro385n21n723@onlyvoer.pbz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/vt/vt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index e58dceaf7ff0e..3db8efd58747d 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -4368,6 +4368,7 @@ void do_unblank_screen(int leaving_gfx) + set_palette(vc); + set_cursor(vc); + vt_event_post(VT_EVENT_UNBLANK, vc->vc_num, vc->vc_num); ++ notify_update(vc); + } + EXPORT_SYMBOL(do_unblank_screen); + +-- +2.39.5 + diff --git a/queue-5.4/wifi-zd1211rw-fix-potential-null-pointer-dereference.patch b/queue-5.4/wifi-zd1211rw-fix-potential-null-pointer-dereference.patch new file mode 100644 index 0000000000..8ca19a2d34 --- /dev/null +++ b/queue-5.4/wifi-zd1211rw-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,68 @@ +From 6d9976391a54e6a3ebf15ebbf4ed4cb98b1b2a75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jun 2025 14:46:19 +0300 +Subject: wifi: zd1211rw: Fix potential NULL pointer dereference in + zd_mac_tx_to_dev() + +From: Daniil Dulov + +[ Upstream commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 ] + +There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For +example, the following is possible: + + T0 T1 +zd_mac_tx_to_dev() + /* len == skb_queue_len(q) */ + while (len > ZD_MAC_MAX_ACK_WAITERS) { + + filter_ack() + spin_lock_irqsave(&q->lock, flags); + /* position == skb_queue_len(q) */ + for (i=1; itype == NL80211_IFTYPE_AP) + skb = __skb_dequeue(q); + spin_unlock_irqrestore(&q->lock, flags); + + skb_dequeue() -> NULL + +Since there is a small gap between checking skb queue length and skb being +unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL. +Then the pointer is passed to zd_mac_tx_status() where it is dereferenced. + +In order to avoid potential NULL pointer dereference due to situations like +above, check if skb is not NULL before passing it to zd_mac_tx_status(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 459c51ad6e1f ("zd1211rw: port to mac80211") +Signed-off-by: Daniil Dulov +Link: https://patch.msgid.link/20250626114619.172631-1-d.dulov@aladdin.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/zydas/zd1211rw/zd_mac.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c +index a9999d10ae81f..bff6e796fde0d 100644 +--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c ++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c +@@ -584,7 +584,11 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error) + + skb_queue_tail(q, skb); + while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) { +- zd_mac_tx_status(hw, skb_dequeue(q), ++ skb = skb_dequeue(q); ++ if (!skb) ++ break; ++ ++ zd_mac_tx_status(hw, skb, + mac->ack_pending ? mac->ack_signal : 0, + NULL); + mac->ack_pending = 0; +-- +2.39.5 + diff --git a/queue-5.4/xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch b/queue-5.4/xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch new file mode 100644 index 0000000000..419d438100 --- /dev/null +++ b/queue-5.4/xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch @@ -0,0 +1,46 @@ +From 73260812f3e2416bbf14eb20a086eff513b3f2be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 11:13:27 +0530 +Subject: xhci: Allow RPM on the USB controller (1022:43f7) by default + +From: Basavaraj Natikar + +[ Upstream commit 28cbed496059fe1868203b76e9e0ef285733524d ] + +Enable runtime PM by default for older AMD 1022:43f7 xHCI 1.1 host as it +is proven to work. +Driver enables runtime PM by default for newer xHCI 1.2 host. + +Link: https://lore.kernel.org/all/12335218.O9o76ZdvQC@natalenko.name/ +Cc: Mario Limonciello +Tested-by: Oleksandr Natalenko +Signed-off-by: Basavaraj Natikar +Acked-by: Mathias Nyman +Link: https://lore.kernel.org/r/20240304054327.2564500-1-Basavaraj.Natikar@amd.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: cbc889ab0122 ("usb: xhci: quirk for data loss in ISOC transfers") +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-pci.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index e585fa63f766e..64a46db07af86 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -177,8 +177,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_RESET_ON_RESUME; + } + +- if (pdev->vendor == PCI_VENDOR_ID_AMD) ++ if (pdev->vendor == PCI_VENDOR_ID_AMD) { + xhci->quirks |= XHCI_TRUST_TX_LENGTH; ++ if (pdev->device == 0x43f7) ++ xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; ++ } + + if ((pdev->vendor == PCI_VENDOR_ID_AMD) && + ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) || +-- +2.39.5 + diff --git a/queue-5.4/xhci-dbc-flush-queued-requests-before-stopping-dbc.patch b/queue-5.4/xhci-dbc-flush-queued-requests-before-stopping-dbc.patch new file mode 100644 index 0000000000..7fb96256c9 --- /dev/null +++ b/queue-5.4/xhci-dbc-flush-queued-requests-before-stopping-dbc.patch @@ -0,0 +1,51 @@ +From 9caef1dfdbe6904b6287c930035279f78591a20d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jul 2025 06:00:25 -0400 +Subject: xhci: dbc: Flush queued requests before stopping dbc + +From: Mathias Nyman + +[ Upstream commit efe3e3ae5a66cb38ef29c909e951b4039044bae9 ] + +Flush dbc requests when dbc is stopped and transfer rings are freed. +Failure to flush them lead to leaking memory and dbc completing odd +requests after resuming from suspend, leading to error messages such as: + +[ 95.344392] xhci_hcd 0000:00:0d.0: no matched request + +Cc: stable +Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250627144127.3889714-5-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-dbgcap.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c +index 93e2cca5262d1..5c8e464adaeb1 100644 +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -549,6 +549,18 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci) + + WARN_ON(!dbc); + ++ switch (dbc->state) { ++ case DS_DISABLED: ++ return; ++ case DS_CONFIGURED: ++ spin_lock(&dbc->lock); ++ xhci_dbc_flush_requests(dbc); ++ spin_unlock(&dbc->lock); ++ break; ++ default: ++ break; ++ } ++ + cancel_delayed_work_sync(&dbc->event_work); + + if (port->registered) +-- +2.39.5 + diff --git a/queue-5.4/xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch b/queue-5.4/xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch new file mode 100644 index 0000000000..d70d9623ac --- /dev/null +++ b/queue-5.4/xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch @@ -0,0 +1,39 @@ +From 914ef1a384c06eeaf19c66863fe8d9d222eff5d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jun 2025 17:41:20 +0300 +Subject: xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS + +From: Hongyu Xie + +[ Upstream commit cd65ee81240e8bc3c3119b46db7f60c80864b90b ] + +Disable stream for platform xHC controller with broken stream. + +Fixes: 14aec589327a6 ("storage: accept some UAS devices if streams are unavailable") +Cc: stable +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250627144127.3889714-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-plat.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index fa320006b04d2..73570b392282d 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -333,7 +333,8 @@ static int xhci_plat_probe(struct platform_device *pdev) + if (ret) + goto disable_usb_phy; + +- if (HCC_MAX_PSA(xhci->hcc_params) >= 4) ++ if (HCC_MAX_PSA(xhci->hcc_params) >= 4 && ++ !(xhci->quirks & XHCI_BROKEN_STREAMS)) + xhci->shared_hcd->can_do_streams = 1; + + ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); +-- +2.39.5 +