Fixes for 5.15

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.15/bus-mhi-host-fix-race-between-channel-preparation-an.patch b/queue-5.15/bus-mhi-host-fix-race-between-channel-preparation-an.patch
new file mode 100644 (file)
index 0000000..1552bd8
--- /dev/null
+++ b/queue-5.15/bus-mhi-host-fix-race-between-channel-preparation-an.patch
@@ -0,0 +1,46 @@
+From f205565c00e0f98575316526fee320307ab0460e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Oct 2022 11:05:32 +0800
+Subject: bus: mhi: host: Fix race between channel preparation and M0 event
+
+From: Qiang Yu <quic_qianyu@quicinc.com>
+
+[ Upstream commit 869a99907faea6d1835b0bd0d0422ae3519c6ea9 ]
+
+There is a race condition where mhi_prepare_channel() updates the
+read and write pointers as the base address and in parallel, if
+an M0 transition occurs, the tasklet goes ahead and rings
+doorbells for all channels with a delta in TRE rings assuming
+they are already enabled. This causes a null pointer access. Fix
+it by adding a channel enabled check before ringing channel
+doorbells.
+
+Cc: stable@vger.kernel.org # 5.19
+Fixes: a6e2e3522f29 "bus: mhi: core: Add support for PM state transitions"
+Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://lore.kernel.org/r/1665889532-13634-1-git-send-email-quic_qianyu@quicinc.com
+[mani: CCed stable list]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/core/pm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c
+index 1020268a075a..1a87b9c6c2f8 100644
+--- a/drivers/bus/mhi/core/pm.c
++++ b/drivers/bus/mhi/core/pm.c
+@@ -297,7 +297,8 @@ int mhi_pm_m0_transition(struct mhi_controller *mhi_cntrl)
+               read_lock_irq(&mhi_chan->lock);
+ 
+               /* Only ring DB if ring is not empty */
+-              if (tre_ring->base && tre_ring->wp  != tre_ring->rp)
++              if (tre_ring->base && tre_ring->wp  != tre_ring->rp &&
++                  mhi_chan->ch_state == MHI_CH_STATE_ENABLED)
+                       mhi_ring_chan_db(mhi_cntrl, mhi_chan);
+               read_unlock_irq(&mhi_chan->lock);
+       }
+-- 
+2.35.1
+

diff --git a/queue-5.15/series b/queue-5.15/series
index b0af4542ee106c83747f5b484e956cb8a7781a34..5be475b62a9d28dc7fb378b92d2ecd6e8bd008a1 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -16,3 +16,5 @@ s390-percpu-add-read_once-to-arch_this_cpu_to_op_simple.patch
 drm-virtio-fix-gem-handle-creation-uaf.patch
 drm-i915-gt-reset-twice.patch
 net-mlx5e-set-action-fwd-flag-when-parsing-tc-action-goto.patch
+bus-mhi-host-fix-race-between-channel-preparation-an.patch
+usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch

diff --git a/queue-5.15/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch b/queue-5.15/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch
new file mode 100644 (file)
index 0000000..9da88d9
--- /dev/null
+++ b/queue-5.15/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch
@@ -0,0 +1,49 @@
+From d5f0e8cc3ddf92375db10b698e690fb7adcf24ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Dec 2022 21:15:26 +0100
+Subject: usb: ulpi: defer ulpi_register on ulpi_read_id timeout
+
+From: Ferry Toth <ftoth@exalondelft.nl>
+
+[ Upstream commit 8a7b31d545d3a15f0e6f5984ae16f0ca4fd76aac ]
+
+Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral
+if extcon is present") Dual Role support on Intel Merrifield platform
+broke due to rearranging the call to dwc3_get_extcon().
+
+It appears to be caused by ulpi_read_id() on the first test write failing
+with -ETIMEDOUT. Currently ulpi_read_id() expects to discover the phy via
+DT when the test write fails and returns 0 in that case, even if DT does not
+provide the phy. As a result usb probe completes without phy.
+
+Make ulpi_read_id() return -ETIMEDOUT to its user if the first test write
+fails. The user should then handle it appropriately. A follow up patch
+will make dwc3_core_init() set -EPROBE_DEFER in this case and bail out.
+
+Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT")
+Cc: stable@vger.kernel.org
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
+Link: https://lore.kernel.org/r/20221205201527.13525-2-ftoth@exalondelft.nl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/common/ulpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
+index 5509d3847af4..0e462933d270 100644
+--- a/drivers/usb/common/ulpi.c
++++ b/drivers/usb/common/ulpi.c
+@@ -206,7 +206,7 @@ static int ulpi_read_id(struct ulpi *ulpi)
+       /* Test the interface */
+       ret = ulpi_write(ulpi, ULPI_SCRATCH, 0xaa);
+       if (ret < 0)
+-              goto err;
++              return ret;
+ 
+       ret = ulpi_read(ulpi, ULPI_SCRATCH);
+       if (ret < 0)
+-- 
+2.35.1
+