From: Greg Kroah-Hartman Date: Sun, 1 May 2022 16:33:22 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v5.4.192~69 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=15ed862d5f9582255b8fe9af14bdc0b46ae479a5;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch binder-address-corner-cases-in-deferred-copy-and-fixup.patch binder-gracefully-handle-binder_type_fda-objects-with-num_fds-0.patch ceph-fix-possible-null-pointer-dereference-for-req-r_session.patch eeprom-at25-use-dma-safe-buffers.patch iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch iio-dac-ad5592r-fix-the-missing-return-value.patch iio-imu-inv_icm42600-fix-i2c-init-possible-nack.patch iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch iio-scd4x-check-return-of-scd4x_write_and_fetch.patch kernfs-fix-null-dereferencing-in-kernfs_remove.patch serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch serial-amba-pl011-do-not-time-out-prematurely-when-draining-tx-fifo.patch serial-imx-fix-overrun-interrupts-in-dma-mode.patch topology-make-core_mask-include-at-least-cluster_siblings.patch usb-cdns3-fix-issue-for-clear-halt-endpoint.patch usb-core-don-t-hold-the-device-lock-while-sleeping-in-do_proc_control.patch usb-dwc3-core-fix-tx-rx-threshold-settings.patch usb-dwc3-core-only-handle-soft-reset-in-dctl.patch usb-dwc3-gadget-return-proper-request-status.patch usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch usb-dwc3-try-usb-role-switch-first-in-dwc3_drd_init.patch usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch usb-phy-generic-get-the-vbus-supply.patch usb-typec-ucsi-fix-reuse-of-completion-structure.patch usb-typec-ucsi-fix-role-swapping.patch --- diff --git a/queue-5.17/arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch b/queue-5.17/arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch new file mode 100644 index 00000000000..8e9c9e4e32c --- /dev/null +++ b/queue-5.17/arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch @@ -0,0 +1,35 @@ +From 1dc9f1a66e1718479e1c4f95514e1750602a3cb9 Mon Sep 17 00:00:00 2001 +From: Wang Qing +Date: Sun, 10 Apr 2022 19:36:19 -0700 +Subject: arch_topology: Do not set llc_sibling if llc_id is invalid + +From: Wang Qing + +commit 1dc9f1a66e1718479e1c4f95514e1750602a3cb9 upstream. + +When ACPI is not enabled, cpuid_topo->llc_id = cpu_topo->llc_id = -1, which +will set llc_sibling 0xff(...), this is misleading. + +Don't set llc_sibling(default 0) if we don't know the cache topology. + +Reviewed-by: Sudeep Holla +Signed-off-by: Wang Qing +Fixes: 37c3ec2d810f ("arm64: topology: divorce MC scheduling domain from core_siblings") +Cc: stable +Link: https://lore.kernel.org/r/1649644580-54626-1-git-send-email-wangqing@vivo.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/arch_topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/arch_topology.c ++++ b/drivers/base/arch_topology.c +@@ -645,7 +645,7 @@ void update_siblings_masks(unsigned int + for_each_online_cpu(cpu) { + cpu_topo = &cpu_topology[cpu]; + +- if (cpuid_topo->llc_id == cpu_topo->llc_id) { ++ if (cpu_topo->llc_id != -1 && cpuid_topo->llc_id == cpu_topo->llc_id) { + cpumask_set_cpu(cpu, &cpuid_topo->llc_sibling); + cpumask_set_cpu(cpuid, &cpu_topo->llc_sibling); + } diff --git a/queue-5.17/binder-address-corner-cases-in-deferred-copy-and-fixup.patch b/queue-5.17/binder-address-corner-cases-in-deferred-copy-and-fixup.patch new file mode 100644 index 00000000000..fe43e44ff4e --- /dev/null +++ b/queue-5.17/binder-address-corner-cases-in-deferred-copy-and-fixup.patch @@ -0,0 +1,56 @@ +From 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 Mon Sep 17 00:00:00 2001 +From: Alessandro Astone +Date: Fri, 15 Apr 2022 14:00:15 +0200 +Subject: binder: Address corner cases in deferred copy and fixup + +From: Alessandro Astone + +commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 upstream. + +When handling BINDER_TYPE_FDA object we are pushing a parent fixup +with a certain skip_size but no scatter-gather copy object, since +the copy is handled standalone. +If BINDER_TYPE_FDA is the last children the scatter-gather copy +loop will never stop to skip it, thus we are left with an item in +the parent fixup list. This will trigger the BUG_ON(). + +This is reproducible in android when playing a video. +We receive a transaction that looks like this: + obj[0] BINDER_TYPE_PTR, parent + obj[1] BINDER_TYPE_PTR, child + obj[2] BINDER_TYPE_PTR, child + obj[3] BINDER_TYPE_FDA, child + +Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") +Acked-by: Todd Kjos +Cc: stable +Signed-off-by: Alessandro Astone +Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -2295,6 +2295,7 @@ static int binder_do_deferred_txn_copies + { + int ret = 0; + struct binder_sg_copy *sgc, *tmpsgc; ++ struct binder_ptr_fixup *tmppf; + struct binder_ptr_fixup *pf = + list_first_entry_or_null(pf_head, struct binder_ptr_fixup, + node); +@@ -2349,7 +2350,11 @@ static int binder_do_deferred_txn_copies + list_del(&sgc->node); + kfree(sgc); + } +- BUG_ON(!list_empty(pf_head)); ++ list_for_each_entry_safe(pf, tmppf, pf_head, node) { ++ BUG_ON(pf->skip_size == 0); ++ list_del(&pf->node); ++ kfree(pf); ++ } + BUG_ON(!list_empty(sgc_head)); + + return ret > 0 ? -EINVAL : ret; diff --git a/queue-5.17/binder-gracefully-handle-binder_type_fda-objects-with-num_fds-0.patch b/queue-5.17/binder-gracefully-handle-binder_type_fda-objects-with-num_fds-0.patch new file mode 100644 index 00000000000..d4042219a88 --- /dev/null +++ b/queue-5.17/binder-gracefully-handle-binder_type_fda-objects-with-num_fds-0.patch @@ -0,0 +1,48 @@ +From ef38de9217a04c9077629a24652689d8fdb4c6c6 Mon Sep 17 00:00:00 2001 +From: Alessandro Astone +Date: Fri, 15 Apr 2022 14:00:14 +0200 +Subject: binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 + +From: Alessandro Astone + +commit ef38de9217a04c9077629a24652689d8fdb4c6c6 upstream. + +Some android userspace is sending BINDER_TYPE_FDA objects with +num_fds=0. Like the previous patch, this is reproducible when +playing a video. + +Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0 +were 'correctly handled', as in no fixup was performed. + +After commit 09184ae9b575 we aggregate fixup and skip regions in +binder_ptr_fixup structs and distinguish between the two by using +the skip_size field: if it's 0, then it's a fixup, otherwise skip. +When processing BINDER_TYPE_FDA objects with num_fds=0 we add a +skip region of skip_size=0, and this causes issues because now +binder_do_deferred_txn_copies will think this was a fixup region. + +To address that, return early from binder_translate_fd_array to +avoid adding an empty skip region. + +Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") +Acked-by: Todd Kjos +Cc: stable +Signed-off-by: Alessandro Astone +Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -2486,6 +2486,9 @@ static int binder_translate_fd_array(str + struct binder_proc *proc = thread->proc; + int ret; + ++ if (fda->num_fds == 0) ++ return 0; ++ + fd_buf_size = sizeof(u32) * fda->num_fds; + if (fda->num_fds >= SIZE_MAX / sizeof(u32)) { + binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n", diff --git a/queue-5.17/ceph-fix-possible-null-pointer-dereference-for-req-r_session.patch b/queue-5.17/ceph-fix-possible-null-pointer-dereference-for-req-r_session.patch new file mode 100644 index 00000000000..207efff7527 --- /dev/null +++ b/queue-5.17/ceph-fix-possible-null-pointer-dereference-for-req-r_session.patch @@ -0,0 +1,44 @@ +From 7acae6183cf37c48b8da48bbbdb78820fb3913f3 Mon Sep 17 00:00:00 2001 +From: Xiubo Li +Date: Thu, 14 Apr 2022 09:07:21 +0800 +Subject: ceph: fix possible NULL pointer dereference for req->r_session + +From: Xiubo Li + +commit 7acae6183cf37c48b8da48bbbdb78820fb3913f3 upstream. + +The request will be inserted into the ci->i_unsafe_dirops before +assigning the req->r_session, so it's possible that we will hit +NULL pointer dereference bug here. + +Cc: stable@vger.kernel.org +URL: https://tracker.ceph.com/issues/55327 +Signed-off-by: Xiubo Li +Reviewed-by: Jeff Layton +Tested-by: Aaron Tomlin +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/caps.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -2267,6 +2267,8 @@ retry: + list_for_each_entry(req, &ci->i_unsafe_dirops, + r_unsafe_dir_item) { + s = req->r_session; ++ if (!s) ++ continue; + if (unlikely(s->s_mds >= max_sessions)) { + spin_unlock(&ci->i_unsafe_lock); + for (i = 0; i < max_sessions; i++) { +@@ -2287,6 +2289,8 @@ retry: + list_for_each_entry(req, &ci->i_unsafe_iops, + r_unsafe_target_item) { + s = req->r_session; ++ if (!s) ++ continue; + if (unlikely(s->s_mds >= max_sessions)) { + spin_unlock(&ci->i_unsafe_lock); + for (i = 0; i < max_sessions; i++) { diff --git a/queue-5.17/eeprom-at25-use-dma-safe-buffers.patch b/queue-5.17/eeprom-at25-use-dma-safe-buffers.patch new file mode 100644 index 00000000000..5157e4c3af0 --- /dev/null +++ b/queue-5.17/eeprom-at25-use-dma-safe-buffers.patch @@ -0,0 +1,155 @@ +From 5b47b751b760ee1c74a51660fd096aa148a362cd Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Wed, 23 Mar 2022 11:51:55 +0100 +Subject: eeprom: at25: Use DMA safe buffers + +From: Christophe Leroy + +commit 5b47b751b760ee1c74a51660fd096aa148a362cd upstream. + +Reading EEPROM fails with following warning: + +[ 16.357496] ------------[ cut here ]------------ +[ 16.357529] fsl_spi b01004c0.spi: rejecting DMA map of vmalloc memory +[ 16.357698] WARNING: CPU: 0 PID: 371 at include/linux/dma-mapping.h:326 fsl_spi_cpm_bufs+0x2a0/0x2d8 +[ 16.357775] CPU: 0 PID: 371 Comm: od Not tainted 5.16.11-s3k-dev-01743-g19beecbfe9d6-dirty #109 +[ 16.357806] NIP: c03fbc9c LR: c03fbc9c CTR: 00000000 +[ 16.357825] REGS: e68d9b20 TRAP: 0700 Not tainted (5.16.11-s3k-dev-01743-g19beecbfe9d6-dirty) +[ 16.357849] MSR: 00029032 CR: 24002282 XER: 00000000 +[ 16.357931] +[ 16.357931] GPR00: c03fbc9c e68d9be0 c26d06a0 00000039 00000001 c0d36364 c0e96428 00000027 +[ 16.357931] GPR08: 00000001 00000000 00000023 3fffc000 24002282 100d3dd6 100a2ffc 00000000 +[ 16.357931] GPR16: 100cd280 100b0000 00000000 aff54f7e 100d0000 100d0000 00000001 100cf328 +[ 16.357931] GPR24: 100cf328 00000000 00000003 e68d9e30 c156b410 e67ab4c0 e68d9d38 c24ab278 +[ 16.358253] NIP [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8 +[ 16.358292] LR [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8 +[ 16.358325] Call Trace: +[ 16.358336] [e68d9be0] [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8 (unreliable) +[ 16.358388] [e68d9c00] [c03fcb44] fsl_spi_bufs.isra.0+0x94/0x1a0 +[ 16.358436] [e68d9c20] [c03fd970] fsl_spi_do_one_msg+0x254/0x3dc +[ 16.358483] [e68d9cb0] [c03f7e50] __spi_pump_messages+0x274/0x8a4 +[ 16.358529] [e68d9ce0] [c03f9d30] __spi_sync+0x344/0x378 +[ 16.358573] [e68d9d20] [c03fb52c] spi_sync+0x34/0x60 +[ 16.358616] [e68d9d30] [c03b4dec] at25_ee_read+0x138/0x1a8 +[ 16.358667] [e68d9e50] [c04a8fb8] bin_attr_nvmem_read+0x98/0x110 +[ 16.358725] [e68d9e60] [c0204b14] kernfs_fop_read_iter+0xc0/0x1fc +[ 16.358774] [e68d9e80] [c0168660] vfs_read+0x284/0x410 +[ 16.358821] [e68d9f00] [c016925c] ksys_read+0x6c/0x11c +[ 16.358863] [e68d9f30] [c00160e0] ret_from_syscall+0x0/0x28 +... +[ 16.359608] ---[ end trace a4ce3e34afef0cb5 ]--- +[ 16.359638] fsl_spi b01004c0.spi: unable to map tx dma + +This is due to the AT25 driver using buffers on stack, which is not +possible with CONFIG_VMAP_STACK. + +As mentionned in kernel Documentation (Documentation/spi/spi-summary.rst): + + - Follow standard kernel rules, and provide DMA-safe buffers in + your messages. That way controller drivers using DMA aren't forced + to make extra copies unless the hardware requires it (e.g. working + around hardware errata that force the use of bounce buffering). + +Modify the driver to use a buffer located in the at25 device structure +which is allocated via kmalloc during probe. + +Protect writes in this new buffer with the driver's mutex. + +Fixes: b587b13a4f67 ("[PATCH] SPI eeprom driver") +Cc: stable +Signed-off-by: Christophe Leroy +Link: https://lore.kernel.org/r/230a9486fc68ea0182df46255e42a51099403642.1648032613.git.christophe.leroy@csgroup.eu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/eeprom/at25.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/misc/eeprom/at25.c ++++ b/drivers/misc/eeprom/at25.c +@@ -31,6 +31,8 @@ + */ + + #define FM25_SN_LEN 8 /* serial number length */ ++#define EE_MAXADDRLEN 3 /* 24 bit addresses, up to 2 MBytes */ ++ + struct at25_data { + struct spi_eeprom chip; + struct spi_device *spi; +@@ -39,6 +41,7 @@ struct at25_data { + struct nvmem_config nvmem_config; + struct nvmem_device *nvmem; + u8 sernum[FM25_SN_LEN]; ++ u8 command[EE_MAXADDRLEN + 1]; + }; + + #define AT25_WREN 0x06 /* latch the write enable */ +@@ -61,8 +64,6 @@ struct at25_data { + + #define FM25_ID_LEN 9 /* ID length */ + +-#define EE_MAXADDRLEN 3 /* 24 bit addresses, up to 2 MBytes */ +- + /* + * Specs often allow 5ms for a page write, sometimes 20ms; + * it's important to recover from write timeouts. +@@ -78,7 +79,6 @@ static int at25_ee_read(void *priv, unsi + { + struct at25_data *at25 = priv; + char *buf = val; +- u8 command[EE_MAXADDRLEN + 1]; + u8 *cp; + ssize_t status; + struct spi_transfer t[2]; +@@ -92,12 +92,15 @@ static int at25_ee_read(void *priv, unsi + if (unlikely(!count)) + return -EINVAL; + +- cp = command; ++ cp = at25->command; + + instr = AT25_READ; + if (at25->chip.flags & EE_INSTR_BIT3_IS_ADDR) + if (offset >= BIT(at25->addrlen * 8)) + instr |= AT25_INSTR_BIT3; ++ ++ mutex_lock(&at25->lock); ++ + *cp++ = instr; + + /* 8/16/24-bit address is written MSB first */ +@@ -116,7 +119,7 @@ static int at25_ee_read(void *priv, unsi + spi_message_init(&m); + memset(t, 0, sizeof(t)); + +- t[0].tx_buf = command; ++ t[0].tx_buf = at25->command; + t[0].len = at25->addrlen + 1; + spi_message_add_tail(&t[0], &m); + +@@ -124,8 +127,6 @@ static int at25_ee_read(void *priv, unsi + t[1].len = count; + spi_message_add_tail(&t[1], &m); + +- mutex_lock(&at25->lock); +- + /* + * Read it all at once. + * +@@ -152,7 +153,7 @@ static int fm25_aux_read(struct at25_dat + spi_message_init(&m); + memset(t, 0, sizeof(t)); + +- t[0].tx_buf = &command; ++ t[0].tx_buf = at25->command; + t[0].len = 1; + spi_message_add_tail(&t[0], &m); + +@@ -162,6 +163,8 @@ static int fm25_aux_read(struct at25_dat + + mutex_lock(&at25->lock); + ++ at25->command[0] = command; ++ + status = spi_sync(at25->spi, &m); + dev_dbg(&at25->spi->dev, "read %d aux bytes --> %d\n", len, status); + diff --git a/queue-5.17/iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch b/queue-5.17/iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch new file mode 100644 index 00000000000..f65bc9da341 --- /dev/null +++ b/queue-5.17/iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch @@ -0,0 +1,36 @@ +From 89a01cd688d3c0ac983ef0b0e5f40018ab768317 Mon Sep 17 00:00:00 2001 +From: Michael Hennerich +Date: Wed, 6 Apr 2022 12:56:20 +0200 +Subject: iio: dac: ad5446: Fix read_raw not returning set value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Hennerich + +commit 89a01cd688d3c0ac983ef0b0e5f40018ab768317 upstream. + +read_raw should return the un-scaled value. + +Fixes: 5e06bdfb46e8b ("staging:iio:dac:ad5446: Return cached value for 'raw' attribute") +Signed-off-by: Michael Hennerich +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20220406105620.1171340-1-michael.hennerich@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5446.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -178,7 +178,7 @@ static int ad5446_read_raw(struct iio_de + + switch (m) { + case IIO_CHAN_INFO_RAW: +- *val = st->cached_val; ++ *val = st->cached_val >> chan->scan_type.shift; + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: + *val = st->vref_mv; diff --git a/queue-5.17/iio-dac-ad5592r-fix-the-missing-return-value.patch b/queue-5.17/iio-dac-ad5592r-fix-the-missing-return-value.patch new file mode 100644 index 00000000000..bbb2d2adc4b --- /dev/null +++ b/queue-5.17/iio-dac-ad5592r-fix-the-missing-return-value.patch @@ -0,0 +1,34 @@ +From b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 Mon Sep 17 00:00:00 2001 +From: Zizhuang Deng +Date: Thu, 10 Mar 2022 20:54:50 +0800 +Subject: iio: dac: ad5592r: Fix the missing return value. + +From: Zizhuang Deng + +commit b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 upstream. + +The third call to `fwnode_property_read_u32` did not record +the return value, resulting in `channel_offstate` possibly +being assigned the wrong value. + +Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs") +Signed-off-by: Zizhuang Deng +Link: https://lore.kernel.org/r/20220310125450.4164164-1-sunsetdzz@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5592r-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5592r-base.c ++++ b/drivers/iio/dac/ad5592r-base.c +@@ -523,7 +523,7 @@ static int ad5592r_alloc_channels(struct + if (!ret) + st->channel_modes[reg] = tmp; + +- fwnode_property_read_u32(child, "adi,off-state", &tmp); ++ ret = fwnode_property_read_u32(child, "adi,off-state", &tmp); + if (!ret) + st->channel_offstate[reg] = tmp; + } diff --git a/queue-5.17/iio-imu-inv_icm42600-fix-i2c-init-possible-nack.patch b/queue-5.17/iio-imu-inv_icm42600-fix-i2c-init-possible-nack.patch new file mode 100644 index 00000000000..6c39bfd4c19 --- /dev/null +++ b/queue-5.17/iio-imu-inv_icm42600-fix-i2c-init-possible-nack.patch @@ -0,0 +1,48 @@ +From b5d6ba09b10d2ccb865ed9bc45941db0a41c6756 Mon Sep 17 00:00:00 2001 +From: Fawzi Khaber +Date: Mon, 11 Apr 2022 13:15:33 +0200 +Subject: iio: imu: inv_icm42600: Fix I2C init possible nack + +From: Fawzi Khaber + +commit b5d6ba09b10d2ccb865ed9bc45941db0a41c6756 upstream. + +This register write to REG_INTF_CONFIG6 enables a spike filter that +is impacting the line and can prevent the I2C ACK to be seen by the +controller. So we don't test the return value. + +Fixes: 7297ef1e261672b8 ("iio: imu: inv_icm42600: add I2C driver") +Signed-off-by: Fawzi Khaber +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20220411111533.5826-1-jmaneyrol@invensense.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_i2c.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_i2c.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_i2c.c +@@ -18,12 +18,15 @@ static int inv_icm42600_i2c_bus_setup(st + unsigned int mask, val; + int ret; + +- /* setup interface registers */ +- ret = regmap_update_bits(st->map, INV_ICM42600_REG_INTF_CONFIG6, +- INV_ICM42600_INTF_CONFIG6_MASK, +- INV_ICM42600_INTF_CONFIG6_I3C_EN); +- if (ret) +- return ret; ++ /* ++ * setup interface registers ++ * This register write to REG_INTF_CONFIG6 enables a spike filter that ++ * is impacting the line and can prevent the I2C ACK to be seen by the ++ * controller. So we don't test the return value. ++ */ ++ regmap_update_bits(st->map, INV_ICM42600_REG_INTF_CONFIG6, ++ INV_ICM42600_INTF_CONFIG6_MASK, ++ INV_ICM42600_INTF_CONFIG6_I3C_EN); + + ret = regmap_update_bits(st->map, INV_ICM42600_REG_INTF_CONFIG4, + INV_ICM42600_INTF_CONFIG4_I3C_BUS_ONLY, 0); diff --git a/queue-5.17/iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch b/queue-5.17/iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch new file mode 100644 index 00000000000..e03ac90a042 --- /dev/null +++ b/queue-5.17/iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch @@ -0,0 +1,42 @@ +From 3a26787dacf04257a68b16315c984eb2c340bc5e Mon Sep 17 00:00:00 2001 +From: Zheyu Ma +Date: Sat, 9 Apr 2022 11:48:49 +0800 +Subject: iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() + +From: Zheyu Ma + +commit 3a26787dacf04257a68b16315c984eb2c340bc5e upstream. + +When the driver fails to enable the regulator 'vid', we will get the +following splat: + +[ 79.955610] WARNING: CPU: 5 PID: 441 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0 +[ 79.959641] RIP: 0010:_regulator_put+0x3ec/0x4e0 +[ 79.967570] Call Trace: +[ 79.967773] +[ 79.967951] regulator_put+0x1f/0x30 +[ 79.968254] devres_release_group+0x319/0x3d0 +[ 79.968608] i2c_device_probe+0x766/0x940 + +Fix this by disabling the 'vdd' regulator when failing to enable 'vid' +regulator. + +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220409034849.3717231-2-zheyuma97@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/magnetometer/ak8975.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -416,6 +416,7 @@ static int ak8975_power_on(const struct + if (ret) { + dev_warn(&data->client->dev, + "Failed to enable specified Vid supply\n"); ++ regulator_disable(data->vdd); + return ret; + } + diff --git a/queue-5.17/iio-scd4x-check-return-of-scd4x_write_and_fetch.patch b/queue-5.17/iio-scd4x-check-return-of-scd4x_write_and_fetch.patch new file mode 100644 index 00000000000..ad6df649d4c --- /dev/null +++ b/queue-5.17/iio-scd4x-check-return-of-scd4x_write_and_fetch.patch @@ -0,0 +1,51 @@ +From f50232193e61cf89a73130b5e843fef30763c428 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 28 Feb 2022 18:52:23 -0800 +Subject: iio: scd4x: check return of scd4x_write_and_fetch + +From: Tom Rix + +commit f50232193e61cf89a73130b5e843fef30763c428 upstream. + +Clang static analysis reports this problem +scd4x.c:474:10: warning: The left operand of '==' is a + garbage value + if (val == 0xff) { + ~~~ ^ +val is only set from a successful call to scd4x_write_and_fetch() +So check it's return. + +Fixes: 49d22b695cbb ("drivers: iio: chemical: Add support for Sensirion SCD4x CO2 sensor") +Signed-off-by: Tom Rix +Link: https://lore.kernel.org/r/20220301025223.223223-1-trix@redhat.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/chemical/scd4x.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/chemical/scd4x.c b/drivers/iio/chemical/scd4x.c +index 20d4e7584e92..37143b5526ee 100644 +--- a/drivers/iio/chemical/scd4x.c ++++ b/drivers/iio/chemical/scd4x.c +@@ -471,12 +471,15 @@ static ssize_t calibration_forced_value_store(struct device *dev, + ret = scd4x_write_and_fetch(state, CMD_FRC, arg, &val, sizeof(val)); + mutex_unlock(&state->lock); + ++ if (ret) ++ return ret; ++ + if (val == 0xff) { + dev_err(dev, "forced calibration has failed"); + return -EINVAL; + } + +- return ret ?: len; ++ return len; + } + + static IIO_DEVICE_ATTR_RW(calibration_auto_enable, 0); +-- +2.36.0 + diff --git a/queue-5.17/kernfs-fix-null-dereferencing-in-kernfs_remove.patch b/queue-5.17/kernfs-fix-null-dereferencing-in-kernfs_remove.patch new file mode 100644 index 00000000000..87d50ce18ad --- /dev/null +++ b/queue-5.17/kernfs-fix-null-dereferencing-in-kernfs_remove.patch @@ -0,0 +1,93 @@ +From ad8d869343ae4a07a2038a4ca923f699308c8323 Mon Sep 17 00:00:00 2001 +From: Minchan Kim +Date: Wed, 27 Apr 2022 10:21:51 -0700 +Subject: kernfs: fix NULL dereferencing in kernfs_remove + +From: Minchan Kim + +commit ad8d869343ae4a07a2038a4ca923f699308c8323 upstream. + +kernfs_remove supported NULL kernfs_node param to bail out but revent +per-fs lock change introduced regression that dereferencing the +param without NULL check so kernel goes crash. + +This patch checks the NULL kernfs_node in kernfs_remove and if so, +just return. + +Quote from bug report by Jirka + +``` +The bug is triggered by running NAS Parallel benchmark suite on +SuperMicro servers with 2x Xeon(R) Gold 6126 CPU. Here is the error +log: + +[ 247.035564] BUG: kernel NULL pointer dereference, address: 0000000000000008 +[ 247.036009] #PF: supervisor read access in kernel mode +[ 247.036009] #PF: error_code(0x0000) - not-present page +[ 247.036009] PGD 0 P4D 0 +[ 247.036009] Oops: 0000 [#1] PREEMPT SMP PTI +[ 247.058060] CPU: 1 PID: 6546 Comm: umount Not tainted +5.16.0393c3714081a53795bbff0e985d24146def6f57f+ #16 +[ 247.058060] Hardware name: Supermicro Super Server/X11DDW-L, BIOS +2.0b 03/07/2018 +[ 247.058060] RIP: 0010:kernfs_remove+0x8/0x50 +[ 247.058060] Code: 4c 89 e0 5b 5d 41 5c 41 5d 41 5e c3 49 c7 c4 f4 +ff ff ff eb b2 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00 00 +41 54 55 <48> 8b 47 08 48 89 fd 48 85 c0 48 0f 44 c7 4c 8b 60 50 49 83 +c4 60 +[ 247.058060] RSP: 0018:ffffbbfa48a27e48 EFLAGS: 00010246 +[ 247.058060] RAX: 0000000000000001 RBX: ffffffff89e31f98 RCX: 0000000080200018 +[ 247.058060] RDX: 0000000080200019 RSI: fffff6760786c900 RDI: 0000000000000000 +[ 247.058060] RBP: ffffffff89e31f98 R08: ffff926b61b24d00 R09: 0000000080200018 +[ 247.122048] R10: ffff926b61b24d00 R11: ffff926a8040c000 R12: ffff927bd09a2000 +[ 247.122048] R13: ffffffff89e31fa0 R14: dead000000000122 R15: dead000000000100 +[ 247.122048] FS: 00007f01be0a8c40(0000) GS:ffff926fa8e40000(0000) +knlGS:0000000000000000 +[ 247.122048] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 247.122048] CR2: 0000000000000008 CR3: 00000001145c6003 CR4: 00000000007706e0 +[ 247.122048] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 247.122048] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 247.122048] PKRU: 55555554 +[ 247.122048] Call Trace: +[ 247.122048] +[ 247.122048] rdt_kill_sb+0x29d/0x350 +[ 247.122048] deactivate_locked_super+0x36/0xa0 +[ 247.122048] cleanup_mnt+0x131/0x190 +[ 247.122048] task_work_run+0x5c/0x90 +[ 247.122048] exit_to_user_mode_prepare+0x229/0x230 +[ 247.122048] syscall_exit_to_user_mode+0x18/0x40 +[ 247.122048] do_syscall_64+0x48/0x90 +[ 247.122048] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 247.122048] RIP: 0033:0x7f01be2d735b +``` + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215696 +Link: https://lore.kernel.org/lkml/CAE4VaGDZr_4wzRn2___eDYRtmdPaGGJdzu_LCSkJYuY9BEO3cw@mail.gmail.com/ +Fixes: 393c3714081a (kernfs: switch global kernfs_rwsem lock to per-fs lock) +Cc: stable@vger.kernel.org +Reported-by: Jirka Hladky +Tested-by: Jirka Hladky +Acked-by: Tejun Heo +Signed-off-by: Minchan Kim +Link: https://lore.kernel.org/r/20220427172152.3505364-1-minchan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/kernfs/dir.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -1397,7 +1397,12 @@ static void __kernfs_remove(struct kernf + */ + void kernfs_remove(struct kernfs_node *kn) + { +- struct kernfs_root *root = kernfs_root(kn); ++ struct kernfs_root *root; ++ ++ if (!kn) ++ return; ++ ++ root = kernfs_root(kn); + + down_write(&root->kernfs_rwsem); + __kernfs_remove(kn); diff --git a/queue-5.17/serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch b/queue-5.17/serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch new file mode 100644 index 00000000000..a3f840a38c4 --- /dev/null +++ b/queue-5.17/serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch @@ -0,0 +1,36 @@ +From 6e6eebdf5e2455f089ccd000754a0deaeb79af82 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Mon, 18 Apr 2022 16:27:10 +0100 +Subject: serial: 8250: Also set sticky MCR bits in console restoration + +From: Maciej W. Rozycki + +commit 6e6eebdf5e2455f089ccd000754a0deaeb79af82 upstream. + +Sticky MCR bits are lost in console restoration if console suspending +has been disabled. This currently affects the AFE bit, which works in +combination with RTS which we set, so we want to make sure the UART +retains control of its FIFO where previously requested. Also specific +drivers may need other bits in the future. + +Signed-off-by: Maciej W. Rozycki +Fixes: 4516d50aabed ("serial: 8250: Use canary to restart console after suspend") +Cc: stable@vger.kernel.org # v4.0+ +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181518490.9383@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_port.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -3340,7 +3340,7 @@ static void serial8250_console_restore(s + + serial8250_set_divisor(port, baud, quot, frac); + serial_port_out(port, UART_LCR, up->lcr); +- serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS); ++ serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); + } + + /* diff --git a/queue-5.17/serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch b/queue-5.17/serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch new file mode 100644 index 00000000000..41fd4a3ef8b --- /dev/null +++ b/queue-5.17/serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch @@ -0,0 +1,63 @@ +From 637674fa40059cddcc3ad2212728965072f62ea3 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Mon, 18 Apr 2022 16:27:16 +0100 +Subject: serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device + +From: Maciej W. Rozycki + +commit 637674fa40059cddcc3ad2212728965072f62ea3 upstream. + +The EndRun PTP/1588 dual serial port device is based on the Oxford +Semiconductor OXPCIe952 UART device with the PCI vendor:device ID set +for EndRun Technologies and is therefore driven by a fixed 62.5MHz clock +input derived from the 100MHz PCI Express clock. The clock rate is +divided by the oversampling rate of 16 as it is supplied to the baud +rate generator, yielding the baud base of 3906250. + +Replace the incorrect baud base of 4000000 with the right value of +3906250 then, complementing commit 6cbe45d8ac93 ("serial: 8250: Correct +the clock for OxSemi PCIe devices"). + +Signed-off-by: Maciej W. Rozycki +Cc: stable +Fixes: 1bc8cde46a159 ("8250_pci: Added driver for Endrun Technologies PTP PCIe card.") +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181515270.9383@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_pci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -2667,7 +2667,7 @@ enum pci_board_num_t { + pbn_panacom2, + pbn_panacom4, + pbn_plx_romulus, +- pbn_endrun_2_4000000, ++ pbn_endrun_2_3906250, + pbn_oxsemi, + pbn_oxsemi_1_3906250, + pbn_oxsemi_2_3906250, +@@ -3195,10 +3195,10 @@ static struct pciserial_board pci_boards + * signal now many ports are available + * 2 port 952 Uart support + */ +- [pbn_endrun_2_4000000] = { ++ [pbn_endrun_2_3906250] = { + .flags = FL_BASE0, + .num_ports = 2, +- .base_baud = 4000000, ++ .base_baud = 3906250, + .uart_offset = 0x200, + .first_offset = 0x1000, + }, +@@ -4115,7 +4115,7 @@ static const struct pci_device_id serial + */ + { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +- pbn_endrun_2_4000000 }, ++ pbn_endrun_2_3906250 }, + /* + * Quatech cards. These actually have configurable clocks but for + * now we just use the default. diff --git a/queue-5.17/serial-amba-pl011-do-not-time-out-prematurely-when-draining-tx-fifo.patch b/queue-5.17/serial-amba-pl011-do-not-time-out-prematurely-when-draining-tx-fifo.patch new file mode 100644 index 00000000000..1379c5eec35 --- /dev/null +++ b/queue-5.17/serial-amba-pl011-do-not-time-out-prematurely-when-draining-tx-fifo.patch @@ -0,0 +1,67 @@ +From 0e4deb56b0c625efdb70c94f150429e2f2a16fa1 Mon Sep 17 00:00:00 2001 +From: Lino Sanfilippo +Date: Sat, 9 Apr 2022 01:35:02 +0200 +Subject: serial: amba-pl011: do not time out prematurely when draining tx fifo + +From: Lino Sanfilippo + +commit 0e4deb56b0c625efdb70c94f150429e2f2a16fa1 upstream. + +The current timeout for draining the tx fifo in RS485 mode is calculated by +multiplying the time it takes to transmit one character (with the given +baud rate) with the maximal number of characters in the tx queue. + +This timeout is too short for two reasons: +First when calculating the time to transmit one character integer division +is used which may round down the result in case of a remainder of the +division. + +Fix this by rounding up the division result. + +Second the hardware may need additional time (e.g for first putting the +characters from the fifo into the shift register) before the characters are +actually put onto the wire. + +To be on the safe side double the current maximum number of iterations +that are used to wait for the queue draining. + +Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support") +Cc: stable@vger.kernel.org +Signed-off-by: Lino Sanfilippo +Link: https://lore.kernel.org/r/20220408233503.7251-1-LinoSanfilippo@gmx.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/amba-pl011.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -1255,13 +1255,18 @@ static inline bool pl011_dma_rx_running( + + static void pl011_rs485_tx_stop(struct uart_amba_port *uap) + { ++ /* ++ * To be on the safe side only time out after twice as many iterations ++ * as fifo size. ++ */ ++ const int MAX_TX_DRAIN_ITERS = uap->port.fifosize * 2; + struct uart_port *port = &uap->port; + int i = 0; + u32 cr; + + /* Wait until hardware tx queue is empty */ + while (!pl011_tx_empty(port)) { +- if (i == port->fifosize) { ++ if (i > MAX_TX_DRAIN_ITERS) { + dev_warn(port->dev, + "timeout while draining hardware tx queue\n"); + break; +@@ -2052,7 +2057,7 @@ pl011_set_termios(struct uart_port *port + * with the given baud rate. We use this as the poll interval when we + * wait for the tx queue to empty. + */ +- uap->rs485_tx_drain_interval = (bits * 1000 * 1000) / baud; ++ uap->rs485_tx_drain_interval = DIV_ROUND_UP(bits * 1000 * 1000, baud); + + pl011_setup_status_masks(port, termios); + diff --git a/queue-5.17/serial-imx-fix-overrun-interrupts-in-dma-mode.patch b/queue-5.17/serial-imx-fix-overrun-interrupts-in-dma-mode.patch new file mode 100644 index 00000000000..b196a3f81a9 --- /dev/null +++ b/queue-5.17/serial-imx-fix-overrun-interrupts-in-dma-mode.patch @@ -0,0 +1,45 @@ +From 3ee82c6e41f3d2212647ce0bc5a05a0f69097824 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 11 Apr 2022 10:19:57 +0200 +Subject: serial: imx: fix overrun interrupts in DMA mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johan Hovold + +commit 3ee82c6e41f3d2212647ce0bc5a05a0f69097824 upstream. + +Commit 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is +off") accidentally enabled overrun interrupts unconditionally when +deferring DMA enable until after the receiver has been enabled during +startup. + +Fix this by using the DMA-initialised instead of DMA-enabled flag to +determine whether overrun interrupts should be enabled. + +Note that overrun interrupts are already accounted for in +imx_uart_clear_rx_errors() when using DMA since commit 41d98b5da92f +("serial: imx-serial - update RX error counters when DMA is used"). + +Fixes: 76821e222c18 ("serial: imx: ensure that RX irqs are off if RX is off") +Cc: stable@vger.kernel.org # 4.17 +Cc: Uwe Kleine-König +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220411081957.7846-1-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1438,7 +1438,7 @@ static int imx_uart_startup(struct uart_ + imx_uart_writel(sport, ucr1, UCR1); + + ucr4 = imx_uart_readl(sport, UCR4) & ~(UCR4_OREN | UCR4_INVR); +- if (!sport->dma_is_enabled) ++ if (!dma_is_inited) + ucr4 |= UCR4_OREN; + if (sport->inverted_rx) + ucr4 |= UCR4_INVR; diff --git a/queue-5.17/series b/queue-5.17/series index 2a3d5bc28db..37f14a257ae 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -10,3 +10,32 @@ usb-xhci-tegra-fix-pm-usage-reference-leak-of-tegra_xusb_unpowergate_partitions. xhci-enable-runtime-pm-on-second-alderlake-controller.patch xhci-stop-polling-roothubs-after-shutdown.patch xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch +iio-dac-ad5592r-fix-the-missing-return-value.patch +iio-scd4x-check-return-of-scd4x_write_and_fetch.patch +iio-dac-ad5446-fix-read_raw-not-returning-set-value.patch +iio-magnetometer-ak8975-fix-the-error-handling-in-ak8975_power_on.patch +iio-imu-inv_icm42600-fix-i2c-init-possible-nack.patch +usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch +usb-core-don-t-hold-the-device-lock-while-sleeping-in-do_proc_control.patch +usb-typec-ucsi-fix-reuse-of-completion-structure.patch +usb-typec-ucsi-fix-role-swapping.patch +usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch +usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch +usb-dwc3-try-usb-role-switch-first-in-dwc3_drd_init.patch +usb-dwc3-core-fix-tx-rx-threshold-settings.patch +usb-dwc3-core-only-handle-soft-reset-in-dctl.patch +usb-dwc3-gadget-return-proper-request-status.patch +usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch +usb-cdns3-fix-issue-for-clear-halt-endpoint.patch +usb-phy-generic-get-the-vbus-supply.patch +kernfs-fix-null-dereferencing-in-kernfs_remove.patch +binder-gracefully-handle-binder_type_fda-objects-with-num_fds-0.patch +binder-address-corner-cases-in-deferred-copy-and-fixup.patch +serial-imx-fix-overrun-interrupts-in-dma-mode.patch +serial-amba-pl011-do-not-time-out-prematurely-when-draining-tx-fifo.patch +serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch +serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch +eeprom-at25-use-dma-safe-buffers.patch +arch_topology-do-not-set-llc_sibling-if-llc_id-is-invalid.patch +topology-make-core_mask-include-at-least-cluster_siblings.patch +ceph-fix-possible-null-pointer-dereference-for-req-r_session.patch diff --git a/queue-5.17/topology-make-core_mask-include-at-least-cluster_siblings.patch b/queue-5.17/topology-make-core_mask-include-at-least-cluster_siblings.patch new file mode 100644 index 00000000000..49d09029013 --- /dev/null +++ b/queue-5.17/topology-make-core_mask-include-at-least-cluster_siblings.patch @@ -0,0 +1,92 @@ +From db1e59483dfd8d4e956575302520bb8f7e20c79b Mon Sep 17 00:00:00 2001 +From: Darren Hart +Date: Mon, 11 Apr 2022 13:53:34 -0700 +Subject: topology: make core_mask include at least cluster_siblings + +From: Darren Hart + +commit db1e59483dfd8d4e956575302520bb8f7e20c79b upstream. + +Ampere Altra defines CPU clusters in the ACPI PPTT. They share a Snoop +Control Unit, but have no shared CPU-side last level cache. + +cpu_coregroup_mask() will return a cpumask with weight 1, while +cpu_clustergroup_mask() will return a cpumask with weight 2. + +As a result, build_sched_domain() will BUG() once per CPU with: + +BUG: arch topology borken +the CLS domain not a subset of the MC domain + +The MC level cpumask is then extended to that of the CLS child, and is +later removed entirely as redundant. This sched domain topology is an +improvement over previous topologies, or those built without +SCHED_CLUSTER, particularly for certain latency sensitive workloads. +With the current scheduler model and heuristics, this is a desirable +default topology for Ampere Altra and Altra Max system. + +Rather than create a custom sched domains topology structure and +introduce new logic in arch/arm64 to detect these systems, update the +core_mask so coregroup is never a subset of clustergroup, extending it +to cluster_siblings if necessary. Only do this if CONFIG_SCHED_CLUSTER +is enabled to avoid also changing the topology (MC) when +CONFIG_SCHED_CLUSTER is disabled. + +This has the added benefit over a custom topology of working for both +symmetric and asymmetric topologies. It does not address systems where +the CLUSTER topology is above a populated MC topology, but these are not +considered today and can be addressed separately if and when they +appear. + +The final sched domain topology for a 2 socket Ampere Altra system is +unchanged with or without CONFIG_SCHED_CLUSTER, and the BUG is avoided: + +For CPU0: + +CONFIG_SCHED_CLUSTER=y +CLS [0-1] +DIE [0-79] +NUMA [0-159] + +CONFIG_SCHED_CLUSTER is not set +DIE [0-79] +NUMA [0-159] + +Cc: Greg Kroah-Hartman +Cc: "Rafael J. Wysocki" +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Peter Zijlstra +Cc: Vincent Guittot +Cc: D. Scott Phillips +Cc: Ilkka Koskinen +Cc: # 5.16.x +Suggested-by: Barry Song +Reviewed-by: Barry Song +Reviewed-by: Dietmar Eggemann +Acked-by: Sudeep Holla +Signed-off-by: Darren Hart +Link: https://lore.kernel.org/r/c8fe9fce7c86ed56b4c455b8c902982dc2303868.1649696956.git.darren@os.amperecomputing.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/arch_topology.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/base/arch_topology.c ++++ b/drivers/base/arch_topology.c +@@ -628,6 +628,15 @@ const struct cpumask *cpu_coregroup_mask + core_mask = &cpu_topology[cpu].llc_sibling; + } + ++ /* ++ * For systems with no shared cpu-side LLC but with clusters defined, ++ * extend core_mask to cluster_siblings. The sched domain builder will ++ * then remove MC as redundant with CLS if SCHED_CLUSTER is enabled. ++ */ ++ if (IS_ENABLED(CONFIG_SCHED_CLUSTER) && ++ cpumask_subset(core_mask, &cpu_topology[cpu].cluster_sibling)) ++ core_mask = &cpu_topology[cpu].cluster_sibling; ++ + return core_mask; + } + diff --git a/queue-5.17/usb-cdns3-fix-issue-for-clear-halt-endpoint.patch b/queue-5.17/usb-cdns3-fix-issue-for-clear-halt-endpoint.patch new file mode 100644 index 00000000000..a3fdeb97b5b --- /dev/null +++ b/queue-5.17/usb-cdns3-fix-issue-for-clear-halt-endpoint.patch @@ -0,0 +1,57 @@ +From b3fa25de31fb7e9afebe9599b8ff32eda13d7c94 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Tue, 29 Mar 2022 10:46:05 +0200 +Subject: usb: cdns3: Fix issue for clear halt endpoint + +From: Pawel Laszczak + +commit b3fa25de31fb7e9afebe9599b8ff32eda13d7c94 upstream. + +Path fixes bug which occurs during resetting endpoint in +__cdns3_gadget_ep_clear_halt function. During resetting endpoint +controller will change HW/DMA owned TRB. It set Abort flag in +trb->control and will change trb->length field. If driver want +to use the aborted trb it must update the changed field in +TRB. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +cc: +Acked-by: Peter Chen +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20220329084605.4022-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -2684,6 +2684,7 @@ int __cdns3_gadget_ep_clear_halt(struct + struct usb_request *request; + struct cdns3_request *priv_req; + struct cdns3_trb *trb = NULL; ++ struct cdns3_trb trb_tmp; + int ret; + int val; + +@@ -2693,8 +2694,10 @@ int __cdns3_gadget_ep_clear_halt(struct + if (request) { + priv_req = to_cdns3_request(request); + trb = priv_req->trb; +- if (trb) ++ if (trb) { ++ trb_tmp = *trb; + trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE); ++ } + } + + writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd); +@@ -2709,7 +2712,7 @@ int __cdns3_gadget_ep_clear_halt(struct + + if (request) { + if (trb) +- trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE); ++ *trb = trb_tmp; + + cdns3_rearm_transfer(priv_ep, 1); + } diff --git a/queue-5.17/usb-core-don-t-hold-the-device-lock-while-sleeping-in-do_proc_control.patch b/queue-5.17/usb-core-don-t-hold-the-device-lock-while-sleeping-in-do_proc_control.patch new file mode 100644 index 00000000000..b6cf55bebc6 --- /dev/null +++ b/queue-5.17/usb-core-don-t-hold-the-device-lock-while-sleeping-in-do_proc_control.patch @@ -0,0 +1,76 @@ +From 0543e4e8852ef5ff1809ae62f1ea963e2ab23b66 Mon Sep 17 00:00:00 2001 +From: Tasos Sahanidis +Date: Fri, 1 Apr 2022 00:47:00 +0300 +Subject: usb: core: Don't hold the device lock while sleeping in do_proc_control() + +From: Tasos Sahanidis + +commit 0543e4e8852ef5ff1809ae62f1ea963e2ab23b66 upstream. + +Since commit ae8709b296d8 ("USB: core: Make do_proc_control() and +do_proc_bulk() killable") if a device has the USB_QUIRK_DELAY_CTRL_MSG +quirk set, it will temporarily block all other URBs (e.g. interrupts) +while sleeping due to a control. + +This results in noticeable delays when, for example, a userspace usbfs +application is sending URB interrupts at a high rate to a keyboard and +simultaneously updates the lock indicators using controls. Interrupts +with direction set to IN are also affected by this, meaning that +delivery of HID reports (containing scancodes) to the usbfs application +is delayed as well. + +This patch fixes the regression by calling msleep() while the device +mutex is unlocked, as was the case originally with usb_control_msg(). + +Fixes: ae8709b296d8 ("USB: core: Make do_proc_control() and do_proc_bulk() killable") +Cc: stable +Acked-by: Alan Stern +Signed-off-by: Tasos Sahanidis +Link: https://lore.kernel.org/r/3e299e2a-13b9-ddff-7fee-6845e868bc06@tasossah.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/devio.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1197,12 +1197,16 @@ static int do_proc_control(struct usb_de + + usb_unlock_device(dev); + i = usbfs_start_wait_urb(urb, tmo, &actlen); ++ ++ /* Linger a bit, prior to the next control message. */ ++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG) ++ msleep(200); + usb_lock_device(dev); + snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, tbuf, actlen); + if (!i && actlen) { + if (copy_to_user(ctrl->data, tbuf, actlen)) { + ret = -EFAULT; +- goto recv_fault; ++ goto done; + } + } + } else { +@@ -1219,6 +1223,10 @@ static int do_proc_control(struct usb_de + + usb_unlock_device(dev); + i = usbfs_start_wait_urb(urb, tmo, &actlen); ++ ++ /* Linger a bit, prior to the next control message. */ ++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG) ++ msleep(200); + usb_lock_device(dev); + snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, NULL, 0); + } +@@ -1230,10 +1238,6 @@ static int do_proc_control(struct usb_de + } + ret = (i < 0 ? i : actlen); + +- recv_fault: +- /* Linger a bit, prior to the next control message. */ +- if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG) +- msleep(200); + done: + kfree(dr); + usb_free_urb(urb); diff --git a/queue-5.17/usb-dwc3-core-fix-tx-rx-threshold-settings.patch b/queue-5.17/usb-dwc3-core-fix-tx-rx-threshold-settings.patch new file mode 100644 index 00000000000..ded85221be8 --- /dev/null +++ b/queue-5.17/usb-dwc3-core-fix-tx-rx-threshold-settings.patch @@ -0,0 +1,40 @@ +From f28ad9069363dec7deb88032b70612755eed9ee6 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 11 Apr 2022 18:33:47 -0700 +Subject: usb: dwc3: core: Fix tx/rx threshold settings + +From: Thinh Nguyen + +commit f28ad9069363dec7deb88032b70612755eed9ee6 upstream. + +The current driver logic checks against 0 to determine whether the +periodic tx/rx threshold settings are set, but we may get bogus values +from uninitialized variables if no device property is set. Properly +default these variables to 0. + +Fixes: 938a5ad1d305 ("usb: dwc3: Check for ESS TX/RX threshold config") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/cccfce990b11b730b0dae42f9d217dc6fb988c90.1649727139.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1295,10 +1295,10 @@ static void dwc3_get_properties(struct d + u8 lpm_nyet_threshold; + u8 tx_de_emphasis; + u8 hird_threshold; +- u8 rx_thr_num_pkt_prd; +- u8 rx_max_burst_prd; +- u8 tx_thr_num_pkt_prd; +- u8 tx_max_burst_prd; ++ u8 rx_thr_num_pkt_prd = 0; ++ u8 rx_max_burst_prd = 0; ++ u8 tx_thr_num_pkt_prd = 0; ++ u8 tx_max_burst_prd = 0; + u8 tx_fifo_resize_max_num; + const char *usb_psy_name; + int ret; diff --git a/queue-5.17/usb-dwc3-core-only-handle-soft-reset-in-dctl.patch b/queue-5.17/usb-dwc3-core-only-handle-soft-reset-in-dctl.patch new file mode 100644 index 00000000000..d8ad356c7bc --- /dev/null +++ b/queue-5.17/usb-dwc3-core-only-handle-soft-reset-in-dctl.patch @@ -0,0 +1,35 @@ +From f4fd84ae0765a80494b28c43b756a95100351a94 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 21 Apr 2022 19:33:56 -0700 +Subject: usb: dwc3: core: Only handle soft-reset in DCTL + +From: Thinh Nguyen + +commit f4fd84ae0765a80494b28c43b756a95100351a94 upstream. + +Make sure not to set run_stop bit or link state change request while +initiating soft-reset. Register read-modify-write operation may +unintentionally start the controller before the initialization completes +with its previous DCTL value, which can cause initialization failure. + +Fixes: f59dcab17629 ("usb: dwc3: core: improve reset sequence") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/6aecbd78328f102003d40ccf18ceeebd411d3703.1650594792.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -276,7 +276,8 @@ static int dwc3_core_soft_reset(struct d + + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + reg |= DWC3_DCTL_CSFTRST; +- dwc3_writel(dwc->regs, DWC3_DCTL, reg); ++ reg &= ~DWC3_DCTL_RUN_STOP; ++ dwc3_gadget_dctl_write_safe(dwc, reg); + + /* + * For DWC_usb31 controller 1.90a and later, the DCTL.CSFRST bit diff --git a/queue-5.17/usb-dwc3-gadget-return-proper-request-status.patch b/queue-5.17/usb-dwc3-gadget-return-proper-request-status.patch new file mode 100644 index 00000000000..33dfa9194cb --- /dev/null +++ b/queue-5.17/usb-dwc3-gadget-return-proper-request-status.patch @@ -0,0 +1,74 @@ +From c7428dbddcf4ea1919e1c8e15f715b94ca359268 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Fri, 22 Apr 2022 17:36:28 -0700 +Subject: usb: dwc3: gadget: Return proper request status + +From: Thinh Nguyen + +commit c7428dbddcf4ea1919e1c8e15f715b94ca359268 upstream. + +If the user sets the usb_request's no_interrupt, then there will be no +completion event for the request. Currently the driver incorrectly uses +the event status of a different request to report the status for a +request with no_interrupt. The dwc3 driver needs to check the TRB status +associated with the request when reporting its status. + +Note: this is only applicable to missed_isoc TRB completion status, but +the other status are also listed for completeness/documentation. + +Fixes: 6d8a019614f3 ("usb: dwc3: gadget: check for Missed Isoc from event status") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/db2c80108286cfd108adb05bad52138b78d7c3a7.1650673655.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 31 ++++++++++++++++++++++++++++++- + 1 file changed, 30 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3229,6 +3229,7 @@ static int dwc3_gadget_ep_cleanup_comple + const struct dwc3_event_depevt *event, + struct dwc3_request *req, int status) + { ++ int request_status; + int ret; + + if (req->request.num_mapped_sgs) +@@ -3249,7 +3250,35 @@ static int dwc3_gadget_ep_cleanup_comple + req->needs_extra_trb = false; + } + +- dwc3_gadget_giveback(dep, req, status); ++ /* ++ * The event status only reflects the status of the TRB with IOC set. ++ * For the requests that don't set interrupt on completion, the driver ++ * needs to check and return the status of the completed TRBs associated ++ * with the request. Use the status of the last TRB of the request. ++ */ ++ if (req->request.no_interrupt) { ++ struct dwc3_trb *trb; ++ ++ trb = dwc3_ep_prev_trb(dep, dep->trb_dequeue); ++ switch (DWC3_TRB_SIZE_TRBSTS(trb->size)) { ++ case DWC3_TRBSTS_MISSED_ISOC: ++ /* Isoc endpoint only */ ++ request_status = -EXDEV; ++ break; ++ case DWC3_TRB_STS_XFER_IN_PROG: ++ /* Applicable when End Transfer with ForceRM=0 */ ++ case DWC3_TRBSTS_SETUP_PENDING: ++ /* Control endpoint only */ ++ case DWC3_TRBSTS_OK: ++ default: ++ request_status = 0; ++ break; ++ } ++ } else { ++ request_status = status; ++ } ++ ++ dwc3_gadget_giveback(dep, req, request_status); + + out: + return ret; diff --git a/queue-5.17/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch b/queue-5.17/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch new file mode 100644 index 00000000000..29f93c8b3c9 --- /dev/null +++ b/queue-5.17/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch @@ -0,0 +1,44 @@ +From 973e0f7a847ef13ade840d4c30729ce329a66895 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Mon, 25 Apr 2022 13:35:18 +0300 +Subject: usb: dwc3: pci: add support for the Intel Meteor Lake-P + +From: Heikki Krogerus + +commit 973e0f7a847ef13ade840d4c30729ce329a66895 upstream. + +This patch adds the necessary PCI IDs for Intel Meteor Lake-P +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable +Link: https://lore.kernel.org/r/20220425103518.44028-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -44,6 +44,8 @@ + #define PCI_DEVICE_ID_INTEL_ADLM 0x54ee + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 ++#define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 ++#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 + #define PCI_DEVICE_ID_AMD_MR 0x163a + +@@ -421,6 +423,12 @@ static const struct pci_device_id dwc3_p + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + diff --git a/queue-5.17/usb-dwc3-try-usb-role-switch-first-in-dwc3_drd_init.patch b/queue-5.17/usb-dwc3-try-usb-role-switch-first-in-dwc3_drd_init.patch new file mode 100644 index 00000000000..afe3ee7e603 --- /dev/null +++ b/queue-5.17/usb-dwc3-try-usb-role-switch-first-in-dwc3_drd_init.patch @@ -0,0 +1,55 @@ +From ab7aa2866d295438dc60522f85c5421c6b4f1507 Mon Sep 17 00:00:00 2001 +From: Sven Peter +Date: Mon, 11 Apr 2022 17:53:00 +0200 +Subject: usb: dwc3: Try usb-role-switch first in dwc3_drd_init + +From: Sven Peter + +commit ab7aa2866d295438dc60522f85c5421c6b4f1507 upstream. + +If the PHY controller node has a "port" dwc3 tries to find an +extcon device even when "usb-role-switch" is present. This happens +because dwc3_get_extcon() sees that "port" node and then calls +extcon_find_edev_by_node() which will always return EPROBE_DEFER +in that case. + +On the other hand, even if an extcon was present and dwc3_get_extcon() +was successful it would still be ignored in favor of "usb-role-switch". + +Let's just first check if "usb-role-switch" is configured in the device +tree and directly use it instead and only try to look for an extcon +device otherwise. + +Fixes: 8a0a13799744 ("usb: dwc3: Registering a role switch in the DRD code.") +Cc: stable +Signed-off-by: Sven Peter +Link: https://lore.kernel.org/r/20220411155300.9766-1-sven@svenpeter.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/drd.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/usb/dwc3/drd.c ++++ b/drivers/usb/dwc3/drd.c +@@ -571,16 +571,15 @@ int dwc3_drd_init(struct dwc3 *dwc) + { + int ret, irq; + ++ if (ROLE_SWITCH && ++ device_property_read_bool(dwc->dev, "usb-role-switch")) ++ return dwc3_setup_role_switch(dwc); ++ + dwc->edev = dwc3_get_extcon(dwc); + if (IS_ERR(dwc->edev)) + return PTR_ERR(dwc->edev); + +- if (ROLE_SWITCH && +- device_property_read_bool(dwc->dev, "usb-role-switch")) { +- ret = dwc3_setup_role_switch(dwc); +- if (ret < 0) +- return ret; +- } else if (dwc->edev) { ++ if (dwc->edev) { + dwc->edev_nb.notifier_call = dwc3_drd_notifier; + ret = extcon_register_notifier(dwc->edev, EXTCON_USB_HOST, + &dwc->edev_nb); diff --git a/queue-5.17/usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch b/queue-5.17/usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch new file mode 100644 index 00000000000..18952a296d4 --- /dev/null +++ b/queue-5.17/usb-gadget-configfs-clear-deactivation-flag-in-configfs_composite_unbind.patch @@ -0,0 +1,37 @@ +From bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 Mon Sep 17 00:00:00 2001 +From: Vijayavardhan Vennapusa +Date: Wed, 13 Apr 2022 16:10:38 -0500 +Subject: usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() + +From: Vijayavardhan Vennapusa + +commit bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 upstream. + +If any function like UVC is deactivating gadget as part of composition +switch which results in not calling pullup enablement, it is not getting +enabled after switch to new composition due to this deactivation flag +not cleared. This results in USB enumeration not happening after switch +to new USB composition. Hence clear deactivation flag inside gadget +structure in configfs_composite_unbind() before switch to new USB +composition. + +Signed-off-by: Vijayavardhan Vennapusa +Signed-off-by: Dan Vacura +Cc: stable +Link: https://lore.kernel.org/r/20220413211038.72797-1-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1434,6 +1434,8 @@ static void configfs_composite_unbind(st + usb_ep_autoconfig_reset(cdev->gadget); + spin_lock_irqsave(&gi->spinlock, flags); + cdev->gadget = NULL; ++ cdev->deactivations = 0; ++ gadget->deactivated = false; + set_gadget_data(gadget, NULL); + spin_unlock_irqrestore(&gi->spinlock, flags); + } diff --git a/queue-5.17/usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch b/queue-5.17/usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch new file mode 100644 index 00000000000..8ccb7196f7a --- /dev/null +++ b/queue-5.17/usb-gadget-uvc-fix-crash-when-encoding-data-for-usb-request.patch @@ -0,0 +1,63 @@ +From 71d471e3faf90c9674cadc7605ac719e82cb7fac Mon Sep 17 00:00:00 2001 +From: Dan Vacura +Date: Thu, 31 Mar 2022 13:40:23 -0500 +Subject: usb: gadget: uvc: Fix crash when encoding data for usb request + +From: Dan Vacura + +commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream. + +During the uvcg_video_pump() process, if an error occurs and +uvcg_queue_cancel() is called, the buffer queue will be cleared out, but +the current marker (queue->buf_used) of the active buffer (no longer +active) is not reset. On the next iteration of uvcg_video_pump() the +stale buf_used count will be used and the logic of min((unsigned +int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a +nbytes size, causing an invalid memory access. + +[80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed +with status -18. +[80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed +with status -18. +... +uvcg_queue_cancel() is called and the queue is cleared out, but the +marker queue->buf_used is not reset. +... +[80802.262328][ T8682] Unable to handle kernel paging request at virtual +address ffffffc03af9f000 +... +... +[80802.263138][ T8682] Call trace: +[80802.263146][ T8682] __memcpy+0x12c/0x180 +[80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 +[80802.263165][ T8682] process_one_work+0x2cc/0x568 +[80802.263173][ T8682] worker_thread+0x28c/0x518 +[80802.263181][ T8682] kthread+0x160/0x170 +[80802.263188][ T8682] ret_from_fork+0x10/0x18 +[80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 + +Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework") +Cc: +Signed-off-by: Dan Vacura +Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_queue.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c +index d852ac9e47e7..2cda982f3765 100644 +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -264,6 +264,8 @@ void uvcg_queue_cancel(struct uvc_video_queue *queue, int disconnect) + buf->state = UVC_BUF_STATE_ERROR; + vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); + } ++ queue->buf_used = 0; ++ + /* This must be protected by the irqlock spinlock to avoid race + * conditions between uvc_queue_buffer and the disconnection event that + * could result in an interruptible wait in uvc_dequeue_buffer. Do not +-- +2.36.0 + diff --git a/queue-5.17/usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch b/queue-5.17/usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch new file mode 100644 index 00000000000..814706ffbde --- /dev/null +++ b/queue-5.17/usb-misc-fix-improper-handling-of-refcount-in-uss720_probe.patch @@ -0,0 +1,52 @@ +From 0a96fa640dc928da9eaa46a22c46521b037b78ad Mon Sep 17 00:00:00 2001 +From: Hangyu Hua +Date: Thu, 7 Apr 2022 10:40:01 +0800 +Subject: usb: misc: fix improper handling of refcount in uss720_probe() + +From: Hangyu Hua + +commit 0a96fa640dc928da9eaa46a22c46521b037b78ad upstream. + +usb_put_dev shouldn't be called when uss720_probe succeeds because of +priv->usbdev. At the same time, priv->usbdev shouldn't be set to NULL +before destroy_priv in uss720_disconnect because usb_put_dev is in +destroy_priv. + +Fix this by moving priv->usbdev = NULL after usb_put_dev. + +Fixes: dcb4b8ad6a44 ("misc/uss720: fix memory leak in uss720_probe") +Cc: stable +Reviewed-by: Dongliang Mu +Signed-off-by: Hangyu Hua +Link: https://lore.kernel.org/r/20220407024001.11761-1-hbh25y@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/uss720.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -71,6 +71,7 @@ static void destroy_priv(struct kref *kr + + dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n"); + usb_put_dev(priv->usbdev); ++ priv->usbdev = NULL; + kfree(priv); + } + +@@ -736,7 +737,6 @@ static int uss720_probe(struct usb_inter + parport_announce_port(pp); + + usb_set_intfdata(intf, pp); +- usb_put_dev(usbdev); + return 0; + + probe_abort: +@@ -754,7 +754,6 @@ static void uss720_disconnect(struct usb + usb_set_intfdata(intf, NULL); + if (pp) { + priv = pp->private_data; +- priv->usbdev = NULL; + priv->pp = NULL; + dev_dbg(&intf->dev, "parport_remove_port\n"); + parport_remove_port(pp); diff --git a/queue-5.17/usb-phy-generic-get-the-vbus-supply.patch b/queue-5.17/usb-phy-generic-get-the-vbus-supply.patch new file mode 100644 index 00000000000..217e5e63ab4 --- /dev/null +++ b/queue-5.17/usb-phy-generic-get-the-vbus-supply.patch @@ -0,0 +1,38 @@ +From 03e607cbb2931374db1825f371e9c7f28526d3f4 Mon Sep 17 00:00:00 2001 +From: Sean Anderson +Date: Mon, 25 Apr 2022 13:14:09 -0400 +Subject: usb: phy: generic: Get the vbus supply + +From: Sean Anderson + +commit 03e607cbb2931374db1825f371e9c7f28526d3f4 upstream. + +While support for working with a vbus was added, the regulator was never +actually gotten (despite what was documented). Fix this by actually +getting the supply from the device tree. + +Fixes: 7acc9973e3c4 ("usb: phy: generic: add vbus support") +Cc: stable +Signed-off-by: Sean Anderson +Link: https://lore.kernel.org/r/20220425171412.1188485-3-sean.anderson@seco.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/phy/phy-generic.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/phy/phy-generic.c ++++ b/drivers/usb/phy/phy-generic.c +@@ -268,6 +268,13 @@ int usb_phy_gen_create_phy(struct device + return -EPROBE_DEFER; + } + ++ nop->vbus_draw = devm_regulator_get_exclusive(dev, "vbus"); ++ if (PTR_ERR(nop->vbus_draw) == -ENODEV) ++ nop->vbus_draw = NULL; ++ if (IS_ERR(nop->vbus_draw)) ++ return dev_err_probe(dev, PTR_ERR(nop->vbus_draw), ++ "could not get vbus regulator\n"); ++ + nop->dev = dev; + nop->phy.dev = nop->dev; + nop->phy.label = "nop-xceiv"; diff --git a/queue-5.17/usb-typec-ucsi-fix-reuse-of-completion-structure.patch b/queue-5.17/usb-typec-ucsi-fix-reuse-of-completion-structure.patch new file mode 100644 index 00000000000..896fb82a214 --- /dev/null +++ b/queue-5.17/usb-typec-ucsi-fix-reuse-of-completion-structure.patch @@ -0,0 +1,45 @@ +From e25adcca917d7e4cdc1dc6444d0692ffda7594bf Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Tue, 5 Apr 2022 16:48:23 +0300 +Subject: usb: typec: ucsi: Fix reuse of completion structure + +From: Heikki Krogerus + +commit e25adcca917d7e4cdc1dc6444d0692ffda7594bf upstream. + +The role swapping completion variable is reused, so it needs +to be reinitialised every time. Otherwise it will be marked +as done after the first time it's used and completing +immediately. + +Link: https://lore.kernel.org/linux-usb/20220325203959.GA19752@jackp-linux.qualcomm.com/ +Fixes: 6df475f804e6 ("usb: typec: ucsi: Start using struct typec_operations") +Cc: stable@vger.kernel.org +Reported-and-suggested-by: Jack Pham +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20220405134824.68067-2-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -949,6 +949,8 @@ static int ucsi_dr_swap(struct typec_por + role == TYPEC_HOST)) + goto out_unlock; + ++ reinit_completion(&con->complete); ++ + command = UCSI_SET_UOR | UCSI_CONNECTOR_NUMBER(con->num); + command |= UCSI_SET_UOR_ROLE(role); + command |= UCSI_SET_UOR_ACCEPT_ROLE_SWAPS; +@@ -985,6 +987,8 @@ static int ucsi_pr_swap(struct typec_por + if (cur_role == role) + goto out_unlock; + ++ reinit_completion(&con->complete); ++ + command = UCSI_SET_PDR | UCSI_CONNECTOR_NUMBER(con->num); + command |= UCSI_SET_PDR_ROLE(role); + command |= UCSI_SET_PDR_ACCEPT_ROLE_SWAPS; diff --git a/queue-5.17/usb-typec-ucsi-fix-role-swapping.patch b/queue-5.17/usb-typec-ucsi-fix-role-swapping.patch new file mode 100644 index 00000000000..5af361e9f0f --- /dev/null +++ b/queue-5.17/usb-typec-ucsi-fix-role-swapping.patch @@ -0,0 +1,67 @@ +From eb5d7ff3cf0d55093c619b5ad107cd5c05ce8134 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Tue, 5 Apr 2022 16:48:24 +0300 +Subject: usb: typec: ucsi: Fix role swapping + +From: Heikki Krogerus + +commit eb5d7ff3cf0d55093c619b5ad107cd5c05ce8134 upstream. + +All attempts to swap the roles timed out because the +completion was done without releasing the port lock. Fixing +that by releasing the lock before starting to wait for the +completion. + +Link: https://lore.kernel.org/linux-usb/037de7ac-e210-bdf5-ec7a-8c0c88a0be20@gmail.com/ +Fixes: ad74b8649bea ("usb: typec: ucsi: Preliminary support for alternate modes") +Cc: stable@vger.kernel.org +Reported-and-tested-by: Jia-Ju Bai +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20220405134824.68067-3-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -958,14 +958,18 @@ static int ucsi_dr_swap(struct typec_por + if (ret < 0) + goto out_unlock; + ++ mutex_unlock(&con->lock); ++ + if (!wait_for_completion_timeout(&con->complete, +- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) +- ret = -ETIMEDOUT; ++ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) ++ return -ETIMEDOUT; ++ ++ return 0; + + out_unlock: + mutex_unlock(&con->lock); + +- return ret < 0 ? ret : 0; ++ return ret; + } + + static int ucsi_pr_swap(struct typec_port *port, enum typec_role role) +@@ -996,11 +1000,13 @@ static int ucsi_pr_swap(struct typec_por + if (ret < 0) + goto out_unlock; + ++ mutex_unlock(&con->lock); ++ + if (!wait_for_completion_timeout(&con->complete, +- msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) { +- ret = -ETIMEDOUT; +- goto out_unlock; +- } ++ msecs_to_jiffies(UCSI_SWAP_TIMEOUT_MS))) ++ return -ETIMEDOUT; ++ ++ mutex_lock(&con->lock); + + /* Something has gone wrong while swapping the role */ + if (UCSI_CONSTAT_PWR_OPMODE(con->status.flags) !=