From: Sasha Levin Date: Sat, 14 Jan 2023 14:23:24 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v4.14.303~63^2~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ecf58cd67a311bf3027b9dec92e8a128e84a6e9e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/bus-mhi-host-fix-race-between-channel-preparation-an.patch b/queue-5.15/bus-mhi-host-fix-race-between-channel-preparation-an.patch new file mode 100644 index 00000000000..1552bd82ab7 --- /dev/null +++ b/queue-5.15/bus-mhi-host-fix-race-between-channel-preparation-an.patch @@ -0,0 +1,46 @@ +From f205565c00e0f98575316526fee320307ab0460e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Oct 2022 11:05:32 +0800 +Subject: bus: mhi: host: Fix race between channel preparation and M0 event + +From: Qiang Yu + +[ Upstream commit 869a99907faea6d1835b0bd0d0422ae3519c6ea9 ] + +There is a race condition where mhi_prepare_channel() updates the +read and write pointers as the base address and in parallel, if +an M0 transition occurs, the tasklet goes ahead and rings +doorbells for all channels with a delta in TRE rings assuming +they are already enabled. This causes a null pointer access. Fix +it by adding a channel enabled check before ringing channel +doorbells. + +Cc: stable@vger.kernel.org # 5.19 +Fixes: a6e2e3522f29 "bus: mhi: core: Add support for PM state transitions" +Signed-off-by: Qiang Yu +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/1665889532-13634-1-git-send-email-quic_qianyu@quicinc.com +[mani: CCed stable list] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/bus/mhi/core/pm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c +index 1020268a075a..1a87b9c6c2f8 100644 +--- a/drivers/bus/mhi/core/pm.c ++++ b/drivers/bus/mhi/core/pm.c +@@ -297,7 +297,8 @@ int mhi_pm_m0_transition(struct mhi_controller *mhi_cntrl) + read_lock_irq(&mhi_chan->lock); + + /* Only ring DB if ring is not empty */ +- if (tre_ring->base && tre_ring->wp != tre_ring->rp) ++ if (tre_ring->base && tre_ring->wp != tre_ring->rp && ++ mhi_chan->ch_state == MHI_CH_STATE_ENABLED) + mhi_ring_chan_db(mhi_cntrl, mhi_chan); + read_unlock_irq(&mhi_chan->lock); + } +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index b0af4542ee1..5be475b62a9 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -16,3 +16,5 @@ s390-percpu-add-read_once-to-arch_this_cpu_to_op_simple.patch drm-virtio-fix-gem-handle-creation-uaf.patch drm-i915-gt-reset-twice.patch net-mlx5e-set-action-fwd-flag-when-parsing-tc-action-goto.patch +bus-mhi-host-fix-race-between-channel-preparation-an.patch +usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch diff --git a/queue-5.15/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch b/queue-5.15/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch new file mode 100644 index 00000000000..9da88d9e7f5 --- /dev/null +++ b/queue-5.15/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch @@ -0,0 +1,49 @@ +From d5f0e8cc3ddf92375db10b698e690fb7adcf24ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 21:15:26 +0100 +Subject: usb: ulpi: defer ulpi_register on ulpi_read_id timeout + +From: Ferry Toth + +[ Upstream commit 8a7b31d545d3a15f0e6f5984ae16f0ca4fd76aac ] + +Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral +if extcon is present") Dual Role support on Intel Merrifield platform +broke due to rearranging the call to dwc3_get_extcon(). + +It appears to be caused by ulpi_read_id() on the first test write failing +with -ETIMEDOUT. Currently ulpi_read_id() expects to discover the phy via +DT when the test write fails and returns 0 in that case, even if DT does not +provide the phy. As a result usb probe completes without phy. + +Make ulpi_read_id() return -ETIMEDOUT to its user if the first test write +fails. The user should then handle it appropriately. A follow up patch +will make dwc3_core_init() set -EPROBE_DEFER in this case and bail out. + +Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") +Cc: stable@vger.kernel.org +Acked-by: Heikki Krogerus +Signed-off-by: Ferry Toth +Link: https://lore.kernel.org/r/20221205201527.13525-2-ftoth@exalondelft.nl +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/common/ulpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c +index 5509d3847af4..0e462933d270 100644 +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -206,7 +206,7 @@ static int ulpi_read_id(struct ulpi *ulpi) + /* Test the interface */ + ret = ulpi_write(ulpi, ULPI_SCRATCH, 0xaa); + if (ret < 0) +- goto err; ++ return ret; + + ret = ulpi_read(ulpi, ULPI_SCRATCH); + if (ret < 0) +-- +2.35.1 +