From 77dcbb4454a627fcadf18677233d4d1fe84bac4f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 30 Nov 2023 14:55:20 +0000 Subject: [PATCH] 6.6-stable patches added patches: bcache-check-return-value-from-btree_node_alloc_replacement.patch bcache-fixup-init-dirty-data-errors.patch bcache-fixup-lock-c-root-error.patch bcache-prevent-potential-division-by-zero-error.patch usb-cdnsp-fix-deadlock-issue-during-using-ncm-gadget.patch usb-config-fix-iteration-issue-in-usb_get_bos_descriptor.patch usb-dwc2-write-hcint-with-intmask-applied.patch usb-dwc3-fix-default-mode-initialization.patch usb-dwc3-qcom-fix-software-node-leak-on-probe-errors.patch usb-dwc3-qcom-fix-wakeup-after-probe-deferral.patch usb-dwc3-set-the-dma-max_seg_size.patch usb-serial-option-add-fibocom-l7xx-modules.patch usb-serial-option-don-t-claim-interface-4-for-zte-mf290.patch usb-serial-option-fix-fm101r-gl-defines.patch usb-typec-tcpm-fix-sink-caps-op-current-check.patch usb-typec-tcpm-skip-hard-reset-when-in-error-recovery.patch usb-xhci-plat-fix-legacy-phy-double-init.patch --- ...ue-from-btree_node_alloc_replacement.patch | 36 ++++ .../bcache-fixup-init-dirty-data-errors.patch | 44 +++++ .../bcache-fixup-lock-c-root-error.patch | 180 ++++++++++++++++++ ...ent-potential-division-by-zero-error.patch | 53 ++++++ queue-6.6/series | 17 ++ ...adlock-issue-during-using-ncm-gadget.patch | 67 +++++++ ...tion-issue-in-usb_get_bos_descriptor.patch | 51 +++++ ...wc2-write-hcint-with-intmask-applied.patch | 80 ++++++++ ...dwc3-fix-default-mode-initialization.patch | 41 ++++ ...x-software-node-leak-on-probe-errors.patch | 60 ++++++ ...qcom-fix-wakeup-after-probe-deferral.patch | 70 +++++++ .../usb-dwc3-set-the-dma-max_seg_size.patch | 36 ++++ ...rial-option-add-fibocom-l7xx-modules.patch | 106 +++++++++++ ...on-t-claim-interface-4-for-zte-mf290.patch | 65 +++++++ ...-serial-option-fix-fm101r-gl-defines.patch | 46 +++++ ...-tcpm-fix-sink-caps-op-current-check.patch | 63 ++++++ ...ip-hard-reset-when-in-error-recovery.patch | 57 ++++++ ...xhci-plat-fix-legacy-phy-double-init.patch | 121 ++++++++++++ 18 files changed, 1193 insertions(+) create mode 100644 queue-6.6/bcache-check-return-value-from-btree_node_alloc_replacement.patch create mode 100644 queue-6.6/bcache-fixup-init-dirty-data-errors.patch create mode 100644 queue-6.6/bcache-fixup-lock-c-root-error.patch create mode 100644 queue-6.6/bcache-prevent-potential-division-by-zero-error.patch create mode 100644 queue-6.6/usb-cdnsp-fix-deadlock-issue-during-using-ncm-gadget.patch create mode 100644 queue-6.6/usb-config-fix-iteration-issue-in-usb_get_bos_descriptor.patch create mode 100644 queue-6.6/usb-dwc2-write-hcint-with-intmask-applied.patch create mode 100644 queue-6.6/usb-dwc3-fix-default-mode-initialization.patch create mode 100644 queue-6.6/usb-dwc3-qcom-fix-software-node-leak-on-probe-errors.patch create mode 100644 queue-6.6/usb-dwc3-qcom-fix-wakeup-after-probe-deferral.patch create mode 100644 queue-6.6/usb-dwc3-set-the-dma-max_seg_size.patch create mode 100644 queue-6.6/usb-serial-option-add-fibocom-l7xx-modules.patch create mode 100644 queue-6.6/usb-serial-option-don-t-claim-interface-4-for-zte-mf290.patch create mode 100644 queue-6.6/usb-serial-option-fix-fm101r-gl-defines.patch create mode 100644 queue-6.6/usb-typec-tcpm-fix-sink-caps-op-current-check.patch create mode 100644 queue-6.6/usb-typec-tcpm-skip-hard-reset-when-in-error-recovery.patch create mode 100644 queue-6.6/usb-xhci-plat-fix-legacy-phy-double-init.patch diff --git a/queue-6.6/bcache-check-return-value-from-btree_node_alloc_replacement.patch b/queue-6.6/bcache-check-return-value-from-btree_node_alloc_replacement.patch new file mode 100644 index 00000000000..004f1689af6 --- /dev/null +++ b/queue-6.6/bcache-check-return-value-from-btree_node_alloc_replacement.patch @@ -0,0 +1,36 @@ +From 777967e7e9f6f5f3e153abffb562bffaf4430d26 Mon Sep 17 00:00:00 2001 +From: Coly Li +Date: Mon, 20 Nov 2023 13:24:55 +0800 +Subject: bcache: check return value from btree_node_alloc_replacement() + +From: Coly Li + +commit 777967e7e9f6f5f3e153abffb562bffaf4430d26 upstream. + +In btree_gc_rewrite_node(), pointer 'n' is not checked after it returns +from btree_gc_rewrite_node(). There is potential possibility that 'n' is +a non NULL ERR_PTR(), referencing such error code is not permitted in +following code. Therefore a return value checking is necessary after 'n' +is back from btree_node_alloc_replacement(). + +Signed-off-by: Coly Li +Reported-by: Dan Carpenter +Cc: +Link: https://lore.kernel.org/r/20231120052503.6122-3-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/btree.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -1527,6 +1527,8 @@ static int btree_gc_rewrite_node(struct + return 0; + + n = btree_node_alloc_replacement(replace, NULL); ++ if (IS_ERR(n)) ++ return 0; + + /* recheck reserve after allocating replacement node */ + if (btree_check_reserve(b, NULL)) { diff --git a/queue-6.6/bcache-fixup-init-dirty-data-errors.patch b/queue-6.6/bcache-fixup-init-dirty-data-errors.patch new file mode 100644 index 00000000000..64aaaf530c2 --- /dev/null +++ b/queue-6.6/bcache-fixup-init-dirty-data-errors.patch @@ -0,0 +1,44 @@ +From 7cc47e64d3d69786a2711a4767e26b26ba63d7ed Mon Sep 17 00:00:00 2001 +From: Mingzhe Zou +Date: Mon, 20 Nov 2023 13:24:58 +0800 +Subject: bcache: fixup init dirty data errors + +From: Mingzhe Zou + +commit 7cc47e64d3d69786a2711a4767e26b26ba63d7ed upstream. + +We found that after long run, the dirty_data of the bcache device +will have errors. This error cannot be eliminated unless re-register. + +We also found that reattach after detach, this error can accumulate. + +In bch_sectors_dirty_init(), all inode <= d->id keys will be recounted +again. This is wrong, we only need to count the keys of the current +device. + +Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") +Signed-off-by: Mingzhe Zou +Cc: +Signed-off-by: Coly Li +Link: https://lore.kernel.org/r/20231120052503.6122-6-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/writeback.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -991,8 +991,11 @@ void bch_sectors_dirty_init(struct bcach + op.count = 0; + + for_each_key_filter(&c->root->keys, +- k, &iter, bch_ptr_invalid) ++ k, &iter, bch_ptr_invalid) { ++ if (KEY_INODE(k) != op.inode) ++ continue; + sectors_dirty_init_fn(&op.op, c->root, k); ++ } + + rw_unlock(0, c->root); + return; diff --git a/queue-6.6/bcache-fixup-lock-c-root-error.patch b/queue-6.6/bcache-fixup-lock-c-root-error.patch new file mode 100644 index 00000000000..3376b3b999e --- /dev/null +++ b/queue-6.6/bcache-fixup-lock-c-root-error.patch @@ -0,0 +1,180 @@ +From e34820f984512b433ee1fc291417e60c47d56727 Mon Sep 17 00:00:00 2001 +From: Mingzhe Zou +Date: Mon, 20 Nov 2023 13:24:59 +0800 +Subject: bcache: fixup lock c->root error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingzhe Zou + +commit e34820f984512b433ee1fc291417e60c47d56727 upstream. + +We had a problem with io hung because it was waiting for c->root to +release the lock. + +crash> cache_set.root -l cache_set.list ffffa03fde4c0050 + root = 0xffff802ef454c800 +crash> btree -o 0xffff802ef454c800 | grep rw_semaphore + [ffff802ef454c858] struct rw_semaphore lock; +crash> struct rw_semaphore ffff802ef454c858 +struct rw_semaphore { + count = { + counter = -4294967297 + }, + wait_list = { + next = 0xffff00006786fc28, + prev = 0xffff00005d0efac8 + }, + wait_lock = { + raw_lock = { + { + val = { + counter = 0 + }, + { + locked = 0 '\000', + pending = 0 '\000' + }, + { + locked_pending = 0, + tail = 0 + } + } + } + }, + osq = { + tail = { + counter = 0 + } + }, + owner = 0xffffa03fdc586603 +} + +The "counter = -4294967297" means that lock count is -1 and a write lock +is being attempted. Then, we found that there is a btree with a counter +of 1 in btree_cache_freeable. + +crash> cache_set -l cache_set.list ffffa03fde4c0050 -o|grep btree_cache + [ffffa03fde4c1140] struct list_head btree_cache; + [ffffa03fde4c1150] struct list_head btree_cache_freeable; + [ffffa03fde4c1160] struct list_head btree_cache_freed; + [ffffa03fde4c1170] unsigned int btree_cache_used; + [ffffa03fde4c1178] wait_queue_head_t btree_cache_wait; + [ffffa03fde4c1190] struct task_struct *btree_cache_alloc_lock; +crash> list -H ffffa03fde4c1140|wc -l +973 +crash> list -H ffffa03fde4c1150|wc -l +1123 +crash> cache_set.btree_cache_used -l cache_set.list ffffa03fde4c0050 + btree_cache_used = 2097 +crash> list -s btree -l btree.list -H ffffa03fde4c1140|grep -E -A2 "^ lock = {" > btree_cache.txt +crash> list -s btree -l btree.list -H ffffa03fde4c1150|grep -E -A2 "^ lock = {" > btree_cache_freeable.txt +[root@node-3 127.0.0.1-2023-08-04-16:40:28]# pwd +/var/crash/127.0.0.1-2023-08-04-16:40:28 +[root@node-3 127.0.0.1-2023-08-04-16:40:28]# cat btree_cache.txt|grep counter|grep -v "counter = 0" +[root@node-3 127.0.0.1-2023-08-04-16:40:28]# cat btree_cache_freeable.txt|grep counter|grep -v "counter = 0" + counter = 1 + +We found that this is a bug in bch_sectors_dirty_init() when locking c->root: + (1). Thread X has locked c->root(A) write. + (2). Thread Y failed to lock c->root(A), waiting for the lock(c->root A). + (3). Thread X bch_btree_set_root() changes c->root from A to B. + (4). Thread X releases the lock(c->root A). + (5). Thread Y successfully locks c->root(A). + (6). Thread Y releases the lock(c->root B). + + down_write locked ---(1)----------------------┐ + | | + | down_read waiting ---(2)----┐ | + | | ┌-------------┐ ┌-------------┐ + bch_btree_set_root ===(3)========>> | c->root A | | c->root B | + | | └-------------┘ └-------------┘ + up_write ---(4)---------------------┘ | | + | | | + down_read locked ---(5)-----------┘ | + | | + up_read ---(6)-----------------------------┘ + +Since c->root may change, the correct steps to lock c->root should be +the same as bch_root_usage(), compare after locking. + +static unsigned int bch_root_usage(struct cache_set *c) +{ + unsigned int bytes = 0; + struct bkey *k; + struct btree *b; + struct btree_iter iter; + + goto lock_root; + + do { + rw_unlock(false, b); +lock_root: + b = c->root; + rw_lock(false, b, b->level); + } while (b != c->root); + + for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) + bytes += bkey_bytes(k); + + rw_unlock(false, b); + + return (bytes * 100) / btree_bytes(c); +} + +Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") +Signed-off-by: Mingzhe Zou +Cc: +Signed-off-by: Coly Li +Link: https://lore.kernel.org/r/20231120052503.6122-7-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/writeback.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -977,14 +977,22 @@ static int bch_btre_dirty_init_thread_nr + void bch_sectors_dirty_init(struct bcache_device *d) + { + int i; ++ struct btree *b = NULL; + struct bkey *k = NULL; + struct btree_iter iter; + struct sectors_dirty_init op; + struct cache_set *c = d->c; + struct bch_dirty_init_state state; + ++retry_lock: ++ b = c->root; ++ rw_lock(0, b, b->level); ++ if (b != c->root) { ++ rw_unlock(0, b); ++ goto retry_lock; ++ } ++ + /* Just count root keys if no leaf node */ +- rw_lock(0, c->root, c->root->level); + if (c->root->level == 0) { + bch_btree_op_init(&op.op, -1); + op.inode = d->id; +@@ -997,7 +1005,7 @@ void bch_sectors_dirty_init(struct bcach + sectors_dirty_init_fn(&op.op, c->root, k); + } + +- rw_unlock(0, c->root); ++ rw_unlock(0, b); + return; + } + +@@ -1034,7 +1042,7 @@ void bch_sectors_dirty_init(struct bcach + out: + /* Must wait for all threads to stop. */ + wait_event(state.wait, atomic_read(&state.started) == 0); +- rw_unlock(0, c->root); ++ rw_unlock(0, b); + } + + void bch_cached_dev_writeback_init(struct cached_dev *dc) diff --git a/queue-6.6/bcache-prevent-potential-division-by-zero-error.patch b/queue-6.6/bcache-prevent-potential-division-by-zero-error.patch new file mode 100644 index 00000000000..4ef51418082 --- /dev/null +++ b/queue-6.6/bcache-prevent-potential-division-by-zero-error.patch @@ -0,0 +1,53 @@ +From 2c7f497ac274a14330208b18f6f734000868ebf9 Mon Sep 17 00:00:00 2001 +From: Rand Deeb +Date: Mon, 20 Nov 2023 13:24:57 +0800 +Subject: bcache: prevent potential division by zero error + +From: Rand Deeb + +commit 2c7f497ac274a14330208b18f6f734000868ebf9 upstream. + +In SHOW(), the variable 'n' is of type 'size_t.' While there is a +conditional check to verify that 'n' is not equal to zero before +executing the 'do_div' macro, concerns arise regarding potential +division by zero error in 64-bit environments. + +The concern arises when 'n' is 64 bits in size, greater than zero, and +the lower 32 bits of it are zeros. In such cases, the conditional check +passes because 'n' is non-zero, but the 'do_div' macro casts 'n' to +'uint32_t,' effectively truncating it to its lower 32 bits. +Consequently, the 'n' value becomes zero. + +To fix this potential division by zero error and ensure precise +division handling, this commit replaces the 'do_div' macro with +div64_u64(). div64_u64() is designed to work with 64-bit operands, +guaranteeing that division is performed correctly. + +This change enhances the robustness of the code, ensuring that division +operations yield accurate results in all scenarios, eliminating the +possibility of division by zero, and improving compatibility across +different 64-bit environments. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Rand Deeb +Cc: +Signed-off-by: Coly Li +Link: https://lore.kernel.org/r/20231120052503.6122-5-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -1103,7 +1103,7 @@ SHOW(__bch_cache) + sum += INITIAL_PRIO - cached[i]; + + if (n) +- do_div(sum, n); ++ sum = div64_u64(sum, n); + + for (i = 0; i < ARRAY_SIZE(q); i++) + q[i] = INITIAL_PRIO - cached[n * (i + 1) / diff --git a/queue-6.6/series b/queue-6.6/series index d96cf2e1aca..5c37310763b 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -93,3 +93,20 @@ alsa-hda-asus-um5302la-added-quirks-for-cs35l41-1043.patch alsa-hda-realtek-add-quirks-for-asus-2024-zenbooks.patch dm-delay-fix-a-race-between-delay_presuspend-and-del.patch veth-use-tstats-per-cpu-traffic-counters.patch +bcache-check-return-value-from-btree_node_alloc_replacement.patch +bcache-prevent-potential-division-by-zero-error.patch +bcache-fixup-init-dirty-data-errors.patch +bcache-fixup-lock-c-root-error.patch +usb-xhci-plat-fix-legacy-phy-double-init.patch +usb-config-fix-iteration-issue-in-usb_get_bos_descriptor.patch +usb-cdnsp-fix-deadlock-issue-during-using-ncm-gadget.patch +usb-serial-option-add-fibocom-l7xx-modules.patch +usb-serial-option-fix-fm101r-gl-defines.patch +usb-serial-option-don-t-claim-interface-4-for-zte-mf290.patch +usb-typec-tcpm-fix-sink-caps-op-current-check.patch +usb-typec-tcpm-skip-hard-reset-when-in-error-recovery.patch +usb-dwc2-write-hcint-with-intmask-applied.patch +usb-dwc3-fix-default-mode-initialization.patch +usb-dwc3-set-the-dma-max_seg_size.patch +usb-dwc3-qcom-fix-software-node-leak-on-probe-errors.patch +usb-dwc3-qcom-fix-wakeup-after-probe-deferral.patch diff --git a/queue-6.6/usb-cdnsp-fix-deadlock-issue-during-using-ncm-gadget.patch b/queue-6.6/usb-cdnsp-fix-deadlock-issue-during-using-ncm-gadget.patch new file mode 100644 index 00000000000..cbc2d0a38cd --- /dev/null +++ b/queue-6.6/usb-cdnsp-fix-deadlock-issue-during-using-ncm-gadget.patch @@ -0,0 +1,67 @@ +From 58f2fcb3a845fcbbad2f3196bb37d744e0506250 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Wed, 8 Nov 2023 10:31:25 +0100 +Subject: usb: cdnsp: Fix deadlock issue during using NCM gadget + +From: Pawel Laszczak + +commit 58f2fcb3a845fcbbad2f3196bb37d744e0506250 upstream. + +The interrupt service routine registered for the gadget is a primary +handler which mask the interrupt source and a threaded handler which +handles the source of the interrupt. Since the threaded handler is +voluntary threaded, the IRQ-core does not disable bottom halves before +invoke the handler like it does for the forced-threaded handler. + +Due to changes in networking it became visible that a network gadget's +completions handler may schedule a softirq which remains unprocessed. +The gadget's completion handler is usually invoked either in hard-IRQ or +soft-IRQ context. In this context it is enough to just raise the softirq +because the softirq itself will be handled once that context is left. +In the case of the voluntary threaded handler, there is nothing that +will process pending softirqs. Which means it remain queued until +another random interrupt (on this CPU) fires and handles it on its exit +path or another thread locks and unlocks a lock with the bh suffix. +Worst case is that the CPU goes idle and the NOHZ complains about +unhandled softirqs. + +Disable bottom halves before acquiring the lock (and disabling +interrupts) and enable them after dropping the lock. This ensures that +any pending softirqs will handled right away. + +cc: stable@vger.kernel.org +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +Signed-off-by: Pawel Laszczak +Acked-by: Peter Chen +Link: https://lore.kernel.org/r/20231108093125.224963-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdnsp-ring.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/cdns3/cdnsp-ring.c ++++ b/drivers/usb/cdns3/cdnsp-ring.c +@@ -1529,6 +1529,7 @@ irqreturn_t cdnsp_thread_irq_handler(int + unsigned long flags; + int counter = 0; + ++ local_bh_disable(); + spin_lock_irqsave(&pdev->lock, flags); + + if (pdev->cdnsp_state & (CDNSP_STATE_HALTED | CDNSP_STATE_DYING)) { +@@ -1541,6 +1542,7 @@ irqreturn_t cdnsp_thread_irq_handler(int + cdnsp_died(pdev); + + spin_unlock_irqrestore(&pdev->lock, flags); ++ local_bh_enable(); + return IRQ_HANDLED; + } + +@@ -1557,6 +1559,7 @@ irqreturn_t cdnsp_thread_irq_handler(int + cdnsp_update_erst_dequeue(pdev, event_ring_deq, 1); + + spin_unlock_irqrestore(&pdev->lock, flags); ++ local_bh_enable(); + + return IRQ_HANDLED; + } diff --git a/queue-6.6/usb-config-fix-iteration-issue-in-usb_get_bos_descriptor.patch b/queue-6.6/usb-config-fix-iteration-issue-in-usb_get_bos_descriptor.patch new file mode 100644 index 00000000000..4e36b7330bb --- /dev/null +++ b/queue-6.6/usb-config-fix-iteration-issue-in-usb_get_bos_descriptor.patch @@ -0,0 +1,51 @@ +From 974bba5c118f4c2baf00de0356e3e4f7928b4cbc Mon Sep 17 00:00:00 2001 +From: Niklas Neronin +Date: Wed, 15 Nov 2023 14:13:25 +0200 +Subject: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' + +From: Niklas Neronin + +commit 974bba5c118f4c2baf00de0356e3e4f7928b4cbc upstream. + +The BOS descriptor defines a root descriptor and is the base descriptor for +accessing a family of related descriptors. + +Function 'usb_get_bos_descriptor()' encounters an iteration issue when +skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in +the same descriptor being read repeatedly. + +To address this issue, a 'goto' statement is introduced to ensure that the +pointer and the amount read is updated correctly. This ensures that the +function iterates to the next descriptor instead of reading the same +descriptor repeatedly. + +Cc: stable@vger.kernel.org +Fixes: 3dd550a2d365 ("USB: usbcore: Fix slab-out-of-bounds bug during device reset") +Signed-off-by: Niklas Neronin +Acked-by: Mathias Nyman +Reviewed-by: Alan Stern +Link: https://lore.kernel.org/r/20231115121325.471454-1-niklas.neronin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/config.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -1047,7 +1047,7 @@ int usb_get_bos_descriptor(struct usb_de + + if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { + dev_notice(ddev, "descriptor type invalid, skip\n"); +- continue; ++ goto skip_to_next_descriptor; + } + + switch (cap_type) { +@@ -1078,6 +1078,7 @@ int usb_get_bos_descriptor(struct usb_de + break; + } + ++skip_to_next_descriptor: + total_len -= length; + buffer += length; + } diff --git a/queue-6.6/usb-dwc2-write-hcint-with-intmask-applied.patch b/queue-6.6/usb-dwc2-write-hcint-with-intmask-applied.patch new file mode 100644 index 00000000000..76e465e034a --- /dev/null +++ b/queue-6.6/usb-dwc2-write-hcint-with-intmask-applied.patch @@ -0,0 +1,80 @@ +From 0583bc776ca5b5a3f5752869fc31cf7322df2b35 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 15 Nov 2023 15:45:07 +0100 +Subject: USB: dwc2: write HCINT with INTMASK applied + +From: Oliver Neukum + +commit 0583bc776ca5b5a3f5752869fc31cf7322df2b35 upstream. + +dwc2_hc_n_intr() writes back INTMASK as read but evaluates it +with intmask applied. In stress testing this causes spurious +interrupts like this: + +[Mon Aug 14 10:51:07 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 7 - ChHltd set, but reason is unknown +[Mon Aug 14 10:51:07 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001 +[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 0 - ChHltd set, but reason is unknown +[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001 +[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 4 - ChHltd set, but reason is unknown +[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001 +[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_update_urb_state_abn(): trimming xfer length + +Applying INTMASK prevents this. The issue exists in all versions of the +driver. + +Signed-off-by: Oliver Neukum +Tested-by: Ivan Ivanov +Tested-by: Andrea della Porta +Link: https://lore.kernel.org/r/20231115144514.15248-1-oneukum@suse.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd_intr.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -2015,15 +2015,17 @@ static void dwc2_hc_n_intr(struct dwc2_h + { + struct dwc2_qtd *qtd; + struct dwc2_host_chan *chan; +- u32 hcint, hcintmsk; ++ u32 hcint, hcintraw, hcintmsk; + + chan = hsotg->hc_ptr_array[chnum]; + +- hcint = dwc2_readl(hsotg, HCINT(chnum)); ++ hcintraw = dwc2_readl(hsotg, HCINT(chnum)); + hcintmsk = dwc2_readl(hsotg, HCINTMSK(chnum)); ++ hcint = hcintraw & hcintmsk; ++ dwc2_writel(hsotg, hcint, HCINT(chnum)); ++ + if (!chan) { + dev_err(hsotg->dev, "## hc_ptr_array for channel is NULL ##\n"); +- dwc2_writel(hsotg, hcint, HCINT(chnum)); + return; + } + +@@ -2032,11 +2034,9 @@ static void dwc2_hc_n_intr(struct dwc2_h + chnum); + dev_vdbg(hsotg->dev, + " hcint 0x%08x, hcintmsk 0x%08x, hcint&hcintmsk 0x%08x\n", +- hcint, hcintmsk, hcint & hcintmsk); ++ hcintraw, hcintmsk, hcint); + } + +- dwc2_writel(hsotg, hcint, HCINT(chnum)); +- + /* + * If we got an interrupt after someone called + * dwc2_hcd_endpoint_disable() we don't want to crash below +@@ -2046,8 +2046,7 @@ static void dwc2_hc_n_intr(struct dwc2_h + return; + } + +- chan->hcint = hcint; +- hcint &= hcintmsk; ++ chan->hcint = hcintraw; + + /* + * If the channel was halted due to a dequeue, the qtd list might diff --git a/queue-6.6/usb-dwc3-fix-default-mode-initialization.patch b/queue-6.6/usb-dwc3-fix-default-mode-initialization.patch new file mode 100644 index 00000000000..dfd6a37acfe --- /dev/null +++ b/queue-6.6/usb-dwc3-fix-default-mode-initialization.patch @@ -0,0 +1,41 @@ +From 10d510abd096d620b9fda2dd3e0047c5efc4ad2b Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Wed, 25 Oct 2023 11:51:10 +0200 +Subject: usb: dwc3: Fix default mode initialization + +From: Alexander Stein + +commit 10d510abd096d620b9fda2dd3e0047c5efc4ad2b upstream. + +The default mode, configurable by DT, shall be set before usb role switch +driver is registered. Otherwise there is a race between default mode +and mode set by usb role switch driver. + +Fixes: 98ed256a4dbad ("usb: dwc3: Add support for role-switch-default-mode binding") +Cc: stable +Signed-off-by: Alexander Stein +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20231025095110.2405281-1-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/drd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/drd.c ++++ b/drivers/usb/dwc3/drd.c +@@ -505,6 +505,7 @@ static int dwc3_setup_role_switch(struct + dwc->role_switch_default_mode = USB_DR_MODE_PERIPHERAL; + mode = DWC3_GCTL_PRTCAP_DEVICE; + } ++ dwc3_set_mode(dwc, mode); + + dwc3_role_switch.fwnode = dev_fwnode(dwc->dev); + dwc3_role_switch.set = dwc3_usb_role_switch_set; +@@ -526,7 +527,6 @@ static int dwc3_setup_role_switch(struct + } + } + +- dwc3_set_mode(dwc, mode); + return 0; + } + #else diff --git a/queue-6.6/usb-dwc3-qcom-fix-software-node-leak-on-probe-errors.patch b/queue-6.6/usb-dwc3-qcom-fix-software-node-leak-on-probe-errors.patch new file mode 100644 index 00000000000..694c8f38c70 --- /dev/null +++ b/queue-6.6/usb-dwc3-qcom-fix-software-node-leak-on-probe-errors.patch @@ -0,0 +1,60 @@ +From 9feefbf57d92e8ee293dad67585d351c7d0b6e37 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 17 Nov 2023 18:36:49 +0100 +Subject: USB: dwc3: qcom: fix software node leak on probe errors + +From: Johan Hovold + +commit 9feefbf57d92e8ee293dad67585d351c7d0b6e37 upstream. + +Make sure to remove the software node also on (ACPI) probe errors to +avoid leaking the underlying resources. + +Note that the software node is only used for ACPI probe so the driver +unbind tear down is updated to match probe. + +Fixes: 8dc6e6dd1bee ("usb: dwc3: qcom: Constify the software node") +Cc: stable@vger.kernel.org # 5.12 +Cc: Heikki Krogerus +Signed-off-by: Johan Hovold +Acked-by: Heikki Krogerus +Acked-by: Andrew Halaney +Link: https://lore.kernel.org/r/20231117173650.21161-3-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-qcom.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -949,10 +949,12 @@ static int dwc3_qcom_probe(struct platfo + interconnect_exit: + dwc3_qcom_interconnect_exit(qcom); + depopulate: +- if (np) ++ if (np) { + of_platform_depopulate(&pdev->dev); +- else ++ } else { ++ device_remove_software_node(&qcom->dwc3->dev); + platform_device_del(qcom->dwc3); ++ } + platform_device_put(qcom->dwc3); + free_urs: + if (qcom->urs_usb) +@@ -975,11 +977,12 @@ static void dwc3_qcom_remove(struct plat + struct device *dev = &pdev->dev; + int i; + +- device_remove_software_node(&qcom->dwc3->dev); +- if (np) ++ if (np) { + of_platform_depopulate(&pdev->dev); +- else ++ } else { ++ device_remove_software_node(&qcom->dwc3->dev); + platform_device_del(qcom->dwc3); ++ } + platform_device_put(qcom->dwc3); + + if (qcom->urs_usb) diff --git a/queue-6.6/usb-dwc3-qcom-fix-wakeup-after-probe-deferral.patch b/queue-6.6/usb-dwc3-qcom-fix-wakeup-after-probe-deferral.patch new file mode 100644 index 00000000000..6a595f422cf --- /dev/null +++ b/queue-6.6/usb-dwc3-qcom-fix-wakeup-after-probe-deferral.patch @@ -0,0 +1,70 @@ +From 41f5a0973259db9e4e3c9963d36505f80107d1a0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 20 Nov 2023 17:16:06 +0100 +Subject: USB: dwc3: qcom: fix wakeup after probe deferral + +From: Johan Hovold + +commit 41f5a0973259db9e4e3c9963d36505f80107d1a0 upstream. + +The Qualcomm glue driver is overriding the interrupt trigger types +defined by firmware when requesting the wakeup interrupts during probe. + +This can lead to a failure to map the DP/DM wakeup interrupts after a +probe deferral as the firmware defined trigger types do not match the +type used for the initial mapping: + + irq: type mismatch, failed to map hwirq-14 for interrupt-controller@b220000! + irq: type mismatch, failed to map hwirq-15 for interrupt-controller@b220000! + +Fix this by not overriding the firmware provided trigger types when +requesting the wakeup interrupts. + +Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") +Cc: stable@vger.kernel.org # 4.18 +Signed-off-by: Johan Hovold +Reviewed-by: Andrew Halaney +Link: https://lore.kernel.org/r/20231120161607.7405-3-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-qcom.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -549,7 +549,7 @@ static int dwc3_qcom_setup_irq(struct pl + irq_set_status_flags(irq, IRQ_NOAUTOEN); + ret = devm_request_threaded_irq(qcom->dev, irq, NULL, + qcom_dwc3_resume_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ IRQF_ONESHOT, + "qcom_dwc3 HS", qcom); + if (ret) { + dev_err(qcom->dev, "hs_phy_irq failed: %d\n", ret); +@@ -564,7 +564,7 @@ static int dwc3_qcom_setup_irq(struct pl + irq_set_status_flags(irq, IRQ_NOAUTOEN); + ret = devm_request_threaded_irq(qcom->dev, irq, NULL, + qcom_dwc3_resume_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ IRQF_ONESHOT, + "qcom_dwc3 DP_HS", qcom); + if (ret) { + dev_err(qcom->dev, "dp_hs_phy_irq failed: %d\n", ret); +@@ -579,7 +579,7 @@ static int dwc3_qcom_setup_irq(struct pl + irq_set_status_flags(irq, IRQ_NOAUTOEN); + ret = devm_request_threaded_irq(qcom->dev, irq, NULL, + qcom_dwc3_resume_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ IRQF_ONESHOT, + "qcom_dwc3 DM_HS", qcom); + if (ret) { + dev_err(qcom->dev, "dm_hs_phy_irq failed: %d\n", ret); +@@ -594,7 +594,7 @@ static int dwc3_qcom_setup_irq(struct pl + irq_set_status_flags(irq, IRQ_NOAUTOEN); + ret = devm_request_threaded_irq(qcom->dev, irq, NULL, + qcom_dwc3_resume_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ IRQF_ONESHOT, + "qcom_dwc3 SS", qcom); + if (ret) { + dev_err(qcom->dev, "ss_phy_irq failed: %d\n", ret); diff --git a/queue-6.6/usb-dwc3-set-the-dma-max_seg_size.patch b/queue-6.6/usb-dwc3-set-the-dma-max_seg_size.patch new file mode 100644 index 00000000000..f6dba1212dc --- /dev/null +++ b/queue-6.6/usb-dwc3-set-the-dma-max_seg_size.patch @@ -0,0 +1,36 @@ +From 8bbae288a85abed6a1cf7d185d8b9dc2f5dcb12c Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 27 Oct 2023 11:28:20 +0000 +Subject: usb: dwc3: set the dma max_seg_size + +From: Ricardo Ribalda + +commit 8bbae288a85abed6a1cf7d185d8b9dc2f5dcb12c upstream. + +Allow devices to have dma operations beyond 4K, and avoid warnings such +as: + +DMA-API: dwc3 a600000.usb: mapping sg segment longer than device claims to support [len=86016] [max=65536] + +Cc: stable@vger.kernel.org +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Reported-by: Zubin Mithra +Signed-off-by: Ricardo Ribalda +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20231026-dwc3-v2-1-1d4fd5c3e067@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -2006,6 +2006,8 @@ static int dwc3_probe(struct platform_de + + pm_runtime_put(dev); + ++ dma_set_max_seg_size(dev, UINT_MAX); ++ + return 0; + + err_exit_debugfs: diff --git a/queue-6.6/usb-serial-option-add-fibocom-l7xx-modules.patch b/queue-6.6/usb-serial-option-add-fibocom-l7xx-modules.patch new file mode 100644 index 00000000000..84206875eab --- /dev/null +++ b/queue-6.6/usb-serial-option-add-fibocom-l7xx-modules.patch @@ -0,0 +1,106 @@ +From e389fe8b68137344562fb6e4d53d8a89ef6212dd Mon Sep 17 00:00:00 2001 +From: Victor Fragoso +Date: Tue, 21 Nov 2023 21:05:56 +0000 +Subject: USB: serial: option: add Fibocom L7xx modules + +From: Victor Fragoso + +commit e389fe8b68137344562fb6e4d53d8a89ef6212dd upstream. + +Add support for Fibocom L716-EU module series. + +L716-EU is a Fibocom module based on ZTE's V3E/V3T chipset. + +Device creates multiple interfaces when connected to PC as follows: + - Network Interface: ECM or RNDIS (set by FW or AT Command) + - ttyUSB0: AT port + - ttyUSB1: Modem port + - ttyUSB2: AT2 port + - ttyUSB3: Trace port for log information + - ADB: ADB port for debugging. ("Driver=usbfs" when ADB server enabled) + +Here are the outputs of lsusb and usb-devices: +$ ls /dev/ttyUSB* +/dev/ttyUSB0 /dev/ttyUSB1 /dev/ttyUSB2 /dev/ttyUSB3 + +usb-devices: +L716-EU (ECM mode): +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 51 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0001 Rev= 1.00 +S: Manufacturer=Fibocom,Incorporated +S: Product=Fibocom Mobile Boardband +S: SerialNumber=1234567890ABCDEF +C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=87(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +L716-EU (RNDIS mode): +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 49 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0001 Rev= 1.00 +S: Manufacturer=Fibocom,Incorporated +S: Product=Fibocom Mobile Boardband +S: SerialNumber=1234567890ABCDEF +C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host +E: Ad=87(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Victor Fragoso +Reviewed-by: Lars Melin +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2251,6 +2251,7 @@ static const struct usb_device_id option + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) }, /* Fibocom L610 (ECM/RNDIS mode) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0001, 0xff, 0xff, 0xff) }, /* Fibocom L716-EU (ECM/RNDIS mode) */ + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ diff --git a/queue-6.6/usb-serial-option-don-t-claim-interface-4-for-zte-mf290.patch b/queue-6.6/usb-serial-option-don-t-claim-interface-4-for-zte-mf290.patch new file mode 100644 index 00000000000..6b208090d9c --- /dev/null +++ b/queue-6.6/usb-serial-option-don-t-claim-interface-4-for-zte-mf290.patch @@ -0,0 +1,65 @@ +From 8771127e25d6c20d458ad27cf32f7fcfc1755e05 Mon Sep 17 00:00:00 2001 +From: Lech Perczak +Date: Sat, 18 Nov 2023 00:19:17 +0100 +Subject: USB: serial: option: don't claim interface 4 for ZTE MF290 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lech Perczak + +commit 8771127e25d6c20d458ad27cf32f7fcfc1755e05 upstream. + +Interface 4 is used by for QMI interface in stock firmware of MF28D, the +router which uses MF290 modem. Free the interface up, to rebind it to +qmi_wwan driver. +The proper configuration is: + +Interface mapping is: +0: QCDM, 1: (unknown), 2: AT (PCUI), 2: AT (Modem), 4: QMI + +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=0189 Rev= 0.00 +S: Manufacturer=ZTE, Incorporated +S: Product=ZTE LTE Technologies MSM +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms + +Cc: Bjørn Mork +Signed-off-by: Lech Perczak +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1548,7 +1548,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff), + .driver_info = RSVD(4) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0189, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0189, 0xff, 0xff, 0xff), ++ .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */ + .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0196, 0xff, 0xff, 0xff) }, diff --git a/queue-6.6/usb-serial-option-fix-fm101r-gl-defines.patch b/queue-6.6/usb-serial-option-fix-fm101r-gl-defines.patch new file mode 100644 index 00000000000..9a5475c6c8f --- /dev/null +++ b/queue-6.6/usb-serial-option-fix-fm101r-gl-defines.patch @@ -0,0 +1,46 @@ +From a1092619dd28ac0fcf23016160a2fdccd98ef935 Mon Sep 17 00:00:00 2001 +From: Puliang Lu +Date: Thu, 26 Oct 2023 20:35:06 +0800 +Subject: USB: serial: option: fix FM101R-GL defines + +From: Puliang Lu + +commit a1092619dd28ac0fcf23016160a2fdccd98ef935 upstream. + +Modify the definition of the two Fibocom FM101R-GL PID macros, which had +their PIDs switched. + +The correct PIDs are: + +- VID:PID 413C:8213, FM101R-GL ESIM are laptop M.2 cards (with + MBIM interfaces for Linux) + +- VID:PID 413C:8215, FM101R-GL are laptop M.2 cards (with + MBIM interface for Linux) + +0x8213: mbim, tty +0x8215: mbim, tty + +Signed-off-by: Puliang Lu +Fixes: 52480e1f1a25 ("USB: serial: option: add Fibocom to DELL custom modem FM101R-GL") +Link: https://lore.kernel.org/lkml/TYZPR02MB508845BAD7936A62A105CE5D89DFA@TYZPR02MB5088.apcprd02.prod.outlook.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -203,8 +203,8 @@ static void option_instat_callback(struc + #define DELL_PRODUCT_5829E_ESIM 0x81e4 + #define DELL_PRODUCT_5829E 0x81e6 + +-#define DELL_PRODUCT_FM101R 0x8213 +-#define DELL_PRODUCT_FM101R_ESIM 0x8215 ++#define DELL_PRODUCT_FM101R_ESIM 0x8213 ++#define DELL_PRODUCT_FM101R 0x8215 + + #define KYOCERA_VENDOR_ID 0x0c88 + #define KYOCERA_PRODUCT_KPC650 0x17da diff --git a/queue-6.6/usb-typec-tcpm-fix-sink-caps-op-current-check.patch b/queue-6.6/usb-typec-tcpm-fix-sink-caps-op-current-check.patch new file mode 100644 index 00000000000..88a2a110d4b --- /dev/null +++ b/queue-6.6/usb-typec-tcpm-fix-sink-caps-op-current-check.patch @@ -0,0 +1,63 @@ +From 187fb003c57c964ea61ac9fbfe41abf3ca9973eb Mon Sep 17 00:00:00 2001 +From: Badhri Jagan Sridharan +Date: Wed, 1 Nov 2023 01:28:45 +0000 +Subject: usb: typec: tcpm: Fix sink caps op current check + +From: Badhri Jagan Sridharan + +commit 187fb003c57c964ea61ac9fbfe41abf3ca9973eb upstream. + +TCPM checks for sink caps operational current even when PD is disabled. +This incorrectly sets tcpm_set_charge() when PD is disabled. +Check for sink caps only when PD is enabled. + +[ 97.572342] Start toggling +[ 97.578949] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected] +[ 99.571648] CC1: 0 -> 0, CC2: 0 -> 4 [state TOGGLING, polarity 0, connected] +[ 99.571658] state change TOGGLING -> SNK_ATTACH_WAIT [rev3 NONE_AMS] +[ 99.571673] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev3 NONE_AMS] +[ 99.741778] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms] +[ 99.789283] CC1: 0 -> 0, CC2: 4 -> 5 [state SNK_DEBOUNCED, polarity 0, connected] +[ 99.789306] state change SNK_DEBOUNCED -> SNK_DEBOUNCED [rev3 NONE_AMS] +[ 99.903584] VBUS on +[ 99.903591] state change SNK_DEBOUNCED -> SNK_ATTACHED [rev3 NONE_AMS] +[ 99.903600] polarity 1 +[ 99.910155] enable vbus discharge ret:0 +[ 99.910160] Requesting mux state 1, usb-role 2, orientation 2 +[ 99.946791] state change SNK_ATTACHED -> SNK_STARTUP [rev3 NONE_AMS] +[ 99.946798] state change SNK_STARTUP -> SNK_DISCOVERY [rev3 NONE_AMS] +[ 99.946800] Setting voltage/current limit 5000 mV 500 mA +[ 99.946803] vbus=0 charge:=1 +[ 100.027139] state change SNK_DISCOVERY -> SNK_READY [rev3 NONE_AMS] +[ 100.027145] Setting voltage/current limit 5000 mV 3000 mA +[ 100.466830] VBUS on + +Cc: stable@vger.kernel.org +Fixes: 803b1c8a0cea ("usb: typec: tcpm: not sink vbus if operational current is 0mA") +Signed-off-by: Badhri Jagan Sridharan +Reviewed-by: Guenter Roeck +Acked-by: Heikki Krogerus +Tested-by: Will McVicker +Link: https://lore.kernel.org/r/20231101012845.2701348-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +index b386102f7a3a..bfb6f9481e87 100644 +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4273,7 +4273,8 @@ static void run_state_machine(struct tcpm_port *port) + current_lim = PD_P_SNK_STDBY_MW / 5; + tcpm_set_current_limit(port, current_lim, 5000); + /* Not sink vbus if operational current is 0mA */ +- tcpm_set_charge(port, !!pdo_max_current(port->snk_pdo[0])); ++ tcpm_set_charge(port, !port->pd_supported || ++ pdo_max_current(port->snk_pdo[0])); + + if (!port->pd_supported) + tcpm_set_state(port, SNK_READY, 0); +-- +2.43.0 + diff --git a/queue-6.6/usb-typec-tcpm-skip-hard-reset-when-in-error-recovery.patch b/queue-6.6/usb-typec-tcpm-skip-hard-reset-when-in-error-recovery.patch new file mode 100644 index 00000000000..8bac165fef0 --- /dev/null +++ b/queue-6.6/usb-typec-tcpm-skip-hard-reset-when-in-error-recovery.patch @@ -0,0 +1,57 @@ +From a6fe37f428c19dd164c2111157d4a1029bd853aa Mon Sep 17 00:00:00 2001 +From: Badhri Jagan Sridharan +Date: Wed, 1 Nov 2023 02:19:09 +0000 +Subject: usb: typec: tcpm: Skip hard reset when in error recovery + +From: Badhri Jagan Sridharan + +commit a6fe37f428c19dd164c2111157d4a1029bd853aa upstream. + +Hard reset queued prior to error recovery (or) received during +error recovery will make TCPM to prematurely exit error recovery +sequence. Ignore hard resets received during error recovery (or) +port reset sequence. + +``` +[46505.459688] state change SNK_READY -> ERROR_RECOVERY [rev3 NONE_AMS] +[46505.459706] state change ERROR_RECOVERY -> PORT_RESET [rev3 NONE_AMS] +[46505.460433] disable vbus discharge ret:0 +[46505.461226] Setting usb_comm capable false +[46505.467244] Setting voltage/current limit 0 mV 0 mA +[46505.467262] polarity 0 +[46505.470695] Requesting mux state 0, usb-role 0, orientation 0 +[46505.475621] cc:=0 +[46505.476012] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS] +[46505.476020] Received hard reset +[46505.476024] state change PORT_RESET -> HARD_RESET_START [rev3 HARD_RESET] +``` + +Cc: stable@vger.kernel.org +Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") +Signed-off-by: Badhri Jagan Sridharan +Acked-by: Heikki Krogeus +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20231101021909.2962679-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -5392,6 +5392,15 @@ static void _tcpm_pd_hard_reset(struct t + if (port->bist_request == BDO_MODE_TESTDATA && port->tcpc->set_bist_data) + port->tcpc->set_bist_data(port->tcpc, false); + ++ switch (port->state) { ++ case ERROR_RECOVERY: ++ case PORT_RESET: ++ case PORT_RESET_WAIT_OFF: ++ return; ++ default: ++ break; ++ } ++ + if (port->ams != NONE_AMS) + port->ams = NONE_AMS; + if (port->hard_reset_count < PD_N_HARD_RESET_COUNT) diff --git a/queue-6.6/usb-xhci-plat-fix-legacy-phy-double-init.patch b/queue-6.6/usb-xhci-plat-fix-legacy-phy-double-init.patch new file mode 100644 index 00000000000..d7dd994e1ee --- /dev/null +++ b/queue-6.6/usb-xhci-plat-fix-legacy-phy-double-init.patch @@ -0,0 +1,121 @@ +From 16b7e0cccb243033de4406ffb4d892365041a1e7 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 3 Nov 2023 17:43:23 +0100 +Subject: USB: xhci-plat: fix legacy PHY double init + +From: Johan Hovold + +commit 16b7e0cccb243033de4406ffb4d892365041a1e7 upstream. + +Commits 7b8ef22ea547 ("usb: xhci: plat: Add USB phy support") and +9134c1fd0503 ("usb: xhci: plat: Add USB 3.0 phy support") added support +for looking up legacy PHYs from the sysdev devicetree node and +initialising them. + +This broke drivers such as dwc3 which manages PHYs themself as the PHYs +would now be initialised twice, something which specifically can lead to +resources being left enabled during suspend (e.g. with the +usb_phy_generic PHY driver). + +As the dwc3 driver uses driver-name matching for the xhci platform +device, fix this by only looking up and initialising PHYs for devices +that have been matched using OF. + +Note that checking that the platform device has a devicetree node would +currently be sufficient, but that could lead to subtle breakages in case +anyone ever tries to reuse an ancestor's node. + +Fixes: 7b8ef22ea547 ("usb: xhci: plat: Add USB phy support") +Fixes: 9134c1fd0503 ("usb: xhci: plat: Add USB 3.0 phy support") +Cc: stable@vger.kernel.org # 4.1 +Cc: Maxime Ripard +Cc: Stanley Chang +Signed-off-by: Johan Hovold +Tested-by: Stefan Eichenberger +Tested-by: Stanley Chang +Link: https://lore.kernel.org/r/20231103164323.14294-1-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-plat.c | 50 +++++++++++++++++++++++++------------------ + 1 file changed, 30 insertions(+), 20 deletions(-) + +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -148,7 +149,7 @@ int xhci_plat_probe(struct platform_devi + int ret; + int irq; + struct xhci_plat_priv *priv = NULL; +- ++ bool of_match; + + if (usb_disabled()) + return -ENODEV; +@@ -253,16 +254,23 @@ int xhci_plat_probe(struct platform_devi + &xhci->imod_interval); + } + +- hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, "usb-phy", 0); +- if (IS_ERR(hcd->usb_phy)) { +- ret = PTR_ERR(hcd->usb_phy); +- if (ret == -EPROBE_DEFER) +- goto disable_clk; +- hcd->usb_phy = NULL; +- } else { +- ret = usb_phy_init(hcd->usb_phy); +- if (ret) +- goto disable_clk; ++ /* ++ * Drivers such as dwc3 manages PHYs themself (and rely on driver name ++ * matching for the xhci platform device). ++ */ ++ of_match = of_match_device(pdev->dev.driver->of_match_table, &pdev->dev); ++ if (of_match) { ++ hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, "usb-phy", 0); ++ if (IS_ERR(hcd->usb_phy)) { ++ ret = PTR_ERR(hcd->usb_phy); ++ if (ret == -EPROBE_DEFER) ++ goto disable_clk; ++ hcd->usb_phy = NULL; ++ } else { ++ ret = usb_phy_init(hcd->usb_phy); ++ if (ret) ++ goto disable_clk; ++ } + } + + hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node); +@@ -285,15 +293,17 @@ int xhci_plat_probe(struct platform_devi + goto dealloc_usb2_hcd; + } + +- xhci->shared_hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, +- "usb-phy", 1); +- if (IS_ERR(xhci->shared_hcd->usb_phy)) { +- xhci->shared_hcd->usb_phy = NULL; +- } else { +- ret = usb_phy_init(xhci->shared_hcd->usb_phy); +- if (ret) +- dev_err(sysdev, "%s init usb3phy fail (ret=%d)\n", +- __func__, ret); ++ if (of_match) { ++ xhci->shared_hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, ++ "usb-phy", 1); ++ if (IS_ERR(xhci->shared_hcd->usb_phy)) { ++ xhci->shared_hcd->usb_phy = NULL; ++ } else { ++ ret = usb_phy_init(xhci->shared_hcd->usb_phy); ++ if (ret) ++ dev_err(sysdev, "%s init usb3phy fail (ret=%d)\n", ++ __func__, ret); ++ } + } + + xhci->shared_hcd->tpl_support = hcd->tpl_support; -- 2.47.3