From 980c2e13cd7c425e4dfca8bec352a15cea90a72e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 1 Sep 2024 11:29:21 +0200 Subject: [PATCH] 6.10-stable patches added patches: arm-dts-imx6dl-yapp43-increase-led-current-to-match-the-yapp4-hw-design.patch arm64-dts-qcom-x1e80100-add-missing-pcie-minimum-opp.patch arm64-dts-qcom-x1e80100-crd-fix-pcie4-phy-supply.patch arm64-dts-qcom-x1e80100-fix-pcie-domain-numbers.patch arm64-dts-qcom-x1e80100-qcp-fix-pcie4-phy-supply.patch cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch dt-bindings-usb-microchip-usb2514-fix-reference-usb-device-schema.patch firmware-qcom-scm-mark-get_wq_ctx-as-atomic-call.patch scsi-sd-ignore-command-synchronize-cache-error-if-format-in-progress.patch soc-qcom-cmd-db-map-shared-memory-as-wc-not-wb.patch soc-qcom-pmic_glink-actually-communicate-when-remote-goes-down.patch soc-qcom-pmic_glink-fix-race-during-initialization.patch usb-cdnsp-fix-for-link-trb-with-tc.patch usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch usb-dwc3-ep0-don-t-reset-resource-alloc-flag-including-ep0.patch usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch usb-dwc3-st-add-missing-depopulate-in-probe-error-path.patch usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch usb-dwc3-xilinx-add-missing-depopulate-in-probe-error-path.patch usb-gadget-uvc-queue-pump-work-in-uvcg_video_enable.patch usb-serial-option-add-meig-smart-srm825l.patch usb-typec-fsa4480-relax-chip_id-check.patch usb-typec-ucsi-move-unregister-out-of-atomic-section.patch --- ...current-to-match-the-yapp4-hw-design.patch | 65 ++++++ ...1e80100-add-missing-pcie-minimum-opp.patch | 42 ++++ ...om-x1e80100-crd-fix-pcie4-phy-supply.patch | 33 +++ ...com-x1e80100-fix-pcie-domain-numbers.patch | 43 ++++ ...om-x1e80100-qcp-fix-pcie4-phy-supply.patch | 35 +++ ...uirk-for-ge-healthcare-ui-controller.patch | 33 +++ ...2514-fix-reference-usb-device-schema.patch | 48 ++++ ...m-scm-mark-get_wq_ctx-as-atomic-call.patch | 41 ++++ ...ze-cache-error-if-format-in-progress.patch | 62 +++++ queue-6.10/series | 25 ++ ...md-db-map-shared-memory-as-wc-not-wb.patch | 50 ++++ ...ly-communicate-when-remote-goes-down.patch | 44 ++++ ...glink-fix-race-during-initialization.patch | 221 ++++++++++++++++++ .../usb-cdnsp-fix-for-link-trb-with-tc.patch | 91 ++++++++ ...t-index-in-cdnsp_get_hw_deq-function.patch | 38 +++ ...ttr_group-in-remove_power_attributes.patch | 32 +++ ...-invalid-event-buffer-address-access.patch | 55 +++++ ...et-resource-alloc-flag-including-ep0.patch | 47 ++++ ...ssing-depopulate-in-probe-error-path.patch | 40 ++++ ...ssing-depopulate-in-probe-error-path.patch | 51 ++++ ...device-ref-count-on-probe-error-path.patch | 61 +++++ ...ssing-depopulate-in-probe-error-path.patch | 41 ++++ ...queue-pump-work-in-uvcg_video_enable.patch | 46 ++++ ...serial-option-add-meig-smart-srm825l.patch | 71 ++++++ ...sb-typec-fsa4480-relax-chip_id-check.patch | 44 ++++ ...ove-unregister-out-of-atomic-section.patch | 124 ++++++++++ 26 files changed, 1483 insertions(+) create mode 100644 queue-6.10/arm-dts-imx6dl-yapp43-increase-led-current-to-match-the-yapp4-hw-design.patch create mode 100644 queue-6.10/arm64-dts-qcom-x1e80100-add-missing-pcie-minimum-opp.patch create mode 100644 queue-6.10/arm64-dts-qcom-x1e80100-crd-fix-pcie4-phy-supply.patch create mode 100644 queue-6.10/arm64-dts-qcom-x1e80100-fix-pcie-domain-numbers.patch create mode 100644 queue-6.10/arm64-dts-qcom-x1e80100-qcp-fix-pcie4-phy-supply.patch create mode 100644 queue-6.10/cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch create mode 100644 queue-6.10/dt-bindings-usb-microchip-usb2514-fix-reference-usb-device-schema.patch create mode 100644 queue-6.10/firmware-qcom-scm-mark-get_wq_ctx-as-atomic-call.patch create mode 100644 queue-6.10/scsi-sd-ignore-command-synchronize-cache-error-if-format-in-progress.patch create mode 100644 queue-6.10/soc-qcom-cmd-db-map-shared-memory-as-wc-not-wb.patch create mode 100644 queue-6.10/soc-qcom-pmic_glink-actually-communicate-when-remote-goes-down.patch create mode 100644 queue-6.10/soc-qcom-pmic_glink-fix-race-during-initialization.patch create mode 100644 queue-6.10/usb-cdnsp-fix-for-link-trb-with-tc.patch create mode 100644 queue-6.10/usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch create mode 100644 queue-6.10/usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch create mode 100644 queue-6.10/usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch create mode 100644 queue-6.10/usb-dwc3-ep0-don-t-reset-resource-alloc-flag-including-ep0.patch create mode 100644 queue-6.10/usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch create mode 100644 queue-6.10/usb-dwc3-st-add-missing-depopulate-in-probe-error-path.patch create mode 100644 queue-6.10/usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch create mode 100644 queue-6.10/usb-dwc3-xilinx-add-missing-depopulate-in-probe-error-path.patch create mode 100644 queue-6.10/usb-gadget-uvc-queue-pump-work-in-uvcg_video_enable.patch create mode 100644 queue-6.10/usb-serial-option-add-meig-smart-srm825l.patch create mode 100644 queue-6.10/usb-typec-fsa4480-relax-chip_id-check.patch create mode 100644 queue-6.10/usb-typec-ucsi-move-unregister-out-of-atomic-section.patch diff --git a/queue-6.10/arm-dts-imx6dl-yapp43-increase-led-current-to-match-the-yapp4-hw-design.patch b/queue-6.10/arm-dts-imx6dl-yapp43-increase-led-current-to-match-the-yapp4-hw-design.patch new file mode 100644 index 00000000000..8289c97da7b --- /dev/null +++ b/queue-6.10/arm-dts-imx6dl-yapp43-increase-led-current-to-match-the-yapp4-hw-design.patch @@ -0,0 +1,65 @@ +From 8512fbb64b0e599412da661412d10d4ba1cb003c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Vok=C3=A1=C4=8D?= +Date: Tue, 23 Jul 2024 16:25:19 +0200 +Subject: ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Vokáč + +commit 8512fbb64b0e599412da661412d10d4ba1cb003c upstream. + +On the imx6dl-yapp4 revision based boards, the RGB LED is not driven +directly by the LP5562 driver but through FET transistors. Hence the LED +current is not determined by the driver but by the LED series resistors. + +On the imx6dl-yapp43 revision based boards, we removed the FET transistors +to drive the LED directly from the LP5562 but forgot to tune the output +current to match the previous HW design. + +Set the LED current on imx6dl-yapp43 based boards to the same values +measured on the imx6dl-yapp4 boards and limit the maximum current to 20mA. + +Fixes: 7da4734751e0 ("ARM: dts: imx6dl-yapp43: Add support for new HW revision of the IOTA board") +Cc: +Signed-off-by: Michal Vokáč +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi +@@ -274,24 +274,24 @@ + + led@0 { + chan-name = "R"; +- led-cur = /bits/ 8 <0x20>; +- max-cur = /bits/ 8 <0x60>; ++ led-cur = /bits/ 8 <0x6e>; ++ max-cur = /bits/ 8 <0xc8>; + reg = <0>; + color = ; + }; + + led@1 { + chan-name = "G"; +- led-cur = /bits/ 8 <0x20>; +- max-cur = /bits/ 8 <0x60>; ++ led-cur = /bits/ 8 <0xbe>; ++ max-cur = /bits/ 8 <0xc8>; + reg = <1>; + color = ; + }; + + led@2 { + chan-name = "B"; +- led-cur = /bits/ 8 <0x20>; +- max-cur = /bits/ 8 <0x60>; ++ led-cur = /bits/ 8 <0xbe>; ++ max-cur = /bits/ 8 <0xc8>; + reg = <2>; + color = ; + }; diff --git a/queue-6.10/arm64-dts-qcom-x1e80100-add-missing-pcie-minimum-opp.patch b/queue-6.10/arm64-dts-qcom-x1e80100-add-missing-pcie-minimum-opp.patch new file mode 100644 index 00000000000..851e19e2dcb --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-x1e80100-add-missing-pcie-minimum-opp.patch @@ -0,0 +1,42 @@ +From 98abf2fbd179017833c38edc9f3b587c69d07e2a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Jul 2024 11:42:44 +0200 +Subject: arm64: dts: qcom: x1e80100: add missing PCIe minimum OPP + +From: Johan Hovold + +commit 98abf2fbd179017833c38edc9f3b587c69d07e2a upstream. + +Add the missing PCIe CX performance level votes to avoid relying on +other drivers (e.g. USB) to maintain the nominal performance level +required for Gen3 speeds. + +Fixes: 5eb83fc10289 ("arm64: dts: qcom: x1e80100: Add PCIe nodes") +Cc: stable@vger.kernel.org # 6.9 +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240722094249.26471-4-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi ++++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi +@@ -2814,6 +2814,7 @@ + "link_down"; + + power-domains = <&gcc GCC_PCIE_6A_GDSC>; ++ required-opps = <&rpmhpd_opp_nom>; + + phys = <&pcie6a_phy>; + phy-names = "pciephy"; +@@ -2935,6 +2936,7 @@ + "link_down"; + + power-domains = <&gcc GCC_PCIE_4_GDSC>; ++ required-opps = <&rpmhpd_opp_nom>; + + phys = <&pcie4_phy>; + phy-names = "pciephy"; diff --git a/queue-6.10/arm64-dts-qcom-x1e80100-crd-fix-pcie4-phy-supply.patch b/queue-6.10/arm64-dts-qcom-x1e80100-crd-fix-pcie4-phy-supply.patch new file mode 100644 index 00000000000..8c48d6cb777 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-x1e80100-crd-fix-pcie4-phy-supply.patch @@ -0,0 +1,33 @@ +From 30f593fa0088b89f479f7358640687b3cbca93d4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Jul 2024 11:42:42 +0200 +Subject: arm64: dts: qcom: x1e80100-crd: fix PCIe4 PHY supply + +From: Johan Hovold + +commit 30f593fa0088b89f479f7358640687b3cbca93d4 upstream. + +The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j). + +Fixes: d7e03cce0400 ("arm64: dts: qcom: x1e80100-crd: Enable more support") +Cc: stable@vger.kernel.org # 6.9 +Signed-off-by: Johan Hovold +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20240722094249.26471-2-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/qcom/x1e80100-crd.dts ++++ b/arch/arm64/boot/dts/qcom/x1e80100-crd.dts +@@ -648,7 +648,7 @@ + }; + + &pcie4_phy { +- vdda-phy-supply = <&vreg_l3j_0p8>; ++ vdda-phy-supply = <&vreg_l3i_0p8>; + vdda-pll-supply = <&vreg_l3e_1p2>; + + status = "okay"; diff --git a/queue-6.10/arm64-dts-qcom-x1e80100-fix-pcie-domain-numbers.patch b/queue-6.10/arm64-dts-qcom-x1e80100-fix-pcie-domain-numbers.patch new file mode 100644 index 00000000000..b1a4c01a811 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-x1e80100-fix-pcie-domain-numbers.patch @@ -0,0 +1,43 @@ +From f8fa1f2f6412bffa71972f9506b72992d0e6e485 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Jul 2024 11:42:43 +0200 +Subject: arm64: dts: qcom: x1e80100: fix PCIe domain numbers + +From: Johan Hovold + +commit f8fa1f2f6412bffa71972f9506b72992d0e6e485 upstream. + +The current PCIe domain numbers are off by one and do not match the +numbers that the UEFI firmware (and Windows) uses. + +Fixes: 5eb83fc10289 ("arm64: dts: qcom: x1e80100: Add PCIe nodes") +Cc: stable@vger.kernel.org # 6.9 +Reviewed-by: Konrad Dybcio +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20240722094249.26471-3-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/x1e80100.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi ++++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi +@@ -2756,7 +2756,7 @@ + + dma-coherent; + +- linux,pci-domain = <7>; ++ linux,pci-domain = <6>; + num-lanes = <2>; + + interrupts = , +@@ -2878,7 +2878,7 @@ + + dma-coherent; + +- linux,pci-domain = <5>; ++ linux,pci-domain = <4>; + num-lanes = <2>; + + interrupts = , diff --git a/queue-6.10/arm64-dts-qcom-x1e80100-qcp-fix-pcie4-phy-supply.patch b/queue-6.10/arm64-dts-qcom-x1e80100-qcp-fix-pcie4-phy-supply.patch new file mode 100644 index 00000000000..a8247ccc44f --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-x1e80100-qcp-fix-pcie4-phy-supply.patch @@ -0,0 +1,35 @@ +From f03dd49f884f428ba71efe23383ff842f4f15e0e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Jul 2024 11:54:48 +0200 +Subject: arm64: dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply + +From: Johan Hovold + +commit f03dd49f884f428ba71efe23383ff842f4f15e0e upstream. + +The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j) on the CRD so assume +the same applies to the QCP. + +Fixes: f9a9c11471da ("arm64: dts: qcom: x1e80100-qcp: Enable more support") +Cc: stable@vger.kernel.org # 6.9 +Signed-off-by: Johan Hovold +Reviewed-by: Konrad Dybcio +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20240722095459.27437-2-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts ++++ b/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts +@@ -459,7 +459,7 @@ + }; + + &pcie4_phy { +- vdda-phy-supply = <&vreg_l3j_0p8>; ++ vdda-phy-supply = <&vreg_l3i_0p8>; + vdda-pll-supply = <&vreg_l3e_1p2>; + + status = "okay"; diff --git a/queue-6.10/cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch b/queue-6.10/cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch new file mode 100644 index 00000000000..de2781fb50d --- /dev/null +++ b/queue-6.10/cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch @@ -0,0 +1,33 @@ +From 0b00583ecacb0b51712a5ecd34cf7e6684307c67 Mon Sep 17 00:00:00 2001 +From: Ian Ray +Date: Wed, 14 Aug 2024 10:29:05 +0300 +Subject: cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller + +From: Ian Ray + +commit 0b00583ecacb0b51712a5ecd34cf7e6684307c67 upstream. + +USB_DEVICE(0x1901, 0x0006) may send data before cdc_acm is ready, which +may be misinterpreted in the default N_TTY line discipline. + +Signed-off-by: Ian Ray +Acked-by: Oliver Neuku +Cc: stable +Link: https://lore.kernel.org/r/20240814072905.2501-1-ian.ray@gehealthcare.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1761,6 +1761,9 @@ static const struct usb_device_id acm_id + { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */ + .driver_info = SINGLE_RX_URB, + }, ++ { USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */ ++ .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */ ++ }, + { USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, diff --git a/queue-6.10/dt-bindings-usb-microchip-usb2514-fix-reference-usb-device-schema.patch b/queue-6.10/dt-bindings-usb-microchip-usb2514-fix-reference-usb-device-schema.patch new file mode 100644 index 00000000000..034dc200bba --- /dev/null +++ b/queue-6.10/dt-bindings-usb-microchip-usb2514-fix-reference-usb-device-schema.patch @@ -0,0 +1,48 @@ +From 5b235693ed2a1e4963625717a1598becf97759cc Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Thu, 15 Aug 2024 13:31:31 +0200 +Subject: dt-bindings: usb: microchip,usb2514: Fix reference USB device schema + +From: Alexander Stein + +commit 5b235693ed2a1e4963625717a1598becf97759cc upstream. + +An USB hub is not a HCD, but an USB device. Fix the referenced schema +accordingly. + +Fixes: bfbf2e4b77e2 ("dt-bindings: usb: Document the Microchip USB2514 hub") +Cc: stable@vger.kernel.org +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20240815113132.372542-1-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/usb/microchip,usb2514.yaml | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/usb/microchip,usb2514.yaml ++++ b/Documentation/devicetree/bindings/usb/microchip,usb2514.yaml +@@ -10,7 +10,7 @@ maintainers: + - Fabio Estevam + + allOf: +- - $ref: usb-hcd.yaml# ++ - $ref: usb-device.yaml# + + properties: + compatible: +@@ -35,6 +35,13 @@ required: + - compatible + - reg + ++patternProperties: ++ "^.*@[0-9a-f]{1,2}$": ++ description: The hard wired USB devices ++ type: object ++ $ref: /schemas/usb/usb-device.yaml ++ additionalProperties: true ++ + unevaluatedProperties: false + + examples: diff --git a/queue-6.10/firmware-qcom-scm-mark-get_wq_ctx-as-atomic-call.patch b/queue-6.10/firmware-qcom-scm-mark-get_wq_ctx-as-atomic-call.patch new file mode 100644 index 00000000000..fb2a3c7c5c2 --- /dev/null +++ b/queue-6.10/firmware-qcom-scm-mark-get_wq_ctx-as-atomic-call.patch @@ -0,0 +1,41 @@ +From 9960085a3a82c58d3323c1c20b991db6045063b0 Mon Sep 17 00:00:00 2001 +From: Murali Nalajala +Date: Wed, 14 Aug 2024 15:32:44 -0700 +Subject: firmware: qcom: scm: Mark get_wq_ctx() as atomic call + +From: Murali Nalajala + +commit 9960085a3a82c58d3323c1c20b991db6045063b0 upstream. + +Currently get_wq_ctx() is wrongly configured as a standard call. When two +SMC calls are in sleep and one SMC wakes up, it calls get_wq_ctx() to +resume the corresponding sleeping thread. But if get_wq_ctx() is +interrupted, goes to sleep and another SMC call is waiting to be allocated +a waitq context, it leads to a deadlock. + +To avoid this get_wq_ctx() must be an atomic call and can't be a standard +SMC call. Hence mark get_wq_ctx() as a fast call. + +Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic") +Cc: stable@vger.kernel.org +Signed-off-by: Murali Nalajala +Signed-off-by: Unnathi Chalicheemala +Reviewed-by: Elliot Berman +Link: https://lore.kernel.org/r/20240814223244.40081-1-quic_uchalich@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/qcom/qcom_scm-smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firmware/qcom/qcom_scm-smc.c ++++ b/drivers/firmware/qcom/qcom_scm-smc.c +@@ -71,7 +71,7 @@ int scm_get_wq_ctx(u32 *wq_ctx, u32 *fla + struct arm_smccc_res get_wq_res; + struct arm_smccc_args get_wq_ctx = {0}; + +- get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL, ++ get_wq_ctx.args[0] = ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, + ARM_SMCCC_SMC_64, ARM_SMCCC_OWNER_SIP, + SCM_SMC_FNID(QCOM_SCM_SVC_WAITQ, QCOM_SCM_WAITQ_GET_WQ_CTX)); + diff --git a/queue-6.10/scsi-sd-ignore-command-synchronize-cache-error-if-format-in-progress.patch b/queue-6.10/scsi-sd-ignore-command-synchronize-cache-error-if-format-in-progress.patch new file mode 100644 index 00000000000..a56c190048d --- /dev/null +++ b/queue-6.10/scsi-sd-ignore-command-synchronize-cache-error-if-format-in-progress.patch @@ -0,0 +1,62 @@ +From 4f9eedfa27ae5806ed10906bcceee7bae49c8941 Mon Sep 17 00:00:00 2001 +From: Yihang Li +Date: Mon, 19 Aug 2024 17:09:34 +0800 +Subject: scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress + +From: Yihang Li + +commit 4f9eedfa27ae5806ed10906bcceee7bae49c8941 upstream. + +If formatting a suspended disk (such as formatting with different DIF +type), the disk will be resuming first, and then the format command will +submit to the disk through SG_IO ioctl. + +When the disk is processing the format command, the system does not +submit other commands to the disk. Therefore, the system attempts to +suspend the disk again and sends the SYNCHRONIZE CACHE command. However, +the SYNCHRONIZE CACHE command will fail because the disk is in the +formatting process. This will cause the runtime_status of the disk to +error and it is difficult for user to recover it. Error info like: + +[ 669.925325] sd 6:0:6:0: [sdg] Synchronizing SCSI cache +[ 670.202371] sd 6:0:6:0: [sdg] Synchronize Cache(10) failed: Result: hostbyte=0x00 driverbyte=DRIVER_OK +[ 670.216300] sd 6:0:6:0: [sdg] Sense Key : 0x2 [current] +[ 670.221860] sd 6:0:6:0: [sdg] ASC=0x4 ASCQ=0x4 + +To solve the issue, ignore the error and return success/0 when format is +in progress. + +Cc: stable@vger.kernel.org +Signed-off-by: Yihang Li +Link: https://lore.kernel.org/r/20240819090934.2130592-1-liyihang9@huawei.com +Reviewed-by: Bart Van Assche +Reviewed-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/sd.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1711,13 +1711,15 @@ static int sd_sync_cache(struct scsi_dis + (sshdr.asc == 0x74 && sshdr.ascq == 0x71)) /* drive is password locked */ + /* this is no error here */ + return 0; ++ + /* +- * This drive doesn't support sync and there's not much +- * we can do because this is called during shutdown +- * or suspend so just return success so those operations +- * can proceed. ++ * If a format is in progress or if the drive does not ++ * support sync, there is not much we can do because ++ * this is called during shutdown or suspend so just ++ * return success so those operations can proceed. + */ +- if (sshdr.sense_key == ILLEGAL_REQUEST) ++ if ((sshdr.asc == 0x04 && sshdr.ascq == 0x04) || ++ sshdr.sense_key == ILLEGAL_REQUEST) + return 0; + } + diff --git a/queue-6.10/series b/queue-6.10/series index 1eb1c339c75..82036f417fa 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -112,3 +112,28 @@ net-busy-poll-use-ktime_get_ns-instead-of-local_cloc.patch nfc-pn533-add-poll-mod-list-filling-check.patch drm-xe-hwmon-fix-write_i1-param-from-u32-to-u16.patch io_uring-kbuf-return-correct-iovec-count-from-classi.patch +soc-qcom-cmd-db-map-shared-memory-as-wc-not-wb.patch +soc-qcom-pmic_glink-actually-communicate-when-remote-goes-down.patch +soc-qcom-pmic_glink-fix-race-during-initialization.patch +cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch +usb-typec-fsa4480-relax-chip_id-check.patch +firmware-qcom-scm-mark-get_wq_ctx-as-atomic-call.patch +scsi-sd-ignore-command-synchronize-cache-error-if-format-in-progress.patch +dt-bindings-usb-microchip-usb2514-fix-reference-usb-device-schema.patch +usb-serial-option-add-meig-smart-srm825l.patch +usb-gadget-uvc-queue-pump-work-in-uvcg_video_enable.patch +arm64-dts-qcom-x1e80100-crd-fix-pcie4-phy-supply.patch +arm64-dts-qcom-x1e80100-qcp-fix-pcie4-phy-supply.patch +arm64-dts-qcom-x1e80100-add-missing-pcie-minimum-opp.patch +arm64-dts-qcom-x1e80100-fix-pcie-domain-numbers.patch +arm-dts-imx6dl-yapp43-increase-led-current-to-match-the-yapp4-hw-design.patch +usb-dwc3-ep0-don-t-reset-resource-alloc-flag-including-ep0.patch +usb-dwc3-xilinx-add-missing-depopulate-in-probe-error-path.patch +usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch +usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch +usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch +usb-dwc3-st-add-missing-depopulate-in-probe-error-path.patch +usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch +usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch +usb-cdnsp-fix-for-link-trb-with-tc.patch +usb-typec-ucsi-move-unregister-out-of-atomic-section.patch diff --git a/queue-6.10/soc-qcom-cmd-db-map-shared-memory-as-wc-not-wb.patch b/queue-6.10/soc-qcom-cmd-db-map-shared-memory-as-wc-not-wb.patch new file mode 100644 index 00000000000..fb3b5b0e6f1 --- /dev/null +++ b/queue-6.10/soc-qcom-cmd-db-map-shared-memory-as-wc-not-wb.patch @@ -0,0 +1,50 @@ +From f9bb896eab221618927ae6a2f1d566567999839d Mon Sep 17 00:00:00 2001 +From: Volodymyr Babchuk +Date: Thu, 18 Jul 2024 11:33:23 +0530 +Subject: soc: qcom: cmd-db: Map shared memory as WC, not WB + +From: Volodymyr Babchuk + +commit f9bb896eab221618927ae6a2f1d566567999839d upstream. + +Linux does not write into cmd-db region. This region of memory is write +protected by XPU. XPU may sometime falsely detect clean cache eviction +as "write" into the write protected region leading to secure interrupt +which causes an endless loop somewhere in Trust Zone. + +The only reason it is working right now is because Qualcomm Hypervisor +maps the same region as Non-Cacheable memory in Stage 2 translation +tables. The issue manifests if we want to use another hypervisor (like +Xen or KVM), which does not know anything about those specific mappings. + +Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC +removes dependency on correct mappings in Stage 2 tables. This patch +fixes the issue by updating the mapping to MEMREMAP_WC. + +I tested this on SA8155P with Xen. + +Fixes: 312416d9171a ("drivers: qcom: add command DB driver") +Cc: stable@vger.kernel.org # 5.4+ +Signed-off-by: Volodymyr Babchuk +Tested-by: Nikita Travkin # sc7180 WoA in EL2 +Signed-off-by: Maulik Shah +Tested-by: Pavankumar Kondeti +Reviewed-by: Caleb Connolly +Link: https://lore.kernel.org/r/20240718-cmd_db_uncached-v2-1-f6cf53164c90@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/cmd-db.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/qcom/cmd-db.c ++++ b/drivers/soc/qcom/cmd-db.c +@@ -349,7 +349,7 @@ static int cmd_db_dev_probe(struct platf + return -EINVAL; + } + +- cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WB); ++ cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WC); + if (!cmd_db_header) { + ret = -ENOMEM; + cmd_db_header = NULL; diff --git a/queue-6.10/soc-qcom-pmic_glink-actually-communicate-when-remote-goes-down.patch b/queue-6.10/soc-qcom-pmic_glink-actually-communicate-when-remote-goes-down.patch new file mode 100644 index 00000000000..b33ac949bdb --- /dev/null +++ b/queue-6.10/soc-qcom-pmic_glink-actually-communicate-when-remote-goes-down.patch @@ -0,0 +1,44 @@ +From ad51126037a43c05f5f4af5eb262734e3e88ca59 Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Tue, 20 Aug 2024 13:29:32 -0700 +Subject: soc: qcom: pmic_glink: Actually communicate when remote goes down + +From: Bjorn Andersson + +commit ad51126037a43c05f5f4af5eb262734e3e88ca59 upstream. + +When the pmic_glink state is UP and we either receive a protection- +domain (PD) notification indicating that the PD is going down, or that +the whole remoteproc is going down, it's expected that the pmic_glink +client instances are notified that their function has gone DOWN. + +This is not what the code does, which results in the client state either +not updating, or being wrong in many cases. So let's fix the conditions. + +Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") +Cc: stable@vger.kernel.org +Reviewed-by: Heikki Krogerus +Reviewed-by: Neil Armstrong +Reviewed-by: Dmitry Baryshkov +Tested-by: Amit Pundir +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-3-eec53c750a04@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/pmic_glink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -175,7 +175,7 @@ static void pmic_glink_state_notify_clie + if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept) + new_state = SERVREG_SERVICE_STATE_UP; + } else { +- if (pg->pdr_state == SERVREG_SERVICE_STATE_UP && pg->ept) ++ if (pg->pdr_state == SERVREG_SERVICE_STATE_DOWN || !pg->ept) + new_state = SERVREG_SERVICE_STATE_DOWN; + } + diff --git a/queue-6.10/soc-qcom-pmic_glink-fix-race-during-initialization.patch b/queue-6.10/soc-qcom-pmic_glink-fix-race-during-initialization.patch new file mode 100644 index 00000000000..abeb8f6e242 --- /dev/null +++ b/queue-6.10/soc-qcom-pmic_glink-fix-race-during-initialization.patch @@ -0,0 +1,221 @@ +From 3568affcddd68743e25aa3ec1647d9b82797757b Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Tue, 20 Aug 2024 13:29:30 -0700 +Subject: soc: qcom: pmic_glink: Fix race during initialization + +From: Bjorn Andersson + +commit 3568affcddd68743e25aa3ec1647d9b82797757b upstream. + +As pointed out by Stephen Boyd it is possible that during initialization +of the pmic_glink child drivers, the protection-domain notifiers fires, +and the associated work is scheduled, before the client registration +returns and as a result the local "client" pointer has been initialized. + +The outcome of this is a NULL pointer dereference as the "client" +pointer is blindly dereferenced. + +Timeline provided by Stephen: + CPU0 CPU1 + ---- ---- + ucsi->client = NULL; + devm_pmic_glink_register_client() + client->pdr_notify(client->priv, pg->client_state) + pmic_glink_ucsi_pdr_notify() + schedule_work(&ucsi->register_work) + + pmic_glink_ucsi_register() + ucsi_register() + pmic_glink_ucsi_read_version() + pmic_glink_ucsi_read() + pmic_glink_ucsi_read() + pmic_glink_send(ucsi->client) + + ucsi->client = client // Too late! + +This code is identical across the altmode, battery manager and usci +child drivers. + +Resolve this by splitting the allocation of the "client" object and the +registration thereof into two operations. + +This only happens if the protection domain registry is populated at the +time of registration, which by the introduction of commit '1ebcde047c54 +("soc: qcom: add pd-mapper implementation")' became much more likely. + +Reported-by: Amit Pundir +Closes: https://lore.kernel.org/all/CAMi1Hd2_a7TjA7J9ShrAbNOd_CoZ3D87twmO5t+nZxC9sX18tA@mail.gmail.com/ +Reported-by: Johan Hovold +Closes: https://lore.kernel.org/all/ZqiyLvP0gkBnuekL@hovoldconsulting.com/ +Reported-by: Stephen Boyd +Closes: https://lore.kernel.org/all/CAE-0n52JgfCBWiFQyQWPji8cq_rCsviBpW-m72YitgNfdaEhQg@mail.gmail.com/ +Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") +Cc: stable@vger.kernel.org +Reviewed-by: Heikki Krogerus +Reviewed-by: Neil Armstrong +Tested-by: Amit Pundir +Reviewed-by: Johan Hovold +Acked-by: Sebastian Reichel +Tested-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-1-eec53c750a04@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/qcom_battmgr.c | 16 ++++++++++------ + drivers/soc/qcom/pmic_glink.c | 28 ++++++++++++++++++---------- + drivers/soc/qcom/pmic_glink_altmode.c | 17 +++++++++++------ + drivers/usb/typec/ucsi/ucsi_glink.c | 16 ++++++++++------ + include/linux/soc/qcom/pmic_glink.h | 11 ++++++----- + 5 files changed, 55 insertions(+), 33 deletions(-) + +--- a/drivers/power/supply/qcom_battmgr.c ++++ b/drivers/power/supply/qcom_battmgr.c +@@ -1384,12 +1384,16 @@ static int qcom_battmgr_probe(struct aux + "failed to register wireless charing power supply\n"); + } + +- battmgr->client = devm_pmic_glink_register_client(dev, +- PMIC_GLINK_OWNER_BATTMGR, +- qcom_battmgr_callback, +- qcom_battmgr_pdr_notify, +- battmgr); +- return PTR_ERR_OR_ZERO(battmgr->client); ++ battmgr->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_BATTMGR, ++ qcom_battmgr_callback, ++ qcom_battmgr_pdr_notify, ++ battmgr); ++ if (IS_ERR(battmgr->client)) ++ return PTR_ERR(battmgr->client); ++ ++ pmic_glink_client_register(battmgr->client); ++ ++ return 0; + } + + static const struct auxiliary_device_id qcom_battmgr_id_table[] = { +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -66,15 +66,14 @@ static void _devm_pmic_glink_release_cli + spin_unlock_irqrestore(&pg->client_lock, flags); + } + +-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, +- unsigned int id, +- void (*cb)(const void *, size_t, void *), +- void (*pdr)(void *, int), +- void *priv) ++struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev, ++ unsigned int id, ++ void (*cb)(const void *, size_t, void *), ++ void (*pdr)(void *, int), ++ void *priv) + { + struct pmic_glink_client *client; + struct pmic_glink *pg = dev_get_drvdata(dev->parent); +- unsigned long flags; + + client = devres_alloc(_devm_pmic_glink_release_client, sizeof(*client), GFP_KERNEL); + if (!client) +@@ -85,6 +84,18 @@ struct pmic_glink_client *devm_pmic_glin + client->cb = cb; + client->pdr_notify = pdr; + client->priv = priv; ++ INIT_LIST_HEAD(&client->node); ++ ++ devres_add(dev, client); ++ ++ return client; ++} ++EXPORT_SYMBOL_GPL(devm_pmic_glink_client_alloc); ++ ++void pmic_glink_client_register(struct pmic_glink_client *client) ++{ ++ struct pmic_glink *pg = client->pg; ++ unsigned long flags; + + mutex_lock(&pg->state_lock); + spin_lock_irqsave(&pg->client_lock, flags); +@@ -95,11 +106,8 @@ struct pmic_glink_client *devm_pmic_glin + spin_unlock_irqrestore(&pg->client_lock, flags); + mutex_unlock(&pg->state_lock); + +- devres_add(dev, client); +- +- return client; + } +-EXPORT_SYMBOL_GPL(devm_pmic_glink_register_client); ++EXPORT_SYMBOL_GPL(pmic_glink_client_register); + + int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len) + { +--- a/drivers/soc/qcom/pmic_glink_altmode.c ++++ b/drivers/soc/qcom/pmic_glink_altmode.c +@@ -520,12 +520,17 @@ static int pmic_glink_altmode_probe(stru + return ret; + } + +- altmode->client = devm_pmic_glink_register_client(dev, +- altmode->owner_id, +- pmic_glink_altmode_callback, +- pmic_glink_altmode_pdr_notify, +- altmode); +- return PTR_ERR_OR_ZERO(altmode->client); ++ altmode->client = devm_pmic_glink_client_alloc(dev, ++ altmode->owner_id, ++ pmic_glink_altmode_callback, ++ pmic_glink_altmode_pdr_notify, ++ altmode); ++ if (IS_ERR(altmode->client)) ++ return PTR_ERR(altmode->client); ++ ++ pmic_glink_client_register(altmode->client); ++ ++ return 0; + } + + static const struct auxiliary_device_id pmic_glink_altmode_id_table[] = { +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -395,12 +395,16 @@ static int pmic_glink_ucsi_probe(struct + ucsi->port_orientation[port] = desc; + } + +- ucsi->client = devm_pmic_glink_register_client(dev, +- PMIC_GLINK_OWNER_USBC, +- pmic_glink_ucsi_callback, +- pmic_glink_ucsi_pdr_notify, +- ucsi); +- return PTR_ERR_OR_ZERO(ucsi->client); ++ ucsi->client = devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_USBC, ++ pmic_glink_ucsi_callback, ++ pmic_glink_ucsi_pdr_notify, ++ ucsi); ++ if (IS_ERR(ucsi->client)) ++ return PTR_ERR(ucsi->client); ++ ++ pmic_glink_client_register(ucsi->client); ++ ++ return 0; + } + + static void pmic_glink_ucsi_remove(struct auxiliary_device *adev) +--- a/include/linux/soc/qcom/pmic_glink.h ++++ b/include/linux/soc/qcom/pmic_glink.h +@@ -23,10 +23,11 @@ struct pmic_glink_hdr { + + int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len); + +-struct pmic_glink_client *devm_pmic_glink_register_client(struct device *dev, +- unsigned int id, +- void (*cb)(const void *, size_t, void *), +- void (*pdr)(void *, int), +- void *priv); ++struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev, ++ unsigned int id, ++ void (*cb)(const void *, size_t, void *), ++ void (*pdr)(void *, int), ++ void *priv); ++void pmic_glink_client_register(struct pmic_glink_client *client); + + #endif diff --git a/queue-6.10/usb-cdnsp-fix-for-link-trb-with-tc.patch b/queue-6.10/usb-cdnsp-fix-for-link-trb-with-tc.patch new file mode 100644 index 00000000000..827c5adf4a1 --- /dev/null +++ b/queue-6.10/usb-cdnsp-fix-for-link-trb-with-tc.patch @@ -0,0 +1,91 @@ +From 740f2e2791b98e47288b3814c83a3f566518fed2 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Wed, 21 Aug 2024 06:07:42 +0000 +Subject: usb: cdnsp: fix for Link TRB with TC + +From: Pawel Laszczak + +commit 740f2e2791b98e47288b3814c83a3f566518fed2 upstream. + +Stop Endpoint command on LINK TRB with TC bit set to 1 causes that +internal cycle bit can have incorrect state after command complete. +In consequence empty transfer ring can be incorrectly detected +when EP is resumed. +NOP TRB before LINK TRB avoid such scenario. Stop Endpoint command +is then on NOP TRB and internal cycle bit is not changed and have +correct value. + +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +cc: +Signed-off-by: Pawel Laszczak +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/PH7PR07MB953878279F375CCCE6C6F40FDD8E2@PH7PR07MB9538.namprd07.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdnsp-gadget.h | 3 +++ + drivers/usb/cdns3/cdnsp-ring.c | 28 ++++++++++++++++++++++++++++ + 2 files changed, 31 insertions(+) + +--- a/drivers/usb/cdns3/cdnsp-gadget.h ++++ b/drivers/usb/cdns3/cdnsp-gadget.h +@@ -811,6 +811,7 @@ struct cdnsp_stream_info { + * generate Missed Service Error Event. + * Set skip flag when receive a Missed Service Error Event and + * process the missed tds on the endpoint ring. ++ * @wa1_nop_trb: hold pointer to NOP trb. + */ + struct cdnsp_ep { + struct usb_ep endpoint; +@@ -838,6 +839,8 @@ struct cdnsp_ep { + #define EP_UNCONFIGURED BIT(7) + + bool skip; ++ union cdnsp_trb *wa1_nop_trb; ++ + }; + + /** +--- a/drivers/usb/cdns3/cdnsp-ring.c ++++ b/drivers/usb/cdns3/cdnsp-ring.c +@@ -1905,6 +1905,23 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev + return ret; + + /* ++ * workaround 1: STOP EP command on LINK TRB with TC bit set to 1 ++ * causes that internal cycle bit can have incorrect state after ++ * command complete. In consequence empty transfer ring can be ++ * incorrectly detected when EP is resumed. ++ * NOP TRB before LINK TRB avoid such scenario. STOP EP command is ++ * then on NOP TRB and internal cycle bit is not changed and have ++ * correct value. ++ */ ++ if (pep->wa1_nop_trb) { ++ field = le32_to_cpu(pep->wa1_nop_trb->trans_event.flags); ++ field ^= TRB_CYCLE; ++ ++ pep->wa1_nop_trb->trans_event.flags = cpu_to_le32(field); ++ pep->wa1_nop_trb = NULL; ++ } ++ ++ /* + * Don't give the first TRB to the hardware (by toggling the cycle bit) + * until we've finished creating all the other TRBs. The ring's cycle + * state may change as we enqueue the other TRBs, so save it too. +@@ -1999,6 +2016,17 @@ int cdnsp_queue_bulk_tx(struct cdnsp_dev + send_addr = addr; + } + ++ if (cdnsp_trb_is_link(ring->enqueue + 1)) { ++ field = TRB_TYPE(TRB_TR_NOOP) | TRB_IOC; ++ if (!ring->cycle_state) ++ field |= TRB_CYCLE; ++ ++ pep->wa1_nop_trb = ring->enqueue; ++ ++ cdnsp_queue_trb(pdev, ring, 0, 0x0, 0x0, ++ TRB_INTR_TARGET(0), field); ++ } ++ + cdnsp_check_trb_math(preq, enqd_len); + ret = cdnsp_giveback_first_trb(pdev, pep, preq->request.stream_id, + start_cycle, start_trb); diff --git a/queue-6.10/usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch b/queue-6.10/usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch new file mode 100644 index 00000000000..535c49b922e --- /dev/null +++ b/queue-6.10/usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch @@ -0,0 +1,38 @@ +From 0497a356d3c498221eb0c1edc1e8985816092f12 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Tue, 20 Aug 2024 08:21:19 +0000 +Subject: usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function + +From: Pawel Laszczak + +commit 0497a356d3c498221eb0c1edc1e8985816092f12 upstream. + +Patch fixes the incorrect "stream_id" table index instead of +"ep_index" used in cdnsp_get_hw_deq function. + +Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") +cc: stable@vger.kernel.org +Signed-off-by: Pawel Laszczak +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/PH7PR07MB95381F2182688811D5C711CEDD8D2@PH7PR07MB9538.namprd07.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdnsp-ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c +index 02f297f5637d..a60c0cb991cd 100644 +--- a/drivers/usb/cdns3/cdnsp-ring.c ++++ b/drivers/usb/cdns3/cdnsp-ring.c +@@ -402,7 +402,7 @@ static u64 cdnsp_get_hw_deq(struct cdnsp_device *pdev, + struct cdnsp_stream_ctx *st_ctx; + struct cdnsp_ep *pep; + +- pep = &pdev->eps[stream_id]; ++ pep = &pdev->eps[ep_index]; + + if (pep->ep_state & EP_HAS_STREAMS) { + st_ctx = &pep->stream_info.stream_ctx_array[stream_id]; +-- +2.46.0 + diff --git a/queue-6.10/usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch b/queue-6.10/usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch new file mode 100644 index 00000000000..b61fbb0b198 --- /dev/null +++ b/queue-6.10/usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch @@ -0,0 +1,32 @@ +From 3a8839bbb86da7968a792123ed2296d063871a52 Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Tue, 20 Aug 2024 19:01:27 +0800 +Subject: usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() + +From: Zijun Hu + +commit 3a8839bbb86da7968a792123ed2296d063871a52 upstream. + +Device attribute group @usb3_hardware_lpm_attr_group is merged by +add_power_attributes(), but it is not unmerged explicitly, fixed by +unmerging it in remove_power_attributes(). + +Fixes: 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM") +Cc: stable@vger.kernel.org +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20240820-sysfs_fix-v2-1-a9441487077e@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -670,6 +670,7 @@ static int add_power_attributes(struct d + + static void remove_power_attributes(struct device *dev) + { ++ sysfs_unmerge_group(&dev->kobj, &usb3_hardware_lpm_attr_group); + sysfs_unmerge_group(&dev->kobj, &usb2_hardware_lpm_attr_group); + sysfs_unmerge_group(&dev->kobj, &power_attr_group); + } diff --git a/queue-6.10/usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch b/queue-6.10/usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch new file mode 100644 index 00000000000..7ebff6faa77 --- /dev/null +++ b/queue-6.10/usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch @@ -0,0 +1,55 @@ +From 14e497183df28c006603cc67fd3797a537eef7b9 Mon Sep 17 00:00:00 2001 +From: Selvarasu Ganesan +Date: Thu, 15 Aug 2024 12:18:31 +0530 +Subject: usb: dwc3: core: Prevent USB core invalid event buffer address access + +From: Selvarasu Ganesan + +commit 14e497183df28c006603cc67fd3797a537eef7b9 upstream. + +This commit addresses an issue where the USB core could access an +invalid event buffer address during runtime suspend, potentially causing +SMMU faults and other memory issues in Exynos platforms. The problem +arises from the following sequence. + 1. In dwc3_gadget_suspend, there is a chance of a timeout when + moving the USB core to the halt state after clearing the + run/stop bit by software. + 2. In dwc3_core_exit, the event buffer is cleared regardless of + the USB core's status, which may lead to an SMMU faults and + other memory issues. if the USB core tries to access the event + buffer address. + +To prevent this hardware quirk on Exynos platforms, this commit ensures +that the event buffer address is not cleared by software when the USB +core is active during runtime suspend by checking its status before +clearing the buffer address. + +Cc: stable +Signed-off-by: Selvarasu Ganesan +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20240815064836.1491-1-selvarasu.g@samsung.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -559,9 +559,17 @@ int dwc3_event_buffers_setup(struct dwc3 + void dwc3_event_buffers_cleanup(struct dwc3 *dwc) + { + struct dwc3_event_buffer *evt; ++ u32 reg; + + if (!dwc->ev_buf) + return; ++ /* ++ * Exynos platforms may not be able to access event buffer if the ++ * controller failed to halt on dwc3_core_exit(). ++ */ ++ reg = dwc3_readl(dwc->regs, DWC3_DSTS); ++ if (!(reg & DWC3_DSTS_DEVCTRLHLT)) ++ return; + + evt = dwc->ev_buf; + diff --git a/queue-6.10/usb-dwc3-ep0-don-t-reset-resource-alloc-flag-including-ep0.patch b/queue-6.10/usb-dwc3-ep0-don-t-reset-resource-alloc-flag-including-ep0.patch new file mode 100644 index 00000000000..1f8722daada --- /dev/null +++ b/queue-6.10/usb-dwc3-ep0-don-t-reset-resource-alloc-flag-including-ep0.patch @@ -0,0 +1,47 @@ +From 72fca8371f205d654f95b09cd023a71fd5307041 Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Thu, 15 Aug 2024 08:40:29 +0200 +Subject: usb: dwc3: ep0: Don't reset resource alloc flag (including ep0) + +From: Michael Grzeschik + +commit 72fca8371f205d654f95b09cd023a71fd5307041 upstream. + +The DWC3_EP_RESOURCE_ALLOCATED flag ensures that the resource of an +endpoint is only assigned once. Unless the endpoint is reset, don't +clear this flag. Otherwise we may set endpoint resource again, which +prevents the driver from initiate transfer after handling a STALL or +endpoint halt to the control endpoint. + +Commit f2e0eee47038 ("usb: dwc3: ep0: Don't reset resource alloc flag") +was fixing the initial issue, but did this only for physical ep1. Since +the function dwc3_ep0_stall_and_restart is resetting the flags for both +physical endpoints, this also has to be done for ep0. + +Cc: stable@vger.kernel.org +Fixes: b311048c174d ("usb: dwc3: gadget: Rewrite endpoint allocation flow") +Acked-by: Thinh Nguyen +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20240814-dwc3hwep0reset-v2-1-29e1d7d923ea@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/ep0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index d96ffbe52039..c9533a99e47c 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -232,7 +232,8 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) + /* stall is always issued on EP0 */ + dep = dwc->eps[0]; + __dwc3_gadget_ep_set_halt(dep, 1, false); +- dep->flags = DWC3_EP_ENABLED; ++ dep->flags &= DWC3_EP_RESOURCE_ALLOCATED; ++ dep->flags |= DWC3_EP_ENABLED; + dwc->delayed_status = false; + + if (!list_empty(&dep->pending_list)) { +-- +2.46.0 + diff --git a/queue-6.10/usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch b/queue-6.10/usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch new file mode 100644 index 00000000000..7c3302f7d22 --- /dev/null +++ b/queue-6.10/usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch @@ -0,0 +1,40 @@ +From 2aa765a43817ec8add990f83c8e54a9a5d87aa9c Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 16 Aug 2024 09:54:08 +0200 +Subject: usb: dwc3: omap: add missing depopulate in probe error path + +From: Krzysztof Kozlowski + +commit 2aa765a43817ec8add990f83c8e54a9a5d87aa9c upstream. + +Depopulate device in probe error paths to fix leak of children +resources. + +Fixes: ee249b455494 ("usb: dwc3: omap: remove IRQ_NOAUTOEN used with shared irq") +Cc: stable@vger.kernel.org +Acked-by: Thinh Nguyen +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20240816075409.23080-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-omap.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -522,11 +522,13 @@ static int dwc3_omap_probe(struct platfo + if (ret) { + dev_err(dev, "failed to request IRQ #%d --> %d\n", + omap->irq, ret); +- goto err1; ++ goto err2; + } + dwc3_omap_enable_irqs(omap); + return 0; + ++err2: ++ of_platform_depopulate(dev); + err1: + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); diff --git a/queue-6.10/usb-dwc3-st-add-missing-depopulate-in-probe-error-path.patch b/queue-6.10/usb-dwc3-st-add-missing-depopulate-in-probe-error-path.patch new file mode 100644 index 00000000000..72f047df438 --- /dev/null +++ b/queue-6.10/usb-dwc3-st-add-missing-depopulate-in-probe-error-path.patch @@ -0,0 +1,51 @@ +From cd4897bfd14f6a5388b21ba45a066541a0425199 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 14 Aug 2024 11:39:57 +0200 +Subject: usb: dwc3: st: add missing depopulate in probe error path + +From: Krzysztof Kozlowski + +commit cd4897bfd14f6a5388b21ba45a066541a0425199 upstream. + +Depopulate device in probe error paths to fix leak of children +resources. + +Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Patrice Chotard +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20240814093957.37940-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-st.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-st.c ++++ b/drivers/usb/dwc3/dwc3-st.c +@@ -266,7 +266,7 @@ static int st_dwc3_probe(struct platform + if (!child_pdev) { + dev_err(dev, "failed to find dwc3 core device\n"); + ret = -ENODEV; +- goto err_node_put; ++ goto depopulate; + } + + dwc3_data->dr_mode = usb_get_dr_mode(&child_pdev->dev); +@@ -282,6 +282,7 @@ static int st_dwc3_probe(struct platform + ret = st_dwc3_drd_init(dwc3_data); + if (ret) { + dev_err(dev, "drd initialisation failed\n"); ++ of_platform_depopulate(dev); + goto undo_softreset; + } + +@@ -291,6 +292,8 @@ static int st_dwc3_probe(struct platform + platform_set_drvdata(pdev, dwc3_data); + return 0; + ++depopulate: ++ of_platform_depopulate(dev); + err_node_put: + of_node_put(child); + undo_softreset: diff --git a/queue-6.10/usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch b/queue-6.10/usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch new file mode 100644 index 00000000000..11a9a070d50 --- /dev/null +++ b/queue-6.10/usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch @@ -0,0 +1,61 @@ +From ddfcfeba891064b88bb844208b43bef2ef970f0c Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 14 Aug 2024 11:39:56 +0200 +Subject: usb: dwc3: st: fix probed platform device ref count on probe error path + +From: Krzysztof Kozlowski + +commit ddfcfeba891064b88bb844208b43bef2ef970f0c upstream. + +The probe function never performs any paltform device allocation, thus +error path "undo_platform_dev_alloc" is entirely bogus. It drops the +reference count from the platform device being probed. If error path is +triggered, this will lead to unbalanced device reference counts and +premature release of device resources, thus possible use-after-free when +releasing remaining devm-managed resources. + +Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Thinh Nguyen +Reviewed-by: Patrice Chotard +Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-st.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-st.c ++++ b/drivers/usb/dwc3/dwc3-st.c +@@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform + dwc3_data->regmap = regmap; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); +- if (!res) { +- ret = -ENXIO; +- goto undo_platform_dev_alloc; +- } ++ if (!res) ++ return -ENXIO; + + dwc3_data->syscfg_reg_off = res->start; + +@@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform + devm_reset_control_get_exclusive(dev, "powerdown"); + if (IS_ERR(dwc3_data->rstc_pwrdn)) { + dev_err(&pdev->dev, "could not get power controller\n"); +- ret = PTR_ERR(dwc3_data->rstc_pwrdn); +- goto undo_platform_dev_alloc; ++ return PTR_ERR(dwc3_data->rstc_pwrdn); + } + + /* Manage PowerDown */ +@@ -300,8 +297,6 @@ undo_softreset: + reset_control_assert(dwc3_data->rstc_rst); + undo_powerdown: + reset_control_assert(dwc3_data->rstc_pwrdn); +-undo_platform_dev_alloc: +- platform_device_put(pdev); + return ret; + } + diff --git a/queue-6.10/usb-dwc3-xilinx-add-missing-depopulate-in-probe-error-path.patch b/queue-6.10/usb-dwc3-xilinx-add-missing-depopulate-in-probe-error-path.patch new file mode 100644 index 00000000000..9a988ca2ef0 --- /dev/null +++ b/queue-6.10/usb-dwc3-xilinx-add-missing-depopulate-in-probe-error-path.patch @@ -0,0 +1,41 @@ +From 16f2a21d9d7e48e1af02654fe3d926c0ce6cb3e5 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 16 Aug 2024 09:54:09 +0200 +Subject: usb: dwc3: xilinx: add missing depopulate in probe error path + +From: Krzysztof Kozlowski + +commit 16f2a21d9d7e48e1af02654fe3d926c0ce6cb3e5 upstream. + +Depopulate device in probe error paths to fix leak of children +resources. + +Fixes: 53b5ff83d893 ("usb: dwc3: xilinx: improve error handling for PM APIs") +Cc: stable@vger.kernel.org +Reviewed-by: Radhey Shyam Pandey +Signed-off-by: Krzysztof Kozlowski +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20240816075409.23080-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-xilinx.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-xilinx.c ++++ b/drivers/usb/dwc3/dwc3-xilinx.c +@@ -298,9 +298,14 @@ static int dwc3_xlnx_probe(struct platfo + goto err_pm_set_suspended; + + pm_suspend_ignore_children(dev, false); +- return pm_runtime_resume_and_get(dev); ++ ret = pm_runtime_resume_and_get(dev); ++ if (ret < 0) ++ goto err_pm_set_suspended; ++ ++ return 0; + + err_pm_set_suspended: ++ of_platform_depopulate(dev); + pm_runtime_set_suspended(dev); + + err_clk_put: diff --git a/queue-6.10/usb-gadget-uvc-queue-pump-work-in-uvcg_video_enable.patch b/queue-6.10/usb-gadget-uvc-queue-pump-work-in-uvcg_video_enable.patch new file mode 100644 index 00000000000..dd4f09f6cfc --- /dev/null +++ b/queue-6.10/usb-gadget-uvc-queue-pump-work-in-uvcg_video_enable.patch @@ -0,0 +1,46 @@ +From b52a07e07dead777517af3cbda851bb2cc157c9d Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Wed, 14 Aug 2024 19:25:37 +0800 +Subject: usb: gadget: uvc: queue pump work in uvcg_video_enable() + +From: Xu Yang + +commit b52a07e07dead777517af3cbda851bb2cc157c9d upstream. + +Since commit "6acba0345b68 usb:gadget:uvc Do not use worker thread to pump +isoc usb requests", pump work could only be queued in uvc_video_complete() +and uvc_v4l2_qbuf(). If VIDIOC_QBUF is executed before VIDIOC_STREAMON, +we can only depend on uvc_video_complete() to queue pump work. However, +this requires some free requests in req_ready list. If req_ready list is +empty all the time, pump work will never be queued and video datas will +never be pumped to usb controller. Actually, this situation could happen +when run uvc-gadget with static image: + +$ ./uvc-gadget -i 1080p.jpg uvc.0 + +When capture image from this device, the user app will always block there. + +The issue is uvc driver has queued video buffer before streamon, but the +req_ready list is empty all the time after streamon. This will queue pump +work in uvcg_video_enable() to fill some request to req_ready list so the +uvc device could work properly. + +Fixes: 6acba0345b68 ("usb:gadget:uvc Do not use worker thread to pump isoc usb requests") +Cc: stable@vger.kernel.org +Signed-off-by: Xu Yang +Link: https://lore.kernel.org/r/20240814112537.2608949-1-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_video.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -753,6 +753,7 @@ int uvcg_video_enable(struct uvc_video * + video->req_int_count = 0; + + uvc_video_ep_queue_initial_requests(video); ++ queue_work(video->async_wq, &video->pump); + + return ret; + } diff --git a/queue-6.10/usb-serial-option-add-meig-smart-srm825l.patch b/queue-6.10/usb-serial-option-add-meig-smart-srm825l.patch new file mode 100644 index 00000000000..eb2381ed902 --- /dev/null +++ b/queue-6.10/usb-serial-option-add-meig-smart-srm825l.patch @@ -0,0 +1,71 @@ +From 9a471de516c35219d1722c13367191ce1f120fe9 Mon Sep 17 00:00:00 2001 +From: ZHANG Yuntian +Date: Sat, 3 Aug 2024 15:46:07 +0800 +Subject: USB: serial: option: add MeiG Smart SRM825L + +From: ZHANG Yuntian + +commit 9a471de516c35219d1722c13367191ce1f120fe9 upstream. + +Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip. + +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2dee ProdID=4d22 Rev= 4.14 +S: Manufacturer=MEIG +S: Product=LTE-A Module +S: SerialNumber=6f345e48 +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: ZHANG Yuntian +Link: https://lore.kernel.org/0041DFA5200EFB1B+20240803074619.563116-1-yt@radxa.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -619,6 +619,8 @@ static void option_instat_callback(struc + + /* MeiG Smart Technology products */ + #define MEIGSMART_VENDOR_ID 0x2dee ++/* MeiG Smart SRM825L based on Qualcomm 315 */ ++#define MEIGSMART_PRODUCT_SRM825L 0x4d22 + /* MeiG Smart SLM320 based on UNISOC UIS8910 */ + #define MEIGSMART_PRODUCT_SLM320 0x4d41 + +@@ -2366,6 +2368,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-6.10/usb-typec-fsa4480-relax-chip_id-check.patch b/queue-6.10/usb-typec-fsa4480-relax-chip_id-check.patch new file mode 100644 index 00000000000..0495f5fc568 --- /dev/null +++ b/queue-6.10/usb-typec-fsa4480-relax-chip_id-check.patch @@ -0,0 +1,44 @@ +From 4f83cae0edb2b13aabb82e8a4852092844d320aa Mon Sep 17 00:00:00 2001 +From: Luca Weiss +Date: Sun, 18 Aug 2024 22:21:01 +0200 +Subject: usb: typec: fsa4480: Relax CHIP_ID check + +From: Luca Weiss + +commit 4f83cae0edb2b13aabb82e8a4852092844d320aa upstream. + +Some FSA4480-compatible chips like the OCP96011 used on Fairphone 5 +return 0x00 from the CHIP_ID register. Handle that gracefully and only +fail probe when the I2C read has failed. + +With this the dev_dbg will print 0 but otherwise continue working. + + [ 0.251581] fsa4480 1-0042: Found FSA4480 v0.0 (Vendor ID = 0) + +Cc: stable@vger.kernel.org +Fixes: e885f5f1f2b4 ("usb: typec: fsa4480: Check if the chip is really there") +Signed-off-by: Luca Weiss +Reviewed-by: Heikki Krogerus +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20240818-fsa4480-chipid-fix-v1-1-17c239435cf7@fairphone.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/mux/fsa4480.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/mux/fsa4480.c b/drivers/usb/typec/mux/fsa4480.c +index cd235339834b..f71dba8bf07c 100644 +--- a/drivers/usb/typec/mux/fsa4480.c ++++ b/drivers/usb/typec/mux/fsa4480.c +@@ -274,7 +274,7 @@ static int fsa4480_probe(struct i2c_client *client) + return dev_err_probe(dev, PTR_ERR(fsa->regmap), "failed to initialize regmap\n"); + + ret = regmap_read(fsa->regmap, FSA4480_DEVICE_ID, &val); +- if (ret || !val) ++ if (ret) + return dev_err_probe(dev, -ENODEV, "FSA4480 not found\n"); + + dev_dbg(dev, "Found FSA4480 v%lu.%lu (Vendor ID = %lu)\n", +-- +2.46.0 + diff --git a/queue-6.10/usb-typec-ucsi-move-unregister-out-of-atomic-section.patch b/queue-6.10/usb-typec-ucsi-move-unregister-out-of-atomic-section.patch new file mode 100644 index 00000000000..0e753ca35e2 --- /dev/null +++ b/queue-6.10/usb-typec-ucsi-move-unregister-out-of-atomic-section.patch @@ -0,0 +1,124 @@ +From 11bb2ffb679399f99041540cf662409905179e3a Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Tue, 20 Aug 2024 13:29:31 -0700 +Subject: usb: typec: ucsi: Move unregister out of atomic section + +From: Bjorn Andersson + +commit 11bb2ffb679399f99041540cf662409905179e3a upstream. + +Commit '9329933699b3 ("soc: qcom: pmic_glink: Make client-lock +non-sleeping")' moved the pmic_glink client list under a spinlock, as it +is accessed by the rpmsg/glink callback, which in turn is invoked from +IRQ context. + +This means that ucsi_unregister() is now called from atomic context, +which isn't feasible as it's expecting a sleepable context. An effort is +under way to get GLINK to invoke its callbacks in a sleepable context, +but until then lets schedule the unregistration. + +A side effect of this is that ucsi_unregister() can now happen +after the remote processor, and thereby the communication link with it, is +gone. pmic_glink_send() is amended with a check to avoid the resulting NULL +pointer dereference. +This does however result in the user being informed about this error by +the following entry in the kernel log: + + ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI write request: -5 + +Fixes: 9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping") +Cc: stable@vger.kernel.org +Reviewed-by: Heikki Krogerus +Reviewed-by: Neil Armstrong +Reviewed-by: Dmitry Baryshkov +Tested-by: Amit Pundir +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-2-eec53c750a04@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/pmic_glink.c | 10 +++++++++- + drivers/usb/typec/ucsi/ucsi_glink.c | 27 ++++++++++++++++++++++----- + 2 files changed, 31 insertions(+), 6 deletions(-) + +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -112,8 +112,16 @@ EXPORT_SYMBOL_GPL(pmic_glink_client_regi + int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len) + { + struct pmic_glink *pg = client->pg; ++ int ret; + +- return rpmsg_send(pg->ept, data, len); ++ mutex_lock(&pg->state_lock); ++ if (!pg->ept) ++ ret = -ECONNRESET; ++ else ++ ret = rpmsg_send(pg->ept, data, len); ++ mutex_unlock(&pg->state_lock); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(pmic_glink_send); + +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -72,6 +72,9 @@ struct pmic_glink_ucsi { + + struct work_struct notify_work; + struct work_struct register_work; ++ spinlock_t state_lock; ++ bool ucsi_registered; ++ bool pd_running; + + u8 read_buf[UCSI_BUF_SIZE]; + }; +@@ -271,8 +274,20 @@ static void pmic_glink_ucsi_notify(struc + static void pmic_glink_ucsi_register(struct work_struct *work) + { + struct pmic_glink_ucsi *ucsi = container_of(work, struct pmic_glink_ucsi, register_work); ++ unsigned long flags; ++ bool pd_running; + +- ucsi_register(ucsi->ucsi); ++ spin_lock_irqsave(&ucsi->state_lock, flags); ++ pd_running = ucsi->pd_running; ++ spin_unlock_irqrestore(&ucsi->state_lock, flags); ++ ++ if (!ucsi->ucsi_registered && pd_running) { ++ ucsi_register(ucsi->ucsi); ++ ucsi->ucsi_registered = true; ++ } else if (ucsi->ucsi_registered && !pd_running) { ++ ucsi_unregister(ucsi->ucsi); ++ ucsi->ucsi_registered = false; ++ } + } + + static void pmic_glink_ucsi_callback(const void *data, size_t len, void *priv) +@@ -296,11 +311,12 @@ static void pmic_glink_ucsi_callback(con + static void pmic_glink_ucsi_pdr_notify(void *priv, int state) + { + struct pmic_glink_ucsi *ucsi = priv; ++ unsigned long flags; + +- if (state == SERVREG_SERVICE_STATE_UP) +- schedule_work(&ucsi->register_work); +- else if (state == SERVREG_SERVICE_STATE_DOWN) +- ucsi_unregister(ucsi->ucsi); ++ spin_lock_irqsave(&ucsi->state_lock, flags); ++ ucsi->pd_running = (state == SERVREG_SERVICE_STATE_UP); ++ spin_unlock_irqrestore(&ucsi->state_lock, flags); ++ schedule_work(&ucsi->register_work); + } + + static void pmic_glink_ucsi_destroy(void *data) +@@ -348,6 +364,7 @@ static int pmic_glink_ucsi_probe(struct + init_completion(&ucsi->read_ack); + init_completion(&ucsi->write_ack); + init_completion(&ucsi->sync_ack); ++ spin_lock_init(&ucsi->state_lock); + mutex_init(&ucsi->lock); + + ucsi->ucsi = ucsi_create(dev, &pmic_glink_ucsi_ops); -- 2.47.3