Skip to content
  1. Sep 08, 2022
    • Thierry GUIBERT's avatar
      USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) · 2ae507d6
      Thierry GUIBERT authored
      commit a10bc717
      
       upstream.
      
      Supports for ICOM F3400 and ICOM F4400 PMR radios in CDC-ACM driver
      enabling the AT serial port.
      The Vendor Id is 0x0C26
      The Product ID is 0x0020
      
      Output of lsusb :
      Bus 001 Device 009: ID 0c26:0020 Prolific Technology Inc. ICOM Radio
      Couldn't open device, some information will be missing
      Device Descriptor:
        bLength                18
        bDescriptorType         1
        bcdUSB               2.00
        bDeviceClass            2 Communications
        bDeviceSubClass         0
        bDeviceProtocol         0
        bMaxPacketSize0        64
        idVendor           0x0c26 Prolific Technology Inc.
        idProduct          0x0020
        bcdDevice            0.00
        iManufacturer           1 ICOM Inc.
        iProduct                2 ICOM Radio
        iSerial                 3 *obfuscated*
        bNumConfigurations      1
        Configuration Descriptor:
          bLength                 9
          bDescriptorType         2
          wTotalLength       0x0030
          bNumInterfaces          2
          bConfigurationValue     1
          iConfiguration          0
          bmAttributes         0xc0
            Self Powered
          MaxPower                0mA
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        0
            bAlternateSetting       0
            bNumEndpoints           1
            bInterfaceClass         2 Communications
            bInterfaceSubClass      2 Abstract (modem)
            bInterfaceProtocol      1 AT-commands (v.25ter)
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x83  EP 3 IN
              bmAttributes            3
                Transfer Type            Interrupt
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0040  1x 64 bytes
              bInterval              12
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        1
            bAlternateSetting       0
            bNumEndpoints           2
            bInterfaceClass        10 CDC Data
            bInterfaceSubClass      0
            bInterfaceProtocol      0
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x82  EP 2 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval               0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x02  EP 2 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0200  1x 512 bytes
              bInterval               0
      
      Signed-off-by: default avatarThierry GUIBERT <thierry.guibert@croix-rouge.fr>
      Cc: stable <stable@kernel.org>
      Link: https://lore.kernel.org/r/20220819081702.84118-1-thierry.guibert@croix-rouge.fr
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2ae507d6
    • Pawel Laszczak's avatar
      usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer · 459edcb1
      Pawel Laszczak authored
      commit d5dcc336 upstream.
      
      The TRB_SMM flag indicates that DMA has completed the TD service with
      this TRB. Usually it’s a last TRB in TD. In case of ISOC transfer for
      bInterval > 1 each ISOC transfer contains more than one TD associated
      with usb request (one TD per ITP). In such case the TRB_SMM flag will
      be set in every TD and driver will recognize the end of transfer after
      processing the first TD with TRB_SMM. In result driver stops updating
      request->actual and returns incorrect actual length.
      To fix this issue driver additionally must check TRB_CHAIN which is not
      used for isochronous transfers.
      
      Fixes: 249f0a25
      
       ("usb: cdns3: gadget: handle sg list use case at completion correctly")
      cc: <stable@vger.kernel.org>
      Acked-by: default avatarPeter Chen <peter.chen@kernel.org>
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Link: https://lore.kernel.org/r/20220825062207.5824-1-pawell@cadence.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      459edcb1
    • Pawel Laszczak's avatar
      usb: cdns3: fix issue with rearming ISO OUT endpoint · 142e8c06
      Pawel Laszczak authored
      commit b46a6b09 upstream.
      
      ISO OUT endpoint is enabled during queuing first usb request
      in transfer ring and disabled when TRBERR is reported by controller.
      After TRBERR and before next transfer added to TR driver must again
      reenable endpoint but does not.
      To solve this issue during processing TRBERR event driver must
      set the flag EP_UPDATE_EP_TRBADDR in priv_ep->flags field.
      
      Fixes: 7733f6c3
      
       ("usb: cdns3: Add Cadence USB3 DRD Driver")
      cc: <stable@vger.kernel.org>
      Acked-by: default avatarPeter Chen <peter.chen@kernel.org>
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Link: https://lore.kernel.org/r/20220825062137.5766-1-pawell@cadence.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      142e8c06
    • Heiner Kallweit's avatar
      usb: dwc2: fix wrong order of phy_power_on and phy_init · 62ef6b5f
      Heiner Kallweit authored
      commit f9b995b4 upstream.
      
      Since 1599069a ("phy: core: Warn when phy_power_on is called before
      phy_init") the driver complains. In my case (Amlogic SoC) the warning
      is: phy phy-fe03e000.phy.2: phy_power_on was called before phy_init
      So change the order of the two calls. The same change has to be done
      to the order of phy_exit() and phy_power_off().
      
      Fixes: 09a75e85
      
       ("usb: dwc2: refactor common low-level hw code to platform.c")
      Cc: stable@vger.kernel.org
      Acked-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Acked-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Link: https://lore.kernel.org/r/dfcc6b40-2274-4e86-e73c-5c5e6aa3e046@gmail.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      62ef6b5f
    • Badhri Jagan Sridharan's avatar
      usb: typec: tcpm: Return ENOTSUPP for power supply prop writes · dbf5cb01
      Badhri Jagan Sridharan authored
      commit f2d38edc upstream.
      
      When the port does not support USB PD, prevent transition to PD
      only states when power supply property is written. In this case,
      TCPM transitions to SNK_NEGOTIATE_CAPABILITIES
      which should not be the case given that the port is not pd_capable.
      
      [   84.308251] state change SNK_READY -> SNK_NEGOTIATE_CAPABILITIES [rev3 NONE_AMS]
      [   84.308335] Setting usb_comm capable false
      [   84.323367] set_auto_vbus_discharge_threshold mode:3 pps_active:n vbus:5000 ret:0
      [   84.323376] state change SNK_NEGOTIATE_CAPABILITIES -> SNK_WAIT_CAPABILITIES [rev3 NONE_AMS]
      
      Fixes: e9e6e164
      
       ("usb: typec: tcpm: Support non-PD mode")
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Signed-off-by: default avatarBadhri Jagan Sridharan <badhri@google.com>
      Link: https://lore.kernel.org/r/20220817215410.1807477-1-badhri@google.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      dbf5cb01
    • Utkarsh Patel's avatar
      usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device · e68a2682
      Utkarsh Patel authored
      commit 1b1b672c
      
       upstream.
      
      This adds the necessary ACPI ID for Intel Meteor Lake
      IOM devices.
      
      The callback function is_memory() is modified so that it
      also checks if the resource descriptor passed to it is a
      memory type "Address Space Resource Descriptor".
      
      On Intel Meteor Lake the ACPI memory resource is not
      described using the "32-bit Memory Range Descriptor" because
      the memory is outside of the 32-bit address space. The
      memory resource is described using the "Address Space
      Resource Descriptor" instead.
      
      Intel Meteor Lake is the first platform to describe the
      memory resource for this device with Address Space Resource
      Descriptor, but it most likely will not be the last.
      Therefore the change to the is_memory() callback function
      is made generic.
      
      Signed-off-by: default avatarUtkarsh Patel <utkarsh.h.patel@intel.com>
      Cc: stable@vger.kernel.org
      [ heikki: Rewrote the commit message. ]
      Signed-off-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Link: https://lore.kernel.org/r/20220816101629.69054-2-heikki.krogerus@linux.intel.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e68a2682
    • Pablo Sun's avatar
      usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles · 91416070
      Pablo Sun authored
      commit c1e5c2f0 upstream.
      
      Fix incorrect pin assignment values when connecting to a monitor with
      Type-C receptacle instead of a plug.
      
      According to specification, an UFP_D receptacle's pin assignment
      should came from the UFP_D pin assignments field (bit 23:16), while
      an UFP_D plug's assignments are described in the DFP_D pin assignments
      (bit 15:8) during Mode Discovery.
      
      For example the LG 27 UL850-W is a monitor with Type-C receptacle.
      The monitor responds to MODE DISCOVERY command with following
      DisplayPort Capability flag:
      
              dp->alt->vdo=0x140045
      
      The existing logic only take cares of UPF_D plug case,
      and would take the bit 15:8 for this 0x140045 case.
      
      This results in an non-existing pin assignment 0x0 in
      dp_altmode_configure.
      
      To fix this problem a new set of macros are introduced
      to take plug/receptacle differences into consideration.
      
      Fixes: 0e3bb7d6
      
       ("usb: typec: Add driver for DisplayPort alternate mode")
      Cc: stable@vger.kernel.org
      Co-developed-by: default avatarPablo Sun <pablo.sun@mediatek.com>
      Co-developed-by: default avatarMacpaul Lin <macpaul.lin@mediatek.com>
      Reviewed-by: default avatarGuillaume Ranquet <granquet@baylibre.com>
      Reviewed-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Signed-off-by: default avatarPablo Sun <pablo.sun@mediatek.com>
      Signed-off-by: default avatarMacpaul Lin <macpaul.lin@mediatek.com>
      Link: https://lore.kernel.org/r/20220804034803.19486-1-macpaul.lin@mediatek.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      91416070
    • Takashi Iwai's avatar
      Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" · 3d4044c9
      Takashi Iwai authored
      commit 5f73aa2c upstream.
      
      The recent commit 87d0e2f4 ("usb: typec: ucsi: add a common
      function ucsi_unregister_connectors()") introduced a regression that
      caused NULL dereference at reading the power supply sysfs.  It's a
      stale sysfs entry that should have been removed but remains with NULL
      ops.  The commit changed the error handling to skip the entries after
      a NULL con->wq, and this leaves the power device unreleased.
      
      For addressing the regression, the straight revert is applied here.
      Further code improvements can be done from the scratch again.
      
      Link: https://bugzilla.suse.com/show_bug.cgi?id=1202386
      Link: https://lore.kernel.org/r/87r11cmbx0.wl-tiwai@suse.de
      Fixes: 87d0e2f4
      
       ("usb: typec: ucsi: add a common function ucsi_unregister_connectors()")
      Cc: <stable@vger.kernel.org>
      Acked-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Link: https://lore.kernel.org/r/20220823065455.32579-1-tiwai@suse.de
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3d4044c9
    • Slark Xiao's avatar
      USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode · 1f45b7e9
      Slark Xiao authored
      commit 8ffe20d0
      
       upstream.
      
      We added PIDs for MV32-WA/WB MBIM mode before, now we need to add
      support for RmNet mode.
      
      Test evidence as below:
      T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#=  3 Spd=480 MxCh= 0
      D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=1e2d ProdID=00f3 Rev=05.04
      S:  Manufacturer=Cinterion
      S:  Product=Cinterion PID 0x00F3 USB Mobile Broadband
      S:  SerialNumber=d7b4be8d
      C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
      I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
      I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
      
      T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 10 Spd=480 MxCh= 0
      D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=1e2d ProdID=00f4 Rev=05.04
      S:  Manufacturer=Cinterion
      S:  Product=Cinterion PID 0x00F4 USB Mobile Broadband
      S:  SerialNumber=d095087d
      C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
      I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
      I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
      
      Signed-off-by: default avatarSlark Xiao <slark_xiao@163.com>
      [ johan: sort entries ]
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1f45b7e9
    • Yonglin Tan's avatar
      USB: serial: option: add Quectel EM060K modem · cce30bc7
      Yonglin Tan authored
      commit f766f3ab
      
       upstream.
      
      Add usb product id entry for the Quectel EM060K module.
      
      "MBIM mode": DIAG + NMEA + AT + MODEM + MBIM + QDSS
      
      T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  8 Spd=480  MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=2c7c ProdID=030b Rev= 5.04
      S:  Manufacturer=Quectel
      S:  Product=EM060K-GL
      S:  SerialNumber=89fb57db
      C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
      A:  FirstIf#= 8 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
      E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
      E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
      E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#= 8 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
      E:  Ad=88(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
      I:  If#= 9 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
      I:* If#= 9 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
      E:  Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      E:  Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      I:* If#=12 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
      E:  Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
      
      Signed-off-by: default avatarYonglin Tan <yonglin.tan@outlook.com>
      [ johan: mention QDSS port and sort entries ]
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cce30bc7
    • Yan Xinyu's avatar
      USB: serial: option: add support for OPPO R11 diag port · 2a305d1b
      Yan Xinyu authored
      commit 8d5fc280
      
       upstream.
      
      Add support for OPPO R11 USB diag serial port to option driver. This
      phone uses Qualcomm Snapdragon 660 SoC.
      
      usb-devices output:
      T:  Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=22d9 ProdID=276c Rev=04.04
      S:  Manufacturer=OPPO
      S:  Product=SDM660-MTP _SN:09C6BCA7
      S:  SerialNumber=beb2c403
      C:  #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA
      I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
      I:  If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
      
      Signed-off-by: default avatarYan Xinyu <sdlyyxy@bupt.edu.cn>
      Link: https://lore.kernel.org/r/20220714102037.4113889-1-sdlyyxy@bupt.edu.cn
      Link: https://lore.kernel.org/r/Yt1WfSZk03Plpnan@hovoldconsulting.com
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2a305d1b
    • Johan Hovold's avatar
      USB: serial: cp210x: add Decagon UCA device id · bda33a50
      Johan Hovold authored
      commit ceb40384
      
       upstream.
      
      Add the device id for Decagon Devices USB Cable Adapter.
      
      Link: https://lore.kernel.org/r/trinity-819f9db2-d3e1-40e9-a669-9c245817c046-1661523546680@msvc-mesg-web108
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      bda33a50
    • Johan Hovold's avatar
      USB: serial: ch341: fix disabled rx timer on older devices · 40bc52e1
      Johan Hovold authored
      commit 41ca302a
      
       upstream.
      
      At least one older CH341 appears to have the RX timer enable bit
      inverted so that setting it disables the RX timer and prevents the FIFO
      from emptying until it is full.
      
      Only set the RX timer enable bit for devices with version newer than
      0x27 (even though this probably affects all pre-0x30 devices).
      
      Reported-by: default avatarJonathan Woithe <jwoithe@just42.net>
      Tested-by: default avatarJonathan Woithe <jwoithe@just42.net>
      Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au
      Fixes: 4e46c410
      
       ("USB: serial: ch341: reinitialize chip on reconfiguration")
      Cc: stable@vger.kernel.org      # 4.10
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      40bc52e1
    • Johan Hovold's avatar
      USB: serial: ch341: fix lost character on LCR updates · cffe34a4
      Johan Hovold authored
      commit 8e83622a
      
       upstream.
      
      Disable LCR updates for pre-0x30 devices which use a different (unknown)
      protocol for line control and where the current register write causes
      the next received character to be lost.
      
      Note that updating LCR using the INIT command has no effect on these
      devices either.
      
      Reported-by: default avatarJonathan Woithe <jwoithe@just42.net>
      Tested-by: default avatarJonathan Woithe <jwoithe@just42.net>
      Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au
      Fixes: 4e46c410 ("USB: serial: ch341: reinitialize chip on reconfiguration")
      Fixes: 55fa15b5
      
       ("USB: serial: ch341: fix baud rate and line-control handling")
      Cc: stable@vger.kernel.org      # 4.10
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cffe34a4
    • Johan Hovold's avatar
      usb: dwc3: fix PHY disable sequence · 735e7d08
      Johan Hovold authored
      commit d2ac7bef upstream.
      
      Generic PHYs must be powered-off before they can be tore down.
      
      Similarly, suspending legacy PHYs after having powered them off makes no
      sense.
      
      Fix the dwc3_core_exit() (e.g. called during suspend) and open-coded
      dwc3_probe() error-path sequences that got this wrong.
      
      Note that this makes dwc3_core_exit() match the dwc3_core_init() error
      path with respect to powering off the PHYs.
      
      Fixes: 03c1fd62 ("usb: dwc3: core: add phy cleanup for probe error handling")
      Fixes: c499ff71
      
       ("usb: dwc3: core: re-factor init and exit paths")
      Cc: stable@vger.kernel.org      # 4.8
      Reviewed-by: default avatarAndrew Halaney <ahalaney@redhat.com>
      Reviewed-by: default avatarMatthias Kaehlcke <mka@chromium.org>
      Reviewed-by: default avatarManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
      Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
      Link: https://lore.kernel.org/r/20220804151001.23612-2-johan+linaro@kernel.org
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      735e7d08
    • Wesley Cheng's avatar
      usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop · 492a177d
      Wesley Cheng authored
      commit 040f2dbd upstream.
      
      Relocate the pullups_connected check until after it is ensured that there
      are no runtime PM transitions.  If another context triggered the DWC3
      core's runtime resume, it may have already enabled the Run/Stop.  Do not
      re-run the entire pullup sequence again, as it may issue a core soft
      reset while Run/Stop is already set.
      
      This patch depends on
        commit 69e131d1 ("usb: dwc3: gadget: Prevent repeat pullup()")
      
      Fixes: 77adb8bd
      
       ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded")
      Cc: stable <stable@kernel.org>
      Signed-off-by: default avatarWesley Cheng <quic_wcheng@quicinc.com>
      Link: https://lore.kernel.org/r/20220728020647.9377-1-quic_wcheng@quicinc.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      492a177d
    • Johan Hovold's avatar
      usb: dwc3: disable USB core PHY management · 5ea9baee
      Johan Hovold authored
      commit 6000b8d9 upstream.
      
      The dwc3 driver manages its PHYs itself so the USB core PHY management
      needs to be disabled.
      
      Use the struct xhci_plat_priv hack added by commits 46034a99 ("usb:
      host: xhci-plat: add platform data support") and f768e718 ("usb:
      host: xhci-plat: add priv quirk for skip PHY initialization") to
      propagate the setting for now.
      
      Fixes: 4e88d4c0 ("usb: add a flag to skip PHY initialization to struct usb_hcd")
      Fixes: 178a0bce
      
       ("usb: core: hcd: integrate the PHY wrapper into the HCD core")
      Tested-by: default avatarMatthias Kaehlcke <mka@chromium.org>
      Cc: stable <stable@kernel.org>
      Reviewed-by: default avatarMatthias Kaehlcke <mka@chromium.org>
      Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
      Link: https://lore.kernel.org/r/20220825131836.19769-1-johan+linaro@kernel.org
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5ea9baee
    • Mathias Nyman's avatar
      xhci: Add grace period after xHC start to prevent premature runtime suspend. · d9debf9d
      Mathias Nyman authored
      commit 33e32158
      
       upstream.
      
      After xHC controller is started, either in probe or resume, it can take
      a while before any of the connected usb devices are visible to the roothub
      due to link training.
      
      It's possible xhci driver loads, sees no acivity and suspends the host
      before the USB device is visible.
      
      In one testcase with a hotplugged xHC controller the host finally detected
      the connected USB device and generated a wake 500ms after host initial
      start.
      
      If hosts didn't suspend the device duringe training it probablty wouldn't
      take up to 500ms to detect it, but looking at specs reveal USB3 link
      training has a couple long timeout values, such as 120ms
      RxDetectQuietTimeout, and 360ms PollingLFPSTimeout.
      
      So Add a 500ms grace period that keeps polling the roothub for 500ms after
      start, preventing runtime suspend until USB devices are detected.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
      Link: https://lore.kernel.org/r/20220825150840.132216-3-mathias.nyman@linux.intel.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d9debf9d
    • Alan Stern's avatar
      media: mceusb: Use new usb_control_msg_*() routines · d69c738a
      Alan Stern authored
      commit 608e58a0
      
       upstream.
      
      Automatic kernel fuzzing led to a WARN about invalid pipe direction in
      the mceusb driver:
      
      ------------[ cut here ]------------
      usb 6-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 40
      WARNING: CPU: 0 PID: 2465 at drivers/usb/core/urb.c:410
      usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410
      Modules linked in:
      CPU: 0 PID: 2465 Comm: kworker/0:2 Not tainted 5.19.0-rc4-00208-g69cb6c6556ad #1
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
      1.13.0-1ubuntu1.1 04/01/2014
      Workqueue: usb_hub_wq hub_event
      RIP: 0010:usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410
      Code: 7c 24 40 e8 ac 23 91 fd 48 8b 7c 24 40 e8 b2 70 1b ff 45 89 e8
      44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 a0 30 a9 86 e8 48 07 11 02 <0f> 0b
      e9 1c f0 ff ff e8 7e 23 91 fd 0f b6 1d 63 22 83 05 31 ff 41
      RSP: 0018:ffffc900032becf0 EFLAGS: 00010282
      RAX: 0000000000000000 RBX: ffff8881100f3058 RCX: 0000000000000000
      RDX: ffffc90004961000 RSI: ffff888114c6d580 RDI: fffff52000657d90
      RBP: ffff888105ad90f0 R08: ffffffff812c3638 R09: 0000000000000000
      R10: 0000000000000005 R11: ffffed1023504ef1 R12: ffff888105ad9000
      R13: 0000000000000040 R14: 0000000080000380 R15: ffff88810ba96500
      FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000
      CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007ffe810bda58 CR3: 000000010b720000 CR4: 0000000000350ef0
      Call Trace:
      <TASK>
      usb_start_wait_urb+0x101/0x4c0 drivers/usb/core/message.c:58
      usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
      usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153
      mceusb_gen1_init drivers/media/rc/mceusb.c:1431 [inline]
      mceusb_dev_probe+0x258e/0x33f0 drivers/media/rc/mceusb.c:1807
      
      The reason for the warning is clear enough; the driver sends an
      unusual read request on endpoint 0 but does not set the USB_DIR_IN bit
      in the bRequestType field.
      
      More importantly, the whole situation can be avoided and the driver
      simplified by converting it over to the relatively new
      usb_control_msg_recv() and usb_control_msg_send() routines.  That's
      what this fix does.
      
      Link: https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA@mail.gmail.com/
      Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
      Cc: stable@vger.kernel.org
      Reported-and-tested-by: default avatarRondreis <linhaoguo86@gmail.com>
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Link: https://lore.kernel.org/r/YwkfnBFCSEVC6XZu@rowland.harvard.edu
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d69c738a
    • Heikki Krogerus's avatar
      usb: dwc3: pci: Add support for Intel Raptor Lake · 9d539109
      Heikki Krogerus authored
      commit bad0d1d7
      
       upstream.
      
      This adds the necessary PCI device ID for the controller
      inside the Intel Raptor Lake CPU block. The controllers that
      are part of the PCH (chipset) have separate device IDs.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Link: https://lore.kernel.org/r/20220815123334.87526-1-heikki.krogerus@linux.intel.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9d539109
    • Mika Westerberg's avatar
      thunderbolt: Check router generation before connecting xHCI · 4ef3f00c
      Mika Westerberg authored
      commit 93a3c0d4 upstream.
      
      Only Thunderbolt 3 routers need the xHCI connection flow. This also
      ensures the router actually has both lane adapters (1 and 3). While
      there move declaration of the boolean variables inside the block where
      they are being used.
      
      Fixes: 30a4eca6
      
       ("thunderbolt: Add internal xHCI connect flows for Thunderbolt 3 devices")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4ef3f00c
    • Mika Westerberg's avatar
      thunderbolt: Use the actual buffer in tb_async_error() · 9fe0e993
      Mika Westerberg authored
      commit eb100b8f upstream.
      
      The received notification packet is held in pkg->buffer and not in pkg
      itself. Fix this by using the correct buffer.
      
      Fixes: 81a54b5e
      
       ("thunderbolt: Let the connection manager handle all notifications")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9fe0e993
    • SeongJae Park's avatar
      xen-blkfront: Cache feature_persistent value before advertisement · 06cb0542
      SeongJae Park authored
      commit fe8f65b0 upstream.
      
      Xen blkfront advertises its support of the persistent grants feature
      when it first setting up and when resuming in 'talk_to_blkback()'.
      Then, blkback reads the advertised value when it connects with blkfront
      and decides if it will use the persistent grants feature or not, and
      advertises its decision to blkfront.  Blkfront reads the blkback's
      decision and it also makes the decision for the use of the feature.
      
      Commit 402c43ea ("xen-blkfront: Apply 'feature_persistent' parameter
      when connect"), however, made the blkfront's read of the parameter for
      disabling the advertisement, namely 'feature_persistent', to be done
      when it negotiate, not when advertise.  Therefore blkfront advertises
      without reading the parameter.  As the field for caching the parameter
      value is zero-initialized, it always advertises as the feature is
      disabled, so that the persistent grants feature becomes always disabled.
      
      This commit fixes the issue by making the blkfront does parmeter caching
      just before the advertisement.
      
      Fixes: 402c43ea
      
       ("xen-blkfront: Apply 'feature_persistent' parameter when connect")
      Cc: <stable@vger.kernel.org> # 5.10.x
      Reported-by: default avatarMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
      Signed-off-by: default avatarSeongJae Park <sj@kernel.org>
      Tested-by: default avatarMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20220831165824.94815-4-sj@kernel.org
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      06cb0542
    • SeongJae Park's avatar
      xen-blkfront: Advertise feature-persistent as user requested · 6d4ee444
      SeongJae Park authored
      commit 9f5e0fe5 upstream.
      
      The advertisement of the persistent grants feature (writing
      'feature-persistent' to xenbus) should mean not the decision for using
      the feature but only the availability of the feature.  However, commit
      74a85247 ("xen-blkfront: add a parameter for disabling of persistent
      grants") made a field of blkfront, which was a place for saving only the
      negotiation result, to be used for yet another purpose: caching of the
      'feature_persistent' parameter value.  As a result, the advertisement,
      which should follow only the parameter value, becomes inconsistent.
      
      This commit fixes the misuse of the semantic by making blkfront saves
      the parameter value in a separate place and advertises the support based
      on only the saved value.
      
      Fixes: 74a85247
      
       ("xen-blkfront: add a parameter for disabling of persistent grants")
      Cc: <stable@vger.kernel.org> # 5.10.x
      Suggested-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarSeongJae Park <sj@kernel.org>
      Tested-by: default avatarMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20220831165824.94815-3-sj@kernel.org
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6d4ee444
    • SeongJae Park's avatar
      xen-blkback: Advertise feature-persistent as user requested · d925c3bf
      SeongJae Park authored
      commit 06ba5d2e upstream.
      
      The advertisement of the persistent grants feature (writing
      'feature-persistent' to xenbus) should mean not the decision for using
      the feature but only the availability of the feature.  However, commit
      aac8a70d ("xen-blkback: add a parameter for disabling of persistent
      grants") made a field of blkback, which was a place for saving only the
      negotiation result, to be used for yet another purpose: caching of the
      'feature_persistent' parameter value.  As a result, the advertisement,
      which should follow only the parameter value, becomes inconsistent.
      
      This commit fixes the misuse of the semantic by making blkback saves the
      parameter value in a separate place and advertises the support based on
      only the saved value.
      
      Fixes: aac8a70d
      
       ("xen-blkback: add a parameter for disabling of persistent grants")
      Cc: <stable@vger.kernel.org> # 5.10.x
      Suggested-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarSeongJae Park <sj@kernel.org>
      Tested-by: default avatarMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/20220831165824.94815-2-sj@kernel.org
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d925c3bf
    • Steven Price's avatar
      mm: pagewalk: Fix race between unmap and page walker · 9a108bd6
      Steven Price authored
      [ Upstream commit 8782fb61 ]
      
      The mmap lock protects the page walker from changes to the page tables
      during the walk.  However a read lock is insufficient to protect those
      areas which don't have a VMA as munmap() detaches the VMAs before
      downgrading to a read lock and actually tearing down PTEs/page tables.
      
      For users of walk_page_range() the solution is to simply call pte_hole()
      immediately without checking the actual page tables when a VMA is not
      present. We now never call __walk_page_range() without a valid vma.
      
      For walk_page_range_novma() the locking requirements are tightened to
      require the mmap write lock to be taken, and then walking the pgd
      directly with 'no_vma' set.
      
      This in turn means that all page walkers either have a valid vma, or
      it's that special 'novma' case for page table debugging.  As a result,
      all the odd '(!walk->vma && !walk->no_vma)' tests can be removed.
      
      Fixes: dd2283f2
      
       ("mm: mmap: zap pages with read mmap_sem in munmap")
      Reported-by: default avatarJann Horn <jannh@google.com>
      Signed-off-by: default avatarSteven Price <steven.price@arm.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
      Cc: Konstantin Khlebnikov <koct9i@gmail.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      9a108bd6
    • Dan Carpenter's avatar
      xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() · 3aa6a9f8
      Dan Carpenter authored
      [ Upstream commit e9ea0b30 ]
      
      The change from kcalloc() to kvmalloc() means that arg->nr_pages
      might now be large enough that the "args->nr_pages << PAGE_SHIFT" can
      result in an integer overflow.
      
      Fixes: b3f7931f
      
       ("xen/gntdev: switch from kcalloc() to kvcalloc()")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
      Link: https://lore.kernel.org/r/YxDROJqu/RPvR0bi@kili
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      3aa6a9f8
    • Nathan Chancellor's avatar
      powerpc/papr_scm: Ensure rc is always initialized in papr_scm_pmu_register() · 4e2eecb9
      Nathan Chancellor authored
      [ Upstream commit 6cf07810 ]
      
      Clang warns:
      
        arch/powerpc/platforms/pseries/papr_scm.c:492:6: warning: variable 'rc' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
                if (!p->stat_buffer_len)
                    ^~~~~~~~~~~~~~~~~~~
        arch/powerpc/platforms/pseries/papr_scm.c:523:64: note: uninitialized use occurs here
                dev_info(&p->pdev->dev, "nvdimm pmu didn't register rc=%d\n", rc);
                                                                              ^~
        include/linux/dev_printk.h:150:67: note: expanded from macro 'dev_info'
                dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__)
                                                                                ^~~~~~~~~~~
        include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap'
                        _p_func(dev, fmt, ##__VA_ARGS__);                       \
                                            ^~~~~~~~~~~
        arch/powerpc/platforms/pseries/papr_scm.c:492:2: note: remove the 'if' if its condition is always false
                if (!p->stat_buffer_len)
                ^~~~~~~~~~~~~~~~~~~~~~~~
        arch/powerpc/platforms/pseries/papr_scm.c:484:8: note: initialize the variable 'rc' to silence this warning
                int rc, nodeid;
                      ^
                      = 0
        1 warning generated.
      
      The call to papr_scm_pmu_check_events() was eliminated but a return code
      was not added to the if statement. Add the same return code from
      papr_scm_pmu_check_events() for this condition so there is no more
      warning.
      
      Fixes: 9b1ac046
      
       ("powerpc/papr_scm: Fix nvdimm event mappings")
      Signed-off-by: default avatarNathan Chancellor <nathan@kernel.org>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://github.com/ClangBuiltLinux/linux/issues/1701
      Link: https://lore.kernel.org/r/20220830151256.1473169-1-nathan@kernel.org
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      4e2eecb9
    • Jim Mattson's avatar
      KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES · 3d92ba26
      Jim Mattson authored
      [ Upstream commit 0204750b ]
      
      KVM should not claim to virtualize unknown IA32_ARCH_CAPABILITIES
      bits. When kvm_get_arch_capabilities() was originally written, there
      were only a few bits defined in this MSR, and KVM could virtualize all
      of them. However, over the years, several bits have been defined that
      KVM cannot just blindly pass through to the guest without additional
      work (such as virtualizing an MSR promised by the
      IA32_ARCH_CAPABILITES feature bit).
      
      Define a mask of supported IA32_ARCH_CAPABILITIES bits, and mask off
      any other bits that are set in the hardware MSR.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Fixes: 5b76a3cf
      
       ("KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry")
      Signed-off-by: default avatarJim Mattson <jmattson@google.com>
      Reviewed-by: default avatarVipin Sharma <vipinsh@google.com>
      Reviewed-by: default avatarXiaoyao Li <xiaoyao.li@intel.com>
      Message-Id: <20220830174947.2182144-1-jmattson@google.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      3d92ba26
    • Sander Vanheule's avatar
      gpio: realtek-otto: switch to 32-bit I/O · e13ef600
      Sander Vanheule authored
      [ Upstream commit ee0175b3 ]
      
      By using 16-bit I/O on the GPIO peripheral, which is apparently not safe
      on MIPS, the IMR can end up containing garbage. This then results in
      interrupt triggers for lines that don't have an interrupt handler
      associated. The irq_desc lookup fails, and the ISR will not be cleared,
      keeping the CPU busy until reboot, or until another IMR operation
      restores the correct value. This situation appears to happen very
      rarely, for < 0.5% of IMR writes.
      
      Instead of using 8-bit or 16-bit I/O operations on the 32-bit memory
      mapped peripheral registers, switch to using 32-bit I/O only, operating
      on the entire bank for all single bit line settings. For 2-bit line
      settings, with 16-bit port values, stick to manual (un)packing.
      
      This issue has been seen on RTL8382M (HPE 1920-16G), RTL8391M (Netgear
      GS728TP v2), and RTL8393M (D-Link DGS-1210-52 F3, Zyxel GS1900-48).
      
      Reported-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> # DGS-1210-52
      Reported-by: Birger Koblitz <mail@birger-koblitz.de> # GS728TP
      Reported-by: Jan Hoffmann <jan@3e8.eu> # 1920-16G
      Fixes: 0d82fb11
      
       ("gpio: Add Realtek Otto GPIO support")
      Signed-off-by: default avatarSander Vanheule <sander@svanheule.net>
      Cc: Paul Cercueil <paul@crapouillou.net>
      Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarBartosz Golaszewski <brgl@bgdev.pl>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e13ef600
    • Haibo Chen's avatar
      gpio: pca953x: Add mutex_lock for regcache sync in PM · 97ca48ec
      Haibo Chen authored
      [ Upstream commit 518e26f1 ]
      
      The regcache sync will set the cache_bypass = true, at that
      time, when there is regmap write operation, it will bypass
      the regmap cache, then the regcache sync will write back the
      value from cache to register, which is not as our expectation.
      
      Though regmap already use its internal lock to avoid such issue,
      but this driver force disable the regmap internal lock in its
      regmap config: disable_locking = true
      
      To avoid this issue, use the driver's own lock to do the protect
      in system PM.
      
      Fixes: b7657430
      
       ("gpio: pca953x: Restore registers after suspend/resume cycle")
      Signed-off-by: default avatarHaibo Chen <haibo.chen@nxp.com>
      Signed-off-by: default avatarBartosz Golaszewski <brgl@bgdev.pl>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      97ca48ec
    • Armin Wolf's avatar
      hwmon: (gpio-fan) Fix array out of bounds access · 3263984c
      Armin Wolf authored
      [ Upstream commit f233d2be ]
      
      The driver does not check if the cooling state passed to
      gpio_fan_set_cur_state() exceeds the maximum cooling state as
      stored in fan_data->num_speeds. Since the cooling state is later
      used as an array index in set_fan_speed(), an array out of bounds
      access can occur.
      This can be exploited by setting the state of the thermal cooling device
      to arbitrary values, causing for example a kernel oops when unavailable
      memory is accessed this way.
      
      Example kernel oops:
      [  807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064
      [  807.987369] Mem abort info:
      [  807.987398]   ESR = 0x96000005
      [  807.987428]   EC = 0x25: DABT (current EL), IL = 32 bits
      [  807.987477]   SET = 0, FnV = 0
      [  807.987507]   EA = 0, S1PTW = 0
      [  807.987536]   FSC = 0x05: level 1 translation fault
      [  807.987570] Data abort info:
      [  807.987763]   ISV = 0, ISS = 0x00000005
      [  807.987801]   CM = 0, WnR = 0
      [  807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001165000
      [  807.987872] [ffffff80d0588064] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
      [  807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP
      [  807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc snd_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg80211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_isp(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspberrypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops videobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm2835(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genirq uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6
      [  807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G         C        5.15.56-v8+ #1575
      [  807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
      [  807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
      [  807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan]
      [  807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan]
      [  807.988691] sp : ffffffc008cf3bd0
      [  807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 0000000000000000
      [  807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800747c920
      [  807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 000000001999997c
      [  807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 0000000000000000
      [  807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e271b70
      [  807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
      [  807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60c741c
      [  807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 0000000000000009
      [  807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff800369f2e8
      [  807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d0588060
      [  807.989084] Call trace:
      [  807.989091]  set_fan_speed.part.5+0x34/0x80 [gpio_fan]
      [  807.989113]  gpio_fan_set_cur_state+0x34/0x50 [gpio_fan]
      [  807.989199]  cur_state_store+0x84/0xd0
      [  807.989221]  dev_attr_store+0x20/0x38
      [  807.989262]  sysfs_kf_write+0x4c/0x60
      [  807.989282]  kernfs_fop_write_iter+0x130/0x1c0
      [  807.989298]  new_sync_write+0x10c/0x190
      [  807.989315]  vfs_write+0x254/0x378
      [  807.989362]  ksys_write+0x70/0xf8
      [  807.989379]  __arm64_sys_write+0x24/0x30
      [  807.989424]  invoke_syscall+0x4c/0x110
      [  807.989442]  el0_svc_common.constprop.3+0xfc/0x120
      [  807.989458]  do_el0_svc+0x2c/0x90
      [  807.989473]  el0_svc+0x24/0x60
      [  807.989544]  el0t_64_sync_handler+0x90/0xb8
      [  807.989558]  el0t_64_sync+0x1a0/0x1a4
      [  807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416)
      [  807.989627] ---[ end trace 8ded4c918658445b ]---
      
      Fix this by checking the cooling state and return an error if it
      exceeds the maximum cooling state.
      
      Tested on a Raspberry Pi 3.
      
      Fixes: b5cf88e4
      
       ("(gpio-fan): Add thermal control hooks")
      Signed-off-by: default avatarArmin Wolf <W_Armin@gmx.de>
      Link: https://lore.kernel.org/r/20220830011101.178843-1-W_Armin@gmx.de
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      3263984c
    • Stefan Wahren's avatar
      clk: bcm: rpi: Add missing newline · 7d54f19f
      Stefan Wahren authored
      [ Upstream commit 13b5cf8d ]
      
      Some log messages lacks the final newline. So add them.
      
      Fixes: 93d2725a
      
       ("clk: bcm: rpi: Discover the firmware clocks")
      Signed-off-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Link: https://lore.kernel.org/r/20220713154953.3336-3-stefan.wahren@i2se.com
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarIvan T. Ivanov <iivanov@suse.de>
      Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      7d54f19f
    • Stefan Wahren's avatar
      clk: bcm: rpi: Prevent out-of-bounds access · c8b04b73
      Stefan Wahren authored
      [ Upstream commit bc163555 ]
      
      The while loop in raspberrypi_discover_clocks() relies on the assumption
      that the id of the last clock element is zero. Because this data comes
      from the Videocore firmware and it doesn't guarantuee such a behavior
      this could lead to out-of-bounds access. So fix this by providing
      a sentinel element.
      
      Fixes: 93d2725a
      
       ("clk: bcm: rpi: Discover the firmware clocks")
      Link: https://github.com/raspberrypi/firmware/issues/1688
      Suggested-by: default avatarPhil Elwell <phil@raspberrypi.com>
      Signed-off-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Link: https://lore.kernel.org/r/20220713154953.3336-2-stefan.wahren@i2se.com
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarIvan T. Ivanov <iivanov@suse.de>
      Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c8b04b73
    • Stefan Wahren's avatar
      clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate · 838dff24
      Stefan Wahren authored
      [ Upstream commit 35f73cca
      
       ]
      
      The function raspberrypi_fw_get_rate (e.g. used for the recalc_rate
      hook) can fail to get the clock rate from the firmware. In this case
      we cannot return a signed error value, which would be casted to
      unsigned long. Fix this by returning 0 instead.
      
      Signed-off-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
      Link: https://lore.kernel.org/r/20220625083643.4012-1-stefan.wahren@i2se.com
      Fixes: 4e85e535
      
       ("clk: bcm283x: add driver interfacing with Raspberry Pi's firmware")
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      838dff24
    • Kajol Jain's avatar
      powerpc/papr_scm: Fix nvdimm event mappings · 3a58d2aa
      Kajol Jain authored
      [ Upstream commit 9b1ac046 ]
      
      Commit 4c08d4bb ("powerpc/papr_scm: Add perf interface support")
      added performance monitoring support for papr-scm nvdimm devices via
      perf interface. Commit also added an array in papr_scm_priv
      structure called "nvdimm_events_map", which got filled based on the
      result of H_SCM_PERFORMANCE_STATS hcall.
      
      Currently there is an assumption that the order of events in the
      stats buffer, returned by the hypervisor is same. And order also
      happens to matches with the events specified in nvdimm driver code.
      But this assumption is not documented in Power Architecture
      Platform Requirements (PAPR) document. Although the order
      of events happens to be same on current generation od system, but
      it might not be true in future generation systems. Fix the issue, by
      adding a static mapping for nvdimm events to corresponding stat-id,
      and removing the dynamic map from papr_scm_priv structure. Also
      remove the function papr_scm_pmu_check_events from papr_scm.c file,
      as we no longer need to copy stat-ids dynamically.
      
      Fixes: 4c08d4bb
      
       ("powerpc/papr_scm: Add perf interface support")
      Reported-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Signed-off-by: default avatarKajol Jain <kjain@linux.ibm.com>
      Reviewed-by: default avatarVaibhav Jain <vaibhav@linux.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/20220804074852.55157-1-kjain@linux.ibm.com
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      3a58d2aa
    • Peter Robinson's avatar
      Input: rk805-pwrkey - fix module autoloading · dd5ec541
      Peter Robinson authored
      [ Upstream commit 99077ad6 ]
      
      Add the module alias so the rk805-pwrkey driver will
      autoload when built as a module.
      
      Fixes: 5a35b85c
      
       ("Input: add power key driver for Rockchip RK805 PMIC")
      Signed-off-by: default avatarPeter Robinson <pbrobinson@gmail.com>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Link: https://lore.kernel.org/r/20220612225437.3628788-1-pbrobinson@gmail.com
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      dd5ec541
    • Chen-Yu Tsai's avatar
      clk: core: Fix runtime PM sequence in clk_core_unprepare() · 5e7ddb09
      Chen-Yu Tsai authored
      [ Upstream commit 4b592061 ]
      
      In the original commit 9a34b453 ("clk: Add support for runtime PM"),
      the commit message mentioned that pm_runtime_put_sync() would be done
      at the end of clk_core_unprepare(). This mirrors the operations in
      clk_core_prepare() in the opposite order.
      
      However, the actual code that was added wasn't in the order the commit
      message described. Move clk_pm_runtime_put() to the end of
      clk_core_unprepare() so that it is in the correct order.
      
      Fixes: 9a34b453
      
       ("clk: Add support for runtime PM")
      Signed-off-by: default avatarChen-Yu Tsai <wenst@chromium.org>
      Reviewed-by: default avatarNícolas F. R. A. Prado <nfraprado@collabora.com>
      Link: https://lore.kernel.org/r/20220822081424.1310926-3-wenst@chromium.org
      Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      5e7ddb09
    • Stephen Boyd's avatar
      Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops" · 27c26c2a
      Stephen Boyd authored
      [ Upstream commit abb5f3f4 ]
      
      This reverts commit 35b0fac8
      
      . Alexander
      reports that it causes boot failures on i.MX8M Plus based boards
      (specifically imx8mp-tqma8mpql-mba8mpxl.dts).
      
      Reported-by: default avatarAlexander Stein <alexander.stein@ew.tq-group.com>
      Cc: Chen-Yu Tsai <wenst@chromium.org>
      Fixes: 35b0fac8
      
       ("clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops")
      Link: https://lore.kernel.org/r/12115951.O9o76ZdvQC@steina-w
      Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
      Link: https://lore.kernel.org/r/20220831175326.2523912-1-sboyd@kernel.org
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      27c26c2a
    • Chen-Yu Tsai's avatar
      clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops · c25e0ca0
      Chen-Yu Tsai authored
      [ Upstream commit 35b0fac8 ]
      
      In the previous commits that added CLK_OPS_PARENT_ENABLE, support for
      this flag was only added to rate change operations (rate setting and
      reparent) and disabling unused subtree. It was not added to the
      clock gate related operations. Any hardware driver that needs it for
      these operations will either see bogus results, or worse, hang.
      
      This has been seen on MT8192 and MT8195, where the imp_ii2_* clk
      drivers set this, but dumping debugfs clk_summary would cause it
      to hang.
      
      Fixes: fc8726a2 ("clk: core: support clocks which requires parents enable (part 2)")
      Fixes: a4b3518d
      
       ("clk: core: support clocks which requires parents enable (part 1)")
      Signed-off-by: default avatarChen-Yu Tsai <wenst@chromium.org>
      Reviewed-by: default avatarNícolas F. R. A. Prado <nfraprado@collabora.com>
      Tested-by: default avatarNícolas F. R. A. Prado <nfraprado@collabora.com>
      Link: https://lore.kernel.org/r/20220822081424.1310926-2-wenst@chromium.org
      Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c25e0ca0