[PATCH] thunderbolt: icm: preserve USB4 proxy data-valid bit

[PATCH] thunderbolt: icm: preserve USB4 proxy data-valid bit

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

The ICM USB4 switch operation request encodes two values in
request.data_len_valid: bit 4 marks the data payload valid, while bits
3:0 hold the payload length in dwords.  A zero length with the valid bit
set represents the full 16-dword data array.

icm_usb4_switch_op() sets the valid bit when a transmit payload is
present.  For payloads shorter than the full 16 dwords, it then assigns
the length to the whole field and clears the valid bit that was just set.
The payload is still copied into the request, but the descriptor sent to
firmware marks that data as invalid.

This affects USB4 router operations that send short payloads through the
firmware connection manager.  In particular, USB4 NVM writes can send a
short final block when the image size is not aligned to the 64-byte proxy
payload size.  Firmware may then ignore or reject that final block, while
full 16-dword blocks are unaffected because they are encoded as length 0
with the valid bit set.

OR the short payload length into data_len_valid so the valid bit is
preserved.

Fixes: 9039387e166e ("thunderbolt: Add USB4 router operation proxy for firmware connection manager")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/thunderbolt/icm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index 10fefac3b1d9..669807f0eaf8 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -2341,7 +2341,7 @@ static int icm_usb4_switch_op(struct tb_switch *sw, u16 opcode, u32 *metadata,
 	if (tx_data_len) {
 		request.data_len_valid |= ICM_USB4_SWITCH_DATA_VALID;
 		if (tx_data_len < ARRAY_SIZE(request.data))
-			request.data_len_valid =
+			request.data_len_valid |=
 				tx_data_len & ICM_USB4_SWITCH_DATA_LEN_MASK;
 		memcpy(request.data, tx_data, tx_data_len * sizeof(u32));
 	}
--
2.50.1

Re: [PATCH] thunderbolt: icm: preserve USB4 proxy data-valid bit

[Mika Westerberg]

On Mon, Jul 13, 2026 at 05:32:37PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> The ICM USB4 switch operation request encodes two values in
> request.data_len_valid: bit 4 marks the data payload valid, while bits
> 3:0 hold the payload length in dwords.  A zero length with the valid bit
> set represents the full 16-dword data array.
> 
> icm_usb4_switch_op() sets the valid bit when a transmit payload is
> present.  For payloads shorter than the full 16 dwords, it then assigns
> the length to the whole field and clears the valid bit that was just set.
> The payload is still copied into the request, but the descriptor sent to
> firmware marks that data as invalid.
> 
> This affects USB4 router operations that send short payloads through the
> firmware connection manager.  In particular, USB4 NVM writes can send a
> short final block when the image size is not aligned to the 64-byte proxy
> payload size.  Firmware may then ignore or reject that final block, while
> full 16-dword blocks are unaffected because they are encoded as length 0
> with the valid bit set.
> 
> OR the short payload length into data_len_valid so the valid bit is
> preserved.
> 
> Fixes: 9039387e166e ("thunderbolt: Add USB4 router operation proxy for firmware connection manager")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Rao <raoxu@uniontech.com>

Applied to thunderbolt.git/fixes, thanks!