From: Greg Kroah-Hartman Date: Mon, 31 Aug 2020 10:23:12 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.4.235~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2737536b8faf67e12f19ca5ba96b0e001341ca12;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: xen-uses-irqdesc-irq_data_common-handler_data-to-store-a-per-interrupt-xen-data-pointer-which-contains-xen-specific-information.patch xhci-do-warm-reset-when-both-cas-and-xdev_resume-are-set.patch --- diff --git a/queue-4.4/series b/queue-4.4/series index 876239d7b7f..3153d6608e4 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -47,3 +47,5 @@ serial-8250-change-lock-order-in-serial8250_do_startup.patch writeback-protect-inode-i_io_list-with-inode-i_lock.patch writeback-avoid-skipping-inode-writeback.patch writeback-fix-sync-livelock-due-to-b_dirty_time-processing.patch +xen-uses-irqdesc-irq_data_common-handler_data-to-store-a-per-interrupt-xen-data-pointer-which-contains-xen-specific-information.patch +xhci-do-warm-reset-when-both-cas-and-xdev_resume-are-set.patch diff --git a/queue-4.4/xen-uses-irqdesc-irq_data_common-handler_data-to-store-a-per-interrupt-xen-data-pointer-which-contains-xen-specific-information.patch b/queue-4.4/xen-uses-irqdesc-irq_data_common-handler_data-to-store-a-per-interrupt-xen-data-pointer-which-contains-xen-specific-information.patch new file mode 100644 index 00000000000..f91da2a2839 --- /dev/null +++ b/queue-4.4/xen-uses-irqdesc-irq_data_common-handler_data-to-store-a-per-interrupt-xen-data-pointer-which-contains-xen-specific-information.patch @@ -0,0 +1,107 @@ +From c330fb1ddc0a922f044989492b7fcca77ee1db46 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Tue, 25 Aug 2020 17:22:58 +0200 +Subject: XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information. + +From: Thomas Gleixner + +commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream. + +handler data is meant for interrupt handlers and not for storing irq chip +specific information as some devices require handler data to store internal +per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers. + +This obviously creates a conflict of interests and crashes the machine +because the XEN pointer is overwritten by the driver pointer. + +As the XEN data is not handler specific it should be stored in +irqdesc::irq_data::chip_data instead. + +A simple sed s/irq_[sg]et_handler_data/irq_[sg]et_chip_data/ cures that. + +Cc: stable@vger.kernel.org +Reported-by: Roman Shaposhnik +Signed-off-by: Thomas Gleixner +Tested-by: Roman Shaposhnik +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/87lfi2yckt.fsf@nanos.tec.linutronix.de +Signed-off-by: Juergen Gross +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/events/events_base.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn) + /* Get info for IRQ */ + struct irq_info *info_for_irq(unsigned irq) + { +- return irq_get_handler_data(irq); ++ return irq_get_chip_data(irq); + } + + /* Constructors for packed IRQ information. */ +@@ -384,7 +384,7 @@ static void xen_irq_init(unsigned irq) + info->type = IRQT_UNBOUND; + info->refcnt = -1; + +- irq_set_handler_data(irq, info); ++ irq_set_chip_data(irq, info); + + list_add_tail(&info->list, &xen_irq_list_head); + } +@@ -433,14 +433,14 @@ static int __must_check xen_allocate_irq + + static void xen_free_irq(unsigned irq) + { +- struct irq_info *info = irq_get_handler_data(irq); ++ struct irq_info *info = irq_get_chip_data(irq); + + if (WARN_ON(!info)) + return; + + list_del(&info->list); + +- irq_set_handler_data(irq, NULL); ++ irq_set_chip_data(irq, NULL); + + WARN_ON(info->refcnt > 0); + +@@ -610,7 +610,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); + static void __unbind_from_irq(unsigned int irq) + { + int evtchn = evtchn_from_irq(irq); +- struct irq_info *info = irq_get_handler_data(irq); ++ struct irq_info *info = irq_get_chip_data(irq); + + if (info->refcnt > 0) { + info->refcnt--; +@@ -1114,7 +1114,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect + + void unbind_from_irqhandler(unsigned int irq, void *dev_id) + { +- struct irq_info *info = irq_get_handler_data(irq); ++ struct irq_info *info = irq_get_chip_data(irq); + + if (WARN_ON(!info)) + return; +@@ -1148,7 +1148,7 @@ int evtchn_make_refcounted(unsigned int + if (irq == -1) + return -ENOENT; + +- info = irq_get_handler_data(irq); ++ info = irq_get_chip_data(irq); + + if (!info) + return -ENOENT; +@@ -1176,7 +1176,7 @@ int evtchn_get(unsigned int evtchn) + if (irq == -1) + goto done; + +- info = irq_get_handler_data(irq); ++ info = irq_get_chip_data(irq); + + if (!info) + goto done; diff --git a/queue-4.4/xhci-do-warm-reset-when-both-cas-and-xdev_resume-are-set.patch b/queue-4.4/xhci-do-warm-reset-when-both-cas-and-xdev_resume-are-set.patch new file mode 100644 index 00000000000..10f8ded0b10 --- /dev/null +++ b/queue-4.4/xhci-do-warm-reset-when-both-cas-and-xdev_resume-are-set.patch @@ -0,0 +1,69 @@ +From 904df64a5f4d5ebd670801d869ca0a6d6a6e8df6 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Fri, 21 Aug 2020 12:15:48 +0300 +Subject: xhci: Do warm-reset when both CAS and XDEV_RESUME are set + +From: Kai-Heng Feng + +commit 904df64a5f4d5ebd670801d869ca0a6d6a6e8df6 upstream. + +Sometimes re-plugging a USB device during system sleep renders the device +useless: +[ 173.418345] xhci_hcd 0000:00:14.0: Get port status 2-4 read: 0x14203e2, return 0x10262 +... +[ 176.496485] usb 2-4: Waited 2000ms for CONNECT +[ 176.496781] usb usb2-port4: status 0000.0262 after resume, -19 +[ 176.497103] usb 2-4: can't resume, status -19 +[ 176.497438] usb usb2-port4: logical disconnect + +Because PLS equals to XDEV_RESUME, xHCI driver reports U3 to usbcore, +despite of CAS bit is flagged. + +So proritize CAS over XDEV_RESUME to let usbcore handle warm-reset for +the port. + +Cc: stable +Signed-off-by: Kai-Heng Feng +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200821091549.20556-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -599,15 +599,6 @@ static void xhci_hub_report_usb3_link_st + { + u32 pls = status_reg & PORT_PLS_MASK; + +- /* resume state is a xHCI internal state. +- * Do not report it to usb core, instead, pretend to be U3, +- * thus usb core knows it's not ready for transfer +- */ +- if (pls == XDEV_RESUME) { +- *status |= USB_SS_PORT_LS_U3; +- return; +- } +- + /* When the CAS bit is set then warm reset + * should be performed on port + */ +@@ -630,6 +621,16 @@ static void xhci_hub_report_usb3_link_st + pls |= USB_PORT_STAT_CONNECTION; + } else { + /* ++ * Resume state is an xHCI internal state. Do not report it to ++ * usb core, instead, pretend to be U3, thus usb core knows ++ * it's not ready for transfer. ++ */ ++ if (pls == XDEV_RESUME) { ++ *status |= USB_SS_PORT_LS_U3; ++ return; ++ } ++ ++ /* + * If CAS bit isn't set but the Port is already at + * Compliance Mode, fake a connection so the USB core + * notices the Compliance state and resets the port.