From: Greg Kroah-Hartman Date: Sat, 30 Mar 2019 20:36:32 +0000 (+0100) Subject: 5.0-stable patches X-Git-Tag: v3.18.138~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4d6421f7b1ad2569fc42866a56e6aac712852c3a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.0-stable patches added patches: usb-cdc-acm-fix-race-during-wakeup-blocking-tx-traffic.patch usb-host-xhci-rcar-add-xhci_trust_tx_length-quirk.patch usb-typec-fix-unchecked-return-value.patch usb-typec-tcpm-try-pd-2.0-if-sink-does-not-respond-to-3.0-source-caps.patch usb-xhci-dbc-don-t-free-all-memory-with-spinlock-held.patch xhci-don-t-let-usb3-ports-stuck-in-polling-state-prevent-suspend.patch xhci-fix-port-resume-done-detection-for-ss-ports-with-lpm-enabled.patch --- diff --git a/queue-5.0/series b/queue-5.0/series index 19cfc16eb61..24540ca4438 100644 --- a/queue-5.0/series +++ b/queue-5.0/series @@ -115,3 +115,10 @@ usb-mtu3-fix-extcon-dependency.patch usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch usb-common-consider-only-available-nodes-for-dr_mode.patch mm-memory.c-fix-modifying-of-page-protection-by-insert_pfn.patch +usb-host-xhci-rcar-add-xhci_trust_tx_length-quirk.patch +xhci-fix-port-resume-done-detection-for-ss-ports-with-lpm-enabled.patch +usb-xhci-dbc-don-t-free-all-memory-with-spinlock-held.patch +xhci-don-t-let-usb3-ports-stuck-in-polling-state-prevent-suspend.patch +usb-cdc-acm-fix-race-during-wakeup-blocking-tx-traffic.patch +usb-typec-tcpm-try-pd-2.0-if-sink-does-not-respond-to-3.0-source-caps.patch +usb-typec-fix-unchecked-return-value.patch diff --git a/queue-5.0/usb-cdc-acm-fix-race-during-wakeup-blocking-tx-traffic.patch b/queue-5.0/usb-cdc-acm-fix-race-during-wakeup-blocking-tx-traffic.patch new file mode 100644 index 00000000000..c3edff3c5c8 --- /dev/null +++ b/queue-5.0/usb-cdc-acm-fix-race-during-wakeup-blocking-tx-traffic.patch @@ -0,0 +1,46 @@ +From 93e1c8a638308980309e009cc40b5a57ef87caf1 Mon Sep 17 00:00:00 2001 +From: Romain Izard +Date: Fri, 22 Mar 2019 16:53:02 +0100 +Subject: usb: cdc-acm: fix race during wakeup blocking TX traffic + +From: Romain Izard + +commit 93e1c8a638308980309e009cc40b5a57ef87caf1 upstream. + +When the kernel is compiled with preemption enabled, the URB completion +handler can run in parallel with the work responsible for waking up the +tty layer. If the URB handler sets the EVENT_TTY_WAKEUP bit during the +call to tty_port_tty_wakeup() to signal that there is room for additional +input, it will be cleared at the end of this call. As a result, TX traffic +on the upper layer will be blocked. + +This can be seen with a kernel configured with CONFIG_PREEMPT, and a fast +modem connected with PPP running over a USB CDC-ACM port. + +Use test_and_clear_bit() instead, which ensures that each wakeup requested +by the URB completion code will trigger a call to tty_port_tty_wakeup(). + +Fixes: 1aba579f3cf5 cdc-acm: handle read pipe errors +Signed-off-by: Romain Izard +Cc: stable +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -558,10 +558,8 @@ static void acm_softint(struct work_stru + clear_bit(EVENT_RX_STALL, &acm->flags); + } + +- if (test_bit(EVENT_TTY_WAKEUP, &acm->flags)) { ++ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags)) + tty_port_tty_wakeup(&acm->port); +- clear_bit(EVENT_TTY_WAKEUP, &acm->flags); +- } + } + + /* diff --git a/queue-5.0/usb-host-xhci-rcar-add-xhci_trust_tx_length-quirk.patch b/queue-5.0/usb-host-xhci-rcar-add-xhci_trust_tx_length-quirk.patch new file mode 100644 index 00000000000..2e8185a4776 --- /dev/null +++ b/queue-5.0/usb-host-xhci-rcar-add-xhci_trust_tx_length-quirk.patch @@ -0,0 +1,38 @@ +From 40fc165304f0faaae78b761f8ee30b5d216b1850 Mon Sep 17 00:00:00 2001 +From: Yasushi Asano +Date: Mon, 18 Feb 2019 11:26:34 +0100 +Subject: usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk + +From: Yasushi Asano + +commit 40fc165304f0faaae78b761f8ee30b5d216b1850 upstream. + +When plugging BUFFALO LUA4-U3-AGT USB3.0 to Gigabit Ethernet LAN +Adapter, warning messages filled up dmesg. + +[ 101.098287] xhci-hcd ee000000.usb: WARN Successful completion on short TX for slot 1 ep 4: needs XHCI_TRUST_TX_LENGTH quirk? +[ 101.117463] xhci-hcd ee000000.usb: WARN Successful completion on short TX for slot 1 ep 4: needs XHCI_TRUST_TX_LENGTH quirk? +[ 101.136513] xhci-hcd ee000000.usb: WARN Successful completion on short TX for slot 1 ep 4: needs XHCI_TRUST_TX_LENGTH quirk? + +Adding the XHCI_TRUST_TX_LENGTH quirk resolves the issue. + +Signed-off-by: Yasushi Asano +Signed-off-by: Spyridon Papageorgiou +Acked-by: Yoshihiro Shimoda +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-rcar.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -246,6 +246,7 @@ int xhci_rcar_init_quirk(struct usb_hcd + if (!xhci_rcar_wait_for_pll_active(hcd)) + return -ETIMEDOUT; + ++ xhci->quirks |= XHCI_TRUST_TX_LENGTH; + return xhci_rcar_download_firmware(hcd); + } + diff --git a/queue-5.0/usb-typec-fix-unchecked-return-value.patch b/queue-5.0/usb-typec-fix-unchecked-return-value.patch new file mode 100644 index 00000000000..80e393f7627 --- /dev/null +++ b/queue-5.0/usb-typec-fix-unchecked-return-value.patch @@ -0,0 +1,47 @@ +From e82adc1074a7356f1158233551df9e86b7ebfb82 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Mon, 18 Mar 2019 16:18:30 -0500 +Subject: usb: typec: Fix unchecked return value + +From: Gustavo A. R. Silva + +commit e82adc1074a7356f1158233551df9e86b7ebfb82 upstream. + +Currently there is no check on platform_get_irq() return value +in case it fails, hence never actually reporting any errors and +causing unexpected behavior when using such value as argument +for function regmap_irq_get_virq(). + +Fix this by adding a proper check, a message error and return +*irq* in case platform_get_irq() fails. + +Addresses-Coverity-ID: 1443899 ("Improper use of negative value") +Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Guenter Roeck +Acked-by: Heikki Krogerus +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/tcpm/wcove.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/tcpm/wcove.c ++++ b/drivers/usb/typec/tcpm/wcove.c +@@ -615,8 +615,13 @@ static int wcove_typec_probe(struct plat + wcove->dev = &pdev->dev; + wcove->regmap = pmic->regmap; + +- irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, +- platform_get_irq(pdev, 0)); ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) { ++ dev_err(&pdev->dev, "Failed to get IRQ: %d\n", irq); ++ return irq; ++ } ++ ++ irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); + if (irq < 0) + return irq; + diff --git a/queue-5.0/usb-typec-tcpm-try-pd-2.0-if-sink-does-not-respond-to-3.0-source-caps.patch b/queue-5.0/usb-typec-tcpm-try-pd-2.0-if-sink-does-not-respond-to-3.0-source-caps.patch new file mode 100644 index 00000000000..4e95cb21519 --- /dev/null +++ b/queue-5.0/usb-typec-tcpm-try-pd-2.0-if-sink-does-not-respond-to-3.0-source-caps.patch @@ -0,0 +1,75 @@ +From 976daf9d1199932df80e7b04546d1a1bd4ed5ece Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 16 Mar 2019 16:57:12 +0100 +Subject: usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0 source-caps + +From: Hans de Goede + +commit 976daf9d1199932df80e7b04546d1a1bd4ed5ece upstream. + +PD 2.0 sinks are supposed to accept src-capabilities with a 3.0 header and +simply ignore any src PDOs which the sink does not understand such as PPS +but some 2.0 sinks instead ignore the entire PD_DATA_SOURCE_CAP message, +causing contract negotiation to fail. + +This commit fixes such sinks not working by re-trying the contract +negotiation with PD-2.0 source-caps messages if we don't have a contract +after PD_N_HARD_RESET_COUNT hard-reset attempts. + +The problem fixed by this commit was noticed with a Type-C to VGA dongle. + +Signed-off-by: Hans de Goede +Reviewed-by: Guenter Roeck +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/tcpm/tcpm.c | 27 ++++++++++++++++++++++++++- + 1 file changed, 26 insertions(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -37,6 +37,7 @@ + S(SRC_ATTACHED), \ + S(SRC_STARTUP), \ + S(SRC_SEND_CAPABILITIES), \ ++ S(SRC_SEND_CAPABILITIES_TIMEOUT), \ + S(SRC_NEGOTIATE_CAPABILITIES), \ + S(SRC_TRANSITION_SUPPLY), \ + S(SRC_READY), \ +@@ -2966,10 +2967,34 @@ static void run_state_machine(struct tcp + /* port->hard_reset_count = 0; */ + port->caps_count = 0; + port->pd_capable = true; +- tcpm_set_state_cond(port, hard_reset_state(port), ++ tcpm_set_state_cond(port, SRC_SEND_CAPABILITIES_TIMEOUT, + PD_T_SEND_SOURCE_CAP); + } + break; ++ case SRC_SEND_CAPABILITIES_TIMEOUT: ++ /* ++ * Error recovery for a PD_DATA_SOURCE_CAP reply timeout. ++ * ++ * PD 2.0 sinks are supposed to accept src-capabilities with a ++ * 3.0 header and simply ignore any src PDOs which the sink does ++ * not understand such as PPS but some 2.0 sinks instead ignore ++ * the entire PD_DATA_SOURCE_CAP message, causing contract ++ * negotiation to fail. ++ * ++ * After PD_N_HARD_RESET_COUNT hard-reset attempts, we try ++ * sending src-capabilities with a lower PD revision to ++ * make these broken sinks work. ++ */ ++ if (port->hard_reset_count < PD_N_HARD_RESET_COUNT) { ++ tcpm_set_state(port, HARD_RESET_SEND, 0); ++ } else if (port->negotiated_rev > PD_REV20) { ++ port->negotiated_rev--; ++ port->hard_reset_count = 0; ++ tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0); ++ } else { ++ tcpm_set_state(port, hard_reset_state(port), 0); ++ } ++ break; + case SRC_NEGOTIATE_CAPABILITIES: + ret = tcpm_pd_check_request(port); + if (ret < 0) { diff --git a/queue-5.0/usb-xhci-dbc-don-t-free-all-memory-with-spinlock-held.patch b/queue-5.0/usb-xhci-dbc-don-t-free-all-memory-with-spinlock-held.patch new file mode 100644 index 00000000000..ffa3162e152 --- /dev/null +++ b/queue-5.0/usb-xhci-dbc-don-t-free-all-memory-with-spinlock-held.patch @@ -0,0 +1,45 @@ +From 8867ea262196a6945c24a0fb739575af646ec0e9 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 22 Mar 2019 17:50:16 +0200 +Subject: usb: xhci: dbc: Don't free all memory with spinlock held + +From: Mathias Nyman + +commit 8867ea262196a6945c24a0fb739575af646ec0e9 upstream. + +The xhci debug capability (DbC) feature did its memory cleanup with +spinlock held. dma_free_coherent() warns if called with interrupts +disabled + +move the memory cleanup outside the spinlock + +Cc: stable +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-dbgcap.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -516,7 +516,6 @@ static int xhci_do_dbc_stop(struct xhci_ + return -1; + + writel(0, &dbc->regs->control); +- xhci_dbc_mem_cleanup(xhci); + dbc->state = DS_DISABLED; + + return 0; +@@ -562,8 +561,10 @@ static void xhci_dbc_stop(struct xhci_hc + ret = xhci_do_dbc_stop(xhci); + spin_unlock_irqrestore(&dbc->lock, flags); + +- if (!ret) ++ if (!ret) { ++ xhci_dbc_mem_cleanup(xhci); + pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller); ++ } + } + + static void diff --git a/queue-5.0/xhci-don-t-let-usb3-ports-stuck-in-polling-state-prevent-suspend.patch b/queue-5.0/xhci-don-t-let-usb3-ports-stuck-in-polling-state-prevent-suspend.patch new file mode 100644 index 00000000000..7dea7ea2822 --- /dev/null +++ b/queue-5.0/xhci-don-t-let-usb3-ports-stuck-in-polling-state-prevent-suspend.patch @@ -0,0 +1,89 @@ +From d92f2c59cc2cbca6bfb2cc54882b58ba76b15fd4 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 22 Mar 2019 17:50:17 +0200 +Subject: xhci: Don't let USB3 ports stuck in polling state prevent suspend + +From: Mathias Nyman + +commit d92f2c59cc2cbca6bfb2cc54882b58ba76b15fd4 upstream. + +Commit 2f31a67f01a8 ("usb: xhci: Prevent bus suspend if a port connect +change or polling state is detected") was intended to prevent ports that +were still link training from being forced to U3 suspend state mid +enumeration. +This solved enumeration issues for devices with slow link training. + +Turns out some devices are stuck in the link training/polling state, +and thus that patch will prevent suspend completely for these devices. +This is seen with USB3 card readers in some MacBooks. + +Instead of preventing suspend, give some time to complete the link +training. On successful training the port will end up as connected +and enabled. +If port instead is stuck in link training the bus suspend will continue +suspending after 360ms (10 * 36ms) timeout (tPollingLFPSTimeout). + +Original patch was sent to stable, this one should go there as well + +Fixes: 2f31a67f01a8 ("usb: xhci: Prevent bus suspend if a port connect change or polling state is detected") +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 19 ++++++++++++------- + drivers/usb/host/xhci.h | 8 ++++++++ + 2 files changed, 20 insertions(+), 7 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1545,20 +1545,25 @@ int xhci_bus_suspend(struct usb_hcd *hcd + port_index = max_ports; + while (port_index--) { + u32 t1, t2; +- ++ int retries = 10; ++retry: + t1 = readl(ports[port_index]->addr); + t2 = xhci_port_state_to_neutral(t1); + portsc_buf[port_index] = 0; + +- /* Bail out if a USB3 port has a new device in link training */ +- if ((hcd->speed >= HCD_USB3) && ++ /* ++ * Give a USB3 port in link training time to finish, but don't ++ * prevent suspend as port might be stuck ++ */ ++ if ((hcd->speed >= HCD_USB3) && retries-- && + (t1 & PORT_PLS_MASK) == XDEV_POLLING) { +- bus_state->bus_suspended = 0; + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_dbg(xhci, "Bus suspend bailout, port in polling\n"); +- return -EBUSY; ++ msleep(XHCI_PORT_POLLING_LFPS_TIME); ++ spin_lock_irqsave(&xhci->lock, flags); ++ xhci_dbg(xhci, "port %d polling in bus suspend, waiting\n", ++ port_index); ++ goto retry; + } +- + /* suspend ports in U0, or bail out for new connect changes */ + if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) { + if ((t1 & PORT_CSC) && wake_enabled) { +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -452,6 +452,14 @@ struct xhci_op_regs { + */ + #define XHCI_DEFAULT_BESL 4 + ++/* ++ * USB3 specification define a 360ms tPollingLFPSTiemout for USB3 ports ++ * to complete link training. usually link trainig completes much faster ++ * so check status 10 times with 36ms sleep in places we need to wait for ++ * polling to complete. ++ */ ++#define XHCI_PORT_POLLING_LFPS_TIME 36 ++ + /** + * struct xhci_intr_reg - Interrupt Register Set + * @irq_pending: IMAN - Interrupt Management Register. Used to enable diff --git a/queue-5.0/xhci-fix-port-resume-done-detection-for-ss-ports-with-lpm-enabled.patch b/queue-5.0/xhci-fix-port-resume-done-detection-for-ss-ports-with-lpm-enabled.patch new file mode 100644 index 00000000000..d72e8f886d7 --- /dev/null +++ b/queue-5.0/xhci-fix-port-resume-done-detection-for-ss-ports-with-lpm-enabled.patch @@ -0,0 +1,47 @@ +From 6cbcf596934c8e16d6288c7cc62dfb7ad8eadf15 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 22 Mar 2019 17:50:15 +0200 +Subject: xhci: Fix port resume done detection for SS ports with LPM enabled + +From: Mathias Nyman + +commit 6cbcf596934c8e16d6288c7cc62dfb7ad8eadf15 upstream. + +A suspended SS port in U3 link state will go to U0 when resumed, but +can almost immediately after that enter U1 or U2 link power save +states before host controller driver reads the port status. + +Host controller driver only checks for U0 state, and might miss +the finished resume, leaving flags unclear and skip notifying usb +code of the wake. + +Add U1 and U2 to the possible link states when checking for finished +port resume. + +Cc: stable +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1647,10 +1647,13 @@ static void handle_port_status(struct xh + } + } + +- if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_U0 && +- DEV_SUPERSPEED_ANY(portsc)) { ++ if ((portsc & PORT_PLC) && ++ DEV_SUPERSPEED_ANY(portsc) && ++ ((portsc & PORT_PLS_MASK) == XDEV_U0 || ++ (portsc & PORT_PLS_MASK) == XDEV_U1 || ++ (portsc & PORT_PLS_MASK) == XDEV_U2)) { + xhci_dbg(xhci, "resume SS port %d finished\n", port_id); +- /* We've just brought the device into U0 through either the ++ /* We've just brought the device into U0/1/2 through either the + * Resume state after a device remote wakeup, or through the + * U3Exit state after a host-initiated resume. If it's a device + * initiated remote wake, don't pass up the link state change,