From: Greg Kroah-Hartman Date: Mon, 23 Oct 2017 12:56:30 +0000 (+0200) Subject: 4.13-stable patches X-Git-Tag: v3.18.78~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=586f03d30623c1f87f7647e440420f790de44630;p=thirdparty%2Fkernel%2Fstable-queue.git 4.13-stable patches added patches: alsa-usb-audio-add-native-dsd-support-for-pro-ject-pre-box-s2-digital.patch can-af_can-can_pernet_init-add-missing-error-handling-for-kzalloc-returning-null.patch can-esd_usb2-fix-can_dlc-value-for-received-rtr-frames.patch can-flexcan-fix-i.mx28-state-transition-issue.patch can-flexcan-fix-i.mx6-state-transition-issue.patch can-flexcan-fix-p1010-state-transition-issue.patch can-flexcan-fix-state-transition-regression.patch can-flexcan-implement-error-passive-state-quirk.patch can-flexcan-rename-legacy-error-state-quirk.patch can-gs_usb-fix-busy-loop-if-no-more-tx-context-is-available.patch iio-dummy-events-add-missing-break.patch keys-encrypted-fix-dereference-of-null-user_key_payload.patch nbd-don-t-set-the-device-size-until-we-re-connected.patch parisc-fix-detection-of-nonsynchronous-cr16-cycle-counters.patch parisc-fix-double-word-compare-and-exchange-in-lws-code-on-32-bit-kernels.patch s390-cputime-fix-guest-irq-softirq-times-after-cpu-hotplug.patch scsi-qla2xxx-fix-uninitialized-work-element.patch usb-cdc_acm-add-quirk-for-elatec-twn3.patch usb-core-fix-out-of-bounds-access-bug-in-usb_get_bos_descriptor.patch usb-hub-allow-reset-retry-for-usb2-devices-on-connect-bounce.patch usb-musb-check-for-host-mode-using-is_host_active-on-reset-interrupt.patch usb-musb-fix-late-external-abort-on-suspend.patch usb-musb-fix-session-bit-runtime-pm-quirk.patch usb-musb-musb_cppi41-configure-the-number-of-channels-for-da8xx.patch usb-musb-musb_cppi41-fix-cppi41_set_dma_mode-for-da8xx.patch usb-musb-musb_cppi41-fix-the-address-of-teardown-and-autoreq-registers.patch usb-musb-sunxi-explicitly-release-usb-phy-on-exit.patch usb-quirks-add-quirk-for-worlde-mini-midi-keyboard.patch usb-serial-metro-usb-add-ms7820-device-id.patch usb-xhci-handle-error-condition-in-xhci_stop_device.patch usb-xhci-reset-halted-endpoint-if-trb-is-noop.patch xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch xhci-identify-usb-3.1-capable-hosts-by-their-port-protocol-capability.patch --- diff --git a/queue-4.13/alsa-usb-audio-add-native-dsd-support-for-pro-ject-pre-box-s2-digital.patch b/queue-4.13/alsa-usb-audio-add-native-dsd-support-for-pro-ject-pre-box-s2-digital.patch new file mode 100644 index 00000000000..152660875d4 --- /dev/null +++ b/queue-4.13/alsa-usb-audio-add-native-dsd-support-for-pro-ject-pre-box-s2-digital.patch @@ -0,0 +1,30 @@ +From 9bb201a5d5acc733943e8af7151cceab9d976a69 Mon Sep 17 00:00:00 2001 +From: Jussi Laako +Date: Sun, 15 Oct 2017 12:41:32 +0300 +Subject: ALSA: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital + +From: Jussi Laako + +commit 9bb201a5d5acc733943e8af7151cceab9d976a69 upstream. + +Add native DSD support quirk for Pro-Ject Pre Box S2 Digital USB id +2772:0230. + +Signed-off-by: Jussi Laako +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1352,6 +1352,7 @@ u64 snd_usb_interface_dsd_format_quirks( + case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */ + case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */ + case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */ ++ case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */ + if (fp->altsetting == 2) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; diff --git a/queue-4.13/can-af_can-can_pernet_init-add-missing-error-handling-for-kzalloc-returning-null.patch b/queue-4.13/can-af_can-can_pernet_init-add-missing-error-handling-for-kzalloc-returning-null.patch new file mode 100644 index 00000000000..b46a26f65a5 --- /dev/null +++ b/queue-4.13/can-af_can-can_pernet_init-add-missing-error-handling-for-kzalloc-returning-null.patch @@ -0,0 +1,53 @@ +From 5a606223c6b5b7560da253ed52e62c67fa18e29b Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Sat, 29 Jul 2017 11:51:01 +0200 +Subject: can: af_can: can_pernet_init(): add missing error handling for kzalloc returning NULL + +From: Marc Kleine-Budde + +commit 5a606223c6b5b7560da253ed52e62c67fa18e29b upstream. + +This patch adds the missing check and error handling for out-of-memory +situations, when kzalloc cannot allocate memory. + +Fixes: cb5635a36776 ("can: complete initial namespace support") +Acked-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + net/can/af_can.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -875,9 +875,14 @@ static int can_pernet_init(struct net *n + spin_lock_init(&net->can.can_rcvlists_lock); + net->can.can_rx_alldev_list = + kzalloc(sizeof(struct dev_rcv_lists), GFP_KERNEL); +- ++ if (!net->can.can_rx_alldev_list) ++ goto out; + net->can.can_stats = kzalloc(sizeof(struct s_stats), GFP_KERNEL); ++ if (!net->can.can_stats) ++ goto out_free_alldev_list; + net->can.can_pstats = kzalloc(sizeof(struct s_pstats), GFP_KERNEL); ++ if (!net->can.can_pstats) ++ goto out_free_can_stats; + + if (IS_ENABLED(CONFIG_PROC_FS)) { + /* the statistics are updated every second (timer triggered) */ +@@ -892,6 +897,13 @@ static int can_pernet_init(struct net *n + } + + return 0; ++ ++ out_free_can_stats: ++ kfree(net->can.can_stats); ++ out_free_alldev_list: ++ kfree(net->can.can_rx_alldev_list); ++ out: ++ return -ENOMEM; + } + + static void can_pernet_exit(struct net *net) diff --git a/queue-4.13/can-esd_usb2-fix-can_dlc-value-for-received-rtr-frames.patch b/queue-4.13/can-esd_usb2-fix-can_dlc-value-for-received-rtr-frames.patch new file mode 100644 index 00000000000..587f8faa3d8 --- /dev/null +++ b/queue-4.13/can-esd_usb2-fix-can_dlc-value-for-received-rtr-frames.patch @@ -0,0 +1,37 @@ +From 72d92e865d1560723e1957ee3f393688c49ca5bf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Stefan=20M=C3=A4tje?= +Date: Wed, 18 Oct 2017 13:25:17 +0200 +Subject: can: esd_usb2: Fix can_dlc value for received RTR, frames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Mätje + +commit 72d92e865d1560723e1957ee3f393688c49ca5bf upstream. + +The dlc member of the struct rx_msg contains also the ESD_RTR flag to +mark received RTR frames. Without the fix the can_dlc value for received +RTR frames would always be set to 8 by get_can_dlc() instead of the +received value. + +Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") +Signed-off-by: Stefan Mätje +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/esd_usb2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -333,7 +333,7 @@ static void esd_usb2_rx_can_msg(struct e + } + + cf->can_id = id & ESD_IDMASK; +- cf->can_dlc = get_can_dlc(msg->msg.rx.dlc); ++ cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR); + + if (id & ESD_EXTID) + cf->can_id |= CAN_EFF_FLAG; diff --git a/queue-4.13/can-flexcan-fix-i.mx28-state-transition-issue.patch b/queue-4.13/can-flexcan-fix-i.mx28-state-transition-issue.patch new file mode 100644 index 00000000000..7c611c2598e --- /dev/null +++ b/queue-4.13/can-flexcan-fix-i.mx28-state-transition-issue.patch @@ -0,0 +1,33 @@ +From 083c5571290a2d4308b75f1a59cf376b6e907808 Mon Sep 17 00:00:00 2001 +From: "ZHU Yi (ST-FIR/ENG1-Zhu)" +Date: Fri, 15 Sep 2017 07:08:23 +0000 +Subject: can: flexcan: fix i.MX28 state transition issue + +From: ZHU Yi (ST-FIR/ENG1-Zhu) + +commit 083c5571290a2d4308b75f1a59cf376b6e907808 upstream. + +Enable FLEXCAN_QUIRK_BROKEN_PERR_STATE for i.MX28 to report correct +state transitions, especially to error passive. + +Signed-off-by: Wolfgang Grandegger +Signed-off-by: Zhu Yi +Signed-off-by: Mark Jonas +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index d6ad12744ff1..ed544c44848f 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -285,7 +285,9 @@ static const struct flexcan_devtype_data fsl_p1010_devtype_data = { + .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE, + }; + +-static const struct flexcan_devtype_data fsl_imx28_devtype_data; ++static const struct flexcan_devtype_data fsl_imx28_devtype_data = { ++ .quirks = FLEXCAN_QUIRK_BROKEN_PERR_STATE, ++}; + + static const struct flexcan_devtype_data fsl_imx6q_devtype_data = { + .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS | diff --git a/queue-4.13/can-flexcan-fix-i.mx6-state-transition-issue.patch b/queue-4.13/can-flexcan-fix-i.mx6-state-transition-issue.patch new file mode 100644 index 00000000000..88ba68aadf0 --- /dev/null +++ b/queue-4.13/can-flexcan-fix-i.mx6-state-transition-issue.patch @@ -0,0 +1,33 @@ +From cf9c04677f2bf599b44511963039ec6e25583feb Mon Sep 17 00:00:00 2001 +From: "ZHU Yi (ST-FIR/ENG1-Zhu)" +Date: Fri, 15 Sep 2017 07:05:50 +0000 +Subject: can: flexcan: fix i.MX6 state transition issue + +From: ZHU Yi (ST-FIR/ENG1-Zhu) + +commit cf9c04677f2bf599b44511963039ec6e25583feb upstream. + +Enable FLEXCAN_QUIRK_BROKEN_PERR_STATE for i.MX6 to report correct state +transitions. + +Signed-off-by: Zhu Yi +Signed-off-by: Mark Jonas +Acked-by: Wolfgang Grandegger +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -289,7 +289,7 @@ static const struct flexcan_devtype_data + + static const struct flexcan_devtype_data fsl_imx6q_devtype_data = { + .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS | +- FLEXCAN_QUIRK_USE_OFF_TIMESTAMP, ++ FLEXCAN_QUIRK_USE_OFF_TIMESTAMP | FLEXCAN_QUIRK_BROKEN_PERR_STATE, + }; + + static const struct flexcan_devtype_data fsl_vf610_devtype_data = { diff --git a/queue-4.13/can-flexcan-fix-p1010-state-transition-issue.patch b/queue-4.13/can-flexcan-fix-p1010-state-transition-issue.patch new file mode 100644 index 00000000000..478d280893c --- /dev/null +++ b/queue-4.13/can-flexcan-fix-p1010-state-transition-issue.patch @@ -0,0 +1,35 @@ +From fb5b91d61bebc24686ffc379138fd67808b1a1e6 Mon Sep 17 00:00:00 2001 +From: "ZHU Yi (ST-FIR/ENG1-Zhu)" +Date: Fri, 15 Sep 2017 07:09:37 +0000 +Subject: can: flexcan: fix p1010 state transition issue + +From: ZHU Yi (ST-FIR/ENG1-Zhu) + +commit fb5b91d61bebc24686ffc379138fd67808b1a1e6 upstream. + +Enable FLEXCAN_QUIRK_BROKEN_WERR_STATE and +FLEXCAN_QUIRK_BROKEN_PERR_STATE for p1010 to report correct state +transitions. + +Signed-off-by: Zhu Yi +Signed-off-by: Mark Jonas +Acked-by: Wolfgang Grandegger +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -282,7 +282,8 @@ struct flexcan_priv { + }; + + static const struct flexcan_devtype_data fsl_p1010_devtype_data = { +- .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE, ++ .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE | ++ FLEXCAN_QUIRK_BROKEN_PERR_STATE, + }; + + static const struct flexcan_devtype_data fsl_imx28_devtype_data = { diff --git a/queue-4.13/can-flexcan-fix-state-transition-regression.patch b/queue-4.13/can-flexcan-fix-state-transition-regression.patch new file mode 100644 index 00000000000..b1a42d6100a --- /dev/null +++ b/queue-4.13/can-flexcan-fix-state-transition-regression.patch @@ -0,0 +1,36 @@ +From ad2302345d59d29232cb668baaae9e840925d153 Mon Sep 17 00:00:00 2001 +From: "ZHU Yi (ST-FIR/ENG1-Zhu)" +Date: Fri, 15 Sep 2017 06:59:15 +0000 +Subject: can: flexcan: fix state transition regression + +From: ZHU Yi (ST-FIR/ENG1-Zhu) + +commit ad2302345d59d29232cb668baaae9e840925d153 upstream. + +Update state upon any interrupt to report correct state transitions in +case the flexcan core enabled the broken error state quirk fix. + +Signed-off-by: Zhu Yi +Signed-off-by: Mark Jonas +Acked-by: Wolfgang Grandegger +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -765,8 +765,9 @@ static irqreturn_t flexcan_irq(int irq, + flexcan_write(reg_esr & FLEXCAN_ESR_ALL_INT, ®s->esr); + } + +- /* state change interrupt */ +- if (reg_esr & FLEXCAN_ESR_ERR_STATE) ++ /* state change interrupt or broken error state quirk fix is enabled */ ++ if ((reg_esr & FLEXCAN_ESR_ERR_STATE) || ++ (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_ERR_STATE)) + flexcan_irq_state(dev, reg_esr); + + /* bus error IRQ - handle if bus error reporting is activated */ diff --git a/queue-4.13/can-flexcan-implement-error-passive-state-quirk.patch b/queue-4.13/can-flexcan-implement-error-passive-state-quirk.patch new file mode 100644 index 00000000000..c976f82cf3e --- /dev/null +++ b/queue-4.13/can-flexcan-implement-error-passive-state-quirk.patch @@ -0,0 +1,162 @@ +From da49a8075c00b4d98ef069a0ee201177a8b79ead Mon Sep 17 00:00:00 2001 +From: "ZHU Yi (ST-FIR/ENG1-Zhu)" +Date: Fri, 15 Sep 2017 07:03:58 +0000 +Subject: can: flexcan: implement error passive state quirk + +From: ZHU Yi (ST-FIR/ENG1-Zhu) + +commit da49a8075c00b4d98ef069a0ee201177a8b79ead upstream. + +Add FLEXCAN_QUIRK_BROKEN_PERR_STATE for better description of the +missing error passive interrupt quirk. + +Error interrupt flooding may happen if the broken error state quirk fix +is enabled. For example, in case there is singled out node on the bus +and the node sends a frame, then error interrupt flooding happens and +will not stop because the node cannot go to bus off. The flooding will +stop after another node connected to the bus again. + +If high bitrate configured on the low end system, then the flooding +may causes performance issue, hence, this patch mitigates this by: +1. disable error interrupt upon error passive state transition +2. re-enable error interrupt upon error warning state transition +3. disable/enable error interrupt upon error active state transition + depends on FLEXCAN_QUIRK_BROKEN_WERR_STATE + +In this way, the driver is still able to report correct state +transitions without additional latency. When there are bus problems, +flooding of error interrupts is limited to the number of frames required +to change state from error warning to error passive if the core has +[TR]WRN_INT connected (FLEXCAN_QUIRK_BROKEN_WERR_STATE is not enabled), +otherwise, the flooding is limited to the number of frames required to +change state from error active to error passive. + +Signed-off-by: Zhu Yi +Signed-off-by: Mark Jonas +Acked-by: Wolfgang Grandegger +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 75 ++++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 66 insertions(+), 9 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -182,14 +182,14 @@ + /* FLEXCAN hardware feature flags + * + * Below is some version info we got: +- * SOC Version IP-Version Glitch- [TR]WRN_INT Memory err RTR re- +- * Filter? connected? detection ception in MB +- * MX25 FlexCAN2 03.00.00.00 no no no no +- * MX28 FlexCAN2 03.00.04.00 yes yes no no +- * MX35 FlexCAN2 03.00.00.00 no no no no +- * MX53 FlexCAN2 03.00.00.00 yes no no no +- * MX6s FlexCAN3 10.00.12.00 yes yes no yes +- * VF610 FlexCAN3 ? no yes yes yes? ++ * SOC Version IP-Version Glitch- [TR]WRN_INT IRQ Err Memory err RTR re- ++ * Filter? connected? Passive detection ception in MB ++ * MX25 FlexCAN2 03.00.00.00 no no ? no no ++ * MX28 FlexCAN2 03.00.04.00 yes yes no no no ++ * MX35 FlexCAN2 03.00.00.00 no no ? no no ++ * MX53 FlexCAN2 03.00.00.00 yes no no no no ++ * MX6s FlexCAN3 10.00.12.00 yes yes no no yes ++ * VF610 FlexCAN3 ? no yes ? yes yes? + * + * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected. + */ +@@ -198,6 +198,7 @@ + #define FLEXCAN_QUIRK_ENABLE_EACEN_RRS BIT(3) /* Enable EACEN and RRS bit in ctrl2 */ + #define FLEXCAN_QUIRK_DISABLE_MECR BIT(4) /* Disable Memory error detection */ + #define FLEXCAN_QUIRK_USE_OFF_TIMESTAMP BIT(5) /* Use timestamp based offloading */ ++#define FLEXCAN_QUIRK_BROKEN_PERR_STATE BIT(6) /* No interrupt for error passive */ + + /* Structure of the message buffer */ + struct flexcan_mb { +@@ -335,6 +336,22 @@ static inline void flexcan_write(u32 val + } + #endif + ++static inline void flexcan_error_irq_enable(const struct flexcan_priv *priv) ++{ ++ struct flexcan_regs __iomem *regs = priv->regs; ++ u32 reg_ctrl = (priv->reg_ctrl_default | FLEXCAN_CTRL_ERR_MSK); ++ ++ flexcan_write(reg_ctrl, ®s->ctrl); ++} ++ ++static inline void flexcan_error_irq_disable(const struct flexcan_priv *priv) ++{ ++ struct flexcan_regs __iomem *regs = priv->regs; ++ u32 reg_ctrl = (priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_MSK); ++ ++ flexcan_write(reg_ctrl, ®s->ctrl); ++} ++ + static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv) + { + if (!priv->reg_xceiver) +@@ -713,6 +730,7 @@ static irqreturn_t flexcan_irq(int irq, + struct flexcan_regs __iomem *regs = priv->regs; + irqreturn_t handled = IRQ_NONE; + u32 reg_iflag1, reg_esr; ++ enum can_state last_state = priv->can.state; + + reg_iflag1 = flexcan_read(®s->iflag1); + +@@ -767,7 +785,8 @@ static irqreturn_t flexcan_irq(int irq, + + /* state change interrupt or broken error state quirk fix is enabled */ + if ((reg_esr & FLEXCAN_ESR_ERR_STATE) || +- (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_WERR_STATE)) ++ (priv->devtype_data->quirks & (FLEXCAN_QUIRK_BROKEN_WERR_STATE | ++ FLEXCAN_QUIRK_BROKEN_PERR_STATE))) + flexcan_irq_state(dev, reg_esr); + + /* bus error IRQ - handle if bus error reporting is activated */ +@@ -775,6 +794,44 @@ static irqreturn_t flexcan_irq(int irq, + (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)) + flexcan_irq_bus_err(dev, reg_esr); + ++ /* availability of error interrupt among state transitions in case ++ * bus error reporting is de-activated and ++ * FLEXCAN_QUIRK_BROKEN_PERR_STATE is enabled: ++ * +--------------------------------------------------------------+ ++ * | +----------------------------------------------+ [stopped / | ++ * | | | sleeping] -+ ++ * +-+-> active <-> warning <-> passive -> bus off -+ ++ * ___________^^^^^^^^^^^^_______________________________ ++ * disabled(1) enabled disabled ++ * ++ * (1): enabled if FLEXCAN_QUIRK_BROKEN_WERR_STATE is enabled ++ */ ++ if ((last_state != priv->can.state) && ++ (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_PERR_STATE) && ++ !(priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)) { ++ switch (priv->can.state) { ++ case CAN_STATE_ERROR_ACTIVE: ++ if (priv->devtype_data->quirks & ++ FLEXCAN_QUIRK_BROKEN_WERR_STATE) ++ flexcan_error_irq_enable(priv); ++ else ++ flexcan_error_irq_disable(priv); ++ break; ++ ++ case CAN_STATE_ERROR_WARNING: ++ flexcan_error_irq_enable(priv); ++ break; ++ ++ case CAN_STATE_ERROR_PASSIVE: ++ case CAN_STATE_BUS_OFF: ++ flexcan_error_irq_disable(priv); ++ break; ++ ++ default: ++ break; ++ } ++ } ++ + return handled; + } + diff --git a/queue-4.13/can-flexcan-rename-legacy-error-state-quirk.patch b/queue-4.13/can-flexcan-rename-legacy-error-state-quirk.patch new file mode 100644 index 00000000000..5f881e5cf6b --- /dev/null +++ b/queue-4.13/can-flexcan-rename-legacy-error-state-quirk.patch @@ -0,0 +1,60 @@ +From 2f8639b24b4f4f9dd6cf7c1f2aea90e2fcbcc451 Mon Sep 17 00:00:00 2001 +From: "ZHU Yi (ST-FIR/ENG1-Zhu)" +Date: Fri, 15 Sep 2017 07:01:23 +0000 +Subject: can: flexcan: rename legacy error state quirk + +From: ZHU Yi (ST-FIR/ENG1-Zhu) + +commit 2f8639b24b4f4f9dd6cf7c1f2aea90e2fcbcc451 upstream. + +Rename FLEXCAN_QUIRK_BROKEN_ERR_STATE to FLEXCAN_QUIRK_BROKEN_WERR_STATE +for better description of the missing [TR]WRN_INT quirk. + +Signed-off-by: Zhu Yi +Signed-off-by: Mark Jonas +Acked-by: Wolfgang Grandegger +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -193,7 +193,7 @@ + * + * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected. + */ +-#define FLEXCAN_QUIRK_BROKEN_ERR_STATE BIT(1) /* [TR]WRN_INT not connected */ ++#define FLEXCAN_QUIRK_BROKEN_WERR_STATE BIT(1) /* [TR]WRN_INT not connected */ + #define FLEXCAN_QUIRK_DISABLE_RXFG BIT(2) /* Disable RX FIFO Global mask */ + #define FLEXCAN_QUIRK_ENABLE_EACEN_RRS BIT(3) /* Enable EACEN and RRS bit in ctrl2 */ + #define FLEXCAN_QUIRK_DISABLE_MECR BIT(4) /* Disable Memory error detection */ +@@ -281,7 +281,7 @@ struct flexcan_priv { + }; + + static const struct flexcan_devtype_data fsl_p1010_devtype_data = { +- .quirks = FLEXCAN_QUIRK_BROKEN_ERR_STATE, ++ .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE, + }; + + static const struct flexcan_devtype_data fsl_imx28_devtype_data; +@@ -767,7 +767,7 @@ static irqreturn_t flexcan_irq(int irq, + + /* state change interrupt or broken error state quirk fix is enabled */ + if ((reg_esr & FLEXCAN_ESR_ERR_STATE) || +- (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_ERR_STATE)) ++ (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_WERR_STATE)) + flexcan_irq_state(dev, reg_esr); + + /* bus error IRQ - handle if bus error reporting is activated */ +@@ -888,7 +888,7 @@ static int flexcan_chip_start(struct net + * on most Flexcan cores, too. Otherwise we don't get + * any error warning or passive interrupts. + */ +- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_ERR_STATE || ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_WERR_STATE || + priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING) + reg_ctrl |= FLEXCAN_CTRL_ERR_MSK; + else diff --git a/queue-4.13/can-gs_usb-fix-busy-loop-if-no-more-tx-context-is-available.patch b/queue-4.13/can-gs_usb-fix-busy-loop-if-no-more-tx-context-is-available.patch new file mode 100644 index 00000000000..e5ea80ec86b --- /dev/null +++ b/queue-4.13/can-gs_usb-fix-busy-loop-if-no-more-tx-context-is-available.patch @@ -0,0 +1,52 @@ +From 97819f943063b622eca44d3644067c190dc75039 Mon Sep 17 00:00:00 2001 +From: Wolfgang Grandegger +Date: Thu, 14 Sep 2017 18:37:14 +0200 +Subject: can: gs_usb: fix busy loop if no more TX context is available + +From: Wolfgang Grandegger + +commit 97819f943063b622eca44d3644067c190dc75039 upstream. + +If sending messages with no cable connected, it quickly happens that +there is no more TX context available. Then "gs_can_start_xmit()" +returns with "NETDEV_TX_BUSY" and the upper layer does retry +immediately keeping the CPU busy. To fix that issue, I moved +"atomic_dec(&dev->active_tx_urbs)" from "gs_usb_xmit_callback()" to +the TX done handling in "gs_usb_receive_bulk_callback()". Renaming +"active_tx_urbs" to "active_tx_contexts" and moving it into +"gs_[alloc|free]_tx_context()" would also make sense. + +Signed-off-by: Wolfgang Grandegger +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/gs_usb.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -375,6 +375,8 @@ static void gs_usb_receive_bulk_callback + + gs_free_tx_context(txc); + ++ atomic_dec(&dev->active_tx_urbs); ++ + netif_wake_queue(netdev); + } + +@@ -463,14 +465,6 @@ static void gs_usb_xmit_callback(struct + urb->transfer_buffer_length, + urb->transfer_buffer, + urb->transfer_dma); +- +- atomic_dec(&dev->active_tx_urbs); +- +- if (!netif_device_present(netdev)) +- return; +- +- if (netif_queue_stopped(netdev)) +- netif_wake_queue(netdev); + } + + static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, diff --git a/queue-4.13/iio-dummy-events-add-missing-break.patch b/queue-4.13/iio-dummy-events-add-missing-break.patch new file mode 100644 index 00000000000..7e3038c1003 --- /dev/null +++ b/queue-4.13/iio-dummy-events-add-missing-break.patch @@ -0,0 +1,33 @@ +From be94a6f6d488b4767662e8949dc62361bd1d6311 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Fri, 29 Sep 2017 15:24:05 +0200 +Subject: iio: dummy: events: Add missing break + +From: Lars-Peter Clausen + +commit be94a6f6d488b4767662e8949dc62361bd1d6311 upstream. + +Add missing break in iio_simple_dummy_write_event_config() for the voltage +threshold event enable attribute. Without this writing to the +in_voltage0_thresh_rising_en always returns -EINVAL even though the change +was correctly applied. + +Fixes: 3e34e650db197 ("iio: dummy: Demonstrate the usage of new channel types") +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/dummy/iio_simple_dummy_events.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dummy/iio_simple_dummy_events.c ++++ b/drivers/iio/dummy/iio_simple_dummy_events.c +@@ -72,6 +72,7 @@ int iio_simple_dummy_write_event_config( + st->event_en = state; + else + return -EINVAL; ++ break; + default: + return -EINVAL; + } diff --git a/queue-4.13/keys-encrypted-fix-dereference-of-null-user_key_payload.patch b/queue-4.13/keys-encrypted-fix-dereference-of-null-user_key_payload.patch new file mode 100644 index 00000000000..22d127a253e --- /dev/null +++ b/queue-4.13/keys-encrypted-fix-dereference-of-null-user_key_payload.patch @@ -0,0 +1,50 @@ +From 13923d0865ca96312197962522e88bc0aedccd74 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 9 Oct 2017 12:37:49 -0700 +Subject: KEYS: encrypted: fix dereference of NULL user_key_payload + +From: Eric Biggers + +commit 13923d0865ca96312197962522e88bc0aedccd74 upstream. + +A key of type "encrypted" references a "master key" which is used to +encrypt and decrypt the encrypted key's payload. However, when we +accessed the master key's payload, we failed to handle the case where +the master key has been revoked, which sets the payload pointer to NULL. +Note that request_key() *does* skip revoked keys, but there is still a +window where the key can be revoked before we acquire its semaphore. + +Fix it by checking for a NULL payload, treating it like a key which was +already revoked at the time it was requested. + +This was an issue for master keys of type "user" only. Master keys can +also be of type "trusted", but those cannot be revoked. + +Fixes: 7e70cb497850 ("keys: add new key-type encrypted") +Reviewed-by: James Morris +Cc: Mimi Zohar +Cc: David Safford +Signed-off-by: Eric Biggers +Signed-off-by: David Howells +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/encrypted-keys/encrypted.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -309,6 +309,13 @@ static struct key *request_user_key(cons + + down_read(&ukey->sem); + upayload = user_key_payload_locked(ukey); ++ if (!upayload) { ++ /* key was revoked before we acquired its semaphore */ ++ up_read(&ukey->sem); ++ key_put(ukey); ++ ukey = ERR_PTR(-EKEYREVOKED); ++ goto error; ++ } + *master_key = upayload->data; + *master_keylen = upayload->datalen; + error: diff --git a/queue-4.13/nbd-don-t-set-the-device-size-until-we-re-connected.patch b/queue-4.13/nbd-don-t-set-the-device-size-until-we-re-connected.patch new file mode 100644 index 00000000000..5b72f1e2b6c --- /dev/null +++ b/queue-4.13/nbd-don-t-set-the-device-size-until-we-re-connected.patch @@ -0,0 +1,43 @@ +From 639812a1ed9bf49ae2c026086fbf975339cd1eef Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Mon, 9 Oct 2017 13:12:10 -0400 +Subject: nbd: don't set the device size until we're connected + +From: Josef Bacik + +commit 639812a1ed9bf49ae2c026086fbf975339cd1eef upstream. + +A user reported a regression with using the normal ioctl interface on +newer kernels. This happens because I was setting the device size +before the device was actually connected, which caused us to error out +and close everything down. This didn't happen on netlink because we +hold the device lock the whole time we're setting things up, but we +don't do that for the ioctl path. This fixes the problem. + +Fixes: 29eaadc ("nbd: stop using the bdev everywhere") +Signed-off-by: Josef Bacik +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/nbd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -243,7 +243,6 @@ static void nbd_size_set(struct nbd_devi + struct nbd_config *config = nbd->config; + config->blksize = blocksize; + config->bytesize = blocksize * nr_blocks; +- nbd_size_update(nbd); + } + + static void nbd_complete_rq(struct request *req) +@@ -1090,6 +1089,7 @@ static int nbd_start_device(struct nbd_d + args->index = i; + queue_work(recv_workqueue, &args->work); + } ++ nbd_size_update(nbd); + return error; + } + diff --git a/queue-4.13/parisc-fix-detection-of-nonsynchronous-cr16-cycle-counters.patch b/queue-4.13/parisc-fix-detection-of-nonsynchronous-cr16-cycle-counters.patch new file mode 100644 index 00000000000..cc086d04dc4 --- /dev/null +++ b/queue-4.13/parisc-fix-detection-of-nonsynchronous-cr16-cycle-counters.patch @@ -0,0 +1,35 @@ +From 8642b31ba9eef8a01845146a26682d4869e62513 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Wed, 18 Oct 2017 22:25:00 +0200 +Subject: parisc: Fix detection of nonsynchronous cr16 cycle counters + +From: Helge Deller + +commit 8642b31ba9eef8a01845146a26682d4869e62513 upstream. + +For CPUs which have an unknown or invalid CPU location (physical location) +assume that their cycle counters aren't syncronized across CPUs. + +Signed-off-by: Helge Deller +Fixes: c8c3735997a3 ("parisc: Enhance detection of synchronous cr16 clocksources") +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/time.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/parisc/kernel/time.c ++++ b/arch/parisc/kernel/time.c +@@ -253,7 +253,10 @@ static int __init init_cr16_clocksource( + cpu0_loc = per_cpu(cpu_data, 0).cpu_loc; + + for_each_online_cpu(cpu) { +- if (cpu0_loc == per_cpu(cpu_data, cpu).cpu_loc) ++ if (cpu == 0) ++ continue; ++ if ((cpu0_loc != 0) && ++ (cpu0_loc == per_cpu(cpu_data, cpu).cpu_loc)) + continue; + + clocksource_cr16.name = "cr16_unstable"; diff --git a/queue-4.13/parisc-fix-double-word-compare-and-exchange-in-lws-code-on-32-bit-kernels.patch b/queue-4.13/parisc-fix-double-word-compare-and-exchange-in-lws-code-on-32-bit-kernels.patch new file mode 100644 index 00000000000..1fa1aaa417d --- /dev/null +++ b/queue-4.13/parisc-fix-double-word-compare-and-exchange-in-lws-code-on-32-bit-kernels.patch @@ -0,0 +1,55 @@ +From 374b3bf8e8b519f61eb9775888074c6e46b3bf0c Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Sat, 30 Sep 2017 17:24:23 -0400 +Subject: parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels + +From: John David Anglin + +commit 374b3bf8e8b519f61eb9775888074c6e46b3bf0c upstream. + +As discussed on the debian-hppa list, double-wordcompare and exchange +operations fail on 32-bit kernels. Looking at the code, I realized that +the ",ma" completer does the wrong thing in the "ldw,ma 4(%r26), %r29" +instruction. This increments %r26 and causes the following store to +write to the wrong location. + +Note by Helge Deller: +The patch applies cleanly to stable kernel series if this upstream +commit is merged in advance: +f4125cfdb300 ("parisc: Avoid trashing sr2 and sr3 in LWS code"). + +Signed-off-by: John David Anglin +Tested-by: Christoph Biedl +Fixes: 89206491201c ("parisc: Implement new LWS CAS supporting 64 bit operations.") +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/syscall.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -742,7 +742,7 @@ lws_compare_and_swap_2: + 10: ldd 0(%r25), %r25 + 11: ldd 0(%r24), %r24 + #else +- /* Load new value into r22/r23 - high/low */ ++ /* Load old value into r22/r23 - high/low */ + 10: ldw 0(%r25), %r22 + 11: ldw 4(%r25), %r23 + /* Load new value into fr4 for atomic store later */ +@@ -834,11 +834,11 @@ cas2_action: + copy %r0, %r28 + #else + /* Compare first word */ +-19: ldw,ma 0(%r26), %r29 ++19: ldw 0(%r26), %r29 + sub,= %r29, %r22, %r0 + b,n cas2_end + /* Compare second word */ +-20: ldw,ma 4(%r26), %r29 ++20: ldw 4(%r26), %r29 + sub,= %r29, %r23, %r0 + b,n cas2_end + /* Perform the store */ diff --git a/queue-4.13/s390-cputime-fix-guest-irq-softirq-times-after-cpu-hotplug.patch b/queue-4.13/s390-cputime-fix-guest-irq-softirq-times-after-cpu-hotplug.patch new file mode 100644 index 00000000000..1419e02e8c0 --- /dev/null +++ b/queue-4.13/s390-cputime-fix-guest-irq-softirq-times-after-cpu-hotplug.patch @@ -0,0 +1,48 @@ +From b7662eef14caf4f582d453d45395825b5a8f594c Mon Sep 17 00:00:00 2001 +From: Christian Borntraeger +Date: Wed, 4 Oct 2017 14:46:17 +0200 +Subject: s390/cputime: fix guest/irq/softirq times after CPU hotplug + +From: Christian Borntraeger + +commit b7662eef14caf4f582d453d45395825b5a8f594c upstream. + +On CPU hotplug some cpu stats contain bogus values: + +$ cat /proc/stat +cpu 0 0 49 1280 0 0 0 3 0 0 +cpu0 0 0 49 618 0 0 0 3 0 0 +cpu1 0 0 0 662 0 0 0 0 0 0 +[...] +$ echo 0 > /sys/devices/system/cpu/cpu1/online +$ echo 1 > /sys/devices/system/cpu/cpu1/online +$ cat /proc/stat +cpu 0 0 49 3200 0 450359962737 450359962737 3 0 0 +cpu0 0 0 49 1956 0 0 0 3 0 0 +cpu1 0 0 0 1244 0 450359962737 450359962737 0 0 0 +[...] + +pcpu_attach_task() needs the same assignments as vtime_task_switch. + +Signed-off-by: Christian Borntraeger +Fixes: b7394a5f4ce9 ("sched/cputime, s390: Implement delayed accounting of system time") +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/smp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -293,7 +293,10 @@ static void pcpu_attach_task(struct pcpu + lc->lpp = LPP_MAGIC; + lc->current_pid = tsk->pid; + lc->user_timer = tsk->thread.user_timer; ++ lc->guest_timer = tsk->thread.guest_timer; + lc->system_timer = tsk->thread.system_timer; ++ lc->hardirq_timer = tsk->thread.hardirq_timer; ++ lc->softirq_timer = tsk->thread.softirq_timer; + lc->steal_timer = 0; + } + diff --git a/queue-4.13/scsi-qla2xxx-fix-uninitialized-work-element.patch b/queue-4.13/scsi-qla2xxx-fix-uninitialized-work-element.patch new file mode 100644 index 00000000000..e9e65f7625f --- /dev/null +++ b/queue-4.13/scsi-qla2xxx-fix-uninitialized-work-element.patch @@ -0,0 +1,62 @@ +From a9e170e28636fd577249f39029d59e4e960a42b8 Mon Sep 17 00:00:00 2001 +From: Quinn Tran +Date: Tue, 10 Oct 2017 12:08:22 -0700 +Subject: scsi: qla2xxx: Fix uninitialized work element + +From: Quinn Tran + +commit a9e170e28636fd577249f39029d59e4e960a42b8 upstream. + +Fixes following stack trace + +kernel: Call Trace: +kernel: dump_stack+0x63/0x84 +kernel: __warn+0xd1/0xf0 +kernel: warn_slowpath_null+0x1d/0x20 +kernel: __queue_work+0x37a/0x420 +kernel: queue_work_on+0x27/0x40 +kernel: queue_work+0x14/0x20 [qla2xxx] +kernel: schedule_work+0x13/0x20 [qla2xxx] +kernel: qla2x00_post_work+0xab/0xb0 [qla2xxx] +kernel: qla2x00_post_aen_work+0x3b/0x50 [qla2xxx] +kernel: qla2x00_async_event+0x20d/0x15d0 [qla2xxx] +kernel: ? lock_timer_base+0x7d/0xa0 +kernel: qla24xx_intr_handler+0x1da/0x310 [qla2xxx] +kernel: qla2x00_poll+0x36/0x60 [qla2xxx] +kernel: qla2x00_mailbox_command+0x659/0xec0 [qla2xxx] +kernel: ? proc_create_data+0x7a/0xd0 +kernel: qla25xx_init_rsp_que+0x15b/0x240 [qla2xxx] +kernel: ? request_irq+0x14/0x20 [qla2xxx] +kernel: qla25xx_create_rsp_que+0x256/0x3c0 [qla2xxx] +kernel: qla2xxx_create_qpair+0x2af/0x5b0 [qla2xxx] +kernel: qla2x00_probe_one+0x1107/0x1c30 [qla2xxx] + +Fixes: ec7193e26055 ("qla2xxx: Fix delayed response to command for loop mode/direct connect.") +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_os.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3165,6 +3165,8 @@ qla2x00_probe_one(struct pci_dev *pdev, + host->can_queue, base_vha->req, + base_vha->mgmt_svr_loop_id, host->sg_tablesize); + ++ INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn); ++ + if (ha->mqenable) { + bool mq = false; + bool startit = false; +@@ -3213,7 +3215,6 @@ qla2x00_probe_one(struct pci_dev *pdev, + */ + qla2xxx_wake_dpc(base_vha); + +- INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn); + INIT_WORK(&ha->board_disable, qla2x00_disable_board_on_pci_error); + + if (IS_QLA8031(ha) || IS_MCTP_CAPABLE(ha)) { diff --git a/queue-4.13/series b/queue-4.13/series index bc584be743d..3d90bd7e87c 100644 --- a/queue-4.13/series +++ b/queue-4.13/series @@ -1,2 +1,35 @@ staging-bcm2835-audio-fix-memory-corruption.patch usb-devio-revert-usb-devio-don-t-corrupt-user-memory.patch +usb-core-fix-out-of-bounds-access-bug-in-usb_get_bos_descriptor.patch +usb-serial-metro-usb-add-ms7820-device-id.patch +usb-cdc_acm-add-quirk-for-elatec-twn3.patch +usb-quirks-add-quirk-for-worlde-mini-midi-keyboard.patch +usb-hub-allow-reset-retry-for-usb2-devices-on-connect-bounce.patch +alsa-usb-audio-add-native-dsd-support-for-pro-ject-pre-box-s2-digital.patch +can-gs_usb-fix-busy-loop-if-no-more-tx-context-is-available.patch +scsi-qla2xxx-fix-uninitialized-work-element.patch +nbd-don-t-set-the-device-size-until-we-re-connected.patch +s390-cputime-fix-guest-irq-softirq-times-after-cpu-hotplug.patch +parisc-fix-double-word-compare-and-exchange-in-lws-code-on-32-bit-kernels.patch +parisc-fix-detection-of-nonsynchronous-cr16-cycle-counters.patch +iio-dummy-events-add-missing-break.patch +usb-musb-sunxi-explicitly-release-usb-phy-on-exit.patch +usb-musb-fix-session-bit-runtime-pm-quirk.patch +usb-musb-fix-late-external-abort-on-suspend.patch +usb-musb-musb_cppi41-fix-the-address-of-teardown-and-autoreq-registers.patch +usb-musb-musb_cppi41-fix-cppi41_set_dma_mode-for-da8xx.patch +usb-musb-musb_cppi41-configure-the-number-of-channels-for-da8xx.patch +usb-musb-check-for-host-mode-using-is_host_active-on-reset-interrupt.patch +xhci-identify-usb-3.1-capable-hosts-by-their-port-protocol-capability.patch +xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch +usb-xhci-reset-halted-endpoint-if-trb-is-noop.patch +usb-xhci-handle-error-condition-in-xhci_stop_device.patch +can-esd_usb2-fix-can_dlc-value-for-received-rtr-frames.patch +can-af_can-can_pernet_init-add-missing-error-handling-for-kzalloc-returning-null.patch +can-flexcan-fix-state-transition-regression.patch +can-flexcan-rename-legacy-error-state-quirk.patch +can-flexcan-implement-error-passive-state-quirk.patch +can-flexcan-fix-i.mx6-state-transition-issue.patch +can-flexcan-fix-i.mx28-state-transition-issue.patch +can-flexcan-fix-p1010-state-transition-issue.patch +keys-encrypted-fix-dereference-of-null-user_key_payload.patch diff --git a/queue-4.13/usb-cdc_acm-add-quirk-for-elatec-twn3.patch b/queue-4.13/usb-cdc_acm-add-quirk-for-elatec-twn3.patch new file mode 100644 index 00000000000..63041ad42d0 --- /dev/null +++ b/queue-4.13/usb-cdc_acm-add-quirk-for-elatec-twn3.patch @@ -0,0 +1,136 @@ +From 765fb2f181cad669f2beb87842a05d8071f2be85 Mon Sep 17 00:00:00 2001 +From: Maksim Salau +Date: Wed, 11 Oct 2017 11:10:52 +0300 +Subject: usb: cdc_acm: Add quirk for Elatec TWN3 + +From: Maksim Salau + +commit 765fb2f181cad669f2beb87842a05d8071f2be85 upstream. + +Elatec TWN3 has the union descriptor on data interface. This results in +failure to bind the device to the driver with the following log: + usb 1-1.2: new full speed USB device using streamplug-ehci and address 4 + usb 1-1.2: New USB device found, idVendor=09d8, idProduct=0320 + usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 + usb 1-1.2: Product: RFID Device (COM) + usb 1-1.2: Manufacturer: OEM + cdc_acm 1-1.2:1.0: Zero length descriptor references + cdc_acm: probe of 1-1.2:1.0 failed with error -22 + +Adding the NO_UNION_NORMAL quirk for the device fixes the issue. + +`lsusb -v` of the device: + +Bus 001 Device 003: ID 09d8:0320 +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 2 Communications + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 32 + idVendor 0x09d8 + idProduct 0x0320 + bcdDevice 3.00 + iManufacturer 1 OEM + iProduct 2 RFID Device (COM) + iSerial 0 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 67 + bNumInterfaces 2 + bConfigurationValue 1 + iConfiguration 0 + bmAttributes 0x80 + (Bus Powered) + MaxPower 250mA + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0020 1x 32 bytes + bInterval 2 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0020 1x 32 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0020 1x 32 bytes + bInterval 0 + CDC Header: + bcdCDC 1.10 + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 1 + CDC ACM: + bmCapabilities 0x06 + sends break + line coding and serial state + CDC Union: + bMasterInterface 0 + bSlaveInterface 1 +Device Status: 0x0000 + (Bus Powered) + +Signed-off-by: Maksim Salau +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1832,6 +1832,9 @@ static const struct usb_device_id acm_id + { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */ + .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ + }, ++ { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ ++ .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */ ++ }, + + { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ + .driver_info = CLEAR_HALT_CONDITIONS, diff --git a/queue-4.13/usb-core-fix-out-of-bounds-access-bug-in-usb_get_bos_descriptor.patch b/queue-4.13/usb-core-fix-out-of-bounds-access-bug-in-usb_get_bos_descriptor.patch new file mode 100644 index 00000000000..d5f7db3b7a9 --- /dev/null +++ b/queue-4.13/usb-core-fix-out-of-bounds-access-bug-in-usb_get_bos_descriptor.patch @@ -0,0 +1,44 @@ +From 1c0edc3633b56000e18d82fc241e3995ca18a69e Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 18 Oct 2017 12:49:38 -0400 +Subject: USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() + +From: Alan Stern + +commit 1c0edc3633b56000e18d82fc241e3995ca18a69e upstream. + +Andrey used the syzkaller fuzzer to find an out-of-bounds memory +access in usb_get_bos_descriptor(). The code wasn't checking that the +next usb_dev_cap_header structure could fit into the remaining buffer +space. + +This patch fixes the error and also reduces the bNumDeviceCaps field +in the header to match the actual number of capabilities found, in +cases where there are fewer than expected. + +Reported-by: Andrey Konovalov +Signed-off-by: Alan Stern +Tested-by: Andrey Konovalov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -960,10 +960,12 @@ int usb_get_bos_descriptor(struct usb_de + for (i = 0; i < num; i++) { + buffer += length; + cap = (struct usb_dev_cap_header *)buffer; +- length = cap->bLength; + +- if (total_len < length) ++ if (total_len < sizeof(*cap) || total_len < cap->bLength) { ++ dev->bos->desc->bNumDeviceCaps = i; + break; ++ } ++ length = cap->bLength; + total_len -= length; + + if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { diff --git a/queue-4.13/usb-hub-allow-reset-retry-for-usb2-devices-on-connect-bounce.patch b/queue-4.13/usb-hub-allow-reset-retry-for-usb2-devices-on-connect-bounce.patch new file mode 100644 index 00000000000..3124b234a5d --- /dev/null +++ b/queue-4.13/usb-hub-allow-reset-retry-for-usb2-devices-on-connect-bounce.patch @@ -0,0 +1,61 @@ +From 1ac7db63333db1eeff901bfd6bbcd502b4634fa4 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 17 Oct 2017 16:07:33 +0300 +Subject: usb: hub: Allow reset retry for USB2 devices on connect bounce + +From: Mathias Nyman + +commit 1ac7db63333db1eeff901bfd6bbcd502b4634fa4 upstream. + +If the connect status change is set during reset signaling, but +the status remains connected just retry port reset. + +This solves an issue with connecting a 90W HP Thunderbolt 3 dock +with a Lenovo Carbon x1 (5th generation) which causes a 30min loop +of a high speed device being re-discovererd before usb ports starts +working. + +[...] +[ 389.023845] usb 3-1: new high-speed USB device number 55 using xhci_hcd +[ 389.491841] usb 3-1: new high-speed USB device number 56 using xhci_hcd +[ 389.959928] usb 3-1: new high-speed USB device number 57 using xhci_hcd +[...] + +This is caused by a high speed device that doesn't successfully go to the +enabled state after the second port reset. Instead the connection bounces +(connected, with connect status change), bailing out completely from +enumeration just to restart from scratch. + +Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1716332 + +Signed-off-by: Mathias Nyman +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2710,13 +2710,16 @@ static int hub_port_wait_reset(struct us + if (!(portstatus & USB_PORT_STAT_CONNECTION)) + return -ENOTCONN; + +- /* bomb out completely if the connection bounced. A USB 3.0 +- * connection may bounce if multiple warm resets were issued, ++ /* Retry if connect change is set but status is still connected. ++ * A USB 3.0 connection may bounce if multiple warm resets were issued, + * but the device may have successfully re-connected. Ignore it. + */ + if (!hub_is_superspeed(hub->hdev) && +- (portchange & USB_PORT_STAT_C_CONNECTION)) +- return -ENOTCONN; ++ (portchange & USB_PORT_STAT_C_CONNECTION)) { ++ usb_clear_port_feature(hub->hdev, port1, ++ USB_PORT_FEAT_C_CONNECTION); ++ return -EAGAIN; ++ } + + if (!(portstatus & USB_PORT_STAT_ENABLE)) + return -EBUSY; diff --git a/queue-4.13/usb-musb-check-for-host-mode-using-is_host_active-on-reset-interrupt.patch b/queue-4.13/usb-musb-check-for-host-mode-using-is_host_active-on-reset-interrupt.patch new file mode 100644 index 00000000000..5eb3f2e86d7 --- /dev/null +++ b/queue-4.13/usb-musb-check-for-host-mode-using-is_host_active-on-reset-interrupt.patch @@ -0,0 +1,53 @@ +From 445ef61543da3db5b699f87fb0aa4f227165f6ed Mon Sep 17 00:00:00 2001 +From: Jonathan Liu +Date: Mon, 9 Oct 2017 22:46:12 -0500 +Subject: usb: musb: Check for host-mode using is_host_active() on reset interrupt + +From: Jonathan Liu + +commit 445ef61543da3db5b699f87fb0aa4f227165f6ed upstream. + +The sunxi musb has a bug where sometimes it will generate a babble +error on device disconnect instead of a disconnect IRQ. When this +happens the musb controller switches from host mode to device mode +(it clears MUSB_DEVCTL_HM/MUSB_DEVCTL_SESSION and sets +MUSB_DEVCTL_BDEVICE) and gets stuck in this state. + +The babble error is misdetected as a bus reset because MUSB_DEVCTL_HM +was cleared. + +To fix this, use is_host_active() rather than (devctl & MUSB_DEVCTL_HM) +to detect babble error so that sunxi musb babble recovery can handle it +by restoring the mode. This information is provided by the driver logic +and does not rely on register contents. + +Signed-off-by: Jonathan Liu +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_core.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -906,7 +906,7 @@ b_host: + */ + if (int_usb & MUSB_INTR_RESET) { + handled = IRQ_HANDLED; +- if (devctl & MUSB_DEVCTL_HM) { ++ if (is_host_active(musb)) { + /* + * When BABBLE happens what we can depends on which + * platform MUSB is running, because some platforms +@@ -916,9 +916,7 @@ b_host: + * drop the session. + */ + dev_err(musb->controller, "Babble\n"); +- +- if (is_host_active(musb)) +- musb_recover_from_babble(musb); ++ musb_recover_from_babble(musb); + } else { + musb_dbg(musb, "BUS RESET as %s", + usb_otg_state_string(musb->xceiv->otg->state)); diff --git a/queue-4.13/usb-musb-fix-late-external-abort-on-suspend.patch b/queue-4.13/usb-musb-fix-late-external-abort-on-suspend.patch new file mode 100644 index 00000000000..c29b4881525 --- /dev/null +++ b/queue-4.13/usb-musb-fix-late-external-abort-on-suspend.patch @@ -0,0 +1,103 @@ +From 0c3aae9bd59978fb8c3557d7883380bef0f2cfa1 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 9 Oct 2017 22:46:08 -0500 +Subject: USB: musb: fix late external abort on suspend + +From: Johan Hovold + +commit 0c3aae9bd59978fb8c3557d7883380bef0f2cfa1 upstream. + +The musb delayed irq work was never flushed on suspend, something which +since 4.9 can lead to an external abort if the work is scheduled after +the grandparent's clock has been disabled: + +PM: Suspending system (mem) +PM: suspend of devices complete after 125.224 msecs +PM: suspend devices took 0.132 seconds +PM: late suspend of devices complete after 7.423 msecs +PM: noirq suspend of devices complete after 7.083 msecs +suspend debug: Waiting for 5 second(s). +Unhandled fault: external abort on non-linefetch (0x1008) at 0xd0262c60 +... +[] (musb_default_readb) from [] (musb_irq_work+0x48/0x220) +[] (musb_irq_work) from [] (process_one_work+0x1f4/0x758) +[] (process_one_work) from [] (worker_thread+0x54/0x514) +[] (worker_thread) from [] (kthread+0x128/0x158) +[] (kthread) from [] (ret_from_fork+0x14/0x24) + +Commit 2bff3916fda9 ("usb: musb: Fix PM for hub disconnect") started +scheduling musb_irq_work with a delay of up to a second and with +retries thereby making this easy to trigger, for example, by suspending +shortly after a disconnect. + +Note that we set a flag to prevent the irq work from rescheduling itself +during suspend and instead process a disconnect immediately. This takes +care of the case where we are disconnected shortly before suspending. + +However, when in host mode, a disconnect while suspended will still +go unnoticed and thus prevent the controller from runtime suspending +upon resume as the session bit is always set. This will need to be +addressed separately. + +Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support") +Fixes: 467d5c980709 ("usb: musb: Implement session bit based runtime PM for musb-core") +Fixes: 2bff3916fda9 ("usb: musb: Fix PM for hub disconnect") +Cc: Felipe Balbi +Cc: Tony Lindgren +Signed-off-by: Johan Hovold +Tested-by: Tony Lindgren +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_core.c | 11 +++++++++-- + drivers/usb/musb/musb_core.h | 2 ++ + 2 files changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1861,7 +1861,7 @@ static void musb_pm_runtime_check_sessio + MUSB_DEVCTL_HR; + switch (devctl & ~s) { + case MUSB_QUIRK_B_INVALID_VBUS_91: +- if (musb->quirk_retries) { ++ if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, + "Poll devctl on invalid vbus, assume no session"); + schedule_delayed_work(&musb->irq_work, +@@ -1871,7 +1871,7 @@ static void musb_pm_runtime_check_sessio + } + /* fall through */ + case MUSB_QUIRK_A_DISCONNECT_19: +- if (musb->quirk_retries) { ++ if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, + "Poll devctl on possible host mode disconnect"); + schedule_delayed_work(&musb->irq_work, +@@ -2681,8 +2681,15 @@ static int musb_suspend(struct device *d + + musb_platform_disable(musb); + musb_disable_interrupts(musb); ++ ++ musb->flush_irq_work = true; ++ while (flush_delayed_work(&musb->irq_work)) ++ ; ++ musb->flush_irq_work = false; ++ + if (!(musb->io.quirks & MUSB_PRESERVE_SESSION)) + musb_writeb(musb->mregs, MUSB_DEVCTL, 0); ++ + WARN_ON(!list_empty(&musb->pending_list)); + + spin_lock_irqsave(&musb->lock, flags); +--- a/drivers/usb/musb/musb_core.h ++++ b/drivers/usb/musb/musb_core.h +@@ -428,6 +428,8 @@ struct musb { + unsigned test_mode:1; + unsigned softconnect:1; + ++ unsigned flush_irq_work:1; ++ + u8 address; + u8 test_mode_nr; + u16 ackpend; /* ep0 */ diff --git a/queue-4.13/usb-musb-fix-session-bit-runtime-pm-quirk.patch b/queue-4.13/usb-musb-fix-session-bit-runtime-pm-quirk.patch new file mode 100644 index 00000000000..8156ca50132 --- /dev/null +++ b/queue-4.13/usb-musb-fix-session-bit-runtime-pm-quirk.patch @@ -0,0 +1,57 @@ +From 4f190e0b9de89c4c917c3ffb3799e9d00fc534ac Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 9 Oct 2017 22:46:07 -0500 +Subject: USB: musb: fix session-bit runtime-PM quirk + +From: Johan Hovold + +commit 4f190e0b9de89c4c917c3ffb3799e9d00fc534ac upstream. + +The current session-bit quirk implementation does not prevent the retry +counter from underflowing, something which could break runtime PM and +keep the device active for a very long time (about 2^32 seconds) after a +disconnect. + +This notably breaks the B-device timeout case, but could potentially +cause problems also when the controller is operating as an A-device. + +Fixes: 2bff3916fda9 ("usb: musb: Fix PM for hub disconnect") +Cc: Tony Lindgren +Signed-off-by: Johan Hovold +Tested-by: Tony Lindgren +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1861,22 +1861,22 @@ static void musb_pm_runtime_check_sessio + MUSB_DEVCTL_HR; + switch (devctl & ~s) { + case MUSB_QUIRK_B_INVALID_VBUS_91: +- if (musb->quirk_retries--) { ++ if (musb->quirk_retries) { + musb_dbg(musb, + "Poll devctl on invalid vbus, assume no session"); + schedule_delayed_work(&musb->irq_work, + msecs_to_jiffies(1000)); +- ++ musb->quirk_retries--; + return; + } + /* fall through */ + case MUSB_QUIRK_A_DISCONNECT_19: +- if (musb->quirk_retries--) { ++ if (musb->quirk_retries) { + musb_dbg(musb, + "Poll devctl on possible host mode disconnect"); + schedule_delayed_work(&musb->irq_work, + msecs_to_jiffies(1000)); +- ++ musb->quirk_retries--; + return; + } + if (!musb->session) diff --git a/queue-4.13/usb-musb-musb_cppi41-configure-the-number-of-channels-for-da8xx.patch b/queue-4.13/usb-musb-musb_cppi41-configure-the-number-of-channels-for-da8xx.patch new file mode 100644 index 00000000000..8e95f37be4c --- /dev/null +++ b/queue-4.13/usb-musb-musb_cppi41-configure-the-number-of-channels-for-da8xx.patch @@ -0,0 +1,125 @@ +From 297d7fe9e439473800ab1f2f853b4b5f8c888500 Mon Sep 17 00:00:00 2001 +From: Alexandre Bailon +Date: Mon, 9 Oct 2017 22:46:11 -0500 +Subject: usb: musb: musb_cppi41: Configure the number of channels for DA8xx + +From: Alexandre Bailon + +commit 297d7fe9e439473800ab1f2f853b4b5f8c888500 upstream. + +Currently, the number of channels is set to 15 but in the case of DA8xx, +the number of channels is 4. +Update the driver to configure the number of channels at runtime. + +Signed-off-by: Alexandre Bailon +Tested-by: Sekhar Nori +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_cppi41.c | 31 ++++++++++++++++++++++++++----- + 1 file changed, 26 insertions(+), 5 deletions(-) + +--- a/drivers/usb/musb/musb_cppi41.c ++++ b/drivers/usb/musb/musb_cppi41.c +@@ -30,10 +30,12 @@ + #define DA8XX_USB_AUTOREQ 0x14 + #define DA8XX_USB_TEARDOWN 0x1c + ++#define DA8XX_DMA_NUM_CHANNELS 4 ++ + struct cppi41_dma_controller { + struct dma_controller controller; +- struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS]; +- struct cppi41_dma_channel tx_channel[MUSB_DMA_NUM_CHANNELS]; ++ struct cppi41_dma_channel *rx_channel; ++ struct cppi41_dma_channel *tx_channel; + struct hrtimer early_tx; + struct list_head early_tx_list; + u32 rx_mode; +@@ -45,6 +47,7 @@ struct cppi41_dma_controller { + + void (*set_dma_mode)(struct cppi41_dma_channel *cppi41_channel, + unsigned int mode); ++ u8 num_channels; + }; + + static void save_rx_toggle(struct cppi41_dma_channel *cppi41_channel) +@@ -483,7 +486,7 @@ static struct dma_channel *cppi41_dma_ch + struct cppi41_dma_channel *cppi41_channel = NULL; + u8 ch_num = hw_ep->epnum - 1; + +- if (ch_num >= MUSB_DMA_NUM_CHANNELS) ++ if (ch_num >= controller->num_channels) + return NULL; + + if (is_tx) +@@ -643,7 +646,7 @@ static void cppi41_release_all_dma_chans + struct dma_chan *dc; + int i; + +- for (i = 0; i < MUSB_DMA_NUM_CHANNELS; i++) { ++ for (i = 0; i < ctrl->num_channels; i++) { + dc = ctrl->tx_channel[i].dc; + if (dc) + dma_release_channel(dc); +@@ -695,7 +698,7 @@ static int cppi41_dma_controller_start(s + goto err; + + ret = -EINVAL; +- if (port > MUSB_DMA_NUM_CHANNELS || !port) ++ if (port > controller->num_channels || !port) + goto err; + if (is_tx) + cppi41_channel = &controller->tx_channel[port - 1]; +@@ -736,6 +739,8 @@ void cppi41_dma_controller_destroy(struc + + hrtimer_cancel(&controller->early_tx); + cppi41_dma_controller_stop(controller); ++ kfree(controller->rx_channel); ++ kfree(controller->tx_channel); + kfree(controller); + } + EXPORT_SYMBOL_GPL(cppi41_dma_controller_destroy); +@@ -744,6 +749,7 @@ struct dma_controller * + cppi41_dma_controller_create(struct musb *musb, void __iomem *base) + { + struct cppi41_dma_controller *controller; ++ int channel_size; + int ret = 0; + + if (!musb->controller->parent->of_node) { +@@ -770,18 +776,33 @@ cppi41_dma_controller_create(struct musb + controller->tdown_reg = DA8XX_USB_TEARDOWN; + controller->autoreq_reg = DA8XX_USB_AUTOREQ; + controller->set_dma_mode = da8xx_set_dma_mode; ++ controller->num_channels = DA8XX_DMA_NUM_CHANNELS; + } else { + controller->tdown_reg = USB_TDOWN; + controller->autoreq_reg = USB_CTRL_AUTOREQ; + controller->set_dma_mode = cppi41_set_dma_mode; ++ controller->num_channels = MUSB_DMA_NUM_CHANNELS; + } + ++ channel_size = controller->num_channels * ++ sizeof(struct cppi41_dma_channel); ++ controller->rx_channel = kzalloc(channel_size, GFP_KERNEL); ++ if (!controller->rx_channel) ++ goto rx_channel_alloc_fail; ++ controller->tx_channel = kzalloc(channel_size, GFP_KERNEL); ++ if (!controller->tx_channel) ++ goto tx_channel_alloc_fail; ++ + ret = cppi41_dma_controller_start(controller); + if (ret) + goto plat_get_fail; + return &controller->controller; + + plat_get_fail: ++ kfree(controller->tx_channel); ++tx_channel_alloc_fail: ++ kfree(controller->rx_channel); ++rx_channel_alloc_fail: + kfree(controller); + kzalloc_fail: + if (ret == -EPROBE_DEFER) diff --git a/queue-4.13/usb-musb-musb_cppi41-fix-cppi41_set_dma_mode-for-da8xx.patch b/queue-4.13/usb-musb-musb_cppi41-fix-cppi41_set_dma_mode-for-da8xx.patch new file mode 100644 index 00000000000..5bdfd656b02 --- /dev/null +++ b/queue-4.13/usb-musb-musb_cppi41-fix-cppi41_set_dma_mode-for-da8xx.patch @@ -0,0 +1,122 @@ +From e10c5b0c773efb8643ee89d387d310584ca30830 Mon Sep 17 00:00:00 2001 +From: Alexandre Bailon +Date: Mon, 9 Oct 2017 22:46:10 -0500 +Subject: usb: musb: musb_cppi41: Fix cppi41_set_dma_mode() for DA8xx + +From: Alexandre Bailon + +commit e10c5b0c773efb8643ee89d387d310584ca30830 upstream. + +The way to configure the DMA mode on DA8xx is different from DSPS. +Add a new function to configure DMA mode on DA8xx and use a callback +to call the right function based on the platform. + +Signed-off-by: Alexandre Bailon +Tested-by: Sekhar Nori +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_cppi41.c | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +--- a/drivers/usb/musb/musb_cppi41.c ++++ b/drivers/usb/musb/musb_cppi41.c +@@ -26,6 +26,7 @@ + + #define MUSB_DMA_NUM_CHANNELS 15 + ++#define DA8XX_USB_MODE 0x10 + #define DA8XX_USB_AUTOREQ 0x14 + #define DA8XX_USB_TEARDOWN 0x1c + +@@ -41,6 +42,9 @@ struct cppi41_dma_controller { + + u32 tdown_reg; + u32 autoreq_reg; ++ ++ void (*set_dma_mode)(struct cppi41_dma_channel *cppi41_channel, ++ unsigned int mode); + }; + + static void save_rx_toggle(struct cppi41_dma_channel *cppi41_channel) +@@ -355,6 +359,32 @@ static void cppi41_set_dma_mode(struct c + } + } + ++static void da8xx_set_dma_mode(struct cppi41_dma_channel *cppi41_channel, ++ unsigned int mode) ++{ ++ struct cppi41_dma_controller *controller = cppi41_channel->controller; ++ struct musb *musb = controller->controller.musb; ++ unsigned int shift; ++ u32 port; ++ u32 new_mode; ++ u32 old_mode; ++ ++ old_mode = controller->tx_mode; ++ port = cppi41_channel->port_num; ++ ++ shift = (port - 1) * 4; ++ if (!cppi41_channel->is_tx) ++ shift += 16; ++ new_mode = old_mode & ~(3 << shift); ++ new_mode |= mode << shift; ++ ++ if (new_mode == old_mode) ++ return; ++ controller->tx_mode = new_mode; ++ musb_writel(musb->ctrl_base, DA8XX_USB_MODE, new_mode); ++} ++ ++ + static void cppi41_set_autoreq_mode(struct cppi41_dma_channel *cppi41_channel, + unsigned mode) + { +@@ -379,6 +409,7 @@ static bool cppi41_configure_channel(str + dma_addr_t dma_addr, u32 len) + { + struct cppi41_dma_channel *cppi41_channel = channel->private_data; ++ struct cppi41_dma_controller *controller = cppi41_channel->controller; + struct dma_chan *dc = cppi41_channel->dc; + struct dma_async_tx_descriptor *dma_desc; + enum dma_transfer_direction direction; +@@ -404,7 +435,7 @@ static bool cppi41_configure_channel(str + musb_writel(musb->ctrl_base, + RNDIS_REG(cppi41_channel->port_num), len); + /* gen rndis */ +- cppi41_set_dma_mode(cppi41_channel, ++ controller->set_dma_mode(cppi41_channel, + EP_MODE_DMA_GEN_RNDIS); + + /* auto req */ +@@ -413,14 +444,15 @@ static bool cppi41_configure_channel(str + } else { + musb_writel(musb->ctrl_base, + RNDIS_REG(cppi41_channel->port_num), 0); +- cppi41_set_dma_mode(cppi41_channel, ++ controller->set_dma_mode(cppi41_channel, + EP_MODE_DMA_TRANSPARENT); + cppi41_set_autoreq_mode(cppi41_channel, + EP_MODE_AUTOREQ_NONE); + } + } else { + /* fallback mode */ +- cppi41_set_dma_mode(cppi41_channel, EP_MODE_DMA_TRANSPARENT); ++ controller->set_dma_mode(cppi41_channel, ++ EP_MODE_DMA_TRANSPARENT); + cppi41_set_autoreq_mode(cppi41_channel, EP_MODE_AUTOREQ_NONE); + len = min_t(u32, packet_sz, len); + } +@@ -737,9 +769,11 @@ cppi41_dma_controller_create(struct musb + if (musb->io.quirks & MUSB_DA8XX) { + controller->tdown_reg = DA8XX_USB_TEARDOWN; + controller->autoreq_reg = DA8XX_USB_AUTOREQ; ++ controller->set_dma_mode = da8xx_set_dma_mode; + } else { + controller->tdown_reg = USB_TDOWN; + controller->autoreq_reg = USB_CTRL_AUTOREQ; ++ controller->set_dma_mode = cppi41_set_dma_mode; + } + + ret = cppi41_dma_controller_start(controller); diff --git a/queue-4.13/usb-musb-musb_cppi41-fix-the-address-of-teardown-and-autoreq-registers.patch b/queue-4.13/usb-musb-musb_cppi41-fix-the-address-of-teardown-and-autoreq-registers.patch new file mode 100644 index 00000000000..f1041be6030 --- /dev/null +++ b/queue-4.13/usb-musb-musb_cppi41-fix-the-address-of-teardown-and-autoreq-registers.patch @@ -0,0 +1,88 @@ +From bfa53e0e366b98185fadb03f7916d1538cb90ebd Mon Sep 17 00:00:00 2001 +From: Alexandre Bailon +Date: Mon, 9 Oct 2017 22:46:09 -0500 +Subject: usb: musb: musb_cppi41: Fix the address of teardown and autoreq registers + +From: Alexandre Bailon + +commit bfa53e0e366b98185fadb03f7916d1538cb90ebd upstream. + +The DA8xx and DSPS platforms don't use the same address for few registers. +On Da8xx, this is causing some issues (e.g. teardown that doesn't work). +Configure the address of the register during the init and use them instead +of constants. + +Reported-by: nsekhar@ti.com +Signed-off-by: Alexandre Bailon +Tested-by: Sekhar Nori +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_cppi41.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/usb/musb/musb_cppi41.c ++++ b/drivers/usb/musb/musb_cppi41.c +@@ -26,6 +26,9 @@ + + #define MUSB_DMA_NUM_CHANNELS 15 + ++#define DA8XX_USB_AUTOREQ 0x14 ++#define DA8XX_USB_TEARDOWN 0x1c ++ + struct cppi41_dma_controller { + struct dma_controller controller; + struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS]; +@@ -35,6 +38,9 @@ struct cppi41_dma_controller { + u32 rx_mode; + u32 tx_mode; + u32 auto_req; ++ ++ u32 tdown_reg; ++ u32 autoreq_reg; + }; + + static void save_rx_toggle(struct cppi41_dma_channel *cppi41_channel) +@@ -364,8 +370,8 @@ static void cppi41_set_autoreq_mode(stru + if (new_mode == old_mode) + return; + controller->auto_req = new_mode; +- musb_writel(controller->controller.musb->ctrl_base, USB_CTRL_AUTOREQ, +- new_mode); ++ musb_writel(controller->controller.musb->ctrl_base, ++ controller->autoreq_reg, new_mode); + } + + static bool cppi41_configure_channel(struct dma_channel *channel, +@@ -581,12 +587,13 @@ static int cppi41_dma_channel_abort(stru + + do { + if (is_tx) +- musb_writel(musb->ctrl_base, USB_TDOWN, tdbit); ++ musb_writel(musb->ctrl_base, controller->tdown_reg, ++ tdbit); + ret = dmaengine_terminate_all(cppi41_channel->dc); + } while (ret == -EAGAIN); + + if (is_tx) { +- musb_writel(musb->ctrl_base, USB_TDOWN, tdbit); ++ musb_writel(musb->ctrl_base, controller->tdown_reg, tdbit); + + csr = musb_readw(epio, MUSB_TXCSR); + if (csr & MUSB_TXCSR_TXPKTRDY) { +@@ -727,6 +734,14 @@ cppi41_dma_controller_create(struct musb + controller->controller.is_compatible = cppi41_is_compatible; + controller->controller.musb = musb; + ++ if (musb->io.quirks & MUSB_DA8XX) { ++ controller->tdown_reg = DA8XX_USB_TEARDOWN; ++ controller->autoreq_reg = DA8XX_USB_AUTOREQ; ++ } else { ++ controller->tdown_reg = USB_TDOWN; ++ controller->autoreq_reg = USB_CTRL_AUTOREQ; ++ } ++ + ret = cppi41_dma_controller_start(controller); + if (ret) + goto plat_get_fail; diff --git a/queue-4.13/usb-musb-sunxi-explicitly-release-usb-phy-on-exit.patch b/queue-4.13/usb-musb-sunxi-explicitly-release-usb-phy-on-exit.patch new file mode 100644 index 00000000000..a9f4204cb07 --- /dev/null +++ b/queue-4.13/usb-musb-sunxi-explicitly-release-usb-phy-on-exit.patch @@ -0,0 +1,33 @@ +From 6ed05c68cbcae42cd52b8e53b66952bfa9c002ce Mon Sep 17 00:00:00 2001 +From: Jonathan Liu +Date: Mon, 9 Oct 2017 22:46:13 -0500 +Subject: usb: musb: sunxi: Explicitly release USB PHY on exit + +From: Jonathan Liu + +commit 6ed05c68cbcae42cd52b8e53b66952bfa9c002ce upstream. + +This fixes a kernel oops when unloading the driver due to usb_put_phy +being called after usb_phy_generic_unregister when the device is +detached. Calling usb_phy_generic_unregister causes x->dev->driver to +be NULL in usb_put_phy and results in a NULL pointer dereference. + +Signed-off-by: Jonathan Liu +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/sunxi.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/musb/sunxi.c ++++ b/drivers/usb/musb/sunxi.c +@@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb * + if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) + sunxi_sram_release(musb->controller->parent); + ++ devm_usb_put_phy(glue->dev, glue->xceiv); ++ + return 0; + } + diff --git a/queue-4.13/usb-quirks-add-quirk-for-worlde-mini-midi-keyboard.patch b/queue-4.13/usb-quirks-add-quirk-for-worlde-mini-midi-keyboard.patch new file mode 100644 index 00000000000..3caf062955c --- /dev/null +++ b/queue-4.13/usb-quirks-add-quirk-for-worlde-mini-midi-keyboard.patch @@ -0,0 +1,39 @@ +From 2811501e6d8f5747d08f8e25b9ecf472d0dc4c7d Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Tue, 3 Oct 2017 11:16:43 +0300 +Subject: usb: quirks: add quirk for WORLDE MINI MIDI keyboard +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felipe Balbi + +commit 2811501e6d8f5747d08f8e25b9ecf472d0dc4c7d upstream. + +This keyboard doesn't implement Get String descriptors properly even +though string indexes are valid. What happens is that when requesting +for the String descriptor, the device disconnects and +reconnects. Without this quirk, this loop will continue forever. + +Cc: Alan Stern +Reported-by: Владимир Мартьянов +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -221,6 +221,10 @@ static const struct usb_device_id usb_qu + /* Corsair Strafe RGB */ + { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, + ++ /* MIDI keyboard WORLDE MINI */ ++ { USB_DEVICE(0x1c75, 0x0204), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* Acer C120 LED Projector */ + { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM }, + diff --git a/queue-4.13/usb-serial-metro-usb-add-ms7820-device-id.patch b/queue-4.13/usb-serial-metro-usb-add-ms7820-device-id.patch new file mode 100644 index 00000000000..76773a24052 --- /dev/null +++ b/queue-4.13/usb-serial-metro-usb-add-ms7820-device-id.patch @@ -0,0 +1,34 @@ +From 31dc3f819bac28a0990b36510197560258ab7421 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 12 Oct 2017 14:50:46 +0200 +Subject: USB: serial: metro-usb: add MS7820 device id + +From: Johan Hovold + +commit 31dc3f819bac28a0990b36510197560258ab7421 upstream. + +Add device-id entry for (Honeywell) Metrologic MS7820 bar code scanner. + +The device has two interfaces (in this mode?); a vendor-specific +interface with two interrupt endpoints and a second HID interface, which +we do not bind to. + +Reported-by: Ladislav Dobrovsky +Tested-by: Ladislav Dobrovsky +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/metro-usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/metro-usb.c ++++ b/drivers/usb/serial/metro-usb.c +@@ -45,6 +45,7 @@ struct metrousb_private { + static const struct usb_device_id id_table[] = { + { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) }, + { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0c2e, 0x0730, 0xff) }, /* MS7820 */ + { }, /* Terminating entry. */ + }; + MODULE_DEVICE_TABLE(usb, id_table); diff --git a/queue-4.13/usb-xhci-handle-error-condition-in-xhci_stop_device.patch b/queue-4.13/usb-xhci-handle-error-condition-in-xhci_stop_device.patch new file mode 100644 index 00000000000..82df1b3c618 --- /dev/null +++ b/queue-4.13/usb-xhci-handle-error-condition-in-xhci_stop_device.patch @@ -0,0 +1,70 @@ +From b3207c65dfafae27e7c492cb9188c0dc0eeaf3fd Mon Sep 17 00:00:00 2001 +From: Mayank Rana +Date: Fri, 6 Oct 2017 17:45:30 +0300 +Subject: usb: xhci: Handle error condition in xhci_stop_device() + +From: Mayank Rana + +commit b3207c65dfafae27e7c492cb9188c0dc0eeaf3fd upstream. + +xhci_stop_device() calls xhci_queue_stop_endpoint() multiple times +without checking the return value. xhci_queue_stop_endpoint() can +return error if the HC is already halted or unable to queue commands. +This can cause a deadlock condition as xhci_stop_device() would +end up waiting indefinitely for a completion for the command that +didn't get queued. Fix this by checking the return value and bailing +out of xhci_stop_device() in case of error. This patch happens to fix +potential memory leaks of the allocated command structures as well. + +Fixes: c311e391a7ef ("xhci: rework command timeout and cancellation,") +Signed-off-by: Mayank Rana +Signed-off-by: Jack Pham +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -420,14 +420,25 @@ static int xhci_stop_device(struct xhci_ + GFP_NOWAIT); + if (!command) { + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_free_command(xhci, cmd); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto cmd_cleanup; ++ } ++ ++ ret = xhci_queue_stop_endpoint(xhci, command, slot_id, ++ i, suspend); ++ if (ret) { ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_free_command(xhci, command); ++ goto cmd_cleanup; + } +- xhci_queue_stop_endpoint(xhci, command, slot_id, i, +- suspend); + } + } +- xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend); ++ ret = xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend); ++ if (ret) { ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ goto cmd_cleanup; ++ } ++ + xhci_ring_cmd_db(xhci); + spin_unlock_irqrestore(&xhci->lock, flags); + +@@ -439,6 +450,8 @@ static int xhci_stop_device(struct xhci_ + xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n"); + ret = -ETIME; + } ++ ++cmd_cleanup: + xhci_free_command(xhci, cmd); + return ret; + } diff --git a/queue-4.13/usb-xhci-reset-halted-endpoint-if-trb-is-noop.patch b/queue-4.13/usb-xhci-reset-halted-endpoint-if-trb-is-noop.patch new file mode 100644 index 00000000000..cc1515a2d6b --- /dev/null +++ b/queue-4.13/usb-xhci-reset-halted-endpoint-if-trb-is-noop.patch @@ -0,0 +1,55 @@ +From 810a624bd1b64b13ddcc2eb5c1880526a750a870 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Fri, 6 Oct 2017 17:45:29 +0300 +Subject: usb: xhci: Reset halted endpoint if trb is noop + +From: Lu Baolu + +commit 810a624bd1b64b13ddcc2eb5c1880526a750a870 upstream. + +When a URB is cancled, xhci driver turns the untransferred trbs +into no-ops. If an endpoint stalls on a no-op trb that belongs +to the cancelled URB, the event handler won't reset the endpoint. +Hence, it will stay halted. + +Link: http://marc.info/?l=linux-usb&m=149582598330127&w=2 + +Signed-off-by: Lu Baolu +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2578,15 +2578,21 @@ static int handle_tx_event(struct xhci_h + (struct xhci_generic_trb *) ep_trb); + + /* +- * No-op TRB should not trigger interrupts. +- * If ep_trb is a no-op TRB, it means the +- * corresponding TD has been cancelled. Just ignore +- * the TD. ++ * No-op TRB could trigger interrupts in a case where ++ * a URB was killed and a STALL_ERROR happens right ++ * after the endpoint ring stopped. Reset the halted ++ * endpoint. Otherwise, the endpoint remains stalled ++ * indefinitely. + */ + if (trb_is_noop(ep_trb)) { +- xhci_dbg(xhci, +- "ep_trb is a no-op TRB. Skip it for slot %u ep %u\n", +- slot_id, ep_index); ++ if (trb_comp_code == COMP_STALL_ERROR || ++ xhci_requires_manual_halt_cleanup(xhci, ep_ctx, ++ trb_comp_code)) ++ xhci_cleanup_halted_endpoint(xhci, slot_id, ++ ep_index, ++ ep_ring->stream_id, ++ td, ep_trb, ++ EP_HARD_RESET); + goto cleanup; + } + diff --git a/queue-4.13/xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch b/queue-4.13/xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch new file mode 100644 index 00000000000..97018207107 --- /dev/null +++ b/queue-4.13/xhci-cleanup-current_cmd-in-xhci_cleanup_command_queue.patch @@ -0,0 +1,43 @@ +From d1aad52cf8b3f95dfe9b5b64da66343306ddf73b Mon Sep 17 00:00:00 2001 +From: Jeffy Chen +Date: Fri, 6 Oct 2017 17:45:28 +0300 +Subject: xhci: Cleanup current_cmd in xhci_cleanup_command_queue() + +From: Jeffy Chen + +commit d1aad52cf8b3f95dfe9b5b64da66343306ddf73b upstream. + +KASAN reported use-after-free bug when xhci host controller died: +[ 176.952537] BUG: KASAN: use-after-free in xhci_handle_command_timeout+0x68/0x224 +[ 176.960846] Write of size 4 at addr ffffffc0cbb01608 by task kworker/3:3/1680 +... +[ 177.180644] Freed by task 0: +[ 177.183882] kasan_slab_free+0x90/0x15c +[ 177.188194] kfree+0x114/0x28c +[ 177.191630] xhci_cleanup_command_queue+0xc8/0xf8 +[ 177.196916] xhci_hc_died+0x84/0x358 + +Problem here is that when the cmd_timer fired, it would try to access +current_cmd while the command queue is already freed by xhci_hc_died(). + +Cleanup current_cmd in xhci_cleanup_command_queue() to avoid that. + +Fixes: d9f11ba9f107 ("xhci: Rework how we handle unresponsive or hoptlug removed hosts") +Signed-off-by: Jeffy Chen +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1309,6 +1309,7 @@ static void xhci_complete_del_and_free_c + void xhci_cleanup_command_queue(struct xhci_hcd *xhci) + { + struct xhci_command *cur_cmd, *tmp_cmd; ++ xhci->current_cmd = NULL; + list_for_each_entry_safe(cur_cmd, tmp_cmd, &xhci->cmd_list, cmd_list) + xhci_complete_del_and_free_cmd(cur_cmd, COMP_COMMAND_ABORTED); + } diff --git a/queue-4.13/xhci-identify-usb-3.1-capable-hosts-by-their-port-protocol-capability.patch b/queue-4.13/xhci-identify-usb-3.1-capable-hosts-by-their-port-protocol-capability.patch new file mode 100644 index 00000000000..056f7268029 --- /dev/null +++ b/queue-4.13/xhci-identify-usb-3.1-capable-hosts-by-their-port-protocol-capability.patch @@ -0,0 +1,40 @@ +From ea7d0d69426cab6747ed311c53f4142eb48b9454 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 6 Oct 2017 17:45:27 +0300 +Subject: xhci: Identify USB 3.1 capable hosts by their port protocol capability + +From: Mathias Nyman + +commit ea7d0d69426cab6747ed311c53f4142eb48b9454 upstream. + +Many USB 3.1 capable hosts never updated the Serial Bus Release Number +(SBRN) register to USB 3.1 from USB 3.0 + +xhci driver identified USB 3.1 capable hosts based on this SBRN register, +which according to specs "contains the release of the Universal Serial +Bus Specification with which this Universal Serial Bus Host Controller +module is compliant." but still in october 2017 gives USB 3.0 as +the only possible option. + +Make an additional check for USB 3.1 support and enable it if the xHCI +supported protocol capablity lists USB 3.1 capable ports. + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4805,7 +4805,8 @@ int xhci_gen_setup(struct usb_hcd *hcd, + */ + hcd->has_tt = 1; + } else { +- if (xhci->sbrn == 0x31) { ++ /* Some 3.1 hosts return sbrn 0x30, can't rely on sbrn alone */ ++ if (xhci->sbrn == 0x31 || xhci->usb3_rhub.min_rev >= 1) { + xhci_info(xhci, "Host supports USB 3.1 Enhanced SuperSpeed\n"); + hcd->speed = HCD_USB31; + hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;