From: Greg Kroah-Hartman Date: Tue, 8 Nov 2016 10:36:55 +0000 (+0100) Subject: 4.8-stable patches X-Git-Tag: v4.4.31~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8405710ee759eec97e2da06e0f68f3e281436fc2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.8-stable patches added patches: arm64-dts-marvell-fix-clocksource-for-cp110-master-spi0.patch dm-free-io_barrier-after-blk_cleanup_queue-call.patch hv-do-not-lose-pending-heartbeat-vmbus-packets.patch iio-chemical-atlas-ph-sensor-fix-use-of-32-bit-int-to-hold-16-bit-big-endian-value.patch staging-wilc1000-fix-kernel-oops-on-opening-the-device.patch tty-limit-terminal-size-to-4m-chars.patch vt-clear-selection-before-resizing.patch x86-smpboot-init-apic-mapping-before-usage.patch xhci-add-restart-quirk-for-intel-wildcatpoint-pch.patch xhci-workaround-for-hosts-missing-cas-bit.patch --- diff --git a/queue-4.8/arm64-dts-marvell-fix-clocksource-for-cp110-master-spi0.patch b/queue-4.8/arm64-dts-marvell-fix-clocksource-for-cp110-master-spi0.patch new file mode 100644 index 00000000000..09f929d6418 --- /dev/null +++ b/queue-4.8/arm64-dts-marvell-fix-clocksource-for-cp110-master-spi0.patch @@ -0,0 +1,33 @@ +From 51227bf52008bd4c4c50da4b749bbc6e7bbbca52 Mon Sep 17 00:00:00 2001 +From: Marcin Wojtas +Date: Tue, 6 Sep 2016 19:41:11 +0200 +Subject: arm64: dts: marvell: fix clocksource for CP110 master SPI0 + +From: Marcin Wojtas + +commit 51227bf52008bd4c4c50da4b749bbc6e7bbbca52 upstream. + +I2C and SPI interfaces share common clock trees within the CP110 HW block. +It occurred that SPI0 interface has wrong clock assignment in the device +tree, which is fixed in this commit to a proper value. + +Fixes: 728dacc7f4dd ("arm64: dts: marvell: initial DT description of ...") +Signed-off-by: Marcin Wojtas +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi +@@ -131,7 +131,7 @@ + #address-cells = <0x1>; + #size-cells = <0x0>; + cell-index = <1>; +- clocks = <&cpm_syscon0 0 3>; ++ clocks = <&cpm_syscon0 1 21>; + status = "disabled"; + }; + diff --git a/queue-4.8/dm-free-io_barrier-after-blk_cleanup_queue-call.patch b/queue-4.8/dm-free-io_barrier-after-blk_cleanup_queue-call.patch new file mode 100644 index 00000000000..4b07d06a37f --- /dev/null +++ b/queue-4.8/dm-free-io_barrier-after-blk_cleanup_queue-call.patch @@ -0,0 +1,43 @@ +From d09960b0032174eb493c4c13be5b9c9ef36dc9a7 Mon Sep 17 00:00:00 2001 +From: Tahsin Erdogan +Date: Mon, 10 Oct 2016 05:35:19 -0700 +Subject: dm: free io_barrier after blk_cleanup_queue call + +From: Tahsin Erdogan + +commit d09960b0032174eb493c4c13be5b9c9ef36dc9a7 upstream. + +dm_old_request_fn() has paths that access md->io_barrier. The party +destroying io_barrier should ensure that no future execution of +dm_old_request_fn() is possible. Move io_barrier destruction to below +blk_cleanup_queue() to ensure this and avoid a NULL pointer crash during +request-based DM device shutdown. + +Signed-off-by: Tahsin Erdogan +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1423,8 +1423,6 @@ static void cleanup_mapped_device(struct + if (md->bs) + bioset_free(md->bs); + +- cleanup_srcu_struct(&md->io_barrier); +- + if (md->disk) { + spin_lock(&_minor_lock); + md->disk->private_data = NULL; +@@ -1436,6 +1434,8 @@ static void cleanup_mapped_device(struct + if (md->queue) + blk_cleanup_queue(md->queue); + ++ cleanup_srcu_struct(&md->io_barrier); ++ + if (md->bdev) { + bdput(md->bdev); + md->bdev = NULL; diff --git a/queue-4.8/hv-do-not-lose-pending-heartbeat-vmbus-packets.patch b/queue-4.8/hv-do-not-lose-pending-heartbeat-vmbus-packets.patch new file mode 100644 index 00000000000..f82d65ded31 --- /dev/null +++ b/queue-4.8/hv-do-not-lose-pending-heartbeat-vmbus-packets.patch @@ -0,0 +1,45 @@ +From 407a3aee6ee2d2cb46d9ba3fc380bc29f35d020c Mon Sep 17 00:00:00 2001 +From: Long Li +Date: Wed, 5 Oct 2016 16:57:46 -0700 +Subject: hv: do not lose pending heartbeat vmbus packets + +From: Long Li + +commit 407a3aee6ee2d2cb46d9ba3fc380bc29f35d020c upstream. + +The host keeps sending heartbeat packets independent of the +guest responding to them. Even though we respond to the heartbeat messages at +interrupt level, we can have situations where there maybe multiple heartbeat +messages pending that have not been responded to. For instance this occurs when the +VM is paused and the host continues to send the heartbeat messages. +Address this issue by draining and responding to all +the heartbeat messages that maybe pending. + +Signed-off-by: Long Li +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/hv_util.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -283,10 +283,14 @@ static void heartbeat_onchannelcallback( + u8 *hbeat_txf_buf = util_heartbeat.recv_buffer; + struct icmsg_negotiate *negop = NULL; + +- vmbus_recvpacket(channel, hbeat_txf_buf, +- PAGE_SIZE, &recvlen, &requestid); ++ while (1) { ++ ++ vmbus_recvpacket(channel, hbeat_txf_buf, ++ PAGE_SIZE, &recvlen, &requestid); ++ ++ if (!recvlen) ++ break; + +- if (recvlen > 0) { + icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[ + sizeof(struct vmbuspipe_hdr)]; + diff --git a/queue-4.8/iio-chemical-atlas-ph-sensor-fix-use-of-32-bit-int-to-hold-16-bit-big-endian-value.patch b/queue-4.8/iio-chemical-atlas-ph-sensor-fix-use-of-32-bit-int-to-hold-16-bit-big-endian-value.patch new file mode 100644 index 00000000000..15dfa683b26 --- /dev/null +++ b/queue-4.8/iio-chemical-atlas-ph-sensor-fix-use-of-32-bit-int-to-hold-16-bit-big-endian-value.patch @@ -0,0 +1,55 @@ +From d1fe85ec7702917f2f1515b4c421d5d4792201a0 Mon Sep 17 00:00:00 2001 +From: Sandhya Bankar +Date: Sun, 25 Sep 2016 00:46:21 +0530 +Subject: iio:chemical:atlas-ph-sensor: Fix use of 32 bit int to hold 16 bit big endian value + +From: Sandhya Bankar + +commit d1fe85ec7702917f2f1515b4c421d5d4792201a0 upstream. + +This will result in a random value being reported on big endian architectures. +(thanks to Lars-Peter Clausen for pointing out the effects of this bug) + +Only effects a value printed to the log, but as this reports the settings of +the probe in question it may be of direct interest to users. + +Also, fixes the following sparse endianness warnings: + +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 +drivers/iio/chemical/atlas-ph-sensor.c:215:9: warning: cast to restricted __be16 + +Signed-off-by: Sandhya Bankar +Fixes: e8dd92bfbff25 ("iio: chemical: atlas-ph-sensor: add EC feature") +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/chemical/atlas-ph-sensor.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/iio/chemical/atlas-ph-sensor.c ++++ b/drivers/iio/chemical/atlas-ph-sensor.c +@@ -207,13 +207,14 @@ static int atlas_check_ec_calibration(st + struct device *dev = &data->client->dev; + int ret; + unsigned int val; ++ __be16 rval; + +- ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &val, 2); ++ ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &rval, 2); + if (ret) + return ret; + +- dev_info(dev, "probe set to K = %d.%.2d", be16_to_cpu(val) / 100, +- be16_to_cpu(val) % 100); ++ val = be16_to_cpu(rval); ++ dev_info(dev, "probe set to K = %d.%.2d", val / 100, val % 100); + + ret = regmap_read(data->regmap, ATLAS_REG_EC_CALIB_STATUS, &val); + if (ret) diff --git a/queue-4.8/series b/queue-4.8/series index dab0685a972..4357e46c0c4 100644 --- a/queue-4.8/series +++ b/queue-4.8/series @@ -56,3 +56,13 @@ xhci-use-default-usb_resume_timeout-when-resuming-ports.patch usb-renesas_usbhs-add-wait-after-initialization-for-r-car-gen3.patch usb-increase-ohci-watchdog-delay-to-275-msec.patch genwqe-fix-bad-page-access-during-abort-of-resource-allocation.patch +x86-smpboot-init-apic-mapping-before-usage.patch +vt-clear-selection-before-resizing.patch +hv-do-not-lose-pending-heartbeat-vmbus-packets.patch +xhci-add-restart-quirk-for-intel-wildcatpoint-pch.patch +xhci-workaround-for-hosts-missing-cas-bit.patch +tty-limit-terminal-size-to-4m-chars.patch +arm64-dts-marvell-fix-clocksource-for-cp110-master-spi0.patch +iio-chemical-atlas-ph-sensor-fix-use-of-32-bit-int-to-hold-16-bit-big-endian-value.patch +staging-wilc1000-fix-kernel-oops-on-opening-the-device.patch +dm-free-io_barrier-after-blk_cleanup_queue-call.patch diff --git a/queue-4.8/staging-wilc1000-fix-kernel-oops-on-opening-the-device.patch b/queue-4.8/staging-wilc1000-fix-kernel-oops-on-opening-the-device.patch new file mode 100644 index 00000000000..6700a87d4cf --- /dev/null +++ b/queue-4.8/staging-wilc1000-fix-kernel-oops-on-opening-the-device.patch @@ -0,0 +1,70 @@ +From 1d4f1d53e1e2d5e38f4d3ca3bf60f8be5025540f Mon Sep 17 00:00:00 2001 +From: Aditya Shankar +Date: Fri, 7 Oct 2016 09:45:03 +0530 +Subject: Staging: wilc1000: Fix kernel Oops on opening the device + +From: Aditya Shankar + +commit 1d4f1d53e1e2d5e38f4d3ca3bf60f8be5025540f upstream. + +Commit 2518ac59eb27 ("staging: wilc1000: Replace kthread with workqueue +for host interface") adds an unconditional destroy_workqueue() on the +wilc's "hif_workqueue" soon after its creation thereby rendering +it unusable. It then further attempts to queue work onto this +non-existing hif_worqueue and results in: + +Unable to handle kernel NULL pointer dereference at virtual address 00000010 +pgd = de478000 +[00000010] *pgd=3eec0831, *pte=00000000, *ppte=00000000 +Internal error: Oops: 17 [#1] ARM +Modules linked in: wilc1000_sdio(C) wilc1000(C) +CPU: 0 PID: 825 Comm: ifconfig Tainted: G C 4.8.0-rc8+ #37 +Hardware name: Atmel SAMA5 +task: df56f800 task.stack: deeb0000 +PC is at __queue_work+0x90/0x284 +LR is at __queue_work+0x58/0x284 +pc : [] lr : [] psr: 600f0093 +sp : deeb1aa0 ip : def22d78 fp : deea6000 +r10: 00000000 r9 : c0a08150 r8 : c0a2f058 +r7 : 00000001 r6 : dee9b600 r5 : def22d74 r4 : 00000000 +r3 : 00000000 r2 : def22d74 r1 : 07ffffff r0 : 00000000 +Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none +... +[] (__queue_work) from [] (queue_work_on+0x34/0x40) +[] (queue_work_on) from [] (wilc_enqueue_cmd+0x54/0x64 [wilc1000]) +[] (wilc_enqueue_cmd [wilc1000]) from [] (wilc_set_wfi_drv_handler+0x48/0x70 [wilc1000]) +[] (wilc_set_wfi_drv_handler [wilc1000]) from [] (wilc_mac_open+0x214/0x250 [wilc1000]) +[] (wilc_mac_open [wilc1000]) from [] (__dev_open+0xb8/0x11c) +[] (__dev_open) from [] (__dev_change_flags+0x94/0x158) +[] (__dev_change_flags) from [] (dev_change_flags+0x18/0x48) +[] (dev_change_flags) from [] (devinet_ioctl+0x6b4/0x788) +[] (devinet_ioctl) from [] (sock_ioctl+0x154/0x2cc) +[] (sock_ioctl) from [] (do_vfs_ioctl+0x9c/0x878) +[] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c) +[] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) +Code: e5932004 e1520006 01a04003 0affffff (e5943010) +---[ end trace b612328adaa6bf20 ]--- + +This fix removes the unnecessary call to destroy_workqueue() while opening +the device to avoid the above kernel panic. The deinit routine already +does a good job of terminating the workqueue when no longer needed. + +Reported-by: Nicolas Ferre +Fixes: 2518ac59eb27 ("staging: wilc1000: Replace kthread with workqueue for host interface") +Signed-off-by: Aditya Shankar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wilc1000/host_interface.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/staging/wilc1000/host_interface.c ++++ b/drivers/staging/wilc1000/host_interface.c +@@ -3391,7 +3391,6 @@ int wilc_init(struct net_device *dev, st + + clients_count++; + +- destroy_workqueue(hif_workqueue); + _fail_: + return result; + } diff --git a/queue-4.8/tty-limit-terminal-size-to-4m-chars.patch b/queue-4.8/tty-limit-terminal-size-to-4m-chars.patch new file mode 100644 index 00000000000..1929c4d1b6d --- /dev/null +++ b/queue-4.8/tty-limit-terminal-size-to-4m-chars.patch @@ -0,0 +1,38 @@ +From 32b2921e6a7461fe63b71217067a6cf4bddb132f Mon Sep 17 00:00:00 2001 +From: Dmitry Vyukov +Date: Fri, 14 Oct 2016 15:18:28 +0200 +Subject: tty: limit terminal size to 4M chars + +From: Dmitry Vyukov + +commit 32b2921e6a7461fe63b71217067a6cf4bddb132f upstream. + +Size of kmalloc() in vc_do_resize() is controlled by user. +Too large kmalloc() size triggers WARNING message on console. +Put a reasonable upper bound on terminal size to prevent WARNINGs. + +Signed-off-by: Dmitry Vyukov +CC: David Rientjes +Cc: One Thousand Gnomes +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: Peter Hurley +Cc: linux-kernel@vger.kernel.org +Cc: syzkaller@googlegroups.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -870,6 +870,8 @@ static int vc_do_resize(struct tty_struc + if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) + return 0; + ++ if (new_screen_size > (4 << 20)) ++ return -EINVAL; + newscreen = kmalloc(new_screen_size, GFP_USER); + if (!newscreen) + return -ENOMEM; diff --git a/queue-4.8/vt-clear-selection-before-resizing.patch b/queue-4.8/vt-clear-selection-before-resizing.patch new file mode 100644 index 00000000000..7799d149a52 --- /dev/null +++ b/queue-4.8/vt-clear-selection-before-resizing.patch @@ -0,0 +1,34 @@ +From 009e39ae44f4191188aeb6dfbf661b771dbbe515 Mon Sep 17 00:00:00 2001 +From: Scot Doyle +Date: Thu, 13 Oct 2016 12:12:43 -0500 +Subject: vt: clear selection before resizing + +From: Scot Doyle + +commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 upstream. + +When resizing a vt its selection may exceed the new size, resulting in +an invalid memory access [1]. Clear the selection before resizing. + +[1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com + +Reported-and-tested-by: Dmitry Vyukov +Signed-off-by: Scot Doyle +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -874,6 +874,9 @@ static int vc_do_resize(struct tty_struc + if (!newscreen) + return -ENOMEM; + ++ if (vc == sel_cons) ++ clear_selection(); ++ + old_rows = vc->vc_rows; + old_row_size = vc->vc_size_row; + diff --git a/queue-4.8/x86-smpboot-init-apic-mapping-before-usage.patch b/queue-4.8/x86-smpboot-init-apic-mapping-before-usage.patch new file mode 100644 index 00000000000..a36024805e3 --- /dev/null +++ b/queue-4.8/x86-smpboot-init-apic-mapping-before-usage.patch @@ -0,0 +1,64 @@ +From 1e90a13d0c3dc94512af1ccb2b6563e8297838fa Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Sat, 29 Oct 2016 13:42:42 +0200 +Subject: x86/smpboot: Init apic mapping before usage + +From: Thomas Gleixner + +commit 1e90a13d0c3dc94512af1ccb2b6563e8297838fa upstream. + +The recent changes, which forced the registration of the boot cpu on UP +systems, which do not have ACPI tables, have been fixed for systems w/o +local APIC, but left a wreckage for systems which have neither ACPI nor +mptables, but the CPU has an APIC, e.g. virtualbox. + +The boot process crashes in prefill_possible_map() as it wants to register +the boot cpu, which needs to access the local apic, but the local APIC is +not yet mapped. + +There is no reason why init_apic_mapping() can't be invoked before +prefill_possible_map(). So instead of playing another silly early mapping +game, as the ACPI/mptables code does, we just move init_apic_mapping() +before the call to prefill_possible_map(). + +In hindsight, I should have noticed that combination earlier. + +Sorry for the churn (also in stable)! + +Fixes: ff8560512b8d ("x86/boot/smp: Don't try to poke disabled/non-existent APIC") +Reported-and-debugged-by: Michal Necasek +Reported-and-tested-by: Wolfgang Bauer +Cc: prarit@redhat.com +Cc: ville.syrjala@linux.intel.com +Cc: michael.thayer@oracle.com +Cc: knut.osmundsen@oracle.com +Cc: frank.mehnert@oracle.com +Cc: Borislav Petkov +Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1610282114380.5053@nanos +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1222,11 +1222,16 @@ void __init setup_arch(char **cmdline_p) + if (smp_found_config) + get_smp_config(); + ++ /* ++ * Systems w/o ACPI and mptables might not have it mapped the local ++ * APIC yet, but prefill_possible_map() might need to access it. ++ */ ++ init_apic_mappings(); ++ + prefill_possible_map(); + + init_cpu_to_node(); + +- init_apic_mappings(); + io_apic_init_mappings(); + + kvm_guest_init(); diff --git a/queue-4.8/xhci-add-restart-quirk-for-intel-wildcatpoint-pch.patch b/queue-4.8/xhci-add-restart-quirk-for-intel-wildcatpoint-pch.patch new file mode 100644 index 00000000000..0ed62851c80 --- /dev/null +++ b/queue-4.8/xhci-add-restart-quirk-for-intel-wildcatpoint-pch.patch @@ -0,0 +1,41 @@ +From 4c39135aa412d2f1381e43802523da110ca7855c Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Thu, 20 Oct 2016 18:09:18 +0300 +Subject: xhci: add restart quirk for Intel Wildcatpoint PCH + +From: Mathias Nyman + +commit 4c39135aa412d2f1381e43802523da110ca7855c upstream. + +xHC in Wildcatpoint-LP PCH is similar to LynxPoint-LP and need the +same quirks to prevent machines from spurious restart while +shutting them down. + +Reported-by: Hasan Mahmood +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -45,6 +45,7 @@ + + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 + #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 ++#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1 + #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5 + #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f + #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f +@@ -153,7 +154,8 @@ static void xhci_pci_quirks(struct devic + xhci->quirks |= XHCI_SPURIOUS_REBOOT; + } + if (pdev->vendor == PCI_VENDOR_ID_INTEL && +- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { ++ (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) { + xhci->quirks |= XHCI_SPURIOUS_REBOOT; + xhci->quirks |= XHCI_SPURIOUS_WAKEUP; + } diff --git a/queue-4.8/xhci-workaround-for-hosts-missing-cas-bit.patch b/queue-4.8/xhci-workaround-for-hosts-missing-cas-bit.patch new file mode 100644 index 00000000000..48229f1b8e8 --- /dev/null +++ b/queue-4.8/xhci-workaround-for-hosts-missing-cas-bit.patch @@ -0,0 +1,126 @@ +From 346e99736c3ce328fd42d678343b70243aca5f36 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Thu, 20 Oct 2016 18:09:19 +0300 +Subject: xhci: workaround for hosts missing CAS bit + +From: Mathias Nyman + +commit 346e99736c3ce328fd42d678343b70243aca5f36 upstream. + +If a device is unplugged and replugged during Sx system suspend +some Intel xHC hosts will overwrite the CAS (Cold attach status) flag +and no device connection is noticed in resume. + +A device in this state can be identified in resume if its link state +is in polling or compliance mode, and the current connect status is 0. +A device in this state needs to be warm reset. + +Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8 + +Observed on Cherryview and Apollolake as they go into compliance mode +if LFPS times out during polling, and re-plugged devices are not +discovered at resume. + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 37 +++++++++++++++++++++++++++++++++++++ + drivers/usb/host/xhci-pci.c | 6 ++++++ + drivers/usb/host/xhci.h | 3 +++ + 3 files changed, 46 insertions(+) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1355,6 +1355,35 @@ int xhci_bus_suspend(struct usb_hcd *hcd + return 0; + } + ++/* ++ * Workaround for missing Cold Attach Status (CAS) if device re-plugged in S3. ++ * warm reset a USB3 device stuck in polling or compliance mode after resume. ++ * See Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8 ++ */ ++static bool xhci_port_missing_cas_quirk(int port_index, ++ __le32 __iomem **port_array) ++{ ++ u32 portsc; ++ ++ portsc = readl(port_array[port_index]); ++ ++ /* if any of these are set we are not stuck */ ++ if (portsc & (PORT_CONNECT | PORT_CAS)) ++ return false; ++ ++ if (((portsc & PORT_PLS_MASK) != XDEV_POLLING) && ++ ((portsc & PORT_PLS_MASK) != XDEV_COMP_MODE)) ++ return false; ++ ++ /* clear wakeup/change bits, and do a warm port reset */ ++ portsc &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS); ++ portsc |= PORT_WR; ++ writel(portsc, port_array[port_index]); ++ /* flush write */ ++ readl(port_array[port_index]); ++ return true; ++} ++ + int xhci_bus_resume(struct usb_hcd *hcd) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); +@@ -1392,6 +1421,14 @@ int xhci_bus_resume(struct usb_hcd *hcd) + u32 temp; + + temp = readl(port_array[port_index]); ++ ++ /* warm reset CAS limited ports stuck in polling/compliance */ ++ if ((xhci->quirks & XHCI_MISSING_CAS) && ++ (hcd->speed >= HCD_USB3) && ++ xhci_port_missing_cas_quirk(port_index, port_array)) { ++ xhci_dbg(xhci, "reset stuck port %d\n", port_index); ++ continue; ++ } + if (DEV_SUPERSPEED_ANY(temp)) + temp &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS); + else +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -51,6 +51,7 @@ + #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f + #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8 + #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8 ++#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 + + static const char hcd_name[] = "xhci_hcd"; + +@@ -171,6 +172,11 @@ static void xhci_pci_quirks(struct devic + pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) { + xhci->quirks |= XHCI_SSIC_PORT_UNUSED; + } ++ if (pdev->vendor == PCI_VENDOR_ID_INTEL && ++ (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) ++ xhci->quirks |= XHCI_MISSING_CAS; ++ + if (pdev->vendor == PCI_VENDOR_ID_ETRON && + pdev->device == PCI_DEVICE_ID_EJ168) { + xhci->quirks |= XHCI_RESET_ON_RESUME; +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -314,6 +314,8 @@ struct xhci_op_regs { + #define XDEV_U2 (0x2 << 5) + #define XDEV_U3 (0x3 << 5) + #define XDEV_INACTIVE (0x6 << 5) ++#define XDEV_POLLING (0x7 << 5) ++#define XDEV_COMP_MODE (0xa << 5) + #define XDEV_RESUME (0xf << 5) + /* true: port has power (see HCC_PPC) */ + #define PORT_POWER (1 << 9) +@@ -1653,6 +1655,7 @@ struct xhci_hcd { + #define XHCI_MTK_HOST (1 << 21) + #define XHCI_SSIC_PORT_UNUSED (1 << 22) + #define XHCI_NO_64BIT_SUPPORT (1 << 23) ++#define XHCI_MISSING_CAS (1 << 24) + unsigned int num_active_eps; + unsigned int limit_active_eps; + /* There are two roothubs to keep track of bus suspend info for */