From: Greg Kroah-Hartman Date: Tue, 23 May 2017 12:14:16 +0000 (+0200) Subject: 4.11-stable patches X-Git-Tag: v3.18.55~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=63c40fc5c9430fad4add887c4c70219f6d8543f6;p=thirdparty%2Fkernel%2Fstable-queue.git 4.11-stable patches added patches: usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch usb-xhci-fix-lock-inversion-problem.patch xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch xhci-fix-command-ring-stop-regression-in-4.11.patch xhci-remove-gfp_dma-flag-from-allocation.patch --- diff --git a/queue-4.11/series b/queue-4.11/series index e9103ccf5bc..dc8b44aa9fc 100644 --- a/queue-4.11/series +++ b/queue-4.11/series @@ -84,3 +84,9 @@ make-stat-lstat-fstatat-pass-at_no_automount-to-vfs_statx.patch libnvdimm-fix-clear-length-of-nvdimm_forget_poison.patch dax-fix-data-corruption-when-fault-races-with-write.patch edac-amd64-fix-reporting-of-chip-select-sizes-on-fam17h.patch +xhci-fix-command-ring-stop-regression-in-4.11.patch +xhci-remove-gfp_dma-flag-from-allocation.patch +usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch +usb-xhci-fix-lock-inversion-problem.patch +xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch +usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch diff --git a/queue-4.11/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch b/queue-4.11/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch new file mode 100644 index 00000000000..72d3eec1c8f --- /dev/null +++ b/queue-4.11/usb-host-xhci-mem-allocate-zeroed-scratchpad-buffer.patch @@ -0,0 +1,37 @@ +From 7480d912d549f414e0ce39331870899e89a5598c Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Wed, 17 May 2017 18:32:01 +0300 +Subject: usb: host: xhci-mem: allocate zeroed Scratchpad Buffer + +From: Peter Chen + +commit 7480d912d549f414e0ce39331870899e89a5598c upstream. + +According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad +Buffer needs to be zeroed. + + ... + The following operations take place to allocate + Scratchpad Buffers to the xHC: + ... + b. Software clears the Scratchpad Buffer to '0' + +Signed-off-by: Peter Chen +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1729,7 +1729,7 @@ static int scratchpad_alloc(struct xhci_ + xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma); + for (i = 0; i < num_sp; i++) { + dma_addr_t dma; +- void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma, ++ void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma, + flags); + if (!buf) + goto fail_sp5; diff --git a/queue-4.11/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch b/queue-4.11/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch new file mode 100644 index 00000000000..46129b14732 --- /dev/null +++ b/queue-4.11/usb-host-xhci-plat-propagate-return-value-of-platform_get_irq.patch @@ -0,0 +1,32 @@ +From 4b148d5144d64ee135b8924350cb0b3a7fd21150 Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni +Date: Wed, 17 May 2017 18:32:06 +0300 +Subject: usb: host: xhci-plat: propagate return value of platform_get_irq() + +From: Thomas Petazzoni + +commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream. + +platform_get_irq() returns an error code, but the xhci-plat driver +ignores it and always returns -ENODEV. This is not correct, and +prevents -EPROBE_DEFER from being propagated properly. + +Signed-off-by: Thomas Petazzoni +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-plat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -162,7 +162,7 @@ static int xhci_plat_probe(struct platfo + + irq = platform_get_irq(pdev, 0); + if (irq < 0) +- return -ENODEV; ++ return irq; + + /* Try to set 64-bit DMA first */ + if (!pdev->dev.dma_mask) diff --git a/queue-4.11/usb-xhci-fix-lock-inversion-problem.patch b/queue-4.11/usb-xhci-fix-lock-inversion-problem.patch new file mode 100644 index 00000000000..d0a76da0717 --- /dev/null +++ b/queue-4.11/usb-xhci-fix-lock-inversion-problem.patch @@ -0,0 +1,92 @@ +From 63aea0dbab90a2461faaae357cbc8cfd6c8de9fe Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 17 May 2017 18:32:03 +0300 +Subject: USB: xhci: fix lock-inversion problem + +From: Alan Stern + +commit 63aea0dbab90a2461faaae357cbc8cfd6c8de9fe upstream. + +With threaded interrupts, bottom-half handlers are called with +interrupts enabled. Therefore they can't safely use spin_lock(); they +have to use spin_lock_irqsave(). Lockdep warns about a violation +occurring in xhci_irq(): + +========================================================= +[ INFO: possible irq lock inversion dependency detected ] +4.11.0-rc8-dbg+ #1 Not tainted +--------------------------------------------------------- +swapper/7/0 just changed the state of lock: + (&(&ehci->lock)->rlock){-.-...}, at: [] +ehci_hrtimer_func+0x29/0xc0 [ehci_hcd] +but this lock took another, HARDIRQ-unsafe lock in the past: + (hcd_urb_list_lock){+.....} + +and interrupts could create inverse lock ordering between them. + +other info that might help us debug this: + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(hcd_urb_list_lock); + local_irq_disable(); + lock(&(&ehci->lock)->rlock); + lock(hcd_urb_list_lock); + + lock(&(&ehci->lock)->rlock); + *** DEADLOCK *** + +no locks held by swapper/7/0. +the shortest dependencies between 2nd lock and 1st lock: + -> (hcd_urb_list_lock){+.....} ops: 252 { + HARDIRQ-ON-W at: + __lock_acquire+0x602/0x1280 + lock_acquire+0xd5/0x1c0 + _raw_spin_lock+0x2f/0x40 + usb_hcd_unlink_urb_from_ep+0x1b/0x60 [usbcore] + xhci_giveback_urb_in_irq.isra.45+0x70/0x1b0 [xhci_hcd] + finish_td.constprop.60+0x1d8/0x2e0 [xhci_hcd] + xhci_irq+0xdd6/0x1fa0 [xhci_hcd] + usb_hcd_irq+0x26/0x40 [usbcore] + irq_forced_thread_fn+0x2f/0x70 + irq_thread+0x149/0x1d0 + kthread+0x113/0x150 + ret_from_fork+0x2e/0x40 + +This patch fixes the problem. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Bart Van Assche +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2616,11 +2616,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + union xhci_trb *event_ring_deq; + irqreturn_t ret = IRQ_NONE; ++ unsigned long flags; + dma_addr_t deq; + u64 temp_64; + u32 status; + +- spin_lock(&xhci->lock); ++ spin_lock_irqsave(&xhci->lock, flags); + /* Check if the xHC generated the interrupt, or the irq is shared */ + status = readl(&xhci->op_regs->status); + if (status == 0xffffffff) { +@@ -2695,7 +2696,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd + ret = IRQ_HANDLED; + + out: +- spin_unlock(&xhci->lock); ++ spin_unlock_irqrestore(&xhci->lock, flags); + + return ret; + } diff --git a/queue-4.11/xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch b/queue-4.11/xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch new file mode 100644 index 00000000000..b76ed7e891c --- /dev/null +++ b/queue-4.11/xhci-apply-pme_stuck_quirk-and-missing_cas-quirk-for-denverton.patch @@ -0,0 +1,49 @@ +From a0c16630d35a874e82bdf2088f58ecaca1024315 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Wed, 17 May 2017 18:32:00 +0300 +Subject: xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton + +From: Mathias Nyman + +commit a0c16630d35a874e82bdf2088f58ecaca1024315 upstream. + +Intel Denverton microserver is Atom based and need the PME and CAS quirks +as well. + +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-pci.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -52,6 +52,7 @@ + #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8 + #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8 + #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 ++#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 + + static const char hcd_name[] = "xhci_hcd"; + +@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct devic + pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI || +- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) { ++ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) { + xhci->quirks |= XHCI_PME_STUCK_QUIRK; + } + if (pdev->vendor == PCI_VENDOR_ID_INTEL && +@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct devic + } + if (pdev->vendor == PCI_VENDOR_ID_INTEL && + (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || +- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) ++ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) + xhci->quirks |= XHCI_MISSING_CAS; + + if (pdev->vendor == PCI_VENDOR_ID_ETRON && diff --git a/queue-4.11/xhci-fix-command-ring-stop-regression-in-4.11.patch b/queue-4.11/xhci-fix-command-ring-stop-regression-in-4.11.patch new file mode 100644 index 00000000000..02e51076ec3 --- /dev/null +++ b/queue-4.11/xhci-fix-command-ring-stop-regression-in-4.11.patch @@ -0,0 +1,106 @@ +From 604d02a2a66ab7f93fd3b2bde3698c29ef057b65 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Wed, 17 May 2017 18:32:05 +0300 +Subject: xhci: Fix command ring stop regression in 4.11 + +From: Mathias Nyman + +commit 604d02a2a66ab7f93fd3b2bde3698c29ef057b65 upstream. + +In 4.11 TRB completion codes were renamed to match spec. + +Completion codes for command ring stopped and endpoint stopped +were mixed, leading to failures while handling a stopped command ring. + +Use the correct completion code for command ring stopped events. + +Fixes: 0b7c105a04ca ("usb: host: xhci: rename completion codes to match spec") +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 2 +- + drivers/usb/host/xhci-ring.c | 8 ++++---- + drivers/usb/host/xhci.c | 8 ++++---- + 3 files changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -421,7 +421,7 @@ static int xhci_stop_device(struct xhci_ + wait_for_completion(cmd->completion); + + if (cmd->status == COMP_COMMAND_ABORTED || +- cmd->status == COMP_STOPPED) { ++ cmd->status == COMP_COMMAND_RING_STOPPED) { + xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n"); + ret = -ETIME; + } +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -321,7 +321,7 @@ static void xhci_handle_stopped_cmd_ring + if (i_cmd->status != COMP_COMMAND_ABORTED) + continue; + +- i_cmd->status = COMP_STOPPED; ++ i_cmd->status = COMP_COMMAND_RING_STOPPED; + + xhci_dbg(xhci, "Turn aborted command %p to no-op\n", + i_cmd->command_trb); +@@ -1342,7 +1342,7 @@ static void handle_cmd_completion(struct + cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status)); + + /* If CMD ring stopped we own the trbs between enqueue and dequeue */ +- if (cmd_comp_code == COMP_STOPPED) { ++ if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) { + complete_all(&xhci->cmd_ring_stop_completion); + return; + } +@@ -1397,8 +1397,8 @@ static void handle_cmd_completion(struct + break; + case TRB_CMD_NOOP: + /* Is this an aborted command turned to NO-OP? */ +- if (cmd->status == COMP_STOPPED) +- cmd_comp_code = COMP_STOPPED; ++ if (cmd->status == COMP_COMMAND_RING_STOPPED) ++ cmd_comp_code = COMP_COMMAND_RING_STOPPED; + break; + case TRB_RESET_EP: + WARN_ON(slot_id != TRB_TO_SLOT_ID( +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1805,7 +1805,7 @@ static int xhci_configure_endpoint_resul + + switch (*cmd_status) { + case COMP_COMMAND_ABORTED: +- case COMP_STOPPED: ++ case COMP_COMMAND_RING_STOPPED: + xhci_warn(xhci, "Timeout while waiting for configure endpoint command\n"); + ret = -ETIME; + break; +@@ -1856,7 +1856,7 @@ static int xhci_evaluate_context_result( + + switch (*cmd_status) { + case COMP_COMMAND_ABORTED: +- case COMP_STOPPED: ++ case COMP_COMMAND_RING_STOPPED: + xhci_warn(xhci, "Timeout while waiting for evaluate context command\n"); + ret = -ETIME; + break; +@@ -3478,7 +3478,7 @@ int xhci_discover_or_reset_device(struct + ret = reset_device_cmd->status; + switch (ret) { + case COMP_COMMAND_ABORTED: +- case COMP_STOPPED: ++ case COMP_COMMAND_RING_STOPPED: + xhci_warn(xhci, "Timeout waiting for reset device command\n"); + ret = -ETIME; + goto command_cleanup; +@@ -3845,7 +3845,7 @@ static int xhci_setup_device(struct usb_ + */ + switch (command->status) { + case COMP_COMMAND_ABORTED: +- case COMP_STOPPED: ++ case COMP_COMMAND_RING_STOPPED: + xhci_warn(xhci, "Timeout while waiting for setup device command\n"); + ret = -ETIME; + break; diff --git a/queue-4.11/xhci-remove-gfp_dma-flag-from-allocation.patch b/queue-4.11/xhci-remove-gfp_dma-flag-from-allocation.patch new file mode 100644 index 00000000000..17ee4779fff --- /dev/null +++ b/queue-4.11/xhci-remove-gfp_dma-flag-from-allocation.patch @@ -0,0 +1,34 @@ +From 5db851cf20857c5504b146046e97cb7781f2a743 Mon Sep 17 00:00:00 2001 +From: Matthias Lange +Date: Wed, 17 May 2017 18:32:04 +0300 +Subject: xhci: remove GFP_DMA flag from allocation + +From: Matthias Lange + +commit 5db851cf20857c5504b146046e97cb7781f2a743 upstream. + +There is no reason to restrict allocations to the first 16MB ISA DMA +addresses. + +It is causing problems in a virtualization setup with enabled IOMMU +(x86_64). The result is that USB is not working in the VM. + +Signed-off-by: Matthias Lange +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment + } + + if (max_packet) { +- seg->bounce_buf = kzalloc(max_packet, flags | GFP_DMA); ++ seg->bounce_buf = kzalloc(max_packet, flags); + if (!seg->bounce_buf) { + dma_pool_free(xhci->segment_pool, seg->trbs, dma); + kfree(seg);