From 94af55366bce99f8b43b8ea6b4524099d9a97a20 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 18 May 2020 15:08:22 +0200 Subject: [PATCH] 5.6-stable patches added patches: alsa-hda-realtek-add-coef-workaround-for-asus-zenbook-ux431da.patch alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch alsa-usb-audio-add-control-message-quirk-delay-for-kingston-hyperx-headset.patch usb-cdns3-gadget-prev_req-trb-is-null-for-ep0.patch usb-core-hub-limit-hub_quirk_disable_autosuspend-to-usb5534b.patch usb-host-xhci-plat-keep-runtime-active-when-removing-host.patch --- ...-workaround-for-asus-zenbook-ux431da.patch | 61 ++++++++ ...imit-int-mic-boost-for-thinkpad-t530.patch | 66 +++++++++ ...fer-resize-under-concurrent-accesses.patch | 131 +++++++++++++++++ ...rk-delay-for-kingston-hyperx-headset.patch | 43 ++++++ queue-5.6/series | 7 + ...-gadget-prev_req-trb-is-null-for-ep0.patch | 97 +++++++++++++ ...uirk_disable_autosuspend-to-usb5534b.patch | 72 +++++++++ ...ep-runtime-active-when-removing-host.patch | 137 ++++++++++++++++++ 8 files changed, 614 insertions(+) create mode 100644 queue-5.6/alsa-hda-realtek-add-coef-workaround-for-asus-zenbook-ux431da.patch create mode 100644 queue-5.6/alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch create mode 100644 queue-5.6/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch create mode 100644 queue-5.6/alsa-usb-audio-add-control-message-quirk-delay-for-kingston-hyperx-headset.patch create mode 100644 queue-5.6/usb-cdns3-gadget-prev_req-trb-is-null-for-ep0.patch create mode 100644 queue-5.6/usb-core-hub-limit-hub_quirk_disable_autosuspend-to-usb5534b.patch create mode 100644 queue-5.6/usb-host-xhci-plat-keep-runtime-active-when-removing-host.patch diff --git a/queue-5.6/alsa-hda-realtek-add-coef-workaround-for-asus-zenbook-ux431da.patch b/queue-5.6/alsa-hda-realtek-add-coef-workaround-for-asus-zenbook-ux431da.patch new file mode 100644 index 00000000000..7e31484398c --- /dev/null +++ b/queue-5.6/alsa-hda-realtek-add-coef-workaround-for-asus-zenbook-ux431da.patch @@ -0,0 +1,61 @@ +From 1b94e59d30afecf18254ad413e953e7587645a20 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 12 May 2020 09:32:03 +0200 +Subject: ALSA: hda/realtek - Add COEF workaround for ASUS ZenBook UX431DA + +From: Takashi Iwai + +commit 1b94e59d30afecf18254ad413e953e7587645a20 upstream. + +ASUS ZenBook UX431DA requires an additional COEF setup when booted +from the recent Windows 10, otherwise it produces the noisy output. +The quirk turns on COEF 0x1b bit 10 that has been cleared supposedly +due to the pop noise reduction. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207553 +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20200512073203.14091-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5978,6 +5978,7 @@ enum { + ALC294_FIXUP_ASUS_DUAL_SPK, + ALC285_FIXUP_THINKPAD_HEADSET_JACK, + ALC294_FIXUP_ASUS_HPE, ++ ALC294_FIXUP_ASUS_COEF_1B, + ALC285_FIXUP_HP_GPIO_LED, + }; + +@@ -7112,6 +7113,17 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC + }, ++ [ALC294_FIXUP_ASUS_COEF_1B] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* Set bit 10 to correct noisy output after reboot from ++ * Windows 10 (due to pop noise reduction?) ++ */ ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x1b }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x4e4b }, ++ { } ++ }, ++ }, + [ALC285_FIXUP_HP_GPIO_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_gpio_led, +@@ -7283,6 +7295,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B), + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), diff --git a/queue-5.6/alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch b/queue-5.6/alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch new file mode 100644 index 00000000000..5e80f1a9d80 --- /dev/null +++ b/queue-5.6/alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch @@ -0,0 +1,66 @@ +From b590b38ca305d6d7902ec7c4f7e273e0069f3bcc Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 14 May 2020 18:05:33 +0200 +Subject: ALSA: hda/realtek - Limit int mic boost for Thinkpad T530 + +From: Takashi Iwai + +commit b590b38ca305d6d7902ec7c4f7e273e0069f3bcc upstream. + +Lenovo Thinkpad T530 seems to have a sensitive internal mic capture +that needs to limit the mic boost like a few other Thinkpad models. +Although we may change the quirk for ALC269_FIXUP_LENOVO_DOCK, this +hits way too many other laptop models, so let's add a new fixup model +that limits the internal mic boost on top of the existing quirk and +apply to only T530. + +BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1171293 +Cc: +Link: https://lore.kernel.org/r/20200514160533.10337-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5856,6 +5856,7 @@ enum { + ALC269_FIXUP_HP_LINE1_MIC1_LED, + ALC269_FIXUP_INV_DMIC, + ALC269_FIXUP_LENOVO_DOCK, ++ ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, + ALC269_FIXUP_NO_SHUTUP, + ALC286_FIXUP_SONY_MIC_NO_PRESENCE, + ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT, +@@ -6175,6 +6176,12 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT + }, ++ [ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc269_fixup_limit_int_mic_boost, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_LENOVO_DOCK, ++ }, + [ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_no_hp_to_lineout, +@@ -7317,7 +7324,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE), +- SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST), + SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK), +@@ -7456,6 +7463,7 @@ static const struct hda_model_fixup alc2 + {.id = ALC269_FIXUP_HEADSET_MODE, .name = "headset-mode"}, + {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"}, + {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"}, ++ {.id = ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, .name = "lenovo-dock-limit-boost"}, + {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"}, + {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"}, + {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"}, diff --git a/queue-5.6/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch b/queue-5.6/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch new file mode 100644 index 00000000000..8f50d1004f1 --- /dev/null +++ b/queue-5.6/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch @@ -0,0 +1,131 @@ +From c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 7 May 2020 13:44:56 +0200 +Subject: ALSA: rawmidi: Fix racy buffer resize under concurrent accesses + +From: Takashi Iwai + +commit c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d upstream. + +The rawmidi core allows user to resize the runtime buffer via ioctl, +and this may lead to UAF when performed during concurrent reads or +writes: the read/write functions unlock the runtime lock temporarily +during copying form/to user-space, and that's the race window. + +This patch fixes the hole by introducing a reference counter for the +runtime buffer read/write access and returns -EBUSY error when the +resize is performed concurrently against read/write. + +Note that the ref count field is a simple integer instead of +refcount_t here, since the all contexts accessing the buffer is +basically protected with a spinlock, hence we need no expensive atomic +ops. Also, note that this busy check is needed only against read / +write functions, and not in receive/transmit callbacks; the race can +happen only at the spinlock hole mentioned in the above, while the +whole function is protected for receive / transmit callbacks. + +Reported-by: butt3rflyh4ck +Cc: +Link: https://lore.kernel.org/r/CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWrfg@mail.gmail.com +Link: https://lore.kernel.org/r/s5heerw3r5z.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + include/sound/rawmidi.h | 1 + + sound/core/rawmidi.c | 31 +++++++++++++++++++++++++++---- + 2 files changed, 28 insertions(+), 4 deletions(-) + +--- a/include/sound/rawmidi.h ++++ b/include/sound/rawmidi.h +@@ -61,6 +61,7 @@ struct snd_rawmidi_runtime { + size_t avail_min; /* min avail for wakeup */ + size_t avail; /* max used buffer for wakeup */ + size_t xruns; /* over/underruns counter */ ++ int buffer_ref; /* buffer reference count */ + /* misc */ + spinlock_t lock; + wait_queue_head_t sleep; +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -120,6 +120,17 @@ static void snd_rawmidi_input_event_work + runtime->event(runtime->substream); + } + ++/* buffer refcount management: call with runtime->lock held */ ++static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime) ++{ ++ runtime->buffer_ref++; ++} ++ ++static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime) ++{ ++ runtime->buffer_ref--; ++} ++ + static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream) + { + struct snd_rawmidi_runtime *runtime; +@@ -669,6 +680,11 @@ static int resize_runtime_buffer(struct + if (!newbuf) + return -ENOMEM; + spin_lock_irq(&runtime->lock); ++ if (runtime->buffer_ref) { ++ spin_unlock_irq(&runtime->lock); ++ kvfree(newbuf); ++ return -EBUSY; ++ } + oldbuf = runtime->buffer; + runtime->buffer = newbuf; + runtime->buffer_size = params->buffer_size; +@@ -1019,8 +1035,10 @@ static long snd_rawmidi_kernel_read1(str + long result = 0, count1; + struct snd_rawmidi_runtime *runtime = substream->runtime; + unsigned long appl_ptr; ++ int err = 0; + + spin_lock_irqsave(&runtime->lock, flags); ++ snd_rawmidi_buffer_ref(runtime); + while (count > 0 && runtime->avail) { + count1 = runtime->buffer_size - runtime->appl_ptr; + if (count1 > count) +@@ -1039,16 +1057,19 @@ static long snd_rawmidi_kernel_read1(str + if (userbuf) { + spin_unlock_irqrestore(&runtime->lock, flags); + if (copy_to_user(userbuf + result, +- runtime->buffer + appl_ptr, count1)) { +- return result > 0 ? result : -EFAULT; +- } ++ runtime->buffer + appl_ptr, count1)) ++ err = -EFAULT; + spin_lock_irqsave(&runtime->lock, flags); ++ if (err) ++ goto out; + } + result += count1; + count -= count1; + } ++ out: ++ snd_rawmidi_buffer_unref(runtime); + spin_unlock_irqrestore(&runtime->lock, flags); +- return result; ++ return result > 0 ? result : err; + } + + long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream, +@@ -1342,6 +1363,7 @@ static long snd_rawmidi_kernel_write1(st + return -EAGAIN; + } + } ++ snd_rawmidi_buffer_ref(runtime); + while (count > 0 && runtime->avail > 0) { + count1 = runtime->buffer_size - runtime->appl_ptr; + if (count1 > count) +@@ -1373,6 +1395,7 @@ static long snd_rawmidi_kernel_write1(st + } + __end: + count1 = runtime->avail < runtime->buffer_size; ++ snd_rawmidi_buffer_unref(runtime); + spin_unlock_irqrestore(&runtime->lock, flags); + if (count1) + snd_rawmidi_output_trigger(substream, 1); diff --git a/queue-5.6/alsa-usb-audio-add-control-message-quirk-delay-for-kingston-hyperx-headset.patch b/queue-5.6/alsa-usb-audio-add-control-message-quirk-delay-for-kingston-hyperx-headset.patch new file mode 100644 index 00000000000..027d46b5097 --- /dev/null +++ b/queue-5.6/alsa-usb-audio-add-control-message-quirk-delay-for-kingston-hyperx-headset.patch @@ -0,0 +1,43 @@ +From 073919e09ca445d4486968e3f851372ff44cf2b5 Mon Sep 17 00:00:00 2001 +From: Jesus Ramos +Date: Mon, 27 Apr 2020 06:21:39 -0700 +Subject: ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset + +From: Jesus Ramos + +commit 073919e09ca445d4486968e3f851372ff44cf2b5 upstream. + +Kingston HyperX headset with 0951:16ad also needs the same quirk for +delaying the frequency controls. + +Signed-off-by: Jesus Ramos +Cc: +Link: https://lore.kernel.org/r/BY5PR19MB3634BA68C7CCA23D8DF428E796AF0@BY5PR19MB3634.namprd19.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1592,13 +1592,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de + && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + msleep(20); + +- /* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here, +- * otherwise requests like get/set frequency return as failed despite +- * actually succeeding. ++ /* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny ++ * delay here, otherwise requests like get/set frequency return as ++ * failed despite actually succeeding. + */ + if ((chip->usb_id == USB_ID(0x1686, 0x00dd) || + chip->usb_id == USB_ID(0x046d, 0x0a46) || +- chip->usb_id == USB_ID(0x0b0e, 0x0349)) && ++ chip->usb_id == USB_ID(0x0b0e, 0x0349) || ++ chip->usb_id == USB_ID(0x0951, 0x16ad)) && + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + usleep_range(1000, 2000); + } diff --git a/queue-5.6/series b/queue-5.6/series index 23da92a3ebb..df7eced4002 100644 --- a/queue-5.6/series +++ b/queue-5.6/series @@ -135,3 +135,10 @@ bootconfig-fix-to-remove-bootconfig-data-from-initrd-while-boot.patch bootconfig-fix-to-prevent-warning-message-if-no-bootconfig-option.patch usb-usbfs-correct-kernel-user-page-attribute-mismatch.patch usb-usbfs-fix-mmap-dma-mismatch.patch +alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch +alsa-hda-realtek-add-coef-workaround-for-asus-zenbook-ux431da.patch +alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch +alsa-usb-audio-add-control-message-quirk-delay-for-kingston-hyperx-headset.patch +usb-core-hub-limit-hub_quirk_disable_autosuspend-to-usb5534b.patch +usb-host-xhci-plat-keep-runtime-active-when-removing-host.patch +usb-cdns3-gadget-prev_req-trb-is-null-for-ep0.patch diff --git a/queue-5.6/usb-cdns3-gadget-prev_req-trb-is-null-for-ep0.patch b/queue-5.6/usb-cdns3-gadget-prev_req-trb-is-null-for-ep0.patch new file mode 100644 index 00000000000..2a92bae0c39 --- /dev/null +++ b/queue-5.6/usb-cdns3-gadget-prev_req-trb-is-null-for-ep0.patch @@ -0,0 +1,97 @@ +From 95cd7dc47abd71d1a0c9c43594ff2fa32552f46c Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Thu, 30 Apr 2020 15:07:13 +0800 +Subject: usb: cdns3: gadget: prev_req->trb is NULL for ep0 + +From: Peter Chen + +commit 95cd7dc47abd71d1a0c9c43594ff2fa32552f46c upstream. + +And there are no multiple TRBs on EP0 and WA1 workaround, +so it doesn't need to change TRB for EP0. It fixes below oops. + +configfs-gadget gadget: high-speed config #1: b +android_work: sent uevent USB_STATE=CONFIGURED +Unable to handle kernel read from unreadable memory at virtual address 0000000000000008 +Mem abort info: +android_work: sent uevent USB_STATE=DISCONNECTED + ESR = 0x96000004 + EC = 0x25: DABT (current EL), IL = 32 bits + + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 +Data abort info: + ISV = 0, ISS = 0x00000004 + CM = 0, WnR = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b5bb7000 +[0000000000000008] pgd=0000000000000000 +Internal error: Oops: 96000004 [#1] PREEMPT SMP +Modules linked in: +CPU: 2 PID: 430 Comm: HwBinder:401_1 Not tainted 5.4.24-06071-g6fa8921409c1-dirty #77 +Hardware name: Freescale i.MX8QXP MEK (DT) +pstate: 60400085 (nZCv daIf +PAN -UAO) +pc : cdns3_gadget_ep_dequeue+0x1d4/0x270 +lr : cdns3_gadget_ep_dequeue+0x48/0x270 +sp : ffff800012763ba0 +x29: ffff800012763ba0 x28: ffff00082c653c00 +x27: 0000000000000000 x26: ffff000068fa7b00 +x25: ffff0000699b2000 x24: ffff00082c6ac000 +x23: ffff000834f0a480 x22: ffff000834e87b9c +x21: 0000000000000000 x20: ffff000834e87800 +x19: ffff000069eddc00 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 +x15: 0000000000000000 x14: 0000000000000000 +x13: 0000000000000000 x12: 0000000000000001 +x11: ffff80001180fbe8 x10: 0000000000000001 +x9 : ffff800012101558 x8 : 0000000000000001 +x7 : 0000000000000006 x6 : ffff000835d9c668 +x5 : ffff000834f0a4c8 x4 : 0000000096000000 +x3 : 0000000000001810 x2 : 0000000000000000 +x1 : ffff800024bd001c x0 : 0000000000000001 +Call trace: + cdns3_gadget_ep_dequeue+0x1d4/0x270 + usb_ep_dequeue+0x34/0xf8 + composite_dev_cleanup+0x154/0x170 + configfs_composite_unbind+0x6c/0xa8 + usb_gadget_remove_driver+0x44/0x70 + usb_gadget_unregister_driver+0x74/0xe0 + unregister_gadget+0x28/0x58 + gadget_dev_desc_UDC_store+0x80/0x110 + configfs_write_file+0x1e0/0x2a0 + __vfs_write+0x48/0x90 + vfs_write+0xe4/0x1c8 + ksys_write+0x78/0x100 + __arm64_sys_write+0x24/0x30 + el0_svc_common.constprop.0+0x74/0x168 + el0_svc_handler+0x34/0xa0 + el0_svc+0x8/0xc +Code: 52830203 b9407660 f94042e4 11000400 (b9400841) +---[ end trace 1574516e4c1772ca ]--- +Kernel panic - not syncing: Fatal exception +SMP: stopping secondary CPUs +Kernel Offset: disabled +CPU features: 0x0002,20002008 +Memory Limit: none +Rebooting in 5 seconds.. + +Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation") +Cc: stable +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/cdns3/gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -2548,7 +2548,7 @@ found: + link_trb = priv_req->trb; + + /* Update ring only if removed request is on pending_req_list list */ +- if (req_on_hw_ring) { ++ if (req_on_hw_ring && link_trb) { + link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma + + ((priv_req->end_trb + 1) * TRB_SIZE)); + link_trb->control = (link_trb->control & TRB_CYCLE) | diff --git a/queue-5.6/usb-core-hub-limit-hub_quirk_disable_autosuspend-to-usb5534b.patch b/queue-5.6/usb-core-hub-limit-hub_quirk_disable_autosuspend-to-usb5534b.patch new file mode 100644 index 00000000000..7d158b139fb --- /dev/null +++ b/queue-5.6/usb-core-hub-limit-hub_quirk_disable_autosuspend-to-usb5534b.patch @@ -0,0 +1,72 @@ +From 76e1ef1d81a4129d7e2fb8c48c83b166d1c8e040 Mon Sep 17 00:00:00 2001 +From: Eugeniu Rosca +Date: Fri, 15 May 2020 00:02:46 +0200 +Subject: usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B + +From: Eugeniu Rosca + +commit 76e1ef1d81a4129d7e2fb8c48c83b166d1c8e040 upstream. + +On Tue, May 12, 2020 at 09:36:07PM +0800, Kai-Heng Feng wrote [1]: +> This patch prevents my Raven Ridge xHCI from getting runtime suspend. + +The problem described in v5.6 commit 1208f9e1d758c9 ("USB: hub: Fix the +broken detection of USB3 device in SMSC hub") applies solely to the +USB5534B hub [2] present on the Kingfisher Infotainment Carrier Board, +manufactured by Shimafuji Electric Inc [3]. + +Despite that, the aforementioned commit applied the quirk to _all_ hubs +carrying vendor ID 0x424 (i.e. SMSC), of which there are more [4] than +initially expected. Consequently, the quirk is now enabled on platforms +carrying SMSC/Microchip hub models which potentially don't exhibit the +original issue. + +To avoid reports like [1], further limit the quirk's scope to +USB5534B [2], by employing both Vendor and Product ID checks. + +Tested on H3ULCB + Kingfisher rev. M05. + +[1] https://lore.kernel.org/linux-renesas-soc/73933975-6F0E-40F5-9584-D2B8F615C0F3@canonical.com/ +[2] https://www.microchip.com/wwwproducts/en/USB5534B +[3] http://www.shimafuji.co.jp/wp/wp-content/uploads/2018/08/SBEV-RCAR-KF-M06Board_HWSpecificationEN_Rev130.pdf +[4] https://devicehunt.com/search/type/usb/vendor/0424/device/any + +Fixes: 1208f9e1d758c9 ("USB: hub: Fix the broken detection of USB3 device in SMSC hub") +Cc: stable@vger.kernel.org # v4.14+ +Cc: Alan Stern +Cc: Hardik Gajjar +Cc: linux-renesas-soc@vger.kernel.org +Cc: linux-usb@vger.kernel.org +Reported-by: Kai-Heng Feng +Signed-off-by: Eugeniu Rosca +Tested-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20200514220246.13290-1-erosca@de.adit-jv.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -39,6 +39,7 @@ + + #define USB_VENDOR_GENESYS_LOGIC 0x05e3 + #define USB_VENDOR_SMSC 0x0424 ++#define USB_PRODUCT_USB5534B 0x5534 + #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01 + #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02 + +@@ -5621,8 +5622,11 @@ out_hdev_lock: + } + + static const struct usb_device_id hub_id_table[] = { +- { .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_CLASS, ++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR ++ | USB_DEVICE_ID_MATCH_PRODUCT ++ | USB_DEVICE_ID_MATCH_INT_CLASS, + .idVendor = USB_VENDOR_SMSC, ++ .idProduct = USB_PRODUCT_USB5534B, + .bInterfaceClass = USB_CLASS_HUB, + .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, + { .match_flags = USB_DEVICE_ID_MATCH_VENDOR diff --git a/queue-5.6/usb-host-xhci-plat-keep-runtime-active-when-removing-host.patch b/queue-5.6/usb-host-xhci-plat-keep-runtime-active-when-removing-host.patch new file mode 100644 index 00000000000..2036842014f --- /dev/null +++ b/queue-5.6/usb-host-xhci-plat-keep-runtime-active-when-removing-host.patch @@ -0,0 +1,137 @@ +From 1449cb2c2253d37d998c3714aa9b95416d16d379 Mon Sep 17 00:00:00 2001 +From: Li Jun +Date: Thu, 14 May 2020 14:04:32 +0300 +Subject: usb: host: xhci-plat: keep runtime active when removing host + +From: Li Jun + +commit 1449cb2c2253d37d998c3714aa9b95416d16d379 upstream. + +While removing the host (e.g. for USB role switch from host to device), +if runtime pm is enabled by user, below oops occurs on dwc3 and cdns3 +platforms. +Keeping the xhci-plat device active during host removal, and disabling +runtime pm before calling pm_runtime_set_suspended() fixes them. + +oops1: +Unable to handle kernel NULL pointer dereference at virtual address +0000000000000240 +Internal error: Oops: 96000004 [#1] PREEMPT SMP +Modules linked in: +CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.4.3-00107-g64d454a-dirty +Hardware name: FSL i.MX8MP EVK (DT) +Workqueue: pm pm_runtime_work +pstate: 60000005 (nZCv daif -PAN -UAO) +pc : xhci_suspend+0x34/0x698 +lr : xhci_plat_runtime_suspend+0x2c/0x38 +sp : ffff800011ddbbc0 +Call trace: + xhci_suspend+0x34/0x698 + xhci_plat_runtime_suspend+0x2c/0x38 + pm_generic_runtime_suspend+0x28/0x40 + __rpm_callback+0xd8/0x138 + rpm_callback+0x24/0x98 + rpm_suspend+0xe0/0x448 + rpm_idle+0x124/0x140 + pm_runtime_work+0xa0/0xf8 + process_one_work+0x1dc/0x370 + worker_thread+0x48/0x468 + kthread+0xf0/0x120 + ret_from_fork+0x10/0x1c + +oops2: +usb 2-1: USB disconnect, device number 2 +xhci-hcd xhci-hcd.1.auto: remove, state 4 +usb usb2: USB disconnect, device number 1 +xhci-hcd xhci-hcd.1.auto: USB bus 2 deregistered +xhci-hcd xhci-hcd.1.auto: remove, state 4 +usb usb1: USB disconnect, device number 1 +Unable to handle kernel NULL pointer dereference at virtual address +0000000000000138 +Internal error: Oops: 96000004 [#1] PREEMPT SMP +Modules linked in: +CPU: 2 PID: 7 Comm: kworker/u8:0 Not tainted 5.6.0-rc4-next-20200304-03578 +Hardware name: Freescale i.MX8QXP MEK (DT) +Workqueue: 1-0050 tcpm_state_machine_work +pstate: 20000005 (nzCv daif -PAN -UAO) +pc : xhci_free_dev+0x214/0x270 +lr : xhci_plat_runtime_resume+0x78/0x88 +sp : ffff80001006b5b0 +Call trace: + xhci_free_dev+0x214/0x270 + xhci_plat_runtime_resume+0x78/0x88 + pm_generic_runtime_resume+0x30/0x48 + __rpm_callback+0x90/0x148 + rpm_callback+0x28/0x88 + rpm_resume+0x568/0x758 + rpm_resume+0x260/0x758 + rpm_resume+0x260/0x758 + __pm_runtime_resume+0x40/0x88 + device_release_driver_internal+0xa0/0x1c8 + device_release_driver+0x1c/0x28 + bus_remove_device+0xd4/0x158 + device_del+0x15c/0x3a0 + usb_disable_device+0xb0/0x268 + usb_disconnect+0xcc/0x300 + usb_remove_hcd+0xf4/0x1dc + xhci_plat_remove+0x78/0xe0 + platform_drv_remove+0x30/0x50 + device_release_driver_internal+0xfc/0x1c8 + device_release_driver+0x1c/0x28 + bus_remove_device+0xd4/0x158 + device_del+0x15c/0x3a0 + platform_device_del.part.0+0x20/0x90 + platform_device_unregister+0x28/0x40 + cdns3_host_exit+0x20/0x40 + cdns3_role_stop+0x60/0x90 + cdns3_role_set+0x64/0xd8 + usb_role_switch_set_role.part.0+0x3c/0x68 + usb_role_switch_set_role+0x20/0x30 + tcpm_mux_set+0x60/0xf8 + tcpm_reset_port+0xa4/0xf0 + tcpm_detach.part.0+0x28/0x50 + tcpm_state_machine_work+0x12ac/0x2360 + process_one_work+0x1c8/0x470 + worker_thread+0x50/0x428 + kthread+0xfc/0x128 + ret_from_fork+0x10/0x18 +Code: c8037c02 35ffffa3 17ffe7c3 f9800011 (c85f7c01) +---[ end trace 45b1a173d2679e44 ]--- + +[minor commit message cleanup -Mathias] +Cc: Baolin Wang +Cc: +Fixes: b0c69b4bace3 ("usb: host: plat: Enable xHCI plat runtime PM") +Reviewed-by: Peter Chen +Tested-by: Peter Chen +Signed-off-by: Li Jun +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200514110432.25564-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-plat.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -363,6 +363,7 @@ static int xhci_plat_remove(struct platf + struct clk *reg_clk = xhci->reg_clk; + struct usb_hcd *shared_hcd = xhci->shared_hcd; + ++ pm_runtime_get_sync(&dev->dev); + xhci->xhc_state |= XHCI_STATE_REMOVING; + + usb_remove_hcd(shared_hcd); +@@ -376,8 +377,9 @@ static int xhci_plat_remove(struct platf + clk_disable_unprepare(reg_clk); + usb_put_hcd(hcd); + +- pm_runtime_set_suspended(&dev->dev); + pm_runtime_disable(&dev->dev); ++ pm_runtime_put_noidle(&dev->dev); ++ pm_runtime_set_suspended(&dev->dev); + + return 0; + } -- 2.47.3