I'm announcing the release of the 4.14.86 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/admin-guide/kernel-parameters.txt | 56
Documentation/userspace-api/spec_ctrl.rst | 9
Makefile | 2
arch/arm/boot/dts/rk3288-veyron.dtsi | 6
arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 2
arch/x86/Kconfig | 12
arch/x86/Makefile | 5
arch/x86/events/core.c | 20
arch/x86/events/intel/core.c | 52
arch/x86/events/perf_event.h | 13
arch/x86/include/asm/cpufeatures.h | 2
arch/x86/include/asm/msr-index.h | 5
arch/x86/include/asm/nospec-branch.h | 44
arch/x86/include/asm/spec-ctrl.h | 20
arch/x86/include/asm/switch_to.h | 3
arch/x86/include/asm/thread_info.h | 20
arch/x86/include/asm/tlbflush.h | 8
arch/x86/kernel/cpu/amd.c | 4
arch/x86/kernel/cpu/bugs.c | 510 ++++++-
arch/x86/kernel/cpu/common.c | 9
arch/x86/kernel/cpu/mcheck/mce_amd.c | 19
arch/x86/kernel/fpu/signal.c | 4
arch/x86/kernel/process.c | 101 +
arch/x86/kernel/process.h | 39
arch/x86/kernel/process_32.c | 10
arch/x86/kernel/process_64.c | 10
arch/x86/kvm/cpuid.c | 10
arch/x86/kvm/mmu.c | 27
arch/x86/kvm/svm.c | 28
arch/x86/kvm/x86.c | 4
arch/x86/mm/tlb.c | 115 +
arch/xtensa/kernel/asm-offsets.c | 16
arch/xtensa/kernel/process.c | 5
arch/xtensa/kernel/ptrace.c | 42
drivers/android/binder.c | 21
drivers/android/binder_alloc.c | 14
drivers/android/binder_alloc.h | 3
drivers/dma/at_hdmac.c | 10
drivers/hv/channel.c | 8
drivers/iio/magnetometer/st_magn_buffer.c | 12
drivers/media/usb/em28xx/em28xx-dvb.c | 3
drivers/misc/mic/scif/scif_rma.c | 2
drivers/mtd/ubi/vtbl.c | 20
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 9
drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 4
drivers/net/rionet.c | 2
drivers/net/usb/ipheth.c | 10
drivers/net/virtio_net.c | 13
drivers/net/wireless/ath/wil6210/wmi.c | 8
drivers/net/wireless/ti/wlcore/cmd.c | 6
drivers/pci/dwc/pci-layerscape.c | 2
drivers/s390/net/qeth_core_main.c | 27
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 7
drivers/usb/core/quirks.c | 3
drivers/usb/dwc3/gadget.c | 5
drivers/usb/storage/unusual_realtek.h | 10
fs/btrfs/Makefile | 2
fs/btrfs/disk-io.c | 153 --
fs/btrfs/extent-tree.c | 86 +
fs/btrfs/relocation.c | 1
fs/btrfs/super.c | 1
fs/btrfs/transaction.c | 6
fs/btrfs/tree-checker.c | 649 ++++++++++
fs/btrfs/tree-checker.h | 38
fs/btrfs/volumes.c | 30
fs/btrfs/volumes.h | 2
fs/ceph/mds_client.c | 11
fs/direct-io.c | 4
fs/ext2/xattr.c | 2
fs/f2fs/checkpoint.c | 43
fs/f2fs/data.c | 52
fs/f2fs/f2fs.h | 41
fs/f2fs/file.c | 21
fs/f2fs/inode.c | 78 +
fs/f2fs/node.c | 11
fs/f2fs/recovery.c | 6
fs/f2fs/segment.c | 13
fs/f2fs/segment.h | 24
fs/f2fs/super.c | 96 +
fs/xfs/libxfs/xfs_attr.c | 9
include/linux/bpf_verifier.h | 1
include/linux/ceph/auth.h | 8
include/linux/ceph/ceph_features.h | 7
include/linux/ceph/messenger.h | 6
include/linux/ceph/msgr.h | 2
include/linux/jump_label.h | 7
include/linux/ptrace.h | 4
include/linux/sched.h | 9
include/linux/sched/smt.h | 20
include/linux/skbuff.h | 18
include/net/tls.h | 4
include/uapi/linux/btrfs_tree.h | 1
include/uapi/linux/prctl.h | 1
kernel/bpf/verifier.c | 62
kernel/cpu.c | 14
kernel/jump_label.c | 12
kernel/sched/core.c | 19
kernel/sched/fair.c | 4
kernel/sched/sched.h | 4
lib/test_kmod.c | 1
mm/huge_memory.c | 79 -
mm/khugepaged.c | 129 +
mm/shmem.c | 12
net/ceph/auth.c | 16
net/ceph/auth_x.c | 223 ++-
net/ceph/auth_x_protocol.h | 7
net/ceph/messenger.c | 93 -
net/ceph/osd_client.c | 11
net/core/skbuff.c | 4
net/packet/af_packet.c | 4
net/tls/tls_main.c | 124 +
net/tls/tls_sw.c | 13
scripts/Makefile.build | 2
sound/core/control.c | 80 -
sound/isa/wss/wss_lib.c | 2
sound/pci/ac97/ac97_codec.c | 2
sound/pci/hda/patch_realtek.c | 9
sound/sparc/cs4231.c | 8
119 files changed, 2926 insertions(+), 908 deletions(-)
Alexei Starovoitov (1):
bpf: Prevent memory disambiguation attack
Anisse Astier (1):
ALSA: hda/realtek - fix headset mic detection for MSI MS-B171
Arnd Bergmann (1):
btrfs: tree-checker: use %zu format string for size_t
Ben Hutchings (1):
f2fs: Add sanity_check_inode() function
Ben Wolsieffer (1):
staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION
Bernd Eckstein (1):
usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
Boris Pismenny (1):
tls: Use correct sk->sk_prot for IPV6
Borislav Petkov (1):
x86/MCE/AMD: Fix the thresholding machinery initialization order
Chao Yu (9):
f2fs: clean up with is_valid_blkaddr()
f2fs: introduce and spread verify_blkaddr
f2fs: fix to do sanity check with secs_per_zone
f2fs: fix to do sanity check with extra_attr feature
f2fs: fix to do sanity check with user_block_count
f2fs: fix to do sanity check with node footer and iblocks
f2fs: fix to do sanity check with block address in main area
f2fs: fix to do sanity check with i_extra_isize
f2fs: fix to do sanity check with cp_pack_start_sum
Christoph Muellner (1):
arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou.
Darrick J. Wong (1):
xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE
David Sterba (1):
btrfs: tree-check: reduce stack consumption in check_dir_item
Dexuan Cui (1):
Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
Felipe Balbi (1):
Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
Filipe Manana (1):
Btrfs: ensure path name is null terminated at btrfs_control_ioctl
Greg Kroah-Hartman (1):
Linux 4.14.86
Gu Jinxiang (1):
btrfs: validate type when reading a chunk
Heiko Stuebner (1):
ARM: dts: rockchip: Remove @0 from the veyron memory node
Hou Zhiqiang (1):
PCI: layerscape: Fix wrong invocation of outbound window disable accessor
Hugh Dickins (9):
mm/huge_memory: rename freeze_page() to unmap_page()
mm/huge_memory: splitting set mapping+index before unfreeze
mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
mm/khugepaged: collapse_shmem() stop if punched or truncated
mm/khugepaged: fix crashes due to misaccounted holes
mm/khugepaged: collapse_shmem() remember to clear holes
mm/khugepaged: minor reorderings in collapse_shmem()
mm/khugepaged: collapse_shmem() without freezing new_page
mm/khugepaged: collapse_shmem() do not crash on Compound
Ilya Dryomov (8):
libceph: store ceph_auth_handshake pointer in ceph_connection
libceph: factor out __prepare_write_connect()
libceph: factor out __ceph_x_decrypt()
libceph: factor out encrypt_authorizer()
libceph: add authorizer challenge
libceph: implement CEPHX_V2 calculation mode
libceph: weaken sizeof check in ceph_x_verify_authorizer_reply()
libceph: check authorizer reply/challenge length before reading
Ilya Lesokhin (4):
tls: Add function to update the TLS socket configuration
tls: Fix TLS ulp context leak, when TLS_TX setsockopt is not used.
tls: Avoid copying crypto_info again after cipher_type check.
tls: don't override sk_write_space if tls_set_sw_offload fails.
Jaegeuk Kim (3):
f2fs: sanity check on sit entry
f2fs: enhance sanity_check_raw_super() to avoid potential overflow
f2fs: fix missing up_read
Jason Wang (2):
virtio-net: disable guest csum during XDP set
virtio-net: fail XDP set if guest csum is negotiated
Jim Mattson (1):
kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
Jiri Kosina (3):
x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
x86/speculation: Propagate information about RSB filling mitigation to sysfs
Jiri Olsa (2):
perf/x86/intel: Move branch tracing setup to the Intel-specific source file
perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
Josef Bacik (1):
btrfs: release metadata before running delayed refs
Julian Wiedmann (1):
s390/qeth: fix length check in SNMP processing
Junaid Shahid (1):
kvm: mmu: Fix race in emulated page table writes
Kai-Heng Feng (1):
USB: usb-storage: Add new IDs to ums-realtek
Kailang Yang (1):
ALSA: hda/realtek - Support ALC300
Konrad Rzeszutek Wilk (3):
x86/bugs: Add AMD's variant of SSB_NO
x86/bugs: Add AMD's SPEC_CTRL MSR usage
x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
Konstantin Khlebnikov (1):
mm/huge_memory.c: reorder operations in __split_huge_page_tail()
Larry Finger (1):
staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station
Lior David (1):
wil6210: missing length check in wmi_set_ie
Liran Alon (1):
KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall
Lorenzo Bianconi (2):
net: thunderx: set xdp_prog to NULL if bpf_prog_add fails
net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue
Luis Chamberlain (1):
lib/test_kmod.c: fix rmmod double free
Martin Kelly (1):
iio:st_magn: Fix enable device after trigger
Matthias Schwarzott (1):
media: em28xx: Fix use-after-free when disconnecting
Max Filippov (3):
xtensa: enable coprocessors that are being flushed
xtensa: fix coprocessor context offset definitions
xtensa: fix coprocessor part of ptrace_{get,set}xregs
Maximilian Heyne (1):
fs: fix lost error code in dio_complete
Michael Niewöhner (1):
usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
Pan Bian (3):
rapidio/rionet: do not free skb before reading its length
btrfs: relocation: set trans to be NULL after ending transaction
ext2: fix potential use after free
Peter Zijlstra (1):
sched/core: Fix cpu.max vs. cpuhotplug deadlock
Peter Zijlstra (Intel) (1):
sched/smt: Make sched_smt_present track topology
Petr Machata (1):
net: skb_scrub_packet(): Scrub offload_fwd_mark
Qu Wenruo (13):
btrfs: Verify that every chunk has corresponding block group at mount time
btrfs: Refactor check_leaf function for later expansion
btrfs: Check if item pointer overlaps with the item itself
btrfs: Add sanity check for EXTENT_DATA when reading out leaf
btrfs: Add checker for EXTENT_CSUM
btrfs: Move leaf and node validation checker to tree-checker.c
btrfs: tree-checker: Enhance btrfs_check_node output
btrfs: tree-checker: Fix false panic for sanity test
btrfs: tree-checker: Add checker for dir item
btrfs: tree-checker: Verify block_group_item
btrfs: tree-checker: Detect invalid and empty essential trees
btrfs: Check that each block group has corresponding chunk at mount time
btrfs: tree-checker: Check level for leaves and nodes
Richard Genoud (2):
dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
dmaengine: at_hdmac: fix module unloading
Richard Weinberger (1):
ubi: Initialize Fastmap checkmapping correctly
Sasha Levin (1):
Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()"
Sebastian Andrzej Siewior (1):
x86/fpu: Disable bottom halves while loading FPU registers
Shaokun Zhang (1):
btrfs: tree-checker: Fix misleading group system information
Takashi Iwai (4):
ALSA: wss: Fix invalid snd_free_pages() at error path
ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
ALSA: control: Fix race between adding and removing a user element
ALSA: sparc: Fix invalid snd_free_pages() at error path
Thomas Gleixner (21):
x86/speculation: Rename SSBD update functions
x86/Kconfig: Select SCHED_SMT if SMP enabled
sched/smt: Expose sched_smt_present static key
x86/speculation: Rework SMT state change
x86/l1tf: Show actual SMT state
x86/speculation: Reorder the spec_v2 code
x86/speculation: Mark string arrays const correctly
x86/speculataion: Mark command line parser data __initdata
x86/speculation: Unify conditional spectre v2 print functions
x86/speculation: Add command line control for indirect branch speculation
x86/process: Consolidate and simplify switch_to_xtra() code
x86/speculation: Avoid __switch_to_xtra() calls
x86/speculation: Prepare for conditional IBPB in switch_mm()
ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS
x86/speculation: Split out TIF update
x86/speculation: Prevent stale SPEC_CTRL msr content
x86/speculation: Prepare arch_smt_update() for PRCTL mode
x86/speculation: Add prctl() control for indirect branch speculation
x86/speculation: Enable prctl mode for spectre_v2_user
x86/speculation: Add seccomp Spectre v2 user space protection mode
x86/speculation: Provide IBPB always command line options
Tim Chen (7):
x86/speculation: Update the TIF_SSBD comment
x86/speculation: Clean up spectre_v2_parse_cmdline()
x86/speculation: Remove unnecessary ret variable in cpu_show_common()
x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common()
x86/speculation: Disable STIBP when enhanced IBRS is in use
x86/speculation: Reorganize speculation control MSRs update
x86/speculation: Prepare for per task indirect branch speculation control
Todd Kjos (1):
binder: fix race that allows malicious free of live buffer
Tom Lendacky (2):
x86/bugs: Update when to check for the LS_CFG SSBD mitigation
x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
Vakul Garg (1):
net/tls: Fixed return value when tls_complete_pending_work() fails
Wanpeng Li (1):
KVM: X86: Fix scan ioapic use-before-initialization
Willem de Bruijn (1):
packet: copy user buffers before orphan or clone
Yu Zhao (1):
mm: use swp_offset as key in shmem_replace_page()
YueHaibing (1):
misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
Yunlei He (1):
f2fs: check blkaddr more accuratly before issue a bio
Zhenzhong Duan (3):
x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant
x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
x86/retpoline: Remove minimal retpoline support
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: vicodec: fix memchr() kernel oops
Author: Hans Verkuil <hverkuil(a)xs4all.nl>
Date: Sat Nov 17 06:25:08 2018 -0500
The size passed to memchr is too large as it assumes the search
starts at the start of the buffer, but it can start at an offset.
Cc: <stable(a)vger.kernel.org> # for v4.19 and up
Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/platform/vicodec/vicodec-core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index b292cff26c86..013cdebecbc4 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -304,7 +304,8 @@ restart:
for (; p < p_out + sz; p++) {
u32 copy;
- p = memchr(p, magic[ctx->comp_magic_cnt], sz);
+ p = memchr(p, magic[ctx->comp_magic_cnt],
+ p_out + sz - p);
if (!p) {
ctx->comp_magic_cnt = 0;
break;
Changes since v2 [1]:
* Fix links in the changelogs to reference lkml.kernel.org instead of
lore.kernel.org (Peter)
* Collect Acked-by's from Kirill and Peter.
* Add more Cc's for patches 1 and 2.
* Strengthen the lead-in comment for the set_p*_safe() helpers (Dave)
[1]: https://lkml.org/lkml/2018/12/1/358
---
>From patch 5:
Commit f77084d96355 "x86/mm/pat: Disable preemption around
__flush_tlb_all()" addressed a case where __flush_tlb_all() is called
without preemption being disabled. It also left a warning to catch other
cases where preemption is not disabled. That warning triggers for the
memory hotplug path which is also used for persistent memory enabling:
WARNING: CPU: 35 PID: 911 at ./arch/x86/include/asm/tlbflush.h:460
RIP: 0010:__flush_tlb_all+0x1b/0x3a
[..]
Call Trace:
phys_pud_init+0x29c/0x2bb
kernel_physical_mapping_init+0xfc/0x219
init_memory_mapping+0x1a5/0x3b0
arch_add_memory+0x2c/0x50
devm_memremap_pages+0x3aa/0x610
pmem_attach_disk+0x585/0x700 [nd_pmem]
Andy wondered why a path that can sleep was using __flush_tlb_all() [1]
and Dave confirmed the expectation for TLB flush is for modifying /
invalidating existing pte entries, but not initial population [2]. Drop
the usage of __flush_tlb_all() in phys_{p4d,pud,pmd}_init() on the
expectation that this path is only ever populating empty entries for the
linear map. Note, at linear map teardown time there is a call to the
all-cpu flush_tlb_all() to invalidate the removed mappings.
Additionally, Dave wanted some runtime assurances that
kernel_physical_mapping_init() is only populating and not changing
existing page table entries. Patches 1 - 4 are implementing a new
set_pte() family of helpers for that purpose.
Patch 5 is tagged for -stable because the false positive warning is now
showing up on 4.19-stable kernels. Patches 1 - 4 are not tagged for
-stable, but if the sanity checking is needed please mark them as such.
The hang that was observed while developing the sanity checking
implementation was resolved by Peter's suggestion to not trigger when
the same pte value is being rewritten.
---
Dan Williams (5):
generic/pgtable: Make {pmd,pud}_same() unconditionally available
generic/pgtable: Introduce {p4d,pgd}_same()
generic/pgtable: Introduce set_pte_safe()
x86/mm: Validate kernel_physical_mapping_init() pte population
x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init()
arch/x86/include/asm/pgalloc.h | 27 ++++++++++++++
arch/x86/mm/init_64.c | 30 ++++++----------
include/asm-generic/5level-fixup.h | 1 +
include/asm-generic/pgtable-nop4d-hack.h | 1 +
include/asm-generic/pgtable-nop4d.h | 1 +
include/asm-generic/pgtable-nopud.h | 1 +
include/asm-generic/pgtable.h | 56 +++++++++++++++++++++++++-----
7 files changed, 90 insertions(+), 27 deletions(-)
From: Hans Verkuil <hverkuil(a)xs4all.nl>
[ Upstream commit 7cf7b2e977abf3f992036939e35a8eab60013aff ]
Lower the minimum height to 360 to be consistent with the webcam input of vivid.
The 480 was rather arbitrary but it made it harder to use vivid as a source for
encoding since the default resolution when you load vivid is 640x360.
Signed-off-by: Hans Verkuil <hans.verkuil(a)cisco.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas(a)ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/media/platform/vicodec/vicodec-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index 408cd55d3580..daa5caa6adc6 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info");
#define MAX_WIDTH 4096U
#define MIN_WIDTH 640U
#define MAX_HEIGHT 2160U
-#define MIN_HEIGHT 480U
+#define MIN_HEIGHT 360U
#define dprintk(dev, fmt, arg...) \
v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg)
--
2.17.1
Hey,
On 2018-12-04 22:53, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v4.19.6, v4.14.85, v4.9.142, v4.4.166, v3.18.128,
>
> v4.19.6: Build OK!
> v4.14.85: Failed to apply! Possible dependencies:
> cd414f3d9316 ("drm/msm: Move memptrs to msm_gpu")
> eec874ce5ff1 ("drm/msm/adreno: load gpu at probe/bind time")
> f7de15450e90 ("drm/msm: Add per-instance submit queues")
> f97decac5f4c ("drm/msm: Support multiple ringbuffers")
v4.14.85 can be rebased fairly cleanly:
https://gitlab.collabora.com/robertfoss/linux/commits/msm_in_fence_put_v3_v…
However v4.9.142 and earlier does not rebase very cleanly at all.
I don't know what the rule of thumb for backporting fixes is, but the feature
that is fixed here does not seem to exist in v4.9.142 and earlier.
Rob.
>
> v4.9.142: Failed to apply! Possible dependencies:
> 1cec20f0ea0e ("dma-buf: Restart reservation_object_wait_timeout_rcu() after writes")
> 78010cd9736e ("dma-buf/fence: add an lockdep_assert_held()")
> f54d1867005c ("dma-buf: Rename struct fence to dma_fence")
> fedf54132d24 ("dma-buf: Restart reservation_object_get_fences_rcu() after writes")
>
> v4.4.166: Failed to apply! Possible dependencies:
> 0f477c6dea70 ("staging/android/sync: add sync_fence_create_dma")
> 31954660a7a6 ("dma-buf/sync_file: improve Kconfig description for Sync Files")
> 375fb53ec1be ("staging: android: replace explicit NULL comparison")
> 395dec6f6bc5 ("Documentation: add doc for sync_file_get_fence()")
> 62304fb1fc08 ("dma-buf/sync_file: de-stage sync_file")
> 696f74cf5439 ("staging/android: move sync_file functions comments to sync.c")
> 699f68556943 ("android: unconditionally remove callbacks in sync_fence_free()")
> 73465f1c0825 ("staging/android/sync: Support sync points created from dma-fences")
> 8a0044846115 ("staging/android: create a 'sync' dir for debugfs information")
> 9b32381ca50f ("staging/android: fix sync framework documentation")
> a44eb74cd413 ("staging/android: move SW_SYNC_USER to a debugfs file")
> b55b54b5db33 ("staging/android: remove struct sync_pt")
> c01a958eca6e ("drm/msm: reject submit ioctl if no gpu")
> c784c82a3fd6 ("Documentation: add Sync File doc")
> cd572182bd3d ("Staging: android: Fix brace coding style warning in sync_debug.c")
> d4cab38e153d ("staging/android: prepare sync_file for de-staging")
> d7c3110c28de ("staging/android: remove name arg from sync_file_create()")
> d7fdb0ae9d11 ("staging/android: rename sync_fence to sync_file")
> f54d1867005c ("dma-buf: Rename struct fence to dma_fence")
> fac8434dab96 ("Documentation: Fix some grammar mistakes in sync_file.txt")
>
> v3.18.128: Failed to apply! Possible dependencies:
> 0541cdf585a8 ("Staging: android: fix line length coding style issue in sync_debug.c")
> 0f477c6dea70 ("staging/android/sync: add sync_fence_create_dma")
> 31954660a7a6 ("dma-buf/sync_file: improve Kconfig description for Sync Files")
> 353fdf17060b ("staging: android: Replace timeval with timespec64")
> 375fb53ec1be ("staging: android: replace explicit NULL comparison")
> 395dec6f6bc5 ("Documentation: add doc for sync_file_get_fence()")
> 62304fb1fc08 ("dma-buf/sync_file: de-stage sync_file")
> 699f68556943 ("android: unconditionally remove callbacks in sync_fence_free()")
> 73465f1c0825 ("staging/android/sync: Support sync points created from dma-fences")
> 8a0044846115 ("staging/android: create a 'sync' dir for debugfs information")
> 9b32381ca50f ("staging/android: fix sync framework documentation")
> a44eb74cd413 ("staging/android: move SW_SYNC_USER to a debugfs file")
> b8797affa142 ("staging: android: fix coding style checks in sw_sync.c")
> c01a958eca6e ("drm/msm: reject submit ioctl if no gpu")
> c784c82a3fd6 ("Documentation: add Sync File doc")
> cd572182bd3d ("Staging: android: Fix brace coding style warning in sync_debug.c")
> d30649a8b618 ("staging: android: Remove unnecessary externs")
> d4cab38e153d ("staging/android: prepare sync_file for de-staging")
> d7c3110c28de ("staging/android: remove name arg from sync_file_create()")
> d7fdb0ae9d11 ("staging/android: rename sync_fence to sync_file")
> db1ad33bcfc4 ("drivers/staging: make android sw_sync.c explicitly non-modular")
> f54d1867005c ("dma-buf: Rename struct fence to dma_fence")
> fac8434dab96 ("Documentation: Fix some grammar mistakes in sync_file.txt")
>
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
>
Don't allow USB3 U1 or U2 if the latency to wake up from the U-state
reaches the service interval for a periodic endpoint.
This is according to xhci 1.1 specification section 4.23.5.2 extra note:
"Software shall ensure that a device is prevented from entering a U-state
where its worst case exit latency approaches the ESIT."
Allowing too long exit latencies for periodic endpoint confuses xHC
internal scheduling, and new devices may fail to enumerate with a
"Not enough bandwidth for new device state" error from the host.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
---
drivers/usb/host/xhci.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index c20b85e..dae3be1 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4514,6 +4514,14 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
{
unsigned long long timeout_ns;
+ /* Prevent U1 if service interval is shorter than U1 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+ if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
+ dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
if (xhci->quirks & XHCI_INTEL_HOST)
timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
else
@@ -4570,6 +4578,14 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
{
unsigned long long timeout_ns;
+ /* Prevent U2 if service interval is shorter than U2 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+ if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
+ dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
if (xhci->quirks & XHCI_INTEL_HOST)
timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
else
--
2.7.4
From: Sandeep Singh <sandeep.singh(a)amd.com>
Occasionally AMD SNPS 3.0 xHC does not respond to
CSS when set, also it does not flag anything on SRE and HCE
to point the internal xHC errors on USBSTS register. This stalls
the entire system wide suspend and there is no point in stalling
just because of xHC CSS is not responding.
To work around this problem, if the xHC does not flag
anything on SRE and HCE, we can skip the CSS
timeout and allow the system to continue the suspend. Once the
system resume happens we can internally reset the controller
using XHCI_RESET_ON_RESUME quirk
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com>
Signed-off-by: Sandeep Singh <Sandeep.Singh(a)amd.com>
cc: Nehal Shah <Nehal-bakulchandra.Shah(a)amd.com>
Cc: <stable(a)vger.kernel.org>
Tested-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com>
Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com>
---
drivers/usb/host/xhci-pci.c | 4 ++++
drivers/usb/host/xhci.c | 26 ++++++++++++++++++++++----
drivers/usb/host/xhci.h | 3 +++
3 files changed, 29 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index a951526..a9ec705 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -139,6 +139,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
pdev->device == 0x43bb))
xhci->quirks |= XHCI_SUSPEND_DELAY;
+ if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+ (pdev->device == 0x15e0 || pdev->device == 0x15e1))
+ xhci->quirks |= XHCI_SNPS_BROKEN_SUSPEND;
+
if (pdev->vendor == PCI_VENDOR_ID_AMD)
xhci->quirks |= XHCI_TRUST_TX_LENGTH;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index c928dbb..c20b85e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -968,6 +968,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
unsigned int delay = XHCI_MAX_HALT_USEC;
struct usb_hcd *hcd = xhci_to_hcd(xhci);
u32 command;
+ u32 res;
if (!hcd->state)
return 0;
@@ -1021,11 +1022,28 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
command = readl(&xhci->op_regs->command);
command |= CMD_CSS;
writel(command, &xhci->op_regs->command);
+ xhci->broken_suspend = 0;
if (xhci_handshake(&xhci->op_regs->status,
STS_SAVE, 0, 10 * 1000)) {
- xhci_warn(xhci, "WARN: xHC save state timeout\n");
- spin_unlock_irq(&xhci->lock);
- return -ETIMEDOUT;
+ /*
+ * AMD SNPS xHC 3.0 occasionally does not clear the
+ * SSS bit of USBSTS and when driver tries to poll
+ * to see if the xHC clears BIT(8) which never happens
+ * and driver assumes that controller is not responding
+ * and times out. To workaround this, its good to check
+ * if SRE and HCE bits are not set (as per xhci
+ * Section 5.4.2) and bypass the timeout.
+ */
+ res = readl(&xhci->op_regs->status);
+ if ((xhci->quirks & XHCI_SNPS_BROKEN_SUSPEND) &&
+ (((res & STS_SRE) == 0) &&
+ ((res & STS_HCE) == 0))) {
+ xhci->broken_suspend = 1;
+ } else {
+ xhci_warn(xhci, "WARN: xHC save state timeout\n");
+ spin_unlock_irq(&xhci->lock);
+ return -ETIMEDOUT;
+ }
}
spin_unlock_irq(&xhci->lock);
@@ -1078,7 +1096,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
spin_lock_irq(&xhci->lock);
- if (xhci->quirks & XHCI_RESET_ON_RESUME)
+ if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend)
hibernated = true;
if (!hibernated) {
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 260b259..c3515ba 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1850,6 +1850,7 @@ struct xhci_hcd {
#define XHCI_ZERO_64B_REGS BIT_ULL(32)
#define XHCI_DEFAULT_PM_RUNTIME_ALLOW BIT_ULL(33)
#define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34)
+#define XHCI_SNPS_BROKEN_SUSPEND BIT_ULL(35)
unsigned int num_active_eps;
unsigned int limit_active_eps;
@@ -1879,6 +1880,8 @@ struct xhci_hcd {
void *dbc;
/* platform-specific data -- must come last */
unsigned long priv[0] __aligned(sizeof(s64));
+ /* Broken Suspend flag for SNPS Suspend resume issue */
+ u8 broken_suspend;
};
/* Platform specific overrides to generic XHCI hc_driver ops */
--
2.7.4