April 2021 - Linux-stable-mirror

[PATCH AUTOSEL 4.14 1/5] KVM: arm64: Hide system instruction access to Trace registers

by Sasha Levin

From: Suzuki K Poulose <suzuki.poulose(a)arm.com> [ Upstream commit 1d676673d665fd2162e7e466dcfbe5373bfdb73e ] Currently we advertise the ID_AA6DFR0_EL1.TRACEVER for the guest, when the trace register accesses are trapped (CPTR_EL2.TTA == 1). So, the guest will get an undefined instruction, if trusts the ID registers and access one of the trace registers. Lets be nice to the guest and hide the feature to avoid unexpected behavior. Even though this can be done at KVM sysreg emulation layer, we do this by removing the TRACEVER from the sanitised feature register field. This is fine as long as the ETM drivers can handle the individual trace units separately, even when there are differences among the CPUs. Cc: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20210323120647.454211-2-suzuki.poulose@arm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- arch/arm64/kernel/cpufeature.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 174aa12fb8b1..1481e18aa5ca 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -230,7 +230,6 @@ static const struct arm64_ftr_bits ftr_id_aa64dfr0[] = { * of support. */ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_EXACT, ID_AA64DFR0_PMUVER_SHIFT, 4, 0), - ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_EXACT, ID_AA64DFR0_TRACEVER_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_EXACT, ID_AA64DFR0_DEBUGVER_SHIFT, 4, 0x6), ARM64_FTR_END, }; -- 2.30.2

3 years, 8 months

1
4
0 0

[PATCH AUTOSEL 5.4 01/13] interconnect: core: fix error return code of icc_link_destroy()

by Sasha Levin

From: Jia-Ju Bai <baijiaju1990(a)gmail.com> [ Upstream commit 715ea61532e731c62392221238906704e63d75b6 ] When krealloc() fails and new is NULL, no error return code of icc_link_destroy() is assigned. To fix this bug, ret is assigned with -ENOMEM hen new is NULL. Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com> Link: https://lore.kernel.org/r/20210306132857.17020-1-baijiaju1990@gmail.com Signed-off-by: Georgi Djakov <georgi.djakov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/interconnect/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c index c498796adc07..e579b3633a84 100644 --- a/drivers/interconnect/core.c +++ b/drivers/interconnect/core.c @@ -704,6 +704,8 @@ int icc_link_destroy(struct icc_node *src, struct icc_node *dst) GFP_KERNEL); if (new) src->links = new; + else + ret = -ENOMEM; out: mutex_unlock(&icc_lock); -- 2.30.2

3 years, 8 months

1
12
0 0

[PATCH AUTOSEL 5.11 01/22] interconnect: core: fix error return code of icc_link_destroy()

by Sasha Levin

From: Jia-Ju Bai <baijiaju1990(a)gmail.com> [ Upstream commit 715ea61532e731c62392221238906704e63d75b6 ] When krealloc() fails and new is NULL, no error return code of icc_link_destroy() is assigned. To fix this bug, ret is assigned with -ENOMEM hen new is NULL. Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com> Link: https://lore.kernel.org/r/20210306132857.17020-1-baijiaju1990@gmail.com Signed-off-by: Georgi Djakov <georgi.djakov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/interconnect/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c index 5ad519c9f239..8a1e70e00876 100644 --- a/drivers/interconnect/core.c +++ b/drivers/interconnect/core.c @@ -942,6 +942,8 @@ int icc_link_destroy(struct icc_node *src, struct icc_node *dst) GFP_KERNEL); if (new) src->links = new; + else + ret = -ENOMEM; out: mutex_unlock(&icc_lock); -- 2.30.2

3 years, 8 months

1
21
0 0

patch "misc: vmw_vmci: explicitly initialize vmci_datagram payload" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled misc: vmw_vmci: explicitly initialize vmci_datagram payload to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From b2192cfeba8481224da0a4ec3b4a7ccd80b1623b Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Fri, 2 Apr 2021 21:17:42 +0900 Subject: misc: vmw_vmci: explicitly initialize vmci_datagram payload KMSAN complains that vmci_check_host_caps() left the payload part of check_msg uninitialized. ===================================================== BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G B 5.11.0-rc7+ #4 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 Call Trace: dump_stack+0x21c/0x280 kmsan_report+0xfb/0x1e0 kmsan_internal_check_memory+0x202/0x520 kmsan_check_memory+0xd/0x10 iowrite8_rep+0x86/0x380 vmci_guest_probe_device+0xf0b/0x1e70 pci_device_probe+0xab3/0xe70 really_probe+0xd16/0x24d0 driver_probe_device+0x29d/0x3a0 device_driver_attach+0x25a/0x490 __driver_attach+0x78c/0x840 bus_for_each_dev+0x210/0x340 driver_attach+0x89/0xb0 bus_add_driver+0x677/0xc40 driver_register+0x485/0x8e0 __pci_register_driver+0x1ff/0x350 vmci_guest_init+0x3e/0x41 vmci_drv_init+0x1d6/0x43f do_one_initcall+0x39c/0x9a0 do_initcall_level+0x1d7/0x259 do_initcalls+0x127/0x1cb do_basic_setup+0x33/0x36 kernel_init_freeable+0x29a/0x3ed kernel_init+0x1f/0x840 ret_from_fork+0x1f/0x30 Uninit was created at: kmsan_internal_poison_shadow+0x5c/0xf0 kmsan_slab_alloc+0x8d/0xe0 kmem_cache_alloc+0x84f/0xe30 vmci_guest_probe_device+0xd11/0x1e70 pci_device_probe+0xab3/0xe70 really_probe+0xd16/0x24d0 driver_probe_device+0x29d/0x3a0 device_driver_attach+0x25a/0x490 __driver_attach+0x78c/0x840 bus_for_each_dev+0x210/0x340 driver_attach+0x89/0xb0 bus_add_driver+0x677/0xc40 driver_register+0x485/0x8e0 __pci_register_driver+0x1ff/0x350 vmci_guest_init+0x3e/0x41 vmci_drv_init+0x1d6/0x43f do_one_initcall+0x39c/0x9a0 do_initcall_level+0x1d7/0x259 do_initcalls+0x127/0x1cb do_basic_setup+0x33/0x36 kernel_init_freeable+0x29a/0x3ed kernel_init+0x1f/0x840 ret_from_fork+0x1f/0x30 Bytes 28-31 of 36 are uninitialized Memory access of size 36 starts at ffff8881675e5f00 ===================================================== Fixes: 1f166439917b69d3 ("VMCI: guest side driver implementation.") Cc: <stable(a)vger.kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/20210402121742.3917-2-penguin-kernel@I-love.SAKUR… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/vmw_vmci/vmci_guest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c index cc8eeb361fcd..1018dc77269d 100644 --- a/drivers/misc/vmw_vmci/vmci_guest.c +++ b/drivers/misc/vmw_vmci/vmci_guest.c @@ -168,7 +168,7 @@ static int vmci_check_host_caps(struct pci_dev *pdev) VMCI_UTIL_NUM_RESOURCES * sizeof(u32); struct vmci_datagram *check_msg; - check_msg = kmalloc(msg_size, GFP_KERNEL); + check_msg = kzalloc(msg_size, GFP_KERNEL); if (!check_msg) { dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__); return -ENOMEM; -- 2.31.1

3 years, 8 months

1
0
0 0

patch "misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 376565b9717c30cd58ad33860fa42697615fa2e4 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Fri, 2 Apr 2021 21:17:41 +0900 Subject: misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct KMSAN complains that the vmci_use_ppn64() == false path in vmci_dbell_register_notification_bitmap() left upper 32bits of bitmap_set_msg.bitmap_ppn64 member uninitialized. ===================================================== BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10 CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.11.0-rc7+ #4 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 Call Trace: dump_stack+0x21c/0x280 kmsan_report+0xfb/0x1e0 kmsan_internal_check_memory+0x484/0x520 kmsan_check_memory+0xd/0x10 iowrite8_rep+0x86/0x380 vmci_send_datagram+0x150/0x280 vmci_dbell_register_notification_bitmap+0x133/0x1e0 vmci_guest_probe_device+0xcab/0x1e70 pci_device_probe+0xab3/0xe70 really_probe+0xd16/0x24d0 driver_probe_device+0x29d/0x3a0 device_driver_attach+0x25a/0x490 __driver_attach+0x78c/0x840 bus_for_each_dev+0x210/0x340 driver_attach+0x89/0xb0 bus_add_driver+0x677/0xc40 driver_register+0x485/0x8e0 __pci_register_driver+0x1ff/0x350 vmci_guest_init+0x3e/0x41 vmci_drv_init+0x1d6/0x43f do_one_initcall+0x39c/0x9a0 do_initcall_level+0x1d7/0x259 do_initcalls+0x127/0x1cb do_basic_setup+0x33/0x36 kernel_init_freeable+0x29a/0x3ed kernel_init+0x1f/0x840 ret_from_fork+0x1f/0x30 Local variable ----bitmap_set_msg@vmci_dbell_register_notification_bitmap created at: vmci_dbell_register_notification_bitmap+0x50/0x1e0 vmci_dbell_register_notification_bitmap+0x50/0x1e0 Bytes 28-31 of 32 are uninitialized Memory access of size 32 starts at ffff88810098f570 ===================================================== Fixes: 83e2ec765be03e8a ("VMCI: doorbell implementation.") Cc: <stable(a)vger.kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/20210402121742.3917-1-penguin-kernel@I-love.SAKUR… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/misc/vmw_vmci/vmci_doorbell.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c index 345addd9306d..fa8a7fce4481 100644 --- a/drivers/misc/vmw_vmci/vmci_doorbell.c +++ b/drivers/misc/vmw_vmci/vmci_doorbell.c @@ -326,7 +326,7 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle) bool vmci_dbell_register_notification_bitmap(u64 bitmap_ppn) { int result; - struct vmci_notify_bm_set_msg bitmap_set_msg; + struct vmci_notify_bm_set_msg bitmap_set_msg = { }; bitmap_set_msg.hdr.dst = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID, VMCI_SET_NOTIFY_BITMAP); -- 2.31.1

3 years, 8 months

1
0
0 0

[PATCH 1/2] Revert "mtd: spi-nor: macronix: Add support for mx25l51245g"

by Tudor Ambarus

This reverts commit 04b8edad262eec0d153005973dfbdd83423c0dcb. mx25l51245g and mx66l51235l have the same flash ID. The flash detection returns the first entry in the flash_info array that matches the flash ID that was read, thus for the 0xc2201a ID, mx25l51245g was always hit, introducing a regression for mx66l51235l. If one wants to differentiate the flash names, a better fix would be to differentiate between the two at run-time, depending on SFDP, and choose the correct name from a list of flash names, depending on the SFDP differentiator. Fixes: 04b8edad262e ("mtd: spi-nor: macronix: Add support for mx25l51245g") Cc: stable(a)vger.kernel.org Signed-off-by: Tudor Ambarus <tudor.ambarus(a)microchip.com> --- drivers/mtd/spi-nor/macronix.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/mtd/spi-nor/macronix.c b/drivers/mtd/spi-nor/macronix.c index 6c2680b4cdad..42c2cf31702e 100644 --- a/drivers/mtd/spi-nor/macronix.c +++ b/drivers/mtd/spi-nor/macronix.c @@ -72,9 +72,6 @@ static const struct flash_info macronix_parts[] = { SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, { "mx25l25655e", INFO(0xc22619, 0, 64 * 1024, 512, 0) }, - { "mx25l51245g", INFO(0xc2201a, 0, 64 * 1024, 1024, - SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | - SPI_NOR_4B_OPCODES) }, { "mx66l51235l", INFO(0xc2201a, 0, 64 * 1024, 1024, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | SPI_NOR_4B_OPCODES) }, -- 2.25.1

3 years, 8 months

2
1
0 0

FAILED: patch "[PATCH] mei: allow map and unmap of client dma buffer only for" failed to apply to 5.11-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.11-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From ce068bc7da473e39b64d130101e178406023df0c Mon Sep 17 00:00:00 2001 From: Tomas Winkler <tomas.winkler(a)intel.com> Date: Thu, 18 Mar 2021 07:59:59 +0200 Subject: [PATCH] mei: allow map and unmap of client dma buffer only for disconnected client Allow map and unmap of the client dma buffer only when the client is not connected. The functions return -EPROTO if the client is already connected. This is to fix the race when traffic may start or stop when buffer is not available. Cc: <stable(a)vger.kernel.org> #v5.11+ Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Link: https://lore.kernel.org/r/20210318055959.305627-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index 4378a9b25848..2cc370adb238 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -2286,8 +2286,8 @@ int mei_cl_dma_alloc_and_map(struct mei_cl *cl, const struct file *fp, if (buffer_id == 0) return -EINVAL; - if (!mei_cl_is_connected(cl)) - return -ENODEV; + if (mei_cl_is_connected(cl)) + return -EPROTO; if (cl->dma_mapped) return -EPROTO; @@ -2327,9 +2327,7 @@ int mei_cl_dma_alloc_and_map(struct mei_cl *cl, const struct file *fp, mutex_unlock(&dev->device_lock); wait_event_timeout(cl->wait, - cl->dma_mapped || - cl->status || - !mei_cl_is_connected(cl), + cl->dma_mapped || cl->status, mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT)); mutex_lock(&dev->device_lock); @@ -2376,8 +2374,9 @@ int mei_cl_dma_unmap(struct mei_cl *cl, const struct file *fp) return -EOPNOTSUPP; } - if (!mei_cl_is_connected(cl)) - return -ENODEV; + /* do not allow unmap for connected client */ + if (mei_cl_is_connected(cl)) + return -EPROTO; if (!cl->dma_mapped) return -EPROTO; @@ -2405,9 +2404,7 @@ int mei_cl_dma_unmap(struct mei_cl *cl, const struct file *fp) mutex_unlock(&dev->device_lock); wait_event_timeout(cl->wait, - !cl->dma_mapped || - cl->status || - !mei_cl_is_connected(cl), + !cl->dma_mapped || cl->status, mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT)); mutex_lock(&dev->device_lock);

3 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] usb: musb: Fix suspend with devices connected for a64" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 92af4fc6ec331228aca322ca37c8aea7b150a151 Mon Sep 17 00:00:00 2001 From: Tony Lindgren <tony(a)atomide.com> Date: Wed, 24 Mar 2021 09:11:41 +0200 Subject: [PATCH] usb: musb: Fix suspend with devices connected for a64 Pinephone running on Allwinner A64 fails to suspend with USB devices connected as reported by Bhushan Shah <bshah(a)kde.org>. Reverting commit 5fbf7a253470 ("usb: musb: fix idling for suspend after disconnect interrupt") fixes the issue. Let's add suspend checks also for suspend after disconnect interrupt quirk handling like we already do elsewhere. Fixes: 5fbf7a253470 ("usb: musb: fix idling for suspend after disconnect interrupt") Reported-by: Bhushan Shah <bshah(a)kde.org> Tested-by: Bhushan Shah <bshah(a)kde.org> Signed-off-by: Tony Lindgren <tony(a)atomide.com> Link: https://lore.kernel.org/r/20210324071142.42264-1-tony@atomide.com Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c index 1cd87729ba60..fc0457db62e1 100644 --- a/drivers/usb/musb/musb_core.c +++ b/drivers/usb/musb/musb_core.c @@ -2004,10 +2004,14 @@ static void musb_pm_runtime_check_session(struct musb *musb) MUSB_DEVCTL_HR; switch (devctl & ~s) { case MUSB_QUIRK_B_DISCONNECT_99: - musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); - schedule_delayed_work(&musb->irq_work, - msecs_to_jiffies(1000)); - break; + if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); + schedule_delayed_work(&musb->irq_work, + msecs_to_jiffies(1000)); + musb->quirk_retries--; + break; + } + fallthrough; case MUSB_QUIRK_B_INVALID_VBUS_91: if (musb->quirk_retries && !musb->flush_irq_work) { musb_dbg(musb,

3 years, 8 months

1
0
0 0

stable/linux-5.10.y - 5.10.27

by Patrick Mccormick

JOB ID : 29cbaf7acada1e4b67b23f0841955606b597319a JOB LOG : /home/ci-hypervisor/avocado/job-results/job-2021-03-30T18.59-29cbaf7/job.log (1/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_nptl: PASS (6.21 s) (2/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_math: PASS (2.01 s) (3/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_hugetlb: PASS (0.08 s) (4/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_ipc: PASS (20.08 s) (5/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_uevent: PASS (0.06 s) (6/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_containers: PASS (36.90 s) (7/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_filecaps: PASS (0.11 s) (8/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/ltp.py:LTP.test_hyperthreading: PASS (71.20 s) (9/9) /home/ci-hypervisor/.local/lib/python3.6/site-packages/fathom/tests/kpatch.sh: PASS (13.63 s) RESULTS : PASS 9 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0

3 years, 8 months

2
2
0 0

[BUG]: usb: dwc3: gadget: Prevent EP queuing while stopping transfers

by H. Nikolaus Schaller

it seems as if the patch 9de499997c37 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") in v5.11.y f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") in v5.12-rc5 reproducible breaks dwc3 RNDIS gadget, at least on the Pyra Handheld (OMAP5). The symptom of having this patch in tree (v5.11.10 or v5.12) is that rndis/gadget initially works after boot. But after unplugging the cable, a replug gives warnings like the following and RNDIS isn't up and running any more: [ 72.009811] ------------[ cut here ]------------ [ 72.014768] WARNING: CPU: 0 PID: 2499 at drivers/usb/dwc3/gadget.c:361 dwc3_send_gadget_ep_cmd+0x1f8/0x330 [dwc3] [ 72.025846] dwc3 4a030000.usb: No resource for ep2in [ 72.031125] Modules linked in: bnep usb_f_ecm g_ether usb_f_rndis u_ether libcomposite configfs ipv6 snd_soc_omap_hdmi wl18xx wlcore panel_boe_btl507212_w677l mac80211 snd_soc_spdif_tx snd_soc_dmic dwc3 roles cfg80211 libarc4 snd_soc_omap_abe_twl6040 snd_soc_simple_card omapdrm pvrsrvkm_omap5_sgx544_116 snd_soc_omap_mcpdm snd_soc_simple_card_utils etnaviv wwan_on_off snd_soc_twl6040 leds_gpio snd_soc_gtm601 drm_kms_helper pwm_bl pwm_omap_dmtimer ti_tpd12s015 display_connector generic_adc_battery snd_soc_w2cbw003_bt gpu_sched syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm drm_panel_orientation_quirks omap_sham omap_aes_driver crypto_engine omap_crypto ehci_omap dwc3_omap wlcore_sdio snd_soc_ts3a227e ina2xx_adc leds_is31fl319x tsc2007 bq2429x_charger bq27xxx_battery_i2c bq27xxx_battery ina2xx as5013 tca8418_keypad twl6040_vibra bmp280_spi clk_twl6040 gpio_twl6040 hci_uart btbcm palmas_pwrbutton palmas_gpadc usb3503 bluetooth bmc150_accel_i2c bmc150_magn_i2c bmp280_i2c bmg160_ i2c [ 72.032887] bmc150_accel_core bmc150_magn bmg160_core bmp280 ecdh_generic bno055 industrialio_triggered_buffer ecc kfifo_buf industrialio snd_soc_omap_aess snd_soc_omap_mcbsp snd_soc_ti_sdma [ 72.143285] CPU: 0 PID: 2499 Comm: irq/200-dwc3 Not tainted 5.12.0-rc5-letux-lpae+ #5479 [ 72.151914] Hardware name: Generic OMAP5 (Flattened Device Tree) [ 72.158300] [<c020ec60>] (unwind_backtrace) from [<c020a1d0>] (show_stack+0x10/0x14) [ 72.166595] [<c020a1d0>] (show_stack) from [<c096aa34>] (dump_stack+0x8c/0xac) [ 72.174325] [<c096aa34>] (dump_stack) from [<c022ba94>] (__warn+0xcc/0xf4) [ 72.181668] [<c022ba94>] (__warn) from [<c022bb2c>] (warn_slowpath_fmt+0x70/0x9c) [ 72.189664] [<c022bb2c>] (warn_slowpath_fmt) from [<bf41ef44>] (dwc3_send_gadget_ep_cmd+0x1f8/0x330 [dwc3]) [ 72.200223] [<bf41ef44>] (dwc3_send_gadget_ep_cmd [dwc3]) from [<bf41f55c>] (__dwc3_gadget_ep_enable+0x344/0x420 [dwc3]) [ 72.212003] [<bf41f55c>] (__dwc3_gadget_ep_enable [dwc3]) from [<bf41f6f0>] (dwc3_gadget_ep_enable+0xb8/0xe8 [dwc3]) [ 72.223420] [<bf41f6f0>] (dwc3_gadget_ep_enable [dwc3]) from [<c078eef8>] (usb_ep_enable+0x3c/0xd4) [ 72.233182] [<c078eef8>] (usb_ep_enable) from [<bf57497c>] (ecm_set_alt+0x48/0x13c [usb_f_ecm]) [ 72.242490] [<bf57497c>] (ecm_set_alt [usb_f_ecm]) from [<bf5450b4>] (composite_setup+0xa88/0x152c [libcomposite]) [ 72.253629] [<bf5450b4>] (composite_setup [libcomposite]) from [<bf421edc>] (dwc3_ep0_delegate_req+0x2c/0x40 [dwc3]) [ 72.264981] [<bf421edc>] (dwc3_ep0_delegate_req [dwc3]) from [<bf422d9c>] (dwc3_ep0_interrupt+0x31c/0x824 [dwc3]) [ 72.276122] [<bf422d9c>] (dwc3_ep0_interrupt [dwc3]) from [<bf420698>] (dwc3_process_event_buf+0x11c/0xa50 [dwc3]) [ 72.287357] [<bf420698>] (dwc3_process_event_buf [dwc3]) from [<bf420ff0>] (dwc3_thread_interrupt+0x24/0x3c [dwc3]) [ 72.298679] [<bf420ff0>] (dwc3_thread_interrupt [dwc3]) from [<c027972c>] (irq_thread_fn+0x1c/0x5c) [ 72.308440] [<c027972c>] (irq_thread_fn) from [<c0279a54>] (irq_thread+0x158/0x1e8) [ 72.316617] [<c0279a54>] (irq_thread) from [<c02492d8>] (kthread+0x138/0x148) [ 72.324254] [<c02492d8>] (kthread) from [<c0200140>] (ret_from_fork+0x14/0x34) [ 72.331968] Exception stack(0xc2e99fb0 to 0xc2e99ff8) [ 72.337339] 9fa0: 00000000 00000000 00000000 00000000 [ 72.346022] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 72.354716] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 72.361753] ---[ end trace d949466d43afc2cb ]--- [ 72.366675] ------------[ cut here ]------------ [ 72.371579] WARNING: CPU: 0 PID: 2499 at drivers/usb/gadget/udc/core.c:278 usb_ep_queue+0xe8/0x108 [ 72.381131] Modules linked in: bnep usb_f_ecm g_ether usb_f_rndis u_ether libcomposite configfs ipv6 snd_soc_omap_hdmi wl18xx wlcore panel_boe_btl507212_w677l mac80211 snd_soc_spdif_tx snd_soc_dmic dwc3 roles cfg80211 libarc4 snd_soc_omap_abe_twl6040 snd_soc_simple_card omapdrm pvrsrvkm_omap5_sgx544_116 snd_soc_omap_mcpdm snd_soc_simple_card_utils etnaviv wwan_on_off snd_soc_twl6040 leds_gpio snd_soc_gtm601 drm_kms_helper pwm_bl pwm_omap_dmtimer ti_tpd12s015 display_connector generic_adc_battery snd_soc_w2cbw003_bt gpu_sched syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm drm_panel_orientation_quirks omap_sham omap_aes_driver crypto_engine omap_crypto ehci_omap dwc3_omap wlcore_sdio snd_soc_ts3a227e ina2xx_adc leds_is31fl319x tsc2007 bq2429x_charger bq27xxx_battery_i2c bq27xxx_battery ina2xx as5013 tca8418_keypad twl6040_vibra bmp280_spi clk_twl6040 gpio_twl6040 hci_uart btbcm palmas_pwrbutton palmas_gpadc usb3503 bluetooth bmc150_accel_i2c bmc150_magn_i2c bmp280_i2c bmg160_ i2c [ 72.382817] bmc150_accel_core bmc150_magn bmg160_core bmp280 ecdh_generic bno055 industrialio_triggered_buffer ecc kfifo_buf industrialio snd_soc_omap_aess snd_soc_omap_mcbsp snd_soc_ti_sdma [ 72.493132] CPU: 0 PID: 2499 Comm: irq/200-dwc3 Tainted: G W 5.12.0-rc5-letux-lpae+ #5479 [ 72.503202] Hardware name: Generic OMAP5 (Flattened Device Tree) [ 72.509581] [<c020ec60>] (unwind_backtrace) from [<c020a1d0>] (show_stack+0x10/0x14) [ 72.517852] [<c020a1d0>] (show_stack) from [<c096aa34>] (dump_stack+0x8c/0xac) [ 72.525571] [<c096aa34>] (dump_stack) from [<c022ba94>] (__warn+0xcc/0xf4) [ 72.532926] [<c022ba94>] (__warn) from [<c022bb2c>] (warn_slowpath_fmt+0x70/0x9c) [ 72.540921] [<c022bb2c>] (warn_slowpath_fmt) from [<c078ee9c>] (usb_ep_queue+0xe8/0x108) [ 72.549558] [<c078ee9c>] (usb_ep_queue) from [<bf574914>] (ecm_do_notify+0x138/0x158 [usb_f_ecm]) [ 72.559049] [<bf574914>] (ecm_do_notify [usb_f_ecm]) from [<bf574a68>] (ecm_set_alt+0x134/0x13c [usb_f_ecm]) [ 72.569524] [<bf574a68>] (ecm_set_alt [usb_f_ecm]) from [<bf5450b4>] (composite_setup+0xa88/0x152c [libcomposite]) [ 72.580626] [<bf5450b4>] (composite_setup [libcomposite]) from [<bf421edc>] (dwc3_ep0_delegate_req+0x2c/0x40 [dwc3]) [ 72.592038] [<bf421edc>] (dwc3_ep0_delegate_req [dwc3]) from [<bf422d9c>] (dwc3_ep0_interrupt+0x31c/0x824 [dwc3]) [ 72.603209] [<bf422d9c>] (dwc3_ep0_interrupt [dwc3]) from [<bf420698>] (dwc3_process_event_buf+0x11c/0xa50 [dwc3]) [ 72.614469] [<bf420698>] (dwc3_process_event_buf [dwc3]) from [<bf420ff0>] (dwc3_thread_interrupt+0x24/0x3c [dwc3]) [ 72.625793] [<bf420ff0>] (dwc3_thread_interrupt [dwc3]) from [<c027972c>] (irq_thread_fn+0x1c/0x5c) [ 72.635556] [<c027972c>] (irq_thread_fn) from [<c0279a54>] (irq_thread+0x158/0x1e8) [ 72.643705] [<c0279a54>] (irq_thread) from [<c02492d8>] (kthread+0x138/0x148) [ 72.651334] [<c02492d8>] (kthread) from [<c0200140>] (ret_from_fork+0x14/0x34) [ 72.659055] Exception stack(0xc2e99fb0 to 0xc2e99ff8) [ 72.664437] 9fa0: 00000000 00000000 00000000 00000000 [ 72.673123] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 72.681821] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 72.688840] ---[ end trace d949466d43afc2cc ]--- [ 72.708346] bq2429x_charger 1-006b: bq2429x_usb_detect: state changed: state->[ HOST FCHG INDPM PWRGOOD] fault->[] [ 72.719587] bq2429x_charger 1-006b: bq2429x: VBUS became available [ 72.920591] ------------[ cut here ]------------ [ 72.925514] WARNING: CPU: 0 PID: 2499 at drivers/usb/dwc3/gadget.c:361 dwc3_send_gadget_ep_cmd+0x1f8/0x330 [dwc3] [ 72.936612] dwc3 4a030000.usb: No resource for ep1in [ 72.941892] Modules linked in: bnep usb_f_ecm g_ether usb_f_rndis u_ether libcomposite configfs ipv6 snd_soc_omap_hdmi wl18xx wlcore panel_boe_btl507212_w677l mac80211 snd_soc_spdif_tx snd_soc_dmic dwc3 roles cfg80211 libarc4 snd_soc_omap_abe_twl6040 snd_soc_simple_card omapdrm pvrsrvkm_omap5_sgx544_116 snd_soc_omap_mcpdm snd_soc_simple_card_utils etnaviv wwan_on_off snd_soc_twl6040 leds_gpio snd_soc_gtm601 drm_kms_helper pwm_bl pwm_omap_dmtimer ti_tpd12s015 display_connector generic_adc_battery snd_soc_w2cbw003_bt gpu_sched syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm drm_panel_orientation_quirks omap_sham omap_aes_driver crypto_engine omap_crypto ehci_omap dwc3_omap wlcore_sdio snd_soc_ts3a227e ina2xx_adc leds_is31fl319x tsc2007 bq2429x_charger bq27xxx_battery_i2c bq27xxx_battery ina2xx as5013 tca8418_keypad twl6040_vibra bmp280_spi clk_twl6040 gpio_twl6040 hci_uart btbcm palmas_pwrbutton palmas_gpadc usb3503 bluetooth bmc150_accel_i2c bmc150_magn_i2c bmp280_i2c bmg160_ i2c [ 72.943662] bmc150_accel_core bmc150_magn bmg160_core bmp280 ecdh_generic bno055 industrialio_triggered_buffer ecc kfifo_buf industrialio snd_soc_omap_aess snd_soc_omap_mcbsp snd_soc_ti_sdma [ 73.054078] CPU: 0 PID: 2499 Comm: irq/200-dwc3 Tainted: G W 5.12.0-rc5-letux-lpae+ #5479 [ 73.064176] Hardware name: Generic OMAP5 (Flattened Device Tree) [ 73.070582] [<c020ec60>] (unwind_backtrace) from [<c020a1d0>] (show_stack+0x10/0x14) [ 73.078867] [<c020a1d0>] (show_stack) from [<c096aa34>] (dump_stack+0x8c/0xac) [ 73.086585] [<c096aa34>] (dump_stack) from [<c022ba94>] (__warn+0xcc/0xf4) [ 73.093930] [<c022ba94>] (__warn) from [<c022bb2c>] (warn_slowpath_fmt+0x70/0x9c) [ 73.101926] [<c022bb2c>] (warn_slowpath_fmt) from [<bf41ef44>] (dwc3_send_gadget_ep_cmd+0x1f8/0x330 [dwc3]) [ 73.112425] [<bf41ef44>] (dwc3_send_gadget_ep_cmd [dwc3]) from [<bf41f55c>] (__dwc3_gadget_ep_enable+0x344/0x420 [dwc3]) [ 73.124234] [<bf41f55c>] (__dwc3_gadget_ep_enable [dwc3]) from [<bf41f6f0>] (dwc3_gadget_ep_enable+0xb8/0xe8 [dwc3]) [ 73.135678] [<bf41f6f0>] (dwc3_gadget_ep_enable [dwc3]) from [<c078eef8>] (usb_ep_enable+0x3c/0xd4) [ 73.145444] [<c078eef8>] (usb_ep_enable) from [<bf558f40>] (gether_connect+0x24/0x19c [u_ether]) [ 73.154873] [<bf558f40>] (gether_connect [u_ether]) from [<bf574a50>] (ecm_set_alt+0x11c/0x13c [usb_f_ecm]) [ 73.165258] [<bf574a50>] (ecm_set_alt [usb_f_ecm]) from [<bf5451d4>] (composite_setup+0xba8/0x152c [libcomposite]) [ 73.176368] [<bf5451d4>] (composite_setup [libcomposite]) from [<bf421edc>] (dwc3_ep0_delegate_req+0x2c/0x40 [dwc3]) [ 73.187772] [<bf421edc>] (dwc3_ep0_delegate_req [dwc3]) from [<bf422eb0>] (dwc3_ep0_interrupt+0x430/0x824 [dwc3]) [ 73.198919] [<bf422eb0>] (dwc3_ep0_interrupt [dwc3]) from [<bf420698>] (dwc3_process_event_buf+0x11c/0xa50 [dwc3]) [ 73.210172] [<bf420698>] (dwc3_process_event_buf [dwc3]) from [<bf420ff0>] (dwc3_thread_interrupt+0x24/0x3c [dwc3]) [ 73.221494] [<bf420ff0>] (dwc3_thread_interrupt [dwc3]) from [<c027972c>] (irq_thread_fn+0x1c/0x5c) [ 73.231260] [<c027972c>] (irq_thread_fn) from [<c0279a54>] (irq_thread+0x158/0x1e8) [ 73.239411] [<c0279a54>] (irq_thread) from [<c02492d8>] (kthread+0x138/0x148) [ 73.247041] [<c02492d8>] (kthread) from [<c0200140>] (ret_from_fork+0x14/0x34) [ 73.254758] Exception stack(0xc2e99fb0 to 0xc2e99ff8) [ 73.260135] 9fa0: 00000000 00000000 00000000 00000000 [ 73.268815] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 73.277476] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 73.284490] ---[ end trace d949466d43afc2cd ]--- Even once I was able to trigger a kernel panic just by unplugging/replugging the cable. Reverting this patch makes DWC3 work again after cable unplug/replug. On both, v5.11.10 and 5.12-rc5. Please suggest a fix for testing. BR and thanks, Nikolaus Schaller

3 years, 8 months

2
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2021