[PATCH 0/2] xhci fixes for usb-linus

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple small xhci fixes for usb-linus 7.2-rc.
Fix one memory leak, and one sleep in atomic during free.

Thanks
Mathias

Xu Rao (1):
  xhci: sideband: fix ring sg table pages leak

胡连勤 (1):
  usb: xhci: Fix sleep in atomic context in xhci_free_streams()

 drivers/usb/host/xhci-sideband.c |  2 ++
 drivers/usb/host/xhci.c          | 11 ++++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH 1/2] xhci: sideband: fix ring sg table pages leak

[Mathias Nyman]

From: Xu Rao <raoxu@uniontech.com>

xhci_ring_to_sgtable() allocates a temporary pages array and
uses it to build the returned sg_table with
sg_alloc_table_from_pages().

The error paths free the pages array, but the success path
returns the sg_table without freeing it. This leaks the temporary
array every time a sideband client gets an endpoint or event ring
buffer.

Free the pages array after sg_alloc_table_from_pages() succeeds.
The returned sg_table has its own scatterlist entries and does not
depend on the temporary array after construction.

Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci-sideband.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/xhci-sideband.c b/drivers/usb/host/xhci-sideband.c
index 23153e136d4b..a5deeee4d5dc 100644
--- a/drivers/usb/host/xhci-sideband.c
+++ b/drivers/usb/host/xhci-sideband.c
@@ -58,6 +58,8 @@ xhci_ring_to_sgtable(struct xhci_sideband *sb, struct xhci_ring *ring)
 	if (sg_alloc_table_from_pages(sgt, pages, n_pages, 0, sz, GFP_KERNEL))
 		goto err;
 
+	kvfree(pages);
+
 	/*
 	 * Save first segment dma address to sg dma_address field for the sideband
 	 * client to have access to the IOVA of the ring.
-- 
2.43.0

[PATCH 2/2] usb: xhci: Fix sleep in atomic context in xhci_free_streams()

[Mathias Nyman]

From: 胡连勤 <hulianqin@vivo.com>

When a USB device with active stream endpoints is disconnected,
xhci_free_streams() is called from the hub_event workqueue to
free the stream resources.  It calls xhci_free_stream_info()
while holding xhci->lock with irqs disabled.

xhci_free_stream_info() invokes xhci_free_stream_ctx(), which
calls dma_free_coherent() for large stream context arrays.

dma_free_coherent() can sleep (e.g. via vunmap), triggering
a BUG when called from atomic context.

Call trace:
 dma_free_attrs+0x174/0x220
 xhci_free_stream_info+0xd0/0x11c
 xhci_free_streams+0x278/0x37c
 usb_free_streams+0x98/0xc0
 usb_unbind_interface+0x1b8/0x2f8
 device_release_driver_internal+0x1d4/0x2cc
 device_release_driver+0x18/0x28
 bus_remove_device+0x160/0x1a4
 device_del+0x1ec/0x350
 usb_disable_device+0x98/0x214
 usb_disconnect+0xf0/0x35c
 hub_event+0xab4/0x19ec
 process_one_work+0x278/0x63c

Fix this by saving the stream_info pointers and clearing the
ep references under the lock, then calling xhci_free_stream_info()
outside the lock where sleeping is allowed.

Fixes: 8df75f42f8e6 ("USB: xhci: Add memory allocation for USB3 bulk streams.")
Cc: stable@vger.kernel.org
Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6922cc5496c1..f44ccee5fa07 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3785,6 +3785,7 @@ static int xhci_free_streams(struct usb_hcd *hcd, struct usb_device *udev,
 	struct xhci_virt_device *vdev;
 	struct xhci_command *command;
 	struct xhci_input_control_ctx *ctrl_ctx;
+	struct xhci_stream_info *stream_info[EP_CTX_PER_DEV];
 	unsigned int ep_index;
 	unsigned long flags;
 	u32 changed_ep_bitmask;
@@ -3845,10 +3846,15 @@ static int xhci_free_streams(struct usb_hcd *hcd, struct usb_device *udev,
 	if (ret < 0)
 		return ret;
 
+	/*
+	 * dma_free_coherent() called by xhci_free_stream_info() may sleep,
+	 * so save stream_info pointers and clear references under lock,
+	 * then free the memory outside lock.
+	 */
 	spin_lock_irqsave(&xhci->lock, flags);
 	for (i = 0; i < num_eps; i++) {
 		ep_index = xhci_get_endpoint_index(&eps[i]->desc);
-		xhci_free_stream_info(xhci, vdev->eps[ep_index].stream_info);
+		stream_info[i] = vdev->eps[ep_index].stream_info;
 		vdev->eps[ep_index].stream_info = NULL;
 		/* FIXME Unset maxPstreams in endpoint context and
 		 * update deq ptr to point to normal string ring.
@@ -3858,6 +3864,9 @@ static int xhci_free_streams(struct usb_hcd *hcd, struct usb_device *udev,
 	}
 	spin_unlock_irqrestore(&xhci->lock, flags);
 
+	for (i = 0; i < num_eps; i++)
+		xhci_free_stream_info(xhci, stream_info[i]);
+
 	return 0;
 }
 
-- 
2.43.0

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

Two fixes for usb-linus, one of them solving the 6.16 regression reported
by Michal and Arch Linux users regarding xHCI host not responding after
suspend and resume

Thanks
Mathias

Niklas Neronin (1):
  usb: xhci: fix host not responding after suspend and resume

Weitao Wang (1):
  usb: xhci: Fix slot_id resource race conflict

 drivers/usb/host/xhci-hub.c  |  3 +--
 drivers/usb/host/xhci-mem.c  | 22 +++++++++++-----------
 drivers/usb/host/xhci-ring.c |  9 +++++++--
 drivers/usb/host/xhci.c      | 23 ++++++++++++++++-------
 drivers/usb/host/xhci.h      |  3 ++-
 5 files changed, 37 insertions(+), 23 deletions(-)

-- 
2.43.0

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple xhci fixes for usb-linus.

Fix one DbC busyloop issue, and a VIA vendor specific issue.
The VIA issue is not marked for stable (yet) as it changes code
in the active path for all hosts.
A previous attempt at solving this caused regression, so letting
this get some real life exposure before adding it to stable.

Thanks
Mathias

Mathias Nyman (1):
  xhci: dbc: Avoid event polling busyloop if pending rx transfers are
    inactive.

Michal Pecio (1):
  usb: xhci: Don't trust the EP Context cycle bit when moving HW dequeue

 drivers/usb/host/xhci-dbgcap.c | 19 ++++++++++++++++---
 drivers/usb/host/xhci-dbgcap.h |  3 +++
 drivers/usb/host/xhci-ring.c   | 19 +++++++++----------
 3 files changed, 28 insertions(+), 13 deletions(-)

-- 
2.43.0

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple fixes for usb-linus 6.13-rc, resolves a ring expansion regression that
snuck into 6.13-rc1, and turns a NEC specific workaround generic as it seen on
other vendors xHC as well.

Thanks
Mathias

Mathias Nyman (1):
  xhci: Turn NEC specific quirk for handling Stop Endpoint errors
    generic

Niklas Neronin (1):
  usb: xhci: fix ring expansion regression in 6.13-rc1

 drivers/usb/host/xhci-mem.c  | 2 +-
 drivers/usb/host/xhci-ring.c | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple small fixes for 6.11-rc

- Don't try to free interrupters that failed to allocate.

- Add missing "return 0" lost in refactoring of tranfer event handler,
  this causes extra unneeded check for halted endpoint handling.

Thanks
Mathias

Marc Zyngier (1):
  usb: xhci: Check for xhci->interrupters being allocated in
    xhci_mem_clearup()

Niklas Neronin (1):
  usb: xhci: fix duplicate stall handling in handle_tx_event()

 drivers/usb/host/xhci-mem.c  | 2 +-
 drivers/usb/host/xhci-ring.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple xhci fixes for 6.9 rc
The null pointer dereferece fix solves a regression in 6.9-rc1,
so no need to add it to stable

Thanks
-Mathias

Mathias Nyman (1):
  xhci: Fix root hub port null pointer dereference in xhci tracepoints

Oliver Neukum (1):
  usb: xhci: correct return value in case of STS_HCE

 drivers/usb/host/xhci-ring.c  |  9 ++++-----
 drivers/usb/host/xhci-trace.h | 12 +++++-------
 2 files changed, 9 insertions(+), 12 deletions(-)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple xhci fixes for 6.4
Fixing a S3 resume issue on AMD hosts, and a flaw in calculating free TRBs
in ring buffer which may cause xhci to hog extra memory.

Thanks
Mathias

Mario Limonciello (1):
  xhci-pci: Only run d3cold avoidance quirk for s2idle

Mathias Nyman (1):
  xhci: Fix incorrect tracking of free space on transfer rings

 drivers/usb/host/xhci-pci.c  | 12 ++++++++++--
 drivers/usb/host/xhci-ring.c | 29 ++++++++++++++++++++++++++++-
 drivers/usb/host/xhci.h      |  2 +-
 3 files changed, 39 insertions(+), 4 deletions(-)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple small xhci fixes for usb-linus

Add Host controller error (HCE) to the list of reasons to reset the host
during resume.
Also make sure we don't change the error value returned if URB submission
fails.

Thanks
-Mathias


Hongyu Xie (1):
  xhci: Prevent futile URB re-submissions due to incorrect return value.

Puma Hsu (1):
  xhci: re-initialize the HC during resume if HCE was set

 drivers/usb/host/xhci.c | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple xhci patches for usb-linus that solves two suspend/resume related issues.

Thanks
-Mathias

Kai-Heng Feng (1):
  xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime
    suspending

Mathias Nyman (1):
  xhci: avoid race between disable slot command and host runtime suspend

 drivers/usb/host/xhci-hub.c  |  1 +
 drivers/usb/host/xhci-ring.c |  1 -
 drivers/usb/host/xhci.c      | 26 +++++++++++++++-----------
 3 files changed, 16 insertions(+), 12 deletions(-)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

two patches for usb-linus and 5.12 stable
xhci changes in 5.12 caused a regression in stall handling.
Due to this some usb card readers failed to work with 5.12

These two patches fix that regression.

Thanks
-Mathias

Mathias Nyman (2):
  xhci: fix giving back URB with incorrect status regression in 5.12
  xhci: Fix 5.12 regression of missing xHC cache clearing command after
    a Stall

 drivers/usb/host/xhci-ring.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple fixes for usb-linus.
Fixes one "xHCI died" case found when stress testing URB cancel on
several devices at once, and one timing issue on Tegra xhci

JC Kuo (1):
  xhci: tegra: Delay for disabling LFPS detector

Mathias Nyman (1):
  xhci: make sure TRB is fully written before giving it to the
    controller

 drivers/usb/host/xhci-ring.c  | 2 ++
 drivers/usb/host/xhci-tegra.c | 7 +++++++
 2 files changed, 9 insertions(+)

-- 
2.25.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

Two small xhci fixes for usb-linus, both fix NULL pointer dereference issues.
Would be nice if they could still make 5.7 

Thanks
Mathias

Li Jun (1):
  usb: host: xhci-plat: keep runtime active when removing host

Sriharsha Allenki (1):
  usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb
    sg list

 drivers/usb/host/xhci-plat.c | 4 +++-
 drivers/usb/host/xhci-ring.c | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

-- 
2.17.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple minor xhci fixes for usb-linus, fixing xhci trace events and
adding a quirk flag for a AMD xhci host.

-Mathias

Alberto Mattea (1):
  usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c

Steven Rostedt (VMware) (1):
  xhci: Do not open code __print_symbolic() in xhci trace events

 drivers/usb/host/xhci-pci.c   |  3 ++-
 drivers/usb/host/xhci-trace.h | 23 ++++++-----------------
 2 files changed, 8 insertions(+), 18 deletions(-)

-- 
2.17.1

[PATCH 0/2] xhci fixes for usb-linus

[Mathias Nyman]

Hi Greg

A couple of fixes for usb-linus, one to detect usb 3.2 xhci hosts,
another to resolve a rare host hang at resume issue.

-Mathias

Mathias Nyman (2):
  usb: xhci: Don't try to recover an endpoint if port is in error state.
  xhci: detect USB 3.2 capable host controllers correctly

 drivers/usb/host/xhci-ring.c | 15 ++++++++++++++-
 drivers/usb/host/xhci.c      | 25 ++++++++++++++++++++-----
 drivers/usb/host/xhci.h      |  9 +++++++++
 3 files changed, 43 insertions(+), 6 deletions(-)

-- 
2.7.4