linux-stable.git/drivers/net/can, branch v3.19

can: kvaser_usb: Fix state handling upon BUS_ERROR events

2015-01-27T07:55:09+00:00

While being in an ERROR_WARNING state, and receiving further
bus error events with error counters still in the ERROR_WARNING
range of 97-127 inclusive, the state handling code erroneously
reverts back to ERROR_ACTIVE.

Per the CAN standard, only revert to ERROR_ACTIVE when the
error counters are less than 96.

Moreover, in certain Kvaser models, the BUS_ERROR flag is
always set along with undefined bits in the M16C status
register. Thus use bitwise operators instead of full equality
for checking that register against bus errors.

Signed-off-by: Ahmed S. Darwish 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT

2015-01-27T07:55:09+00:00

On some x86 laptops, plugging a Kvaser device again after an
unplug makes the firmware always ignore the very first command.
For such a case, provide some room for retries instead of
completely exiting the driver init code.

Signed-off-by: Ahmed S. Darwish 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: kvaser_usb: Send correct context to URB completion

2015-01-27T07:55:08+00:00

Send expected argument to the URB completion hander: a CAN
netdevice instead of the network interface private context
`kvaser_usb_net_priv'.

This was discovered by having some garbage in the kernel
log in place of the netdevice names: can0 and can1.

Signed-off-by: Ahmed S. Darwish 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: kvaser_usb: Do not sleep in atomic context

2015-01-27T07:55:08+00:00

Upon receiving a hardware event with the BUS_RESET flag set,
the driver kills all of its anchored URBs and resets all of
its transmit URB contexts.

Unfortunately it does so under the context of URB completion
handler `kvaser_usb_read_bulk_callback()', which is often
called in an atomic context.

While the device is flooded with many received error packets,
usb_kill_urb() typically sleeps/reschedules till the transfer
request of each killed URB in question completes, leading to
the sleep in atomic bug. [3]

In v2 submission of the original driver patch [1], it was
stated that the URBs kill and tx contexts reset was needed
since we don't receive any tx acknowledgments later and thus
such resources will be locked down forever. Fortunately this
is no longer needed since an earlier bugfix in this patch
series is now applied: all tx URB contexts are reset upon CAN
channel close. [2]

Moreover, a BUS_RESET is now treated _exactly_ like a BUS_OFF
event, which is the recommended handling method advised by
the device manufacturer.

[1] http://article.gmane.org/gmane.linux.network/239442
    http://www.webcitation.org/6Vr2yagAQ

[2] can: kvaser_usb: Reset all URB tx contexts upon channel close
    889b77f7fd2bcc922493d73a4c51d8a851505815

[3] Stacktrace:

   [] dump_stack+0x45/0x57
 [] __schedule_bug+0x41/0x4f
 [] __schedule+0x5f1/0x700
 [] ? _raw_spin_unlock_irqrestore+0xa/0x10
 [] schedule+0x24/0x70
 [] usb_kill_urb+0x65/0xa0
 [] ? prepare_to_wait_event+0x110/0x110
 [] usb_kill_anchored_urbs+0x48/0x80
 [] kvaser_usb_unlink_tx_urbs+0x18/0x50 [kvaser_usb]
 [] kvaser_usb_rx_error+0xc0/0x400 [kvaser_usb]
 [] ? vprintk_default+0x1a/0x20
 [] kvaser_usb_read_bulk_callback+0x4c1/0x5f0 [kvaser_usb]
 [] __usb_hcd_giveback_urb+0x5e/0xc0
 [] usb_hcd_giveback_urb+0x41/0x110
 [] finish_urb+0x98/0x180 [ohci_hcd]
 [] ? acct_account_cputime+0x17/0x20
 [] ? local_clock+0x15/0x30
 [] ohci_work+0x1fb/0x5a0 [ohci_hcd]
 [] ? process_backlog+0xb1/0x130
 [] ohci_irq+0xeb/0x270 [ohci_hcd]
 [] usb_hcd_irq+0x21/0x30
 [] handle_irq_event_percpu+0x43/0x120
 [] handle_irq_event+0x3d/0x60
 [] handle_fasteoi_irq+0x74/0x110
 [] handle_irq+0x1d/0x30
 [] do_IRQ+0x57/0x100
 [] common_interrupt+0x6a/0x6a

Signed-off-by: Ahmed S. Darwish 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: c_can: end pending transmission on network stop (ifdown)

2015-01-21T21:43:14+00:00

Put controller into init mode in network stop to end pending transmissions. The
issue is observed in cases when transmitted frame is not acked.

Signed-off-by: Viktor Babrian 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: kvaser_usb: Don't dereference skb after a netif_rx()

2015-01-15T15:58:02+00:00

We should not touch the packet after a netif_rx: it might
get freed behind our back.

Suggested-by: Marc Kleine-Budde 
Signed-off-by: Ahmed S. Darwish 
Signed-off-by: Marc Kleine-Budde

can: kvaser_usb: Don't send a RESET_CHIP for non-existing channels

2015-01-15T15:58:01+00:00

Recent Leaf firmware versions (>= 3.1.557) do not allow to send
commands for non-existing channels.  If a command is sent for a
non-existing channel, the firmware crashes.

Reported-by: Christopher Storah 
Signed-off-by: Olivier Sobrie 
Signed-off-by: Ahmed S. Darwish 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: kvaser_usb: Reset all URB tx contexts upon channel close

2015-01-15T15:58:01+00:00

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in very high frequency (*), closing the CAN channel while
all the transmissions are on (#), opening the device again (@),
then sending a small number of packets would make the driver
enter an almost infinite loop of:

[....]
[15959.853988] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853990] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853991] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853993] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853994] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853995] kvaser_usb 4-3:1.0 can0: cannot find free context
[....]

_dragging the whole system down_ in the process due to the
excessive logging output.

Initially, this has caused random panics in the kernel due to a
buggy error recovery path.  That got fixed in an earlier commit.(%)
This patch aims at solving the root cause. -->

16 tx URBs and contexts are allocated per CAN channel per USB
device. Such URBs are protected by:

a) A simple atomic counter, up to a value of MAX_TX_URBS (16)
b) A flag in each URB context, stating if it's free
c) The fact that ndo_start_xmit calls are themselves protected
   by the networking layers higher above

After grabbing one of the tx URBs, if the driver noticed that all
of them are now taken, it stops the netif transmission queue.
Such queue is worken up again only if an acknowedgment was received
from the firmware on one of our earlier-sent frames.

Meanwhile, upon channel close (#), the driver sends a CMD_STOP_CHIP
to the firmware, effectively closing all further communication.  In
the high traffic case, the atomic counter remains at MAX_TX_URBS,
and all the URB contexts remain marked as active.  While opening
the channel again (@), it cannot send any further frames since no
more free tx URB contexts are available.

Reset all tx URB contexts upon CAN channel close.

(*) 50 parallel instances of `cangen0 -g 0 -ix`
(#) `ifconfig can0 down`
(@) `ifconfig can0 up`
(%) "can: kvaser_usb: Don't free packets when tight on URBs"

Signed-off-by: Ahmed S. Darwish 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: kvaser_usb: Don't free packets when tight on URBs

2015-01-15T15:58:00+00:00

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in high frequency caused seemingly-random panics in the
kernel.

On further inspection, it seems the driver erroneously freed the
to-be-transmitted packet upon getting tight on URBs and returning
NETDEV_TX_BUSY, leading to invalid memory writes and double frees
at a later point in time.

Note:

Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
is a driver bug in and out of itself: it means that our start/stop
queue flow control is broken.

This patch only fixes the (buggy) error handling code; the root
cause shall be fixed in a later commit.

Acked-by: Olivier Sobrie 
Signed-off-by: Ahmed S. Darwish 
Cc: linux-stable 
Signed-off-by: Marc Kleine-Budde

can: c_can: use regmap_update_bits() to modify RAMINIT register

2015-01-15T15:58:00+00:00

use of regmap_read() and regmap_write() in c_can_hw_raminit_syscon()
is not safe as the RAMINIT register can be shared between different drivers
at least for TI SoCs.

To make the modification atomic we switch to using regmap_update_bits().

regmap_update_bits() skips writing to the register if it's read content is the
same as what is going to be written. This causes an issue for us when we
need to clear the DONE bit with the initial condition START:0, DONE:1 as
DONE bit must be written with 1 to clear it.

So we defer the clearing of DONE bit to later when we set the START bit.
There we are sure that START bit is changed from 0 to 1 so the write of
1 to already set DONE bit will happen.

Signed-off-by: Roger Quadros 
Signed-off-by: Marc Kleine-Budde