linux.git/drivers/usb/host, branch v3.11-rc4 Linux kernel source tree xhci: fix null pointer dereference on ring_doorbell_for_active_rings 2013-07-25T15:10:09+00:00 Oleksij Rempel linux@rempel-privat.de 2013-07-21T13:36:19+00:00 d66eaf9f89502971fddcb0de550b01fa6f409d83 in some cases where device is attched to xhci port and do not responding, for example ath9k_htc with stalled firmware, kernel will crash on ring_doorbell_for_active_rings. This patch check if pointer exist before it is used. This patch should be backported to kernels as old as 2.6.35, that contain the commit e9df17eb1408cfafa3d1844bfc7f22c7237b31b8 "USB: xhci: Correct assumptions about number of rings per endpoint" Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable@vger.kernel.org 
in some cases where device is attched to xhci port and do not responding,
for example ath9k_htc with stalled firmware, kernel will
crash on ring_doorbell_for_active_rings.
This patch check if pointer exist before it is used.

This patch should be backported to kernels as old as 2.6.35, that
contain the commit e9df17eb1408cfafa3d1844bfc7f22c7237b31b8 "USB: xhci:
Correct assumptions about number of rings per endpoint"

Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
usb: host: xhci: Enable XHCI_SPURIOUS_SUCCESS for all controllers with xhci 1.0 2013-07-25T15:10:02+00:00 George Cherian george.cherian@ti.com 2013-07-01T05:29:12+00:00 07f3cb7c28bf3f4dd80bfb136cf45810c46ac474 Xhci controllers with hci_version > 0.96 gives spurious success events on short packet completion. During webcam capture the "ERROR Transfer event TRB DMA ptr not part of current TD" was observed. The same application works fine with synopsis controllers hci_version 0.96. The same issue is seen with Intel Pantherpoint xhci controller. So enabling this quirk in xhci_gen_setup if controller verion is greater than 0.96. For xhci-pci move the quirk to much generic place xhci_gen_setup. Note from Sarah: The xHCI 1.0 spec changed how hardware handles short packets. The HW will notify SW of the TRB where the short packet occurred, and it will also give a successful status for the last TRB in a TD (the one with the IOC flag set). On the second successful status, that warning will be triggered in the driver. Software is now supposed to not assume the TD is not completed until it gets that last successful status. That means we have a slight race condition, although it should have little practical impact. This patch papers over that issue. It's on my long-term to-do list to fix this race condition, but it is a much more involved patch that will probably be too big for stable. This patch is needed for stable to avoid serious log spam. This patch should be backported to kernels as old as 3.0, that contain the commit ad808333d8201d53075a11bc8dd83b81f3d68f0b "Intel xhci: Ignore spurious successful event." The patch will have to be modified for kernels older than 3.2, since that kernel added the xhci_gen_setup function for xhci platform devices. The correct conflict resolution for kernels older than 3.2 is to set XHCI_SPURIOUS_SUCCESS in xhci_pci_quirks for all xHCI 1.0 hosts. Signed-off-by: George Cherian <george.cherian@ti.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable@vger.kernel.org 
Xhci controllers with hci_version > 0.96 gives spurious success
events on short packet completion. During webcam capture the
"ERROR Transfer event TRB DMA ptr not part of current TD" was observed.
The same application works fine with synopsis controllers hci_version 0.96.
The same issue is seen with Intel Pantherpoint xhci controller. So enabling
this quirk in xhci_gen_setup if controller verion is greater than 0.96.
For xhci-pci move the quirk to much generic place xhci_gen_setup.

Note from Sarah:

The xHCI 1.0 spec changed how hardware handles short packets.  The HW
will notify SW of the TRB where the short packet occurred, and it will
also give a successful status for the last TRB in a TD (the one with the
IOC flag set).  On the second successful status, that warning will be
triggered in the driver.

Software is now supposed to not assume the TD is not completed until it
gets that last successful status.  That means we have a slight race
condition, although it should have little practical impact.  This patch
papers over that issue.

It's on my long-term to-do list to fix this race condition, but it is a
much more involved patch that will probably be too big for stable.  This
patch is needed for stable to avoid serious log spam.

This patch should be backported to kernels as old as 3.0, that
contain the commit ad808333d8201d53075a11bc8dd83b81f3d68f0b "Intel xhci:
Ignore spurious successful event."

The patch will have to be modified for kernels older than 3.2, since
that kernel added the xhci_gen_setup function for xhci platform devices.
The correct conflict resolution for kernels older than 3.2 is to set
XHCI_SPURIOUS_SUCCESS in xhci_pci_quirks for all xHCI 1.0 hosts.

Signed-off-by: George Cherian <george.cherian@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
usb: fix build warning in pci-quirks.h when CONFIG_PCI is not enabled 2013-07-25T15:09:55+00:00 Randy Dunlap rdunlap@infradead.org 2013-07-23T22:22:59+00:00 c4d949b76f2c714e0da20c53252e586e8127ac79 Fix warning when CONFIG_PCI is not enabled (from commit 296365781903226a3fb8758901eaeec09d2798e4). drivers/usb/host/pci-quirks.h: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Moiz Sonasath <m-sonasath@ti.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> 
Fix warning when CONFIG_PCI is not enabled
(from commit 296365781903226a3fb8758901eaeec09d2798e4).

drivers/usb/host/pci-quirks.h: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default]

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Moiz Sonasath <m-sonasath@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
usb: xhci: Mark two functions __maybe_unused 2013-07-25T15:09:48+00:00 Olof Johansson olof@lixom.net 2013-07-23T18:58:20+00:00 d5c82feb5cf8026cd4af048330fdcd46e861c686 Resolves the following build warnings: drivers/usb/host/xhci.c:332:13: warning: 'xhci_msix_sync_irqs' defined but not used [-Wunused-function] drivers/usb/host/xhci.c:3901:12: warning: 'xhci_change_max_exit_latency' defined but not used [-Wunused-function] These functions are not always used, and since they're marked static they will produce build warnings: - xhci_msix_sync_irqs is only used with CONFIG_PCI. - xhci_change_max_exit_latency is a little more complicated with dependencies on CONFIG_PM and CONFIG_PM_RUNTIME. Instead of building a bigger maze of ifdefs in this code, I've just marked both with __maybe_unused. Signed-off-by: Olof Johansson <olof@lixom.net> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> 
Resolves the following build warnings:
drivers/usb/host/xhci.c:332:13: warning: 'xhci_msix_sync_irqs' defined but not used [-Wunused-function]
drivers/usb/host/xhci.c:3901:12: warning: 'xhci_change_max_exit_latency' defined but not used [-Wunused-function]

These functions are not always used, and since they're marked static
they will produce build warnings:
- xhci_msix_sync_irqs is only used with CONFIG_PCI.
- xhci_change_max_exit_latency is a little more complicated with
  dependencies on CONFIG_PM and CONFIG_PM_RUNTIME.

Instead of building a bigger maze of ifdefs in this code, I've just
marked both with __maybe_unused.

Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
xhci: Avoid NULL pointer deref when host dies. 2013-07-25T15:09:23+00:00 Sarah Sharp sarah.a.sharp@linux.intel.com 2013-07-24T17:27:13+00:00 203a86613fb3bf2767335659513fa98563a3eb71 When the host controller fails to respond to an Enable Slot command, and the host fails to respond to the register write to abort the command ring, the xHCI driver will assume the host is dead, and call usb_hc_died(). The USB device's slot_id is still set to zero, and the pointer stored at xhci->devs[0] will always be NULL. The call to xhci_check_args in xhci_free_dev should have caught the NULL virt_dev pointer. However, xhci_free_dev is designed to free the xhci_virt_device structures, even if the host is dead, so that we don't leak kernel memory. xhci_free_dev checks the return value from the generic xhci_check_args function. If the return value is -ENODEV, it carries on trying to free the virtual device. The issue is that xhci_check_args looks at the host controller state before it looks at the xhci_virt_device pointer. It will return -ENIVAL because the host is dead, and xhci_free_dev will ignore the return value, and happily dereference the NULL xhci_virt_device pointer. The fix is to make sure that xhci_check_args checks the xhci_virt_device pointer before it checks the host state. See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1203453 for further details. This patch doesn't solve the underlying issue, but will ensure we don't see any more NULL pointer dereferences because of the issue. This patch should be backported to kernels as old as 3.1, that contain the commit 7bd89b4017f46a9b92853940fd9771319acb578a "xhci: Don't submit commands or URBs to halted hosts." Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Reported-by: Vincent Thiele <vincentthiele@gmail.com> Cc: stable@vger.kernel.org 
When the host controller fails to respond to an Enable Slot command, and
the host fails to respond to the register write to abort the command
ring, the xHCI driver will assume the host is dead, and call
usb_hc_died().

The USB device's slot_id is still set to zero, and the pointer stored at
xhci->devs[0] will always be NULL.  The call to xhci_check_args in
xhci_free_dev should have caught the NULL virt_dev pointer.

However, xhci_free_dev is designed to free the xhci_virt_device
structures, even if the host is dead, so that we don't leak kernel
memory.  xhci_free_dev checks the return value from the generic
xhci_check_args function.  If the return value is -ENODEV, it carries on
trying to free the virtual device.

The issue is that xhci_check_args looks at the host controller state
before it looks at the xhci_virt_device pointer.  It will return -ENIVAL
because the host is dead, and xhci_free_dev will ignore the return
value, and happily dereference the NULL xhci_virt_device pointer.

The fix is to make sure that xhci_check_args checks the xhci_virt_device
pointer before it checks the host state.

See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1203453 for
further details.  This patch doesn't solve the underlying issue, but
will ensure we don't see any more NULL pointer dereferences because of
the issue.

This patch should be backported to kernels as old as 3.1, that
contain the commit 7bd89b4017f46a9b92853940fd9771319acb578a "xhci: Don't
submit commands or URBs to halted hosts."

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Vincent Thiele <vincentthiele@gmail.com>
Cc: stable@vger.kernel.org
USB: EHCI: Fix resume signalling on remote wakeup 2013-07-22T18:35:34+00:00 Roger Quadros rogerq@ti.com 2013-07-09T14:03:50+00:00 47a64a13d54f6c669b00542848d5550be3d3310e Set the ehci->resuming flag for the port we receive a remote wakeup on so that resume signalling can be completed. Without this, the root hub timer will not fire again to check if the resume was completed and there will be a never-ending wait on on the port. This effect is only observed if the HUB IRQ IN does not come after we have initiated the port resume. Signed-off-by: Roger Quadros <rogerq@ti.com> Cc: stable <stable@vger.kernel.org> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Set the ehci->resuming flag for the port we receive a remote
wakeup on so that resume signalling can be completed.

Without this, the root hub timer will not fire again to check
if the resume was completed and there will be a never-ending wait on
on the port.

This effect is only observed if the HUB IRQ IN does not come after we
have initiated the port resume.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2013-07-13T21:52:21+00:00 Linus Torvalds torvalds@linux-foundation.org 2013-07-13T21:52:21+00:00 d1447464789918db1e1a3d0aaf50d3d0f6487a4f Pull MIPS updates from Ralf Baechle: "MIPS updates: - All the things that didn't make 3.10. - Removes the Windriver PPMC platform. Nobody will miss it. - Remove a workaround from kernel/irq/irqdomain.c which was there exclusivly for MIPS. Patch by Grant Likely. - More small improvments for the SEAD 3 platform - Improvments on the BMIPS / SMP support for the BCM63xx series. - Various cleanups of dead leftovers. - Platform support for the Cavium Octeon-based EdgeRouter Lite. Two large KVM patchsets didn't make it for this pull request because their respective authors are vacationing" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (124 commits) MIPS: Kconfig: Add missing MODULES dependency to VPE_LOADER MIPS: BCM63xx: CLK: Add dummy clk_{set,round}_rate() functions MIPS: SEAD3: Disable L2 cache on SEAD-3. MIPS: BCM63xx: Enable second core SMP on BCM6328 if available MIPS: BCM63xx: Add SMP support to prom.c MIPS: define write{b,w,l,q}_relaxed MIPS: Expose missing pci_io{map,unmap} declarations MIPS: Malta: Update GCMP detection. Revert "MIPS: make CAC_ADDR and UNCAC_ADDR account for PHYS_OFFSET" MIPS: APSP: Remove <asm/kspd.h> SSB: Kconfig: Amend SSB_EMBEDDED dependencies MIPS: microMIPS: Fix improper definition of ISA exception bit. MIPS: Don't try to decode microMIPS branch instructions where they cannot exist. MIPS: Declare emulate_load_store_microMIPS as a static function. MIPS: Fix typos and cleanup comment MIPS: Cleanup indentation and whitespace MIPS: BMIPS: support booting from physical CPU other than 0 MIPS: Only set cpu_has_mmips if SYS_SUPPORTS_MICROMIPS MIPS: GIC: Fix gic_set_affinity infinite loop MIPS: Don't save/restore OCTEON wide multiplier state on syscalls. ... 
Pull MIPS updates from Ralf Baechle:
 "MIPS updates:

   - All the things that didn't make 3.10.
   - Removes the Windriver PPMC platform.  Nobody will miss it.
   - Remove a workaround from kernel/irq/irqdomain.c which was there
     exclusivly for MIPS.  Patch by Grant Likely.
   - More small improvments for the SEAD 3 platform
   - Improvments on the BMIPS / SMP support for the BCM63xx series.
   - Various cleanups of dead leftovers.
   - Platform support for the Cavium Octeon-based EdgeRouter Lite.

  Two large KVM patchsets didn't make it for this pull request because
  their respective authors are vacationing"

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (124 commits)
  MIPS: Kconfig: Add missing MODULES dependency to VPE_LOADER
  MIPS: BCM63xx: CLK: Add dummy clk_{set,round}_rate() functions
  MIPS: SEAD3: Disable L2 cache on SEAD-3.
  MIPS: BCM63xx: Enable second core SMP on BCM6328 if available
  MIPS: BCM63xx: Add SMP support to prom.c
  MIPS: define write{b,w,l,q}_relaxed
  MIPS: Expose missing pci_io{map,unmap} declarations
  MIPS: Malta: Update GCMP detection.
  Revert "MIPS: make CAC_ADDR and UNCAC_ADDR account for PHYS_OFFSET"
  MIPS: APSP: Remove <asm/kspd.h>
  SSB: Kconfig: Amend SSB_EMBEDDED dependencies
  MIPS: microMIPS: Fix improper definition of ISA exception bit.
  MIPS: Don't try to decode microMIPS branch instructions where they cannot exist.
  MIPS: Declare emulate_load_store_microMIPS as a static function.
  MIPS: Fix typos and cleanup comment
  MIPS: Cleanup indentation and whitespace
  MIPS: BMIPS: support booting from physical CPU other than 0
  MIPS: Only set cpu_has_mmips if SYS_SUPPORTS_MICROMIPS
  MIPS: GIC: Fix gic_set_affinity infinite loop
  MIPS: Don't save/restore OCTEON wide multiplier state on syscalls.
  ...
Merge tag 'soc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc 2013-07-02T20:43:38+00:00 Linus Torvalds torvalds@linux-foundation.org 2013-07-02T20:43:38+00:00 3883cbb6c1bda013a3ce2dbdab7dc97c52e4a232 Pull ARM SoC specific changes from Arnd Bergmann: "These changes are all to SoC-specific code, a total of 33 branches on 17 platforms were pulled into this. Like last time, Renesas sh-mobile is now the platform with the most changes, followed by OMAP and EXYNOS. Two new platforms, TI Keystone and Rockchips RK3xxx are added in this branch, both containing almost no platform specific code at all, since they are using generic subsystem interfaces for clocks, pinctrl, interrupts etc. The device drivers are getting merged through the respective subsystem maintainer trees. One more SoC (u300) is now multiplatform capable and several others (shmobile, exynos, msm, integrator, kirkwood, clps711x) are moving towards that goal with this series but need more work. Also noteworthy is the work on PCI here, which is traditionally part of the SoC specific code. With the changes done by Thomas Petazzoni, we can now more easily have PCI host controller drivers as loadable modules and keep them separate from the platform code in drivers/pci/host. This has already led to the discovery that three platforms (exynos, spear and imx) are actually using an identical PCIe host controller and will be able to share a driver once support for spear and imx is added." * tag 'soc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (480 commits) ARM: integrator: let pciv3 use mem/premem from device tree ARM: integrator: set local side PCI addresses right ARM: dts: Add pcie controller node for exynos5440-ssdk5440 ARM: dts: Add pcie controller node for Samsung EXYNOS5440 SoC ARM: EXYNOS: Enable PCIe support for Exynos5440 pci: Add PCIe driver for Samsung Exynos ARM: OMAP5: voltagedomain data: remove temporary OMAP4 voltage data ARM: keystone: Move CPU bringup code to dedicated asm file ARM: multiplatform: always pick one CPU type ARM: imx: select syscon for IMX6SL ARM: keystone: select ARM_ERRATA_798181 only for SMP ARM: imx: Synertronixx scb9328 needs to select SOC_IMX1 ARM: OMAP2+: AM43x: resolve SMP related build error dmaengine: edma: enable build for AM33XX ARM: edma: Add EDMA crossbar event mux support ARM: edma: Add DT and runtime PM support to the private EDMA API dmaengine: edma: Add TI EDMA device tree binding arm: add basic support for Rockchip RK3066a boards arm: add debug uarts for rockchip rk29xx and rk3xxx series arm: Add basic clocks for Rockchip rk3066a SoCs ... 
Pull ARM SoC specific changes from Arnd Bergmann:
 "These changes are all to SoC-specific code, a total of 33 branches on
  17 platforms were pulled into this.  Like last time, Renesas sh-mobile
  is now the platform with the most changes, followed by OMAP and
  EXYNOS.

  Two new platforms, TI Keystone and Rockchips RK3xxx are added in this
  branch, both containing almost no platform specific code at all, since
  they are using generic subsystem interfaces for clocks, pinctrl,
  interrupts etc.  The device drivers are getting merged through the
  respective subsystem maintainer trees.

  One more SoC (u300) is now multiplatform capable and several others
  (shmobile, exynos, msm, integrator, kirkwood, clps711x) are moving
  towards that goal with this series but need more work.

  Also noteworthy is the work on PCI here, which is traditionally part
  of the SoC specific code.  With the changes done by Thomas Petazzoni,
  we can now more easily have PCI host controller drivers as loadable
  modules and keep them separate from the platform code in
  drivers/pci/host.  This has already led to the discovery that three
  platforms (exynos, spear and imx) are actually using an identical PCIe
  host controller and will be able to share a driver once support for
  spear and imx is added."

* tag 'soc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (480 commits)
  ARM: integrator: let pciv3 use mem/premem from device tree
  ARM: integrator: set local side PCI addresses right
  ARM: dts: Add pcie controller node for exynos5440-ssdk5440
  ARM: dts: Add pcie controller node for Samsung EXYNOS5440 SoC
  ARM: EXYNOS: Enable PCIe support for Exynos5440
  pci: Add PCIe driver for Samsung Exynos
  ARM: OMAP5: voltagedomain data: remove temporary OMAP4 voltage data
  ARM: keystone: Move CPU bringup code to dedicated asm file
  ARM: multiplatform: always pick one CPU type
  ARM: imx: select syscon for IMX6SL
  ARM: keystone: select ARM_ERRATA_798181 only for SMP
  ARM: imx: Synertronixx scb9328 needs to select SOC_IMX1
  ARM: OMAP2+: AM43x: resolve SMP related build error
  dmaengine: edma: enable build for AM33XX
  ARM: edma: Add EDMA crossbar event mux support
  ARM: edma: Add DT and runtime PM support to the private EDMA API
  dmaengine: edma: Add TI EDMA device tree binding
  arm: add basic support for Rockchip RK3066a boards
  arm: add debug uarts for rockchip rk29xx and rk3xxx series
  arm: Add basic clocks for Rockchip rk3066a SoCs
  ...
xhci: Add missing unlocks on error paths 2013-06-25T23:41:06+00:00 Emil Goode emilgoode@gmail.com 2013-06-25T22:49:36+00:00 1f21569c0ffc83034c1ea023d16c6114a429c131 This patch adds missing unlocks on error paths in the xhci_free_streams and xhci_configure_endpoint functions. Signed-off-by: Emil Goode <emilgoode@gmail.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This patch adds missing unlocks on error paths in the
xhci_free_streams and xhci_configure_endpoint functions.

Signed-off-by: Emil Goode <emilgoode@gmail.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ehci-atmel.c: prepare clk before calling enable 2013-06-24T23:21:52+00:00 Boris BREZILLON b.brezillon@overkiz.com 2013-06-19T11:20:09+00:00 cfafb62fb4d21648eb706f3028811b611c60d15e Replace clk_enable/disable with clk_prepare_enable/disable_unprepare to avoid common clk framework warnings. Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Replace clk_enable/disable with clk_prepare_enable/disable_unprepare to
avoid common clk framework warnings.

Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>