1. 21 6月, 2016 2 次提交
  2. 02 6月, 2016 1 次提交
    • T
      usb: musb: Return error value from musb_mailbox · 12b7db2b
      Tony Lindgren 提交于
      At least on n900 we have phy-twl4030-usb only generating cable
      interrupts, and then have a separate USB PHY.
      
      In order for musb to know the real cable status, we need to
      clear any cached state until musb is ready. Otherwise the cable
      status interrupts will get just ignored if the status does
      not change from the initial state.
      
      To do this, let's add a return value to musb_mailbox(), and
      reset cached linkstat to MUSB_UNKNOWN on error. Sorry to cause
      a bit of churn here, I should have added that already last time
      patching musb_mailbox().
      Signed-off-by: NTony Lindgren <tony@atomide.com>
      Signed-off-by: NBin Liu <b-liu@ti.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      12b7db2b
  3. 31 5月, 2016 1 次提交
  4. 29 4月, 2016 1 次提交
    • C
      usb: core: hub: hub_port_init lock controller instead of bus · feb26ac3
      Chris Bainbridge 提交于
      The XHCI controller presents two USB buses to the system - one for USB2
      and one for USB3. The hub init code (hub_port_init) is reentrant but
      only locks one bus per thread, leading to a race condition failure when
      two threads attempt to simultaneously initialise a USB2 and USB3 device:
      
      [    8.034843] xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
      [   13.183701] usb 3-3: device descriptor read/all, error -110
      
      On a test system this failure occurred on 6% of all boots.
      
      The call traces at the point of failure are:
      
      Call Trace:
       [<ffffffff81b9bab7>] schedule+0x37/0x90
       [<ffffffff817da7cd>] usb_kill_urb+0x8d/0xd0
       [<ffffffff8111e5e0>] ? wake_up_atomic_t+0x30/0x30
       [<ffffffff817dafbe>] usb_start_wait_urb+0xbe/0x150
       [<ffffffff817db10c>] usb_control_msg+0xbc/0xf0
       [<ffffffff817d07de>] hub_port_init+0x51e/0xb70
       [<ffffffff817d4697>] hub_event+0x817/0x1570
       [<ffffffff810f3e6f>] process_one_work+0x1ff/0x620
       [<ffffffff810f3dcf>] ? process_one_work+0x15f/0x620
       [<ffffffff810f4684>] worker_thread+0x64/0x4b0
       [<ffffffff810f4620>] ? rescuer_thread+0x390/0x390
       [<ffffffff810fa7f5>] kthread+0x105/0x120
       [<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
       [<ffffffff81ba183f>] ret_from_fork+0x3f/0x70
       [<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
      
      Call Trace:
       [<ffffffff817fd36d>] xhci_setup_device+0x53d/0xa40
       [<ffffffff817fd87e>] xhci_address_device+0xe/0x10
       [<ffffffff817d047f>] hub_port_init+0x1bf/0xb70
       [<ffffffff811247ed>] ? trace_hardirqs_on+0xd/0x10
       [<ffffffff817d4697>] hub_event+0x817/0x1570
       [<ffffffff810f3e6f>] process_one_work+0x1ff/0x620
       [<ffffffff810f3dcf>] ? process_one_work+0x15f/0x620
       [<ffffffff810f4684>] worker_thread+0x64/0x4b0
       [<ffffffff810f4620>] ? rescuer_thread+0x390/0x390
       [<ffffffff810fa7f5>] kthread+0x105/0x120
       [<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
       [<ffffffff81ba183f>] ret_from_fork+0x3f/0x70
       [<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
      
      Which results from the two call chains:
      
      hub_port_init
       usb_get_device_descriptor
        usb_get_descriptor
         usb_control_msg
          usb_internal_control_msg
           usb_start_wait_urb
            usb_submit_urb / wait_for_completion_timeout / usb_kill_urb
      
      hub_port_init
       hub_set_address
        xhci_address_device
         xhci_setup_device
      
      Mathias Nyman explains the current behaviour violates the XHCI spec:
      
       hub_port_reset() will end up moving the corresponding xhci device slot
       to default state.
      
       As hub_port_reset() is called several times in hub_port_init() it
       sounds reasonable that we could end up with two threads having their
       xhci device slots in default state at the same time, which according to
       xhci 4.5.3 specs still is a big no no:
      
       "Note: Software shall not transition more than one Device Slot to the
        Default State at a time"
      
       So both threads fail at their next task after this.
       One fails to read the descriptor, and the other fails addressing the
       device.
      
      Fix this in hub_port_init by locking the USB controller (instead of an
      individual bus) to prevent simultaneous initialisation of both buses.
      
      Fixes: 638139eb ("usb: hub: allow to process more usb hub events in parallel")
      Link: https://lkml.org/lkml/2016/2/8/312
      Link: https://lkml.org/lkml/2016/2/4/748Signed-off-by: NChris Bainbridge <chris.bainbridge@gmail.com>
      Cc: stable <stable@vger.kernel.org>
      Acked-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      feb26ac3
  5. 19 4月, 2016 1 次提交
  6. 06 4月, 2016 2 次提交
  7. 06 3月, 2016 1 次提交
  8. 04 3月, 2016 10 次提交
  9. 07 2月, 2016 1 次提交
  10. 04 2月, 2016 2 次提交
  11. 25 1月, 2016 1 次提交
  12. 24 12月, 2015 1 次提交
    • B
      net: cdc_ncm: avoid changing RX/TX buffers on MTU changes · 1dfddff5
      Bjørn Mork 提交于
      NCM buffer sizes are negotiated with the device independently of
      the network device MTU.  The RX buffers are allocated by the
      usbnet framework based on the rx_urb_size value set by cdc_ncm. A
      single RX buffer can hold a number of MTU sized packets.
      
      The default usbnet change_mtu ndo only modifies rx_urb_size if it
      is equal to hard_mtu.  And the cdc_ncm driver will set rx_urb_size
      and hard_mtu independently of each other, based on dwNtbInMaxSize
      and dwNtbOutMaxSize respectively. It was therefore assumed that
      usbnet_change_mtu() would never touch rx_urb_size.  This failed to
      consider the case where dwNtbInMaxSize and dwNtbOutMaxSize happens
      to be equal.
      
      Fix by implementing an NCM specific change_mtu ndo, modifying the
      netdev MTU without touching the buffer size settings.
      Signed-off-by: NBjørn Mork <bjorn@mork.no>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1dfddff5
  13. 23 12月, 2015 1 次提交
    • D
      usb: gadget: forbid queuing request to a disabled ep · 8a0859b6
      Du, Changbin 提交于
      Queue a request to disabled ep  doesn't make sense, and induce caller
      make mistakes.
      
      Here is a example for the android mtp gadget function driver. A mem
      corruption can happen on below senario.
      1) On disconnect, mtp driver disable its EPs,
      2) During send_file_work and receive_file_work, mtp queues a request
         to ep. (The mtp driver need improve its synchronization logic!)
      3) mtp_function_unbind is invoked and all mtp requests are freed.
      4) when udc process the request queued on step 2, will cause kernel
         NULL pointer dereference exception.
      Signed-off-by: NDu, Changbin <changbin.du@intel.com>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      8a0859b6
  14. 17 12月, 2015 5 次提交
  15. 15 12月, 2015 2 次提交
  16. 12 12月, 2015 1 次提交
  17. 02 12月, 2015 1 次提交
  18. 22 10月, 2015 2 次提交
  19. 14 10月, 2015 1 次提交
  20. 04 10月, 2015 2 次提交
  21. 01 10月, 2015 1 次提交