1. 08 4月, 2017 1 次提交
  2. 25 1月, 2017 9 次提交
  3. 04 1月, 2017 2 次提交
    • O
      xhci: Fix race related to abort operation · 1c111b6c
      OGAWA Hirofumi 提交于
      Current abort operation has race.
      
          xhci_handle_command_timeout()
            xhci_abort_cmd_ring()
              xhci_write_64(CMD_RING_ABORT)
              xhci_handshake(5s)
      	  do {
      	    check CMD_RING_RUNNING
                  udelay(1)
      					 ...
      					 COMP_CMD_ABORT event
      					 COMP_CMD_STOP event
      					 xhci_handle_stopped_cmd_ring()
      					   restart cmd_ring
                                                 CMD_RING_RUNNING become 1 again
      	  } while ()
                return -ETIMEDOUT
              xhci_write_64(CMD_RING_ABORT)
              /* can abort random command */
      
      To do abort operation correctly, we have to wait both of COMP_CMD_STOP
      event and negation of CMD_RING_RUNNING.
      
      But like above, while timeout handler is waiting negation of
      CMD_RING_RUNNING, event handler can restart cmd_ring. So timeout
      handler never be notice negation of CMD_RING_RUNNING, and retry of
      CMD_RING_ABORT can abort random command (BTW, I guess retry of
      CMD_RING_ABORT was workaround of this race).
      
      To fix this race, this moves xhci_handle_stopped_cmd_ring() to
      xhci_abort_cmd_ring().  And timeout handler waits COMP_CMD_STOP event.
      
      At this point, timeout handler is owner of cmd_ring, and safely
      restart cmd_ring by using xhci_handle_stopped_cmd_ring().
      
      [FWIW, as bonus, this way would be easily extend to add CMD_RING_PAUSE
      operation]
      
      [locks edited as patch is rebased on other locking fixes -Mathias]
      Signed-off-by: NOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1c111b6c
    • O
      xhci: Use delayed_work instead of timer for command timeout · cb4d5ce5
      OGAWA Hirofumi 提交于
      This is preparation to fix abort operation race (See "xhci: Fix race
      related to abort operation"). To make timeout sleepable, use
      delayed_work instead of timer.
      
      [change a newly added pending timer fix to pending work -Mathias]
      Signed-off-by: NOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cb4d5ce5
  4. 14 11月, 2016 5 次提交
  5. 03 11月, 2016 1 次提交
  6. 20 10月, 2016 1 次提交
    • M
      xhci: workaround for hosts missing CAS bit · 346e9973
      Mathias Nyman 提交于
      If a device is unplugged and replugged during Sx system suspend
      some  Intel xHC hosts will overwrite the CAS (Cold attach status) flag
      and no device connection is noticed in resume.
      
      A device in this state can be identified in resume if its link state
      is in polling or compliance mode, and the current connect status is 0.
      A device in this state needs to be warm reset.
      
      Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8
      
      Observed on Cherryview and Apollolake as they go into compliance mode
      if LFPS times out during polling, and re-plugged devices are not
      discovered at resume.
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      CC: <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      346e9973
  7. 27 6月, 2016 1 次提交
    • M
      xhci: TD-fragment, align the unsplittable case with a bounce buffer · f9c589e1
      Mathias Nyman 提交于
      If the last trb before a link is not packet size aligned, and is not
      splittable then use a bounce buffer for that chunk of max packet size
      unalignable data.
      
      Allocate a max packet size bounce buffer for every segment of a bulk
      endpoint ring at the same time as allocating the ring.
      If we need to align the data before the link trb in that segment then
      copy the data to the segment bounce buffer, dma map it, and enqueue it.
      Once the td finishes, or is cancelled, unmap it.
      
      For in transfers we need to first map the bounce buffer, then queue it,
      after it finishes, copy the bounce buffer to the original sg list, and
      finally unmap it
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f9c589e1
  8. 27 4月, 2016 2 次提交
  9. 14 4月, 2016 2 次提交
  10. 15 2月, 2016 3 次提交
  11. 04 2月, 2016 2 次提交
  12. 02 12月, 2015 2 次提交
  13. 17 10月, 2015 2 次提交
  14. 04 10月, 2015 4 次提交
  15. 09 8月, 2015 2 次提交
  16. 23 7月, 2015 1 次提交