1. 20 4月, 2017 1 次提交
  2. 08 4月, 2017 10 次提交
  3. 29 3月, 2017 1 次提交
    • M
      xhci: Manually give back cancelled URB if we can't queue it for cancel · d3519b9d
      Mathias Nyman 提交于
      xhci needs to take care of four scenarios when asked to cancel a URB.
      
      1 URB is not queued or already given back.
        usb_hcd_check_unlink_urb() will return an error, we pass the error on
      
      2 We fail to find xhci internal structures from urb private data such as
        virtual device and endpoint ring.
        Give back URB immediately, can't do anything about internal structures.
      
      3 URB private data has valid pointers to xhci internal data, but host is
        not  responding.
        give back URB immedately and remove the URB from the endpoint lists.
      
      4 Everyting is working
        add URB to cancel list, queue a command to stop the endpoint, after
        which the URB can be turned to no-op or skipped, removed from lists,
        and given back.
      
      We failed to give back the urb in case 2 where the correct device and
      endpoint pointers could not be retrieved from URB private data.
      
      This caused a hang on Dell Inspiron 5558/0VNM2T at resume from suspend
      as urb was never returned.
      
      [  245.270505] INFO: task rtsx_usb_ms_1:254 blocked for more than 120 seconds.
      [  245.272244]       Tainted: G        W       4.11.0-rc3-ARCH #2
      [  245.273983] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      [  245.275737] rtsx_usb_ms_1   D    0   254      2 0x00000000
      [  245.277524] Call Trace:
      [  245.279278]  __schedule+0x2d3/0x8a0
      [  245.281077]  schedule+0x3d/0x90
      [  245.281961]  usb_kill_urb.part.3+0x6c/0xa0 [usbcore]
      [  245.282861]  ? wake_atomic_t_function+0x60/0x60
      [  245.283760]  usb_kill_urb+0x21/0x30 [usbcore]
      [  245.284649]  usb_start_wait_urb+0xe5/0x170 [usbcore]
      [  245.285541]  ? try_to_del_timer_sync+0x53/0x80
      [  245.286434]  usb_bulk_msg+0xbd/0x160 [usbcore]
      [  245.287326]  rtsx_usb_send_cmd+0x63/0x90 [rtsx_usb]
      
      Reported-by: diego.viola@gmail.com
      Tested-by: diego.viola@gmail.com
      Cc: stable@vger.kernel.org
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d3519b9d
  4. 23 3月, 2017 1 次提交
  5. 17 3月, 2017 1 次提交
  6. 10 3月, 2017 1 次提交
  7. 25 1月, 2017 10 次提交
  8. 11 1月, 2017 1 次提交
    • M
      xhci: fix deadlock at host remove by running watchdog correctly · d6169d04
      Mathias Nyman 提交于
      If a URB is killed while the host is removed we can end up in a situation
      where the hub thread takes the roothub device lock, and waits for
      the URB to be given back by xhci-hcd, blocking the host remove code.
      
      xhci-hcd tries to stop the endpoint and give back the urb, but can't
      as the host is removed from PCI bus at the same time, preventing the normal
      way of giving back urb.
      
      Instead we need to rely on the stop command timeout function to give back
      the urb. This xhci_stop_endpoint_command_watchdog() timeout function
      used a XHCI_STATE_DYING flag to indicate if the timeout function is already
      running, but later this flag has been taking into use in other places to
      mark that xhci is dying.
      
      Remove checks for XHCI_STATE_DYING in xhci_urb_dequeue. We are still
      checking that reading from pci state does not return 0xffffffff or that
      host is not halted before trying to stop the endpoint.
      
      This whole area of stopping endpoints, giving back URBs, and the wathdog
      timeout need rework, this fix focuses on solving a specific deadlock
      issue that we can then send to stable before any major rework.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d6169d04
  9. 04 1月, 2017 1 次提交
  10. 14 11月, 2016 5 次提交
  11. 03 11月, 2016 1 次提交
  12. 31 8月, 2016 1 次提交
  13. 07 7月, 2016 1 次提交
    • T
      timers: Remove set_timer_slack() leftovers · 53bf837b
      Thomas Gleixner 提交于
      We now have implicit batching in the timer wheel. The slack API is no longer
      used, so remove it.
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Arjan van de Ven <arjan@infradead.org>
      Cc: Chris Mason <clm@fb.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: David Woodhouse <dwmw2@infradead.org>
      Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Frederic Weisbecker <fweisbec@gmail.com>
      Cc: George Spelvin <linux@sciencehorizons.net>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Jaehoon Chung <jh80.chung@samsung.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: John Stultz <john.stultz@linaro.org>
      Cc: Josh Triplett <josh@joshtriplett.org>
      Cc: Len Brown <lenb@kernel.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Mathias Nyman <mathias.nyman@intel.com>
      Cc: Pali Rohár <pali.rohar@gmail.com>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Sebastian Reichel <sre@kernel.org>
      Cc: Ulf Hansson <ulf.hansson@linaro.org>
      Cc: linux-block@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Cc: linux-mmc@vger.kernel.org
      Cc: linux-pm@vger.kernel.org
      Cc: linux-usb@vger.kernel.org
      Cc: netdev@vger.kernel.org
      Cc: rt@linutronix.de
      Link: http://lkml.kernel.org/r/20160704094342.189813118@linutronix.deSigned-off-by: NIngo Molnar <mingo@kernel.org>
      53bf837b
  14. 27 6月, 2016 1 次提交
    • M
      xhci: TD-fragment, align the unsplittable case with a bounce buffer · f9c589e1
      Mathias Nyman 提交于
      If the last trb before a link is not packet size aligned, and is not
      splittable then use a bounce buffer for that chunk of max packet size
      unalignable data.
      
      Allocate a max packet size bounce buffer for every segment of a bulk
      endpoint ring at the same time as allocating the ring.
      If we need to align the data before the link trb in that segment then
      copy the data to the segment bounce buffer, dma map it, and enqueue it.
      Once the td finishes, or is cancelled, unmap it.
      
      For in transfers we need to first map the bounce buffer, then queue it,
      after it finishes, copy the bounce buffer to the original sg list, and
      finally unmap it
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f9c589e1
  15. 02 6月, 2016 2 次提交
    • M
      xhci: fix platform quirks overwrite regression in 4.7-rc1 · 757de492
      Mathias Nyman 提交于
      commit b1c127ae ("usb: host: xhci: plat: make use of new methods in
      xhci_plat_priv") sets xhci->quirks before calling xhci_gen_setup(), which
      will overwrite them.
      
      Don't overwite the quirks, just add the new ones
      
      Fixes: b1c127ae ("usb: host: xhci: plat: make use of new methods in xhci_plat_priv")
      Reported-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      757de492
    • G
      xhci: Cleanup only when releasing primary hcd · 27a41a83
      Gabriel Krisman Bertazi 提交于
      Under stress occasions some TI devices might not return early when
      reading the status register during the quirk invocation of xhci_irq made
      by usb_hcd_pci_remove.  This means that instead of returning, we end up
      handling this interruption in the middle of a shutdown.  Since
      xhci->event_ring has already been freed in xhci_mem_cleanup, we end up
      accessing freed memory, causing the Oops below.
      
      commit 8c24d6d7 ("usb: xhci: stop everything on the first call to
      xhci_stop") is the one that changed the instant in which we clean up the
      event queue when stopping a device.  Before, we didn't call
      xhci_mem_cleanup at the first time xhci_stop is executed (for the shared
      HCD), instead, we only did it after the invocation for the primary HCD,
      much later at the removal path.  The code flow for this oops looks like
      this:
      
      xhci_pci_remove()
      	usb_remove_hcd(xhci->shared)
      	        xhci_stop(xhci->shared)
       			xhci_halt()
      			xhci_mem_cleanup(xhci);  // Free the event_queue
      	usb_hcd_pci_remove(primary)
      		xhci_irq()  // Access the event_queue if STS_EINT is set. Crash.
      		xhci_stop()
      			xhci_halt()
      			// return early
      
      The fix modifies xhci_stop to only cleanup the xhci data when releasing
      the primary HCD.  This way, we still have the event_queue configured
      when invoking xhci_irq.  We still halt the device on the first call to
      xhci_stop, though.
      
      I could reproduce this issue several times on the mainline kernel by
      doing a bind-unbind stress test with a specific storage gadget attached.
      I also ran the same test over-night with my patch applied and didn't
      observe the issue anymore.
      
      [  113.334124] Unable to handle kernel paging request for data at address 0x00000028
      [  113.335514] Faulting instruction address: 0xd00000000d4f767c
      [  113.336839] Oops: Kernel access of bad area, sig: 11 [#1]
      [  113.338214] SMP NR_CPUS=1024 NUMA PowerNV
      
      [c000000efe47ba90] c000000000720850 usb_hcd_irq+0x50/0x80
      [c000000efe47bac0] c00000000073d328 usb_hcd_pci_remove+0x68/0x1f0
      [c000000efe47bb00] d00000000daf0128 xhci_pci_remove+0x78/0xb0
      [xhci_pci]
      [c000000efe47bb30] c00000000055cf70 pci_device_remove+0x70/0x110
      [c000000efe47bb70] c00000000061c6bc __device_release_driver+0xbc/0x190
      [c000000efe47bba0] c00000000061c7d0 device_release_driver+0x40/0x70
      [c000000efe47bbd0] c000000000619510 unbind_store+0x120/0x150
      [c000000efe47bc20] c0000000006183c4 drv_attr_store+0x64/0xa0
      [c000000efe47bc60] c00000000039f1d0 sysfs_kf_write+0x80/0xb0
      [c000000efe47bca0] c00000000039e14c kernfs_fop_write+0x18c/0x1f0
      [c000000efe47bcf0] c0000000002e962c __vfs_write+0x6c/0x190
      [c000000efe47bd90] c0000000002eab40 vfs_write+0xc0/0x200
      [c000000efe47bde0] c0000000002ec85c SyS_write+0x6c/0x110
      [c000000efe47be30] c000000000009260 system_call+0x38/0x108
      Signed-off-by: NGabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
      Cc: Roger Quadros <rogerq@ti.com>
      Cc: joel@jms.id.au
      Cc: stable@vger.kernel.org
      Reviewed-by: NRoger Quadros <rogerq@ti.com>
      Cc: <stable@vger.kernel.org> #v4.3+
      Tested-by: NJoel Stanley <joel@jms.id.au>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      27a41a83
  16. 27 4月, 2016 1 次提交
  17. 14 4月, 2016 1 次提交
    • M
      xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers · 98d74f9c
      Mathias Nyman 提交于
      PCI hotpluggable xhci controllers such as some Alpine Ridge solutions will
      remove the xhci controller from the PCI bus when the last USB device is
      disconnected.
      
      Add a flag to indicate that the host is being removed to avoid queueing
      configure_endpoint commands for the dropped endpoints.
      For PCI hotplugged controllers this will prevent 5 second command timeouts
      For static xhci controllers the configure_endpoint command is not needed
      in the removal case as everything will be returned, freed, and the
      controller is reset.
      
      For now the flag is only set for PCI connected host controllers.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      98d74f9c