1. 03 11月, 2016 2 次提交
  2. 24 10月, 2016 3 次提交
  3. 20 10月, 2016 3 次提交
  4. 12 10月, 2016 1 次提交
  5. 05 10月, 2016 1 次提交
  6. 27 9月, 2016 1 次提交
  7. 13 9月, 2016 3 次提交
  8. 08 9月, 2016 1 次提交
  9. 31 8月, 2016 9 次提交
  10. 16 8月, 2016 4 次提交
    • M
      xhci: don't dereference a xhci member after removing xhci · f1f6d9a8
      Mathias Nyman 提交于
      Remove the hcd after checking for the xhci last quirks, not before.
      
      This caused a hang on a Alpine Ridge xhci based maching which remove
      the whole xhci controller when unplugging the last usb device
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f1f6d9a8
    • J
      usb: xhci: Fix panic if disconnect · 88716a93
      Jim Lin 提交于
      After a device is disconnected, xhci_stop_device() will be invoked
      in xhci_bus_suspend().
      Also the "disconnect" IRQ will have ISR to invoke
      xhci_free_virt_device() in this sequence.
      xhci_irq -> xhci_handle_event -> handle_cmd_completion ->
      xhci_handle_cmd_disable_slot -> xhci_free_virt_device
      
      If xhci->devs[slot_id] has been assigned to NULL in
      xhci_free_virt_device(), then virt_dev->eps[i].ring in
      xhci_stop_device() may point to an invlid address to cause kernel
      panic.
      
      virt_dev = xhci->devs[slot_id];
      :
      if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
      
      [] Unable to handle kernel paging request at virtual address 00001a68
      [] pgd=ffffffc001430000
      [] [00001a68] *pgd=000000013c807003, *pud=000000013c807003,
      *pmd=000000013c808003, *pte=0000000000000000
      [] Internal error: Oops: 96000006 [#1] PREEMPT SMP
      [] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G     U
      [] Workqueue: pm pm_runtime_work
      [] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti:
      ffffffc0bc0ec000
      [] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4
      
      This issue is found when running with realtek ethernet device
      (0bda:8153).
      Signed-off-by: NJim Lin <jilin@nvidia.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      88716a93
    • A
      xhci: really enqueue zero length TRBs. · 0d2daade
      Alban Browaeys 提交于
      Enqueue the first TRB even if full_len is zero.
      Without this "adb install <apk>" freezes the system.
      Signed-off-by: NAlban Browaeys <alban.browaeys@gmail.com>
      Fixes: 86065c27 ("xhci: don't rely on precalculated value of needed trbs in the enqueue loop")
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0d2daade
    • M
      xhci: always handle "Command Ring Stopped" events · 33be1265
      Mathias Nyman 提交于
      Fix "Command completion event does not match command" errors by always
      handling the command ring stopped events.
      
      The command ring stopped event is generated as a result of aborting
      or stopping the command ring with a register write. It is not caused
      by a command in the command queue, and thus won't have a matching command
      in the comman list.
      
      Solve it by handling the command ring stopped event before checking for a
      matching command.
      
      In most command time out cases we abort the command ring, and get
      a command ring stopped event. The events command pointer will point at
      the current command ring dequeue, which in most cases matches the timed
      out command in the command list, and no error messages are seen.
      
      If we instead get a command aborted event before the command ring stopped
      event, the abort event will increse the command ring dequeue pointer, and
      the following command ring stopped events command pointer will point at the
      next, not yet queued command. This case triggered the error message
      Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      CC: <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      33be1265
  11. 15 8月, 2016 3 次提交
  12. 09 8月, 2016 4 次提交
  13. 07 7月, 2016 1 次提交
    • T
      timers: Remove set_timer_slack() leftovers · 53bf837b
      Thomas Gleixner 提交于
      We now have implicit batching in the timer wheel. The slack API is no longer
      used, so remove it.
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Arjan van de Ven <arjan@infradead.org>
      Cc: Chris Mason <clm@fb.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: David Woodhouse <dwmw2@infradead.org>
      Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Frederic Weisbecker <fweisbec@gmail.com>
      Cc: George Spelvin <linux@sciencehorizons.net>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Jaehoon Chung <jh80.chung@samsung.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: John Stultz <john.stultz@linaro.org>
      Cc: Josh Triplett <josh@joshtriplett.org>
      Cc: Len Brown <lenb@kernel.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Mathias Nyman <mathias.nyman@intel.com>
      Cc: Pali Rohár <pali.rohar@gmail.com>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Sebastian Reichel <sre@kernel.org>
      Cc: Ulf Hansson <ulf.hansson@linaro.org>
      Cc: linux-block@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      Cc: linux-mmc@vger.kernel.org
      Cc: linux-pm@vger.kernel.org
      Cc: linux-usb@vger.kernel.org
      Cc: netdev@vger.kernel.org
      Cc: rt@linutronix.de
      Link: http://lkml.kernel.org/r/20160704094342.189813118@linutronix.deSigned-off-by: NIngo Molnar <mingo@kernel.org>
      53bf837b
  14. 01 7月, 2016 1 次提交
    • A
      xhci: free the correct ring · f76a28a6
      Arnd Bergmann 提交于
      gcc warns about what first looks like a reference to an uninitialized
      variable:
      
      drivers/usb/host/xhci-ring.c: In function 'handle_cmd_completion':
      drivers/usb/host/xhci-ring.c:753:4: error: 'ep_ring' may be used uninitialized in this function [-Werror=maybe-uninitialized]
          xhci_unmap_td_bounce_buffer(xhci, ep_ring, cur_td);
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      drivers/usb/host/xhci-ring.c:647:20: note: 'ep_ring' was declared here
        struct xhci_ring *ep_ring;
                          ^~~~~~~
      
      It's clear to see that the list_empty() check means it can never be
      uninitialized, however it still looks wrong:
      
      When ep->cancelled_td_list contains more than one entry, the
      ep_ring variable will point to the ring that was retrieved
      from the last urb, and we have to look it up again in the
      second loop instead, which fixes the behavior and gets rid of the
      warning too.
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Fixes: f9c589e1 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
      Acked-by: NMathias Nyman <mathias.nyman@linux.intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f76a28a6
  15. 30 6月, 2016 2 次提交
  16. 27 6月, 2016 1 次提交