Commit eefb3dd7 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'for-usb-linus-2013-09-23' of... 

Merge tag 'for-usb-linus-2013-09-23' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus

Sarah writes:

xhci: Bug fixes for 3.12.

Hi Greg,

Here's five bug fixes for 3.12.

The first two bugs fix issues with the command cancellation handling,
which can lead to oopses or the xHCI driver attempting to handle
previously-completed transfers.  People have been running into oopses
and odd behavior with command cancellation for a couple kernel releases,
so they're marked for stable.

The third patch fixes an issue with USB remote wakeup under xHCI that
can only be reproduced under ChromeOS.  As discussed, this fix is not
urgent, and isn't marked for stable.

The fourth patch fixes a race condition between URB cancellation and
userspace clearing an endpoint stall.  The fifth patch removes some
annoying dmesg spam when a USB 3.0 device is disconnected, by avoiding
sending a Set SEL request.

Sarah Sharp
parents 4a10c2ac 38d7f688

drivers/usb/core/hub.c

+3 −0
Original line number Diff line number Diff line
@@ -3426,6 +3426,9 @@ static int usb_req_set_sel(struct usb_device *udev, enum usb3_link_state state) 
	unsigned long long u2_pel;

	int ret;



	if (udev->state != USB_STATE_CONFIGURED)

		return 0;



	/* Convert SEL and PEL stored in ns to us */

	u1_sel = DIV_ROUND_UP(udev->u1_params.sel, 1000);

	u1_pel = DIV_ROUND_UP(udev->u1_params.pel, 1000);

drivers/usb/host/xhci-hub.c

+36 −11
Original line number Diff line number Diff line
@@ -287,7 +287,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend) 
		if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)

			xhci_queue_stop_endpoint(xhci, slot_id, i, suspend);

	}

	cmd->command_trb = xhci->cmd_ring->enqueue;

	cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);

	list_add_tail(&cmd->cmd_list, &virt_dev->cmd_list);

	xhci_queue_stop_endpoint(xhci, slot_id, 0, suspend);

	xhci_ring_cmd_db(xhci);
@@ -552,11 +552,15 @@ void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex) 
 *  - Mark a port as being done with device resume,

 *    and ring the endpoint doorbells.

 *  - Stop the Synopsys redriver Compliance Mode polling.

 *  - Drop and reacquire the xHCI lock, in order to wait for port resume.

 */

static u32 xhci_get_port_status(struct usb_hcd *hcd,

		struct xhci_bus_state *bus_state,

		__le32 __iomem **port_array,

		u16 wIndex, u32 raw_port_status)

		u16 wIndex, u32 raw_port_status,

		unsigned long flags)

	__releases(&xhci->lock)

	__acquires(&xhci->lock)

{

	struct xhci_hcd *xhci = hcd_to_xhci(hcd);

	u32 status = 0;
@@ -591,21 +595,42 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, 
			return 0xffffffff;

		if (time_after_eq(jiffies,

					bus_state->resume_done[wIndex])) {

			int time_left;



			xhci_dbg(xhci, "Resume USB2 port %d\n",

					wIndex + 1);

			bus_state->resume_done[wIndex] = 0;

			clear_bit(wIndex, &bus_state->resuming_ports);



			set_bit(wIndex, &bus_state->rexit_ports);

			xhci_set_link_state(xhci, port_array, wIndex,

					XDEV_U0);

			xhci_dbg(xhci, "set port %d resume\n",

					wIndex + 1);

			slot_id = xhci_find_slot_id_by_port(hcd, xhci,

					wIndex + 1);



			spin_unlock_irqrestore(&xhci->lock, flags);

			time_left = wait_for_completion_timeout(

					&bus_state->rexit_done[wIndex],

					msecs_to_jiffies(

						XHCI_MAX_REXIT_TIMEOUT));

			spin_lock_irqsave(&xhci->lock, flags);



			if (time_left) {

				slot_id = xhci_find_slot_id_by_port(hcd,

						xhci, wIndex + 1);

				if (!slot_id) {

					xhci_dbg(xhci, "slot_id is zero\n");

					return 0xffffffff;

				}

				xhci_ring_device(xhci, slot_id);

			} else {

				int port_status = xhci_readl(xhci,

						port_array[wIndex]);

				xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",

						XHCI_MAX_REXIT_TIMEOUT,

						port_status);

				status |= USB_PORT_STAT_SUSPEND;

				clear_bit(wIndex, &bus_state->rexit_ports);

			}



			bus_state->port_c_suspend |= 1 << wIndex;

			bus_state->suspended_ports &= ~(1 << wIndex);

		} else {
@@ -728,7 +753,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, 
			break;

		}

		status = xhci_get_port_status(hcd, bus_state, port_array,

				wIndex, temp);

				wIndex, temp, flags);

		if (status == 0xffffffff)

			goto error;

drivers/usb/host/xhci-mem.c

+2 −0
Original line number Diff line number Diff line
@@ -2428,6 +2428,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) 
	for (i = 0; i < USB_MAXCHILDREN; ++i) {

		xhci->bus_state[0].resume_done[i] = 0;

		xhci->bus_state[1].resume_done[i] = 0;

		/* Only the USB 2.0 completions will ever be used. */

		init_completion(&xhci->bus_state[1].rexit_done[i]);

	}



	if (scratchpad_alloc(xhci, flags))

drivers/usb/host/xhci-ring.c

+35 −2
Original line number Diff line number Diff line
@@ -123,6 +123,16 @@ static int enqueue_is_link_trb(struct xhci_ring *ring) 
	return TRB_TYPE_LINK_LE32(link->control);

}



union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring)

{

	/* Enqueue pointer can be left pointing to the link TRB,

	 * we must handle that

	 */

	if (TRB_TYPE_LINK_LE32(ring->enqueue->link.control))

		return ring->enq_seg->next->trbs;

	return ring->enqueue;

}



/* Updates trb to point to the next TRB in the ring, and updates seg if the next

 * TRB is in a new segment.  This does not skip over link TRBs, and it does not

 * effect the ring dequeue or enqueue pointers.
@@ -859,8 +869,12 @@ remove_finished_td: 
		/* Otherwise ring the doorbell(s) to restart queued transfers */

		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);

	}



	/* Clear stopped_td and stopped_trb if endpoint is not halted */

	if (!(ep->ep_state & EP_HALTED)) {

		ep->stopped_td = NULL;

		ep->stopped_trb = NULL;

	}



	/*

	 * Drop the lock and complete the URBs in the cancelled TD list.
@@ -1414,6 +1428,12 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, 
			inc_deq(xhci, xhci->cmd_ring);

			return;

		}

		/* There is no command to handle if we get a stop event when the

		 * command ring is empty, event->cmd_trb points to the next

		 * unset command

		 */

		if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)

			return;

	}



	switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
@@ -1743,6 +1763,19 @@ static void handle_port_status(struct xhci_hcd *xhci, 
		}

	}



	/*

	 * Check to see if xhci-hub.c is waiting on RExit to U0 transition (or

	 * RExit to a disconnect state).  If so, let the the driver know it's

	 * out of the RExit state.

	 */

	if (!DEV_SUPERSPEED(temp) &&

			test_and_clear_bit(faked_port_index,

				&bus_state->rexit_ports)) {

		complete(&bus_state->rexit_done[faked_port_index]);

		bogus_port_status = true;

		goto cleanup;

	}



	if (hcd->speed != HCD_USB3)

		xhci_test_and_clear_bit(xhci, port_array, faked_port_index,

					PORT_PLC);

drivers/usb/host/xhci.c

+5 −20
Original line number Diff line number Diff line
@@ -2598,15 +2598,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, 
	if (command) {

		cmd_completion = command->completion;

		cmd_status = &command->status;

		command->command_trb = xhci->cmd_ring->enqueue;



		/* Enqueue pointer can be left pointing to the link TRB,

		 * we must handle that

		 */

		if (TRB_TYPE_LINK_LE32(command->command_trb->link.control))

			command->command_trb =

				xhci->cmd_ring->enq_seg->next->trbs;



		command->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);

		list_add_tail(&command->cmd_list, &virt_dev->cmd_list);

	} else {

		cmd_completion = &virt_dev->cmd_completion;
@@ -2614,7 +2606,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, 
	}

	init_completion(cmd_completion);



	cmd_trb = xhci->cmd_ring->dequeue;

	cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);

	if (!ctx_change)

		ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,

				udev->slot_id, must_succeed);
@@ -3439,14 +3431,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev) 


	/* Attempt to submit the Reset Device command to the command ring */

	spin_lock_irqsave(&xhci->lock, flags);

	reset_device_cmd->command_trb = xhci->cmd_ring->enqueue;



	/* Enqueue pointer can be left pointing to the link TRB,

	 * we must handle that

	 */

	if (TRB_TYPE_LINK_LE32(reset_device_cmd->command_trb->link.control))

		reset_device_cmd->command_trb =

			xhci->cmd_ring->enq_seg->next->trbs;

	reset_device_cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);



	list_add_tail(&reset_device_cmd->cmd_list, &virt_dev->cmd_list);

	ret = xhci_queue_reset_device(xhci, slot_id);
@@ -3650,7 +3635,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) 
	union xhci_trb *cmd_trb;



	spin_lock_irqsave(&xhci->lock, flags);

	cmd_trb = xhci->cmd_ring->dequeue;

	cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);

	ret = xhci_queue_slot_control(xhci, TRB_ENABLE_SLOT, 0);

	if (ret) {

		spin_unlock_irqrestore(&xhci->lock, flags);
@@ -3785,7 +3770,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev) 
				slot_ctx->dev_info >> 27);



	spin_lock_irqsave(&xhci->lock, flags);

	cmd_trb = xhci->cmd_ring->dequeue;

	cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);

	ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,

					udev->slot_id);

	if (ret) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE