xhci_alloc_segments_for_ring() builds a list of xhci_segments and links
the tail to head at the end (forming a ring). When it bails out for OOM
reasons half-way through, it tries to destroy its half-built list with
xhci_free_segments_for_ring(), even though it is not a ring yet. This
causes a null-pointer dereference upon hitting the last element.
Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes
the output parameters to be valid upon this kind of OOM failure, and
calls xhci_ring_free() on them. Since the (incomplete) list/ring should
already be destroyed in that case, this would lead to a use after free.
This patch fixes those issues by having xhci_alloc_segments_for_ring()
destroy its half-built, non-circular list manually and destroying the
invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().
This patch should be backported to kernels as old as 2.6.31, that
contains the commit 0ebbab3742 "USB: xhci:
Ring allocation and initialization."
A separate patch will need to be developed for kernels older than 3.4,
since the ring allocation code was refactored in that kernel.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
The xHCI 1.0 specification made a change to the TD Size field in TRBs.
The value is now the number of packets that remain to be sent in the TD,
not including this TRB. The TD Size value for the last TRB in a TD must
always be zero.
The xHCI function xhci_v1_0_td_remainder() attempts to calculate this,
but it gets it wrong. First, it erroneously reuses the old
xhci_td_remainder function, which will right shift the value by 10. The
xHCI 1.0 spec as of June 2011 says nothing about right shifting by 10.
Second, it does not set the TD size for the last TRB in a TD to zero.
Third, it uses roundup instead of DIV_ROUND_UP. The total packet count
is supposed to be the total number of bytes in this TD, divided by the
max packet size, rounded up. DIV_ROUND_UP is the right function to use
in that case.
With the old code, a TD on an endpoint with max packet size 1024 would
be set up like so:
TRB 1, TRB length = 600 bytes, TD size = 0
TRB 1, TRB length = 200 bytes, TD size = 0
TRB 1, TRB length = 100 bytes, TD size = 0
With the new code, the TD would be set up like this:
TRB 1, TRB length = 600 bytes, TD size = 1
TRB 1, TRB length = 200 bytes, TD size = 1
TRB 1, TRB length = 100 bytes, TD size = 0
This commit should be backported to kernels as old as 3.0, that contain
the commit 4da6e6f247 "xhci 1.0: Update TD
size field format."
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Chintan Mehta <chintan.mehta@sibridgetech.com>
Reported-by: Shimmer Huang <shimmering.h@gmail.com>
Tested-by: Bhavik Kothari <bhavik.kothari@sibridgetech.com>
Tested-by: Shimmer Huang <shimmering.h@gmail.com>
Cc: stable@vger.kernel.org
David reports that at drivers/usb/host/xhci.c:2257:
static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
}
The static analyser cppcheck says
[linux-3.7-rc2/drivers/usb/host/xhci.c:2257]: (style) Redundant condition: If ep_type == 5, the comparison ep_type != 7 is always true.
Maybe the original programmer intention was something like
static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
}
Fix this.
This patch should be backported to stable kernels as old as 3.2, that
contain the commit 2b69899934 "xhci: USB
3.0 BW checking."
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: David Binderman <dcb314@hotmail.com>
Cc: stable@vger.kernel.org
Non-static xHCI driver symbols should start with the "xhci_" prefix, in
order to avoid namespace pollution. Rename the "handshake" function to
"xhci_handshake".
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Ben Hutchings <ben@decadent.org.uk>
This patch (as1632b) fixes a bug in ehci-hcd. The USB core uses
urb->hcpriv to determine whether or not an URB is active; host
controller drivers are supposed to set this pointer to a non-NULL
value when an URB is queued. However ehci-hcd sets it to NULL for
isochronous URBs, which defeats the check in usbcore.
In itself this isn't a big deal. But people have recently found that
certain sequences of actions will cause the snd-usb-audio driver to
reuse URBs without waiting for them to complete. In the absence of
proper checking by usbcore, the URBs get added to their endpoint list
twice. This leads to list corruption and a system freeze.
The patch makes ehci-hcd assign a meaningful value to urb->hcpriv for
isochronous URBs. Improving robustness always helps.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Artem S. Tashkinov <t.artem@lycos.com>
Reported-by: Christof Meerwald <cmeerw@cmeerw.org>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1630) cleans up a few minor items resulting from the
split-up of the ehci-hcd driver:
Remove the product_desc string from the ehci_driver_overrides
structure. All drivers will use the generic "EHCI Host
Controller" string. (This was requested by Felipe Balbi.)
Allow drivers to pass a NULL pointer to ehci_init_driver()
if they don't have to override any settings.
Remove a #define symbol that is no longer used from the
ChipIdea host driver.
Rename overrides to pci_overrides in ehci-pci.c, for
consistency with ehci-platform.c.
Mark the *_overrides structures as __initdata.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1627) splits the ehci-hcd core code, which has become a
separate library module, out from the ChipIdea host driver. Instead
of #include-ing ehci-hcd.c directly, the ChipIdea module will now use
the ehci-hcd library in a normal fashion.
This fixes a build error caused by commit
3e02320399 (USB: EHCI: prepare to make
ehci-hcd a library module); I had forgotten about the unorthodox way
the ChipIdea driver uses the ehci-hcd code.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In the former code, we have a race condition between the first interrupt
and the regs field initilization in the usb_hcd structure.
If the OHCI irq fires before hcd->regs is set, we are getting a null
pointer dereference in ohci_irq.
When calling usb_add_hcd(), it first executes the reset() callback,
then enables the ohci interrupt, and finally executes the start()
callback. So moving the ohci_init() call which actually initializes the
reg field from start() to reset() should remove the race.
Tested by enabling the external HSIC hub in the bootloader on an exynos5
machine and booting. With the former code, this triggers an early interrupt
about 50% of the boots and a subsequent kernel panic in ohci_irq when trying
to access the registers.
Cc: Olof Johansson <olofj@chromium.org>
Cc: Doug Anderson <dianders@chromium.org>
Cc: Arjun.K.V <arjun.kv@samsung.com>
Cc: Vikas Sajjan <vikas.sajjan@samsung.com>
Cc: Abhilash Kesavan <a.kesavan@samsung.com>
Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1628) fixes a build error in the ehci-platform driver
when compiled for the PowerPC architecture. The error was introduced
by commit 99f91934a9 (USB: EHCI: make
ehci-platform a separate driver).
The fix is simple; a few additional header-file #includes are needed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1626) splits the ehci-platform code from ehci-hcd out
into its own separate driver module.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1625) splits the PCI portion of ehci-hcd out into its
own separate driver module, called ehci-pci. Consistently with the
current practice, the decision whether to build this module is not
user-configurable. If EHCI and PCI are enabled then the module will
be built, always.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1624) prepares ehci-hcd for being split up into a core
library and separate platform driver modules. A generic
ehci_hc_driver structure is created, containing all the "standard"
values, and a new mechanism is added whereby a driver module can
specify a set of overrides to those values. In addition the
ehci_setup(), ehci_suspend(), and ehci_resume() routines need to be
EXPORTed for use by the drivers.
As a side effect of this change, a few routines no longer need to be
marked __maybe_unused.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1623) removes the ehci_port_power() routine and all the
places that call it. There's no reason for ehci-hcd to change the
port power settings; the hub driver takes care of all that stuff.
There is one exception: When the controller is resumed from
hibernation or following a loss of power, the ports that are supposed
to be handed over to a companion controller must be powered on first.
Otherwise the handover won't work. This process is not visible to the
hub driver, so it has to be handled in ehci-hcd.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1622) removes the USB-2.1 Link Power Management code
from the ehci-hcd driver. This code was never integrated with
usbcore, it is full of bugs, and it was not getting used by anybody.
However, the debugging code for dumping the LPM-related fields in the
EHCI registers is left in place. In theory it might be useful to see
these values, even though we don't use them.
This essentially amounts to a partial revert of commit
aa4d834298 (USB: EHCI: EHCI 1.1
addendum: preparation) and an almost full revert of commit
48f2497014 (USB: EHCI: EHCI 1.1
addendum: Basic LPM feature support) plus its follow-ons.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This pulls in all of the USB changes in 3.7-rc3 into usb-next and
resolves the merge issue with:
drivers/usb/misc/ezusb.c
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the variable ep_ctx from xhci_add_endpoint(), since it is
assigned but unused. Caught by Coverity.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Remove the variable slot_ctx from xhci_dbg_ctx(), since it is assigned
but unused. Caught by Coverity.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Coverity complains that xhci_evaluate_context_result() is missing a
break statement after the COMP_EBADSLT switch case. It's not a big
deal, since we wanted to return the same error code as the case
statement below it does. The end result would be one that a Slot
Disabled error completion code would also print the warning message
associated with a Context State error code. No other bad behavior would
result.
It's not worth backporting to stable kernels, since it only fixes an
issue with too much debugging.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
The command cancellation code doesn't check whether find_trb_seg()
couldn't find the segment that contains the TRB to be canceled. This
could cause a NULL pointer deference later in the function when next_trb
is called. It's unlikely to happen unless something is wrong with the
command ring pointers, so add some debugging in case it happens.
This patch should be backported to stable kernels as old as 3.0, that
contain the commit b63f4053cc "xHCI:
handle command after aborting the command ring".
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
BIOS vendors keep changing the BIOS versions. Only match the beginning
of the string to match all Lucid tablets with board name M11JB.
Signed-off-by: Anisse Astier <anisse@astier.eu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch (as1619) improves the interface to the "hub_for_each_child"
macro. The name clearly suggests that the macro iterates over child
devices; it does not suggest that the loop will also iterate over
unnconnected ports.
The patch changes the macro so that it will skip over unconnected
ports and iterate only the actual child devices. The two existing
call sites are updated to avoid testing for a NULL child pointer,
which is now unnecessary.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In preparation for splitting the ehci-hcd driver into a core library
and separate platform-specific driver modules, this patch (as1618)
moves ehci_update_device() from a couple of platform-specific source
files into ehci-lpm.c. This is where it should have been all along,
since all it does is call a couple of other functions that are already
in ehci-lpm.c.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In preparation for splitting the ehci-hcd driver into a core library
and separate platform-specific driver modules, this patch (as1617)
changes the way ehci_read_frame_index() is handled.
Since the same core library will have to work with both PCI and
non-PCI platforms, the quirk handler routine will be compiled
unconditionally. The decision about whether to call it or simply to
read the frame index register is made at run time, based on whether
the frame_index_bug quirk flag is set.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In preparation for splitting the ehci-hcd driver into a core library
and separate platform-specific driver modules, this patch (as1616)
moves the console logging macros from ehci-dbg.c to ehci.h, where they
will be available to the platform drivers.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Without this condition, all controllers will do this delay,
and increase the resume time.
Only enabled and unsuspended port needs this delay, but
Some buggy hardware(like Synopsys usb controller) will
clear suspend bit once they receive/send resume signal,
so it takes resume bit as consideration.
Tested it at Freescale i.mx6q Sabrelite board.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The devm_ functions allocate memory that is released when a driver
detaches. This makes the code smaller and a bit simpler.
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_clk_get() for these functions.
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Convert clk_enable/clk_disable to clk_prepare_enable/clk_disable_unprepare
calls as required by common clock framework.
Signed-off-by: Thomas Abraham <thomas.abraham@linaro.org>
Acked-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Convert clk_enable/clk_disable to clk_prepare_enable/clk_disable_unprepare
calls as required by common clock framework.
Signed-off-by: Thomas Abraham <thomas.abraham@linaro.org>
Acked-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Almost nothing from this file is used, and the file will hopefully be
deleted soon. Copy the tiny portions that are used directly into
ehci-tegra.c. I believe that Venu Byravarasu is working on cleaning up
our USB driver, and those cleanups will remove the need for these
constants.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-by: Venu Byravarasu <vbyravarasu@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xhci_service_interval_to_ns() returns long long
to avoid an overflow. However, the type cast happens
too late. The fix is to force ULL from the beginning.
This patch should be backported to kernels as old as 3.5, that contain
the commit e3567d2c15 "xhci: Add Intel
U1/U2 timeout policy."
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
CC: stable@vger.kernel.org
An le16 is accessed without conversion.
This patch should be backported to kernels as old as 3.5, that contain
the commit e3567d2c15 "xhci: Add Intel
U1/U2 timeout policy."
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
CC: stable@vger.kernel.org
Commit cfa49b4b (USB: ohci: merge ohci_finish_controller_resume with
ohci_resume) merged ohci_finish_controller_resume with ohci_resume but forgot
to update the ohci-sm501 driver accordingly, thus causing the folllowing build
failure:
drivers/usb/host/ohci-sm501.c: In function 'ohci_sm501_resume':
drivers/usb/host/ohci-sm501.c:241:2: error: implicit declaration of function
'ohci_finish_controller_resume' [-Werror=implicit-function-declaration]
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Struct usb_hub_descriptor.ss.DeviceRemovable has been defined as __le16
and (__force__ __u16) doesn't need.
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
When setting usb port's acpi power resource, there will be some xhci hub requests.
This will cause dead lock since xhci->lock has been held before setting acpi power
resource in the xhci_hub_control(). The usb_acpi_power_manageable() function might
fall into sleep so release xhci->lock before invoking it.
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
This patch changes the ohci-platform driver to use the device managed helper
function for requesting memory region and ioremapping memory resources.
As a result the error path in the probe function is simplified, and the
platform driver remove callback does no longer need to release and iounmap
memory resources. devm_request_and_ioremap() will use either the ioremap()
or ioremap_nocache() handler depending on the resource's CACHEABLE flag, so
we are good with this change.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch changes the ehci-platform driver to use the device managed helper
function for requesting memory region and ioremapping memory resources.
As a result the error path in the probe function is simplified, and the
platform driver remove callback does no longer need to release and iounmap
memory resources. devm_request_and_ioremap() will use either the ioremap()
or ioremap_nocache() handler depending on the resource's CACHEABLE flag, so
we are good with this change.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
We meant to write "resource" instead of "recourse", this patch fixes this
typo.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix the obvious typo in the error message, we meant to write "resource"
instead of "recourse".
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch converts the ohci-platform driver to use dev_err() functions
instead of pr_err().
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch converts the ehci-platform driver to make use of the dev_err()
functions instead of pr_err().
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
A previous patch converted the Alchemy platform to use the OHCI and EHCI
platform drivers. As a result, all the common logic to handle USB present in
drivers/usb/host/alchemy-common.c has no reason to remain here, so we move it
to arch/mips/alchemy/common/usb.c which is a more appropriate place. This
change was suggested by Manuel Lauss.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All users have been converted to use the OHCI platform driver instead, thus
making ohci-au1xxx obsolete, remove it.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All users have been converted to use the OHCI platform driver instead, thus
making ohci-sh obsolete, so remove it.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All users have been converted to use the OHCI platform driver instead, thus
making ohci-xls obsolete, remove it.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All users have been converted to use the OHCI platform driver instead, thus
making ohci-cns3xxx, so remove it.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The users have been converted to use the platform OHCI driver instead, thus
making the ohci-pnx8550 driver obsolete, so remove it.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
