From: Greg Kroah-Hartman Date: Mon, 7 Jul 2014 17:02:42 +0000 (-0700) Subject: 3.15-stable patches X-Git-Tag: v3.4.98~60 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3201389f18c0610205787bcf766f2f237ab3dd29;p=thirdparty%2Fkernel%2Fstable-queue.git 3.15-stable patches added patches: rt2x00-disable-tkip-on-usb.patch rt2x00-fix-rfkill-regression-on-rt2500pci.patch usb-chipidea-udc-delete-td-from-req-s-td-list-at-ep_dequeue.patch usb-ftdi_sio-fix-null-deref-at-port-probe.patch usb-gadget-f_fs-fix-null-pointer-dereference-when-there-are-no-strings.patch usb-gadget-f_fs-resurect-usb_functionfs_descs_head-structure.patch usb-musb-ensure-that-cppi41-timer-gets-armed-on-premature-dma-tx-irq.patch usb-musb-fix-panic-upon-musb_am335x-module-removal.patch usb-musb-ux500-don-t-propagate-the-of-node.patch usb-option-add-device-id-for-speedup-su9800-usb-3g-modem.patch usb-option-add-modify-olivetti-olicard-modems.patch xhci-correct-burst-count-field-for-isoc-transfers-on-1.0-xhci-hosts.patch xhci-fix-runtime-suspended-xhci-from-blocking-system-suspend.patch xhci-use-correct-slot-id-when-handling-a-reset-device-command.patch --- diff --git a/queue-3.15/rt2x00-disable-tkip-on-usb.patch b/queue-3.15/rt2x00-disable-tkip-on-usb.patch new file mode 100644 index 00000000000..bb4903826ed --- /dev/null +++ b/queue-3.15/rt2x00-disable-tkip-on-usb.patch @@ -0,0 +1,56 @@ +From 8edcb0ba0d56f5914eef11eda6db8bfe74eb9ca8 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 10 Jun 2014 12:51:06 +0200 +Subject: rt2x00: disable TKIP on USB + +From: Stanislaw Gruszka + +commit 8edcb0ba0d56f5914eef11eda6db8bfe74eb9ca8 upstream. + +On USB we can not get atomically TKIP key. We have to disable support +for TKIP acceleration on USB hardware to avoid bug as showed bellow. + +[ 860.827243] BUG: scheduling while atomic: hostapd/3397/0x00000002 + +[ 860.827280] Call Trace: +[ 860.827282] [] dump_stack+0x4d/0x66 +[ 860.827284] [] __schedule_bug+0x47/0x55 +[ 860.827285] [] __schedule+0x733/0x7b0 +[ 860.827287] [] schedule+0x29/0x70 +[ 860.827289] [] schedule_timeout+0x15a/0x2b0 +[ 860.827291] [] ? ftrace_raw_event_tick_stop+0xc0/0xc0 +[ 860.827294] [] ? __module_text_address+0x12/0x70 +[ 860.827296] [] wait_for_completion_timeout+0xb3/0x140 +[ 860.827298] [] ? wake_up_state+0x20/0x20 +[ 860.827301] [] usb_start_wait_urb+0x7d/0x150 +[ 860.827303] [] usb_control_msg+0xc5/0x110 +[ 860.827305] [] rt2x00usb_vendor_request+0xc6/0x160 [rt2x00usb] +[ 860.827307] [] rt2x00usb_vendor_req_buff_lock+0x75/0x150 [rt2x00usb] +[ 860.827309] [] rt2x00usb_vendor_request_buff+0xa3/0xe0 [rt2x00usb] +[ 860.827311] [] rt2x00usb_register_multiread+0x33/0x40 [rt2800usb] +[ 860.827314] [] rt2800_get_tkip_seq+0x39/0x50 [rt2800lib] +[ 860.827321] [] ieee80211_get_key+0x218/0x2a0 [mac80211] +[ 860.827322] [] ? __nlmsg_put+0x6c/0x80 +[ 860.827329] [] nl80211_get_key+0x22e/0x360 [cfg80211] + +Reported-and-tested-by: Peter Wu +Reported-and-tested-by: Pontus Fuchs +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00mac.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_h + crypto.cipher = rt2x00crypto_key_to_cipher(key); + if (crypto.cipher == CIPHER_NONE) + return -EOPNOTSUPP; ++ if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev)) ++ return -EOPNOTSUPP; + + crypto.cmd = cmd; + diff --git a/queue-3.15/rt2x00-fix-rfkill-regression-on-rt2500pci.patch b/queue-3.15/rt2x00-fix-rfkill-regression-on-rt2500pci.patch new file mode 100644 index 00000000000..e519c946e7d --- /dev/null +++ b/queue-3.15/rt2x00-fix-rfkill-regression-on-rt2500pci.patch @@ -0,0 +1,118 @@ +From 616a8394b5df8c88f4dd416f4527439a4e365034 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Mon, 16 Jun 2014 18:45:15 +0200 +Subject: rt2x00: fix rfkill regression on rt2500pci + +From: Stanislaw Gruszka + +commit 616a8394b5df8c88f4dd416f4527439a4e365034 upstream. + +As reported by Niels, starting rfkill polling during device probe +(commit e2bc7c5, generally sane change) broke rfkill on rt2500pci +device. I considered that bug as some initalization issue, which +should be fixed on rt2500pci specific code. But after several +attempts (see bug report for details) we fail to find working solution. +Hence I decided to revert to old behaviour on rt2500pci to fix +regression. + +Additionally patch also unregister rfkill on device remove instead +of ifconfig down, what was another issue introduced by bad commit. + +Bug report: +https://bugzilla.kernel.org/show_bug.cgi?id=73821 + +Fixes: e2bc7c5f3cb8 ("rt2x00: Fix rfkill_polling register function.") +Bisected-by: Niels +Reported-and-tested-by: Niels +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2500pci.c | 7 ++++++- + drivers/net/wireless/rt2x00/rt2x00.h | 1 + + drivers/net/wireless/rt2x00/rt2x00dev.c | 24 +++++++++++++++++++++--- + 3 files changed, 28 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2500pci.c ++++ b/drivers/net/wireless/rt2x00/rt2500pci.c +@@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct + /* + * Detect if this device has an hardware controlled radio. + */ +- if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) ++ if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) { + __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags); ++ /* ++ * On this device RFKILL initialized during probe does not work. ++ */ ++ __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags); ++ } + + /* + * Check if the BBP tuning should be enabled. +--- a/drivers/net/wireless/rt2x00/rt2x00.h ++++ b/drivers/net/wireless/rt2x00/rt2x00.h +@@ -693,6 +693,7 @@ enum rt2x00_capability_flags { + REQUIRE_SW_SEQNO, + REQUIRE_HT_TX_DESC, + REQUIRE_PS_AUTOWAKE, ++ REQUIRE_DELAYED_RFKILL, + + /* + * Capabilities +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struc + return; + + /* +- * Unregister extra components. ++ * Stop rfkill polling. + */ +- rt2x00rfkill_unregister(rt2x00dev); ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); + + /* + * Allow the HW to uninitialize. +@@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct r + + set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags); + ++ /* ++ * Start rfkill polling. ++ */ ++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); ++ + return 0; + } + +@@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_de + rt2x00link_register(rt2x00dev); + rt2x00leds_register(rt2x00dev); + rt2x00debug_register(rt2x00dev); +- rt2x00rfkill_register(rt2x00dev); ++ ++ /* ++ * Start rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_register(rt2x00dev); + + return 0; + +@@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_ + clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); + + /* ++ * Stop rfkill polling. ++ */ ++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags)) ++ rt2x00rfkill_unregister(rt2x00dev); ++ ++ /* + * Disable radio. + */ + rt2x00lib_disable_radio(rt2x00dev); diff --git a/queue-3.15/series b/queue-3.15/series index 11143d74526..96e6d1aa9ad 100644 --- a/queue-3.15/series +++ b/queue-3.15/series @@ -5,3 +5,17 @@ ibmvscsi-add-memory-barriers-for-send-receive.patch virtio-scsi-avoid-cancelling-uninitialized-work-items.patch scsi_error-fix-invalid-setting-of-host-byte.patch virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch +xhci-use-correct-slot-id-when-handling-a-reset-device-command.patch +xhci-correct-burst-count-field-for-isoc-transfers-on-1.0-xhci-hosts.patch +xhci-fix-runtime-suspended-xhci-from-blocking-system-suspend.patch +usb-option-add-device-id-for-speedup-su9800-usb-3g-modem.patch +usb-option-add-modify-olivetti-olicard-modems.patch +usb-musb-ux500-don-t-propagate-the-of-node.patch +usb-musb-ensure-that-cppi41-timer-gets-armed-on-premature-dma-tx-irq.patch +usb-musb-fix-panic-upon-musb_am335x-module-removal.patch +usb-chipidea-udc-delete-td-from-req-s-td-list-at-ep_dequeue.patch +usb-ftdi_sio-fix-null-deref-at-port-probe.patch +usb-gadget-f_fs-resurect-usb_functionfs_descs_head-structure.patch +usb-gadget-f_fs-fix-null-pointer-dereference-when-there-are-no-strings.patch +rt2x00-disable-tkip-on-usb.patch +rt2x00-fix-rfkill-regression-on-rt2500pci.patch diff --git a/queue-3.15/usb-chipidea-udc-delete-td-from-req-s-td-list-at-ep_dequeue.patch b/queue-3.15/usb-chipidea-udc-delete-td-from-req-s-td-list-at-ep_dequeue.patch new file mode 100644 index 00000000000..0b1a6d555bf --- /dev/null +++ b/queue-3.15/usb-chipidea-udc-delete-td-from-req-s-td-list-at-ep_dequeue.patch @@ -0,0 +1,102 @@ +From e4adcff09ca39ecbcc4851d40d0f0a5458e7b77a Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Wed, 2 Jul 2014 12:16:31 +0800 +Subject: usb: chipidea: udc: delete td from req's td list at ep_dequeue + +From: Peter Chen + +commit e4adcff09ca39ecbcc4851d40d0f0a5458e7b77a upstream. + +We need to delete un-finished td from current request's td list +at ep_dequeue API, otherwise, this non-user td will be remained +at td list before this request is freed. So if we do ep_queue-> +ep_dequeue->ep_queue sequence, when the complete interrupt for +the second ep_queue comes, we search td list for this request, +the first td (added by the first ep_queue) will be handled, and +its status is still active, so we will consider the this transfer +still not be completed, but in fact, it has completed. It causes +the peripheral side considers it never receives current data for +this transfer. + +We met this problem when do "Error Recovery Test - Device Configured" +test item for USBCV2 MSC test, the host has never received ACK for +the IN token for CSW due to peripheral considers it does not get this +CBW, the USBCV test log like belows: + +-------------------------------------------------------------------------- +INFO +Issuing BOT MSC Reset, reset should always succeed +INFO +Retrieving status on CBW endpoint +INFO +CBW endpoint status = 0x0 +INFO +Retrieving status on CSW endpoint +INFO +CSW endpoint status = 0x0 +INFO +Issuing required command (Test Unit Ready) to verify device has recovered +INFO +Issuing CBW (attempt #1): +INFO +|----- CBW LUN = 0x0 +INFO +|----- CBW Flags = 0x0 +INFO +|----- CBW Data Transfer Length = 0x0 +INFO +|----- CBW CDB Length = 0x6 +INFO +|----- CBW CDB-00 = 0x0 +INFO +|----- CBW CDB-01 = 0x0 +INFO +|----- CBW CDB-02 = 0x0 +INFO +|----- CBW CDB-03 = 0x0 +INFO +|----- CBW CDB-04 = 0x0 +INFO +|----- CBW CDB-05 = 0x0 +INFO +Issuing CSW : try 1 +INFO +CSW Bulk Request timed out! +ERROR +Failed CSW phase : should have been success or stall +FAIL +(5.3.4) The CSW status value must be 0x00, 0x01, or 0x02. +ERROR +BOTCommonMSCRequest failed: error=80004000 + +Cc: Andrzej Pietrasiewicz +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/udc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1328,6 +1328,7 @@ static int ep_dequeue(struct usb_ep *ep, + struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep); + struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req); + unsigned long flags; ++ struct td_node *node, *tmpnode; + + if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY || + hwep->ep.desc == NULL || list_empty(&hwreq->queue) || +@@ -1338,6 +1339,12 @@ static int ep_dequeue(struct usb_ep *ep, + + hw_ep_flush(hwep->ci, hwep->num, hwep->dir); + ++ list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) { ++ dma_pool_free(hwep->td_pool, node->ptr, node->dma); ++ list_del(&node->td); ++ kfree(node); ++ } ++ + /* pop request */ + list_del_init(&hwreq->queue); + diff --git a/queue-3.15/usb-ftdi_sio-fix-null-deref-at-port-probe.patch b/queue-3.15/usb-ftdi_sio-fix-null-deref-at-port-probe.patch new file mode 100644 index 00000000000..72f73db57ba --- /dev/null +++ b/queue-3.15/usb-ftdi_sio-fix-null-deref-at-port-probe.patch @@ -0,0 +1,52 @@ +From aea1ae8760314e072bf1b773521e9de5d5dda10d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 5 Jun 2014 16:05:52 +0200 +Subject: USB: ftdi_sio: fix null deref at port probe + +From: Johan Hovold + +commit aea1ae8760314e072bf1b773521e9de5d5dda10d upstream. + +Fix NULL-pointer dereference when probing an interface with no +endpoints. + +These devices have two bulk endpoints per interface, but this avoids +crashing the kernel if a user forces a non-FTDI device to be probed. + +Note that the iterator variable was made unsigned in order to avoid +a maybe-uninitialized compiler warning for ep_desc after the loop. + +Fixes: 895f28badce9 ("USB: ftdi_sio: fix hi-speed device packet size +calculation") + +Reported-by: Mike Remski +Tested-by: Mike Remski +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1566,14 +1566,17 @@ static void ftdi_set_max_packet_size(str + struct usb_device *udev = serial->dev; + + struct usb_interface *interface = serial->interface; +- struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc; ++ struct usb_endpoint_descriptor *ep_desc; + + unsigned num_endpoints; +- int i; ++ unsigned i; + + num_endpoints = interface->cur_altsetting->desc.bNumEndpoints; + dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints); + ++ if (!num_endpoints) ++ return; ++ + /* NOTE: some customers have programmed FT232R/FT245R devices + * with an endpoint size of 0 - not good. In this case, we + * want to override the endpoint descriptor setting and use a diff --git a/queue-3.15/usb-gadget-f_fs-fix-null-pointer-dereference-when-there-are-no-strings.patch b/queue-3.15/usb-gadget-f_fs-fix-null-pointer-dereference-when-there-are-no-strings.patch new file mode 100644 index 00000000000..57fb2ee37d2 --- /dev/null +++ b/queue-3.15/usb-gadget-f_fs-fix-null-pointer-dereference-when-there-are-no-strings.patch @@ -0,0 +1,55 @@ +From f0688c8b81d2ea239c3fb0b848f623b579238d99 Mon Sep 17 00:00:00 2001 +From: Michal Nazarewicz +Date: Tue, 17 Jun 2014 17:47:41 +0200 +Subject: usb: gadget: f_fs: fix NULL pointer dereference when there are no strings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Nazarewicz + +commit f0688c8b81d2ea239c3fb0b848f623b579238d99 upstream. + +If the descriptors do not need any strings and user space sends empty +set of strings, the ffs->stringtabs field remains NULL. Thus +*ffs->stringtabs in functionfs_bind leads to a NULL pointer +dereferenece. + +The bug was introduced by commit [fd7c9a007f: “use usb_string_ids_n()”]. + +While at it, remove double initialisation of lang local variable in +that function. + +ffs->strings_count does not need to be checked in any way since in +the above scenario it will remain zero and usb_string_ids_n() is +a no-operation when colled with 0 argument. + +Signed-off-by: Michal Nazarewicz +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/f_fs.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/usb/gadget/f_fs.c ++++ b/drivers/usb/gadget/f_fs.c +@@ -1508,11 +1508,13 @@ static int functionfs_bind(struct ffs_da + ffs->ep0req->context = ffs; + + lang = ffs->stringtabs; +- for (lang = ffs->stringtabs; *lang; ++lang) { +- struct usb_string *str = (*lang)->strings; +- int id = first_id; +- for (; str->s; ++id, ++str) +- str->id = id; ++ if (lang) { ++ for (; *lang; ++lang) { ++ struct usb_string *str = (*lang)->strings; ++ int id = first_id; ++ for (; str->s; ++id, ++str) ++ str->id = id; ++ } + } + + ffs->gadget = cdev->gadget; diff --git a/queue-3.15/usb-gadget-f_fs-resurect-usb_functionfs_descs_head-structure.patch b/queue-3.15/usb-gadget-f_fs-resurect-usb_functionfs_descs_head-structure.patch new file mode 100644 index 00000000000..b1f65254815 --- /dev/null +++ b/queue-3.15/usb-gadget-f_fs-resurect-usb_functionfs_descs_head-structure.patch @@ -0,0 +1,46 @@ +From 09122141785348bf9539762a5f5dbbae3761c783 Mon Sep 17 00:00:00 2001 +From: Michal Nazarewicz +Date: Fri, 13 Jun 2014 15:38:04 +0200 +Subject: usb: gadget: f_fs: resurect usb_functionfs_descs_head structure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Nazarewicz + +commit 09122141785348bf9539762a5f5dbbae3761c783 upstream. + +Even though usb_functionfs_descs_head structure is now deprecated, +it has been used by some user space tools. Its removel in commit +[ac8dde1: “Add flags to descriptors block”] was an oversight +leading to build breakage for such tools. + +Bring it back so that old user space tools can still be build +without problems on newer kernel versions. + +Reported-by: Lad, Prabhakar +Reported-by: Krzysztof Opasiak +Signed-off-by: Michal Nazarewicz +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + include/uapi/linux/usb/functionfs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/include/uapi/linux/usb/functionfs.h ++++ b/include/uapi/linux/usb/functionfs.h +@@ -33,6 +33,13 @@ struct usb_endpoint_descriptor_no_audio + __u8 bInterval; + } __attribute__((packed)); + ++/* Legacy format, deprecated as of 3.14. */ ++struct usb_functionfs_descs_head { ++ __le32 magic; ++ __le32 length; ++ __le32 fs_count; ++ __le32 hs_count; ++} __attribute__((packed, deprecated)); + + /* + * Descriptors format: diff --git a/queue-3.15/usb-musb-ensure-that-cppi41-timer-gets-armed-on-premature-dma-tx-irq.patch b/queue-3.15/usb-musb-ensure-that-cppi41-timer-gets-armed-on-premature-dma-tx-irq.patch new file mode 100644 index 00000000000..5c26e1bf852 --- /dev/null +++ b/queue-3.15/usb-musb-ensure-that-cppi41-timer-gets-armed-on-premature-dma-tx-irq.patch @@ -0,0 +1,87 @@ +From c58d80f523ffc15ef4d062fc7aeb03793fe39701 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 20 Jun 2014 23:41:24 +0200 +Subject: usb: musb: Ensure that cppi41 timer gets armed on premature DMA TX irq + +From: Thomas Gleixner + +commit c58d80f523ffc15ef4d062fc7aeb03793fe39701 upstream. + +Some TI chips raise the DMA complete interrupt before the actual +transfer has been completed. The code tries to busy wait for a few +microseconds and if that fails it arms an hrtimer to recheck. So far +so good, but that has the following issue: + +CPU 0 CPU1 + +start_next_transfer(RQ1); + +DMA interrupt + if (premature_irq(RQ1)) + if (!hrtimer_active(timer)) + hrtimer_start(timer); + +hrtimer expires + timer->state = CALLBACK_RUNNING; + timer->fn() + cppi41_recheck_tx_req() + complete_request(RQ1); + if (requests_pending()) + start_next_transfer(RQ2); + + DMA interrupt + if (premature_irq(RQ2)) + if (!hrtimer_active(timer)) + hrtimer_start(timer); + timer->state = INACTIVE; + +The premature interrupt of request2 on CPU1 does not arm the timer and +therefor the request completion never happens because it checks for +!hrtimer_active(). hrtimer_active() evaluates: + + timer->state != HRTIMER_STATE_INACTIVE + +which of course evaluates to true in the above case as timer->state is +CALLBACK_RUNNING. + +That's clearly documented: + + * A timer is active, when it is enqueued into the rbtree or the + * callback function is running or it's in the state of being migrated + * to another cpu. + +But that's not what the code wants to check. The code wants to check +whether the timer is queued, i.e. whether its armed and waiting for +expiry. + +We have a helper function for this: hrtimer_is_queued(). This +evaluates: + + timer->state & HRTIMER_STATE_QUEUED + +So in the above case this evaluates to false and therefor forces the +DMA interrupt on CPU1 to call hrtimer_start(). + +Use hrtimer_is_queued() instead of hrtimer_active() and evrything is +good. + +Reported-by: Torben Hohn +Signed-off-by: Thomas Gleixner +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_cppi41.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/musb/musb_cppi41.c ++++ b/drivers/usb/musb/musb_cppi41.c +@@ -318,7 +318,7 @@ static void cppi41_dma_callback(void *pr + } + list_add_tail(&cppi41_channel->tx_check, + &controller->early_tx_list); +- if (!hrtimer_active(&controller->early_tx)) { ++ if (!hrtimer_is_queued(&controller->early_tx)) { + hrtimer_start_range_ns(&controller->early_tx, + ktime_set(0, 140 * NSEC_PER_USEC), + 40 * NSEC_PER_USEC, diff --git a/queue-3.15/usb-musb-fix-panic-upon-musb_am335x-module-removal.patch b/queue-3.15/usb-musb-fix-panic-upon-musb_am335x-module-removal.patch new file mode 100644 index 00000000000..6d735d7ec2e --- /dev/null +++ b/queue-3.15/usb-musb-fix-panic-upon-musb_am335x-module-removal.patch @@ -0,0 +1,154 @@ +From 7adb5c876e9c0677078a1e1094c6eafd29c30b74 Mon Sep 17 00:00:00 2001 +From: Ezequiel Garcia +Date: Mon, 23 Jun 2014 15:34:22 -0300 +Subject: usb: musb: Fix panic upon musb_am335x module removal + +From: Ezequiel Garcia + +commit 7adb5c876e9c0677078a1e1094c6eafd29c30b74 upstream. + +At probe time, the musb_am335x driver register its childs by +calling of_platform_populate(), which registers all childs in +the devicetree hierarchy recursively. + +On the other side, the driver's remove() function uses of_device_unregister() +to remove each child of musb_am335x's. + +However, when musb_dsps is loaded, its devices are attached to the musb_am335x +device as musb_am335x childs. Hence, musb_am335x remove() will attempt to +unregister the devices registered by musb_dsps, which produces a kernel panic. + +In other words, the childs in the "struct device" hierarchy are not the same +as the childs in the "devicetree" hierarchy. + +Ideally, we should enforce the removal of the devices registered by +musb_am335x *only*, instead of all its child devices. However, because of the +recursive nature of of_platform_populate, this doesn't seem possible. + +Therefore, as the only solution at hand, this commit disables musb_am335x +driver removal capability, preventing it from being ever removed. This was +originally suggested by Sebastian Siewior: + +https://www.mail-archive.com/linux-omap@vger.kernel.org/msg104946.html + +And for reference, here's the panic upon module removal: + +musb-hdrc musb-hdrc.0.auto: remove, state 4 +usb usb1: USB disconnect, device number 1 +musb-hdrc musb-hdrc.0.auto: USB bus 1 deregistered +Unable to handle kernel NULL pointer dereference at virtual address 0000008c +pgd = de11c000 +[0000008c] *pgd=9e174831, *pte=00000000, *ppte=00000000 +Internal error: Oops: 17 [#1] ARM +Modules linked in: musb_am335x(-) musb_dsps musb_hdrc usbcore usb_common +CPU: 0 PID: 623 Comm: modprobe Not tainted 3.15.0-rc4-00001-g24efd13 #69 +task: de1b7500 ti: de122000 task.ti: de122000 +PC is at am335x_shutdown+0x10/0x28 +LR is at am335x_shutdown+0xc/0x28 +pc : [] lr : [] psr: a0000013 +sp : de123df8 ip : 00000004 fp : 00028f00 +r10: 00000000 r9 : de122000 r8 : c000e6c4 +r7 : de0e3c10 r6 : de0e3800 r5 : de624010 r4 : de1ec750 +r3 : de0e3810 r2 : 00000000 r1 : 00000001 r0 : 00000000 +Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +Control: 10c5387d Table: 9e11c019 DAC: 00000015 +Process modprobe (pid: 623, stack limit = 0xde122240) +Stack: (0xde123df8 to 0xde124000) +3de0: de0e3810 bf054488 +3e00: bf05444c de624010 60000013 bf043650 000012fc de624010 de0e3810 bf043a20 +3e20: de0e3810 bf04b240 c0635b88 c02ca37c c02ca364 c02c8db0 de1b7500 de0e3844 +3e40: de0e3810 c02c8e28 c0635b88 de02824c de0e3810 c02c884c de0e3800 de0e3810 +3e60: de0e3818 c02c5b20 bf05417c de0e3800 de0e3800 c0635b88 de0f2410 c02ca838 +3e80: bf05417c de0e3800 bf055438 c02ca8cc de0e3c10 bf054194 de0e3c10 c02ca37c +3ea0: c02ca364 c02c8db0 de1b7500 de0e3c44 de0e3c10 c02c8e28 c0635b88 de02824c +3ec0: de0e3c10 c02c884c de0e3c10 de0e3c10 de0e3c18 c02c5b20 de0e3c10 de0e3c10 +3ee0: 00000000 bf059000 a0000013 c02c5bc0 00000000 bf05900c de0e3c10 c02c5c48 +3f00: de0dd0c0 de1ec970 de0f2410 bf05929c de0f2444 bf05902c de0f2410 c02ca37c +3f20: c02ca364 c02c8db0 bf05929c de0f2410 bf05929c c02c94c8 bf05929c 00000000 +3f40: 00000800 c02c8ab4 bf0592e0 c007fc40 c00dd820 6273756d 336d615f 00783533 +3f60: c064a0ac de1b7500 de122000 de1b7500 c000e590 00000001 c000e6c4 c0060160 +3f80: 00028e70 00028e70 00028ea4 00000081 60000010 00028e70 00028e70 00028ea4 +3fa0: 00000081 c000e500 00028e70 00028e70 00028ea4 00000800 becb59f8 00027608 +3fc0: 00028e70 00028e70 00028ea4 00000081 00000001 00000001 00000000 00028f00 +3fe0: b6e6b6f0 becb59d4 000160e8 b6e6b6fc 60000010 00028ea4 00000000 00000000 +[] (am335x_shutdown) from [] (dsps_musb_exit+0x3c/0x4c [musb_dsps]) +[] (dsps_musb_exit [musb_dsps]) from [] (musb_shutdown+0x80/0x90 [musb_hdrc]) +[] (musb_shutdown [musb_hdrc]) from [] (musb_remove+0x24/0x68 [musb_hdrc]) +[] (musb_remove [musb_hdrc]) from [] (platform_drv_remove+0x18/0x1c) +[] (platform_drv_remove) from [] (__device_release_driver+0x70/0xc8) +[] (__device_release_driver) from [] (device_release_driver+0x20/0x2c) +[] (device_release_driver) from [] (bus_remove_device+0xdc/0x10c) +[] (bus_remove_device) from [] (device_del+0x104/0x198) +[] (device_del) from [] (platform_device_del+0x14/0x9c) +[] (platform_device_del) from [] (platform_device_unregister+0xc/0x20) +[] (platform_device_unregister) from [] (dsps_remove+0x18/0x38 [musb_dsps]) +[] (dsps_remove [musb_dsps]) from [] (platform_drv_remove+0x18/0x1c) +[] (platform_drv_remove) from [] (__device_release_driver+0x70/0xc8) +[] (__device_release_driver) from [] (device_release_driver+0x20/0x2c) +[] (device_release_driver) from [] (bus_remove_device+0xdc/0x10c) +[] (bus_remove_device) from [] (device_del+0x104/0x198) +[] (device_del) from [] (device_unregister+0xc/0x20) +[] (device_unregister) from [] (of_remove_populated_child+0xc/0x14 [musb_am335x]) +[] (of_remove_populated_child [musb_am335x]) from [] (device_for_each_child+0x44/0x70) +[] (device_for_each_child) from [] (am335x_child_remove+0x18/0x30 [musb_am335x]) +[] (am335x_child_remove [musb_am335x]) from [] (platform_drv_remove+0x18/0x1c) +[] (platform_drv_remove) from [] (__device_release_driver+0x70/0xc8) +[] (__device_release_driver) from [] (driver_detach+0xb4/0xb8) +[] (driver_detach) from [] (bus_remove_driver+0x4c/0xa0) +[] (bus_remove_driver) from [] (SyS_delete_module+0x128/0x1cc) +[] (SyS_delete_module) from [] (ret_fast_syscall+0x0/0x48) + +Fixes: 97238b35d5bb ("usb: musb: dsps: use proper child nodes") +Acked-by: George Cherian +Signed-off-by: Ezequiel Garcia +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_am335x.c | 23 ++++++----------------- + 1 file changed, 6 insertions(+), 17 deletions(-) + +--- a/drivers/usb/musb/musb_am335x.c ++++ b/drivers/usb/musb/musb_am335x.c +@@ -19,21 +19,6 @@ err: + return ret; + } + +-static int of_remove_populated_child(struct device *dev, void *d) +-{ +- struct platform_device *pdev = to_platform_device(dev); +- +- of_device_unregister(pdev); +- return 0; +-} +- +-static int am335x_child_remove(struct platform_device *pdev) +-{ +- device_for_each_child(&pdev->dev, NULL, of_remove_populated_child); +- pm_runtime_disable(&pdev->dev); +- return 0; +-} +- + static const struct of_device_id am335x_child_of_match[] = { + { .compatible = "ti,am33xx-usb" }, + { }, +@@ -42,13 +27,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_ + + static struct platform_driver am335x_child_driver = { + .probe = am335x_child_probe, +- .remove = am335x_child_remove, + .driver = { + .name = "am335x-usb-childs", + .of_match_table = am335x_child_of_match, + }, + }; + +-module_platform_driver(am335x_child_driver); ++static int __init am335x_child_init(void) ++{ ++ return platform_driver_register(&am335x_child_driver); ++} ++module_init(am335x_child_init); ++ + MODULE_DESCRIPTION("AM33xx child devices"); + MODULE_LICENSE("GPL v2"); diff --git a/queue-3.15/usb-musb-ux500-don-t-propagate-the-of-node.patch b/queue-3.15/usb-musb-ux500-don-t-propagate-the-of-node.patch new file mode 100644 index 00000000000..bf457ae7bde --- /dev/null +++ b/queue-3.15/usb-musb-ux500-don-t-propagate-the-of-node.patch @@ -0,0 +1,56 @@ +From 82363cf2eeafeea6ba88849f5e2febdc8a05943f Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Tue, 10 Jun 2014 10:54:16 +0200 +Subject: usb: musb: ux500: don't propagate the OF node + +From: Linus Walleij + +commit 82363cf2eeafeea6ba88849f5e2febdc8a05943f upstream. + +There is a regression in the upcoming v3.16-rc1, that is caused +by a problem that has been around for a while but now finally +hangs the system. The bootcrawl looks like this: + +pinctrl-nomadik soc:pinctrl: pin GPIO256_AF28 already +requested by a03e0000.usb_per5; cannot claim for musb-hdrc.0.auto +pinctrl-nomadik soc:pinctrl: pin-256 (musb-hdrc.0.auto) status -22 +pinctrl-nomadik soc:pinctrl: could not request pin 256 +(GPIO256_AF28) from group usb_a_1 on device pinctrl-nomadik +musb-hdrc musb-hdrc.0.auto: Error applying setting, reverse +things back +HS USB OTG: no transceiver configured +musb-hdrc musb-hdrc.0.auto: musb_init_controller failed +with status -517 +platform musb-hdrc.0.auto: Driver musb-hdrc requests +probe deferral +(...) + +The ux500 MUSB driver propagates the OF node to the dynamically +created musb-hdrc device, which is incorrect as it makes the OF +core believe there are two devices spun from the very same +DT node, which confuses other parts of the device core, notably +the pin control subsystem, which will try to apply all the pin +control settings also to the HDRC device as it gets +instantiated. (The OMAP2430 for example, does not set the +of_node member.) + +Cc: Arnd Bergmann +Acked-by: Lee Jones +Signed-off-by: Linus Walleij +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/ux500.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/musb/ux500.c ++++ b/drivers/usb/musb/ux500.c +@@ -274,7 +274,6 @@ static int ux500_probe(struct platform_d + musb->dev.parent = &pdev->dev; + musb->dev.dma_mask = &pdev->dev.coherent_dma_mask; + musb->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; +- musb->dev.of_node = pdev->dev.of_node; + + glue->dev = &pdev->dev; + glue->musb = musb; diff --git a/queue-3.15/usb-option-add-device-id-for-speedup-su9800-usb-3g-modem.patch b/queue-3.15/usb-option-add-device-id-for-speedup-su9800-usb-3g-modem.patch new file mode 100644 index 00000000000..8b84792b7ec --- /dev/null +++ b/queue-3.15/usb-option-add-device-id-for-speedup-su9800-usb-3g-modem.patch @@ -0,0 +1,48 @@ +From 1cab4c68e339086cdaff7535848e878e8f261fca Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 20 May 2014 16:27:40 +0200 +Subject: USB: option: add device ID for SpeedUp SU9800 usb 3g modem + +From: Oliver Neukum + +commit 1cab4c68e339086cdaff7535848e878e8f261fca upstream. + +Reported by Alif Mubarak Ahmad: + +This device vendor and product id is 1c9e:9800 +It is working as serial interface with generic usbserial driver. +I thought it is more suitable to use usbserial option driver, which has +better capability distinguishing between modem serial interface and +micro sd storage interface. + +[ johan: style changes ] + +Signed-off-by: Oliver Neukum +Tested-by: Alif Mubarak Ahmad +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -352,6 +352,9 @@ static void option_instat_callback(struc + /* Zoom */ + #define ZOOM_PRODUCT_4597 0x9607 + ++/* SpeedUp SU9800 usb 3g modem */ ++#define SPEEDUP_PRODUCT_SU9800 0x9800 ++ + /* Haier products */ + #define HAIER_VENDOR_ID 0x201e + #define HAIER_PRODUCT_CE100 0x2009 +@@ -1577,6 +1580,7 @@ static const struct usb_device_id option + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, ++ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, diff --git a/queue-3.15/usb-option-add-modify-olivetti-olicard-modems.patch b/queue-3.15/usb-option-add-modify-olivetti-olicard-modems.patch new file mode 100644 index 00000000000..c24689b9c90 --- /dev/null +++ b/queue-3.15/usb-option-add-modify-olivetti-olicard-modems.patch @@ -0,0 +1,67 @@ +From b0ebef36e93703e59003ad6a1a20227e47714417 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Fri, 6 Jun 2014 17:25:56 +0200 +Subject: usb: option: add/modify Olivetti Olicard modems +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit b0ebef36e93703e59003ad6a1a20227e47714417 upstream. + +Adding a couple of Olivetti modems and blacklisting the net +function on a couple which are already supported. + +Reported-by: Lars Melin +Signed-off-by: Bjørn Mork +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -375,8 +375,12 @@ static void option_instat_callback(struc + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c + #define OLIVETTI_PRODUCT_OLICARD100 0xc000 ++#define OLIVETTI_PRODUCT_OLICARD120 0xc001 ++#define OLIVETTI_PRODUCT_OLICARD140 0xc002 + #define OLIVETTI_PRODUCT_OLICARD145 0xc003 ++#define OLIVETTI_PRODUCT_OLICARD155 0xc004 + #define OLIVETTI_PRODUCT_OLICARD200 0xc005 ++#define OLIVETTI_PRODUCT_OLICARD160 0xc00a + #define OLIVETTI_PRODUCT_OLICARD500 0xc00b + + /* Celot products */ +@@ -1615,15 +1619,21 @@ static const struct usb_device_id option + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, +- +- { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), +- .driver_info = (kernel_ulong_t)&net_intf6_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), +- .driver_info = (kernel_ulong_t)&net_intf4_blacklist +- }, ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, diff --git a/queue-3.15/xhci-correct-burst-count-field-for-isoc-transfers-on-1.0-xhci-hosts.patch b/queue-3.15/xhci-correct-burst-count-field-for-isoc-transfers-on-1.0-xhci-hosts.patch new file mode 100644 index 00000000000..6a751a4fb3e --- /dev/null +++ b/queue-3.15/xhci-correct-burst-count-field-for-isoc-transfers-on-1.0-xhci-hosts.patch @@ -0,0 +1,40 @@ +From 3213b151387df0b95f4eada104f68eb1c1409cb3 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 24 Jun 2014 17:14:41 +0300 +Subject: xhci: correct burst count field for isoc transfers on 1.0 xhci hosts + +From: Mathias Nyman + +commit 3213b151387df0b95f4eada104f68eb1c1409cb3 upstream. + +The transfer burst count (TBC) field in xhci 1.0 hosts should be set +to the number of bursts needed to transfer all packets in a isoc TD. +Supported values are 0-2 (1 to 3 bursts per service interval). + +Formula for TBC calculation is given in xhci spec section 4.11.2.3: +TBC = roundup( Transfer Descriptor Packet Count / Max Burst Size +1 ) - 1 + +This patch should be applied to stable kernels since 3.0 that contain +the commit 5cd43e33b9519143f06f507dd7cbee6b7a621885 +"xhci 1.0: Set transfer burst count field." + +Suggested-by: ShiChun Ma +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3699,7 +3699,7 @@ static unsigned int xhci_get_burst_count + return 0; + + max_burst = urb->ep->ss_ep_comp.bMaxBurst; +- return roundup(total_packet_count, max_burst + 1) - 1; ++ return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1; + } + + /* diff --git a/queue-3.15/xhci-fix-runtime-suspended-xhci-from-blocking-system-suspend.patch b/queue-3.15/xhci-fix-runtime-suspended-xhci-from-blocking-system-suspend.patch new file mode 100644 index 00000000000..d7598129ba0 --- /dev/null +++ b/queue-3.15/xhci-fix-runtime-suspended-xhci-from-blocking-system-suspend.patch @@ -0,0 +1,86 @@ +From d6236f6d1d885aa19d1cd7317346fe795227a3cc Mon Sep 17 00:00:00 2001 +From: "Wang, Yu" +Date: Tue, 24 Jun 2014 17:14:44 +0300 +Subject: xhci: Fix runtime suspended xhci from blocking system suspend. + +From: "Wang, Yu" + +commit d6236f6d1d885aa19d1cd7317346fe795227a3cc upstream. + +The system suspend flow as following: +1, Freeze all user processes and kenrel threads. + +2, Try to suspend all devices. + +2.1, If pci device is in RPM suspended state, then pci driver will try +to resume it to RPM active state in the prepare stage. + +2.2, xhci_resume function calls usb_hcd_resume_root_hub to queue two +workqueue items to resume usb2&usb3 roothub devices. + +2.3, Call suspend callbacks of devices. + +2.3.1, All suspend callbacks of all hcd's children, including +roothub devices are called. + +2.3.2, Finally, hcd_pci_suspend callback is called. + +Due to workqueue threads were already frozen in step 1, the workqueue +items can't be scheduled, and the roothub devices can't be resumed in +this flow. The HCD_FLAG_WAKEUP_PENDING flag which is set in +usb_hcd_resume_root_hub won't be cleared. Finally, +hcd_pci_suspend will return -EBUSY, and system suspend fails. + +The reason why this issue doesn't show up very often is due to that +choose_wakeup will be called in step 2.3.1. In step 2.3.1, if +udev->do_remote_wakeup is not equal to device_may_wakeup(&udev->dev), then +udev will resume to RPM active for changing the wakeup settings. This +has been a lucky hit which hides this issue. + +For some special xHCI controllers which have no USB2 port, then roothub +will not match hub driver due to probe failed. Then its +do_remote_wakeup will be set to zero, and we won't be as lucky. + +xhci driver doesn't need to resume roothub devices everytime like in +the above case. It's only needed when there are pending event TRBs. + +This patch should be back-ported to kernels as old as 3.2, that +contains the commit f69e3120df82391a0ee8118e0a156239a06b2afb +"USB: XHCI: resume root hubs when the controller resumes" + +Signed-off-by: Wang, Yu +Acked-by: Alan Stern +[use readl() instead of removed xhci_readl(), reword commit message -Mathias] +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -932,7 +932,7 @@ int xhci_suspend(struct xhci_hcd *xhci) + */ + int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + { +- u32 command, temp = 0; ++ u32 command, temp = 0, status; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct usb_hcd *secondary_hcd; + int retval = 0; +@@ -1050,8 +1050,12 @@ int xhci_resume(struct xhci_hcd *xhci, b + + done: + if (retval == 0) { +- usb_hcd_resume_root_hub(hcd); +- usb_hcd_resume_root_hub(xhci->shared_hcd); ++ /* Resume root hubs only when have pending events. */ ++ status = readl(&xhci->op_regs->status); ++ if (status & STS_EINT) { ++ usb_hcd_resume_root_hub(hcd); ++ usb_hcd_resume_root_hub(xhci->shared_hcd); ++ } + } + + /* diff --git a/queue-3.15/xhci-use-correct-slot-id-when-handling-a-reset-device-command.patch b/queue-3.15/xhci-use-correct-slot-id-when-handling-a-reset-device-command.patch new file mode 100644 index 00000000000..7fce8071ae4 --- /dev/null +++ b/queue-3.15/xhci-use-correct-slot-id-when-handling-a-reset-device-command.patch @@ -0,0 +1,47 @@ +From 6fcfb0d682a8212d321a6131adc94daf0905992a Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 24 Jun 2014 17:14:40 +0300 +Subject: xhci: Use correct SLOT ID when handling a reset device command + +From: Mathias Nyman + +commit 6fcfb0d682a8212d321a6131adc94daf0905992a upstream. + +Command completion events normally include command completion status, +SLOT_ID, and a pointer to the original command. Reset device command +completion SLOT_ID may be zero according to xhci specs 4.6.11. + +VIA controllers set the SLOT_ID to zero, triggering a WARN_ON in the +command completion handler. + +Use the SLOT ID found from the original command instead. + +This patch should be applied to stable kernels since 3.13 that contain +the commit 20e7acb13ff48fbc884d5918c3697c27de63922a +"xhci: use completion event's slot id rather than dig it out of command" + +Reported-by: Saran Neti +Tested-by: Saran Neti +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1611,8 +1611,11 @@ static void handle_cmd_completion(struct + xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code); + break; + case TRB_RESET_DEV: +- WARN_ON(slot_id != TRB_TO_SLOT_ID( +- le32_to_cpu(cmd_trb->generic.field[3]))); ++ /* SLOT_ID field in reset device cmd completion event TRB is 0. ++ * Use the SLOT_ID from the command TRB instead (xhci 4.6.11) ++ */ ++ slot_id = TRB_TO_SLOT_ID( ++ le32_to_cpu(cmd_trb->generic.field[3])); + xhci_handle_cmd_reset_dev(xhci, slot_id, event); + break; + case TRB_NEC_GET_FW: