<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers, branch v3.10.66</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>s390/3215: fix tty output containing tabs</title>
<updated>2015-01-27T15:52:33+00:00</updated>
<author>
<name>Martin Schwidefsky</name>
<email>schwidefsky@de.ibm.com</email>
</author>
<published>2014-08-13T10:01:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=10baac916052c3e2e914f0f582fa0deadfb5728a'/>
<id>10baac916052c3e2e914f0f582fa0deadfb5728a</id>
<content type='text'>
commit e512d56c799517f33b301d81e9a5e0ebf30c2d1e upstream.

git commit 37f81fa1f63ad38e16125526bb2769ae0ea8d332
"n_tty: do O_ONLCR translation as a single write"
surfaced a bug in the 3215 device driver. In combination this
broke tab expansion for tty ouput.

The cause is an asymmetry in the behaviour of tty3215_ops-&gt;write
vs tty3215_ops-&gt;put_char. The put_char function scans for '\t'
but the write function does not.

As the driver has logic for the '\t' expansion remove XTABS
from c_oflag of the initial termios as well.

Reported-by: Stephen Powell &lt;zlinuxman@wowway.com&gt;
Signed-off-by: Martin Schwidefsky &lt;schwidefsky@de.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e512d56c799517f33b301d81e9a5e0ebf30c2d1e upstream.

git commit 37f81fa1f63ad38e16125526bb2769ae0ea8d332
"n_tty: do O_ONLCR translation as a single write"
surfaced a bug in the 3215 device driver. In combination this
broke tab expansion for tty ouput.

The cause is an asymmetry in the behaviour of tty3215_ops-&gt;write
vs tty3215_ops-&gt;put_char. The put_char function scans for '\t'
but the write function does not.

As the driver has logic for the '\t' expansion remove XTABS
from c_oflag of the initial termios as well.

Reported-by: Stephen Powell &lt;zlinuxman@wowway.com&gt;
Signed-off-by: Martin Schwidefsky &lt;schwidefsky@de.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>s390/3215: fix hanging console issue</title>
<updated>2015-01-27T15:52:33+00:00</updated>
<author>
<name>Martin Schwidefsky</name>
<email>schwidefsky@de.ibm.com</email>
</author>
<published>2014-07-15T15:53:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=214a899e44b238787c5893ed5e34d2f5c62eb048'/>
<id>214a899e44b238787c5893ed5e34d2f5c62eb048</id>
<content type='text'>
commit 26d766c60f4ea08cd14f0f3435a6db3d6cc2ae96 upstream.

The ccw_device_start in raw3215_start_io can fail. raw3215_try_io
does not check if the request could be started and removes any
pending timer. This can leave the system in a hanging state.
Check for pending request after raw3215_start_io and start a
timer if necessary.

Signed-off-by: Martin Schwidefsky &lt;schwidefsky@de.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 26d766c60f4ea08cd14f0f3435a6db3d6cc2ae96 upstream.

The ccw_device_start in raw3215_start_io can fail. raw3215_try_io
does not check if the request could be started and removes any
pending timer. This can leave the system in a hanging state.
Check for pending request after raw3215_start_io and start a
timer if necessary.

Signed-off-by: Martin Schwidefsky &lt;schwidefsky@de.ibm.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>mmc: sdhci: Fix sleep in atomic after inserting SD card</title>
<updated>2015-01-27T15:52:33+00:00</updated>
<author>
<name>Krzysztof Kozlowski</name>
<email>k.kozlowski@samsung.com</email>
</author>
<published>2015-01-05T09:50:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=34a322c73ac589947e5daf84375da23e1babd657'/>
<id>34a322c73ac589947e5daf84375da23e1babd657</id>
<content type='text'>
commit 2836766a9d0bd02c66073f8dd44796e6cc23848d upstream.

Sleep in atomic context happened on Trats2 board after inserting or
removing SD card because mmc_gpio_get_cd() was called under spin lock.

Fix this by moving card detection earlier, before acquiring spin lock.
The mmc_gpio_get_cd() call does not have to be protected by spin lock
because it does not access any sdhci internal data.
The sdhci_do_get_cd() call access host flags (SDHCI_DEVICE_DEAD). After
moving it out side of spin lock it could theoretically race with driver
removal but still there is no actual protection against manual card
eject.

Dmesg after inserting SD card:
[   41.663414] BUG: sleeping function called from invalid context at drivers/gpio/gpiolib.c:1511
[   41.670469] in_atomic(): 1, irqs_disabled(): 128, pid: 30, name: kworker/u8:1
[   41.677580] INFO: lockdep is turned off.
[   41.681486] irq event stamp: 61972
[   41.684872] hardirqs last  enabled at (61971): [&lt;c0490ee0&gt;] _raw_spin_unlock_irq+0x24/0x5c
[   41.693118] hardirqs last disabled at (61972): [&lt;c04907ac&gt;] _raw_spin_lock_irq+0x18/0x54
[   41.701190] softirqs last  enabled at (61648): [&lt;c0026fd4&gt;] __do_softirq+0x234/0x2c8
[   41.708914] softirqs last disabled at (61631): [&lt;c00273a0&gt;] irq_exit+0xd0/0x114
[   41.716206] Preemption disabled at:[&lt;  (null)&gt;]   (null)
[   41.721500]
[   41.722985] CPU: 3 PID: 30 Comm: kworker/u8:1 Tainted: G        W      3.18.0-rc5-next-20141121 #883
[   41.732111] Workqueue: kmmcd mmc_rescan
[   41.735945] [&lt;c0014d2c&gt;] (unwind_backtrace) from [&lt;c0011c80&gt;] (show_stack+0x10/0x14)
[   41.743661] [&lt;c0011c80&gt;] (show_stack) from [&lt;c0489d14&gt;] (dump_stack+0x70/0xbc)
[   41.750867] [&lt;c0489d14&gt;] (dump_stack) from [&lt;c0228b74&gt;] (gpiod_get_raw_value_cansleep+0x18/0x30)
[   41.759628] [&lt;c0228b74&gt;] (gpiod_get_raw_value_cansleep) from [&lt;c03646e8&gt;] (mmc_gpio_get_cd+0x38/0x58)
[   41.768821] [&lt;c03646e8&gt;] (mmc_gpio_get_cd) from [&lt;c036d378&gt;] (sdhci_request+0x50/0x1a4)
[   41.776808] [&lt;c036d378&gt;] (sdhci_request) from [&lt;c0357934&gt;] (mmc_start_request+0x138/0x268)
[   41.785051] [&lt;c0357934&gt;] (mmc_start_request) from [&lt;c0357cc8&gt;] (mmc_wait_for_req+0x58/0x1a0)
[   41.793469] [&lt;c0357cc8&gt;] (mmc_wait_for_req) from [&lt;c0357e68&gt;] (mmc_wait_for_cmd+0x58/0x78)
[   41.801714] [&lt;c0357e68&gt;] (mmc_wait_for_cmd) from [&lt;c0361c00&gt;] (mmc_io_rw_direct_host+0x98/0x124)
[   41.810480] [&lt;c0361c00&gt;] (mmc_io_rw_direct_host) from [&lt;c03620f8&gt;] (sdio_reset+0x2c/0x64)
[   41.818641] [&lt;c03620f8&gt;] (sdio_reset) from [&lt;c035a3d8&gt;] (mmc_rescan+0x254/0x2e4)
[   41.826028] [&lt;c035a3d8&gt;] (mmc_rescan) from [&lt;c003a0e0&gt;] (process_one_work+0x180/0x3f4)
[   41.833920] [&lt;c003a0e0&gt;] (process_one_work) from [&lt;c003a3bc&gt;] (worker_thread+0x34/0x4b0)
[   41.841991] [&lt;c003a3bc&gt;] (worker_thread) from [&lt;c003fed8&gt;] (kthread+0xe4/0x104)
[   41.849285] [&lt;c003fed8&gt;] (kthread) from [&lt;c000f268&gt;] (ret_from_fork+0x14/0x2c)
[   42.038276] mmc0: new high speed SDHC card at address 1234

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 94144a465dd0 ("mmc: sdhci: add get_cd() implementation")
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 2836766a9d0bd02c66073f8dd44796e6cc23848d upstream.

Sleep in atomic context happened on Trats2 board after inserting or
removing SD card because mmc_gpio_get_cd() was called under spin lock.

Fix this by moving card detection earlier, before acquiring spin lock.
The mmc_gpio_get_cd() call does not have to be protected by spin lock
because it does not access any sdhci internal data.
The sdhci_do_get_cd() call access host flags (SDHCI_DEVICE_DEAD). After
moving it out side of spin lock it could theoretically race with driver
removal but still there is no actual protection against manual card
eject.

Dmesg after inserting SD card:
[   41.663414] BUG: sleeping function called from invalid context at drivers/gpio/gpiolib.c:1511
[   41.670469] in_atomic(): 1, irqs_disabled(): 128, pid: 30, name: kworker/u8:1
[   41.677580] INFO: lockdep is turned off.
[   41.681486] irq event stamp: 61972
[   41.684872] hardirqs last  enabled at (61971): [&lt;c0490ee0&gt;] _raw_spin_unlock_irq+0x24/0x5c
[   41.693118] hardirqs last disabled at (61972): [&lt;c04907ac&gt;] _raw_spin_lock_irq+0x18/0x54
[   41.701190] softirqs last  enabled at (61648): [&lt;c0026fd4&gt;] __do_softirq+0x234/0x2c8
[   41.708914] softirqs last disabled at (61631): [&lt;c00273a0&gt;] irq_exit+0xd0/0x114
[   41.716206] Preemption disabled at:[&lt;  (null)&gt;]   (null)
[   41.721500]
[   41.722985] CPU: 3 PID: 30 Comm: kworker/u8:1 Tainted: G        W      3.18.0-rc5-next-20141121 #883
[   41.732111] Workqueue: kmmcd mmc_rescan
[   41.735945] [&lt;c0014d2c&gt;] (unwind_backtrace) from [&lt;c0011c80&gt;] (show_stack+0x10/0x14)
[   41.743661] [&lt;c0011c80&gt;] (show_stack) from [&lt;c0489d14&gt;] (dump_stack+0x70/0xbc)
[   41.750867] [&lt;c0489d14&gt;] (dump_stack) from [&lt;c0228b74&gt;] (gpiod_get_raw_value_cansleep+0x18/0x30)
[   41.759628] [&lt;c0228b74&gt;] (gpiod_get_raw_value_cansleep) from [&lt;c03646e8&gt;] (mmc_gpio_get_cd+0x38/0x58)
[   41.768821] [&lt;c03646e8&gt;] (mmc_gpio_get_cd) from [&lt;c036d378&gt;] (sdhci_request+0x50/0x1a4)
[   41.776808] [&lt;c036d378&gt;] (sdhci_request) from [&lt;c0357934&gt;] (mmc_start_request+0x138/0x268)
[   41.785051] [&lt;c0357934&gt;] (mmc_start_request) from [&lt;c0357cc8&gt;] (mmc_wait_for_req+0x58/0x1a0)
[   41.793469] [&lt;c0357cc8&gt;] (mmc_wait_for_req) from [&lt;c0357e68&gt;] (mmc_wait_for_cmd+0x58/0x78)
[   41.801714] [&lt;c0357e68&gt;] (mmc_wait_for_cmd) from [&lt;c0361c00&gt;] (mmc_io_rw_direct_host+0x98/0x124)
[   41.810480] [&lt;c0361c00&gt;] (mmc_io_rw_direct_host) from [&lt;c03620f8&gt;] (sdio_reset+0x2c/0x64)
[   41.818641] [&lt;c03620f8&gt;] (sdio_reset) from [&lt;c035a3d8&gt;] (mmc_rescan+0x254/0x2e4)
[   41.826028] [&lt;c035a3d8&gt;] (mmc_rescan) from [&lt;c003a0e0&gt;] (process_one_work+0x180/0x3f4)
[   41.833920] [&lt;c003a0e0&gt;] (process_one_work) from [&lt;c003a3bc&gt;] (worker_thread+0x34/0x4b0)
[   41.841991] [&lt;c003a3bc&gt;] (worker_thread) from [&lt;c003fed8&gt;] (kthread+0xe4/0x104)
[   41.849285] [&lt;c003fed8&gt;] (kthread) from [&lt;c000f268&gt;] (ret_from_fork+0x14/0x2c)
[   42.038276] mmc0: new high speed SDHC card at address 1234

Signed-off-by: Krzysztof Kozlowski &lt;k.kozlowski@samsung.com&gt;
Fixes: 94144a465dd0 ("mmc: sdhci: add get_cd() implementation")
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Input: I8042 - add Acer Aspire 7738 to the nomux list</title>
<updated>2015-01-27T15:52:33+00:00</updated>
<author>
<name>Dmitry Torokhov</name>
<email>dmitry.torokhov@gmail.com</email>
</author>
<published>2015-01-08T22:53:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=beca3ef9283f3dd2e00f34f42e068fbdb96619df'/>
<id>beca3ef9283f3dd2e00f34f42e068fbdb96619df</id>
<content type='text'>
commit 9333caeaeae4f831054e0e127a6ed3948b604d3e upstream.

When KBC is in active multiplexing mode the touchpad on this laptop does
not work.

Reported-by: Bilal Koc &lt;koc.bilo@googlemail.com&gt;
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9333caeaeae4f831054e0e127a6ed3948b604d3e upstream.

When KBC is in active multiplexing mode the touchpad on this laptop does
not work.

Reported-by: Bilal Koc &lt;koc.bilo@googlemail.com&gt;
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Input: i8042 - reset keyboard to fix Elantech touchpad detection</title>
<updated>2015-01-27T15:52:32+00:00</updated>
<author>
<name>Srihari Vijayaraghavan</name>
<email>linux.bug.reporting@gmail.com</email>
</author>
<published>2015-01-08T00:25:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=bdf5d03391206438cb73d7622d5bf42014241487'/>
<id>bdf5d03391206438cb73d7622d5bf42014241487</id>
<content type='text'>
commit 148e9a711e034e06310a8c36b64957934ebe30f2 upstream.

On some laptops, keyboard needs to be reset in order to successfully detect
touchpad (e.g., some Gigabyte laptop models with Elantech touchpads).
Without resettin keyboard touchpad pretends to be completely dead.

Based on the original patch by Mateusz Jończyk this version has been
expanded to include DMI based detection &amp; application of the fix
automatically on the affected models of laptops. This has been confirmed to
fix problem by three users already on three different models of laptops.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81331
Signed-off-by: Srihari Vijayaraghavan &lt;linux.bug.reporting@gmail.com&gt;
Acked-by: Mateusz Jończyk &lt;mat.jonczyk@o2.pl&gt;
Tested-by: Srihari Vijayaraghavan &lt;linux.bug.reporting@gmail.com&gt;
Tested by: Zakariya Dehlawi &lt;zdehlawi@gmail.com&gt;
Tested-by: Guillaum Bouchard &lt;guillaum.bouchard@gmail.com&gt;
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 148e9a711e034e06310a8c36b64957934ebe30f2 upstream.

On some laptops, keyboard needs to be reset in order to successfully detect
touchpad (e.g., some Gigabyte laptop models with Elantech touchpads).
Without resettin keyboard touchpad pretends to be completely dead.

Based on the original patch by Mateusz Jończyk this version has been
expanded to include DMI based detection &amp; application of the fix
automatically on the affected models of laptops. This has been confirmed to
fix problem by three users already on three different models of laptops.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81331
Signed-off-by: Srihari Vijayaraghavan &lt;linux.bug.reporting@gmail.com&gt;
Acked-by: Mateusz Jończyk &lt;mat.jonczyk@o2.pl&gt;
Tested-by: Srihari Vijayaraghavan &lt;linux.bug.reporting@gmail.com&gt;
Tested by: Zakariya Dehlawi &lt;zdehlawi@gmail.com&gt;
Tested-by: Guillaum Bouchard &lt;guillaum.bouchard@gmail.com&gt;
Signed-off-by: Dmitry Torokhov &lt;dmitry.torokhov@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>can: kvaser_usb: Don't send a RESET_CHIP for non-existing channels</title>
<updated>2015-01-27T15:52:32+00:00</updated>
<author>
<name>Ahmed S. Darwish</name>
<email>ahmed.darwish@valeo.com</email>
</author>
<published>2015-01-05T17:57:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=74f52d3e778e424329276414dfa3ff18940ad3bc'/>
<id>74f52d3e778e424329276414dfa3ff18940ad3bc</id>
<content type='text'>
commit 5e7e6e0c9b47a45576c38b4a72d67927a5e049f7 upstream.

Recent Leaf firmware versions (&gt;= 3.1.557) do not allow to send
commands for non-existing channels.  If a command is sent for a
non-existing channel, the firmware crashes.

Reported-by: Christopher Storah &lt;Christopher.Storah@invetech.com.au&gt;
Signed-off-by: Olivier Sobrie &lt;olivier@sobrie.be&gt;
Signed-off-by: Ahmed S. Darwish &lt;ahmed.darwish@valeo.com&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 5e7e6e0c9b47a45576c38b4a72d67927a5e049f7 upstream.

Recent Leaf firmware versions (&gt;= 3.1.557) do not allow to send
commands for non-existing channels.  If a command is sent for a
non-existing channel, the firmware crashes.

Reported-by: Christopher Storah &lt;Christopher.Storah@invetech.com.au&gt;
Signed-off-by: Olivier Sobrie &lt;olivier@sobrie.be&gt;
Signed-off-by: Ahmed S. Darwish &lt;ahmed.darwish@valeo.com&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>can: kvaser_usb: Reset all URB tx contexts upon channel close</title>
<updated>2015-01-27T15:52:32+00:00</updated>
<author>
<name>Ahmed S. Darwish</name>
<email>ahmed.darwish@valeo.com</email>
</author>
<published>2015-01-05T17:52:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a642edcae9ed114ea0d1dd33046d17422728b131'/>
<id>a642edcae9ed114ea0d1dd33046d17422728b131</id>
<content type='text'>
commit 889b77f7fd2bcc922493d73a4c51d8a851505815 upstream.

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in very high frequency (*), closing the CAN channel while
all the transmissions are on (#), opening the device again (@),
then sending a small number of packets would make the driver
enter an almost infinite loop of:

[....]
[15959.853988] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853990] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853991] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853993] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853994] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853995] kvaser_usb 4-3:1.0 can0: cannot find free context
[....]

_dragging the whole system down_ in the process due to the
excessive logging output.

Initially, this has caused random panics in the kernel due to a
buggy error recovery path.  That got fixed in an earlier commit.(%)
This patch aims at solving the root cause. --&gt;

16 tx URBs and contexts are allocated per CAN channel per USB
device. Such URBs are protected by:

a) A simple atomic counter, up to a value of MAX_TX_URBS (16)
b) A flag in each URB context, stating if it's free
c) The fact that ndo_start_xmit calls are themselves protected
   by the networking layers higher above

After grabbing one of the tx URBs, if the driver noticed that all
of them are now taken, it stops the netif transmission queue.
Such queue is worken up again only if an acknowedgment was received
from the firmware on one of our earlier-sent frames.

Meanwhile, upon channel close (#), the driver sends a CMD_STOP_CHIP
to the firmware, effectively closing all further communication.  In
the high traffic case, the atomic counter remains at MAX_TX_URBS,
and all the URB contexts remain marked as active.  While opening
the channel again (@), it cannot send any further frames since no
more free tx URB contexts are available.

Reset all tx URB contexts upon CAN channel close.

(*) 50 parallel instances of `cangen0 -g 0 -ix`
(#) `ifconfig can0 down`
(@) `ifconfig can0 up`
(%) "can: kvaser_usb: Don't free packets when tight on URBs"

Signed-off-by: Ahmed S. Darwish &lt;ahmed.darwish@valeo.com&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 889b77f7fd2bcc922493d73a4c51d8a851505815 upstream.

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in very high frequency (*), closing the CAN channel while
all the transmissions are on (#), opening the device again (@),
then sending a small number of packets would make the driver
enter an almost infinite loop of:

[....]
[15959.853988] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853990] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853991] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853993] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853994] kvaser_usb 4-3:1.0 can0: cannot find free context
[15959.853995] kvaser_usb 4-3:1.0 can0: cannot find free context
[....]

_dragging the whole system down_ in the process due to the
excessive logging output.

Initially, this has caused random panics in the kernel due to a
buggy error recovery path.  That got fixed in an earlier commit.(%)
This patch aims at solving the root cause. --&gt;

16 tx URBs and contexts are allocated per CAN channel per USB
device. Such URBs are protected by:

a) A simple atomic counter, up to a value of MAX_TX_URBS (16)
b) A flag in each URB context, stating if it's free
c) The fact that ndo_start_xmit calls are themselves protected
   by the networking layers higher above

After grabbing one of the tx URBs, if the driver noticed that all
of them are now taken, it stops the netif transmission queue.
Such queue is worken up again only if an acknowedgment was received
from the firmware on one of our earlier-sent frames.

Meanwhile, upon channel close (#), the driver sends a CMD_STOP_CHIP
to the firmware, effectively closing all further communication.  In
the high traffic case, the atomic counter remains at MAX_TX_URBS,
and all the URB contexts remain marked as active.  While opening
the channel again (@), it cannot send any further frames since no
more free tx URB contexts are available.

Reset all tx URB contexts upon CAN channel close.

(*) 50 parallel instances of `cangen0 -g 0 -ix`
(#) `ifconfig can0 down`
(@) `ifconfig can0 up`
(%) "can: kvaser_usb: Don't free packets when tight on URBs"

Signed-off-by: Ahmed S. Darwish &lt;ahmed.darwish@valeo.com&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>can: kvaser_usb: Don't free packets when tight on URBs</title>
<updated>2015-01-27T15:52:32+00:00</updated>
<author>
<name>Ahmed S. Darwish</name>
<email>ahmed.darwish@valeo.com</email>
</author>
<published>2015-01-05T17:49:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=853a4bc8853520f75d0b35fc0b0951eb6999b58a'/>
<id>853a4bc8853520f75d0b35fc0b0951eb6999b58a</id>
<content type='text'>
commit b442723fcec445fb0ae1104888dd22cd285e0a91 upstream.

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in high frequency caused seemingly-random panics in the
kernel.

On further inspection, it seems the driver erroneously freed the
to-be-transmitted packet upon getting tight on URBs and returning
NETDEV_TX_BUSY, leading to invalid memory writes and double frees
at a later point in time.

Note:

Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
is a driver bug in and out of itself: it means that our start/stop
queue flow control is broken.

This patch only fixes the (buggy) error handling code; the root
cause shall be fixed in a later commit.

Acked-by: Olivier Sobrie &lt;olivier@sobrie.be&gt;
Signed-off-by: Ahmed S. Darwish &lt;ahmed.darwish@valeo.com&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit b442723fcec445fb0ae1104888dd22cd285e0a91 upstream.

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in high frequency caused seemingly-random panics in the
kernel.

On further inspection, it seems the driver erroneously freed the
to-be-transmitted packet upon getting tight on URBs and returning
NETDEV_TX_BUSY, leading to invalid memory writes and double frees
at a later point in time.

Note:

Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
is a driver bug in and out of itself: it means that our start/stop
queue flow control is broken.

This patch only fixes the (buggy) error handling code; the root
cause shall be fixed in a later commit.

Acked-by: Olivier Sobrie &lt;olivier@sobrie.be&gt;
Signed-off-by: Ahmed S. Darwish &lt;ahmed.darwish@valeo.com&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>USB: keyspan: fix null-deref at probe</title>
<updated>2015-01-27T15:52:32+00:00</updated>
<author>
<name>Johan Hovold</name>
<email>johan@kernel.org</email>
</author>
<published>2014-12-22T17:39:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b9e33b264083ffd7d9d2ad301c3c336e7519a99f'/>
<id>b9e33b264083ffd7d9d2ad301c3c336e7519a99f</id>
<content type='text'>
commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream.

Fix null-pointer dereference during probe if the interface-status
completion handler is called before the individual ports have been set
up.

Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and
memory leaks")
Reported-by: Richard &lt;richjunk@pacbell.net&gt;
Tested-by: Richard &lt;richjunk@pacbell.net&gt;
Signed-off-by: Johan Hovold &lt;johan@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream.

Fix null-pointer dereference during probe if the interface-status
completion handler is called before the individual ports have been set
up.

Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and
memory leaks")
Reported-by: Richard &lt;richjunk@pacbell.net&gt;
Tested-by: Richard &lt;richjunk@pacbell.net&gt;
Signed-off-by: Johan Hovold &lt;johan@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices</title>
<updated>2015-01-27T15:52:32+00:00</updated>
<author>
<name>David Peterson</name>
<email>david.peterson@cel.com</email>
</author>
<published>2015-01-06T15:00:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=11959cfbb097164fc01fdcb0d9a4fa47628a91fd'/>
<id>11959cfbb097164fc01fdcb0d9a4fa47628a91fd</id>
<content type='text'>
commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream.

Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks
devices.

Signed-off-by: David Peterson &lt;david.peterson@cel.com&gt;
Signed-off-by: Johan Hovold &lt;johan@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream.

Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks
devices.

Signed-off-by: David Peterson &lt;david.peterson@cel.com&gt;
Signed-off-by: Johan Hovold &lt;johan@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
