linux/drivers/mfd/rtsx_usb.c, branch v4.2

mfd: rtsx_usb: Prevent DMA from stack

2015-03-12T09:27:41Z

Functions rtsx_usb_ep0_read_register() and rtsx_usb_get_card_status() both use arbitrary buffer addresses from arguments directly for DMA and the buffers could be located in stack. This was caught by DMA-API debug check. Fixes this by using double-buffers via kzalloc in both functions to guarantee the validity of DMA buffer. WARNING: CPU: 1 PID: 25 at lib/dma-debug.c:1166 check_for_stack+0x96/0xe0() ehci-pci 0000:00:1a.0: DMA-API: device driver maps memory from stack [addr=ffff8801199e3cef] Modules linked in: rtsx_usb_ms arc4 memstick intel_rapl iosf_mbi rtl8192ce snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel rtl_pci rtl8192c_common snd_hda_controller x86_pkg_temp_thermal snd_hda_codec rtlwifi mac80211 coretemp kvm_intel kvm iTCO_wdt snd_hwdep snd_seq snd_seq_device crct10dif_pclmul iTCO_vendor_support sparse_keymap cfg80211 crc32_pclmul snd_pcm crc32c_intel ghash_clmulni_intel rfkill i2c_i801 snd_timer shpchp snd serio_raw mei_me lpc_ich soundcore mei tpm_tis tpm wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc i915 rtsx_usb_sdmmc mmc_core 8021q uas garp stp i2c_algo_bit llc mrp drm_kms_helper usb_storage drm rtsx_usb mfd_core r8169 mii video CPU: 1 PID: 25 Comm: kworker/1:2 Not tainted 3.20.0-0.rc0.git7.3.fc22.x86_64 #1 Hardware name: WB WB-B06211/WB-B0621, BIOS EB062IWB V1.0 12/12/2013 Workqueue: events rtsx_usb_ms_handle_req [rtsx_usb_ms] 0000000000000000 000000003d188e66 ffff8801199e3808 ffffffff8187642b 0000000000000000 ffff8801199e3860 ffff8801199e3848 ffffffff810ab39a ffff8801199e3864 ffff8801199e3cef ffff880119b57098 ffff880119b37320 Call Trace: [] dump_stack+0x4c/0x65 [] warn_slowpath_common+0x8a/0xc0 [] warn_slowpath_fmt+0x55/0x70 [] ? _raw_spin_unlock_irqrestore+0x36/0x70 [] check_for_stack+0x96/0xe0 [] debug_dma_map_page+0x104/0x150 [] usb_hcd_map_urb_for_dma+0x646/0x790 [] usb_hcd_submit_urb+0x1d5/0xa90 [] ? mark_held_locks+0x7f/0xc0 [] ? mark_held_locks+0x7f/0xc0 [] ? lockdep_init_map+0x65/0x5d0 [] usb_submit_urb+0x42e/0x5f0 [] usb_start_wait_urb+0x77/0x190 [] ? __kmalloc+0x205/0x2d0 [] usb_control_msg+0xdc/0x130 [] rtsx_usb_ep0_read_register+0x59/0x70 [rtsx_usb] [] ? rtsx_usb_get_rsp+0x41/0x50 [rtsx_usb] [] rtsx_usb_ms_handle_req+0x7ce/0x9c5 [rtsx_usb_ms] Reported-by: Josh Boyer Signed-off-by: Roger Tseng Signed-off-by: Lee Jones

mfd: rtsx_usb: Defer autosuspend while card exists

2015-01-22T16:08:02Z

A card insertion happens after the lastest polling before reader is suspended may never have a chance to be detected. Under current 1-HZ polling interval setting in mmc_core, the worst case of such undetectablility is about 1 second. To further reduce the undetectability, detect card slot again in suspend method and defer the autosuspend if the slot is loaded. The default 2 second autosuspend delay of USB subsystem should let the next polling detects the card. Signed-off-by: Roger Tseng Signed-off-by: Lee Jones

mfd: rtsx_usb: Fix runtime PM deadlock

2015-01-20T12:52:55Z

sd_set_power_mode() in derived module drivers/mmc/host/rtsx_usb_sdmmc.c acquires dev_mutex and then calls pm_runtime_get_sync() to make sure the device is awake while initializing a newly inserted card. Once it is called during suspending state and explicitly before rtsx_usb_suspend() acquires the same dev_mutex, both routine deadlock and further hang the driver because pm_runtime_get_sync() waits the pending PM operations. Fix this by using an empty suspend method. mmc_core always turns the LED off after a request is done and thus it is ok to remove the only rtsx_usb_turn_off_led() here. Cc: # v3.16+ Fixes: 730876be2566 ("mfd: Add realtek USB card reader driver") Signed-off-by: Roger Tseng [Lee: Removed newly unused variable] Signed-off-by: Lee Jones

mfd: Use mfd_add_hotplug_devices() helper

2014-11-25T16:18:42Z

Use mfd_add_hotplug_devices helper to register the subdevices. Signed-off-by: Johan Hovold Signed-off-by: Lee Jones

mfd: rtsx_usb: Fix decimal printf format specifiers prefixed with 0x

2014-09-26T07:15:38Z

The prefix suggests the number should be printed in hex, so use the %x specifier to do that. Found by using regex suggested by Joe Perches. Signed-off-by: Hans Wennborg Signed-off-by: Lee Jones

drivers/mfd/rtsx_usb.c: export device table

2014-08-14T16:56:15Z

The rtsx_usb driver contains the table for the devices it supports but doesn't export it. As a result, no alias is generated and it doesn't get loaded automatically. Via https://bugzilla.novell.com/show_bug.cgi?id=890096 Signed-off-by: Jeff Mahoney Reported-by: Marcel Witte Cc: Roger Tseng Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

mfd: rtsx_usb: Make mfd_cell array const

2014-06-03T07:11:39Z

mfd_add_devices() expects array of struct mfd_cell to be const. Signed-off-by: Krzysztof Kozlowski Acked-by: Roger Tseng Signed-off-by: Lee Jones

mfd: rtsx_usb: Add comment in rtsx_usb_suspend

2014-04-28T10:01:18Z

Explain why there is no need to have a symmetric LED turn-on in resume handler while calling rtsx_usb_turn_off_led() in suspend handler. Signed-off-by: Roger Tseng Signed-off-by: Lee Jones

mfd: rtsx_usb: Fix possible race condition

2014-04-28T10:00:57Z

Fix two possible race condition generated by misuse of del_timer in rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices in rtsx_usb_probe(). Signed-off-by: Roger Tseng Signed-off-by: Lee Jones

mfd: Add realtek USB card reader driver

2014-03-19T08:58:18Z

Realtek USB card reader provides a channel to transfer command or data to flash memory cards. This driver exports host instances for mmc and memstick subsystems and handles basic works. Acked-by: Greg Kroah-Hartman Signed-off-by: Roger Tseng Signed-off-by: Lee Jones