instead of limiting link TRB only to Isoc endpoints,
let's use it for all endpoint types, this way we are
more likely to transfer more data before a
XferComplete event.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
By moving our % DWC3_NUM_TRB operation to the
increment helpers, the rest of the driver can be
simplified.
It's also a good practice to make sure we will have
a single place dealing with details about how to
increment our enqueue and dequeue pointers.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Add three little helpers which will aid in making
the code slightly easier to read. One helper
increments enqueue pointer, another increments
dequeue pointer and the last one tests if we're
dealing with the last TRB.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
instead of using a bitwise and, let's rely on the %
operator since that's a lot more clear. Also, GCC
will optimize % 256 to nothing anyway.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
We *know* that we have 1 PAGE (4096 bytes) for our
TRB poll. We also know the size of each TRB and know
that we can fit 256 of them in one PAGE. By using a
u8 type we can make sure that:
enqueue++ % 256;
gets optimized to an increment only.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
This makes it clear that we're dealing with a queue
of TRBs. No functional changes. While at that, also
rename start_slot to first_trb_index for similar
reasons.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
The DWC3 OMAP driver supports DT-boot only, as result dma_mask will be
always configured properly from DT -
of_platform_device_create_pdata()->of_dma_configure(). More over,
dwc3-omap.c can be built as module and in this case it's unsafe to
assign local variable as dma_mask.
Hence, remove dma_mask configuration code.
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Some freescale QorIQ platforms require to disable receiver detection
in P3 for correct detection of USB devices. If GUSB3PIPECTL(DISRXDETINP3)
is set, Core will change PHY power state to P2 and then perform receiver
detection. After receiver detection, Core will change PHY power state to
P3. Same quirk would be added in dts file in future patches.
Signed-off-by: Sriram Dash <sriram.dash@nxp.com>
Signed-off-by: Rajesh Bhagat <rajesh.bhagat@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Synopsys Databook says we should move link to U0
before issuing a Start Transfer command. We could
require the gadget driver to call
usb_gadget_wakeup() however I feel that changing all
gadget drivers to keep track of Link State and
conditionally call usb_gadget_wakeup() would be far
too much work. For now we will handle this at the
UDC level, but at some point composite.c should be
one handling this.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Synopsys Databook 2.60a has a note that if we're
sending an endpoint command we _must_ make sure that
DWC3_GUSB2PHY(n).SUSPHY bit is cleared.
This patch implements that particular detail.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
dwc3_send_gadget_ep_cmd() had three return
points. That becomes a pain to track when we need to
debug something or if we need to add more code
before returning.
Let's combine all three return points into a single
one just by introducing a local 'ret' variable.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Sort IDs in groups to be easily found when needed.
There is no functional change.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
It seems there are leftovers of some assignments which are not used
anymore. Compiler even warns us about:
drivers/usb/gadget/udc/pch_udc.c:2022:22: warning: variable ‘dev’ set \
but not used [-Wunused-but-set-variable]
drivers/usb/gadget/udc/pch_udc.c:2639:9: warning: variable ‘ret’ set \
but not used [-Wunused-but-set-variable]
Remove them and shut compiler about.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Try to enable MSI in case hardware supports it. At least Intel Quark is
known SoC which indeed does.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
devres API allows to make error paths cleaner and less error
prone. Convert the driver to use it.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
There is no need to repeat the work that is already done in the PCI
driver core. The patch removes excerpts from suspend and resume
callbacks.
Note that there is no more calls performed to enable or disable a PCI
device during suspend-resume cycle. Nowadays they seems to be
superfluous. Someone can read more in [1].
While here, convert PM ops to use modern API.
[1] https://www.kernel.org/doc/ols/2009/ols2009-pages-319-330.pdf
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[felipe.balbi@linux.intel.com: fixed build break and checkpatch error ]
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
The phy-am335x driver selects 'USB_COMMON', but all other drivers
use 'depends on' for that symbol, and it depends on USB || USB_GADGET
itself, which causes a Kconfig warning:
warning: (AM335X_PHY_USB) selects USB_COMMON which has unmet direct dependencies (USB_SUPPORT && (USB || USB_GADGET))
As suggested by Felipe Balbi, this turns the logic around, and makes
'USB_COMMON' selected by everything else that needs it, so we can
remove the dependencies.
Fixes: 59f042f644 ("usb: phy: phy-am335x: bypass first VBUS sensing for host-only mode")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Felipe Balbi <balbi@kernel.org>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
we don't plan on using multiple event buffers, but
if we find a good use case for it, this little trick
will help us avoid a loop in hardirq handler looping
for each and every event buffer.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
we will be using a single event buffer and that
renders ev_buffs array unnecessary. Let's remove it
in favor of a single pointer to a single event
buffer.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
We never, ever route any of the other event buffers
so we might as well drop support for them.
Until someone has a real, proper benefit for
multiple event buffers, we will rely on a single
one. This also helps reduce memory footprint of
dwc3.ko which won't allocate memory for the extra
event buffers.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
coccicheck found this pattern which could be
converted to PTR_ERR_OR_ZERO(). No functional
changes.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
coccicheck found this pattern which could be
converted to PTR_ERR_OR_ZERO(). No functional
changes.
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
request_list and req_queued were, well, weird naming
choices.
Let's give those better names and call them,
respectively, pending_list and started_list. These
new names better reflect what these lists are
supposed to do.
While at that also rename req->queued to req->started.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
previously we were using a maximum of 32 TRBs per
endpoint. With each TRB being 16 bytes long, we were
using 512 bytes of memory for each endpoint.
However, SLAB/SLUB will always allocate PAGE_SIZE
chunks. In order to better utilize the memory we
allocate and to allow deeper queues for gadgets
which would benefit from it (g_ether comes to mind),
let's increase the maximum to 256 TRBs which rounds
up to 4096 bytes for each endpoint.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
CSP bit of TRB Control is useful for protocols such
CDC EEM/ECM/NCM where we're transferring in blocks
of MTU-sized requests (usually MTU is 1500 bytes).
We know we will always have a short packet after two
(for HS) wMaxPacketSize packets and, usually, we
will have a long(-ish) queue of requests (for our
g_ether gadget, we have at least 10
requests).
Instead of always stopping the queue processing to
interrupt, giveback and restart, let's tell dwc3 to
interrupt but continue processing following request
if we have anything already pending in the queue.
This gave me a considerable improvement of 40% on my
test setup.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
That FIFO resizing logic was added to support OMAP5
ES1.0 which had a bogus default FIFO size. I can't
remember the exact size of default FIFO, but it was
less than one bulk superspeed packet (<1024) which
would prevent USB3 from ever working on OMAP5 ES1.0.
However, OMAP5 ES1.0 support has been dropped by
commit aa2f4b16f8 ("ARM: OMAP5: id: Remove ES1.0
support") which renders FIFO resizing unnecessary.
Tested-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Here are some USB fixes and new device ids for 4.6-rc3.
Nothing major, the normal USB gadget fixes and usb-serial driver ids,
along with some other fixes mixed in. All except the USB serial ids
have been tested in linux-next, the id additions should be fine as they
are "trivial".
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iEYEABECAAYFAlcJLLUACgkQMUfUDdst+ym3wgCeNSzb74ZskDbGsXUooE0XhYRc
iPoAnRpn/ahoBTzmkKiQXQ1+Br8pAUtN
=vyU/
-----END PGP SIGNATURE-----
Merge tag 'usb-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some USB fixes and new device ids for 4.6-rc3.
Nothing major, the normal USB gadget fixes and usb-serial driver ids,
along with some other fixes mixed in. All except the USB serial ids
have been tested in linux-next, the id additions should be fine as
they are 'trivial'"
* tag 'usb-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
USB: option: add "D-Link DWM-221 B1" device id
USB: serial: cp210x: Adding GE Healthcare Device ID
USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
usb: dwc3: keystone: drop dma_mask configuration
usb: gadget: udc-core: remove manual dma configuration
usb: dwc3: pci: add ID for one more Intel Broxton platform
usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
usb: dwc2: do not override forced dr_mode in gadget setup
usb: gadget: f_midi: unlock on error
USB: digi_acceleport: do sanity checking for the number of ports
USB: cypress_m8: add endpoint sanity check
USB: mct_u232: add sanity checking in probe
usb: fix regression in SuperSpeed endpoint descriptor parsing
USB: usbip: fix potential out-of-bounds write
usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize
usb: phy: qcom-8x16: fix regulator API abuse
usb: ch9: Fix SSP Device Cap wFunctionalitySupport type
usb: gadget: composite: Access SSP Dev Cap fields properly
...
Here are some new device ids.
Signed-off-by: Johan Hovold <johan@kernel.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJXB7dGAAoJEEEN5E/e4bSVmqsQALLjUGRr+eM/JE8XbeyATSE7
5sYuxgX+9Yzp3+ePCmbxZvmKd/7ZRyrloCsE9e292AT1fx4XynArnJeX0Ad4SSuj
bNpN9gB2culcZuUQ8T7BOieBwlj+gzYLmsaCrnl7Pf7XwrMcsHhY3fuyWs+YaC6W
b6hJ9KgWm5CzRKGrBJjV43tOb2LZKemQmFuccu33igsGmdTKuGrPPewrPHriVsgr
+yUWDdCNs0t00436I8Z18YSRGiKFi1RxmOPleWRL8FVsr9GoZNUV2xlc1cKblqSd
msgfAgmj5FB/0aUog648K1IV+hdqvpSP4SXD3sytKfFCL4qFCVzy0hzMt9dJMl5A
WQBZUhN1j2AJ7qMtAyQDjR4Y/QbX+rBIKjBgRgbdB5dLonoQ+lw++zacz4Al9FK2
vKwCuBl5nr/ReXd7zqZ3YBnlo6Kdu17Ba4HkNurk/zqG8tOZFWyDrqPw/KmrOwQW
1UPIjjWGR7o4zDJa5H+XIQCTPsGoeQJuncJG3akGAwRzVe0+jmaCWnkwnJRgtXZl
kwpa41VaP6nXUIty+/xRFvOU/wMo0pVSda+ok/2TWUfifKomkxcju397bIe2MT82
31aMNmbZyf+Zz/K5Hy+Sg+5Gat+82yDn7og57T+K3i+8m4/eVTFdHSCGf3B5iJxd
6ALqRa//5lfGa8mkHutv
=vUqa
-----END PGP SIGNATURE-----
Merge tag 'usb-serial-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:
USB-serial fixes for v4.6-rc3
Here are some new device ids.
Signed-off-by: Johan Hovold <johan@kernel.org>
We have two more fixes to f_midi. It should now
behave much better.
dwc3-keystone.c has gotten a fix which now allows it
to work on keystone device when running in
peripheral mode. A similar fix for DMA configuration
was made for udc-core, too.
We have a new PCI ID for Intel's Broxton
platform. DWC3 can run on those platforms as well.
And we also have some dwc2 got a fix for dr_mode
usage, while renesas controller got 3 important
fixes: a NULL pointer deref fix, IRQ <-> DMA race
fix, and a fix to prevent a situation where we would
queue a request to a disabled endpoint.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJXBjgnAAoJEIaOsuA1yqREXl0P/iP7ZyyVj5QEflgcOCWVN5lt
JHB9Ek0Ykmt4l/fd+ixcYMOdEGeLWBZPBEy8Jz25ZYnYDGBy0BosbeN/Au4eQjr7
BrDh1AzIgCuqvP0XWzh+BZCUgFCf3ltPBat/sCXcc74hPCkWs0OcOfEEOOC9Kkjr
qA4Nm/JKjmcQszchvmYkPIPn5V3hMyA33Wm4JBXDBHJerMIGBORBoqw2/+s29xRT
cKlyFuX9Ce+4NqOAV0MAvXr1Jk0KyJhFOK/TdNfKAsg9QodUk/xwU23v1MGScgQc
oeBUEAzpqnA/pebE8vm0jRrlxZ1HqBYo3C5qJAgMmBumFMw1YmtFwZiiEq2qE3me
+W2hsI3rmIH5o/3fzQEOclV8HOFp3hUm4jZtSnD7CJcjP4eahGqQ8QzOLY2kq+NS
ykmDIXqTqG7mKFquuuwBn0kj49AfGUTmB2dinHUcxEb2KKfyNO2fU8MH6GAU8dlm
f8TCINbnXvUQkQMGBTGY+pY5GhtWb66CxCLzyGzt70bmLNtNFgzmkzrFl7xY9DSZ
sWn8o2AvzlyoCbm8WIJQ0LwUonRK32qZZgBgubPwTD8IVgn4NEKqSObA8DUCagdO
XrzUzYF4fnrTT+wGMA0ECFEZEuX4doG/6P9BgS+TQT2sPwOls8t733O5DgBTPP1f
bXp5L1goyUA3wt3WJ4xt
=QLLF
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-v4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v4.6-rc3
We have two more fixes to f_midi. It should now
behave much better.
dwc3-keystone.c has gotten a fix which now allows it
to work on keystone device when running in
peripheral mode. A similar fix for DMA configuration
was made for udc-core, too.
We have a new PCI ID for Intel's Broxton
platform. DWC3 can run on those platforms as well.
And we also have some dwc2 got a fix for dr_mode
usage, while renesas controller got 3 important
fixes: a NULL pointer deref fix, IRQ <-> DMA race
fix, and a fix to prevent a situation where we would
queue a request to a disabled endpoint.
The CP2105 is used in the GE Healthcare Remote Alarm Box, with the
Manufacturer ID of 0x1901 and Product ID of 0x0194.
Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
A Fedora user reports that the ftdi_sio driver works properly for the
ICP DAS I-7561U device. Further, the user manual for these devices
instructs users to load the driver and add the ids using the sysfs
interface.
Add support for these in the driver directly so that the devices work
out of the box instead of needing manual configuration.
Reported-by: <thesource@mail.ru>
CC: stable <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
The Keystone 2 supports DT-boot only, as result dma_mask will be
always configured properly from DT -
of_platform_device_create_pdata()->of_dma_configure(). More over,
dwc3-keystone.c can be built as module and in this case it's unsafe to
assign local variable as dma_mask.
Hence, remove dma_mask configuration code.
Cc: Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Since commit 7ace8fc821 ("usb: gadget: udc: core: Fix argument of
dma_map_single for IOMMU") it is not necessary to configure DMA for
usb_gadget device manually, because all DMA operation are performed
using parent/controller device.
Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
BXT-M is a Intel Broxton SoC based platform with unique PCI ID.
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} macros were introduced *long* time
ago with promise that one day it will be possible to implement page
cache with bigger chunks than PAGE_SIZE.
This promise never materialized. And unlikely will.
We have many places where PAGE_CACHE_SIZE assumed to be equal to
PAGE_SIZE. And it's constant source of confusion on whether
PAGE_CACHE_* or PAGE_* constant should be used in a particular case,
especially on the border between fs and mm.
Global switching to PAGE_CACHE_SIZE != PAGE_SIZE would cause to much
breakage to be doable.
Let's stop pretending that pages in page cache are special. They are
not.
The changes are pretty straight-forward:
- <foo> << (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> <foo>;
- <foo> >> (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> <foo>;
- PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} -> PAGE_{SIZE,SHIFT,MASK,ALIGN};
- page_cache_get() -> get_page();
- page_cache_release() -> put_page();
This patch contains automated changes generated with coccinelle using
script below. For some reason, coccinelle doesn't patch header files.
I've called spatch for them manually.
The only adjustment after coccinelle is revert of changes to
PAGE_CAHCE_ALIGN definition: we are going to drop it later.
There are few places in the code where coccinelle didn't reach. I'll
fix them manually in a separate patch. Comments and documentation also
will be addressed with the separate patch.
virtual patch
@@
expression E;
@@
- E << (PAGE_CACHE_SHIFT - PAGE_SHIFT)
+ E
@@
expression E;
@@
- E >> (PAGE_CACHE_SHIFT - PAGE_SHIFT)
+ E
@@
@@
- PAGE_CACHE_SHIFT
+ PAGE_SHIFT
@@
@@
- PAGE_CACHE_SIZE
+ PAGE_SIZE
@@
@@
- PAGE_CACHE_MASK
+ PAGE_MASK
@@
expression E;
@@
- PAGE_CACHE_ALIGN(E)
+ PAGE_ALIGN(E)
@@
expression E;
@@
- page_cache_get(E)
+ get_page(E)
@@
expression E;
@@
- page_cache_release(E)
+ put_page(E)
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This patch fixes an issue that usbhsg_queue_done() may cause kernel
panic when dma callback is running and usb_ep_disable() is called
by interrupt handler. (Especially, we can reproduce this issue using
g_audio with usb-dmac driver.)
For example of a flow:
usbhsf_dma_complete (on tasklet)
--> usbhsf_pkt_handler (on tasklet)
--> usbhsg_queue_done (on tasklet)
*** interrupt happened and usb_ep_disable() is called ***
--> usbhsg_queue_pop (on tasklet)
Then, oops happened.
Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
The host/device mode set with dr_mode should be kept all the time,
not being changed to OTG in gadget setup (by overriding CFGUSB_FORCEDEVMODE
and CFGUSB_FORCEHOSTMODE bits).
Acked-by: John Youn <johnyoun@synopsys.com>
Tested-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Przemek Rudy <prudy1@o2.pl>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
We added some new locking here, but missed an error path where we need
to unlock.
Fixes: 9acdf4df2f ('usb: gadget: f_midi: added spinlock on transmit function')
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Acked-by: Felipe F. Tonello <eu@felipetonello.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
The driver can be crashed with devices that expose crafted descriptors
with too few endpoints.
See: http://seclists.org/bugtraq/2016/Mar/61
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
[johan: fix OOB endpoint check and add error messages ]
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
An attack using the lack of sanity checking in probe is known. This
patch checks for the existence of a second port.
CVE-2016-3136
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
[johan: add error message ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b37d83a6a4 ("usb: Parse the new USB 3.1 SuperSpeedPlus Isoc
endpoint companion descriptor") caused a regression in 4.6-rc1 and fails
to parse SuperSpeed endpoint companion descriptors.
The new SuperSpeedPlus Isoc endpoint companion parsing code incorrectly
decreased the the remaining buffer size before comparing the size with the
expected length of the descriptor.
This lead to possible failure in reading the SuperSpeed endpoint companion
descriptor of the last endpoint, displaying a message like:
"No SuperSpeed endpoint companion for config 1 interface 0 altsetting 0
ep 129: using minimum values"
Fix it by decreasing the size after comparing it.
Also finish all the SS endpoint companion parsing before calling SSP isoc
endpoint parsing function.
Fixes: b37d83a6a4
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.
Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch adds a code to surely disable TX IRQ of the pipe before
starting TX DMAC transfer. Otherwise, a lot of unnecessary TX IRQs
may happen in rare cases when DMAC is used.
Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
buflen by default (256) is smaller than wMaxPacketSize (512) in high-speed
devices.
That caused the OUT endpoint to freeze if the host send any data packet of
length greater than 256 bytes.
This is an example dump of what happended on that enpoint:
HOST: [DATA][Length=260][...]
DEVICE: [NAK]
HOST: [PING]
DEVICE: [NAK]
HOST: [PING]
DEVICE: [NAK]
...
HOST: [PING]
DEVICE: [NAK]
This patch fixes this problem by setting the minimum usb_request's buffer size
for the OUT endpoint as its wMaxPacketSize.
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe F. Tonello <eu@felipetonello.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
