If dma_pool_alloc() fails we are jumping to fail and releasing all the
bd_tables which have been added to the chain but we missed freeing this
bd_table which was just allocated and still not added to the chain of
bd_table.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Fix potential null-pointer dereference at probe by making sure that the
required endpoints are present.
The whiteheat driver assumes there are at least five pairs of bulk
endpoints, of which the final pair is used for the "command port". An
attempt to bind to an interface with fewer bulk endpoints would
currently lead to an oops.
Fixes CVE-2015-5257.
Reported-by: Moein Ghasemzadeh <moein@istuary.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Don't check if timer is running with a timer_pending() before
deleting it with del_timer_sync(), this defies the whole point of
the sync part and can cause a possible race.
Instead we just want to make sure the timer is initialized early enough
before we have a chance to delete it.
Cc: <stable@vger.kernel.org>
Reported-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Some changes between xhci 0.96 and xhci 1.0 specifications forced us to
check the hci version in code, some of these checks were implemented as
hci_version == 1.0, which will not work with new xhci 1.1 controllers.
xhci 1.1 behaves similar to xhci 1.0 in these cases, so change these
checks to hci_version >= 1.0
Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xhci_stop will be called twice, once for the shared hcd
and again for the primary hcd.
We stop the XHCI controller in any case so clean up
everything on the first call else we can timeout
waiting for pending requests to complete.
Cc: <stable@vger.kernel.org>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For whatever reason if XHCI died in the previous instant
then it will never recover on the next xhci_start unless we
clear the DYING flag.
Cc: <stable@vger.kernel.org>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xhci_pme_quirk() is only used when CONFIG_PM is defined.
Compiling a kernel without PM complains about this function
[reworded commit message -Mathias]
Cc: <stable@vger.kernel.org>
Signed-off-by: Tomer Barletz <barletz@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
We want to give the command abortion an additional try to stop
the command ring before we completely hose xhci.
Cc: <stable@vger.kernel.org>
Tested-by: Vincent Pelletier <plr.vincent@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bits 1:0 of the bmAttributes are used for the burst multiplier.
The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7
into use.
Use the existing USB_SS_MULT() macro instead to make sure the mult value
and hence max packet calculations are correct for USB3.1 devices.
Note that burst multiplier in bmAttributes is zero based and that
the USB_SS_MULT() macro adds one.
Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Here's the second pull request for current -rc cycle.
A few fixes on dummy_hcd which have been around for
longer than they should be.
MUSB got a couple fixes, the most important of which
is a fix to DMA channel teardown on AM335x devices.
And DWC3 got a minor fix for when using RT-enabled
kernels.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJWAF8tAAoJEIaOsuA1yqREmlcQALFf3vheeMxu095CX1YKhuGK
ktqRaSg/3Uwq3h6M1PJ8nf/n/oJQFbOJvMgZlKU5JgJy0fnyQIah1sUOkQCcisHM
EWvfzAfa12yMX5Z9vCQbRksjkPg4ckte8vDhqCturNocYUPqid4KntU7G+8GTtqR
OvnjN35foEkT01y2SW2JK/l6ZGoqfQ9etgVgfs+2FzEBTfjtT1Yi9uovi6V/pjCF
h3KAhR340EK7jUg/+p6wFBDgvRS9FenuV5BebT+mldWMWGfAMwLNB06v2fbOZ+Jh
+zAT/kq/l0gIRER6MIdR8hqzIzIWI4bmD/huCmi55auK3pP5zMwRvl2vifp2feVQ
FI4WbL/44Tsr+N/PlB1iG82iI4XmYrwv72NWn9K0vbY9vzS7LSvoS9COpeFYTaAE
6+k/sB5Sw6eYPeeM4kdjKD+XfWpki2b9jxsgYKo01et6MvDoOwEvtGyCeBohYUF1
WwJulAPk/8cmZiI1JL4Rf8CDV+fOB2DHvVtKcnpQjlvdDud2sl6bIdT/zdceCidJ
F6+bu9JRuM2MFNbJChut1iJOiecoJMXeII00IDynCmQtg1fyDTS2+Un725rSqDxD
/+PXZqXFqpW8TBrToBPJGx0uiwBJciDXUN8hX/O+E6S3wmGeJYDHKspPQUA2iJvK
BSbCrIDsQEb6m3NS7bR8
=Lyn+
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-v4.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v4.3-rc3
Here's the second pull request for current -rc cycle.
A few fixes on dummy_hcd which have been around for
longer than they should be.
MUSB got a couple fixes, the most important of which
is a fix to DMA channel teardown on AM335x devices.
And DWC3 got a minor fix for when using RT-enabled
kernels.
Using spin_lock() in hard irq handler is pointless
and causes a BUG() in RT (real-time) configuration
so get rid of it.
The reason it's pointless is because the driver is
basically accessing register which is, anyways,
atomic.
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
After a few iterations of start/stop UVC camera streaming, the streaming
stops.
This patch adds 250us delay in the cppi channel abort path to let cppi
drain properly.
Using 50us delay seems to be too aggressive, some webcams are still
broken. 250us is the original value used in TI 3.2 kernel.
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
The I2C core always reports the MODALIAS uevent as "i2c:<client name"
regardless if the device was registered using OF or platform code so
So the driver needs to export the I2C table and this be built into
the module or udev won't have the necessary information to auto load
the module when the device is added.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Remove unneeded NULL test.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@ expression x; @@
-if (x != NULL)
\(kmem_cache_destroy\|mempool_destroy\|dma_pool_destroy\)(x);
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
dummy_timer uses transfer() to update transfer limit. However,
limit passed to dummy_timer changes depending on transfer type,
so the actual limit is overwritten.
This can cause unpredictably slow / fast bulk transfers when
coupled with control / interrupt transfers.
Fix by returning actual amount of data sent in transfer() and
substracting from total.
Signed-off-by: Igor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
transfer() schedules a rescan for transfers larger than
maxpacket, which is wrong for transfers that are multiples
of maxpacket.
Rewrite to fix and clarify packet multiple / remainder
transfer logic.
Signed-off-by: Igor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
We already know at this point that to_host is false.
Signed-off-by: Igor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
currently, when a zlp flag is set and an urb/usb_request
buffer is filled without a short packet, transfer() leaves
its status at -EINPROGRESS and does not rescan for short
packet.
In a scenario where ep.maxpacket bytes are copied,
URB_ZERO_PACKET is set, urb buffer is filled and usb_request
buffer is not, transfer() returns with an urb with
-EINPROGRESS status, which dummy_hcd treats as incomplete
transfer.
Check for zlp and rescan appropriately.
Signed-off-by: Igor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Fix the regression caused by commit ad78c91860 ("usb: musb: dsps: just
start polling already") which causes polling the ID pin status even in
device-only mode.
Fixes: ad78c91860 ("usb: musb: dsps: just start polling already")
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
The recently added endpoint capabilities flags verification breaks Atmel
USBA because the endpoint configuration was only added when the driver
is bound using the legacy pdata interface.
Convert endpoint configuration to new capabilities model when driver is
bound to a device tree as well.
Signed-off-by: Sylvain Rochet <sylvain.rochet@finsecur.com>
Fixes: 47bef38651 ("usb: gadget: atmel_usba_udc: add ep capabilities support")
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
- Fix the stall implementation
- Fix device mode transfer at zynq platform
- other small fixes
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJV+8GAAAoJEEhZKYFQ1nG79FMH/2dAYwuA4S9OgQq2rGZnaZnM
MaWFKF5Q/4mLdVd9cnJDL1B/GVq0yT50n2P8h4/pjHLGetmo6iMIDgjsQXcO6JTa
vyWTggq/2eCQDJk/dBMbQlyzyavrGT4SY4PYbMJ/ggZEm9UmI/ONjBWlExnLkiqp
Yjk7lJ/JH3Du3cgZ3nePJoB7r0ETbJnxZf3H1AgU3//n74xcgRz48HeBQxMHXqj5
Hy9CDbsrKcyhigx3liIPr1zFdWs0P5km199PrWTkyKVmjAjIxU7mlimUbM2RuPwo
IVOcce5Z6OWObfmNiZtrc2ZcxbAfvUOeT6OkEmyhAeq1fvVtdEO3Wh8suWZGaSg=
=O6FV
-----END PGP SIGNATURE-----
Merge tag 'usb-ci-v4.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus
Peter writes:
USB Chipidea fixes for v4.3-rc2
- Fix the stall implementation
- Fix device mode transfer at zynq platform
- other small fixes
Just some new ZTE device IDs.
Signed-off-by: Johan Hovold <johan@kernel.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJV+uRrAAoJEEEN5E/e4bSV0pMP/iX1nPVHp3Q5ROWuyGTDL0I2
sul191jXkDZ/iHA2hnwC1vpaLqtguCfQwL+v0iZnek5OJiNcUcvw/Ykwu5Uxycul
yNUpceUVFppI99XabpC2bhc+Uy3sBqp4+n2mzdOZxwJM6HIaiTzE/Wnnn/MCm67m
r7NyvY7lJxrTl4hUCI9kqo89f30NVX0fFnfLojLex85v5soOjLNYTrvG1ysrUlu0
cJAH5fM0Hn642idIpT1Ogq/YXPrd+jFN3aFoFAZuT76+ogwYAMmbMR4lYLMs4sNd
wPIlttphO+pMvCPoKIviwBB/fun61PGECDsOTlXyw6tjqFlm8bYiaIePrRgV4LSZ
duqOJpdzf6Q15SZHWrJi4ZJG1rDs1xE78MMzIoa2xmw4cuwykAp/QAJBSMriQ+VW
1iOjYWlXmQPM+m3flPW6DVSIdQhjLlY3L6Xqw9YlXsEz6DFdjSkeXYP2wDv/Tfy3
B2NTeL5erPfbus+D2PZuu5EDQPvgV9yLt12ZQ1eNIV64g+dFk5w3/KrV+f73J34+
mfnbS27UtaQIcACDLOvmwsEI8+4QSGRflgQUhxD8lMxgcBL4+2aed4JaV/PBE+BH
QoaS0kzjaL0lXYwqwTxHOme40bQg2d5wtMR209S9uuwNcBLD9xdgGaRKdtfh8G/d
KPs48njOlAvTJheTta6W
=/StG
-----END PGP SIGNATURE-----
Merge tag 'usb-serial-4.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:
USB-serial fixes for v4.3-rc2
Just some new ZTE device IDs.
Signed-off-by: Johan Hovold <johan@kernel.org>
Use imx6sx instead of imx6sl's platform flags for imx6sx.
Fixes: e14db48dfc ("usb: chipidea: imx: add runtime power management support")
Cc: <stable@vger.kernel.org> # v4.1+
Signed-off-by: Li Jun <jun.li@freescale.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Due to having hardware tx buffers less than 512 bytes in size, streaming
must be enabled on the Zynq for the udc to work at all. Add platform data
specific to the Zynq udc, which does not set the CI_HDRC_DISABLE_STREAMING
flag.
Based on a patch by the same name from the Xilinx vendor tree.
Signed-off-by: Nathan Sullivan <nathan.sullivan@ni.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
According to spec, there are functional and protocol stalls.
For functional stall, it is for bulk and interrupt endpoints,
below are cases for it:
- Host sends SET_FEATURE request for Set-Halt, the udc driver
needs to set stall, and return true unconditionally.
- The gadget driver may call usb_ep_set_halt to stall certain
endpoints, if there is a transfer in pending, the udc driver
should not set stall, and return -EAGAIN accordingly.
These two kinds of stall need to be cleared by host using CLEAR_FEATURE
request (Clear-Halt).
For protocol stall, it is for control endpoint, this stall will
be set if the control request has failed. This stall will be
cleared by next setup request (hardware will do it).
It fixed usbtest (drivers/usb/misc/usbtest.c) Test 13 "set/clear halt"
test failure, meanwhile, this change has been verified by
USB2 CV Compliance Test and MSC Tests.
Cc: <stable@vger.kernel.org> #3.10+
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Felipe Balbi <balbi@ti.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
The gpio-desc migration done in v4.0 caused a regression
with legacy boots due to reversed reset logic.
e.g. omap3-beagle USB host breaks on legacy boot.
Request the reset GPIO with GPIOF_ACTIVE_LOW flag so that
it matches the driver logic and pin behaviour.
Fixes: e9f2cefb0c ("usb: phy: generic: migrate to gpio_desc")
Cc: <stable@vger.kernel.org> # 4.0+
Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
This platform driver has a OF device ID table but the OF module
alias information is not created so module autoloading won't work.
Signed-off-by: Luis de Bethencourt <luis@debethencourt.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
In certain situations, an interrupt triggers on resume, before musb_start()
has been called. This has been observed to cause enumeration issues after
suspend/resume cycles with AM335x.
Signed-off-by: Pascal Huerst <pascal.huerst@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
If a failure happens early in udc_pci_probe(), error handling code
just kfree(dev) and returns. The patch adds proper resource
deallocations in udc_pci_probe() itself,
since udc_pci_remove() is not suitabe to be called so early
in initialization process.
By the way, iounmap(dev->regs) is replaced by iounmap(dev->virt_addr)
in udc_pci_remove() for clarity.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Fix build errors that happen when USB_QCOM_8X16_PHY=y and EXTCON=m:
drivers/built-in.o: In function `phy_8x16_init':
phy-qcom-8x16-usb.c:(.text+0x86ef4): undefined reference to `extcon_get_cable_state'
drivers/built-in.o: In function `phy_8x16_probe':
phy-qcom-8x16-usb.c:(.text+0x870bf): undefined reference to `extcon_get_edev_by_phandle'
phy-qcom-8x16-usb.c:(.text+0x87133): undefined reference to `extcon_register_interest'
phy-qcom-8x16-usb.c:(.text+0x87151): undefined reference to `extcon_unregister_interest'
drivers/built-in.o: In function `phy_8x16_remove':
phy-qcom-8x16-usb.c:(.text+0x872ec): undefined reference to `extcon_unregister_interest'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Felipe Balbi <balbi@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
The change ensures otg is not in a A- state when checking for VBUS in
peripheral mode.
musb_start() where VBUS checking is in can be called in many situations.
One example is in babble recovery routine, in which otg is transitioning
from A-HOST to A-WAIT-BCON, but VBUS discharge takes time, so
musb->is_active could be set to 1 due to this improper checking, then it
causes musb_bus_suspend() failed which leads to warning log message
flooding.
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
If we enable IRQs before requesting our
extcon device, we might fall into a situation
where and IRQ fires before we're ready to
handle it.
Signed-off-by: Felipe Balbi <balbi@ti.com>
This patch fixes possible regression introduced by
patch reworking endpoint claiming mechanism. It restores
setring ep->driver_data to NULL in usb_ep_autoconfig_reset(),
which was removed by patch commit cc476b42a3.
Fixes: cc476b42a3 ("usb: gadget: encapsulate endpoint
claiming mechanism")
Reported-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
This is intended to add ZTE device PIDs on kernel.
Signed-off-by: Liu.Zhao <lzsos369@163.com>
Cc: stable <stable@vger.kernel.org>
[johan: sort the new entries ]
Signed-off-by: Johan Hovold <johan@kernel.org>
This is an HP-branded Sierra Wireless EM7355:
https://bugzilla.redhat.com/show_bug.cgi?id=1223646#c2
Signed-off-by: David Ward <david.ward@ll.mit.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex
products.
Signed-off-by: Matthijs Kooijman <matthijs@stdin.nl>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Silence read-urb resubmission errors when the device is going away.
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Avoid spamming the logs (e.g. with -EPROTO errors) when attempting to
resubmit the interrupt urb while a disconnect of an in-use device is
being processed.
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The scanner (here DS3508) always returns 64 bytes per urb buffer. The first
byte indicates the data length used in the current buffer. There even was
a comment describing this. But the comment also said that we'll send
everything in the buffer to the tty layer. That means sending the actual
barcode data and lots of trailing zeroes. This patch lets the driver only
send the real data.
Signed-off-by: Philipp Hachtmann <hachti@hachti.de>
Acked-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The driver used usb_get_serial_data(port->serial) which compiled but resulted
in a NULL pointer being returned (and subsequently used). I did not go deeper
into this but I guess this is a regression.
Signed-off-by: Philipp Hachtmann <hachti@hachti.de>
Fixes: a85796ee51 ("USB: symbolserial: move private-data allocation to
port_probe")
Cc: stable <stable@vger.kernel.org> # v3.10
Acked-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The current code prints all wMaxPacketSize content at endpoint
descriptor, if there is a high speed, high bandwidth endpoint,
it may confuse the users, eg, if there are 3 transactions during
microframe, it will print "wMaxPacket 1400" for packet content.
This commit splits wMaxpacketSize and transaction numbers for
output messages.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The ehci platform device's drvdata is the pointer of struct usb_hcd
already, so we doesn't need to call bus_to_hcd conversion again.
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 1d958bef45 as the
signed-off-by address is invalid.
Cc: Stefan Koch <stefan.koch10@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit de7718bd9c as the
signed-off-by address is invalid.
Cc: Stefan Koch <stefan.koch10@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit ef0909c50f as the
signed-off-by address is invalid.
Cc: Stefan Koch <stefan.koch10@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 187b3d75bb as the
signed-off-by address is invalid.
Cc: Stefan Koch <stefan.koch10@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 3cf1fc8065 as the
signed-off-by address is invalid.
Cc: Stefan Koch <stefan.koch10@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
