If we have USB gadgets disabled and USB_MUSB_HOST set, we get
errors "possible irq lock inverssion dependency detected"
errors during boot.
Let's fix the issue by adding start_musb flag and start
the controller after we're out of the spinlock protected
section.
Reported-by: Ladislav Michl <ladis@linux-mips.org>
Tested-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
at dual-role mode, the root cause of this issue is the usbcmd.rs
is cleared by chipidea udc code.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJXtmlkAAoJEEhZKYFQ1nG7NNYIAJkZkiDvmdJWj9Bd0m742ftB
nroxMUAD02CJNRj1vH2h/9ahTjsTsXDyO8sFbWxgmBxpg7JKwuOFNXZQaFUHqZXh
aLjNW8199iX5bRiAncEgeJvZGDRoOo7mHrCtNGBYCvDXWqISI5CiyHzT7svzEHus
7AleXuWp/SnexOT/LS9xSZ//ooCtMCMBR+2Ns+QYQrHVtI6CwZ6umC8jiK9Xec7L
FSyPfpZk9sQtcMN27Cgk8D7YFx/Z13SHgfF139LZNNwUQYsjkfjD7Ru6okkmxFS2
bvy7LJlYaGVKoezjB6VktNL/fZ8DoggC2gFTe6kbmHhev/u1YDM+JBU21Jo4MzA=
=VOuU
-----END PGP SIGNATURE-----
Merge tag 'usb-ci-v4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus
Peter writes:
Fix one bug that host can't work after insmod gadget module
at dual-role mode, the root cause of this issue is the usbcmd.rs
is cleared by chipidea udc code.
Here are a couple of fixes for non-atomic allocations in write paths,
and some new option device ids.
Signed-off-by: Johan Hovold <johan@kernel.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJXvxNgAAoJEEEN5E/e4bSVibEP/1HuoOsGKaOR9RI3y/dRzcFe
ZVYtKQZ2M+zYBRlkbTGKpGO8urzfNL3T+TfA51i2HUnsa9s4AEFuyoC8eW/amj3D
mKm2rn0BwPH+E86Pvg0Jgf/tyveCGB3u2rbkZWHhbbJDA/eI2nX1w9DlldSHpZfx
PgFKPemBeUSc+AKIuw2eAbw4y9Br2hnvb2ZDzXE7CHpiu/Jnk6UuXCO6aygr+IAj
KK0dcW1D+QBoefHgNNMydk1OMvs5BAl/GdnUn5UqlMfe95b617eaOhkQlM0h+JVk
yO2zLF8tz64xE5gYzT0PWeHBSl5Ugf0yVQdIypYToldIellIz+2z8TxfQ38U0Fu5
fyB4c2KAy3+CESDgNZZMYXOPY1sfkjArTrvrbp4lwbgZTlg+CTtcn63OXl0DDhIW
x5w0KpguralZvjmhjKrmi46TljEX05UV/PqtConXuFujylyXTq36RLF+1OeH+ZyW
+MGYHHHvqjK4/uqesXmu52UQPq08VaBktxUwqaKhh/0Pg1ta0XcdCH+6dBEeWy5i
idHFFQBqV9QE08DhLPa24kS+DOpmEUiTi/AOxpdlpDtsW4XkbVv7IF/t3W+sx6G5
U+XfoujHcYBrIbfiN/kcE1W896Y+MeJ8VhCRxCt8vwmgYXTjwpkYaq2eYaA+zp/Z
PddZx/fqr8W5ADICIyyj
=bKLC
-----END PGP SIGNATURE-----
Merge tag 'usb-serial-4.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:
USB-serial fixes for v4.8-rc4
Here are a couple of fixes for non-atomic allocations in write paths,
and some new option device ids.
Signed-off-by: Johan Hovold <johan@kernel.org>
Few fixes on dwc3 again, the most important being a
fix for pm_runtime to make it work with current
intel platforms.
Other than that, there's a signedness bug fix in fsl
udc and some other minor fixes.
-----BEGIN PGP SIGNATURE-----
iQI6BAABCAAkBQJXvrw3HRxmZWxpcGUuYmFsYmlAbGludXguaW50ZWwuY29tAAoJ
EIaOsuA1yqREWCMP/0zlF8sqCLgTOJcR8wBbzCCY6CLxrWrBxUB5+Ld6gs101f/0
d1YEqgRtGxauaJVdTfwiSoVTb+WGzG97ExHXBSQjcxniG/3u39Yq+KkKao6+Y4iR
bqoT7vqPkLqNhVxzIL2Mx0uWBiCibl2NrAfXreNhSxHkabrf6JsWMfQ9Kc0N47/j
aFRJ4U+NG/q53NbSfpfSxYG0p0LB4BHEpR0BVIKtWxMgFEsdwOMM6ZyqHpw3pede
km7wqp/7HAUu2rhiZFQtLuPa7yjqlGEZ8vO1ERzIACDy+CiedRoJW+hHE0rJn4TL
xjCLGEEeH7pP/lqAmsw6oxjg9cdhTakfMcM0374203U31hTIYC6PK1gRMivvE3rD
zZ8RLU3NCuAh6HBQaHl/k+i3t9U76K/DJuFbSKnO1wwYMlDS2u6WBUWTXFDanYij
BTIJSrqAEp+Ne3MCMQ0u79daTO5iTAhf08xbMwLJwY9c8k43bFmo2kYoGjo8aAyi
0U03NYMfuOTqcTpYNlRXyRhFGdCM0wxvYwzGaUs+oxPzzpsrQiotd0Lm8+UWSB/Y
b4EfsZew0CBNnN3BPgyPDSrntPFiyL6OV2bRkLnxgUlwVEoEIBqTRu0Uv6bsrLkG
qO4ibILgDbGUIuC8EyyR3ObQcTNQxxLTbdHyrNIq8dcgLypu3tW9jHHCe6vO
=Tm2m
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-v4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v4.8-rc3
Few fixes on dwc3 again, the most important being a
fix for pm_runtime to make it work with current
intel platforms.
Other than that, there's a signedness bug fix in fsl
udc and some other minor fixes.
There was a typo when generating endpoint name which
would be very confusing when debugging. Fix it.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
These product IDs are listed in Windows driver.
0x6803 corresponds to WeTelecom WM-D300.
0x6802 name is unknown.
Signed-off-by: Aleksandr Makarov <aleksandr.o.makarov@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
UBSAN complains about a left shift by -1 in proc_do_submiturb(). This
can occur when an URB is submitted for a bulk or control endpoint on
a high-speed device, since the code doesn't bother to check the
endpoint type; normally only interrupt or isochronous endpoints have
a nonzero bInterval value.
Aside from the fact that the operation is illegal, it shouldn't matter
because the result isn't used. Still, in theory it could cause a
hardware exception or other problem, so we should work around it.
This patch avoids doing the left shift unless the shift amount is >= 0.
The same piece of code has another problem. When checking the device
speed (the exponential encoding for interrupt endpoints is used only
by high-speed or faster devices), we need to look for speed >=
USB_SPEED_SUPER as well as speed == USB_SPEED HIGH. The patch adds
this check.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Vittorio Zecca <zeccav@gmail.com>
Tested-by: Vittorio Zecca <zeccav@gmail.com>
Suggested-by: Bjørn Mork <bjorn@mork.no>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The maximum value allowed for wMaxPacketSize of a high-speed interrupt
endpoint is 1024 bytes, not 1023.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: aed9d65ac3 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When usb gadget is set gadget serial function, it will be crash in below
situation.
It will clean the 'port->port_usb' pointer in gserial_disconnect() function
when usb link is inactive, but it will release lock for disabling the endpoints
in this function. Druing the lock release period, it maybe complete one request
to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb'
pointer had been set NULL, thus it will be crash in gs_start_tx() function.
This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function
to avoid this situation.
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
__dwc3_gadget_wakeup() is called while holding a spinlock, then depends on
jiffies in order to timeout while polling the USB core for a link state
update. In the case the wakeup failed, the timeout will never happen and
will also cause the cpu to stall until rcu_preempt kicks in.
This switches to a "decrement variable and wait" timeout scheme.
Signed-off-by: Nicolas Saenz Julienne <nicolassaenzj@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
We can't assign -EINVAL to a u16.
Fixes: 3948f0e0c9 ('usb: add Freescale QE/CPM USB peripheral controller driver')
Acked-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
In eth_start_xmit, the socket buffer may be NULL. So, add NULL pointer
check at .wrap API.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
In eth_start_xmit, the socket buffer may be NULL. So, add NULL pointer
check at .wrap API.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
In case of error, the function usb_get_phy() returns ERR_PTR() and never
returns NULL. The NULL test in the return value check should be replaced
with IS_ERR().
Fixes: b5a2875605 ("usb: renesas_usbhs: Allow an OTG PHY driver to
provide VBUS")
Cc: <stable@vger.kernel.org> # v4.3+
Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Allow for platforms that have a reset controller driver in place to bring
the USB IP out of reset.
Signed-off-by: Dinh Nguyen <dinguyen@opensource.altera.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
After going through runtime_suspend/runtime_resume
cycle once we would be left with an unbalanced
pm_runtime_get() call. Fix that by making sure that
we try to suspend right after resuming so things are
balanced and device can runtime_suspend again.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
During runtime_resume of dwc3-pci.c, we need to
runtime suspend our child device (which is dwc3
proper) otherwise nothing will happen.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
When the controller is configured to be dual role and it's in host mode,
if bind udc and gadgt driver, those gadget operations will do gadget
disconnect and finally pull down DP line, which will break host function.
Cc: <stable@vger.kernel.org> # 4.1+
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Remove the hcd after checking for the xhci last quirks, not before.
This caused a hang on a Alpine Ridge xhci based maching which remove
the whole xhci controller when unplugging the last usb device
CC: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
After a device is disconnected, xhci_stop_device() will be invoked
in xhci_bus_suspend().
Also the "disconnect" IRQ will have ISR to invoke
xhci_free_virt_device() in this sequence.
xhci_irq -> xhci_handle_event -> handle_cmd_completion ->
xhci_handle_cmd_disable_slot -> xhci_free_virt_device
If xhci->devs[slot_id] has been assigned to NULL in
xhci_free_virt_device(), then virt_dev->eps[i].ring in
xhci_stop_device() may point to an invlid address to cause kernel
panic.
virt_dev = xhci->devs[slot_id];
:
if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
[] Unable to handle kernel paging request at virtual address 00001a68
[] pgd=ffffffc001430000
[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003,
*pmd=000000013c808003, *pte=0000000000000000
[] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G U
[] Workqueue: pm pm_runtime_work
[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti:
ffffffc0bc0ec000
[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4
This issue is found when running with realtek ethernet device
(0bda:8153).
Signed-off-by: Jim Lin <jilin@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Enqueue the first TRB even if full_len is zero.
Without this "adb install <apk>" freezes the system.
Signed-off-by: Alban Browaeys <alban.browaeys@gmail.com>
Fixes: 86065c2719 ("xhci: don't rely on precalculated value of needed trbs in the enqueue loop")
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix "Command completion event does not match command" errors by always
handling the command ring stopped events.
The command ring stopped event is generated as a result of aborting
or stopping the command ring with a register write. It is not caused
by a command in the command queue, and thus won't have a matching command
in the comman list.
Solve it by handling the command ring stopped event before checking for a
matching command.
In most command time out cases we abort the command ring, and get
a command ring stopped event. The events command pointer will point at
the current command ring dequeue, which in most cases matches the timed
out command in the command list, and no error messages are seen.
If we instead get a command aborted event before the command ring stopped
event, the abort event will increse the command ring dequeue pointer, and
the following command ring stopped events command pointer will point at the
next, not yet queued command. This case triggered the error message
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This fixes the "BOGUS urb xfer" warning logged by usb_submit_urb().
Signed-off-by: Gavin Li <git@thegavinli.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
There is an allocation with GFP_KERNEL flag in mos7840_write(),
while it may be called from interrupt context.
Follow-up for commit 1912528376 ("USB: kobil_sct: fix non-atomic
allocation in write path")
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
There is an allocation with GFP_KERNEL flag in mos7720_write(),
while it may be called from interrupt context.
Follow-up for commit 1912528376 ("USB: kobil_sct: fix non-atomic
allocation in write path")
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Here is a fix of a memory leak in a driver-registration error path, and
some new device ids.
Signed-off-by: Johan Hovold <johan@kernel.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJXrYB3AAoJEEEN5E/e4bSVz5sQAKjgRwxltR6uu4shLwSlumPA
F/LWuPxZjKsDfn+QuYNTAw5bJF4smCB9AlCXesXGHSlU8q4wCMdHp2cU9adbmGys
K6Ah1gzPY+PMkjtW4qiI3kR6AFXE+SgEUKGSskRpkiJ6Vq5IdO+qmk/TNEL96h2w
B2a8CrPFbd2BW9J0Np3/W7BRMx9g1OUiQzif6vBZXAlGXt+pGlW8sAYZfzzzGddq
m8UXbnXQkvi7Pr5Gwplcfs7PX3Qd3RLP4St4SpbeYE6uIJ2EgAaHV8uRwMa45Lmi
AtROmXSj5SkgpqKHPNBxSe/kBqf6HTIGLLSHFKmGHfBQ009S+iPpg2XlQw8MCpLz
EjX/oji00RgzbtQ10ztyNSxHqRKEdEVZmsWuJvHj01ajLvZgGWpBye2A5c/SUQRF
yVtsex2YkFCuRDDuhE9iqx5+XOHKEIVHdRIP8EasFTENN8Dt7NLuMqw6YsD4Cf9G
tdEa2ZuzipwXjqdXUfON0SKNFnjP9KjOOS8+ECnnuj5RlBeELFXIVamXn5vbQDl/
EI+jAcC2K9Hwa8cVI8FXT/NhBCVv92OMvHVvwnSNiEZFHA30UGhuXZyJfz5SY/Bp
xP3P2dTbGd9j6X2eQitewIJFdoEkRE0XzT87v1t7Bw01kRB1rIvM5pspy5OcbT62
YmuVbzihdFQ7Xz++vSSD
=k37B
-----END PGP SIGNATURE-----
Merge tag 'usb-serial-4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:
USB-serial fixes for v4.8-rc2
Here is a fix of a memory leak in a driver-registration error path, and
some new device ids.
Signed-off-by: Johan Hovold <johan@kernel.org>
In sg_timeout(), req->status is set to "-ETIMEDOUT" before calling
into usb_sg_cancel(). usb_sg_cancel() will do nothing and return
directly if req->status has been set to a non-zero value. This will
cause driver hang whenever transfer time out is triggered.
This patch fixes this issue. It could be backported to stable kernel
with version later than v3.15.
Cc: stable@vger.kernel.org # 3.15+
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
First set of fixes for v4.8-rc cycle. Again, dwc3 is
the most active driver with over 60% of this pull
request touching it.
The most important fixes are related to scatterlist
usage with dwc3. Before this pull request, we were
increment request->actual multiple times and this
would result in request->actual being larger than
request->length.
Also, if a we received a short packet midway through
processing a scatterlist, we were not clearning HWO
bit as we should.
Other than the large dwc3 scatterlist fixes, we have
a new Device ID for Intel's Kabylake silicon.
Other drivers, such as fsl_qe_udc and renesas udc,
also got a few minor fixes. Details are in shortlog.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJXrGw7AAoJEIaOsuA1yqREVv8QAKs+UEW+M2hnX1jolG4525YY
0fEYHVuH8K+PSzhG0aPr3vWG3GHBn37in4l0Ey5x5dyBxkFN2LQfnPkBWMYQeFAS
fBwh1o+V+Xec7DHUDqgexb10kOKVI7U2H3Ob9VV9BMYKU1D5SgRduG569UDPzWIJ
bXyHYOiTEwdubu+eXNAZA05nFSoZinHQ/m/4alaIfoOGJo6sHs7mLuVaAdp4g+OA
vD6UgOTFSuSB+rDbYLhxSc9kVwRFQKAEe5u/YuI6Puxpsnsu1D5S5t/KPty1DTUV
UZS63O3L3VcdGe54hew7iPg/UKGcUCaOw/HUJlro+d/jxrz48AqgAlQr3ZGxhdWJ
LDDkWJJhNJXdBs7TmrrZfC+qhLRhvAXVasf/TFaXAsejHU5KeyiDCp0UU/LnqYlD
YIAVnxL6er2Sn3jI6KJQ4Ek8uufpAZZ3gFWZ60Ka6AXXYVdu5PTnaca+3J0eyVjZ
F4kWWyR3wFSJ1zmWvTJsnuww77cLoUu7sPg+w4dvIoG/x1yGg+JBuBJzq1VyF307
XDHtM+134Y4XVbvz5wIySLOmXnLPCb1F6Gp67GjuoBOMjL086JvFlbut2/bJs7Nj
6RVHRJUECaTRUQz5dUEYYwoFnjQXgWv7vEn4QD/507jm4krcxhuxaDgtK47yKjXS
DGjMIGO0b3yK8rvqqoWM
=7VYA
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-v4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v4.8-rc1
First set of fixes for v4.8-rc cycle. Again, dwc3 is
the most active driver with over 60% of this pull
request touching it.
The most important fixes are related to scatterlist
usage with dwc3. Before this pull request, we were
increment request->actual multiple times and this
would result in request->actual being larger than
request->length.
Also, if a we received a short packet midway through
processing a scatterlist, we were not clearning HWO
bit as we should.
Other than the large dwc3 scatterlist fixes, we have
a new Device ID for Intel's Kabylake silicon.
Other drivers, such as fsl_qe_udc and renesas udc,
also got a few minor fixes. Details are in shortlog.
stop consuming TRBs when we reach one with HWO bit
already set. This will prevent us from prematurely
retiring a TRB.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
According to Synopsys Databook 2.60a, section 8.3.4,
it's stated that:
The LST bit should be set to 0 (isochronous
transfers normally continue until the
endpoint is removed entirely, at which time
an End Transfer command is used to stop the
transfer).
This patch makes sure that detail is observed and
fixes a regression with Android Audio playback
caused by recent changes to DWC3 gadget.
Signed-off-by: Janusz Dziedzic <januszx.dziedzic@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
When rndis data transfer is in progress, some Windows7 Host PC is not
sending the GET_ENCAPSULATED_RESPONSE command for receiving the response
for the previous SEND_ENCAPSULATED_COMMAND processed.
The rndis function driver appends each response for the
SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted,
the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset.
As the rndis response queue is not freed, the previous response is sent
as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host
block any more Rndis transfers.
Hence free the rndis response queue as a part of this soft-reset so that
the correct response for REMOTE_NDIS_RESET_MSG is sent properly during the
response command.
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Signed-off-by: Xerox Lin <xerox_lin@htc.com>
[AmitP: Cherry-picked this patch and folded other relevant
fixes from Android common kernel android-4.4]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
The udc device needs to be deleted if error occurs
Fixes: 855ed04a37 ("usb: gadget: udc-core: independent registration of
gadgets and gadget drivers")
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=.
Fixes: 3948f0e0c9 ('usb: add Freescale QE/CPM USB peripheral controller driver')
Acked-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
In 'composite_os_desc_req_prepare', if one of the memory allocations fail,
0 will be returned, which means success.
We should return -ENOMEM instead.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
If this memory allocation fail, we will return 0, which means success.
Return -ENOMEM instead.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
When reading synchronously from a non-zero endpoint, gadgetfs will
return -EFAULT even if the read succeeds, due to a bad check of the
copy_to_iter() return value.
This fix compares the return value of copy_to_iter to the amount of
bytes that was passed, and only fails if they are not the same.
Signed-off-by: Binyamin Sharet <s.binyamin@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
For case 14 and case 21, their correct return value is the number
of bytes transferred, so it is a positive integer. But in usbtest_ioctl,
it takes non-zero as false return value for usbtest_do_ioctl, so
it will treat the correct test as wrong test, then the time on
tests will be the minus value.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Cc: stable <stable@vger.kernel.org>
Fixes: 18fc4ebdc7 ("usb: misc: usbtest: Remove timeval usage")
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Add missing platform_set_drvdata() in dwc3_of_simple_probe(), otherwise
calling platform_get_drvdata() in remove returns NULL.
This is detected by Coccinelle semantic patch.
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Add missing platform_set_drvdata() in omap_otg_probe(), otherwise
calling platform_get_drvdata() in remove returns NULL.
This is detected by Coccinelle semantic patch.
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
There may be a race condition if f_fs calls unregister_gadget_item in
ffs_closed() when unregister_gadget is called by UDC store at the same time.
this leads to a kernel NULL pointer dereference:
[ 310.644928] Unable to handle kernel NULL pointer dereference at virtual address 00000004
[ 310.645053] init: Service 'adbd' is being killed...
[ 310.658938] pgd = c9528000
[ 310.662515] [00000004] *pgd=19451831, *pte=00000000, *ppte=00000000
[ 310.669702] Internal error: Oops: 817 [#1] PREEMPT SMP ARM
[ 310.675211] Modules linked in:
[ 310.678294] CPU: 0 PID: 1537 Comm: ->transport Not tainted 4.1.15-03725-g793404c #2
[ 310.685958] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[ 310.692493] task: c8e24200 ti: c945e000 task.ti: c945e000
[ 310.697911] PC is at usb_gadget_unregister_driver+0xb4/0xd0
[ 310.703502] LR is at __mutex_lock_slowpath+0x10c/0x16c
[ 310.708648] pc : [<c075efc0>] lr : [<c0bfb0bc>] psr: 600f0113
<snip..>
[ 311.565585] [<c075efc0>] (usb_gadget_unregister_driver) from [<c075e2b8>] (unregister_gadget_item+0x1c/0x34)
[ 311.575426] [<c075e2b8>] (unregister_gadget_item) from [<c076fcc8>] (ffs_closed+0x8c/0x9c)
[ 311.583702] [<c076fcc8>] (ffs_closed) from [<c07736b8>] (ffs_data_reset+0xc/0xa0)
[ 311.591194] [<c07736b8>] (ffs_data_reset) from [<c07738ac>] (ffs_data_closed+0x90/0xd0)
[ 311.599208] [<c07738ac>] (ffs_data_closed) from [<c07738f8>] (ffs_ep0_release+0xc/0x14)
[ 311.607224] [<c07738f8>] (ffs_ep0_release) from [<c023e030>] (__fput+0x80/0x1d0)
[ 311.614635] [<c023e030>] (__fput) from [<c014e688>] (task_work_run+0xb0/0xe8)
[ 311.621788] [<c014e688>] (task_work_run) from [<c010afdc>] (do_work_pending+0x7c/0xa4)
[ 311.629718] [<c010afdc>] (do_work_pending) from [<c010770c>] (work_pending+0xc/0x20)
for functions using functionFS, i.e. android adbd will close /dev/usb-ffs/adb/ep0
when usb IO thread fails, but switch adb from on to off also triggers write
"none" > UDC. These 2 operations both call unregister_gadget, which will lead
to the panic above.
add a mutex before calling unregister_gadget for api used in f_fs.
Signed-off-by: Winter Wang <wente.wang@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
dev->port_usb is checked for null pointer at above code, so dev->port_usb
might be null, fix it by adding null pointer check.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
cdev->config is checked for null pointer at above code, so cdev->config
might be null, fix it by adding null pointer check.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
This patch fixes an issue that isochronous transfer's data is possible to
be lost as a workaround. Since this driver uses a workqueue to start
the dmac, the transfer is possible to be delayed when system load is high.
Fixes: 6e4b74e469 ("usb: renesas: fix scheduling in atomic context bug")
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
This patch fixes an issue that unexpected BRDY interruption happens
when the usb_ep_{enable,disable}() are called with different direction.
In this case, the driver will cause the following message:
renesas_usbhs e6590000.usb: irq_ready run_error 1 : -16
This issue causes the followings:
1) A pipe is enabled as transmission
2) The pipe sent a data
3) The pipe is disabled and re-enabled as reception.
4) The pipe got a queue
Since the driver doesn't clear the BRDYSTS flags after 2) above, the issue
happens. If we add such clearing the flags into the driver, the code will
become complicate. So, this patch clears the BRDYSTS flag of reception in
usbhsg_ep_enable() to avoid complicate.
Cc: <stable@vger.kernel.org> # v4.1+ (usbhs_xxxsts_clear() is needed)
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Since R-Car Gen3 SoC has the USB-DMAC, this driver should set
dparam->has_usb_dmac to 1. Otherwise, behavior of this driver and
the usb-dmac driver will be mismatch, then sometimes receiving data will
be corrupt.
Fixes: de18757e27 ("usb: renesas_usbhs: add R-Car Gen3 power control")
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Intel Kabylake PCH has the same DWC3 than Intel
Sunrisepoint. Add the new ID to the supported devices.
Cc: <stable@vger.kernel.org>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
