Commit graph

2375 commits

Author SHA1 Message Date
Kees Cook
aba37fd975 usb: gadget: tcm_usb_gadget: stop format strings
This makes sure that the name coming out of configfs cannot be used
accidentally as a format string.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:08:27 -07:00
Robert Baldyga
48968f8d5f usb: gadget: f_fs: add missing spinlock and mutex unlock
This patch adds missing spin_unlock and mutex_unlock calls in
error handling code.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi
dad4babe41 usb: gadget: composite: switch over to ERR_CAST()
This patch fixes the following Coccinelle warning:

drivers/usb/gadget/composite.c:1142:9-16: WARNING: \
	ERR_CAST can be used with uc

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi
3b74c73f8d usb: gadget: inode: switch over to memdup_user()
This patch fixes the following Coccinelle warning:

drivers/usb/gadget/inode.c:442:8-15: WARNING \
	opportunity for memdup_user

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi
f3c7364982 usb: gadget: f_subset: switch over to PTR_RET
this patch fixes the following Coccinelle warning:

drivers/usb/gadget/f_subset.c:279:8-14: WARNING: \
	PTR_RET can be used

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi
ade79d13a8 usb: gadget: lpc32xx_udc: fix wrong clk_put() sequence
This patch fixes the following Coccinelle error:

drivers/usb/gadget/lpc32xx_udc.c:3313:1-7: ERROR: \
	missing clk_put; clk_get on line 3139 and \
	execution via conditional on line 3146

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Greg Kroah-Hartman
7338a06593 usb: patches for v3.15
another substantial pull request with new features all over
 the place.
 
 dwc3 got a bit closer towards hibernation support with after
 a few patches re-factoring code to be reused for hibernation.
 Also in dwc3 two new workarounds for known silicon bugs have
 been implemented, some randconfig build errors have been fixed,
 and it was taught about the new generic phy layer.
 
 MUSB on AM335x now supports isochronous transfers thanks to
 George Cherian's work.
 
 The atmel_usba driver got two crash fixes: one when no endpoint
 was specified in DeviceTree data and another when stopping the UDC
 in DEBUG builds.
 
 Function FS got a much needed fix to ffs_epfile_io() which was
 copying too much data to userspace in some cases.
 
 The printer gadget got a fix for a possible deadlock and plugged
 a memory leak.
 
 Ethernet drivers now use NAPI for RX which gives improved throughput.
 
 Other than that, the usual miscelaneous fixes, cleanups, and
 the like.
 
 Signed-of-by: Felipe Balbi <balbi@ti.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTGmOyAAoJEIaOsuA1yqREVsQP/AjfOAuQJ7awaUVsJqBLGADW
 qmxc1rd+wKv7e9s4Jtu8z8PaZklAd4E3M8M378BsJIiMSbHZhb/KUFQPVgkp5Rnz
 Ps9k7k4P3+yoovWruR1YRk+/mx5ra//MdJ+FNMe6wa3Y57X7NRAfzSSQOOnmkJ5+
 3aSz2IRKXBmSqpcMZVTgn1j/YATfZxpCmrTPSOdgyIjeWs+8s1SjaEFsgCaVb4vH
 V1B3HsMPRCtrR0BV0f1FA1xp1pXdAU3UeRecuVibP5DDIKhMqB7N8BWTi2nu8c+1
 8wZ4S3BNJwBPmHU/XOkjLWnoZ6gZVIx2DEeCdh0hXF2lsbJYELCPptYEApDPyOvF
 zli6cCdPcM+bnWzmQyBXmu7uPVBOz3lv1HAkodOwhof1K556baZfXF+OpZ21+/oj
 l3I9Ebr86soVmxMzY1FyMN0F+klNCPTzmx4GS0GHJDCpMLvfX5rRVR0EXggIPGMC
 Lug/G8ySP0s+R1NTx+I6zJUV3BXkjp2KQmfjiMSzWzOAMSdaucRu4S71mgCvx1uN
 5T4tWAAtl90O/6V+d3Lx4PMOUiBXCv3ZboDKNdRXrX3/omd2JkOKqj4J8hxJ1F0w
 l6jb8IIXiO6xElC6fBQ7Dq54kD7cLzEnFBn5I4Fg5AjPatbHDEjerArL8I+Loe/u
 E+V2mp0qzoUxtqi5aMND
 =AAie
 -----END PGP SIGNATURE-----

Merge tag 'usb-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

Felipe writes:

usb: patches for v3.15

another substantial pull request with new features all over
the place.

dwc3 got a bit closer towards hibernation support with after
a few patches re-factoring code to be reused for hibernation.
Also in dwc3 two new workarounds for known silicon bugs have
been implemented, some randconfig build errors have been fixed,
and it was taught about the new generic phy layer.

MUSB on AM335x now supports isochronous transfers thanks to
George Cherian's work.

The atmel_usba driver got two crash fixes: one when no endpoint
was specified in DeviceTree data and another when stopping the UDC
in DEBUG builds.

Function FS got a much needed fix to ffs_epfile_io() which was
copying too much data to userspace in some cases.

The printer gadget got a fix for a possible deadlock and plugged
a memory leak.

Ethernet drivers now use NAPI for RX which gives improved throughput.

Other than that, the usual miscelaneous fixes, cleanups, and
the like.

Signed-of-by: Felipe Balbi <balbi@ti.com>
2014-03-07 16:47:36 -08:00
Chuansheng Liu
cfe919b53b usb: gadget: return the right length in ffs_epfile_io()
When the request length is aligned to maxpacketsize, sometimes
the return length ret > the user space requested len.

At that time, we will use min_t(size_t, ret, len) to limit the
size in case of user data buffer overflow.

But we need return the min_t(size_t, ret, len) to tell the user
space rightly also.

[ balbi@ti.com: also fix comment's indentation ]

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: David Cohen <david.a.cohen@linux.intel.com>
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-07 10:03:25 -06:00
Weinn Jheng
716fb91dfe usb: gadget: u_ether: move hardware transmit to RX NAPI
In order to reduce the interrupt times in the embedded system,
a receiving workqueue is introduced.
This modification also enhanced the overall throughput as the
benefits of reducing interrupt occurrence.

This work was derived from previous work:
u_ether: move hardware transmit to RX workqueue.
Which should be base on codeaurora's work.

However, the benchmark on my platform shows the throughput
with workqueue is slightly better than NAPI.

Signed-off-by: Weinn Jheng <clanlab.proj@gmail.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: Stephen Hemminger <shemminger@vyatta.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-07 10:03:24 -06:00
Michal Nazarewicz
ac8dde11f2 usb: gadget: f_fs: Add flags to descriptors block
This reworks the way SuperSpeed descriptors are added and instead of
having a magic after full and high speed descriptors, it reworks the
whole descriptors block to include a flags field which lists which
descriptors are present and makes future extensions possible.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:11 -06:00
Manu Gautam
8d4e897bd0 usb: gadget: f_fs: Add support for SuperSpeed Mode
Allow userspace to pass SuperSpeed descriptors and
handle them in the driver accordingly.
This change doesn't modify existing desc_header and thereby
keeps the ABI changes backward compatible i.e. existing
userspace drivers compiled with old header (functionfs.h)
would continue to work with the updated kernel.

Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:10 -06:00
Gregory CLEMENT
d8eb6c653e usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled
commit 511f3c5 (usb: gadget: udc-core: fix a regression during gadget driver
unbinding) introduced a crash when DEBUG is enabled.

The debug trace in the atmel_usba_stop function made the assumption that the
driver pointer passed in parameter was not NULL, but since the commit above,
such assumption was no longer always true.

This commit now uses the driver pointer stored in udc which fixes this
issue.

[ balbi@ti.com : improved commit log a bit ]

Cc: <stable@vger.kernel.org> # v3.2+
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:10 -06:00
Alexandre Belloni
fb0e139d93 usb: gadget: atmel_usba: fix crash when no endpoint are specified
If no endpoints are present in the device tree, the kernel will crash with the
following error:

Unable to handle kernel paging request at virtual address 00101008
[...]
[<c0222ff4>] (composite_dev_prepare) from [<c022326c>] (composite_bind+0x5c/0x190)
[<c022326c>] (composite_bind) from [<c021ff8c>] (udc_bind_to_driver+0x48/0xf0)
[<c021ff8c>] (udc_bind_to_driver) from [<c02208e0>] (usb_gadget_probe_driver+0x7c/0xa0)
[<c02208e0>] (usb_gadget_probe_driver) from [<c0008970>] (do_one_initcall+0x94/0x140)
[<c0008970>] (do_one_initcall) from [<c04b4b50>] (kernel_init_freeable+0xec/0x1b4)
[<c04b4b50>] (kernel_init_freeable) from [<c0376cc4>] (kernel_init+0x8/0xe4)
[<c0376cc4>] (kernel_init) from [<c0009590>] (ret_from_fork+0x14/0x24)
Code: e5950014 e1a04001 e5902008 e3a010d0 (e5922008)
---[ end trace 35c74bdd89b373d0 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

This checks for that case and returns an error, not allowing the driver to be
loaded with no endpoints.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:10 -06:00
Marek Szyprowski
b83e333a4d usb: gadget: s3c-hsotg: add proper suspend/resume support
This patch adds suspend/resume support to s3c-hsotg driver. It makes UDC
driver more power efficient.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:06 -06:00
Robert Baldyga
0e06bcac79 usb: gadget: at91_udc: fix ep maxpacket initialisation
This patch fixes problem with unnecessary usb_ep_set_maxpacket_limit() usage.
It should not be used in at91udc_probe() function, where maxpacket values are
set for field "maxpacket" of struct at91_ep, which is representation of
endpoint in driver internals. Function usb_ep_set_maxpacket_limit() is called
in udc_reinit() function, where struct usb_ep instances are initialised with
values set previously in struct at91_ep instances. So it's very important to
initialise it properly.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:49 -06:00
Greg Kroah-Hartman
3c701651c8 Merge 3.14-rc4 into usb-next
We want the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-24 15:59:22 -08:00
Andrzej Pietrasiewicz
f0f42204d0 usb: gadget: fix NULL pointer dereference
Fix possible NULL pointer dereference introduced in
commit 219580e (usb: f_fs: check quirk to pad epout
buf size when not aligned to maxpacketsize)

In cases we do wait with:

wait_event_interruptible(epfile->wait, (ep = epfile->ep));

for endpoint to be enabled, functionfs_bind() has not been called yet
and epfile->ffs->gadget is still NULL and the automatic variable 'gadget'
has been initialized with NULL at the point of its definition.
Later on it is used as a parameter to:

usb_ep_align_maybe(gadget, ep->ep, len)

which in turn dereferences it.

This patch fixes it by moving the actual assignment to the local 'gadget'
variable after the potential waiting has completed.

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:17:23 -06:00
Peter Chen
8679059e36 usb: gadget: printer: using gadget_is_otg to check otg support at runtime
We need to use gadget_is_otg to check if the gadget is really
otg support at runtime, other composite gadget drivers have already
followed this method.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:17:22 -06:00
Dan Carpenter
798a2468e0 usb: gadget: gr_udc: remove some unneeded error handling
Debugfs function return an ERR_PTR if they compiled out.  We don't need
to test for that here because if the debugfs file are compiled out then
it is ok to pass an ERR_PTR to debugfs_create_file() since it will just
be a no-op stub.

Debugfs return NULLs on error, but we don't need to test for that either
because debugfs_create_file() will accept NULL pointers.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:16:17 -06:00
Bo Shen
3fcba0d87b usb: gadget: at91: using USBA_NR_DMAS for DMA channels
The SoCs earlier than sama5d3, they have the same number endpoints
and DMA channels. In driver code, they use the same definition
USBA_NR_ENDPOINTS for both endpoints and dma channels. However,
in sama5d3, it has different number for endpoints and DMA channels.
So, define a new macro USBA_NR_DMAs for DMA channels. And the
USBA_NR_ENDPOINS is not used anymore, remove it at the same time.

Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-19 13:47:12 -06:00
Bo Shen
aa7be0f8f7 usb: gadget: at91: fix the number of endpoint parameter
In sama5d3 SoC, there are 16 endpoints, which is different with
earlier SoCs (only have 7 endpoints). The USBA_NR_ENDPOINTS macro
is not suitable for sama5d3. So, get the endpoints number through
the udc->num_ep, which get from platform data for non-dt kernel,
or parse from dt node.

Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-19 13:46:48 -06:00
Robert Baldyga
2e4c7553cd usb: gadget: f_fs: add aio support
This patch adds asynchronous I/O support for FunctionFS endpoint files.
It adds ffs_epfile_aio_write() and ffs_epfile_aio_read() functions responsible
for preparing AIO operations.

It also modifies ffs_epfile_io() function, adding aio handling code. Instead
of extending list of parameters of this function, there is new struct
ffs_io_data which contains all information needed to perform I/O operation.
Pointer to this struct replaces "buf" and "len" parameters of ffs_epfile_io()
function. Allocated buffer is freed immediately only after sync operation,
because in async IO it's freed in complete funcion. For each async operation
an USB request is allocated, because it allows to have more than one request
queued on single endpoint.

According to changes in ffs_epfile_io() function, functions ffs_epfile_write()
and ffs_epfile_read() are updated to use new API.

For asynchronous I/O operations there is new request complete function named
ffs_epfile_async_io_complete(), which completes AIO operation, and frees
used memory.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:02 -06:00
Robert Baldyga
23de91e970 usb: gadget: f_fs: add poll for endpoint 0
This patch adds poll function for file representing ep0.

Ability of read from or write to ep0 file is related with actual state of ffs:
- When desctiptors or strings are not written yet, POLLOUT flag is set.
- If there is any event to read, POLLIN flag is set.
- If setup request was read, POLLIN and POLLOUT flag is set, to allow
  send response (by performing I/O operation consistent with setup request
  direction) or set stall (by performing I/O operation opposite  setup
  request direction).

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Robert Baldyga
0a7b1f8a70 usb: gadget: f_fs: fix setup request handling
This patch fixes __ffs_ep0_queue_wait() function, which now returns number of
bytes transferred in USB request or error code in case of failure. This is
needed by ffs_ep0_read() function, when read data is copied to userspace.

It also cleans up code by removing usused variable ep0req_status.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Michal Nazarewicz
a7ecf0544f usb: gadget: functionfs: replace FFS_SETUP_STATUS with an inline function
The FFS_SETUP_STATUS macro could be trivialy replaced with an static
inline function but more importantly its name was tad confusing.
The name suggested it was a simple accessor macro but it actually
did change the state of the ffs_data structure perfomring
a FFS_SETUP_CANCELLED -> FFS_NO_SETUP transition.  The name of the
function -- ffs_setup_state_clear_cancelled -- should better
describe what the function actually does.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Michal Nazarewicz
e46318a000 usb: gadget: functionfs: fix typo in the enum variable
Since “cancelled” is spelled with two “l”s, rename FFS_SETUP_CANCELED
to FFS_SETUP_CANCELLED.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Andrzej Pietrasiewicz
da13a7738e usb: gadget: FunctionFS: use consistent naming with regard to ffs_lock
Consistently prefix function name with underscore if the function has to
be called with ffs_lock taken.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz
10b69ce08c usb: gadget: FunctionFS: staticize functions used only in f_fs.c
ffs_alloc_dev and ffs_free_dev are used only in f_fs.c,
so make them static.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz
ab13cb0c0d usb: gadget: code cleanup
Remove trailing whitespace

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Andrzej Pietrasiewicz
ea365922f9 usb: gadget: FunctionFS: dereference ffs_dev conditionally
ffs_dev->ffs_release_dev_callback should be accessed only if ffs_dev
is not NULL.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Robert Baldyga
c9f721b2f3 usb: gadget: s3c-hsotg: stall ep0 in set_halt function
When s3c_hsotg_ep_sethalt() function is called for ep0 it should be stalled
in the same way that it is in s3c_hsotg_process_control() function, because
SET_HALT for ep0 is delayed response for setup request. Endpoint 0, if
halted, it doesn't need CLEAR_HALT because it clears "stalled" state
automatically when next setup request is received.

For this reason this patch moves code setting ep0 to "stalled" state to new
function named s3c_hsotg_stall_ep0() which is called in
s3c_hsotg_process_control() function as an immediate response for setup
request, and in s3c_hsotg_ep_sethalt() function as a delayed response for
setup request.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
wenlin.kang
7e98f60003 usb: gadget: printer: fix memory leak
When read data from g_printer, we see a Segmentation fault. eg:

Unable to handle kernel paging request at virtual address bf048000 pgd
= cf038000 [bf048000] *pgd=8e8cf811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT ARM Modules linked in: bluetooth
rfcomm g_printer
CPU: 0    Not tainted  (3.4.43-WR5.0.1.9_standard #1)
PC is at __copy_to_user_std+0x310/0x3a8 LR is at 0x4c808010
pc : [<c036e990>]    lr : [<4c808010>]    psr: 20000013
sp : cf883ea8  ip : 80801018  fp : cf883f24
r10: bf04706c  r9 : 18a21205  r8 : 21953888
r7 : 201588aa  r6 : 5109aa16  r5 : 0705aaa2  r4 : 5140aa8a
r3 : 0000004c  r2 : 00000fdc  r1 : bf048000  r0 : bef5fc3c
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 8f038019  DAC: 00000015 Process
g_printer_test. (pid: 661, stack limit = 0xcf8822e8)
Stack: (0xcf883ea8 to 0xcf884000)
3ea0:                   bf047068 00001fff bef5ecb9 cf882000 00001fff bef5ecb9
3ec0: 00001fff 00000000 cf2e8724 bf044d3c 80000013 80000013 00000001
bf04706c
3ee0: cf883f24 cf883ef0 c012e5ac c0324388 c007c8ac c0046298 00008180
cf29b900
3f00: 00002000 bef5ecb8 cf883f68 00000003 cf882000 cf29b900 cf883f54
cf883f28
3f20: c012ea08 bf044b0c c000eb88 00000000 cf883f7c 00000000 00000000
00002000
3f40: bef5ecb8 00000003 cf883fa4 cf883f58 c012eae8 c012e960 00000001
bef60cb8
3f60: 000000a8 c000eb88 00000000 00000000 cf883fa4 00000000 c014329c
00000000
3f80: 000000d4 41af63f0 00000003 c000eb88 cf882000 00000000 00000000
cf883fa8
3fa0: c000e920 c012eaa4 00000000 000000d4 00000003 bef5ecb8 00002000
bef5ecb8
3fc0: 00000000 000000d4 41af63f0 00000003 b6f534c0 00000000 419f9000
00000000
3fe0: 00000000 bef5ecac 000086d9 41a986bc 60000010 00000003 0109608a
0088828a
Code: f5d1f07c e8b100f0 e1a03c2e e2522020 (e8b15300) ---[ end trace
97e2618e250e3377 ]--- Segmentation fault

The root cause is the dev->rx_buffers list has been broken.
When we call printer_read(), the following call tree is triggered:

printer_read()
	|
	+---setup_rx_reqs(req)
	|	|
	|	+---usb_ep_queue(req)
	|	|	|
	|	|	+---...
	|	|		|
	|	|		+---rx_complete(req).
	|	|
	|	+---add the req to dev->rx_reqs_active
	|
	+---while(!list_empty(&dev->rx_buffers)))

The route happens when we don't use DMA or fail to start DMA in USB
driver. We can see: in the case, in rx_complete() it will add the req
to dev->rx_buffers. meanwhile we see that we will also add the req to
dev->rx_reqs_active after usb_ep_queue() return, so this adding will
break the dev->rx_buffers out.

After, when we call list_empty() to check dev->rx_buffers in while(),
due to can't check correctly dev->rx_buffers, so the Segmentation fault
occurs when copy_to_user() is called.

Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
wenlin.kang
2c2b04253b usb: gadget: printer: fix possible deadlock
The problem occurs in follow path.

printer_read()
	|
	+---setup_rx_reqs()
		|
		+---usb_ep_queue()
			|
			+---...
				|
				+---rx_complete()

Although it is clear from code, we can't get it normally.
only when we enable some spin_lock debug config option, we can find it.
eg:
BUG: spinlock lockup on CPU#0, g_printer_test_/584
 lock: bf05e158, .magic: dead4ead, .owner: g_printer_test_/584, .owner_cpu: 0
[<c0016e1c>] (unwind_backtrace+0x0/0x104) from [<c067aef8>] (dump_stack+0x20/0x24)
[<c067aef8>] (dump_stack+0x20/0x24) from [<c0680bec>] (spin_dump+0x8c/0x94)
[<c0680bec>] (spin_dump+0x8c/0x94) from [<c039071c>] (do_raw_spin_lock+0x128/0x154)
[<c039071c>] (do_raw_spin_lock+0x128/0x154) from [<c0685618>] (_raw_spin_lock_irqsave+0x64/0x70)
[<c0685618>] (_raw_spin_lock_irqsave+0x64/0x70) from [<bf05b4e8>] (rx_complete+0x54/0x10c [g_printer])
[<bf05b4e8>] (rx_complete+0x54/0x10c [g_printer]) from [<c0480478>] (musb_g_giveback+0x78/0x88)
[<c0480478>] (musb_g_giveback+0x78/0x88) from [<c048060c>] (rxstate+0xa0/0x10c)
[<c048060c>] (rxstate+0xa0/0x10c) from [<c0480d50>] (musb_ep_restart+0x44/0x70)
[<c0480d50>] (musb_ep_restart+0x44/0x70) from [<c0480fe4>] (musb_gadget_queue+0xe8/0xf8)
[<c0480fe4>] (musb_gadget_queue+0xe8/0xf8) from [<bf05b2b0>] (setup_rx_reqs+0xa4/0x178 [g_printer])
[<bf05b2b0>] (setup_rx_reqs+0xa4/0x178 [g_printer]) from [<bf05bb58>] (printer_read+0x9c/0x3f4 [g_printer])
[<bf05bb58>] (printer_read+0x9c/0x3f4 [g_printer]) from [<c01387f0>] (vfs_read+0xb4/0x144)
[<c01387f0>] (vfs_read+0xb4/0x144) from [<c01388d0>] (sys_read+0x50/0x124)
[<c01388d0>] (sys_read+0x50/0x124) from [<c000e900>] (ret_fast_syscall+0x0/0x3c)

The root cause is that we use the same lock two time in a path, so to avoid
the deadlock, we need to unlock in setup_rx_reqs(), and only unlock.

Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
Sachin Kamat
236064c253 usb: gadget: s3c-hsudc: remove unused label
Fixes the following compilation warning:
drivers/usb/gadget/s3c-hsudc.c: In function ‘s3c_hsudc_probe’:
drivers/usb/gadget/s3c-hsudc.c:1347:1: warning: label ‘err_add_device’
defined but not used [-Wunused-label]

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Sachin Kamat
e362115a07 usb: gadget: s3c2410_udc: Fix build error
Pass value instead of address as expected by 'usb_ep_set_maxpacket_limit'.
Fixes the following compilation error introduced by commit e117e742d3
("usb: gadget: add "maxpacket_limit" field to struct usb_ep"):

drivers/usb/gadget/s3c2410_udc.c: In function ‘s3c2410_udc_reinit’:
drivers/usb/gadget/s3c2410_udc.c:1632:3: error:
cannot take address of bit-field ‘maxpacket’
   usb_ep_set_maxpacket_limit(&ep->ep, &ep->ep.maxpacket);

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Reviewed-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Julia Lawall
abcdcc29c6 usb: gadget: fix error return code
Set the return variable to an error code as done elsewhere in the function.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}

// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Jingoo Han
8b3bc14f2d usb: gadget: s3c-hsotg: use %pad for dma_addr_t
Use %pad for dma_addr_t to avoid the following build warnings
in printks.

drivers/usb/gadget/s3c-hsotg.c: In function 's3c_hsotg_start_req'
drivers/usb/gadget/s3c-hsotg.c:722:3: warning: format '%x' expects argument of type 'unsigned int' but argument 6 has type
'dma_addr_t' [-Wformat]
drivers/usb/gadget/s3c-hsotg.c:792:3: warning: format '%x' expects argument of type 'unsigned int' but argument 5 has type
'dma_addr_t' [-Wformat]

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:52 -06:00
Matt Porter
1a7ed5bec4 usb: gadget: s3c-hsotg: fix build on x86 and other architectures
The readsl and writesl I/O accessors are only defined on some
architectures. The driver currently depends on CONFIG_ARM because
the build breaks on x86, in particular. Switch to use of ioread32_rep
and iowrite32_rep to fix build on all architectures and remove the
CONFIG_ARM dependency.

Also update printk formatting to handle a long long dma_addr_t to avoid
warnings on !32-bit architectures.

Signed-off-by: Matt Porter <mporter@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:52 -06:00
Florian Fainelli
2d1f7af3d6 usb: gadget: bcm63xx_udc: fix build failure on DMA channel code
Commit 3dc6475 ("bcm63xx_enet: add support Broadcom BCM6345 Ethernet")
changed the ENETDMA[CS] macros such that they are no longer macros, but
actual register offset definitions. The bcm63xx_udc driver was not
updated, and as a result, causes the following build error to pop up:

 CC      drivers/usb/gadget/u_ether.o
drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_write':
drivers/usb/gadget/bcm63xx_udc.c:642:24: error: called object '0' is not
a function
drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_reset_channel':
drivers/usb/gadget/bcm63xx_udc.c:698:46: error: called object '0' is not
a function
drivers/usb/gadget/bcm63xx_udc.c:700:49: error: called object '0' is not
a function

Fix this by updating usb_dmac_{read,write}l and usb_dmas_{read,write}l to
take an extra channel argument, and use the channel width
(ENETDMA_CHAN_WIDTH) to offset the register we want to access, hence
doing again what the macro implicitely did for us.

Cc: Kevin Cernekee <cernekee@gmail.com>
Cc: Jonas Gorski <jogo@openwrt.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:34:54 -06:00
Sachin Kamat
d246c9d55a usb: gadget: s3c2410_udc: Fix build error
Pass value instead of address as expected by 'usb_ep_set_maxpacket_limit'.
Fixes the following compilation error introduced by commit e117e742d3
("usb: gadget: add "maxpacket_limit" field to struct usb_ep"):

drivers/usb/gadget/s3c2410_udc.c: In function ‘s3c2410_udc_reinit’:
drivers/usb/gadget/s3c2410_udc.c:1632:3: error:
cannot take address of bit-field ‘maxpacket’
   usb_ep_set_maxpacket_limit(&ep->ep, &ep->ep.maxpacket);

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Reviewed-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:34:04 -06:00
Richard Weinberger
275200b38d Remove MACH_OMAP_H4_OTG
The symbol is an orphan, get rid of it.

Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-11 13:39:55 -08:00
Linus Torvalds
f2c73464d7 ARM: SoC cleanups for 3.14
This is the branch where we usually queue up cleanup efforts, moving
 drivers out of the architecture directory, header file restructuring,
 etc. Sometimes they tangle with new development so it's hard to keep it
 strictly to cleanups.
 
 Some of the things included in this branch are:
 
 * Atmel SAMA5 conversion to common clock
 * Reset framework conversion for tegra platforms
  - Some of this depends on tegra clock driver reworks that are shared with Mike
    Turquette's clk tree.
 * Tegra DMA refactoring, which are shared branches with the DMA tree.
 * Removal of some header files on exynos to prepare for multiplatform
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJS4Vf7AAoJEIwa5zzehBx3f9UP/jwMlbfbSZHfNQ/QG0SqZ9RD
 zvddyDMHY/qXnzgF3Dax+JR9BDDVy8AlQe713FCoiHJZggWRAbbavkx8gxITDrZQ
 6NYaEkkuVxqyM8APl3PwMqYm8UZ8MUf4lCltlOA4jkesY9vue91AFnfyKh2CvHrn
 Leg4XT6mFzf/vYDL6RbvTz/Qr253uv3KvYBxkeiRNa0Y7OXRemEXSOfgxh0YGxUl
 LZ2IWQFOh/DH4kaeQI8V4G67X3ceHiFyhCnl0CPwfxaZaNBVaxvIFgIUTdetS6Sb
 zcXa029tE/Dfsr55vZAv9LUHEipCSOeE5rn2EJWehTWyM7vJ42Eozqgh+zfCjXS7
 Ib6g2npsvIluQit/RdITu44h5yZlrQsLgKTGJ8jjXqbT4HQ/746W8b/TP0YLtbw7
 N8oqr7k4vsZyF0dAYZQtfQUZeGISz67UbFcdzl9tmYOR7HFuAYkAQYst77zkVJf8
 om59BAYYTG5FNjQ4I9AKUfJzxXYveI6AKpXSCCZiahpFM2D1CJIzp9Wi0GwK1HRR
 sFVWhS0dajvz63pVVC2tw5Sq4J7onRRNGIXFPoE5fkmlelm0/q0zzGjw3Z0nTqbZ
 8zxuwuy2FfPJK11GbUAIhAgn1sCLYyAhl6IE+FsanGeMOSGIMrH0v5/HphAxoCXt
 BvqMDogyLoGPce1Gm3pJ
 =3CcT
 -----END PGP SIGNATURE-----

Merge tag 'cleanup-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC cleanups from Olof Johansson:
 "This is the branch where we usually queue up cleanup efforts, moving
  drivers out of the architecture directory, header file restructuring,
  etc.  Sometimes they tangle with new development so it's hard to keep
  it strictly to cleanups.

  Some of the things included in this branch are:

   * Atmel SAMA5 conversion to common clock
   * Reset framework conversion for tegra platforms
    - Some of this depends on tegra clock driver reworks that are shared
      with Mike Turquette's clk tree.
   * Tegra DMA refactoring, which are shared branches with the DMA tree.
   * Removal of some header files on exynos to prepare for
     multiplatform"

* tag 'cleanup-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (169 commits)
  ARM: mvebu: move Armada 370/XP specific definitions to armada-370-xp.h
  ARM: mvebu: remove prototypes of non-existing functions from common.h
  ARM: mvebu: move ARMADA_XP_MAX_CPUS to armada-370-xp.h
  serial: sh-sci: Rework baud rate calculation
  serial: sh-sci: Compute overrun_bit without using baud rate algo
  serial: sh-sci: Remove unused GPIO request code
  serial: sh-sci: Move overrun_bit and error_mask fields out of pdata
  serial: sh-sci: Support resources passed through platform resources
  serial: sh-sci: Don't check IRQ in verify port operation
  serial: sh-sci: Set the UPF_FIXED_PORT flag
  serial: sh-sci: Remove duplicate interrupt check in verify port op
  serial: sh-sci: Simplify baud rate calculation algorithms
  serial: sh-sci: Remove baud rate calculation algorithm 5
  serial: sh-sci: Sort headers alphabetically
  ARM: EXYNOS: Kill exynos_pm_late_initcall()
  ARM: EXYNOS: Consolidate selection of PM_GENERIC_DOMAINS for Exynos4
  ARM: at91: switch Calao QIL-A9260 board to DT
  clk: at91: fix pmc_clk_ids data type attriubte
  PM / devfreq: use inclusion <mach/map.h> instead of <plat/map-s5p.h>
  ARM: EXYNOS: remove <mach/regs-clock.h> for exynos
  ...
2014-01-23 18:36:55 -08:00
Paul Gortmaker
803a536243 usb: delete non-required instances of include <linux/init.h>
None of these files are actually using any __init type directives
and hence don't need to include <linux/init.h>.  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-08 15:01:39 -08:00
Wei Yongjun
d85b277ed1 usb: gadget: remove unused variable in gr_queue_int()
The variable 'dev' is initialized but never used
otherwise, so remove the unused variable.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-07 16:30:25 -08:00
Wei Yongjun
62e3986cae usb: gadget: s3c-hsotg: remove duplicated include from s3c-hsotg.c
Remove duplicated include.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-07 16:30:10 -08:00
Olof Johansson
509633c836 Linux 3.13-rc4
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.15 (GNU/Linux)
 
 iQEcBAABAgAGBQJSrhGrAAoJEHm+PkMAQRiGsNoH/jIK3CsQ2lbW7yRLXmfgtbzz
 i2Kep6D4SDvmaLpLYOVC8xNYTiE8jtTbSXHomwP5wMZ63MQDhBfnEWsEWqeZ9+D9
 3Q46p0QWuoBgYu2VGkoxTfygkT6hhSpwWIi3SeImbY4fg57OHiUil/+YGhORM4Qc
 K4549OCTY3sIrgmWL77gzqjRUo+pQ4C73NKqZ3+5nlOmYBZC1yugk8mFwEpQkwhK
 4NRNU760Fo+XIht/bINqRiPMddzC15p0mxvJy3cDW8bZa1tFSS9SB7AQUULBbcHL
 +2dFlFOEb5SV1sNiNPrJ0W+h2qUh2e7kPB0F8epaBppgbwVdyQoC2u4uuLV2ZN0=
 =lI2r
 -----END PGP SIGNATURE-----

Merge tag 'v3.13-rc4' into next/cleanup

Linux 3.13-rc4
2013-12-26 10:31:33 -08:00
Felipe Balbi
4685d021f5 usb: gadget: at91_udc: fix build warning
commit e117e742 (usb: gadget: add "maxpacket_limit"
field to struct usb_ep) added a build warning to
at91_udc when it passed the wrong argument to
usb_ep_set_maxpacket_limit().

Fix this by passing correct argument.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-12-23 19:28:17 -06:00
Andreas Larsson
27e9dcc924 usb: gadget: Add UDC driver for Aeroflex Gaisler GRUSBDC
This adds an UDC driver for GRUSBDC USB Device Controller cores available in the
GRLIB VHDL IP core library. The driver only supports DMA mode.

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-12-23 19:26:13 -06:00
Matt Porter
f7e504c72d usb: gadget: s3c-hsotg: get phy bus width from phy subsystem
Adds support for querying the phy bus width from the generic phy
subsystem. Configure UTMI bus width in GUSBCFG based on this value.

Signed-off-by: Matt Porter <mporter@linaro.org>
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-12-23 14:31:49 -06:00
Matt Porter
74084844e8 usb: gadget: s3c-hsotg: enable generic phy support
Adds support for the generic PHY subsystem. Generic PHY
support is probed and then the driver falls back to checking
for an old style USB PHY and pdata if not found.

Signed-off-by: Matt Porter <mporter@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-12-23 14:31:16 -06:00