1. 01 Jun, 2016 34 commits
  2. 31 May, 2016 6 commits
    • Peter Griffin's avatar
      usb: dwc3: st: Fix USB_DR_MODE_PERIPHERAL configuration. · 27a0faaf
      Peter Griffin authored
      Set USB3_FORCE_VBUSVALID when configured for USB_DR_MODE_PERIPHERAL
      mode, as it is required to have a working setup.
      
      This worked on the internal driver by relying on the reset
      value of the syscfg register as the bits aren't explicity cleared
      and set like the upstream driver.
      
      Also add a comment about what setting this bit means.
      Signed-off-by: default avatarPeter Griffin <peter.griffin@linaro.org>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      27a0faaf
    • William Wu's avatar
      usb: gadget: composite: don't queue OS desc req if length is invalid · 7e14f47a
      William Wu authored
      In OS descriptors handling, if ctrl->bRequestType is
      USB_RECIP_DEVICE and w_index != 0x4 or (w_value >> 8)
      is true, it will not assign a valid value to req->length,
      but use the default value(-EOPNOTSUPP), and queue an
      OS desc request with the invalid req->length. It always
      happens on the platforms which use os_desc (for example:
      rk3366, rk3399), and cause kernel panic as follows
      (use dwc3 driver):
      
      Unable to handle kernel paging request at virtual address ffffffc0f7e00000
      Internal error: Oops: 96000146 [#1] PREEMPT SMP
      PC is at __dma_clean_range+0x18/0x30
      LR is at __swiotlb_map_page+0x50/0x64
      Call trace:
      [<ffffffc0000930f8>] __dma_clean_range+0x18/0x30
      [<ffffffc00062214c>] usb_gadget_map_request+0x134/0x1b0
      [<ffffffc0005c289c>] __dwc3_ep0_do_control_data+0x110/0x14c
      [<ffffffc0005c2d38>] __dwc3_gadget_ep0_queue+0x198/0x1b8
      [<ffffffc0005c2e18>] dwc3_gadget_ep0_queue+0xc0/0xe8
      [<ffffffc00061cfec>] composite_ep0_queue.constprop.14+0x34/0x98
      [<ffffffc00061dfb0>] composite_setup+0xf60/0x100c
      [<ffffffc0006204dc>] android_setup+0xd8/0x138
      [<ffffffc0005c29a4>] dwc3_ep0_delegate_req+0x34/0x50
      [<ffffffc0005c3534>] dwc3_ep0_interrupt+0x5dc/0xb58
      [<ffffffc0005c0c3c>] dwc3_thread_interrupt+0x15c/0xa24
      
      With this patch, the gadget driver will not queue
      a request and return immediately if req->length is
      invalid. And the usb controller driver can handle
      the unsupport request correctly.
      Signed-off-by: default avatarWilliam Wu <william.wu@rock-chips.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      7e14f47a
    • Jim Lin's avatar
      usb: gadget: f_fs: Fix kernel panic if use_os_string not set · c6010c8b
      Jim Lin authored
      If c->cdev->use_os_string flag is not set,
      don't need to invoke ffs_do_os_descs() in _ffs_func_bind.
      So uninitialized ext_compat_id pointer won't be accessed by
      __ffs_func_bind_do_os_desc to cause kernel panic.
      Signed-off-by: default avatarJim Lin <jilin@nvidia.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      c6010c8b
    • Heinrich Schuchardt's avatar
      usb: gadget: f_tcm: out of bound access in usbg_drop_tpg · e877b729
      Heinrich Schuchardt authored
      Commit dc8c46a5 ("usb: gadget: f_tcm: convert to new function
      interface with backward compatibility") introduced a possible out
      of bounds memory access:
      
      If tpg is not found in function usbg_drop_tpg,
      tpg_instances[TPG_INSTANCES] is accessed.
      
      Fixes: dc8c46a5 ("usb: gadget: f_tcm: convert to new function interface with backward compatibility")
      Signed-off-by: default avatarHeinrich Schuchardt <xypron.glpk@gmx.de>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      e877b729
    • Heinrich Schuchardt's avatar
      usb: gadget: avoid exposing kernel stack · ffeee83a
      Heinrich Schuchardt authored
      Function in_rq_cur copies random bytes from the stack.
      Zero the memory instead.
      
      Fixes: 132fcb46 ("usb: gadget: Add Audio Class 2.0 Driver")
      Signed-off-by: default avatarHeinrich Schuchardt <xypron.glpk@gmx.de>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      ffeee83a
    • Arnd Bergmann's avatar
      usb: dwc2: fix regression on big-endian PowerPC/ARM systems · 23e34392
      Arnd Bergmann authored
      A patch that went into Linux-4.4 to fix big-endian mode on a Lantiq
      MIPS system unfortunately broke big-endian operation on PowerPC
      APM82181 as reported by Christian Lamparter, and likely other
      systems.
      
      It actually introduced multiple issues:
      
      - it broke big-endian ARM kernels: any machine that was working
        correctly with a little-endian kernel is no longer using byteswaps
        on big-endian kernels, which clearly breaks them.
      - On PowerPC the same thing must be true: if it was working before,
        using big-endian kernels is now broken. Unlike ARM, 32-bit PowerPC
        usually uses big-endian kernels, so they are likely all broken.
      - The barrier for dwc2_writel is on the wrong side of the __raw_writel(),
        so the MMIO no longer synchronizes with DMA operations.
      - On architectures that require specific CPU instructions for MMIO
        access, using the __raw_ variant may turn this into a pointer
        dereference that does not have the same effect as the readl/writel.
      
      This patch is a simple revert for all architectures other than MIPS,
      in the hope that we can more easily backport it to fix the regression
      on PowerPC and ARM systems without breaking the Lantiq system again.
      
      We should follow this up with a more elaborate change to add runtime
      detection of endianness, to make sure it also works on all other
      combinations of architectures and implementations of the usb-dwc2
      device. That patch however will be fairly large and not appropriate
      for backports to stable kernels.
      
      Felipe suggested a different approach, using an endianness switching
      register to always put the device into LE mode, but unfortunately
      the dwc2 hardware does not provide a generic way to do that. Also,
      I see no practical way of addressing the problem more generally by
      patching architecture specific code on MIPS.
      
      Fixes: 95c8bc36 ("usb: dwc2: Use platform endianness when accessing registers")
      Acked-by: default avatarJohn Youn <johnyoun@synopsys.com>
      Tested-by: default avatarChristian Lamparter <chunkeey@googlemail.com>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      23e34392