The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors. The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.
This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
On some Intel MID platforms the ChipIdea USB controller is used. The EHCI PCI
is in conflict with the proper driver. The patch makes ehci-pci to be ignored
in favour of ChipIdea controller.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
The patch joins the string literals for happy debugging. There is no functional
change.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Currently the USB stack assumes that all host controller drivers are
capable of receiving wakeup requests from downstream devices.
However, this isn't true for the isp1760-hcd driver, which means that
it isn't safe to do a runtime suspend of any device attached to a
root-hub port if the device requires wakeup.
This patch adds a "cant_recv_wakeups" flag to the usb_hcd structure
and sets the flag in isp1760-hcd. The core is modified to prevent a
direct child of the root hub from being put into runtime suspend with
wakeup enabled if the flag is set.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Nicolas Pitre <nico@linaro.org>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
The usbfs API has a peculiar hole: Users are not allowed to reap their
URBs after the device has been disconnected. There doesn't seem to be
any good reason for this; it is an ad-hoc inconsistency.
The patch allows users to issue the USBDEVFS_REAPURB and
USBDEVFS_REAPURBNDELAY ioctls (together with their 32-bit counterparts
on 64-bit systems) even after the device is gone. If no URBs are
pending for a disconnected device then the ioctls will return -ENODEV
rather than -EAGAIN, because obviously no new URBs will ever be able
to complete.
The patch also adds a new capability flag for
USBDEVFS_GET_CAPABILITIES to indicate that the reap-after-disconnect
feature is supported.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Chris Dickens <christopher.a.dickens@gmail.com>
Acked-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Memory allocation failures are reported by a central facility.
No need to repeat the job.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan writes:
USB-serial updates for v3.20-rc1
Removal of dead code in mos7840 and a clean-up of the option blacklist
handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Since commit e9f2cefb0c ("usb: phy: generic: migrate to gpio_desc") a
kernel hang is observed on imx51-babbage board:
[ 1.392824] ci_hdrc ci_hdrc.1: doesn't support gadget
[ 1.397975] ci_hdrc ci_hdrc.1: EHCI Host Controller
[ 1.403205] ci_hdrc ci_hdrc.1: new USB bus registered, assigned bus number 1
[ 1.422335] ci_hdrc ci_hdrc.1: USB 2.0 started, EHCI 1.00
[ 1.432962] hub 1-0:1.0: USB hub found
[ 1.437119] hub 1-0:1.0: 1 port detected
This hang happens because the reset GPIO stays at logic level 0.
The USB PHY reset gpio is defined in the dts file as:
reset-gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
, which means it is active low, so what the gpio reset pin needs to do in this
case is the following:
- Go to logic level 0 to reset the USB PHY
- Stay at 0 for a bit
- Go back to logic level 1
When switching to gpiod API we need to following according to
Documentation/gpio/consumer.txt:
"The first thing a driver must do with a GPIO is setting its direction. If no
direction-setting flags have been given to gpiod_get*(), this is done by
invoking one of the gpiod_direction_*() functions:
int gpiod_direction_input(struct gpio_desc *desc)
int gpiod_direction_output(struct gpio_desc *desc, int value)"
Since no direction-setting flags have been given to devm_gpiod_get_optional()
in our case, we need to use gpiod_direction_output to comply with the gpiod API.
With this change the USB PHY reset performs a proper reset, the kernel boots
fine and USB host is functional.
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
It is currently possible to configure the dwc2 driver as built-in
when host mode or dual-role is enabled, but the USB core is
a loadable module. This leads to a link failure:
drivers/built-in.o: In function `_dwc2_hcd_start':
:(.text+0x84538): undefined reference to `usb_hcd_resume_root_hub'
drivers/built-in.o: In function `_dwc2_hcd_urb_dequeue':
:(.text+0x84aa0): undefined reference to `usb_hcd_check_unlink_urb'
:(.text+0x84e4c): undefined reference to `usb_hcd_unlink_urb_from_ep'
:(.text+0x84e74): undefined reference to `usb_hcd_giveback_urb'
drivers/built-in.o: In function `dwc2_assign_and_init_hc':
:(.text+0x86b98): undefined reference to `usb_hcd_unmap_urb_for_dma'
drivers/built-in.o: In function `_dwc2_hcd_urb_enqueue':
:(.text+0x8717c): undefined reference to `usb_hcd_link_urb_to_ep'
:(.text+0x872f4): undefined reference to `usb_hcd_unlink_urb_from_ep'
drivers/built-in.o: In function `dwc2_host_complete':
:(.text+0x875d4): undefined reference to `usb_hcd_unlink_urb_from_ep'
:(.text+0x87600): undefined reference to `usb_hcd_giveback_urb'
drivers/built-in.o: In function `dwc2_hcd_init':
:(.text+0x87ba8): undefined reference to `usb_disabled'
:(.text+0x87d38): undefined reference to `usb_create_hcd'
:(.text+0x88094): undefined reference to `usb_add_hcd'
:(.text+0x880dc): undefined reference to `usb_put_hcd'
drivers/built-in.o: In function `dwc2_hcd_remove':
:(.text+0x8821c): undefined reference to `usb_remove_hcd'
:(.text+0x8823c): undefined reference to `usb_put_hcd'
drivers/built-in.o: In function `dwc2_hc_handle_tt_clear.isra.10':
:(.text+0x88e2c): undefined reference to `usb_hub_clear_tt_buffer'
drivers/built-in.o: In function `dwc2_hcd_qtd_add':
:(.text+0x8b554): undefined reference to `usb_calc_bus_time'
To fix the problem, this patch changes the dependencies so that
dwc2 host mode can only be enabled if either the USB core is
built-in or both USB and dwc2 are modules.
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
This patch fixes an issue that the following commit causes NULL
pointer dereference in dma_release_channel().
"usb: renesas_usbhs: add support for requesting DT DMA"
(commit id abd2dbf6bb)
The usbhsf_dma_init_dt() should set fifo->{t,r}x_chan to NULL if
dma_request_slave_channel_reason() returns IS_ERR value.
Otherwise, usbhsf_dma_quit() will call dma_release_channel(), and then
NULL pointer dereference happens.
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Simon Horman <horms+renesas@verge.net.au>
Reported-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Declare the interrupt as "one shot" so that it is masked until the end
of the threaded handler. This prevents the irq core from spitting out an
error :
"Threaded irq requested with handler=NULL and !ONESHOT for irq 63"
This was introduced by commit "usb: phy: generic: add vbus support".
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
All the gpios, ie. reset-gpios and vbus-detect-gpio, should be optional
and not prevent the driver from working. Fix the regression in the
behavior introduced by commit "usb: phy: generic: migrate to gpio_desc".
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
USB reset interrupt is no more used to reset the controller.
Thus, reset the controller in pullup callback as described by
Synopsys programming guide. Otherwise enumeration sometimes
fails when usb configuration is switched without physical
disconnection.
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
hsotg->phyif is set in dwc2_gadget_init according to phy interface
width. Use it for configuration instead of hardcoded value.
Moreover, set USB turnaround time according to phy width.
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Pullup doesn't need to be enabled during usb reset since it is
already enabled. This leads to shorter chirp-k duration if done
during usb reset.
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Add a flag to request physical reset of the controller when
s3c_hsotg_core_init_disconnected is called.
During the usb reset, controller must not be fully reconfigured and
resetted. Else this leads to shorter chirp-k duration during
enumeration.
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Handle SET_FEATURE TEST_MODE request sent by the host.
Slightly rework FEATURE request handling to allow parsing
other request types than Endpoint.
Also add a debugfs to change test mode value from user space.
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
When clearing HALT on an endpoint, req->complete of in progress
requests must be called with locks off. New request should only be
started if there is not already a pending request on the endpoint.
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Gregory Herrero <gregory.herrero@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
The omap musb front-end calls into the phy driver directly
instead of using a generic phy interface, which causes a link
error when the specific driver is not built-in:
drivers/built-in.o: In function `omap2430_musb_disable':
usb/musb/omap2430.c:480: undefined reference to `omap_control_usb_set_mode'
drivers/built-in.o: In function `omap2430_musb_enable':
usb/musb/omap2430.c:466: undefined reference to `omap_control_usb_set_mode'
usb/musb/omap2430.c:447: undefined reference to `omap_control_usb_set_mode'
drivers/built-in.o: In function `omap_musb_set_mailbox':
usb/musb/omap2430.c:273: undefined reference to `omap_control_usb_set_mode'
usb/musb/omap2430.c:304: undefined reference to `omap_control_usb_set_mode'
drivers/built-in.o:(.debug_addr+0xbd9e0): more undefined references to `omap_control_usb_set_mode' follow
This adds an explicit dependency.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: ca784be36c ("usb: start using the control module driver")
Cc: <stable@vger.kernel.org> # v3.9+
Signed-off-by: Felipe Balbi <balbi@ti.com>
Multiple musb glue drivers depend on the generic usb phy support,
but fail to list it as a dependency in Kconfig. This results
in build erros like:
drivers/built-in.o: In function `am35x_remove':
:(.text+0xadacc): undefined reference to `usb_phy_generic_unregister'
drivers/built-in.o: In function `am35x_probe':
:(.text+0xae1c8): undefined reference to `usb_phy_generic_register'
:(.text+0xae244): undefined reference to `usb_phy_generic_unregister'
drivers/built-in.o: In function `jz4740_remove':
:(.text+0xaf648): undefined reference to `usb_phy_generic_unregister'
drivers/built-in.o: In function `jz4740_musb_init':
:(.text+0xaf694): undefined reference to `usb_phy_generic_register'
This adds the ones that are missing.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Delete private selfpowered variable, and use common one.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Delete private selfpowered variable, and use common one.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Delete private selfpowered variable, and use common one.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Delete private selfpowered variable, and use common one.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
fsl udc core assumes itself always self powered, so set is_selfpowered
is 1.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Delete private selfpowered variable, and use common one.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Delete private selfpowered variable, and use common one.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
The gadget power property will be used at get_status request.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
commit 8e74475b0e (usb: dwc3: gadget: use udc-core's
reset notifier) added support for the new UDC core's
reset notifier to dwc3 but while at it, it removed
a spin_lock() from dwc3_reset_gadget() which might
cause an unbalanced spin_unlock() further down the line
Fixes: 8e74475b0e (usb: dwc3: gadget: use udc-core's reset notifier)
Cc: <stable@vger.kernel.org> # v3.19
Signed-off-by: Felipe Balbi <balbi@ti.com>
Sometimes we want to just print a formatted
string without passing any extra data. The
following will be used for removing reliance
on dev_vdbg() from dwc3.
Signed-off-by: Felipe Balbi <balbi@ti.com>
if an unknown IRQ event is triggered, that means
the HW is really misbehaving. Instead of printing
a debug message, let's WARN() so users report
when that happens.
Signed-off-by: Felipe Balbi <balbi@ti.com>
