| Commit message (Collapse) | Author | Age |
|---|
| ... | |
| |\ \ \ \ \ \ |
|
| | |/ / / / /
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Driver is setting notify request pointer to NULL in order
to prevent re-queueing of notification request until it is
completed. This results into NULL ptr dereference if ioctl
happens before driver unbind tries to free the request buffer.
Fix this issue by introduce a flag q_again to prevent re-queuing
of same request instead of setting notify request pointer to NULL.
Also add NULL check in usb_cser_free_req() and set the request
pointer to NULL after freeing it.
Change-Id: Id431f911d3bdebfeedd0a5c1e36218ce7467ba67
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| |\ \ \ \ \ \ |
|
| | | |_|/ / /
| |/| | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
RNDIS, RMNET and DPL only supports alternate index 0. Instead of
returning value of data_interface_up which is used for interfaces
supporting non-zero alternate index, simply return 0.
Change-Id: I7fe6c7c636207cd4f85d468f61c87e5a4e12b0ac
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | |/ / / /
|/| | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
'commit 5b42bd749e8c ("usb: gadget: gsi: Optimize TRB's buffer allocation
functionality")' removed handling of EVT_HOST_READY event with state
STATE_INITIALIZED to optimized USB GSI state machine. This handling is
required for specifically when RNDIS interface is being enabled through
device manager, otherwise RNDIS interface doesn't get private IP address
back. Fix this issue by adding back handling of EVT_HOST_READY event with
state STATE_INITIALIZED.
CRs-Fixed: 1050838
Change-Id: I7010005b37b4709f54de58d52a56cb7f5e88bd08
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| |\ \ \ \ \
| |/ / / /
|/| | | /
| | |_|/
| |/| |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* msm-4.4/tmp-510d0a3f:
Linux 4.4.11
nf_conntrack: avoid kernel pointer value leak in slab name
drm/radeon: fix DP link training issue with second 4K monitor
drm/i915/bdw: Add missing delay during L3 SQC credit programming
drm/i915: Bail out of pipe config compute loop on LPT
drm/radeon: fix PLL sharing on DCE6.1 (v2)
Revert "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing"
Input: max8997-haptic - fix NULL pointer dereference
get_rock_ridge_filename(): handle malformed NM entries
tools lib traceevent: Do not reassign parg after collapse_tree()
qla1280: Don't allocate 512kb of host tags
atomic_open(): fix the handling of create_error
regulator: axp20x: Fix axp22x ldo_io voltage ranges
regulator: s2mps11: Fix invalid selector mask and voltages for buck9
workqueue: fix rebind bound workers warning
ARM: dts: at91: sam9x5: Fix the memory range assigned to the PMC
vfs: rename: check backing inode being equal
vfs: add vfs_select_inode() helper
perf/core: Disable the event on a truncated AUX record
regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case
pinctrl: at91-pio4: fix pull-up/down logic
spi: spi-ti-qspi: Handle truncated frames properly
spi: spi-ti-qspi: Fix FLEN and WLEN settings if bits_per_word is overridden
spi: pxa2xx: Do not detect number of enabled chip selects on Intel SPT
ALSA: hda - Fix broken reconfig
ALSA: hda - Fix white noise on Asus UX501VW headset
ALSA: hda - Fix subwoofer pin on ASUS N751 and N551
ALSA: usb-audio: Yet another Phoneix Audio device quirk
ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2)
crypto: testmgr - Use kmalloc memory for RSA input
crypto: hash - Fix page length clamping in hash walk
crypto: qat - fix invalid pf2vf_resp_wq logic
s390/mm: fix asce_bits handling with dynamic pagetable levels
zsmalloc: fix zs_can_compact() integer overflow
ocfs2: fix posix_acl_create deadlock
ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang
net/route: enforce hoplimit max value
tcp: refresh skb timestamp at retransmit time
net: thunderx: avoid exposing kernel stack
net: fix a kernel infoleak in x25 module
uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h MIME-Version: 1.0
bridge: fix igmp / mld query parsing
net: bridge: fix old ioctl unlocked net device walk
VSOCK: do not disconnect socket when peer has shutdown SEND only
net/mlx4_en: Fix endianness bug in IPV6 csum calculation
net: fix infoleak in rtnetlink
net: fix infoleak in llc
net: fec: only clear a queue's work bit if the queue was emptied
netem: Segment GSO packets on enqueue
sch_dsmark: update backlog as well
sch_htb: update backlog as well
net_sched: update hierarchical backlog too
net_sched: introduce qdisc_replace() helper
gre: do not pull header in ICMP error processing
net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case
samples/bpf: fix trace_output example
bpf: fix check_map_func_compatibility logic
bpf: fix refcnt overflow
bpf: fix double-fdput in replace_map_fd_with_map_ptr()
net/mlx4_en: fix spurious timestamping callbacks
ipv4/fib: don't warn when primary address is missing if in_dev is dead
net/mlx5e: Fix minimum MTU
net/mlx5e: Device's mtu field is u16 and not int
openvswitch: use flow protocol when recalculating ipv6 checksums
atl2: Disable unimplemented scatter/gather feature
vlan: pull on __vlan_insert_tag error path and fix csum correction
net: use skb_postpush_rcsum instead of own implementations
cdc_mbim: apply "NDP to end" quirk to all Huawei devices
bpf/verifier: reject invalid LD_ABS | BPF_DW instruction
net: sched: do not requeue a NULL skb
packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface
route: do not cache fib route info on local routes with oif
decnet: Do not build routes to devices without decnet private data.
parisc: Use generic extable search and sort routines
arm64: kasan: Use actual memory node when populating the kernel image shadow
arm64: mm: treat memstart_addr as a signed quantity
arm64: lse: deal with clobbered IP registers after branch via PLT
arm64: mm: check at build time that PAGE_OFFSET divides the VA space evenly
arm64: kasan: Fix zero shadow mapping overriding kernel image shadow
arm64: consistently use p?d_set_huge
arm64: fix KASLR boot-time I-cache maintenance
arm64: hugetlb: partial revert of 66b3923a1a0f
arm64: make irq_stack_ptr more robust
arm64: efi: invoke EFI_RNG_PROTOCOL to supply KASLR randomness
efi: stub: use high allocation for converted command line
efi: stub: add implementation of efi_random_alloc()
efi: stub: implement efi_get_random_bytes() based on EFI_RNG_PROTOCOL
arm64: kaslr: randomize the linear region
arm64: add support for kernel ASLR
arm64: add support for building vmlinux as a relocatable PIE binary
arm64: switch to relative exception tables
extable: add support for relative extables to search and sort routines
scripts/sortextable: add support for ET_DYN binaries
arm64: futex.h: Add missing PAN toggling
arm64: make asm/elf.h available to asm files
arm64: avoid dynamic relocations in early boot code
arm64: avoid R_AARCH64_ABS64 relocations for Image header fields
arm64: add support for module PLTs
arm64: move brk immediate argument definitions to separate header
arm64: mm: use bit ops rather than arithmetic in pa/va translations
arm64: mm: only perform memstart_addr sanity check if DEBUG_VM
arm64: User die() instead of panic() in do_page_fault()
arm64: allow kernel Image to be loaded anywhere in physical memory
arm64: defer __va translation of initrd_start and initrd_end
arm64: move kernel image to base of vmalloc area
arm64: kvm: deal with kernel symbols outside of linear mapping
arm64: decouple early fixmap init from linear mapping
arm64: pgtable: implement static [pte|pmd|pud]_offset variants
arm64: introduce KIMAGE_VADDR as the virtual base of the kernel region
arm64: add support for ioremap() block mappings
arm64: prevent potential circular header dependencies in asm/bug.h
of/fdt: factor out assignment of initrd_start/initrd_end
of/fdt: make memblock minimum physical address arch configurable
arm64: Remove the get_thread_info() function
arm64: kernel: Don't toggle PAN on systems with UAO
arm64: cpufeature: Test 'matches' pointer to find the end of the list
arm64: kernel: Add support for User Access Override
arm64: add ARMv8.2 id_aa64mmfr2 boiler plate
arm64: cpufeature: Change read_cpuid() to use sysreg's mrs_s macro
arm64: use local label prefixes for __reg_num symbols
arm64: vdso: Mark vDSO code as read-only
arm64: ubsan: select ARCH_HAS_UBSAN_SANITIZE_ALL
arm64: ptdump: Indicate whether memory should be faulting
arm64: Add support for ARCH_SUPPORTS_DEBUG_PAGEALLOC
arm64: Drop alloc function from create_mapping
arm64: prefetch: add missing #include for spin_lock_prefetch
arm64: lib: patch in prfm for copy_page if requested
arm64: lib: improve copy_page to deal with 128 bytes at a time
arm64: prefetch: add alternative pattern for CPUs without a prefetcher
arm64: prefetch: don't provide spin_lock_prefetch with LSE
arm64: allow vmalloc regions to be set with set_memory_*
arm64: kernel: implement ACPI parking protocol
arm64: mm: create new fine-grained mappings at boot
arm64: ensure _stext and _etext are page-aligned
arm64: mm: allow passing a pgdir to alloc_init_*
arm64: mm: allocate pagetables anywhere
arm64: mm: use fixmap when creating page tables
arm64: mm: add functions to walk tables in fixmap
arm64: mm: add __{pud,pgd}_populate
arm64: mm: avoid redundant __pa(__va(x))
arm64: mm: add functions to walk page tables by PA
arm64: mm: move pte_* macros
arm64: kasan: avoid TLB conflicts
arm64: mm: add code to safely replace TTBR1_EL1
arm64: add function to install the idmap
arm64: unmap idmap earlier
arm64: unify idmap removal
arm64: mm: place empty_zero_page in bss
arm64: mm: specialise pagetable allocators
asm-generic: Fix local variable shadow in __set_fixmap_offset
Eliminate the .eh_frame sections from the aarch64 vmlinux and kernel modules
arm64: Fix an enum typo in mm/dump.c
arm64: kasan: ensure that the KASAN zero page is mapped read-only
arch/arm64/include/asm/pgtable.h: add pmd_mkclean for THP
arm64: hide __efistub_ aliases from kallsyms
Linux 4.4.10
drm/i915/skl: Fix DMC load on Skylake J0 and K0
lib/test-string_helpers.c: fix and improve string_get_size() tests
ACPI / processor: Request native thermal interrupt handling via _OSC
drm/i915: Fake HDMI live status
drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW
drm/i915: Fix eDP low vswing for Broadwell
drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume
drm/radeon: make sure vertical front porch is at least 1
iio: ak8975: fix maybe-uninitialized warning
iio: ak8975: Fix NULL pointer exception on early interrupt
drm/amdgpu: set metadata pointer to NULL after freeing.
drm/amdgpu: make sure vertical front porch is at least 1
gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading
nvmem: mxs-ocotp: fix buffer overflow in read
USB: serial: cp210x: add Straizona Focusers device ids
USB: serial: cp210x: add ID for Link ECU
ata: ahci-platform: Add ports-implemented DT bindings.
libahci: save port map for forced port map
powerpc: Fix bad inline asm constraint in create_zero_mask()
ACPICA: Dispatcher: Update thread ID for recursive method calls
x86/sysfb_efi: Fix valid BAR address range check
ARC: Add missing io barriers to io{read,write}{16,32}be()
ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value
propogate_mnt: Handle the first propogated copy being a slave
fs/pnode.c: treat zero mnt_group_id-s as unequal
x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO
MAINTAINERS: Remove asterisk from EFI directory names
writeback: Fix performance regression in wb_over_bg_thresh()
batman-adv: Reduce refcnt of removed router when updating route
batman-adv: Fix broadcast/ogm queue limit on a removed interface
batman-adv: Check skb size before using encapsulated ETH+VLAN header
batman-adv: fix DAT candidate selection (must use vid)
mm: update min_free_kbytes from khugepaged after core initialization
proc: prevent accessing /proc/<PID>/environ until it's ready
Input: zforce_ts - fix dual touch recognition
HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk
HID: wacom: Add support for DTK-1651
xen/evtchn: fix ring resize when binding new events
xen/balloon: Fix crash when ballooning on x86 32 bit PAE
xen: Fix page <-> pfn conversion on 32 bit systems
ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel
ARM: EXYNOS: Properly skip unitialized parent clock in power domain on
mm/zswap: provide unique zpool name
mm, cma: prevent nr_isolated_* counters from going negative
Minimal fix-up of bad hashing behavior of hash_64()
MD: make bio mergeable
tracing: Don't display trigger file for events that can't be enabled
mac80211: fix statistics leak if dev_alloc_name() fails
ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation
lpfc: fix misleading indentation
clk: qcom: msm8960: Fix ce3_src register offset
clk: versatile: sp810: support reentrance
clk: qcom: msm8960: fix ce3_core clk enable register
clk: meson: Fix meson_clk_register_clks() signature type mismatch
clk: rockchip: free memory in error cases when registering clock branches
soc: rockchip: power-domain: fix err handle while probing
clk-divider: make sure read-only dividers do not write to their register
CNS3xxx: Fix PCI cns3xxx_write_config()
mwifiex: fix corner case association failure
ata: ahci_xgene: dereferencing uninitialized pointer in probe
nbd: ratelimit error msgs after socket close
mfd: intel-lpss: Remove clock tree on error path
ipvs: drop first packet to redirect conntrack
ipvs: correct initial offset of Call-ID header search in SIP persistence engine
ipvs: handle ip_vs_fill_iph_skb_off failure
RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
Revert: "powerpc/tm: Check for already reclaimed tasks"
arm64: head.S: use memset to clear BSS
efi: stub: define DISABLE_BRANCH_PROFILING for all architectures
arm64: entry: remove pointless SPSR mode check
arm64: mm: move pgd_cache initialisation to pgtable_cache_init
arm64: module: avoid undefined shift behavior in reloc_data()
arm64: module: fix relocation of movz instruction with negative immediate
arm64: traps: address fallout from printk -> pr_* conversion
arm64: ftrace: fix a stack tracer's output under function graph tracer
arm64: pass a task parameter to unwind_frame()
arm64: ftrace: modify a stack frame in a safe way
arm64: remove irq_count and do_softirq_own_stack()
arm64: hugetlb: add support for PTE contiguous bit
arm64: Use PoU cache instr for I/D coherency
arm64: Defer dcache flush in __cpu_copy_user_page
arm64: reduce stack use in irq_handler
arm64: Documentation: add list of software workarounds for errata
arm64: mm: place __cpu_setup in .text
arm64: cmpxchg: Don't incldue linux/mmdebug.h
arm64: mm: fold alternatives into .init
arm64: Remove redundant padding from linker script
arm64: mm: remove pointless PAGE_MASKing
arm64: don't call C code with el0's fp register
arm64: when walking onto the task stack, check sp & fp are in current->stack
arm64: Add this_cpu_ptr() assembler macro for use in entry.S
arm64: irq: fix walking from irq stack to task stack
arm64: Add do_softirq_own_stack() and enable irq_stacks
arm64: Modify stack trace and dump for use with irq_stack
arm64: Store struct thread_info in sp_el0
arm64: Add trace_hardirqs_off annotation in ret_to_user
arm64: ftrace: fix the comments for ftrace_modify_code
arm64: ftrace: stop using kstop_machine to enable/disable tracing
arm64: spinlock: serialise spin_unlock_wait against concurrent lockers
arm64: enable HAVE_IRQ_TIME_ACCOUNTING
arm64: fix COMPAT_SHMLBA definition for large pages
arm64: add __init/__initdata section marker to some functions/variables
arm64: pgtable: implement pte_accessible()
arm64: mm: allow sections for unaligned bases
arm64: mm: detect bad __create_mapping uses
Linux 4.4.9
extcon: max77843: Use correct size for reading the interrupt register
stm class: Select CONFIG_SRCU
megaraid_sas: add missing curly braces in ioctl handler
sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a race
thermal: rockchip: fix a impossible condition caused by the warning
unbreak allmodconfig KCONFIG_ALLCONFIG=...
jme: Fix device PM wakeup API usage
jme: Do not enable NIC WoL functions on S0
bus: imx-weim: Take the 'status' property value into account
ARM: dts: pxa: fix dma engine node to pxa3xx-nand
ARM: dts: armada-375: use armada-370-sata for SATA
ARM: EXYNOS: select THERMAL_OF
ARM: prima2: always enable reset controller
ARM: OMAP3: Add cpuidle parameters table for omap3430
ext4: fix races of writeback with punch hole and zero range
ext4: fix races between buffered IO and collapse / insert range
ext4: move unlocked dio protection from ext4_alloc_file_blocks()
ext4: fix races between page faults and hole punching
perf stat: Document --detailed option
perf tools: handle spaces in file names obtained from /proc/pid/maps
perf hists browser: Only offer symbol scripting when a symbol is under the cursor
mtd: nand: Drop mtd.owner requirement in nand_scan
mtd: brcmnand: Fix v7.1 register offsets
mtd: spi-nor: remove micron_quad_enable()
serial: sh-sci: Remove cpufreq notifier to fix crash/deadlock
ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
x86/mm/kmmio: Fix mmiotrace for hugepages
perf evlist: Reference count the cpu and thread maps at set_maps()
drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
rtc: max77686: Properly handle regmap_irq_get_virq() error code
rtc: rx8025: remove rv8803 id
rtc: ds1685: passing bogus values to irq_restore
rtc: vr41xx: Wire up alarm_irq_enable
rtc: hym8563: fix invalid year calculation
PM / Domains: Fix removal of a subdomain
PM / OPP: Initialize u_volt_min/max to a valid value
misc: mic/scif: fix wrap around tests
misc/bmp085: Enable building as a module
lib/mpi: Endianness fix
fbdev: da8xx-fb: fix videomodes of lcd panels
scsi_dh: force modular build if SCSI is a module
paride: make 'verbose' parameter an 'int' again
regulator: s5m8767: fix get_register() error handling
irqchip/mxs: Fix error check of of_io_request_and_map()
irqchip/sunxi-nmi: Fix error check of of_io_request_and_map()
spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs
locking/mcs: Fix mcs_spin_lock() ordering
regulator: core: Fix nested locking of supplies
regulator: core: Ensure we lock all regulators
regulator: core: fix regulator_lock_supply regression
Revert "regulator: core: Fix nested locking of supplies"
videobuf2-v4l2: Verify planes array in buffer dequeueing
videobuf2-core: Check user space planes array in dqbuf
USB: usbip: fix potential out-of-bounds write
cgroup: make sure a parent css isn't freed before its children
mm/hwpoison: fix wrong num_poisoned_pages accounting
mm: vmscan: reclaim highmem zone if buffer_heads is over limit
numa: fix /proc/<pid>/numa_maps for THP
mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
memcg: relocate charge moving from ->attach to ->post_attach
cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback
slub: clean up code for kmem cgroup support to kmem_cache_free_bulk
workqueue: fix ghost PENDING flag while doing MQ IO
x86/apic: Handle zero vector gracefully in clear_vector_irq()
efi: Expose non-blocking set_variable() wrapper to efivars
efi: Fix out-of-bounds read in variable_matches()
IB/security: Restrict use of the write() interface
IB/mlx5: Expose correct max_sge_rd limit
cxl: Keep IRQ mappings on context teardown
v4l2-dv-timings.h: fix polarity for 4k formats
vb2-memops: Fix over allocation of frame vectors
ASoC: rt5640: Correct the digital interface data select
ASoC: dapm: Make sure we have a card when displaying component widgets
ASoC: ssm4567: Reset device before regcache_sync()
ASoC: s3c24xx: use const snd_soc_component_driver pointer
EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
toshiba_acpi: Fix regression caused by hotkey enabling value
i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
i2c: cpm: Fix build break due to incompatible pointer types
perf intel-pt: Fix segfault tracing transactions
drm/i915: Use fw_domains_put_with_fifo() on HSW
drm/i915: Fixup the free space logic in ring_prepare
drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()
drm/i915: skl_update_scaler() wants a rotation bitmask instead of bit number
drm/i915: Cleanup phys status page too
pwm: brcmstb: Fix check of devm_ioremap_resource() return code
drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
drm/dp/mst: Restore primary hub guid on resume
drm/dp/mst: Validate port in drm_dp_payload_send_msg()
drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
drm: Loongson-3 doesn't fully support wc memory
drm/radeon: fix vertical bars appear on monitor (v2)
drm/radeon: forbid mapping of userptr bo through radeon device file
drm/radeon: fix initial connector audio value
drm/radeon: add a quirk for a XFX R9 270X
drm/amdgpu: fix regression on CIK (v2)
amdgpu/uvd: add uvd fw version for amdgpu
drm/amdgpu: bump the afmt limit for CZ, ST, Polaris
drm/amdgpu: use defines for CRTCs and AMFT blocks
drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work.
iommu/dma: Restore scatterlist offsets correctly
iommu/amd: Fix checking of pci dma aliases
pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs
pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce
xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND"
Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay
Input: gtco - fix crash on detecting device without endpoints
netlink: don't send NETLINK_URELEASE for unbound sockets
nl80211: check netlink protocol in socket release notification
powerpc: Update TM user feature bits in scan_features()
powerpc: Update cpu_user_features2 in scan_features()
powerpc: scan_features() updates incorrect bits for REAL_LE
crypto: talitos - fix AEAD tcrypt tests
crypto: talitos - fix crash in talitos_cra_init()
crypto: sha1-mb - use corrcet pointer while completing jobs
crypto: ccp - Prevent information leakage on export
iwlwifi: mvm: fix memory leak in paging
iwlwifi: pcie: lower the debug level for RSA semaphore access
s390/pci: add extra padding to function measurement block
cpufreq: intel_pstate: Fix processing for turbo activation ratio
Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
drm/qxl: fix cursor position with non-zero hotspot
drm/nouveau/core: use vzalloc for allocating ramht
futex: Acknowledge a new waiter in counter before plist
futex: Handle unlock_pi race gracefully
asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
ALSA: hda - Add dock support for ThinkPad X260
ALSA: pcxhr: Fix missing mutex unlock
ALSA: hda - add PCI ID for Intel Broxton-T
ALSA: hda - Keep powering up ADCs on Cirrus codecs
ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
ALSA: hda - Don't trust the reported actual power state
x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
x86/mm/xen: Suppress hugetlbfs in PV guests
arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission
arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings
sched/cgroup: Fix/cleanup cgroup teardown/init
dmaengine: pxa_dma: fix the maximum requestor line
dmaengine: hsu: correct use of channel status register
dmaengine: dw: fix master selection
debugfs: Make automount point inodes permanently empty
lib: lz4: fixed zram with lz4 on big endian machines
dm cache metadata: fix cmd_read_lock() acquiring write lock
dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros
usb: gadget: f_fs: Fix use-after-free
usb: hcd: out of bounds access in for_each_companion
xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers
usb: xhci: fix wild pointers in xhci_mem_cleanup
xhci: resume USB 3 roothub first
usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host
assoc_array: don't call compare_object() on a node
ARM: OMAP2+: hwmod: Fix updating of sysconfig register
ARM: OMAP2: Fix up interconnect barrier initialization for DRA7
ARM: mvebu: Correct unit address for linksys
ARM: dts: AM43x-epos: Fix clk parent for synctimer
KVM: arm/arm64: Handle forward time correction gracefully
kvm: x86: do not leak guest xcr0 into host interrupt handlers
x86/mce: Avoid using object after free in genpool
block: loop: fix filesystem corruption in case of aio/dio
block: partition: initialize percpuref before sending out KOBJ_ADD
Conflicts:
arch/arm64/Kconfig
arch/arm64/include/asm/cputype.h
arch/arm64/include/asm/hardirq.h
arch/arm64/include/asm/irq.h
arch/arm64/kernel/cpu_errata.c
arch/arm64/kernel/cpuinfo.c
arch/arm64/kernel/setup.c
arch/arm64/kernel/smp.c
arch/arm64/kernel/stacktrace.c
arch/arm64/mm/init.c
arch/arm64/mm/mmu.c
arch/arm64/mm/pageattr.c
mm/memcontrol.c
CRs-Fixed: 1054234
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
Change-Id: I2a7a34631ffee36ce18b9171f16d023be777392f
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
commit 38740a5b87d53ceb89eb2c970150f6e94e00373a upstream.
When using asynchronous read or write operations on the USB endpoints the
issuer of the IO request is notified by calling the ki_complete() callback
of the submitted kiocb when the URB has been completed.
Calling this ki_complete() callback will free kiocb. Make sure that the
structure is no longer accessed beyond that point, otherwise undefined
behaviour might occur.
Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
| |\ \ \ \ |
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Driver allocates notify request in function bind() callback
but frees it in function disable() callback. Upon composition
switch adb daemon gets restarted causing function bind/unbind
to happen twice. This results into allocating notify request
memory twice and only freeing it once either upon disconnect
or next composition switch. Fix the issue freeing memory in
function unbind callback.
Change-Id: I7716cff99b824b55e48aea57b9da91c16a8ecac1
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| |\ \ \ \ \ |
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
TRB's buffer related memory is allocated as part of gsi_bind() for each
USB GSI interface if it is part of USB compsition (i.e. USB multi config
composition). This memory is never de-allocated (i.e. USB cable
disconnect case) until USB composition switch. Also only one USB tethered
GSI interface is used out of mult-config based on selection of USB config
by USB host. Hence allocate TRB's buffer related memory after set_alt(1)
from ipa_work_handler() and de-allocate same from set_alt(0) OR USB
composition switch OR USB bus suspend with remote wakeup disable case.
Change-Id: I1bdfe16273186b594f83fd03936a461895701996
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | |_|/ /
| |/| | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Currently USB GSI function driver increments USB gadget device's
pm usage count on set_alt() and decrements on USB bus suspend or
USB cable disconnect case. Current code is not decrementing this
usage count when sm_state is STATE_INITIALIZED and USB cable is
disconnected (i.e. event EVT_DISCONNECTED posted). In this case,
USB doesn't go into low power mode although USB cable is disconnected.
Hence to handle this case make sure to increment USB device's PM
usage count from state machine instead of set_alt().
Also fix one of bug where state machine is peeking event but it is
not deleting same event from queue which shall result into using
same event multiple time in different states.
Use usb_gadget_autopm_get() instead of usb_gadget_autopm_get_noresume()
as noresume variant only increment usage count which is not sufficient
condition to prevent USB to go into LPM. usb_gadget_autopm_get()
increments both usage count and child count.
Change-Id: I667aef9208d14b2dff5944ad6ad9b053797c4ac9
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Upon usb composition switch there is possibility of ep0 file
release happening after gadget driver bind. In case of composition
switch from adb to a non-adb composition gadget will never gets
bound again resulting into failure of usb device enumeration. Fix
this issue by checking FFS_FL_BOUND flag and avoid extra
gadget driver unbind if it is already done as part of composition
switch.
Change-Id: I1638001ff4a94f08224b188aa42425f3d732fa2b
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release the lock before unregistering gadget item.
Unregistered gadget item will result in unbind call back
to the driver which may use the same lock and resulting
in deadlock condition.
Change-Id: I2f8fba73a831d3bb711fe9310c5758221359819e
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| |/ / / /
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Log function entry and exit and dump relevant values
into ipc log buffer. This allows to debug various
race conditions and stability issues.
Change-Id: I15011d79fc2f054e64f8bbd1f8f5db8944b46ada
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| |/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Upon usb disconnect or composition switch notify ep request buffer
as well as the request are freed. This is racing with user space
ioctl on character device trying to send the notification to USB
host. As a result notify ep request buffer is being dereferenced
causing NULL pointer dereference. Fix the issue by checking
is_connected flag by taking port lock before accessing notify
ep request and request buffer.
Change-Id: I380efdf90305a65d4cde46dfe44762ac11c87678
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| |\ \ \ |
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Stage 1 SMMU enablement on IPA requires that the USB
driver pass physical and virtual addresses to IPA for
addresses that GSI hardware will write to. Update the
connection params for GSI channels to pass this info
to IPA driver.
Change-Id: Ibeedeef900b069b3a113b2daabf461797f28287b
Signed-off-by: Devdutt Patnaik <dpatnaik@codeaurora.org>
|
| |\| | | |
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Add support to IPA USB APIs for SMMU.
CRs-Fixed: 1046497
Change-Id: Ifca675f308b59913743baf2e59dc3ed515a5b974
Acked-by: Ady Abraham <adya@qti.qualcomm.com>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Serial function driver creates debugfs files even though ports
are not allocated. Fetching/reading those files without allocation
of ports leads to crash. Check port allocation before creating
the files.
Change-Id: I85b050a261cca6f961d5d9058efb8b7facf242ce
Signed-off-by: Arumuga Durai A <cadurai@codeaurora.org>
|
| |\ \ \ \ |
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
USB bus suspend with remote wakeup allowed case:
1. SUSPEND interrupt received from controller on USB bus suspend
2. gsi_suspend() blocks ringing of doorbell by USB controller to IPA GSI
and schedule usb_ipa_w work with event EVNT_SUSPEND
3. ipa_work_handler() work handler makes sure that USB GSI interface is
into IDLE state and calls ipa_usb_xdci_suspend() to put IPA GSI related
channel into suspend state and allow turning of IPA's clock
5. ipa_work_handler() decrements PM usage count, allow USB to go into LPM
6. USB controller driver turns off USB clocks and put into LPM
USB bus resume with remote wakeup allowed case:
1. WAKEUP interrupt received from controller on USB bus resume
2. USB controller driver turns on USB clocks
3. gsi_resume() increments PM usage count and schedule usb_ipa_w work with
event EVENT_RESUME
4. ipa_work_handler() work handler calls ipa_usb_xdci_resume() to resume
IPA GSI related channel and turning on IPA's clock
5. ipa_work_handler() unblocks ringing of doorbell by USB controller to
IPA GSI
In above USB bus resume case using specific host with ECM functionality,
host is able to send PING or data packets equal to prepared number of TRBs
(currently 7) on USB EP OUT successfully before above resume step 5 then
GSI ignores rang doorbell as WRITE pointer updating last consumed TRB is
already gone through full cycle. This results into data stall. Hence to fix
this issue increase number of TRBs used with USB OUT endpoint from 7 to 31
for USB ECM function with GSI accelerated path. This helps to have always
pending TRBs with USB controller and ringing of doorbell is not missed by
GSI once above resume step 5 is completed.
Also ECM doesn't support aggregation. Hence fix out aggregation size param.
CRs-Fixed: 1023149
Change-Id: Ife0f265b65fda92a99f5170154da6cb4c6b113b7
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| |/ / / /
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
After gsi_unbind() if gsi_bind() function frees speed descriptor due
to an error leads to double freeing of descriptor. Fix this issue by
setting descriptor pointer back to NULL after freeing the descriptor
memory.
CRs-Fixed: 1038866
Change-Id: Ic5ee71389b6b20c8557e0a75f9bbe5a1749cf655
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| |/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
There is limitation when IPA is performing de/aggregation with MBIM
in scatter-gather mode. Hence instead of 2KB buffer use 16KB buffer
(i.e. size of aggregated frame) with each TRB for MBIM DL case.
CRs-Fixed: 1032467
Change-Id: I4f73d30711b5606c2ac88ce9d05a8483d64b665d
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The test results indicate that larger transfers improve write speeds.
The Rx request transfer length is now 16K bytes. Increase the Rx
transfer length from 16K to 1MB to get good throughputs.
Change-Id: I3c64e6b96d569b4dc61805a53a0835db9142d55e
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If usb_ep_queue() fails on queueing zero-length packet, driver is not
decrementing dpkts_tolaptop_pending counter which may results into seeing
count mismatch. Hence decrement dpkts_tolaptop_pending if zero length
packet queueing fails.
CRs-Fixed: 1027031
Change-Id: Id3c7c2627bdf37524067512db51d3180c570106d
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Currently driver is reading and logging usage count of gadget
device but it is required to use usage count of gadget's parent
device which is used to prevent USB controller's low power mode.
Hence fix reporting of USB devices' usage count.
Also mark sm_state to initialized and remove queueing of
ipa_usb_wq as ipa_work_handler() is running without USB gadget
is initialized i.e. gadget is NULL.
CRs-Fixed: 1021499
Change-Id: Ia64afa3adb769674f6a9a60fde2c7397b7e4fe49
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Currently MTP driver is resetting string id during unbind, when
cable is disconnected. Due to this, composite driver might run out
of string ids, when it tries to allocate string id during next
composition switch to MTP. This results in composition switch failure
when MTP is selected and eventually causing USB enumeration failure.
Fix this by not resetting string id and allocate it once only.
Change-Id: Ieacdc8dd76bc45638002eb749ff87aa95f496fa3
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If cable is disconnected while send_file work is in progress,
Endpoints will be disabled and state will be marked as OFFLINE.
As a part of endpoint disable pending requests will be retire out
with -ECONNRESET error. Due to this we will modify the device state
as ERROR in completion callback. If the state is not offline then
we will mark the device state to ready in send_file_work. This results
in mtp driver to not returning any error for next mtp_write operation
and mtp release will not be called.
Hence fix this issue by adding a proper check in completions to not
moving device state to ERROR in case of disconnect.
Change-Id: Idb4e075c89bdf94790a321bc464d30eba546eeaa
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The existing code shows the phone icon in 'My Computer' of windows host,
for PTP composition.
Create a new Extended Configuration Descriptor for PTP composition and
update the compatibleID to display a camera icon for PTP composition.
Change-Id: If286c5b80874a95be0b5ecc533d0e5c7a14f39d3
Signed-off-by: Azhar Shaikh <azhars@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This change captures time taken by each vfs_read() and vfs_write() call
made from USB MTP gadget driver where data size is equal to USB request
buffer size. It provides debugfs entry to get this information for 100
such call and resetting the same.
How-To use:
To get stats:
cat /sys/kernel/debug/usb_mtp/status
To reset stats:
echo 0 > /sys/kernel/debug/usb_mtp/status
Change-Id: I252e830568704e9e557660c1ae0f7597823e4b17
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
MTP usb device node created as a part of mtp function init call.
Userspace can read/write to MTP device using this node. If MTP is
not enabled in the composition and trying to read mtp_usb dev node
from the userspace leading to null pointer access in mtp_read.
Do not access ep OUT maxpacket size in mtp_read. First block on mtp_read
until the state become online which doesn't wakeup from the thread and
expecting for the read completion or state change which occurs as
a part of set_alt.
Change-Id: Icbee5fe7ae2c02b2bca185a0dc7587eb4940058a
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Azhar Shaikh <azhars@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
32-bit userspace calling into 64-bit kernel
cause different ioctl codes to get generated.
The different ioctl code gets generated
because sizeof is used on mtp and accessory
structures which is different for 32/64
compilation. Because of this, 64-bit kernel
can never execute the right ioctl command.
Implement compat_ioctl to handle such
execution environment.
Change-Id: I26cc10986e28a28eab6f3c65f28f4d2b808112d9
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If cable is disconnected while receive_file work is in progress,
there is a case where mtp driver returns -ECANCELLED instead of
-EIO. This results in mtp server thread not getting disconnect
notification and mtp release will not be called. Due to this, mtp
server will not start mtp connection after next USB connection.
Change-Id: I909bebe0d22c19329cebb0a4a76424e08c82328c
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Current driver code doesn't handle the memory allocation failure
correctly and ends up leaking memory and trying to free
unallocated one.
Change-Id: I7e3527b7e08ccfe566d85e3009d8a015d8daa707
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Currently burst value is set to zero for superspeed in mtp driver.
MTP throughput can be improved by setting max burst value to non
zero value in superspeed mode. Hence set max burst value to two
for both IN and OUT bulk endpoints in superspeed mode.
Change-Id: Ib78b8fec5d1ab934f4d4ec80b7e008149707ce0f
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Update function drivers mtp and accessory to operate
in super speed. The burst capability is not enabled for now.
Change-Id: Ie95cbfc9444c56c8268b70e2916713190699c71a
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Queuing a request on a disabled endpoint during composition switch leads
to prime failure. Hence return -EINVAL if a request is queued on a disabled
endpoint.
Also, in f_mtp, block queuing a request in OUT ep in receive_file_work, if
the device state is STATE_OFFLINE.
Change-Id: I0e706d5280a2460baf6ab05dbf97a09c59b642fb
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Currently if USB composition switch happens while file transfer is
happening either from/to device, ep_queue fails and sets device state
to ERROR even if device state is already set to OFFLINE in function
disable call.
As part of ioctl call, if the state is not offline, moving the device
state to READY and returning the error. Since the device state is marked
as READY, the next write call tries to queue the request to hardware and
is blocked and due to this, userspace is not calling the release function.
Hence next mtp open fails even after cable reconnection.
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Change-Id: Ia8cbd1cd8c81b90389900b83744b2bed89068db5
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If the Host sends CANCEL request when an OUT request is queued,
the mtp_driver should dequeue the request and report the userspace about
the request CANCELLATION. As the mtp_read doesn't wakeup from the thread
which is expecting for the read completion, wakeup the thread using the
state change which occurs as a part of CANCEL request.
Also, when the request is dequeued and so mtp receives read completion
status as error, it moves the state to ERROR. Due to this the application
is not reported about the request cancellation for the next IN(mtp_write)
transfer as the state is not updated from STATE_ERROR to STATE_CANCELED.
So mtp_write proceeds queueing the IN requests for the corresponding sync
which are not processed by the Host and so the transfers initiated later
are observed as error in the HOST side.
So dequeue the OUT(mtp_read) request, if the driver receives a REQ_CANCEL
prior to read completion on mtp_read & update the state to STATE_CANCELED.
Change-Id: I2cd9780f8b3e0ce541472c4d25c8294f11a45d76
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
DWC3 UDC requires OUT endpoint request length to be multiple of
endpoint max packet size. Hence the OUT endpoint request is
always set to the request buffer size in mtp read. The buffer
can be allocated dynamically and is always multiple of 1024.
If the count passed to read system call is less than the buffer
size, we end up reading more bytes and not giving it to userspace.
Userspace calls read with 512 bytes for receiving request from the
host. If the request is for receiving a file, the read is called
with 16K bytes for reading the header and some data. The remaining
data is received via ioctl. If 1MB is used as request length for
16K read, the received file will be corrupted.
Change-Id: I2eedf829f267150ff7a303824e95963219a1f555
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The Tx request transfer length is 16K bytes by default. The test
results indicate that larger transfers improve read speeds. Add
provision for specifying Tx transfer length at runtime.
echo -n 1048576 > /sys/module/g_android/parameters/mtp_tx_req_len
The above command can be used to set Tx transfer length to 1MB. If
the memory allocation is failed, fallback to the default length.
Also add provision for specifying no. of Tx requests at runtime.
echo 8 > /sys/module/g_android/parameters/mtp_tx_reqs
Change-Id: I675fc3303be2aba081d2ab59a9efb94aa478f849
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The Rx request transfer length is 16K bytes by default. The test
results indicate that larger transfers improve write speeds. Add
provision for specifying Rx transfer length at runtime.
echo -n 1048576 > /sys/module/g_android/parameters/mtp_rx_req_len
The above command can be used to set Rx transfer length to 1MB. If
the memory allocation is failed, fallback to the default length.
Change-Id: I74d5da09437c25e9f1772f7cd49aecb8e4fedcf2
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Synopsys USB3 Controller (DWC3) has a restriction where size
of OUT requests (TRB) queued to the controller must be aligned
with the endpoint's max packet size. Generally, MTP userspace
module submits RX requests aligned to 512 bytes which works
fine in High speed mode. But, fails in Super-speed mode where
max packet size can be 1024 bytes.
To overcome this just change the size of RX request buffer
while submitting to DCD as the buffers are already allocated
with the size of 16KB.
Change-Id: I68c32ef3d08b2cf943b52a7269785d0a00146953
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
disconnect"
'commit 3a7ce1db5661 ("usb: gadget: gsi: Decrement USB gadget pm usage
count on cable disconnect")' added decrementing USB gadget device's pm
usage count from STATE_INITIALIZED which results into multiple time
decrementing USB gadget device's pm usage count on USB cable disconnect
as below:
1. On USB cable disconnect, USB bus suspend event is being received which
post EVT_DISCONNECTED. If state is STATE_CONNECTED, ipa_work_handles()
decrements USB gadget device's pm usage count, and move state to
STATE_INITIALIZED.
2. Due to USB cable disconnect, gsi_disable() posts EVT_DISCONNECTED.
This event is processed into STATE_CONNECTED causing additional decrement
of USB gadget device's pm usage count.
Due to above case, USB goes into low power mode with dwc3's pm usage
count negative. On connecting USB host mode cable, xhci resume is failing
due to dwc3's (parent of xhci) is having negative usage count which results
into no USB host mode functionality (pm_runtime_get_sync() returns -EBUSY).
Hence revert commit to allow USB Host mode functionality.
CRs-Fixed: 1020388
Change-Id: I853aba1d2d03945ee49adde7f0ea483cd406ce2b
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
USB GSI function driver uses usb_ipa_w work to queue different events
like EVT_CONNECTED, EVT_DISCONNECTED and more. ipa_event_handler()
uses those events as inputs to make necessary decision about performing
connect and disconnect with IPA driver. It is required that before USB
GSI driver calls ipa_usb_deinit_teth_prot(), it has invoked IPA
disconnect API ipa_usb_xdci_disconnect() if it has called
ipa_usb_xdci_connect() API. Current code is making sure that any
running usb_ipa_w work is being completed before calling
ipa_usb_deinit_teth_prot() but if work is not scheduled and pending,
ipa_usb_xdci_connect() is not called (i.e. later when usb_ipw_w work is
scheduled, EVT_DISCONNECTED is being processed but gsi_unbind() has
changed sm_state as STATE_UNINITIALIZED which results into no-ops.)
which results into USB and IPA driver go out of sync in terms of
expected state machine. Hence calling ipa_usb_init_teth_prot() on next
USB cable connect from gsi_bind_config() fails which results into no
USB GSI functionality. Fix this issue by using drain_workqueue() instead
of flush_workqueue() which makes sure that re-queue work is flushed.
CRs-Fixed: 1005018
Change-Id: I64ff559b85f901688a4abd0110ebb32a5317e34d
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Currently USB GSI function driver increments USB gadget device's
pm usage count on set_alt() and decrements on USB bus suspend or
USB cable disconnect case. Current code is not decrementing this
usage count when sm_state is STATE_INITIALIZED and USB cable is
disconnected (i.e. event EVT_DISCONNECTED posted). Fix this issue
by decrementing USB gadget device's pm usage count by addding check
for event EVT_DISCONNECTED when sm_state is STATE_INITIALIZED.
CRs-Fixed: 1003242
Change-Id: I4d6c9ce254f4c4139313dfd33da6c8745f34a1d3
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Currently ipa_usb_init_teth_prot() is called before gsi_bind()
gets called as a result of usb_add_function() call. gsi_bind()
is polulating ipa_init_params which is passed to
ipa_usb_init_teth_prot(). Since usb_add_function() is getting
called later after gsi_bind_config() returns, ipa_init_params
remains unpopulated and results into ipa_usb_init_teth_prot()
returning failure. Fix this issue by moving the call to
gsi_bind(). This also matches to ipa_usb_deinit_teth_prot()
call in gsi_unbind().
CRs-Fixed: 1013830
Change-Id: I824d3fa62e2736962680ae1c883b9a2916346331
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
gsi driver does not call the gadget API usb_ep_enable()
instead uses gsi ep operation call back to enable gsi ep.
As a result ep->enabled flag remains clear. Later function
driver calls usb_ep_disble() API from gadget framework and
ep disable operation gets skipped. This causes start transfer
command to fail next time when gsi ep gets enabled. Fix this
issue by calling gsi ep disable operation instead of calling
gadget API.
CRs-Fixed: 1013830
Change-Id: I06570dec368b430321ec196a5e4338f657c43b42
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
|
