summaryrefslogtreecommitdiff
path: root/drivers/usb (follow)
Commit message (Collapse)AuthorAge
...
* | | | USB: Fix checker warning and errorsMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | This change fixes checker reported warning and errors messages. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | USB: Add USB BAM2BAM related function drivers and relevant glue driversMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds MSM specific USB function drivers and relevant glue drivers providing RMNET, RNDIS, DPL, ECM and MBIM functionality with BAM2BAM IPA mode. This snapshot is taken as of msm-3.18 kernel 'commit 8007444c107a ("Merge pinctrl: qcom: Update gcc_gp1_clk_b_groups for msm8953")'. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: phy: qmp: Remove both phy_clk_scheme based init functionalityMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently QMP PHY driver expects to have both se_clk and diff_clk based PHY initialization sequence from devicetree. This change removes need of both phy_clk_scheme based init sequence as on newer platform QMP PHY only uses one of phy_clk_scheme. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: phy: qusb: Add support to get phy_clk_schemeMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds qcom,phy-clk-scheme mandatory property with QUSB PHY driver. qcom,phy-clk-scheme property must have "cml" (i.e. DIFF clock scheme) or "cmos" (i.e. SE clock scheme). Based on this input qusb phy driver uses required reset and initialization sequence. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | USB: PHY: Remove TCSR register based clk_scheme usageMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | On newer platform TCSR register based clk_scheme usage is not available. Hence remove its usage from QUSB and QMP PHY drivers. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: Fix compilation warningsMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change fixes below compilation warnings f_fs.c:700:19: warning: unused variable 'ffs' [-Wunused-variable] u_serial.c:1023:3: warning: 'return' with a value, in function returning void Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: gadget: qdss: Add attribute to allow debug interfaceMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds attribute with USB QDSS instance to allow enable/disable debug interface. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: dwc3: Ensure req->dma is initialized to DMA_ERROR_CODEJack Pham2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 269a1b78 "usb: gadget: Add support for DMA mapping optimization of request buffers" added checks to usb_gadget_{map,unmap}_request() to support the pre-mapped DMA buffers that a function can map ahead of time before enqueing the request. However, these routines check the req->dma for a sentinel value, DMA_ERROR_CODE, in order to determine whether or not to proceed with dma_map/unmap(). This means that UDC drivers should initialize to this value when allocating each new request. Do this in the dwc3 gadget driver in order to properly support this. This fixes an issue in which usb_gadget_unmap_request() was incorrectly being called on an uninitialized (as 0) req->dma address, and proceeds to call dma_unmap() which interprets it as physical address 0x0. Change-Id: I514d2b824e272c6c42c483febaa1c4084b0d09ee Signed-off-by: Jack Pham <jackp@codeaurora.org>
* | | | usb: gadget: Add support for DMA mapping optimization of request buffersDanny Segal2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to improve performance, this patch enabled mapping of USB request buffers in advance, before queueing them to the HW. This can be used when there is a pool or pre-mapped request buffers so we don't need to map it again every time the request gets queued. Change-Id: Ic3a6db749343ef1345e0816210517755aee055b3 Signed-off-by: Danny Segal <dsegal@codeaurora.org> Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | USB: gadget: qdss: Fix NULL pointer related crashMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NULL pointer crash is seen when starting USB QDSS data transfer from usb_qdss_connect_work() as cdev was not updated. Issue can be fixed by updating cdev from qdss_bind(). It seems that cdev has been used couple of places to provide gadget related information. Hence removing usage of cdev from qdss data structure and use gadget directly. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: gadget: qdss: Modify to support configfs usageMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - This change adds configfs usage with USB QDSS driver. - It removes all different supported control and data transports and assume BAM2BAM as default mode. - It also removes supported DPL functionality from this driver. Change-Id: I9678c9e9a397445f36272616e517bbb83a59e88a Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | USB: gadget: QDSS: Add snapshot of USB QDSS Function driverMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds USB QDSS function driver which is used for USB QDSS functionality. This snapshot is taken as of msm-3.18 kernel commit d5809484bb1b. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: xhci: clean up command queue when haltingJack Pham2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Calling usb_remove_hcd() on both of the xHCI HCDs may race with hub_event() which executes on its own workqueue. When xhci_halt() is called and stops the command ring, the hub thread may have already issued a command such as xhci_configure_endpoint() and is currently waiting for the command to complete while holding the device lock. Meanwhile since the controller is already halted, no events are expected to complete and the command timer will continually timeout every 5 seconds and re-arm itself. Since the completion for the command is never issued, the threads are essentially deadlocked. Avoid this situation when halting the controller by forcing the command queue to be cleaned up. Change-Id: I88150e3435b5f06e37e9881dddaeff4807c24cc9 Signed-off-by: Jack Pham <jackp@codeaurora.org>
* | | | USB: f_fs: Disable USB LPM on bus_suspend with ADBManu Gautam2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ADB function is mainly used for debugging, hence it is not expected to allow USB LPM followed by system suspend in device bus suspend. Driver also doesn't handle usb_ep_dequeue failure in LPM when adbd is interrupted by signal as buffer is left queued to the hardware after usb_ep_dequeue failure and can cause memory corruption. Change-Id: Ib89c80318dcdd0dbb35d122a2ab77fb61f83518e Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
* | | | USB: gadget: f_mtp: Update header length correctly in send_file_workVijayavardhan Vennapusa2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whenever data is transmitted from device to Host PC, MTP daemon sitting in userspace writes to mtp driver through ioctl, which eventually calls send_file_work to send data. Currently header length is not updated properly to reflect correct length in case data file size is greater than 4GB. Due to this, Host PC throws error when file of size > 4GB is copied from device to Host PC. Hence fix the issue by updating header length to (2 ^ 32 - 1) if length is greater than 4GB. CRs-Fixed: 953737 Change-Id: I3840afb63f365c28bf3638b13b728800bc2419f4 Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
* | | | usb: xhci: Set interrupt moderation for host mode to 4000(1ms)Azhar Shaikh2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Higher value allows xhci core to moderate interrupts resulting in fewer interrupts from xhci core. This results in lower CPU utilization during peak throughput scenarios. Change-Id: I69548fd9a1adff1b8eafee40c0f92639efd93b2e Signed-off-by: Devdutt Patnaik <dpatnaik@codeaurora.org> Signed-off-by: Azhar Shaikh <azhars@codeaurora.org>
* | | | usb: xhci-plat: Add support to modify imod from sysfsDevdutt Patnaik2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xhci allows interrupts to be moderated at 250ns interval; provide an sysfs interface to modify interrupt rate from userspace to understand throughput variation by changing imod. Usage: Below command will moderate interrupts at 1ms or (4000 * 250ns) interval. echo 4000 > /sys/devices/8a00000.ssusb/8a00000.dwc3/xhci-hcd.0.auto/ config_imod Change-Id: I455d5a0f9a0314e86f711efd35315002b20f5343 Signed-off-by: Devdutt Patnaik <dpatnaik@codeaurora.org> Signed-off-by: Azhar Shaikh <azhars@codeaurora.org> Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: gadget: audio: Don't attempt to close already closed filesManu Gautam2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Audio function driver (f_uac1.c) may call gaudio_cleanup back to back without calling gaudio_setup. Handle this gracefully by marking file pointer as NULL on file_close as gaudio_cleanup routine already checks for NULL before file_close. Change-Id: Ib6acb05578105d64cceaa766d0b0434d1a467c8f Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
* | | | usb: Remove DPDM pulsing functionalityMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This change removes DP DM pulsing functionality related support from QUSB PHY driver as it is not required. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: phy: qusb: Expose DP/DM operations as a regulatorJack Pham2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of having the controller driver call the PHY's DP/DM properties on behalf of the charger driver to enable and disable the regulator, allow the PHY to expose a regulator device. The charger driver then obtains a handle to this regulator to perform regulator enable and disable directly. Change-Id: I266a8cffb4912c2eb6724d73b7ed8c87b83a9e80 Signed-off-by: Jack Pham <jackp@codeaurora.org> Signed-off-by: Azhar Shaikh <azhars@codeaurora.org>
* | | | usb: gadget: diag: Fix NULL pointer crash by adding free_funcMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Configfs framework expects to have free_func() supported with each registered USB function. This change adds free_func() functionality and also frees diag_context as part of it, otherwise there would be memory leak for each composition switch when performing composition switch having USB DIAG interface. Change-Id: I1311cfd5265bd468dc62b6735596afb7cf36a7d2 Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | xhci-hub: Handle error condition with xhci_stop_deviceMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xhci_stop_device() is calling xhci_queue_stop_endpoint() multiple time and doesn't check return value. xhci_queue_stop_endpoint() can return error if xhci is already halted or not able to queue command. xhci_stop_device() waits for stop command completion using wait_for_completion which wouldn't be interrupted or completed if queueing of command fails. It results into possible deadlock condition where usb_disconnect() waits for this udev->lock which is already acquired by caller of xhci_stop_device() which is set_port_feature(). Fix this issue by handling error condition and making sure that xhci_stop_device() doesn't wait if queueing of command is failed. Change-Id: Ica4db17afcd39a7e89fcf985f41760efd2756653 Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | | usb: diag: Fix build error if CONFIG_USB_F_DIAG=mJack Pham2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of #ifdef, use the IS_ENABLED() macro which correctly handles if the Kconfig symbol is built-in (=y) or a module (=m). Also add missing MODULE_LICENSE and MODULE_DESCRIPTION to f_diag.c to allow building as a module. Signed-off-by: Jack Pham <jackp@codeaurora.org>
* | | | Merge remote-tracking branch 'lsk-44/linux-linaro-lsk-v4.4' into 44rc2David Keitel2016-03-23
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * lsk-44/linux-linaro-lsk-v4.4: Linux 4.4.3 modules: fix modparam async_probe request module: wrapper for symbol name. itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper prctl: take mmap sem for writing to protect against others xfs: log mount failures don't wait for buffers to be released Revert "xfs: clear PF_NOFREEZE for xfsaild kthread" xfs: inode recovery readahead can race with inode buffer creation libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct ovl: setattr: check permissions before copy-up ovl: root: copy attr ovl: check dentry positiveness in ovl_cleanup_whiteouts() ovl: use a minimal buffer in ovl_copy_xattr ovl: allow zero size xattr futex: Drop refcount if requeue_pi() acquired the rtmutex devm_memremap_release(): fix memremap'd addr handling ipc/shm: handle removed segments gracefully in shm_mmap() intel_scu_ipcutil: underflow in scu_reg_access() mm,thp: khugepaged: call pte flush at the time of collapse dump_stack: avoid potential deadlocks radix-tree: fix oops after radix_tree_iter_retry drivers/hwspinlock: fix race between radix tree insertion and lookup radix-tree: fix race in gang lookup MAINTAINERS: return arch/sh to maintained state, with new maintainers memcg: only free spare array when readers are done numa: fix /proc/<pid>/numa_maps for hugetlbfs on s390 fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list() scripts/bloat-o-meter: fix python3 syntax error dma-debug: switch check from _text to _stext m32r: fix m32104ut_defconfig build fail xhci: Fix list corruption in urb dequeue at host removal Revert "xhci: don't finish a TD if we get a short-transfer event mid TD" iommu/vt-d: Clear PPR bit to ensure we get more page request interrupts iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG iommu/vt-d: Fix mm refcounting to hold mm_count not mm_users iommu/amd: Correct the wrong setting of alias DTE in do_attach iommu/vt-d: Don't skip PCI devices when disabling IOTLB Input: vmmouse - fix absolute device registration string_helpers: fix precision loss for some inputs Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Input: elantech - mark protocols v2 and v3 as semi-mt mm: fix regression in remap_file_pages() emulation mm: replace vma_lock_anon_vma with anon_vma_lock_read/write mm: fix mlock accouting libnvdimm: fix namespace object confusion in is_uuid_busy() mm: soft-offline: check return value in second __get_any_page() call perf kvm record/report: 'unprocessable sample' error while recording/reporting guest data KVM: PPC: Fix ONE_REG AltiVec support KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 KVM: arm/arm64: Fix reference to uninitialised VGIC arm64: dma-mapping: fix handling of devices registered before arch_initcall ARM: OMAP2+: Fix ppa_zero_params and ppa_por_params for rodata ARM: OMAP2+: Fix save_secure_ram_context for rodata ARM: OMAP2+: Fix l2dis_3630 for rodata ARM: OMAP2+: Fix l2_inv_api_params for rodata ARM: OMAP2+: Fix wait_dll_lock_timed for rodata ARM: dts: at91: sama5d4ek: add phy address and IRQ for macb0 ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type ARM: dts: at91: sama5d4: fix instance id of DBGU ARM: dts: at91: sama5d4 xplained: properly mux phy interrupt ARM: dts: omap5-board-common: enable rtc and charging of backup battery ARM: dts: Fix omap5 PMIC control lines for RTC writes ARM: dts: Fix wl12xx missing clocks that cause hangs ARM: nomadik: fix up SD/MMC DT settings ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() ARM: 8519/1: ICST: try other dividends than 1 arm64: mm: avoid calling apply_to_page_range on empty range ARM: mvebu: remove duplicated regulator definition in Armada 388 GP powerpc/ioda: Set "read" permission when "write" is set powerpc/powernv: Fix stale PE primary bus powerpc/eeh: Fix stale cached primary bus powerpc/eeh: Fix PE location code SUNRPC: Fixup socket wait for memory udf: Check output buffer length when converting name to CS0 udf: Prevent buffer overrun with multi-byte characters udf: limit the maximum number of indirect extents in a row pNFS/flexfiles: Fix an XDR encoding bug in layoutreturn nfs: Fix race in __update_open_stateid() pNFS/flexfiles: Fix an Oopsable typo in ff_mirror_match_fh() NFS: Fix attribute cache revalidation cifs: fix erroneous return value cifs_dbg() outputs an uninitialized buffer in cifs_readdir() cifs: fix race between call_async() and reconnect() cifs: Ratelimit kernel log messages iio: inkern: fix a NULL dereference on error iio: pressure: mpl115: fix temperature offset sign iio: light: acpi-als: Report data as processed iio: dac: mcp4725: set iio name property in sysfs iio: add IIO_TRIGGER dependency to STK8BA50 iio: add HAS_IOMEM dependency to VF610_ADC iio-light: Use a signed return type for ltr501_match_samp_freq() iio:adc:ti_am335x_adc Fix buffered mode by identifying as software buffer. iio: adis_buffer: Fix out-of-bounds memory access scsi: fix soft lockup in scsi_remove_target() on module removal SCSI: Add Marvell Console to VPD blacklist scsi_dh_rdac: always retry MODE SELECT on command lock violation drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration SCSI: fix crashes in sd and sr runtime PM iscsi-target: Fix potential dead-lock during node acl delete scsi: add Synology to 1024 sector blacklist klist: fix starting point removed bug in klist iterators tracepoints: Do not trace when cpu is offline tracing: Fix freak link error caused by branch tracer perf tools: tracepoint_error() can receive e=NULL, robustify it tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines ptrace: use fsuid, fsgid, effective creds for fs access checks Btrfs: fix direct IO requests not reporting IO error to user space Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Btrfs: fix page reading in extent_same ioctl leading to csum errors Btrfs: fix invalid page accesses in extent_same (dedup) ioctl btrfs: properly set the termination value of ctx->pos in readdir Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()" Btrfs: fix fitrim discarding device area reserved for boot loader's use btrfs: handle invalid num_stripes in sys_array ext4: don't read blocks from disk after extents being swapped ext4: fix potential integer overflow ext4: fix scheduling in atomic on group checksum failure serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485) serial: 8250_pci: Add Intel Broadwell ports tty: Add support for PCIe WCH382 2S multi-IO card pty: make sure super_block is still valid in final /dev/tty close pty: fix possible use after free of tty->driver_data staging/speakup: Use tty_ldisc_ref() for paste kworker phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload phy: twl4030-usb: Relase usb phy on unload ALSA: seq: Fix double port list deletion ALSA: seq: Fix leak of pool buffer at concurrent writes ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream ALSA: hda - Cancel probe work instead of flush at remove x86/mm: Fix vmalloc_fault() to handle large pages properly x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache() x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable x86/mm/pat: Avoid truncation when converting cpa->numpages to address x86/mm: Fix types used in pgprot cacheability flags translations Linux 4.4.2 HID: multitouch: fix input mode switching on some Elan panels mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress zsmalloc: fix migrate_zspage-zs_free race condition zram: don't call idr_remove() from zram_remove() zram: try vmalloc() after kmalloc() zram/zcomp: use GFP_NOIO to allocate streams rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly encoded rtlwifi: rtl8821ae: Fix errors in parameter initialization crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init() crypto: atmel-sha - remove calls of clk_prepare() from atomic contexts crypto: atmel-sha - fix atmel_sha_remove() crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path crypto: algif_skcipher - Do not dereference ctx without socket lock crypto: algif_skcipher - Do not assume that req is unchanged crypto: user - lock crypto_alg_list on alg dump EVM: Use crypto_memneq() for digest comparisons crypto: algif_hash - wait for crypto_ahash_init() to complete crypto: shash - Fix has_key setting crypto: chacha20-ssse3 - Align stack pointer to 64 bytes crypto: caam - make write transactions bufferable on PPC platforms crypto: algif_skcipher - sendmsg SG marking is off by one crypto: algif_skcipher - Load TX SG list after waiting crypto: crc32c - Fix crc32c soft dependency crypto: algif_skcipher - Fix race condition in skcipher_check_key crypto: algif_hash - Fix race condition in hash_check_key crypto: af_alg - Forbid bind(2) when nokey child sockets are present crypto: algif_skcipher - Remove custom release parent function crypto: algif_hash - Remove custom release parent function crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path ahci: Intel DNV device IDs SATA libata: disable forced PORTS_IMPL for >= AHCI 1.3 crypto: algif_skcipher - Add key check exception for cipher_null crypto: skcipher - Add crypto_skcipher_has_setkey crypto: algif_hash - Require setkey before accept(2) crypto: hash - Add crypto_ahash_has_setkey crypto: algif_skcipher - Add nokey compatibility path crypto: af_alg - Add nokey compatibility path crypto: af_alg - Fix socket double-free when accept fails crypto: af_alg - Disallow bind/setkey/... after accept(2) crypto: algif_skcipher - Require setkey before accept(2) sched: Fix crash in sched_init_numa() ext4 crypto: add missing locking for keyring_key access iommu/io-pgtable-arm: Ensure we free the final level on teardown tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) tty: Retry failed reopen if tty teardown in-progress tty: Wait interruptibly for tty lock on reopen n_tty: Fix unsafe reference to "other" ldisc usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms usb: xhci: handle both SSIC ports in PME stuck quirk usb: phy: msm: fix error handling in probe. usb: cdc-acm: send zero packet for intel 7260 modem usb: cdc-acm: handle unlinked urb in acm read callback USB: option: fix Cinterion AHxx enumeration USB: serial: option: Adding support for Telit LE922 USB: cp210x: add ID for IAI USB to RS485 adaptor USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable usb: hub: do not clear BOS field during reset device USB: visor: fix null-deref at probe USB: serial: visor: fix crash on detecting device without write_urbs ASoC: rt5645: fix the shift bit of IN1 boost saa7134-alsa: Only frees registered sound cards ALSA: dummy: Implement timer backend switching more safely ALSA: hda - Fix bad dereference of jack object ALSA: hda - Fix speaker output from VAIO AiO machines Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo" ALSA: hda - Fix static checker warning in patch_hdmi.c ALSA: hda - Add fixup for Mac Mini 7,1 model ALSA: timer: Fix race between stop and interrupt ALSA: timer: Fix wrong instance passed to slave callbacks ALSA: timer: Fix race at concurrent reads ALSA: timer: Fix link corruption due to double start or stop ALSA: timer: Fix leftover link at closing ALSA: timer: Code cleanup ALSA: seq: Fix lockdep warnings due to double mutex locks ALSA: seq: Fix race at closing in virmidi driver ALSA: seq: Fix yet another races among ALSA timer accesses ASoC: dpcm: fix the BE state on hw_free ALSA: pcm: Fix potential deadlock in OSS emulation ALSA: hda/realtek - Support Dell headset mode for ALC225 ALSA: hda/realtek - Support headset mode for ALC225 ALSA: hda/realtek - New codec support of ALC225 ALSA: rawmidi: Fix race at copying & updating the position ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check ALSA: rawmidi: Make snd_rawmidi_transmit() race-free ALSA: seq: Degrade the error message for too many opens ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() ALSA: dummy: Disable switching timer backend via sysfs ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures ALSA: hda - disable dynamic clock gating on Broxton before reset ALSA: Add missing dependency on CONFIG_SND_TIMER ALSA: bebob: Use a signed return type for get_formation_index ALSA: usb-audio: avoid freeing umidi object twice ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC ALSA: usb-audio: Fix OPPO HA-1 vendor ID ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000 ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay hrtimer: Handle remaining time proper for TIME_LOW_RES md/raid: only permit hot-add of compatible integrity profiles media: i2c: Don't export ir-kbd-i2c module alias parisc: Fix __ARCH_SI_PREAMBLE_SIZE parisc: Protect huge page pte changes with spinlocks printk: do cond_resched() between lines while outputting to consoles tracing/stacktrace: Show entire trace if passed in function not found tracing: Fix stacktrace skip depth in trace_buffer_unlock_commit_regs() PCI: Fix minimum allocation address overwrite PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD mtd: nand: assign reasonable default name for NAND drivers wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) wlcore/wl12xx: spi: fix oops on firmware load ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup ocfs2/dlm: ignore cleaning the migration mle that is inuse ALSA: hda - Implement loopback control switch for Realtek and other codecs block: fix bio splitting on max sectors base/platform: Fix platform drivers with no probe callback HID: usbhid: fix recursive deadlock ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock block: split bios to max possible length NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn crypto: sun4i-ss - add missing statesize Linux 4.4.1 arm64: kernel: fix architected PMU registers unconditional access arm64: kernel: enforce pmuserenr_el0 initialization and restore arm64: mm: ensure that the zero page is visible to the page table walker arm64: Clear out any singlestep state on a ptrace detach operation powerpc/module: Handle R_PPC64_ENTRY relocations scripts/recordmcount.pl: support data in text section on powerpc powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered powerpc: Make value-returning atomics fully ordered powerpc/tm: Check for already reclaimed tasks batman-adv: Drop immediate orig_node free function batman-adv: Drop immediate batadv_hard_iface free function batman-adv: Drop immediate neigh_ifinfo free function batman-adv: Drop immediate batadv_neigh_node free function batman-adv: Drop immediate batadv_orig_ifinfo free function batman-adv: Avoid recursive call_rcu for batadv_nc_node batman-adv: Avoid recursive call_rcu for batadv_bla_claim team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid net/mlx5_core: Fix trimming down IRQ number bridge: fix lockdep addr_list_lock false positive splat ipv6: update skb->csum when CE mark is propagated net: bpf: reject invalid shifts phonet: properly unshare skbs in phonet_rcv() dwc_eth_qos: Fix dma address for multi-fragment skbs bonding: Prevent IPv6 link local address on enslaved devices net: preserve IP control block during GSO segmentation udp: disallow UFO for sockets with SO_NO_CHECK option net: pktgen: fix null ptr deref in skb allocation sched,cls_flower: set key address type when present tcp_yeah: don't set ssthresh below 2 ipv6: tcp: add rcu locking in tcp_v6_send_synack() net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory vxlan: fix test which detect duplicate vxlan iface unix: properly account for FDs passed over unix sockets xhci: refuse loading if nousb is used usb: core: lpm: fix usb3_hardware_lpm sysfs node USB: cp210x: add ID for ELV Marble Sound Board 1 rtlwifi: fix memory leak for USB device ASoC: compress: Fix compress device direction check ASoC: wm5110: Fix PGA clear when disabling DRE ALSA: timer: Handle disconnection more safely ALSA: hda - Flush the pending probe work at remove ALSA: hda - Fix missing module loading with model=generic option ALSA: hda - Fix bass pin fixup for ASUS N550JX ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 ALSA: hrtimer: Fix stall by hrtimer_cancel() ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode ALSA: hda - Add fixup for Dell Latitidue E6540 ALSA: timer: Fix double unlink of active_list ALSA: timer: Fix race among timer ioctls ALSA: hda - fix the headset mic detection problem for a Dell laptop ALSA: timer: Harden slave timer list handling ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices ALSA: hda - Fix white noise on Dell Latitude E5550 ALSA: seq: Fix race at timer setup and close ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect ALSA: seq: Fix missing NULL check at remove_events ioctl ALSA: hda - Fixup inverted internal mic for Lenovo E50-80 ALSA: usb: Add native DSD support for Oppo HA-1 x86/mm: Improve switch_mm() barrier comments x86/mm: Add barriers and document switch_mm()-vs-flush synchronization x86/boot: Double BOOT_HEAP_SIZE to 64KB x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] kvm: x86: Fix vmwrite to SECONDARY_VM_EXEC_CONTROL KVM: x86: correctly print #AC in traces KVM: x86: expose MSR_TSC_AUX to userspace x86/xen: don't reset vcpu_info on a cancelled suspend KEYS: Fix keyring ref leak in join_session_keyring() Conflicts: arch/arm64/kernel/perf_event.c drivers/scsi/sd.c sound/core/compress_offload.c Change-Id: I9f77fe42aaae249c24cd6e170202110ab1426878 Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
| * | | xhci: Fix list corruption in urb dequeue at host removalMathias Nyman2016-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5c82171167adb8e4ac77b91a42cd49fb211a81a0 upstream. xhci driver frees data for all devices, both usb2 and and usb3 the first time usb_remove_hcd() is called, including td_list and and xhci_ring structures. When usb_remove_hcd() is called a second time for the second xhci bus it will try to dequeue all pending urbs, and touches td_list which is already freed for that endpoint. Reported-by: Joe Lawrence <joe.lawrence@stratus.com> Tested-by: Joe Lawrence <joe.lawrence@stratus.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | Revert "xhci: don't finish a TD if we get a short-transfer event mid TD"Mathias Nyman2016-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a6835090716a85f2297668ba593bd00e1051e662 upstream. This reverts commit e210c422b6fd ("xhci: don't finish a TD if we get a short transfer event mid TD") Turns out that most host controllers do not follow the xHCI specs and never send the second event for the last TRB in the TD if there was a short event mid-TD. Returning the URB directly after the first short-transfer event is far better than never returning the URB. (class drivers usually timeout after 30sec). For the hosts that do send the second event we will go back to treating it as misplaced event and print an error message for it. The origial patch was sent to stable kernels and needs to be reverted from there as well Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platformsLu Baolu2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ccc04afb72cddbdf7c0e1c17e92886405a71b754 upstream. Intel Broxton M was verifed to require XHCI_PME_STUCK_QUIRK quirk as well. Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | usb: xhci: handle both SSIC ports in PME stuck quirkLu Baolu2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit fa89537783cb442263fa5a14df6c7693eaf32f11 upstream. Commit abce329c27b3 ("xhci: Workaround to get D3 working in Intel xHCI") adds a workaround for a limitation of PME storm caused by SSIC port in some Intel SoCs. This commit only handled one SSIC port, while there are actually two SSIC ports in the chips. This patch handles both SSIC ports. Without this fix, users still see PME storm. Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | usb: phy: msm: fix error handling in probe.Srinivas Kandagatla2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a38a08dfaaab978dced63aa9cad45f0f62e23a66 upstream. This driver registers for extcon events as part of its probe, but never unregisters them in case of error in the probe path. There were multiple issues noticed due to this missing error handling. One of them is random crashes if the regulators are not ready yet by the time probe is invoked. Ivan's previous attempt [1] to fix this issue, did not really address all the failure cases like regualtor/get_irq failures. [1] https://lkml.org/lkml/2015/9/7/62 Without this patch the kernel would carsh with log: ... Unable to handle kernel paging request at virtual address 17d78410 pgd = ffffffc001a5c000 [17d78410] *pgd=00000000b6806003, *pud=00000000b6806003, *pmd=0000000000000000 Internal error: Oops: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6 Comm: kworker/u8:0 Not tainted 4.4.0+ #48 Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) Workqueue: deferwq deferred_probe_work_func task: ffffffc03686e900 ti: ffffffc0368b0000 task.ti: ffffffc0368b0000 PC is at raw_notifier_chain_register+0x1c/0x44 LR is at extcon_register_notifier+0x88/0xc8 pc : [<ffffffc0000da43c>] lr : [<ffffffc000606298>] pstate: 80000085 sp : ffffffc0368b3a70 x29: ffffffc0368b3a70 x28: ffffffc03680c310 x27: ffffffc035518000 x26: ffffffc035518000 x25: ffffffc03bfa20e0 x24: ffffffc035580a18 x23: 0000000000000000 x22: ffffffc035518458 x21: ffffffc0355e9a60 x20: ffffffc035518000 x19: 0000000000000000 x18: 0000000000000028 x17: 0000000000000003 x16: ffffffc0018153c8 x15: 0000000000000001 x14: ffffffc03686f0f8 x13: ffffffc03686f0f8 x12: 0000000000000003 x11: 0000000000000001 x10: 0000000000000001 x9 : ffffffc03686f0f8 x8 : 0000e3872014c1a1 x7 : 0000000000000028 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : 00000000354fb170 x2 : 0000000017d78400 x1 : ffffffc0355e9a60 x0 : ffffffc0354fb268 Fixes: 591fc116f330 ("usb: phy: msm: Use extcon framework for VBUS and ID detection") Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | usb: cdc-acm: send zero packet for intel 7260 modemLu Baolu2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ffdb1e369a73b380fce95b05f8498d92c43842b4 upstream. For Intel 7260 modem, it is needed for host side to send zero packet if the BULK OUT size is equal to USB endpoint max packet length. Otherwise, modem side may still wait for more data and cannot give response to host side. Signed-off-by: Konrad Leszczynski <konrad.leszczynski@intel.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | usb: cdc-acm: handle unlinked urb in acm read callbackLu Baolu2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 19454462acb1bdef80542061bdc9b410e4ed1ff6 upstream. In current acm driver, the bulk-in callback function ignores the URBs unlinked in usb core. This causes unexpected data loss in some cases. For example, runtime suspend entry will unlinked all urbs and set urb->status to -ENOENT even those urbs might have data not processed yet. Hence, data loss occurs. This patch lets bulk-in callback function handle unlinked urbs to avoid data loss. Signed-off-by: Tang Jian Qiang <jianqiang.tang@intel.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Acked-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | USB: option: fix Cinterion AHxx enumerationJohn Ernberg2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4152b387da81617c80cb2946b2d56e3958906b3e upstream. In certain kernel configurations where the cdc_ether and option drivers are compiled as modules there can occur a race condition in enumeration. This causes the option driver to enumerate the ethernet(wwan) interface as usb-serial interfaces. usb-devices output for the modem: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=0055 Rev=00.00 S: Manufacturer=Cinterion S: Product=AHx C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=10mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether Signed-off-by: John Ernberg <john.ernberg@actia.se> Fixes: 1941138e1c02 ("USB: added support for Cinterion's products...") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | USB: serial: option: Adding support for Telit LE922Daniele Palmas2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ff4e2494dc17b173468e1713fdf6237fd8578bc7 upstream. This patch adds support for two PIDs of LE922. Signed-off-by: Daniele Palmas <dnlplm@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | USB: cp210x: add ID for IAI USB to RS485 adaptorPeter Dedecker2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f487c54ddd544e1c9172cd510954f697b77b76e3 upstream. Added the USB serial console device ID for IAI Corp. RCB-CV-USB USB to RS485 adaptor. Signed-off-by: Peter Dedecker <peter.dedecker@hotmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | USB: serial: ftdi_sio: add support for Yaesu SCU-18 cableGreg Kroah-Hartman2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit e03cdf22a2727c60307be6a729233edab3bfda9c upstream. Harald Linden reports that the ftdi_sio driver works properly for the Yaesu SCU-18 cable if the device ids are added to the driver. So let's add them. Reported-by: Harald Linden <harald.linden@7183.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | usb: hub: do not clear BOS field during reset deviceDu, Changbin2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit d8f00cd685f5c8e0def8593e520a7fef12c22407 upstream. In function usb_reset_and_verify_device, the old BOS descriptor may still be used before allocating a new one. (usb_unlocked_disable_lpm function uses it under the situation that it fails to disable lpm.) So we cannot set the udev->bos to NULL before that, just keep what it was. It will be overwrite when allocating a new one. Crash log: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [<ffffffff8171f98d>] usb_enable_link_state+0x2d/0x2f0 Call Trace: [<ffffffff8171ed5b>] ? usb_set_lpm_timeout+0x12b/0x140 [<ffffffff8171fcd1>] usb_enable_lpm+0x81/0xa0 [<ffffffff8171fdd8>] usb_disable_lpm+0xa8/0xc0 [<ffffffff8171fe1c>] usb_unlocked_disable_lpm+0x2c/0x50 [<ffffffff81723933>] usb_reset_and_verify_device+0xc3/0x710 [<ffffffff8172c4ed>] ? usb_sg_wait+0x13d/0x190 [<ffffffff81724743>] usb_reset_device+0x133/0x280 [<ffffffff8179ccd1>] usb_stor_port_reset+0x61/0x70 [<ffffffff8179cd68>] usb_stor_invoke_transport+0x88/0x520 Signed-off-by: Du, Changbin <changbin.du@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | USB: visor: fix null-deref at probeJohan Hovold2016-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 upstream. Fix null-pointer dereference at probe should a (malicious) Treo device lack the expected endpoints. Specifically, the Treo port-setup hack was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | USB: serial: visor: fix crash on detecting device without write_urbsVladis Dronov2016-02-17
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit cb3232138e37129e88240a98a1d2aba2187ff57c upstream. The visor driver crashes in clie_5_attach() when a specially crafted USB device without bulk-out endpoint is detected. This fix adds a check that the device has proper configuration expected by the driver. Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Fixes: cfb8da8f69b8 ("USB: visor: fix initialisation of UX50/TH55 devices") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | xhci: refuse loading if nousb is usedOliver Neukum2016-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1eaf35e4dd592c59041bc1ed3248c46326da1f5f upstream. The module should fail to load. Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | usb: core: lpm: fix usb3_hardware_lpm sysfs nodeLu Baolu2016-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit bf5ce5bf3cc7136fd7fe5e8999a580bc93a9c8f6 upstream. Commit 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM") introduced usb3_hardware_lpm sysfs node. This doesn't show the correct status of USB3 U1 and U2 LPM status. This patch fixes this by replacing usb3_hardware_lpm with two nodes, usb3_hardware_lpm_u1 (for U1) and usb3_hardware_lpm_u2 (for U2), and recording the U1/U2 LPM status in right places. This patch should be back-ported to kernels as old as 4.3, that contains Commit 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM"). Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | USB: cp210x: add ID for ELV Marble Sound Board 1Oliver Freyermuth2016-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f7d7f59ab124748156ea551edf789994f05da342 upstream. Add the USB device ID for ELV Marble Sound Board 1. Signed-off-by: Oliver Freyermuth <o.freyermuth@googlemail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | usb: gadget: f_diag: Fix check to update dload cookieMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | This change update dload cookie if cdev->desc.iSerialNumber is already available instead of trying to get string descriptors. It also adds check against possibility of string descriptors being NULL to avoid device crash. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: gadget: cdev: Add USB serial driver functionalityMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds below functionality: 1. Add USB serial driver functionality 2. Add configfS support 3. Enable USB character serial driver Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: Rename u_data_bridge.c as f_cdev.cMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | To reduce depedency on f_serial.c, this change rename u_data_bridge.c as f_cdev.c and USB serial functionality shall be added on this driver. Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: u_data_bridge: Check for USB cable connect with gbridge_port_write()Mayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is NULL pointer crash seen due to accessing port->port_usb from gbridge_port_write() when port bridge application's write thread is pre-empted and USB cable disconnect is being performed. Fix this issue by adding check for USB cable is connected or not and handling USB request accordingly. Change-Id: Ide14de298b7186cbe7b7af1e99c8c47bc389130b Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: u_data_bridge: Lower DTR on USB cable disconnect to modemMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When DUN call is operational and USB cable is being disconnected, DTR is not being lowered with modem. This results into no DUN call functionality on next USB cable connect case. Fix this issue by lowering DTR to modem on USB cable disconnect. This change also returns zero instead of -EAGAIN when there is no write USB request available. Also it moves port open interrupted message loglevel from pr_err() to pr_debug to reduce logging on serial console. Change-Id: I3259417aceee2713d7765c9de34ace4ea2d3ed96 Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: u_data_bridge: Check allowable size with gbridge_port_write()Mayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently gbridge_port_write() is not checking size of user space provided data and directly copies buffer into USB request buffer which is having size as 2KB. If user space application writes data bigger than 2KB, copy_from_user() tries to copy data beyond allocated USB request buffer size which results into memory corruption. Fix this issue by checking allowable size with gbridge_port_write() and making sure that it doesn't copy data beyond allocated buffer size. Change-Id: I7a34e37f5d1609792374f07b70542b80edbe6944 Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: u_data_bridge: Improve USB RX (read) functionalityMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change handles below cases and improves performance: 1. If USB OUT request buffer is bigger than provided read buffer from application, then data equal to read buffer is copied. This results into data loss. Handle this case by making sure that whole USB OUT request buffer is provided to application across multiple read() call. 2. If read buffer size is greater than available data as part of one USB OUT request buffer, then copy data from other USB OUT request buffers until read buffer is filled completely. Change-Id: If2756ed82bd6e95650ebcc38c4042bfb593f8a2b Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: u_data_bridge: Return error when no USB TX request availableMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases, it has been observed that all USB TX requests are queued with USB controller and port bridge is trying to write data. gbridge_port_write() API is returning zero (success of data) instead of error code which results into data loss. Hence return -EAGAIN when there is no USB TX request available. Also mark this error as non-fatal by using pr_debug() here. Change-Id: Id56788b372b62a005448a729e5f00de6fb895e47 Signed-off-by: Mayank Rana <mrana@codeaurora.org>
* | | usb: u_data_bridge: Fix handling of USB RX requestsMayank Rana2016-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently on USB composition switch or USB cable disconnect, USB RX requests are being added as part of read_queued list instead of read_pool. In some cases it is seen that if port bridge is trying to read data, those requests are requeued and fails with -ESHUTDOWN, and again it continues with results into watchdog timeout due to error log coming from read request completion handler. Fix this by adding proper check in read request completion handler. Also reduce USB Tx/RX buffer size from PAGE_SIZE to 2048 bytes. It also fixes issue where USB RX requests are not being queued after USB composition switch. CRs-Fixed: 854301 Change-Id: I3616dc35c093cfa19865891f46e7b1ccc7302573 Signed-off-by: Mayank Rana <mrana@codeaurora.org>