Commit Graph

2394 Commits

Author SHA1 Message Date
Duan Jiong 9f58fa4c91 usb: gadget: f_subset: replace PTR_RET with PTR_ERR_OR_ZERO
PTR_RET is deprecated. Do not recommend its usage anymore.
Use PTR_ERR_OR_ZERO instead.

Signed-off-by: Duan Jiong <duanj.fnst@cn.fujitsu.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:29 -05:00
Andreas Larsson 8652bcbfa0 usb: gadget: gr_udc: Use GFP_ATOMIC when allocating under held spinlock
As gr_ep_init must be called with dev->lock held, GFP_KERNEL must not be used.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:28 -05:00
Andreas Larsson b38d27e552 usb: gadget: gr_udc: Return error code when trying to set ep.maxpacket > ep.maxpacket_limit
Make gr_ep_enable fail properly when a call requests a larger ep.maxpacket than
ep.maxpacket_limit.

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:27 -05:00
Andreas Larsson 5bddbd72c6 usb: gadget: gr_udc: Add ep.maxpacket_limit to debugfs information
Add information on ep.maxpacket_limit for each endpoint in the debugfs
information.

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:27 -05:00
Andreas Larsson 73e1c093e8 usb: gadget: gr_udc: Use of_property_read_u32_index to access arrays
Use an appropriate accessor function for property arrays to make the code nicer
and make the code correct if it would ever run on little endian architectures.
Suggested by Mark Rutland.

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:27 -05:00
Andreas Larsson 196800da39 usb: gadget: gr_udc: Use platform_get_irq instead of irq_of_parse_and_map
Use platform_get_irq as no mapping needs to be done. No functional difference
for SPARC which is the typical environment for the driver though. Suggested by
Mark Rutland.

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:26 -05:00
Andreas Larsson 22876266de usb: gadget: gr_udc: improve platform_device variable name
Rename struct platform_device pointers from ofdev to pdev for clarity,
while at that, also use platform_set/get_drvdata() helpers.

Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:26 -05:00
Felipe Balbi 0700faaf73 usb: gadget: only GPL drivers in the gadget and phy framework
We only support GPL drivers in the USB Gadget Framework,
it sounds correct to make all exported symbols GPL too.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-04-21 14:07:12 -05:00
Linus Torvalds 141eaccd01 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull SCSI target updates from Nicholas Bellinger:
 "Here are the target pending updates for v3.15-rc1.  Apologies in
  advance for waiting until the second to last day of the merge window
  to send these out.

  The highlights this round include:

   - iser-target support for T10 PI (DIF) offloads (Sagi + Or)
   - Fix Task Aborted Status (TAS) handling in target-core (Alex Leung)
   - Pass in transport supported PI at session initialization (Sagi + MKP + nab)
   - Add WRITE_INSERT + READ_STRIP T10 PI support in target-core (nab + Sagi)
   - Fix iscsi-target ERL=2 ASYNC_EVENT connection pointer bug (nab)
   - Fix tcm_fc use-after-free of ft_tpg (Andy Grover)
   - Use correct ib_sg_dma primitives in ib_isert (Mike Marciniszyn)

  Also, note the virtio-scsi + vhost-scsi changes to expose T10 PI
  metadata into KVM guest have been left-out for now, as there where a
  few comments from MST + Paolo that where not able to be addressed in
  time for v3.15.  Please expect this feature for v3.16-rc1"

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (43 commits)
  ib_srpt: Use correct ib_sg_dma primitives
  target/tcm_fc: Rename ft_tport_create to ft_tport_get
  target/tcm_fc: Rename ft_{add,del}_lport to {add,del}_wwn
  target/tcm_fc: Rename structs and list members for clarity
  target/tcm_fc: Limit to 1 TPG per wwn
  target/tcm_fc: Don't export ft_lport_list
  target/tcm_fc: Fix use-after-free of ft_tpg
  target: Add check to prevent Abort Task from aborting itself
  target: Enable READ_STRIP emulation in target_complete_ok_work
  target/sbc: Add sbc_dif_read_strip software emulation
  target: Enable WRITE_INSERT emulation in target_execute_cmd
  target/sbc: Add sbc_dif_generate software emulation
  target/sbc: Only expose PI read_cap16 bits when supported by fabric
  target/spc: Only expose PI mode page bits when supported by fabric
  target/spc: Only expose PI inquiry bits when supported by fabric
  target: Pass in transport supported PI at session initialization
  target/iblock: Fix double bioset_integrity_free bug
  Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist
  target/rd: T10-Dif: RAM disk is allocating more space than required.
  iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
  ...
2014-04-12 16:51:08 -07:00
Nicholas Bellinger e70beee783 target: Pass in transport supported PI at session initialization
In order to support local WRITE_INSERT + READ_STRIP operations for
non PI enabled fabrics, the fabric driver needs to be able signal
what protection offload operations are supported.

This is done at session initialization time so the modes can be
signaled by individual se_wwn + se_portal_group endpoints, as well
as optionally across different transports on the same endpoint.

For iser-target, set TARGET_PROT_ALL if the underlying ib_device
has already signaled PI offload support, and allow this to be
exposed via a new iscsit_transport->iscsit_get_sup_prot_ops()
callback.

For loopback, set TARGET_PROT_ALL to signal SCSI initiator mode
operation.

For all other drivers, set TARGET_PROT_NORMAL to disable fabric
level PI.

Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Cc: Quinn Tran <quinn.tran@qlogic.com>
Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-07 01:48:54 -07:00
Nicholas Bellinger 131e6abc67 target: Add TFO->abort_task for aborted task resources release
Now that TASK_ABORTED status is not generated for all cases by
TMR ABORT_TASK + LUN_RESET, a new TFO->abort_task() caller is
necessary in order to give fabric drivers a chance to unmap
hardware / software resources before the se_cmd descriptor is
released via the normal TFO->release_cmd() codepath.

This patch adds TFO->aborted_task() in core_tmr_abort_task()
in place of the original transport_send_task_abort(), and
also updates all fabric drivers to implement this caller.

The fabric drivers that include changes to perform cleanup
via ->aborted_task() are:

  - iscsi-target
  - iser-target
  - srpt
  - tcm_qla2xxx

The fabric drivers that currently set ->aborted_task() to
NOPs are:

  - loopback
  - tcm_fc
  - usb-gadget
  - sbp-target
  - vhost-scsi

For the latter five, there appears to be no additional cleanup
required before invoking TFO->release_cmd() to release the
se_cmd descriptor.

v2 changes:
  - Move ->aborted_task() call into transport_cmd_finish_abort (Alex)

Cc: Alex Leung <amleung21@yahoo.com>
Cc: Mark Rustad <mark.d.rustad@intel.com>
Cc: Roland Dreier <roland@kernel.org>
Cc: Vu Pham <vu@mellanox.com>
Cc: Chris Boot <bootc@bootc.net>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
Cc: Saurav Kashyap <saurav.kashyap@qlogic.com>
Cc: Quinn Tran <quinn.tran@qlogic.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2014-04-07 01:48:51 -07:00
Linus Torvalds 2d1eb87ae1 Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm
Pull ARM changes from Russell King:

 - Perf updates from Will Deacon:
   - Support for Qualcomm Krait processors (run perf on your phone!)
   - Support for Cortex-A12 (run perf stat on your FPGA!)
   - Support for perf_sample_event_took, allowing us to automatically decrease
     the sample rate if we can't handle the PMU interrupts quickly enough
     (run perf record on your FPGA!).

 - Basic uprobes support from David Long:
     This patch series adds basic uprobes support to ARM. It is based on
     patches developed earlier by Rabin Vincent. That approach of adding
     hooks into the kprobes instruction parsing code was not well received.
     This approach separates the ARM instruction parsing code in kprobes out
     into a separate set of functions which can be used by both kprobes and
     uprobes. Both kprobes and uprobes then provide their own semantic action
     tables to process the results of the parsing.

 - ARMv7M (microcontroller) updates from Uwe Kleine-König

 - OMAP DMA updates (recently added Vinod's Ack even though they've been
   sitting in linux-next for a few months) to reduce the reliance of
   omap-dma on the code in arch/arm.

 - SA11x0 changes from Dmitry Eremin-Solenikov and Alexander Shiyan

 - Support for Cortex-A12 CPU

 - Align support for ARMv6 with ARMv7 so they can cooperate better in a
   single zImage.

 - Addition of first AT_HWCAP2 feature bits for ARMv8 crypto support.

 - Removal of IRQ_DISABLED from various ARM files

 - Improved efficiency of virt_to_page() for single zImage

 - Patch from Ulf Hansson to permit runtime PM callbacks to be available for
   AMBA devices for suspend/resume as well.

 - Finally kill asm/system.h on ARM.

* 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: (89 commits)
  dmaengine: omap-dma: more consolidation of CCR register setup
  dmaengine: omap-dma: move IRQ handling to omap-dma
  dmaengine: omap-dma: move register read/writes into omap-dma.c
  ARM: omap: dma: get rid of 'p' allocation and clean up
  ARM: omap: move dma channel allocation into plat-omap code
  ARM: omap: dma: get rid of errata global
  ARM: omap: clean up DMA register accesses
  ARM: omap: remove almost-const variables
  ARM: omap: remove references to disable_irq_lch
  dmaengine: omap-dma: cleanup errata 3.3 handling
  dmaengine: omap-dma: provide register read/write functions
  dmaengine: omap-dma: use cached CCR value when enabling DMA
  dmaengine: omap-dma: move barrier to omap_dma_start_desc()
  dmaengine: omap-dma: move clnk_ctrl setting to preparation functions
  dmaengine: omap-dma: improve efficiency loading C.SA/C.EI/C.FI registers
  dmaengine: omap-dma: consolidate clearing channel status register
  dmaengine: omap-dma: move CCR buffering disable errata out of the fast path
  dmaengine: omap-dma: provide register definitions
  dmaengine: omap-dma: consolidate setup of CCR
  dmaengine: omap-dma: consolidate setup of CSDP
  ...
2014-04-05 13:20:43 -07:00
Russell King bce5669be3 Merge branch 'devel-stable' into for-next 2014-04-04 00:33:49 +01:00
Linus Torvalds 3e75c6de1a USB patches for 3.15-rc1
Here's the big USB pull request for 3.15-rc1.
 
 The normal set of patches, lots of controller driver updates, and a
 smattering of individual USB driver updates as well.
 
 All have been in linux-next for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iEYEABECAAYFAlM7AbcACgkQMUfUDdst+ymbZACgncdbZyPsVZ7ZUpBFNbO/vBVT
 T9UAmwciojEzjh7b+x4ylsWH+O3LWVN3
 =RpAF
 -----END PGP SIGNATURE-----

Merge tag 'usb-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB patches from Greg KH:
 "Here's the big USB pull request for 3.15-rc1.

  The normal set of patches, lots of controller driver updates, and a
  smattering of individual USB driver updates as well.

  All have been in linux-next for a while"

* tag 'usb-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (249 commits)
  xhci: Transition maintainership to Mathias Nyman.
  USB: disable reset-resume when USB_QUIRK_RESET is set
  USB: unbind all interfaces before rebinding any
  usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210
  usb: gadget: tcm_usb_gadget: stop format strings
  usb: gadget: f_fs: add missing spinlock and mutex unlock
  usb: gadget: composite: switch over to ERR_CAST()
  usb: gadget: inode: switch over to memdup_user()
  usb: gadget: f_subset: switch over to PTR_RET
  usb: gadget: lpc32xx_udc: fix wrong clk_put() sequence
  USB: keyspan: remove dead debugging code
  USB: serial: add missing newlines to dev_<level> messages.
  USB: serial: add missing braces
  USB: serial: continue to write on errors
  USB: serial: continue to read on errors
  USB: serial: make bulk_out_size a lower limit
  USB: cypress_m8: fix potential scheduling while atomic
  devicetree: bindings: document lsi,zevio-usb
  usb: chipidea: add support for USB OTG controller on LSI Zevio SoCs
  usb: chipidea: imx: Use dev_name() for ci_hdrc name to distinguish USBs
  ...
2014-04-01 17:06:09 -07:00
Linus Torvalds cb15955638 TTY/Serial driver update for 3.15-rc1
Here's the big tty/serial driver update for 3.15-rc1.
 
 Nothing major, a number of serial driver updates and a few tty core
 fixes as well.
 
 All have been in linux-next for a while.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iEYEABECAAYFAlM7CWAACgkQMUfUDdst+ylDXACg0vZ+J+5OXbbE3lywVCAebjhB
 XzkAn1lz7JRIils7IlckAJ2w/m50b174
 =M+8c
 -----END PGP SIGNATURE-----

Merge tag 'tty-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial driver update from Greg KH:
 "Here's the big tty/serial driver update for 3.15-rc1.

  Nothing major, a number of serial driver updates and a few tty core
  fixes as well.

  All have been in linux-next for a while"

* tag 'tty-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (71 commits)
  tty/serial: omap: empty the RX FIFO at the end of half-duplex TX
  tty/serial: omap: fix RX interrupt enable/disable in half-duplex TX
  serial: sh-sci: Neaten dev_<level> uses
  serial: sh-sci: Replace hardcoded 3 by UART_PM_STATE_OFF
  serial: sh-sci: Add more register documentation
  serial: sh-sci: Remove useless casts
  serial: sh-sci: Replace printk() by pr_*()
  serial_core: Avoid NULL pointer dereference in uart_close()
  serial_core: Get a reference for port->tty in uart_remove_one_port()
  serial: clps711x: Give a chance to perform useful tasks during wait loop
  serial_core: Grammar s/ports/port's/
  serial_core: Spelling s/contro/control/
  serial: efm32: properly namespace location property
  serial: max310x: Add missing #include <linux/uaccess.h>
  synclink: fix info leak in ioctl
  serial: 8250: Clean up the locking for -rt
  serial: 8250_pci: change BayTrail default uartclk
  serial: 8250_pci: more BayTrail error-free bauds
  serial: sh-sci: Add missing call to uart_remove_one_port() in failure path
  serial_core: Unregister console in uart_remove_one_port()
  ...
2014-04-01 16:55:57 -07:00
Kees Cook aba37fd975 usb: gadget: tcm_usb_gadget: stop format strings
This makes sure that the name coming out of configfs cannot be used
accidentally as a format string.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:08:27 -07:00
Robert Baldyga 48968f8d5f usb: gadget: f_fs: add missing spinlock and mutex unlock
This patch adds missing spin_unlock and mutex_unlock calls in
error handling code.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi dad4babe41 usb: gadget: composite: switch over to ERR_CAST()
This patch fixes the following Coccinelle warning:

drivers/usb/gadget/composite.c:1142:9-16: WARNING: \
	ERR_CAST can be used with uc

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi 3b74c73f8d usb: gadget: inode: switch over to memdup_user()
This patch fixes the following Coccinelle warning:

drivers/usb/gadget/inode.c:442:8-15: WARNING \
	opportunity for memdup_user

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi f3c7364982 usb: gadget: f_subset: switch over to PTR_RET
this patch fixes the following Coccinelle warning:

drivers/usb/gadget/f_subset.c:279:8-14: WARNING: \
	PTR_RET can be used

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Felipe Balbi ade79d13a8 usb: gadget: lpc32xx_udc: fix wrong clk_put() sequence
This patch fixes the following Coccinelle error:

drivers/usb/gadget/lpc32xx_udc.c:3313:1-7: ERROR: \
	missing clk_put; clk_get on line 3139 and \
	execution via conditional on line 3146

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17 16:05:31 -07:00
Takashi Iwai 5fdb83f190 ASoC: Updates for v3.15
Quite a busy release for ASoC this time, more on janitorial work than
 exciting new features but welcome nontheless:
 
  - Lots of cleanups from Takashi for enumerations; the original API for
    these was error prone so he's refactored lots of code to use more
    modern APIs which avoid issues.
  - Elimination of the ASoC level wrappers for I2C and SPI moving us
    closer to converting to regmap completely and avoiding some
    randconfig hassle.
  - Provide both manually and transparently locked DAPM APIs rather than
    a mix of the two fixing some concurrency issues.
  - Start converting CODEC drivers to use separate bus interface drivers
    rather than having them all in one file helping avoid dependency
    issues.
  - DPCM support for Intel Haswell and Bay Trail platforms.
  - Lots of work on improvements for simple-card, DaVinci and the Renesas
    rcar drivers.
  - New drivers for Analog Devices ADAU1977, TI PCM512x and parts of the
    CSR SiRF SoC.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTIOhJAAoJELSic+t+oim90CoP/3CVTm9cWv1qhPSU6jjn6RJG
 /djmhntJfHd/GXo+0TiiwNK9WmZjFrJUr+5ofkDTCqSzFz1Suc90B6oHxY4dFbgF
 IyIpTexGwTLv3H6yDjadYAfmGDSsE9sM2dkID9oXy6aEzjNby/a1VEiBnRgx16X1
 YGvMVK8AGFn/AyC/zOV6EcKJxUjdDogqZ5wkR2XHzwDoYjl9ufxK9BnSIygYABOW
 ABAjyrZf3xx97AH82BB6iqcZMh5GxGNTvI3hQd/vjx0r7RFUDNLqmF2cPZAMTRW/
 bXWxVmtNHie1+lCldyMFm8pV/Pv09zuqDAQKbPY2TeHj2zF8CM548NlkFHqwHlp0
 S9K5E1N+/2wcXMjQa1wBELohUdl6dVh1OFOAz7M8o0TJdSOZyR6PJ9r0NprP8NgS
 67FBU+ZqnWIK159m9rKkFfPhnaDuDzk+rpwyK0fQxQgpdGGjLyv7OK3GhS30oTnA
 Z2GjEyUySM1BcEEWAtfUD5fHbjN28e1Icn53q5q4JK4gvx4DXBy08uY/vumvjXjO
 8oum3q3RjRvqIhzMrJoVgs+c8RHwS/bZQhlu9Q3qNTsDNDyMnaZWHFAnP8RDqHjv
 ojZiMJkJdpqceZ3z1k5ZG8GWJ2JaZBikSbeNk2Ltg17/0nackq2r8ekrIoEUPVk2
 ph4DJNC2s1qCFtx7tzQj
 =C5oo
 -----END PGP SIGNATURE-----

Merge tag 'asoc-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next

ASoC: Updates for v3.15

Quite a busy release for ASoC this time, more on janitorial work than
exciting new features but welcome nontheless:

 - Lots of cleanups from Takashi for enumerations; the original API for
   these was error prone so he's refactored lots of code to use more
   modern APIs which avoid issues.
 - Elimination of the ASoC level wrappers for I2C and SPI moving us
   closer to converting to regmap completely and avoiding some
   randconfig hassle.
 - Provide both manually and transparently locked DAPM APIs rather than
   a mix of the two fixing some concurrency issues.
 - Start converting CODEC drivers to use separate bus interface drivers
   rather than having them all in one file helping avoid dependency
   issues.
 - DPCM support for Intel Haswell and Bay Trail platforms.
 - Lots of work on improvements for simple-card, DaVinci and the Renesas
   rcar drivers.
 - New drivers for Analog Devices ADAU1977, TI PCM512x and parts of the
   CSR SiRF SoC.
2014-03-13 09:53:25 +01:00
Greg Kroah-Hartman 7338a06593 usb: patches for v3.15
another substantial pull request with new features all over
 the place.
 
 dwc3 got a bit closer towards hibernation support with after
 a few patches re-factoring code to be reused for hibernation.
 Also in dwc3 two new workarounds for known silicon bugs have
 been implemented, some randconfig build errors have been fixed,
 and it was taught about the new generic phy layer.
 
 MUSB on AM335x now supports isochronous transfers thanks to
 George Cherian's work.
 
 The atmel_usba driver got two crash fixes: one when no endpoint
 was specified in DeviceTree data and another when stopping the UDC
 in DEBUG builds.
 
 Function FS got a much needed fix to ffs_epfile_io() which was
 copying too much data to userspace in some cases.
 
 The printer gadget got a fix for a possible deadlock and plugged
 a memory leak.
 
 Ethernet drivers now use NAPI for RX which gives improved throughput.
 
 Other than that, the usual miscelaneous fixes, cleanups, and
 the like.
 
 Signed-of-by: Felipe Balbi <balbi@ti.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTGmOyAAoJEIaOsuA1yqREVsQP/AjfOAuQJ7awaUVsJqBLGADW
 qmxc1rd+wKv7e9s4Jtu8z8PaZklAd4E3M8M378BsJIiMSbHZhb/KUFQPVgkp5Rnz
 Ps9k7k4P3+yoovWruR1YRk+/mx5ra//MdJ+FNMe6wa3Y57X7NRAfzSSQOOnmkJ5+
 3aSz2IRKXBmSqpcMZVTgn1j/YATfZxpCmrTPSOdgyIjeWs+8s1SjaEFsgCaVb4vH
 V1B3HsMPRCtrR0BV0f1FA1xp1pXdAU3UeRecuVibP5DDIKhMqB7N8BWTi2nu8c+1
 8wZ4S3BNJwBPmHU/XOkjLWnoZ6gZVIx2DEeCdh0hXF2lsbJYELCPptYEApDPyOvF
 zli6cCdPcM+bnWzmQyBXmu7uPVBOz3lv1HAkodOwhof1K556baZfXF+OpZ21+/oj
 l3I9Ebr86soVmxMzY1FyMN0F+klNCPTzmx4GS0GHJDCpMLvfX5rRVR0EXggIPGMC
 Lug/G8ySP0s+R1NTx+I6zJUV3BXkjp2KQmfjiMSzWzOAMSdaucRu4S71mgCvx1uN
 5T4tWAAtl90O/6V+d3Lx4PMOUiBXCv3ZboDKNdRXrX3/omd2JkOKqj4J8hxJ1F0w
 l6jb8IIXiO6xElC6fBQ7Dq54kD7cLzEnFBn5I4Fg5AjPatbHDEjerArL8I+Loe/u
 E+V2mp0qzoUxtqi5aMND
 =AAie
 -----END PGP SIGNATURE-----

Merge tag 'usb-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

Felipe writes:

usb: patches for v3.15

another substantial pull request with new features all over
the place.

dwc3 got a bit closer towards hibernation support with after
a few patches re-factoring code to be reused for hibernation.
Also in dwc3 two new workarounds for known silicon bugs have
been implemented, some randconfig build errors have been fixed,
and it was taught about the new generic phy layer.

MUSB on AM335x now supports isochronous transfers thanks to
George Cherian's work.

The atmel_usba driver got two crash fixes: one when no endpoint
was specified in DeviceTree data and another when stopping the UDC
in DEBUG builds.

Function FS got a much needed fix to ffs_epfile_io() which was
copying too much data to userspace in some cases.

The printer gadget got a fix for a possible deadlock and plugged
a memory leak.

Ethernet drivers now use NAPI for RX which gives improved throughput.

Other than that, the usual miscelaneous fixes, cleanups, and
the like.

Signed-of-by: Felipe Balbi <balbi@ti.com>
2014-03-07 16:47:36 -08:00
Chuansheng Liu cfe919b53b usb: gadget: return the right length in ffs_epfile_io()
When the request length is aligned to maxpacketsize, sometimes
the return length ret > the user space requested len.

At that time, we will use min_t(size_t, ret, len) to limit the
size in case of user data buffer overflow.

But we need return the min_t(size_t, ret, len) to tell the user
space rightly also.

[ balbi@ti.com: also fix comment's indentation ]

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Reviewed-by: David Cohen <david.a.cohen@linux.intel.com>
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-07 10:03:25 -06:00
Weinn Jheng 716fb91dfe usb: gadget: u_ether: move hardware transmit to RX NAPI
In order to reduce the interrupt times in the embedded system,
a receiving workqueue is introduced.
This modification also enhanced the overall throughput as the
benefits of reducing interrupt occurrence.

This work was derived from previous work:
u_ether: move hardware transmit to RX workqueue.
Which should be base on codeaurora's work.

However, the benchmark on my platform shows the throughput
with workqueue is slightly better than NAPI.

Signed-off-by: Weinn Jheng <clanlab.proj@gmail.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: Stephen Hemminger <shemminger@vyatta.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-07 10:03:24 -06:00
Michal Nazarewicz ac8dde11f2 usb: gadget: f_fs: Add flags to descriptors block
This reworks the way SuperSpeed descriptors are added and instead of
having a magic after full and high speed descriptors, it reworks the
whole descriptors block to include a flags field which lists which
descriptors are present and makes future extensions possible.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:11 -06:00
Manu Gautam 8d4e897bd0 usb: gadget: f_fs: Add support for SuperSpeed Mode
Allow userspace to pass SuperSpeed descriptors and
handle them in the driver accordingly.
This change doesn't modify existing desc_header and thereby
keeps the ABI changes backward compatible i.e. existing
userspace drivers compiled with old header (functionfs.h)
would continue to work with the updated kernel.

Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:10 -06:00
Gregory CLEMENT d8eb6c653e usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled
commit 511f3c5 (usb: gadget: udc-core: fix a regression during gadget driver
unbinding) introduced a crash when DEBUG is enabled.

The debug trace in the atmel_usba_stop function made the assumption that the
driver pointer passed in parameter was not NULL, but since the commit above,
such assumption was no longer always true.

This commit now uses the driver pointer stored in udc which fixes this
issue.

[ balbi@ti.com : improved commit log a bit ]

Cc: <stable@vger.kernel.org> # v3.2+
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:10 -06:00
Alexandre Belloni fb0e139d93 usb: gadget: atmel_usba: fix crash when no endpoint are specified
If no endpoints are present in the device tree, the kernel will crash with the
following error:

Unable to handle kernel paging request at virtual address 00101008
[...]
[<c0222ff4>] (composite_dev_prepare) from [<c022326c>] (composite_bind+0x5c/0x190)
[<c022326c>] (composite_bind) from [<c021ff8c>] (udc_bind_to_driver+0x48/0xf0)
[<c021ff8c>] (udc_bind_to_driver) from [<c02208e0>] (usb_gadget_probe_driver+0x7c/0xa0)
[<c02208e0>] (usb_gadget_probe_driver) from [<c0008970>] (do_one_initcall+0x94/0x140)
[<c0008970>] (do_one_initcall) from [<c04b4b50>] (kernel_init_freeable+0xec/0x1b4)
[<c04b4b50>] (kernel_init_freeable) from [<c0376cc4>] (kernel_init+0x8/0xe4)
[<c0376cc4>] (kernel_init) from [<c0009590>] (ret_from_fork+0x14/0x24)
Code: e5950014 e1a04001 e5902008 e3a010d0 (e5922008)
---[ end trace 35c74bdd89b373d0 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

This checks for that case and returns an error, not allowing the driver to be
loaded with no endpoints.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:10 -06:00
Marek Szyprowski b83e333a4d usb: gadget: s3c-hsotg: add proper suspend/resume support
This patch adds suspend/resume support to s3c-hsotg driver. It makes UDC
driver more power efficient.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:06 -06:00
Robert Baldyga 0e06bcac79 usb: gadget: at91_udc: fix ep maxpacket initialisation
This patch fixes problem with unnecessary usb_ep_set_maxpacket_limit() usage.
It should not be used in at91udc_probe() function, where maxpacket values are
set for field "maxpacket" of struct at91_ep, which is representation of
endpoint in driver internals. Function usb_ep_set_maxpacket_limit() is called
in udc_reinit() function, where struct usb_ep instances are initialised with
values set previously in struct at91_ep instances. So it's very important to
initialise it properly.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:49 -06:00
Peter Hurley a9c3f68f3c tty: Fix low_latency BUG
The user-settable knob, low_latency, has been the source of
several BUG reports which stem from flush_to_ldisc() running
in interrupt context. Since 3.12, which added several sleeping
locks (termios_rwsem and buf->lock) to the input processing path,
the frequency of these BUG reports has increased.

Note that changes in 3.12 did not introduce this regression;
sleeping locks were first added to the input processing path
with the removal of the BKL from N_TTY in commit
a88a69c912,
'n_tty: Fix loss of echoed characters and remove bkl from n_tty'
and later in commit 38db89799b,
'tty: throttling race fix'. Since those changes, executing
flush_to_ldisc() in interrupt_context (ie, low_latency set), is unsafe.

However, since most devices do not validate if the low_latency
setting is appropriate for the context (process or interrupt) in
which they receive data, some reports are due to misconfiguration.
Further, serial dma devices for which dma fails, resort to
interrupt receiving as a backup without resetting low_latency.

Historically, low_latency was used to force wake-up the reading
process rather than wait for the next scheduler tick. The
effect was to trim multiple milliseconds of latency from
when the process would receive new data.

Recent tests [1] have shown that the reading process now receives
data with only 10's of microseconds latency without low_latency set.

Remove the low_latency rx steering from tty_flip_buffer_push();
however, leave the knob as an optional hint to drivers that can
tune their rx fifos and such like. Cleanup stale code comments
regarding low_latency.

[1] https://lkml.org/lkml/2014/2/20/434

"Yay.. thats an annoying historical pain in the butt gone."
	-- Alan Cox

Reported-by: Beat Bolli <bbolli@ewanet.ch>
Reported-by: Pavel Roskin <proski@gnu.org>
Acked-by: David Sterba <dsterba@suse.cz>
Cc: Grant Edwards <grant.b.edwards@gmail.com>
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: Hal Murray <murray+fedora@ip-64-139-1-69.sjc.megapath.net>
Cc: <stable@vger.kernel.org> # 3.12.x+
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-28 16:31:00 -08:00
David Howells 74c4137b2a ARM: 7989/1: Delete asm/system.h
Delete ARM's asm/system.h.  It's the last holdout and should be got rid of.

This builds for defconfig, lpc32xx_defconfig, exynos_defconfig + XEN, the
previous changed to a Gemini system and an omap3 config with TI_DAVINCI_EMAC.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2014-02-25 11:33:37 +00:00
Greg Kroah-Hartman 3c701651c8 Merge 3.14-rc4 into usb-next
We want the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-24 15:59:22 -08:00
Andrzej Pietrasiewicz f0f42204d0 usb: gadget: fix NULL pointer dereference
Fix possible NULL pointer dereference introduced in
commit 219580e (usb: f_fs: check quirk to pad epout
buf size when not aligned to maxpacketsize)

In cases we do wait with:

wait_event_interruptible(epfile->wait, (ep = epfile->ep));

for endpoint to be enabled, functionfs_bind() has not been called yet
and epfile->ffs->gadget is still NULL and the automatic variable 'gadget'
has been initialized with NULL at the point of its definition.
Later on it is used as a parameter to:

usb_ep_align_maybe(gadget, ep->ep, len)

which in turn dereferences it.

This patch fixes it by moving the actual assignment to the local 'gadget'
variable after the potential waiting has completed.

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:17:23 -06:00
Peter Chen 8679059e36 usb: gadget: printer: using gadget_is_otg to check otg support at runtime
We need to use gadget_is_otg to check if the gadget is really
otg support at runtime, other composite gadget drivers have already
followed this method.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:17:22 -06:00
Dan Carpenter 798a2468e0 usb: gadget: gr_udc: remove some unneeded error handling
Debugfs function return an ERR_PTR if they compiled out.  We don't need
to test for that here because if the debugfs file are compiled out then
it is ok to pass an ERR_PTR to debugfs_create_file() since it will just
be a no-op stub.

Debugfs return NULLs on error, but we don't need to test for that either
because debugfs_create_file() will accept NULL pointers.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:16:17 -06:00
Bo Shen 3fcba0d87b usb: gadget: at91: using USBA_NR_DMAS for DMA channels
The SoCs earlier than sama5d3, they have the same number endpoints
and DMA channels. In driver code, they use the same definition
USBA_NR_ENDPOINTS for both endpoints and dma channels. However,
in sama5d3, it has different number for endpoints and DMA channels.
So, define a new macro USBA_NR_DMAs for DMA channels. And the
USBA_NR_ENDPOINS is not used anymore, remove it at the same time.

Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-19 13:47:12 -06:00
Bo Shen aa7be0f8f7 usb: gadget: at91: fix the number of endpoint parameter
In sama5d3 SoC, there are 16 endpoints, which is different with
earlier SoCs (only have 7 endpoints). The USBA_NR_ENDPOINTS macro
is not suitable for sama5d3. So, get the endpoints number through
the udc->num_ep, which get from platform data for non-dt kernel,
or parse from dt node.

Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-19 13:46:48 -06:00
Robert Baldyga 2e4c7553cd usb: gadget: f_fs: add aio support
This patch adds asynchronous I/O support for FunctionFS endpoint files.
It adds ffs_epfile_aio_write() and ffs_epfile_aio_read() functions responsible
for preparing AIO operations.

It also modifies ffs_epfile_io() function, adding aio handling code. Instead
of extending list of parameters of this function, there is new struct
ffs_io_data which contains all information needed to perform I/O operation.
Pointer to this struct replaces "buf" and "len" parameters of ffs_epfile_io()
function. Allocated buffer is freed immediately only after sync operation,
because in async IO it's freed in complete funcion. For each async operation
an USB request is allocated, because it allows to have more than one request
queued on single endpoint.

According to changes in ffs_epfile_io() function, functions ffs_epfile_write()
and ffs_epfile_read() are updated to use new API.

For asynchronous I/O operations there is new request complete function named
ffs_epfile_async_io_complete(), which completes AIO operation, and frees
used memory.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:02 -06:00
Robert Baldyga 23de91e970 usb: gadget: f_fs: add poll for endpoint 0
This patch adds poll function for file representing ep0.

Ability of read from or write to ep0 file is related with actual state of ffs:
- When desctiptors or strings are not written yet, POLLOUT flag is set.
- If there is any event to read, POLLIN flag is set.
- If setup request was read, POLLIN and POLLOUT flag is set, to allow
  send response (by performing I/O operation consistent with setup request
  direction) or set stall (by performing I/O operation opposite  setup
  request direction).

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Robert Baldyga 0a7b1f8a70 usb: gadget: f_fs: fix setup request handling
This patch fixes __ffs_ep0_queue_wait() function, which now returns number of
bytes transferred in USB request or error code in case of failure. This is
needed by ffs_ep0_read() function, when read data is copied to userspace.

It also cleans up code by removing usused variable ep0req_status.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Michal Nazarewicz a7ecf0544f usb: gadget: functionfs: replace FFS_SETUP_STATUS with an inline function
The FFS_SETUP_STATUS macro could be trivialy replaced with an static
inline function but more importantly its name was tad confusing.
The name suggested it was a simple accessor macro but it actually
did change the state of the ffs_data structure perfomring
a FFS_SETUP_CANCELLED -> FFS_NO_SETUP transition.  The name of the
function -- ffs_setup_state_clear_cancelled -- should better
describe what the function actually does.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Michal Nazarewicz e46318a000 usb: gadget: functionfs: fix typo in the enum variable
Since “cancelled” is spelled with two “l”s, rename FFS_SETUP_CANCELED
to FFS_SETUP_CANCELLED.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Andrzej Pietrasiewicz da13a7738e usb: gadget: FunctionFS: use consistent naming with regard to ffs_lock
Consistently prefix function name with underscore if the function has to
be called with ffs_lock taken.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz 10b69ce08c usb: gadget: FunctionFS: staticize functions used only in f_fs.c
ffs_alloc_dev and ffs_free_dev are used only in f_fs.c,
so make them static.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz ab13cb0c0d usb: gadget: code cleanup
Remove trailing whitespace

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Andrzej Pietrasiewicz ea365922f9 usb: gadget: FunctionFS: dereference ffs_dev conditionally
ffs_dev->ffs_release_dev_callback should be accessed only if ffs_dev
is not NULL.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Robert Baldyga c9f721b2f3 usb: gadget: s3c-hsotg: stall ep0 in set_halt function
When s3c_hsotg_ep_sethalt() function is called for ep0 it should be stalled
in the same way that it is in s3c_hsotg_process_control() function, because
SET_HALT for ep0 is delayed response for setup request. Endpoint 0, if
halted, it doesn't need CLEAR_HALT because it clears "stalled" state
automatically when next setup request is received.

For this reason this patch moves code setting ep0 to "stalled" state to new
function named s3c_hsotg_stall_ep0() which is called in
s3c_hsotg_process_control() function as an immediate response for setup
request, and in s3c_hsotg_ep_sethalt() function as a delayed response for
setup request.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
wenlin.kang 7e98f60003 usb: gadget: printer: fix memory leak
When read data from g_printer, we see a Segmentation fault. eg:

Unable to handle kernel paging request at virtual address bf048000 pgd
= cf038000 [bf048000] *pgd=8e8cf811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT ARM Modules linked in: bluetooth
rfcomm g_printer
CPU: 0    Not tainted  (3.4.43-WR5.0.1.9_standard #1)
PC is at __copy_to_user_std+0x310/0x3a8 LR is at 0x4c808010
pc : [<c036e990>]    lr : [<4c808010>]    psr: 20000013
sp : cf883ea8  ip : 80801018  fp : cf883f24
r10: bf04706c  r9 : 18a21205  r8 : 21953888
r7 : 201588aa  r6 : 5109aa16  r5 : 0705aaa2  r4 : 5140aa8a
r3 : 0000004c  r2 : 00000fdc  r1 : bf048000  r0 : bef5fc3c
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 8f038019  DAC: 00000015 Process
g_printer_test. (pid: 661, stack limit = 0xcf8822e8)
Stack: (0xcf883ea8 to 0xcf884000)
3ea0:                   bf047068 00001fff bef5ecb9 cf882000 00001fff bef5ecb9
3ec0: 00001fff 00000000 cf2e8724 bf044d3c 80000013 80000013 00000001
bf04706c
3ee0: cf883f24 cf883ef0 c012e5ac c0324388 c007c8ac c0046298 00008180
cf29b900
3f00: 00002000 bef5ecb8 cf883f68 00000003 cf882000 cf29b900 cf883f54
cf883f28
3f20: c012ea08 bf044b0c c000eb88 00000000 cf883f7c 00000000 00000000
00002000
3f40: bef5ecb8 00000003 cf883fa4 cf883f58 c012eae8 c012e960 00000001
bef60cb8
3f60: 000000a8 c000eb88 00000000 00000000 cf883fa4 00000000 c014329c
00000000
3f80: 000000d4 41af63f0 00000003 c000eb88 cf882000 00000000 00000000
cf883fa8
3fa0: c000e920 c012eaa4 00000000 000000d4 00000003 bef5ecb8 00002000
bef5ecb8
3fc0: 00000000 000000d4 41af63f0 00000003 b6f534c0 00000000 419f9000
00000000
3fe0: 00000000 bef5ecac 000086d9 41a986bc 60000010 00000003 0109608a
0088828a
Code: f5d1f07c e8b100f0 e1a03c2e e2522020 (e8b15300) ---[ end trace
97e2618e250e3377 ]--- Segmentation fault

The root cause is the dev->rx_buffers list has been broken.
When we call printer_read(), the following call tree is triggered:

printer_read()
	|
	+---setup_rx_reqs(req)
	|	|
	|	+---usb_ep_queue(req)
	|	|	|
	|	|	+---...
	|	|		|
	|	|		+---rx_complete(req).
	|	|
	|	+---add the req to dev->rx_reqs_active
	|
	+---while(!list_empty(&dev->rx_buffers)))

The route happens when we don't use DMA or fail to start DMA in USB
driver. We can see: in the case, in rx_complete() it will add the req
to dev->rx_buffers. meanwhile we see that we will also add the req to
dev->rx_reqs_active after usb_ep_queue() return, so this adding will
break the dev->rx_buffers out.

After, when we call list_empty() to check dev->rx_buffers in while(),
due to can't check correctly dev->rx_buffers, so the Segmentation fault
occurs when copy_to_user() is called.

Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00