| Age | Commit message (Collapse) | Author |
|---|
|
When report count is more than one and report size is not 4 bytes, then we
need some packing into result buffer from the caller of function
sensor_hub_get_feature.
By default the value extracted from a field is 4 bytes from hid core
(using hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT)), even
if report size if less than 4 byte. So when we copy data to user buffer in
sensor_hub_get_feature, we need to only copy report size bytes even
when report count is more than 1. This is
not an issue for most of the sensor hub fields as report count will be 1
where we already copy only report size bytes, but some string fields
like description, it is a problem as the report count will be more than 1.
For example:
Field(6)
Physical(Sensor.OtherCustom)
Application(Sensor.Sensor)
Usage(11)
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Sensor.0306
Report Size(16)
Report Count(11)
Here since the report size is 2 bytes, we will have 2 additional bytes of
0s copied into user buffer, if we directly copy to user buffer from
report->field[]->value
This change will copy report size bytes into the buffer of caller for each
usage report->field[]->value. So for example without this change, the
data displayed for a custom sensor field "sensor-model":
76 00 101 00 110 00 111 00 118 00 111
(truncated to report count of 11)
With change
76 101 110 111 118 111 32 89 111 103 97
("Lenovo Yoga" in ASCII )
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
We used to use generic implementation of dma_map_ops.mmap which is
dma_common_mmap() but that only worked for simpler cached mappings when
vaddr = paddr.
If a driver requests uncached DMA buffer kernel maps it to virtual
address so that MMU gets involved and page uncached status takes into
account. In that case usage of dma_common_mmap() lead to mapping of
vaddr to vaddr for user-space which is obviously wrong. For more detals
please refer to verbose explanation here [1].
So here we implement our own version of mmap() which always deals
with dma_addr and maps underlying memory to user-space properly
(note that DMA buffer mapped to user-space is always uncached
because there's no way to properly manage cache from user-space).
[1] https://lkml.org/lkml/2016/10/26/973
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: <stable@vger.kernel.org> #4.5+
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
|
|
RFC 2734 defines the datagram_size field in fragment encapsulation
headers thus:
datagram_size: The encoded size of the entire IP datagram. The
value of datagram_size [...] SHALL be one less than the value of
Total Length in the datagram's IP header (see STD 5, RFC 791).
Accordingly, the eth1394 driver of Linux 2.6.36 and older set and got
this field with a -/+1 offset:
ether1394_tx() /* transmit */
ether1394_encapsulate_prep()
hdr->ff.dg_size = dg_size - 1;
ether1394_data_handler() /* receive */
if (hdr->common.lf == ETH1394_HDR_LF_FF)
dg_size = hdr->ff.dg_size + 1;
else
dg_size = hdr->sf.dg_size + 1;
Likewise, I observe OS X 10.4 and Windows XP Pro SP3 to transmit 1500
byte sized datagrams in fragments with datagram_size=1499 if link
fragmentation is required.
Only firewire-net sets and gets datagram_size without this offset. The
result is lacking interoperability of firewire-net with OS X, Windows
XP, and presumably Linux' eth1394. (I did not test with the latter.)
For example, FTP data transfers to a Linux firewire-net box with max_rec
smaller than the 1500 bytes MTU
- from OS X fail entirely,
- from Win XP start out with a bunch of fragmented datagrams which
time out, then continue with unfragmented datagrams because Win XP
temporarily reduces the MTU to 576 bytes.
So let's fix firewire-net's datagram_size accessors.
Note that firewire-net thereby loses interoperability with unpatched
firewire-net, but only if link fragmentation is employed. (This happens
with large broadcast datagrams, and with large datagrams on several
FireWire CardBus cards with smaller max_rec than equivalent PCI cards,
and it can be worked around by setting a small enough MTU.)
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
|
|
The IP-over-1394 driver firewire-net lacked input validation when
handling incoming fragmented datagrams. A maliciously formed fragment
with a respectively large datagram_offset would cause a memcpy past the
datagram buffer.
So, drop any packets carrying a fragment with offset + length larger
than datagram_size.
In addition, ensure that
- GASP header, unfragmented encapsulation header, or fragment
encapsulation header actually exists before we access it,
- the encapsulated datagram or fragment is of nonzero size.
Reported-by: Eyal Itkin <eyal.itkin@gmail.com>
Reviewed-by: Eyal Itkin <eyal.itkin@gmail.com>
Fixes: CVE 2016-8633
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
|
|
The CLCD does not come up on Versatile Express as it does not
(currently) have a syscon node for controlling the block apart
from the CLCD itself. Make sure the .init() function can bail
out without an error making it probe again.
Reported-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: Amit Pundir <amit.pundir@linaro.org>
Tested-by: Nicolae Rosia <nicolae_rosia@mentor.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
|
|
Intel's BXT devices need to execute a _DSM method
during {runtime_,}{suspend,resume} in order to get a
chunk of dwc3 to power gate and save some extra
power.
Let's do that now.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
We'll be tracking a little more information for PCI
drivers, it's about time we add a private structure
for that.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
When we get a half-way processed request, we should
make sure to try to prepare further TRBs for it or
for any possibly queued up request held in our
pending_list. This will make sure our controller is
kept busy for as long as possible.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Say we have three requests prepared to the HW (reqA,
reqB, and reqC). All of them are composed of
SG-lists with several entries and they all requests
interrupt only on last TRBs of the SG-list.
When we get interrupt for reqA, it could be that
reqB is already half-way transferred and some of its
TRBs will have HWO already cleared.
It's okay to free up TRBs without HWO bit set, but
we need to guarantee we don't giveback a request
that's half-way transferred as that will confuse
gadget drivers.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
In cases where we're given an SG-list which is
longer than the amount of currently available TRBs,
we will be left with the same request on
started_list and we should prioritize that request
over possible new requests on pending_list. That's
a way to guarantee requests complete in order.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
This will give us a simpler way of figuring out how
many bytes were left in each TRB. It's useful for
cases where we queue only part of an SG-list due to
amount of available TRBs at the time of kicking the
transfer.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
If XferNotReady comes before usb_ep_queue() we will
set our PENDING request flag and wait for a
request. However, originally, we were assuming
usb_ep_queue() would always happen before our first
XferNotReady and that causes a corner case where we
could try to issue ENDTRANSFER command before
STARTTRANSFER.
Let's fix that by tracking endpoints which have been
started.
Reported-by: Janusz Dziedzic <januszx.dziedzic@intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Instead of just delaying for 100us, we should
actually wait for End Transfer Command Complete
interrupt before moving on. Note that this should
only be done if we're dealing with one of the core
revisions that actually require the interrupt before
moving on.
[ felipe.balbi@linux.intel.com: minor improvements ]
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
dev_kfree_skb_any() is used to free packets that are dropped by the
network stack. Therefore the function should not be used for packets
that have been successfully processed by the network stack. Instead
dev_consume_skb_any() has to be used for such consumed packets.
This separation helps to identify dropped packets.
Signed-off-by: Torsten Polle <tpolle@de.adit-jv.com>
Signed-off-by: Harish Jenny K N <harish_kandiga@mentor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Socket buffers should be linked to the (network) device that allocated
the buffers. __netdev_alloc_skb performs this task.
Signed-off-by: Torsten Polle <tpolle@de.adit-jv.com>
Signed-off-by: Jim Baxter <jim_baxter@mentor.com>
Signed-off-by: Harish Jenny K N <harish_kandiga@mentor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Socket buffers should be linked to the (network) device that allocated
the buffers.
Signed-off-by: Torsten Polle <tpolle@de.adit-jv.com>
Signed-off-by: Harish Jenny K N <harish_kandiga@mentor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
There is only one waiter for the completion, therefore there
is no need to use complete_all(). Let's make that clear by
using complete() instead of complete_all().
The usage pattern of the completion is:
waiter context waker context
reinit_completion()
usb_esp_queue()
wait_for_completion_interruptible()
ffs_ep0_complete()
complete()
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Michal Nazarewicz <mina86@mina86.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
The combo of list_empty() check and return list_first_entry()
can be replaced with list_first_entry_or_null().
Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
The combo of list_empty() check and return list_first_entry()
can be replaced with list_first_entry_or_null().
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
The combo of list_empty() check and return list_first_entry()
can be replaced with list_first_entry_or_null().
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Use the more common logging mechanism.
Miscellanea:
o Realign multiline statements
o Coalesce format
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Let's not reimplement generic kernel helpers,
instead call kasprintf().
[ felipe.balbi@linux.intel.com: better commit log ]
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
When we change the USB function with configfs dynamically, we possibly
met this situation: one core is doing the control transfer, another core
is trying to unregister the USB gadget from userspace, we must wait for
completing this control tranfer, or it will hang the controller to set
the DEVCTRLHLT flag.
[ felipe.balbi@linux.intel.com: several fixes to the patch
- call complete() before starting following SETUP transfer
- add a macro for ep0_in_setup's timeout
- change commit subject slightly
- break lines at 72 characters (git adds an 8-character tab)
- avoid changes to dwc3_gadget_run_stop() ]
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
That function is unnecessarily called from
dwc3_gadget_reset_interrupt(). Gadget drivers (and
thus, functions) are required to dequeue all pending
requests when they get notified about a USB Bus
Reset.
Trying to make sure there are no pending requests
only serves the purpose of working around possibly
bad gadgets.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
This helper will be responsible for reading and
parsing our properties. No functional changes in
this patch, cleanup only.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Kernel will give us page aligned memory anyway.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
This little helper will be used to setup anything
related to GCTL register. There are no functional
changes, this is a cleanup only patch.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
This little helper will be used to make sure we're
dealing with a valid Synopsys DWC3 or DWC3.1 core.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
For the usb31 IP and from version 2.90a of the usb3 IP, the core
supports HW exit from L1 in HS. Enable it, otherwise the controller may
never exit from LPM to do a transfer.
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Member @mem in struct dwc3 is not used in any places. Clean up it.
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
We should never kill the machine just because some
USB endpoint type is wrong. WARN about it and move
on.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
We don't need to know about short packets unless
gadget driver told us it's not ok to see them on the
bus. In the normal situation we can continue
processing the list of requests if we get a Short
packet.
Also, note that we're making sure ISP is only set
for OUT endpoints, where that setting is valid.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
CSP bit is only valid for OUT endpoints. Synopsys
databook is unclear if HW ignores CSP for IN
endpoints (chances are, it does) but to avoid
problems, let's make sure to set CSP only when valid
to do so.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Recent changes have turned this field obsolete. Remove it.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
By extracting smaller functions from
dwc3_ep0_handle_feature(), it becomes far easier to
understand what's going on. Cleanup only, no
functional changes.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Cleanup only, no functional changes.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Cleanup only, no functional changes.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
We want to reduce the usage of dwc3_trace() in favor
of proper tracepoints which can be enabled/disabled
by the user. Let's start with our register
accessors.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
We shouldn't have any glue layer which doesn't
compile everywhere. In order to make sure this is
always the case, make sure COMPILE_TEST is properly
added at dependency list of a config entry.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
We don't need dwc3_trace() unless we're building a
kernel with CONFIG_FTRACE. This patch reduces
dwc3.ko text size a bit while also removing overhead
of dwc3_trace() calls.
text data bss dec hex filename
50796 581 0 51377 c8b1 drivers/usb/dwc3/dwc3.o
43961 581 0 44542 adfe drivers/usb/dwc3/dwc3.o.patched
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
We can offset the latency of a full Start Transfer
command - where we _must_ poll for its completion -
to usb_ep_enable() time. This means that once
requests start showing up from the gadget driver, we
can rely on No Response Update Transfer command -
where we don't need to poll for completion.
This patch, starts implementing this method for Bulk
endpoints, even though, technically, we could extend
it to all other endpoints in future commits.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
In case of periodic transfers, let's pretty print
the size field as a multiplier followed by length,
such as :
3x 1024
instead of:
33555456
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Cc: Li Yang <leoli@freescale.com>
Cc: <linuxppc-dev@lists.ozlabs.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Cc: Valentina Manea <valentina.manea.m@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: <linux-usb@vger.kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
|
Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: <linux-usb@vger.kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
