This patch fixes the below array index out of bounds issue.
Buffer overflow, array index of 'aInfo' may be out of
bounds. Array 'aInfo' of size 78 may use index value(s) 6..84
The data stored in 'aInfo' array exceeds the array size of 78.
This patch increases the size of this array to hold the string
correctly without any memory corruption.
This issue was reported by Klockwork tool.
Signed-off-by: Maulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch fixes the following NULL pointer dereference issue.
Pointer 'request' returned from call to function 'next_request'
at line 748 may be NULL and may be dereferenced at line 792.
============
Code Snippet
============
748: request = next_request(musb_ep);
785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
csr &= ~(MUSB_RXCSR_AUTOCLEAR
| MUSB_RXCSR_DMAENAB
| MUSB_RXCSR_DMAMODE);
musb_writew(epio, MUSB_RXCSR,
MUSB_RXCSR_P_WZC_BITS | csr);
792: request->actual += musb_ep->dma->actual_len;
Signed-off-by: Maulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Since a DMA transfer may need to be kicked off several times to complete,
the DMA start must include the length that has already been transferred.
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Gadget stalling a zero-length SETUP request results in this error message:
SetupEnd came in a wrong ep0stage idle
In order to avoid it, always set the CSR0.DataEnd bit after detecting a zero-
length request. Add the missing '\n' to the error message itself as well...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Race condition exists between the cppi_interrupt handler and
davinci_interrupt handler w.r.t completing a TX IO. Since DM646x
has seperate DMA and USB endpoint interrupts cppi_interrupt handler
needs to hold the lock while operating on the endpoint.
Update over previous patch to avoid taking the lock if already
taken. Tested on DM644x, DM355 and DM646x platforms.
Signed-off-by: Swaminathan S <swami.iyer@ti.com>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On OTG and gadget-only configurations, we need a gadget driver
in order to work properly, so avoid changing operation modes
when there's no gadget driver loaded.
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When registering gadget driver, the state of the transceiver
must be set from undefined (no gadget) to b_idle.
Module unload sets the transceiver state to undefined state.
After the first load/unload pair, the reset irq will be lost.
Signed-off-by: Arnaud Mandy <ext-arnaud.2.mandy@nokia.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes a null-pointer dereference bug.
Signed-off-by: Swaminathan S <swami.iyer@ti.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Current musb gadget dma code produces the warning:
drivers/usb/musb/musb_gadget.c: In function 'txstate':
drivers/usb/musb/musb_gadget.c:312: warning: comparison of distinct
pointer types lacks a cast
So switch to min_t(size_t, ...).
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
probe() already was on __init, so moving remove() to __exit.
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit 7723de7e19 (USB: musb_gadget: remove
pointless loop) included uncalled for (and incorrect) optimization that
might cause a kernel oops in txstate() -- undo it.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix the following sparse warning:
drivers/usb/musb/musb_host.c:1642:9: warning: symbol 'status' shadows an earlier one
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix the following sparse warnings:
drivers/usb/musb/musb_gadget.c:1161:5: warning: symbol 'musb_gadget_set_halt' was not declared. Should it be static?
drivers/usb/musb/musb_gadget.c:1244:5: warning: symbol 'musb_gadget_set_wedge' was not declared. Should it be static?
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix the following sparse warning:
drivers/usb/musb/omap2430.c:314:16: warning: Using plain integer as NULL pointer
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Remove the pointless 'do () while (0)' loop from musb_g_tx() -- it
makes this function symmetric to musb_g_rx()...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Stop playing with musb->lock and abusing musb_gadget_set_halt() in
the code clearing the endpoint halt feature -- instead, manipulate
the registers directly.
While at it, get rid uf unneeded line breaks and over-indentation in
the code setting the endpoint halt feature.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Implement the driver's set_wedge() method by adding the 'wedged' flag
to the 'struct musb_ep'.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit a5073b5283 (musb_gadget: fix
unhandled endpoint 0 IRQs) somehow missed its key change:
"The gadget EP0 code routinely ignores an interrupt at end of
the data phase because of musb_g_ep0_giveback() resetting the
state machine to "idle, waiting for SETUP" phase prematurely."
So, the majority of the cases of unhandled IRQs is still unfixed...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
MUSB: save hardware revision at init
This can be used later to flag workarounds for issues affecting
particular revisions. Saving this at init avoids having to
read the HWVERS register multiple times in code.
While at it, use macros to extract the version information
instead of using hardcoded values.
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Cc: Ajay Kumar Gupta <ajay.gupta@ti.com>
Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The debug code in the DMA ISR uses a %d for a size_t when it should be
using %zu. Otherwise gcc whines with:
drivers/usb/musb/musbhsdma.c: In function 'dma_controller_irq':
drivers/usb/musb/musbhsdma.c:288: warning: format '%d' expects type 'int',
but argument 7 has type 'size_t'
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Otherwise we get the link failure:
drivers/built-in.o: In function 'musb_platform_init':
drivers/usb/musb/blackfin.c:300: undefined reference to 'usb_nop_xceiv_register'
make: *** [.tmp_vmlinux1] Error 1
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Since we can't work around anomaly 05000380, throw a build error up and
instruct the user to use a different mode.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
If we clear the interrupt pending bits at the end, we sometimes return too
fast and have the same interrupt assert itself. There is no way in a
Blackfin system to force a sync of this state, so the hardware manual
instructs people to clear interrupt flags early in their ISR.
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Only allow USE_MODE1 when the Blackfin part is not affected by anomaly
05000456 (USB Receive Interrupt Is Not Generated in DMA Mode 1) since we
can't support the mode in that case.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Add some helpful notes about how the driver works around different
anomalies that exist in the on-chip host controller.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Do not allow MUSB driver to be selected on derivatives that don't have the
MUSB controller on them.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The Blackfin version of musb_read_target_reg_base() returns a u16 when the
common code expects a (void __iomem *), so update the Blackfin function to
return the right value. This fixes the compile warning:
drivers/usb/musb/musb_core.c: In function 'musb_core_init':
drivers/usb/musb/musb_core.c:1448: warning: assignment makes pointer from
integer without a cast
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Otherwise gcc will whine about epnum/dma_reg being unused when building
for BF54x parts.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On tx channel abort a cppi interrupt is generated for a short time by
setting the lowest bit of the TCPPICOMPPTR register. It is then reset
immediately by clearing the bit. When the interrupt handler is run,
it does not detect an interrupt in the TCPPIMSKSR or RCPPIMSKSR
registers and thus exits early without writing the TCPPIEOIR register.
It appears that this inhibits further cppi interrupts until the handler
is called by chance, f.ex. from davinci_interrupt().
By moving the unmasking of the interrupt below the writes to
TCPPICOMPPTR, no interrupt is generated and no write to TCPPIEOIR is
necessary.
Signed-off-by: Daniel Glöckner <dg@emlix.com>
Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
In gadget mode the answer to a control request should be followed by
a zero-length packet if the amount transferred is an exact multiple of
the endpoint's packet size and the requests has its "zero" flag set.
This patch prevents the request from being immediately removed from the
queue when a control IN transfer ends on a full packet and "zero" is set.
The next time ep0_txstate is entered, a zero-length packet is queued and
the request is removed as fifo_count is 0.
Signed-off-by: Daniel Glöckner <dg@emlix.com>
Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Isochronous Tx DMA is getting programmed but never getting started
for CPPI and TUSB DMAs and thus Isochronous Tx doesn't work.
Fixing it by starting DMAs using musb_h_tx_dma_start().
Signed-off-by: Swaminathan S <swami.iyer@ti.com>
Signed-off-by: Babu Ravi <ravibabu@ti.com>
Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The driver incorrectly cancels the mass-storage device CSW request
(which leads to device reset) due to giving back URB at the head of
endpoint's queue after sending each STALL handshake; stop doing that
and start checking for the queue being non-empty before stalling an
endpoint and disallowing stall in such case in musb_gadget_set_halt()
like the other gadget drivers do.
Moreover, the driver starts Rx request despite of the endpoint being
halted -- fix this by moving the SendStall bit check from musb_g_rx()
to rxstate(). And we also sometimes get into rxstate() with DMA still
active after clearing an endpoint's halt (not clear why), so bail out
in this case, similarly to what txstate() does...
While at it, also do the following changes :
- in musb_gadget_set_halt(), remove pointless Tx FIFO flushing (the
driver does not allow stalling with non-empty Tx FIFO anyway);
- in rxstate(), stop pointlessly zeroing the 'csr' variable;
- in musb_gadget_set_halt(), move the 'done' label to a more proper
place;
- in musb_g_rx(), eliminate the 'done' label completely...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Move the remaining headers under plat-omap/include/mach
to plat-omap/include/plat. Also search and replace the
files using these headers to include using the right path.
This was done with:
#!/bin/bash
mach_dir_old="arch/arm/plat-omap/include/mach"
plat_dir_new="arch/arm/plat-omap/include/plat"
headers=$(cd $mach_dir_old && ls *.h)
omap_dirs="arch/arm/*omap*/ \
drivers/video/omap \
sound/soc/omap"
other_files="drivers/leds/leds-ams-delta.c \
drivers/mfd/menelaus.c \
drivers/mfd/twl4030-core.c \
drivers/mtd/nand/ams-delta.c"
for header in $headers; do
old="#include <mach\/$header"
new="#include <plat\/$header"
for dir in $omap_dirs; do
find $dir -type f -name \*.[chS] | \
xargs sed -i "s/$old/$new/"
done
find drivers/ -type f -name \*omap*.[chS] | \
xargs sed -i "s/$old/$new/"
for file in $other_files; do
sed -i "s/$old/$new/" $file
done
done
for header in $(ls $mach_dir_old/*.h); do
git mv $header $plat_dir_new/
done
Signed-off-by: Tony Lindgren <tony@atomide.com>
The MUSB code relies on platform implementations that currently only
exists for Arm and Blackfin processors, so have the MUSB Kconfig depend
upon those arches.
This should prevent other arches from building MUSB via randconfig.
Reported-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The Blackfin port doesn't support HAVE_CLK and the musb driver works fine
with support stubbed out, so take the existing Blackfin clk stubs and move
them to common musb code so we can drop the Kconfig dependency.
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Invoke put_device(musb->xceiv->dev) before musb_platform_exit()as
xceiv is getting unregistered in musb_platform_exit().
Fixes put_device() panic when module insert/removal is performed
multiple times.
Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
OMAP3EVM uses ISP1504 phy which doesn't require any programming and
thus has to use NOP otg transceiver.
Cleanups being done:
- Remove unwanted code in usb-musb.c file
- Register NOP in OMAP3EVM board file using
usb_nop_xceiv_register().
- Select NOP_USB_XCEIV for OMAP3EVM boards.
- Don't enable TWL4030_USB in omap3_evm_defconfig
Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: Eino-Ville Talvala <talvala@stanford.edu>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
INDEX register has to be set to '0' before reading
CONFIGDATA register which is only present in TI musb
platforms.
Currently the default register access mode is set to
FLAT_MODE thus INDEX register is not getting set
properly with musb_ep_select() which is just a nop
operation in FLAT_MODE.This invalid register read is
causing module reinset failure.
Fixing the issue by moving INDEX register write part to
musb_read_configdata() function itself.
Signed-off-by: Vikram Pandita <vikram.pandita@ti.com>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
musb_otg_timer_func() is defined under #ifdef CONFIG_USB_MUSB_OTG.
Make sure any reference to it is also under the same #ifdef.
Without this fix, the driver failes to compile when USB_OTG is defined
but USB_MUSB_OTG isn't.
Signed-off-by: Amit Kucheria <amit.kucheria@canonical.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This function uses wrong bit mask to prevent clearing RXCSR status
bits when halting an endpoint -- which results in clearing SentStall
and RxPktRdy bits (that the code actually tries to avoid); must be
a result of cut-and-paste...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch reworks platform driver power management code
for musb from legacy callbacks to dev_pm_ops.
The callbacks are converted for CONFIG_SUSPEND like this:
suspend() -> suspend()
resume_early() -> resume_noirq()
Signed-off-by: Magnus Damm <damm@igel.co.jp>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Commit c9cd06b3d6 (musb_host: refactor
URB giveback) included due to my overlook the change incorrect in the
context of the current kernel -- undo it.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
