Merge tag 'usb-4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
authorLinus Torvalds <torvalds@linux-foundation.org>
Sat, 11 Mar 2017 08:08:39 +0000 (00:08 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sat, 11 Mar 2017 08:08:39 +0000 (00:08 -0800)
Pull USB fixes from Greg KH:
 "Here is a number of different USB fixes for 4.11-rc2.

  Seems like there were a lot of unresolved issues that people have been
  finding for this subsystem, and a bunch of good security auditing
  happening as well from Johan Hovold. There's the usual batch of gadget
  driver fixes and xhci issues resolved as well.

 All of these have been in linux-next with no reported issues"

* tag 'usb-4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits)
  usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers
  usb: host: xhci-dbg: HCIVERSION should be a binary number
  usb: xhci: remove dummy extra_priv_size for size of xhci_hcd struct
  usb: xhci-mtk: check hcc_params after adding primary hcd
  USB: serial: digi_acceleport: fix OOB-event processing
  MAINTAINERS: usb251xb: remove reference inexistent file
  doc: dt-bindings: usb251xb: mark reg as required
  usb: usb251xb: dt: add unit suffix to oc-delay and power-on-time
  usb: usb251xb: remove max_{power,current}_{sp,bp} properties
  usb-storage: Add ignore-residue quirk for Initio INIC-3619
  USB: iowarrior: fix NULL-deref in write
  USB: iowarrior: fix NULL-deref at probe
  usb: phy: isp1301: Add OF device ID table
  usb: ohci-at91: Do not drop unhandled USB suspend control requests
  USB: serial: safe_serial: fix information leak in completion handler
  USB: serial: io_ti: fix information leak in completion handler
  USB: serial: omninet: drop open callback
  USB: serial: omninet: fix reference leaks at open
  USB: serial: io_ti: fix NULL-deref in interrupt callback
  usb: dwc3: gadget: make to increment req->remaining in all cases
  ...

26 files changed:
Documentation/devicetree/bindings/usb/usb251xb.txt
MAINTAINERS
drivers/usb/dwc3/dwc3-omap.c
drivers/usb/dwc3/gadget.c
drivers/usb/dwc3/gadget.h
drivers/usb/gadget/configfs.c
drivers/usb/gadget/function/f_fs.c
drivers/usb/gadget/function/f_uvc.c
drivers/usb/gadget/legacy/inode.c
drivers/usb/gadget/udc/atmel_usba_udc.c
drivers/usb/gadget/udc/dummy_hcd.c
drivers/usb/gadget/udc/net2280.c
drivers/usb/gadget/udc/pxa27x_udc.c
drivers/usb/host/ohci-at91.c
drivers/usb/host/xhci-dbg.c
drivers/usb/host/xhci-mtk.c
drivers/usb/host/xhci-plat.c
drivers/usb/host/xhci-tegra.c
drivers/usb/misc/iowarrior.c
drivers/usb/misc/usb251xb.c
drivers/usb/phy/phy-isp1301.c
drivers/usb/serial/digi_acceleport.c
drivers/usb/serial/io_ti.c
drivers/usb/serial/omninet.c
drivers/usb/serial/safe_serial.c
drivers/usb/storage/unusual_devs.h

index 0c065f77658f138e8bc535e85c7d2a99f5268b59..3957d4edaa745fc068c4ab8ba796f9c8d8190a1f 100644 (file)
@@ -7,18 +7,18 @@ Required properties :
  - compatible : Should be "microchip,usb251xb" or one of the specific types:
        "microchip,usb2512b", "microchip,usb2512bi", "microchip,usb2513b",
        "microchip,usb2513bi", "microchip,usb2514b", "microchip,usb2514bi"
- - hub-reset-gpios : Should specify the gpio for hub reset
+ - reset-gpios : Should specify the gpio for hub reset
+ - reg : I2C address on the selected bus (default is <0x2C>)
 
 Optional properties :
- - reg : I2C address on the selected bus (default is <0x2C>)
  - skip-config : Skip Hub configuration, but only send the USB-Attach command
- - vendor-id : USB Vendor ID of the hub (16 bit, default is 0x0424)
- - product-id : USB Product ID of the hub (16 bit, default depends on type)
- - device-id : USB Device ID of the hub (16 bit, default is 0x0bb3)
- - language-id : USB Language ID (16 bit, default is 0x0000)
- - manufacturer : USB Manufacturer string (max 31 characters long)
- - product : USB Product string (max 31 characters long)
- - serial : USB Serial string (max 31 characters long)
+ - vendor-id : Set USB Vendor ID of the hub (16 bit, default is 0x0424)
+ - product-id : Set USB Product ID of the hub (16 bit, default depends on type)
+ - device-id : Set USB Device ID of the hub (16 bit, default is 0x0bb3)
+ - language-id : Set USB Language ID (16 bit, default is 0x0000)
+ - manufacturer : Set USB Manufacturer string (max 31 characters long)
+ - product : Set USB Product string (max 31 characters long)
+ - serial : Set USB Serial string (max 31 characters long)
  - {bus,self}-powered : selects between self- and bus-powered operation (default
        is self-powered)
  - disable-hi-speed : disable USB Hi-Speed support
@@ -31,8 +31,10 @@ Optional properties :
        (default is individual)
  - dynamic-power-switching : enable auto-switching from self- to bus-powered
        operation if the local power source is removed or unavailable
- - oc-delay-{100us,4ms,8ms,16ms} : set over current timer delay (default is 8ms)
- - compound-device : indicated the hub is part of a compound device
+ - oc-delay-us : Delay time (in microseconds) for filtering the over-current
+       sense inputs. Valid values are 100, 4000, 8000 (default) and 16000. If
+       an invalid value is given, the default is used instead.
+ - compound-device : indicate the hub is part of a compound device
  - port-mapping-mode : enable port mapping mode
  - string-support : enable string descriptor support (required for manufacturer,
        product and serial string configuration)
@@ -40,34 +42,15 @@ Optional properties :
        device connected.
  - sp-disabled-ports : Specifies the ports which will be self-power disabled
  - bp-disabled-ports : Specifies the ports which will be bus-power disabled
- - max-sp-power : Specifies the maximum current the hub consumes from an
-       upstream port when operating as self-powered hub including the power
-       consumption of a permanently attached peripheral if the hub is
-       configured as a compound device. The value is given in mA in a 0 - 500
-       range (default is 2).
- - max-bp-power : Specifies the maximum current the hub consumes from an
-       upstream port when operating as bus-powered hub including the power
-       consumption of a permanently attached peripheral if the hub is
-       configured as a compound device. The value is given in mA in a 0 - 500
-       range (default is 100).
- - max-sp-current : Specifies the maximum current the hub consumes from an
-       upstream port when operating as self-powered hub EXCLUDING the power
-       consumption of a permanently attached peripheral if the hub is
-       configured as a compound device. The value is given in mA in a 0 - 500
-       range (default is 2).
- - max-bp-current : Specifies the maximum current the hub consumes from an
-       upstream port when operating as bus-powered hub EXCLUDING the power
-       consumption of a permanently attached peripheral if the hub is
-       configured as a compound device. The value is given in mA in a 0 - 500
-       range (default is 100).
- - power-on-time : Specifies the time it takes from the time the host initiates
-       the power-on sequence to a port until the port has adequate power. The
-       value is given in ms in a 0 - 510 range (default is 100ms).
+ - power-on-time-ms : Specifies the time it takes from the time the host
+       initiates the power-on sequence to a port until the port has adequate
+       power. The value is given in ms in a 0 - 510 range (default is 100ms).
 
 Examples:
        usb2512b@2c {
                compatible = "microchip,usb2512b";
-               hub-reset-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+               reg = <0x2c>;
+               reset-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
        };
 
        usb2514b@2c {
index c265a5fe48481f548629079cb529137e0a377f31..c776906f67a9f6795a0aef555a7fe348d07c506f 100644 (file)
@@ -8307,7 +8307,6 @@ M:        Richard Leitner <richard.leitner@skidata.com>
 L:     linux-usb@vger.kernel.org
 S:     Maintained
 F:     drivers/usb/misc/usb251xb.c
-F:     include/linux/platform_data/usb251xb.h
 F:     Documentation/devicetree/bindings/usb/usb251xb.txt
 
 MICROSOFT SURFACE PRO 3 BUTTON DRIVER
index 2092e46b1380e91712f3aab90434ba157dde809e..f8d0747810e78d7cc7930fed1b71cfc9c5aeb048 100644 (file)
@@ -250,6 +250,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
                val = dwc3_omap_read_utmi_ctrl(omap);
                val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG;
                dwc3_omap_write_utmi_ctrl(omap, val);
+               break;
 
        case OMAP_DWC3_VBUS_OFF:
                val = dwc3_omap_read_utmi_ctrl(omap);
@@ -392,7 +393,7 @@ static void dwc3_omap_set_utmi_mode(struct dwc3_omap *omap)
 {
        u32                     reg;
        struct device_node      *node = omap->dev->of_node;
-       int                     utmi_mode = 0;
+       u32                     utmi_mode = 0;
 
        reg = dwc3_omap_read_utmi_ctrl(omap);
 
index 4db97ecae8859ba0bc03c91c4948fc7af205390f..0d75158e43fe4807569db4d10204cee406b097b7 100644 (file)
@@ -1342,6 +1342,68 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                if (r == req) {
                        /* wait until it is processed */
                        dwc3_stop_active_transfer(dwc, dep->number, true);
+
+                       /*
+                        * If request was already started, this means we had to
+                        * stop the transfer. With that we also need to ignore
+                        * all TRBs used by the request, however TRBs can only
+                        * be modified after completion of END_TRANSFER
+                        * command. So what we do here is that we wait for
+                        * END_TRANSFER completion and only after that, we jump
+                        * over TRBs by clearing HWO and incrementing dequeue
+                        * pointer.
+                        *
+                        * Note that we have 2 possible types of transfers here:
+                        *
+                        * i) Linear buffer request
+                        * ii) SG-list based request
+                        *
+                        * SG-list based requests will have r->num_pending_sgs
+                        * set to a valid number (> 0). Linear requests,
+                        * normally use a single TRB.
+                        *
+                        * For each of these two cases, if r->unaligned flag is
+                        * set, one extra TRB has been used to align transfer
+                        * size to wMaxPacketSize.
+                        *
+                        * All of these cases need to be taken into
+                        * consideration so we don't mess up our TRB ring
+                        * pointers.
+                        */
+                       wait_event_lock_irq(dep->wait_end_transfer,
+                                       !(dep->flags & DWC3_EP_END_TRANSFER_PENDING),
+                                       dwc->lock);
+
+                       if (!r->trb)
+                               goto out1;
+
+                       if (r->num_pending_sgs) {
+                               struct dwc3_trb *trb;
+                               int i = 0;
+
+                               for (i = 0; i < r->num_pending_sgs; i++) {
+                                       trb = r->trb + i;
+                                       trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                       dwc3_ep_inc_deq(dep);
+                               }
+
+                               if (r->unaligned) {
+                                       trb = r->trb + r->num_pending_sgs + 1;
+                                       trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                       dwc3_ep_inc_deq(dep);
+                               }
+                       } else {
+                               struct dwc3_trb *trb = r->trb;
+
+                               trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                               dwc3_ep_inc_deq(dep);
+
+                               if (r->unaligned) {
+                                       trb = r->trb + 1;
+                                       trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                       dwc3_ep_inc_deq(dep);
+                               }
+                       }
                        goto out1;
                }
                dev_err(dwc->dev, "request %p was not queued to %s\n",
@@ -1352,6 +1414,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
 
 out1:
        /* giveback the request */
+       dep->queued_requests--;
        dwc3_gadget_giveback(dep, req, -ECONNRESET);
 
 out0:
@@ -2126,12 +2189,12 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                return 1;
        }
 
-       if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-               return 1;
-
        count = trb->size & DWC3_TRB_SIZE_MASK;
        req->remaining += count;
 
+       if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
+               return 1;
+
        if (dep->direction) {
                if (count) {
                        trb_status = DWC3_TRB_SIZE_TRBSTS(trb->size);
@@ -3228,15 +3291,10 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
 
 int dwc3_gadget_suspend(struct dwc3 *dwc)
 {
-       int ret;
-
        if (!dwc->gadget_driver)
                return 0;
 
-       ret = dwc3_gadget_run_stop(dwc, false, false);
-       if (ret < 0)
-               return ret;
-
+       dwc3_gadget_run_stop(dwc, false, false);
        dwc3_disconnect_gadget(dwc);
        __dwc3_gadget_stop(dwc);
 
index 3129bcf74d7d8de7ffe8d23923a7ba34d4e5cff9..265e223ab64554f6be78d37d15e36a86bb571c74 100644 (file)
@@ -28,23 +28,23 @@ struct dwc3;
 #define gadget_to_dwc(g)       (container_of(g, struct dwc3, gadget))
 
 /* DEPCFG parameter 1 */
-#define DWC3_DEPCFG_INT_NUM(n)         ((n) << 0)
+#define DWC3_DEPCFG_INT_NUM(n)         (((n) & 0x1f) << 0)
 #define DWC3_DEPCFG_XFER_COMPLETE_EN   (1 << 8)
 #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN        (1 << 9)
 #define DWC3_DEPCFG_XFER_NOT_READY_EN  (1 << 10)
 #define DWC3_DEPCFG_FIFO_ERROR_EN      (1 << 11)
 #define DWC3_DEPCFG_STREAM_EVENT_EN    (1 << 13)
-#define DWC3_DEPCFG_BINTERVAL_M1(n)    ((n) << 16)
+#define DWC3_DEPCFG_BINTERVAL_M1(n)    (((n) & 0xff) << 16)
 #define DWC3_DEPCFG_STREAM_CAPABLE     (1 << 24)
-#define DWC3_DEPCFG_EP_NUMBER(n)       ((n) << 25)
+#define DWC3_DEPCFG_EP_NUMBER(n)       (((n) & 0x1f) << 25)
 #define DWC3_DEPCFG_BULK_BASED         (1 << 30)
 #define DWC3_DEPCFG_FIFO_BASED         (1 << 31)
 
 /* DEPCFG parameter 0 */
-#define DWC3_DEPCFG_EP_TYPE(n)         ((n) << 1)
-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) ((n) << 3)
-#define DWC3_DEPCFG_FIFO_NUMBER(n)     ((n) << 17)
-#define DWC3_DEPCFG_BURST_SIZE(n)      ((n) << 22)
+#define DWC3_DEPCFG_EP_TYPE(n)         (((n) & 0x3) << 1)
+#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) (((n) & 0x7ff) << 3)
+#define DWC3_DEPCFG_FIFO_NUMBER(n)     (((n) & 0x1f) << 17)
+#define DWC3_DEPCFG_BURST_SIZE(n)      (((n) & 0xf) << 22)
 #define DWC3_DEPCFG_DATA_SEQ_NUM(n)    ((n) << 26)
 /* This applies for core versions earlier than 1.94a */
 #define DWC3_DEPCFG_IGN_SEQ_NUM                (1 << 31)
index 78c44979dde382ca8c58e9f9f84024180ce9663d..cbff3b02840df901ca0ca03c646b14f5f6085719 100644 (file)
@@ -269,6 +269,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item,
                ret = unregister_gadget(gi);
                if (ret)
                        goto err;
+               kfree(name);
        } else {
                if (gi->composite.gadget_driver.udc_name) {
                        ret = -EBUSY;
index a5b7cd6156987a80ad74ba73bde16a30de4e2bf9..a0085571824d9b4352c7245625a30c3248d789f5 100644 (file)
@@ -1834,11 +1834,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
        spin_lock_irqsave(&func->ffs->eps_lock, flags);
        while(count--) {
                struct usb_endpoint_descriptor *ds;
+               struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+               int needs_comp_desc = false;
                int desc_idx;
 
-               if (ffs->gadget->speed == USB_SPEED_SUPER)
+               if (ffs->gadget->speed == USB_SPEED_SUPER) {
                        desc_idx = 2;
-               else if (ffs->gadget->speed == USB_SPEED_HIGH)
+                       needs_comp_desc = true;
+               } else if (ffs->gadget->speed == USB_SPEED_HIGH)
                        desc_idx = 1;
                else
                        desc_idx = 0;
@@ -1855,6 +1858,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
                ep->ep->driver_data = ep;
                ep->ep->desc = ds;
+
+               comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                               USB_DT_ENDPOINT_SIZE);
+               ep->ep->maxburst = comp_desc->bMaxBurst + 1;
+
+               if (needs_comp_desc)
+                       ep->ep->comp_desc = comp_desc;
+
                ret = usb_ep_enable(ep->ep);
                if (likely(!ret)) {
                        epfile->ep = ep;
@@ -2253,7 +2264,7 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
 
                if (len < sizeof(*d) ||
                    d->bFirstInterfaceNumber >= ffs->interfaces_count ||
-                   d->Reserved1)
+                   !d->Reserved1)
                        return -EINVAL;
                for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
                        if (d->Reserved2[i])
index 27ed51b5082f66de17c41761f260a4b96dcc0f33..29b41b5dee04d2e0e3e87a6dc97d6dde84af49d0 100644 (file)
@@ -258,13 +258,6 @@ uvc_function_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
        memcpy(&uvc_event->req, ctrl, sizeof(uvc_event->req));
        v4l2_event_queue(&uvc->vdev, &v4l2_event);
 
-       /* Pass additional setup data to userspace */
-       if (uvc->event_setup_out && uvc->event_length) {
-               uvc->control_req->length = uvc->event_length;
-               return usb_ep_queue(uvc->func.config->cdev->gadget->ep0,
-                       uvc->control_req, GFP_ATOMIC);
-       }
-
        return 0;
 }
 
index 79a2d8fba6b60622e7ba94570ce1c07265fc8ade..a2c916869293720e378ced6b265532846eca52a3 100644 (file)
@@ -1781,8 +1781,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
        spin_lock_irq (&dev->lock);
        value = -EINVAL;
-       if (dev->buf)
+       if (dev->buf) {
+               kfree(kbuf);
                goto fail;
+       }
        dev->buf = kbuf;
 
        /* full or low speed config */
index 11bbce28bc231b701bef74cc38b99e5dbd3cc6ca..2035906b8ced173c2e869a3272334d4265acf79c 100644 (file)
@@ -610,7 +610,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 {
        struct usba_ep *ep = to_usba_ep(_ep);
        struct usba_udc *udc = ep->udc;
-       unsigned long flags, ept_cfg, maxpacket;
+       unsigned long flags, maxpacket;
        unsigned int nr_trans;
 
        DBG(DBG_GADGET, "%s: ep_enable: desc=%p\n", ep->ep.name, desc);
@@ -630,7 +630,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
        ep->is_in = 0;
 
        DBG(DBG_ERR, "%s: EPT_CFG = 0x%lx (maxpacket = %lu)\n",
-                       ep->ep.name, ept_cfg, maxpacket);
+                       ep->ep.name, ep->ept_cfg, maxpacket);
 
        if (usb_endpoint_dir_in(desc)) {
                ep->is_in = 1;
index c60abe3a68f9cf48c21831d40bc32c4e9390b892..8cabc5944d5f1d834db7dd2186777cd79536016b 100644 (file)
@@ -1031,6 +1031,8 @@ static int dummy_udc_probe(struct platform_device *pdev)
        int             rc;
 
        dum = *((void **)dev_get_platdata(&pdev->dev));
+       /* Clear usb_gadget region for new registration to udc-core */
+       memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
        dum->gadget.name = gadget_name;
        dum->gadget.ops = &dummy_ops;
        dum->gadget.max_speed = USB_SPEED_SUPER;
index 85504419ab312e58a83c52d524bfdebadf5e1ed7..3828c2ec8623b155c9948ae90dcebdc4a0106ce6 100644 (file)
@@ -1146,15 +1146,15 @@ static int scan_dma_completions(struct net2280_ep *ep)
         */
        while (!list_empty(&ep->queue)) {
                struct net2280_request  *req;
-               u32                     tmp;
+               u32 req_dma_count;
 
                req = list_entry(ep->queue.next,
                                struct net2280_request, queue);
                if (!req->valid)
                        break;
                rmb();
-               tmp = le32_to_cpup(&req->td->dmacount);
-               if ((tmp & BIT(VALID_BIT)) != 0)
+               req_dma_count = le32_to_cpup(&req->td->dmacount);
+               if ((req_dma_count & BIT(VALID_BIT)) != 0)
                        break;
 
                /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
@@ -1163,40 +1163,41 @@ static int scan_dma_completions(struct net2280_ep *ep)
                 */
                if (unlikely(req->td->dmadesc == 0)) {
                        /* paranoia */
-                       tmp = readl(&ep->dma->dmacount);
-                       if (tmp & DMA_BYTE_COUNT_MASK)
+                       u32 const ep_dmacount = readl(&ep->dma->dmacount);
+
+                       if (ep_dmacount & DMA_BYTE_COUNT_MASK)
                                break;
                        /* single transfer mode */
-                       dma_done(ep, req, tmp, 0);
+                       dma_done(ep, req, req_dma_count, 0);
                        num_completed++;
                        break;
                } else if (!ep->is_in &&
                           (req->req.length % ep->ep.maxpacket) &&
                           !(ep->dev->quirks & PLX_PCIE)) {
 
-                       tmp = readl(&ep->regs->ep_stat);
+                       u32 const ep_stat = readl(&ep->regs->ep_stat);
                        /* AVOID TROUBLE HERE by not issuing short reads from
                         * your gadget driver.  That helps avoids errata 0121,
                         * 0122, and 0124; not all cases trigger the warning.
                         */
-                       if ((tmp & BIT(NAK_OUT_PACKETS)) == 0) {
+                       if ((ep_stat & BIT(NAK_OUT_PACKETS)) == 0) {
                                ep_warn(ep->dev, "%s lost packet sync!\n",
                                                ep->ep.name);
                                req->req.status = -EOVERFLOW;
                        } else {
-                               tmp = readl(&ep->regs->ep_avail);
-                               if (tmp) {
+                               u32 const ep_avail = readl(&ep->regs->ep_avail);
+                               if (ep_avail) {
                                        /* fifo gets flushed later */
                                        ep->out_overflow = 1;
                                        ep_dbg(ep->dev,
                                                "%s dma, discard %d len %d\n",
-                                               ep->ep.name, tmp,
+                                               ep->ep.name, ep_avail,
                                                req->req.length);
                                        req->req.status = -EOVERFLOW;
                                }
                        }
                }
-               dma_done(ep, req, tmp, 0);
+               dma_done(ep, req, req_dma_count, 0);
                num_completed++;
        }
 
index e1335ad5bce9f2c96dc729e14ede027994b8b381..832c4fdbe98512a2b70b6b9e9424acc21a09b83b 100644 (file)
@@ -2534,9 +2534,10 @@ static int pxa_udc_remove(struct platform_device *_dev)
        usb_del_gadget_udc(&udc->gadget);
        pxa_cleanup_debugfs(udc);
 
-       if (!IS_ERR_OR_NULL(udc->transceiver))
+       if (!IS_ERR_OR_NULL(udc->transceiver)) {
                usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
-       usb_put_phy(udc->transceiver);
+               usb_put_phy(udc->transceiver);
+       }
 
        udc->transceiver = NULL;
        the_controller = NULL;
index 414e3c376dbbd59587dc3398f4a90872a5aae19c..5302f988e7e670eec3fbd66f0058a49e91f22b76 100644 (file)
@@ -350,7 +350,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                case USB_PORT_FEAT_SUSPEND:
                        dev_dbg(hcd->self.controller, "SetPortFeat: SUSPEND\n");
-                       if (valid_port(wIndex)) {
+                       if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                       1);
                                return 0;
@@ -393,7 +393,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                case USB_PORT_FEAT_SUSPEND:
                        dev_dbg(hcd->self.controller, "ClearPortFeature: SUSPEND\n");
-                       if (valid_port(wIndex)) {
+                       if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                       0);
                                return 0;
index 363d125300eacfbef6287644f89af6abe007c920..2b4a00fa735dfef5c51b4a9f583e5783e87ad957 100644 (file)
@@ -109,7 +109,7 @@ static void xhci_print_cap_regs(struct xhci_hcd *xhci)
        xhci_dbg(xhci, "RTSOFF 0x%x:\n", temp & RTSOFF_MASK);
 
        /* xhci 1.1 controllers have the HCCPARAMS2 register */
-       if (hci_version > 100) {
+       if (hci_version > 0x100) {
                temp = readl(&xhci->cap_regs->hcc_params2);
                xhci_dbg(xhci, "HCC PARAMS2 0x%x:\n", (unsigned int) temp);
                xhci_dbg(xhci, "  HC %s Force save context capability",
index 9066ec9e0c2e7aacefabcd41f8f77805d635afe2..67d5dc79b6b50e6fbaa30cddface8602dded27ee 100644 (file)
@@ -382,7 +382,6 @@ static int usb_wakeup_of_property_parse(struct xhci_hcd_mtk *mtk,
 
 static int xhci_mtk_setup(struct usb_hcd *hcd);
 static const struct xhci_driver_overrides xhci_mtk_overrides __initconst = {
-       .extra_priv_size = sizeof(struct xhci_hcd),
        .reset = xhci_mtk_setup,
 };
 
@@ -678,13 +677,13 @@ static int xhci_mtk_probe(struct platform_device *pdev)
                goto power_off_phys;
        }
 
-       if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
-               xhci->shared_hcd->can_do_streams = 1;
-
        ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
        if (ret)
                goto put_usb3_hcd;
 
+       if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
+               xhci->shared_hcd->can_do_streams = 1;
+
        ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
        if (ret)
                goto dealloc_usb2_hcd;
index 6d33b42ffcf5224a1b347666c77b010df9001d91..bd02a6cd8e2c081f53c82b6f1face7b38bd0dbf7 100644 (file)
@@ -286,6 +286,8 @@ static int xhci_plat_remove(struct platform_device *dev)
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        struct clk *clk = xhci->clk;
 
+       xhci->xhc_state |= XHCI_STATE_REMOVING;
+
        usb_remove_hcd(xhci->shared_hcd);
        usb_phy_shutdown(hcd->usb_phy);
 
index a59fafb4b329f532be52773c53a874b00cae789a..74436f8ca5382f736dbf352c21b7c2f83a8438ba 100644 (file)
@@ -1308,7 +1308,6 @@ static int tegra_xhci_setup(struct usb_hcd *hcd)
 }
 
 static const struct xhci_driver_overrides tegra_xhci_overrides __initconst = {
-       .extra_priv_size = sizeof(struct xhci_hcd),
        .reset = tegra_xhci_setup,
 };
 
index 095778ff984de25838b1e0eda53e0794dd382f8c..37c63cb39714b86ada39d3232565ef1595ed71c6 100644 (file)
@@ -781,12 +781,6 @@ static int iowarrior_probe(struct usb_interface *interface,
        iface_desc = interface->cur_altsetting;
        dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
-       if (iface_desc->desc.bNumEndpoints < 1) {
-               dev_err(&interface->dev, "Invalid number of endpoints\n");
-               retval = -EINVAL;
-               goto error;
-       }
-
        /* set up the endpoint information */
        for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                endpoint = &iface_desc->endpoint[i].desc;
@@ -797,6 +791,21 @@ static int iowarrior_probe(struct usb_interface *interface,
                        /* this one will match for the IOWarrior56 only */
                        dev->int_out_endpoint = endpoint;
        }
+
+       if (!dev->int_in_endpoint) {
+               dev_err(&interface->dev, "no interrupt-in endpoint found\n");
+               retval = -ENODEV;
+               goto error;
+       }
+
+       if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
+               if (!dev->int_out_endpoint) {
+                       dev_err(&interface->dev, "no interrupt-out endpoint found\n");
+                       retval = -ENODEV;
+                       goto error;
+               }
+       }
+
        /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
        dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
        if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
index 4e18600dc9b43e2603ec2c8f371545e63b75a404..91f66d68bcb7b55bd000e18ad551d8b6bc27ff7c 100644 (file)
@@ -375,18 +375,24 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
        if (of_get_property(np, "dynamic-power-switching", NULL))
                hub->conf_data2 |= BIT(7);
 
-       if (of_get_property(np, "oc-delay-100us", NULL)) {
-               hub->conf_data2 &= ~BIT(5);
-               hub->conf_data2 &= ~BIT(4);
-       } else if (of_get_property(np, "oc-delay-4ms", NULL)) {
-               hub->conf_data2 &= ~BIT(5);
-               hub->conf_data2 |= BIT(4);
-       } else if (of_get_property(np, "oc-delay-8ms", NULL)) {
-               hub->conf_data2 |= BIT(5);
-               hub->conf_data2 &= ~BIT(4);
-       } else if (of_get_property(np, "oc-delay-16ms", NULL)) {
-               hub->conf_data2 |= BIT(5);
-               hub->conf_data2 |= BIT(4);
+       if (!of_property_read_u32(np, "oc-delay-us", property_u32)) {
+               if (*property_u32 == 100) {
+                       /* 100 us*/
+                       hub->conf_data2 &= ~BIT(5);
+                       hub->conf_data2 &= ~BIT(4);
+               } else if (*property_u32 == 4000) {
+                       /* 4 ms */
+                       hub->conf_data2 &= ~BIT(5);
+                       hub->conf_data2 |= BIT(4);
+               } else if (*property_u32 == 16000) {
+                       /* 16 ms */
+                       hub->conf_data2 |= BIT(5);
+                       hub->conf_data2 |= BIT(4);
+               } else {
+                       /* 8 ms (DEFAULT) */
+                       hub->conf_data2 |= BIT(5);
+                       hub->conf_data2 &= ~BIT(4);
+               }
        }
 
        if (of_get_property(np, "compound-device", NULL))
@@ -432,30 +438,9 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
                }
        }
 
-       hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
-       if (!of_property_read_u32(np, "max-sp-power", property_u32))
-               hub->max_power_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                         250);
-
-       hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
-       if (!of_property_read_u32(np, "max-bp-power", property_u32))
-               hub->max_power_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                         250);
-
-       hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
-       if (!of_property_read_u32(np, "max-sp-current", property_u32))
-               hub->max_current_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                           250);
-
-       hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
-       if (!of_property_read_u32(np, "max-bp-current", property_u32))
-               hub->max_current_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                           250);
-
        hub->power_on_time = USB251XB_DEF_POWER_ON_TIME;
-       if (!of_property_read_u32(np, "power-on-time", property_u32))
-               hub->power_on_time = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          255);
+       if (!of_property_read_u32(np, "power-on-time-ms", property_u32))
+               hub->power_on_time = min_t(u8, *property_u32 / 2, 255);
 
        if (of_property_read_u16_array(np, "language-id", &hub->lang_id, 1))
                hub->lang_id = USB251XB_DEF_LANGUAGE_ID;
@@ -492,6 +477,10 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
        /* The following parameters are currently not exposed to devicetree, but
         * may be as soon as needed.
         */
+       hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
+       hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
+       hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
+       hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
        hub->bat_charge_en = USB251XB_DEF_BATTERY_CHARGING_ENABLE;
        hub->boost_up = USB251XB_DEF_BOOST_UP;
        hub->boost_x = USB251XB_DEF_BOOST_X;
index db68156568e6e7bc209eaf942eaa9c51bd4e15ad..b3b33cf7ddf608f24b0bca12f1c241261837f791 100644 (file)
@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, isp1301_id);
 
+static const struct of_device_id isp1301_of_match[] = {
+       {.compatible = "nxp,isp1301" },
+       { },
+};
+MODULE_DEVICE_TABLE(of, isp1301_of_match);
+
 static struct i2c_client *isp1301_i2c_client;
 
 static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear)
@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client)
 static struct i2c_driver isp1301_driver = {
        .driver = {
                .name = DRV_NAME,
+               .of_match_table = of_match_ptr(isp1301_of_match),
        },
        .probe = isp1301_probe,
        .remove = isp1301_remove,
index ab78111e09680f47267cbe5fc7fe9a25ca5eea21..6537d3ca2797d8573236578e3088f6dbce1ce1b5 100644 (file)
@@ -1500,7 +1500,7 @@ static int digi_read_oob_callback(struct urb *urb)
                return -1;
 
        /* handle each oob command */
-       for (i = 0; i < urb->actual_length - 4; i += 4) {
+       for (i = 0; i < urb->actual_length - 3; i += 4) {
                opcode = buf[i];
                line = buf[i + 1];
                status = buf[i + 2];
index ceaeebaa6f90587b6d8ea01e53daaad243be8b6d..a76b95d32157871f5e2964b629784a7642da8480 100644 (file)
@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb)
        function    = TIUMP_GET_FUNC_FROM_CODE(data[0]);
        dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
                port_number, function, data[1]);
+
+       if (port_number >= edge_serial->serial->num_ports) {
+               dev_err(dev, "bad port number %d\n", port_number);
+               goto exit;
+       }
+
        port = edge_serial->serial->port[port_number];
        edge_port = usb_get_serial_port_data(port);
        if (!edge_port) {
@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb)
 
        port_number = edge_port->port->port_number;
 
-       if (edge_port->lsr_event) {
+       if (urb->actual_length > 0 && edge_port->lsr_event) {
                edge_port->lsr_event = 0;
                dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
                        __func__, port_number, edge_port->lsr_mask, *data);
index a180b17d24323b074aee19e33bf0f497ad271d8a..dd706953b4660905cc5abf5e85477bfb6bdb4149 100644 (file)
@@ -31,7 +31,6 @@
 #define BT_IGNITIONPRO_ID      0x2000
 
 /* function prototypes */
-static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void omninet_process_read_urb(struct urb *urb);
 static void omninet_write_bulk_callback(struct urb *urb);
 static int  omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -60,7 +59,6 @@ static struct usb_serial_driver zyxel_omninet_device = {
        .attach =               omninet_attach,
        .port_probe =           omninet_port_probe,
        .port_remove =          omninet_port_remove,
-       .open =                 omninet_open,
        .write =                omninet_write,
        .write_room =           omninet_write_room,
        .write_bulk_callback =  omninet_write_bulk_callback,
@@ -140,17 +138,6 @@ static int omninet_port_remove(struct usb_serial_port *port)
        return 0;
 }
 
-static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
-{
-       struct usb_serial       *serial = port->serial;
-       struct usb_serial_port  *wport;
-
-       wport = serial->port[1];
-       tty_port_tty_set(&wport->port, tty);
-
-       return usb_serial_generic_open(tty, port);
-}
-
 #define OMNINET_HEADERLEN      4
 #define OMNINET_BULKOUTSIZE    64
 #define OMNINET_PAYLOADSIZE    (OMNINET_BULKOUTSIZE - OMNINET_HEADERLEN)
index 93c6c9b08daae534234ca75121f696cec521857d..8a069aa154eda461ae12807d2518bbfd0bb27bf4 100644 (file)
@@ -200,6 +200,11 @@ static void safe_process_read_urb(struct urb *urb)
        if (!safe)
                goto out;
 
+       if (length < 2) {
+               dev_err(&port->dev, "malformed packet\n");
+               return;
+       }
+
        fcs = fcs_compute10(data, length, CRC10_INITFCS);
        if (fcs) {
                dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);
index 16cc18369111d039ffededa7559075a869638708..9129f6cb823074a555a90f74611dac3f0164a60d 100644 (file)
@@ -2071,6 +2071,20 @@ UNUSUAL_DEV(  0x1370, 0x6828, 0x0110, 0x0110,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_IGNORE_RESIDUE ),
 
+/*
+ * Reported by Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+ * The INIC-3619 bridge is used in the StarTech SLSODDU33B
+ * SATA-USB enclosure for slimline optical drives.
+ *
+ * The quirk enables MakeMKV to properly exchange keys with
+ * an installed BD drive.
+ */
+UNUSUAL_DEV(  0x13fd, 0x3609, 0x0209, 0x0209,
+               "Initio Corporation",
+               "INIC-3619",
+               USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+               US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Qinglin Ye <yestyle@gmail.com> */
 UNUSUAL_DEV(  0x13fe, 0x3600, 0x0100, 0x0100,
                "Kingston",