#
34427557 |
|
13-Mar-2023 |
Andy Shevchenko <andriy.shevchenko@linux.intel.com> |
usb: gadget: aspeed: Rectify a bit a random header inclusion It looks like the driver copied'n'pasted almost random set of headers for its code. Rectify it a bit by removing of_gpio.h that is not only unused, but also will be removed in the future completely. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20230313155310.80022-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
83045e19 |
|
24-Oct-2022 |
Henry Tian <tianxiaofeng@bytedance.com> |
usb: gadget: aspeed: fix buffer overflow In ast_vhub_epn_handle_ack() when the received data length exceeds the buffer, it does not check the case and just copies to req.buf and cause a buffer overflow, kernel oops on this case. This issue could be reproduced on a BMC with an OS that enables the lan over USB: 1. In OS, enable the usb eth dev, verify it pings the BMC OK; 2. In OS, set the usb dev mtu to 2000. (Default is 1500); 3. In OS, ping the BMC with `-s 2000` argument. The BMC kernel will get oops with below logs: skbuff: skb_over_panic: text:8058e098 len:2048 put:2048 head:84c678a0 data:84c678c2 tail:0x84c680c2 end:0x84c67f00 dev:usb0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! Internal error: Oops - BUG: 0 [#1] ARM CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.69-c9fb275-dirty-d1e579a #1 Hardware name: Generic DT based system PC is at skb_panic+0x60/0x6c LR is at irq_work_queue+0x6c/0x94 Fix the issue by checking the length and set `-EOVERFLOW`. Tested: Verify the BMC kernel does not get oops in the above case, and the usb ethernet gets RX packets errors instead. Signed-off-by: Lei YU <yulei.sh@bytedance.com> Signed-off-by: Henry Tian <tianxiaofeng@bytedance.com> Reviewed-by: Neal Liu <neal_liu@aspeedtech.com> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Link: https://lore.kernel.org/r/20221024094853.2877441-1-yulei.sh@bytedance.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
6163d499 |
|
08-Mar-2022 |
Jakob Koschel <jakobkoschel@gmail.com> |
usb: gadget: aspeed: remove usage of list iterator past the loop body If the list representing the request queue does not contain the expected request, the value of the list_for_each_entry() iterator will not point to a valid structure. To avoid type confusion in such case, the list iterator scope will be limited to the list_for_each_entry() loop. In preparation to limiting scope of the list iterator to the list traversal loop, use a dedicated pointer to point to the found request object [1]. Link: https://lore.kernel.org/all/YhdfEIwI4EdtHdym@kroah.com/ Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com> Link: https://lore.kernel.org/r/20220308171818.384491-17-jakobkoschel@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
5786b433 |
|
22-Aug-2021 |
Cai Huoqing <caihuoqing@baidu.com> |
usb: gadget: aspeed: Remove repeated verbose license text remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Link: https://lore.kernel.org/r/20210823045807.49-1-caihuoqing@baidu.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
bd4d6070 |
|
30-Mar-2021 |
Tao Ren <rentao.bupt@gmail.com> |
usb: gadget: aspeed: fix dma map failure Currently the virtual port_dev device is passed to DMA API, and this is wrong because the device passed to DMA API calls must be the actual hardware device performing the DMA. The patch replaces usb_gadget_map_request/usb_gadget_unmap_request APIs with usb_gadget_map_request_by_dev/usb_gadget_unmap_request_by_dev APIs so the DMA capable platform device can be passed to the DMA APIs. The patch fixes below backtrace detected on Facebook AST2500 OpenBMC platforms: [<80106550>] show_stack+0x20/0x24 [<80106868>] dump_stack+0x28/0x30 [<80823540>] __warn+0xfc/0x110 [<8011ac30>] warn_slowpath_fmt+0xb0/0xc0 [<8011ad44>] dma_map_page_attrs+0x24c/0x314 [<8016a27c>] usb_gadget_map_request_by_dev+0x100/0x1e4 [<805cedd8>] usb_gadget_map_request+0x1c/0x20 [<805cefbc>] ast_vhub_epn_queue+0xa0/0x1d8 [<7f02f710>] usb_ep_queue+0x48/0xc4 [<805cd3e8>] ecm_do_notify+0xf8/0x248 [<7f145920>] ecm_set_alt+0xc8/0x1d0 [<7f145c34>] composite_setup+0x680/0x1d30 [<7f00deb8>] ast_vhub_ep0_handle_setup+0xa4/0x1bc [<7f02ee94>] ast_vhub_dev_irq+0x58/0x84 [<7f0309e0>] ast_vhub_irq+0xb0/0x1c8 [<7f02e118>] __handle_irq_event_percpu+0x50/0x19c [<8015e5bc>] handle_irq_event_percpu+0x38/0x8c [<8015e758>] handle_irq_event+0x38/0x4c Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub") Reviewed-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Tao Ren <rentao.bupt@gmail.com> Link: https://lore.kernel.org/r/20210331045831.28700-1-rentao.bupt@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
4e0dcf62 |
|
08-Jan-2021 |
Ryan Chen <ryan_chen@aspeedtech.com> |
usb: gadget: aspeed: fix stop dma register setting. The vhub engine has two dma mode, one is descriptor list, another is single stage DMA. Each mode has different stop register setting. Descriptor list operation (bit2) : 0 disable reset, 1: enable reset Single mode operation (bit0) : 0 : disable, 1: enable Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub") Cc: stable <stable@vger.kernel.org> Acked-by: Felipe Balbi <balbi@kernel.org> Acked-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com> Link: https://lore.kernel.org/r/20210108081238.10199-2-ryan_chen@aspeedtech.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
487bc828 |
|
02-Mar-2020 |
Tao Ren <rentao.bupt@gmail.com> |
usb: gadget: aspeed: read vhub properties from device tree The patch introduces 2 DT properties ("aspeed,vhub-downstream-ports" and "aspeed,vhub-generic-endpoints") which replaces hardcoded port/endpoint number. It is to make it more convenient to add support for newer vhub revisions with different number of ports and endpoints. Signed-off-by: Tao Ren <rentao.bupt@gmail.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
|
#
ef9d3468 |
|
25-Jul-2019 |
Benjamin Herrenschmidt <benh@kernel.crashing.org> |
usb: gadget: aspeed: Don't reject requests on suspended devices A disconnect may just suspend the hub in absence of a physical disconnect detection. If we start rejecting requests, the mass storage function gets into a spin trying to requeue the same request for ever and hangs. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
#
4035c5b5 |
|
20-Mar-2019 |
Chunfeng Yun <chunfeng.yun@mediatek.com> |
usb: introduce usb_ep_type_string() function In some places, the code prints a human-readable USB endpoint transfer type (e.g. "bulk"). This involves a switch statement sometimes wrapped around in ({ ... }) block leading to code repetition. To make this scenario easier, here introduces usb_ep_type_string() function, which returns a human-readable name of provided endpoint type. It also changes a few places switch was used to use this new function. Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
#
4d537f37 |
|
20-Mar-2019 |
Chunfeng Yun <chunfeng.yun@mediatek.com> |
usb: introduce usb_ep_type_string() function In some places, the code prints a human-readable USB endpoint transfer type (e.g. "bulk"). This involves a switch statement sometimes wrapped around in ({ ... }) block leading to code repetition. To make this scenario easier, here introduces usb_ep_type_string() function, which returns a human-readable name of provided endpoint type. It also changes a few places switch was used to use this new function. Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
4d8cd616 |
|
04-Jan-2019 |
Matteo Croce <mcroce@redhat.com> |
usb: gadget: aspeed: fix typo Fix spelling mistake: "lenght" -> "length" Signed-off-by: Matteo Croce <mcroce@redhat.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
#
3c168909 |
|
28-Sep-2018 |
Colin Ian King <colin.king@canonical.com> |
usb: gadget: fix spelling mistakeis "[En]queing" -> "[En]queuing" Trivial fix to spelling mistakes in debug warning messages Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
bf3854aa |
|
28-Sep-2018 |
Colin Ian King <colin.king@canonical.com> |
usb: gadget: fix spelling mistakeis "[En]queing" -> "[En]queuing" Trivial fix to spelling mistakes in debug warning messages Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
#
bb286336 |
|
11-Jul-2018 |
Benjamin Herrenschmidt <benh@kernel.crashing.org> |
usb: gadget: aspeed: Workaround memory ordering issue The Aspeed SoC has a memory ordering issue that (thankfully) only affects the USB gadget device. A read back is necessary after writing to memory and before letting the device DMA from it. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|
#
7ecca2a4 |
|
03-May-2018 |
Benjamin Herrenschmidt <benh@kernel.crashing.org> |
usb/gadget: Add driver for Aspeed SoC virtual hub The Aspeed BMC SoCs support a "virtual hub" function. It provides some HW support for a top-level USB2 hub behind which sit 5 gadget "ports". This driver adds support for the full functionality, emulating the hub standard requests and exposing 5 UDC gadget drivers corresponding to the ports. The hub itself has HW provided dedicated EP0 and EP1 (the latter for hub interrupts). It also has dedicated EP0s for each function. For other endpoints, there's a pool of 15 "generic" endpoints that are shared among the ports. The driver relies on my previous patch adding a "dispose" EP op to handle EP allocation between ports. EPs are allocated from the shared pool in the UDC "match_ep" callback and assigned to the UDC instance (added to the gadget ep_list). When the composite driver gets unbound, the new hook will allow the UDC to clean things up and return those EPs to the shared pool. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
|