From: "Du, Changbin"
Since the buffer size for req is rounded up to maxpacketsize,
then we may end up with more data then user space has space
for.
If it happen, we can keep the excess data for next i/o, or
report an error. But we cannot silently drop data, because
USB layer should ensure the da
From: "Du, Changbin"
Add debugobject support to track the life time of struct urb.
This feature help us detect violation of urb operations by
generating a warning message from debugobject core. And we fix
the possible issues at runtime to avoid oops if we can.
I have done some tests with some cl
From: "Du, Changbin"
When usb_ep_enable on a enabled ep, the configuration of the ep probably
has changed. In this scenario, the ep configuration in hw should be
reprogrammed by udc driver. Hence, it is better to return an error to
inform the caller.
Signed-off-by: Du, Changbin
---
change from
From: "Du, Changbin"
Queue a request to disabled ep doesn't make sense, and induce caller
make mistakes.
Here is a example for the android mtp gadget function driver. A mem
corruption can happen on below senario.
1) On disconnect, mtp driver disable its EPs,
2) During send_file_work and receive
From: "Du, Changbin"
Queue a request to disabled ep doesn't make sense, and induce caller
make mistakes.
Here is a example for the android mtp gadget function driver. A mem
corruption can happen on below senario.
1) On disconnect, mtp driver disable its EPs,
2) During send_file_work and receive
From: "Du, Changbin"
Queue a request to disabled ep doesn't make sense, and induce caller
make mistakes.
Here is a example for the android mtp gadget function driver. A mem
corruption can happen on below senario.
1) On disconnect, mtp driver disable its EPs,
2) During send_file_work and receive
From: "Du, Changbin"
If acm_bind fails before allocate notification and acm->notify_req is
not set to NULL after freed last time, double free will happen.
kernel BUG at mm/slub.c:3392!
invalid opcode: [#1] PREEMPT SMP
EIP is at kfree+0x172/0x180
Call Trace:
[<80c0e3b6>] ? usb_ep_autoconfig_
From: "Du, Changbin"
acm, ecm, hid, ncm, phonet, rndis and uvc functions all have double
memory free issue. Set pointers to NULL after freed to avoid this.
Here explain how it happen on acm function, others has analogical case.
If acm_bind fails before allocate notification and acm->notify_req
From: "Du, Changbin"
ffs_epfile_io and ffs_epfile_io_complete runs in different context, but
there is no synchronization between them.
consider the following scenario:
1) ffs_epfile_io interrupted by sigal while
wait_for_completion_interruptible
2) then ffs_epfile_io set ret to -EINTR
3) just be
From: "Du, Changbin"
This is a reworked patch based on reverted commit d8f00cd685f5 ("usb:
hub: do not clear BOS field during reset device").
The privious one caused double mem-free if run to re_enumerate label.
New patch title changed to distinguish from old one. And I have tested
it with memor
From: "Du, Changbin"
Actually, the function only clean one trb. So rename the function.
Signed-off-by: Du, Changbin
---
drivers/usb/dwc3/gadget.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 3ac170f..f84be3d
From: "Du, Changbin"
Signed-off-by: Du, Changbin
---
drivers/usb/dwc3/debugfs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
index 071b286..2d4f397 100644
--- a/drivers/usb/dwc3/debugfs.c
+++ b/drivers/usb/dwc3/debugfs.c
@@ -657,
From: "Du, Changbin"
The first patch removed unnecessary checking for debugfs api call;
The second patch fix a memory leak issue;
The third patch add one new entry to debufs.
Du, Changbin (3):
usb: dwc3: make dwc3_debugfs_init return value be void
usb: dwc3: free dwc->regset on dwc3_debugfs_
From: "Du, Changbin"
Debugfs init failure is not so important. We can continue our job on
this failure. Also no need to check debugfs_create_file call results.
Signed-off-by: Du, Changbin
---
drivers/usb/dwc3/core.c| 10 +-
drivers/usb/dwc3/debug.h | 6 +++---
drivers/usb/dwc3/d
From: "Du, Changbin"
For DWC3 USB controller, the Global Debug Queue/FIFO Space Available
Register(GDBGFIFOSPACE) can be used to dump FIFO/Queue available space.
This can be used to check some special issues, like whether data is
successfully copied from memory to fifo when a trb is blocked.
Sig
From: "Du, Changbin"
FIFO/Queue available space info can be used to debug dwc3 issues.
First we remove unnecessary checking for debugfs api call, then add
the new entry.
changes from v2:
1. Remove commit "usb: dwc3: free dwc->regset on dwc3_debugfs_exit"
Du, Changbin (2):
usb: dwc3: make d
From: "Du, Changbin"
For DWC3 USB controller, the Global Debug Queue/FIFO Space Available
Register(GDBGFIFOSPACE) can be used to dump FIFO/Queue available space.
This can be used to check some special issues, like whether data is
successfully copied from memory to fifo when a trb is blocked.
Sig
From: "Du, Changbin"
Debugfs init failure is not so important. We can continue our job on
this failure. Also no need to check debugfs_create_file call results.
Signed-off-by: Du, Changbin
---
changes from v2:
no changes
---
drivers/usb/dwc3/core.c| 10 +-
drivers/usb/dwc3/debug.
From: "Du, Changbin"
dwc->regset is allocated on dwc3_debugfs_init, and should
be released on dwc3_debugfs_exit.
Signed-off-by: Du, Changbin
---
This patch is seperated from patch set:
[PATCH v2 0/3] Improvement, fix and new entry for dwc3 debugfs
Because it is not related to other 2 patches.
From: "Du, Changbin"
dwc->regset is allocated on dwc3_debugfs_init, and should
be released on init failure or dwc3_debugfs_exit. Btw,
The line "dwc->root = NULL" is unnecessary, so remove it.
Signed-off-by: Du, Changbin
---
v2:
Title changed;
free dwc->regset on failure path.
---
drivers/
From: "Du, Changbin"
dwc->regset is allocated on dwc3_debugfs_init, and should
be released on init failure or dwc3_debugfs_exit. Btw,
The line "dwc->root = NULL" is unnecessary, so remove it.
Signed-off-by: Du, Changbin
---
v3:
remove unnecessary if(!NULL) for free
v2:
Title changed;
free
From: "Du, Changbin"
Debugfs init failure is not so important. We can continue our job on
this failure. Also no break need for debugfs_create_file call failure.
Signed-off-by: Du, Changbin
---
v4:
Do not fail silently, but print error.
---
drivers/usb/dwc3/core.c| 10 +
drivers/
From: "Du, Changbin"
For DWC3 USB controller, the Global Debug Queue/FIFO Space Available
Register(GDBGFIFOSPACE) can be used to dump FIFO/Queue available space.
This can be used to check some special issues, like whether data is
successfully copied from memory to fifo when a trb is blocked.
Sig
From: "Du, Changbin"
FIFO/Queue available space info can be used to debug dwc3 issues.
First we remove unnecessary checking for debugfs api call, then add
the new entry.
Du, Changbin (2):
usb: dwc3: make dwc3_debugfs_init return value be void
usb: dwc3: add debugfs node to dump FIFO/Queue av
From: "Du, Changbin"
The dwc3 controller can't generate a disconnect event after it is
stopped. Thus gadget dissconnect callback is not invoked when do
soft dissconnect. Call dissconnect here to workaround this issue.
Note, most time we still see disconnect be called that because
it is invoked b
From: "Du, Changbin"
On most platforms, there is only one device controller available.
In this case, we desn't care the UDC's name. So let's ignore the
name by setting 'UDC' to 'any'. And also we can change UDC name
at any time if it is not binded (no need set to "" first).
Signed-off-by: Du, Ch
From: "Du, Changbin"
When I am configuring Gadget Configfs, I need found a exactly UDC name before
I can start my gadget. But, really I doesn't care about which UDC name is used,
because I have only controller. "any" is a good option.
Du, Changbin (2):
usb: configfs: allow UDC binding rule con
From: "Du, Changbin"
Add the usage of new binding mode 'any'.
$ echo any > UDC
Signed-off-by: Du, Changbin
Signed-off-by: Du, Changbin
---
Documentation/usb/gadget_configfs.txt | 6 --
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/Documentation/usb/gadget_configfs.txt
b/D
From: "Du, Changbin"
With the first patch, enable a enabled ep will return -EBUSY.
The second patch forbid queuing on disabled ep to avoid panic.
Du, Changbin (2):
usb: dwc2: add ep enabled flag to avoid double enable/disable
usb: dwc2: forbid queuing request to a disabled ep
drivers/usb/d
From: "Du, Changbin"
Enabling a already enabled ep is illegal, because the ep may has trbs
running. Reprogram the ep may break running transfer. So udc driver
must avoid this happening by return an error -EBUSY. Gadget function
driver also should avoid such things, but that is out of udc driver.
From: "Du, Changbin"
Queue a request to disabled ep doesn't make sense, and induce caller
make mistakes.
Here is a example for the android mtp gadget function driver. A mem
corruption can happen on below senario.
1) On disconnect, mtp driver disable its EPs,
2) During send_file_work and receive
From: "Du, Changbin"
Queue a request to disabled ep doesn't make sense, and induce caller
make mistakes.
Here is a example for the android mtp gadget function driver. A mem
corruption can happen on below senario.
1) On disconnect, mtp driver disable its EPs,
2) During send_file_work and receive
From: "Du, Changbin"
When usb_ep_enable on a enabled ep, the configuration of the ep probably
has changed. In this scenario, the ep configuration in hw should be
reprogrammed by udc driver. Hence, it is better to return an error to
inform the caller.
Signed-off-by: Du, Changbin
---
include/lin
From: "Du, Changbin"
To stop an out endpoint, software should set sets the Global OUT NAK,
but not the Global Non-periodic IN NAK. This driver bug leads the out-ep
failed be in disabled state with below error.
dwc2_hsotg_ep_stop_xfr: timeout DOEPCTL.EPDisable
Signed-off-by: Du, Changbin
---
d
34 matches
Mail list logo
