Add some helpful notes about how the driver works around different
anomalies that exist in the on-chip host controller.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Do not allow MUSB driver to be selected on derivatives that don't have the
MUSB controller on them.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The Blackfin version of musb_read_target_reg_base() returns a u16 when the
common code expects a (void __iomem *), so update the Blackfin function to
return the right value. This fixes the compile warning:
drivers/usb/musb/musb_core.c: In function 'musb_core_init':
drivers/usb/musb/musb_core.c:1448: warning: assignment makes pointer from
integer without a cast
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Otherwise gcc will whine about epnum/dma_reg being unused when building
for BF54x parts.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The xHCI 0.95 and 0.96 specification defines several transfer buffer
request completion codes that indicate a USB transaction error occurred.
When a stall, babble, transaction, or split transaction error completion code
is set, the xHCI has halted that endpoint ring. Software must issue a
Reset Endpoint command and a Set Transfer Ring Dequeue Pointer command
to clean up the halted ring.
The USB device driver is supposed to call into usb_reset_endpoint() when
an endpoint stalls. That calls into the xHCI driver to issue the proper
commands. However, drivers don't call that function for the other
errors that cause the xHC to halt the endpoint ring. If a babble,
transaction, or split transaction error occurs, check if the endpoint
context reports a halted condition, and clean up the endpoint ring if it
does.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
An xHCI host controller manufacturer can choose to implement several
vendor-specific informational completion codes. These are all to be
treated like a successful transfer completion.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When the xHCI hardware says a transfer completed with a split
transaction error, set the URB status to -EPROTO.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The transfer descriptor (TD) is a series of transfer request buffers
(TRBs) that describe the buffer pointer, length, and other
characteristics. The xHCI controllers want to know an estimate of how
long the TD is, for caching reasons. In each TRB, there is a "TD size"
field that provides a rough estimate of the remaining buffers to be
transmitted, including the buffer pointed to by that TRB.
The TD size is 5 bits long, and contains the remaining size in bytes,
right shifted by 10 bits. So a remaining TD size less than 1024 would get
a zero in the TD size field, and a remaining size greater than 32767 would
get 31 in the field.
This patches fixes a bug in the TD_REMAINDER macro that is triggered when
the URB has a scatter gather list with a size bigger than 32767 bytes.
Not all host controllers pay attention to the TD size field, so the bug
will not appear on all USB 3.0 hosts.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The Multifunction Composite Gadget has two configurations
consisting of Ethernet (RNDIS in first and CDC Ethernet in
second configuration), CDC Serial and File-backed Storage
functions.
When connected to a Windows host, the first configuration
is chosen thus gadget provides RNDIS Ethernet, serial and
mass storage whereas when connected to Linux host, second
configuration is chosen thus providing CDC Ethernet,
serial and mass storage.
Which configurations are built can be configured via
KConfig options.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
thread_exits callback has been added to fsg_common structure.
This callback is called when MSF's thread exits (is terminated
by a signal or function is unregistered). It's then gadget's
responsibility to unregister the gadget.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Changed definition of usb_composite_unregister() function
removing __exit declaration. This way, the function is
included even if the whole code was not compiled as module.
This is required if a compiled-in code would like to
unregister a composite gadget.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Most of the data from fsg_dev have been moved to fsg_common
structure. The fsg_dev structure holds only endpoint dependent
data. The fsg_common structure has a fsg pointer which points
to active fsg_dev structure -- endpoints are referenced via this
pointer.
This fixes the problem of several threads created when a single
instance of MSF is used in several USB configurations.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fixed most of the errors and warnings in f_mass_storage.c and
storage_common.c reported by checkpatch.pl as well as updated
comments.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
A two fsg_config fields were added:
* lun_name_format which lets one specify format of a name
used when registering LUN devices. It is useful if there
would be ever need for two MSFs to be used in a single
composite gadget (as opposed to single MSF in two
configuration); and
* thread_name which lets one specify the name of a kernel
thread used by MSF. This is not required since two or more
threads can have the same name but nevertheless it's here
for consistency.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Removed all references to mod_data in f_mass_storage.c and
instead created fsg_config structure fsg_common_init() takes
as an argument -- it stores all configuration options that
were previously taken from mod_data.
Moreover, The fsg_config structure allows per-LUN
configuration of removable and CD-ROM emulation.
Module parameters are handled by defining an object of
fsg_module_parameters structure and then declaring module
parameters via FSG_MODULE_PARAMETERS() macro. It adds proper
declarations to the code making specified object be populated
from module parameters.
To use values stored there one may use either
fsg_config_from_params() which will will a fsg_config structure
with values taken from fsg_module_parameters structure or
fsg_common_from_params() which will initialise fsg_common
structure directly.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The f_mass_storage.c has been changed into a composite function.
mass_storage.c file has been introduced which defines a
g_mass_storage gadget based on composite framework.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
It's not surprising that the transfer request buffer (TRB) physical to
virtual address translation function has bugs in it, since I wrote most of
it at 4am last October. Add a test suite to check the TRB math. This
runs at memory initialization time, and causes the driver to fail to load
if the TRB math fails.
Please excuse the excessively long lines in the test vectors; they can't
really be made shorter and still be readable.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Allow module_param to be writeable. This allows us to change
the parameter if usbtest is built-in in the kernel.
Signed-off-by: Vikram Pandita <vikram.pandita@ti.com>
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Add a missing goto. We dereference usb_class on the next line.
Found by smatch static checker.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
td and dev can not be null.
Also they are dereferenced in list_for_each_entry_safe and list_for_each
before the check happens so we would have an oops if it were possible
for them to be null.
Found using the smatch static checker.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1302) removes the auto_pm flag from struct usb_device.
The flag's only purpose was to distinguish between autosuspends and
external suspends, but that information is now available in the
pm_message_t argument passed to suspend methods.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Quiet the following sparse noise:
warning: Using plain integer as NULL pointer
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device
has 4 interfaces, of which 1 is handled by storage and the other 3 by
option driver.
The device appears first as CD-only 05c6:2100 device and must be switched
to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch.
The MessageContent for usb_modeswitch.conf is:
"55534243e0c26a85000000000000061b000000020000000000000000000000"
Signed-off-by: Zhang Le <r0bertz@gentoo.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB drivers that create character devices call usb_register_dev in their
probe function. This associates the usb_interface device with that minor
number and creates the character device and announces it to the world.
However, the driver's probe function is called before the new
usb_interface is added to the driver's klist_devices.
This is a problem because userspace will respond to the character device
creation announcement by opening the character device. The driver's open
function will the call usb_find_interface to find the usb_interface
associated with that minor number. usb_find_interface will walk the
driver's list of devices and find the usb_interface with the matching
minor number.
Because the announcement happens before the usb_interface is added to the
driver's klist_devices, a race condition exists. A straightforward fix
is to walk the list of devices on usb_bus_type instead since the device
is added to that list before the announcement occurs.
bus_find_device calls get_device to bump the reference count on the found
device. It is arguable that the reference count should be dropped by the
caller of usb_find_interface instead of usb_find_interface, however,
the current users of usb_find_interface do not expect this.
Signed-off-by: Russ Dill <Russ.Dill@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
istl_flip is a signed bitfield of one bit so it can be -1 or 0.
However in drivers/usb/host/isp1362-hcd.c:1103:
finish_iso_transfers(isp1362_hcd,
&isp1362_hcd->istl_queue[isp1362_hcd->istl_flip]);
So if isp1362_hcd->istl_flip is set, the 2nd argument becomes
&isp1362_hcd->istl_queue[-1], which is invalid.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch fixes a bug when incrementing/decrementing on a BCD formatted
integer (i.e. 0x09++ should be 0x10 not 0x0A). It just adds a function
for incrementing/decrementing BCD integers by converting to decimal,
doing the increment/decrement and then converting back to BCD.
Signed-off-by: Nathaniel McCallum <nathaniel@natemccallum.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The current code to generate usb modaliases from usb_device_id assumes
that the device's bcdDevice descriptor will actually be in BCD format.
While this should be a sane assumption, some devices don't follow spec
and just use plain old hex. This causes drivers for these devices to
generate invalid modalias lines which will never actually match for the
hardware.
The following patch adds hex support for bcdDevice in file2alias.c by
detecting when a driver uses a hex formatted bcdDevice_(lo|hi) and
adjusts the output to hex format accordingly.
Drivers for devices which have bcdDevice conforming to BCD will have no
change in modalias output. Drivers for devices which don't conform
(i.e. ibmcam) should now generate valid modaliases.
EXAMPLE OUTPUT (ibmcam; space added to highlight change)
Old: usb:v0545p800D d030[10-9] dc*dsc*dp*ic*isc*ip*
New: usb:v0545p800D d030a dc*dsc*dp*ic*isc*ip*
Signed-off-by: Nathaniel McCallum <nathaniel@natemccallum.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Nokia S60 phones expose two ACM channels. The first is a modem and is picked
up by the standard AT-command interface information in the CDC-ACM driver. The
second is marked as having a vendor-specific protocol. Normally, we don't
expose those as ttys. (On some other devices, they may be claimed by the
rndis_host driver and used as a network interface).
But on S60 this second ACM channel is the way that third-party S60 application
developers are expected to communicate over USB. It acts as a serial device
at the S60 end, and so it should on Linux too.
The list of devices is largely derived from:
http://wiki.forum.nokia.com/index.php/S60_Platform_and_device_identification_codeshttp://wiki.forum.nokia.com/index.php/Nokia_USB_Product_IDs
and includes only the S60 3rd Edition+ devices documented there.
There are many devices for which the USB device ID is not documented,
including:
Nokia 6290
Nokia E63
Nokia 5630 XpressMusic
Nokia 5730 XpressMusic
Nokia 6710 Navigator
Nokia 6720 classic
Nokia 6730 Classic
Nokia 6760 slide
Nokia 6790 slide
Nokia 6790 Surge
Nokia E52
Nokia E55
Nokia E71x (AT&T)
Nokia E72
Nokia E75
Nokia E75 US+LTA variant
Nokia N79
Nokia N86 8MP
Nokia 5230 (RM-588)
Nokia 5230 (RM-594)
Nokia 5530 XpressMusic
Nokia 5530 XpressMusic (china)
Nokia 5800 XM
Nokia N97 (RM-506)
Nokia N97 mini
Nokia X6
It would be good to add those subsequently.
Signed-off-by: Adrian Taylor <aat@realvnc.com>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
In map_urb_for_dma(), the DMA address returned by dma_map_single()
is not checked to determine if it is legal. This lack of checking
contributed to a problem with the libertas wireless driver
(http://marc.info/?l=linux-wireless&m=125695331205062&w=2). The
difficulty was not detected until the buffer was unmapped. By this time
memory corruption had occurred.
The situation is fixed by testing the returned DMA address, and
returning -EAGAIN if the address is invalid.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
usb: ehci: Allow EHCI to be built on OMAP3
OMAP3 chips have a built-in EHCI controller.
The recently introduced omap ehci-hcd driver missed
out on selecting USB_ARCH_HAS_EHCI in Kconfig.
Without this, the driver cannot be built.
Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Cc: Vikram Pandita <vikram.pandita@ti.com>
Cc: Ajay Kumar Gupta <ajay.gupta@ti.com>
Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1301) adds support to usbmon for scatter-gather URBs.
The text interface looks at only the first scatterlist element, since
it never copies more than 32 bytes of data anyway. The binary
interface copies as much data as possible up to the first
non-addressable buffer.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1300) adds native scatter-gather support to ehci-hcd.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch deals with reducing the memory footprint for sierra driver.
This optimization is aimed for embedded software customers.
Some sierra modems can expose upwards of 7 USB interfaces, each possibly
offering different services. In general, interfaces used for the
exchange of wireless data require much higher throughput, hence require
more memory (i.e. more URBs) than lower performance interfaces. URBs
used for the IN direction are pre-allocated by the driver and this patch
introduces a way to configure the number of IN URBs allocated on a
per-interface basis. Interfaces with lower throughput requirements
receive fewer URBs, thereby reducing the RAM memory consumed by the
driver.
NOTE1: This driver has always pre-allocated URBs for the IN direction.
NOTE2: The number of URBs pre-allocated for the low-performance
interfaces has already been extensively tested in previous versions of
this driver.
We also added the capability to log function calls by adding DEBUG flag.
Please note that this flag is commented out because this is the default
state
for it.
Signed-off-by: Elina Pasheva <epasheva@sierrawireless.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Without Interface Association Descriptor, the CDC serial and
RNDIS functions did not work correctly when added to a
composite gadget with other functions. This is because, it
defined two interfaces and some hosts tried to treat each
interface separatelly.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Moved code initialising fsg_common structure to fsg_common_init()
function which is called from fsg_bind(). Moreover, changed
reference counting mechanism: fsg_common has a reference counter
which counts how many fsg_dev structures uses it. When this
reaches zero fsg_common_release() is run which unregisters
LUN devices and frees memory.
fsg_common_init() takes pointer to fsg_common structure as an
argument. If it is NULL function allocates storage otherwise
uses pointed to memory (handy if fsg_common is a field of another
structure or a static variable).
fsg_common_release() will free storage only if
free_storage_on_release is set -- it is initialised by
fsg_common_init(): set if allocation was done, unset
otherwise (one may overwrite it of course).
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Using version of fsg_buffhd structure with buf field being an
array of characters with predefined size. Since mass storage
function does not define changing buffer size on run-time it is
not required for the field to be a pointer to void and allocating
space dynamically.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
In the final version, many fsg_dev structures will (be able to)
refer to a single fsg_common structure and so it is required
to move common data to another object which can be shared.
Situation where many fsg_dev structures refer single fsg_common
structure is when a single instance of MSF is used in several
USB configurations.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Removed code that was included when CONFIG_USB_FILE_STORAGE_TEST
was defined. If this functionality is required one may still use
the original File-backed Storage Gadget. It has been agreed that
testing functionality is not required in the composite function.
Also removed fsg_suspend() and fsg_resume() which were no
operations.
Moreover, storage_common.c has been modified in such a way that
defining certain macros skips parts of the file. Those macros
are:
* FSG_NO_INTR_EP -- skips interrupt endpoint descriptors
* FSG_NO_DEVICE_STRINGS -- skips certain strings
* FSG_NO_OTG -- skips OTG descriptor
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Copied file_storage.c to f_mass_storage.c which will be used as
template for the Mass Storage composite Function.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Since storage_common.c no longer references mod_data object
it is now possible to include it before mod_data object is
defined. This makes it possible to move some defines that
are used as default values of mod_data fields to be defined
in storage_common.c file (where they should be set from
the beginning).
Also, show_ro(), show_file(), store_ro() and store_file()
have been moved to storage_common.c with LUN's device's
drvdata changed from pointing to fsg_dev to pointing to
rw_semaphore (&fsg->filesem).
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
removable and cdrom flag has been added to the fsg_lun structure
removing any references to mod_data object from storage_common.c.
As of read-only flag, previously it was set if a read-only
backing file was specified (which is good) and remained set
even after the file has been closed (which may be considered an
issue). Currently, the initial read-only flag is preserved so
if it was unset each time file is opened code will try to open
it read-write even if previous file was opened read-only.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Prefixed some identifiers that were defined in storage_common.c file
with "fsg_". Not all identifiers were prefixed but the ones that are
most likely to produce conflicts when used with other USB functions.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Moved parts of the file_storage.c file which do not reference fsg_dev
structure to newly created storage_common.c file. dump_msg() and
dump_cdb() have been changed to macros to remove fsg_dev reference.
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Sonic Zhang