Skip to content

Commit 080ebb1

Browse files
torvaldstorvalds
committed
Merge tag 'usb-4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH: "Here are a number of USB fixes for reported issues for your tree. The normal amount of gadget fixes, xhci fixes, new device ids, and a few other minor things. All of them have been in linux-next for a while, the full details are in the shortlog below" * tag 'usb-4.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (43 commits) xhci: don't dereference a xhci member after removing xhci usb: xhci: Fix panic if disconnect xhci: really enqueue zero length TRBs. xhci: always handle "Command Ring Stopped" events cdc-acm: fix wrong pipe type on rx interrupt xfers usb: misc: usbtest: add fix for driver hang usb: dwc3: gadget: stop processing on HWO set usb: dwc3: don't set last bit for ISOC endpoints usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG usb: udc: core: fix error handling usb: gadget: fsl_qe_udc: off by one in setup_received_handle() usb/gadget: fix gadgetfs aio support. usb: gadget: composite: Fix return value in case of error usb: gadget: uvc: Fix return value in case of error usb: gadget: fix check in sync read from ep in gadgetfs usb: misc: usbtest: usbtest_do_ioctl may return positive integer usb: dwc3: fix missing platform_set_drvdata() in dwc3_of_simple_probe() usb: phy: omap-otg: Fix missing platform_set_drvdata() in omap_otg_probe() usb: gadget: configfs: add mutex lock before unregister gadget usb: gadget: u_ether: fix dereference after null check coverify warning ...
2 parents a8414fa + f1f6d9a commit 080ebb1

31 files changed

+215
-79
lines changed

‎drivers/usb/class/cdc-acm.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1354,7 +1354,6 @@ static int acm_probe(struct usb_interface *intf,
13541354
spin_lock_init(&acm->write_lock);
13551355
spin_lock_init(&acm->read_lock);
13561356
mutex_init(&acm->mutex);
1357-
acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
13581357
acm->is_int_ep = usb_endpoint_xfer_int(epread);
13591358
if (acm->is_int_ep)
13601359
acm->bInterval = epread->bInterval;
@@ -1394,14 +1393,14 @@ static int acm_probe(struct usb_interface *intf,
13941393
urb->transfer_dma = rb->dma;
13951394
if (acm->is_int_ep) {
13961395
usb_fill_int_urb(urb, acm->dev,
1397-
acm->rx_endpoint,
1396+
usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
13981397
rb->base,
13991398
acm->readsize,
14001399
acm_read_bulk_callback, rb,
14011400
acm->bInterval);
14021401
} else {
14031402
usb_fill_bulk_urb(urb, acm->dev,
1404-
acm->rx_endpoint,
1403+
usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
14051404
rb->base,
14061405
acm->readsize,
14071406
acm_read_bulk_callback, rb);

‎drivers/usb/class/cdc-acm.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,6 @@ struct acm {
9696
struct acm_rb read_buffers[ACM_NR];
9797
struct acm_wb *putbuffer; /* for acm_tty_put_char() */
9898
int rx_buflimit;
99-
int rx_endpoint;
10099
spinlock_t read_lock;
101100
int write_used; /* number of non-empty write buffers */
102101
int transmitting;

‎drivers/usb/core/config.c

Lines changed: 63 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
171171
ep, buffer, size);
172172
}
173173

174+
static const unsigned short low_speed_maxpacket_maxes[4] = {
175+
[USB_ENDPOINT_XFER_CONTROL] = 8,
176+
[USB_ENDPOINT_XFER_ISOC] = 0,
177+
[USB_ENDPOINT_XFER_BULK] = 0,
178+
[USB_ENDPOINT_XFER_INT] = 8,
179+
};
180+
static const unsigned short full_speed_maxpacket_maxes[4] = {
181+
[USB_ENDPOINT_XFER_CONTROL] = 64,
182+
[USB_ENDPOINT_XFER_ISOC] = 1023,
183+
[USB_ENDPOINT_XFER_BULK] = 64,
184+
[USB_ENDPOINT_XFER_INT] = 64,
185+
};
186+
static const unsigned short high_speed_maxpacket_maxes[4] = {
187+
[USB_ENDPOINT_XFER_CONTROL] = 64,
188+
[USB_ENDPOINT_XFER_ISOC] = 1024,
189+
[USB_ENDPOINT_XFER_BULK] = 512,
190+
[USB_ENDPOINT_XFER_INT] = 1023,
191+
};
192+
static const unsigned short super_speed_maxpacket_maxes[4] = {
193+
[USB_ENDPOINT_XFER_CONTROL] = 512,
194+
[USB_ENDPOINT_XFER_ISOC] = 1024,
195+
[USB_ENDPOINT_XFER_BULK] = 1024,
196+
[USB_ENDPOINT_XFER_INT] = 1024,
197+
};
198+
174199
static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
175200
int asnum, struct usb_host_interface *ifp, int num_ep,
176201
unsigned char *buffer, int size)
@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
179204
struct usb_endpoint_descriptor *d;
180205
struct usb_host_endpoint *endpoint;
181206
int n, i, j, retval;
207+
unsigned int maxp;
208+
const unsigned short *maxpacket_maxes;
182209

183210
d = (struct usb_endpoint_descriptor *) buffer;
184211
buffer += d->bLength;
@@ -286,16 +313,49 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
286313
endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
287314
}
288315

316+
/* Validate the wMaxPacketSize field */
317+
maxp = usb_endpoint_maxp(&endpoint->desc);
318+
319+
/* Find the highest legal maxpacket size for this endpoint */
320+
i = 0; /* additional transactions per microframe */
321+
switch (to_usb_device(ddev)->speed) {
322+
case USB_SPEED_LOW:
323+
maxpacket_maxes = low_speed_maxpacket_maxes;
324+
break;
325+
case USB_SPEED_FULL:
326+
maxpacket_maxes = full_speed_maxpacket_maxes;
327+
break;
328+
case USB_SPEED_HIGH:
329+
/* Bits 12..11 are allowed only for HS periodic endpoints */
330+
if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
331+
i = maxp & (BIT(12) | BIT(11));
332+
maxp &= ~i;
333+
}
334+
/* fallthrough */
335+
default:
336+
maxpacket_maxes = high_speed_maxpacket_maxes;
337+
break;
338+
case USB_SPEED_SUPER:
339+
case USB_SPEED_SUPER_PLUS:
340+
maxpacket_maxes = super_speed_maxpacket_maxes;
341+
break;
342+
}
343+
j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
344+
345+
if (maxp > j) {
346+
dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
347+
cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
348+
maxp = j;
349+
endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
350+
}
351+
289352
/*
290353
* Some buggy high speed devices have bulk endpoints using
291354
* maxpacket sizes other than 512. High speed HCDs may not
292355
* be able to handle that particular bug, so let's warn...
293356
*/
294357
if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
295358
&& usb_endpoint_xfer_bulk(d)) {
296-
unsigned maxp;
297-
298-
maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
299359
if (maxp != 512)
300360
dev_warn(ddev, "config %d interface %d altsetting %d "
301361
"bulk endpoint 0x%X has invalid maxpacket %d\n",

‎drivers/usb/core/devio.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
241241
goto error_decrease_mem;
242242
}
243243

244-
mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
244+
mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
245+
&dma_handle);
245246
if (!mem) {
246247
ret = -ENOMEM;
247248
goto error_free_usbm;
@@ -2582,7 +2583,9 @@ static unsigned int usbdev_poll(struct file *file,
25822583
if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
25832584
mask |= POLLOUT | POLLWRNORM;
25842585
if (!connected(ps))
2585-
mask |= POLLERR | POLLHUP;
2586+
mask |= POLLHUP;
2587+
if (list_empty(&ps->list))
2588+
mask |= POLLERR;
25862589
return mask;
25872590
}
25882591

‎drivers/usb/core/hub.c

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
10521052

10531053
/* Continue a partial initialization */
10541054
if (type == HUB_INIT2 || type == HUB_INIT3) {
1055-
device_lock(hub->intfdev);
1055+
device_lock(&hdev->dev);
10561056

10571057
/* Was the hub disconnected while we were waiting? */
1058-
if (hub->disconnected) {
1059-
device_unlock(hub->intfdev);
1060-
kref_put(&hub->kref, hub_release);
1061-
return;
1062-
}
1058+
if (hub->disconnected)
1059+
goto disconnected;
10631060
if (type == HUB_INIT2)
10641061
goto init2;
10651062
goto init3;
@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
12621259
queue_delayed_work(system_power_efficient_wq,
12631260
&hub->init_work,
12641261
msecs_to_jiffies(delay));
1265-
device_unlock(hub->intfdev);
1262+
device_unlock(&hdev->dev);
12661263
return; /* Continues at init3: below */
12671264
} else {
12681265
msleep(delay);
@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
12811278
/* Scan all ports that need attention */
12821279
kick_hub_wq(hub);
12831280

1284-
/* Allow autosuspend if it was suppressed */
1285-
if (type <= HUB_INIT3)
1281+
if (type == HUB_INIT2 || type == HUB_INIT3) {
1282+
/* Allow autosuspend if it was suppressed */
1283+
disconnected:
12861284
usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
1287-
1288-
if (type == HUB_INIT2 || type == HUB_INIT3)
1289-
device_unlock(hub->intfdev);
1285+
device_unlock(&hdev->dev);
1286+
}
12901287

12911288
kref_put(&hub->kref, hub_release);
12921289
}
@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
13151312
struct usb_device *hdev = hub->hdev;
13161313
int i;
13171314

1318-
cancel_delayed_work_sync(&hub->init_work);
1319-
13201315
/* hub_wq and related activity won't re-trigger */
13211316
hub->quiescing = 1;
13221317

‎drivers/usb/dwc3/dwc3-of-simple.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ static int dwc3_of_simple_probe(struct platform_device *pdev)
6161
if (!simple->clks)
6262
return -ENOMEM;
6363

64+
platform_set_drvdata(pdev, simple);
6465
simple->dev = dev;
6566

6667
for (i = 0; i < simple->num_clocks; i++) {

‎drivers/usb/dwc3/dwc3-pci.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
#define PCI_DEVICE_ID_INTEL_BXT 0x0aaa
3838
#define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa
3939
#define PCI_DEVICE_ID_INTEL_APL 0x5aaa
40+
#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0
4041

4142
static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
4243
static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
@@ -227,6 +228,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
227228
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
228229
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
229230
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
231+
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
230232
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
231233
{ } /* Terminating Entry */
232234
};

‎drivers/usb/dwc3/gadget.c

Lines changed: 33 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -829,7 +829,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
829829
if (!req->request.no_interrupt && !chain)
830830
trb->ctrl |= DWC3_TRB_CTRL_IOC | DWC3_TRB_CTRL_ISP_IMI;
831831

832-
if (last)
832+
if (last && !usb_endpoint_xfer_isoc(dep->endpoint.desc))
833833
trb->ctrl |= DWC3_TRB_CTRL_LST;
834834

835835
if (chain)
@@ -1955,7 +1955,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
19551955

19561956
static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
19571957
struct dwc3_request *req, struct dwc3_trb *trb,
1958-
const struct dwc3_event_depevt *event, int status)
1958+
const struct dwc3_event_depevt *event, int status,
1959+
int chain)
19591960
{
19601961
unsigned int count;
19611962
unsigned int s_pkt = 0;
@@ -1964,17 +1965,22 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
19641965
dep->queued_requests--;
19651966
trace_dwc3_complete_trb(dep, trb);
19661967

1968+
/*
1969+
* If we're in the middle of series of chained TRBs and we
1970+
* receive a short transfer along the way, DWC3 will skip
1971+
* through all TRBs including the last TRB in the chain (the
1972+
* where CHN bit is zero. DWC3 will also avoid clearing HWO
1973+
* bit and SW has to do it manually.
1974+
*
1975+
* We're going to do that here to avoid problems of HW trying
1976+
* to use bogus TRBs for transfers.
1977+
*/
1978+
if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
1979+
trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
1980+
19671981
if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
1968-
/*
1969-
* We continue despite the error. There is not much we
1970-
* can do. If we don't clean it up we loop forever. If
1971-
* we skip the TRB then it gets overwritten after a
1972-
* while since we use them in a ring buffer. A BUG()
1973-
* would help. Lets hope that if this occurs, someone
1974-
* fixes the root cause instead of looking away :)
1975-
*/
1976-
dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
1977-
dep->name, trb);
1982+
return 1;
1983+
19781984
count = trb->size & DWC3_TRB_SIZE_MASK;
19791985

19801986
if (dep->direction) {
@@ -2013,15 +2019,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
20132019
s_pkt = 1;
20142020
}
20152021

2016-
/*
2017-
* We assume here we will always receive the entire data block
2018-
* which we should receive. Meaning, if we program RX to
2019-
* receive 4K but we receive only 2K, we assume that's all we
2020-
* should receive and we simply bounce the request back to the
2021-
* gadget driver for further processing.
2022-
*/
2023-
req->request.actual += req->request.length - count;
2024-
if (s_pkt)
2022+
if (s_pkt && !chain)
20252023
return 1;
20262024
if ((event->status & DEPEVT_STATUS_LST) &&
20272025
(trb->ctrl & (DWC3_TRB_CTRL_LST |
@@ -2040,27 +2038,40 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
20402038
struct dwc3_trb *trb;
20412039
unsigned int slot;
20422040
unsigned int i;
2041+
int count = 0;
20432042
int ret;
20442043

20452044
do {
2045+
int chain;
2046+
20462047
req = next_request(&dep->started_list);
20472048
if (WARN_ON_ONCE(!req))
20482049
return 1;
20492050

2051+
chain = req->request.num_mapped_sgs > 0;
20502052
i = 0;
20512053
do {
20522054
slot = req->first_trb_index + i;
20532055
if (slot == DWC3_TRB_NUM - 1)
20542056
slot++;
20552057
slot %= DWC3_TRB_NUM;
20562058
trb = &dep->trb_pool[slot];
2059+
count += trb->size & DWC3_TRB_SIZE_MASK;
20572060

20582061
ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
2059-
event, status);
2062+
event, status, chain);
20602063
if (ret)
20612064
break;
20622065
} while (++i < req->request.num_mapped_sgs);
20632066

2067+
/*
2068+
* We assume here we will always receive the entire data block
2069+
* which we should receive. Meaning, if we program RX to
2070+
* receive 4K but we receive only 2K, we assume that's all we
2071+
* should receive and we simply bounce the request back to the
2072+
* gadget driver for further processing.
2073+
*/
2074+
req->request.actual += req->request.length - count;
20642075
dwc3_gadget_giveback(dep, req, status);
20652076

20662077
if (ret)

‎drivers/usb/gadget/composite.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1913,6 +1913,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
19131913
break;
19141914

19151915
case USB_RECIP_ENDPOINT:
1916+
if (!cdev->config)
1917+
break;
19161918
endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
19171919
list_for_each_entry(f, &cdev->config->functions, list) {
19181920
if (test_bit(endp, f->endpoints))
@@ -2124,14 +2126,14 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev,
21242126

21252127
cdev->os_desc_req = usb_ep_alloc_request(ep0, GFP_KERNEL);
21262128
if (!cdev->os_desc_req) {
2127-
ret = PTR_ERR(cdev->os_desc_req);
2129+
ret = -ENOMEM;
21282130
goto end;
21292131
}
21302132

21312133
/* OS feature descriptor length <= 4kB */
21322134
cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL);
21332135
if (!cdev->os_desc_req->buf) {
2134-
ret = PTR_ERR(cdev->os_desc_req->buf);
2136+
ret = -ENOMEM;
21352137
kfree(cdev->os_desc_req);
21362138
goto end;
21372139
}

‎drivers/usb/gadget/configfs.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1490,7 +1490,9 @@ void unregister_gadget_item(struct config_item *item)
14901490
{
14911491
struct gadget_info *gi = to_gadget_info(item);
14921492

1493+
mutex_lock(&gi->lock);
14931494
unregister_gadget(gi);
1495+
mutex_unlock(&gi->lock);
14941496
}
14951497
EXPORT_SYMBOL_GPL(unregister_gadget_item);
14961498

‎drivers/usb/gadget/function/rndis.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params *params,
680680
{
681681
rndis_reset_cmplt_type *resp;
682682
rndis_resp_t *r;
683+
u8 *xbuf;
684+
u32 length;
685+
686+
/* drain the response queue */
687+
while ((xbuf = rndis_get_next_response(params, &length)))
688+
rndis_free_response(params, xbuf);
683689

684690
r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
685691
if (!r)

‎drivers/usb/gadget/function/u_ether.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -556,7 +556,8 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
556556
/* Multi frame CDC protocols may store the frame for
557557
* later which is not a dropped frame.
558558
*/
559-
if (dev->port_usb->supports_multi_frame)
559+
if (dev->port_usb &&
560+
dev->port_usb->supports_multi_frame)
560561
goto multiframe;
561562
goto drop;
562563
}

0 commit comments

Comments
 (0)