summaryrefslogtreecommitdiff
path: root/drivers/usb
AgeCommit message (Collapse)Author
2019-10-10USB: legousbtower: fix use-after-free on releaseJohan Hovold
The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro") Cc: stable <stable@vger.kernel.org> # 3.12 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191009153848.8664-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: cdns3: Fix for incorrect DMA mask.Pawel Laszczak
This patch restores the correct DMA mask after switching back to device mode. The issue occurred because Device part of controller use 32 bits DMA and Host side use 64 bits DMA. During loading XHCI driver the DMA mask used by driver is overwritten by XHCI driver so it must be restored to 32 bits. Reported-by: Pawel Laszczak <pawell@cadence.com> Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Pawel Laszczak <pawell@cadence.com> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Reviewed-by: Peter Chen <peter.chen@nxp.com> Tested-by: Roger Quadros <rogerq@ti.com> Link: https://lore.kernel.org/r/1570449803-15299-1-git-send-email-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: cdns3: fix cdns3_core_init_role()Roger Quadros
At startup we should trigger the HW state machine only if it is OTG mode. Otherwise we should just start the respective role. Initialize idle role by default. If we don't do this then cdns3_idle_role_stop() is not called when switching to host/device role and so lane switch mechanism doesn't work. This results to super-speed device not working in one orientation if it was plugged before driver probe. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Sekhar Nori <nsekhar@ti.com> Link: https://lore.kernel.org/r/20191007121601.25996-2-rogerq@ti.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: cdns3: gadget: Fix full-speed modeRoger Quadros
We need to disable USB3 PHY for full-speed mode else gadget mode is broken. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Sekhar Nori <nsekhar@ti.com> Reviewed-by: Peter Chen <peter.chen@nxp.com> Link: https://lore.kernel.org/r/20191007121601.25996-3-rogerq@ti.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10USB: usb-skeleton: drop redundant in-urb checkJohan Hovold
The driver bails out at probe if we can't find a bulk-in endpoint or if we fail to allocate the URB, so drop the check in read(). Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191009170944.30057-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10USB: usb-skeleton: fix use-after-free after driver unbindJohan Hovold
The driver failed to stop its read URB on disconnect, something which could lead to a use-after-free in the completion handler after driver unbind in case the character device has been closed. Fixes: e7389cc9a7ff ("USB: skel_read really sucks royally") Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191009170944.30057-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10USB: usb-skeleton: fix NULL-deref on disconnectJohan Hovold
The driver was using its struct usb_interface pointer as an inverted disconnected flag and was setting it to NULL before making sure all completion handlers had run. This could lead to NULL-pointer dereferences in the dev_err() statements in the completion handlers which relies on said pointer. Fix this by using a dedicated disconnected flag. Note that this is also addresses a NULL-pointer dereference at release() and a struct usb_interface reference leak introduced by a recent runtime PM fix, which depends on and should have been submitted together with this patch. Fixes: 4212cd74ca6f ("USB: usb-skeleton.c: remove err() usage") Fixes: 5c290a5e42c3 ("USB: usb-skeleton: fix runtime PM after driver unbind") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191009170944.30057-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: typec: remove duplicated include from hd3ss3220.cYueHaibing
Remove duplicated include. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Link: https://lore.kernel.org/r/20191009120449.44899-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: core: devio.c: Fix assignment of 0/1 to bool variablesSaurav Girepunje
Use true/false for is_in bool type in function proc_do_submiturb. Signed-off-by: Saurav Girepunje <saurav.girepunje@gmail.com> Link: https://lore.kernel.org/r/20191007182649.GA7068@saurav Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10USB: core: drop OOM messageJohan Hovold
Drop redundant OOM message on allocation failures which would already have been logged by the allocator. This also allows us to clean up the error paths somewhat. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191008090240.30376-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: typec: hd3ss3220: hd3ss3220_probe() warn: passing zero to 'PTR_ERR'Biju Das
This patch fixes the warning passing zero to 'PTR_ERR' by changing the check from 'IS_ERR_OR_NULL' to 'IS_ERR'. Also improved the error handling on probe function. Fixes: 1c48c759ef4b ("usb: typec: driver for TI HD3SS3220 USB Type-C DRP port controller") Reported-by: kbuild test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Biju Das <biju.das@bp.renesas.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/1570462729-25722-1-git-send-email-biju.das@bp.renesas.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: hub: Check device descriptor before resusciationDavid Heinzelmann
If a device connected to an xHCI host controller disconnects from the USB bus and then reconnects, e.g. triggered by a firmware update, then the host controller automatically activates the connection and the port is enabled. The implementation of hub_port_connect_change() assumes that if the port is enabled then nothing has changed. There is no check if the USB descriptors have changed. As a result, the kernel's internal copy of the descriptors ends up being incorrect and the device doesn't work properly anymore. The solution to the problem is for hub_port_connect_change() always to check whether the device's descriptors have changed before resuscitating an enabled port. Signed-off-by: David Heinzelmann <heinzelmann.david@gmail.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/20191009044647.24536-1-heinzelmann.david@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: gadget: Remove set but not used variable 'opts' in msg_do_configzhengbin
Fixes gcc '-Wunused-but-set-variable' warning: drivers/usb/gadget/legacy/mass_storage.c: In function msg_do_config: drivers/usb/gadget/legacy/mass_storage.c:108:19: warning: variable opts set but not used [-Wunused-but-set-variable] It is not used since commit f78bbcae86e6 ("usb: f_mass_storage: test whether thread is running before starting another") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: zhengbin <zhengbin13@huawei.com> Link: https://lore.kernel.org/r/1570610434-68293-3-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: gadget: Remove set but not used variable 'opts' in acm_ms_do_configzhengbin
Fixes gcc '-Wunused-but-set-variable' warning: drivers/usb/gadget/legacy/acm_ms.c: In function acm_ms_do_config: drivers/usb/gadget/legacy/acm_ms.c:108:19: warning: variable opts set but not used [-Wunused-but-set-variable] It is not used since commit f78bbcae86e6 ("usb: f_mass_storage: test whether thread is running before starting another") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: zhengbin <zhengbin13@huawei.com> Link: https://lore.kernel.org/r/1570610434-68293-2-git-send-email-zhengbin13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: mtu3: fix race condition about delayed_statusChunfeng Yun
usb_composite_setup_continue() may be called before composite_setup() return USB_GADGET_DELAYED_STATUS, then the controller driver will delay status stage after composite_setup() finish, but the class driver don't ask the controller to continue delayed status anymore, this will cause control transfer timeout. happens when use mass storage (also enabled other class driver): cpu1: cpu2 handle_setup(SET_CONFIG) //gadget driver unlock (g->lock) gadget_driver->setup() composite_setup() lock(cdev->lock) set_config() fsg_set_alt() // maybe some times due to many class are enabled raise FSG_STATE_CONFIG_CHANGE return USB_GADGET_DELAYED_STATUS handle_exception() usb_composite_setup_continue() unlock(cdev->lock) lock(cdev->lock) ep0_queue() lock (g->lock) //no delayed status, nothing todo unlock (g->lock) unlock(cdev->lock) return USB_GADGET_DELAYED_STATUS // composite_setup lock (g->lock) get USB_GADGET_DELAYED_STATUS //handle_setup [1] Try to fix the race condition as following: After the driver gets USB_GADGET_DELAYED_STATUS at [1], if we find there is a usb_request in ep0 request list, it means composite already asked us to continue delayed status by usb_composite_setup_continue(), so we skip request about delayed_status by composite_setup() and still do status stage. Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/1570611900-7112-2-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: mtu3: add a new function to do status stageChunfeng Yun
Exact a new static function to do status stage Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/1570611900-7112-1-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-10usb: typec: add dependency for TYPEC_HD3SS3220Mao Wenan
If CONFIG_TYPEC_HD3SS3220=y, CONFIG_USB_ROLE_SWITCH=m, below errors can be found: drivers/usb/typec/hd3ss3220.o: In function `hd3ss3220_remove': hd3ss3220.c:(.text+0x64): undefined reference to `usb_role_switch_put' drivers/usb/typec/hd3ss3220.o: In function `hd3ss3220_dr_set': hd3ss3220.c:(.text+0x154): undefined reference to `usb_role_switch_set_role' drivers/usb/typec/hd3ss3220.o: In function `hd3ss3220_set_role': hd3ss3220.c:(.text+0x294): undefined reference to `usb_role_switch_set_role' hd3ss3220.c:(.text+0x2f4): undefined reference to `usb_role_switch_set_role' hd3ss3220.c:(.text+0x348): undefined reference to `usb_role_switch_set_role' hd3ss3220.c:(.text+0x390): undefined reference to `usb_role_switch_set_role' drivers/usb/typec/hd3ss3220.o: In function `hd3ss3220_probe': hd3ss3220.c:(.text+0x5e8): undefined reference to `fwnode_usb_role_switch_get' hd3ss3220.c:(.text+0x8a4): undefined reference to `usb_role_switch_put' make: *** [vmlinux] Error 1 This patch add dependency USB_ROLE_SWITCH for TYPEC_HD3SS3220. Fixes: 1c48c759ef4b ("usb: typec: driver for TI HD3SS3220 USB Type-C DRP port controller") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Mao Wenan <maowenan@huawei.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by: Biju Das <biju.das@bp.renesas.com> Link: https://lore.kernel.org/r/20191009014707.38716-1-maowenan@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb: host: xhci-tegra: Add Tegra194 XHCI supportJC Kuo
This commit adds Tegra194 XUSB host mode controller support. This is very similar to the existing Tegra124/Tegra210/Tegra186 XHCI, except 1. the number of ports and PHYs differs 2. the IPFS wrapper being removed 3. mailbox registers address changes Signed-off-by: JC Kuo <jckuo@nvidia.com> Link: https://lore.kernel.org/r/20191004162906.4818-3-jckuo@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07xhci: tegra: Parameterize mailbox register addressesJC Kuo
Tegra194 XUSB host controller has rearranged mailbox registers. This commit makes mailbox registers address a part of "soc" data so that xhci-tegra driver can be used for Tegra194. Signed-off-by: JC Kuo <jckuo@nvidia.com> Link: https://lore.kernel.org/r/20191004162906.4818-2-jckuo@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb: isp1760: isp1760-hcd.c: Drop condition with no effectSaurav Girepunje
As the "else if" and "else" branch body are identical the condition has no effect. So drop the else if condition. Signed-off-by: Saurav Girepunje <saurav.girepunje@gmail.com> Link: https://lore.kernel.org/r/20191005053733.GA10727@saurav Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb: image: microtek.c: Remove unused variableSaurav Girepunje
Remove unused variable "err" from mts_scsi_queuecommand_lck(). Signed-off-by: Saurav Girepunje <saurav.girepunje@gmail.com> Link: https://lore.kernel.org/r/20191005054931.GA11565@saurav Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb:cdns3: Fix for CV CH9 running with g_zero driver.Pawel Laszczak
Patch fixes issue with Halt Endnpoint Test observed during using g_zero driver as DUT. Bug occurred only on some testing board. Endpoint can defer transition to Halted state if endpoint has pending requests. Patch add additional condition that allows to return correct endpoint status during Get Endpoint Status request even if the halting endpoint is in progress. Reported-by: Rahul Kumar <kurahul@cadence.com> Signed-off-by: Rahul Kumar <kurahul@cadence.com> Signed-off-by: Pawel Laszczak <pawell@cadence.com> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Tested-by: Roger Quadros <rogerq@ti.com> Link: https://lore.kernel.org/r/1570430355-26118-1-git-send-email-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb: dwc3: Remove dev_err() on platform_get_irq() failureHans de Goede
Since commit 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()"), platform_get_irq() will call dev_err() itself on failure, so there is no need for the driver to also do this. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Link: https://lore.kernel.org/r/20191005210449.3926-4-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07usb: dwc3: Switch to platform_get_irq_byname_optional()Hans de Goede
The dwc3 code to get the "peripheral" / "host" / "otg" IRQ first tries platform_get_irq_byname() and then falls back to the IRQ at index 0 if the platform_get_irq_byname(). In this case we do not want platform_get_irq_byname() to print an error on failure, so switch to platform_get_irq_byname_optional() instead which does not print an error. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205037 Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Link: https://lore.kernel.org/r/20191005210449.3926-3-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-06usb: typec: hd3ss3220_irq() can be statickbuild test robot
Fixes: 1c48c759ef4b ("usb: typec: driver for TI HD3SS3220 USB Type-C DRP port controller") Signed-off-by: kbuild test robot <lkp@intel.com> Link: https://lore.kernel.org/r/20191005215727.qfypxoswkiyu45ak@332d0cec05f4 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04Merge tag 'usb-serial-5.4-rc2' of ↵Greg Kroah-Hartman
https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.4-rc2 Here's a fix for a long-standing issue in the keyspan driver which could lead to NULL-pointer dereferences when a device had unexpected endpoint descriptors. Included are also some new device IDs. All but the last two commits have been in linux-next with no reported issues. Signed-off-by: Johan Hovold <johan@kernel.org> * tag 'usb-serial-5.4-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: keyspan: fix NULL-derefs on open() and write() USB: serial: option: add support for Cinterion CLS8 devices USB: serial: option: add Telit FN980 compositions USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20
2019-10-04USB: serial: fix runtime PM after driver unbindJohan Hovold
Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from the interface. Leaving the interface with a positive PM usage counter would prevent a later bound driver from suspending the device. Fixes: c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191001084908.2003-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04USB: usblp: fix runtime PM after driver unbindJohan Hovold
Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from the interface. Leaving the interface with a positive PM usage counter would prevent a later bound driver from suspending the device. Fixes: c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191001084908.2003-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04USB: usb-skeleton: fix runtime PM after driver unbindJohan Hovold
Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from the interface. Leaving the interface with a positive PM usage counter would prevent a later bound driver from suspending the device. Fixes: c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191001084908.2003-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci-ext-caps.c: Add missing platform_device_put() on error in ↵Wei Yongjun
xhci_create_intel_xhci_sw_pdev() Add the missing platform_device_put() before return from xhci_create_intel_xhci_sw_pdev() in the error handling case. Fixes: 6ed151f26484 ("xhci-ext-caps.c: Add property to disable Intel SW switch") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Link: https://lore.kernel.org/r/20190905100001.128349-1-weiyongjun1@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behaviorYoshihiro Shimoda
According to usb_ep_set_halt()'s description, __usbhsg_ep_set_halt_wedge() should return -EAGAIN if the IN endpoint has any queue or data. Otherwise, this driver is possible to cause just STALL without sending a short packet data on g_mass_storage driver, and then a few resetting a device happens on a host side during a usb enumaration. Fixes: 2f98382dcdfe ("usb: renesas_usbhs: Add Renesas USBHS Gadget") Cc: <stable@vger.kernel.org> # v3.0+ Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Link: https://lore.kernel.org/r/1569924633-322-3-git-send-email-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}()Yoshihiro Shimoda
The commit 97664a207bc2 ("usb: renesas_usbhs: shrink spin lock area") had added a usbhsg_pipe_disable() calling into __usbhsg_ep_set_halt_wedge() accidentally. But, this driver should not call the usbhsg_pipe_disable() because the function discards all queues. So, this patch removes it. Fixes: 97664a207bc2 ("usb: renesas_usbhs: shrink spin lock area") Cc: <stable@vger.kernel.org> # v3.1+ Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Link: https://lore.kernel.org/r/1569924633-322-2-git-send-email-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04udc: lpc32xx: fix 64-bit compiler warningArnd Bergmann
gcc points out a suspicious cast from a pointer to an 'int' when compile-testing on 64-bit architectures. drivers/usb/gadget/udc/lpc32xx_udc.c: In function ‘udc_pop_fifo’: drivers/usb/gadget/udc/lpc32xx_udc.c:1156:11: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] drivers/usb/gadget/udc/lpc32xx_udc.c: In function ‘udc_stuff_fifo’: drivers/usb/gadget/udc/lpc32xx_udc.c:1257:11: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] The code works find, but it's easy enough to change the cast to a uintptr_t to shut up that warning. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20190918200201.2292008-1-arnd@arndb.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci: Fix NULL pointer dereference in xhci_clear_tt_buffer_complete()Mathias Nyman
udev stored in ep->hcpriv might be NULL if tt buffer is cleared due to a halted control endpoint during device enumeration xhci_clear_tt_buffer_complete is called by hub_tt_work() once it's scheduled, and by then usb core might have freed and allocated a new udev for the next enumeration attempt. Fixes: ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer") Cc: <stable@vger.kernel.org> # v5.3 Reported-by: Johan Hovold <johan@kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-9-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci: Increase STS_SAVE timeout in xhci_suspend()Kai-Heng Feng
After commit f7fac17ca925 ("xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()"), ASMedia xHCI may fail to suspend. Although the algorithms are essentially the same, the old max timeout is (usec + usec * time of doing readl()), and the new max timeout is just usec, which is much less than the old one. Increase the timeout to make ASMedia xHCI able to suspend again. BugLink: https://bugs.launchpad.net/bugs/1844021 Fixes: f7fac17ca925 ("xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()") Cc: <stable@vger.kernel.org> # v5.2+ Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-8-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci: Prevent deadlock when xhci adapter breaks during initBill Kuzeja
The system can hit a deadlock if an xhci adapter breaks while initializing. The deadlock is between two threads: thread 1 is tearing down the adapter and is stuck in usb_unlocked_disable_lpm waiting to lock the hcd->handwidth_mutex. Thread 2 is holding this mutex (while still trying to add a usb device), but is stuck in xhci_endpoint_reset waiting for a stop or config command to complete. A reboot is required to resolve. It turns out when calling xhci_queue_stop_endpoint and xhci_queue_configure_endpoint in xhci_endpoint_reset, the return code is not checked for errors. If the timing is right and the adapter dies just before either of these commands get issued, we hang indefinitely waiting for a completion on a command that didn't get issued. This wasn't a problem before the following fix because we didn't send commands in xhci_endpoint_reset: commit f5249461b504 ("xhci: Clear the host side toggle manually when endpoint is soft reset") With the patch I am submitting, a duration test which breaks adapters during initialization (and which deadlocks with the standard kernel) runs without issue. Fixes: f5249461b504 ("xhci: Clear the host side toggle manually when endpoint is soft reset") Cc: <stable@vger.kernel.org> # v4.17+ Cc: Torez Smith <torez@redhat.com> Signed-off-by: Bill Kuzeja <william.kuzeja@stratus.com> Signed-off-by: Torez Smith <torez@redhat.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-7-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: xhci: wait for CNR controller not ready bit in xhci resumeRick Tseng
NVIDIA 3.1 xHCI card would lose power when moving power state into D3Cold. Thus we need to wait for CNR bit to clear in xhci resume, just as in xhci init. [Minor changes to comment and commit message -Mathias] Cc: <stable@vger.kernel.org> Signed-off-by: Rick Tseng <rtseng@nvidia.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-6-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hostsMathias Nyman
Early xHCI 1.1 spec did not mention USB 3.1 capable hosts should set sbrn to 0x31, or that the minor revision is a two digit BCD containing minor and sub-minor numbers. This was later clarified in xHCI 1.2. Some USB 3.1 capable hosts therefore have sbrn set to 0x30, or minor revision set to 0x1 instead of 0x10. Detect the USB 3.1 capability correctly for these hosts as well Fixes: ddd57980a0fd ("xhci: detect USB 3.2 capable host controllers correctly") Cc: <stable@vger.kernel.org> # v4.18+ Cc: Loïc Yhuel <loic.yhuel@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-5-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci: Check all endpoints for LPM timeoutJan Schmidt
If an endpoint is encountered that returns USB3_LPM_DEVICE_INITIATED, keep checking further endpoints, as there might be periodic endpoints later that return USB3_LPM_DISABLED due to shorter service intervals. Without this, the code can set too high a maximum-exit-latency and prevent the use of multiple USB3 cameras that should be able to work. Cc: <stable@vger.kernel.org> Signed-off-by: Jan Schmidt <jan@centricular.com> Tested-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-4-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci: Prevent device initiated U1/U2 link pm if exit latency is too longMathias Nyman
If host/hub initiated link pm is prevented by a driver flag we still must ensure that periodic endpoints have longer service intervals than link pm exit latency before allowing device initiated link pm. Fix this by continue walking and checking endpoint service interval if xhci_get_timeout_no_hub_lpm() returns anything else than USB3_LPM_DISABLED While at it fix the split line error message Tested-by: Jan Schmidt <jan@centricular.com> Cc: <stable@vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-3-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04xhci: Fix false warning message about wrong bounce buffer write lengthMathias Nyman
The check printing out the "WARN Wrong bounce buffer write length:" uses incorrect values when comparing bytes written from scatterlist to bounce buffer. Actual copied lengths are fine. The used seg->bounce_len will be set to equal new_buf_len a few lines later in the code, but is incorrect when doing the comparison. The patch which added this false warning was backported to 4.8+ kernels so this should be backported as far as well. Cc: <stable@vger.kernel.org> # v4.8+ Fixes: 597c56e372da ("xhci: update bounce buffer with correct sg num") Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/1570190373-30684-2-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: usb251xb: add pm_opsMarco Felsch
Currently the driver don't support pm_ops. These ops are not necessary if the supply isn't switchable (always on). This assumptions seems to be wrong because no one needs a powered hub during suspend-to-ram/disk. So adding simple_dev_pm_ops to be able to switch off the hub during suspend and to restore the config after a resume operation. Signed-off-by: Marco Felsch <m.felsch@pengutronix.de> Acked-by: Richard Leitner <richard.leitner@skidata.com> Link: https://lore.kernel.org/r/20190917144449.32739-5-m.felsch@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: usb251xb: simplify reset helperMarco Felsch
Currently the reset handler was always called to deassert the reset line because assert the line was done during probe. Now if we want to support pm by turn of the supply we need to call this routine twice and the i2c_lock_bus is done twice too. To simplify that we can drop the state and just do a reset in one go. So a future pm operation don't need to lock the i2c bus twice. Signed-off-by: Marco Felsch <m.felsch@pengutronix.de> Reviewed-by: Richard Leitner <richard.leitner@skidata.com> Tested-by: Richard Leitner <richard.leitner@skidata.com> Link: https://lore.kernel.org/r/20190917144449.32739-4-m.felsch@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: usb251xb: add vdd supply supportMarco Felsch
Currently we don't handle the supply. We need to add the supply support to be able to switch the supply off e.g. during a suspend-to-ram operation. So we can guarantee a correct (re-)initialization. Signed-off-by: Marco Felsch <m.felsch@pengutronix.de> Reviewed-by: Richard Leitner <richard.leitner@skidata.com> Tested-by: Richard Leitner <richard.leitner@skidata.com> Link: https://lore.kernel.org/r/20190917144449.32739-3-m.felsch@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: typec: driver for TI HD3SS3220 USB Type-C DRP port controllerBiju Das
Driver for TI HD3SS3220 USB Type-C DRP port controller. The driver currently registers the port and supports data role swapping. Signed-off-by: Biju Das <biju.das@bp.renesas.com> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/1567584941-13690-3-git-send-email-biju.das@bp.renesas.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: renesas_usbhs: add suspend event support in gadget modeVeeraiyan Chidambaram
When R-Car Gen3 USB 2.0 is in Gadget mode, if host is detached an interrupt will be generated and Suspended state bit is set in interrupt status register. Interrupt handler will call driver->suspend(composite_suspend) if suspended state bit is set. composite_suspend will call ffs_func_suspend which will post FUNCTIONFS_SUSPEND and will be consumed by user space application via /dev/ep0. To be able to detect host detach, extend the DVSQ_MASK to cover the Suspended bit of the DVSQ[2:0] bitfield from the Interrupt Status Register 0 (INTSTS0) register and perform appropriate action in the DVST interrupt handler (usbhsg_irq_dev_state). Without this commit, disconnection of the phone from R-Car-H3 ES2.0 Salvator-X CN9 port is not recognized and reverse role switch does not happen. If phone is connected again it does not enumerate. With this commit, disconnection will be recognized and reverse role switch will happen by a user space application. If phone is connected again it will enumerate properly and will become visible in the output of 'lsusb'. Signed-off-by: Veeraiyan Chidambaram <veeraiyan.chidambaram@in.bosch.com> Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Link: https://lore.kernel.org/r/1568207756-22325-3-git-send-email-external.veeraiyan.c@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: renesas_usbhs: enable DVSE interruptEugeniu Rosca
Commit [1] enabled the possibility of checking the DVST (Device State Transition) bit of INTSTS0 (Interrupt Status Register 0) and calling the irq_dev_state() handler if the DVST bit is set. But neither commit [1] nor commit [2] actually enabled the DVSE (Device State Transition Interrupt Enable) bit in the INTENB0 (Interrupt Enable Register 0). As a consequence, irq_dev_state() handler is getting called as a side effect of other (non-DVSE) interrupts being fired, which definitely can't be relied upon, if DVST notifications are of any value. Why this doesn't hurt is because usbhsg_irq_dev_state() currently doesn't do much except of a dev_dbg(). Once more work is added to the handler (e.g. detecting device "Suspended" state and notifying other USB gadget components about it), enabling DVSE becomes a hard requirement. Do it in a standalone commit for better visibility and clear explanation. [1] commit f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code") [2] commit 2f98382dcdfe ("usb: renesas_usbhs: Add Renesas USBHS Gadget") Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com> Signed-off-by: Veeraiyan Chidambaram <veeraiyan.chidambaram@in.bosch.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Link: https://lore.kernel.org/r/1568207756-22325-2-git-send-email-external.veeraiyan.c@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04usb: renesas_usbhs: simplify usbhs_status_get_device_state()Eugeniu Rosca
Similar to usbhs_status_get_ctrl_stage(), *_get_device_state() is not supposed to return any error code since its return value is the DVSQ bitfield of the INTSTS0 register. According to SoC HW manual rev1.00, every single value of DVSQ[2:0] is valid and none is an error: ----8<---- Device State 000: Powered state 001: Default state 010: Address state 011: Configuration state 1xx: Suspended state ----8<---- Hence, simplify the function body. The motivation behind dropping the switch/case construct is being able to implement reading the suspended state. The latter (based on the above DVSQ[2:0] description) doesn't have a unique value, but is rather a list of states (which makes switch/case less suitable for reading/validating it): 100: (Suspended) Powered state 101: (Suspended) Default state 110: (Suspended) Address state 111: (Suspended) Configuration state Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com> Signed-off-by: Veeraiyan Chidambaram <veeraiyan.chidambaram@in.bosch.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Link: https://lore.kernel.org/r/1568207756-22325-1-git-send-email-external.veeraiyan.c@de.adit-jv.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04USB: host: ohci-at91: resume: balance the clock start callBoris Krasnovskiy
There is a clock enable counter run away problem in resume ohci_at91. Code enables clock that was never disabled in case of non wakeup interface. That would make clock unstoppable in future. Use proper alternative to start clocks only if they were stopped before. Signed-off-by: Boris Krasnovskiy <Boris.Krasnovskiy@lairdconnect.com> Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/20190911064154.28633-4-nicolas.ferre@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-04USB: host: ohci-at91: suspend: delay needed before to stop clocksNicolas Ferre
In order to completely remove marginal power consumption in PM suspend, we need to let the controller settle down before being stopped. In ohci_hcd_at91_drv_suspend() function, one additional delay is needed before to stop the clocks. Reported-by: Boris Krasnovskiy <Boris.Krasnovskiy@lairdconnect.com> Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/20190911064154.28633-3-nicolas.ferre@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit (git 2.34.1) at 2025-09-13 01:07:56 +0000