From 8802559e9372fb2fdc47abf35c97b460316b4d67 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Wed, 14 Feb 2018 18:08:20 +0200 Subject: USB: gadget: bcm63xx: Re-use DEFINE_SHOW_ATTRIBUTE() macro ...instead of open coding file operations followed by custom ->open() callbacks per each attribute. Cc: Kevin Cernekee Cc: Florian Fainelli Cc: bcm-kernel-feedback-list@broadcom.com Signed-off-by: Andy Shevchenko Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/bcm63xx_udc.c | 33 ++++----------------------------- 1 file changed, 4 insertions(+), 29 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/bcm63xx_udc.c b/drivers/usb/gadget/udc/bcm63xx_udc.c index 465ccd1104de..3a8df8601074 100644 --- a/drivers/usb/gadget/udc/bcm63xx_udc.c +++ b/drivers/usb/gadget/udc/bcm63xx_udc.c @@ -2158,6 +2158,7 @@ static int bcm63xx_usbd_dbg_show(struct seq_file *s, void *p) return 0; } +DEFINE_SHOW_ATTRIBUTE(bcm63xx_usbd_dbg); /* * bcm63xx_iudma_dbg_show - Show IUDMA status and descriptors. @@ -2238,33 +2239,7 @@ static int bcm63xx_iudma_dbg_show(struct seq_file *s, void *p) return 0; } - -static int bcm63xx_usbd_dbg_open(struct inode *inode, struct file *file) -{ - return single_open(file, bcm63xx_usbd_dbg_show, inode->i_private); -} - -static int bcm63xx_iudma_dbg_open(struct inode *inode, struct file *file) -{ - return single_open(file, bcm63xx_iudma_dbg_show, inode->i_private); -} - -static const struct file_operations usbd_dbg_fops = { - .owner = THIS_MODULE, - .open = bcm63xx_usbd_dbg_open, - .llseek = seq_lseek, - .read = seq_read, - .release = single_release, -}; - -static const struct file_operations iudma_dbg_fops = { - .owner = THIS_MODULE, - .open = bcm63xx_iudma_dbg_open, - .llseek = seq_lseek, - .read = seq_read, - .release = single_release, -}; - +DEFINE_SHOW_ATTRIBUTE(bcm63xx_iudma_dbg); /** * bcm63xx_udc_init_debugfs - Create debugfs entries. @@ -2282,11 +2257,11 @@ static void bcm63xx_udc_init_debugfs(struct bcm63xx_udc *udc) goto err_root; usbd = debugfs_create_file("usbd", 0400, root, udc, - &usbd_dbg_fops); + &bcm63xx_usbd_dbg_fops); if (!usbd) goto err_usbd; iudma = debugfs_create_file("iudma", 0400, root, udc, - &iudma_dbg_fops); + &bcm63xx_iudma_dbg_fops); if (!iudma) goto err_iudma; -- cgit From 688d4ca31796f53934d326363f667e897216e91d Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Wed, 14 Feb 2018 18:08:21 +0200 Subject: USB: gadget: gr: Re-use DEFINE_SHOW_ATTRIBUTE() macro ...instead of open coding file operations followed by custom ->open() callbacks per each attribute. Signed-off-by: Andy Shevchenko Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/gr_udc.c | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c index b3fb1bbdb854..ca83c15d8ea4 100644 --- a/drivers/usb/gadget/udc/gr_udc.c +++ b/drivers/usb/gadget/udc/gr_udc.c @@ -179,8 +179,7 @@ static void gr_seq_ep_show(struct seq_file *seq, struct gr_ep *ep) seq_puts(seq, "\n"); } - -static int gr_seq_show(struct seq_file *seq, void *v) +static int gr_dfs_show(struct seq_file *seq, void *v) { struct gr_udc *dev = seq->private; u32 control = gr_read32(&dev->regs->control); @@ -203,19 +202,7 @@ static int gr_seq_show(struct seq_file *seq, void *v) return 0; } - -static int gr_dfs_open(struct inode *inode, struct file *file) -{ - return single_open(file, gr_seq_show, inode->i_private); -} - -static const struct file_operations gr_dfs_fops = { - .owner = THIS_MODULE, - .open = gr_dfs_open, - .read = seq_read, - .llseek = seq_lseek, - .release = single_release, -}; +DEFINE_SHOW_ATTRIBUTE(gr_dfs); static void gr_dfs_create(struct gr_udc *dev) { -- cgit From 5aaa036b18709157270f762c929a70494ad09828 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Wed, 14 Feb 2018 18:08:22 +0200 Subject: USB: gadget: pxa25x: Re-use DEFINE_SHOW_ATTRIBUTE() macro ...instead of open coding file operations followed by custom ->open() callbacks per each attribute. Cc: Daniel Mack Cc: Haojian Zhuang Cc: Robert Jarzmik Signed-off-by: Andy Shevchenko Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/pxa25x_udc.c | 20 +++----------------- 1 file changed, 3 insertions(+), 17 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/pxa25x_udc.c b/drivers/usb/gadget/udc/pxa25x_udc.c index 0e3f5faa000e..d4be53559f2e 100644 --- a/drivers/usb/gadget/udc/pxa25x_udc.c +++ b/drivers/usb/gadget/udc/pxa25x_udc.c @@ -1233,8 +1233,7 @@ static const struct usb_gadget_ops pxa25x_udc_ops = { #ifdef CONFIG_USB_GADGET_DEBUG_FS -static int -udc_seq_show(struct seq_file *m, void *_d) +static int udc_debug_show(struct seq_file *m, void *_d) { struct pxa25x_udc *dev = m->private; unsigned long flags; @@ -1335,25 +1334,12 @@ done: local_irq_restore(flags); return 0; } - -static int -udc_debugfs_open(struct inode *inode, struct file *file) -{ - return single_open(file, udc_seq_show, inode->i_private); -} - -static const struct file_operations debug_fops = { - .open = udc_debugfs_open, - .read = seq_read, - .llseek = seq_lseek, - .release = single_release, - .owner = THIS_MODULE, -}; +DEFINE_SHOW_ATTRIBUTE(udc_debug); #define create_debug_files(dev) \ do { \ dev->debugfs_udc = debugfs_create_file(dev->gadget.name, \ - S_IRUGO, NULL, dev, &debug_fops); \ + S_IRUGO, NULL, dev, &udc_debug_fops); \ } while (0) #define remove_debug_files(dev) debugfs_remove(dev->debugfs_udc) -- cgit From 2247276989a16f84fc00930b407ab648b0b52cf6 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Wed, 14 Feb 2018 18:08:23 +0200 Subject: USB: gadget: pxa27x: Re-use DEFINE_SHOW_ATTRIBUTE() macro ...instead of open coding file operations followed by custom ->open() callbacks per each attribute. Cc: Daniel Mack Cc: Haojian Zhuang Cc: Robert Jarzmik Signed-off-by: Andy Shevchenko Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/pxa27x_udc.c | 42 +++---------------------------------- 1 file changed, 3 insertions(+), 39 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c index fadcf2653c3d..a58242e901df 100644 --- a/drivers/usb/gadget/udc/pxa27x_udc.c +++ b/drivers/usb/gadget/udc/pxa27x_udc.c @@ -131,6 +131,7 @@ static int state_dbg_show(struct seq_file *s, void *p) return 0; } +DEFINE_SHOW_ATTRIBUTE(state_dbg); static int queues_dbg_show(struct seq_file *s, void *p) { @@ -163,6 +164,7 @@ static int queues_dbg_show(struct seq_file *s, void *p) return 0; } +DEFINE_SHOW_ATTRIBUTE(queues_dbg); static int eps_dbg_show(struct seq_file *s, void *p) { @@ -199,45 +201,7 @@ static int eps_dbg_show(struct seq_file *s, void *p) return 0; } - -static int eps_dbg_open(struct inode *inode, struct file *file) -{ - return single_open(file, eps_dbg_show, inode->i_private); -} - -static int queues_dbg_open(struct inode *inode, struct file *file) -{ - return single_open(file, queues_dbg_show, inode->i_private); -} - -static int state_dbg_open(struct inode *inode, struct file *file) -{ - return single_open(file, state_dbg_show, inode->i_private); -} - -static const struct file_operations state_dbg_fops = { - .owner = THIS_MODULE, - .open = state_dbg_open, - .llseek = seq_lseek, - .read = seq_read, - .release = single_release, -}; - -static const struct file_operations queues_dbg_fops = { - .owner = THIS_MODULE, - .open = queues_dbg_open, - .llseek = seq_lseek, - .read = seq_read, - .release = single_release, -}; - -static const struct file_operations eps_dbg_fops = { - .owner = THIS_MODULE, - .open = eps_dbg_open, - .llseek = seq_lseek, - .read = seq_read, - .release = single_release, -}; +DEFINE_SHOW_ATTRIBUTE(eps_dbg); static void pxa_init_debugfs(struct pxa_udc *udc) { -- cgit From ddd05979f89cbbbd94dd4186f5ed5b2262cc1d9f Mon Sep 17 00:00:00 2001 From: Souptick Joarder Date: Wed, 14 Feb 2018 23:59:13 +0530 Subject: usb: gadget: udc: bdc: Use dma_pool_zalloc Use dma_pool_zalloc instead of dma_pool_alloc + memset Signed-off-by: Souptick Joarder Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/bdc/bdc_ep.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c index f40d4c13cfa4..03149b9d7ea7 100644 --- a/drivers/usb/gadget/udc/bdc/bdc_ep.c +++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c @@ -151,7 +151,7 @@ static int ep_bd_list_alloc(struct bdc_ep *ep) if (!bd_table) goto fail; - bd_table->start_bd = dma_pool_alloc(bdc->bd_table_pool, + bd_table->start_bd = dma_pool_zalloc(bdc->bd_table_pool, GFP_ATOMIC, &dma); if (!bd_table->start_bd) { @@ -167,7 +167,6 @@ static int ep_bd_list_alloc(struct bdc_ep *ep) (unsigned long long)bd_table->dma, prev_table); ep->bd_list.bd_table_array[index] = bd_table; - memset(bd_table->start_bd, 0, bd_p_tab * sizeof(struct bdc_bd)); if (prev_table) chain_table(prev_table, bd_table, bd_p_tab); -- cgit From ac87e560f7c0f91b62012e9a159c0681a373b922 Mon Sep 17 00:00:00 2001 From: Wolfram Sang Date: Tue, 6 Feb 2018 09:50:40 +0100 Subject: usb: gadget: udc: change comparison to bitshift when dealing with a mask Due to a typo, the mask was destroyed by a comparison instead of a bit shift. Reported-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/goku_udc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/goku_udc.h b/drivers/usb/gadget/udc/goku_udc.h index 26601bf4e7a9..70023d401079 100644 --- a/drivers/usb/gadget/udc/goku_udc.h +++ b/drivers/usb/gadget/udc/goku_udc.h @@ -25,7 +25,7 @@ struct goku_udc_regs { # define INT_EP1DATASET 0x00040 # define INT_EP2DATASET 0x00080 # define INT_EP3DATASET 0x00100 -#define INT_EPnNAK(n) (0x00100 < (n)) /* 0 < n < 4 */ +#define INT_EPnNAK(n) (0x00100 << (n)) /* 0 < n < 4 */ # define INT_EP1NAK 0x00200 # define INT_EP2NAK 0x00400 # define INT_EP3NAK 0x00800 -- cgit From a127f4f228104d391a6aa62a9a57b2ba697f90c2 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Fri, 26 Jan 2018 15:39:00 +0000 Subject: USB: gadget: function: remove redundant initialization of 'tv_nexus' Pointer tv_nexus is being initialized a value and this is never read and is later being updated with the same value. Remove the redundant initialization so that the assignment to tv_nexus is performed later and more local to when it is being read. Cleans up clang warning: drivers/usb/gadget/function/f_tcm.c:1097:25: warning: Value stored to 'tv_nexus' during its initialization is never read Signed-off-by: Colin Ian King Signed-off-by: Felipe Balbi --- drivers/usb/gadget/function/f_tcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c index da81cf16b850..d78dbb73bde8 100644 --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -1094,7 +1094,7 @@ static int usbg_submit_command(struct f_uas *fu, struct command_iu *cmd_iu = cmdbuf; struct usbg_cmd *cmd; struct usbg_tpg *tpg = fu->tpg; - struct tcm_usbg_nexus *tv_nexus = tpg->tpg_nexus; + struct tcm_usbg_nexus *tv_nexus; u32 cmd_len; u16 scsi_tag; -- cgit From 13431c60705f385b7f1c7bb749a93b84cf55c83f Mon Sep 17 00:00:00 2001 From: Ladislav Michl Date: Mon, 22 Jan 2018 17:05:21 +0100 Subject: usb: gadget: udc: atmel: Use devm_ioremap_resource() As devm_ioremap_resource() checks for valid resource, make use of it instead of testing ourselves. As a bonus memory region is requested. Acked-by: Nicolas Ferre Signed-off-by: Ladislav Michl Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/atmel_usba_udc.c | 34 +++++++++++++-------------------- 1 file changed, 13 insertions(+), 21 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c index 075eaaa8a408..f420710abdd7 100644 --- a/drivers/usb/gadget/udc/atmel_usba_udc.c +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c @@ -2272,7 +2272,7 @@ static struct usba_ep * usba_udc_pdata(struct platform_device *pdev, static int usba_udc_probe(struct platform_device *pdev) { - struct resource *regs, *fifo; + struct resource *res; struct clk *pclk, *hclk; struct usba_udc *udc; int irq, ret, i; @@ -2284,10 +2284,18 @@ static int usba_udc_probe(struct platform_device *pdev) udc->gadget = usba_gadget_template; INIT_LIST_HEAD(&udc->gadget.ep_list); - regs = platform_get_resource(pdev, IORESOURCE_MEM, CTRL_IOMEM_ID); - fifo = platform_get_resource(pdev, IORESOURCE_MEM, FIFO_IOMEM_ID); - if (!regs || !fifo) - return -ENXIO; + res = platform_get_resource(pdev, IORESOURCE_MEM, CTRL_IOMEM_ID); + udc->regs = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(udc->regs)) + return PTR_ERR(udc->regs); + dev_info(&pdev->dev, "MMIO registers at %pR mapped at %p\n", + res, udc->regs); + + res = platform_get_resource(pdev, IORESOURCE_MEM, FIFO_IOMEM_ID); + udc->fifo = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(udc->fifo)) + return PTR_ERR(udc->fifo); + dev_info(&pdev->dev, "FIFO at %pR mapped at %p\n", res, udc->fifo); irq = platform_get_irq(pdev, 0); if (irq < 0) @@ -2307,22 +2315,6 @@ static int usba_udc_probe(struct platform_device *pdev) udc->hclk = hclk; udc->vbus_pin = -ENODEV; - ret = -ENOMEM; - udc->regs = devm_ioremap(&pdev->dev, regs->start, resource_size(regs)); - if (!udc->regs) { - dev_err(&pdev->dev, "Unable to map I/O memory, aborting.\n"); - return ret; - } - dev_info(&pdev->dev, "MMIO registers at 0x%08lx mapped at %p\n", - (unsigned long)regs->start, udc->regs); - udc->fifo = devm_ioremap(&pdev->dev, fifo->start, resource_size(fifo)); - if (!udc->fifo) { - dev_err(&pdev->dev, "Unable to map FIFO, aborting.\n"); - return ret; - } - dev_info(&pdev->dev, "FIFO at 0x%08lx mapped at %p\n", - (unsigned long)fifo->start, udc->fifo); - platform_set_drvdata(pdev, udc); /* Make sure we start from a clean slate */ -- cgit From 5d6ae4f0da8a64a185074dabb1b2f8c148efa741 Mon Sep 17 00:00:00 2001 From: Chris Dickens Date: Sun, 31 Dec 2017 18:59:42 -0800 Subject: usb: gadget: composite: fix incorrect handling of OS desc requests When handling an OS descriptor request, one of the first operations is to zero out the request buffer using the wLength from the setup packet. There is no bounds checking, so a wLength > 4096 would clobber memory adjacent to the request buffer. Fix this by taking the min of wLength and the request buffer length prior to the memset. While at it, define the buffer length in a header file so that magic numbers don't appear throughout the code. When returning data to the host, the data length should be the min of the wLength and the valid data we have to return. Currently we are returning wLength, thus requests for a wLength greater than the amount of data in the OS descriptor buffer would return invalid (albeit zero'd) data following the valid descriptor data. Fix this by counting the number of bytes when constructing the data and using this when determining the length of the request. Signed-off-by: Chris Dickens Signed-off-by: Felipe Balbi --- drivers/usb/gadget/composite.c | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 77c7ecca816a..b8b629c615d3 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1422,7 +1422,7 @@ static int count_ext_compat(struct usb_configuration *c) return res; } -static void fill_ext_compat(struct usb_configuration *c, u8 *buf) +static int fill_ext_compat(struct usb_configuration *c, u8 *buf) { int i, count; @@ -1449,10 +1449,12 @@ static void fill_ext_compat(struct usb_configuration *c, u8 *buf) buf += 23; } count += 24; - if (count >= 4096) - return; + if (count + 24 >= USB_COMP_EP0_OS_DESC_BUFSIZ) + return count; } } + + return count; } static int count_ext_prop(struct usb_configuration *c, int interface) @@ -1497,25 +1499,20 @@ static int fill_ext_prop(struct usb_configuration *c, int interface, u8 *buf) struct usb_os_desc *d; struct usb_os_desc_ext_prop *ext_prop; int j, count, n, ret; - u8 *start = buf; f = c->interface[interface]; + count = 10; /* header length */ for (j = 0; j < f->os_desc_n; ++j) { if (interface != f->os_desc_table[j].if_id) continue; d = f->os_desc_table[j].os_desc; if (d) list_for_each_entry(ext_prop, &d->ext_prop, entry) { - /* 4kB minus header length */ - n = buf - start; - if (n >= 4086) - return 0; - - count = ext_prop->data_len + + n = ext_prop->data_len + ext_prop->name_len + 14; - if (count > 4086 - n) - return -EINVAL; - usb_ext_prop_put_size(buf, count); + if (count + n >= USB_COMP_EP0_OS_DESC_BUFSIZ) + return count; + usb_ext_prop_put_size(buf, n); usb_ext_prop_put_type(buf, ext_prop->type); ret = usb_ext_prop_put_name(buf, ext_prop->name, ext_prop->name_len); @@ -1541,11 +1538,12 @@ static int fill_ext_prop(struct usb_configuration *c, int interface, u8 *buf) default: return -EINVAL; } - buf += count; + buf += n; + count += n; } } - return 0; + return count; } /* @@ -1827,6 +1825,7 @@ unknown: req->complete = composite_setup_complete; buf = req->buf; os_desc_cfg = cdev->os_desc_config; + w_length = min_t(u16, w_length, USB_COMP_EP0_OS_DESC_BUFSIZ); memset(buf, 0, w_length); buf[5] = 0x01; switch (ctrl->bRequestType & USB_RECIP_MASK) { @@ -1850,8 +1849,8 @@ unknown: count += 16; /* header */ put_unaligned_le32(count, buf); buf += 16; - fill_ext_compat(os_desc_cfg, buf); - value = w_length; + value = fill_ext_compat(os_desc_cfg, buf); + value = min_t(u16, w_length, value); } break; case USB_RECIP_INTERFACE: @@ -1880,8 +1879,7 @@ unknown: interface, buf); if (value < 0) return value; - - value = w_length; + value = min_t(u16, w_length, value); } break; } @@ -2156,8 +2154,8 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev, goto end; } - /* OS feature descriptor length <= 4kB */ - cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL); + cdev->os_desc_req->buf = kmalloc(USB_COMP_EP0_OS_DESC_BUFSIZ, + GFP_KERNEL); if (!cdev->os_desc_req->buf) { ret = -ENOMEM; usb_ep_free_request(ep0, cdev->os_desc_req); -- cgit From 636ba13aec8a0198d3fa4e2246e291a19694b50f Mon Sep 17 00:00:00 2001 From: Chris Dickens Date: Sun, 31 Dec 2017 18:59:43 -0800 Subject: usb: gadget: composite: remove duplicated code in OS desc handling When the host wants to fetch OS descriptors, it sends two requests. The first is only for the header and the second for the full amount specified by the header in the first request. The OS descriptor handling code is distinguishing the header-only requests based on the wLength of the setup packet, but the same code is executed in both cases to construct the actual header. Simplify this by always constructing the header and then filling out the rest of the request if the wLength is greater than the size of the header. Also remove the duplicate code for queueing the request to ep0 by adding a goto label. Signed-off-by: Chris Dickens Signed-off-by: Felipe Balbi --- drivers/usb/gadget/composite.c | 72 +++++++++++++----------------------------- 1 file changed, 22 insertions(+), 50 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index b8b629c615d3..1924e20f6e8c 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1427,6 +1427,7 @@ static int fill_ext_compat(struct usb_configuration *c, u8 *buf) int i, count; count = 16; + buf += 16; for (i = 0; i < c->next_interface_id; ++i) { struct usb_function *f; int j; @@ -1502,6 +1503,7 @@ static int fill_ext_prop(struct usb_configuration *c, int interface, u8 *buf) f = c->interface[interface]; count = 10; /* header length */ + buf += 10; for (j = 0; j < f->os_desc_n; ++j) { if (interface != f->os_desc_table[j].if_id) continue; @@ -1833,22 +1835,14 @@ unknown: if (w_index != 0x4 || (w_value >> 8)) break; buf[6] = w_index; - if (w_length == 0x10) { - /* Number of ext compat interfaces */ - count = count_ext_compat(os_desc_cfg); - buf[8] = count; - count *= 24; /* 24 B/ext compat desc */ - count += 16; /* header */ - put_unaligned_le32(count, buf); - value = w_length; - } else { - /* "extended compatibility ID"s */ - count = count_ext_compat(os_desc_cfg); - buf[8] = count; - count *= 24; /* 24 B/ext compat desc */ - count += 16; /* header */ - put_unaligned_le32(count, buf); - buf += 16; + /* Number of ext compat interfaces */ + count = count_ext_compat(os_desc_cfg); + buf[8] = count; + count *= 24; /* 24 B/ext compat desc */ + count += 16; /* header */ + put_unaligned_le32(count, buf); + value = w_length; + if (w_length > 0x10) { value = fill_ext_compat(os_desc_cfg, buf); value = min_t(u16, w_length, value); } @@ -1858,46 +1852,23 @@ unknown: break; interface = w_value & 0xFF; buf[6] = w_index; - if (w_length == 0x0A) { - count = count_ext_prop(os_desc_cfg, - interface); - put_unaligned_le16(count, buf + 8); - count = len_ext_prop(os_desc_cfg, - interface); - put_unaligned_le32(count, buf); - - value = w_length; - } else { - count = count_ext_prop(os_desc_cfg, - interface); - put_unaligned_le16(count, buf + 8); - count = len_ext_prop(os_desc_cfg, - interface); - put_unaligned_le32(count, buf); - buf += 10; + count = count_ext_prop(os_desc_cfg, + interface); + put_unaligned_le16(count, buf + 8); + count = len_ext_prop(os_desc_cfg, + interface); + put_unaligned_le32(count, buf); + value = w_length; + if (w_length > 0x0A) { value = fill_ext_prop(os_desc_cfg, interface, buf); - if (value < 0) - return value; - value = min_t(u16, w_length, value); + if (value >= 0) + value = min_t(u16, w_length, value); } break; } - if (value >= 0) { - req->length = value; - req->context = cdev; - req->zero = value < w_length; - value = composite_ep0_queue(cdev, req, - GFP_ATOMIC); - if (value < 0) { - DBG(cdev, "ep_queue --> %d\n", value); - req->status = 0; - composite_setup_complete(gadget->ep0, - req); - } - } - return value; + goto check_value; } VDBG(cdev, @@ -1971,6 +1942,7 @@ try_fun_setup: goto done; } +check_value: /* respond with data transfer before status phase? */ if (value >= 0 && value != USB_GADGET_DELAYED_STATUS) { req->length = value; -- cgit From 28af04b4a7879a027cb23c1d616a60e31ff4af7c Mon Sep 17 00:00:00 2001 From: Thinh Nguyen Date: Wed, 10 Jan 2018 13:17:13 -0800 Subject: usb: gadget: mass_storage: Set max_speed to SSP Increase max_speed of the mass_storage driver for UDCs that support SuperSpeed Plus. The composite driver will pass this value to UDC core to set the device speed on probe (actual speed may be different depending on whether the USB controller supports it or other external factors). Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi --- drivers/usb/gadget/legacy/mass_storage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c index ef3d25259b0e..fd5595ac5bf7 100644 --- a/drivers/usb/gadget/legacy/mass_storage.c +++ b/drivers/usb/gadget/legacy/mass_storage.c @@ -225,7 +225,7 @@ static int msg_unbind(struct usb_composite_dev *cdev) static struct usb_composite_driver msg_driver = { .name = "g_mass_storage", .dev = &msg_device_desc, - .max_speed = USB_SPEED_SUPER, + .max_speed = USB_SPEED_SUPER_PLUS, .needs_serial = 1, .strings = dev_strings, .bind = msg_bind, -- cgit From 4058ebf33cb0be88ca516f968eda24ab7b6b93e4 Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen Date: Fri, 12 Jan 2018 11:05:02 +0100 Subject: usb: gadget: ffs: Execute copy_to_user() with USER_DS set When using a AIO read() operation on the function FS gadget driver a URB is submitted asynchronously and on URB completion the received data is copied to the userspace buffer associated with the read operation. This is done from a kernel worker thread invoking copy_to_user() (through copy_to_iter()). And while the user space process memory is made available to the kernel thread using use_mm(), some architecture require in addition to this that the operation runs with USER_DS set. Otherwise the userspace memory access will fail. For example on ARM64 with Privileged Access Never (PAN) and User Access Override (UAO) enabled the following crash occurs. Internal error: Accessing user space memory with fs=KERNEL_DS: 9600004f [#1] SMP Modules linked in: CPU: 2 PID: 1636 Comm: kworker/2:1 Not tainted 4.9.0-04081-g8ab2dfb-dirty #487 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) Workqueue: events ffs_user_copy_worker task: ffffffc87afc8080 task.stack: ffffffc87a00c000 PC is at __arch_copy_to_user+0x190/0x220 LR is at copy_to_iter+0x78/0x3c8 [...] [] __arch_copy_to_user+0x190/0x220 [] ffs_user_copy_worker+0x70/0x130 [] process_one_work+0x1dc/0x460 [] worker_thread+0x50/0x4b0 [] kthread+0xd8/0xf0 [] ret_from_fork+0x10/0x50 Address this by placing a set_fs(USER_DS) before of the copy operation and revert it again once the copy operation has finished. This patch is analogous to commit d7ffde35e31a ("vhost: use USER_DS in vhost_worker thread") which addresses the same underlying issue. Signed-off-by: Lars-Peter Clausen Signed-off-by: Felipe Balbi --- drivers/usb/gadget/function/f_fs.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index c2592d883f67..e33e8ca5a120 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -758,9 +758,13 @@ static void ffs_user_copy_worker(struct work_struct *work) bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; if (io_data->read && ret > 0) { + mm_segment_t oldfs = get_fs(); + + set_fs(USER_DS); use_mm(io_data->mm); ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data); unuse_mm(io_data->mm); + set_fs(oldfs); } io_data->kiocb->ki_complete(io_data->kiocb, ret, ret); -- cgit From 946ef68ad4e45aa048a5fb41ce8823ed29da866a Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen Date: Fri, 12 Jan 2018 11:26:16 +0100 Subject: usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS Some UDC drivers (like the DWC3) expect that the response to a setup() request is queued from within the setup function itself so that it is available as soon as setup() has completed. Upon receiving a setup request the function fs driver creates an event that is made available to userspace. And only once userspace has acknowledged that event the response to the setup request is queued. So it violates the requirement of those UDC drivers and random failures can be observed. This is basically a race condition and if userspace is able to read the event and queue the response fast enough all is good. But if it is not, for example because other processes are currently scheduled to run, the USB host that sent the setup request will observe an error. To avoid this the gadget framework provides the USB_GADGET_DELAYED_STATUS return code. If a setup() callback returns this value the UDC driver is aware that response is not yet available and can uses the appropriate methods to handle this case. Since in the case of function fs the response will never be available when the setup() function returns make sure that this status code is used. This fixed random occasional failures that were previously observed on a DWC3 based system under high system load. Signed-off-by: Lars-Peter Clausen Signed-off-by: Felipe Balbi --- drivers/usb/gadget/function/f_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index e33e8ca5a120..fb2a027f0208 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -3243,7 +3243,7 @@ static int ffs_func_setup(struct usb_function *f, __ffs_event_add(ffs, FUNCTIONFS_SETUP); spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); - return 0; + return USB_GADGET_DELAYED_STATUS; } static bool ffs_func_req_match(struct usb_function *f, -- cgit From 7c55984e191f0f5436c1cd1d1e1a3c297458cfba Mon Sep 17 00:00:00 2001 From: Ludovic Desroches Date: Thu, 1 Feb 2018 10:34:31 +0100 Subject: usb: gadget: udc: atmel: remove code related to platform stuff With the removal of AVR platforms, code related to platform stuff is useless. Signed-off-by: Ludovic Desroches Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/atmel_usba_udc.c | 73 +-------------------------------- 1 file changed, 2 insertions(+), 71 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c index f420710abdd7..1c4d52dbdf71 100644 --- a/drivers/usb/gadget/udc/atmel_usba_udc.c +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c @@ -2019,7 +2019,6 @@ static int atmel_usba_stop(struct usb_gadget *gadget) return 0; } -#ifdef CONFIG_OF static void at91sam9rl_toggle_bias(struct usba_udc *udc, int is_on) { regmap_update_bits(udc->pmc, AT91_CKGR_UCKR, AT91_PMC_BIASEN, @@ -2204,71 +2203,6 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev, err: return ERR_PTR(ret); } -#else -static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev, - struct usba_udc *udc) -{ - return ERR_PTR(-ENOSYS); -} -#endif - -static struct usba_ep * usba_udc_pdata(struct platform_device *pdev, - struct usba_udc *udc) -{ - struct usba_platform_data *pdata = dev_get_platdata(&pdev->dev); - struct usba_ep *eps; - int i; - - if (!pdata) - return ERR_PTR(-ENXIO); - - eps = devm_kzalloc(&pdev->dev, sizeof(struct usba_ep) * pdata->num_ep, - GFP_KERNEL); - if (!eps) - return ERR_PTR(-ENOMEM); - - udc->gadget.ep0 = &eps[0].ep; - - udc->vbus_pin = pdata->vbus_pin; - udc->vbus_pin_inverted = pdata->vbus_pin_inverted; - udc->num_ep = pdata->num_ep; - - INIT_LIST_HEAD(&eps[0].ep.ep_list); - - for (i = 0; i < pdata->num_ep; i++) { - struct usba_ep *ep = &eps[i]; - - ep->ep_regs = udc->regs + USBA_EPT_BASE(i); - ep->dma_regs = udc->regs + USBA_DMA_BASE(i); - ep->fifo = udc->fifo + USBA_FIFO_BASE(i); - ep->ep.ops = &usba_ep_ops; - ep->ep.name = pdata->ep[i].name; - ep->fifo_size = pdata->ep[i].fifo_size; - usb_ep_set_maxpacket_limit(&ep->ep, ep->fifo_size); - ep->udc = udc; - INIT_LIST_HEAD(&ep->queue); - ep->nr_banks = pdata->ep[i].nr_banks; - ep->index = pdata->ep[i].index; - ep->can_dma = pdata->ep[i].can_dma; - ep->can_isoc = pdata->ep[i].can_isoc; - - if (i == 0) { - ep->ep.caps.type_control = true; - } else { - ep->ep.caps.type_iso = ep->can_isoc; - ep->ep.caps.type_bulk = true; - ep->ep.caps.type_int = true; - } - - ep->ep.caps.dir_in = true; - ep->ep.caps.dir_out = true; - - if (i) - list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list); - } - - return eps; -} static int usba_udc_probe(struct platform_device *pdev) { @@ -2327,10 +2261,7 @@ static int usba_udc_probe(struct platform_device *pdev) usba_writel(udc, CTRL, USBA_DISABLE_MASK); clk_disable_unprepare(pclk); - if (pdev->dev.of_node) - udc->usba_ep = atmel_udc_of_init(pdev, udc); - else - udc->usba_ep = usba_udc_pdata(pdev, udc); + udc->usba_ep = atmel_udc_of_init(pdev, udc); toggle_bias(udc, 0); @@ -2454,7 +2385,7 @@ static struct platform_driver udc_driver = { .driver = { .name = "atmel_usba_udc", .pm = &usba_udc_pm_ops, - .of_match_table = of_match_ptr(atmel_udc_dt_ids), + .of_match_table = atmel_udc_dt_ids, }, }; -- cgit From 3df034081021fa4b6967ce3364bc7d867ec1c870 Mon Sep 17 00:00:00 2001 From: Ludovic Desroches Date: Thu, 1 Feb 2018 10:34:32 +0100 Subject: usb: gadget: udc: atmel: convert to use GPIO descriptors Use GPIO descriptors instead of relying on the old method. Include irq.h header since it is needed and was indirectly included through of_gpio.h. Reviewed-by: Linus Walleij Signed-off-by: Ludovic Desroches Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/atmel_usba_udc.c | 51 ++++++++++++++------------------- drivers/usb/gadget/udc/atmel_usba_udc.h | 4 ++- 2 files changed, 25 insertions(+), 30 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c index 1c4d52dbdf71..27c16399c7e8 100644 --- a/drivers/usb/gadget/udc/atmel_usba_udc.c +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c @@ -23,7 +23,8 @@ #include #include #include -#include +#include +#include #include "atmel_usba_udc.h" #define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \ @@ -415,8 +416,8 @@ static inline void usba_int_enb_set(struct usba_udc *udc, u32 val) static int vbus_is_present(struct usba_udc *udc) { - if (gpio_is_valid(udc->vbus_pin)) - return gpio_get_value(udc->vbus_pin) ^ udc->vbus_pin_inverted; + if (udc->vbus_pin) + return gpiod_get_value(udc->vbus_pin) ^ udc->vbus_pin_inverted; /* No Vbus detection: Assume always present */ return 1; @@ -1975,8 +1976,8 @@ static int atmel_usba_start(struct usb_gadget *gadget, mutex_lock(&udc->vbus_mutex); - if (gpio_is_valid(udc->vbus_pin)) - enable_irq(gpio_to_irq(udc->vbus_pin)); + if (udc->vbus_pin) + enable_irq(gpiod_to_irq(udc->vbus_pin)); /* If Vbus is present, enable the controller and wait for reset */ udc->vbus_prev = vbus_is_present(udc); @@ -1990,8 +1991,8 @@ static int atmel_usba_start(struct usb_gadget *gadget, return 0; err: - if (gpio_is_valid(udc->vbus_pin)) - disable_irq(gpio_to_irq(udc->vbus_pin)); + if (udc->vbus_pin) + disable_irq(gpiod_to_irq(udc->vbus_pin)); mutex_unlock(&udc->vbus_mutex); @@ -2006,8 +2007,8 @@ static int atmel_usba_stop(struct usb_gadget *gadget) { struct usba_udc *udc = container_of(gadget, struct usba_udc, gadget); - if (gpio_is_valid(udc->vbus_pin)) - disable_irq(gpio_to_irq(udc->vbus_pin)); + if (udc->vbus_pin) + disable_irq(gpiod_to_irq(udc->vbus_pin)); if (fifo_mode == 0) udc->configured_ep = 1; @@ -2054,7 +2055,6 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev, { u32 val; const char *name; - enum of_gpio_flags flags; struct device_node *np = pdev->dev.of_node; const struct of_device_id *match; struct device_node *pp; @@ -2074,9 +2074,9 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev, udc->num_ep = 0; - udc->vbus_pin = of_get_named_gpio_flags(np, "atmel,vbus-gpio", 0, - &flags); - udc->vbus_pin_inverted = (flags & OF_GPIO_ACTIVE_LOW) ? 1 : 0; + udc->vbus_pin = devm_gpiod_get_optional(&pdev->dev, "atmel,vbus", + GPIOD_IN); + udc->vbus_pin_inverted = gpiod_is_active_low(udc->vbus_pin); if (fifo_mode == 0) { pp = NULL; @@ -2247,7 +2247,6 @@ static int usba_udc_probe(struct platform_device *pdev) udc->pdev = pdev; udc->pclk = pclk; udc->hclk = hclk; - udc->vbus_pin = -ENODEV; platform_set_drvdata(pdev, udc); @@ -2277,24 +2276,18 @@ static int usba_udc_probe(struct platform_device *pdev) } udc->irq = irq; - if (gpio_is_valid(udc->vbus_pin)) { - if (!devm_gpio_request(&pdev->dev, udc->vbus_pin, "atmel_usba_udc")) { - irq_set_status_flags(gpio_to_irq(udc->vbus_pin), - IRQ_NOAUTOEN); - ret = devm_request_threaded_irq(&pdev->dev, - gpio_to_irq(udc->vbus_pin), NULL, + if (udc->vbus_pin) { + irq_set_status_flags(gpiod_to_irq(udc->vbus_pin), IRQ_NOAUTOEN); + ret = devm_request_threaded_irq(&pdev->dev, + gpiod_to_irq(udc->vbus_pin), NULL, usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS, "atmel_usba_udc", udc); if (ret) { - udc->vbus_pin = -ENODEV; + udc->vbus_pin = NULL; dev_warn(&udc->pdev->dev, "failed to request vbus irq; " "assuming always on\n"); } - } else { - /* gpio_request fail so use -EINVAL for gpio_is_valid */ - udc->vbus_pin = -EINVAL; - } } ret = usb_add_gadget_udc(&pdev->dev, &udc->gadget); @@ -2346,9 +2339,9 @@ static int usba_udc_suspend(struct device *dev) * Device may wake up. We stay clocked if we failed * to request vbus irq, assuming always on. */ - if (gpio_is_valid(udc->vbus_pin)) { + if (udc->vbus_pin) { usba_stop(udc); - enable_irq_wake(gpio_to_irq(udc->vbus_pin)); + enable_irq_wake(gpiod_to_irq(udc->vbus_pin)); } out: @@ -2364,8 +2357,8 @@ static int usba_udc_resume(struct device *dev) if (!udc->driver) return 0; - if (device_may_wakeup(dev) && gpio_is_valid(udc->vbus_pin)) - disable_irq_wake(gpio_to_irq(udc->vbus_pin)); + if (device_may_wakeup(dev) && udc->vbus_pin) + disable_irq_wake(gpiod_to_irq(udc->vbus_pin)); /* If Vbus is present, enable the controller and wait for reset */ mutex_lock(&udc->vbus_mutex); diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.h b/drivers/usb/gadget/udc/atmel_usba_udc.h index 860a00a6fdd0..969ce8f3c3e2 100644 --- a/drivers/usb/gadget/udc/atmel_usba_udc.h +++ b/drivers/usb/gadget/udc/atmel_usba_udc.h @@ -7,6 +7,8 @@ #ifndef __LINUX_USB_GADGET_USBA_UDC_H__ #define __LINUX_USB_GADGET_USBA_UDC_H__ +#include + /* USB register offsets */ #define USBA_CTRL 0x0000 #define USBA_FNUM 0x0004 @@ -323,7 +325,7 @@ struct usba_udc { struct platform_device *pdev; const struct usba_udc_errata *errata; int irq; - int vbus_pin; + struct gpio_desc *vbus_pin; int vbus_pin_inverted; int num_ep; int configured_ep; -- cgit From 3589cce2b92ba8a11372f2c707adc9eb623efa67 Mon Sep 17 00:00:00 2001 From: Jaejoong Kim Date: Tue, 27 Feb 2018 11:04:22 +0900 Subject: usb: gadget: udc: Use scnprintf() instead of snprintf() The show() method should use scnprintf() not snprintf() because snprintf() may returns a value that exceeds its second argument. Signed-off-by: Jaejoong Kim Signed-off-by: Felipe Balbi --- drivers/usb/gadget/udc/core.c | 4 ++-- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 1f8b19d9cf97..50988b21a21b 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -1482,7 +1482,7 @@ ssize_t name##_show(struct device *dev, \ struct device_attribute *attr, char *buf) \ { \ struct usb_udc *udc = container_of(dev, struct usb_udc, dev); \ - return snprintf(buf, PAGE_SIZE, "%s\n", \ + return scnprintf(buf, PAGE_SIZE, "%s\n", \ usb_speed_string(udc->gadget->param)); \ } \ static DEVICE_ATTR_RO(name) @@ -1497,7 +1497,7 @@ ssize_t name##_show(struct device *dev, \ struct usb_udc *udc = container_of(dev, struct usb_udc, dev); \ struct usb_gadget *gadget = udc->gadget; \ \ - return snprintf(buf, PAGE_SIZE, "%d\n", gadget->name); \ + return scnprintf(buf, PAGE_SIZE, "%d\n", gadget->name); \ } \ static DEVICE_ATTR_RO(name) diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c index e744d4b7bfed..baf72f95f0f1 100644 --- a/drivers/usb/gadget/udc/dummy_hcd.c +++ b/drivers/usb/gadget/udc/dummy_hcd.c @@ -2366,7 +2366,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb) { int ep = usb_pipeendpoint(urb->pipe); - return snprintf(buf, size, + return scnprintf(buf, size, "urb/%p %s ep%d%s%s len %d/%d\n", urb, ({ char *s; -- cgit From aaeab02ddcc830e31c33cdb72a3c117b2d499ae2 Mon Sep 17 00:00:00 2001 From: Benjamin Herrenschmidt Date: Fri, 23 Mar 2018 13:44:06 +1100 Subject: usb/gadget: Add an EP dispose() callback for EP lifetime tracking Some UDC may want to allocate endpoints dynamically, either because the HW supports an arbitrary large number or because (like the Aspeed BMC SoCs), the pool of HW endpoints is shared between multiple gadgets. The allocation side can be done rather easily using the existing match_ep() UDC hook. However we have no good place to "free" them. This implements a "simple" variant of this, which calls an EP dispose callback on all EPs associated with a gadget when the composite device gets unbound. This is required by my upcoming Aspeed vHub driver. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Felipe Balbi --- drivers/usb/gadget/composite.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'drivers/usb/gadget') diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 1924e20f6e8c..63a7cb87514a 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -2142,6 +2142,7 @@ end: void composite_dev_cleanup(struct usb_composite_dev *cdev) { struct usb_gadget_string_container *uc, *tmp; + struct usb_ep *ep, *tmp_ep; list_for_each_entry_safe(uc, tmp, &cdev->gstrings, list) { list_del(&uc->list); @@ -2163,6 +2164,21 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev) } cdev->next_string_id = 0; device_remove_file(&cdev->gadget->dev, &dev_attr_suspended); + + /* + * Some UDC backends have a dynamic EP allocation scheme. + * + * In that case, the dispose() callback is used to notify the + * backend that the EPs are no longer in use. + * + * Note: The UDC backend can remove the EP from the ep_list as + * a result, so we need to use the _safe list iterator. + */ + list_for_each_entry_safe(ep, tmp_ep, + &cdev->gadget->ep_list, ep_list) { + if (ep->ops->dispose) + ep->ops->dispose(ep); + } } static int composite_bind(struct usb_gadget *gadget, -- cgit