Commit Graph

19597 Commits

Author SHA1 Message Date
Romain Izard
a3e20083bd usb: gadget: udc: atmel: GPIO inversion is handled by gpiod
When converting to GPIO descriptors, gpiod_get_value automatically
handles the line inversion flags from the device tree.

Do not invert the line twice.

Fixes: 3df0340810 ("usb: gadget: udc: atmel: convert to use GPIO descriptors")
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:24:44 +03:00
Michel Pollet
1ca532e991 USB: rndis: Fix for handling garbled messages
A message can be forged to crash the stack; here we make sure we don't
completely break the system if this occurs

Signed-off-by: Michel Pollet <michel.pollet@bp.renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:24:28 +03:00
Masahiro Yamada
44feb8e6ea usb: dwc3: use local copy of resource to fix-up register offset
It is not a good idea to directly modify the resource of a platform
device.  Modify its local copy, and pass it to devm_ioremap_resource()
so that we do not need to restore it in the failure path and the remove
hook.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:23:47 +03:00
Chunfeng Yun
1ef6c42afc usb: gadget: composite: fill bcdUSB as 0x0320 for SuperSpeed or higher speeds
The USB3CV version 2.1.80 (March 26, 2018) requires all devices
( gen1, gen2, single lane, dual lane) to return the value of 0x0320
in the bcdUSB field

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:22:21 +03:00
Manu Gautam
bcb128777a usb: dwc3: core: Suspend PHYs on runtime suspend in host mode
Some PHY drivers (e.g. for Qualcomm QUSB2 and QMP PHYs) support
runtime PM to reduce PHY power consumption during bus_suspend.
Add changes to let core auto-suspend PHYs on host bus-suspend
using GUSB2PHYCFG register if needed for a platform. Also perform
PHYs runtime suspend/resume and let platform glue drivers e.g.
dwc3-qcom handle remote wakeup during bus suspend by waking up
devices on receiving wakeup event from PHY.

Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:20:32 +03:00
Manu Gautam
a4333c3a6b usb: dwc3: Add Qualcomm DWC3 glue driver
DWC3 controller on Qualcomm SOCs has a Qscratch wrapper.
Some of its uses are described below resulting in need to
have a separate glue driver instead of using dwc3-of-simple:
 - It exposes register interface to override vbus-override
   and lane0-pwr-present signals going to hardware. These
   must be updated in peripheral mode for DWC3 if vbus lines
   are not connected to hardware block. Otherwise RX termination
   in SS mode or DP pull-up is not applied by device controller.
 - pwr_events_irq_stat support to check if USB2 PHY is in L2 state
   before glue driver proceeds with suspend.
 - Support for wakeup interrupts lines that are asserted whenever
   there is any wakeup event on USB3 or USB2 bus.
 - Support to replace pip3 clock going to DWC3 with utmi clock
   for hardware configuration where SSPHY is not used with DWC3.

Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:20:13 +03:00
Icenowy Zheng
e362098f0e usb: dwc3: of-simple: Add compatible for Allwinner H6 platform
Add compatible string to use this generic glue layer to support
Allwinner H6 platform's dwc3 controller.

Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:18:35 +03:00
Lukasz Nowak
d3ac41bb33 usb: gadget: f_ecm: fix host mac address for multiple instances
In case there are multiple ecm instances, either for multiple
otg controllers, or multiple virtual links using libcomposite,
each instance needs to have its own host mac address string
value for iMACAddress.

Update the source array (ecm_string_defs), every time before
usb_gstrings_attach(). Without that, all links wrongly were
getting the same, last allocated, host mac address, rather
than the correct one, as requested via configfs.

Signed-off-by: Lukasz Nowak <lukasz.nowak@exablue.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:17:18 +03:00
John Greb
eea52743eb USB: Gadget Ethernet: Re-enable Jumbo frames.
Fixes: <b3e3893e1253> ("net: use core MTU range checking")
which patched only one of two functions used to setup the
USB Gadget Ethernet driver, causing a serious performance
regression in the ability to increase mtu size above 1500.

Signed-off-by: John Greb <h3x4m3r0n@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:17:14 +03:00
Artur Petrosyan
c7c24e7a04 usb: dwc2: Change reading of current frame number flow.
The current frame_number is read from core for both
device and host modes. Reading of the current frame
number needs to be performed ASAP due to IRQ latency's.
This is why, it is moved to common interrupt handler.

Accordingly updated dwc2_gadget_target_frame_elapsed()
function which uses stored frame_number instead of
reading frame number.

In cases when target frame value is incremented
the frame_number is required to read again.

Signed-off-by: Artur Petrosyan <arturp@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:17:09 +03:00
Stefan Wahren
971b750d31 usb: dwc2: debugfs: Don't touch RX FIFO during register dump
Dumping the registers via debugfs makes USB on Raspberry Pi completely
unusable. The read of register GRXSTSP ("Receive Status Read and Pop
Register") is responsible for this behaviour, because it pops the RX FIFO.
So avoid this by omitting the relevant register.

CC: Mian Yousaf Kaukab <yousaf.kaukab@intel.com>
Fixes: 563cf017c4 ("usb: dwc2: debugfs: add support for complete register dump")
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:17:00 +03:00
Artur Petrosyan
d5d5f07913 usb: dwc2: Fix crash in incomplete isoc intr handlers.
Crash caused by going out of "eps_out" array range.
Iteration on "eps_out" changed to less than "num_of_eps".

Signed-off-by: Artur Petrosyan <arturp@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:16:50 +03:00
Grigor Tovmasyan
b43ebc96e9 usb: dwc2: Add Interpacket Gap(IPG) feature support
Added GHWCFG4_IPG_ISOC_SUPPORTED and DCFG_IPG_ISOC_SUPPORDED
bits definitions to enable/disable IPG feature.

Added ipg_isoc_en core parameter which will indicate IPG support
enable/disable and initialize it.

Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:16:47 +03:00
Minas Harutyunyan
37981e0050 usb: dwc2: Enable BNA interrupt for IN endpoints
In DDMA mode required to enable BNA interrupt for
both directions.

Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:16:43 +03:00
Minas Harutyunyan
729cac693e usb: dwc2: Change ISOC DDMA flow
Changed existing two descriptor-chain flow to one chain.

In two-chain implementation BNA interrupt used for switching between
two chains. BNA interrupt asserted because of returning to
beginning of the chain based on L-bit of last descriptor.

Because of that we lose packets. This issue resolved by using one
desc-chain.

Removed all staff related to two desc-chain flow from
DDMA ISOC related functions.

Removed request length checking from dwc2_gadget_fill_isoc_desc()
function. Request length checking added to dwc2_hsotg_ep_queue()
function. If request length greater than descriptor limits then
request not added to queue. Additional checking done for High
Bandwidth ISOC OUT's which not supported by driver. In
dwc2_gadget_fill_isoc_desc() function also checked desc-chain
status (full or not) to avoid of reusing not yet processed
descriptors.

In dwc2_gadget_start_isoc_ddma() function creation of desc-chain
always started from descriptor 0. Before filling descriptors, they
were initialized by HOST BUSY status.

In dwc2_gadget_complete_isoc_request_ddma() added checking for
desc-chain rollover. Also added checking completion status.
Request completed successfully if DEV_DMA_STS is DEV_DMA_STS_SUCC,
otherwise complete with actual=0. For systems with high IRQ latency
added pointer compl_desc to next descriptor to be completed by
XferCompl interrupt. This pointer replace descriptor index calculation
based on DxEPDMA register. On descriptor completion interrupt
processing all descriptors starting from compl_desc till descriptor
which Buffer Status field not equal DMA_DONE status.

Actually removed dwc2_gadget_start_next_isoc_ddma() function because
now driver use only one desc-chain and instead that function added
dwc2_gadget_handle_isoc_bna() function for handling BNA interrupts.

Handling BNA interrupt done by flushing TxFIFOs for OUT EPs,
completing request with actual=0 and resetting desc-chain number and
target frame to initial values for restarting transfers.

On handling NAK request completed with actual=0. Incremented target
frame to allow fill desc chain and start transfers.
In DDMA mode avoided of frame number incrementing, because tracking
of frame number performed in dwc2_gadget_fill_isoc_desc() function.

When core assert XferCompl along with BNA, we should ignore XferCompl
in dwc2_hsotg_epint() function.

On BNA interrupt replaced dwc2_gadget_start_next_isoc_ddma() by above
mentioned BNA handler.

In dwc2_hsotg_ep_enable() function added sanity check of bInterval
for ISOC IN in DDMA mode, because HW doesn't supported EP's with
bInterval more than 10 and check for mc for ISOC OUT transfers,
because core doesn't support high bandwidth transfers.

Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:16:19 +03:00
Chunfeng Yun
f39846824c usb: mtu3: make USB_MTU3_DUAL_ROLE depend on EXTCON but not USB_MTU3
In fact the driver depends on EXTCON only when it's configed as
USB_MTU3_DUAL_ROLE, so make USB_MTU3_DUAL_ROLE depend on EXTCON but
not USB_MTU3.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:15:10 +03:00
Chunfeng Yun
f3b28e5e07 usb: mtu3: fix operation failure when test TEST_J/K
There is an error dialog popped up in PC when test TEST_J/K
by EHSETT tool, due to not waiting for the completion of
control transfer. Here fix it by entering test mode after
Status Stage finish.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:15:07 +03:00
Chunfeng Yun
11254eb2de usb: mtu3: fix an unrecognized issue when connected with PC
When boot on the platform with the USB cable connected to Win7,
the Win7 will pop up an error dialog: "USB Device not recognized",
but finally the Win7 can enumerate it successfully.
The root cause is as the following:
When the xHCI driver set PORT_POWER of the OTG port, and if both
IDPIN and VBUS_VALID are high at the same time, the MTU3 controller
will set SESSION and pull up DP, so the Win7 can detect existence
of USB device, but if the mtu3 driver can't switch to device mode
during the debounce time, the Win7 can not enumerate it.
Here to fix it by removing the 1s delayed EXTCON register to speed up
mode switch.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:14:59 +03:00
Chunfeng Yun
00505adef8 usb: mtu3: remove repeated setting of gadget state
The usb_add_gadget_udc() will set the gadget state as
USB_STATE_NOTATTACHED, so we needn't set it again.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:14:57 +03:00
Chunfeng Yun
288ee3c362 usb: mtu3: avoid TX data length truncated in SS/SSP mode
The variable of 'count' is declared as u8, this will cause an issue
due to value truncated when works in SS or SSP mode and data length
is greater than 255, so change it as u32.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:14:56 +03:00
Wolfram Sang
64f5b56c91 usb: phy: simplify getting .drvdata
We should get drvdata from struct device directly. Going via
platform_device is an unneeded step back and forth.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:11:17 +03:00
Wolfram Sang
8836b39a16 usb: mtu3: simplify getting .drvdata
We should get drvdata from struct device directly. Going via
platform_device is an unneeded step back and forth.

Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:11:08 +03:00
Dmitry Osipenko
e10d3fc5bc usb: phy: Add Kconfig entry for Tegra PHY driver
Tegra's EHCI driver has a build dependency on Tegra's PHY driver and
currently Tegra's PHY driver is built only when Tegra's EHCI driver is
built. Add own Kconfig entry for the Tegra's PHY driver so that drivers
other than ehci-tegra (like ChipIdea UDC) could work with ehci-tegra
driver being disabled in kernels config by allowing user to manually
select the PHY driver.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:09:51 +03:00
Dmitry Osipenko
d2b9889f77 usb: tegra: Move utmi-pads reset from ehci-tegra to tegra-phy
UTMI pads are shared by USB controllers and reset of UTMI pads is shared
with the reset of USB1 controller. Currently reset of UTMI pads is done by
the EHCI driver and ChipIdea UDC works because EHCI driver always happen
to be probed first. Move reset controls from ehci-tegra to tegra-phy in
order to resolve the problem.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:09:49 +03:00
Dmitry Osipenko
3e1d333f6b usb: phy: tegra: Cleanup error messages
Tegra's PHY driver has a mix of pr_err() and dev_err(), let's switch to
dev_err() and use common errors message formatting across the driver for
consistency.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:09:46 +03:00
Jerry Zhang
6819e3233f usb: gadget: f_fs: Add compat_ioctl to epfiles
This allows 32 bit owners of ffs endpoints to
make ioctls into a 64 bit kernel.

All of the current epfile ioctls can be handled
with the same struct definitions as regular
ioctl.

Acked-by: Michał Nazarewicz <mina86@mina86.com>
Signed-off-by: Jerry Zhang <zhangjerry@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:08:56 +03:00
Jerry Zhang
9286e24b83 usb: gadget: f_midi: Use refcount when freeing f_midi_opts
Currently, the midi function is not freed until it is
both removed from the config and released by the user.
Since the user could take a long time to release the
card, it's possible that the function could be unlinked
and thus f_midi_opts would be null when freeing f_midi.

Thus, refcount f_midi_opts and only free it when it is
unlinked and all f_midis have been freed.

Signed-off-by: Jerry Zhang <zhangjerry@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:08:44 +03:00
Benjamin Herrenschmidt
7ecca2a408 usb/gadget: Add driver for Aspeed SoC virtual hub
The Aspeed BMC SoCs support a "virtual hub" function. It provides some
HW support for a top-level USB2 hub behind which sit 5 gadget "ports".

This driver adds support for the full functionality, emulating the
hub standard requests and exposing 5 UDC gadget drivers corresponding
to the ports.

The hub itself has HW provided dedicated EP0 and EP1 (the latter for
hub interrupts). It also has dedicated EP0s for each function. For
other endpoints, there's a pool of 15 "generic" endpoints that are
shared among the ports.

The driver relies on my previous patch adding a "dispose" EP op to
handle EP allocation between ports. EPs are allocated from the shared
pool in the UDC "match_ep" callback and assigned to the UDC instance
(added to the gadget ep_list).

When the composite driver gets unbound, the new hook will allow the UDC
to clean things up and return those EPs to the shared pool.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:06:53 +03:00
Benjamin Herrenschmidt
655016dc2d usb/gadget: Constify usb_gadget_get_string "table" argument
The table is never modified by the function. This allows us
to use it on a statically defined table that is marked const.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-05-15 10:06:49 +03:00
Daniel Glöckner
ebc3dd688c usb: musb: fix remote wakeup racing with suspend
It has been observed that writing 0xF2 to the power register while it
reads as 0xF4 results in the register having the value 0xF0, i.e. clearing
RESUME and setting SUSPENDM in one go does not work. It might also violate
the USB spec to transition directly from resume to suspend, especially
when not taking T_DRSMDN into account. But this is what happens when a
remote wakeup occurs between SetPortFeature USB_PORT_FEAT_SUSPEND on the
root hub and musb_bus_suspend being called.

This commit returns -EBUSY when musb_bus_suspend is called while remote
wakeup is signalled and thus avoids to reset the RESUME bit. Ignoring
this error when musb_port_suspend is called from musb_hub_control is ok.

Signed-off-by: Daniel Glöckner <dg@emlix.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-14 17:04:06 +02:00
Mathias Nyman
2278446e2b xhci: Fix USB3 NULL pointer dereference at logical disconnect.
Hub driver will try to disable a USB3 device twice at logical disconnect,
racing with xhci_free_dev() callback from the first port disable.

This can be triggered with "udisksctl power-off --block-device <disk>"
or by writing "1" to the "remove" sysfs file for a USB3 device
in 4.17-rc4.

USB3 devices don't have a similar disabled link state as USB2 devices,
and use a U3 suspended link state instead. In this state the port
is still enabled and connected.

hub_port_connect() first disconnects the device, then later it notices
that device is still enabled (due to U3 states) it will try to disable
the port again (set to U3).

The xhci_free_dev() called during device disable is async, so checking
for existing xhci->devs[i] when setting link state to U3 the second time
was successful, even if device was being freed.

The regression was caused by, and whole thing revealed by,
Commit 44a182b9d1 ("xhci: Fix use-after-free in xhci_free_virt_device")
which sets xhci->devs[i]->udev to NULL before xhci_virt_dev() returned.
and causes a NULL pointer dereference the second time we try to set U3.

Fix this by checking xhci->devs[i]->udev exists before setting link state.

The original patch went to stable so this fix needs to be applied there as
well.

Fixes: 44a182b9d1 ("xhci: Fix use-after-free in xhci_free_virt_device")
Cc: <stable@vger.kernel.org>
Reported-by: Jordan Glover <Golden_Miller83@protonmail.ch>
Tested-by: Jordan Glover <Golden_Miller83@protonmail.ch>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-14 11:05:53 +02:00
Greg Kroah-Hartman
58318cd4df Merge 4.17-rc4 into usb-next
We want the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-08 09:47:16 +02:00
Greg Kroah-Hartman
6844dc4272 Merge tag 'usb-serial-4.17-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:

USB-serial fixes for v4.17-rc4

Here's a fix for a long-standing issue in the visor driver, which could
have security implications. Included is also a new modem device id.

Both commits have been in linux-next for a couple of days with no
reported issues.

Signed-off-by: Johan Hovold <johan@kernel.org>
2018-05-04 14:38:32 -07:00
Greg Kroah-Hartman
43b78f1155 Revert "usb: host: ehci: Use dma_pool_zalloc()"
This reverts commit 22072e83eb as it is
broken.

Alan writes:
	What you can't see just from reading the patch is that in both
	cases (ehci->itd_pool and ehci->sitd_pool) there are two
	allocation paths -- the two branches of an "if" statement -- and
	only one of the paths calls dma_pool_[z]alloc.  However, the
	memset is needed for both paths, and so it can't be eliminated.
	Given that it must be present, there's no advantage to calling
	dma_pool_zalloc rather than dma_pool_alloc.

Reported-by: Erick Cafferata <erick@cafferata.me>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Souptick Joarder <jrdr.linux@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-04 14:35:12 -07:00
Shuah Khan (Samsung OSG)
dcadfaf212 usbip: usbip_host: run rebind from exit when module is removed
After removing usbip_host module, devices it releases are left without
a driver. For example, when a keyboard or a mass storage device are
bound to usbip_host when it is removed, these devices are no longer
bound to any driver.

Fix it to run device_attach() from the module exit routine to restore
the devices to their original drivers. This includes cleanup changes
and moving device_attach() code to a common routine to be called from
rebind_store() and usbip_host_exit().

Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-03 13:52:03 -07:00
Shuah Khan (Samsung OSG)
ae70c6dc3f usbip: usbip_host: delete device from busid_table after rebind
Device is left in the busid_table after unbind and rebind. Rebind
initiates usb bus scan and the original driver claims the device.
After rescan the device should be deleted from the busid_table as
it no longer belongs to usbip_host.

Fix it to delete the device after device_attach() succeeds.

Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-03 13:52:02 -07:00
Heikki Krogerus
1a2f474d32 usb: typec: tps6598x: handle block reads separately with plain-I2C adapters
If the I2C adapter that the PD controller is attached to
does not support SMBus protocol, the driver needs to handle
block reads separately. The first byte returned in block
read protocol will show the total number of bytes. It needs
to be stripped away.

This is handled separately in the driver only because right
now we have no way of requesting the used protocol with
regmap-i2c. This is in practice a workaround for what is
really a problem in regmap-i2c. The other option would have
been to register custom regmap, or not use regmap at all,
however, since the solution is very simple, I choose to use
it in this case for convenience. It is easy to remove once
we figure out how to handle this kind of cases in
regmap-i2c.

Fixes: 0a4c005bd1 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-03 10:55:31 -07:00
Heikki Krogerus
5671a4608c usb: typec: tcpm: Release the role mux when exiting
The ref count for the USB role switch device must be
released after we are done using the switch.

Fixes: c6962c2972 ("usb: typec: tcpm: Set USB role switch to device mode when configured as such")
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-03 10:55:27 -07:00
Alan Stern
fb5ee84ea7 USB: Accept bulk endpoints with 1024-byte maxpacket
Some non-compliant high-speed USB devices have bulk endpoints with a
1024-byte maxpacket size.  Although such endpoints don't work with
xHCI host controllers, they do work with EHCI controllers.  We used to
accept these invalid sizes (with a warning), but we no longer do
because of an unintentional change introduced by commit aed9d65ac3
("USB: validate wMaxPacketValue entries in endpoint descriptors").

This patch restores the old behavior, so that people with these
peculiar devices can use them without patching their kernels by hand.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Suggested-by: Elvinas <elvinas@veikia.lt>
Fixes: aed9d65ac3 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-03 10:16:38 -07:00
Mathias Nyman
44a182b9d1 xhci: Fix use-after-free in xhci_free_virt_device
KASAN found a use-after-free in xhci_free_virt_device+0x33b/0x38e
where xhci_free_virt_device() sets slot id to 0 if udev exists:
if (dev->udev && dev->udev->slot_id)
	dev->udev->slot_id = 0;

dev->udev will be true even if udev is freed because dev->udev is
not set to NULL.

set dev->udev pointer to NULL in xhci_free_dev()

The original patch went to stable so this fix needs to be applied
there as well.

Fixes: a400efe455 ("xhci: zero usb device slot_id member when disabling and freeing a xhci slot")
Cc: <stable@vger.kernel.org>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-03 08:55:32 -07:00
Greg Kroah-Hartman
4842ed5bfc USB: serial: visor: handle potential invalid device configuration
If we get an invalid device configuration from a palm 3 type device, we
might incorrectly parse things, and we have the potential to crash in
"interesting" ways.

Fix this up by verifying the size of the configuration passed to us by
the device, and only if it is correct, will we handle it.

Note that this also fixes an information leak of slab data.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ johan: add comment about the info leak ]
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2018-05-02 09:37:19 +02:00
SZ Lin (林上智)
4205cb01f6 USB: serial: option: adding support for ublox R410M
This patch adds support for ublox R410M PID 0x90b2 USB modem to option
driver, this module supports LTE Cat M1 / NB1.

Interface layout:
0: QCDM/DIAG
1: ADB
2: AT
3: RMNET

Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
2018-05-02 09:15:22 +02:00
Giuseppe Lippolis
4d304a6fe9 USB: serial: option: blacklist unused dwm-158 interfaces
The dwm-158 interface 4 and 5 doesn't answer to the AT commands
and doesn't appears a option interface.
Tested on openwrt distribution (kernel 4.14 using the old blacklist
definitions).

Lars Melin also writes:

	Blacklisting interface 4 and 5 is correct because:

	MI_00 D-Link Mobile Broadband Device  (cdc_ether)
	MI_02 D-Link HSPA+DataCard Diagnostics Interface (also ppp modem)
	MI_03 D-Link HSPA+DataCard NMEA Device
	MI_04 D-Link HSPA+DataCard Speech Port
	MI_05 D-Link HSPA+DataCard Debug Port
	MI_06 USB Mass Storage Device

Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com>
[ johan: add Lars's comment on the interface layout and reword summary ]
Cc: Lars Melin <larsm17@gmail.com>
Cc: Dan Williams <dcbw@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
2018-05-02 09:09:48 +02:00
Bin Liu
9aea9b6cc7 usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
The usb_request pointer could be NULL in musb_g_tx(), where the
tracepoint call would trigger the NULL pointer dereference failure when
parsing the members of the usb_request pointer.

Move the tracepoint call to where the usb_request pointer is already
checked to solve the issue.

Fixes: fc78003e53 ("usb: musb: gadget: add usb-request tracepoints")
Cc: stable@vger.kernel.org # v4.8+
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-30 09:52:17 -07:00
Bin Liu
2b63f1329d usb: musb: host: fix potential NULL pointer dereference
musb_start_urb() doesn't check the pass-in parameter if it is NULL.  But
in musb_bulk_nak_timeout() the parameter passed to musb_start_urb() is
returned from first_qh(), which could be NULL.

So wrap the musb_start_urb() call here with a if condition check to
avoid the potential NULL pointer dereference.

Fixes: f283862f3b ("usb: musb: NAK timeout scheme on bulk TX endpoint")
Cc: stable@vger.kernel.org # v3.7+
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-30 09:52:17 -07:00
Gustavo A. R. Silva
252427037a typec: tcpm: Fix incorrect 'and' operator
Currently, logical and is being used instead of *bitwise* and.

Fix this by using a proper bitwise and operator.

Addresses-Coverity-ID: 1468455 ("Logical vs. bitwise operator")
Fixes: 64f7c494a3 ("typec: tcpm: Add support for sink PPS related messages")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-30 09:05:44 -07:00
Greg Kroah-Hartman
328da89950 Merge tag 'fixes-for-v4.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:

usb: fixes for v4.17-rc3

Not much this time around: A list_del corruption on dwc3_ep_dequeue(),
sparse warning fix also on dwc3, build issues with f_phonet.

Apart from these three, some other minor fixes.

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2018-04-30 08:49:58 -07:00
Greg Kroah-Hartman
890fa45d01 Merge 4.17-rc3 into usb-next
This resolves the merge issue with drivers/usb/core/hcd.c

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-30 04:58:51 -07:00
Colin Ian King
a4a00f6b9d usb-misc: sisusbvga: fix spelling mistake: "asymmeric" -> "asymmetric"
Trivial fix to spelling mistake in text string

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-29 15:38:18 +02:00
Greg Kroah-Hartman
573a094873 Merge tag 'usb-serial-4.17-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:

USB-serial fixes for v4.17-rc3

Here are a few device ids for -rc3, including a new "simple driver".

All have been in linux-next with no reported issues.

Signed-off-by: Johan Hovold <johan@kernel.org>
2018-04-26 19:29:24 +02:00