1. 11 10月, 2017 1 次提交
    • A
      USB: dummy-hcd: Fix deadlock caused by disconnect detection · ab219221
      Alan Stern 提交于
      The dummy-hcd driver calls the gadget driver's disconnect callback
      under the wrong conditions.  It should invoke the callback when Vbus
      power is turned off, but instead it does so when the D+ pullup is
      turned off.
      
      This can cause a deadlock in the composite core when a gadget driver
      is unregistered:
      
      [   88.361471] ============================================
      [   88.362014] WARNING: possible recursive locking detected
      [   88.362580] 4.14.0-rc2+ #9 Not tainted
      [   88.363010] --------------------------------------------
      [   88.363561] v4l_id/526 is trying to acquire lock:
      [   88.364062]  (&(&cdev->lock)->rlock){....}, at: [<ffffffffa0547e03>] composite_disconnect+0x43/0x100 [libcomposite]
      [   88.365051]
      [   88.365051] but task is already holding lock:
      [   88.365826]  (&(&cdev->lock)->rlock){....}, at: [<ffffffffa0547b09>] usb_function_deactivate+0x29/0x80 [libcomposite]
      [   88.366858]
      [   88.366858] other info that might help us debug this:
      [   88.368301]  Possible unsafe locking scenario:
      [   88.368301]
      [   88.369304]        CPU0
      [   88.369701]        ----
      [   88.370101]   lock(&(&cdev->lock)->rlock);
      [   88.370623]   lock(&(&cdev->lock)->rlock);
      [   88.371145]
      [   88.371145]  *** DEADLOCK ***
      [   88.371145]
      [   88.372211]  May be due to missing lock nesting notation
      [   88.372211]
      [   88.373191] 2 locks held by v4l_id/526:
      [   88.373715]  #0:  (&(&cdev->lock)->rlock){....}, at: [<ffffffffa0547b09>] usb_function_deactivate+0x29/0x80 [libcomposite]
      [   88.374814]  #1:  (&(&dum_hcd->dum->lock)->rlock){....}, at: [<ffffffffa05bd48d>] dummy_pullup+0x7d/0xf0 [dummy_hcd]
      [   88.376289]
      [   88.376289] stack backtrace:
      [   88.377726] CPU: 0 PID: 526 Comm: v4l_id Not tainted 4.14.0-rc2+ #9
      [   88.378557] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
      [   88.379504] Call Trace:
      [   88.380019]  dump_stack+0x86/0xc7
      [   88.380605]  __lock_acquire+0x841/0x1120
      [   88.381252]  lock_acquire+0xd5/0x1c0
      [   88.381865]  ? composite_disconnect+0x43/0x100 [libcomposite]
      [   88.382668]  _raw_spin_lock_irqsave+0x40/0x54
      [   88.383357]  ? composite_disconnect+0x43/0x100 [libcomposite]
      [   88.384290]  composite_disconnect+0x43/0x100 [libcomposite]
      [   88.385490]  set_link_state+0x2d4/0x3c0 [dummy_hcd]
      [   88.386436]  dummy_pullup+0xa7/0xf0 [dummy_hcd]
      [   88.387195]  usb_gadget_disconnect+0xd8/0x160 [udc_core]
      [   88.387990]  usb_gadget_deactivate+0xd3/0x160 [udc_core]
      [   88.388793]  usb_function_deactivate+0x64/0x80 [libcomposite]
      [   88.389628]  uvc_function_disconnect+0x1e/0x40 [usb_f_uvc]
      
      This patch changes the code to test the port-power status bit rather
      than the port-connect status bit when deciding whether to isue the
      callback.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Reported-by: NDavid Tulloh <david@tulloh.id.au>
      CC: <stable@vger.kernel.org>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      ab219221
  2. 28 9月, 2017 7 次提交
    • N
      usb: gadget: udc: atmel: set vbus irqflags explicitly · 6baeda12
      Nicolas Ferre 提交于
      The driver triggers actions on both edges of the vbus signal.
      
      The former PIO controller was triggering IRQs on both falling and rising edges
      by default. Newer PIO controller don't, so it's better to set it explicitly to
      IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING.
      
      Without this patch we may trigger the connection with host but only on some
      bouncing signal conditions and thus lose connecting events.
      Acked-by: NLudovic Desroches <ludovic.desroches@microchip.com>
      Signed-off-by: NNicolas Ferre <nicolas.ferre@microchip.com>
      Cc: stable <stable@vger.kernel.org> # v4.4+
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      6baeda12
    • Y
      usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe() · 447b8a01
      Yoshihiro Shimoda 提交于
      This patch fixes an issue that this driver cannot go status stage
      in control read when the req.zero is set to 1 and the len in
      usb3_write_pipe() is set to 0. Otherwise, if we use g_ncm driver,
      usb enumeration takes long time (5 seconds or more).
      
      Fixes: 746bfe63 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
      Cc: <stable@vger.kernel.org> # v4.5+
      Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      447b8a01
    • Y
      usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value · 73f2f574
      Yoshihiro Shimoda 提交于
      According to the datasheet of R-Car Gen3, the Pn_RAMMAP.Pn_MPKT should
      be set to one of 8, 16, 32, 64, 512 and 1024. Otherwise, when a gadget
      driver uses an interrupt endpoint, unexpected behavior happens. So,
      this patch fixes it.
      
      Fixes: 746bfe63 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
      Cc: <stable@vger.kernel.org> # v4.5+
      Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      73f2f574
    • Y
      usb: gadget: udc: renesas_usb3: fix for no-data control transfer · 4dcf4bab
      Yoshihiro Shimoda 提交于
      When bRequestType & USB_DIR_IN is false and req.length is 0 in control
      transfer, since it means non-data, this driver should not set the mode
      as control write. So, this patch fixes it.
      
      Fixes: 746bfe63 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
      Cc: <stable@vger.kernel.org> # v4.5+
      Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      4dcf4bab
    • A
      USB: dummy-hcd: Fix erroneous synchronization change · 7dbd8f4c
      Alan Stern 提交于
      A recent change to the synchronization in dummy-hcd was incorrect.
      The issue was that dummy_udc_stop() contained no locking and therefore
      could race with various gadget driver callbacks, and the fix was to
      add locking and issue the callbacks with the private spinlock held.
      
      UDC drivers aren't supposed to do this.  Gadget driver callback
      routines are allowed to invoke functions in the UDC driver, and these
      functions will generally try to acquire the private spinlock.  This
      would deadlock the driver.
      
      The correct solution is to drop the spinlock before issuing callbacks,
      and avoid races by emulating the synchronize_irq() call that all real
      UDC drivers must perform in their ->udc_stop() routines after
      disabling interrupts.  This involves adding a flag to dummy-hcd's
      private structure to keep track of whether interrupts are supposed to
      be enabled, and adding a counter to keep track of ongoing callbacks so
      that dummy_udc_stop() can wait for them all to finish.
      
      A real UDC driver won't receive disconnect, reset, suspend, resume, or
      setup events once it has disabled interrupts.  dummy-hcd will receive
      them but won't try to issue any gadget driver callbacks, which should
      be just as good.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Fixes: f16443a0 ("USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks")
      CC: <stable@vger.kernel.org>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      7dbd8f4c
    • A
      USB: dummy-hcd: fix infinite-loop resubmission bug · 0173a68b
      Alan Stern 提交于
      The dummy-hcd HCD/UDC emulator tries not to do too much work during
      each timer interrupt.  But it doesn't try very hard; currently all
      it does is limit the total amount of bulk data transferred.  Other
      transfer types aren't limited, and URBs that transfer no data (because
      of an error, perhaps) don't count toward the limit, even though on a
      real USB bus they would consume at least a minimum overhead.
      
      This means it's possible to get the driver stuck in an infinite loop,
      for example, if the host class driver resubmits an URB every time it
      completes (which is common for interrupt URBs).  Each time the URB is
      resubmitted it gets added to the end of the pending-URBs list, and
      dummy-hcd doesn't stop until that list is empty.  Andrey Konovalov was
      able to trigger this failure mode using the syzkaller fuzzer.
      
      This patch fixes the infinite-loop problem by restricting the URBs
      handled during each timer interrupt to those that were already on the
      pending list when the interrupt routine started.  Newly added URBs
      won't be processed until the next timer interrupt.  The problem of
      properly accounting for non-bulk bandwidth (as well as packet and
      transaction overhead) is not addressed here.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Reported-by: NAndrey Konovalov <andreyknvl@google.com>
      Tested-by: NAndrey Konovalov <andreyknvl@google.com>
      CC: <stable@vger.kernel.org>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      0173a68b
    • A
      USB: dummy-hcd: fix connection failures (wrong speed) · fe659bcc
      Alan Stern 提交于
      The dummy-hcd UDC driver is not careful about the way it handles
      connection speeds.  It ignores the module parameter that is supposed
      to govern the maximum connection speed and it doesn't set the HCD
      flags properly for the case where it ends up running at full speed.
      
      The result is that in many cases, gadget enumeration over dummy-hcd
      fails because the bMaxPacketSize byte in the device descriptor is set
      incorrectly.  For example, the default settings call for a high-speed
      connection, but the maxpacket value for ep0 ends up being set for a
      Super-Speed connection.
      
      This patch fixes the problem by initializing the gadget's max_speed
      and the HCD flags correctly.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      CC: <stable@vger.kernel.org>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      fe659bcc
  3. 20 9月, 2017 3 次提交
    • A
      usb: gadget: dummy: fix nonsensical comparisons · 7661ca09
      Arnd Bergmann 提交于
      gcc-8 points out two comparisons that are clearly bogus
      and almost certainly not what the author intended to write:
      
      drivers/usb/gadget/udc/dummy_hcd.c: In function 'set_link_state_by_speed':
      drivers/usb/gadget/udc/dummy_hcd.c:379:31: error: bitwise comparison always evaluates to false [-Werror=tautological-compare]
               USB_PORT_STAT_ENABLE) == 1 &&
                                     ^~
      drivers/usb/gadget/udc/dummy_hcd.c:381:25: error: bitwise comparison always evaluates to false [-Werror=tautological-compare]
            USB_SS_PORT_LS_U0) == 1 &&
                               ^~
      
      I looked at the code for a bit and came up with a change that makes
      it look like what the author probably meant here. This makes it
      look reasonable to me and to gcc, shutting up the warning.
      
      It does of course change behavior as the two conditions are actually
      evaluated rather than being hardcoded to false, and I have made no
      attempt at verifying that the changed logic makes sense in the context
      of a USB HCD, so that part needs to be reviewed carefully.
      
      Fixes: 1cd8fd28 ("usb: gadget: dummy_hcd: add SuperSpeed support")
      Cc: Tatyana Brokhman <tlinder@codeaurora.org>
      Cc: Felipe Balbi <balbi@kernel.org>
      Acked-by: NAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      7661ca09
    • R
      usb: gadget: udc: fix snps_udc_plat.c build errors · 641663a1
      Randy Dunlap 提交于
      Fix build errors that happen when CONFIG_EXTCON=m and
      CONFIG_USB_SNP_UDC_PLAT=y by preventing that combination in Kconfig.
      CONFIG_EXTCON can still be disabled or enabled for this driver since
      <linux/extcon.h> has stubs for the disabled case, but if CONFIG_EXTCON=m,
      USB_SNP_UDC_PLAT is restricted to m or n (cannot be builtin).
      
      drivers/built-in.o: In function `udc_plat_remove':
      snps_udc_plat.c:(.text+0x2c4060): undefined reference to `extcon_unregister_notifier'
      drivers/built-in.o: In function `udc_plat_probe':
      snps_udc_plat.c:(.text+0x2c438c): undefined reference to `extcon_get_edev_by_phandle'
      snps_udc_plat.c:(.text+0x2c43f2): undefined reference to `extcon_register_notifier'
      snps_udc_plat.c:(.text+0x2c4416): undefined reference to `extcon_get_state'
      snps_udc_plat.c:(.text+0x2c44f7): undefined reference to `extcon_unregister_notifier'
      Reported-by: Nkbuild test robot <fengguang.wu@intel.com>
      Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      641663a1
    • R
      usb: gadget: core: fix ->udc_set_speed() logic · 97e133d5
      Roger Quadros 提交于
      Consider the following case: udc controller supports SuperSpeed.  If we
      first load a HighSpeed gadget followed by a SuperSpeed gadget, the
      SuperSpeed gadget will be limited to HighSpeed as UDC core driver
      doesn't call ->udc_set_speed() in the second case.
      
      Call ->udc_set_speed() unconditionally to fix this issue.
      
      This will also fix the case for dwc3 controller driver when SuperSpeed
      gadget is loaded first and works in HighSpeed only as udc_set_speed()
      was never being called.
      
      Fixes: 6099eca796ae ("usb: gadget: core: introduce ->udc_set_speed() method")
      Cc: <stable@vger.kernel.org> [v4.13+]
      Signed-off-by: NRoger Quadros <rogerq@ti.com>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      97e133d5
  4. 18 8月, 2017 1 次提交
    • A
      USB: Gadget core: fix inconsistency in the interface tousb_add_gadget_udc_release() · afd7fd81
      Alan Stern 提交于
      The usb_add_gadget_udc_release() routine in the USB gadget core will
      sometimes but not always call the gadget's release function when an
      error occurs.  More specifically, if the struct usb_udc allocation
      fails then the release function is not called, and for other errors it
      is.
      
      As a result, users of this routine cannot know whether they need to
      deallocate the memory containing the gadget structure following an
      error.  This leads to unavoidable memory leaks or double frees.
      
      This patch fixes the problem by splitting the existing
      device_register() call into device_initialize() and device_add(), and
      doing the udc allocation in between.  That way, even if the allocation
      fails it is still possible to call device_del(), and so the release
      function will be always called following an error.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Reported-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      afd7fd81
  5. 16 8月, 2017 1 次提交
  6. 15 8月, 2017 13 次提交
  7. 11 8月, 2017 1 次提交
  8. 09 8月, 2017 3 次提交
  9. 03 8月, 2017 1 次提交
  10. 22 7月, 2017 1 次提交
  11. 18 7月, 2017 4 次提交
  12. 17 7月, 2017 2 次提交
  13. 19 6月, 2017 2 次提交