- Apr 21, 2023
-
-
Wesley Cheng authored
Several sequences utilize the same routine for forcing the control endpoint back into the SETUP phase. This is required, because those operations need to ensure that EP0 is back in the default state. Acked-by:
Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by:
Wesley Cheng <quic_wcheng@quicinc.com> Link: https://lore.kernel.org/r/20230420212759.29429-3-quic_wcheng@quicinc.com Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Wesley Cheng authored
Do not call gadget stop until the poll for controller halt is completed. DEVTEN is cleared as part of gadget stop, so the intention to allow ep0 events to continue while waiting for controller halt is not happening. Fixes: c9668379 ("usb: dwc3: ep0: Don't prepare beyond Setup stage") Cc: stable@vger.kernel.org Acked-by:
-
- Apr 20, 2023
-
-
Alan Stern authored
The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387 shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of these endpoints (and similarly for the radio-shark driver). Link: https://syzkaller.appspot.com/bug?extid=4b3f8190f6e13b3efd74 Reported-and-tested-by:
<syzbot+4b3f8190f6e13b3efd74@syzkaller.appspotmail.com> Signed-off-by:
Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/e2858ab4-4adf-46e5-bbf6-c56742034547@rowland.harvard.edu Signed-off-by:
-
Alan Stern authored
The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce70 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18 e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003 R15: ffff888021213600 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sisusb_bulkout_msg drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline] sisusb_send_bulk_msg.constprop.0+0x904/0x1230 drivers/usb/misc/sisusbvga/sisusbvga.c:379 sisusb_send_bridge_packet drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline] sisusb_do_init_gfxdevice drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline] sisusb_init_gfxdevice+0x87b/0x4000 drivers/usb/misc/sisusbvga/sisusbvga.c:2177 sisusb_probe+0x9cd/0xbe2 drivers/usb/misc/sisusbvga/sisusbvga.c:2869 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of the endpoints. Link: https://syzkaller.appspot.com/bug?extid=23be03b56c5259385d79 Reported-and-tested-by:
<syzbot+23be03b56c5259385d79@syzkaller.appspotmail.com> Signed-off-by:
-
Alan Stern authored
Many of the older USB drivers in the Linux USB stack were written based simply on a vendor's device specification. They use the endpoint information in the spec and assume these endpoints will always be present, with the properties listed, in any device matching the given vendor and product IDs. While that may have been true back then, with spoofing and fuzzing it is not true any more. More and more we are finding that those old drivers need to perform at least a minimum of checking before they try to use any endpoint other than ep0. To make this checking as simple as possible, we now add a couple of utility routines to the USB core. usb_check_bulk_endpoints() and usb_check_int_endpoints() take an interface pointer together with a list of endpoint addresses (numbers and directions). They check that the interface's current alternate setting includes endpoints with those addresses and that each of these endpoints has the right type: bulk or interrupt, respectively. Although we already have usb_find_common_endpoints() and related routines meant for a similar purpose, they are not well suited for this kind of checking. Those routines find endpoints of various kinds, but only one (either the first or the last) of each kind, and they don't verify that the endpoints' addresses agree with what the caller expects. In theory the new routines could be more general: They could take a particular altsetting as their argument instead of always using the interface's current altsetting. In practice I think this won't matter too much; multiple altsettings tend to be used for transferring media (audio or visual) over isochronous endpoints, not bulk or interrupt. Drivers for such devices will generally require more sophisticated checking than these simplistic routines provide. Signed-off-by:
-
Wesley Cheng authored
It was observed that there are hosts that may complete pending SETUP transactions before the stop active transfers and controller halt occurs, leading to lingering endxfer commands on DEPs on subsequent pullup/gadget start iterations. dwc3_gadget_ep_disable name=ep8in flags=0x3009 direction=1 dwc3_gadget_ep_disable name=ep4in flags=1 direction=1 dwc3_gadget_ep_disable name=ep3out flags=1 direction=0 usb_gadget_disconnect deactivated=0 connected=0 ret=0 The sequence shows that the USB gadget disconnect (dwc3_gadget_pullup(0)) routine completed successfully, allowing for the USB gadget to proceed with a USB gadget connect. However, if this occurs the system runs into an issue where: BUG: spinlock already unlocked on CPU spin_bug+0x0 dwc3_remove_requests+0x278 dwc3_ep0_out_start+0xb0 __dwc3_gadget_start+0x25c This is due to the pending endxfers, leading to gadget start (w/o lock held) to execute the remove requests, which will unlock the dwc3 spinlock as part of giveback. To mitigate this, resolve the pending endxfers on the pullup disable path by re-locating the SETUP phase check after stop active transfers, since that is where the DWC3_EP_DELAY_STOP is potentially set. This also allows for handling of a host that may be unresponsive by using the completion timeout to trigger the stall and restart for EP0. Fixes: c9668379 ("usb: dwc3: ep0: Don't prepare beyond Setup stage") Cc: stable@vger.kernel.org Acked-by:
-
Stanley Chang authored
Add a new 'snps,parkmode-disable-hs-quirk' DT quirk to dwc3 core for disable the high-speed parkmode. For some USB wifi devices, if enable this feature it will reduce the performance. Therefore, add an option for disabling HS park mode by device-tree. In Synopsys's dwc3 data book: In a few high speed devices when an IN request is sent within 900ns of the ACK of the previous packet, these devices send a NAK. When connected to these devices, if required, the software can disable the park mode if you see performance drop in your system. When park mode is disabled, pipelining of multiple packet is disabled and instead one packet at a time is requested by the scheduler. This allows up to 12 NAKs in a micro-frame and improves performance of these slow devices. Acked-by:
Rob Herring <robh@kernel.org> Signed-off-by:
Stanley Chang <stanley_chang@realtek.com> Link: https://lore.kernel.org/r/20230419020044.15475-2-stanley_chang@realtek.com Signed-off-by:
-
Stanley Chang authored
Setting the PARKMODE_DISABLE_HS bit in the DWC3_USB3_GUCTL1. When this bit is set to '1' all HS bus instances in park mode are disabled For some USB wifi devices, if enable this feature it will reduce the performance. Therefore, add an option for disabling HS park mode by device-tree. In Synopsys's dwc3 data book: In a few high speed devices when an IN request is sent within 900ns of the ACK of the previous packet, these devices send a NAK. When connected to these devices, if required, the software can disable the park mode if you see performance drop in your system. When park mode is disabled, pipelining of multiple packet is disabled and instead one packet at a time is requested by the scheduler. This allows up to 12 NAKs in a micro-frame and improves performance of these slow devices. Acked-by:
-
Krzysztof Kozlowski authored
Qualcomm MSM8974 comes with USB HS phy in two variants, although final DTS chooses only one. Allow such combination in the ChipIdea USB2 bindings and also disallow any other properties in the ulpi node. Signed-off-by:
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20230420065051.22994-1-krzysztof.kozlowski@linaro.org Signed-off-by:
-
Chunfeng Yun authored
Add optional clock 'xhci_ck' which is usually the same as sys_ck, but some SoC use two separated clocks when the controller supports dual role mode; Add optional clock 'frmcnt_ck' used on 4nm or advanced process SoC. Signed-off-by:
Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/20230417025203.18097-7-chunfeng.yun@mediatek.com Signed-off-by:
-
Chunfeng Yun authored
Add optional clock 'xhci_ck' and 'frmcnt_ck'; Reviewed-by:
-
Chunfeng Yun authored
The allow_userspace_control flag enables manual role switch from userspace, turn this feature on like several other USB DRD controller drivers. Reviewed-by:
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by:
-
Chunfeng Yun authored
No need unlock @mtu->lock when unmap request, unlock it just before giving back request, due to we do not lock this spinlock when map the request. Reviewed-by:
-
Chunfeng Yun authored
When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it. e.g. qmu done irq on cpu0 thread running on cpu1 qmu_done_tx() handle gpd [0] mtu3_requ_complete() mtu3_gadget_ep_disable() unlock @mtu->lock give back request lock @mtu->lock mtu3_ep_disable() mtu3_gpd_ring_free() unlock @mtu->lock lock @mtu->lock get next gpd [1] [1]: goto [0] to handle next gpd, and next gpd may be NULL. Fixes: 48e0d373 ("usb: mtu3: supports new QMU format") Signed-off-by: -
Chunfeng Yun authored
Prefer to use boolean value due to gpd_ring_empty() return true or false. See "16) Function return values and names" in coding-style.rst Reviewed-by:
-
Chunfeng Yun authored
When the Rx enconnter errors, currently, only print error logs, that may cause class driver's RX halt, shall give back the request with error status meanwhile. Signed-off-by:
-
Yinhao Hu authored
From the comment of ci_usb_phy_init, it returns an error code if usb_phy_init has failed, and it should do some clean up, not just return directly. Fix this by goto the error handling. Fixes: 74475ede ("usb: chipidea: move PHY operation to core") Reviewed-by:
Dongliang Mu <dzm91@hust.edu.cn> Acked-by:
Peter Chen <peter.chen@kernel.org> Signed-off-by:
Yinhao Hu <dddddd@hust.edu.cn> Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn Signed-off-by:
-
Badhri Jagan Sridharan authored
usb_gadget_connect calls gadget->ops->pullup without checking whether gadget->connected was previously set. Make this symmetric to usb_gadget_disconnect by returning early if gadget->connected is already set. Fixes: 5a1da544 ("usb: gadget: core: do not try to disconnect gadget if it is not connected") Cc: stable@vger.kernel.org Signed-off-by:
Badhri Jagan Sridharan <badhri@google.com> Link: https://lore.kernel.org/r/20230407030741.3163220-2-badhri@google.com Signed-off-by:
-
Badhri Jagan Sridharan authored
usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect. Guarding udc->vbus, udc->started, gadget->connect, gadget->deactivate related functions with connect_lock. usb_gadget_connect_locked, usb_gadget_disconnect_locked, usb_udc_connect_control_locked, usb_gadget_udc_start_locked, usb_gadget_udc_stop_locked are called with this lock held as they can be simulataneously invoked from different code paths. Adding an additional check to make sure udc is started(udc->started) before pullup callback is invoked. Fixes: 628ef0d2 ("usb: udc: add usb_udc_vbus_handler") Cc: stable@vger.kernel.org Signed-off-by:
-
Fabrice Gasnier authored
ucsi_init() may be deferred as usb_role_sw may be deferred in ucsi_register_port(). This results in several PPM init failed (-517) messages maybe printed several times upon boot, like on stm32mp135f-dk board, until the role_switch driver gets probed. [ 19.880945] dwc2 49000000.usb: supply vusb_d not found, using dummy regulator [ 19.887136] dwc2 49000000.usb: supply vusb_a not found, using dummy regulator [ 19.975432] ucsi-stm32g0-i2c 0-0053: PPM init failed (-517) [ 20.155746] dwc2 49000000.usb: EPs: 9, dedicated fifos, 952 entries in SPRAM [ 20.175429] ucsi-stm32g0-i2c 0-0053: PPM init failed (-517) [ 20.184242] dwc2 49000000.usb: DWC OTG Controller Adopt dev_err_probe() instead of dev_err(), to only print other errors. Also print an error in case the wait count has expired. Reviewed-by:
Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by:
Fabrice Gasnier <fabrice.gasnier@foss.st.com> Link: https://lore.kernel.org/r/20230412161734.3425090-1-fabrice.gasnier@foss.st.com Signed-off-by:
-
Frank Wang authored
PD3.0 Spec 6.4.4.3.2 say that only Responder supports 12 or more SVIDs, the Discover SVIDs Command Shall be executed multiple times until a Discover SVIDs VDO is returned ending either with a SVID value of 0x0000 in the last part of the last VDO or with a VDO containing two SVIDs with values of 0x0000. In the current implementation, if the last VDO does not find that the Discover SVIDs Command would be executed multiple times even if the Responder SVIDs are less than 12, and we found some odd dockers just meet this case. So fix it. Acked-by:
Frank Wang <frank.wang@rock-chips.com> Link: https://lore.kernel.org/r/20230316081149.24519-1-frank.wang@rock-chips.com Signed-off-by:
-
Johan Hovold authored
Clean up the probe variable declarations by removing the stray newlines. Acked-by:
Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20230404072524.19014-12-johan+linaro@kernel.org Signed-off-by:
-
Johan Hovold authored
The probe callback has become unwieldy so break out the clock lookups into a new helper function to improve readability. Acked-by:
-
Johan Hovold authored
Refactor the PHY handling using four new helpers to initialise, deinitialise, power on and power off all the PHYs. Acked-by:
-
Johan Hovold authored
Clean up the core init error handling by using descriptive names for the error labels and releasing resourcing in reverse order consistently. Acked-by:
-
Johan Hovold authored
While there likely are no platforms out there that mix generic and legacy PHYs the driver should still be able to handle that, if only for consistency reasons. Add the missing calls to shutdown any legacy PHYs if generic PHY initialisation fails. Note that we continue to happily ignore potential errors from the legacy PHY callbacks... Acked-by:
-
Johan Hovold authored
Use descriptive names consistently for the probe error labels. Acked-by:
-
Johan Hovold authored
The hibernation code is broken and has never been enabled in mainline and should thus be dropped. Specifically, the scratch buffer DMA mapping would have been leaked on every suspend cycle since commit 51f5d49a ("usb: dwc3: core: simplify suspend/resume operations") if this feature was ever enabled. The related error handling was also broken and could have resulted in attempts to unmap never mapped buffers, etc. This effectively revert commit 0ffcaf37 ("usb: dwc3: core: allocate scratch buffers"). Acked-by:
-
Johan Hovold authored
The hibernation code is broken and has never been enabled in mainline and should thus be dropped. Remove the hibernation bits from the gadget code, which effectively reverts commits e1dadd3b ("usb: dwc3: workaround: bogus hibernation events") and 7b2a0368 ("usb: dwc3: gadget: set KEEP_CONNECT in case of hibernation") except for the spurious interrupt warning. Acked-by:
-
Johan Hovold authored
Add the missing calls to disable autosuspend on probe errors and on driver unbind. Acked-by:
-
Johan Hovold authored
Make sure to balance the runtime PM usage count on driver unbind by adding back the pm_runtime_allow() call that had been erroneously removed. Fixes: 266d0493 ("usb: dwc3: core: don't trigger runtime pm when remove driver") Cc: stable@vger.kernel.org # 5.9 Cc: Li Jun <jun.li@nxp.com> Acked-by:
-
Johan Hovold authored
Make sure not to suspend the device when probe fails to avoid disabling clocks and phys multiple times. Fixes: 32808237 ("usb: dwc3: fix runtime PM in error path") Cc: stable@vger.kernel.org # 4.8 Cc: Roger Quadros <rogerq@ti.com> Acked-by:
-
Fabrice Gasnier authored
It's needed on STM32MP15, when using the integrated full-speed PHY. This clock is an output of USBPHYC, and the HS USBPHYC is not attached as PHY in this case (managed directly by dwc2 ggpio glue): &usbotg_hs { compatible = "st,stm32mp15-fsotg", "snps,dwc2"; pinctrl-names = "default"; pinctrl-0 = <&usbotg_hs_pins_a &usbotg_fs_dp_dm_pins_a>; vbus-supply = <&vbus_otg>; status = "okay"; }; USBPHYC clock output must be used, so it can be properly enabled as a clock provider. Without this, currently, when the dualport High-Speed USBPHYC isn't requested by either USBH or OTG, it remains uninitialized when probing OTG: OTG configured with full-speed PHY isn't properly clocked, resulting in error log like: [ 2.383138] dwc2 49000000.usb-otg: dwc2_core_reset: HANG! Soft Reset timeout GRSTCTL_CSFTRST. Signed-off-by: -
Fabrice Gasnier authored
Add support for the utmi clock. It's needed on STM32MP15, when using the integrated full-speed PHY. This clock is an output of USBPHYC, but HS USBPHYC is not attached as PHY in this case: Full-Speed PHY is directly managed in dwc2 glue, through GGPIO register. Typical DT when using FS PHY &usbotg_hs { compatible = "st,stm32mp15-fsotg", "snps,dwc2"; pinctrl-names = "default"; pinctrl-0 = <&usbotg_hs_pins_a &usbotg_fs_dp_dm_pins_a>; vbus-supply = <&vbus_otg>; status = "okay"; }; In this configuration, USBPHYC clock output must be defined, so it can be properly enabled as a clock provider: clocks = <&rcc USBO_K>, <&usbphyc>; clock-names = "otg", "utmi"; Acked-by:Minas Harutyunyan <hminas@synopsys.com> Signed-off-by:
-
Fabrice Gasnier authored
utmi clock is typically provided by PHY output. Add this optional clock, as the core could use other clocks depending on the SoC where it's used. This is needed on stm32mp15, when using the integrated full-speed PHY. Acked-by:
-
Fabrice Gasnier authored
Add error handling in __dwc2_lowlevel_hw_enable() that may leave the clocks and regulators enabled upon error. Acked-by:
-
Chunfeng Yun authored
Add optional clock frmcnt_ck used on 4nm or advanced process SoC Reviewed-by:
-
Chunfeng Yun authored
Add optional clock 'frmcnt_ck' used on 4nm or advanced process SoC Reviewed-by:
-
Stanley Chang authored
For Realtek SoC, the usb xhci uses different driver for u2phy and u3phy. Therefore, add a hook to retrieve the USB 3.0 PHY to XHCI plat. Signed-off-by:
-
Nobuhiro Iwamatsu authored
Use common dev_is_pci() helper for checking PCI devices. And if CONFIG_PCI is not defined, dev_is_pci returns false. Therefore, CONFIG_PCI is also unnecessary, so remove it. Signed-off-by:
Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp> Link: https://lore.kernel.org/r/20230405234605.2310155-1-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by:
-
