Commit Graph

4216 Commits

Author SHA1 Message Date
Kyungtae Kim 15753588bc USB: gadget: fix illegal array access in binding with UDC
FuzzUSB (a variant of syzkaller) found an illegal array access
using an incorrect index while binding a gadget with UDC.

Reference: https://www.spinics.net/lists/linux-usb/msg194331.html

This bug occurs when a size variable used for a buffer
is misused to access its strcpy-ed buffer.
Given a buffer along with its size variable (taken from user input),
from which, a new buffer is created using kstrdup().
Due to the original buffer containing 0 value in the middle,
the size of the kstrdup-ed buffer becomes smaller than that of the original.
So accessing the kstrdup-ed buffer with the same size variable
triggers memory access violation.

The fix makes sure no zero value in the buffer,
by comparing the strlen() of the orignal buffer with the size variable,
so that the access to the kstrdup-ed buffer is safe.

BUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200
drivers/usb/gadget/configfs.c:266
Read of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208

CPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xce/0x128 lib/dump_stack.c:118
 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374
 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266
 flush_write_buffer fs/configfs/file.c:251 [inline]
 configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283
 __vfs_write+0x85/0x110 fs/read_write.c:494
 vfs_write+0x1cd/0x510 fs/read_write.c:558
 ksys_write+0x18a/0x220 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:620
 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Signed-off-by: Kyungtae Kim <kt0755@gmail.com>
Reported-and-tested-by: Kyungtae Kim <kt0755@gmail.com>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200510054326.GA19198@pizza01
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-15 15:42:17 +02:00
Samuel Zou 4210f3a6e4 usb: gadget: udc: atmel: Make some symbols static
Fix the following sparse warnings:

drivers/usb/gadget/udc/atmel_usba_udc.c:188:30: warning: symbol 'queue_dbg_fops' was not declared.
drivers/usb/gadget/udc/atmel_usba_udc.c:196:30: warning: symbol 'regs_dbg_fops' was not declared.

queue_dbg_fops and regs_dbg_fops have only call within atmel_usba_udc.c
They should be static

Fixes: 914a3f3b37 ("USB: add atmel_usba_udc driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Samuel Zou <zou_wei@huawei.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-14 12:40:16 +03:00
Andrey Konovalov da39b5ee40 usb: raw-gadget: fix null-ptr-deref when reenabling endpoints
Currently we preassign gadget endpoints to raw-gadget endpoints during
initialization. Fix resetting this assignment in raw_ioctl_ep_disable(),
otherwise we will get null-ptr-derefs when an endpoint is reenabled.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-14 12:35:41 +03:00
Andrey Konovalov c61769bd47 usb: raw-gadget: support stalling/halting/wedging endpoints
Raw Gadget is currently unable to stall/halt/wedge gadget endpoints,
which is required for proper emulation of certain USB classes.

This patch adds a few more ioctls:

- USB_RAW_IOCTL_EP0_STALL allows to stall control endpoint #0 when
  there's a pending setup request for it.
- USB_RAW_IOCTL_SET/CLEAR_HALT/WEDGE allow to set/clear halt/wedge status
  on non-control non-isochronous endpoints.

Fixes: f2c2e71764 ("usb: gadget: add raw-gadget interface")
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-14 12:30:18 +03:00
Andrey Konovalov 97df5e5758 usb: raw-gadget: fix gadget endpoint selection
Currently automatic gadget endpoint selection based on required features
doesn't work. Raw Gadget tries iterating over the list of available
endpoints and finding one that has the right direction and transfer type.
Unfortunately selecting arbitrary gadget endpoints (even if they satisfy
feature requirements) doesn't work, as (depending on the UDC driver) they
might have fixed addresses, and one also needs to provide matching
endpoint addresses in the descriptors sent to the host.

The composite framework deals with this by assigning endpoint addresses
in usb_ep_autoconfig() before enumeration starts. This approach won't work
with Raw Gadget as the endpoints are supposed to be enabled after a
set_configuration/set_interface request from the host, so it's too late to
patch the endpoint descriptors that had already been sent to the host.

For Raw Gadget we take another approach. Similarly to GadgetFS, we allow
the user to make the decision as to which gadget endpoints to use.

This patch adds another Raw Gadget ioctl USB_RAW_IOCTL_EPS_INFO that
exposes information about all non-control endpoints that a currently
connected UDC has. This information includes endpoints addresses, as well
as their capabilities and limits to allow the user to choose the most
fitting gadget endpoint.

The USB_RAW_IOCTL_EP_ENABLE ioctl is updated to use the proper endpoint
validation routine usb_gadget_ep_match_desc().

These changes affect the portability of the gadgets that use Raw Gadget
when running on different UDCs. Nevertheless, as long as the user relies
on the information provided by USB_RAW_IOCTL_EPS_INFO to dynamically
choose endpoint addresses, UDC-agnostic gadgets can still be written with
Raw Gadget.

Fixes: f2c2e71764 ("usb: gadget: add raw-gadget interface")
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-14 12:30:17 +03:00
Andrey Konovalov 6e50764420 usb: raw-gadget: fix return value of ep read ioctls
They must return the number of bytes transferred during the data stage.

Fixes: 068fbff4f8 ("usb: raw-gadget: Fix copy_to/from_user() checks")
Fixes: f2c2e71764 ("usb: gadget: add raw-gadget interface")
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-09 11:05:09 +03:00
Wei Yongjun e27d4b30b7 usb: gadget: legacy: fix error return code in gncm_bind()
If 'usb_otg_descriptor_alloc()' fails, we must return a
negative error code -ENOMEM, not 0.

Fixes: 1156e91dd7 ("usb: gadget: ncm: allocate and init otg descriptor by otg capabilities")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-09 11:05:08 +03:00
Wei Yongjun e8f7f9e349 usb: gadget: legacy: fix error return code in cdc_bind()
If 'usb_otg_descriptor_alloc()' fails, we must return a
negative error code -ENOMEM, not 0.

Fixes: ab6796ae98 ("usb: gadget: cdc2: allocate and init otg descriptor by otg capabilities")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-09 11:05:08 +03:00
Masahiro Yamada d13cce7579 usb: gadget: legacy: fix redundant initialization warnings
Fix the following cppcheck warnings:

drivers/usb/gadget/legacy/inode.c:1364:8: style: Redundant initialization for 'value'. The initialized value is overwritten$
 value = -EOPNOTSUPP;
       ^
drivers/usb/gadget/legacy/inode.c:1331:15: note: value is initialized
 int    value = -EOPNOTSUPP;
              ^
drivers/usb/gadget/legacy/inode.c:1364:8: note: value is overwritten
 value = -EOPNOTSUPP;
       ^
drivers/usb/gadget/legacy/inode.c:1817:8: style: Redundant initialization for 'value'. The initialized value is overwritten$
 value = -EINVAL;
       ^
drivers/usb/gadget/legacy/inode.c:1787:18: note: value is initialized
 ssize_t   value = len, length = len;
                 ^
drivers/usb/gadget/legacy/inode.c:1817:8: note: value is overwritten
 value = -EINVAL;
       ^
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-09 11:05:08 +03:00
Thierry Reding 0534d40160 usb: gadget: tegra-xudc: Fix idle suspend/resume
When the XUDC device is idle (i.e. powergated), care must be taken not
to access any registers because that would lead to a crash.

Move the call to tegra_xudc_device_mode_off() into the same conditional
as the tegra_xudc_powergate() call to make sure we only force device
mode off if the XUDC is actually powered up.

Fixes: 49db427232 ("usb: gadget: Add UDC driver for tegra XUSB device mode controller")
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-09 11:05:08 +03:00
Christophe JAILLET ccaef7e6e3 usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'
'dev' is allocated in 'net2272_probe_init()'. It must be freed in the error
handling path, as already done in the remove function (i.e.
'net2272_plat_remove()')

Fixes: 90fccb529d ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-09 11:05:08 +03:00
Christophe JAILLET 19b94c1f9c usb: gadget: audio: Fix a missing error return value in audio_bind()
If 'usb_otg_descriptor_alloc()' fails, we must return an error code, not 0.

Fixes: 56023ce0fd ("usb: gadget: audio: allocate and init otg descriptor by otg capabilities")
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-05-09 11:05:02 +03:00
Greg Kroah-Hartman 4dfb9ce89f USB: fixes for v5.7-rc2
DWC3 learns how to properly set maxpacket limit and got a fix for a
 request completion bug. The raw gadget got a fix for
 copy_to/from_user() checks. Atmel got an improvement on vbus
 disconnect handling.
 
 We're also adding support for another SoC to the Renesas DRD driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEElLzh7wn96CXwjh2IzL64meEamQYFAl6cAmkRHGJhbGJpQGtl
 cm5lbC5vcmcACgkQzL64meEamQaFGBAA15Q1Wrs2jxdOM1wdbLiQY/T8eIt/0U8z
 itiBoB4MCJpSRUOVmsjNTWBpoo081GTzmjw7OCGVS5xhBiPn0ecrT5zu9fIfnKz4
 zRPUUK5Mo1vzU1Ii+Vvz6Lv2fHRMeYfRzItHb9qCQwV4RWwoTAuGg4idaeqGsy53
 sRxFo5nj4DzwVGcOuM8sEpuqPegcErh9+qv8aujbdCtWrvPC6ocJNlnjbxb2M7Yy
 FkbqKq22MP5ZXtBFW9cObhainje9sXQGVZX1mJjU+aQDDg86FbdMzysuLNI1Mc9X
 cwuDCPyS8kdoPLB3sLndaSBFIlrYWZQZ3HCV81B/ANEU3etEtLQROr6I3/oX+FlT
 TedA5fARr4ZS/SIDNtaRP3vNySoY+K2bYzfA0zS8CTAn0Jh5fA2vSxVFzneIdJVD
 CXaIH152VhxjZja5lT4Ftu2fwpr/vRZsDJ1e/a3hiNj+N+PWMdkEA13fND6HUUGm
 HLdLUwR9UofpLc3osr97o1rn6GcClI31rXJzRiXCJJm1QJpfjKZohgGNtJ1vsCEb
 gcLYQ8qZeKiWDZwXue5cuZ7VauvD6iaGuyfD24A5Oy2FtHV4/Em96Uu5YGDz4+Nm
 bRPMahrFI6qKQ/dxdTNVFOiEgZI3TTG4hRfJYBny6+smwnX+luCdMBLLzHpTx6dk
 uFfc89ezflg=
 =lK94
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v5.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

USB: fixes for v5.7-rc2

DWC3 learns how to properly set maxpacket limit and got a fix for a
request completion bug. The raw gadget got a fix for
copy_to/from_user() checks. Atmel got an improvement on vbus
disconnect handling.

We're also adding support for another SoC to the Renesas DRD driver.

* tag 'fixes-for-v5.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb:
  usb: raw-gadget: Fix copy_to/from_user() checks
  usb: raw-gadget: fix raw_event_queue_fetch locking
  usb: gadget: udc: atmel: Fix vbus disconnect handling
  usb: dwc3: gadget: Fix request completion check
  usb: dwc3: gadget: Do link recovery for SS and SSP
  dt-bindings: usb: renesas,usb3-peri: add r8a77961 support
  dt-bindings: usb: renesas,usbhs: add r8a77961 support
  dt-bindings: usb: usb-xhci: add r8a77961 support
  docs: dt: qcom,dwc3.txt: fix cross-reference for a converted file
  usb: dwc3: gadget: Properly set maxpacket limit
  usb: dwc3: Fix GTXFIFOSIZ.TXFDEP macro name
  usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
2020-04-20 13:29:31 +02:00
Dan Carpenter a7b778357c usb: raw-gadget: Fix copy_to/from_user() checks
The copy_to/from_user() functions return the number of bytes remaining
but we want to return negative error codes.  I changed a couple checks
in raw_ioctl_ep_read() and raw_ioctl_ep0_read() to show that we still
we returning zero on error.

Fixes: f2c2e71764 ("usb: gadget: add raw-gadget interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-04-17 12:26:26 +03:00
Andrey Konovalov 0666aa539e usb: raw-gadget: fix raw_event_queue_fetch locking
If queue->size check in raw_event_queue_fetch() fails (which normally
shouldn't happen, that check is a fail-safe), the function returns
without reenabling interrupts. This patch fixes that issue, along with
propagating the cause of failure to the function caller.

Fixes: f2c2e71764 ("usb: gadget: add raw-gadget interface"
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-04-17 12:23:19 +03:00
Cristian Birsan 12b94da411 usb: gadget: udc: atmel: Fix vbus disconnect handling
A DMA transfer can be in progress while vbus is lost due to a cable
disconnect. For endpoints that use DMA, this condition can lead to
peripheral hang. The patch ensures that endpoints are disabled before
the clocks are stopped to prevent this issue.

Fixes: a64ef71ddc ("usb: gadget: atmel_usba_udc: condition clocks to vbus state")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-04-17 11:55:29 +03:00
Udipto Goswami 1c2e54fbf1 usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
For userspace functions using OS Descriptors, if a function also supplies
Extended Property descriptors currently the counts and lengths stored in
the ms_os_descs_ext_prop_{count,name_len,data_len} variables are not
getting reset to 0 during an unbind or when the epfiles are closed. If
the same function is re-bound and the descriptors are re-written, this
results in those count/length variables to monotonically increase
causing the VLA allocation in _ffs_func_bind() to grow larger and larger
at each bind/unbind cycle and eventually fail to allocate.

Fix this by clearing the ms_os_descs_ext_prop count & lengths to 0 in
ffs_data_reset().

Fixes: f0175ab519 ("usb: gadget: f_fs: OS descriptors support")
Cc: stable@vger.kernel.org
Signed-off-by: Udipto Goswami <ugoswami@codeaurora.org>
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Reviewed-by: Manu Gautam <mgautam@codeaurora.org>
Link: https://lore.kernel.org/r/20200402044521.9312-1-sallenki@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-16 14:59:49 +02:00
Andrey Konovalov fdd10499de usb: raw-gadget: fix raw_event_queue_fetch locking
If queue->size check in raw_event_queue_fetch() fails (which normally
shouldn't happen, that check is a fail-safe), the function returns
without reenabling interrupts. This patch fixes that issue, along with
propagating the cause of failure to the function caller.

Fixes: f2c2e71764 ("usb: gadget: add raw-gadget interface")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Link: https://lore.kernel.org/r/9f7ce7a1472cfb9447f6c5a494186fa1f2670f6f.1586270396.git.andreyknvl@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-16 14:52:14 +02:00
Dan Carpenter 068fbff4f8 usb: raw-gadget: Fix copy_to/from_user() checks
The copy_to/from_user() functions return the number of bytes remaining
but we want to return negative error codes.  I changed a couple checks
in raw_ioctl_ep_read() and raw_ioctl_ep0_read() to show that we still
we returning zero on error.

Fixes: f2c2e71764 ("usb: gadget: add raw-gadget interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Link: https://lore.kernel.org/r/20200406145119.GG68494@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-16 14:52:10 +02:00
Nathan Chancellor 09b04abb70 usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
When building with Clang + -Wtautological-pointer-compare:

drivers/usb/gadget/udc/bdc/bdc_ep.c:543:28: warning: comparison of
address of 'req->queue' equal to a null pointer is always false
[-Wtautological-pointer-compare]
        if (req == NULL  || &req->queue == NULL || &req->usb_req == NULL)
                             ~~~~~^~~~~    ~~~~
drivers/usb/gadget/udc/bdc/bdc_ep.c:543:51: warning: comparison of
address of 'req->usb_req' equal to a null pointer is always false
[-Wtautological-pointer-compare]
        if (req == NULL  || &req->queue == NULL || &req->usb_req == NULL)
                                                    ~~~~~^~~~~~~    ~~~~
2 warnings generated.

As it notes, these statements will always evaluate to false so remove
them.

Fixes: efed421a94 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC")
Link: https://github.com/ClangBuiltLinux/linux/issues/749
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-04-16 11:02:26 +03:00
Linus Torvalds 79f51b7b9c SCSI misc on 20200402
update changing all our txt files to rst ones.  Excluding that, we
 have the usual driver updates (qla2xxx, ufs, lpfc, zfcp, ibmvfc,
 pm80xx, aacraid), a treewide update for scnprintf and some other minor
 updates.  The major core update is Hannes moving functions out of the
 aacraid driver and into the core.
 
 Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCXoYKiyYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishSasAP4iGwSB
 Y8tFaZgWadu76+wj5MdqTBoXdhnIuFF0rZG3pQEAiIKdsfQlbSFdm75+gUtx5hG/
 GOilX/pJczTRJDCGNis=
 =g7Sk
 -----END PGP SIGNATURE-----

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI updates from James Bottomley:
 "This series has a huge amount of churn because it pulls in Mauro's doc
  update changing all our txt files to rst ones.

  Excluding that, we have the usual driver updates (qla2xxx, ufs, lpfc,
  zfcp, ibmvfc, pm80xx, aacraid), a treewide update for scnprintf and
  some other minor updates.

  The major core change is Hannes moving functions out of the aacraid
  driver and into the core"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (223 commits)
  scsi: aic7xxx: aic97xx: Remove FreeBSD-specific code
  scsi: ufs: Do not rely on prefetched data
  scsi: dc395x: remove dc395x_bios_param
  scsi: libiscsi: Fix error count for active session
  scsi: hpsa: correct race condition in offload enabled
  scsi: message: fusion: Replace zero-length array with flexible-array member
  scsi: qedi: Add PCI shutdown handler support
  scsi: qedi: Add MFW error recovery process
  scsi: ufs: Enable block layer runtime PM for well-known logical units
  scsi: ufs-qcom: Override devfreq parameters
  scsi: ufshcd: Let vendor override devfreq parameters
  scsi: ufshcd: Update the set frequency to devfreq
  scsi: ufs: Resume ufs host before accessing ufs device
  scsi: ufs-mediatek: customize the delay for enabling host
  scsi: ufs: make HCE polling more compact to improve initialization latency
  scsi: ufs: allow custom delay prior to host enabling
  scsi: ufs-mediatek: use common delay function
  scsi: ufs: introduce common and flexible delay function
  scsi: ufs: use an enum for host capabilities
  scsi: ufs: fix uninitialized tx_lanes in ufshcd_disable_tx_lcc()
  ...
2020-04-02 17:03:53 -07:00
Linus Torvalds 4b9fd8a829 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
 "The main changes in this cycle were:

   - Continued user-access cleanups in the futex code.

   - percpu-rwsem rewrite that uses its own waitqueue and atomic_t
     instead of an embedded rwsem. This addresses a couple of
     weaknesses, but the primary motivation was complications on the -rt
     kernel.

   - Introduce raw lock nesting detection on lockdep
     (CONFIG_PROVE_RAW_LOCK_NESTING=y), document the raw_lock vs. normal
     lock differences. This too originates from -rt.

   - Reuse lockdep zapped chain_hlocks entries, to conserve RAM
     footprint on distro-ish kernels running into the "BUG:
     MAX_LOCKDEP_CHAIN_HLOCKS too low!" depletion of the lockdep
     chain-entries pool.

   - Misc cleanups, smaller fixes and enhancements - see the changelog
     for details"

* 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (55 commits)
  fs/buffer: Make BH_Uptodate_Lock bit_spin_lock a regular spinlock_t
  thermal/x86_pkg_temp: Make pkg_temp_lock a raw_spinlock_t
  Documentation/locking/locktypes: Minor copy editor fixes
  Documentation/locking/locktypes: Further clarifications and wordsmithing
  m68knommu: Remove mm.h include from uaccess_no.h
  x86: get rid of user_atomic_cmpxchg_inatomic()
  generic arch_futex_atomic_op_inuser() doesn't need access_ok()
  x86: don't reload after cmpxchg in unsafe_atomic_op2() loop
  x86: convert arch_futex_atomic_op_inuser() to user_access_begin/user_access_end()
  objtool: whitelist __sanitizer_cov_trace_switch()
  [parisc, s390, sparc64] no need for access_ok() in futex handling
  sh: no need of access_ok() in arch_futex_atomic_op_inuser()
  futex: arch_futex_atomic_op_inuser() calling conventions change
  completion: Use lockdep_assert_RT_in_threaded_ctx() in complete_all()
  lockdep: Add posixtimer context tracing bits
  lockdep: Annotate irq_work
  lockdep: Add hrtimer context tracing bits
  lockdep: Introduce wait-type checks
  completion: Use simple wait queues
  sched/swait: Prepare usage in completions
  ...
2020-03-30 16:17:15 -07:00
Linus Torvalds db34c5ffee USB / PHY patches for 5.7-rc1
Here are the big set of USB and PHY driver patches for 5.7-rc1.
 
 Nothing huge here, some new PHY drivers, loads of USB gadget fixes and
 updates, xhci updates, usb-serial driver updates and new device ids, and
 other minor things.  Full details in the shortlog.
 
 All have been in linux-next for a while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXoHL9w8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymz6wCcDwDTZouXj+0B37q+kwlCQQPyLukAn2CxKfrM
 d+wScRHWoZutA8IdzqaU
 =5+jn
 -----END PGP SIGNATURE-----

Merge tag 'usb-5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / PHY updates from Greg KH:
 "Here are the big set of USB and PHY driver patches for 5.7-rc1.

  Nothing huge here, some new PHY drivers, loads of USB gadget fixes and
  updates, xhci updates, usb-serial driver updates and new device ids,
  and other minor things. Full details in the shortlog.

  All have been in linux-next for a while with no reported issues"

* tag 'usb-5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (239 commits)
  USB: cdc-acm: restore capability check order
  usb: cdns3: make signed 1 bit bitfields unsigned
  usb: gadget: fsl: remove unused variable 'driver_desc'
  usb: gadget: f_fs: Fix use after free issue as part of queue failure
  usb: typec: Correct the documentation for typec_cable_put()
  USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
  USB: serial: option: add Wistron Neweb D19Q1
  USB: serial: option: add BroadMobi BM806U
  USB: serial: option: add support for ASKEY WWHC050
  usb: core: Add ACPI support for USB interface devices
  driver core: platform: Reimplement devm_platform_ioremap_resource
  usb: dwc2: convert to devm_platform_get_and_ioremap_resource
  usb: host: hisilicon: convert to devm_platform_get_and_ioremap_resource
  usb: host: xhci-plat: convert to devm_platform_get_and_ioremap_resource
  drivers: provide devm_platform_get_and_ioremap_resource()
  phy: qcom-qusb2: Add new overriding tuning parameters in QUSB2 V2 PHY
  phy: qcom-qusb2: Add support for overriding tuning parameters in QUSB2 V2 PHY
  dt-bindings: phy: qcom-qusb2: Add support for overriding Phy tuning parameters
  phy: qcom-qusb2: Add generic QUSB2 V2 PHY support
  dt-bindings: phy: qcom,qusb2: Add compatibles for QUSB2 V2 phy and SC7180
  ...
2020-03-30 13:54:11 -07:00
Linus Torvalds 063d194224 media updates for v5.7-rc1
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAl6Bvm0ACgkQCF8+vY7k
 4RViMQ//baNJyAA8/Hpxz1w5+nL5hsTOhf2PcPgnCLkRVQnIiKMZoq7AS5KWtbqu
 im0SM6nWduGc2T/44Ew13YmBnuWMdXL9Gs8XtAkNakgSV1UM+A3pRuOWRYCyU3Ts
 1QDsc3N7oY9cvyJGWOlqdcA4gp4AaKxjS6M6Z18wYBk/jYSCcj4ZVecT89DYeeM7
 wFORkv/xSdgC3eoKWEwTyglzUmrXKrbfHdcNWrQBg+1SN3WrMYQWCL6nSYMqn0Vu
 f9L5E6jUSx9s6+apxS0OUQmDj78RM1JCEY1P8lgc3tAtVJ+X3yZbxwtpcvujhFPv
 c48NUQeyxAJc7evarvkd73Gwl4buujqHSgiRUovHwqUXHJuGZ3PBTryV9HzbmYYy
 EeHS/23t09F3j9zYtuoDNFIED03Mi+TNeS04cq8OIfwNl7xpUSEV0S/wd11V2308
 cfm6lsogGE9HRbaIxCHgx4AiGFVhbpK1OQt66iYze8r/wyxnN8MVOHGWw+eI4LRK
 9gwh7Wx37k6uCrjfOnLSgx7kcJ+mxSZEYyHJZqqtPm9H1SC68GOxhL/S3Zu7arvK
 eiwFfxJBiunCEfauOx28kaAdvBZVyEvYeDFYl/k+q4DCIGjvK0FXud6QRjNXv24S
 qUXYZKPUALTFOpbkQ3IQiBOQNM4NhF15RzCqRUptVnlF05MSywg=
 =Ve8R
 -----END PGP SIGNATURE-----

Merge tag 'media/v5.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - New sensor driver: imx219

 - Support for some new pixelformats

 - Support for Sun8i SoC

 - Added more codecs to meson vdec driver

 - Prepare for removing the legacy usbvision driver by moving it to
   staging. This driver has issues and use legacy core APIs. If nobody
   steps up to address those, it is time for its retirement.

 - Several cleanups and improvements on drivers, with the addition of
   new supported boards

* tag 'media/v5.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (236 commits)
  media: venus: firmware: Ignore secure call error on first resume
  media: mtk-vpu: load vpu firmware from the new location
  media: i2c: video-i2c: fix build errors due to 'imply hwmon'
  media: MAINTAINERS: add myself to co-maintain Hantro G1/G2 for i.MX8MQ
  media: hantro: add initial i.MX8MQ support
  media: dt-bindings: Document i.MX8MQ VPU bindings
  media: vivid: fix incorrect PA assignment to HDMI outputs
  media: hantro: Add linux-rockchip mailing list to MAINTAINERS
  media: cedrus: h264: Fix 4K decoding on H6
  media: siano: Use scnprintf() for avoiding potential buffer overflow
  media: rc: Use scnprintf() for avoiding potential buffer overflow
  media: allegro: create new struct for channel parameters
  media: allegro: move mail definitions to separate file
  media: allegro: pass buffers through firmware
  media: allegro: verify source and destination buffer in VCU response
  media: allegro: handle dependency of bitrate and bitrate_peak
  media: allegro: read bitrate mode directly from control
  media: allegro: make QP configurable
  media: allegro: make frame rate configurable
  media: allegro: skip filler data if possible
  ...
2020-03-30 13:42:05 -07:00
YueHaibing ad2d701212 usb: gadget: fsl: remove unused variable 'driver_desc'
drivers/usb/gadget/udc/fsl_udc_core.c:56:19:
 warning: 'driver_desc' defined but not used [-Wunused-const-variable=]

It is never used, so remove it.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20200326071419.19240-1-yuehaibing@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-26 15:05:44 +01:00
Sriharsha Allenki f63ec55ff9 usb: gadget: f_fs: Fix use after free issue as part of queue failure
In AIO case, the request is freed up if ep_queue fails.
However, io_data->req still has the reference to this freed
request. In the case of this failure if there is aio_cancel
call on this io_data it will lead to an invalid dequeue
operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request
is freed as part of queue failure.

Fixes: 2e4c7553cd ("usb: gadget: f_fs: add aio support")
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
CC: stable <stable@vger.kernel.org>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-26 15:05:44 +01:00
Thomas Gleixner a5c6234e10 completion: Use simple wait queues
completion uses a wait_queue_head_t to enqueue waiters.

wait_queue_head_t contains a spinlock_t to protect the list of waiters
which excludes it from being used in truly atomic context on a PREEMPT_RT
enabled kernel.

The spinlock in the wait queue head cannot be replaced by a raw_spinlock
because:

  - wait queues can have custom wakeup callbacks, which acquire other
    spinlock_t locks and have potentially long execution times

  - wake_up() walks an unbounded number of list entries during the wake up
    and may wake an unbounded number of waiters.

For simplicity and performance reasons complete() should be usable on
PREEMPT_RT enabled kernels.

completions do not use custom wakeup callbacks and are usually single
waiter, except for a few corner cases.

Replace the wait queue in the completion with a simple wait queue (swait),
which uses a raw_spinlock_t for protecting the waiter list and therefore is
safe to use inside truly atomic regions on PREEMPT_RT.

There is no semantical or functional change:

  - completions use the exclusive wait mode which is what swait provides

  - complete() wakes one exclusive waiter

  - complete_all() wakes all waiters while holding the lock which protects
    the wait queue against newly incoming waiters. The conversion to swait
    preserves this behaviour.

complete_all() might cause unbound latencies with a large number of waiters
being woken at once, but most complete_all() usage sites are either in
testing or initialization code or have only a really small number of
concurrent waiters which for now does not cause a latency problem. Keep it
simple for now.

The fixup of the warning check in the USB gadget driver is just a straight
forward conversion of the lockless waiter check from one waitqueue type to
the other.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Davidlohr Bueso <dbueso@suse.de>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lkml.kernel.org/r/20200321113242.317954042@linutronix.de
2020-03-21 16:00:24 +01:00
Thomas Gleixner c1d51dd505 usb: gadget: Use completion interface instead of open coding it
ep_io() uses a completion on stack and open codes the waiting with:

  wait_event_interruptible (done.wait, done.done);
and
  wait_event (done.wait, done.done);

This waits in non-exclusive mode for complete(), but there is no reason to
do so because the completion can only be waited for by the task itself and
complete() wakes exactly one exlusive waiter.

Replace the open coded implementation with the corresponding
wait_for_completion*() functions.

No functional change.

Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lkml.kernel.org/r/20200321113241.043380271@linutronix.de
2020-03-21 16:00:20 +01:00
Nagarjuna Kristam b4e19931c9 usb: gadget: tegra-xudc: Support multiple device modes
This change supports limited multiple device modes by:
- At most 4 ports contains OTG/Device capability.
- One port run as device mode at a time.

Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2020-03-19 14:18:57 +01:00
Nagarjuna Kristam b9c9fd4a36 usb: gadget: tegra-xudc: Use phy_set_mode() to set/unset device mode
When device mode is set/unset, VBUS override activity is done via
exported functions from padctl driver. Use phy_set_mode() instead.

Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2020-03-19 14:18:57 +01:00
Nagarjuna Kristam b77f2ffe76 usb: gadget: tegra-xudc: Add usb-phy support
usb-phy is used to get notified on the USB role changes. Get usb-phy from
the UTMI PHY.

Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2020-03-19 14:18:57 +01:00
Nagarjuna Kristam 9ce0a14bc7 usb: gadget: tegra-xudc: Remove usb-role-switch support
Padctl driver will act as a central driver to receive USB role changes via
usb-role-switch. This is updated to corresponding host, device drivers.
Hence remove usb-role-switch from XUDC driver.

Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
[treding@nvidia.com: rebase onto Greg's usb-next branch]
Signed-off-by: Thierry Reding <treding@nvidia.com>
2020-03-19 14:18:57 +01:00
Bart Van Assche a7afff31d5 scsi: treewide: Consolidate {get,put}_unaligned_[bl]e24() definitions
Move the get_unaligned_be24(), get_unaligned_le24() and
put_unaligned_le24() definitions from various drivers into
include/linux/unaligned/generic.h. Add a put_unaligned_be24()
implementation.

Link: https://lore.kernel.org/r/20200313203102.16613-4-bvanassche@acm.org
Cc: Keith Busch <kbusch@kernel.org>
Cc: Sagi Grimberg <sagi@grimberg.me>
Cc: Jens Axboe <axboe@fb.com>
Cc: Harvey Harrison <harvey.harrison@gmail.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> # For drivers/usb
Reviewed-by: Felipe Balbi <balbi@kernel.org> # For drivers/usb/gadget
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2020-03-16 22:08:34 -04:00
Masahiro Yamada df8df5e4bc usb: get rid of 'choice' for legacy gadget drivers
drivers/usb/gadget/legacy/Kconfig creates a 'choice' inside another
'choice'.

The outer choice: line 17 "USB Gadget precomposed configurations"
The inner choice: line 484 "EHCI Debug Device mode"

I wondered why the whole legacy gadget drivers reside in such a big
choice block.

This dates back to 2003, "[PATCH] USB: fix for multiple definition of
`usb_gadget_get_string'". [1]

At that time, the global function, usb_gadget_get_string(), was linked
into multiple drivers. That was why only one driver was able to become
built-in at the same time.

Later, commit a84d9e5361 ("usb: gadget: start with libcomposite")
moved usb_gadget_get_string() to a separate module, libcomposite.ko
instead of including usbstring.c from multiple modules.

More and more refactoring was done, and after commit 1bcce93947
("usb: gadget: multi: convert to new interface of f_mass_storage"),
you can link multiple gadget drivers into vmlinux without causing
multiple definition error.

This is the only user of the nested choice structure ever. Removing
this mess will make some Kconfig cleanups possible.

[1]: https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?id=fee4cf49a81381e072c063571d1aadbb29207408

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Felipe Balbi <balbi@kernel.org>
Link: https://lore.kernel.org/r/20200315154948.26569-1-masahiroy@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-16 08:36:35 +01:00
Greg Kroah-Hartman a8ab3e7629 USB: changes for v5.7 merge window
Lots of changes on dwc3 this time, most of them from Thinh fixing a
 bunch of really old mishaps on the driver.
 
 DWC2 got support for STM32MP15 and a couple RockChip SoCs while DWC3
 learned about Amlogic A1 family.
 
 Apart from these, we have a few spelling fixes and other minor
 non-critical fixes all over the place.
 
 Signed-off-by: Felipe Balbi <balbi@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEElLzh7wn96CXwjh2IzL64meEamQYFAl5uL0YRHGJhbGJpQGtl
 cm5lbC5vcmcACgkQzL64meEamQYLSg//dnxrqey6J8hRGYdp9h5Dm0SQxhxp9KCW
 IyL7L287W2D9+JCtoXYrCOlvNM7vMJwwiI3O5XvuRbwllJPUC37HidrFwvOEhqDZ
 BV4J+A30U7OLBlikyzkY/m3I2F94E0DR6PdTsoNVcA3s6GTPs0oDUcKy8ZckDs9/
 Fg21Y3GZplVdtCvbHU/q6Ou7iulm2lZlZg+RC/u3edmRycJ1S29BKxnL40C63hiD
 8kd4rQ/679IIsmV6JAhUWJAS1/3XZG68ozyWEcKiu8kltyAv7L2ponmKA9jiP+1C
 5+EPPvW7xyYb2vkY7N85jR+MjzsF5VK9O4LXPsoPQ/lDW9IZ83zZvOPJ9UuKQwzW
 iqaocn1SB+Ovx2lQZv3kjv6v6nKCzE7HfTVFQSk/ycV8aprXeOzItO+dJ4mPjsXy
 uX1hWePs5/9bG1Cr3apoVSf9x+6v4+MNY/qmxcyzrBkXpcmDan6SemkWNgtceVW/
 RScdyHdhVNVU22hPblADP4oNTOjHRYpQR4TvS9KXcv7Qjb+alN44JcsYWyAGSHLa
 Mb3oEDsJ4lvzIaVL/p23ISIPa+aXWgN3VBrwtErUofYQCNEqLia8D/ofncTkHvKp
 0aquwfTO+0UVeFvuPcD13TQ66RwfNPWcxMGz36hEzmJqcsKFTcS47QFS6I8KRd7M
 ab8AAFqizwo=
 =L9gx
 -----END PGP SIGNATURE-----

Merge tag 'usb-for-v5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

Felipe writes:

USB: changes for v5.7 merge window

Lots of changes on dwc3 this time, most of them from Thinh fixing a
bunch of really old mishaps on the driver.

DWC2 got support for STM32MP15 and a couple RockChip SoCs while DWC3
learned about Amlogic A1 family.

Apart from these, we have a few spelling fixes and other minor
non-critical fixes all over the place.

Signed-off-by: Felipe Balbi <balbi@kernel.org>

* tag 'usb-for-v5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (41 commits)
  dt-bindings: usb: add documentation for aspeed usb-vhub
  ARM: dts: aspeed-g4: add vhub port and endpoint properties
  ARM: dts: aspeed-g5: add vhub port and endpoint properties
  ARM: dts: aspeed-g6: add usb functions
  usb: gadget: aspeed: add ast2600 vhub support
  usb: gadget: aspeed: read vhub properties from device tree
  usb: gadget: aspeed: support per-vhub usb descriptors
  usb: gadget: f_phonet: Replace zero-length array with flexible-array member
  usb: gadget: composite: Inform controller driver of self-powered
  usb: gadget: amd5536udc: fix spelling mistake "reserverd" -> "reserved"
  udc: s3c-hsudc: Silence warning about supplies during deferred probe
  usb: dwc2: Silence warning about supplies during deferred probe
  dt-bindings: usb: dwc2: add compatible property for rk3368 usb
  dt-bindings: usb: dwc2: add compatible property for rk3328 usb
  usb: gadget: add raw-gadget interface
  usb: dwc2: Implement set_selfpowered()
  usb: dwc3: qcom: Replace <linux/clk-provider.h> by <linux/of_clk.h>
  usb: dwc3: core: don't do suspend for device mode if already suspended
  usb: dwc3: Rework resets initialization to be more flexible
  usb: dwc3: Rework clock initialization to be more flexible
  ...
2020-03-16 08:22:49 +01:00
Tao Ren b9a57990f9 usb: gadget: aspeed: add ast2600 vhub support
Add AST2600 support in aspeed-vhub driver. There are 3 major differences
between AST2500 and AST2600 vhub:
  - AST2600 supports 7 downstream ports while AST2500 supports 5.
  - AST2600 supports 21 generic endpoints while AST2500 supports 15.
  - EP0 data buffer's 8-byte DMA alignment restriction is removed from
    AST2600.

Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 12:11:47 +02:00
Tao Ren 487bc82801 usb: gadget: aspeed: read vhub properties from device tree
The patch introduces 2 DT properties ("aspeed,vhub-downstream-ports" and
"aspeed,vhub-generic-endpoints") which replaces hardcoded port/endpoint
number. It is to make it more convenient to add support for newer vhub
revisions with different number of ports and endpoints.

Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 12:11:44 +02:00
Tao Ren 6dbf05fcb6 usb: gadget: aspeed: support per-vhub usb descriptors
This patch store vhub's standard usb descriptors in struct "ast_vhub" so
it's more convenient to customize descriptors and potentially support
multiple vhub instances in the future.

Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 12:11:42 +02:00
Gustavo A. R. Silva eaea6efe1d usb: gadget: f_phonet: Replace zero-length array with flexible-array member
The current codebase makes use of the zero-length array language
extension to the C90 standard, but the preferred mechanism to declare
variable-length types such as these ones is a flexible array member[1][2],
introduced in C99:

struct foo {
        int stuff;
        struct boo array[];
};

By making use of the mechanism above, we will get a compiler warning
in case the flexible array does not occur last in the structure, which
will help us prevent some kind of undefined behavior bugs from being
inadvertenly introduced[3] to the codebase from now on.

This issue was found with the help of Coccinelle.

[1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
[2] https://github.com/KSPP/linux/issues/21
[3] commit 7649773293 ("cxgb3/l2t: Fix undefined behaviour")

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 12:10:58 +02:00
Thinh Nguyen 5e5caf4fa8 usb: gadget: composite: Inform controller driver of self-powered
Different configuration/condition may draw different power. Inform the
controller driver of the change so it can respond properly (e.g.
GET_STATUS request). This fixes an issue with setting MaxPower from
configfs. The composite driver doesn't check this value when setting
self-powered.

Cc: stable@vger.kernel.org
Fixes: 88af8bbe4e ("usb: gadget: the start of the configfs interface")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 12:10:14 +02:00
Alexandre Belloni eeead84748 usb: gadget: amd5536udc: fix spelling mistake "reserverd" -> "reserved"
The variable is named reserved, the comment should say so.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 12:08:07 +02:00
Marek Szyprowski f48f7f9216 udc: s3c-hsudc: Silence warning about supplies during deferred probe
Don't confuse user with meaningless warning about the failure in getting
supplies in case of deferred probe.

Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 12:04:27 +02:00
Andrey Konovalov f2c2e71764 usb: gadget: add raw-gadget interface
USB Raw Gadget is a kernel module that provides a userspace interface for
the USB Gadget subsystem. Essentially it allows to emulate USB devices
from userspace. Enabled with CONFIG_USB_RAW_GADGET. Raw Gadget is
currently a strictly debugging feature and shouldn't be used in
production.

Raw Gadget is similar to GadgetFS, but provides a more low-level and
direct access to the USB Gadget layer for the userspace. The key
differences are:

1. Every USB request is passed to the userspace to get a response, while
   GadgetFS responds to some USB requests internally based on the provided
   descriptors. However note, that the UDC driver might respond to some
   requests on its own and never forward them to the Gadget layer.

2. GadgetFS performs some sanity checks on the provided USB descriptors,
   while Raw Gadget allows you to provide arbitrary data as responses to
   USB requests.

3. Raw Gadget provides a way to select a UDC device/driver to bind to,
   while GadgetFS currently binds to the first available UDC.

4. Raw Gadget uses predictable endpoint names (handles) across different
   UDCs (as long as UDCs have enough endpoints of each required transfer
   type).

5. Raw Gadget has ioctl-based interface instead of a filesystem-based one.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 11:34:48 +02:00
Colin Ian King 09890fb107 usb: gadget: remove redundant assignment to variable status
Variable status is being assigned with a value that is never read, it is
assigned a new value immediately afterwards. The assignment is redundant
and can be removed.

Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 11:06:39 +02:00
YueHaibing 49f1997ad2 usb: gadget: xudc: Remove redundant platform_get_irq error message
platform_get_irq() will call dev_err() itself on failure,
so there is no need for the driver to also do this.
This is detected by coccinelle.

Acked-by: Thierry Reding <treding@nvidia.com>
Reviewed-by: Nagarjuna Kristam <nkristam@nvidia.com>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 11:06:39 +02:00
Jassi Brar 48ba02b2e2 usb: gadget: add udc driver for max3420
The MAX3420 is USB2.0 only, UDC-over-SPI controller. This driver
also supports the peripheral mode of MAX3421.

Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15 11:06:39 +02:00
Heikki Krogerus bce3052f0c usb: roles: Provide the switch drivers handle to the switch in the API
The USB role callback functions had a parameter pointing to
the parent device (struct device) of the switch. The
assumption was that the switch parent is always the
controller. Firstly, that may not be true in every case, and
secondly, it prevents us from supporting devices that supply
multiple muxes.

Changing the first parameter of usb_role_switch_set_t and
usb_role_switch_get_t from struct device to struct
usb_role_switch.

Cc: Peter Chen <Peter.Chen@nxp.com>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Chunfeng Yun <chunfeng.yun@mediatek.com>
Cc: Bin Liu <b-liu@ti.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20200302135353.56659-6-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-04 11:12:50 +01:00
Kees Cook c06a1c378a usb: gadget: net2280: Distribute switch variables for initialization
Variables declared in a switch statement before any case statements
cannot be automatically initialized with compiler instrumentation (as
they are not part of any execution flow). With GCC's proposed automatic
stack variable initialization feature, this triggers a warning (and they
don't get initialized). Clang's automatic stack variable initialization
(via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also
doesn't initialize such variables[1]. Note that these warnings (or silent
skipping) happen before the dead-store elimination optimization phase,
so even when the automatic initializations are later elided in favor of
direct initializations, the warnings remain.

To avoid these problems, move such variables into the "case" where
they're used or lift them up into the main function body.

drivers/usb/gadget/udc/net2280.c: In function ‘handle_stat0_irqs_superspeed’:
drivers/usb/gadget/udc/net2280.c:2871:22: warning: statement will never be executed [-Wswitch-unreachable]
 2871 |   struct net2280_ep *e;
      |                      ^

[1] https://bugs.llvm.org/show_bug.cgi?id=44916

Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/202002201515.DFC51CF@keescook
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-04 10:51:21 +01:00
Marek Szyprowski 6e15919473 udc: s3c-hsudc: Silence warning about supplies during deferred probe
Don't confuse user with meaningless warning about the failure in getting
supplies in case of deferred probe.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200228092808.4580-1-m.szyprowski@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-04 10:51:21 +01:00
Hans Verkuil 0ceba55022 media: gadget: uvc: rename VFL_TYPE_GRABBER to _VIDEO
'GRABBER' is a weird name, all other types map to the /dev
device names. Rename to 'VIDEO' to be consistent with the
other types.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-02-24 16:52:45 +01:00