linux-stable.git/drivers/usb/dwc3, branch linux-3.18.y

usb: dwc3: gadget: Fix the uninitialized link_state when udc starts

2019-03-23T07:18:53+00:00

[ Upstream commit 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 ]

Currently the link_state is uninitialized and the default value is 0(U0)
before the first time we start the udc, and after we start the udc then
 stop the udc, the link_state will be undefined.
We may have the following warnings if we start the udc again with
an undefined link_state:

WARNING: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308
dwc3 100e0000.hidwc3_0: wakeup failed --> -22
[...]
Call Trace:
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (dump_stack+0x84/0x98)
[] (dump_stack) from [] (__warn+0xe8/0x100)
[] (__warn) from [](warn_slowpath_fmt+0x38/0x48)
[] (warn_slowpath_fmt) from [](dwc3_send_gadget_ep_cmd+0x304/0x308)
[] (dwc3_send_gadget_ep_cmd) from [](dwc3_ep0_start_trans+0x48/0xf4)
[] (dwc3_ep0_start_trans) from [](dwc3_ep0_out_start+0x64/0x80)
[] (dwc3_ep0_out_start) from [](__dwc3_gadget_start+0x1e0/0x278)
[] (__dwc3_gadget_start) from [](dwc3_gadget_start+0x88/0x10c)
[] (dwc3_gadget_start) from [](udc_bind_to_driver+0x88/0xbc)
[] (udc_bind_to_driver) from [](usb_gadget_probe_driver+0xf8/0x140)
[] (usb_gadget_probe_driver) from [](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite])
[] (gadget_dev_desc_UDC_store [libcomposite]) from[] (configfs_write_file+0xd4/0x160)
[] (configfs_write_file) from [] (__vfs_write+0x1c/0x114)
[] (__vfs_write) from [] (vfs_write+0xa4/0x168)
[] (vfs_write) from [] (SyS_write+0x3c/0x90)
[] (SyS_write) from [] (ret_fast_syscall+0x0/0x3c)

Signed-off-by: Zeng Tao 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields

2018-05-30T05:47:41+00:00

[ Upstream commit 0cab8d26d6e5e053b2bed3356992aaa71dc93628 ]

Update two GTXFIFOSIZ bit fields for the DWC_usb31 controller. TXFDEP
is a 15-bit value instead of 16-bit value, and bit 15 is TXFRAMNUM.

The GTXFIFOSIZ register for DWC_usb31 is as follows:
 +-------+-----------+----------------------------------+
 | BITS  | Name      | Description                      |
 +=======+===========+==================================+
 | 31:16 | TXFSTADDR | Transmit FIFOn RAM Start Address |
 | 15    | TXFRAMNUM | Asynchronous/Periodic TXFIFO     |
 | 14:0  | TXFDEP    | TXFIFO Depth                     |
 +-------+-----------+----------------------------------+

Signed-off-by: Thinh Nguyen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: pci: Properly cleanup resource

2018-04-24T07:29:25+00:00

commit cabdf83dadfb3d83eec31e0f0638a92dbd716435 upstream.

Platform device is allocated before adding resources. Make sure to
properly cleanup on error case.

Cc: 
Fixes: f1c7e7108109 ("usb: dwc3: convert to pcim_enable_device()")
Signed-off-by: Thinh Nguyen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: keystone: check return value

2018-04-13T17:52:12+00:00

[ Upstream commit 018047a1dba7636e1f7fdae2cc290a528991d648 ]

Function devm_clk_get() returns an ERR_PTR when it fails. However, in
function kdwc3_probe(), its return value is not checked, which may
result in a bad memory access bug. This patch fixes the bug.

Signed-off-by: Pan Bian 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: gadget: Set maxpacket size for ep0 IN

2018-02-28T09:16:18+00:00

commit 6180026341e852a250e1f97ebdcf71684a3c81b9 upstream.

There are 2 control endpoint structures for DWC3. However, the driver
only updates the OUT direction control endpoint structure during
ConnectDone event. DWC3 driver needs to update the endpoint max packet
size for control IN endpoint as well. If the max packet size is not
properly set, then the driver will incorrectly calculate the data
transfer size and fail to send ZLP for HS/FS 3-stage control read
transfer.

The fix is simply to update the max packet size for the ep0 IN direction
during ConnectDone event.

Cc: stable@vger.kernel.org
Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Signed-off-by: Thinh Nguyen 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: replace %p with %pK

2017-07-15T08:14:39+00:00

commit 04fb365c453e14ff9e8a28f1c46050d920a27a4a upstream.

%p will leak kernel pointers, so let's not expose the information on
dmesg and instead use %pK. %pK will only show the actual addresses if
explicitly enabled under /proc/sys/kernel/kptr_restrict.

Acked-by: Greg Kroah-Hartman 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: gadget: make Set Endpoint Configuration macros safe

2017-04-18T05:55:50+00:00

commit 7369090a9fb57c3fc705ce355d2e4523a5a24716 upstream.

Some gadget drivers are bad, bad boys. We notice
that ADB was passing bad Burst Size which caused top
bits of param0 to be overwritten which confused DWC3
when running this command.

In order to avoid future issues, we're going to make
sure values passed by macros are always safe for the
controller. Note that ADB still needs a fix to *not*
pass bad values.

Reported-by: Mohamed Abbas 
Sugested-by: Adam Andruszak 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: dwc3: gadget: always cleanup all TRBs

2016-08-31T23:32:14+00:00

[ Upstream commit 7c705dfe2ebe731c8fd068623b6b4df2d3512c08 ]

If we stop earlier due to short packet, we will
not be able to giveback all TRBs.

Cc: 
Cc: Brian E Rogers 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: gadget: fix for short pkts during chained xfers

2016-08-31T23:32:09+00:00

[ Upstream commit e5b36ae2f851024d43c76e51f395d32ce8d769ce ]

DWC3 has one interesting peculiarity with chained
transfers. If we setup N chained transfers and we
get a short packet before processing all N TRBs,
DWC3 will (conditionally) issue a XferComplete or
XferInProgress event and retire all TRBs from the
one which got a short packet to the last without
clearing their HWO bits.

This means SW must clear HWO bit manually, which
this patch is doing.

Cc: 
Cc: Brian E Rogers 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin

usb: dwc3: gadget: increment request->actual once

2016-08-31T23:32:04+00:00

[ Upstream commit c7de573471832dff7d31f0c13b0f143d6f017799 ]

When using SG lists, we would end up setting
request->actual to:

	num_mapped_sgs * (request->length - count)

Let's fix that up by incrementing request->actual
only once.

Cc: 
Reported-by: Brian E Rogers 
Signed-off-by: Felipe Balbi 
Signed-off-by: Sasha Levin