kernel/linux.git/drivers/usb/dwc3, branch v4.17.1

usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue

2018-04-25T11:26:26+00:00

dwc3_ep_dequeue() waits for completion of End Transfer command using wait_event_lock_irq(), which will release the dwc3->lock while waiting and reacquire after completion. This allows a potential race condition with ep_disable() which also removes all requests from started_list and pending_list. The check for NULL r->trb should catch this but currently it exits to the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its list entry was already removed, if CONFIG_DEBUG_LIST is enabled a 'list_del corruption' bug is thrown since its next/prev pointers are already LIST_POISON1/2. If r->trb is NULL it should simply exit to 'out0'. Fixes: cf3113d893d4 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue") Cc: stable@vger.kernel.org # v4.12+ Signed-off-by: Mayank Rana Signed-off-by: Jack Pham Signed-off-by: Felipe Balbi

usb: dwc3: gadget: dwc3_gadget_del_and_unmap_request() can be static

2018-04-25T11:26:06+00:00

Fixes the following sparse warning: drivers/usb/dwc3/gadget.c:169:6: warning: symbol 'dwc3_gadget_del_and_unmap_request' was not declared. Should it be static? Signed-off-by: Wei Yongjun Signed-off-by: Felipe Balbi

usb: dwc3: gadget: never call ->complete() from ->ep_queue()

2018-03-26T11:22:09+00:00

This is a requirement which has always existed but, somehow, wasn't reflected in the documentation and problems weren't found until now when Tuba Yavuz found a possible deadlock happening between dwc3 and f_hid. She described the situation as follows: spin_lock_irqsave(&hidg->write_spinlock, flags); // first acquire /* we our function has been disabled by host */ if (!hidg->req) { free_ep_req(hidg->in_ep, hidg->req); goto try_again; } [...] status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC); => [...] => usb_gadget_giveback_request => f_hidg_req_complete => spin_lock_irqsave(&hidg->write_spinlock, flags); // second acquire Note that this happens because dwc3 would call ->complete() on a failed usb_ep_queue() due to failed Start Transfer command. This is, anyway, a theoretical situation because dwc3 currently uses "No Response Update Transfer" command for Bulk and Interrupt endpoints. It's still good to make this case impossible to happen even if the "No Reponse Update Transfer" command is changed. Reported-by: Tuba Yavuz Signed-off-by: Felipe Balbi Cc: stable Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-for-v4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-testing

2018-03-23T12:33:09+00:00

Felipe writes: usb: changes for v4.17 merge window Quite a lot happened in this cycle, with a total of 95 non-merge commits. The most interesting parts are listed below: Synopsys has been adding better support for USB 3.1 to dwc3. The same series also sets g_mass_storage's max speed to SSP. Roger Quadros (TI) added support for dual-role using the OTG block available in some dwc3 implementations, this makes sure that AM437x can swap roles in runtime. We have a new SoC supported in dwc3 now - Amlogic Meson GX - thanks to the work of Martin Blumenstingl. We also have a ton of changes in dwc2 (51% of all changes, in fact). The most interesting part there is the support for Hibernation (a Synopsys PM feature). Apart from these, we have our regular set of non-critical fixes all over the place.

usb: dwc3: core: Fix broken system suspend/resume on AM437x

2018-03-22T08:50:15+00:00

On TI's AM437x, the DWC3 controller looses state after a system suspend/resume. We are re-initializing the controller but we miss restoring the PRTCAP register. This causes USB host to break on AM437x after a system suspend/resume. Fix this by restoring the PRTCAP register on system resume. Signed-off-by: Roger Quadros Signed-off-by: Felipe Balbi

usb: dwc3: Check controller type before setting speed

2018-03-22T08:49:03+00:00

DWC_usb3 speed can only be set up to SuperSpeed. Limit the setting to SuperSpeed only should the value be higher. Otherwise, the controller will read an invalid speed value and set the device to an incorrect speed. Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi

usb: dwc3: Dump LSP and BMU debug info

2018-03-22T08:49:02+00:00

Dump LSP and BMU debug info. Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi

usb: dwc3: Check for ESS TX/RX threshold config

2018-03-22T08:48:59+00:00

Check and configure TX/RX threshold for DWC_usb31. Update dwc3 structure with new fields to store these threshold configurations. Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi

usb: dwc3: Add DWC_usb31 GTXTHRCFG reg fields

2018-03-22T08:48:55+00:00

usb: dwc3: gadget: Check IP revision for GRXTHRCFG

2018-03-22T08:48:53+00:00

DWC_usb31 controller has a different UsbRxPktCnt bit fields from GRXTHRCFG register. Check for DWC_usb31 IP revision to read the appropriate value. Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi