From ce7d0008c2356626f69f37ef1afce8fbc83fe142 Mon Sep 17 00:00:00 2001 From: Wesley Cheng Date: Sat, 10 Jul 2021 02:13:10 -0700 Subject: usb: gadget: udc: core: Introduce check_config to verify USB configuration Some UDCs may have constraints on how many high bandwidth endpoints it can support in a certain configuration. This API allows for the composite driver to pass down the total number of endpoints to the UDC so it can verify it has the required resources to support the configuration. Signed-off-by: Wesley Cheng Link: https://lore.kernel.org/r/1625908395-5498-2-git-send-email-wcheng@codeaurora.org Signed-off-by: Greg Kroah-Hartman --- include/linux/usb/gadget.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include/linux/usb') diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h index 75c7538e350a..776851e57741 100644 --- a/include/linux/usb/gadget.h +++ b/include/linux/usb/gadget.h @@ -329,6 +329,7 @@ struct usb_gadget_ops { struct usb_ep *(*match_ep)(struct usb_gadget *, struct usb_endpoint_descriptor *, struct usb_ss_ep_comp_descriptor *); + int (*check_config)(struct usb_gadget *gadget); }; /** @@ -608,6 +609,7 @@ int usb_gadget_connect(struct usb_gadget *gadget); int usb_gadget_disconnect(struct usb_gadget *gadget); int usb_gadget_deactivate(struct usb_gadget *gadget); int usb_gadget_activate(struct usb_gadget *gadget); +int usb_gadget_check_config(struct usb_gadget *gadget); #else static inline int usb_gadget_frame_number(struct usb_gadget *gadget) { return 0; } @@ -631,6 +633,8 @@ static inline int usb_gadget_deactivate(struct usb_gadget *gadget) { return 0; } static inline int usb_gadget_activate(struct usb_gadget *gadget) { return 0; } +static inline int usb_gadget_check_config(struct usb_gadget *gadget) +{ return 0; } #endif /* CONFIG_USB_GADGET */ /*-------------------------------------------------------------------------*/ -- cgit v1.2.3 From b48f8939b9ff593ebed20433bb53c51199920412 Mon Sep 17 00:00:00 2001 From: Ruslan Bilovol Date: Mon, 12 Jul 2021 14:55:26 +0200 Subject: usb: audio-v2: add ability to define feature unit descriptor Similar to UAC1 spec, UAC2 feature unit descriptor has variable size. Current audio-v2 feature unit descriptor structure is used for parsing descriptors, but can't be used to define your own descriptor. Add a new macro similar to what audio v1 already has. Signed-off-by: Ruslan Bilovol Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20210712125529.76070-2-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman --- include/linux/usb/audio-v2.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'include/linux/usb') diff --git a/include/linux/usb/audio-v2.h b/include/linux/usb/audio-v2.h index ead8c9a47c6a..8fc2abd7aecb 100644 --- a/include/linux/usb/audio-v2.h +++ b/include/linux/usb/audio-v2.h @@ -156,6 +156,20 @@ struct uac2_feature_unit_descriptor { __u8 bmaControls[]; /* variable length */ } __attribute__((packed)); +#define UAC2_DT_FEATURE_UNIT_SIZE(ch) (6 + ((ch) + 1) * 4) + +/* As above, but more useful for defining your own descriptors: */ +#define DECLARE_UAC2_FEATURE_UNIT_DESCRIPTOR(ch) \ +struct uac2_feature_unit_descriptor_##ch { \ + __u8 bLength; \ + __u8 bDescriptorType; \ + __u8 bDescriptorSubtype; \ + __u8 bUnitID; \ + __u8 bSourceID; \ + __le32 bmaControls[ch + 1]; \ + __u8 iFeature; \ +} __packed + /* 4.7.2.10 Effect Unit Descriptor */ struct uac2_effect_unit_descriptor { -- cgit v1.2.3 From 2037f2991ddedded1ef4aaabe4caf11e306158dc Mon Sep 17 00:00:00 2001 From: Chunfeng Yun Date: Thu, 15 Jul 2021 17:07:50 +0800 Subject: usb: common: add helper to get role-switch-default-mode Add helper to get "role-switch-default-mode", and convert it to the corresponding enum usb_dr_mode Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1626340078-29111-6-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/common/common.c | 20 ++++++++++++++++++++ include/linux/usb/otg.h | 1 + 2 files changed, 21 insertions(+) (limited to 'include/linux/usb') diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c index 347fb3d3894a..c9bdeb4ddcb5 100644 --- a/drivers/usb/common/common.c +++ b/drivers/usb/common/common.c @@ -200,6 +200,26 @@ enum usb_dr_mode usb_get_dr_mode(struct device *dev) } EXPORT_SYMBOL_GPL(usb_get_dr_mode); +/** + * usb_get_role_switch_default_mode - Get default mode for given device + * @dev: Pointer to the given device + * + * The function gets string from property 'role-switch-default-mode', + * and returns the corresponding enum usb_dr_mode. + */ +enum usb_dr_mode usb_get_role_switch_default_mode(struct device *dev) +{ + const char *str; + int ret; + + ret = device_property_read_string(dev, "role-switch-default-mode", &str); + if (ret < 0) + return USB_DR_MODE_UNKNOWN; + + return usb_get_dr_mode_from_string(str); +} +EXPORT_SYMBOL_GPL(usb_get_role_switch_default_mode); + /** * usb_decode_interval - Decode bInterval into the time expressed in 1us unit * @epd: The descriptor of the endpoint diff --git a/include/linux/usb/otg.h b/include/linux/usb/otg.h index 7ceeecbb9e02..6475f880be37 100644 --- a/include/linux/usb/otg.h +++ b/include/linux/usb/otg.h @@ -128,5 +128,6 @@ enum usb_dr_mode { * and returns the corresponding enum usb_dr_mode */ extern enum usb_dr_mode usb_get_dr_mode(struct device *dev); +extern enum usb_dr_mode usb_get_role_switch_default_mode(struct device *dev); #endif /* __LINUX_USB_OTG_H */ -- cgit v1.2.3 From bf88fef0b6f1488abeca594d377991171c00e52a Mon Sep 17 00:00:00 2001 From: Dmitry Osipenko Date: Sat, 17 Jul 2021 21:21:27 +0300 Subject: usb: otg-fsm: Fix hrtimer list corruption The HNP work can be re-scheduled while it's still in-fly. This results in re-initialization of the busy work, resetting the hrtimer's list node of the work and crashing kernel with null dereference within kernel/timer once work's timer is expired. It's very easy to trigger this problem by re-plugging USB cable quickly. Initialize HNP work only once to fix this trouble. Unable to handle kernel NULL pointer dereference at virtual address 00000126) ... PC is at __run_timers.part.0+0x150/0x228 LR is at __next_timer_interrupt+0x51/0x9c ... (__run_timers.part.0) from [] (run_timer_softirq+0x2f/0x50) (run_timer_softirq) from [] (__do_softirq+0xd5/0x2f0) (__do_softirq) from [] (irq_exit+0xab/0xb8) (irq_exit) from [] (handle_domain_irq+0x45/0x60) (handle_domain_irq) from [] (gic_handle_irq+0x6b/0x7c) (gic_handle_irq) from [] (__irq_svc+0x65/0xac) Cc: stable@vger.kernel.org Acked-by: Peter Chen Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/common/usb-otg-fsm.c | 6 +++++- include/linux/usb/otg-fsm.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) (limited to 'include/linux/usb') diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c index 3740cf95560e..0697fde51d00 100644 --- a/drivers/usb/common/usb-otg-fsm.c +++ b/drivers/usb/common/usb-otg-fsm.c @@ -193,7 +193,11 @@ static void otg_start_hnp_polling(struct otg_fsm *fsm) if (!fsm->host_req_flag) return; - INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); + if (!fsm->hnp_work_inited) { + INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); + fsm->hnp_work_inited = true; + } + schedule_delayed_work(&fsm->hnp_polling_work, msecs_to_jiffies(T_HOST_REQ_POLL)); } diff --git a/include/linux/usb/otg-fsm.h b/include/linux/usb/otg-fsm.h index 3aee78dda16d..784659d4dc99 100644 --- a/include/linux/usb/otg-fsm.h +++ b/include/linux/usb/otg-fsm.h @@ -196,6 +196,7 @@ struct otg_fsm { struct mutex lock; u8 *host_req_flag; struct delayed_work hnp_polling_work; + bool hnp_work_inited; bool state_changed; }; -- cgit v1.2.3 From 97d99f7e8f1ccaa18d6447f4a3b0b48ed64aa214 Mon Sep 17 00:00:00 2001 From: Chunfeng Yun Date: Fri, 13 Aug 2021 14:30:53 +0800 Subject: usb: gadget: remove unnecessary AND operation when get ep maxp usb_endpoint_maxp() already returns actual max packet size, no need to AND 0x7ff. Acked-by: Felipe Balbi Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1628836253-7432-7-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman --- include/linux/usb/gadget.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/linux/usb') diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h index 776851e57741..10fe57cf40be 100644 --- a/include/linux/usb/gadget.h +++ b/include/linux/usb/gadget.h @@ -492,7 +492,7 @@ extern char *usb_get_gadget_udc_name(void); */ static inline size_t usb_ep_align(struct usb_ep *ep, size_t len) { - int max_packet_size = (size_t)usb_endpoint_maxp(ep->desc) & 0x7ff; + int max_packet_size = (size_t)usb_endpoint_maxp(ep->desc); return round_up(len, max_packet_size); } -- cgit v1.2.3 From 72dd1843232c9de48e21dc1c85d169fe5328e52e Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Wed, 18 Aug 2021 10:30:17 -0700 Subject: USB: EHCI: Add register array bounds to HCS ports The original EHCI register struct used a trailing 0-element array for addressing the N_PORTS-many available registers. However, after commit a46af4ebf9ff ("USB: EHCI: define extension registers like normal ones") the 0-element array started to overlap the USBMODE extension register. To avoid future compile-time warnings about accessing indexes within a 0-element array, rearrange the struct to actually describe the expected layout (max 15 registers) with a union. All offsets remain the same, and bounds checking becomes possible on accesses to port_status and hostpc. There are no binary differences, and struct offsets continue to match. "pahole --hex -C ehci_regs" before: struct ehci_regs { u32 command; /* 0 0x4 */ u32 status; /* 0x4 0x4 */ u32 intr_enable; /* 0x8 0x4 */ u32 frame_index; /* 0xc 0x4 */ u32 segment; /* 0x10 0x4 */ u32 frame_list; /* 0x14 0x4 */ u32 async_next; /* 0x18 0x4 */ u32 reserved1[2]; /* 0x1c 0x8 */ u32 txfill_tuning; /* 0x24 0x4 */ u32 reserved2[6]; /* 0x28 0x18 */ /* --- cacheline 1 boundary (64 bytes) --- */ u32 configured_flag; /* 0x40 0x4 */ u32 port_status[0]; /* 0x44 0 */ u32 reserved3[9]; /* 0x44 0x24 */ u32 usbmode; /* 0x68 0x4 */ u32 reserved4[6]; /* 0x6c 0x18 */ /* --- cacheline 2 boundary (128 bytes) was 4 bytes ago --- */ u32 hostpc[0]; /* 0x84 0 */ u32 reserved5[17]; /* 0x84 0x44 */ /* --- cacheline 3 boundary (192 bytes) was 8 bytes ago --- */ u32 usbmode_ex; /* 0xc8 0x4 */ /* size: 204, cachelines: 4, members: 18 */ /* last cacheline: 12 bytes */ }; after: struct ehci_regs { u32 command; /* 0 0x4 */ u32 status; /* 0x4 0x4 */ u32 intr_enable; /* 0x8 0x4 */ u32 frame_index; /* 0xc 0x4 */ u32 segment; /* 0x10 0x4 */ u32 frame_list; /* 0x14 0x4 */ u32 async_next; /* 0x18 0x4 */ u32 reserved1[2]; /* 0x1c 0x8 */ u32 txfill_tuning; /* 0x24 0x4 */ u32 reserved2[6]; /* 0x28 0x18 */ /* --- cacheline 1 boundary (64 bytes) --- */ u32 configured_flag; /* 0x40 0x4 */ union { u32 port_status[15]; /* 0x44 0x3c */ struct { u32 reserved3[9]; /* 0x44 0x24 */ u32 usbmode; /* 0x68 0x4 */ }; /* 0x44 0x28 */ }; /* 0x44 0x3c */ /* --- cacheline 2 boundary (128 bytes) --- */ u32 reserved4; /* 0x80 0x4 */ u32 hostpc[15]; /* 0x84 0x3c */ /* --- cacheline 3 boundary (192 bytes) --- */ u32 reserved5[2]; /* 0xc0 0x8 */ u32 usbmode_ex; /* 0xc8 0x4 */ /* size: 204, cachelines: 4, members: 16 */ /* last cacheline: 12 bytes */ }; With this fixed, adding -Wzero-length-bounds to the build no longer produces several warnings like this: In file included from drivers/usb/host/ehci-hcd.c:306: drivers/usb/host/ehci-hub.c: In function 'ehci_port_handed_over': drivers/usb/host/ehci-hub.c:1194:8: warning: array subscript '' is outside the bounds of an interior zero-length array 'u32[0]' {aka 'unsigned int[]'} [-Wzero-length-bounds] 1194 | reg = &ehci->regs->port_status[portnum - 1]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/usb/host/ehci.h:274, from drivers/usb/host/ehci-hcd.c:97: ./include/linux/usb/ehci_def.h:130:7: note: while referencing 'port_status' 130 | u32 port_status[0]; /* up to N_PORTS */ | ^~~~~~~~~~~ Cc: Greg Kroah-Hartman Cc: Arnd Bergmann Cc: Al Cooper Cc: Alan Stern Cc: linux-usb@vger.kernel.org Acked-by: Alan Stern Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210818173018.2259231-2-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman --- include/linux/usb/ehci_def.h | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) (limited to 'include/linux/usb') diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h index 78e006355557..dcbe2b068569 100644 --- a/include/linux/usb/ehci_def.h +++ b/include/linux/usb/ehci_def.h @@ -45,6 +45,7 @@ struct ehci_caps { #define HCS_PORTROUTED(p) ((p)&(1 << 7)) /* true: port routing */ #define HCS_PPC(p) ((p)&(1 << 4)) /* true: port power control */ #define HCS_N_PORTS(p) (((p)>>0)&0xf) /* bits 3:0, ports on HC */ +#define HCS_N_PORTS_MAX 15 /* N_PORTS valid 0x1-0xF */ u32 hcc_params; /* HCCPARAMS - offset 0x8 */ /* EHCI 1.1 addendum */ @@ -126,8 +127,9 @@ struct ehci_regs { u32 configured_flag; #define FLAG_CF (1<<0) /* true: we'll support "high speed" */ - /* PORTSC: offset 0x44 */ - u32 port_status[0]; /* up to N_PORTS */ + union { + /* PORTSC: offset 0x44 */ + u32 port_status[HCS_N_PORTS_MAX]; /* up to N_PORTS */ /* EHCI 1.1 addendum */ #define PORTSC_SUSPEND_STS_ACK 0 #define PORTSC_SUSPEND_STS_NYET 1 @@ -164,28 +166,28 @@ struct ehci_regs { #define PORT_CSC (1<<1) /* connect status change */ #define PORT_CONNECT (1<<0) /* device connected */ #define PORT_RWC_BITS (PORT_CSC | PORT_PEC | PORT_OCC) - - u32 reserved3[9]; - - /* USBMODE: offset 0x68 */ - u32 usbmode; /* USB Device mode */ + struct { + u32 reserved3[9]; + /* USBMODE: offset 0x68 */ + u32 usbmode; /* USB Device mode */ + }; #define USBMODE_SDIS (1<<3) /* Stream disable */ #define USBMODE_BE (1<<2) /* BE/LE endianness select */ #define USBMODE_CM_HC (3<<0) /* host controller mode */ #define USBMODE_CM_IDLE (0<<0) /* idle state */ - - u32 reserved4[6]; + }; + u32 reserved4; /* Moorestown has some non-standard registers, partially due to the fact that * its EHCI controller has both TT and LPM support. HOSTPCx are extensions to * PORTSCx */ /* HOSTPC: offset 0x84 */ - u32 hostpc[0]; /* HOSTPC extension */ + u32 hostpc[HCS_N_PORTS_MAX]; #define HOSTPC_PHCD (1<<22) /* Phy clock disable */ #define HOSTPC_PSPD (3<<25) /* Port speed detection */ - u32 reserved5[17]; + u32 reserved5[2]; /* USBMODE_EX: offset 0xc8 */ u32 usbmode_ex; /* USB Device mode extension */ -- cgit v1.2.3 From e4788edc730a0d2b26e1ae1f08fbb3f635b92dbb Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Wed, 18 Aug 2021 10:30:18 -0700 Subject: USB: EHCI: Add alias for Broadcom INSNREG Refactor struct ehci_regs to avoid accessing beyond the end of port_status. This change results in no difference in the final object code. Avoids several warnings when building with -Warray-bounds: drivers/usb/host/ehci-brcm.c: In function 'ehci_brcm_reset': drivers/usb/host/ehci-brcm.c:113:32: warning: array subscript 16 is above array bounds of 'u32[15]' {aka 'unsigned int[15]'} [-Warray-bounds] 113 | ehci_writel(ehci, 0x00800040, &ehci->regs->port_status[0x10]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/usb/host/ehci.h:274, from drivers/usb/host/ehci-brcm.c:15: ./include/linux/usb/ehci_def.h:132:7: note: while referencing 'port_status' 132 | u32 port_status[HCS_N_PORTS_MAX]; | ^~~~~~~~~~~ Note that the documentation around this proprietary register was confusing. If "USB_EHCI_INSNREG00" is at port_status[0x0f], its offset would be 0x80 (not 0x90). The comments have been adjusted to fix this apparent typo. Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's") Cc: Al Cooper Cc: Alan Stern Cc: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org Cc: bcm-kernel-feedback-list@broadcom.com Suggested-by: Arnd Bergmann Acked-by: Alan Stern Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210818173018.2259231-3-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/host/ehci-brcm.c | 11 ++++------- include/linux/usb/ehci_def.h | 13 ++++++++++--- 2 files changed, 14 insertions(+), 10 deletions(-) (limited to 'include/linux/usb') diff --git a/drivers/usb/host/ehci-brcm.c b/drivers/usb/host/ehci-brcm.c index 3e0ebe8cc649..d3626bfa966b 100644 --- a/drivers/usb/host/ehci-brcm.c +++ b/drivers/usb/host/ehci-brcm.c @@ -108,10 +108,9 @@ static int ehci_brcm_reset(struct usb_hcd *hcd) /* * SWLINUX-1705: Avoid OUT packet underflows during high memory * bus usage - * port_status[0x0f] = Broadcom-proprietary USB_EHCI_INSNREG00 @ 0x90 */ - ehci_writel(ehci, 0x00800040, &ehci->regs->port_status[0x10]); - ehci_writel(ehci, 0x00000001, &ehci->regs->port_status[0x12]); + ehci_writel(ehci, 0x00800040, &ehci->regs->brcm_insnreg[1]); + ehci_writel(ehci, 0x00000001, &ehci->regs->brcm_insnreg[3]); return ehci_setup(hcd); } @@ -223,11 +222,9 @@ static int __maybe_unused ehci_brcm_resume(struct device *dev) /* * SWLINUX-1705: Avoid OUT packet underflows during high memory * bus usage - * port_status[0x0f] = Broadcom-proprietary USB_EHCI_INSNREG00 - * @ 0x90 */ - ehci_writel(ehci, 0x00800040, &ehci->regs->port_status[0x10]); - ehci_writel(ehci, 0x00000001, &ehci->regs->port_status[0x12]); + ehci_writel(ehci, 0x00800040, &ehci->regs->brcm_insnreg[1]); + ehci_writel(ehci, 0x00000001, &ehci->regs->brcm_insnreg[3]); ehci_resume(hcd, false); diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h index dcbe2b068569..c892c5bc6638 100644 --- a/include/linux/usb/ehci_def.h +++ b/include/linux/usb/ehci_def.h @@ -176,16 +176,23 @@ struct ehci_regs { #define USBMODE_CM_HC (3<<0) /* host controller mode */ #define USBMODE_CM_IDLE (0<<0) /* idle state */ }; - u32 reserved4; /* Moorestown has some non-standard registers, partially due to the fact that * its EHCI controller has both TT and LPM support. HOSTPCx are extensions to * PORTSCx */ - /* HOSTPC: offset 0x84 */ - u32 hostpc[HCS_N_PORTS_MAX]; + union { + struct { + u32 reserved4; + /* HOSTPC: offset 0x84 */ + u32 hostpc[HCS_N_PORTS_MAX]; #define HOSTPC_PHCD (1<<22) /* Phy clock disable */ #define HOSTPC_PSPD (3<<25) /* Port speed detection */ + }; + + /* Broadcom-proprietary USB_EHCI_INSNREG00 @ 0x80 */ + u32 brcm_insnreg[4]; + }; u32 reserved5[2]; -- cgit v1.2.3