History

Merge tag 'usb-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH: "Here are a number of USB fixes for 4.14-rc4 to resolved reported issues. There's a bunch of stuff in here based on the great work Andrey Konovalov is doing in fuzzing the USB stack. Lots of bug fixes when dealing with corrupted USB descriptors that we've never seen in "normal" operation, but is now ensuring the stack is much more hardened overall. There's also the usual XHCI and gadget driver fixes as well, and a build error fix, and a few other minor things, full details in the shortlog. All of these have been in linux-next with no reported issues" * tag 'usb-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (38 commits) usb: dwc3: of-simple: Add compatible for Spreadtrum SC9860 platform usb: gadget: udc: atmel: set vbus irqflags explicitly usb: gadget: ffs: handle I/O completion in-order usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe() usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value usb: gadget: udc: renesas_usb3: fix for no-data control transfer USB: dummy-hcd: Fix erroneous synchronization change USB: dummy-hcd: fix infinite-loop resubmission bug USB: dummy-hcd: fix connection failures (wrong speed) USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse USB: devio: Don't corrupt user memory USB: devio: Prevent integer overflow in proc_do_submiturb() USB: g_mass_storage: Fix deadlock when driver is unbound USB: gadgetfs: Fix crash caused by inadequate synchronization USB: gadgetfs: fix copy_to_user while holding spinlock USB: uas: fix bug in handling of alternate settings usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives usb-storage: fix bogus hardware error messages for ATA pass-thru devices ...

Linus Torvalds committed 9 years ago

Commit 887c8ba2 parents 27b3b16 80c82ff33 files · +277 −145Browse files

Unified · Split

33 files
  1. drivers/usb/class/cdc-wdm.c +3 −1
  2. drivers/usb/core/config.c +12 −4
  3. drivers/usb/core/devio.c +10 −1
  4. drivers/usb/core/hub.c +1 −1
  5. drivers/usb/core/message.c +4 −0
  6. drivers/usb/dwc3/dwc3-of-simple.c +1 −0
  7. drivers/usb/dwc3/ep0.c +7 −0
  8. drivers/usb/gadget/function/f_fs.c +13 −4
  9. drivers/usb/gadget/function/f_mass_storage.c +7 −20
  10. drivers/usb/gadget/function/f_mass_storage.h +0 −14
  11. drivers/usb/gadget/function/f_printer.c +6 −1
  12. drivers/usb/gadget/function/u_fs.h +1 −0
  13. drivers/usb/gadget/legacy/inode.c +40 −6
  14. drivers/usb/gadget/legacy/mass_storage.c +3 −23
  15. drivers/usb/gadget/udc/Kconfig +1 −0
  16. drivers/usb/gadget/udc/atmel_usba_udc.c +3 −1
  17. drivers/usb/gadget/udc/core.c +1 −2
  18. drivers/usb/gadget/udc/dummy_hcd.c +54 −11
  19. drivers/usb/gadget/udc/renesas_usb3.c +15 −4
  20. drivers/usb/host/pci-quirks.c +5 −5
  21. drivers/usb/host/xhci-hub.c +10 −4
  22. drivers/usb/host/xhci-pci.c +0 −12
  23. drivers/usb/host/xhci-plat.c +10 −6
  24. drivers/usb/host/xhci.c +2 −1
  25. drivers/usb/host/xhci.h +6 −4
  26. drivers/usb/renesas_usbhs/fifo.c +18 −3
  27. drivers/usb/storage/transport.c +13 −1
  28. drivers/usb/storage/uas-detect.h +8 −7
  29. drivers/usb/storage/uas.c +5 −5
  30. drivers/usb/storage/unusual_devs.h +7 −0
  31. drivers/uwb/hwa-rc.c +2 −0
  32. drivers/uwb/uwbd.c +8 −4
  33. include/uapi/linux/usb/ch9.h +1 −0
drivers/usb/class/cdc-wdm.c+3−1
@@ -190,8 +190,10 @@ static void wdm_in_callback(struct urb *urb) · 189 unmodified lines
190190 /*
191191 * only set a new error if there is no previous error.
192192 * Errors are only cleared during read/open
193+ * Avoid propagating -EPIPE (stall) to userspace since it is
194+ * better handled as an empty read
193195 */
194− if (desc->rerr == 0)
196+ if (desc->rerr == 0 && status != -EPIPE)
195197 desc->rerr = status;
196198
197199 if (length + desc->length > desc->wMaxCommand) {
drivers/usb/core/config.c+12−4
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, · 642 unmodified lines
643643
644644 } else if (header->bDescriptorType ==
645645 USB_DT_INTERFACE_ASSOCIATION) {
646+ struct usb_interface_assoc_descriptor *d;
647+
648+ d = (struct usb_interface_assoc_descriptor *)header;
649+ if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
650+ dev_warn(ddev,
651+ "config %d has an invalid interface association descriptor of length %d, skipping\n",
652+ cfgno, d->bLength);
653+ continue;
654+ }
655+
646656 if (iad_num == USB_MAXIADS) {
647657 dev_warn(ddev, "found more Interface "
648658 "Association Descriptors "
649659 "than allocated for in "
650660 "configuration %d\n", cfgno);
651661 } else {
652− config->intf_assoc[iad_num] =
653− (struct usb_interface_assoc_descriptor
654− *)header;
662+ config->intf_assoc[iad_num] = d;
655663 iad_num++;
656664 }
657665
@@ -852,7 +860,7 @@ int usb_get_configuration(struct usb_device *dev) · 194 unmodified lines
852860 }
853861
854862 if (dev->quirks & USB_QUIRK_DELAY_INIT)
855− msleep(100);
863+ msleep(200);
856864
857865 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
858866 bigbuffer, length);
drivers/usb/core/devio.c+10−1
@@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644); · 139 unmodified lines
140140 MODULE_PARM_DESC(usbfs_memory_mb,
141141 "maximum MB allowed for usbfs buffers (0 = no limit)");
142142
143+/* Hard limit, necessary to avoid arithmetic overflow */
144+#define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000)
145+
143146 static atomic64_t usbfs_memory_usage; /* Total memory currently allocated */
144147
145148 /* Check whether it's okay to allocate more memory for a transfer */
@@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb · 1314 unmodified lines
14601463 USBDEVFS_URB_ZERO_PACKET |
14611464 USBDEVFS_URB_NO_INTERRUPT))
14621465 return -EINVAL;
1466+ if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
1467+ return -EINVAL;
14631468 if (uurb->buffer_length > 0 && !uurb->buffer)
14641469 return -EINVAL;
14651470 if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
@@ -1571,7 +1576,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb · 105 unmodified lines
15711576 totlen += isopkt[u].length;
15721577 }
15731578 u *= sizeof(struct usb_iso_packet_descriptor);
1574− uurb->buffer_length = totlen;
1579+ if (totlen <= uurb->buffer_length)
1580+ uurb->buffer_length = totlen;
1581+ else
1582+ WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d",
1583+ totlen, uurb->buffer_length);
15751584 break;
15761585
15771586 default:
drivers/usb/core/hub.c+1−1
@@ -4838,7 +4838,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, · 4837 unmodified lines
48384838 goto loop;
48394839
48404840 if (udev->quirks & USB_QUIRK_DELAY_INIT)
4841− msleep(1000);
4841+ msleep(2000);
48424842
48434843 /* consecutive bus-powered hubs aren't reliable; they can
48444844 * violate the voltage drop budget. if the new child has
drivers/usb/core/message.c+4−0
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, · 2068 unmodified lines
20692069 elength = 1;
20702070 goto next_desc;
20712071 }
2072+ if ((buflen < elength) || (elength < 3)) {
2073+ dev_err(&intf->dev, "invalid descriptor buffer length\n");
2074+ break;
2075+ }
20722076 if (buffer[1] != USB_DT_CS_INTERFACE) {
20732077 dev_err(&intf->dev, "skipping garbage\n");
20742078 goto next_desc;
drivers/usb/dwc3/dwc3-of-simple.c+1−0
@@ -177,6 +177,7 @@ static const struct of_device_id of_dwc3_simple_match[] = { · 176 unmodified lines
177177 { .compatible = "rockchip,rk3399-dwc3" },
178178 { .compatible = "xlnx,zynqmp-dwc3" },
179179 { .compatible = "cavium,octeon-7130-usb-uctl" },
180+ { .compatible = "sprd,sc9860-dwc3" },
180181 { /* Sentinel */ }
181182 };
182183 MODULE_DEVICE_TABLE(of, of_dwc3_simple_match);
drivers/usb/dwc3/ep0.c+7−0
@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, · 989 unmodified lines
990990 DWC3_TRBCTL_CONTROL_DATA,
991991 true);
992992
993+ req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
994+
993995 /* Now prepare one extra TRB to align transfer size */
994996 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
995997 maxpacket - rem,
@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, · 19 unmodified lines
10151017 DWC3_TRBCTL_CONTROL_DATA,
10161018 true);
10171019
1020+ req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
1021+
10181022 /* Now prepare one extra TRB to align transfer size */
10191023 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
10201024 0, DWC3_TRBCTL_CONTROL_DATA,
@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, · 8 unmodified lines
10291033 dwc3_ep0_prepare_one_trb(dep, req->request.dma,
10301034 req->request.length, DWC3_TRBCTL_CONTROL_DATA,
10311035 false);
1036+
1037+ req->trb = &dwc->ep0_trb[dep->trb_enqueue];
1038+
10321039 ret = dwc3_ep0_start_trans(dep);
10331040 }
10341041
drivers/usb/gadget/function/f_fs.c+13−4
@@ -46,7 +46,8 @@ · 45 unmodified lines
4646 static void ffs_data_get(struct ffs_data *ffs);
4747 static void ffs_data_put(struct ffs_data *ffs);
4848 /* Creates new ffs_data object. */
49−static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
49+static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
50+ __attribute__((malloc));
5051
5152 /* Opened counter handling. */
5253 static void ffs_data_opened(struct ffs_data *ffs);
@@ -780,11 +781,12 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep, · 727 unmodified lines
780781 struct usb_request *req)
781782 {
782783 struct ffs_io_data *io_data = req->context;
784+ struct ffs_data *ffs = io_data->ffs;
783785
784786 ENTER();
785787
786788 INIT_WORK(&io_data->work, ffs_user_copy_worker);
787− schedule_work(&io_data->work);
789+ queue_work(ffs->io_completion_wq, &io_data->work);
788790 }
789791
790792 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
@@ -1500,7 +1502,7 @@ ffs_fs_mount(struct file_system_type *t, int flags, · 709 unmodified lines
15001502 if (unlikely(ret < 0))
15011503 return ERR_PTR(ret);
15021504
1503− ffs = ffs_data_new();
1505+ ffs = ffs_data_new(dev_name);
15041506 if (unlikely(!ffs))
15051507 return ERR_PTR(-ENOMEM);
15061508 ffs->file_perms = data.perms;
@@ -1610,6 +1612,7 @@ static void ffs_data_put(struct ffs_data *ffs) · 103 unmodified lines
16101612 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
16111613 waitqueue_active(&ffs->ep0req_completion.wait) ||
16121614 waitqueue_active(&ffs->wait));
1615+ destroy_workqueue(ffs->io_completion_wq);
16131616 kfree(ffs->dev_name);
16141617 kfree(ffs);
16151618 }
@@ -1642,7 +1645,7 @@ static void ffs_data_closed(struct ffs_data *ffs) · 26 unmodified lines
16421645 ffs_data_put(ffs);
16431646 }
16441647
1645−static struct ffs_data *ffs_data_new(void)
1648+static struct ffs_data *ffs_data_new(const char *dev_name)
16461649 {
16471650 struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
16481651 if (unlikely(!ffs))
@@ -1650,6 +1653,12 @@ static struct ffs_data *ffs_data_new(void) · 1 unmodified line
16501653
16511654 ENTER();
16521655
1656+ ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
1657+ if (!ffs->io_completion_wq) {
1658+ kfree(ffs);
1659+ return NULL;
1660+ }
1661+
16531662 refcount_set(&ffs->ref, 1);
16541663 atomic_set(&ffs->opened, 0);
16551664 ffs->state = FFS_READ_DESCRIPTORS;
drivers/usb/gadget/function/f_mass_storage.c+7−20
@@ -307,8 +307,6 @@ struct fsg_common { · 306 unmodified lines
307307 struct completion thread_notifier;
308308 struct task_struct *thread_task;
309309
310− /* Callback functions. */
311− const struct fsg_operations *ops;
312310 /* Gadget's private data. */
313311 void *private_data;
314312
@@ -2438,6 +2436,7 @@ static void handle_exception(struct fsg_common *common) · 2123 unmodified lines
24382436 static int fsg_main_thread(void *common_)
24392437 {
24402438 struct fsg_common *common = common_;
2439+ int i;
24412440
24422441 /*
24432442 * Allow the thread to be killed by a signal, but set the signal mask
@@ -2476,21 +2475,16 @@ static int fsg_main_thread(void *common_) · 32 unmodified lines
24762475 common->thread_task = NULL;
24772476 spin_unlock_irq(&common->lock);
24782477
2479− if (!common->ops || !common->ops->thread_exits
2480− || common->ops->thread_exits(common) < 0) {
2481− int i;
2478+ /* Eject media from all LUNs */
24822479
2483− down_write(&common->filesem);
2484− for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
2485− struct fsg_lun *curlun = common->luns[i];
2486− if (!curlun || !fsg_lun_is_open(curlun))
2487− continue;
2480+ down_write(&common->filesem);
2481+ for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
2482+ struct fsg_lun *curlun = common->luns[i];
24882483
2484+ if (curlun && fsg_lun_is_open(curlun))
24892485 fsg_lun_close(curlun);
2490− curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
2491− }
2492− up_write(&common->filesem);
24932486 }
2487+ up_write(&common->filesem);
24942488
24952489 /* Let fsg_unbind() know the thread has exited */
24962490 complete_and_exit(&common->thread_notifier, 0);
@@ -2681,13 +2675,6 @@ void fsg_common_remove_luns(struct fsg_common *common) · 184 unmodified lines
26812675 }
26822676 EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
26832677
2684−void fsg_common_set_ops(struct fsg_common *common,
2685− const struct fsg_operations *ops)
2686−{
2687− common->ops = ops;
2688−}
2689−EXPORT_SYMBOL_GPL(fsg_common_set_ops);
2690−
26912678 void fsg_common_free_buffers(struct fsg_common *common)
26922679 {
26932680 _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
drivers/usb/gadget/function/f_mass_storage.h+0−14
@@ -60,17 +60,6 @@ struct fsg_module_parameters { · 59 unmodified lines
6060 struct fsg_common;
6161
6262 /* FSF callback functions */
63−struct fsg_operations {
64− /*
65− * Callback function to call when thread exits. If no
66− * callback is set or it returns value lower then zero MSF
67− * will force eject all LUNs it operates on (including those
68− * marked as non-removable or with prevent_medium_removal flag
69− * set).
70− */
71− int (*thread_exits)(struct fsg_common *common);
72−};
73−
7463 struct fsg_lun_opts {
7564 struct config_group group;
7665 struct fsg_lun *lun;
@@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun); · 65 unmodified lines
142131
143132 void fsg_common_remove_luns(struct fsg_common *common);
144133
145−void fsg_common_set_ops(struct fsg_common *common,
146− const struct fsg_operations *ops);
147−
148134 int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
149135 unsigned int id, const char *name,
150136 const char **name_pfx);
drivers/usb/gadget/function/f_printer.c+6−1
@@ -555,6 +555,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) · 554 unmodified lines
555555 size_t size; /* Amount of data in a TX request. */
556556 size_t bytes_copied = 0;
557557 struct usb_request *req;
558+ int value;
558559
559560 DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
560561
@@ -634,7 +635,11 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) · 73 unmodified lines
634635 return -EAGAIN;
635636 }
636637
637− if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
638+ /* here, we unlock, and only unlock, to avoid deadlock. */
639+ spin_unlock(&dev->lock);
640+ value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
641+ spin_lock(&dev->lock);
642+ if (value) {
638643 list_add(&req->list, &dev->tx_reqs);
639644 spin_unlock_irqrestore(&dev->lock, flags);
640645 mutex_unlock(&dev->lock_printer_io);
drivers/usb/gadget/function/u_fs.h+1−0
@@ -279,6 +279,7 @@ struct ffs_data { · 278 unmodified lines
279279 } file_perms;
280280
281281 struct eventfd_ctx *ffs_eventfd;
282+ struct workqueue_struct *io_completion_wq;
282283 bool no_disconnect;
283284 struct work_struct reset_work;
284285
drivers/usb/gadget/legacy/inode.c+40−6
@@ -28,7 +28,7 @@ · 27 unmodified lines
2828 #include <linux/aio.h>
2929 #include <linux/uio.h>
3030 #include <linux/refcount.h>
31−
31+#include <linux/delay.h>
3232 #include <linux/device.h>
3333 #include <linux/moduleparam.h>
3434
@@ -116,6 +116,7 @@ enum ep0_state { · 81 unmodified lines
116116 struct dev_data {
117117 spinlock_t lock;
118118 refcount_t count;
119+ int udc_usage;
119120 enum ep0_state state; /* P: lock */
120121 struct usb_gadgetfs_event event [N_EVENT];
121122 unsigned ev_next;
@@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) · 391 unmodified lines
513514 INIT_WORK(&priv->work, ep_user_copy_worker);
514515 schedule_work(&priv->work);
515516 }
516− spin_unlock(&epdata->dev->lock);
517517
518518 usb_ep_free_request(ep, req);
519+ spin_unlock(&epdata->dev->lock);
519520 put_ep(epdata);
520521 }
521522
@@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) · 417 unmodified lines
939940 struct usb_request *req = dev->req;
940941
941942 if ((retval = setup_req (ep, req, 0)) == 0) {
943+ ++dev->udc_usage;
942944 spin_unlock_irq (&dev->lock);
943945 retval = usb_ep_queue (ep, req, GFP_KERNEL);
944946 spin_lock_irq (&dev->lock);
947+ --dev->udc_usage;
945948 }
946949 dev->state = STATE_DEV_CONNECTED;
947950
@@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) · 35 unmodified lines
983986 retval = -EIO;
984987 else {
985988 len = min (len, (size_t)dev->req->actual);
986−// FIXME don't call this with the spinlock held ...
989+ ++dev->udc_usage;
990+ spin_unlock_irq(&dev->lock);
987991 if (copy_to_user (buf, dev->req->buf, len))
988992 retval = -EFAULT;
989993 else
990994 retval = len;
995+ spin_lock_irq(&dev->lock);
996+ --dev->udc_usage;
991997 clean_req (dev->gadget->ep0, dev->req);
992998 /* NOTE userspace can't yet choose to stall */
993999 }
@@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) · 137 unmodified lines
11311137 retval = setup_req (dev->gadget->ep0, dev->req, len);
11321138 if (retval == 0) {
11331139 dev->state = STATE_DEV_CONNECTED;
1140+ ++dev->udc_usage;
11341141 spin_unlock_irq (&dev->lock);
11351142 if (copy_from_user (dev->req->buf, buf, len))
11361143 retval = -EFAULT;
@@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) · 5 unmodified lines
11421149 GFP_KERNEL);
11431150 }
11441151 spin_lock_irq(&dev->lock);
1152+ --dev->udc_usage;
11451153 if (retval < 0) {
11461154 clean_req (dev->gadget->ep0, dev->req);
11471155 } else
@@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) · 95 unmodified lines
12431251 struct usb_gadget *gadget = dev->gadget;
12441252 long ret = -ENOTTY;
12451253
1246− if (gadget->ops->ioctl)
1254+ spin_lock_irq(&dev->lock);
1255+ if (dev->state == STATE_DEV_OPENED ||
1256+ dev->state == STATE_DEV_UNBOUND) {
1257+ /* Not bound to a UDC */
1258+ } else if (gadget->ops->ioctl) {
1259+ ++dev->udc_usage;
1260+ spin_unlock_irq(&dev->lock);
1261+
12471262 ret = gadget->ops->ioctl (gadget, code, value);
12481263
1264+ spin_lock_irq(&dev->lock);
1265+ --dev->udc_usage;
1266+ }
1267+ spin_unlock_irq(&dev->lock);
1268+
12491269 return ret;
12501270 }
12511271
@@ -1463,10 +1483,12 @@ delegate: · 211 unmodified lines
14631483 if (value < 0)
14641484 break;
14651485
1486+ ++dev->udc_usage;
14661487 spin_unlock (&dev->lock);
14671488 value = usb_ep_queue (gadget->ep0, dev->req,
14681489 GFP_KERNEL);
14691490 spin_lock (&dev->lock);
1491+ --dev->udc_usage;
14701492 if (value < 0) {
14711493 clean_req (gadget->ep0, dev->req);
14721494 break;
@@ -1490,8 +1512,12 @@ delegate: · 17 unmodified lines
14901512 req->length = value;
14911513 req->zero = value < w_length;
14921514
1515+ ++dev->udc_usage;
14931516 spin_unlock (&dev->lock);
14941517 value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
1518+ spin_lock(&dev->lock);
1519+ --dev->udc_usage;
1520+ spin_unlock(&dev->lock);
14951521 if (value < 0) {
14961522 DBG (dev, "ep_queue --> %d\n", value);
14971523 req->status = 0;
@@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev) · 20 unmodified lines
15181544 /* break link to FS */
15191545 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
15201546 list_del_init (&ep->epfiles);
1547+ spin_unlock_irq (&dev->lock);
1548+
15211549 dentry = ep->dentry;
15221550 ep->dentry = NULL;
15231551 parent = d_inode(dentry->d_parent);
15241552
15251553 /* break link to controller */
1554+ mutex_lock(&ep->lock);
15261555 if (ep->state == STATE_EP_ENABLED)
15271556 (void) usb_ep_disable (ep->ep);
15281557 ep->state = STATE_EP_UNBOUND;
15291558 usb_ep_free_request (ep->ep, ep->req);
15301559 ep->ep = NULL;
1560+ mutex_unlock(&ep->lock);
1561+
15311562 wake_up (&ep->wait);
15321563 put_ep (ep);
15331564
1534− spin_unlock_irq (&dev->lock);
1535−
15361565 /* break link to dcache */
15371566 inode_lock(parent);
15381567 d_delete (dentry);
@@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget) · 64 unmodified lines
16031632
16041633 spin_lock_irq (&dev->lock);
16051634 dev->state = STATE_DEV_UNBOUND;
1635+ while (dev->udc_usage > 0) {
1636+ spin_unlock_irq(&dev->lock);
1637+ usleep_range(1000, 2000);
1638+ spin_lock_irq(&dev->lock);
1639+ }
16061640 spin_unlock_irq (&dev->lock);
16071641
16081642 destroy_ep_files (dev);
drivers/usb/gadget/legacy/mass_storage.c+3−23
@@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS; · 106 unmodified lines
107107
108108 FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
109109
110−static unsigned long msg_registered;
111−static void msg_cleanup(void);
112−
113−static int msg_thread_exits(struct fsg_common *common)
114−{
115− msg_cleanup();
116− return 0;
117−}
118−
119110 static int msg_do_config(struct usb_configuration *c)
120111 {
121112 struct fsg_opts *opts;
@@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = { · 32 unmodified lines
154145
155146 static int msg_bind(struct usb_composite_dev *cdev)
156147 {
157− static const struct fsg_operations ops = {
158− .thread_exits = msg_thread_exits,
159− };
160148 struct fsg_opts *opts;
161149 struct fsg_config config;
162150 int status;
@@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev) · 10 unmodified lines
173161 if (status)
174162 goto fail;
175163
176− fsg_common_set_ops(opts->common, &ops);
177−
178164 status = fsg_common_set_cdev(opts->common, cdev, config.can_stall);
179165 if (status)
180166 goto fail_set_cdev;
@@ -256,18 +242,12 @@ MODULE_LICENSE("GPL"); · 75 unmodified lines
256242
257243 static int __init msg_init(void)
258244 {
259− int ret;
260−
261− ret = usb_composite_probe(&msg_driver);
262− set_bit(0, &msg_registered);
263−
264− return ret;
245+ return usb_composite_probe(&msg_driver);
265246 }
266247 module_init(msg_init);
267248
268−static void msg_cleanup(void)
249+static void __exit msg_cleanup(void)
269250 {
270− if (test_and_clear_bit(0, &msg_registered))
271− usb_composite_unregister(&msg_driver);
251+ usb_composite_unregister(&msg_driver);
272252 }
273253 module_exit(msg_cleanup);
drivers/usb/gadget/udc/Kconfig+1−0
@@ -273,6 +273,7 @@ config USB_SNP_CORE · 272 unmodified lines
273273 config USB_SNP_UDC_PLAT
274274 tristate "Synopsys USB 2.0 Device controller"
275275 depends on USB_GADGET && OF && HAS_DMA
276+ depends on EXTCON || EXTCON=n
276277 select USB_GADGET_DUALSPEED
277278 select USB_SNP_CORE
278279 default ARCH_BCM_IPROC
drivers/usb/gadget/udc/atmel_usba_udc.c+3−1
@@ -29,6 +29,8 @@ · 28 unmodified lines
2929 #include <linux/of_gpio.h>
3030
3131 #include "atmel_usba_udc.h"
32+#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \
33+ | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING)
3234
3335 #ifdef CONFIG_USB_GADGET_DEBUG_FS
3436 #include <linux/debugfs.h>
@@ -2361,7 +2363,7 @@ static int usba_udc_probe(struct platform_device *pdev) · 2326 unmodified lines
23612363 IRQ_NOAUTOEN);
23622364 ret = devm_request_threaded_irq(&pdev->dev,
23632365 gpio_to_irq(udc->vbus_pin), NULL,
2364− usba_vbus_irq_thread, IRQF_ONESHOT,
2366+ usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS,
23652367 "atmel_usba_udc", udc);
23662368 if (ret) {
23672369 udc->vbus_pin = -ENODEV;
drivers/usb/gadget/udc/core.c+1−2
@@ -1320,8 +1320,7 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri · 1319 unmodified lines
13201320 udc->dev.driver = &driver->driver;
13211321 udc->gadget->dev.driver = &driver->driver;
13221322
1323− if (driver->max_speed < udc->gadget->max_speed)
1324− usb_gadget_udc_set_speed(udc, driver->max_speed);
1323+ usb_gadget_udc_set_speed(udc, driver->max_speed);
13251324
13261325 ret = driver->bind(udc->gadget, driver);
13271326 if (ret)
drivers/usb/gadget/udc/dummy_hcd.c+54−11
@@ -237,6 +237,8 @@ struct dummy_hcd { · 236 unmodified lines
237237
238238 struct usb_device *udev;
239239 struct list_head urbp_list;
240+ struct urbp *next_frame_urbp;
241+
240242 u32 stream_en_ep;
241243 u8 num_stream[30 / 2];
242244
@@ -253,11 +255,13 @@ struct dummy { · 10 unmodified lines
253255 */
254256 struct dummy_ep ep[DUMMY_ENDPOINTS];
255257 int address;
258+ int callback_usage;
256259 struct usb_gadget gadget;
257260 struct usb_gadget_driver *driver;
258261 struct dummy_request fifo_req;
259262 u8 fifo_buf[FIFO_SIZE];
260263 u16 devstatus;
264+ unsigned ints_enabled:1;
261265 unsigned udc_suspended:1;
262266 unsigned pullup:1;
263267
@@ -375,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd) · 111 unmodified lines
375379 USB_PORT_STAT_CONNECTION) == 0)
376380 dum_hcd->port_status |=
377381 (USB_PORT_STAT_C_CONNECTION << 16);
378− if ((dum_hcd->port_status &
379− USB_PORT_STAT_ENABLE) == 1 &&
380− (dum_hcd->port_status &
381− USB_SS_PORT_LS_U0) == 1 &&
382− dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
382+ if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) &&
383+ (dum_hcd->port_status &
384+ USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 &&
385+ dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
383386 dum_hcd->active = 1;
384387 }
385388 } else {
@@ -440,18 +443,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd) · 54 unmodified lines
440443 (~dum_hcd->old_status) & dum_hcd->port_status;
441444
442445 /* Report reset and disconnect events to the driver */
443− if (dum->driver && (disconnect || reset)) {
446+ if (dum->ints_enabled && (disconnect || reset)) {
444447 stop_activity(dum);
448+ ++dum->callback_usage;
449+ spin_unlock(&dum->lock);
445450 if (reset)
446451 usb_gadget_udc_reset(&dum->gadget, dum->driver);
447452 else
448453 dum->driver->disconnect(&dum->gadget);
454+ spin_lock(&dum->lock);
455+ --dum->callback_usage;
449456 }
450− } else if (dum_hcd->active != dum_hcd->old_active) {
457+ } else if (dum_hcd->active != dum_hcd->old_active &&
458+ dum->ints_enabled) {
459+ ++dum->callback_usage;
460+ spin_unlock(&dum->lock);
451461 if (dum_hcd->old_active && dum->driver->suspend)
452462 dum->driver->suspend(&dum->gadget);
453463 else if (!dum_hcd->old_active && dum->driver->resume)
454464 dum->driver->resume(&dum->gadget);
465+ spin_lock(&dum->lock);
466+ --dum->callback_usage;
455467 }
456468
457469 dum_hcd->old_status = dum_hcd->port_status;
@@ -972,8 +984,11 @@ static int dummy_udc_start(struct usb_gadget *g, · 514 unmodified lines
972984 * can't enumerate without help from the driver we're binding.
973985 */
974986
987+ spin_lock_irq(&dum->lock);
975988 dum->devstatus = 0;
976989 dum->driver = driver;
990+ dum->ints_enabled = 1;
991+ spin_unlock_irq(&dum->lock);
977992
978993 return 0;
979994 }
@@ -984,6 +999,16 @@ static int dummy_udc_stop(struct usb_gadget *g) · 4 unmodified lines
984999 struct dummy *dum = dum_hcd->dum;
9851000
9861001 spin_lock_irq(&dum->lock);
1002+ dum->ints_enabled = 0;
1003+ stop_activity(dum);
1004+
1005+ /* emulate synchronize_irq(): wait for callbacks to finish */
1006+ while (dum->callback_usage > 0) {
1007+ spin_unlock_irq(&dum->lock);
1008+ usleep_range(1000, 2000);
1009+ spin_lock_irq(&dum->lock);
1010+ }
1011+
9871012 dum->driver = NULL;
9881013 spin_unlock_irq(&dum->lock);
9891014
@@ -1037,7 +1062,12 @@ static int dummy_udc_probe(struct platform_device *pdev) · 47 unmodified lines
10371062 memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
10381063 dum->gadget.name = gadget_name;
10391064 dum->gadget.ops = &dummy_ops;
1040− dum->gadget.max_speed = USB_SPEED_SUPER;
1065+ if (mod_data.is_super_speed)
1066+ dum->gadget.max_speed = USB_SPEED_SUPER;
1067+ else if (mod_data.is_high_speed)
1068+ dum->gadget.max_speed = USB_SPEED_HIGH;
1069+ else
1070+ dum->gadget.max_speed = USB_SPEED_FULL;
10411071
10421072 dum->gadget.dev.parent = &pdev->dev;
10431073 init_dummy_udc_hw(dum);
@@ -1246,6 +1276,8 @@ static int dummy_urb_enqueue( · 202 unmodified lines
12461276
12471277 list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list);
12481278 urb->hcpriv = urbp;
1279+ if (!dum_hcd->next_frame_urbp)
1280+ dum_hcd->next_frame_urbp = urbp;
12491281 if (usb_pipetype(urb->pipe) == PIPE_CONTROL)
12501282 urb->error_count = 1; /* mark as a new urb */
12511283
@@ -1521,6 +1553,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address) · 269 unmodified lines
15211553 if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ?
15221554 dum->ss_hcd : dum->hs_hcd)))
15231555 return NULL;
1556+ if (!dum->ints_enabled)
1557+ return NULL;
15241558 if ((address & ~USB_DIR_IN) == 0)
15251559 return &dum->ep[0];
15261560 for (i = 1; i < DUMMY_ENDPOINTS; i++) {
@@ -1762,6 +1796,7 @@ static void dummy_timer(unsigned long _dum_hcd) · 235 unmodified lines
17621796 spin_unlock_irqrestore(&dum->lock, flags);
17631797 return;
17641798 }
1799+ dum_hcd->next_frame_urbp = NULL;
17651800
17661801 for (i = 0; i < DUMMY_ENDPOINTS; i++) {
17671802 if (!ep_info[i].name)
@@ -1778,6 +1813,10 @@ restart: · 10 unmodified lines
17781813 int type;
17791814 int status = -EINPROGRESS;
17801815
1816+ /* stop when we reach URBs queued after the timer interrupt */
1817+ if (urbp == dum_hcd->next_frame_urbp)
1818+ break;
1819+
17811820 urb = urbp->urb;
17821821 if (urb->unlinked)
17831822 goto return_urb;
@@ -1857,10 +1896,12 @@ restart: · 73 unmodified lines
18571896 * until setup() returns; no reentrancy issues etc.
18581897 */
18591898 if (value > 0) {
1899+ ++dum->callback_usage;
18601900 spin_unlock(&dum->lock);
18611901 value = dum->driver->setup(&dum->gadget,
18621902 &setup);
18631903 spin_lock(&dum->lock);
1904+ --dum->callback_usage;
18641905
18651906 if (value >= 0) {
18661907 /* no delays (max 64KB data stage) */
@@ -2561,8 +2602,6 @@ static struct hc_driver dummy_hcd = { · 694 unmodified lines
25612602 .product_desc = "Dummy host controller",
25622603 .hcd_priv_size = sizeof(struct dummy_hcd),
25632604
2564− .flags = HCD_USB3 | HCD_SHARED,
2565−
25662605 .reset = dummy_setup,
25672606 .start = dummy_start,
25682607 .stop = dummy_stop,
@@ -2591,8 +2630,12 @@ static int dummy_hcd_probe(struct platform_device *pdev) · 22 unmodified lines
25912630 dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc);
25922631 dum = *((void **)dev_get_platdata(&pdev->dev));
25932632
2594− if (!mod_data.is_super_speed)
2633+ if (mod_data.is_super_speed)
2634+ dummy_hcd.flags = HCD_USB3 | HCD_SHARED;
2635+ else if (mod_data.is_high_speed)
25952636 dummy_hcd.flags = HCD_USB2;
2637+ else
2638+ dummy_hcd.flags = HCD_USB11;
25962639 hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev));
25972640 if (!hs_hcd)
25982641 return -ENOMEM;
drivers/usb/gadget/udc/renesas_usb3.c+15−4
@@ -1038,7 +1038,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, · 1037 unmodified lines
10381038 usb3_ep->ep.maxpacket);
10391039 u8 *buf = usb3_req->req.buf + usb3_req->req.actual;
10401040 u32 tmp = 0;
1041− bool is_last;
1041+ bool is_last = !len ? true : false;
10421042
10431043 if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0)
10441044 return -EBUSY;
@@ -1059,7 +1059,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep, · 14 unmodified lines
10591059 usb3_write(usb3, tmp, fifo_reg);
10601060 }
10611061
1062− is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
1062+ if (!is_last)
1063+ is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
10631064 /* Send the data */
10641065 usb3_set_px_con_send(usb3_ep, len, is_last);
10651066
@@ -1150,7 +1151,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep, · 84 unmodified lines
11501151 usb3_set_p0_con_for_ctrl_read_data(usb3);
11511152 } else {
11521153 usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD);
1153− usb3_set_p0_con_for_ctrl_write_data(usb3);
1154+ if (usb3_req->req.length)
1155+ usb3_set_p0_con_for_ctrl_write_data(usb3);
11541156 }
11551157
11561158 usb3_p0_xfer(usb3_ep, usb3_req);
@@ -2053,7 +2055,16 @@ static u32 usb3_calc_ramarea(int ram_size) · 896 unmodified lines
20532055 static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep,
20542056 const struct usb_endpoint_descriptor *desc)
20552057 {
2056− return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc));
2058+ int i;
2059+ const u32 max_packet_array[] = {8, 16, 32, 64, 512};
2060+ u32 mpkt = PN_RAMMAP_MPKT(1024);
2061+
2062+ for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) {
2063+ if (usb_endpoint_maxp(desc) <= max_packet_array[i])
2064+ mpkt = PN_RAMMAP_MPKT(max_packet_array[i]);
2065+ }
2066+
2067+ return usb3_ep->rammap_val | mpkt;
20572068 }
20582069
20592070 static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep,
drivers/usb/host/pci-quirks.c+5−5
@@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev) · 446 unmodified lines
447447 if ((value & ASMT_CONTROL_WRITE_BIT) == 0)
448448 return 0;
449449
450− usleep_range(40, 60);
450+ udelay(50);
451451 }
452452
453453 dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__);
@@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports); · 568 unmodified lines
10221022 *
10231023 * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS.
10241024 * It signals to the BIOS that the OS wants control of the host controller,
1025− * and then waits 5 seconds for the BIOS to hand over control.
1025+ * and then waits 1 second for the BIOS to hand over control.
10261026 * If we timeout, assume the BIOS is broken and take control anyway.
10271027 */
10281028 static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
@@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) · 40 unmodified lines
10691069 if (val & XHCI_HC_BIOS_OWNED) {
10701070 writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
10711071
1072− /* Wait for 5 seconds with 10 microsecond polling interval */
1072+ /* Wait for 1 second with 10 microsecond polling interval */
10731073 timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
1074− 0, 5000, 10);
1074+ 0, 1000000, 10);
10751075
10761076 /* Assume a buggy BIOS and take HC ownership anyway */
10771077 if (timeout) {
@@ -1100,7 +1100,7 @@ hc_init: · 22 unmodified lines
11001100 * operational or runtime registers. Wait 5 seconds and no more.
11011101 */
11021102 timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0,
1103− 5000, 10);
1103+ 5000000, 10);
11041104 /* Assume a buggy HC and start HC initialization anyway */
11051105 if (timeout) {
11061106 val = readl(op_reg_base + XHCI_STS_OFFSET);
drivers/usb/host/xhci-hub.c+10−4
@@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, · 111 unmodified lines
112112
113113 /* If PSI table exists, add the custom speed attributes from it */
114114 if (usb3_1 && xhci->usb3_rhub.psi_count) {
115− u32 ssp_cap_base, bm_attrib, psi;
115+ u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;
116116 int offset;
117117
118118 ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE;
@@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf, · 20 unmodified lines
139139 for (i = 0; i < xhci->usb3_rhub.psi_count; i++) {
140140 psi = xhci->usb3_rhub.psi[i];
141141 psi &= ~USB_SSP_SUBLINK_SPEED_RSVD;
142+ psi_exp = XHCI_EXT_PORT_PSIE(psi);
143+ psi_mant = XHCI_EXT_PORT_PSIM(psi);
144+
145+ /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */
146+ for (; psi_exp < 3; psi_exp++)
147+ psi_mant /= 1000;
148+ if (psi_mant >= 10)
149+ psi |= BIT(14);
150+
142151 if ((psi & PLT_MASK) == PLT_SYM) {
143152 /* Symmetric, create SSA RX and TX from one PSI entry */
144153 put_unaligned_le32(psi, &buf[offset]);
@@ -1506,9 +1515,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd) · 1361 unmodified lines
15061515 t2 |= PORT_WKOC_E | PORT_WKCONN_E;
15071516 t2 &= ~PORT_WKDISC_E;
15081517 }
1509− if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
1510− (hcd->speed < HCD_USB3))
1511− t2 &= ~PORT_WAKE_BITS;
15121518 } else
15131519 t2 &= ~PORT_WAKE_BITS;
15141520
drivers/usb/host/xhci-pci.c+0−12
@@ -54,11 +54,6 @@ · 53 unmodified lines
5454 #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
5555 #define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
5656
57−#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
58−#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba
59−#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb
60−#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc
61−
6257 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142
6358
6459 static const char hcd_name[] = "xhci_hcd";
@@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) · 77 unmodified lines
142137 if (pdev->vendor == PCI_VENDOR_ID_AMD)
143138 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
144139
145− if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
146− ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
147− (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
148− (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
149− (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
150− xhci->quirks |= XHCI_U2_DISABLE_WAKE;
151−
152140 if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
153141 xhci->quirks |= XHCI_LPM_SUPPORT;
154142 xhci->quirks |= XHCI_INTEL_HOST;
drivers/usb/host/xhci-plat.c+10−6
@@ -178,14 +178,18 @@ static int xhci_plat_probe(struct platform_device *pdev) · 177 unmodified lines
178178 * 2. xhci_plat is child of a device from firmware (dwc3-plat)
179179 * 3. xhci_plat is grandchild of a pci device (dwc3-pci)
180180 */
181− sysdev = &pdev->dev;
182− if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node)
183− sysdev = sysdev->parent;
181+ for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) {
182+ if (is_of_node(sysdev->fwnode) ||
183+ is_acpi_device_node(sysdev->fwnode))
184+ break;
184185 #ifdef CONFIG_PCI
185− else if (sysdev->parent && sysdev->parent->parent &&
186− sysdev->parent->parent->bus == &pci_bus_type)
187− sysdev = sysdev->parent->parent;
186+ else if (sysdev->bus == &pci_bus_type)
187+ break;
188188 #endif
189+ }
190+
191+ if (!sysdev)
192+ sysdev = &pdev->dev;
189193
190194 /* Try to set 64-bit DMA first */
191195 if (WARN_ON(!sysdev->dma_mask))
drivers/usb/host/xhci.c+2−1
@@ -1703,7 +1703,8 @@ static int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev, · 1702 unmodified lines
17031703 if (xhci->quirks & XHCI_MTK_HOST) {
17041704 ret = xhci_mtk_add_ep_quirk(hcd, udev, ep);
17051705 if (ret < 0) {
1706− xhci_free_endpoint_ring(xhci, virt_dev, ep_index);
1706+ xhci_ring_free(xhci, virt_dev->eps[ep_index].new_ring);
1707+ virt_dev->eps[ep_index].new_ring = NULL;
17071708 return ret;
17081709 }
17091710 }
drivers/usb/host/xhci.h+6−4
@@ -735,6 +735,8 @@ struct xhci_ep_ctx { · 734 unmodified lines
735735 #define EP_MAXPSTREAMS(p) (((p) << 10) & EP_MAXPSTREAMS_MASK)
736736 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
737737 #define EP_HAS_LSA (1 << 15)
738+/* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
739+#define CTX_TO_MAX_ESIT_PAYLOAD_HI(p) (((p) >> 24) & 0xff)
738740
739741 /* ep_info2 bitmasks */
740742 /*
@@ -1681,7 +1683,7 @@ struct xhci_bus_state { · 940 unmodified lines
16811683
16821684 static inline unsigned int hcd_index(struct usb_hcd *hcd)
16831685 {
1684− if (hcd->speed == HCD_USB3)
1686+ if (hcd->speed >= HCD_USB3)
16851687 return 0;
16861688 else
16871689 return 1;
@@ -1826,7 +1828,7 @@ struct xhci_hcd { · 138 unmodified lines
18261828 /* For controller with a broken Port Disable implementation */
18271829 #define XHCI_BROKEN_PORT_PED (1 << 25)
18281830 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26)
1829−#define XHCI_U2_DISABLE_WAKE (1 << 27)
1831+/* Reserved. It was XHCI_U2_DISABLE_WAKE */
18301832 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
18311833
18321834 unsigned int num_active_eps;
@@ -2540,8 +2542,8 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq, · 707 unmodified lines
25402542 u8 lsa;
25412543 u8 hid;
25422544
2543− esit = EP_MAX_ESIT_PAYLOAD_HI(info) << 16 |
2544− EP_MAX_ESIT_PAYLOAD_LO(tx_info);
2545+ esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
2546+ CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
25452547
25462548 ep_state = info & EP_STATE_MASK;
25472549 max_pstr = info & EP_MAXPSTREAMS_MASK;
drivers/usb/renesas_usbhs/fifo.c+18−3
@@ -282,11 +282,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe, · 281 unmodified lines
282282 struct usbhs_fifo *fifo)
283283 {
284284 struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
285+ int ret = 0;
285286
286− if (!usbhs_pipe_is_dcp(pipe))
287− usbhsf_fifo_barrier(priv, fifo);
287+ if (!usbhs_pipe_is_dcp(pipe)) {
288+ /*
289+ * This driver checks the pipe condition first to avoid -EBUSY
290+ * from usbhsf_fifo_barrier() with about 10 msec delay in
291+ * the interrupt handler if the pipe is RX direction and empty.
292+ */
293+ if (usbhs_pipe_is_dir_in(pipe))
294+ ret = usbhs_pipe_is_accessible(pipe);
295+ if (!ret)
296+ ret = usbhsf_fifo_barrier(priv, fifo);
297+ }
288298
289− usbhs_write(priv, fifo->ctr, BCLR);
299+ /*
300+ * if non-DCP pipe, this driver should set BCLR when
301+ * usbhsf_fifo_barrier() returns 0.
302+ */
303+ if (!ret)
304+ usbhs_write(priv, fifo->ctr, BCLR);
290305 }
291306
292307 static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
drivers/usb/storage/transport.c+13−1
@@ -834,13 +834,25 @@ Retry_Sense: · 833 unmodified lines
834834 if (result == USB_STOR_TRANSPORT_GOOD) {
835835 srb->result = SAM_STAT_GOOD;
836836 srb->sense_buffer[0] = 0x0;
837+ }
838+
839+ /*
840+ * ATA-passthru commands use sense data to report
841+ * the command completion status, and often devices
842+ * return Check Condition status when nothing is
843+ * wrong.
844+ */
845+ else if (srb->cmnd[0] == ATA_16 ||
846+ srb->cmnd[0] == ATA_12) {
847+ /* leave the data alone */
848+ }
837849
838850 /*
839851 * If there was a problem, report an unspecified
840852 * hardware error to prevent the higher layers from
841853 * entering an infinite retry loop.
842854 */
843− } else {
855+ else {
844856 srb->result = DID_ERROR << 16;
845857 if ((sshdr.response_code & 0x72) == 0x72)
846858 srb->sense_buffer[1] = HARDWARE_ERROR;
drivers/usb/storage/uas-detect.h+8−7
@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf) · 8 unmodified lines
99 intf->desc.bInterfaceProtocol == USB_PR_UAS);
1010 }
1111
12−static int uas_find_uas_alt_setting(struct usb_interface *intf)
12+static struct usb_host_interface *uas_find_uas_alt_setting(
13+ struct usb_interface *intf)
1314 {
1415 int i;
1516
@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf) · 1 unmodified line
1718 struct usb_host_interface *alt = &intf->altsetting[i];
1819
1920 if (uas_is_interface(alt))
20− return alt->desc.bAlternateSetting;
21+ return alt;
2122 }
2223
23− return -ENODEV;
24+ return NULL;
2425 }
2526
2627 static int uas_find_endpoints(struct usb_host_interface *alt,
@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf, · 31 unmodified lines
5859 struct usb_device *udev = interface_to_usbdev(intf);
5960 struct usb_hcd *hcd = bus_to_hcd(udev->bus);
6061 unsigned long flags = id->driver_info;
61− int r, alt;
62−
62+ struct usb_host_interface *alt;
63+ int r;
6364
6465 alt = uas_find_uas_alt_setting(intf);
65− if (alt < 0)
66+ if (!alt)
6667 return 0;
6768
68− r = uas_find_endpoints(&intf->altsetting[alt], eps);
69+ r = uas_find_endpoints(alt, eps);
6970 if (r < 0)
7071 return 0;
7172
drivers/usb/storage/uas.c+5−5
@@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids); · 872 unmodified lines
873873 static int uas_switch_interface(struct usb_device *udev,
874874 struct usb_interface *intf)
875875 {
876− int alt;
876+ struct usb_host_interface *alt;
877877
878878 alt = uas_find_uas_alt_setting(intf);
879− if (alt < 0)
880− return alt;
879+ if (!alt)
880+ return -ENODEV;
881881
882− return usb_set_interface(udev,
883− intf->altsetting[0].desc.bInterfaceNumber, alt);
882+ return usb_set_interface(udev, alt->desc.bInterfaceNumber,
883+ alt->desc.bAlternateSetting);
884884 }
885885
886886 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
drivers/usb/storage/unusual_devs.h+7−0
@@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000, · 1458 unmodified lines
14591459 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
14601460 US_FL_SANE_SENSE ),
14611461
1462+/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */
1463+UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999,
1464+ "Seagate",
1465+ "External",
1466+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
1467+ US_FL_NO_WP_DETECT ),
1468+
14621469 UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999,
14631470 "Maxtor",
14641471 "USB to SATA",
drivers/uwb/hwa-rc.c+2−0
@@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface, · 824 unmodified lines
825825
826826 if (iface->cur_altsetting->desc.bNumEndpoints < 1)
827827 return -ENODEV;
828+ if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc))
829+ return -ENODEV;
828830
829831 result = -ENOMEM;
830832 uwb_rc = uwb_rc_alloc();
drivers/uwb/uwbd.c+8−4
@@ -302,18 +302,22 @@ static int uwbd(void *param) · 301 unmodified lines
302302 /** Start the UWB daemon */
303303 void uwbd_start(struct uwb_rc *rc)
304304 {
305− rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
306− if (rc->uwbd.task == NULL)
305+ struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
306+ if (IS_ERR(task)) {
307+ rc->uwbd.task = NULL;
307308 printk(KERN_ERR "UWB: Cannot start management daemon; "
308309 "UWB won't work\n");
309− else
310+ } else {
311+ rc->uwbd.task = task;
310312 rc->uwbd.pid = rc->uwbd.task->pid;
313+ }
311314 }
312315
313316 /* Stop the UWB daemon and free any unprocessed events */
314317 void uwbd_stop(struct uwb_rc *rc)
315318 {
316− kthread_stop(rc->uwbd.task);
319+ if (rc->uwbd.task)
320+ kthread_stop(rc->uwbd.task);
317321 uwbd_flush(rc);
318322 }
319323
include/uapi/linux/usb/ch9.h+1−0
@@ -780,6 +780,7 @@ struct usb_interface_assoc_descriptor { · 779 unmodified lines
780780 __u8 iFunction;
781781 } __attribute__ ((packed));
782782
783+#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8
783784
784785 /*-------------------------------------------------------------------------*/
785786