aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb/host
AgeCommit message (Collapse)AuthorFilesLines
2024-07-19Merge tag 'usb-6.11-rc1' of ↵Linus Torvalds11-254/+214
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 6.11-rc1. Nothing earth-shattering in here, just constant forward progress in adding support for new hardware and better debugging functionalities for thunderbolt devices and the subsystem. Included in here are: - thunderbolt debugging update and driver additions - xhci driver updates - typec driver updates - kselftest device driver changes (acked by the relevant maintainers, depended on other changes in this tree.) - cdns3 driver updates - gadget driver updates - MODULE_DESCRIPTION() additions - dwc3 driver updates and fixes All of these have been in linux-next for a while with no reported issues" * tag 'usb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (112 commits) kselftest: devices: Add test to detect device error logs kselftest: Move ksft helper module to common directory kselftest: devices: Move discoverable devices test to subdirectory usb: gadget: f_uac2: fix non-newline-terminated function name USB: uas: Implement the new shutdown callback USB: core: add 'shutdown' callback to usb_driver usb: typec: Drop explicit initialization of struct i2c_device_id::driver_data to 0 usb: dwc3: enable CCI support for AMD-xilinx DWC3 controller usb: dwc2: add support for other Lantiq SoCs usb: gadget: Use u16 types for 16-bit fields usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup usb: dwc3: core: Check all ports when set phy suspend usb: typec: tcpci: add support to set connector orientation dt-bindings: usb: Convert fsl-usb to yaml usb: typec: ucsi: reorder operations in ucsi_run_command() usb: typec: ucsi: extract common code for command handling usb: typec: ucsi: inline ucsi_read_message_in usb: typec: ucsi: rework command execution functions usb: typec: ucsi: split read operation usb: typec: ucsi: simplify command sending API ...
2024-07-03xhci: always resume roothubs if xHC was reset during resumeMathias Nyman1-3/+13
Usb device connect may not be detected after runtime resume if xHC is reset during resume. In runtime resume cases xhci_resume() will only resume roothubs if there are pending port events. If the xHC host is reset during runtime resume due to a Save/Restore Error (SRE) then these pending port events won't be detected as PORTSC change bits are not immediately set by host after reset. Unconditionally resume roothubs if xHC is reset during resume to ensure device connections are detected. Also return early with error code if starting xHC fails after reset. Issue was debugged and a similar solution suggested by Remi Pommarel. Using this instead as it simplifies future refactoring. Reported-by: Remi Pommarel <repk@triplefau.lt> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218987 Suggested-by: Remi Pommarel <repk@triplefau.lt> Tested-by: Remi Pommarel <repk@triplefau.lt> Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240627145523.1453155-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27xhci: sort out TRB Endpoint ID bitfield macrosMathias Nyman2-22/+17
xhci macros that read and write endpoint ID bitfields of TRBs are mixing the 1-based Endpoint ID as described in the xHCI specification, and 0-based endpoint index used by driver as an array index. Sort this out by naming macros that deal with 1 based Endpoint ID fields to *_EP_ID_*, and 0 based endpoint index values to *_EP_INDEX_*. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-22-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27xhci: Apply XHCI_RESET_TO_DEFAULT quirk to TGLReka Norman1-1/+3
TGL systems have the same issue as ADL, where a large boot firmware delay is seen if USB ports are left in U3 at shutdown. So apply the XHCI_RESET_TO_DEFAULT quirk to TGL as well. The issue it fixes is a ~20s boot time delay when booting from S5. It affects TGL devices, and TGL support was added starting from v5.3. Cc: stable@vger.kernel.org Signed-off-by: Reka Norman <rekanorman@chromium.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-21-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: add 'goto' for halted endpoint check in handle_tx_event()Niklas Neronin1-16/+17
Add 'goto' statement for a halted endpoint, streamlining the error handling process. In future handle_tx_event() changes this 'goto' statement will have more uses. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-20-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: move process TD code out of the while loopNiklas Neronin1-32/+30
This part is and should only performed once, so it's moved out of the while loop to improve code readability. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-19-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: remove infinite loop preventionNiklas Neronin1-15/+0
If a buggy HW reports some unpredicted event (for example, an overrun event following a MSE event while the EP ring is actually not empty), the driver will never find the TD, and it will loop until the TD list is empty. Before commits [1][2], the spin lock was released when giving back a URB in the do-while loop. This could cause more TD to be added to TD list, causing an infinite loop. Because of commits [1][2] the spin lock is not released any more, thus the infinite loop prevention is unnecessary and is removed. [1], commit 0c03d89d0c71 ("xhci: Giveback urb in finish_td directly") [2], commit 36dc01657b49 ("usb: host: xhci: Support running urb giveback in tasklet context") Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-18-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: remove false xhci_giveback_urb_in_irq() header commentNiklas Neronin1-4/+0
The function doesn't releases and re-acquires the lock, this was removed in commit 36dc01657b49 ("usb: host: xhci: Support running urb giveback in tasklet context") Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-17-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: ensure skipped isoc TDs are returned when isoc ring is stoppedNiklas Neronin1-13/+12
Missed service event tells the driver that the hardware wasn't able to process some queued isoc TDs in their right time slots, and some TDs will be skipped. The driver sets a 'skip' flag to indicate that the next transfer event after this event will point to some future TD instead of the next queued TD. Once the driver receives the next event, it will skip and give back all those hardware skipped TDs. However, should this subsequent event be a stop endpoint which does not point to the next pending TD, the driver fails to return the skipped TDs. Instead, it loops for a period before outputting an erroneous message. Fix this by repositioning the 'stop endpoint' check to follow the isoc skip check, ensuring the skipped TDs are properly returned. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-16-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27xhci: rework xhci internal endpoint halt state detection.Mathias Nyman1-27/+29
When xhci_requires_manual_halt_cleanup() was written it wasn't clear that the xhci internal endpoint halt state always needs to be cleared with a reset endpoint command. Functional stall cases additionally halt the device side endpoint which requires class driver to clear the device side halt with a CLEAR_FEATURE(ENDPOINT_HALT) request as well. Clean up, rename, and make sure the new function always return true when internal endpoint state is halted, including stall cases. Based on related cleanup suggestion code by Niklas Neronin cc: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-15-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: remove obsolete sanity check debug messagesNiklas Neronin1-8/+2
Remove debug messages that served as sanity checks during the initial implementation phase of underrun/overrun completion codes. These checks are now unnecessary. Instead, improve the default debug messages for underrun/overrun events, so that they are consistent with the reset of the completion codes. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-14-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: improve error message for targetless transfer eventNiklas Neronin1-2/+2
Improve error message for unknown transfer event without a TRB, by also printing the event code number. This removes the inevitable question; "what was the unknown event code exactly?" Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-13-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: move untargeted transfer event handling to a separate functionNiklas Neronin1-27/+29
Move handling transfer events without a target transfer TRB into handle_transferless_tx_event(), this type of event does not utilize the rest of handle_tx_event() and as a result it's better to separate it into a dedicated function. Additionally, this change reduces handle_tx_event()'s size and makes it more readable. [Mathias: Simplify code to return helper function value directly. This removes the second xhci_err() message for untargeted and unexpected event completion types] Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-12-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: move all segment re-numbering to xhci_link_rings()Niklas Neronin1-12/+13
This is a preparation patch for switching from custom segment list handling to using list.h functions. Contain all segment re-numbering in xhci_link_rings() which links two segments lists together, and performs all necessary adjustments for them to fit together. No need to send segment number to xhci_alloc_segments_for_ring() as a parameter after this. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-11-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: move link chain bit quirk checks into one helper function.Niklas Neronin3-16/+9
Older 0.95 xHCI hosts and some other specific newer hosts require the chain bit to be set for Link TRBs even if the link TRB is not in the middle of a transfer descriptor (TD). move the checks for all those cases into one xhci_link_chain_quirk() function to clean up and avoid code duplication. No functional changes. [skip renaming chain_links flag, reword commit message -Mathias] Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-10-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: remove unused argument from handle_port_status()Niklas Neronin1-4/+2
Argument struct 'xhci_interrupter *ir' is not used, and as a consequence is removed. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-9-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: remove unused argument from xhci_handle_cmd_config_ep()Niklas Neronin1-3/+2
Argument u32 'cmd_comp_code' is not used, and as a consequence is removed. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-8-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: remove unused 'xhci' argumentNiklas Neronin1-21/+14
Remove argument 'struct xhci_hcd *xhci' from functions which do not utilize it. This change contributes to a simpler codebase by avoiding redundant arguments. Functions which have the argument removed: check_interval() xhci_num_trbs_free() xhci_handle_cmd_enable_slot() xhci_clear_interrupt_pending() xhci_requires_manual_halt_cleanup() Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27usb: xhci: remove 'num_trbs' from struct 'xhci_td'Niklas Neronin2-5/+0
Remove 'num_trbs' from 'xhci_td' as it's no longer used following the removal of 'num_trbs_free' tracking in commit 2710f8186f88 ("xhci: Stop unnecessary tracking of free trbs in a ring"). Tracking of 'num_trbs_free' is still performed in xhci DbC, but it does not utilize 'num_trbs'. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27xhci: dbc: Allow users to modify DbC poll interval via sysfsUday M Bhat2-1/+39
xhci DbC driver polls the host controller for DbC events at a reduced rate when DbC is enabled but there are no active data transfers. Allow users to modify this reduced poll interval via dbc_poll_interval_ms sysfs entry. Unit is milliseconds and accepted range is 0 to 5000. Max interval of 5000 ms is selected as it matches the common 5 second timeout used in usb stack. Default value is 64 milliseconds. A long interval is useful when users know there won't be any activity on systems connected via DbC for long periods, and want to avoid battery drainage due to unnecessary CPU usage. Example being Android Debugger (ADB) usage over DbC on ChromeOS systems running Android Runtime. [minor changes and rewording -Mathias] Co-developed-by: Samuel Jacob <samjaco@google.com> Signed-off-by: Samuel Jacob <samjaco@google.com> Signed-off-by: Uday M Bhat <uday.m.bhat@intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27xhci: Set correct transferred length for cancelled isoc transfersMathias Nyman1-1/+3
The transferred length is incorrectly zeroed for cancelled isoc transfer TDs when the transfer ring stops on a cancelled TD with a 'Stop - Length Invalid' completion code. Length was always set to zero in these cases even if it should be set to the sum of the TRB transfer block lengths up to the TRB the ring stopped on, _excluding_ the one stopped on. No issues reported due to this isoc case. Found while inspecting related case in bulk transfer 'Stop - Length Invalid' handling. Change this so that 'Stop - Length Invalid' transfer completion cases always sum up TRB lengths instead of report a zero length. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27xhci: show usb device name in xhci urb tracingMathias Nyman1-1/+4
parsing xhci traces on systems with several xHCI controllers and connected usb devices is difficult as entries are all interleaved. showing usb devname in urb tracing reveals both which device, and which bus/controller the entry is for. old: xhci_urb_enqueue: ep2in-bulk: urb 0000000039224498 ... new: xhci_urb_enqueue: 3-9.4 ep1in-bulk: urb 0000000013bf21e7 ... Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-27xhci: Remove dead code in xhci_move_dequeue_past_td()Hector Martin1-21/+0
This codepath is trivially dead, since the function is never called with a non-NULL td (the only callsite is immediately preceded by a NULL guard). [remove unused label 'deq_found' -Mathias] Signed-off-by: Hector Martin <marcan@marcan.st> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240626124835.1023046-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-20usb: host: xhci-plat: Add support for XHCI_WRITE_64_HI_LODaehwan Jung1-0/+3
xHCI specification 5.1 "Register Conventions" states that 64 bit registers should be written in low-high order. All writing operations in xhci is done low-high order following the spec. Add a new quirk to support workaround for high-low order. Signed-off-by: Daehwan Jung <dh10.jung@samsung.com> Link: https://lore.kernel.org/r/1718019553-111939-4-git-send-email-dh10.jung@samsung.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-20xhci: Add a quirk for writing ERST in high-low orderDaehwan Jung2-1/+6
This quirk is for the controller that has a limitation in supporting separate ERSTBA_HI and ERSTBA_LO programming. It's supported when the ERSTBA is programmed ERSTBA_HI before ERSTBA_LO. That's because the internal initialization of event ring fetches the "Event Ring Segment Table Entry" based on the indication of ERSTBA_LO written. Signed-off-by: Daehwan Jung <dh10.jung@samsung.com> Link: https://lore.kernel.org/r/1718019553-111939-3-git-send-email-dh10.jung@samsung.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-20usb: host: add missing MODULE_DESCRIPTION() macrosJeff Johnson2-0/+2
With ARCH=x86, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/host/ohci-exynos.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/host/xhci-pci-renesas.o Add the missing invocations of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com> Link: https://lore.kernel.org/r/20240611-md-drivers-usb-host-v1-1-e2071a696ef8@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-18Merge tag 'v6.10-rc4' into usb-nextGreg Kroah-Hartman3-14/+53
We need the USB / Thunderbolt fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-12xhci: Handle TD clearing for multiple streams caseHector Martin2-11/+44
When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/"should never happen" paths to ensure we at least clear any affected TDs, even if we can't issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens. This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") early on in the XHCI driver's life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted endpoints into two steps"), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious). Then later, in commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs."), it was acknowledged again. [Mathias: commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") was a targeted regression fix to the previously mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the TD clearing of multiple streams to its original state.] Apparently the commit author was aware of the problem (yet still chose to submit it): It was still mentioned as a FIXME, an xhci_dbg() was added to log the problem condition, and the remaining issue was mentioned in the commit description. The choice of making the log type xhci_dbg() for what is, at this point, a completely unhandled and known broken condition is puzzling and unfortunate, as it guarantees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you turn on DEBUG, the message doesn't really hint at there being a problem at all). It took me *months* of random xHC crashes to finally find a reliable repro and be able to do a deep dive debug session, which could all have been avoided had this unhandled, broken condition been actually reported with a warning, as it should have been as a bug intentionally left in unfixed (never mind that it shouldn't have been left in at all). > Another fix to solve clearing the caches of all stream rings with > cancelled TDs is needed, but not as urgent. 3 years after that statement and 14 years after the original bug was introduced, I think it's finally time to fix it. And maybe next time let's not leave bugs unfixed (that are actually worse than the original bug), and let's actually get people to review kernel commits please. Fixes xHC crashes and IOMMU faults with UAS devices when handling errors/faults. Easiest repro is to use `hdparm` to mark an early sector (e.g. 1024) on a disk as bad, then `cat /dev/sdX > /dev/null` in a loop. At least in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to different streams) and the one that didn't get cleared properly ends up faulting the xHC entirely when it tries to access DMA pages that have since been unmapped, referred to by the stale TDs. This normally happens quickly (after two or three loops). After this fix, I left the `cat` in a loop running overnight and experienced no xHC failures, with all read errors recovered properly. Repro'd and tested on an Apple M1 Mac Mini (dwc3 host). On systems without an IOMMU, this bug would instead silently corrupt freed memory, making this a security bug (even on systems with IOMMUs this could silently corrupt memory belonging to other USB devices on the same controller, so it's still a security bug). Given that the kernel autoprobes partition tables, I'm pretty sure a malicious USB device pretending to be a UAS device and reporting an error with the right timing could deliberately trigger a UAF and write to freed memory, with no user action. [Mathias: Commit message and code comment edit, original at:] https://lore.kernel.org/linux-usb/20240524-xhci-streams-v1-1-6b1f13819bea@marcan.st/ Fixes: e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") Fixes: 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") Fixes: 674f8438c121 ("xhci: split handling halted endpoints into two steps") Cc: stable@vger.kernel.org Cc: security@kernel.org Reviewed-by: Neal Gompa <neal@gompa.dev> Signed-off-by: Hector Martin <marcan@marcan.st> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240611120610.3264502-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-12xhci: Apply broken streams quirk to Etron EJ188 xHCI hostKuangyi Chiang1-1/+3
As described in commit 8f873c1ff4ca ("xhci: Blacklist using streams on the Etron EJ168 controller"), EJ188 have the same issue as EJ168, where Streams do not work reliable on EJ188. So apply XHCI_BROKEN_STREAMS quirk to EJ188 as well. Cc: stable@vger.kernel.org Signed-off-by: Kuangyi Chiang <ki.chiang65@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240611120610.3264502-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-12xhci: Apply reset resume quirk to Etron EJ188 xHCI hostKuangyi Chiang1-0/+5
As described in commit c877b3b2ad5c ("xhci: Add reset on resume quirk for asrock p67 host"), EJ188 have the same issue as EJ168, where completely dies on resume. So apply XHCI_RESET_ON_RESUME quirk to EJ188 as well. Cc: stable@vger.kernel.org Signed-off-by: Kuangyi Chiang <ki.chiang65@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240611120610.3264502-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-12xhci: Set correct transferred length for cancelled bulk transfersMathias Nyman1-3/+2
The transferred length is set incorrectly for cancelled bulk transfer TDs in case the bulk transfer ring stops on the last transfer block with a 'Stop - Length Invalid' completion code. length essentially ends up being set to the requested length: urb->actual_length = urb->transfer_buffer_length Length for 'Stop - Length Invalid' cases should be the sum of all TRB transfer block lengths up to the one the ring stopped on, _excluding_ the one stopped on. Fix this by always summing up TRB lengths for 'Stop - Length Invalid' bulk cases. This issue was discovered by Alan Stern while debugging https://bugzilla.kernel.org/show_bug.cgi?id=218890, but does not solve that bug. Issue is older than 4.10 kernel but fix won't apply to those due to major reworks in that area. Tested-by: Pierre Tomon <pierretom+12@ik.me> Cc: stable@vger.kernel.org # v4.10+ Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240611120610.3264502-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-04usb: host: oxu210hp: remove unused struct 'ehci_dbg_port'Dr. David Alan Gilbert1-25/+0
'ehci_dbg_port' is unused in oxu210hp-hcd.c since it's original commit b92a78e582b1 ("usb host: Oxford OXU210HP HCD driver.") when it was in a separate header. Remove it. Note, that this structure, and some others in the driver are mostly clones of include/linux/usb/ehci_def.h. Someone with the hardware to be able to test it might be able to remove a lot more structs as well and just use that header. Signed-off-by: "Dr. David Alan Gilbert" <linux@treblig.org> Link: https://lore.kernel.org/r/20240529210002.106369-1-linux@treblig.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-10Merge 6.9-rc7 into usb-nextGreg Kroah-Hartman3-1/+12
We want the USB fixes in here as well, and resolve a merge conflict in drivers/usb/dwc3/core.c Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: compact 'trb_in_td()' argumentsNiklas Neronin2-27/+16
Pass pointer to the TD (struct xhci_td *) directly, instead of its components separately. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-19-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: remove duplicate TRB_TO_SLOT_ID() callsNiklas Neronin1-11/+6
Remove unnecessary repeated calls to TRB_TO_SLOT_ID(). The slot ID is stored in the 'slot_id' variable at the function's start. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-18-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01xhci: pci: Use PCI_VENDOR_ID_RENESASAndy Shevchenko1-2/+2
Instead of plain hexadecimal, use already defined PCI_VENDOR_ID_RENESAS. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-17-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01xhci: pci: Group out Thunderbolt xHCI IDsAndy Shevchenko1-7/+9
It's better to keep track on Thunderbolt xHCI IDs in a separate group. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-16-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01xhci: pci: Use full names in PCI IDs for Intel platformsAndy Shevchenko1-9/+9
There are three out of many Intel platforms that are using TLAs instead of the full names in the PCI IDs. Modify them accordingly. This also fixes the logic of grouping as seemed to be by an LSB byte of the ID. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-15-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: remove goto 'cleanup' in handle_tx_event()Niklas Neronin1-17/+21
By removing the goto 'cleanup' statement, and replacing it with 'continue', 'break' and 'return', helps simplify the code and further showcase in which case the while loop iterates. This change prepares for the comprehensive handle_tx_event() rework. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-14-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: replace goto with return when possible in handle_tx_event()Niklas Neronin1-3/+3
Simplifying the handle_tx_event() function by addressing the complexity of its while loop. Replaces specific 'goto cleanup' statements with 'return' statements, applicable only where 'ep->skip' is set to 'false', ensuring loop termination. The original while loop, combined with 'goto cleanup', adds unnecessary complexity. This change aims to untangle the loop's logic, facilitating a more straightforward review of the upcoming comprehensive rework. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-13-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: remove 'handling_skipped_tds' from handle_tx_event()Niklas Neronin1-9/+4
When handle_tx_event() encounters a COMP_MISSED_SERVICE_ERROR or COMP_NO_PING_RESPONSE_ERROR event, it moves to 'goto cleanup'. Here, it sets a flag, 'handling_skipped_tds', based on conditions that exclude these two error events. Subsequently, the process evaluates the loop that persists as long as 'handling_skipped_tds' remains true. However, since 'trb_comp_code' does not change after its assignment, if it indicates either of the two error conditions, the loop terminates immediately. To simplify this process and enhance clarity, the modification involves returning immediately upon detecting COMP_MISSED_SERVICE_ERROR or COMP_NO_PING_RESPONSE_ERROR. This adjustment allows for the direct use of 'ep->skip', removing the necessity for the 'handling_skipped_tds' flag. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-12-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: prevent potential failure in handle_tx_event() for Transfer ↵Niklas Neronin1-2/+3
events without TRB Some transfer events don't always point to a TRB, and consequently don't have a endpoint ring. In these cases, function handle_tx_event() should not proceed, because if 'ep->skip' is set, the pointer to the endpoint ring is used. To prevent a potential failure and make the code logical, return after checking the completion code for a Transfer event without TRBs. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-11-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01xhci: remove XHCI_TRUST_TX_LENGTH quirkMathias Nyman4-30/+10
If this quirk was set then driver would treat transfer events with 'Success' completion code as 'Short packet' if there were untransferred bytes left. This is so common that turn it into default behavior. xhci_warn_ratelimited() is no longer used after this, so remove it. A success event with untransferred bytes left doesn't always mean a misbehaving controller. If there was an error mid a multi-TRB TD it's allowed to issue a success event for the last TRB in that TD. See xhci 1.2 spec 4.9.1 Transfer Descriptors "Note: If an error is detected while processing a multi-TRB TD, the xHC shall generate a Transfer Event for the TRB that the error was detected on with the appropriate error Condition Code, then may advance to the next TD. If in the process of advancing to the next TD, a Transfer TRB is encountered with its IOC flag set, then the Condition Code of the Transfer Event generated for that Transfer TRB should be Success, because there was no error actually associated with the TRB that generated the Event. However, an xHC implementation may redundantly assert the original error Condition Code." Co-developed-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-10-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01xhci: improve PORTSC register debugging outputMathias Nyman1-1/+6
Print the full hex value of PORTSC register in addition to the human readable decoded string while debugging PORTSC value. If PORTSC value is 0xffffffff then don't decode it. This lets us inspect Rsvd bits of PORTSC. Same is done for USBSTS register values. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-9-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: use array_size() when allocating and freeing memoryNiklas Neronin1-7/+7
Replace size_mul() with array_size() in memory allocation and freeing processes, it fits better semantically. Macro array_size() is identical to size_mult(), which clamps the max size, so it's imperative that array_size() is used when freeing said memory. Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-8-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: remove redundant variable 'erst_size'Niklas Neronin2-3/+1
'erst_size' represents the maximum capacity of entries that ERST can hold, while 'num_entries' indicates the actual number of entries currently held in the ERST. These two values are identical because the xhci driver does not support ERST expansion. Thus, 'erst_size' is removed. Suggested-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: address off-by-one in xhci_num_trbs_free()Niklas Neronin1-1/+1
Reduce the number of do-while loops by 1. The number of loops should be number of segment + 1, the +1 is in case deq and enq are on the same segment. But due to the use of a do-while loop, the expression is evaluated after executing the loop, thus the loop is executed 1 extra time. Changing the do-while loop expression from "<=" to "<", reduces the loop amount by 1. The expression "<=" would also work if it was a while loop instead of a do-while loop. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: improve debug message in xhci_ring_expansion_needed()Niklas Neronin1-4/+2
Address debug message inaccuracies in xhci_ring_expansion_needed(). Specifically, remove the portion of the debug message that indicates the number of enqueue TRBs to be added to the dequeue segment. This part of the message may mislead and the calculated value is incorrect. Given that this value is not of significant importance and the statement is not consistently accurate, it has been omitted. The specific issues with the debug message that this commit resolves: - The calculation of the number of TRBs is incorrect. The current calculation erroneously includes the link TRB, which is reserved. Furthermore, the calculated number of TRBs can exceed the dequeue segment, resulting in a misleading debug message. - The current phrasing suggests that "ring expansion by X is needed, adding X TRBs moves enqueue Y TRBs into the dequeue segment". The intended message, however, is "IF the ring is NOT expanded by X, THEN adding X TRBs moves enqueue Y TRBs into the dequeue segment". Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01usb: xhci: check if 'requested segments' exceeds ERST capacityNiklas Neronin2-14/+14
Check if requested segments ('segs' or 'ERST_DEFAULT_SEGS') exceeds the maximum amount ERST supports. When 'segs' is '0', 'ERST_DEFAULT_SEGS' is used instead. But both values may not exceed ERST max. Macro 'ERST_MAX_SEGS' is renamed to 'ERST_DEFAULT_SEGS'. The new name better represents the macros, which is the number of Event Ring segments to allocate, when the amount is not specified. Additionally, rename and change xhci_create_secondary_interrupter()'s argument 'int num_segs' to 'unsigned int segs'. This makes it the same as its counter part in xhci_alloc_interrupter(). Fixes: c99b38c41234 ("xhci: add support to allocate several interrupters") Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-01xhci: remove xhci_check_usb2_port_capability helperMathias Nyman1-21/+8
This helper was only called from one function. Removing it both reduces lines of code and made it more readable. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20240429140245.3955523-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Powered by cgit, Gruvboxed by Blaster4385.