usb: gadget: Fix OS descriptors support

The current code is broken as it re-defines "req" inside the
if block, then goto out of it. Thus the request that ends
up being sent is not th

usb: gadget: Fix OS descriptors support

The current code is broken as it re-defines "req" inside the
if block, then goto out of it. Thus the request that ends
up being sent is not the one that was populated by the
code in question.

This fixes RNDIS driver autodetect by Windows 10 for me.

The bug was introduced by Chris rework to remove the local
queuing inside the if { } block of the redefined request.

Fixes: 636ba13aec8a ("usb: gadget: composite: remove duplicated code in OS desc handling")
Cc: <stable@vger.kernel.org> # v4.17
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: fix delayed_status race condition when set_interface

It happens when enable debug log, if set_alt() returns
USB_GADGET_DELAYED_STATUS and usb_composite_setup_cont

usb: gadget: composite: fix delayed_status race condition when set_interface

It happens when enable debug log, if set_alt() returns
USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue()
is called before increasing count of @delayed_status,
so fix it by using spinlock of @cdev->lock.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Tested-by: Jay Hsu <shih-chieh.hsu@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: fill bcdUSB as 0x0320 for SuperSpeed or higher speeds

The USB3CV version 2.1.80 (March 26, 2018) requires all devices
( gen1, gen2, single lane, dual lane) to ret

usb: gadget: composite: fill bcdUSB as 0x0320 for SuperSpeed or higher speeds

The USB3CV version 2.1.80 (March 26, 2018) requires all devices
( gen1, gen2, single lane, dual lane) to return the value of 0x0320
in the bcdUSB field

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb/gadget: Add an EP dispose() callback for EP lifetime tracking

Some UDC may want to allocate endpoints dynamically, either because
the HW supports an arbitrary large number or because

usb/gadget: Add an EP dispose() callback for EP lifetime tracking

Some UDC may want to allocate endpoints dynamically, either because
the HW supports an arbitrary large number or because (like the Aspeed
BMC SoCs), the pool of HW endpoints is shared between multiple gadgets.

The allocation side can be done rather easily using the existing
match_ep() UDC hook.

However we have no good place to "free" them.

This implements a "simple" variant of this, which calls an EP dispose
callback on all EPs associated with a gadget when the composite device
gets unbound.

This is required by my upcoming Aspeed vHub driver.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: remove duplicated code in OS desc handling

When the host wants to fetch OS descriptors, it sends two requests. The
first is only for the header and the second for

usb: gadget: composite: remove duplicated code in OS desc handling

When the host wants to fetch OS descriptors, it sends two requests. The
first is only for the header and the second for the full amount
specified by the header in the first request. The OS descriptor handling
code is distinguishing the header-only requests based on the wLength of
the setup packet, but the same code is executed in both cases to
construct the actual header. Simplify this by always constructing the
header and then filling out the rest of the request if the wLength is
greater than the size of the header.

Also remove the duplicate code for queueing the request to ep0 by adding
a goto label.

Signed-off-by: Chris Dickens <christopher.a.dickens@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: fix incorrect handling of OS desc requests

When handling an OS descriptor request, one of the first operations is
to zero out the request buffer using the wLength

usb: gadget: composite: fix incorrect handling of OS desc requests

When handling an OS descriptor request, one of the first operations is
to zero out the request buffer using the wLength from the setup packet.
There is no bounds checking, so a wLength > 4096 would clobber memory
adjacent to the request buffer. Fix this by taking the min of wLength
and the request buffer length prior to the memset. While at it, define
the buffer length in a header file so that magic numbers don't appear
throughout the code.

When returning data to the host, the data length should be the min of
the wLength and the valid data we have to return. Currently we are
returning wLength, thus requests for a wLength greater than the amount
of data in the OS descriptor buffer would return invalid (albeit zero'd)
data following the valid descriptor data. Fix this by counting the
number of bytes when constructing the data and using this when
determining the length of the request.

Signed-off-by: Chris Dickens <christopher.a.dickens@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: don't dereference g until after it has been null checked

Avoid dereferencing pointer g until after g has been sanity null checked;
move the assignment of cdev much later whe

usb: gadget: don't dereference g until after it has been null checked

Avoid dereferencing pointer g until after g has been sanity null checked;
move the assignment of cdev much later when it is required into a more
local scope.

Detected by CoverityScan, CID#1222135 ("Dereference before null check")

Fixes: b785ea7ce662 ("usb: gadget: composite: fix ep->maxburst initialization")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

USB: gadget: Remove redundant license text

Now that the SPDX tag is in all USB files, that identifies the license
in a specific and legally-defined manner. So the extra GPL text wording

USB: gadget: Remove redundant license text

Now that the SPDX tag is in all USB files, that identifies the license
in a specific and legally-defined manner. So the extra GPL text wording
can be removed as it is no longer needed at all.

This is done on a quest to remove the 700+ different ways that files in
the kernel describe the GPL license text. And there's unneeded stuff
like the address (sometimes incorrect) for the FSF which is never
needed.

No copyright headers or other non-license-description text was removed.

Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

USB: add SPDX identifiers to all remaining files in drivers/usb/

It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.

USB: add SPDX identifiers to all remaining files in drivers/usb/

It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.

Update the drivers/usb/ and include/linux/usb* files with the correct
SPDX license identifier based on the license text in the file itself.
The SPDX identifier is a legally binding shorthand, which can be used
instead of the full boiler plate text.

This work is based on a script and data from Thomas Gleixner, Philippe
Ombredanne, and Kate Stewart.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

usb: gadget: composite: mark expected switch fall-throughs

In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.

Signed-of

usb: gadget: composite: mark expected switch fall-throughs

In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.

Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options

KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in usb_composite_overwrite_

usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options

KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in usb_composite_overwrite_options+...
[libcomposite] at addr ...
Read of size 1 by task ...

when some driver is un-bound and then bound again.
For example, this happens with FunctionFS driver when "ffs-test"
test application is run several times in a row.

If the driver has empty manufacturer ID string in initial static data,
it is then replaced with generated string. After driver unbinding
the generated string is freed, but the driver data still keep that
pointer. And if the driver is then bound again, that pointer
is re-used for string emptiness check.

The fix is to clean up the driver string data upon its unbinding
to drop the pointer to freed memory.

Fixes: cc2683c318a5 ("usb: gadget: Provide a default implementation of default manufacturer string")
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

Merge tag 'usb-for-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-testing

Felipe writes:

usb: changes for v4.13 merge window

This time around we

Merge tag 'usb-for-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-testing

Felipe writes:

usb: changes for v4.13 merge window

This time around we have a total of 57 non-merge commits. A list of
most important changes follows:

- Improvements to dwc3 tracing interface
- Initial dual-role support for dwc3
- Improvements to how we handle DMA resources in dwc3
- A new f_uac1 implementation which much more flexible
- Removal of AVR32 bits
- Improvements to f_mass_storage driver

show more ...

usb: gadget: composite: make sure to reactivate function on unbind

If a function sets bind_deactivated flag, upon removal we will be left
with an unbalanced deactivation. Let's make sure

usb: gadget: composite: make sure to reactivate function on unbind

If a function sets bind_deactivated flag, upon removal we will be left
with an unbalanced deactivation. Let's make sure that we conditionally
call usb_function_activate() from usb_remove_function() and make sure
usb_remove_function() is called from remove_config().

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: Allow a non-SuperSpeed gadget to support LPM

This commit allows a gadget that does not support SuperSpeed to indicate
that it supports LPM. It does this by setting the 'lpm_

usb: gadget: Allow a non-SuperSpeed gadget to support LPM

This commit allows a gadget that does not support SuperSpeed to indicate
that it supports LPM. It does this by setting the 'lpm_capable' flag in
the gadget structure.

If a gadget sets this, the composite gadget framework will set the
bcdUSB to 0x0201 to indicate that this supports BOS descriptors, and
also return a USB 2.0 Extension descriptor as part of the BOS descriptor
set.

See USB 2.0 LPM ECN Section 3.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Sevak Arakelyan <sevaka@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: Exclude SS Dev Cap Desc

Don't send the SuperSpeed USB Device Capability descriptor if
the gadget is not capable of SuperSpeed.

Signed-off-by: John Youn <

usb: gadget: composite: Exclude SS Dev Cap Desc

Don't send the SuperSpeed USB Device Capability descriptor if
the gadget is not capable of SuperSpeed.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Sevak Arakelyan <sevaka@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: Fix function used to free memory

'cdev->os_desc_req' has been allocated with 'usb_ep_alloc_request()' so
'usb_ep_free_request()' should be used to free it.

usb: gadget: composite: Fix function used to free memory

'cdev->os_desc_req' has been allocated with 'usb_ep_alloc_request()' so
'usb_ep_free_request()' should be used to free it.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: Test get_alt() presence instead of set_alt()

By convention (according to doc) if function does not provide
get_alt() callback composite framework should assume th

usb: gadget: composite: Test get_alt() presence instead of set_alt()

By convention (according to doc) if function does not provide
get_alt() callback composite framework should assume that it has only
altsetting 0 and should respond with error if host tries to set
other one.

After commit dd4dff8b035f ("USB: composite: Fix bug: should test
set_alt function pointer before use it")
we started checking set_alt() callback instead of get_alt().
This check is useless as we check if set_alt() is set inside
usb_add_function() and fail if it's NULL.

Let's fix this check and move comment about why we check the get
method instead of set a little bit closer to prevent future false
fixes.

Fixes: dd4dff8b035f ("USB: composite: Fix bug: should test set_alt function pointer before use it")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: use kasprintf() instead of open coding it

Let's not reimplement generic kernel helpers,
instead call kasprintf().

[ felipe.balbi@linux.intel.com: better

usb: gadget: composite: use kasprintf() instead of open coding it

Let's not reimplement generic kernel helpers,
instead call kasprintf().

[ felipe.balbi@linux.intel.com: better commit log ]

Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: remove unnecessary & operation

Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this drive

usb: gadget: composite: remove unnecessary & operation

Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: always set ep->mult to a sensible value

ep->mult is supposed to be set to Isochronous and
Interrupt Endapoint's multiplier value. This value
is computed from

usb: gadget: composite: always set ep->mult to a sensible value

ep->mult is supposed to be set to Isochronous and
Interrupt Endapoint's multiplier value. This value
is computed from different places depending on the
link speed.

If we're dealing with HighSpeed, then it's part of
bits [12:11] of wMaxPacketSize. This case wasn't
taken into consideration before.

While at that, also make sure the ep->mult defaults
to one so drivers can use it unconditionally and
assume they'll never multiply ep->maxpacket to zero.

Cc: <stable@vger.kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: correctly initialize ep->maxpacket

usb_endpoint_maxp() returns wMaxPacketSize in its
raw form. Without taking into consideration that it
also contains other b

usb: gadget: composite: correctly initialize ep->maxpacket

usb_endpoint_maxp() returns wMaxPacketSize in its
raw form. Without taking into consideration that it
also contains other bits reserved for isochronous
endpoints.

This patch fixes one occasion where this is a
problem by making sure that we initialize
ep->maxpacket only with lower 10 bits of the value
returned by usb_endpoint_maxp(). Note that seperate
patches will be necessary to audit all call sites of
usb_endpoint_maxp() and make sure that
usb_endpoint_maxp() only returns lower 10 bits of
wMaxPacketSize.

Cc: <stable@vger.kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: let USB functions process ctrl reqs in cfg0

It can sometimes be necessary for gadget drivers to process non-standard
control requests, which host devices can send

usb: gadget: composite: let USB functions process ctrl reqs in cfg0

It can sometimes be necessary for gadget drivers to process non-standard
control requests, which host devices can send without having sent
USB_REQ_SET_CONFIGURATION.

Therefore, the req_match() usb_function method is enhanced with the new
parameter "config0". When a USB configuration is active, this parameter
is false. When a non-core control request is processed in
composite_setup(), without an active configuration, req_match() of the
USB functions of all available configurations which implement this
function, is called with config0=true. Then the control request gets
processed by the first usb_function instance whose req_match() returns
true.

Signed-off-by: Felix Hädicke <felixhaedicke@web.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: Fix return value in case of error

In 'composite_os_desc_req_prepare', if one of the memory allocations fail,
0 will be returned, which means success.
We shoul

usb: gadget: composite: Fix return value in case of error

In 'composite_os_desc_req_prepare', if one of the memory allocations fail,
0 will be returned, which means success.
We should return -ENOMEM instead.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: fix dereference after null check coverify warning

cdev->config is checked for null pointer at above code, so cdev->config
might be null, fix it by adding null poi

usb: gadget: composite: fix dereference after null check coverify warning

cdev->config is checked for null pointer at above code, so cdev->config
might be null, fix it by adding null pointer check.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...

usb: gadget: composite: don't queue OS desc req if length is invalid

In OS descriptors handling, if ctrl->bRequestType is
USB_RECIP_DEVICE and w_index != 0x4 or (w_value >> 8)
is tru

usb: gadget: composite: don't queue OS desc req if length is invalid

In OS descriptors handling, if ctrl->bRequestType is
USB_RECIP_DEVICE and w_index != 0x4 or (w_value >> 8)
is true, it will not assign a valid value to req->length,
but use the default value(-EOPNOTSUPP), and queue an
OS desc request with the invalid req->length. It always
happens on the platforms which use os_desc (for example:
rk3366, rk3399), and cause kernel panic as follows
(use dwc3 driver):

Unable to handle kernel paging request at virtual address ffffffc0f7e00000
Internal error: Oops: 96000146 [#1] PREEMPT SMP
PC is at __dma_clean_range+0x18/0x30
LR is at __swiotlb_map_page+0x50/0x64
Call trace:
[<ffffffc0000930f8>] __dma_clean_range+0x18/0x30
[<ffffffc00062214c>] usb_gadget_map_request+0x134/0x1b0
[<ffffffc0005c289c>] __dwc3_ep0_do_control_data+0x110/0x14c
[<ffffffc0005c2d38>] __dwc3_gadget_ep0_queue+0x198/0x1b8
[<ffffffc0005c2e18>] dwc3_gadget_ep0_queue+0xc0/0xe8
[<ffffffc00061cfec>] composite_ep0_queue.constprop.14+0x34/0x98
[<ffffffc00061dfb0>] composite_setup+0xf60/0x100c
[<ffffffc0006204dc>] android_setup+0xd8/0x138
[<ffffffc0005c29a4>] dwc3_ep0_delegate_req+0x34/0x50
[<ffffffc0005c3534>] dwc3_ep0_interrupt+0x5dc/0xb58
[<ffffffc0005c0c3c>] dwc3_thread_interrupt+0x15c/0xa24

With this patch, the gadget driver will not queue
a request and return immediately if req->length is
invalid. And the usb controller driver can handle
the unsupport request correctly.

Signed-off-by: William Wu <william.wu@rock-chips.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

show more ...