linux-toradex.git/drivers/usb/gadget/composite.c, branch v4.10

usb: gadget: composite: Fix function used to free memory

2017-01-12T07:58:05+00:00

'cdev->os_desc_req' has been allocated with 'usb_ep_alloc_request()' so
'usb_ep_free_request()' should be used to free it.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Felipe Balbi

usb: gadget: composite: Test get_alt() presence instead of set_alt()

2017-01-02T08:55:28+00:00

By convention (according to doc) if function does not provide
get_alt() callback composite framework should assume that it has only
altsetting 0 and should respond with error if host tries to set
other one.

After commit dd4dff8b035f ("USB: composite: Fix bug: should test
set_alt function pointer before use it")
we started checking set_alt() callback instead of get_alt().
This check is useless as we check if set_alt() is set inside
usb_add_function() and fail if it's NULL.

Let's fix this check and move comment about why we check the get
method instead of set a little bit closer to prevent future false
fixes.

Fixes: dd4dff8b035f ("USB: composite: Fix bug: should test set_alt function pointer before use it")
Cc: stable 
Signed-off-by: Krzysztof Opasiak 
Signed-off-by: Felipe Balbi

usb: gadget: composite: use kasprintf() instead of open coding it

2016-11-03T08:38:36+00:00

Let's not reimplement generic kernel helpers,
instead call kasprintf().

[ felipe.balbi@linux.intel.com: better commit log ]

Signed-off-by: Juergen Gross 
Signed-off-by: Felipe Balbi

usb: gadget: composite: remove unnecessary & operation

2016-11-03T08:38:24+00:00

Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we can remove the &
operation from this driver.

Signed-off-by: Felipe Balbi

usb: gadget: composite: always set ep->mult to a sensible value

2016-10-31T09:15:33+00:00

ep->mult is supposed to be set to Isochronous and
Interrupt Endapoint's multiplier value. This value
is computed from different places depending on the
link speed.

If we're dealing with HighSpeed, then it's part of
bits [12:11] of wMaxPacketSize. This case wasn't
taken into consideration before.

While at that, also make sure the ep->mult defaults
to one so drivers can use it unconditionally and
assume they'll never multiply ep->maxpacket to zero.

Cc: 
Signed-off-by: Felipe Balbi

usb: gadget: composite: correctly initialize ep->maxpacket

2016-10-31T09:15:33+00:00

usb_endpoint_maxp() returns wMaxPacketSize in its
raw form. Without taking into consideration that it
also contains other bits reserved for isochronous
endpoints.

This patch fixes one occasion where this is a
problem by making sure that we initialize
ep->maxpacket only with lower 10 bits of the value
returned by usb_endpoint_maxp(). Note that seperate
patches will be necessary to audit all call sites of
usb_endpoint_maxp() and make sure that
usb_endpoint_maxp() only returns lower 10 bits of
wMaxPacketSize.

Cc: 
Signed-off-by: Felipe Balbi

usb: gadget: composite: let USB functions process ctrl reqs in cfg0

2016-08-25T09:13:17+00:00

It can sometimes be necessary for gadget drivers to process non-standard
control requests, which host devices can send without having sent
USB_REQ_SET_CONFIGURATION.

Therefore, the req_match() usb_function method is enhanced with the new
parameter "config0". When a USB configuration is active, this parameter
is false. When a non-core control request is processed in
composite_setup(), without an active configuration, req_match() of the
USB functions of all available configurations which implement this
function, is called with config0=true. Then the control request gets
processed by the first usb_function instance whose req_match() returns
true.

Signed-off-by: Felix Hädicke 
Signed-off-by: Felipe Balbi

usb: gadget: composite: Fix return value in case of error

2016-08-11T12:09:46+00:00

In 'composite_os_desc_req_prepare', if one of the memory allocations fail,
0 will be returned, which means success.
We should return -ENOMEM instead.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Felipe Balbi

usb: gadget: composite: fix dereference after null check coverify warning

2016-08-11T12:09:44+00:00

cdev->config is checked for null pointer at above code, so cdev->config
might be null, fix it by adding null pointer check.

Signed-off-by: Peter Chen 
Signed-off-by: Felipe Balbi

usb: gadget: composite: don't queue OS desc req if length is invalid

2016-05-31T08:24:31+00:00

In OS descriptors handling, if ctrl->bRequestType is
USB_RECIP_DEVICE and w_index != 0x4 or (w_value >> 8)
is true, it will not assign a valid value to req->length,
but use the default value(-EOPNOTSUPP), and queue an
OS desc request with the invalid req->length. It always
happens on the platforms which use os_desc (for example:
rk3366, rk3399), and cause kernel panic as follows
(use dwc3 driver):

Unable to handle kernel paging request at virtual address ffffffc0f7e00000
Internal error: Oops: 96000146 [#1] PREEMPT SMP
PC is at __dma_clean_range+0x18/0x30
LR is at __swiotlb_map_page+0x50/0x64
Call trace:
[] __dma_clean_range+0x18/0x30
[] usb_gadget_map_request+0x134/0x1b0
[] __dwc3_ep0_do_control_data+0x110/0x14c
[] __dwc3_gadget_ep0_queue+0x198/0x1b8
[] dwc3_gadget_ep0_queue+0xc0/0xe8
[] composite_ep0_queue.constprop.14+0x34/0x98
[] composite_setup+0xf60/0x100c
[] android_setup+0xd8/0x138
[] dwc3_ep0_delegate_req+0x34/0x50
[] dwc3_ep0_interrupt+0x5dc/0xb58
[] dwc3_thread_interrupt+0x15c/0xa24

With this patch, the gadget driver will not queue
a request and return immediately if req->length is
invalid. And the usb controller driver can handle
the unsupport request correctly.

Signed-off-by: William Wu 
Signed-off-by: Felipe Balbi