Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some small USB fixes for 4.20-rc6
The "largest" here are some xhci fixes for reported issues. Also here
is a USB core fix, some quirk additions, and a usb-serial fix which
required the export of one of the tty layer's functions to prevent
code duplication. The tty maintainer agreed with this change.
All of these have been in linux-next with no reported issues"
* tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
xhci: Prevent U1/U2 link pm states if exit latency is too long
xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
USB: check usb_get_extra_descriptor for proper size
USB: serial: console: fix reported terminal settings
usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
USB: Fix invalid-free bug in port_over_current_notify()
usb: appledisplay: Add 27" Apple Cinema Display
+70
-15
+9
-2
drivers/tty/tty_io.c
+9
-2
drivers/tty/tty_io.c
···
1373
1373
return ERR_PTR(retval);
1374
1374
}
1375
1375
1376
-
static void tty_free_termios(struct tty_struct *tty)
1376
+
/**
1377
+
* tty_save_termios() - save tty termios data in driver table
1378
+
* @tty: tty whose termios data to save
1379
+
*
1380
+
* Locking: Caller guarantees serialisation with tty_init_termios().
1381
+
*/
1382
+
void tty_save_termios(struct tty_struct *tty)
1377
1383
{
1378
1384
struct ktermios *tp;
1379
1385
int idx = tty->index;
···
1398
1392
}
1399
1393
*tp = tty->termios;
1400
1394
}
1395
+
EXPORT_SYMBOL_GPL(tty_save_termios);
1401
1396
1402
1397
/**
1403
1398
* tty_flush_works - flush all works of a tty/pty pair
···
1498
1491
WARN_ON(!mutex_is_locked(&tty_mutex));
1499
1492
if (tty->ops->shutdown)
1500
1493
tty->ops->shutdown(tty);
1501
-
tty_free_termios(tty);
1494
+
tty_save_termios(tty);
1502
1495
tty_driver_remove_tty(tty->driver, tty);
1503
1496
tty->port->itty = NULL;
1504
1497
if (tty->link)
+3
-2
drivers/usb/core/hub.c
+3
-2
drivers/usb/core/hub.c
···
2251
2251
/* descriptor may appear anywhere in config */
2252
2252
err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
2253
2253
le16_to_cpu(udev->config[0].desc.wTotalLength),
2254
-
USB_DT_OTG, (void **) &desc);
2254
+
USB_DT_OTG, (void **) &desc, sizeof(*desc));
2255
2255
if (err || !(desc->bmAttributes & USB_OTG_HNP))
2256
2256
return 0;
2257
2257
···
5163
5163
/* Handle notifying userspace about hub over-current events */
5164
5164
static void port_over_current_notify(struct usb_port *port_dev)
5165
5165
{
5166
-
static char *envp[] = { NULL, NULL, NULL };
5166
+
char *envp[3];
5167
5167
struct device *hub_dev;
5168
5168
char *port_dev_path;
5169
5169
···
5187
5187
if (!envp[1])
5188
5188
goto exit;
5189
5189
5190
+
envp[2] = NULL;
5190
5191
kobject_uevent_env(&hub_dev->kobj, KOBJ_CHANGE, envp);
5191
5192
5192
5193
kfree(envp[1]);
+4
drivers/usb/core/quirks.c
+4
drivers/usb/core/quirks.c
···
333
333
/* Midiman M-Audio Keystation 88es */
334
334
{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
335
335
336
+
/* SanDisk Ultra Fit and Ultra Flair */
337
+
{ USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
338
+
{ USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
339
+
336
340
/* M-Systems Flash Disk Pioneers */
337
341
{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
338
342
+3
-3
drivers/usb/core/usb.c
+3
-3
drivers/usb/core/usb.c
···
832
832
*/
833
833
834
834
int __usb_get_extra_descriptor(char *buffer, unsigned size,
835
-
unsigned char type, void **ptr)
835
+
unsigned char type, void **ptr, size_t minsize)
836
836
{
837
837
struct usb_descriptor_header *header;
838
838
839
839
while (size >= sizeof(struct usb_descriptor_header)) {
840
840
header = (struct usb_descriptor_header *)buffer;
841
841
842
-
if (header->bLength < 2) {
842
+
if (header->bLength < 2 || header->bLength > size) {
843
843
printk(KERN_ERR
844
844
"%s: bogus descriptor, type %d length %d\n",
845
845
usbcore_name,
···
848
848
return -1;
849
849
}
850
850
851
-
if (header->bDescriptorType == type) {
851
+
if (header->bDescriptorType == type && header->bLength >= minsize) {
852
852
*ptr = header;
853
853
return 0;
854
854
}
+1
-1
drivers/usb/host/hwa-hc.c
+1
-1
drivers/usb/host/hwa-hc.c
···
640
640
top = itr + itr_size;
641
641
result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
642
642
le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
643
-
USB_DT_SECURITY, (void **) &secd);
643
+
USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
644
644
if (result == -1) {
645
645
dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
646
646
return 0;
+4
drivers/usb/host/xhci-pci.c
+4
drivers/usb/host/xhci-pci.c
···
139
139
pdev->device == 0x43bb))
140
140
xhci->quirks |= XHCI_SUSPEND_DELAY;
141
141
142
+
if (pdev->vendor == PCI_VENDOR_ID_AMD &&
143
+
(pdev->device == 0x15e0 || pdev->device == 0x15e1))
144
+
xhci->quirks |= XHCI_SNPS_BROKEN_SUSPEND;
145
+
142
146
if (pdev->vendor == PCI_VENDOR_ID_AMD)
143
147
xhci->quirks |= XHCI_TRUST_TX_LENGTH;
144
148
+38
-4
drivers/usb/host/xhci.c
+38
-4
drivers/usb/host/xhci.c
···
968
968
unsigned int delay = XHCI_MAX_HALT_USEC;
969
969
struct usb_hcd *hcd = xhci_to_hcd(xhci);
970
970
u32 command;
971
+
u32 res;
971
972
972
973
if (!hcd->state)
973
974
return 0;
···
1022
1021
command = readl(&xhci->op_regs->command);
1023
1022
command |= CMD_CSS;
1024
1023
writel(command, &xhci->op_regs->command);
1024
+
xhci->broken_suspend = 0;
1025
1025
if (xhci_handshake(&xhci->op_regs->status,
1026
1026
STS_SAVE, 0, 10 * 1000)) {
1027
-
xhci_warn(xhci, "WARN: xHC save state timeout\n");
1028
-
spin_unlock_irq(&xhci->lock);
1029
-
return -ETIMEDOUT;
1027
+
/*
1028
+
* AMD SNPS xHC 3.0 occasionally does not clear the
1029
+
* SSS bit of USBSTS and when driver tries to poll
1030
+
* to see if the xHC clears BIT(8) which never happens
1031
+
* and driver assumes that controller is not responding
1032
+
* and times out. To workaround this, its good to check
1033
+
* if SRE and HCE bits are not set (as per xhci
1034
+
* Section 5.4.2) and bypass the timeout.
1035
+
*/
1036
+
res = readl(&xhci->op_regs->status);
1037
+
if ((xhci->quirks & XHCI_SNPS_BROKEN_SUSPEND) &&
1038
+
(((res & STS_SRE) == 0) &&
1039
+
((res & STS_HCE) == 0))) {
1040
+
xhci->broken_suspend = 1;
1041
+
} else {
1042
+
xhci_warn(xhci, "WARN: xHC save state timeout\n");
1043
+
spin_unlock_irq(&xhci->lock);
1044
+
return -ETIMEDOUT;
1045
+
}
1030
1046
}
1031
1047
spin_unlock_irq(&xhci->lock);
1032
1048
···
1096
1078
set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
1097
1079
1098
1080
spin_lock_irq(&xhci->lock);
1099
-
if (xhci->quirks & XHCI_RESET_ON_RESUME)
1081
+
if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend)
1100
1082
hibernated = true;
1101
1083
1102
1084
if (!hibernated) {
···
4514
4496
{
4515
4497
unsigned long long timeout_ns;
4516
4498
4499
+
/* Prevent U1 if service interval is shorter than U1 exit latency */
4500
+
if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
4501
+
if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
4502
+
dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
4503
+
return USB3_LPM_DISABLED;
4504
+
}
4505
+
}
4506
+
4517
4507
if (xhci->quirks & XHCI_INTEL_HOST)
4518
4508
timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
4519
4509
else
···
4577
4551
struct usb_endpoint_descriptor *desc)
4578
4552
{
4579
4553
unsigned long long timeout_ns;
4554
+
4555
+
/* Prevent U2 if service interval is shorter than U2 exit latency */
4556
+
if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
4557
+
if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
4558
+
dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
4559
+
return USB3_LPM_DISABLED;
4560
+
}
4561
+
}
4580
4562
4581
4563
if (xhci->quirks & XHCI_INTEL_HOST)
4582
4564
timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+3
drivers/usb/host/xhci.h
+3
drivers/usb/host/xhci.h
···
1850
1850
#define XHCI_ZERO_64B_REGS BIT_ULL(32)
1851
1851
#define XHCI_DEFAULT_PM_RUNTIME_ALLOW BIT_ULL(33)
1852
1852
#define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34)
1853
+
#define XHCI_SNPS_BROKEN_SUSPEND BIT_ULL(35)
1853
1854
1854
1855
unsigned int num_active_eps;
1855
1856
unsigned int limit_active_eps;
···
1880
1879
void *dbc;
1881
1880
/* platform-specific data -- must come last */
1882
1881
unsigned long priv[0] __aligned(sizeof(s64));
1882
+
/* Broken Suspend flag for SNPS Suspend resume issue */
1883
+
u8 broken_suspend;
1883
1884
};
1884
1885
1885
1886
/* Platform specific overrides to generic XHCI hc_driver ops */
+1
drivers/usb/misc/appledisplay.c
+1
drivers/usb/misc/appledisplay.c
+1
-1
drivers/usb/serial/console.c
+1
-1
drivers/usb/serial/console.c
···
101
101
cflag |= PARENB;
102
102
break;
103
103
}
104
-
co->cflag = cflag;
105
104
106
105
/*
107
106
* no need to check the index here: if the index is wrong, console
···
163
164
serial->type->set_termios(tty, port, &dummy);
164
165
165
166
tty_port_tty_set(&port->port, NULL);
167
+
tty_save_termios(tty);
166
168
tty_kref_put(tty);
167
169
}
168
170
tty_port_set_initialized(&port->port, 1);
+1
include/linux/tty.h
+1
include/linux/tty.h
···
556
556
extern void tty_release_struct(struct tty_struct *tty, int idx);
557
557
extern int tty_release(struct inode *inode, struct file *filp);
558
558
extern void tty_init_termios(struct tty_struct *tty);
559
+
extern void tty_save_termios(struct tty_struct *tty);
559
560
extern int tty_standard_install(struct tty_driver *driver,
560
561
struct tty_struct *tty);
561
562
+2
-2
include/linux/usb.h
+2
-2
include/linux/usb.h
···
407
407
};
408
408
409
409
int __usb_get_extra_descriptor(char *buffer, unsigned size,
410
-
unsigned char type, void **ptr);
410
+
unsigned char type, void **ptr, size_t min);
411
411
#define usb_get_extra_descriptor(ifpoint, type, ptr) \
412
412
__usb_get_extra_descriptor((ifpoint)->extra, \
413
413
(ifpoint)->extralen, \
414
-
type, (void **)ptr)
414
+
type, (void **)ptr, sizeof(**(ptr)))
415
415
416
416
/* ----------------------------------------------------------------------- */
417
417