[PATCH 0/4] xhci features for usb-next

[PATCH 0/4] xhci features for usb-next

[Mathias Nyman]

Hi Greg

Minor xhci tuneups for usb-next.
The memory leak fix might look like it belongs to usb-linus and stable,
but is really about a leak possibility on a very unlikely error path.
Nice to have it fixed, but not sure it's stable material.

-Mathias

Christophe JAILLET (2):
  usb: xhci: dbc: Simplify error handling in 'xhci_dbc_alloc_requests()'
  usb: xhci: dbc: Use GFP_KERNEL instead of GFP_ATOMIC in
    'xhci_dbc_alloc_requests()'

Ikjoon Jang (1):
  xhci: fix possible memleak on setup address fails.

Mathias Nyman (1):
  xhci: add TSP bitflag to TRB tracing

 drivers/usb/host/xhci-dbgtty.c | 4 ++--
 drivers/usb/host/xhci.c        | 3 ++-
 drivers/usb/host/xhci.h        | 3 ++-
 3 files changed, 6 insertions(+), 4 deletions(-)

-- 
2.7.4

[PATCH 1/4] usb: xhci: dbc: Simplify error handling in 'xhci_dbc_alloc_requests()'

[Mathias Nyman]

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

If the 'kmalloc()' fails, we need to undo the previous
'dbc_alloc_request()' call.

Because of the more similar function name, it is more logical to use
'dbc_free_request()' instead of 'xhci_dbc_free_req()'.

Both are equivalent here because:
 static void xhci_dbc_free_req(struct dbc_ep *dep, struct dbc_request *req)
 {
 	kfree(req->buf);
 	dbc_free_request(dep, req);
 }
and 'req->buf' is known to be NULL at this point

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci-dbgtty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index aff79ff5aba4..845939f8a0b8 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -146,7 +146,7 @@ xhci_dbc_alloc_requests(struct dbc_ep *dep, struct list_head *head,
 		req->length = DBC_MAX_PACKET;
 		req->buf = kmalloc(req->length, GFP_KERNEL);
 		if (!req->buf) {
-			xhci_dbc_free_req(dep, req);
+			dbc_free_request(dep, req);
 			break;
 		}
 
-- 
2.7.4

[PATCH 2/4] usb: xhci: dbc: Use GFP_KERNEL instead of GFP_ATOMIC in 'xhci_dbc_alloc_requests()'

[Mathias Nyman]

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

There is no need to use GFP_ATOMIC to allocate 'req'. GFP_KERNEL should be
enough and is already used for another allocation juste a few lines below.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci-dbgtty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index 845939f8a0b8..be726c791323 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -139,7 +139,7 @@ xhci_dbc_alloc_requests(struct dbc_ep *dep, struct list_head *head,
 	struct dbc_request	*req;
 
 	for (i = 0; i < DBC_QUEUE_SIZE; i++) {
-		req = dbc_alloc_request(dep, GFP_ATOMIC);
+		req = dbc_alloc_request(dep, GFP_KERNEL);
 		if (!req)
 			break;
 
-- 
2.7.4

[PATCH 3/4] xhci: add TSP bitflag to TRB tracing

[Mathias Nyman]

Software can set a Transfer State Preserve (TSP) flag to maintain
data toggle and sequence number when issuing a reset endpoint
command.

xhci driver is using TSP for soft retry, we want to show TSP usage
in tracing as well

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index f5c41448d067..f9f88626a57a 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -2337,12 +2337,13 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
 		break;
 	case TRB_RESET_EP:
 		sprintf(str,
-			"%s: ctx %08x%08x slot %d ep %d flags %c",
+			"%s: ctx %08x%08x slot %d ep %d flags %c:%c",
 			xhci_trb_type_string(type),
 			field1, field0,
 			TRB_TO_SLOT_ID(field3),
 			/* Macro decrements 1, maybe it shouldn't?!? */
 			TRB_TO_EP_INDEX(field3) + 1,
+			field3 & TRB_TSP ? 'T' : 't',
 			field3 & TRB_CYCLE ? 'C' : 'c');
 		break;
 	case TRB_STOP_RING:
-- 
2.7.4

[PATCH 4/4] xhci: fix possible memleak on setup address fails.

[Mathias Nyman]

From: Ikjoon Jang <ikjn@chromium.org>

Xhci re-enables a slot on transaction error in set_address using
xhci_disable_slot() + xhci_alloc_dev().

But in this case, xhci_alloc_dev() creates debugfs entries upon an
existing device without cleaning up old entries, thus memory leaks.

So this patch simply moves calling xhci_debugfs_free_dev() from
xhci_free_dev() to xhci_disable_slot().

[added "possible" to header as this is about failure codepath -Mathias]
Signed-off-by: Ikjoon Jang <ikjn@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index e315c0158e90..500865975687 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3814,7 +3814,6 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
 		virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING;
 		del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
 	}
-	xhci_debugfs_remove_slot(xhci, udev->slot_id);
 	virt_dev->udev = NULL;
 	ret = xhci_disable_slot(xhci, udev->slot_id);
 	if (ret)
@@ -3832,6 +3831,8 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
 	if (!command)
 		return -ENOMEM;
 
+	xhci_debugfs_remove_slot(xhci, slot_id);
+
 	spin_lock_irqsave(&xhci->lock, flags);
 	/* Don't disable the slot if the host controller is dead. */
 	state = readl(&xhci->op_regs->status);
-- 
2.7.4

Re: [PATCH 0/4] xhci features for usb-next

[Greg KH]

On Thu, Jun 17, 2021 at 06:03:50PM +0300, Mathias Nyman wrote:
> Hi Greg
> 
> A few small patches for usb-next.
> 
> There's one double free fix here as well that I normally would send to
> usb-linus, but we're late in the cycle and this issue should be rare.
> It has been there since 5.6 and requires system to be out of memory, so
> I thought it can be added this way.

Yes, that's fine, all now applied, thanks.

greg k-h

[PATCH 0/4] xhci features for usb-next

[Mathias Nyman]

Hi Greg

A few small patches for usb-next.

There's one double free fix here as well that I normally would send to
usb-linus, but we're late in the cycle and this issue should be rare.
It has been there since 5.6 and requires system to be out of memory, so
I thought it can be added this way.

Thanks
-Mathias

Mathias Nyman (3):
  xhci: Remove unused defines for ERST_SIZE and ERST_ENTRIES
  xhci: Add adaptive interrupt rate for isoch TRBs with XHCI_AVOID_BEI
    quirk
  xhci: handle failed buffer copy to URB sg list and fix a W=1 copiler
    warning

Zhangjiantao (Kirin, nanjing) (1):
  xhci: solve a double free problem while doing s4

 drivers/usb/host/xhci-mem.c  |  3 +++
 drivers/usb/host/xhci-ring.c |  7 ++++++-
 drivers/usb/host/xhci.c      |  9 +++++++--
 drivers/usb/host/xhci.h      | 11 +++++++----
 4 files changed, 23 insertions(+), 7 deletions(-)

-- 
2.25.1

[PATCH 0/4] xhci features for usb-next

[Mathias Nyman]

Hi Greg

I saw you already picked the Mediatek xhci patches.

Here are a few additional patches I had pending for usb-next
but didn't get around to submit before easter.

Mostly fixing potential issues found by fuzzer and other tools.

Thanks
-Mathias

Mathias Nyman (4):
  xhci: check port array allocation was successful before dereferencing
    it
  xhci: check control context is valid before dereferencing it.
  xhci: fix potential array out of bounds with several interrupters
  xhci: prevent double-fetch of transfer and transfer event TRBs

 drivers/usb/host/xhci-mem.c  |  3 +++
 drivers/usb/host/xhci-ring.c | 42 ++++++++++++++++--------------------
 drivers/usb/host/xhci.c      | 14 +++++++++++-
 3 files changed, 35 insertions(+), 24 deletions(-)

-- 
2.25.1

[PATCH 0/4] xhci features for usb-next

[Mathias Nyman]

Hi Greg

A few xhci features for usb-next, hope they are not too late for 5.5 kernel.
These features mainly prepare driver for handling a flood of xhci events,
but also enables runtime PM as default for a Ice Lake xHCI, and adds a bit
of tracing.

-Mathias

Mathias Nyman (1):
  xhci: Add tracing for xhci doorbell register writes

Mika Westerberg (1):
  xhci-pci: Allow host runtime PM as default also for Intel Ice Lake
    xHCI

Peter Chen (1):
  usb: host: xhci: update event ring dequeue pointer on purpose

Suwan Kim (1):
  usb: host: xhci: Support running urb giveback in tasklet context

 drivers/usb/host/xhci-pci.c   |  4 ++-
 drivers/usb/host/xhci-ring.c  | 68 +++++++++++++++++++++++++++++++------------
 drivers/usb/host/xhci-trace.h | 26 +++++++++++++++++
 drivers/usb/host/xhci.c       |  3 +-
 drivers/usb/host/xhci.h       | 29 ++++++++++++++++++
 5 files changed, 109 insertions(+), 21 deletions(-)

-- 
2.7.4

[PATCH 0/4] xhci features for usb-next

[Mathias Nyman]

Hi Greg

A few features for usb next, mostly tracing and debugging features, but
also support for Immediate Data Transfer for small (up to 8 bytes)
data transfers

-Mathias

Mathias Nyman (3):
  xhci: add port and bus number to port dynamic debugging
  xhci: Add tracing for input control context
  usb: xhci: add endpoint context tracing when an endpoint is added

Nicolas Saenz Julienne (1):
  usb: xhci: add Immediate Data Transfer support

 drivers/usb/host/xhci-hub.c   | 44 +++++++++++++++++++++++++----------------
 drivers/usb/host/xhci-ring.c  | 24 ++++++++++++++++++----
 drivers/usb/host/xhci-trace.h | 30 ++++++++++++++++++++++++++++
 drivers/usb/host/xhci.c       | 40 +++++++++++++++++++++++++++++++++----
 drivers/usb/host/xhci.h       | 46 +++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 159 insertions(+), 25 deletions(-)

-- 
2.7.4