1. 15 Aug, 2019 1 commit
  2. 29 Apr, 2019 2 commits
    • Johan Hovold's avatar
      USB: cdc-acm: clean up throttle handling · 0f02321e
      Johan Hovold authored
      
      
      Clean up the throttle implementation by dropping the redundant
      throttle_req flag which was a remnant from back when USB serial had only
      a single read URB, something which was later carried over to cdc-acm.
      
      Also convert the throttled flag to an atomic bit flag.
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0f02321e
    • Johan Hovold's avatar
      USB: cdc-acm: fix unthrottle races · 764478f4
      Johan Hovold authored
      Fix two long-standing bugs which could potentially lead to memory
      corruption or leave the port throttled until it is reopened (on weakly
      ordered systems), respectively, when read-URB completion races with
      unthrottle().
      
      First, the URB must not be marked as free before processing is complete
      to prevent it from being submitted by unthrottle() on another CPU.
      
      	CPU 1				CPU 2
      	================		================
      	complete()			unthrottle()
      	  process_urb();
      	  smp_mb__before_atomic();
      	  set_bit(i, free);		  if (test_and_clear_bit(i, free))
      						  submit_urb();
      
      Second, the URB must be marked as free before checking the throttled
      flag to prevent unthrottle() on another CPU from failing to observe that
      the URB needs to be submitted if complete() sees that the throttled flag
      is set.
      
      	CPU 1				CPU 2
      	================		================
      	complete()			unthrottle()
      	  set_bit(i, free);		  throttled = 0;
      	  smp_mb__after_atomic();	  smp_mb();
      	  if (throttled)		  if (test_and_clear_bit(i, free))
      		  return;			  submit_urb();
      
      Note that test_and_clear_bit() only implies barriers when the test is
      successful. To handle the case where the URB is still in use an explicit
      barrier needs to be added to unthrottle() for the second race condition.
      
      Also note that the first race was fixed by 36e59e0d ("cdc-acm: fix
      race between callback and unthrottle") back in 2015, but the bug was
      reintroduced a year later.
      
      Fixes: 1aba579f ("cdc-acm: handle read pipe errors")
      Fixes: 088c64f8
      
       ("USB: cdc-acm: re-write read processing")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      764478f4
  3. 27 Mar, 2019 1 commit
    • Romain Izard's avatar
      usb: cdc-acm: fix race during wakeup blocking TX traffic · 93e1c8a6
      Romain Izard authored
      When the kernel is compiled with preemption enabled, the URB completion
      handler can run in parallel with the work responsible for waking up the
      tty layer. If the URB handler sets the EVENT_TTY_WAKEUP bit during the
      call to tty_port_tty_wakeup() to signal that there is room for additional
      input, it will be cleared at the end of this call. As a result, TX traffic
      on the upper layer will be blocked.
      
      This can be seen with a kernel configured with CONFIG_PREEMPT, and a fast
      modem connected with PPP running over a USB CDC-ACM port.
      
      Use test_and_clear_bit() instead, which ensures that each wakeup requested
      by the URB completion code will trigger a call to tty_port_tty_wakeup().
      
      Fixes: 1aba579f
      
       cdc-acm: handle read pipe errors
      Signed-off-by: default avatarRomain Izard <romain.izard.pro@gmail.com>
      Cc: stable <stable@vger.kernel.org>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      93e1c8a6
  4. 07 Jan, 2019 1 commit
  5. 20 Dec, 2018 1 commit
    • Macpaul Lin's avatar
      cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader. · eafb27fa
      Macpaul Lin authored
      Mediatek Preloader is a proprietary embedded boot loader for loading
      Little Kernel and Linux into device DRAM.
      
      This boot loader also handle firmware update. Mediatek Preloader will be
      enumerated as a virtual COM port when the device is connected to Windows
      or Linux OS via CDC-ACM class driver. When the USB enumeration has been
      done, Mediatek Preloader will send out handshake command "READY" to PC
      actively instead of waiting command from the download tool.
      
      Since Linux 4.12, the commit "tty: reset termios state on device
      registration" (93857edd
      
      ) causes Mediatek
      Preloader receiving some abnoraml command like "READYXX" as it sent.
      This will be recognized as an incorrect response. The behavior change
      also causes the download handshake fail. This change only affects
      subsequent connects if the reconnected device happens to get the same minor
      number.
      
      By disabling the ECHO termios flag could avoid this problem. However, it
      cannot be done by user space configuration when download tool open
      /dev/ttyACM0. This is because the device running Mediatek Preloader will
      send handshake command "READY" immediately once the CDC-ACM driver is
      ready.
      
      This patch wants to fix above problem by introducing "DISABLE_ECHO"
      property in driver_info. When Mediatek Preloader is connected, the
      CDC-ACM driver could disable ECHO flag in termios to avoid the problem.
      Signed-off-by: default avatarMacpaul Lin <macpaul.lin@mediatek.com>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarJohan Hovold <johan@kernel.org>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      eafb27fa
  6. 20 Nov, 2018 1 commit
  7. 13 Oct, 2018 1 commit
  8. 09 Oct, 2018 3 commits
  9. 02 Oct, 2018 1 commit
  10. 10 Sep, 2018 1 commit
    • Oliver Neukum's avatar
      Revert "cdc-acm: implement put_char() and flush_chars()" · df3aa13c
      Oliver Neukum authored
      This reverts commit a81cf979
      
      .
      
      The patch causes a regression, which I cannot find the reason for.
      So let's revert for now, as a revert hurts only performance.
      
      Original report:
      I was trying to resolve the problem with Oliver but we don't get any conclusion
      for 5 months, so I am now sending this to mail list and cdc_acm authors.
      
      I am using simple request-response protocol to obtain the boiller parameters
      in constant intervals.
      
      A simple one transaction is:
      1. opening the /dev/ttyACM0
      2. sending the following 10-bytes request to the device:
         unsigned char req[] = {0x02, 0xfe, 0x01, 0x05, 0x08, 0x02, 0x01, 0x69, 0xab, 0x03};
      3. reading response (frame of 74 bytes length).
      4. closing the descriptor
      I am doing this transaction with 5 seconds intervals.
      
      Before the bad commit everything was working correctly: I've got a requests and
      a responses in a timely manner.
      
      After the bad commit more time I am using the kernel module, more problems I have.
      The graph [2] is showing the problem.
      
      As you can see after module load all seems fine but after about 30 minutes I've got
      a plenty of EAGAINs when doing read()'s and trying to read back the data.
      
      When I rmmod and insmod the cdc_acm module again, then the situation is starting
      over again: running ok shortly after load, and more time it is running, more EAGAINs
      I have when calling read().
      
      As a bonus I can see the problem on the device itself:
      The device is configured as you can see here on this screen [3].
      It has two transmision LEDs: TX and RX. Blink duration is set for 100ms.
      This is a recording before the bad commit when all is working fine: [4]
      And this is with the bad commit: [5]
      As you can see the TX led is blinking wrongly long (indicating transmission?)
      and I have problems doing read() calls (EAGAIN).
      Reported-by: default avatarMariusz Bialonczyk <manio@skyboo.net>
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Fixes: a81cf979
      
       ("cdc-acm: implement put_char() and flush_chars()")
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      df3aa13c
  11. 16 Jul, 2018 1 commit
  12. 28 Jun, 2018 1 commit
  13. 25 Jun, 2018 2 commits
    • Jaejoong Kim's avatar
      usb: cdc-acm: Decrement tty port's refcount if probe() fail · cae2bc76
      Jaejoong Kim authored
      
      
      The cdc-acm driver does not have a refcount of itself, but uses a
      tty_port's refcount. That is, if the refcount of tty_port is '0', we
      can clean up the cdc-acm driver by calling the .destruct()
      callback function of struct tty_port_operations.
      
      The problem is the destruct() callback function is not called if
      the probe() fails, because tty_port's refcount is not zero. So,
      add tty_port_put() when probe() fails.
      Signed-off-by: default avatarJaejoong Kim <climbbb.kim@gmail.com>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cae2bc76
    • Houston Yaroschoff's avatar
      usb: cdc_acm: Add quirk for Uniden UBC125 scanner · 4a762569
      Houston Yaroschoff authored
      
      
      Uniden UBC125 radio scanner has USB interface which fails to work
      with cdc_acm driver:
        usb 1-1.5: new full-speed USB device number 4 using xhci_hcd
        cdc_acm 1-1.5:1.0: Zero length descriptor references
        cdc_acm: probe of 1-1.5:1.0 failed with error -22
      
      Adding the NO_UNION_NORMAL quirk for the device fixes the issue:
        usb 1-4: new full-speed USB device number 15 using xhci_hcd
        usb 1-4: New USB device found, idVendor=1965, idProduct=0018
        usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
        usb 1-4: Product: UBC125XLT
        usb 1-4: Manufacturer: Uniden Corp.
        usb 1-4: SerialNumber: 0001
        cdc_acm 1-4:1.0: ttyACM0: USB ACM device
      
      `lsusb -v` of the device:
      
        Bus 001 Device 015: ID 1965:0018 Uniden Corporation
        Device Descriptor:
          bLength                18
          bDescriptorType         1
          bcdUSB               2.00
          bDeviceClass            2 Communications
          bDeviceSubClass         0
          bDeviceProtocol         0
          bMaxPacketSize0        64
          idVendor           0x1965 Uniden Corporation
          idProduct          0x0018
          bcdDevice            0.01
          iManufacturer           1 Uniden Corp.
          iProduct                2 UBC125XLT
          iSerial                 3 0001
          bNumConfigurations      1
          Configuration Descriptor:
            bLength                 9
            bDescriptorType         2
            wTotalLength           48
            bNumInterfaces          2
            bConfigurationValue     1
            iConfiguration          0
            bmAttributes         0x80
              (Bus Powered)
            MaxPower              500mA
            Interface Descriptor:
              bLength                 9
              bDescriptorType         4
              bInterfaceNumber        0
              bAlternateSetting       0
              bNumEndpoints           1
              bInterfaceClass         2 Communications
              bInterfaceSubClass      2 Abstract (modem)
              bInterfaceProtocol      0 None
              iInterface              0
              Endpoint Descriptor:
                bLength                 7
                bDescriptorType         5
                bEndpointAddress     0x87  EP 7 IN
                bmAttributes            3
                  Transfer Type            Interrupt
                  Synch Type               None
                  Usage Type               Data
                wMaxPacketSize     0x0008  1x 8 bytes
                bInterval              10
            Interface Descriptor:
              bLength                 9
              bDescriptorType         4
              bInterfaceNumber        1
              bAlternateSetting       0
              bNumEndpoints           2
              bInterfaceClass        10 CDC Data
              bInterfaceSubClass      0 Unused
              bInterfaceProtocol      0
              iInterface              0
              Endpoint Descriptor:
                bLength                 7
                bDescriptorType         5
                bEndpointAddress     0x81  EP 1 IN
                bmAttributes            2
                  Transfer Type            Bulk
                  Synch Type               None
                  Usage Type               Data
                wMaxPacketSize     0x0040  1x 64 bytes
                bInterval               0
              Endpoint Descriptor:
                bLength                 7
                bDescriptorType         5
                bEndpointAddress     0x02  EP 2 OUT
                bmAttributes            2
                  Transfer Type            Bulk
                  Synch Type               None
                  Usage Type               Data
                wMaxPacketSize     0x0040  1x 64 bytes
                bInterval               0
        Device Status:     0x0000
          (Bus Powered)
      Signed-off-by: default avatarHouston Yaroschoff <hstn@4ever3.net>
      Cc: stable <stable@vger.kernel.org>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4a762569
  14. 16 Feb, 2018 1 commit
    • Dominik Bozek's avatar
      usb: cdc_acm: prevent race at write to acm while system resumes · b86b8eb6
      Dominik Bozek authored
      
      
      ACM driver may accept data to transmit while system is not fully
      resumed. In this case ACM driver buffers data and prepare URBs
      on usb anchor list.
      There is a little chance that two tasks put a char and initiate
      acm_tty_flush_chars(). In such a case, driver will put one URB
      twice on usb anchor list.
      This patch also reset length of data before resue of a buffer.
      This not only prevent sending rubbish, but also lower risc of race.
      
      Without this patch we hit following kernel panic in one of our
      stabilty/stress tests.
      
      [   46.884442] *list_add double add*: new=ffff9b2ab7289330, prev=ffff9b2ab7289330, next=ffff9b2ab81e28e0.
      [   46.884476] Modules linked in: hci_uart btbcm bluetooth rfkill_gpio igb_avb(O) cfg80211 snd_soc_sst_bxt_tdf8532 snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_soc_sst_acpi snd_soc_sst_match snd_hda_ext_core snd_hda_core trusty_timer trusty_wall trusty_log trusty_virtio trusty_ipc trusty_mem trusty_irq trusty virtio_ring virtio intel_ipu4_mmu_bxtB0 lib2600_mod_bxtB0 intel_ipu4_isys_mod_bxtB0 lib2600psys_mod_bxtB0 intel_ipu4_psys_mod_bxtB0 intel_ipu4_mod_bxtB0 intel_ipu4_wrapper_bxtB0 intel_ipu4_acpi videobuf2_dma_contig as3638 dw9714 lm3643 crlmodule smiapp smiapp_pll
      [   46.884480] CPU: 1 PID: 33 Comm: kworker/u8:1 Tainted: G     U  W  O    4.9.56-quilt-2e5dc0ac-g618ed69ced6e-dirty #4
      [   46.884489] Workqueue: events_unbound flush_to_ldisc
      [   46.884494]  ffffb98ac012bb08 ffffffffad3e82e5 ffffb98ac012bb58 0000000000000000
      [   46.884497]  ffffb98ac012bb48 ffffffffad0a23d1 00000024ad6374dd ffff9b2ab7289330
      [   46.884500]  ffff9b2ab81e28e0 ffff9b2ab7289330 0000000000000002 0000000000000000
      [   46.884501] Call Trace:
      [   46.884507]  [<ffffffffad3e82e5>] dump_stack+0x67/0x92
      [   46.884511]  [<ffffffffad0a23d1>] __warn+0xd1/0xf0
      [   46.884513]  [<ffffffffad0a244f>] warn_slowpath_fmt+0x5f/0x80
      [   46.884516]  [<ffffffffad407443>] __list_add+0xb3/0xc0
      [   46.884521]  [<ffffffffad71133c>] *usb_anchor_urb*+0x4c/0xa0
      [   46.884524]  [<ffffffffad782c6f>] *acm_tty_flush_chars*+0x8f/0xb0
      [   46.884527]  [<ffffffffad782cd1>] *acm_tty_put_char*+0x41/0x100
      [   46.884530]  [<ffffffffad4ced34>] tty_put_char+0x24/0x40
      [   46.884533]  [<ffffffffad4d3bf5>] do_output_char+0xa5/0x200
      [   46.884535]  [<ffffffffad4d3e98>] __process_echoes+0x148/0x290
      [   46.884538]  [<ffffffffad4d654c>] n_tty_receive_buf_common+0x57c/0xb00
      [   46.884541]  [<ffffffffad4d6ae4>] n_tty_receive_buf2+0x14/0x20
      [   46.884543]  [<ffffffffad4d9662>] tty_ldisc_receive_buf+0x22/0x50
      [   46.884545]  [<ffffffffad4d9c05>] flush_to_ldisc+0xc5/0xe0
      [   46.884549]  [<ffffffffad0bcfe8>] process_one_work+0x148/0x440
      [   46.884551]  [<ffffffffad0bdc19>] worker_thread+0x69/0x4a0
      [   46.884554]  [<ffffffffad0bdbb0>] ? max_active_store+0x80/0x80
      [   46.884556]  [<ffffffffad0c2e10>] kthread+0x110/0x130
      [   46.884559]  [<ffffffffad0c2d00>] ? kthread_park+0x60/0x60
      [   46.884563]  [<ffffffffadad9917>] ret_from_fork+0x27/0x40
      [   46.884566] ---[ end trace 3bd599058b8a9eb3 ]---
      Signed-off-by: default avatarDominik Bozek <dominikx.bozek@intel.com>
      Signed-off-by: default avatarKuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b86b8eb6
  15. 24 Jan, 2018 1 commit
  16. 22 Jan, 2018 1 commit
  17. 16 Jan, 2018 1 commit
    • Hans de Goede's avatar
      USB: cdc-acm: Do not log urb submission errors on disconnect · f0386c08
      Hans de Goede authored
      
      
      When disconnected sometimes the cdc-acm driver logs errors like these:
      
      [20278.039417] cdc_acm 2-2:2.1: urb 9 failed submission with -19
      [20278.042924] cdc_acm 2-2:2.1: urb 10 failed submission with -19
      [20278.046449] cdc_acm 2-2:2.1: urb 11 failed submission with -19
      [20278.049920] cdc_acm 2-2:2.1: urb 12 failed submission with -19
      [20278.053442] cdc_acm 2-2:2.1: urb 13 failed submission with -19
      [20278.056915] cdc_acm 2-2:2.1: urb 14 failed submission with -19
      [20278.060418] cdc_acm 2-2:2.1: urb 15 failed submission with -19
      
      Silence these by not logging errors when the result is -ENODEV.
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f0386c08
  18. 04 Nov, 2017 2 commits
  19. 17 Oct, 2017 1 commit
    • Maksim Salau's avatar
      usb: cdc_acm: Add quirk for Elatec TWN3 · 765fb2f1
      Maksim Salau authored
      
      
      Elatec TWN3 has the union descriptor on data interface. This results in
      failure to bind the device to the driver with the following log:
        usb 1-1.2: new full speed USB device using streamplug-ehci and address 4
        usb 1-1.2: New USB device found, idVendor=09d8, idProduct=0320
        usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
        usb 1-1.2: Product: RFID Device (COM)
        usb 1-1.2: Manufacturer: OEM
        cdc_acm 1-1.2:1.0: Zero length descriptor references
        cdc_acm: probe of 1-1.2:1.0 failed with error -22
      
      Adding the NO_UNION_NORMAL quirk for the device fixes the issue.
      
      `lsusb -v` of the device:
      
      Bus 001 Device 003: ID 09d8:0320
      Device Descriptor:
        bLength                18
        bDescriptorType         1
        bcdUSB               2.00
        bDeviceClass            2 Communications
        bDeviceSubClass         0
        bDeviceProtocol         0
        bMaxPacketSize0        32
        idVendor           0x09d8
        idProduct          0x0320
        bcdDevice            3.00
        iManufacturer           1 OEM
        iProduct                2 RFID Device (COM)
        iSerial                 0
        bNumConfigurations      1
        Configuration Descriptor:
          bLength                 9
          bDescriptorType         2
          wTotalLength           67
          bNumInterfaces          2
          bConfigurationValue     1
          iConfiguration          0
          bmAttributes         0x80
            (Bus Powered)
          MaxPower              250mA
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        0
            bAlternateSetting       0
            bNumEndpoints           1
            bInterfaceClass         2 Communications
            bInterfaceSubClass      2 Abstract (modem)
            bInterfaceProtocol      1 AT-commands (v.25ter)
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x83  EP 3 IN
              bmAttributes            3
                Transfer Type            Interrupt
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0020  1x 32 bytes
              bInterval               2
          Interface Descriptor:
            bLength                 9
            bDescriptorType         4
            bInterfaceNumber        1
            bAlternateSetting       0
            bNumEndpoints           2
            bInterfaceClass        10 CDC Data
            bInterfaceSubClass      0 Unused
            bInterfaceProtocol      0
            iInterface              0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x02  EP 2 OUT
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0020  1x 32 bytes
              bInterval               0
            Endpoint Descriptor:
              bLength                 7
              bDescriptorType         5
              bEndpointAddress     0x81  EP 1 IN
              bmAttributes            2
                Transfer Type            Bulk
                Synch Type               None
                Usage Type               Data
              wMaxPacketSize     0x0020  1x 32 bytes
              bInterval               0
            CDC Header:
              bcdCDC               1.10
            CDC Call Management:
              bmCapabilities       0x03
                call management
                use DataInterface
              bDataInterface          1
            CDC ACM:
              bmCapabilities       0x06
                sends break
                line coding and serial state
            CDC Union:
              bMasterInterface        0
              bSlaveInterface         1
      Device Status:     0x0000
        (Bus Powered)
      Signed-off-by: default avatarMaksim Salau <msalau@iotecha.com>
      Acked-by: default avatarOliver Neukum <oneukum@suse.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      765fb2f1
  20. 17 Jul, 2017 1 commit
  21. 01 Apr, 2017 3 commits
  22. 23 Mar, 2017 1 commit
  23. 02 Mar, 2017 1 commit
  24. 26 Jan, 2017 1 commit
    • Johan Hovold's avatar
      USB: cdc-acm: fix TIOCGSERIAL flags · 4ddecf76
      Johan Hovold authored
      The driver reports that it always uses a low-latency mode by returning
      the ASYNC_LOW_LATENCY flag through TIOCGSERIAL.
      
      Even if this behaviour could not be changed, this may have made some
      sense prior to 7a9a65ce
      
       ("cdc-acm: Fix long standing abuse of
      tty->low_latency") which removed the unconditional setting of the
      corresponding tty low_latency flag (something which had always been
      broken in itself).
      
      Since the driver does not have a low-latency mode, let's drop the flag.
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4ddecf76
  25. 05 Dec, 2016 1 commit
  26. 21 Nov, 2016 6 commits
  27. 10 Nov, 2016 2 commits