summaryrefslogtreecommitdiff
path: root/drivers/usb/dwc2
AgeCommit message (Collapse)Author
2015-10-19usb: dwc2: host: Fix use after free w/ simultaneous irqsDoug Anderson
While plugging / unplugging on a DWC2 host port with "slub_debug=FZPUA" enabled, I found a crash that was quite obviously a use after free. It appears that in some cases when we handle the various sub-cases of HCINT we may end up freeing the QTD. If there is more than one bit set in HCINT we may then end up continuing to use the QTD, which is bad. Let's be paranoid and check for this after each sub-case. This should be safe since we officially have the "hsotg->lock" (it was grabbed in dwc2_handle_hcd_intr). The specific crash I found was: Unable to handle kernel paging request at virtual address 6b6b6b9f At the time of the crash, the kernel reported: (dwc2_hc_nak_intr+0x5c/0x198) (dwc2_handle_hcd_intr+0xa84/0xbf8) (_dwc2_hcd_irq+0x1c/0x20) (usb_hcd_irq+0x34/0x48) Popping into kgdb found that "*qtd" was filled with "0x6b", AKA qtd had been freed and filled with slub_debug poison. kgdb gave a little better stack crawl: 0 dwc2_hc_nak_intr (hsotg=hsotg@entry=0xec42e058, chan=chan@entry=0xec546dc0, chnum=chnum@entry=4, qtd=qtd@entry=0xec679600) at drivers/usb/dwc2/hcd_intr.c:1237 1 dwc2_hc_n_intr (chnum=4, hsotg=0xec42e058) at drivers/usb/dwc2/hcd_intr.c:2041 2 dwc2_hc_intr (hsotg=0xec42e058) at drivers/usb/dwc2/hcd_intr.c:2078 3 dwc2_handle_hcd_intr (hsotg=0xec42e058) at drivers/usb/dwc2/hcd_intr.c:2128 4 _dwc2_hcd_irq (hcd=<optimized out>) at drivers/usb/dwc2/hcd.c:2837 5 usb_hcd_irq (irq=<optimized out>, __hcd=<optimized out>) at drivers/usb/core/hcd.c:2353 Popping up to frame #1 (dwc2_hc_n_intr) found: (gdb) print /x hcint $12 = 0x12 AKA: #define HCINTMSK_CHHLTD (1 << 1) #define HCINTMSK_NAK (1 << 4) Further debugging found that by simulating receiving those two interrupts at the same time it was trivial to replicate the use-after-free. See <http://crosreview.com/305712> for a patch and instructions. This lead to getting the following stack crawl of the actual free: 0 arch_kgdb_breakpoint () at arch/arm/include/asm/outercache.h:103 1 kgdb_breakpoint () at kernel/debug/debug_core.c:1054 2 dwc2_hcd_qtd_unlink_and_free (hsotg=<optimized out>, qh=<optimized out>, qtd=0xe4479a00) at drivers/usb/dwc2/hcd.h:488 3 dwc2_deactivate_qh (free_qtd=<optimized out>, qh=0xe5efa280, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:671 4 dwc2_release_channel (hsotg=hsotg@entry=0xed424618, chan=chan@entry=0xed5be000, qtd=<optimized out>, halt_status=<optimized out>) at drivers/usb/dwc2/hcd_intr.c:742 5 dwc2_halt_channel (hsotg=0xed424618, chan=0xed5be000, qtd=<optimized out>, halt_status=<optimized out>) at drivers/usb/dwc2/hcd_intr.c:804 6 dwc2_complete_non_periodic_xfer (chnum=<optimized out>, halt_status=<optimized out>, qtd=<optimized out>, chan=<optimized out>, hsotg=<optimized out>) at drivers/usb/dwc2/hcd_intr.c:889 7 dwc2_hc_xfercomp_intr (hsotg=hsotg@entry=0xed424618, chan=chan@entry=0xed5be000, chnum=chnum@entry=6, qtd=qtd@entry=0xe4479a00) at drivers/usb/dwc2/hcd_intr.c:1065 8 dwc2_hc_chhltd_intr_dma (qtd=0xe4479a00, chnum=6, chan=0xed5be000, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:1823 9 dwc2_hc_chhltd_intr (qtd=0xe4479a00, chnum=6, chan=0xed5be000, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:1944 10 dwc2_hc_n_intr (chnum=6, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:2052 11 dwc2_hc_intr (hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:2097 12 dwc2_handle_hcd_intr (hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:2147 13 _dwc2_hcd_irq (hcd=<optimized out>) at drivers/usb/dwc2/hcd.c:2837 14 usb_hcd_irq (irq=<optimized out>, __hcd=<optimized out>) at drivers/usb/core/hcd.c:2353 Though we could add specific code to handle this case, adding the general purpose code to check for all cases where qtd might be freed seemed safer. Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-16usb: dwc2: host: Protect PCGCTL with lock in dwc2_port_resume()Douglas Anderson
From code inspection, it appears to be unsafe to do a read-modify-write of PCGCTL in dwc2_port_resume(). Let's make sure the spinlock is held around this operation. Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-14usb: dwc2: refactor common low-level hw code to platform.cMarek Szyprowski
DWC2 module on some platforms needs three additional hardware resources: phy controller, clock and power supply. All of them must be enabled/activated to properly initialize and operate. This was initially handled in s3c-hsotg driver, which has been converted to 'gadget' part of dwc2 driver. Unfortunately, not all of this code got moved to common platform code, what resulted in accessing DWC2 registers without enabling low-level hardware resources. This fails for example on Exynos SoCs. This patch moves all the code for managing those resources to common platform.c file and provides convenient wrappers for controlling them. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: John Youn <johnyoun@synopsys.com> Tested-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-14usb: dwc2: remove no longer needed init_mutexMarek Szyprowski
init_mutex is a leftover from the time, when s3c-hsotg driver did not implement proper pull up/down control and emulated it by enabling enabling/disabling usb phy. Proper pull up/down control has been added by commit 5b9451f8c4fbaf0549139755fb45ff2b57975b7f ("usb: dwc2: gadget: use soft-disconnect udc feature in pullup() method"), so init_muxtex can be removed now to avoid potential deadlocks with other locks. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: John Youn <johnyoun@synopsys.com> Tested-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-13usb: dwc2: fix duplicate argument warningMian Yousaf Kaukab
Fix a duplicate argument warning reported by 0-DAY kernel test infrastructure in the following patch: 77dbf71 usb: dwc2: host: add disconnect interrupt to host only interrupts Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-02usb: dwc2: gadget: parity fix in isochronous modeRoman Bacik
USB OTG driver in isochronous mode has to set the parity of the receiving microframe. The parity is set to even by default. This causes problems for an audio gadget, if the host starts transmitting on odd microframes. This fix uses Incomplete Periodic Transfer interrupt to toggle between even and odd parity until the Transfer Complete interrupt is received. Signed-off-by: Roman Bacik <rbacik@broadcom.com> Reviewed-by: Abhinav Ratna <aratna@broadcom.com> Reviewed-by: Srinath Mannam <srinath.mannam@broadcom.com> Signed-off-by: Scott Branden <sbranden@broadcom.com> Signed-off-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: fix unbalanced phy controlMarek Szyprowski
Even when DWC2 is in (internal) suspended state, it should disable PHY in suspend and then enable it in resume. This patch fixes unbalanced PHY control sequence. Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: remove non-functional clock gatingMarek Szyprowski
During typical gadget operation, dwc2 clock was enabled 3 times: from dwc2_gadget_init(), dwc2_hsotg_udc_start() and dwc2_hsotg_pullup(), and then disabled in s3c_hsotg_pullup(), s3c_hsotg_udc_stop() and dwc2_hsotg_remove(). This really makes no sense, so leave clock control code only in dwc2_gadget_init/remove functions. Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: remove double call to dwc2_hsotg_of_probeMarek Szyprowski
This patch removes doubled call to dwc2_hsotg_of_probe() function. Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: fix a memory use-after-free bugYunzhi Li
When dwc2_hsotg_handle_unaligned_buf_complete() hs_req->req.buf already destroyed, in dwc2_hsotg_unmap_dma(), it touches hs_req->req.dma again, so dwc2_hsotg_unmap_dma() should be called before dwc2_hsotg_handle_unaligned_buf_complete(). Otherwise, it will cause a bad_page BUG, when allocate this memory page next time. This bug led to the following crash: BUG: Bad page state in process swapper/0 pfn:2bdbc [ 26.820440] page:eed76780 count:0 mapcount:0 mapping: (null) index:0x0 [ 26.854710] page flags: 0x200(arch_1) [ 26.885836] page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set [ 26.919179] bad because of flags: [ 26.948917] page flags: 0x200(arch_1) [ 26.979100] Modules linked in: [ 27.008401] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W3.14.0 #17 [ 27.041816] [<c010e1f8>] (unwind_backtrace) from [<c010a704>] (show_stack+0x20/0x24) [ 27.076108] [<c010a704>] (show_stack) from [<c087eea8>] (dump_stack+0x70/0x8c) [ 27.110246] [<c087eea8>] (dump_stack) from [<c01ce0b8>] (bad_page+0xfc/0x12c) [ 27.143958] [<c01ce0b8>] (bad_page) from [<c01ce65c>] (get_page_from_freelist+0x3e4/0x50c) [ 27.179298] [<c01ce65c>] (get_page_from_freelist) from [<c01ce9a0>] (__alloc_pages_nodemask) [ 27.216296] [<c01ce9a0>] (__alloc_pages_nodemask) from [<c01cf00c>] (__get_free_pages+0x20/) [ 27.252326] [<c01cf00c>] (__get_free_pages) from [<c01e5bec>] (kmalloc_order_trace+0x34/0xa) [ 27.288295] [<c01e5bec>] (kmalloc_order_trace) from [<c0203304>] (__kmalloc+0x40/0x1ac) [ 27.323751] [<c0203304>] (__kmalloc) from [<c052abc0>] (dwc2_hsotg_ep_queue.isra.12+0x7c/0x1) [ 27.359937] [<c052abc0>] (dwc2_hsotg_ep_queue.isra.12) from [<c052af88>] (dwc2_hsotg_ep_queue) [ 27.397478] [<c052af88>] (dwc2_hsotg_ep_queue_lock) from [<c0554110>] (rx_submit+0xfc/0x164) [ 27.433619] [<c0554110>] (rx_submit) from [<c05546e8>] (rx_complete+0x22c/0x230) [ 27.468872] [<c05546e8>] (rx_complete) from [<c052b528>] (dwc2_hsotg_complete_request+0xfc/0) [ 27.506240] [<c052b528>] (dwc2_hsotg_complete_request) from [<c052bba0>] (dwc2_hsotg_handle_o) [ 27.545401] [<c052bba0>] (dwc2_hsotg_handle_outdone) from [<c052be70>] (dwc2_hsotg_epint+0x2c) [ 27.583689] [<c052be70>] (dwc2_hsotg_epint) from [<c052c750>] (dwc2_hsotg_irq+0x1dc/0x4ac) [ 27.621041] [<c052c750>] (dwc2_hsotg_irq) from [<c01682e0>] (handle_irq_event_percpu+0x70/0x) [ 27.659066] [<c01682e0>] (handle_irq_event_percpu) from [<c01684ec>] (handle_irq_event+0x4c) [ 27.697322] [<c01684ec>] (handle_irq_event) from [<c016bae0>] (handle_fasteoi_irq+0xc8/0x11) [ 27.735451] [<c016bae0>] (handle_fasteoi_irq) from [<c0167b8c>] (generic_handle_irq+0x30/0x) [ 27.773918] [<c0167b8c>] (generic_handle_irq) from [<c0167ca4>] (__handle_domain_irq+0x84/0) [ 27.812018] [<c0167ca4>] (__handle_domain_irq) from [<c01003b0>] (gic_handle_irq+0x48/0x6c) [ 27.849695] [<c01003b0>] (gic_handle_irq) from [<c010b340>] (__irq_svc+0x40/0x50) [ 27.886907] Exception stack(0xc0d01ee0 to 0xc0d01f28) Acked-by: John Youn <johnyoun@synopsys.com> Tested-by: Heiko Stuebner <heiko@sntech.de> Tested-by: Jeffy Chen <jeffy.chen@rock-chips.com> Signed-off-by: Yunzhi Li <lyz@rock-chips.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: exit hibernation on session requestMian Yousaf Kaukab
Controller enters hibernation through suspend interrupt on disconnection. On connection, session request interrupt is generated. dwc2 must exit hibernation and restore state from this interrupt before continuing. In host mode, exit from hibernation is handled by bus_resume function. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: handle reset interrupt before endpoint interruptsMian Yousaf Kaukab
If system is loaded, reset, enum-done and setup interrupts can occur at the same time. Current interrupt handling sequence will handle setup packet's interrupt before handling reset interrupt. Which will break the enumeration process. Correct sequence is to handle reset, enum-done and then any other endpoint interrupts. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: exit hibernation before power downGregory Herrero
When disconnecting cable, controller will detect a suspend condition and enter partial power down. If vbus_session is called by the phy driver during hibernation, make sure controller exit hibernation before it is accessed. Signed-off-by: Jianqiang Tang <jianqiang.tang@intel.com> Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: unmask idstschng interrupt only if controller supports itGregory Herrero
idstschng interrupt should not be used when id pin control is external. This is already handled on dwc2 host part. Fix it on gadget part as well. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: only reset core after addressed stateMian Yousaf Kaukab
There is a 200ms guard period to avoid unnecessary resets of the dwc2 ip. This delay sometimes prove to be too large when usbcv is run with an ehci host. dwc2 only needs to be reset after addressed state. Change the logic to reset ip after addressed state. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: kill ep0 requests before reinitializing coreMian Yousaf Kaukab
Make sure there are no requests pending on ep0 before reinitializing core. Otherwise, dwc2_hsotg_enqueue_setup will fail afterwards. Also, take hsotg->lock before calling dwc2_hsotg_core_init_disconnected() from dwc2_conn_id_status_change() as dwc2_hsotg_complete_request() expect lock to be held. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: stop current transfer on dequeueMian Yousaf Kaukab
If the request being dequeued is already started, disable endpoint to stop the transfer and then call dwc2_hsotg_complete_request(). Endpoint will be re-enabled on next call to dwc2_hsotg_start_req(). Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: print complete setup packetMian Yousaf Kaukab
wIndex field was missing. Also print in natural order instead of Req first, so that its easier to compare for example against bus analyzer logs. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: ignore stall check for ep0Mian Yousaf Kaukab
dwc2_hsotg_start_req starts a request only if endpoint is not stalled. Ignore this check for ep0 as core will clear DOEPCTL0.Stall after sending stall handshake. Prepare instead for receiving next setup packet. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: abort core init if core_reset failsGregory Herrero
No point of continue with initialization if core is not in a sane state. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: set op_state in vbus_session callGregory Herrero
Some device may have external id pin control enabled, so op_state will not be set on id pin interrupt change. Thus, ensure op_state is set to peripheral during vbus detection. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: don't modify pullup state in host modeGregory Herrero
Modifying the pullup state during host mode trig a new enumeration of attached device. Thus, avoid modifying pullup in host mode. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: force dr_mode in case of configuration mismatchMian Yousaf Kaukab
If dual role configuration is not selected, check and force dr_mode based on the selected configuration. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: initialize op_state for peripheral only configurationMian Yousaf Kaukab
ID status change interrupt will not be handled in peripheral only configuration. So initialize op_state during gadget init. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: gadget: ensure lx_state corresponds to current stateGregory Herrero
Correctly update lx_state on gadget connection and disconnection. When usb cable is disconnected, lx_state must be updated to L3 as controller could be in power off state. When usb cable is connected, lx_state must be updated to L0 as controller is powered. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: kill remaining urbs using -ECONNRESET statusGregory Herrero
On a disconnect, dwc2 will kill all remaining urbs from qh list. urbs are given back to hcd with -ETIMEDOUT status. Some usb device driver, like mass storage, will unlink all urbs using usb_hcd_unlink_urb when receiving a negative status different from -ECONNRESET. The following flow will then happen: dwc2_hcd_disconnect() -> dwc2_kill_all_urbs() try to kill first pending urb. -> dwc2_host_complete(-ETIMEDOUT) -> usb_hcd_giveback_urb(-ETIMEDOUT) -> sg_complete() -> usb_unlink_urb() -> usb_put_dev(urb->dev) -> dwc2_kill_all_urbs() try to kill next pending urb. -> dwc2_host_complete(-ETIMEDOUT) -> usb_hcd_giveback_urb(-ETIMEDOUT) -> NULL pointer dereferencing because urb->dev has been freed for all urbs of this device. The root cause of this NULL pointer is to call call usb_unlink_urb() while we are killing all urbs. To avoid this return urb with -ECONNRESET status This issue usually happens while removing mass storage device during transfer. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: use correct frame number during qh initGregory Herrero
On first qh initialization, hsotg->frame_number is not corresponding to reality. So read it from host controller to get correct value. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: correctly dump urb isochronous descriptorsGregory Herrero
Print urb->iso_frame_desc.status after it has been updated using dwc2_hcd_urb_get_iso_desc_status(). Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: wait 3ms for controller stabilizationGregory Herrero
Some high speed mass storage devices fail to enumerate with following error: Cannot enable port %i. Maybe the USB cable is bad? This happens only when the device is plugged while the controller is in hibernation state. After exiting hibernation, the controller detects the device as a low speed device and fail to enumerate it. Problem occurs only if HPRT0.PWR bit is programmed in a too short delay after exiting hibernation. Dumping hprt register in _dwc2_hcd_resume() directly after dwc2_exit_hibernation() shows that HPRT0.LNSTS (D+/D- level) becomes valid approximately 2ms after exiting hibernation. Since dwc2_exit_hibernation() is called from atomic context, move the delay out of this function. Delay value is experimental and not mentioned in Synopsys documentation. To be on the safe side 3ms delay is used. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: clear pending interrupts prior hibernationGregory Herrero
If an interrupt rises during hibernation process, dwc2 will assert interrupt line to interrupt controller. If interrupt is level sensitive, interrupt handler will be called in a loop because dwc2 will not be able to clear it while controller is hibernated. Thus, clear all controller interrupts before hibernation entry. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: disable interrupt during stopGregory Herrero
Disable host interrupts before synchronising dwc2 irq. So that interrupts are not generated once controller is stopped. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: add disconnect interrupt to host only interruptsMian Yousaf Kaukab
GINTSTS.DisconnInt is host only interrupt and should be disable after dwc2_disable_host_interrupts is called. Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: disconnect hcd prior stopping itGregory Herrero
In case controller is asked to stop while devices are connected, disconnect all devices and clean up before stopping. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: reset frame number after suspendGregory Herrero
Frame number is reset in hardware after exiting hibernation. Thus, reset frame_number and ensure qh are queued with correct sched_frame. Otherwise, qh->sched_frame may be too high compared to current frame number (which is 0). This can delay addition of qh in the list of transfers until frame number reaches qh->sched_frame. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: resume only if bus is suspendedGregory Herrero
Port can be resumed in bus_resume callback. In this case, there is no need to drive resume a second time when hcd ask for it. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: ignore wakeup interrupt if hibernation supportedGregory Herrero
If hibernation is supported, resume of devices will be handled in bus_resume callback. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: avoid resetting lx_state to L3 during disconnectGregory Herrero
When a device is disconnected, lx_state must not be changed since the device may be disconnected whereas controller is still powered. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: update hcd and lx_state during start/stop callbacksGregory Herrero
During hcd initialization, hardware accessible flag and lx_state must be reset to the working state since controller is powered at this stage. Same logic applied for stop callback. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: enter hibernation during bus suspendGregory Herrero
Disable controller power and enter hibernation when usb bus is suspended. A phy driver is required to disable the power of the controller and detect remote-wakeup or disconnection since the controller will not be able to detect these in this state. Once the phy driver detects bus activity, it must call usb_hcd_resume_root_hub. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: add flag to reflect bus stateGregory Herrero
lx_state must be used to reflect controller power state only and not bus state. Thus add a flag to track state during bus suspend. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: create a function to handle port_resumeGregory Herrero
port resume sequence may be used in different places. Create a function to handle it. Make hprt0 read-modify-write atomic and clear HPRT0_SUSP for both writes as it is a "read, write-set, and self-clear (R_WS_SC)" bit. Since the lock is released between the writes, read hprt0 again. Since the phy clock is stopped in dwc2_port_suspend(), enable it here and remove the PCGCTL write from dwc2_hcd_hub_control() Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-01usb: dwc2: host: don't clear hprt0 status bits when exiting hibernationGregory Herrero
When entering hibernation hprt0 must be read using dwc2_read_hprt0(). Otherwise, any set hprt0 status bits will be cleared when restoring hprt0 on exit from hibernation. Signed-off-by: Gregory Herrero <gregory.herrero@intel.com> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Tested-by: Robert Baldyga <r.baldyga@samsung.com> Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com> Tested-by: John Youn <johnyoun@synopsys.com> Acked-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-09-27usb: common: of_usb_get_dr_mode to usb_get_dr_modeHeikki Krogerus
By using the unified device property interface, the function can be made available for all platforms and not just the ones using DT. Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-09-27usb: dwc2: Use platform endianness when accessing registersAntti Seppälä
This patch switches calls to readl/writel to their dwc2_readl/dwc2_writel equivalents which preserve platform endianness. This patch is necessary to access dwc2 registers correctly on big-endian systems such as the mips based SoCs made by Lantiq. Then dwc2 can be used to replace ifx-hcd driver for Lantiq platforms found e.g. in OpenWrt. The patch was autogenerated with the following commands: $EDITOR core.h sed -i "s/\<readl\>/dwc2_readl/g" *.c hcd.h hw.h sed -i "s/\<writel\>/dwc2_writel/g" *.c hcd.h hw.h Some files were then hand-edited to fix checkpatch.pl warnings about too long lines. Signed-off-by: Antti Seppälä <a.seppala@gmail.com> Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com> Signed-off-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-09-27usb: dwc2: rename all s3c_* to dwc2_*Felipe Balbi
this driver has long ago became dwc2.ko with both peripheral and host roles, there's no point in keeping the old function names. Acked-by: John Youn <johnyoun@synopsys.com> Tested-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-09-01Merge branch 'for-next' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial Pull trivial tree updates from Jiri Kosina: "The usual stuff from trivial tree for 4.3 (kerneldoc updates, printk() fixes, Documentation and MAINTAINERS updates)" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (28 commits) MAINTAINERS: update my e-mail address mod_devicetable: add space before */ scsi: a100u2w: trivial typo in printk i2c: Fix typo in i2c-bfin-twi.c treewide: fix typos in comment blocks Doc: fix trivial typo in SubmittingPatches proportions: Spelling s/consitent/consistent/ dm: Spelling s/consitent/consistent/ aic7xxx: Fix typo in error message pcmcia: Fix typo in locking documentation scsi/arcmsr: Fix typos in error log drm/nouveau/gr: Fix typo in nv10.c [SCSI] Fix printk typos in drivers/scsi staging: comedi: Grammar s/Enable support a/Enable support for a/ Btrfs: Spelling s/consitent/consistent/ README: GTK+ is a acronym ASoC: omap: Fix typo in config option description mm: tlb.c: Fix error message ntfs: super.c: Fix error log fix typo in Documentation/SubmittingPatches ...
2015-08-07treewide: Fix typo in printkMasanari Iida
This patch fix spelling typo inv various part of sources. Signed-off-by: Masanari Iida <standby24x7@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2015-08-04usb: dwc2: gadget: add ep capabilities supportRobert Baldyga
Convert endpoint configuration to new capabilities model. Signed-off-by: Robert Baldyga <r.baldyga@samsung.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-07-29usb: dwc2: gadget: use | instead of + for bitmasksFelipe Balbi
It's just a lot clearer to use | operator instead of + operator. Caught by coccicheck: " drivers/usb/dwc2/gadget.c:2883:26-27: WARNING: sum of probable bitmasks, consider | " Cc: John Youn <John.Youn@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-07-06usb: dwc2: embed storage for reg backup in struct dwc2_hsotgMian Yousaf Kaukab
Register backup function can be called from atomic context. Instead of using atomic memory pool, embed backup storage space in struct dwc2_hsotg. Also add a valid flag in each struct as NULL pointer can't be used as the content validity check any more. Acked-by: John Youn <johnyoun@synopsys.com> Tested-by: Heiko Stuebner <heiko@sntech.de> Tested-by: Doug Anderson <dianders@chromium.org> Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com> Signed-off-by: Felipe Balbi <balbi@ti.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-17 07:25:26 +0000