提交 · 1200a82a59b6aa65758ccc92c3447b98c53cd7a2 · openeuler / raspberrypi-kernel

24 10月, 2014 2 次提交

usb: dwc3: gadget: Properly initialize LINK TRB · 1200a82a

由 Jack Pham 提交于 10月 21, 2014

On ISOC endpoints the last trb_pool entry used as a
LINK TRB is not getting zeroed out correctly due to
memset being called incorrectly and in the wrong place.
If pool allocated from DMA was not zero-initialized
to begin with this will result in the size and ctrl
values being random garbage. Call memset correctly after
assignment of the trb_link pointer.

Fixes: f6bafc6a ("usb: dwc3: convert TRBs into bitshifts")
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: NJack Pham <jackp@codeaurora.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

1200a82a

usb: dwc2: gadget: fix gadget unregistration in udc_stop() function · 32805c35

由 Marek Szyprowski 提交于 10月 20, 2014

udc_stop() should clear ->driver pointer unconditionally to let the UDC
framework to work correctly with both registering/unregistering gadgets
and enabling/disabling gadgets by writing to
/sys/class/udc/*hsotg/soft_connect interface.
Acked-by: NPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

32805c35

23 10月, 2014 13 次提交

usb: dwc2: Bits in bitfield should add up to 32 · fd4850cf

由 Charles Manning 提交于 10月 02, 2014

The unioned u32 is used for clearing etc. Having the number of
bitfield bits add up to more than 32 is broken, even if benign.
Acked-by: NPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: NCharles Manning <cdhmanning@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

fd4850cf

usb: dwc2: gadget: sparse warning of context imbalance · b585a48b

由 Sudip Mukherjee 提交于 10月 17, 2014

sparse was giving the following warning:
        warning: context imbalance in 's3c_hsotg_ep_enable'
	                - different lock contexts for basic block

we were returning ENOMEM while still holding the spinlock.
The sparse warning was fixed by releasing the spinlock before return.

Cc: <stable@vger.kernel.org> # v3.17
Acked-by: NPaul Zimmerman <paulz@synopsys.com>
Signed-off-by: NSudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

b585a48b

usb: gadget: udc: core: fix kernel oops with soft-connect · bfa6b18c

由 Felipe Balbi 提交于 10月 17, 2014

Currently, there's no guarantee that udc->driver
will be valid when using soft_connect sysfs
interface. In fact, we can very easily trigger
a NULL pointer dereference by trying to disconnect
when a gadget driver isn't loaded.

Fix this bug:

~# echo disconnect > soft_connect
[   33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014
[   33.694221] pgd = ed0cc000
[   33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000
[   33.703766] Internal error: Oops: 17 [#1] SMP ARM
[   33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore
[   33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345
[   33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000
[   33.748116] PC is at usb_udc_softconn_store+0xa4/0xec
[   33.753416] LR is at mark_held_locks+0x78/0x90
[   33.758057] pc : [<c04df128>]    lr : [<c00896a4>]    psr: 20000013
[   33.758057] sp : ee68bec8  ip : c0c00008  fp : ee68bee4
[   33.770050] r10: ee6b394c  r9 : ee68bf80  r8 : ee6062c0
[   33.775508] r7 : 00000000  r6 : ee6062c0  r5 : 0000000b  r4 : ee739408
[   33.782346] r3 : 00000000  r2 : 00000000  r1 : ee71d390  r0 : ee664170
[   33.789168] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   33.796636] Control: 10c5387d  Table: ad0cc059  DAC: 00000015
[   33.802638] Process bash (pid: 1457, stack limit = 0xee68a248)
[   33.808740] Stack: (0xee68bec8 to 0xee68c000)
[   33.813299] bec0:                   0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8
[   33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940
[   33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000
[   33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000
[   33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0
[   33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34
[   33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8
[   33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000
[   33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000
[   33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565
[   33.898890] [<c04df128>] (usb_udc_softconn_store) from [<c04112ac>] (dev_attr_store+0x28/0x34)
[   33.907920] [<c04112ac>] (dev_attr_store) from [<c01c2868>] (sysfs_kf_write+0x5c/0x60)
[   33.916200] [<c01c2868>] (sysfs_kf_write) from [<c01c1a24>] (kernfs_fop_write+0xd0/0x194)
[   33.924773] [<c01c1a24>] (kernfs_fop_write) from [<c0152dd8>] (vfs_write+0xb0/0x1bc)
[   33.932874] [<c0152dd8>] (vfs_write) from [<c0153330>] (SyS_write+0x54/0xb0)
[   33.940247] [<c0153330>] (SyS_write) from [<c000f080>] (ret_fast_syscall+0x0/0x48)
[   33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014)
[   33.954625] ---[ end trace f849bead94eab7ea ]---

Fixes: 2ccea03a (usb: gadget: introduce UDC Class)
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: NFelipe Balbi <balbi@ti.com>

bfa6b18c

usb: musb: musb_dsps: fix NULL pointer in suspend · f042e9cb

由 Sebastian Andrzej Siewior 提交于 10月 13, 2014

So testing managed to configure musb in DMA mode but not load the
matching cppi41 driver for DMA. This results in

|musb-hdrc musb-hdrc.0.auto: Failed to request rx1.
|musb-hdrc musb-hdrc.0.auto: musb_init_controller failed with status -517
|platform musb-hdrc.0.auto: Driver musb-hdrc requests probe deferral

which is "okay". Once the driver is loaded we re-try probing and
everyone is happy. Until then if you try suspend say
    echo mem > /sys/power/state
then you go boom

|Unable to handle kernel NULL pointer dereference at virtual address 000003a4
|pgd = cf50c000
|[000003a4] *pgd=8f6a3831, *pte=00000000, *ppte=00000000
|Internal error: Oops: 17 [#1] ARM
|PC is at dsps_suspend+0x18/0x9c [musb_dsps]
|LR is at dsps_suspend+0x18/0x9c [musb_dsps]
|pc : [<bf08e268>] lr : [<bf08e268>] psr: a0000013
|sp : cbd97e00 ip : c0af4394 fp : 00000000
|r10: c0831d90 r9 : 00000002 r8 : cf6da410
|r7 : c03ba4dc r6 : bf08f224 r5 : 00000000 r4 : cbc5fcd0
|r3 : bf08e250 r2 : bf08f264 r1 : cf6da410 r0 : 00000000
|[<bf08e268>] (dsps_suspend [musb_dsps]) from [<c03ba508>] (platform_pm_suspend+0x2c/0x54)
|Code: e1a04000 e9900041 e2800010 eb4caa8e (e59053a4)

because platform_get_drvdata(glue->musb) returns a NULL pointer as long as the
device is not fully probed.
Tested-by: NGeorge Cherian <george.cherian@ti.com>
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

f042e9cb

usb: musb: dsps: start OTG timer on resume again · 53185b3a

由 Sebastian Andrzej Siewior 提交于 10月 13, 2014

Commit 468bcc2a ("usb: musb: dsps: kill OTG timer on suspend") stopped
the timer in suspend path but forgot the re-enable it in the resume
path. This patch fixes the behaviour.

Cc: <stable@vger.kernel.org> # v3.14+
Fixes 468bcc2a "usb: musb: dsps: kill OTG timer on suspend"
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

53185b3a

usb: gadget: loopback: don't queue requests to bogus endpoints · e0857ce5

由 Felipe Balbi 提交于 10月 13, 2014

A request allocated from e.g. ep1out cannot
be queued to any other endpoint. This bug has
been in f_loopback at least since mid-2011 and
since nobody has really screamed about it, we're
not backporting to any stable kernels.

Debugged with MUSB since that's the only controller
which complains about this case.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

e0857ce5

usb: ffs: fix regression when quirk_ep_out_aligned_size flag is set · c0d31b3c

由 David Cohen 提交于 10月 13, 2014

The commit '2e4c7553 usb: gadget: f_fs: add aio support' broke the
quirk implemented to align buffer size to maxpacketsize on out endpoint.
As result, functionfs does not work on Intel platforms using dwc3 driver
(i.e. Bay Trail and Merrifield). This patch fixes the issue.

This code is based on a previous Qiuxu's patch.

Fixes: 2e4c7553 (usb: gadget: f_fs: add aio support)
Cc: <stable@vger.kernel.org> # v3.16+
Signed-off-by: NDavid Cohen <david.a.cohen@linux.intel.com>
Signed-off-by: NQiuxu Zhuo <qiuxu.zhuo@intel.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

c0d31b3c

usb: gadget: f_fs: remove redundant ffs_data_get() · a3058a5d

由 Robert Baldyga 提交于 10月 09, 2014

During FunctionFS bind, ffs_data_get() function was called twice
(in functionfs_bind() and in ffs_do_functionfs_bind()), while on unbind
ffs_data_put() was called once (in functionfs_unbind() function).
In result refcount never reached value 0, and ffs memory resources has
been never released.

Since ffs_data_get() call in ffs_do_functionfs_bind() is redundant
and not neccessary, we remove it to have equal number of gets ans puts,
and free allocated memory after refcount reach 0.

Fixes: 5920cda6 (usb: gadget: FunctionFS: convert to new function
	interface with backward compatibility)
Cc: <stable@vger.kernel.org> # v3.14+
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

a3058a5d

usb: gadget: udc: USB_GADGET_XILINX should depend on HAS_DMA · f1113be1

由 Geert Uytterhoeven 提交于 10月 09, 2014

If NO_DMA=y:

drivers/built-in.o: In function `xudc_done':
udc-xilinx.c:(.text+0x54f4d2): undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `xudc_dma_send':
udc-xilinx.c:(.text+0x54f9f8): undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `xudc_read_fifo':
udc-xilinx.c:(.text+0x54ff4a): undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `xudc_ep_queue':
udc-xilinx.c:(.text+0x550e7c): undefined reference to `usb_gadget_map_request'
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

f1113be1

Revert "usb: dwc3: dwc3-omap: Disable/Enable only wrapper interrupts in prepare/complete" · b01ff5cb

由 Roger Quadros 提交于 10月 07, 2014

This reverts commit 02dae36a.

That commit is bogus in two ways:

1) There's no way dwc3-omap's ->suspend() can cause any effect
	on xhci's ->suspend(). Linux device driver model guarantees
	that a parent's ->suspend() will only be called after all
	children are suspended. dwc3-omap is the parent of the
	parent of xhci.

2) When implementing Deep Sleep states where context is lost,
	USBOTGSS_IRQ0 register, well, looses context so we
	_must_ rewrite it otherwise core IRQs will never be
	reenabled and USB will appear to be dead.

Fixes: 02dae36a (usb: dwc3: dwc3-omap: Disable/Enable only
	wrapper interrupts in prepare/complete)
Cc: <stable@vger.kernel.org> # v3.17
Cc: George Cherian <george.cherian@ti.com>
Signed-off-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

b01ff5cb

usb: gadget: composite: enable BESL support · a6615937

由 Felipe Balbi 提交于 9月 30, 2014

According to USB 2.0 ECN Errata for Link Power
Management (USB2-LPM-Errata-final.pdf), BESL
must be enabled if LPM is enabled.

This helps with USB30CV TD 9.21 LPM L1
Suspend Resume Test.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

a6615937

usb: musb: cppi41: restart hrtimer only if not yet done · d2e6d62c

由 Thomas Gleixner 提交于 10月 02, 2014

commit c58d80f5 ("usb: musb: Ensure that cppi41 timer gets armed on
premature DMA TX irq") fixed hrtimer scheduling bug. There is one left
which does not trigger that often.
The following scenario is still possible:

    lock(&x->lock);
    hrtimer_start(&x->t);
    unlock(&x->lock);

expires:
    t->function();
                                lock(&x->lock);
    lock(&x->lock);             if (!hrtimer_queued(&x->t))
                                        hrtimer_start(&x->t);
                                unlock(&x->lock);

    if (!list_empty(x->early_tx_list))
           ret = HRTIMER_RESTART;
->         hrtimer_forward_now(...)
    } else
           ret = HRTIMER_NORESTART;

    unlock(&x->lock);

and the timer callback returns HRTIMER_RESTART for an armed timer. This
is wrong and we run into the BUG_ON() in __run_hrtimer().
This can happens on SMP or PREEMPT-RT.
The patch fixes the problem by only starting the timer if the timer is
not yet queued.

Cc: stable@vger.kernel.org
Reported-by: NTorben Hohn <torbenh@linutronix.de>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
[bigeasy: collected information and created a patch + description based
          on it]
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

d2e6d62c

usb: dwc3: ep0: fix Data Phase for transfer sizes aligned to wMaxPacketSize · 36f84ffb

由 Felipe Balbi 提交于 9月 30, 2014

According to Section 8.5.3.2 of the USB 2.0 specification,
a USB device must terminate a Data Phase with either a
short packet or a ZLP (if the previous transfer was
a multiple of wMaxPacketSize).

For reference, here's what the USB 2.0 specification, section
8.5.3.2 says:

"
8.5.3.2 Variable-length Data Stage

A control pipe may have a variable-length data phase
in which the host requests more data than is contained
in the specified data structure. When all of the data
structure is returned to the host, the function should
indicate that the Data stage is ended by returning a
packet that is shorter than the MaxPacketSize for the
pipe. If the data structure is an exact multiple of
wMaxPacketSize for the pipe, the function will return
a zero-length packet to indicate the end of the Data
stage.
"
Signed-off-by: NFelipe Balbi <balbi@ti.com>

36f84ffb

21 10月, 2014 17 次提交

usb: dwc3: ep0: return early on NULL requests · 6856d30c

由 Felipe Balbi 提交于 9月 30, 2014

if our list of requests is empty, return early.

There's really nothing to be done in case our
request list is empty anyway because the only
situation where we our list is empty, is when
we're transferring ZLPs.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

6856d30c

usb: dwc3: pci: Add PCI ID for Intel Braswell · 7d643664

由 Alan Cox 提交于 9月 24, 2014

The device controller is the same but it has different PCI ID. Add this new
ID to the driver's list of supported IDs.
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: NHeikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

7d643664

usb: gadget: function: f_obex: fix Interface Descriptor Test · 3985f3ab