Greg Kroah-Hartman [Sat, 3 Oct 2020 13:59:57 +0000 (15:59 +0200)]
Merge tag 'usb-for-v5.10' of git://git./linux/kernel/git/balbi/usb into usb-next
Felipe writes:
USB: changes for v5.10 merge window
Most of changes are on dwc3 (38.8%) with cdns3 falling close
behind (24.1%).
The biggest changes here are a series of non-critical fixes to corner
cases on dwc3, produced by Thinh N, and a series of major improvements
to cdns3 produced by Peter C.
We also have the traditional set of new device support (Intel Keem
Bay, Hikey 970) on dwc3. A series of sparse/coccinelle and checkpatch
fixes on dwc3 by yours truly and a set of minor changes all over the
stack.
* tag 'usb-for-v5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (117 commits)
usb: dwc2: Fix INTR OUT transfers in DDMA mode.
usb: dwc2: don't use ID/Vbus detection if usb-role-switch on STM32MP15 SoCs
usb: dwc2: override PHY input signals with usb role switch support
dt-bindings: usb: dwc2: add optional usb-role-switch property
usb: dwc3: of-simple: Add compatible string for Intel Keem Bay platform
dt-bindings: usb: Add Intel Keem Bay USB controller bindings
usb: dwc3: gadget: Support up to max stream id
usb: dwc3: gadget: Return early if no TRB update
usb: dwc3: gadget: Keep TRBs in request order
usb: dwc3: gadget: Revise setting IOC when no TRB left
usb: dwc3: gadget: Look ahead when setting IOC
usb: dwc3: gadget: Allow restarting a transfer
usb: bdc: remove duplicated error message
usb: dwc3: Stop active transfers before halting the controller
usb: cdns3: gadget: enlarge the TRB ring length
usb: cdns3: gadget: sg_support is only for DEV_VER_V2 or above
usb: cdns3: gadget: need to handle sg case for workaround 2 case
usb: cdns3: gadget: handle sg list use case at completion correctly
usb: cdns3: gadget: add CHAIN and ISP bit for sg list use case
usb: cdns3: gadget: improve the dump TRB operation at cdns3_ep_run_transfer
...
Sergey Korolev [Sun, 9 Aug 2020 16:12:30 +0000 (19:12 +0300)]
USB: core: remove polling for /sys/kernel/debug/usb/devices
The latest reference to usbfs_conn_disc_event() removed in
commit
fb28d58b72aa ("USB: remove CONFIG_USB_DEVICEFS")
in 2012 and now a user poll() waits infinitely for content changes.
Signed-off-by: Sergey Korolev <s.korolev@ndmsystems.com>
Link: https://lore.kernel.org/r/20200809161233.13135-1-s.korolev@ndmsystems.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Amelie Delaunay [Thu, 24 Sep 2020 09:00:47 +0000 (11:00 +0200)]
usb: typec: add support for STUSB160x Type-C controller family
STMicroelectronics USB Type-C port controllers use I2C interface to
configure, control and read the operation status of the device. All ST USB
Type-C port controllers are based on the same I2C register map. That's why
this driver can be used with all ST USB Type-C ICs.
Some ST USB Type-C port controllers are Dual Role Port (DRP), only Sink or
Source, some supports USB Power Delivery. This can be configured through
connector device tree bindings.
This driver is a basic Type-C port controller driver, with no power
delivery support. It allows to configure ST USB Type-C port controller.
Interrupt is supported and enables CC connection events, to detect
attach and detach and update Type-C subsystem accordingly as well as usb
role switch.
ST USB Type-C port controller can be supplied in three different ways
depending on the target application:
- through VDD pin only (so VDD is the main supply)
- through VSYS pin only (so VSYS is the main supply)
- through VDD and VSYS pins.
When both VDD and VSYS power supplies are present, the low power supply
VSYS is selected as main supply when VSYS voltage is above 3.1V, else
VDD is selected as main supply.
In case of Source or Dual port type, if VDD supply is present, it has to be
enabled in case of Source power role to provide Vbus. When interrupt
support is available, VDD supply is dynamically managed upon attach/detach
interrupt. When there is no interrupt support, VDD supply is enabled by
default.
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Link: https://lore.kernel.org/r/20200924090049.9041-5-amelie.delaunay@st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Amelie Delaunay [Thu, 24 Sep 2020 09:00:45 +0000 (11:00 +0200)]
usb: typec: add typec_find_pwr_opmode
This patch adds a function that converts power operation mode string into
power operation mode value.
It is useful to configure power operation mode through device tree
property, as power capabilities may be linked to hardware design.
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Link: https://lore.kernel.org/r/20200924090049.9041-3-amelie.delaunay@st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Biju Das [Sun, 20 Sep 2020 13:49:03 +0000 (14:49 +0100)]
usb: typec: hd3ss3220: Use OF graph API to get the connector fwnode
Some platforms have only super speed data bus connected to this device
and high speed data bus directly connected to the SoC. In such platforms
modelling connector as a child of this device is making it non compliant
with usb connector bindings. By modelling connector node as standalone
device node along with this device and the SoC data bus will make it
compliant with usb connector bindings.
Update the driver to handle this model by using OF graph API to get the
connector fwnode and usb role switch class API to get role switch handle.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20200920134905.4370-5-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Biju Das [Sun, 20 Sep 2020 13:49:02 +0000 (14:49 +0100)]
dt-bindings: usb: renesas,usb3-peri: Document HS and SS data bus
Document HS and SS data bus for the "usb-role-switch" enabled case.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20200920134905.4370-4-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lad Prabhakar [Sun, 20 Sep 2020 13:49:01 +0000 (14:49 +0100)]
dt-bindings: usb: convert ti,hd3ss3220 bindings to json-schema
Convert ti,hd3ss3220.txt to YAML. Updated the binding documentation
as graph bindings of this device model Super Speed (SS) data bus to
the Super Speed (SS) capable connector.
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20200920134905.4370-3-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Greg Kroah-Hartman [Fri, 2 Oct 2020 11:45:00 +0000 (13:45 +0200)]
Merge tag 'phy-for-5.10' of git://git./linux/kernel/git/phy/linux-phy into usb-next
Vinod writes:
phy for 5.9
- Core:
- New PHY attribute for max_link_rate
- New phy drivers:
- Rockchip dphy driver moved from staging
- Socionext UniPhier AHCI PHY driver
- Intel LGM SoC USB phy
- Intel Keem Bay eMMC PHY driver
- Updates:
- Support for imx8mp usb phy
- Support for DP Phy and USB3+DP combo phy in QMP driver
- Support for Qualcomm sc7180 DP phy
- Support for cadence torrent PCIe and USB single linke and multilink
configurations along with USB, SGMII/QSGMII configurations
* tag 'phy-for-5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (72 commits)
phy: qcom-qmp: initialize the pointer to NULL
phy: qcom-qmp: Add support for sc7180 DP phy
phy: qcom-qmp: Add support for DP in USB3+DP combo phy
phy: qcom-qmp: Use devm_platform_ioremap_resource() to simplify
phy: qcom-qmp: Get dp_com I/O resource by index
phy: qcom-qmp: Move 'serdes' and 'cfg' into 'struct qcom_phy'
phy: qcom-qmp: Remove 'initialized' in favor of 'init_count'
phy: qcom-qmp: Move phy mode into struct qmp_phy
dt-bindings: phy: qcom,qmp-usb3-dp: Add DP phy information
dt-bindings: phy: ti,phy-j721e-wiz: fix bindings for torrent phy
dt-bindings: phy: cdns,torrent-phy: add reset-names
phy: rockchip-dphy-rx0: Include linux/delay.h
phy: fix USB_LGM_PHY warning & build errors
phy: cadence-torrent: Add USB + SGMII/QSGMII multilink configuration
phy: cadence-torrent: Add PCIe + USB multilink configuration
phy: cadence-torrent: Add single link USB register sequences
phy: cadence-torrent: Add single link SGMII/QSGMII register sequences
phy: cadence-torrent: Configure PHY_PLL_CFG as part of link_cmn_vals
phy: cadence-torrent: Add PHY link configuration sequences for single link
phy: cadence-torrent: Add clk changes for multilink configuration
...
Minas Harutyunyan [Thu, 24 Sep 2020 14:08:39 +0000 (18:08 +0400)]
usb: dwc2: Fix INTR OUT transfers in DDMA mode.
In DDMA mode if INTR OUT transfers mps not multiple of 4 then single packet
corresponds to single descriptor.
Descriptor limit set to mps and desc chain limit set to mps *
MAX_DMA_DESC_NUM_GENERIC. On that descriptors complete, to calculate
transfer size should be considered correction value for each descriptor.
In start request function, if "continue" is true then dma buffer address
should be incremmented by offset for all type of transfers, not only for
Control DATA_OUT transfers.
Fixes:
cf77b5fb9b394 ("usb: dwc2: gadget: Transfer length limit checking for DDMA")
Fixes:
e02f9aa6119e0 ("usb: dwc2: gadget: EP 0 specific DDMA programming")
Fixes:
aa3e8bc81311e ("usb: dwc2: gadget: DDMA transfer start and complete")
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Amelie Delaunay [Wed, 9 Sep 2020 09:35:11 +0000 (11:35 +0200)]
usb: dwc2: don't use ID/Vbus detection if usb-role-switch on STM32MP15 SoCs
If usb-role-switch is present in the device tree, it means that ID and Vbus
signals are not connected to the OTG controller but to an external
component (GPIOs, Type-C controller). In this configuration, usb role
switch is used to force valid sessions on STM32MP15 SoCs.
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Amelie Delaunay [Wed, 9 Sep 2020 09:35:10 +0000 (11:35 +0200)]
usb: dwc2: override PHY input signals with usb role switch support
This patch adds support for usb role switch to dwc2, by using overriding
control of the PHY voltage valid and ID input signals.
iddig signal (ID) can be overridden:
- when setting GUSBCFG_FORCEHOSTMODE, iddig input pin is overridden with 1;
- when setting GUSBCFG_FORCEDEVMODE, iddig input pin is overridden with 0.
avalid/bvalid/vbusvalid signals can be overridden respectively with:
- GOTGCTL_AVALOEN + GOTGCTL_AVALOVAL
- GOTGCTL_BVALOEN + GOTGCTL_BVALOVAL
- GOTGCTL_VBVALEN + GOTGCTL_VBVALOVAL
It is possible to determine valid sessions thanks to usb role switch:
- if USB_ROLE_NONE then !avalid && !bvalid && !vbusvalid
- if USB_ROLE_DEVICE then !avalid && bvalid && vbusvalid
- if USB_ROLE_HOST then avalid && !bvalid && vbusvalid
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Amelie Delaunay [Wed, 9 Sep 2020 09:35:09 +0000 (11:35 +0200)]
dt-bindings: usb: dwc2: add optional usb-role-switch property
This patch documents the usb-role-switch property in dwc2 bindings, now
that usb-role-switch support is available in dwc2 driver.
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Wan Ahmad Zainie [Mon, 21 Sep 2020 02:44:59 +0000 (10:44 +0800)]
usb: dwc3: of-simple: Add compatible string for Intel Keem Bay platform
Add compatible string to use this generic glue layer to support
Intel Keem Bay platform's dwc3 controller.
Signed-off-by: Wan Ahmad Zainie <wan.ahmad.zainie.wan.mohamad@intel.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Wan Ahmad Zainie [Mon, 21 Sep 2020 02:44:58 +0000 (10:44 +0800)]
dt-bindings: usb: Add Intel Keem Bay USB controller bindings
Binding description for Intel Keem Bay USB controller.
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Wan Ahmad Zainie <wan.ahmad.zainie.wan.mohamad@intel.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Tue, 29 Sep 2020 22:26:29 +0000 (15:26 -0700)]
usb: dwc3: gadget: Support up to max stream id
DWC3 IPs can use the maximum stream id (up to 2^16) specified by the
USB 3.x specs. Don't limit to stream id 2^15 only. Note that this does
not reflect the number of concurrent streams the controller handles
internally.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Oliver Neukum [Mon, 28 Sep 2020 14:17:55 +0000 (23:17 +0900)]
USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().
syzbot is reporting hung task at wdm_flush() [1], for there is a circular
dependency that wdm_flush() from flip_close() for /dev/cdc-wdm0 forever
waits for /dev/raw-gadget to be closed while close() for /dev/raw-gadget
cannot be called unless close() for /dev/cdc-wdm0 completes.
Tetsuo Handa considered that such circular dependency is an usage error [2]
which corresponds to an unresponding broken hardware [3]. But Alan Stern
responded that we should be prepared for such hardware [4]. Therefore,
this patch changes wdm_flush() to use wait_event_interruptible_timeout()
which gives up after 30 seconds, for hardware that remains silent must be
ignored. The 30 seconds are coming out of thin air.
Changing wait_event() to wait_event_interruptible_timeout() makes error
reporting from close() syscall less reliable. To compensate it, this patch
also implements wdm_fsync() which does not use timeout. Those who want to
be very sure that data has gone out to the device are now advised to call
fsync(), with a caveat that fsync() can return -EINVAL when running on
older kernels which do not implement wdm_fsync().
This patch also fixes three more problems (listed below) found during
exhaustive discussion and testing.
Since multiple threads can concurrently call wdm_write()/wdm_flush(),
we need to use wake_up_all() whenever clearing WDM_IN_USE in order to
make sure that all waiters are woken up. Also, error reporting needs
to use fetch-and-clear approach in order not to report same error for
multiple times.
Since wdm_flush() checks WDM_DISCONNECTING, wdm_write() should as well
check WDM_DISCONNECTING.
In wdm_flush(), since locks are not held, it is not safe to dereference
desc->intf after checking that WDM_DISCONNECTING is not set [5]. Thus,
remove dev_err() from wdm_flush().
[1] https://syzkaller.appspot.com/bug?id=
e7b761593b23eb50855b9ea31e3be5472b711186
[2] https://lkml.kernel.org/r/
27b7545e-8f41-10b8-7c02-
e35a08eb1611@i-love.sakura.ne.jp
[3] https://lkml.kernel.org/r/
79ba410f-e0ef-2465-b94f-
6b9a4a82adf5@i-love.sakura.ne.jp
[4] https://lkml.kernel.org/r/
20200530011040.GB12419@rowland.harvard.edu
[5] https://lkml.kernel.org/r/
c85331fc-874c-6e46-a77f-
0ef1dc075308@i-love.sakura.ne.jp
Reported-by: syzbot <syzbot+854768b99f19e89d7f81@syzkaller.appspotmail.com>
Cc: stable <stable@vger.kernel.org>
Co-developed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20200928141755.3476-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Petko Manolov [Sun, 27 Sep 2020 12:49:08 +0000 (15:49 +0300)]
net: pegasus: Use the new usb control message API.
The old usb_control_msg() let the caller handle the error and also did not
account for partial reads. Since these are now considered harmful, move the
driver over to usb_control_msg_recv/send() calls.
Added small note about why set_registers() can't be used to substitute
set_register().
Signed-off-by: Petko Manolov <petko.manolov@konsulko.com>
Acked-by: David S. Miller <davem@davemloft.net>
Link: https://lore.kernel.org/r/20200927124909.16380-2-petko.manolov@konsulko.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Petko Manolov [Sun, 27 Sep 2020 12:49:09 +0000 (15:49 +0300)]
net: rtl8150: Use the new usb control message API.
The old usb_control_msg() let the caller handle the error and also did not
account for partial reads. Since these are now considered harmful, move the
driver over to usb_control_msg_recv/send() calls.
Signed-off-by: Petko Manolov <petko.manolov@konsulko.com>
Acked-by: David S. Miller <davem@davemloft.net>
Link: https://lore.kernel.org/r/20200927124909.16380-3-petko.manolov@konsulko.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Heikki Krogerus [Mon, 28 Sep 2020 13:33:24 +0000 (16:33 +0300)]
usb: typec: displayport: Reduce noise from the driver
It's not an error if the mode can't be entered because
another mode is already active, so no longer printing an
error message if that happens.
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20200928133324.48841-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Alan Stern [Mon, 28 Sep 2020 15:22:17 +0000 (11:22 -0400)]
USB: hub: Add Kconfig option to reduce number of port initialization retries
Description based on one by Yasushi Asano:
According to 6.7.22 A-UUT “Device No Response” for connection timeout
of USB OTG and EH automated compliance plan v1.2, enumeration failure
has to be detected within 30 seconds. However, the old and new
enumeration schemes each make a total of 12 attempts, and each attempt
can take 5 seconds to time out, so the PET test fails.
This patch adds a new Kconfig option (CONFIG_USB_FEW_INIT_RETRIES);
when the option is set all the initialization retry loops except the
outermost are reduced to a single iteration. This reduces the total
number of attempts to four, allowing Linux hosts to pass the PET test.
The new option is disabled by default to preserve the existing
behavior. The reduced number of retries may fail to initialize a few
devices that currently do work, but for the most part there should be
no change. And in cases where the initialization does fail, it will
fail much more quickly.
Reported-and-tested-by: yasushi asano <yazzep@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20200928152217.GB134701@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Alan Stern [Mon, 28 Sep 2020 15:20:50 +0000 (11:20 -0400)]
USB: hub: Clean up use of port initialization schemes and retries
The SET_CONFIG_TRIES macro in hub.c is badly named; it controls the
number of port-initialization retry attempts rather than the number of
Set-Configuration attempts. Furthermore, the USE_NEW_SCHEME macro and
use_new_scheme() function are written in a very confusing manner,
making it almost impossible to figure out exactly what they do or
check that they are correct.
This patch renames SET_CONFIG_TRIES to PORT_INIT_TRIES, removes
USE_NEW_SCHEME entirely, and rewrites use_new_scheme() to be much more
transparent, with added comments explaining how it works. The patch
also pulls the single call site of use_new_scheme() out from the
Get-Descriptor retry loop (where it returns the same value each time)
and renames the local variable used to store the result.
The overall effect is a minor cleanup. However, there is one
functional change: If the "use_both_schemes" module parameter isn't
set (by default it is set), the existing code does only two retry
iterations. After this patch it will always perform four, regardless
of the parameter's value.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20200928152050.GA134701@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Thinh Nguyen [Thu, 1 Oct 2020 00:44:38 +0000 (17:44 -0700)]
usb: dwc3: gadget: Return early if no TRB update
If the transfer had already started and there's no TRB to update, then
there's no need to go through __dwc3_gadget_kick_transfer(). There is
no problem reissuing UPDATE_TRANSFER command. This change just saves
the driver from doing a few operations. This happens when we run out of
TRB and function driver still queues for more requests.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 1 Oct 2020 00:44:32 +0000 (17:44 -0700)]
usb: dwc3: gadget: Keep TRBs in request order
If we couldn't finish preparing all the TRBs of a request, don't prepare
the next request. Otherwise, the TRBs order will be mixed up and the
controller will process the wrong TRB. This is a corner case where
there's not enough TRBs for a request that needs the extra TRB but
there's still 1 available TRB in the pool.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 1 Oct 2020 00:44:25 +0000 (17:44 -0700)]
usb: dwc3: gadget: Revise setting IOC when no TRB left
To keep the setting of interrupt-on-completion (IOC) when out of TRBs
consistent and easier to read, the caller of dwc3_prepare_one_trb()
will determine if the TRB must have IOC bit set. This also reduces the
number of times we need to call dwc3_calc_trbs_left(). Note that we only
care about setting IOC from insufficient number of TRBs for SG and not
linear requests (because we don't need to split linear requests).
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 1 Oct 2020 00:44:19 +0000 (17:44 -0700)]
usb: dwc3: gadget: Look ahead when setting IOC
Previously if we run out of TRBs for the last SG entry that requires
an extra TRB, we set interrupt-on-completion (IOC) bit to an already
prepared TRB (i.e. HWO=1). This logic is not clean, and it's not a
typical way to prepare TRB. Also, this prevents showing IOC setup in
tracepoint when __dwc3_prepare_one_trb() is executed. Instead, let's
look ahead when preparing TRB to know whether to set the IOC bit before
the last SG entry. This requires adding a new parameter "must_interrupt"
to dwc3_prepare_one_trb().
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Tue, 29 Sep 2020 07:18:48 +0000 (00:18 -0700)]
usb: dwc3: gadget: Allow restarting a transfer
It's possible that there's no new TRBs prepared when kicking a transfer.
This happens when we need to stop and restart a transfer such as in the
case of reinitiating a stream or retrying isoc transfer. For streams,
sometime host may reject a stream and the device may need to reinitiate
that stream by stopping and restarting a transfer. In this case, all the
TRBs may have already been prepared. Allow the function
__dwc3_gadget_kick_transfer() to go through even though there's no new
TRB.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Tang Bin [Mon, 28 Sep 2020 12:00:51 +0000 (20:00 +0800)]
usb: bdc: remove duplicated error message
in case devm_platform_ioremap_resource() fails, that function already
prints a relevant error message which renders the driver's dev_err()
redundant. Let's remove the unnecessary message and, while at that,
also make sure to pass along the error value returned by
devm_platform_ioremap_resource() instead of always returning -ENOMEM.
Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
[balbi@kernel.org : improved commit log]
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Wesley Cheng [Tue, 29 Sep 2020 00:20:59 +0000 (17:20 -0700)]
usb: dwc3: Stop active transfers before halting the controller
In the DWC3 databook, for a device initiated disconnect or bus reset, the
driver is required to send dependxfer commands for any pending transfers.
In addition, before the controller can move to the halted state, the SW
needs to acknowledge any pending events. If the controller is not halted
properly, there is a chance the controller will continue accessing stale or
freed TRBs and buffers.
Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
Reviewed-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Thu, 10 Sep 2020 09:11:30 +0000 (17:11 +0800)]
usb: cdns3: gadget: enlarge the TRB ring length
At Android ADB and MTP use case, it uses f_fs which supports scatter list,
it means one request may need several TRBs for it. Besides, TRB consumes
very fast compared to TRB has prepared for above use case, there are at
most 120 pending requests, the date size is 16KB for each request, so four
TRBs (4KB per TRB) per sg entry at worst case. so we need to enlarge the
TRB ring length to avoid "no free TRB error". Since each TRB only consumes
12 bytes (3 * 32 bits), we enlarge the TRB length to 600, it leaves some
buffers for potential "no free TRB error", and only increases a little
memory cost.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Thu, 10 Sep 2020 09:11:29 +0000 (17:11 +0800)]
usb: cdns3: gadget: sg_support is only for DEV_VER_V2 or above
The scatter buffer list support earlier than DEV_VER_V2 is not
good enough, software can't know well about short transfer for it.
Cc: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Thu, 10 Sep 2020 09:11:28 +0000 (17:11 +0800)]
usb: cdns3: gadget: need to handle sg case for workaround 2 case
Add sg case for workaround 2, the workaround 2 is described at the
beginning of this file.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Thu, 10 Sep 2020 09:11:27 +0000 (17:11 +0800)]
usb: cdns3: gadget: handle sg list use case at completion correctly
- Judge each TRB has been handled at cdns3_trb_handled, since
the DMA pointer may be at the middle of the TD, we can't consider
this TD has finished at that time.
- Calculate req->actual according to finished TRBs.
- Handle short transfer for sg list use case correctly. When the
short transfer occurs, we check OUT_SMM at TRB to see if it is
the last TRB.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Thu, 10 Sep 2020 09:11:26 +0000 (17:11 +0800)]
usb: cdns3: gadget: add CHAIN and ISP bit for sg list use case
For sg buffer list use case, we need to add ISP for each TRB, and
add CHAIN bit for each TRB except for the last TRB.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Thu, 10 Sep 2020 09:11:24 +0000 (17:11 +0800)]
usb: cdns3: gadget: improve the dump TRB operation at cdns3_ep_run_transfer
It only dumps the first TRB per request, it is not useful if only dump
the first TRB when there are several TRBs per request. We improve it by
dumpping all TRBs per request in this commit.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Thu, 10 Sep 2020 09:11:23 +0000 (17:11 +0800)]
usb: cdns3: gadget: using correct sg operations
It needs to use request->num_mapped_sgs to indicate mapped sg number,
the request->num_sgs is the sg number before the mapping. These two
entries have different values for the platforms which iommu or
swiotlb is used. Besides, it needs to use correct sg APIs for
mapped sg list for TRB assignment.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Mauro Carvalho Chehab [Tue, 8 Sep 2020 07:20:57 +0000 (09:20 +0200)]
dt-bindings: document a new quirk for dwc3
At Hikey 970, setting the SPLIT disable at the General
User Register 3 is required.
Without that, the URBs generated by the usbhid driver
return -EPROTO errors. That causes the code at
hid-core.c to call hid_io_error(), which schedules
a reset_work, causing a call to hid_reset().
In turn, the code there will call:
usb_queue_reset_device(usbhid->intf);
The net result is that the input devices won't work, and
will be reset on every 0.5 seconds:
[ 33.122384] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0002
[ 33.378220] usb 1-1.1: reset low-speed USB device number 3 using xhci-hcd
[ 33.698394] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0000
[ 34.882365] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0002
[ 35.138217] usb 1-1.1: reset low-speed USB device number 3 using xhci-hcd
[ 35.458617] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0000
[ 36.642392] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0002
[ 36.898207] usb 1-1.1: reset low-speed USB device number 3 using xhci-hcd
[ 37.218598] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0000
[ 38.402368] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0002
[ 38.658174] usb 1-1.1: reset low-speed USB device number 3 using xhci-hcd
[ 38.978594] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0000
[ 40.162361] hub 1-1:1.0: state 7 ports 4 chg 0000 evt 0002
[ 40.418148] usb 1-1.1: reset low-speed USB device number 3 using xhci-hcd
...
[ 397.698132] usb 1-1.1: reset low-speed USB device number 3 using xhci-hcd
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Yu Chen [Tue, 8 Sep 2020 07:20:56 +0000 (09:20 +0200)]
usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc
SPLIT_BOUNDARY_DISABLE should be set for DesignWare USB3 DRD Core
of Hisilicon Kirin Soc when dwc3 core act as host.
[mchehab: dropped a dev_dbg() as only traces are now allowwed on this driver]
Signed-off-by: Yu Chen <chenyu56@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Tang Bin [Sun, 27 Sep 2020 13:53:04 +0000 (21:53 +0800)]
usb: bdc: Fix unused assignment in bdc_probe()
Delete unused initialized value of 'ret', because it will
be assigned by the function clk_prepare_enable().
Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Zqiang [Sun, 27 Sep 2020 08:01:16 +0000 (16:01 +0800)]
usb: gadget: uvc: Fix the wrong v4l2_device_unregister call
If an error occurred before calling the 'v4l2_device_register' func,
and then goto error, but no need to call 'v4l2_device_unregister'
func.
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:22:14 +0000 (01:22 -0700)]
usb: dwc3: gadget: Rename misleading function names
The functions dwc3_prepare_one_trb_sg and dwc3_prepare_one_trb_linear
are not necessarily preparing "one" TRB, it can prepare multiple TRBs.
Rename these functions as follow:
dwc3_prepare_one_trb_sg -> dwc3_prepare_trbs_sg
dwc3_prepare_one_trb_linear -> dwc3_prepare_trbs_linear
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:22:07 +0000 (01:22 -0700)]
usb: dwc3: gadget: Refactor preparing last TRBs
There are a lot of common codes for preparing SG and linear TRBs.
Refactor them for easier read.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:22:01 +0000 (01:22 -0700)]
usb: dwc3: gadget: Set IOC if not enough for extra TRBs
If we run out of TRBs because we need extra TRBs, make sure to set the
IOC bit for the previously prepared TRB to get completion notification
to free up TRBs to resume later.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:21:55 +0000 (01:21 -0700)]
usb: dwc3: gadget: Check for number of TRBs prepared
By returning the number of TRBs prepared, we know whether to execute
__dwc3_gadget_kick_transfer(). This allows us to check if we ran out of
TRBs when extra TRBs are needed for OUT transfers. It also allows us to
properly handle usb_gadget_map_request_by_dev() error.
Fixes:
c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:21:49 +0000 (01:21 -0700)]
usb: dwc3: gadget: Return the number of prepared TRBs
In preparation for fixing the check for number of remaining TRBs,
revise dwc3_prepare_one_trb_linear() and dwc3_prepare_one_trb_sg() to
return the number of prepared TRBs.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:21:43 +0000 (01:21 -0700)]
usb: dwc3: ep0: Fix ZLP for OUT ep0 requests
The current ZLP handling for ep0 requests is only for control IN
requests. For OUT direction, DWC3 needs to check and setup for MPS
alignment.
Usually, control OUT requests can indicate its transfer size via the
wLength field of the control message. So usb_request->zero is usually
not needed for OUT direction. To handle ZLP OUT for control endpoint,
make sure the TRB is MPS size.
Cc: stable@vger.kernel.org
Fixes:
c7fcdeb2627c ("usb: dwc3: ep0: simplify EP0 state machine")
Fixes:
d6e5a549cc4d ("usb: dwc3: simplify ZLP handling")
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:21:36 +0000 (01:21 -0700)]
usb: dwc3: gadget: Improve TRB ZLP setup
For OUT requests that requires extra TRBs for ZLP. We don't need to
prepare the 0-length TRB and simply prepare the MPS size TRB. This
reduces 1 TRB needed to prepare for ZLP.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:21:30 +0000 (01:21 -0700)]
usb: dwc3: gadget: Refactor preparing extra TRB
When the driver prepares the extra TRB, it uses bounce buffer. If we
just add a new parameter to dwc3_prepare_one_trb() to indicate this,
then we can refactor and simplify the driver quite a bit.
dwc3_prepare_one_trb() also checks if a request had been moved to the
started list. This is a prerequisite to subsequence patches improving
the handling of extra TRBs.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:21:24 +0000 (01:21 -0700)]
usb: dwc3: gadget: Reclaim extra TRBs after request completion
An SG request may be partially completed (due to no available TRBs).
Don't reclaim extra TRBs and clear the needs_extra_trb flag until the
request is fully completed. Otherwise, the driver will reclaim the wrong
TRB.
Cc: stable@vger.kernel.org
Fixes:
1f512119a08c ("usb: dwc3: gadget: add remaining sg entries to ring")
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 24 Sep 2020 08:21:18 +0000 (01:21 -0700)]
usb: dwc3: gadget: Check MPS of the request length
When preparing for SG, not all the entries are prepared at once. When
resume, don't use the remaining request length to calculate for MPS
alignment. Use the entire request->length to do that.
Cc: stable@vger.kernel.org
Fixes:
5d187c0454ef ("usb: dwc3: gadget: Don't setup more than requested")
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Chunfeng Yun [Mon, 14 Sep 2020 06:17:30 +0000 (14:17 +0800)]
usb: gadget: bcm63xx_udc: fix up the error of undeclared usb_debug_root
Fix up the build error caused by undeclared usb_debug_root
Cc: stable <stable@vger.kernel.org>
Fixes:
a66ada4f241c ("usb: gadget: bcm63xx_udc: create debugfs directory under usb root")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thierry Reding [Thu, 6 Aug 2020 16:04:17 +0000 (18:04 +0200)]
usb: gadget: tegra-xudc: Do not print errors on probe deferral
Probe deferral is an expected condition and can happen multiple times
during boot. Make sure not to output an error message in that case
because they are not useful.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thierry Reding [Thu, 6 Aug 2020 16:04:16 +0000 (18:04 +0200)]
usb: gadget: tegra-xudc: Properly align parameters
Align parameters on subsequent lines with the parameters on the first
line for consistency.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Colin Ian King [Wed, 5 Aug 2020 13:14:58 +0000 (14:14 +0100)]
usb: gadget: fix spelling mistake "Dectected" -> "Detected"
There is a spelling mistake in a literal string. Fix it.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thierry Reding [Thu, 6 Aug 2020 16:04:15 +0000 (18:04 +0200)]
usb: gadget: tegra-xudc: Use consistent spelling and formatting
Make sure to use consistent spelling and formatting in error messages.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Christophe JAILLET [Sun, 9 Aug 2020 07:29:48 +0000 (09:29 +0200)]
usb: gadget: tegra-xudc: Avoid GFP_ATOMIC where it is not needed
There is no need to use GFP_ATOMIC here. It is a probe function, no
spinlock is taken.
Reviewed-by: JC Kuo <jckuo@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Tue, 11 Aug 2020 02:00:26 +0000 (10:00 +0800)]
usb: gadget: core: do not try to disconnect gadget if it is not connected
Current UDC core connects gadget during the loading gadget flow
(udc_bind_to_driver->usb_udc_connect_control), but for
platforms which do not connect gadget if the VBUS is not there,
they call usb_gadget_disconnect, but the gadget is not connected
at this time, notify disconnecton for the gadget driver is meaningless
at this situation.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Thinh Nguyen [Thu, 30 Jul 2020 23:29:03 +0000 (16:29 -0700)]
usb: dwc3: gadget: Refactor ep command completion
Refactor END_TRANSFER command completion handling and move it outside of
the switch statement to its own function. This makes it cleaner and
consistent with other event handler functions. No functional change
here.
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Krzysztof Kozlowski [Fri, 31 Jul 2020 07:41:22 +0000 (09:41 +0200)]
usb: gadget: s3c: Remove unused 'udc' variable
Remove unused 'udc' variable to fix compile warnings:
drivers/usb/gadget/udc/s3c2410_udc.c: In function 's3c2410_udc_dequeue':
drivers/usb/gadget/udc/s3c2410_udc.c:1268:22: warning: variable 'udc' set but not used [-Wunused-but-set-variable]
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Li Jun [Wed, 22 Jul 2020 09:02:55 +0000 (17:02 +0800)]
usb: dwc3: debugfs: do not queue work if try to change mode on non-drd
Do not try to queue a drd work for change mode if the port is not a drd,
this is to avoid below kernel dump:
[ 60.115529] ------------[ cut here ]------------
[ 60.120166] WARNING: CPU: 1 PID: 627 at kernel/workqueue.c:1473
__queue_work+0x46c/0x520
[ 60.128254] Modules linked in:
[ 60.131313] CPU: 1 PID: 627 Comm: sh Not tainted
5.7.0-rc4-00022-g914a586-dirty #135
[ 60.139054] Hardware name: NXP i.MX8MQ EVK (DT)
[ 60.143585] pstate:
a0000085 (NzCv daIf -PAN -UAO)
[ 60.148376] pc : __queue_work+0x46c/0x520
[ 60.152385] lr : __queue_work+0x314/0x520
[ 60.156393] sp :
ffff8000124ebc40
[ 60.159705] x29:
ffff8000124ebc40 x28:
ffff800011808018
[ 60.165018] x27:
ffff800011819ef8 x26:
ffff800011d39980
[ 60.170331] x25:
ffff800011808018 x24:
0000000000000100
[ 60.175643] x23:
0000000000000013 x22:
0000000000000001
[ 60.180955] x21:
ffff0000b7c08e00 x20:
ffff0000b6c31080
[ 60.186267] x19:
ffff0000bb99bc00 x18:
0000000000000000
[ 60.191579] x17:
0000000000000000 x16:
0000000000000000
[ 60.196891] x15:
0000000000000000 x14:
0000000000000000
[ 60.202202] x13:
0000000000000000 x12:
0000000000000000
[ 60.207515] x11:
0000000000000000 x10:
0000000000000040
[ 60.212827] x9 :
ffff800011d55460 x8 :
ffff800011d55458
[ 60.218138] x7 :
ffff0000b7800028 x6 :
0000000000000000
[ 60.223450] x5 :
ffff0000b7800000 x4 :
0000000000000000
[ 60.228762] x3 :
ffff0000bb997cc0 x2 :
0000000000000001
[ 60.234074] x1 :
0000000000000000 x0 :
ffff0000b6c31088
[ 60.239386] Call trace:
[ 60.241834] __queue_work+0x46c/0x520
[ 60.245496] queue_work_on+0x6c/0x90
[ 60.249075] dwc3_set_mode+0x48/0x58
[ 60.252651] dwc3_mode_write+0xf8/0x150
[ 60.256489] full_proxy_write+0x5c/0xa8
[ 60.260327] __vfs_write+0x18/0x40
[ 60.263729] vfs_write+0xdc/0x1c8
[ 60.267045] ksys_write+0x68/0xf0
[ 60.270360] __arm64_sys_write+0x18/0x20
[ 60.274286] el0_svc_common.constprop.0+0x68/0x160
[ 60.279077] do_el0_svc+0x20/0x80
[ 60.282394] el0_sync_handler+0x10c/0x178
[ 60.286403] el0_sync+0x140/0x180
[ 60.289716] ---[ end trace
70b155582e2b7988 ]---
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Li Jun [Tue, 28 Jul 2020 12:42:41 +0000 (20:42 +0800)]
usb: dwc3: core: add phy cleanup for probe error handling
Add the phy cleanup if dwc3 mode init fail, which is the missing part of
de-init for dwc3 core init.
Fixes:
c499ff71ff2a ("usb: dwc3: core: re-factor init and exit paths")
Cc: <stable@vger.kernel.org>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Li Jun [Tue, 28 Jul 2020 12:42:40 +0000 (20:42 +0800)]
usb: dwc3: core: don't trigger runtime pm when remove driver
No need to trigger runtime pm in driver removal, otherwise if user
disable auto suspend via sys file, runtime suspend may be entered,
which will call dwc3_core_exit() again and there will be clock disable
not balance warning:
[ 2026.820154] xhci-hcd xhci-hcd.0.auto: remove, state 4
[ 2026.825268] usb usb2: USB disconnect, device number 1
[ 2026.831017] xhci-hcd xhci-hcd.0.auto: USB bus 2 deregistered
[ 2026.836806] xhci-hcd xhci-hcd.0.auto: remove, state 4
[ 2026.842029] usb usb1: USB disconnect, device number 1
[ 2026.848029] xhci-hcd xhci-hcd.0.auto: USB bus 1 deregistered
[ 2026.865889] ------------[ cut here ]------------
[ 2026.870506] usb2_ctrl_root_clk already disabled
[ 2026.875082] WARNING: CPU: 0 PID: 731 at drivers/clk/clk.c:958
clk_core_disable+0xa0/0xa8
[ 2026.883170] Modules linked in: dwc3(-) phy_fsl_imx8mq_usb [last
unloaded: dwc3]
[ 2026.890488] CPU: 0 PID: 731 Comm: rmmod Not tainted
5.8.0-rc7-00280-g9d08cca-dirty #245
[ 2026.898489] Hardware name: NXP i.MX8MQ EVK (DT)
[ 2026.903020] pstate:
20000085 (nzCv daIf -PAN -UAO BTYPE=--)
[ 2026.908594] pc : clk_core_disable+0xa0/0xa8
[ 2026.912777] lr : clk_core_disable+0xa0/0xa8
[ 2026.916958] sp :
ffff8000121b39a0
[ 2026.920271] x29:
ffff8000121b39a0 x28:
ffff0000b11f3700
[ 2026.925583] x27:
0000000000000000 x26:
ffff0000b539c700
[ 2026.930895] x25:
000001d7e44e1232 x24:
ffff0000b76fa800
[ 2026.936208] x23:
ffff0000b76fa6f8 x22:
ffff800008d01040
[ 2026.941520] x21:
ffff0000b539ce00 x20:
ffff0000b7105000
[ 2026.946832] x19:
ffff0000b7105000 x18:
0000000000000010
[ 2026.952144] x17:
0000000000000001 x16:
0000000000000000
[ 2026.957456] x15:
ffff0000b11f3b70 x14:
ffffffffffffffff
[ 2026.962768] x13:
ffff8000921b36f7 x12:
ffff8000121b36ff
[ 2026.968080] x11:
ffff8000119e1000 x10:
ffff800011bf26d0
[ 2026.973392] x9 :
0000000000000000 x8 :
ffff800011bf3000
[ 2026.978704] x7 :
ffff800010695d68 x6 :
0000000000000252
[ 2026.984016] x5 :
ffff0000bb9881f0 x4 :
0000000000000000
[ 2026.989327] x3 :
0000000000000027 x2 :
0000000000000023
[ 2026.994639] x1 :
ac2fa471aa7cab00 x0 :
0000000000000000
[ 2026.999951] Call trace:
[ 2027.002401] clk_core_disable+0xa0/0xa8
[ 2027.006238] clk_core_disable_lock+0x20/0x38
[ 2027.010508] clk_disable+0x1c/0x28
[ 2027.013911] clk_bulk_disable+0x34/0x50
[ 2027.017758] dwc3_core_exit+0xec/0x110 [dwc3]
[ 2027.022122] dwc3_suspend_common+0x84/0x188 [dwc3]
[ 2027.026919] dwc3_runtime_suspend+0x74/0x9c [dwc3]
[ 2027.031712] pm_generic_runtime_suspend+0x28/0x40
[ 2027.036419] genpd_runtime_suspend+0xa0/0x258
[ 2027.040777] __rpm_callback+0x88/0x140
[ 2027.044526] rpm_callback+0x20/0x80
[ 2027.048015] rpm_suspend+0xd0/0x418
[ 2027.051503] __pm_runtime_suspend+0x58/0xa0
[ 2027.055693] dwc3_runtime_idle+0x7c/0x90 [dwc3]
[ 2027.060224] __rpm_callback+0x88/0x140
[ 2027.063973] rpm_idle+0x78/0x150
[ 2027.067201] __pm_runtime_idle+0x58/0xa0
[ 2027.071130] dwc3_remove+0x64/0xc0 [dwc3]
[ 2027.075140] platform_drv_remove+0x28/0x48
[ 2027.079239] device_release_driver_internal+0xf4/0x1c0
[ 2027.084377] driver_detach+0x4c/0xd8
[ 2027.087954] bus_remove_driver+0x54/0xa8
[ 2027.091877] driver_unregister+0x2c/0x58
[ 2027.095799] platform_driver_unregister+0x10/0x18
[ 2027.100509] dwc3_driver_exit+0x14/0x1408 [dwc3]
[ 2027.105129] __arm64_sys_delete_module+0x178/0x218
[ 2027.109922] el0_svc_common.constprop.0+0x68/0x160
[ 2027.114714] do_el0_svc+0x20/0x80
[ 2027.118031] el0_sync_handler+0x88/0x190
[ 2027.121953] el0_sync+0x140/0x180
[ 2027.125267] ---[ end trace
027f4f8189958f1f ]---
[ 2027.129976] ------------[ cut here ]------------
Fixes:
fc8bb91bc83e ("usb: dwc3: implement runtime PM")
Cc: <stable@vger.kernel.org>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Fri, 21 Aug 2020 02:55:49 +0000 (10:55 +0800)]
Revert "usb: udc: allow adding and removing the same gadget device"
We have already allocated gadget structure dynamically at UDC (dwc3)
driver, so commit
fac323471df6 ("usb: udc: allow adding and removing
the same gadget device")could be reverted.
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Fri, 21 Aug 2020 02:55:48 +0000 (10:55 +0800)]
usb: dwc3: allocate gadget structure dynamically
The current code uses commit
fac323471df6 ("usb: udc: allow adding
and removing the same gadget device") as the workaround to let
the gadget device is re-used, but it is not allowed from driver
core point. In this commit, we allocate gadget structure dynamically,
and free it at its release function. Since the gadget device's
driver_data has already occupied by usb_composite_dev structure, we have
to use gadget device's platform data to store dwc3 structure.
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Fri, 21 Aug 2020 02:55:47 +0000 (10:55 +0800)]
usb: cdns3: gadget: fix possible memory leak
If cdns3_gadget_start is failed, it never frees cdns3_device structure.
Meanwhile, there is no release function for gadget device, it causes
there is no sync with driver core.
To fix this, we add release function for gadget device, and free
cdns3_device structure at there. Meanwhile, With the new UDC core
APIs, we could work with driver core better to handle memory leak
issue.
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Alan Stern [Fri, 21 Aug 2020 02:55:46 +0000 (10:55 +0800)]
USB: UDC: net2272: Fix memory leaks
Like net2280 (on which it was based), the net2272 UDC driver has a
problem with leaking memory along some of its failure pathways. It
also has another problem, not previously noted, in that some of the
failure pathways will call usb_del_gadget_udc() without first calling
usb_add_gadget_udc_release(). And it leaks memory by calling kfree()
when it should call put_device().
Until now it has been impossible to handle the memory leaks, because of
lack of support in the UDC core for separately initializing and adding
gadgets, or for separately deleting and freeing gadgets. An earlier
patch in this series adds the necessary support, making it possible to
fix the outstanding problems properly.
This patch adds an "added" flag to the net2272 structure to indicate
whether or not the gadget has been registered (and thus whether or not
to call usb_del_gadget()), and it fixes the deallocation issues by
calling usb_put_gadget() at the appropriate places.
A similar memory leak issue, apparently never before recognized, stems
from the fact that the driver never initializes the drvdata field in
the gadget's embedded struct device! Evidently this wasn't noticed
because the pointer is only ever used as an argument to kfree(), which
doesn't mind getting called with a NULL pointer. In fact, the drvdata
for gadget device will be written by usb_composite_dev structure if
any gadget class is loaded, so it needs to use usb_gadget structure
to get net2280 private data.
CC: Anton Vasilyev <vasilyev@ispras.ru>
CC: Evgeny Novikov <novikov@ispras.ru>
CC: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Alan Stern [Fri, 21 Aug 2020 02:55:45 +0000 (10:55 +0800)]
USB: UDC: net2280: Fix memory leaks
As Anton and Evgeny have noted, the net2280 UDC driver has a problem
with leaking memory along some of its failure pathways. It also has
another problem, not previously noted, in that some of the failure
pathways will call usb_del_gadget_udc() without first calling
usb_add_gadget_udc_release(). And it leaks memory by calling kfree()
when it should call put_device().
Previous attempts to fix the problems have failed because of lack of
support in the UDC core for separately initializing and adding
gadgets, or for separately deleting and freeing gadgets. The previous
patch in this series adds the necessary support, making it possible to
fix the outstanding problems properly.
This patch adds an "added" flag to the net2280 structure to indicate
whether or not the gadget has been registered (and thus whether or not
to call usb_del_gadget()), and it fixes the deallocation issues by
calling usb_put_gadget() at the appropriate point.
A similar memory leak issue, apparently never before recognized, stems
from the fact that the driver never initializes the drvdata field in
the gadget's embedded struct device! Evidently this wasn't noticed
because the pointer is only ever used as an argument to kfree(), which
doesn't mind getting called with a NULL pointer. In fact, the drvdata
for gadget device will be written by usb_composite_dev structure if
any gadget class is loaded, so it needs to use usb_gadget structure
to get net2280 private data.
CC: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reported-by: Anton Vasilyev <vasilyev@ispras.ru>
Reported-by: Evgeny Novikov <novikov@ispras.ru>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Alan Stern [Fri, 21 Aug 2020 02:55:44 +0000 (10:55 +0800)]
USB: UDC: Expand device model API interface
The routines used by the UDC core to interface with the kernel's
device model, namely usb_add_gadget_udc(),
usb_add_gadget_udc_release(), and usb_del_gadget_udc(), provide access
to only a subset of the device model's full API. They include
functionality equivalent to device_register() and device_unregister()
for gadgets, but they omit device_initialize(), device_add(),
device_del(), get_device(), and put_device().
This patch expands the UDC API by adding usb_initialize_gadget(),
usb_add_gadget(), usb_del_gadget(), usb_get_gadget(), and
usb_put_gadget() to fill in the gap. It rewrites the existing
routines to call the new ones.
CC: Anton Vasilyev <vasilyev@ispras.ru>
CC: Evgeny Novikov <novikov@ispras.ru>
CC: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Fri, 21 Aug 2020 03:14:37 +0000 (11:14 +0800)]
usb: cdns3: gadget: fix some endian issues
It is found by sparse.
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Ye Bin [Mon, 24 Aug 2020 08:42:34 +0000 (16:42 +0800)]
usb: gadget: fsl: Fix unsigned expression compared with zero in fsl_udc_probe
udc_controller->irq is "unsigned int" always >= 0, but platform_get_irq may
return little than zero. So "dc_controller->irq < 0" condition is never
accessible.
Acked-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Lorenzo Colitti [Tue, 18 Aug 2020 16:19:49 +0000 (01:19 +0900)]
usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well
The u_ether driver has a qmult setting that multiplies the
transmit queue length (which by default is 2).
The intent is that it should be enabled at high/super speed, but
because the code does not explicitly check for USB_SUPER_PLUS,
it is disabled at that speed.
Fix this by ensuring that the queue multiplier is enabled for any
wired link at high speed or above. Using >= for USB_SPEED_*
constants seems correct because it is what the gadget_is_xxxspeed
functions do.
The queue multiplier substantially helps performance at higher
speeds. On a direct SuperSpeed Plus link to a Linux laptop,
iperf3 single TCP stream:
Before (qmult=1): 1.3 Gbps
After (qmult=5): 3.2 Gbps
Fixes:
04617db7aa68 ("usb: gadget: add SS descriptors to Ethernet gadget")
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Yoshihiro Shimoda [Wed, 9 Sep 2020 00:01:32 +0000 (09:01 +0900)]
usb: gadget: u_serial: clear suspended flag when disconnecting
The commit
aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume
callbacks") set/cleared the suspended flag in USB bus suspend/resume
only. But, when a USB cable is disconnected in the suspend, since some
controllers will not detect USB bus resume, the suspended flag is not
cleared. After that, user cannot send any data. To fix the issue,
clears the suspended flag in the gserial_disconnect().
Fixes:
aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Linh Phung <linh.phung.jy@renesas.com>
Tested-by: Tam Nguyen <tam.nguyen.xa@renesas.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Randy Dunlap [Wed, 9 Sep 2020 00:57:19 +0000 (17:57 -0700)]
usb: phy: phy-ab8500-usb: fix spello of "function"
Fix typo/spello of "function".
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: linux-usb@vger.kernel.org
Cc: Jiri Kosina <trivial@kernel.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Lorenzo Colitti [Tue, 25 Aug 2020 05:55:05 +0000 (14:55 +0900)]
usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
Currently, enabling f_ncm at SuperSpeed Plus speeds results in an
oops in config_ep_by_speed because ncm_set_alt passes in NULL
ssp_descriptors. Fix this by re-using the SuperSpeed descriptors.
This is safe because usb_assign_descriptors calls
usb_copy_descriptors.
Tested: enabled f_ncm on a dwc3 gadget and 10Gbps link, ran iperf
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Lorenzo Colitti [Tue, 25 Aug 2020 05:55:04 +0000 (14:55 +0900)]
usb: gadget: f_ncm: set SuperSpeed bulk descriptor bMaxBurst to 15
This improves performance on fast connections. When directly
connecting to a Linux laptop running 5.6, single-stream iperf3
goes from ~1.7Gbps to ~2.3Gbps out, and from ~620Mbps to ~720Mbps
in.
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Lorenzo Colitti [Tue, 25 Aug 2020 05:55:03 +0000 (14:55 +0900)]
usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above.
Currently, SuperSpeed NCM gadgets report a speed of 851 Mbps
in USB_CDC_NOTIFY_SPEED_CHANGE. But the calculation appears to
assume 16 packets per microframe, and USB 3 and above no longer
use microframes.
Maximum speed is actually much higher. On a direct connection,
theoretical throughput is at most 3.86 Gbps for gen1x1 and
9.36 Gbps for gen2x1, and I have seen gadget->host iperf
throughput of >2 Gbps for gen1x1 and >4 Gbps for gen2x1.
Unfortunately the ConnectionSpeedChange defined in the CDC spec
only uses 32-bit values, so we can't report accurate numbers for
10Gbps and above. So, report 3.75Gbps for SuperSpeed (which is
roughly maximum theoretical performance) and 4.25Gbps for
SuperSpeed Plus (which is close to the maximum that we can report
in a 32-bit unsigned integer).
This results in:
[50879.191272] cdc_ncm 2-2:1.0 enx228b127e050c: renamed from usb0
[50879.234778] cdc_ncm 2-2:1.0 enx228b127e050c: 3750 mbit/s downlink 3750 mbit/s uplink
on SuperSpeed and:
[50798.434527] cdc_ncm 8-2:1.0 enx228b127e050c: renamed from usb0
[50798.524278] cdc_ncm 8-2:1.0 enx228b127e050c: 4250 mbit/s downlink 4250 mbit/s uplink
on SuperSpeed Plus.
Fixes:
1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors for CDC NCM")
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Tue, 1 Sep 2020 02:33:52 +0000 (10:33 +0800)]
usb: cdns3: gadget: move wait configuration operation
After commit
f4cfe5ce607d ("usb: cdns3: gadget: improve the
set_configuration handling"), the software will inform the
hardware the request has finished at cdns3_ep0_complete_setup.
The configuration set bit is only set after request has finished,
so it needs to move waiting operation after that. Meanwhile,
if it is timeout, it will show warning message and return error.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Tue, 1 Sep 2020 02:33:51 +0000 (10:33 +0800)]
usb: cdns3: drd: call PHY .set_mode accordingly
Some PHYs may need to enter related mode, and do some settings.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Tue, 1 Sep 2020 02:33:50 +0000 (10:33 +0800)]
usb: cdns3: gadget: clear the interrupt status when disconnect the host
It is meaningless to handle any interrupts after disconnecting
with host
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Tue, 1 Sep 2020 02:33:49 +0000 (10:33 +0800)]
usb: cdns3: gadget: set fast access bit
Below is the recommendation from Cadence designer:
Using this bit to be sure that PHY clock is keeping up in active
state. It's good to keep Fast Access bit enabled as long as there
is any access to USB register.
It is used to fix the potential ARM core hang when visit controller
register after DEVDS (.pullup is cleared) is set, the threaded irq
may be scheduled at that time.
Cc: Pawel Laszczak <pawell@cadence.com>
Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Tue, 1 Sep 2020 02:33:48 +0000 (10:33 +0800)]
usb: cdns3: core: quit if it uses role switch class
If the board uses role switch class for switching the role, it should
not depends on SoC OTG hardware siginal any more, so quit early.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Raymond Tan [Fri, 21 Aug 2020 13:11:01 +0000 (16:11 +0300)]
usb: dwc3: pci: Allow Elkhart Lake to utilize DSM method for PM functionality
Similar to some other IA platforms, Elkhart Lake too depends on the
PMU register write to request transition of Dx power state.
Thus, we add the PCI_DEVICE_ID_INTEL_EHLLP to the list of devices that
shall execute the ACPI _DSM method during D0/D3 sequence.
[heikki.krogerus@linux.intel.com: included Fixes tag]
Fixes:
dbb0569de852 ("usb: dwc3: pci: Add Support for Intel Elkhart Lake Devices")
Cc: stable@vger.kernel.org
Signed-off-by: Raymond Tan <raymond.tan@intel.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Marc Zyngier [Mon, 14 Sep 2020 13:06:34 +0000 (14:06 +0100)]
usb: dwc2: Always disable regulators on driver teardown
If the dwc2 driver fails to probe after having enabled the regulators,
it ends up being unregistered with regulators enabled, something the
core regulator code is legitimately upset about:
dwc2
ff400000.usb: supply vusb_d not found, using dummy regulator
dwc2
ff400000.usb: supply vusb_a not found, using dummy regulator
dwc2
ff400000.usb: dwc2_core_reset: HANG! AHB Idle timeout GRSTCTL GRSTCTL_AHBIDLE
WARNING: CPU: 2 PID: 112 at drivers/regulator/core.c:2074 _regulator_put.part.0+0x16c/0x174
Modules linked in: dwc2(E+) dwc3(E) udc_core(E) rtc_hym8563(E) dwmac_generic(E) ulpi(E) usbcore(E) dwc3_meson_g12a(E) roles(E) meson_gx_mmc(E+) i2c_meson(E) mdio_mux_meson_g12a(E) mdio_mux(E) dwmac_meson8b(E) stmmac_platform(E) stmmac(E) mdio_xpcs(E) phylink(E) of_mdio(E) fixed_phy(E) libphy(E) pwm_regulator(E) fixed(E)
CPU: 2 PID: 112 Comm: systemd-udevd Tainted: G E 5.9.0-rc4-00102-g423583bc8cf9 #1840
Hardware name: amlogic w400/w400, BIOS 2020.04 05/22/2020
pstate:
80400009 (Nzcv daif +PAN -UAO BTYPE=--)
pc : _regulator_put.part.0+0x16c/0x174
lr : regulator_bulk_free+0x6c/0x9c
sp :
ffffffc012353820
x29:
ffffffc012353820 x28:
ffffff805a4b7000
x27:
ffffff8059c2eac0 x26:
ffffff8059c2e810
x25:
ffffff805a4b7d00 x24:
ffffffc008cf3028
x23:
ffffffc011729ef8 x22:
ffffff807e2761d8
x21:
ffffffc01171df78 x20:
ffffff805a4b7700
x19:
ffffff805a4b7700 x18:
0000000000000030
x17:
0000000000000000 x16:
0000000000000000
x15:
ffffff807ea8d178 x14:
3935312820435455
x13:
2038323a36313a37 x12:
ffffffffffffffff
x11:
0000000000000040 x10:
0000000000000007
x9 :
ffffffc0106f77d0 x8 :
ffffffffffffffe0
x7 :
ffffffffffffffff x6 :
0000000000017702
x5 :
ffffff805a4b7400 x4 :
0000000000000000
x3 :
ffffffc01171df78 x2 :
ffffff807ea8cc40
x1 :
0000000000000000 x0 :
0000000000000001
Call trace:
_regulator_put.part.0+0x16c/0x174
regulator_bulk_free+0x6c/0x9c
devm_regulator_bulk_release+0x28/0x3c
release_nodes+0x1c8/0x2c0
devres_release_all+0x44/0x6c
really_probe+0x1ec/0x504
driver_probe_device+0x100/0x170
device_driver_attach+0xcc/0xd4
__driver_attach+0xb0/0x17c
bus_for_each_dev+0x7c/0xd4
driver_attach+0x30/0x3c
bus_add_driver+0x154/0x250
driver_register+0x84/0x140
__platform_driver_register+0x54/0x60
dwc2_platform_driver_init+0x2c/0x1000 [dwc2]
do_one_initcall+0x54/0x2d0
do_init_module+0x68/0x29c
In order to fix this, tie the regulator disabling to the teardown
process by registering a devm action callback. This makes sure that
the regulators are disabled at the right time (just before they are
released).
Cc: Minas Harutyunyan <hminas@synopsys.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Pawel Laszczak [Fri, 18 Sep 2020 08:30:35 +0000 (10:30 +0200)]
usb: gadget: config_ep_by_speed_and_alt instead of config_ep_by_speed
This patch replace config_ep_by_speed with config_ep_by_speed_and_alt.
This change allows to select proper usb_ss_ep_comp_descriptor for each
stream capable endpoints.
f_tcm function for SS use array of headers for both BOT/UAS alternate
setting:
static struct usb_descriptor_header *uasp_ss_function_desc[] = {
(struct usb_descriptor_header *) &bot_intf_desc,
(struct usb_descriptor_header *) &uasp_ss_bi_desc,
(struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
(struct usb_descriptor_header *) &uasp_ss_bo_desc,
(struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
(struct usb_descriptor_header *) &uasp_intf_desc,
(struct usb_descriptor_header *) &uasp_ss_bi_desc,
(struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
(struct usb_descriptor_header *) &uasp_ss_bo_desc,
(struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
(struct usb_descriptor_header *) &uasp_ss_status_desc,
(struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
(struct usb_descriptor_header *) &uasp_status_pipe_desc,
(struct usb_descriptor_header *) &uasp_ss_cmd_desc,
(struct usb_descriptor_header *) &uasp_cmd_comp_desc,
(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
NULL,
};
The first 5 descriptors are associated with BOT alternate setting,
and others are associated with UAS.
During handling UAS alternate setting f_tcm driver invokes
config_ep_by_speed and this function sets incorrect companion endpoint
descriptor in usb_ep object.
Instead setting ep->comp_desc to uasp_bi_ep_comp_desc function in this
case set ep->comp_desc to bot_uasp_ss_bi_desc.
And in result it uses the descriptor from BOT alternate setting
instead UAS.
Finally, it causes that controller driver during enabling endpoints
detect that just enabled endpoint for bot.
Signed-off-by: Jayshri Pawar <jpawar@cadence.com>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Qinglang Miao [Sat, 19 Sep 2020 02:52:08 +0000 (10:52 +0800)]
usb: gadget: lpc32xx_udc: Convert to DEFINE_SHOW_ATTRIBUTE
Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code.
Acked-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Christian Lamparter [Sun, 20 Sep 2020 00:18:50 +0000 (02:18 +0200)]
usb: dwc2: add support for APM82181 USB OTG
adds the specific compatible string for the DWC2 IP found in the APM82181
SoCs. The IP is setup correctly through the auto detection... With the
exception of the AHB Burst Size. The default of GAHBCFG_HBSTLEN_INCR4 of
the "snps,dwc2" can cause a system hang when the USB and SATA is used
concurrently. Because the predecessor (PPC460EX (Canyonlands)) already
had the same problem, this SoC can make use of the existing
dwc2_set_amcc_params() function.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Christian Lamparter [Sun, 20 Sep 2020 00:18:49 +0000 (02:18 +0200)]
dt-bindings: usb: dwc2: add support for APM82181 SoCs USB OTG HS and FS
adds the specific compatible string for the DWC2 IP found in the APM82181
SoCs. The APM82181's USB-OTG seems like it was taken from its direct
predecessor: the PPC460EX (canyonlands).
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Bryan O'Donoghue [Sun, 20 Sep 2020 17:01:58 +0000 (18:01 +0100)]
USB: gadget: f_ncm: Fix NDP16 datagram validation
commit
2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()")
adds important bounds checking however it unfortunately also introduces a
bug with respect to section 3.3.1 of the NCM specification.
wDatagramIndex[1] : "Byte index, in little endian, of the second datagram
described by this NDP16. If zero, then this marks the end of the sequence
of datagrams in this NDP16."
wDatagramLength[1]: "Byte length, in little endian, of the second datagram
described by this NDP16. If zero, then this marks the end of the sequence
of datagrams in this NDP16."
wDatagramIndex[1] and wDatagramLength[1] respectively then may be zero but
that does not mean we should throw away the data referenced by
wDatagramIndex[0] and wDatagramLength[0] as is currently the case.
Breaking the loop on (index2 == 0 || dg_len2 == 0) should come at the end
as was previously the case and checks for index2 and dg_len2 should be
removed since zero is valid.
I'm not sure how much testing the above patch received but for me right now
after enumeration ping doesn't work. Reverting the commit restores ping,
scp, etc.
The extra validation associated with wDatagramIndex[0] and
wDatagramLength[0] appears to be valid so, this change removes the incorrect
restriction on wDatagramIndex[1] and wDatagramLength[1] restoring data
processing between host and device.
Fixes:
2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()")
Cc: Ilja Van Sprundel <ivansprundel@ioactive.com>
Cc: Brooke Basile <brookebasile@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Pawel Laszczak [Tue, 15 Sep 2020 11:45:43 +0000 (14:45 +0300)]
usb: cdns3: Enable workaround for USB2.0 PHY Rx compliance test PHY lockup
USB2.0 PHY hangs in Rx Compliance test when the incoming packet
amplitude is varied below and above the Squelch Level of
Receiver during the active packet multiple times.
Version 1 of the controller allows PHY to be reset when RX fail condition
is detected to work around the above issue. This feature is
disabled by default and needs to be enabled using a bit from
the newly added PHYRST_CFG register. This patch enables the workaround.
There is no way to know controller version before device controller
is started and the workaround needs to be applied for both host and
device modes, so we rely on a DT property do decide when to
apply the workaround.
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Roger Quadros [Tue, 15 Sep 2020 11:45:42 +0000 (14:45 +0300)]
dt-bindings: usb: cdns,usb3: Add cdns,phyrst-a-enable property
Controller version 0x0002450D has USB2 PHY RX sensitivity issues
that needs to be worked around by enabling phyrst-a-enable bit
in PHYRST_CFG register.
There is no way to know controller version before device controller
is started and the workaround needs to be applied for both host and
device modes, so we add this DT property.
Signed-off-by: Roger Quadros <rogerq@ti.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Roger Quadros [Tue, 15 Sep 2020 11:45:41 +0000 (14:45 +0300)]
dt-bindings: usb: Convert cdns-usb3.txt to YAML schema
Converts cdns-usb3.txt to YAML schema cdns,usb3.yaml
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Neil Armstrong [Thu, 17 Sep 2020 06:59:47 +0000 (08:59 +0200)]
usb: dwc-meson-g12a: Add support for USB on AXG SoCs
The Amlogic AXG is close to the GXL Glue but with a single OTG PHY.
It needs the same init sequence as GXL & GXM, but it seems it doesn't need
the host disconnect bit.
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Neil Armstrong [Thu, 17 Sep 2020 06:59:46 +0000 (08:59 +0200)]
dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: add the Amlogic AXG Families USB Glue Bindings
The Amlogic AXG is close to the GXL Glue but with a single OTG PHY.
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Lad Prabhakar [Fri, 28 Aug 2020 07:50:19 +0000 (08:50 +0100)]
dt-bindings: usb: renesas,usb-xhci: Document r8a774e1 support
Document r8a774e1 xhci support. The driver will use the fallback
compatible string "renesas,rcar-gen3-xhci", therefore no driver
change is needed.
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Marian-Cristian Rotariu <marian-cristian.rotariu.rb@bp.renesas.com>
Acked-by: Rob Herring <robh@kernel.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Linus Walleij [Fri, 28 Aug 2020 15:30:55 +0000 (17:30 +0200)]
usb: gadget: pch_udc: Convert to use GPIO descriptors
This switches the PCH UDC driver to use GPIO descriptors. The way
this is supposed to be used is confusing. The code contains the
following:
/* GPIO port for VBUS detecting */
static int vbus_gpio_port = -1; /* GPIO port number (-1:Not used) */
So a hardcoded GPIO number in the code. Further the probe() path
very clearly will exit if the GPIO is not found, so this driver
can only be configured by editing the code, hard-coding a GPIO
number into this variable.
This is simply not how we do things. My guess is that this is
used in products by patching a GPIO number into this variable and
shipping a kernel that is compile-time tailored for the target
system.
I switched this mechanism to using a GPIO descriptor associated
with the parent PCI device. This can be added by using the 16bit
subsystem ID or similar to identify which exact machine we are
running on and what GPIO is present on that machine, and then
add a GPIO descriptor using gpiod_add_lookup_table() from
<linux/gpio/machine.h>. Since I don't have any target systems
I cannot add this but I'm happy to help. I put in a FIXME so
the people actually using this driver knows what to do.
Cc: Felipe Balbi <balbi@kernel.org>
Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Wed, 2 Sep 2020 09:57:33 +0000 (17:57 +0800)]
usb: cdns3: imx: add glue layer runtime pm implementation
Add imx glue layer runtime pm implementation, and the runtime
pm is default off.
Reviewed-by: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Wed, 2 Sep 2020 09:57:32 +0000 (17:57 +0800)]
usb: cdns3: add runtime PM support
Introduce runtime PM and wakeup interrupt handler for cdns3,
the runtime PM is default off since other cdns3 may not
implement glue layer support for runtime PM.
One typical wakeup event use case is xHCI runtime suspend will clear
USBCMD.RS bit, after that the xHCI will not trigger any interrupts,
so its parent (cdns core device) needs to resume xHCI device when
any (wakeup) events occurs at host port.
When the controller is in low power mode, the lpm flag will be set.
The interrupt triggered later than lpm flag is set considers as
wakeup interrupt and handled at cdns_wakeup_irq. Once the wakeup
occurs, it first disables interrupt to avoid later interrupt
occurrence since the controller is in low power mode at that
time, and access registers may be invalid at that time. At wakeup
handler, it will call pm_request_resume to wakeup xHCI device, and
at runtime resume handler, it will enable interrupt again.
The API platform_suspend is introduced for glue layer to implement
platform specific PM sequence.
Reviewed-by: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Peter Chen [Wed, 2 Sep 2020 09:57:31 +0000 (17:57 +0800)]
usb: cdns3: introduce set_phy_power_on{off} APIs
Since we have both USB2 and USB3 PHYs for cdns3 controller, it is
better we have unity APIs to handle both USB2 and USB3's power, it
could simplify code for error handling and further power management
implementation.
Reviewed-by: Pawel Laszczak <pawell@cadence.com>
Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
YueHaibing [Fri, 31 Jul 2020 08:20:08 +0000 (16:20 +0800)]
usb: mtu3: Remove unsused inline function is_first_entry
It is never used, so can be removed.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Li Jun [Sun, 26 Jul 2020 03:17:39 +0000 (11:17 +0800)]
usb: dwc3: core: do not queue work if dr_mode is not USB_DR_MODE_OTG
Do not try to queue a drd work if dr_mode is not USB_DR_MODE_OTG
because the work is not inited, this may be triggered by user try
to change mode file of debugfs on a single role port, which will
cause below kernel dump:
[ 60.115529] ------------[ cut here ]------------
[ 60.120166] WARNING: CPU: 1 PID: 627 at kernel/workqueue.c:1473
__queue_work+0x46c/0x520
[ 60.128254] Modules linked in:
[ 60.131313] CPU: 1 PID: 627 Comm: sh Not tainted
5.7.0-rc4-00022-g914a586-dirty #135
[ 60.139054] Hardware name: NXP i.MX8MQ EVK (DT)
[ 60.143585] pstate:
a0000085 (NzCv daIf -PAN -UAO)
[ 60.148376] pc : __queue_work+0x46c/0x520
[ 60.152385] lr : __queue_work+0x314/0x520
[ 60.156393] sp :
ffff8000124ebc40
[ 60.159705] x29:
ffff8000124ebc40 x28:
ffff800011808018
[ 60.165018] x27:
ffff800011819ef8 x26:
ffff800011d39980
[ 60.170331] x25:
ffff800011808018 x24:
0000000000000100
[ 60.175643] x23:
0000000000000013 x22:
0000000000000001
[ 60.180955] x21:
ffff0000b7c08e00 x20:
ffff0000b6c31080
[ 60.186267] x19:
ffff0000bb99bc00 x18:
0000000000000000
[ 60.191579] x17:
0000000000000000 x16:
0000000000000000
[ 60.196891] x15:
0000000000000000 x14:
0000000000000000
[ 60.202202] x13:
0000000000000000 x12:
0000000000000000
[ 60.207515] x11:
0000000000000000 x10:
0000000000000040
[ 60.212827] x9 :
ffff800011d55460 x8 :
ffff800011d55458
[ 60.218138] x7 :
ffff0000b7800028 x6 :
0000000000000000
[ 60.223450] x5 :
ffff0000b7800000 x4 :
0000000000000000
[ 60.228762] x3 :
ffff0000bb997cc0 x2 :
0000000000000001
[ 60.234074] x1 :
0000000000000000 x0 :
ffff0000b6c31088
[ 60.239386] Call trace:
[ 60.241834] __queue_work+0x46c/0x520
[ 60.245496] queue_work_on+0x6c/0x90
[ 60.249075] dwc3_set_mode+0x48/0x58
[ 60.252651] dwc3_mode_write+0xf8/0x150
[ 60.256489] full_proxy_write+0x5c/0xa8
[ 60.260327] __vfs_write+0x18/0x40
[ 60.263729] vfs_write+0xdc/0x1c8
[ 60.267045] ksys_write+0x68/0xf0
[ 60.270360] __arm64_sys_write+0x18/0x20
[ 60.274286] el0_svc_common.constprop.0+0x68/0x160
[ 60.279077] do_el0_svc+0x20/0x80
[ 60.282394] el0_sync_handler+0x10c/0x178
[ 60.286403] el0_sync+0x140/0x180
[ 60.289716] ---[ end trace
70b155582e2b7988 ]---
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Zqiang [Fri, 5 Jun 2020 03:05:33 +0000 (11:05 +0800)]
usb: gadget: function: printer: fix use-after-free in __lock_acquire
Fix this by increase object reference count.
BUG: KASAN: use-after-free in __lock_acquire+0x3fd4/0x4180
kernel/locking/lockdep.c:3831
Read of size 8 at addr
ffff8880683b0018 by task syz-executor.0/3377
CPU: 1 PID: 3377 Comm: syz-executor.0 Not tainted 5.6.11 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xce/0x128 lib/dump_stack.c:118
print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374
__kasan_report+0x131/0x1b0 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:641
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
__lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831
lock_acquire+0x127/0x350 kernel/locking/lockdep.c:4488
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159
printer_ioctl+0x4a/0x110 drivers/usb/gadget/function/f_printer.c:723
vfs_ioctl fs/ioctl.c:47 [inline]
ksys_ioctl+0xfb/0x130 fs/ioctl.c:763
__do_sys_ioctl fs/ioctl.c:772 [inline]
__se_sys_ioctl fs/ioctl.c:770 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770
do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4531a9
Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:
00007fd14ad72c78 EFLAGS:
00000246 ORIG_RAX:
0000000000000010
RAX:
ffffffffffffffda RBX:
000000000073bfa8 RCX:
00000000004531a9
RDX:
fffffffffffffff9 RSI:
000000000000009e RDI:
0000000000000003
RBP:
0000000000000003 R08:
0000000000000000 R09:
0000000000000000
R10:
0000000000000000 R11:
0000000000000246 R12:
00000000004bbd61
R13:
00000000004d0a98 R14:
00007fd14ad736d4 R15:
00000000ffffffff
Allocated by task 2393:
save_stack+0x21/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:515
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529
kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2813
kmalloc include/linux/slab.h:555 [inline]
kzalloc include/linux/slab.h:669 [inline]
gprinter_alloc+0xa1/0x870 drivers/usb/gadget/function/f_printer.c:1416
usb_get_function+0x58/0xc0 drivers/usb/gadget/functions.c:61
config_usb_cfg_link+0x1ed/0x3e0 drivers/usb/gadget/configfs.c:444
configfs_symlink+0x527/0x11d0 fs/configfs/symlink.c:202
vfs_symlink+0x33d/0x5b0 fs/namei.c:4201
do_symlinkat+0x11b/0x1d0 fs/namei.c:4228
__do_sys_symlinkat fs/namei.c:4242 [inline]
__se_sys_symlinkat fs/namei.c:4239 [inline]
__x64_sys_symlinkat+0x73/0xb0 fs/namei.c:4239
do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3368:
save_stack+0x21/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:337 [inline]
__kasan_slab_free+0x135/0x190 mm/kasan/common.c:476
kasan_slab_free+0xe/0x10 mm/kasan/common.c:485
slab_free_hook mm/slub.c:1444 [inline]
slab_free_freelist_hook mm/slub.c:1477 [inline]
slab_free mm/slub.c:3034 [inline]
kfree+0xf7/0x410 mm/slub.c:3995
gprinter_free+0x49/0xd0 drivers/usb/gadget/function/f_printer.c:1353
usb_put_function+0x38/0x50 drivers/usb/gadget/functions.c:87
config_usb_cfg_unlink+0x2db/0x3b0 drivers/usb/gadget/configfs.c:485
configfs_unlink+0x3b9/0x7f0 fs/configfs/symlink.c:250
vfs_unlink+0x287/0x570 fs/namei.c:4073
do_unlinkat+0x4f9/0x620 fs/namei.c:4137
__do_sys_unlink fs/namei.c:4184 [inline]
__se_sys_unlink fs/namei.c:4182 [inline]
__x64_sys_unlink+0x42/0x50 fs/namei.c:4182
do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at
ffff8880683b0000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 24 bytes inside of
1024-byte region [
ffff8880683b0000,
ffff8880683b0400)
The buggy address belongs to the page:
page:
ffffea0001a0ec00 refcount:1 mapcount:0 mapping:
ffff88806c00e300
index:0xffff8880683b1800 compound_mapcount: 0
flags: 0x100000000010200(slab|head)
raw:
0100000000010200 0000000000000000 0000000600000001 ffff88806c00e300
raw:
ffff8880683b1800 000000008010000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>