From abf710e655fe843afe0ab6a56e344567d933b018 Mon Sep 17 00:00:00 2001 From: Vikram Pandita Date: Fri, 18 May 2012 13:48:04 -0700 Subject: usb: musb: handle nuked ep dma interrupt User can trigger disabling of gadget at run time while the transfers are going on. Eg: 1: rmmod of musb driver while transfers are going on Eg: 2: On android doing: echo 0 > /sys/class/android_usb/android0/enable While a big file transfer is going on via PTP/MTP. In such a case, musb_gadget_disable() calls nuke() but the dma interrupt may still happen for an endpoint since hw would raise the interrupt in anycase. This can result in a NULL pointer access crash: [ 314.030426] PC is at txstate+0x74/0x20c [ 314.034759] LR is at musb_g_tx+0x140/0x204 [ 314.039489] pc : [] lr : [] psr: 20000193 [ 314.039520] sp : c783bc68 ip : 00000002 fp : c783bc9c [ 314.052429] r10: 00000018 r9 : 00000000 r8 : 00000200 [ 314.058258] r7 : 00000000 r6 : fc0ab130 r5 : c781a410 r4 : c6caf640 [ 314.065643] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : c781a000 [ 315.083251] Backtrace: [ 315.086242] [] (txstate+0x0/0x20c) from [] (musb_g_tx+0x140/0x204) [ 315.095123] [] (musb_g_tx+0x0/0x204) from [] (musb_dma_completion+0x40/0x54) [ 315.104980] [] (musb_dma_completion+0x0/0x54) from [] (dma_controller_irq+0x118/0x184) [ 315.115661] [] (dma_controller_irq+0x0/0x184) from [] (handle_irq_event_percpu+0x54/0x188) So put protection in code to handle possiblity of getting an interrupt for an endpoint that might have been already nuked. Reported-by: Todd Poynor Signed-off-by: Vikram Pandita Signed-off-by: Felipe Balbi --- drivers/usb/musb/musb_gadget.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'drivers/usb/musb') diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index f42c29b11f71..695c892e70e7 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c @@ -328,6 +328,13 @@ static void txstate(struct musb *musb, struct musb_request *req) musb_ep = req->ep; + /* Check if EP is disabled */ + if (!musb_ep->desc) { + dev_dbg(musb->controller, "ep:%s disabled - ignore request\n", + musb_ep->end_point.name); + return; + } + /* we shouldn't get here while DMA is active ... but we do ... */ if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) { dev_dbg(musb->controller, "dma pending...\n"); @@ -650,6 +657,13 @@ static void rxstate(struct musb *musb, struct musb_request *req) len = musb_ep->packet_sz; + /* Check if EP is disabled */ + if (!musb_ep->desc) { + dev_dbg(musb->controller, "ep:%s disabled - ignore request\n", + musb_ep->end_point.name); + return; + } + /* We shouldn't get here while DMA is active, but we do... */ if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) { dev_dbg(musb->controller, "DMA pending...\n"); -- cgit v1.2.3 From 2ed9127cff9a255b7671b8d3d938109f68a87961 Mon Sep 17 00:00:00 2001 From: Mantesh Sarasetti Date: Fri, 1 Jun 2012 14:54:30 +0300 Subject: usb: musb: host: Disable MUSB DMA mode incase of DMA channel request failure Currently in case of MUSB DMA channel request failure we are not clearing MUSB_RXCSR_DMAENAB, MUSB_RXCSR_H_AUTOREQ and MUSB_RXCSR_AUTOCLEAR bits of MUSB RXCSR of MUSB DMA. Which is causing failure in receipt of data packets in next transfer. Fix is to disable the MUSB DMA mode and related bits incase of DMA channel request fails Signed-off-by: Mantesh Sarashetti Signed-off-by: Ruslan Bilovol Signed-off-by: Felipe Balbi --- drivers/usb/musb/musb_host.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'drivers/usb/musb') diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index ef8d744800ac..33fc45151b8f 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -1736,7 +1736,11 @@ void musb_host_rx(struct musb *musb, u8 epnum) c->channel_release(dma); hw_ep->rx_channel = NULL; dma = NULL; - /* REVISIT reset CSR */ + val = musb_readw(epio, MUSB_RXCSR); + val &= ~(MUSB_RXCSR_DMAENAB + | MUSB_RXCSR_H_AUTOREQ + | MUSB_RXCSR_AUTOCLEAR); + musb_writew(epio, MUSB_RXCSR, val); } } #endif /* Mentor DMA */ -- cgit v1.2.3