kernel/linux.git/drivers/usb/dwc2, branch v4.4.8

usb: dwc2: fix kernel oops during driver probe

2015-11-20T15:29:47+00:00

This patch make sure that all necessary members of dwc2_hsotg are initialized before the irq handler is requested. So the kernel oops triggered by dwc2_handle_common_intr has been fixed. dwc2 20980000.usb: Configuration mismatch. Forcing host mode dwc2 20980000.usb: no platform data or transceiver defined Unable to handle kernel paging request at virtual address cc860040 pgd = c0004000 [cc860040] *pgd=0b41e811, *pte=00000000, *ppte=00000000 Internal error: Oops: 7 [#1] ARM CPU: 0 PID: 1 Comm: swapper Not tainted 4.3.0-rc3+ #19 Hardware name: BCM2835 task: cb494000 ti: cb4d0000 task.ti: cb4d0000 PC is at dwc2_is_controller_alive+0x18/0x34 LR is at dwc2_handle_common_intr+0x24/0xb60 Acked-by: John Youn Tested-by: Marek Szyprowski Signed-off-by: Stefan Wahren Signed-off-by: Felipe Balbi

usb: dwc2: make otg clk optional

2015-11-19T20:48:49+00:00

Fixes commit 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c") The above commit consolidated the low-level phy access into a common location. This change made the otg clk a requirement and broke some platforms when it was moved into platform.c. So make clk handling optional again. Acked-by: Eric Anholt Signed-off-by: Stefan Wahren Cc: Marek Szyprowski Acked-by: John Youn Tested-by: Marek Szyprowski Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c") Signed-off-by: Felipe Balbi

usb: dwc2: Return errors from PHY

2015-11-19T20:48:49+00:00

When searching for PHYs, any error was treated as if the PHY did not exist or was not specified. Thus the probe function did not correctly return error conditions such as -EPROBE_DEFER. Fixed so that only a non-existing PHY is ignored and any other error is returned. Acked-by: Eric Anholt Reported-by: Alexander Aring Signed-off-by: John Youn Signed-off-by: Stefan Wahren Tested-by: Marek Szyprowski Signed-off-by: Felipe Balbi

usb: dwc2: Make PHY optional

2015-11-19T20:48:49+00:00

Fixes commit 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c") The above commit consolidated the low-level phy access into a common location. This change introduced a check from the gadget requiring that a PHY is specified. This requirement never existed on the host side and broke some platforms when it was moved into platform.c. The gadget doesn't require the PHY either so remove the check. Acked-by: Eric Anholt Reported-by: Stefan Wahren Cc: Marek Szyprowski Signed-off-by: John Youn Tested-by: Marek Szyprowski Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c") Signed-off-by: Felipe Balbi

usb: dwc2: host: Fix remote wakeup when not in DWC2_L2

2015-11-17T17:35:38+00:00

In commit 734643dfbdde ("usb: dwc2: host: add flag to reflect bus state") we changed dwc2_port_suspend() not to set the lx_state anymore (instead it sets the new bus_suspended variable). This introduced a bug where we would fail to detect device insertions if: 1. Plug empty hub into dwc2 2. Plug USB flash drive into the empty hub. 3. Wait a few seconds 4. Unplug USB flash drive 5. Less than 2 seconds after step 4, plug the USB flash drive in again. The dwc2_hcd_rem_wakeup() function should have been changed to look at the new bus_suspended variable. Let's fix it. Since commit b46146d59fda ("usb: dwc2: host: resume root hub on remote wakeup") talks about needing the root hub resumed if the bus was suspended, we'll include it in our test. It appears that the "port_l1_change" should only be set to 1 if we were in DWC2_L1 (the driver currently never sets this), so we'll update the former "else" case based on this test. Fixes: 734643dfbdde ("usb: dwc2: host: add flag to reflect bus state") Acked-by: John Youn Tested-by: Gregory Herrero Reviewed-by: Heiko Stuebner Signed-off-by: Douglas Anderson Signed-off-by: Felipe Balbi

usb: dwc2: host: Fix ahbcfg for rk3066

2015-11-17T17:29:52+00:00

The comment for ahbcfg for rk3066 parameters (also used for rk3288) claimed that ahbcfg was INCR16, but it wasn't. Since the bits weren't shifted properly, the 0x7 ended up being masked and we ended up programming 0x3 for the HBstLen. Let's set it to INCR16 properly. As per Wu Liang Feng at Rockchip this may increase transmission efficiency. I did blackbox tests with writing 0s to a USB-based SD reader (forcefully capping CPU Freq to try to measure efficiency): cd /sys/devices/system/cpu/cpu0/cpufreq echo userspace > scaling_governor echo 126000 > scaling_setspeed for i in $(seq 10); do dd if=/dev/zero of=/dev/sdb bs=1M count=750 done With the above tests I found that speeds went from ~15MB/s to ~18MB/s. Note that most other tests I did (including reading from the same USB reader) didn't show any difference in performance. Tested-by: Heiko Stuebner Acked-by: John Youn Reviewed-by: Liangfeng Wu Signed-off-by: Douglas Anderson Signed-off-by: Felipe Balbi

usb: dwc2: host: Fix use after free w/ simultaneous irqs

2015-10-19T14:22:46+00:00

While plugging / unplugging on a DWC2 host port with "slub_debug=FZPUA" enabled, I found a crash that was quite obviously a use after free. It appears that in some cases when we handle the various sub-cases of HCINT we may end up freeing the QTD. If there is more than one bit set in HCINT we may then end up continuing to use the QTD, which is bad. Let's be paranoid and check for this after each sub-case. This should be safe since we officially have the "hsotg->lock" (it was grabbed in dwc2_handle_hcd_intr). The specific crash I found was: Unable to handle kernel paging request at virtual address 6b6b6b9f At the time of the crash, the kernel reported: (dwc2_hc_nak_intr+0x5c/0x198) (dwc2_handle_hcd_intr+0xa84/0xbf8) (_dwc2_hcd_irq+0x1c/0x20) (usb_hcd_irq+0x34/0x48) Popping into kgdb found that "*qtd" was filled with "0x6b", AKA qtd had been freed and filled with slub_debug poison. kgdb gave a little better stack crawl: 0 dwc2_hc_nak_intr (hsotg=hsotg@entry=0xec42e058, chan=chan@entry=0xec546dc0, chnum=chnum@entry=4, qtd=qtd@entry=0xec679600) at drivers/usb/dwc2/hcd_intr.c:1237 1 dwc2_hc_n_intr (chnum=4, hsotg=0xec42e058) at drivers/usb/dwc2/hcd_intr.c:2041 2 dwc2_hc_intr (hsotg=0xec42e058) at drivers/usb/dwc2/hcd_intr.c:2078 3 dwc2_handle_hcd_intr (hsotg=0xec42e058) at drivers/usb/dwc2/hcd_intr.c:2128 4 _dwc2_hcd_irq (hcd=) at drivers/usb/dwc2/hcd.c:2837 5 usb_hcd_irq (irq=, __hcd=) at drivers/usb/core/hcd.c:2353 Popping up to frame #1 (dwc2_hc_n_intr) found: (gdb) print /x hcint $12 = 0x12 AKA: #define HCINTMSK_CHHLTD (1 << 1) #define HCINTMSK_NAK (1 << 4) Further debugging found that by simulating receiving those two interrupts at the same time it was trivial to replicate the use-after-free. See for a patch and instructions. This lead to getting the following stack crawl of the actual free: 0 arch_kgdb_breakpoint () at arch/arm/include/asm/outercache.h:103 1 kgdb_breakpoint () at kernel/debug/debug_core.c:1054 2 dwc2_hcd_qtd_unlink_and_free (hsotg=, qh=, qtd=0xe4479a00) at drivers/usb/dwc2/hcd.h:488 3 dwc2_deactivate_qh (free_qtd=, qh=0xe5efa280, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:671 4 dwc2_release_channel (hsotg=hsotg@entry=0xed424618, chan=chan@entry=0xed5be000, qtd=, halt_status=) at drivers/usb/dwc2/hcd_intr.c:742 5 dwc2_halt_channel (hsotg=0xed424618, chan=0xed5be000, qtd=, halt_status=) at drivers/usb/dwc2/hcd_intr.c:804 6 dwc2_complete_non_periodic_xfer (chnum=, halt_status=, qtd=, chan=, hsotg=) at drivers/usb/dwc2/hcd_intr.c:889 7 dwc2_hc_xfercomp_intr (hsotg=hsotg@entry=0xed424618, chan=chan@entry=0xed5be000, chnum=chnum@entry=6, qtd=qtd@entry=0xe4479a00) at drivers/usb/dwc2/hcd_intr.c:1065 8 dwc2_hc_chhltd_intr_dma (qtd=0xe4479a00, chnum=6, chan=0xed5be000, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:1823 9 dwc2_hc_chhltd_intr (qtd=0xe4479a00, chnum=6, chan=0xed5be000, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:1944 10 dwc2_hc_n_intr (chnum=6, hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:2052 11 dwc2_hc_intr (hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:2097 12 dwc2_handle_hcd_intr (hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:2147 13 _dwc2_hcd_irq (hcd=) at drivers/usb/dwc2/hcd.c:2837 14 usb_hcd_irq (irq=, __hcd=) at drivers/usb/core/hcd.c:2353 Though we could add specific code to handle this case, adding the general purpose code to check for all cases where qtd might be freed seemed safer. Acked-by: John Youn Signed-off-by: Douglas Anderson Signed-off-by: Felipe Balbi

usb: dwc2: host: Protect PCGCTL with lock in dwc2_port_resume()

2015-10-16T19:44:15+00:00

From code inspection, it appears to be unsafe to do a read-modify-write of PCGCTL in dwc2_port_resume(). Let's make sure the spinlock is held around this operation. Acked-by: John Youn Signed-off-by: Douglas Anderson Signed-off-by: Felipe Balbi

usb: dwc2: refactor common low-level hw code to platform.c

2015-10-14T13:40:15+00:00

DWC2 module on some platforms needs three additional hardware resources: phy controller, clock and power supply. All of them must be enabled/activated to properly initialize and operate. This was initially handled in s3c-hsotg driver, which has been converted to 'gadget' part of dwc2 driver. Unfortunately, not all of this code got moved to common platform code, what resulted in accessing DWC2 registers without enabling low-level hardware resources. This fails for example on Exynos SoCs. This patch moves all the code for managing those resources to common platform.c file and provides convenient wrappers for controlling them. Signed-off-by: Marek Szyprowski Acked-by: John Youn Tested-by: John Youn Signed-off-by: Felipe Balbi

usb: dwc2: remove no longer needed init_mutex

2015-10-14T13:39:17+00:00

init_mutex is a leftover from the time, when s3c-hsotg driver did not implement proper pull up/down control and emulated it by enabling enabling/disabling usb phy. Proper pull up/down control has been added by commit 5b9451f8c4fbaf0549139755fb45ff2b57975b7f ("usb: dwc2: gadget: use soft-disconnect udc feature in pullup() method"), so init_muxtex can be removed now to avoid potential deadlocks with other locks. Signed-off-by: Marek Szyprowski Acked-by: John Youn Tested-by: John Youn Signed-off-by: Felipe Balbi