Commit Graph

425986 Commits

Author SHA1 Message Date
Peter Chen
14de8c3a62 usb: doc: phy-mxs: Add more compatible strings
Add "fsl,imx6q-usbphy" for imx6dq and imx6dl, add
"fsl,imx6sl-usbphy" for imx6sl, and "fsl,imx23-usbphy"
is still a fallback for other strings.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:06 -06:00
Marek Szyprowski
b83e333a4d usb: gadget: s3c-hsotg: add proper suspend/resume support
This patch adds suspend/resume support to s3c-hsotg driver. It makes UDC
driver more power efficient.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:06 -06:00
George Cherian
aecbc31d76 usb: musb: musb_cppi41: Dont reprogram DMA if tear down is initiated
Reprogramming the DMA after tear down is initiated leads to warning.
This is mainly seen with ISOCH since we do a delayed completion for
ISOCH transfers. In ISOCH transfers dma_completion should not reprogram
if the channel tear down is initiated.

Signed-off-by: George Cherian <george.cherian@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:05 -06:00
Kishon Vijay Abraham I
57303488cd usb: dwc3: adapt dwc3 core to use Generic PHY Framework
Adapted dwc3 core to use the Generic PHY Framework. So for init, exit,
power_on and power_off the following APIs are used phy_init(), phy_exit(),
phy_power_on() and phy_power_off().

However using the old USB phy library wont be removed till the PHYs of all
other SoC's using dwc3 core is adapted to the Generic PHY Framework.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:05 -06:00
Kishon Vijay Abraham I
122f06e60f usb: dwc3: core: support optional PHYs
Since PHYs for dwc3 is optional (not all SoCs having PHYs for DWC3
should be programmed), do not return from probe if the USB PHY library
returns -ENODEV as that indicates the platform does not have a
programmable PHY.

While this can be considered as a temporary fix, a long term solution
would be to add 'nop' PHY for platforms that does not have programmable
PHY.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:05 -06:00
Kishon Vijay Abraham I
8d7212bc41 Documentation: dt bindings: move ..usb/usb-phy.txt to ..phy/ti-phy.txt
Since now we have a separate folder for phy, move the PHY dt binding
documentation of TI to that folder.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:04 -06:00
Felipe Balbi
dbf5aaf7ce usb: dwc3: define more revisions
few new revisions of the core have been released,
add them to our list of revisions so we can apply
workarounds if necessary.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:04 -06:00
Felipe Balbi
610183051d usb: dwc3: fix randconfig build errors
commit 388e5c5 (usb: dwc3: remove dwc3 dependency
on host AND gadget.) created the possibility for
host-only and peripheral-only dwc3 builds but
left a possible randconfig build error when host-only
builds are selected.

Cc: <stable@vger.kernel.org> # v3.8+
Reported-by: Jim Davis <jim.epost@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:04 -06:00
Felipe Balbi
b997ada5db usb: dwc3: gadget: pre-start Stream transfers when they're queued
we need to pre-start stream transfers otherwise we
will never know when to start them.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:03 -06:00
Felipe Balbi
bc5ba2e0b8 usb: dwc3: gadget: call gadget driver's ->suspend/->resume
When going into bus suspend/resume we _must_
call gadget driver's ->suspend/->resume callbacks
accordingly. This patch implements that very feature
which has been missing forever.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:03 -06:00
Paul Zimmerman
b992e6813e usb: dwc3: gadget: add 'force' argument to stop_active_transfer
It's not always we need to force a transfer to be removed
from the core's internal cache. This extra argument will
help differentiating those two cases.

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:03 -06:00
Felipe Balbi
356363bf6b usb: dwc3: gadget: make sure HIRD threshold is 0 in superspeed
During superspeed, HIRD threshold should always
be zero. Curent driver wasn't making sure that
was the case.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:03 -06:00
Felipe Balbi
7b2a0368bb usb: dwc3: gadget: set KEEP_CONNECT in case of hibernation
if we have hibernation configured, Databook
instructs us to set KEEP_CONNECT bit together
with RUN_STOP bit, in step 9 of section 12.3.6.1
Initialization for Hibernation Support.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:02 -06:00
Felipe Balbi
835fadb40c usb: dwc3: core: fix indentation
no functional changes, just converting spaces
into tab.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:40:02 -06:00
Felipe Balbi
0ffcaf3798 usb: dwc3: core: allocate scratch buffers
We must read HWPARAMS4 register to figure out
how many scratch buffers we should allocate.

Later patch will use "Set Scratchpad Buffer
Array" command to pass the pointer to the
IP so it can be used during hibernation.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 14:39:55 -06:00
Paul Zimmerman
265b70a73a usb: dwc3: gadget: add a 'restore' argument to set_ep_config
That argument will be used in later patches when we
have working hibernation support. For now, always
pass it as false.

The idea of this patch is to decrease to size of
following patches and slowly add hibernation building
blocks to the gadget side of dwc3 so that it becomes
very easy to review the actual hibernation code.

[ balbi@ti.com : rewrote patch on top of current
	tree. Added commit log. ]

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:52 -06:00
Paul Zimmerman
911f1f88ca usb: dwc3: gadget: implement dwc3_gadget_get_link_state
This function will be used during hibernation to get
the current link state. It will be needed at least
for Hibernation support.

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:51 -06:00
Paul Zimmerman
4cfcf87676 usb: dwc3: add 'saved_state' field to dwc3_ep structure
This extra field will save endpoint state when we're
about to enter hibernation. It will be used later
to restore the endpoint state when resuming.

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:51 -06:00
Felipe Balbi
81bc5599d6 usb: dwc3: add has_hibernation flag
this will tell driver that this version
of the core was configured with hibernation
feature enabled.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:51 -06:00
Felipe Balbi
f2b685d5aa usb: dwc3: cleanup struct dwc3
move 1-bit flags to the bottom of the structure,
sort all bit flags alphabetically, add documentation
which was missing.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:50 -06:00
Felipe Balbi
e1dadd3b0f usb: dwc3: workaround: bogus hibernation events
Revision 2.20a of the core has a known issue
which would generate bogus hibernation events
_and_ random failures on USB CV TD.9.23 test
case.

The suggested workaround is to ignore hibernation
events which don't match currently connected
speed.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:50 -06:00
Felipe Balbi
32a4a13584 usb: dwc3: workaround: clock gating issues
Revisions between 2.10a and 2.50a (included) have
a known issue which may cause xHCI compliance tests
to fail and/or quality issues with Isochronous
transactions.

Note that this issue only impacts certain configurations
of those revisions, namely the ones which have clock
gating enabled.

The suggested workaround is to disable clock gating in
known broken revisions, make sure HW LPM is disabled
and set GCTL.SOFITPSYNC to 1.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:50 -06:00
Felipe Balbi
183ca11179 usb: dwc3: core: define bit 10 of GCTL register
This bit is necessary for implemeting workaround
for known issue with some revisions of this core.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:49 -06:00
Felipe Balbi
f3af36511e usb: dwc3: gadget: always enable IOC on bulk/interrupt transfers
by setting IOC always, we can recycle TRBs a
lot sooner at the expense of some increased
CPU load.

The extra load seems to be quite minimal on
OMAP5 devices (instead of 1 IRQ for one MSC
transfer, we get
CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS).

Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:49 -06:00
Robert Baldyga
0e06bcac79 usb: gadget: at91_udc: fix ep maxpacket initialisation
This patch fixes problem with unnecessary usb_ep_set_maxpacket_limit() usage.
It should not be used in at91udc_probe() function, where maxpacket values are
set for field "maxpacket" of struct at91_ep, which is representation of
endpoint in driver internals. Function usb_ep_set_maxpacket_limit() is called
in udc_reinit() function, where struct usb_ep instances are initialised with
values set previously in struct at91_ep instances. So it's very important to
initialise it properly.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:49 -06:00
Geert Uytterhoeven
3f83e53878 usb: musb: USB_MUSB_DUAL_ROLE/USB_MUSB_GADGET should depend on HAS_DMA
If NO_DMA=y:

    drivers/built-in.o: In function `txstate':
    musb_gadget.c:(.text+0x35955a): undefined reference to `dma_unmap_single'
    musb_gadget.c:(.text+0x35957e): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `musb_g_giveback':
    (.text+0x359672): undefined reference to `dma_mapping_error'
    drivers/built-in.o: In function `musb_g_giveback':
    (.text+0x3596ba): undefined reference to `dma_unmap_single'
    drivers/built-in.o: In function `musb_g_giveback':
    (.text+0x3596e0): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `rxstate':
    musb_gadget.c:(.text+0x3599d0): undefined reference to `dma_unmap_single'
    musb_gadget.c:(.text+0x3599f6): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `musb_gadget_queue':
    musb_gadget.c:(.text+0x35a8c0): undefined reference to `dma_map_single'
    musb_gadget.c:(.text+0x35a8d0): undefined reference to `dma_mapping_error'
    musb_gadget.c:(.text+0x35a906): undefined reference to `dma_sync_single_for_cpu'
    musb_gadget.c:(.text+0x35a9a0): undefined reference to `dma_unmap_single'
    musb_gadget.c:(.text+0x35a9c8): undefined reference to `dma_sync_single_for_cpu'

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:48 -06:00
Sergei Shtylyov
7241a21a71 usb: phy: rcar-gen2-usb: always use 'dev' variable in probe() method
The probe() method has the 'dev' local variable declared and used but strangely
not in all cases where it should be...

Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:48 -06:00
Felipe Balbi
eee3f15d5f usb: musb: avoid NULL pointer dereference
instead of relying on the otg pointer, which
can be NULL in certain cases, we can use the
gadget and host pointers we already hold inside
struct musb.

Cc: <stable@vger.kernel.org>
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-03-05 09:44:48 -06:00
Markus Pargmann
40f099e32c usb: musb: dsps, debugfs files
debugfs files to show the contents of important dsps registers.

Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:48:20 -06:00
Huang Rui
06f9b6e596 usb: dwc3: fix wrong bit mask in dwc3_event_devt
Around DWC USB3 2.30a release another bit has been added to the
Device-Specific Event (DEVT) Event Information (EvtInfo) bitfield.

Because of that, what used to be 8 bits long, has become 9 bits long.

Per dwc3 2.30a+ spec in the Device-Specific Event (DEVT), the field of
Event Information Bits(EvtInfo) uses [24:16] bits, and it has 9 bits
not 8 bits. And the following reserved field uses [31:25] bits not
[31:24] bits, and it has 7 bits.

So in dwc3_event_devt, the bit mask should be:
event_info	[24:16]		9 bits
reserved31_25	[31:25]		7 bits

This patch makes sure that newer core releases will work fine with
Linux and that we will decode the event information properly on new
core releases.

[ balbi@ti.com : improve commit log a bit ]

Cc: <stable@vger.kernel.org>
Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:16:41 -06:00
Dan Carpenter
798a2468e0 usb: gadget: gr_udc: remove some unneeded error handling
Debugfs function return an ERR_PTR if they compiled out.  We don't need
to test for that here because if the debugfs file are compiled out then
it is ok to pass an ERR_PTR to debugfs_create_file() since it will just
be a no-op stub.

Debugfs return NULLs on error, but we don't need to test for that either
because debugfs_create_file() will accept NULL pointers.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-20 09:16:17 -06:00
Bo Shen
3fcba0d87b usb: gadget: at91: using USBA_NR_DMAS for DMA channels
The SoCs earlier than sama5d3, they have the same number endpoints
and DMA channels. In driver code, they use the same definition
USBA_NR_ENDPOINTS for both endpoints and dma channels. However,
in sama5d3, it has different number for endpoints and DMA channels.
So, define a new macro USBA_NR_DMAs for DMA channels. And the
USBA_NR_ENDPOINS is not used anymore, remove it at the same time.

Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-19 13:47:12 -06:00
Bo Shen
aa7be0f8f7 usb: gadget: at91: fix the number of endpoint parameter
In sama5d3 SoC, there are 16 endpoints, which is different with
earlier SoCs (only have 7 endpoints). The USBA_NR_ENDPOINTS macro
is not suitable for sama5d3. So, get the endpoints number through
the udc->num_ep, which get from platform data for non-dt kernel,
or parse from dt node.

Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-19 13:46:48 -06:00
Robert Baldyga
2e4c7553cd usb: gadget: f_fs: add aio support
This patch adds asynchronous I/O support for FunctionFS endpoint files.
It adds ffs_epfile_aio_write() and ffs_epfile_aio_read() functions responsible
for preparing AIO operations.

It also modifies ffs_epfile_io() function, adding aio handling code. Instead
of extending list of parameters of this function, there is new struct
ffs_io_data which contains all information needed to perform I/O operation.
Pointer to this struct replaces "buf" and "len" parameters of ffs_epfile_io()
function. Allocated buffer is freed immediately only after sync operation,
because in async IO it's freed in complete funcion. For each async operation
an USB request is allocated, because it allows to have more than one request
queued on single endpoint.

According to changes in ffs_epfile_io() function, functions ffs_epfile_write()
and ffs_epfile_read() are updated to use new API.

For asynchronous I/O operations there is new request complete function named
ffs_epfile_async_io_complete(), which completes AIO operation, and frees
used memory.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:02 -06:00
Robert Baldyga
23de91e970 usb: gadget: f_fs: add poll for endpoint 0
This patch adds poll function for file representing ep0.

Ability of read from or write to ep0 file is related with actual state of ffs:
- When desctiptors or strings are not written yet, POLLOUT flag is set.
- If there is any event to read, POLLIN flag is set.
- If setup request was read, POLLIN and POLLOUT flag is set, to allow
  send response (by performing I/O operation consistent with setup request
  direction) or set stall (by performing I/O operation opposite  setup
  request direction).

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Robert Baldyga
0a7b1f8a70 usb: gadget: f_fs: fix setup request handling
This patch fixes __ffs_ep0_queue_wait() function, which now returns number of
bytes transferred in USB request or error code in case of failure. This is
needed by ffs_ep0_read() function, when read data is copied to userspace.

It also cleans up code by removing usused variable ep0req_status.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:01 -06:00
Michal Nazarewicz
a7ecf0544f usb: gadget: functionfs: replace FFS_SETUP_STATUS with an inline function
The FFS_SETUP_STATUS macro could be trivialy replaced with an static
inline function but more importantly its name was tad confusing.
The name suggested it was a simple accessor macro but it actually
did change the state of the ffs_data structure perfomring
a FFS_SETUP_CANCELLED -> FFS_NO_SETUP transition.  The name of the
function -- ffs_setup_state_clear_cancelled -- should better
describe what the function actually does.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Michal Nazarewicz
e46318a000 usb: gadget: functionfs: fix typo in the enum variable
Since “cancelled” is spelled with two “l”s, rename FFS_SETUP_CANCELED
to FFS_SETUP_CANCELLED.

Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:53:00 -06:00
Andrzej Pietrasiewicz
da13a7738e usb: gadget: FunctionFS: use consistent naming with regard to ffs_lock
Consistently prefix function name with underscore if the function has to
be called with ffs_lock taken.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz
10b69ce08c usb: gadget: FunctionFS: staticize functions used only in f_fs.c
ffs_alloc_dev and ffs_free_dev are used only in f_fs.c,
so make them static.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:56 -06:00
Andrzej Pietrasiewicz
ab13cb0c0d usb: gadget: code cleanup
Remove trailing whitespace

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Andrzej Pietrasiewicz
ea365922f9 usb: gadget: FunctionFS: dereference ffs_dev conditionally
ffs_dev->ffs_release_dev_callback should be accessed only if ffs_dev
is not NULL.

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Markus Pargmann
de9db572fe usb: musb: dsps, use devm_kzalloc
Replace kzalloc by devm_kzalloc and remove the kfree() calls.

Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:55 -06:00
Wolfram Sang
30bbae9fad usb: dwc3: omap: don't check resource with devm_ioremap_resource
devm_ioremap_resource does sanity checks on the given resource. No need to
duplicate this in the driver.

Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
Robert Baldyga
c9f721b2f3 usb: gadget: s3c-hsotg: stall ep0 in set_halt function
When s3c_hsotg_ep_sethalt() function is called for ep0 it should be stalled
in the same way that it is in s3c_hsotg_process_control() function, because
SET_HALT for ep0 is delayed response for setup request. Endpoint 0, if
halted, it doesn't need CLEAR_HALT because it clears "stalled" state
automatically when next setup request is received.

For this reason this patch moves code setting ep0 to "stalled" state to new
function named s3c_hsotg_stall_ep0() which is called in
s3c_hsotg_process_control() function as an immediate response for setup
request, and in s3c_hsotg_ep_sethalt() function as a delayed response for
setup request.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
wenlin.kang
7e98f60003 usb: gadget: printer: fix memory leak
When read data from g_printer, we see a Segmentation fault. eg:

Unable to handle kernel paging request at virtual address bf048000 pgd
= cf038000 [bf048000] *pgd=8e8cf811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT ARM Modules linked in: bluetooth
rfcomm g_printer
CPU: 0    Not tainted  (3.4.43-WR5.0.1.9_standard #1)
PC is at __copy_to_user_std+0x310/0x3a8 LR is at 0x4c808010
pc : [<c036e990>]    lr : [<4c808010>]    psr: 20000013
sp : cf883ea8  ip : 80801018  fp : cf883f24
r10: bf04706c  r9 : 18a21205  r8 : 21953888
r7 : 201588aa  r6 : 5109aa16  r5 : 0705aaa2  r4 : 5140aa8a
r3 : 0000004c  r2 : 00000fdc  r1 : bf048000  r0 : bef5fc3c
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 8f038019  DAC: 00000015 Process
g_printer_test. (pid: 661, stack limit = 0xcf8822e8)
Stack: (0xcf883ea8 to 0xcf884000)
3ea0:                   bf047068 00001fff bef5ecb9 cf882000 00001fff bef5ecb9
3ec0: 00001fff 00000000 cf2e8724 bf044d3c 80000013 80000013 00000001
bf04706c
3ee0: cf883f24 cf883ef0 c012e5ac c0324388 c007c8ac c0046298 00008180
cf29b900
3f00: 00002000 bef5ecb8 cf883f68 00000003 cf882000 cf29b900 cf883f54
cf883f28
3f20: c012ea08 bf044b0c c000eb88 00000000 cf883f7c 00000000 00000000
00002000
3f40: bef5ecb8 00000003 cf883fa4 cf883f58 c012eae8 c012e960 00000001
bef60cb8
3f60: 000000a8 c000eb88 00000000 00000000 cf883fa4 00000000 c014329c
00000000
3f80: 000000d4 41af63f0 00000003 c000eb88 cf882000 00000000 00000000
cf883fa8
3fa0: c000e920 c012eaa4 00000000 000000d4 00000003 bef5ecb8 00002000
bef5ecb8
3fc0: 00000000 000000d4 41af63f0 00000003 b6f534c0 00000000 419f9000
00000000
3fe0: 00000000 bef5ecac 000086d9 41a986bc 60000010 00000003 0109608a
0088828a
Code: f5d1f07c e8b100f0 e1a03c2e e2522020 (e8b15300) ---[ end trace
97e2618e250e3377 ]--- Segmentation fault

The root cause is the dev->rx_buffers list has been broken.
When we call printer_read(), the following call tree is triggered:

printer_read()
	|
	+---setup_rx_reqs(req)
	|	|
	|	+---usb_ep_queue(req)
	|	|	|
	|	|	+---...
	|	|		|
	|	|		+---rx_complete(req).
	|	|
	|	+---add the req to dev->rx_reqs_active
	|
	+---while(!list_empty(&dev->rx_buffers)))

The route happens when we don't use DMA or fail to start DMA in USB
driver. We can see: in the case, in rx_complete() it will add the req
to dev->rx_buffers. meanwhile we see that we will also add the req to
dev->rx_reqs_active after usb_ep_queue() return, so this adding will
break the dev->rx_buffers out.

After, when we call list_empty() to check dev->rx_buffers in while(),
due to can't check correctly dev->rx_buffers, so the Segmentation fault
occurs when copy_to_user() is called.

Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
wenlin.kang
2c2b04253b usb: gadget: printer: fix possible deadlock
The problem occurs in follow path.

printer_read()
	|
	+---setup_rx_reqs()
		|
		+---usb_ep_queue()
			|
			+---...
				|
				+---rx_complete()

Although it is clear from code, we can't get it normally.
only when we enable some spin_lock debug config option, we can find it.
eg:
BUG: spinlock lockup on CPU#0, g_printer_test_/584
 lock: bf05e158, .magic: dead4ead, .owner: g_printer_test_/584, .owner_cpu: 0
[<c0016e1c>] (unwind_backtrace+0x0/0x104) from [<c067aef8>] (dump_stack+0x20/0x24)
[<c067aef8>] (dump_stack+0x20/0x24) from [<c0680bec>] (spin_dump+0x8c/0x94)
[<c0680bec>] (spin_dump+0x8c/0x94) from [<c039071c>] (do_raw_spin_lock+0x128/0x154)
[<c039071c>] (do_raw_spin_lock+0x128/0x154) from [<c0685618>] (_raw_spin_lock_irqsave+0x64/0x70)
[<c0685618>] (_raw_spin_lock_irqsave+0x64/0x70) from [<bf05b4e8>] (rx_complete+0x54/0x10c [g_printer])
[<bf05b4e8>] (rx_complete+0x54/0x10c [g_printer]) from [<c0480478>] (musb_g_giveback+0x78/0x88)
[<c0480478>] (musb_g_giveback+0x78/0x88) from [<c048060c>] (rxstate+0xa0/0x10c)
[<c048060c>] (rxstate+0xa0/0x10c) from [<c0480d50>] (musb_ep_restart+0x44/0x70)
[<c0480d50>] (musb_ep_restart+0x44/0x70) from [<c0480fe4>] (musb_gadget_queue+0xe8/0xf8)
[<c0480fe4>] (musb_gadget_queue+0xe8/0xf8) from [<bf05b2b0>] (setup_rx_reqs+0xa4/0x178 [g_printer])
[<bf05b2b0>] (setup_rx_reqs+0xa4/0x178 [g_printer]) from [<bf05bb58>] (printer_read+0x9c/0x3f4 [g_printer])
[<bf05bb58>] (printer_read+0x9c/0x3f4 [g_printer]) from [<c01387f0>] (vfs_read+0xb4/0x144)
[<c01387f0>] (vfs_read+0xb4/0x144) from [<c01388d0>] (sys_read+0x50/0x124)
[<c01388d0>] (sys_read+0x50/0x124) from [<c000e900>] (ret_fast_syscall+0x0/0x3c)

The root cause is that we use the same lock two time in a path, so to avoid
the deadlock, we need to unlock in setup_rx_reqs(), and only unlock.

Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:54 -06:00
Sachin Kamat
236064c253 usb: gadget: s3c-hsudc: remove unused label
Fixes the following compilation warning:
drivers/usb/gadget/s3c-hsudc.c: In function ‘s3c_hsudc_probe’:
drivers/usb/gadget/s3c-hsudc.c:1347:1: warning: label ‘err_add_device’
defined but not used [-Wunused-label]

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Sachin Kamat
e362115a07 usb: gadget: s3c2410_udc: Fix build error
Pass value instead of address as expected by 'usb_ep_set_maxpacket_limit'.
Fixes the following compilation error introduced by commit e117e742d3
("usb: gadget: add "maxpacket_limit" field to struct usb_ep"):

drivers/usb/gadget/s3c2410_udc.c: In function ‘s3c2410_udc_reinit’:
drivers/usb/gadget/s3c2410_udc.c:1632:3: error:
cannot take address of bit-field ‘maxpacket’
   usb_ep_set_maxpacket_limit(&ep->ep, &ep->ep.maxpacket);

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Reviewed-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00
Julia Lawall
abcdcc29c6 usb: gadget: fix error return code
Set the return variable to an error code as done elsewhere in the function.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}

// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2014-02-18 10:52:53 -06:00