1. 24 Jul, 2020 19 commits
    • Evgeny Novikov's avatar
      usb: gadget: net2280: fix memory leak on probe error handling paths · 2468c877
      Evgeny Novikov authored
      Driver does not release memory for device on error handling paths in
      net2280_probe() when gadget_release() is not registered yet.
      
      The patch fixes the bug like in other similar drivers.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarEvgeny Novikov <novikov@ispras.ru>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      2468c877
    • Pawel Laszczak's avatar
      usb: cdns3: drd: simplify *switch_gadet and *switch_host · b2aeb6da
      Pawel Laszczak authored
      Patch split function cdns3_drd_switch_gadget and
      cdns3_drd_switch_host into:
      - cdns3_drd_host_on
      - cdns3_drd_host_off
      - cdns3_drd_gadget_on
      - cdns3_drd_gadgett_off
      
      These functions don't have any shared code so it's better to
      have smaller, faster and easier functions.
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      b2aeb6da
    • Pawel Laszczak's avatar
      usb: cdns3: core: removed overwriting some error code · f41ca26b
      Pawel Laszczak authored
      Some error code can be preserved, so we can remove overwriting
      error code returned by some functions.
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      f41ca26b
    • Pawel Laszczak's avatar
      usb: cdns3: core: removed 'goto not_otg' · 5c2cf30f
      Pawel Laszczak authored
      Patch removes 'goto not_otg' instruction from
      cdns3_hw_role_state_machine function.
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      5c2cf30f
    • Pawel Laszczak's avatar
      usb: cdns3: Added CDNS3_ID_PERIPHERAL and CDNS3_ID_HOST · 08c35dd3
      Pawel Laszczak authored
      Patch adds 2 definitions that make it easier to understand the code.
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      08c35dd3
    • Pawel Laszczak's avatar
      usb: cdns3: drd: changed return type from int to bool · 24525849
      Pawel Laszczak authored
      Patch changes return type from int to bool for
      cdns3_is_host and cdns3_is_device functions.
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      24525849
    • Pawel Laszczak's avatar
      usb: cdns3: drd: return IRQ_NONE explicitly. · 03cce68a
      Pawel Laszczak authored
      IRQ_NONE can be returned indirect.
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      03cce68a
    • Pawel Laszczak's avatar
      usb: cnds3: drd: deleted != · ecf4f823
      Pawel Laszczak authored
      Patch deletes unnecessary != from condition statement in cdns3_drd_init
      function.
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      ecf4f823
    • Pawel Laszczak's avatar
      usb: cdns3: drd: removed not needed variables initialization · 27afe166
      Pawel Laszczak authored
      Patch remove some variables initialization from core.c and drd.c
      file.
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      27afe166
    • Pawel Laszczak's avatar
      usb: cdns3: core: removed cdns3_get_current_role_driver function · b20aecff
      Pawel Laszczak authored
      Function is not used in driver so it can be removed.
      Signed-off-by: default avatarPawel Laszczak <pawell@cadence.com>
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      b20aecff
    • Peter Chen's avatar
      usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint · 95f5acfc
      Peter Chen authored
      During the endpoint dequeue operation, it changes dequeued TRB as link
      TRB, when the endpoint is disabled and re-enabled, the DMA fetches the
      TRB before the link TRB, after it handles current TRB, the DMA pointer
      will advance to the TRB after link TRB, but enqueue and dequene
      variables don't know it due to no hardware interrupt at the time, when
      the next TRB is added to link TRB position, the DMA will not handle
      this TRB due to its pointer is already at the next TRB. See the trace
      log like below:
      
      file-storage-675   [001] d..1    86.585657: usb_ep_queue: ep0: req 00000000df9b3a4f length 0/0 sgs 0/0 stream 0 zsI status 0 --> 0
      file-storage-675   [001] d..1    86.585663: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr (null)], flags:0 SID: 0
      file-storage-675   [001] d..1    86.585671: cdns3_prepare_trb: ep1out: trb 000000007f770303, dma buf: 0xbd195800, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
      file-storage-675   [001] d..1    86.585676: cdns3_ring:
                  Ring contents for ep1out:
                  Ring deq index: 0, trb: 000000007f770303 (virt), 0xc4003000 (dma)
                  Ring enq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
                  free trbs: 38, CCS=1, PCS=1
                  @0x00000000c4003000 bd195800 80020400 00000425
                  @0x00000000c400300c c4003018 80020400 00001811
                  @0x00000000c4003018 bcfcc000 0000001f 00000426
                  @0x00000000c4003024 bcfce800 0000001f 00000426
      
      	    ...
      
       irq/144-5b13000-698   [000] d...    87.619286: usb_gadget_giveback_request: ep1in: req 0000000031b832eb length 13/13 sgs 0/0 stream 0 zsI status 0 --> 0
          file-storage-675   [001] d..1    87.619287: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr 0x80020400c400300c], flags:0 SID: 0
          file-storage-675   [001] d..1    87.619294: cdns3_prepare_trb: ep1out: trb 0000000049c1ba21, dma buf: 0xbd198000, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
          file-storage-675   [001] d..1    87.619297: cdns3_ring:
                      Ring contents for ep1out:
                      Ring deq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
                      Ring enq index: 2, trb: 0000000059b34b67 (virt), 0xc4003018 (dma)
                      free trbs: 38, CCS=1, PCS=1
                      @0x00000000c4003000 bd195800 0000001f 00000427
                      @0x00000000c400300c bd198000 80020400 00000425
                      @0x00000000c4003018 bcfcc000 0000001f 00000426
                      @0x00000000c4003024 bcfce800 0000001f 00000426
      		...
      
          file-storage-675   [001] d..1    87.619305: cdns3_doorbell_epx: ep1out, ep_trbaddr c4003018
          file-storage-675   [001] ....    87.619308: usb_ep_queue: ep1out: req 000000002ebce364 length 0/1024 sgs 0/0 stream 0 zsI status -115 --> 0
       irq/144-5b13000-698   [000] d..1    87.619315: cdns3_epx_irq: IRQ for ep1out: 01000c80 TRBERR , ep_traddr: c4003018 ep_last_sid: 00000000 use_streams: 0
       irq/144-5b13000-698   [000] d..1    87.619395: cdns3_usb_irq: IRQ 00000008 = Hot Reset
      
      Fixes: f616c3bd ("usb: cdns3: Fix dequeue implementation")
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      95f5acfc
    • Peter Chen's avatar
      usb: cdns3: ep0: delete the unnecessary operation · 33c4b00b
      Peter Chen authored
      It doesn't need to enable/disable L1 on the fly for EP0 transfer,
      we only need to enable L1 after SET_CONFIGURATION.
      
      This code may be introduced by careless.
      
      Cc: Pawel Laszczak <pawell@cadence.com>
      Signed-off-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      33c4b00b
    • Evgeny Novikov's avatar
      usb: gadget: net2272: skip BAR1 on error handling paths in probe · ae90cc82
      Evgeny Novikov authored
      net2272_rdk1_probe() skips "i == 1" (BAR1) during allocation of
      resources. The patch does this on error hanling paths as well.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: default avatarEvgeny Novikov <novikov@ispras.ru>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      ae90cc82
    • Chunfeng Yun's avatar
      usb: gadget: bdc: use readl_poll_timeout() to simplify code · 75ae051e
      Chunfeng Yun authored
      Use readl_poll_timeout() to poll register status
      
      Cc: Florian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Signed-off-by: default avatarChunfeng Yun <chunfeng.yun@mediatek.com>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      75ae051e
    • Marek Szyprowski's avatar
      usb: dwc2: Fix error path in gadget registration · 33a06f13
      Marek Szyprowski authored
      When gadget registration fails, one should not call usb_del_gadget_udc().
      Ensure this by setting gadget->udc to NULL. Also in case of a failure
      there is no need to disable low-level hardware, so return immiedetly
      instead of jumping to error_init label.
      
      This fixes the following kernel NULL ptr dereference on gadget failure
      (can be easily triggered with g_mass_storage without any module
      parameters):
      
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
      dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
      Mass Storage Function, version: 2009/09/11
      LUN: removable file: (no medium)
      no file given for LUN0
      g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
      8<--- cut here ---
      Unable to handle kernel NULL pointer dereference at virtual address 00000104
      pgd = (ptrval)
      [00000104] *pgd=00000000
      Internal error: Oops: 805 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc5 #3133
      Hardware name: Samsung Exynos (Flattened Device Tree)
      Workqueue: events deferred_probe_work_func
      PC is at usb_del_gadget_udc+0x38/0xc4
      LR is at __mutex_lock+0x31c/0xb18
      ...
      Process kworker/0:1 (pid: 12, stack limit = 0x(ptrval))
      Stack: (0xef121db0 to 0xef122000)
      ...
      [<c076bf3c>] (usb_del_gadget_udc) from [<c0726bec>] (dwc2_hsotg_remove+0x10/0x20)
      [<c0726bec>] (dwc2_hsotg_remove) from [<c0711208>] (dwc2_driver_probe+0x57c/0x69c)
      [<c0711208>] (dwc2_driver_probe) from [<c06247c0>] (platform_drv_probe+0x6c/0xa4)
      [<c06247c0>] (platform_drv_probe) from [<c0621df4>] (really_probe+0x200/0x48c)
      [<c0621df4>] (really_probe) from [<c06221e8>] (driver_probe_device+0x78/0x1fc)
      [<c06221e8>] (driver_probe_device) from [<c061fcd4>] (bus_for_each_drv+0x74/0xb8)
      [<c061fcd4>] (bus_for_each_drv) from [<c0621b54>] (__device_attach+0xd4/0x16c)
      [<c0621b54>] (__device_attach) from [<c0620c98>] (bus_probe_device+0x88/0x90)
      [<c0620c98>] (bus_probe_device) from [<c06211b0>] (deferred_probe_work_func+0x3c/0xd0)
      [<c06211b0>] (deferred_probe_work_func) from [<c0149280>] (process_one_work+0x234/0x7dc)
      [<c0149280>] (process_one_work) from [<c014986c>] (worker_thread+0x44/0x51c)
      [<c014986c>] (worker_thread) from [<c0150b1c>] (kthread+0x158/0x1a0)
      [<c0150b1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
      Exception stack(0xef121fb0 to 0xef121ff8)
      ...
      ---[ end trace 9724c2fc7cc9c982 ]---
      
      While fixing this also fix the double call to dwc2_lowlevel_hw_disable()
      if dr_mode is set to USB_DR_MODE_PERIPHERAL. In such case low-level
      hardware is already disabled before calling usb_add_gadget_udc(). That
      function correctly preserves low-level hardware state, there is no need
      for the second unconditional dwc2_lowlevel_hw_disable() call.
      
      Fixes: 207324a3 ("usb: dwc2: Postponed gadget registration to the udc class driver")
      Acked-by: default avatarMinas Harutyunyan <hminas@synopsys.com>
      Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      33a06f13
    • Michał Mirosław's avatar
      usb: gadget: udc: atmel: implement .pullup callback · abac8a85
      Michał Mirosław authored
      Implement udc->pullup callback, so that udc_connect/disconnect work.
      This is needed for composite gadget, as it assumes udc_disconnect()
      actually works and calls its ->disconnect callback.
      Acked-by: default avatarCristian Birsan <cristian.birsan@microchip.com>
      Acked-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
      Signed-off-by: default avatarMichał Mirosław <mirq-linux@rere.qmqm.pl>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      abac8a85
    • Marek Szyprowski's avatar
      usb: gadget: udc: Flush pending work also in error path · 37d9453b
      Marek Szyprowski authored
      When binding an UDC driver to the pending gadget fails in
      check_pending_gadget_drivers(), the usb_add_gadget_udc_release() function
      ends without waiting for the usb_gadget_state_work to finish, what in
      turn might cause the whole struct usb_gadget being freed by the caller
      before the usb_gadget_state_work being executed.
      
      This can be observed on some boards with USB Mass Storage gadget
      compiled-in and kernel booted without the needed module parameters:
      
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
      dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
      dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
      Mass Storage Function, version: 2009/09/11
      LUN: removable file: (no medium)
      no file given for LUN0
      g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
      dwc2: probe of 12480000.hsotg failed with error -22
      8<--- cut here ---
      Unable to handle kernel NULL pointer dereference at virtual address 00000004
      pgd = (ptrval)
      [00000004] *pgd=00000000
      Internal error: Oops: 5 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 1 PID: 88 Comm: kworker/1:2 Not tainted 5.8.0-rc5-next-20200715-00062-gc5bb489ae825-dirty #8792
      Hardware name: Samsung Exynos (Flattened Device Tree)
      Workqueue:  0x0 (rcu_gp)
      PC is at process_one_work+0x44/0x7dc
      ...
      Process kworker/1:2 (pid: 88, stack limit = 0x(ptrval))
      Stack: (0xed9f1f00 to 0xed9f2000)
      ...
      [<c0148590>] (process_one_work) from [<c0148d6c>] (worker_thread+0x44/0x51c)
      [<c0148d6c>] (worker_thread) from [<c01500c0>] (kthread+0x158/0x1a0)
      [<c01500c0>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
      Exception stack(0xed9f1fb0 to 0xed9f1ff8)
      ...
      ---[ end trace 5033c1326a62e5f3 ]---
      note: kworker/1:2[88] exited with preempt_count 1
      
      Fix this by flushing pending work in error path.
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      37d9453b
    • Peter Chen's avatar
      usb: cdns3: gadget: improve the set_configuration handling · f4cfe5ce
      Peter Chen authored
      - Delete the duplicated EP_CMD_ERDY and EP_CMD_REQ_CMPL setting
      - Prepare the next setup before setting EP_CMD_ERDY and EP_CMD_REQ_CMPL,
      it could avoid a bug that DMA hang at EP0 OUT for DEV_VER_NXP_V1
      - Delete the duplicated cdns3_set_hw_configuration calling at
      cdns3_req_ep0_set_configuration, the composite.c will handle
      this request, and call .ep0_queue back, and at .ep_queue it will
      call cdns3_set_hw_configuration.
      - Move cdns3_allow_enable_l1 into cdns3_set_hw_configuration since
      it is part of this function.
      Signed-off-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      f4cfe5ce
    • Dan Robertson's avatar
      usb: dwc3: meson-g12a: fix shared reset control use · 7a410953
      Dan Robertson authored
      The reset is a shared reset line, but reset_control_reset is still used
      and reset_control_deassert is not guaranteed to have been called before
      the first reset_control_assert call. When suspending the following
      warning may be seen:
      
      WARNING: CPU: 1 PID: 5530 at drivers/reset/core.c:355 reset_control_assert+0x184/0x19c
      Hardware name: Hardkernel ODROID-N2 (DT)
      [..]
      pc : reset_control_assert+0x184/0x19c
      lr : dwc3_meson_g12a_suspend+0x68/0x7c
      [..]
      Call trace:
       reset_control_assert+0x184/0x19c
       dwc3_meson_g12a_suspend+0x68/0x7c
       platform_pm_suspend+0x28/0x54
       __device_suspend+0x590/0xabc
       dpm_suspend+0x104/0x404
       dpm_suspend_start+0x84/0x1bc
       suspend_devices_and_enter+0xc4/0x4fc
       pm_suspend+0x198/0x2d4
      
      Fixes: 6d9fa35a ("usb: dwc3: meson-g12a: get the reset as shared")
      Signed-off-by: default avatarDan Robertson <dan@dlrobertson.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
      7a410953
  2. 23 Jul, 2020 2 commits
  3. 22 Jul, 2020 1 commit
  4. 21 Jul, 2020 14 commits
  5. 20 Jul, 2020 1 commit
  6. 19 Jul, 2020 3 commits
    • Linus Torvalds's avatar
      Linux 5.8-rc6 · ba47d845
      Linus Torvalds authored
      ba47d845
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-2020-07-19' of... · 92188b41
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into master
      
      Pull perf tooling fixes from Arnaldo Carvalho de Melo:
      
       - Update hashmap.h from libbpf and kvm.h from x86's kernel UAPI.
      
       - Set opt->set in libsubcmd's OPT_CALLBACK_SET(). This fixes
         'perf record --switch-output-event event-name' usage"
      
      * tag 'perf-tools-fixes-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        tools arch kvm: Sync kvm headers with the kernel sources
        perf tools: Sync hashmap.h with libbpf's
        libsubcmd: Fix OPT_CALLBACK_SET()
      92188b41
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2020-07-19' of... · efb9666e
      Linus Torvalds authored
      Merge tag 'x86-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
      
      Pull x86 fixes from Thomas Gleixner:
       "A pile of fixes for x86:
      
         - Fix the I/O bitmap invalidation on XEN PV, which was overlooked in
           the recent ioperm/iopl rework. This caused the TSS and XEN's I/O
           bitmap to get out of sync.
      
         - Use the proper vectors for HYPERV.
      
         - Make disabling of stack protector for the entry code work with GCC
           builds which enable stack protector by default. Removing the option
           is not sufficient, it needs an explicit -fno-stack-protector to
           shut it off.
      
         - Mark check_user_regs() noinstr as it is called from noinstr code.
           The missing annotation causes it to be placed in the text section
           which makes it instrumentable.
      
         - Add the missing interrupt disable in exc_alignment_check()
      
         - Fixup a XEN_PV build dependency in the 32bit entry code
      
         - A few fixes to make the Clang integrated assembler happy
      
         - Move EFI stub build to the right place for out of tree builds
      
         - Make prepare_exit_to_usermode() static. It's not longer called from
           ASM code"
      
      * tag 'x86-urgent-2020-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/boot: Don't add the EFI stub to targets
        x86/entry: Actually disable stack protector
        x86/ioperm: Fix io bitmap invalidation on Xen PV
        x86: math-emu: Fix up 'cmp' insn for clang ias
        x86/entry: Fix vectors to IDTENTRY_SYSVEC for CONFIG_HYPERV
        x86/entry: Add compatibility with IAS
        x86/entry/common: Make prepare_exit_to_usermode() static
        x86/entry: Mark check_user_regs() noinstr
        x86/traps: Disable interrupts in exc_aligment_check()
        x86/entry/32: Fix XEN_PV build dependency
      efb9666e