redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
889,999 Commits
15 Branches
0 Tags
3.4 GiB
Commit Graph

99 Commits (redonkable)

Author SHA1 Message Date
Andrey Zhizhikin ee7b6ad15b This is the 5.4.67 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9rJlYACgkQONu9yGCS
 aT6WbRAAga6QVKrO6R4NeKk0fPqKQQoQeTK+phBOFA7jAoX/rIRKyob2Si9BwhBA
 F77vZ6HIZ7+e/o35JJQYQbffbHYs0ANuS1oHGqe0vgbh+72Viaan6g7lFOhpx8qf
 y0YS7q+hw4WLZB0gGlBM7nkPXRiis32IrEVabQW+t8hmT2lWyutY8E2yFAU60tvI
 Tvjm2c2pvHEcHz9MrjEd/jIVxMFnIl42FBTx9bGsbDUCDzBwEvPArS4bNioP7EFJ
 O+rrGCNvwtiv0DuKzX1UIZzQ88IROmU3ZjsIlgOwla7xJWv4QDgmPfyAyRI48QhH
 PAZQmSntz+y+MP6B3z3ZBrxc2Fx0kCDtugn2P9+2RVUEpheANJ293vUgYTKN9Roy
 dHdWHFWNTO9IYpIN0cZjc25db4ULdjerWQrKcCr6ZO8+Ep/0mSzx3lkWjfuUP8Hr
 L2RD6rAm259OpPq8xhAcJpJvoQLwGxaBHyr4QYUmRgmNVURoqe9Q0MTZuiyGsXhm
 rtcNky9WvmyyI1lJgXi4A+vmsIThCHEstEMycgTejfJ4itIVA9e1ctJVVomWULCn
 9oNStBJpmHw0myDCohbKNjeO1UX/erdF9NaoGto5bnfIhcSae1YQEjRB8zKmzbg1
 DpgC1f7IZ7q53vfrDGsAjInOcuEwAn/Y5JMLJOL4mdA9j3XlX2o=
 =Ot99
 -----END PGP SIGNATURE-----

Merge tag 'v5.4.67' into 5.4-2.2.x-imx

This is the 5.4.67 stable release

This updates the kernel present in the NXP release imx_5.4.47_2.2.0 to the
latest patchset available from stable korg.

Base stable kernel version present in the NXP BSP release is v5.4.47.

Following conflicts were recorded and resolved:
- arch/arm/mach-imx/pm-imx6.c
NXP version has a different PM vectoring scheme, where the IRAM bottom
half (8k) is used to store IRAM code and pm_info. Keep this version to
be compatible with NXP PM implementation.

- arch/arm64/boot/dts/freescale/imx8mm-evk.dts
- arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts
NXP patches kept to provide proper LDO setup:
imx8mm-evk.dts: 975d8ab07267ded741c4c5d7500e524c85ab40d3
imx8mn-ddr4-evk.dts: e8e35fd0e759965809f3dca5979a908a09286198

- drivers/crypto/caam/caamalg.c
Keep NXP version, as it already covers the functionality for the
upstream patch [d6bbd4eea2]

- drivers/gpu/drm/imx/dw_hdmi-imx.c
- drivers/gpu/drm/imx/imx-ldb.c
- drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
Port changes from upstream commit [1a27987101], which extends
component lifetime by moving drm structures allocation/free from
bind() to probe().

- drivers/gpu/drm/imx/imx-ldb.c
Merge patch [1752ab50e8] from upstream to disable both LVDS channels
when Enoder is disabled

- drivers/mmc/host/sdhci-esdhc-imx.c
Fix merge fuzz produced by [6534c897fd].

- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
Commit d1a00c9bb1 from upstream solves the issue with improper error
reporting when qdisc type support is absent. Upstream version is merged
into NXP implementation.

- drivers/net/ethernet/freescale/enetc/enetc.c
Commit [ce06fcb6a6] from upstream merged,
base NXP version kept

- drivers/net/ethernet/freescale/enetc/enetc_pf.c
Commit [e8b86b4d87] from upstream solves
the kernel panic in case if probing fails. NXP has a clean-up logic
implemented different, where the MDIO remove would be invoked in any
failure case. Keep the NXP logic in place.

- drivers/thermal/imx_thermal.c
Upstream patch [9025a5589c] adds missing
of_node_put call, NXP version has been adapted to accommodate this patch
into the code.

- drivers/usb/cdns3/ep0.c
Manual merge of commit [be8df02707] from
upstream to protect cdns3_check_new_setup

- drivers/xen/swiotlb-xen.c
Port upstream commit cca58a1669 to NXP tree, manual hunk was
resolved during merge.

- sound/soc/fsl/fsl_esai.c
Commit [53057bd4ac] upstream addresses the problem of endless isr in
case if exception interrupt is enabled and tasklet is scheduled. Since
NXP implementation has tasklet removed with commit [2bbe95fe6c],
upstream fix does not match the main implementation, hence we keep the
NXP version here.

- sound/soc/fsl/fsl_sai.c
Apply patch [b8ae2bf5cc] from upstream, which uses FIFO watermark
mask macro.

Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
 2020-09-26 20:54:42 +00:00
Sasha Levin 961bfe1277 usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint 
[ Upstream commit 95f5acfc4f ]

During the endpoint dequeue operation, it changes dequeued TRB as link
TRB, when the endpoint is disabled and re-enabled, the DMA fetches the
TRB before the link TRB, after it handles current TRB, the DMA pointer
will advance to the TRB after link TRB, but enqueue and dequene
variables don't know it due to no hardware interrupt at the time, when
the next TRB is added to link TRB position, the DMA will not handle
this TRB due to its pointer is already at the next TRB. See the trace
log like below:

file-storage-675   [001] d..1    86.585657: usb_ep_queue: ep0: req 00000000df9b3a4f length 0/0 sgs 0/0 stream 0 zsI status 0 --> 0
file-storage-675   [001] d..1    86.585663: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr (null)], flags:0 SID: 0
file-storage-675   [001] d..1    86.585671: cdns3_prepare_trb: ep1out: trb 000000007f770303, dma buf: 0xbd195800, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
file-storage-675   [001] d..1    86.585676: cdns3_ring:
            Ring contents for ep1out:
            Ring deq index: 0, trb: 000000007f770303 (virt), 0xc4003000 (dma)
            Ring enq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
            free trbs: 38, CCS=1, PCS=1
            @0x00000000c4003000 bd195800 80020400 00000425
            @0x00000000c400300c c4003018 80020400 00001811
            @0x00000000c4003018 bcfcc000 0000001f 00000426
            @0x00000000c4003024 bcfce800 0000001f 00000426

	    ...

 irq/144-5b13000-698   [000] d...    87.619286: usb_gadget_giveback_request: ep1in: req 0000000031b832eb length 13/13 sgs 0/0 stream 0 zsI status 0 --> 0
    file-storage-675   [001] d..1    87.619287: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr 0x80020400c400300c], flags:0 SID: 0
    file-storage-675   [001] d..1    87.619294: cdns3_prepare_trb: ep1out: trb 0000000049c1ba21, dma buf: 0xbd198000, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
    file-storage-675   [001] d..1    87.619297: cdns3_ring:
                Ring contents for ep1out:
                Ring deq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
                Ring enq index: 2, trb: 0000000059b34b67 (virt), 0xc4003018 (dma)
                free trbs: 38, CCS=1, PCS=1
                @0x00000000c4003000 bd195800 0000001f 00000427
                @0x00000000c400300c bd198000 80020400 00000425
                @0x00000000c4003018 bcfcc000 0000001f 00000426
                @0x00000000c4003024 bcfce800 0000001f 00000426
		...

    file-storage-675   [001] d..1    87.619305: cdns3_doorbell_epx: ep1out, ep_trbaddr c4003018
    file-storage-675   [001] ....    87.619308: usb_ep_queue: ep1out: req 000000002ebce364 length 0/1024 sgs 0/0 stream 0 zsI status -115 --> 0
 irq/144-5b13000-698   [000] d..1    87.619315: cdns3_epx_irq: IRQ for ep1out: 01000c80 TRBERR , ep_traddr: c4003018 ep_last_sid: 00000000 use_streams: 0
 irq/144-5b13000-698   [000] d..1    87.619395: cdns3_usb_irq: IRQ 00000008 = Hot Reset

Fixes: f616c3bda4 ("usb: cdns3: Fix dequeue implementation")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2020-09-03 11:26:49 +02:00
Peter Chen 2475b58432
usb: cdns3: gadget: improve the set_configuration handling 
- Delete the duplicated EP_CMD_ERDY and EP_CMD_REQ_CMPL setting
- Prepare the next setup before setting EP_CMD_ERDY and EP_CMD_REQ_CMPL,
it could avoid a bug that DMA hang at EP0 OUT for DEV_VER_NXP_V1
- Delete the duplicated cdns3_set_hw_configuration calling at
cdns3_req_ep0_set_configuration, the composite.c will handle
this request, and call .ep0_queue back, and at .ep_queue it will
call cdns3_set_hw_configuration.

(This patch is porting from upstream with some tiny changes)
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
 2020-08-05 09:50:17 +08:00
Peter Chen 07408c690b
MLK-24283-3 usb: cdns3: gadget: the TD_SIZE entry is 16 bit at TRB 
The TD_SIZE entry is 16 bit at TRB for HS/FS, it fixed the issue
if the request length is 16384 bytes for FS transfer, at this case,
the TD_SIZE is 0 at current code.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-06-17 10:06:05 +08:00
Peter Chen aa917820d3
MLK-24283-2 usb: cdns3: gadget: Add L1 resume workaround 
The Cadence device doesn't have abilities to send L1 resume by hardware,
so the software needs to send L1 resume at below situations:
- When the software is prepared to transfer
- When the bus is in L1 suspend

If the bus is not in L1 suspend, sending resume by software has no real
effect.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-06-17 10:06:05 +08:00
Peter Chen e6be4400ac usb: cdns3: gadget: prev_req->trb is NULL for ep0 
commit 95cd7dc47a upstream.

And there are no multiple TRBs on EP0 and WA1 workaround,
so it doesn't need to change TRB for EP0. It fixes below oops.

configfs-gadget gadget: high-speed config #1: b
android_work: sent uevent USB_STATE=CONFIGURED
Unable to handle kernel read from unreadable memory at virtual address 0000000000000008
Mem abort info:
android_work: sent uevent USB_STATE=DISCONNECTED
  ESR = 0x96000004
  EC = 0x25: DABT (current EL), IL = 32 bits

  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b5bb7000
[0000000000000008] pgd=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 2 PID: 430 Comm: HwBinder:401_1 Not tainted 5.4.24-06071-g6fa8921409c1-dirty #77
Hardware name: Freescale i.MX8QXP MEK (DT)
pstate: 60400085 (nZCv daIf +PAN -UAO)
pc : cdns3_gadget_ep_dequeue+0x1d4/0x270
lr : cdns3_gadget_ep_dequeue+0x48/0x270
sp : ffff800012763ba0
x29: ffff800012763ba0 x28: ffff00082c653c00
x27: 0000000000000000 x26: ffff000068fa7b00
x25: ffff0000699b2000 x24: ffff00082c6ac000
x23: ffff000834f0a480 x22: ffff000834e87b9c
x21: 0000000000000000 x20: ffff000834e87800
x19: ffff000069eddc00 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000001
x11: ffff80001180fbe8 x10: 0000000000000001
x9 : ffff800012101558 x8 : 0000000000000001
x7 : 0000000000000006 x6 : ffff000835d9c668
x5 : ffff000834f0a4c8 x4 : 0000000096000000
x3 : 0000000000001810 x2 : 0000000000000000
x1 : ffff800024bd001c x0 : 0000000000000001
Call trace:
 cdns3_gadget_ep_dequeue+0x1d4/0x270
 usb_ep_dequeue+0x34/0xf8
 composite_dev_cleanup+0x154/0x170
 configfs_composite_unbind+0x6c/0xa8
 usb_gadget_remove_driver+0x44/0x70
 usb_gadget_unregister_driver+0x74/0xe0
 unregister_gadget+0x28/0x58
 gadget_dev_desc_UDC_store+0x80/0x110
 configfs_write_file+0x1e0/0x2a0
 __vfs_write+0x48/0x90
 vfs_write+0xe4/0x1c8
 ksys_write+0x78/0x100
 __arm64_sys_write+0x24/0x30
 el0_svc_common.constprop.0+0x74/0x168
 el0_svc_handler+0x34/0xa0
 el0_svc+0x8/0xc
Code: 52830203 b9407660 f94042e4 11000400 (b9400841)
---[ end trace 1574516e4c1772ca ]---
Kernel panic - not syncing: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x0002,20002008
Memory Limit: none
Rebooting in 5 seconds..

Fixes: f616c3bda4 ("usb: cdns3: Fix dequeue implementation")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-05-20 08:20:31 +02:00
Peter Chen f7f8a6ec4b
MLK-23913-6 usb: cdns3: gadget: refine the stop flow 
The new usb_gadget_disconnect API includes both calling class
driver's disconnect and calling .pullup at udc driver, so we
could simply your udc driver handling.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-05-11 07:14:37 +08:00
Peter Chen 291cd74401
MLK-23913-5 usb: cdns3: gadget: clear the interrupt status when disconnect the host 
We do not want to handle any interrupts after usb_gadget_disconnect
is called.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-05-11 07:14:37 +08:00
Peter Chen 62faac59a9
MLK-23913-4 usb: cdns3: gadget: set fast access bit 
Below is the recommendation from Cadence designer:
Using this bit to be sure that PHY clock is keeping up in active
state. It's good to keep Fast Access bit enabled as long as there
is any access to USB register.

It is used to fix the potential ARM core hang when visit controller
register after DEVDS is set.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-05-11 07:14:37 +08:00
Peter Chen 6aaf410cb5
MLK-23913-3 usb: cdns3: gadget: prev_req->trb is NULL for ep0 
And there are no multiple TRBs on EP0 and WA1 workaround,
so it doesn't need to change TRB for EP0. It fixes below oops.

configfs-gadget gadget: high-speed config #1: b
android_work: sent uevent USB_STATE=CONFIGURED
Unable to handle kernel read from unreadable memory at virtual address 0000000000000008
Mem abort info:
android_work: sent uevent USB_STATE=DISCONNECTED
  ESR = 0x96000004
  EC = 0x25: DABT (current EL), IL = 32 bits

  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b5bb7000
[0000000000000008] pgd=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 2 PID: 430 Comm: HwBinder:401_1 Not tainted 5.4.24-06071-g6fa8921409c1-dirty #77
Hardware name: Freescale i.MX8QXP MEK (DT)
pstate: 60400085 (nZCv daIf +PAN -UAO)
pc : cdns3_gadget_ep_dequeue+0x1d4/0x270
lr : cdns3_gadget_ep_dequeue+0x48/0x270
sp : ffff800012763ba0
x29: ffff800012763ba0 x28: ffff00082c653c00
x27: 0000000000000000 x26: ffff000068fa7b00
x25: ffff0000699b2000 x24: ffff00082c6ac000
x23: ffff000834f0a480 x22: ffff000834e87b9c
x21: 0000000000000000 x20: ffff000834e87800
x19: ffff000069eddc00 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000001
x11: ffff80001180fbe8 x10: 0000000000000001
x9 : ffff800012101558 x8 : 0000000000000001
x7 : 0000000000000006 x6 : ffff000835d9c668
x5 : ffff000834f0a4c8 x4 : 0000000096000000
x3 : 0000000000001810 x2 : 0000000000000000
x1 : ffff800024bd001c x0 : 0000000000000001
Call trace:
 cdns3_gadget_ep_dequeue+0x1d4/0x270
 usb_ep_dequeue+0x34/0xf8
 composite_dev_cleanup+0x154/0x170
 configfs_composite_unbind+0x6c/0xa8
 usb_gadget_remove_driver+0x44/0x70
 usb_gadget_unregister_driver+0x74/0xe0
 unregister_gadget+0x28/0x58
 gadget_dev_desc_UDC_store+0x80/0x110
 configfs_write_file+0x1e0/0x2a0
 __vfs_write+0x48/0x90
 vfs_write+0xe4/0x1c8
 ksys_write+0x78/0x100
 __arm64_sys_write+0x24/0x30
 el0_svc_common.constprop.0+0x74/0x168
 el0_svc_handler+0x34/0xa0
 el0_svc+0x8/0xc
Code: 52830203 b9407660 f94042e4 11000400 (b9400841)
---[ end trace 1574516e4c1772ca ]---
Kernel panic - not syncing: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x0002,20002008
Memory Limit: none
Rebooting in 5 seconds..

Fixes: f616c3bda4 ("usb: cdns3: Fix dequeue implementation")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-05-11 07:14:37 +08:00
Peter Chen 064543d565
MLK-23913-2 usb: cdns3: gadget: assign interrupt number to gadget structure 
Assign interrupt number to USB gadget structure.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-05-11 07:14:37 +08:00
Peter Chen bf26d9822c
MLK-23809-2 usb: cdns3: gadget: delete useless parameter 'is_short' 
In cdns3_transfer_completed, it uses is_short to judge if current
request is short transfer to calculate req->actual correctly, but
is_short variable may for previous transfer, it causes req->actual
calculation wrong for current transfer. Eg, the previous transfer is
non-short tranfer, and the current one is short transfer, the req->actual
will accumulate the non-transfered TRB's length.

In fact, below condition already stands for short trasnfer for scatter
list:

	if (priv_req->num_of_trb > 1 &&
		le32_to_cpu(trb->control) & TRB_SMM)

So we could (need) to delete the parameter 'is_short'

Reviewed-by: Jun Li <jun.li@nxp.com>
Reported-by: Faqiang Zhu <faqiang.zhu@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-04-27 11:51:50 +08:00
Peter Chen 5435fea4a1
MLK-23809-1 usb: cdns3: gadget: calculate actual length correctly 
For each request, it needs to clear transfer_end, otherwise,
the second transfer's actual transfer length will not
report to class driver if the first transfer is short and both
the two transfers are handled in the same threaded irq handler.

Reviewed-by: Jun Li <jun.li@nxp.com>
Reported-by: Faqiang Zhu <faqiang.zhu@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-04-27 11:51:39 +08:00
Peter Chen 64c25ec54b
MLK-23677-1 usb: cdns3: gadget: the initialize value for trb->length should be zero 
With commit d2e892c29d ("MLK-23595-1 usb: cdns3:
gadget: calculate TDL per TD"), the first trb->length assignment
is moved before the do-while loop, but only considering DEV_VER_V2
situation, in fact, we need to initialize trb->length for all situations.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-03-27 11:21:59 +08:00
Peter Chen 147a7ddcfa
MLK-23595-5 usb: cdns3: gadget: sg_support is only for DEV_VER_V2 
The scatter buffer list support earlies for DEV_VER_V2 is not
good enough, software can't know short transfer well per
transfer. So, we only support sg for DEV_VER_V2.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-03-19 15:06:56 +08:00
Peter Chen 2d985587f1
MLK-23595-4 usb: cdns3: gadget: calculate short transfer req->actual correctly 
For short transfer, every TRB was finished in TD according to DMA pointer,
but the Transfer Length for TRBs which were not handled were not updated,
so we can't calculte these TRBs.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-03-19 15:06:53 +08:00
Peter Chen eca571c273
MLK-23595-3 usb: cdns3: gadget: improve the dump TRB at cdns3_ep_run_transfer 
We need to dump all TRBs for this transfer, but ont only the last one.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-03-19 15:06:49 +08:00
Peter Chen 3490e68497
MLK-23595-2 usb: cdns3: gadget: add CHAIN and ISP bit for sg list 
For sg buffer list use case, we need to add ISP for each TRB, and
add CHAIN bit for each TRB except for the last TRB.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-03-19 15:06:44 +08:00
Peter Chen d2e892c29d
MLK-23595-1 usb: cdns3: gadget: calculate TDL per TD 
TDL is for TD length, so we need to calculate this value per
TD, but not for TRB, and the TDL is only needed for the first
TRB in TD.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-03-19 15:06:25 +08:00
Peter Chen cb05b3e1b1 usb: cdns3: gadget: toggle cycle bit before reset endpoint 
commit 4bf2dd6513 upstream.

If there are TRBs pending during reset endpoint operation, the
DMA will advance after reset operation, but it isn't expected,
since the data is not yet available (For OUT, the data is not
yet available). After the data is ready, there won't be any
interrupt since the EP_TRADDR already points to next TRB entry
and doorbell is not set.

To fix it, it toggles cycle bit before reset operation, and restores
it after reset, it could avoid unexpected DMA advance due to
cycle bit is for software during the endpoint reset operation.

Fixes: 7733f6c32e ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200219141455.23257-3-peter.chen@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-03-12 13:00:18 +01:00
Peter Chen 39b57e6ab2 usb: cdns3: gadget: link trb should point to next request 
commit 8a7c47fb72 upstream.

It has marked the dequeue trb as link trb, but its next segment
pointer is still itself, it causes the transfer can't go on. Fix
it by set its pointer as the trb address for the next request.

Fixes: f616c3bda4 ("usb: cdns3: Fix dequeue implementation")
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200219141455.23257-2-peter.chen@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-03-12 13:00:18 +01:00
Peter Chen b201be8945
MLK-23349-3 usb: cdns3: gadget: link trb should point to next request 
It has marked the dequeue trb as link trb, but its next segment
pointer is still itself, it causes the transfer can't go on. Fix
it by set its pointer as the trb address for the next request.

Reviewed-by: Jun Li <jun.li@nxp.com>
Fixes: f616c3bda4 ("usb: cdns3: Fix dequeue implementation")
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-02-28 11:15:58 +08:00
Pawel Laszczak 46162c83c1
usb: cdns3: Fix dequeue implementation. 
Dequeuing implementation in cdns3_gadget_ep_dequeue gets first request from
deferred_req_list and changed TRB associated with it to LINK TRB.
This approach is incorrect because deferred_req_list contains requests
that have not been placed on hardware RING.  In this case driver should
just giveback this request to gadget driver.

The patch implements new approach that first checks where dequeuing
request is located and only when it's on Transfer Ring then changes TRB
associated with it to LINK TRB.
During processing completed transfers such LINK TRB will be ignored.

Reported-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Fixes: 7733f6c32e ("usb: cdns3: Add Cadence USB3 DRD Driver")
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/1570958420-22196-1-git-send-email-pawell@cadence.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-02-28 11:15:58 +08:00
Peter Chen b597790d41
MLK-23181-5 usb: cdns3: gadget: need to handle sg case for cdns3_descmiss_copy_data 
Add sg request case for cdns3_descmiss_copy_data.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-01-20 17:26:31 +08:00
Peter Chen f9e2ca657f
MLK-23181-3 usb: cdns3: gadget: handle multiple trb request properly 
We use polling EP_TRADDR to judge if the trb has finished, so for
request which includes multiple trb, we may quit the trb judgement
in the middle of request, in that case, we can't giveback the
request. We should only giveback the request when all the TRB in
this request has finished.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-01-20 17:26:19 +08:00
Peter Chen 3e7c6dff3e
MLK-23181-2 usb: cdns3: gadget: add one missing condition for cdns3_request_handled 
If the dequeue pointer advances to the first trb, but the priv_req->end_trb
is the last trb, we consider the trb this dequeue pointer points doesn't
belong to this request.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-01-20 17:23:29 +08:00
Peter Chen adb129da17
MLK-23181-1 usb: cdns3: gadget: using num_mapped_sgs for scatter list 
For some systems, the iommu or swiotlb is used, the sg list may not
the same between before and after DMA map. So we should use
num_mapped_sgs for DMA since it is the final DMA mapped sg list
for hardware.

Reviewed-by: Jun Li <jun.li@nxp.com>
Reported-by: Zhang Sanshan <pete.zhang@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2020-01-20 17:23:04 +08:00
Peter Chen f1fcfe2293 usb: cdns3: should not use the same dev_id for shared interrupt handler 
commit af58e1fca9 upstream.

Both drd and gadget interrupt handler use the struct cdns3 pointer as
dev_id, it causes devm_free_irq at cdns3_gadget_exit doesn't free
gadget's interrupt handler, it freed drd's handler. So, when the
host interrupt occurs, the gadget's interrupt hanlder is still
called, and causes below oops. To fix it, we use gadget's private
data priv_dev as interrupt dev_id for gadget.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000380
Mem abort info:
  ESR = 0x96000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000971d79000
[0000000000000380] pgd=0000000971d6f003, pud=0000000971d6e003, pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in: mxc_jpeg_encdec crct10dif_ce fsl_imx8_ddr_perf
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-03486-g69f4e7d9c54a-dirty #254
Hardware name: Freescale i.MX8QM MEK (DT)
pstate: 00000085 (nzcv daIf -PAN -UAO)
pc : cdns3_device_irq_handler+0x1c/0xb8
lr : __handle_irq_event_percpu+0x78/0x2c0
sp : ffff800010003e30
x29: ffff800010003e30 x28: ffff8000129bb000
x27: ffff8000126e9000 x26: ffff0008f61b5600
x25: ffff800011fe1018 x24: ffff8000126ea120
x23: ffff800010003f04 x22: 0000000000000000
x21: 0000000000000093 x20: ffff0008f61b5600
x19: ffff0008f5061a80 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 003d090000000000
x13: 00003d0900000000 x12: 0000000000000000
x11: 00003d0900000000 x10: 0000000000000040
x9 : ffff800012708cb8 x8 : ffff800012708cb0
x7 : ffff0008f7c7a9d0 x6 : 0000000000000000
x5 : ffff0008f7c7a910 x4 : ffff8008ed359000
x3 : ffff800010003f40 x2 : 0000000000000000
x1 : ffff0008f5061a80 x0 : ffff800010161a60
Call trace:
 cdns3_device_irq_handler+0x1c/0xb8
 __handle_irq_event_percpu+0x78/0x2c0
 handle_irq_event_percpu+0x40/0x98
 handle_irq_event+0x4c/0xd0
 handle_fasteoi_irq+0xbc/0x168
 generic_handle_irq+0x34/0x50
 __handle_domain_irq+0x6c/0xc0
 gic_handle_irq+0xd4/0x174
 el1_irq+0xb8/0x180
 arch_cpu_idle+0x3c/0x230
 default_idle_call+0x38/0x40
 do_idle+0x20c/0x298
 cpu_startup_entry+0x28/0x48
 rest_init+0xdc/0xe8
 arch_call_rest_init+0x14/0x1c
 start_kernel+0x48c/0x4b8
Code: aa0103f3 aa1e03e0 d503201f f9409662 (f941c040)
---[ end trace 091dcf4dee011b0e ]---
Kernel panic - not syncing: Fatal exception in interrupt
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x0002,2100600c
Memory Limit: none
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

Fixes: 7733f6c32e ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: <stable@vger.kernel.org> #v5.4
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/1577437804-18146-1-git-send-email-peter.chen@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-01-14 20:08:29 +01:00
Peter Chen 4ad131b729
LF-468-1 usb: cdns3: gadget: handle trb correctly at sg case 
At current transfer complete handler, it doesn't consider
sg (scatter buffer list) case, and only handles single trb
request. In fact, we need to handle every trbs in request,
and giveback the request after all trbs are handled.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-12-18 15:12:09 +08:00
Peter Chen f262be36f6
LF-252 usb: cdns3: gadget: fix the issue for DMA scatter buffer list 
If the DMA buffer is sgatter list, current TD organization is wrong.
Fix this in this commit. We triggered this issue due to the f_fs
begins to use scatter buffer list as data buffer.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-29 16:28:05 +08:00
Peter Chen 6613a67cd8
MLK-22878 usb: cdns3: gadget: add imx8qxp C0 support 
We use controller version to differetiate between B0 (0x00024502)
and C0 (0x0002450C). The controller uses TDL check to
avoid "NO NAK" issue at B0 if there is not buffer for OUT, this issue
is described at "Work around 2" at the begin of gadget.c

At default, the TDL value is 0, so it always NAK host's OUT token.
When the TD is added, the TDL value is non-zero, it will respond
NAK/ACK according to OUT FIFO's situation.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-27 10:03:20 +08:00
Peter Chen 32b92522ec
MA-15789-1 usb: cdns3: gadget: move USB interrupt handling to thread irq 
Since the endpoint interrupt handling is at thread irq, to align with
it, move USB interrupt handling to thread irq, otherwise, it may has
lock recursion issue.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-26 09:07:11 +08:00
Peter Chen b2d9251b02 MLK-22527-1 usb: cdns3: gadget: quit functional halt if there are pending requests 
If the non-control endpoints want to halt, but there are pending
requests on this endpoint, we need to return -EAGAIN, otherwise,
the controller may be in stuck if we stall the doolbell'ed
endpoint.

With this change, we could pass the USB certification MSC test.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:27 +08:00
Peter Chen d1fea6ce83 MLK-22366-7 usb: cdns3: gadget: quit if endpoint has already disabled 
It fixed below oops:
audit: audit_lost=500851 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
libprocessgroup: Successfully killed process cgroup uid 0 pid 25371 in 49ms
init: Service 'adbd' (pid 25371) received signal 9
init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:14)
init: Received control message 'start' for 'adbd' from pid: 3308 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
init: starting service 'adbd'...
init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000
read descriptors
read strings
init: Received control message 'start' for 'adbd' from pid: 3447 (system_server)
android_work: did not send uevent (0 0           (null))
audit: audit_lost=500888 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
audit: audit_lost=500925 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
using random self ethernet address
using random host ethernet address
read descriptors
read strings
usb0: HOST MAC 32:e7:67:29:5f:d8
usb0: MAC 02:5c:48:b3:2b:d7
android_work: sent uevent USB_STATE=CONNECTED
configfs-gadget gadget: high-speed config #1: b
android_work: sent uevent USB_STATE=CONFIGURED
Unable to handle kernel NULL pointer dereference at virtual address 00000002
Mem abort info:
  Exception class = DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgd = ffff8008f7bed000
[0000000000000002] *pgd=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 2 PID: 3326 Comm: Binder:3276_2 Not tainted 4.14.98-07848-gfb2a5a8 #1
Hardware name: Freescale i.MX8QM MEK (DT)
task: ffff8008f77f3800 task.stack: ffff00000b378000
PC is at __cdns3_gadget_ep_queue.isra.18+0x238/0x524
LR is at cdns3_gadget_ep_queue+0x44/0xd8
pc : [<ffff0000089bbf90>] lr : [<ffff0000089bc2c0>] pstate: 400001c5
sp : ffff00000b37ba40
x29: ffff00000b37ba40 x28: ffff8008f235fa00
x27: ffff8008f2f11600 x26: ffff8008f2dee118
x25: ffff8008f2df0000 x24: 0000000000000000
x23: ffff000009c8e000 x22: ffff8008f2df0000
x21: 0000000000000000 x20: ffff8008f2dee118
x19: ffff8008f1f1ac00 x18: 0000fcc72810fc1a
x17: 0000fcc729e2d0e0 x16: ffff0000082b4430
x15: 0000000000000000 x14: ffffffffffffffff
x13: 0000000000000000 x12: 0000000000000020
x11: 0000000000000020 x10: 0101010101010101
x9 : 0000000000000000 x8 : 0000000000000024
x7 : 0000000040000000 x6 : 0000000000000020
x5 : 0000000000000000 x4 : 0000000000000000
x3 : 0000000000000140 x2 : 0000000000000000
x1 : ffff8008f1f1ac00 x0 : ffff8008f7738010

X0: 0xffff8008f7737f90:
7f90  f75baef8 ffff8008 00000000 00000000 3305708c 00000000 f7332aa0 ffff8008
7fb0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fd0  00005408 00000001 a1ff0014 00000000 00000000 00000000 00000000 00000000
7ff0  00000000 00000000 00000000 00000000 f7548780 ffff8008 ffffffff 00000000
8010  09dc50d8 ffff0000 f76fc800 ffff8008 f7548780 ffff8008 f7738428 ffff8008
8030  f76e7c28 ffff8008 09dc50e8 ffff0000 f6e6ae80 ffff8008 09dc4ac8 ffff0000
8050  f753e660 ffff8008 00000007 00000007 00000000 00000000 00000000 00000000
8070  00000000 00000000 00000000 00000000 f7738080 ffff8008 f7738080 ffff8008

X1: 0xffff8008f1f1ab80:
ab80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
aba0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abe0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ac00  ec128080 ffff8008 0000062a 00000000 f5383800 00000000 00000000 00000000
ac20  00000000 00000000 00000000 00000000 08a179d8 ffff0000 e85aeb00 ffff8008
ac40  f1f1ac40 ffff8008 f1f1ac40 ffff8008 ffffff8d 00000000 f2dee118 ffff8008
ac60  0afdb024 ffff0000 00000003 00000003 00000000 00000000 00000000 00000000

X19: 0xffff8008f1f1ab80:
ab80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
aba0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
abe0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
ac00  ec128080 ffff8008 0000062a 00000000 f5383800 00000000 00000000 00000000
ac20  00000000 00000000 00000000 00000000 08a179d8 ffff0000 e85aeb00 ffff8008
ac40  f1f1ac40 ffff8008 f1f1ac40 ffff8008 ffffff8d 00000000 f2dee118 ffff8008
ac60  0afdb024 ffff0000 00000003 00000003 00000000 00000000 00000000 00000000

X20: 0xffff8008f2dee098:
e098  ae000000 00000000 f2df0000 ffff8008 00307065 00000000 00000000 00000000
e0b8  00000000 00000010 00000000 00000000 00000080 00000000 00000002 00000000
e0d8  00000000 00000000 00000002 00000000 00000000 00000000 00000000 00000000
e0f8  00000000 00000000 f2dee200 ffff8008 f2dee000 ffff8008 087793a4 ffff0000
e118  f0475900 ffff8008 f2dee1a8 ffff8008 091c36b0 ffff0000 f2dee230 ffff8008
e138  f2df0048 ffff8008 0000002e 02000000 000f0400 00000101 00000000 00000000
e158  00000000 00000000 f2dee160 ffff8008 f2dee160 ffff8008 f2dee170 ffff8008
e178  f2dee170 ffff8008 f2dee180 ffff8008 f2dee180 ffff8008 0afdb000 ffff0000

X22: 0xffff8008f2deff80:
ff80  f33b40a0 ffff8008 f3dd6810 ffff8008 f03f8de8 ffff8008 00000000 00000000
ffa0  27ac430e 00000000 00000000 00000000 f2aec128 ffff8008 f32e0680 ffff8008
ffc0  00000000 00000000 f3623400 ffff8008 000000ac 00000001 41e80011 00000000
ffe0  f3b18000 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000
0000  f7738010 ffff8008 f7738010 ffff8008 000000c0 00000000 f2df0018 ffff8008
0020  f2df0018 ffff8008 08a077e4 ffff0000 f2d42c00 ffff8008 091c3650 ffff0000
0040  f2dee018 ffff8008 f2dee130 ffff8008 f2deee30 ffff8008 00000003 00000005
0060  00000007 00000000 095d1550 ffff0000 f7738010 ffff8008 f2deef00 ffff8008

X25: 0xffff8008f2deff80:
ff80  f33b40a0 ffff8008 f3dd6810 ffff8008 f03f8de8 ffff8008 00000000 00000000
ffa0  27ac430e 00000000 00000000 00000000 f2aec128 ffff8008 f32e0680 ffff8008
ffc0  00000000 00000000 f3623400 ffff8008 000000ac 00000001 41e80011 00000000
ffe0  f3b18000 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000
0000  f7738010 ffff8008 f7738010 ffff8008 000000c0 00000000 f2df0018 ffff8008
0020  f2df0018 ffff8008 08a077e4 ffff0000 f2d42c00 ffff8008 091c3650 ffff0000
0040  f2dee018 ffff8008 f2dee130 ffff8008 f2deee30 ffff8008 00000003 00000005
0060  00000007 00000000 095d1550 ffff0000 f7738010 ffff8008 f2deef00 ffff8008

X26: 0xffff8008f2dee098:
e098  ae000000 00000000 f2df0000 ffff8008 00307065 00000000 00000000 00000000
e0b8  00000000 00000010 00000000 00000000 00000080 00000000 00000002 00000000
e0d8  00000000 00000000 00000002 00000000 00000000 00000000 00000000 00000000
e0f8  00000000 00000000 f2dee200 ffff8008 f2dee000 ffff8008 087793a4 ffff0000
e118  f0475900 ffff8008 f2dee1a8 ffff8008 091c36b0 ffff0000 f2dee230 ffff8008
e138  f2df0048 ffff8008 0000002e 02000000 000f0400 00000101 00000000 00000000
e158  00000000 00000000 f2dee160 ffff8008 f2dee160 ffff8008 f2dee170 ffff8008
e178  f2dee170 ffff8008 f2dee180 ffff8008 f2dee180 ffff8008 0afdb000 ffff0000

X27: 0xffff8008f2f11580:
1580  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
15a0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
15c0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
15e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1600  f0475000 ffff8008 00000003 00000000 f235fa00 ffff8008 00000000 00000000
1620  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1640  00000000 00000000 00000000 00000000 00000002 00000000 00000000 00000000
1660  00000000 00000000 00000000 00000000 08e3b158 ffff0000 f2f11600 ffff8008

X28: 0xffff8008f235f980:
f980  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
f9a0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
f9c0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
f9e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
fa00  00000000 00000000 09f6e3d8 ffff0000 00000000 00000000 f2f11600 ffff8008
fa20  00000000 00000000 00000000 00000000 812aa8c0 812aa8c0 00ffffff ff2aa8c0
fa40  00001800 00000080 30627375 00000000 00000000 00000000 00000000 00000000
fa60  0046ac7c 00000001 0046ac7c 00000001 00000000 00000000 00000000 00000000

Process Binder:3276_2 (pid: 3326, stack limit = 0xffff00000b378000)
Call trace:
Exception stack(0xffff00000b37b900 to 0xffff00000b37ba40)
b900: ffff8008f7738010 ffff8008f1f1ac00 0000000000000000 0000000000000140
b920: 0000000000000000 0000000000000000 0000000000000020 0000000040000000
b940: 0000000000000024 0000000000000000 0101010101010101 0000000000000020
b960: 0000000000000020 0000000000000000 ffffffffffffffff 0000000000000000
b980: ffff0000082b4430 0000fcc729e2d0e0 0000fcc72810fc1a ffff8008f1f1ac00
b9a0: ffff8008f2dee118 0000000000000000 ffff8008f2df0000 ffff000009c8e000
b9c0: 0000000000000000 ffff8008f2df0000 ffff8008f2dee118 ffff8008f2f11600
b9e0: ffff8008f235fa00 ffff00000b37ba40 ffff0000089bc2c0 ffff00000b37ba40
ba00: ffff0000089bbf90 00000000400001c5 ffff00000b37ba20 ffff00000827c354
ba20: 0000ffffffffffff ffff000008d578c4 ffff00000b37ba40 ffff0000089bbf90
[<ffff0000089bbf90>] __cdns3_gadget_ep_queue.isra.18+0x238/0x524
[<ffff0000089bc2c0>] cdns3_gadget_ep_queue+0x44/0xd8
[<ffff000008a06f70>] usb_ep_queue+0x5c/0xfc
[<ffff000008a1762c>] rx_submit+0xec/0x1bc
[<ffff000008a1775c>] rx_fill+0x60/0xb4
[<ffff000008a17c7c>] eth_open+0x64/0x78
[<ffff000008d72cf4>] __dev_open+0xe0/0x164
[<ffff000008d73128>] __dev_change_flags+0x160/0x18c
[<ffff000008d73174>] dev_change_flags+0x20/0x5c
[<ffff000008e359f0>] devinet_ioctl+0x68c/0x724
[<ffff000008e37cc4>] inet_ioctl+0x8c/0xa8
[<ffff000008d48a48>] sock_do_ioctl+0x34/0x70
[<ffff000008d49da0>] sock_ioctl+0x21c/0x320
[<ffff0000082b3b98>] do_vfs_ioctl+0xbc/0x954
[<ffff0000082b44b4>] SyS_ioctl+0x84/0x98
Exception stack(0xffff00000b37bec0 to 0xffff00000b37c000)
bec0: 000000000000003d 0000000000008914 0000fcc728110840 0000000000000003
bee0: 0000fcc728110850 6f43ffffffffffff 0000000000000000 0000000000800000
bf00: 000000000000001d 0000fcc7281107f8 0000fcc7281107f8 0000fcc728110840
bf20: 0000fcc728110458 0000000000000028 ffffffffffffffff 00002d18ec000000
bf40: 0000fcc72962af68 0000fcc729e2d0e0 0000fcc72810fc1a 0000fcc728111588
bf60: 0000fcc72962b000 0000ab36f6e99ac5 0000ab36f6e99a8e 0000000000000008
bf80: 0000ab36f6e99ac8 0000fcc728111588 0000ab36f6e99c0e 0000000000000006
bfa0: 0000fcc72902b108 0000fcc728110830 0000fcc729e2d16c 0000fcc728110740
bfc0: 0000fcc729e73758 00000000a0000000 000000000000003d 000000000000001d
bfe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[<ffff000008083ac0>] el0_svc_naked+0x34/0x38
Code: d503201f f9401e82 aa1303e1 f94006c0 (39c00842)
---[ end trace f7b45310362d53ac ]---
Kernel panic - not syncing: Fatal exception
SMP: stopping secondary CPUs
SMP: failed to stop secondary CPUs 0,2,4
Kernel Offset: disabled
CPU features: 0x180200c
Memory Limit: none
Rebooting in 5 seconds..
SMP: stopping secondary CPUs
SMP: failed to stop secondary CPUs 0,2,4

Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:24 +08:00
Peter Chen e5daab383b MLK-22366-6 usb: cdns3: gadget: do not call disconnect if it is not configured 
Fix below oops:
init: Received control message 'start' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
init: starting service 'adbd'...
init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
android_work: sent uevent USB_STATE=CONNECTED
android_work: sent uevent USB_STATE=DISCONNECTED
configfs-gadget gadget: high-speed config #1: b
android_work: sent uevent USB_STATE=CONNECTED
android_work: sent uevent USB_STATE=CONFIGURED
init: Received control message 'start' for 'adbd' from pid: 3499 (system_server)
init: Received control message 'stop' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
android_work: sent uevent USB_STATE=DISCONNECTED
audit: audit_lost=179935 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
audit: audit_lost=179970 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
using random self ethernet address
using random host ethernet address
read descriptors
read strings
usb0: HOST MAC f2:80:c5:eb:a1:fd
usb0: MAC 92:da:4f:13:01:73
android_work: did not send uevent (0 0           (null))
audit: audit_lost=180005 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
android_work: sent uevent USB_STATE=CONNECTED
android_work: sent uevent USB_STATE=DISCONNECTED
init: Received control message 'start' for 'adbd' from pid: 3499 (system_server)
composite_disconnect: Calling disconnect on a Gadget that is                      not connected
android_work: did not send uevent (0 0           (null))
init: Received control message 'stop' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
init: Sending signal 9 to service 'adbd' (pid 22343) process group...
------------[ cut here ]------------
audit: audit_lost=180038 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
WARNING: CPU: 0 PID: 3468 at /home/tianyang/maddev_pie9.0/vendor/nxp-opensource/kernel_imx/drivers/usb/gadget/composite.c:2009 composite_disconnect+0x80/0x88
Modules linked in:
CPU: 0 PID: 3468 Comm: HWC-UEvent-Thre Not tainted 4.14.98-07846-g0b40a9b-dirty #16
Hardware name: Freescale i.MX8QM MEK (DT)
task: ffff8008f2349c00 task.stack: ffff00000b0a8000
PC is at composite_disconnect+0x80/0x88
LR is at composite_disconnect+0x80/0x88
pc : [<ffff0000089ff9b0>] lr : [<ffff0000089ff9b0>] pstate: 600001c5
sp : ffff000008003dd0
x29: ffff000008003dd0 x28: ffff8008f2349c00
x27: ffff000009885018 x26: ffff000008004000
Timeout for IPC response!
x25: ffff000009885018 x24: ffff000009c8e280
x23: ffff8008f2d98010 x22: 00000000000001c0
x21: ffff8008f2d98394 x20: ffff8008f2d98010
x19: 0000000000000000 x18: 0000e3956f4f075a
fxos8700 4-001e: i2c block read acc failed
x17: 0000e395735727e8 x16: ffff00000829f4d4
x15: ffffffffffffffff x14: 7463656e6e6f6320
x13: 746f6e2009090920 x12: 7369207461687420
x11: 7465676461472061 x10: 206e6f207463656e
x9 : 6e6f637369642067 x8 : ffff000009c8e280
x7 : ffff0000086ca6cc x6 : ffff000009f15e78
x5 : 0000000000000000 x4 : 0000000000000000
x3 : ffffffffffffffff x2 : c3f28b86000c3900
x1 : c3f28b86000c3900 x0 : 000000000000004e

X20: 0xffff8008f2d97f90:
7f90  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fb0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
libprocessgroup: Failed to kill process cgroup uid 0 pid 22343 in 215ms, 1 processes remain
7fd0
Timeout for IPC response!
 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
using random self ethernet address
7ff0  00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008
8010  00000100 00000000 f2d98018 ffff8008 f2d98018 ffff8008 08a067dc
using random host ethernet address
 ffff0000
8030  f206d800 ffff8008 091c3650 ffff0000 f7957b18 ffff8008 f7957730 ffff8008
8050  f716a630 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000
8070  f76c8010 ffff8008 f716a800 ffff8008 095cac68 ffff0000 f206d828 ffff8008

X21: 0xffff8008f2d98314:
8314  ffff8008 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8334  00000000 00000000 00000000 00000000 00000000 08a04cf4 ffff0000 00000000
8354  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8374  00000000 00000000 00000000 00001001 00000000 00000000 00000000 00000000
8394  e4bbe4bb 0f230000 ffff0000 0afae000 ffff0000 ae001000 00000000 f206d400
Timeout for IPC response!
83b4  ffff8008 00000000 00000000 f7957b18 ffff8008 f7957718 ffff8008 f7957018
83d4  ffff8008 f7957118 ffff8008 f7957618 ffff8008 f7957818 ffff8008 f7957918
83f4  ffff8008 f7957d18 ffff8008 00000000 00000000 00000000 00000000 00000000

X23: 0xffff8008f2d97f90:
7f90  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fb0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fd0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7ff0  00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008
8010  00000100 00000000 f2d98018 ffff8008 f2d98018 ffff8008 08a067dc ffff0000
8030  f206d800 ffff8008 091c3650 ffff0000 f7957b18 ffff8008 f7957730 ffff8008
8050  f716a630 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000
8070  f76c8010 ffff8008 f716a800 ffff8008 095cac68 ffff0000 f206d828 ffff8008

X28: 0xffff8008f2349b80:
9b80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9ba0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9bc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9be0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9c00  00000022 00000000 ffffffff ffffffff 00010001 00000000 00000000 00000000
9c20  0b0a8000 ffff0000 00000002 00404040 00000000 00000000 00000000 00000000
9c40  00000001 00000000 00000001 00000000 001ebd44 00000001 f390b800 ffff8008
9c60  00000000 00000001 00000070 00000070 00000070 00000000 09031d48 ffff0000

Call trace:
Exception stack(0xffff000008003c90 to 0xffff000008003dd0)
3c80:                                   000000000000004e c3f28b86000c3900
3ca0: c3f28b86000c3900 ffffffffffffffff 0000000000000000 0000000000000000
3cc0: ffff000009f15e78 ffff0000086ca6cc ffff000009c8e280 6e6f637369642067
3ce0: 206e6f207463656e 7465676461472061 7369207461687420 746f6e2009090920
3d00: 7463656e6e6f6320 ffffffffffffffff ffff00000829f4d4 0000e395735727e8
3d20: 0000e3956f4f075a 0000000000000000 ffff8008f2d98010 ffff8008f2d98394
3d40: 00000000000001c0 ffff8008f2d98010 ffff000009c8e280 ffff000009885018
3d60: ffff000008004000 ffff000009885018 ffff8008f2349c00 ffff000008003dd0
3d80: ffff0000089ff9b0 ffff000008003dd0 ffff0000089ff9b0 00000000600001c5
3da0: ffff8008f33f2cd8 0000000000000000 0000ffffffffffff 0000000000000000
init: Received control message 'start' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
3dc0: ffff000008003dd0 ffff0000089ff9b0
[<ffff0000089ff9b0>] composite_disconnect+0x80/0x88
[<ffff000008a044d4>] android_disconnect+0x3c/0x68
[<ffff0000089ba9f8>] cdns3_device_irq_handler+0xfc/0x2c8
[<ffff0000089b84c0>] cdns3_irq+0x44/0x94
[<ffff00000814494c>] __handle_irq_event_percpu+0x60/0x24c
[<ffff000008144c0c>] handle_irq_event+0x58/0xc0
[<ffff00000814873c>] handle_fasteoi_irq+0x98/0x180
[<ffff000008143a10>] generic_handle_irq+0x24/0x38
[<ffff000008144170>] __handle_domain_irq+0x60/0xac
[<ffff0000080819c4>] gic_handle_irq+0xd4/0x17c
Exception stack(0xffff00000b0ab950 to 0xffff00000b0aba90)

Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:23 +08:00
Peter Chen f8e6f51571 MLK-22366-4 usb: cdns3: gadget: don't call request handler for the unconfigured device 
We don't need to notify the bus reset for class driver if the non-control
endpoints are not enabled. It could cause unnecessary disconnect event for
android due to below two reasons:
- Android declares the disconnect event for reset handler.
- The controller will get two reset interrupts at HS mode
it fixed two below oops:

oops #1

android_work: did not send uevent (0 0           (null))
android_work: sent uevent USB_STATE=CONNECTED
android_work: sent uevent USB_STATE=DISCONNECTED
android_work: sent uevent USB_STATE=CONNECTED
configfs-gadget gadget: high-speed config #1: b
android_work: sent uevent USB_STATE=CONFIGURED
android_work: sent uevent USB_STATE=DISCONNECTED
audit: audit_lost=8846 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
init: Received control message 'start' for 'adbd' from pid: 3275 (system_server)
android_work: sent uevent USB_STATE=CONNECTED
android_disconnect: gadget driver already disconnected
init: Received control message 'stop' for 'adbd' from pid: 3135
(/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
init: Sending signal 9 to service 'adbd' (pid 5859) process group...
android_work: sent uevent USB_STATE=DISCONNECTED
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5858 at kernel_imx/drivers/usb/gadget/configfs.c:1533 android_disconnect+0x60/0x68
Modules linked in:
audit: audit_lost=8877 audit_rate_limit=5 audit_backlog_limit=64
CPU: 0 PID: 5858 Comm: main Not tainted 4.14.98-07844-g346f959 #14
audit: rate limit exceeded
Hardware name: Freescale i.MX8QXP MEK (DT)
task: ffff800063950e00 task.stack: ffff00000daf8000
PC is at android_disconnect+0x60/0x68
LR is at android_disconnect+0x60/0x68
pc : [<ffff000008a044cc>] lr : [<ffff000008a044cc>] pstate: 600001c5
sp : ffff000008003e00
x29: ffff000008003e00 x28: ffff800063950e00
Timeout for IPC response!
x27: ffff000009885018 x26: ffff000008004000
Failed power operation on resource 248 sc_err 3
x25: ffff000009885018 x24: ffff000009c8e280
x23: ffff800836158810 x22: 00000000000001c0
x21: ffff800836158b94 x20: ffff800836158810
x19: 0000000000000000 x18: 0000f6cba5d06050
Synchronous External Abort: synchronous external abort (0x96000210) at 0xffff000011790024
x17: 0000f6cba74ac218 x16: ffff00000829be84
Internal error: : 96000210 [#1] PREEMPT SMP
Modules linked in:
x15: 0000f6cba5d067f0
x14: 0000f6cba5d0a3d0
CPU: 2 PID: 2353 Comm: kworker/2:1H Not tainted 4.14.98-07844-g346f959 #14
Hardware name: Freescale i.MX8QXP MEK (DT)
x13: 656c626174206665 x12: 078db5fab2ae6e00
Workqueue: kblockd blk_mq_run_work_fn
x11: ffff000008003ad0
task: ffff80083bf62a00 task.stack: ffff00000b5e8000
x10: ffff000008003ad0
PC is at esdhc_readl_le+0x8/0x15c
x9 : 0000000000000006
LR is at sdhci_send_command+0xc4/0xa54
x8 : ffff000009c8e280
pc : [<ffff000008b82ea4>] lr : [<ffff000008b6ca48>] pstate: 200001c5
i2c-rpmsg virtio0.rpmsg-i2c-channel.-1.2: rpmsg_xfer failed: timeout
fxos8700 14-001e: i2c block read acc failed
i2c-rpmsg virtio0.rpmsg-i2c-channel.-1.2: rpmsg_xfer failed: timeout

oops 2#:

init: Received control message 'start' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
init: starting service 'adbd'...
init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
android_work: sent uevent USB_STATE=CONNECTED
android_work: sent uevent USB_STATE=DISCONNECTED
configfs-gadget gadget: high-speed config #1: b
android_work: sent uevent USB_STATE=CONNECTED
android_work: sent uevent USB_STATE=CONFIGURED
init: Received control message 'start' for 'adbd' from pid: 3499 (system_server)
init: Received control message 'stop' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
android_work: sent uevent USB_STATE=DISCONNECTED
audit: audit_lost=179935 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
audit: audit_lost=179970 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
using random self ethernet address
using random host ethernet address
read descriptors
read strings
usb0: HOST MAC f2:80:c5:eb:a1:fd
usb0: MAC 92:da:4f:13:01:73
android_work: did not send uevent (0 0           (null))
audit: audit_lost=180005 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
read descriptors
read strings
android_work: did not send uevent (0 0           (null))
android_work: sent uevent USB_STATE=CONNECTED
android_work: sent uevent USB_STATE=DISCONNECTED
init: Received control message 'start' for 'adbd' from pid: 3499 (system_server)
composite_disconnect: Calling disconnect on a Gadget that is                      not connected
android_work: did not send uevent (0 0           (null))
init: Received control message 'stop' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
init: Sending signal 9 to service 'adbd' (pid 22343) process group...
------------[ cut here ]------------
audit: audit_lost=180038 audit_rate_limit=5 audit_backlog_limit=64
audit: rate limit exceeded
WARNING: CPU: 0 PID: 3468 at /home/tianyang/maddev_pie9.0/vendor/nxp-opensource/kernel_imx/drivers/usb/gadget/composite.c:2009 composite_disconnect+0x80/0x88
Modules linked in:
CPU: 0 PID: 3468 Comm: HWC-UEvent-Thre Not tainted 4.14.98-07846-g0b40a9b-dirty #16
Hardware name: Freescale i.MX8QM MEK (DT)
task: ffff8008f2349c00 task.stack: ffff00000b0a8000
PC is at composite_disconnect+0x80/0x88
LR is at composite_disconnect+0x80/0x88
pc : [<ffff0000089ff9b0>] lr : [<ffff0000089ff9b0>] pstate: 600001c5
sp : ffff000008003dd0
x29: ffff000008003dd0 x28: ffff8008f2349c00
x27: ffff000009885018 x26: ffff000008004000
Timeout for IPC response!
x25: ffff000009885018 x24: ffff000009c8e280
x23: ffff8008f2d98010 x22: 00000000000001c0
x21: ffff8008f2d98394 x20: ffff8008f2d98010
x19: 0000000000000000 x18: 0000e3956f4f075a
fxos8700 4-001e: i2c block read acc failed
x17: 0000e395735727e8 x16: ffff00000829f4d4
x15: ffffffffffffffff x14: 7463656e6e6f6320
x13: 746f6e2009090920 x12: 7369207461687420
x11: 7465676461472061 x10: 206e6f207463656e
x9 : 6e6f637369642067 x8 : ffff000009c8e280
x7 : ffff0000086ca6cc x6 : ffff000009f15e78
x5 : 0000000000000000 x4 : 0000000000000000
x3 : ffffffffffffffff x2 : c3f28b86000c3900
x1 : c3f28b86000c3900 x0 : 000000000000004e

X20: 0xffff8008f2d97f90:
7f90  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fb0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
libprocessgroup: Failed to kill process cgroup uid 0 pid 22343 in 215ms, 1 processes remain
7fd0
Timeout for IPC response!
 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
using random self ethernet address
7ff0  00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008
8010  00000100 00000000 f2d98018 ffff8008 f2d98018 ffff8008 08a067dc
using random host ethernet address
 ffff0000
8030  f206d800 ffff8008 091c3650 ffff0000 f7957b18 ffff8008 f7957730 ffff8008
8050  f716a630 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000
8070  f76c8010 ffff8008 f716a800 ffff8008 095cac68 ffff0000 f206d828 ffff8008

X21: 0xffff8008f2d98314:
8314  ffff8008 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8334  00000000 00000000 00000000 00000000 00000000 08a04cf4 ffff0000 00000000
8354  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8374  00000000 00000000 00000000 00001001 00000000 00000000 00000000 00000000
8394  e4bbe4bb 0f230000 ffff0000 0afae000 ffff0000 ae001000 00000000 f206d400
Timeout for IPC response!
83b4  ffff8008 00000000 00000000 f7957b18 ffff8008 f7957718 ffff8008 f7957018
83d4  ffff8008 f7957118 ffff8008 f7957618 ffff8008 f7957818 ffff8008 f7957918
83f4  ffff8008 f7957d18 ffff8008 00000000 00000000 00000000 00000000 00000000

X23: 0xffff8008f2d97f90:
7f90  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fb0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fd0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7ff0  00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008
8010  00000100 00000000 f2d98018 ffff8008 f2d98018 ffff8008 08a067dc ffff0000
8030  f206d800 ffff8008 091c3650 ffff0000 f7957b18 ffff8008 f7957730 ffff8008
8050  f716a630 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000
8070  f76c8010 ffff8008 f716a800 ffff8008 095cac68 ffff0000 f206d828 ffff8008

X28: 0xffff8008f2349b80:
9b80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9ba0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9bc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9be0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9c00  00000022 00000000 ffffffff ffffffff 00010001 00000000 00000000 00000000
9c20  0b0a8000 ffff0000 00000002 00404040 00000000 00000000 00000000 00000000
9c40  00000001 00000000 00000001 00000000 001ebd44 00000001 f390b800 ffff8008
9c60  00000000 00000001 00000070 00000070 00000070 00000000 09031d48 ffff0000

Call trace:
Exception stack(0xffff000008003c90 to 0xffff000008003dd0)
3c80:                                   000000000000004e c3f28b86000c3900
3ca0: c3f28b86000c3900 ffffffffffffffff 0000000000000000 0000000000000000
3cc0: ffff000009f15e78 ffff0000086ca6cc ffff000009c8e280 6e6f637369642067
3ce0: 206e6f207463656e 7465676461472061 7369207461687420 746f6e2009090920
3d00: 7463656e6e6f6320 ffffffffffffffff ffff00000829f4d4 0000e395735727e8
3d20: 0000e3956f4f075a 0000000000000000 ffff8008f2d98010 ffff8008f2d98394
3d40: 00000000000001c0 ffff8008f2d98010 ffff000009c8e280 ffff000009885018
3d60: ffff000008004000 ffff000009885018 ffff8008f2349c00 ffff000008003dd0
3d80: ffff0000089ff9b0 ffff000008003dd0 ffff0000089ff9b0 00000000600001c5
3da0: ffff8008f33f2cd8 0000000000000000 0000ffffffffffff 0000000000000000
init: Received control message 'start' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx)
3dc0: ffff000008003dd0 ffff0000089ff9b0
[<ffff0000089ff9b0>] composite_disconnect+0x80/0x88
[<ffff000008a044d4>] android_disconnect+0x3c/0x68
[<ffff0000089ba9f8>] cdns3_device_irq_handler+0xfc/0x2c8
[<ffff0000089b84c0>] cdns3_irq+0x44/0x94
[<ffff00000814494c>] __handle_irq_event_percpu+0x60/0x24c
[<ffff000008144c0c>] handle_irq_event+0x58/0xc0
[<ffff00000814873c>] handle_fasteoi_irq+0x98/0x180
[<ffff000008143a10>] generic_handle_irq+0x24/0x38
[<ffff000008144170>] __handle_domain_irq+0x60/0xac
[<ffff0000080819c4>] gic_handle_irq+0xd4/0x17c
Exception stack(0xffff00000b0ab950 to 0xffff00000b0aba90)
b940:                                   ffff8008f2a65c00 0000000000000140
b960: 00000000000068ea ffff8008f6cf9c00 0000000000000000 0000000000000000
b980: ffff000009893800 ffff8008f23c38a8 ffff8008ffee21a0 00000000ffffffff
b9a0: 0000000000000001 6f6674616c702f73 30313162352f6d72 336273752e303030
b9c0: 3162352f6364752f ffffffffffffffff ffff00000829f4d4 0000e395735727e8
b9e0: 0000e3956f4f075a ffff8008f2a65c00 0000000000000001 0000000000000140
ba00: 00000000000000c3 0000000000000001 0000000000000001 ffff000009c8e000
ba20: ffff8008f2c5b940 ffff8008d5a6fb00 0000000000000067 ffff00000b0aba90
ba40: ffff00000812b354 ffff00000b0aba90 ffff000009010044 0000000060000145
ba60: 0000000000000140 00000000000000c3 0000ffffffffffff 0000000000000001
ba80: ffff00000b0aba90 ffff000009010044
[<ffff000008083230>] el1_irq+0xb0/0x124
[<ffff000009010044>] _raw_spin_unlock_irqrestore+0x18/0x48
[<ffff00000812b354>] __wake_up_common_lock+0xa0/0xd4
[<ffff00000812b3c0>] __wake_up_sync_key+0x1c/0x24
[<ffff000008d515f0>] sock_def_readable+0x40/0x70
[<ffff000008e7a71c>] unix_dgram_sendmsg+0x45c/0x728
[<ffff000008d4df10>] sock_write_iter+0x10c/0x124
[<ffff00000829c4e0>] do_iter_readv_writev+0xf8/0x160
[<ffff00000829d2e4>] do_iter_write.part.17+0x38/0x154
[<ffff00000829e9c4>] vfs_writev+0x114/0x158
[<ffff00000829ea68>] do_writev+0x60/0xe8
[<ffff00000829f4e4>] SyS_writev+0x10/0x18
Exception stack(0xffff00000b0abec0 to 0xffff00000b0ac000)
bec0: 000000000000000f 0000e3956f4f0cb0 0000000000000004 0000000000000003
bee0: 0000000000000067 0000000080000000 725705beff78606b 7f7f7fff7f7f7f7f
bf00: 0000000000000042 000000000000005c 0000e3956f4f0e60 0000000000000053
bf20: 0000e3956f4f0f98 ffffffffffffffff ffffffffff000000 ffffffffffffffff
bf40: 0000e39572bf0cc0 0000e395735727e8 0000e3956f4f075a 0000000000000000
bf60: 000000000000000f 0000e3956f4f0cb0 0000000000000004 0000e39572bf17e0
bf80: 0000e3956f4f2588 0000e39572bf1618 0000000000000004 0000000000000000
bfa0: 0000e39572bf1618 0000e3956f4f0d70 0000e39572bd4260 0000e3956f4f0cb0
bfc0: 0000e395735727f0 0000000060000000 000000000000000f 0000000000000042
bfe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[<ffff000008083ac0>] el0_svc_naked+0x34/0x38

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:22 +08:00
Peter Chen 0f13bfdbb0 MLK-22366-3 usb: cdns3: gadget: set request as NULL when it is freed 
Meanwhile, the pending_setup_status work item needs to be flushed after
EP0 is dequeued. It fixed below oops:

[  292.766596] android_work: sent uevent USB_STATE=DISCONNECTED
[  292.769602] ------------[ cut here ]------------
[  292.769631] WARNING: CPU: 3 PID: 88 at /home/b29397/work/projects/linux-imx/drivers/usb/gadget/composite.c:1383 com
posite_setup_complete+0xc8/0xd0
[  292.769639] Modules linked in:
[  292.790493] audit: audit_lost=5519 audit_rate_limit=5 audit_backlog_limit=64
[  292.796604] audit: rate limit exceeded
[  292.803165] CPU: 3 PID: 88 Comm: kworker/3:1 Not tainted 4.14.98-07842-g3848d2f45363-dirty #51
[  292.803168] Hardware name: Freescale i.MX8QXP MEK (DT)
[  292.803183] Workqueue: events_freezable cdns3_pending_setup_status_handler
[  292.803188] task: ffff80083ac68e80 task.stack: ffff00000ada8000
[  292.803195] PC is at composite_setup_complete+0xc8/0xd0
[  292.803200] LR is at composite_setup_complete+0xc8/0xd0
[  292.803204] pc : [<ffff000008aa17c8>] lr : [<ffff000008aa17c8>] pstate: 000001c5
[  292.803206] sp : ffff00000adabd70
[  292.803208] x29: ffff00000adabd70 x28: 0000000000000000
[  292.803215] x27: ffff80083abf8c38 x26: ffff000009619518
[  292.803227] x25: 0000000000000000 x24: ffff00000a150cf8
[  292.870582] x23: 0000000000000000 x22: ffff80083ff6c100
[  292.875901] x21: 0000000000000140 x20: ffff800836342718
[  292.881216] x19: ffff8000706e5900 x18: 0000000000000010
[  292.886533] x17: 0000eb3821d31268 x16: ffff000008313fc8
[  292.891850] x15: ffffffffffffffff x14: ffff00000a12e008
[  292.897166] x13: ffff00008a4319d7 x12: ffff00000a4319df
[  292.902483] x11: ffff00000a157000 x10: ffff00000adaba90
[  292.907801] x9 : 00000000ffffffd0 x8 : ffff000008729658
[  292.913116] x7 : 75716572206e776f x6 : 0000000000000006
[  292.918433] x5 : 0000000000000000 x4 : 0000000000000000
[  292.923749] x3 : 0000000000000000 x2 : 13710ac2b6ac9b00
[  292.929067] x1 : 0000000000000000 x0 : 0000000000000020
[  292.934397]
[  292.934397] X19: 0xffff8000706e5880:
[  292.939448] 5880  00004ef4 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  292.947651] 58a0  00000000 00000000 00004ef5 00000000 00000000 00000000 00000000 00000000
[  292.955860] 58c0  00000000 00000000 00000000 00000000 00000000 00000000 71f24600 ffff8000
[  292.964070] 58e0  00000300 00000001 706e58e0 ffff8000 395101c0 ffff8008 00000000 00000000
[  292.972280] 5900  706e5000 ffff8000 00000000 00000000 f47ff000 00000000 00000000 00000000
[  292.980487] 5920  00000000 00000000 00000000 00000000 08aa1700 ffff0000 3bb36428 ffff8008
[  292.988697] 5940  706e5940 ffff8000 706e5940 ffff8000 00000000 00000000 36342718 ffff8008
[  292.996907] 5960  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.005121]
[  293.005121] X20: 0xffff800836342698:
[  293.010181] 2698  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.014718] using random self ethernet address
[  293.018391] 26b8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.018413] 26d8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.018435] 26f8  00000000 00000000 36342900 ffff8008 3ac7c880 ffff8008 087e56b0 ffff0000
[  293.018458] 2718  3bb36428 ffff8008 363427a8 ffff8008 092cbfa0
[  293.030136] using random host ethernet address
[  293.031092]  ffff0000 00000000 00000000
[  293.031101] 2738  00000000 00000000 00000031 02000000 00000200 00000004 0a286238 ffff0000
[  293.031136] 2758  00000000 00000000 36342760 ffff8008 36342760 ffff8008 36342770 ffff8008
[  293.077978] 2778  36342770 ffff8008 36342780 ffff8008 36342780 ffff8008 0ae25000 ffff0000
[  293.086193]
[  293.086193] X22: 0xffff80083ff6c080:
[  293.091253] c080  3ff6c080 ffff8008 3ff6c080 ffff8008 ffffffe0 0000000f 3ff6c098 ffff8008
[  293.099463] c0a0  3ff6c098 ffff8008 080fb2b0 ffff0000 00000000 00000000 00000000 00000000
[  293.107672] c0c0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.115882] c0e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.124083] c100  3ff68000 ffff8008 3a00ce00 ffff8008 00000000 ffffffff 00000002 00000001
[  293.132293] c120  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.140494] c140  00000000 00000000 00000000 00000000 00000000 00000000 00000001 00000100
[  293.148695] c160  3ff6c160 ffff8008 3ff6c160 ffff8008 3ff53170 ffff8008 3a00ce00 ffff8008
[  293.156903]
[  293.156903] X27: 0xffff80083abf8bb8:
[  293.161961] 8bb8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.170162] 8bd8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.178371] 8bf8  00000000 00000000 00000000 00000000 643a725f 5f706368 3aafd100 ffff8008
[  293.186583] 8c18  00000000 73706d75 00000000 74706f5f 3abf8c28 ffff8008 3abf8c28 ffff8008
[  293.194791] 8c38  00000000 dead0000 00000000 ffff8008 3abf8c48 ffff8008 3abf8c48 ffff8008
[  293.203001] 8c58  00000050 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  293.211210] 8c78  00000000 00000000 00000001 ffff8008 3607ac00 ffff8008 00000002 00000000
[  293.219420] 8c98  3abf8c98 ffff8008 00000000 00000000 00000000 00000000 3ad74fb0 ffff8008
[  293.227625]
[  293.229119] Call trace:
[  293.231573] Exception stack(0xffff00000adabc30 to 0xffff00000adabd70)
[  293.238027] bc20:                                   0000000000000020 0000000000000000
[  293.245865] bc40: 13710ac2b6ac9b00 0000000000000000 0000000000000000 0000000000000000
[  293.253707] bc60: 0000000000000006 75716572206e776f ffff000008729658 00000000ffffffd0
[  293.261543] bc80: ffff00000adaba90 ffff00000a157000 ffff00000a4319df ffff00008a4319d7
[  293.269379] bca0: ffff00000a12e008 ffffffffffffffff ffff000008313fc8 0000eb3821d31268
[  293.277217] bcc0: 0000000000000010 ffff8000706e5900 ffff800836342718 0000000000000140
[  293.285051] bce0: ffff80083ff6c100 0000000000000000 ffff00000a150cf8 0000000000000000
[  293.292887] bd00: ffff000009619518 ffff80083abf8c38 0000000000000000 ffff00000adabd70
[  293.300723] bd20: ffff000008aa17c8 ffff00000adabd70 ffff000008aa17c8 00000000000001c5
[  293.308562] bd40: ffff000008aa1700 0000000000000000 ffffffffffffffff ffff800838000058
[  293.316406] bd60: ffff00000adabd70 ffff000008aa17c8
[  293.321303] [<ffff000008aa17c8>] composite_setup_complete+0xc8/0xd0
[  293.327584] [<ffff000008a56040>] cdns3_pending_setup_status_handler+0x70/0x98
[  293.334729] [<ffff0000080fe1e0>] process_one_work+0x1d8/0x470
[  293.340476] [<ffff0000080fe4c4>] worker_thread+0x4c/0x458
[  293.345885] [<ffff0000081052ec>] kthread+0x134/0x138
[  293.350862] [<ffff00000808525c>] ret_from_fork+0x10/0x1c
[  293.356175] ---[ end trace 9b2dcf754a0dbda5 ]---
[  293.392462] init: Service 'adbd' (pid 4743) received signal 9
[  293.399231] init: Sending signal 9 to service 'adbd' (pid 4743) process group...
[  293.412539] libprocessgroup: Successfully killed process cgroup uid 0 pid 4743 in 4ms
[  295.781315] init: Received control message 'start' for 'adbd' from pid: 3253 (system_server)
[  295.790279] init: starting service 'adbd'...
[  295.798116] init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000

Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:22 +08:00
Peter Chen 17cb94a10a MLK-22366-2 usb: cdns3: gadget: fix the hot plug and function switch issue 
- If the UDC is not started, we need not to access register at .udc_stop
- Clear all priv_ep flags except EP_CLAIMED which should be cleared at
.udc_stop
- Clear warning message that the .ep_disable may be called twice, one
from class driver, one from UDC driver.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:21 +08:00
Peter Chen b9fb073145 MLK-18579-1 usb: cdns3: using upstream multiple TD driver 
Keep the internal framework, just use the UDC driver from
upstream version which supports multiple TD.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:17 +08:00
Peter Chen e4cf494471 MA-13475 usb: cdns3: gadget: fix NULL pointer issue when switch functions 
Below oops is reproduced when switch between mtp and ptp function
at Android, the interrupt occurs when the usb_ss->gadget_driver
is already NULL. In this commit, we add NULL pointer check for
it as well as protecting for clear usb_ss->gadget_driver.

init: Sending signal 9 to service 'adbd' (pid 4644) process group...
Mem abort info:
  Exception class = DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgd = ffff800830e49000
[0000000000000020] *pgd=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in: wlan
CPU: 0 PID: 3226 Comm: surfaceflinger Not tainted 4.14.98 #1
init: Successfully killed process cgroup uid 0 pid 4644 in 11ms
Hardware name: Freescale i.MX8QXP MEK (DT)
task: ffff80083bf55400 task.stack: ffff00000ffe8000
PC is at cdns_get_setup_ret+0x38/0x64
LR is at cdns_get_setup_ret+0x24/0x64
pc : [<ffff0000089b0e88>] lr : [<ffff0000089b0e74>] pstate: 000001c5
sp : ffff000008003d10
x29: ffff000008003d10 x28: ffff80083bf55400
x27: ffff000009873018 x26: ffff000008004000
x25: ffff000009873018 x24: ffff000009c6a288
x23: ffff000008003f24 x22: ffff00000a85e000
x21: 0000000000000001 x20: ffff8008361c97b8
x19: ffff8008361c9000 x18: 0000000000000001
x17: 0000fe6e544aee34 x16: ffff0000082b54f0
x15: 0000ffffccae15f0 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000010000
x11: 0000000000000040 x10: 0000000000000040
x9 : ffff8008380ae238 x8 : ffff800838000248
x7 : 0000000000000000 x6 : ffff800838000248
init: Service 'adbd' (pid 4644) killed by signal 9
x5 : ffff80083ae40600 x4 : 0000000000000000
x3 : 00000000000001c0 x2 : 0000000000000000
x1 : ffff00000a85e000 x0 : ffff8008361c9300

X0: 0xffff8008361c9280:
9280  00000000 00000000 00000000 00000000 000f000f
init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:15)
 00000000 3bf6ce00 ffff8008
92a0  3acd9a00 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000
92c0  00000000 00000000 00000000 00000000 00000000 00000000 089b0e3c ffff0000
92e0  00000000
init: processing action (sys.usb.config=mtp,adb && sys.usb.configfs=1) from (/init.usb.configfs.rc:33)
 00000000 00000000 00000000
read descriptors
read strings
init: starting service 'adbd'...
 00000000
init: property_set("ro.boottime.adbd", "97804848500") failed: property already set
init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000
 00000000 0e0f0000 ffff0000
9300  3ff21105 ffff8008 3ff1d120 ffff8008 2e15d4e0 ffff8008 089f9558 ffff0000
9320  3618ac00 ffff8008 091b7860 ffff0000 3bf6ce18 ffff8008 3bf6cd30
read descriptors
read strings
 ffff8008
9340  3acd9a30 ffff8008 00000000 00000005 00000000 00000000 095c4e58 ffff0000
9360  361c9000 ffff8008 3acd9700 ffff8008 095be4c8 ffff0000 3618ac28 ffff8008

X5: 0xffff80083ae40580:
0580  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
05a0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
05c0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
05e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0600  03440204 ffffffff 00000000 00000000 00000000 00000000 0000000f 00000000
0620  00000001 00000000 00000000 00000030 0000010f 00000000 3ae40600 ffff8008
0640  09d7aae0 ffff0000 3a088000 ffff8008 3aa22c80 ffff8008 00000000 00000000
0660  09886e24 ffff0000 081496ec ffff0000 3b444080 ffff8008 00000000 00000000

X6: 0xffff8008380001c8:
01c8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
01e8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0208  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0228  fffffc00 ffffffff 00000000 00000000 00000000 00000000 38000248 ffff8008
0248  003f0000 00000000 380af6c0 ffff8008 09c937f0 ffff0000 38000260 ffff8008
0268  38000260 ffff8008 00000000 00000000 3a007400 ffff8008 3a007600 ffff8008
0288  3a007800 ffff8008 3a007a00 ffff8008 3a007c00 ffff8008 3a6be600 ffff8008
02a8  3ab1da00 ffff8008 3ab1dc00 ffff8008 3ab1de00 ffff8008 3ac52000 ffff8008

X8: 0xffff8008380001c8:
01c8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
01e8  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0208  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0228  fffffc00 ffffffff 00000000 00000000 00000000 00000000 38000248 ffff8008
0248  003f0000 00000000 380af6c0 ffff8008 09c937f0 ffff0000 38000260 ffff8008
0268  38000260 ffff8008 00000000 00000000 3a007400 ffff8008 3a007600 ffff8008
0288  3a007800 ffff8008 3a007a00 ffff8008 3a007c00 ffff8008 3a6be600 ffff8008
02a8  3ab1da00 ffff8008 3ab1dc00 ffff8008 3ab1de00 ffff8008 3ac52000 ffff8008

X9: 0xffff8008380ae1b8:
e1b8  3ae1ddd0 ffff8008 3ae1de58 ffff8008 3ae1dee0 ffff8008 3ae1df68 ffff8008
e1d8  3aad9000 ffff8008 3aad9088 ffff8008 3aad9110 ffff8008 3aad9198 ffff8008
e1f8  3aad9220 ffff8008 3aad92a8 ffff8008 3aad9330 ffff8008 3aad93b8 ffff8008
e218  00000000 00000000 00000000 00000000 00000000 00000000 380ae238 ffff8008
e238  000b0400 00000000 3802c490 ffff8008 3a081060 ffff8008 380ae250 ffff8008
e258  380ae250 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000
e278  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
e298  00000000 00000000 3aea2c28 ffff8008 3aea2e28 ffff8008 00000000 00000000

X19: 0xffff8008361c8f80:
8f80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8fa0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8fc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8fe0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9000  3ab9f410 ffff8008 3bf6b000 ffff8008 095c4e48 ffff0000 361c9378 ffff8008
9020  360ed558 ffff8008 3ab9f420 ffff8008 3a7d5800 ffff8008 09d9fa00 ffff0000
9040  361b94c8 ffff8008 00000006 00000003 00000000 00000000 00000000 00000000
9060  00000000 00000000 00000000 00000000 361c9070 ffff8008 361c9070 ffff8008

X20: 0xffff8008361c9738:
9738  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9758  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9778  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9798  0000000e 00000000 71a71600 ffff8000 00000000 00000000 00000000 00000000
97b8  044c044c 00000002 00000000 00000000 00000001 00000000 3ab9f410 ffff8008
97d8  00000001 00000000 3bf6cc70 ffff8008 3bf6c170 ffff8008 00000000 00000000
97f8  00000000 00000000 361c9800 ffff8008 361c9800 ffff8008 089b1dc8 ffff0000
9818  71a71600 ffff8000 00000000 00000000 00000000 00000000 00000000 00000000

X28: 0xffff80083bf55380:
5380  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
53a0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
53c0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
53e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5400  00000022 00000000 ffffffff ffffffff 00010001 00000000 00000000 00000000
5420  0ffe8000 ffff0000 00000006 00404100 00000000 00000000 00000000 00000000
5440  00000001 00000000 000000e6 00000000 ffff3a2d 00000000 30c10000 ffff8008
5460  00000000 00000001 00000062 00000070 00000062 00000001 09023e38 ffff0000

Process surfaceflinger (pid: 3226, stack limit = 0xffff00000ffe8000)
Call trace:
Exception stack(0xffff000008003bd0 to 0xffff000008003d10)
3bc0:                                   ffff8008361c9300 ffff00000a85e000
3be0: 0000000000000000 00000000000001c0 0000000000000000 ffff80083ae40600
3c00: ffff800838000248 0000000000000000 ffff800838000248 ffff8008380ae238
3c20: 0000000000000040 0000000000000040 0000000000010000 0000000000000000
3c40: 0000000000000000 0000ffffccae15f0 ffff0000082b54f0 0000fe6e544aee34
3c60: 0000000000000001 ffff8008361c9000 ffff8008361c97b8 0000000000000001
3c80: ffff00000a85e000 ffff000008003f24 ffff000009c6a288 ffff000009873018
3ca0: ffff000008004000 ffff000009873018 ffff80083bf55400 ffff000008003d10
3cc0: ffff0000089b0e74 ffff000008003d10 ffff0000089b0e88 00000000000001c5
3ce0: 00000000000001c0 1a8824534cfb2000 0000ffffffffffff ffff0000080f87c8
3d00: ffff000008003d10 ffff0000089b0e88
[<ffff0000089b0e88>] cdns_get_setup_ret+0x38/0x64
[<ffff0000089b2a48>] cdns_check_ep0_interrupt_proceed+0xc0/0x8dc
[<ffff0000089b3508>] cdns_irq_handler_thread+0x2a4/0x4e8
[<ffff0000089afd98>] cdns3_irq+0x44/0x94
[<ffff000008145994>] __handle_irq_event_percpu+0x60/0x24c
[<ffff000008145c54>] handle_irq_event+0x58/0xc0
[<ffff000008149784>] handle_fasteoi_irq+0x98/0x180
[<ffff000008144a58>] generic_handle_irq+0x24/0x38
[<ffff0000081451b8>] __handle_domain_irq+0x60/0xac
[<ffff0000080819c4>] gic_handle_irq+0xd4/0x17c

Signed-off-by: Peter Chen <peter.chen@nxp.com>
(cherry picked from commit 6ee6e32b0c3fcbea70117eaea3c315f0e220144c)
 2019-11-25 15:56:16 +08:00
Peter Chen 67481f9ff8 MLK-20585-2 usb: cdns3: gadget: fix the KASAN issue 
BUG: KASAN: use-after-free in pending_setup_status_handler+0x4c/0x9c
Read of size 8 at addr ffff8008b2fb6130 by task kworker/0:1/4432

CPU: 0 PID: 4432 Comm: kworker/0:1 Not tainted 4.14.78-06631-gd2e1817-dirty #18
Hardware name: Freescale i.MX8QM MEK (DT)
Workqueue: events_freezable pending_setup_status_handler
Call trace:
[<ffff20000808dff8>] dump_backtrace+0x0/0x49c
[<ffff20000808e4a8>] show_stack+0x14/0x1c
[<ffff20000967b808>] dump_stack+0xa0/0xc8
[<ffff200008344f80>] print_address_description+0x124/0x2f8
[<ffff200008345404>] kasan_report+0x200/0x348
[<ffff200008343780>] __asan_load8+0x6c/0x84
[<ffff200008d897d8>] pending_setup_status_handler+0x4c/0x9c
[<ffff2000081236e4>] process_one_work+0x250/0x72c
[<ffff200008123c58>] worker_thread+0x98/0x69c
[<ffff20000812cd00>] kthread+0x170/0x1b0
[<ffff200008085cd8>] ret_from_fork+0x10/0x18

Allocated by task 4689:
 kasan_kmalloc.part.5+0x50/0x124
 kasan_kmalloc+0xc4/0xe4
 kmem_cache_alloc_trace+0x13c/0x298
 usb_ss_gadget_ep_alloc_request+0x48/0x50
 usb_ep_alloc_request+0x44/0x16c
 composite_dev_prepare+0x4c/0x1b8
 configfs_composite_bind+0x6c/0x694
 udc_bind_to_driver+0xcc/0x218
 usb_gadget_probe_driver+0x108/0x1b0
 gadget_dev_desc_UDC_store+0xf4/0x174
 configfs_write_file+0x184/0x25c
 vfs_write+0xf0/0x26c
 SyS_write+0x64/0xd4
 el0_svc_naked+0x34/0x38

Freed by task 3406:
 kasan_slab_free+0xb0/0x1c0
 kfree+0x7c/0x270
 usb_ss_gadget_ep_free_request+0x10/0x18
 usb_ep_free_request+0x44/0x158
 composite_dev_cleanup+0x188/0x230
 configfs_composite_unbind+0x48/0x80
 usb_gadget_remove_driver+0x84/0xf0
 usb_gadget_unregister_driver+0x10c/0x134
 gadget_dev_desc_UDC_store+0xa0/0x174
 configfs_write_file+0x184/0x25c
 vfs_write+0xf0/0x26c
 SyS_write+0x64/0xd4
 el0_svc_naked+0x34/0x38

The buggy address belongs to the object at ffff8008b2fb6100
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 48 bytes inside of
 128-byte region [ffff8008b2fb6100, ffff8008b2fb6180)
The buggy address belongs to the page:
page:ffff7e0022cbed80 count:1 mapcount:0 mapping:          (null) index:0x0

Reported-by: Yang Tian <yang.tian@nxp.com>
Tested-by: Yang Tian <yang.tian@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
(cherry picked from commit 0cf9ae2a80c243f4c8191e447374d466cdbb2bd6)
 2019-11-25 15:56:15 +08:00
Peter Chen 150ce1ee8e MLK-20585-1 usb: cdns3: gadget: fix the KASAN issue 
BUG: KASAN: use-after-free in cdns3_gadget_remove+0x114/0x1d8
Read of size 8 at addr ffff80081f8817a0 by task swapper/0/1

CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.78-05577-gbe1ecd23b99a-dirty #231
Hardware name: Freescale i.MX8QXP MEK (DT)
Call trace:
[<ffff20000808cd10>] dump_backtrace+0x0/0x510
[<ffff20000808d234>] show_stack+0x14/0x20
[<ffff200009471d84>] dump_stack+0xa4/0xc8
[<ffff2000082966c0>] print_address_description+0x60/0x250
[<ffff200008296bb8>] kasan_report+0x240/0x308
[<ffff2000082952e0>] __asan_load8+0x88/0xb0
[<ffff200008d089cc>] cdns3_gadget_remove+0x114/0x1d8
[<ffff200008d0220c>] cdns3_probe+0x634/0x940
[<ffff2000089ebf10>] platform_drv_probe+0x70/0xf0
[<ffff2000089e9060>] driver_probe_device+0x388/0x5f0
[<ffff2000089e9414>] __driver_attach+0x14c/0x150
[<ffff2000089e5dd8>] bus_for_each_dev+0xd8/0x138
[<ffff2000089e8560>] driver_attach+0x30/0x40
[<ffff2000089e7c38>] bus_add_driver+0x278/0x3a0
[<ffff2000089ea27c>] driver_register+0xb4/0x198
[<ffff2000089ebe0c>] __platform_driver_register+0x7c/0x88
[<ffff20000a0d78e8>] cdns3_driver_platform_register+0x1c/0x24
[<ffff200008083cc0>] do_one_initcall+0x90/0x1b8
[<ffff20000a071040>] kernel_init_freeable+0x238/0x2d8
[<ffff20000948c2a8>] kernel_init+0x10/0x118
[<ffff200008085450>] ret_from_fork+0x10/0x18

Allocated by task 1:
 kasan_kmalloc+0xd8/0x188
 __cdns3_gadget_init+0xb8/0x998
 cdns3_gadget_init+0xbc/0xd0
 cdns3_probe+0x718/0x940
 platform_drv_probe+0x70/0xf0
 driver_probe_device+0x388/0x5f0
 __driver_attach+0x14c/0x150
 bus_for_each_dev+0xd8/0x138
 driver_attach+0x30/0x40
 bus_add_driver+0x278/0x3a0
 driver_register+0xb4/0x198
 __platform_driver_register+0x7c/0x88
 cdns3_driver_platform_register+0x1c/0x24
 do_one_initcall+0x90/0x1b8
 kernel_init_freeable+0x238/0x2d8
 kernel_init+0x10/0x118
 ret_from_fork+0x10/0x18

Freed by task 1:
 kasan_slab_free+0x88/0x188
 kfree+0x70/0x1e0
 cdns3_gadget_release+0x60/0x80
 device_release+0x44/0xd8
 kobject_put+0xd8/0x280
 device_unregister+0x28/0x80
 cdns3_gadget_remove+0x100/0x1d8
 cdns3_probe+0x634/0x940
 platform_drv_probe+0x70/0xf0
 driver_probe_device+0x388/0x5f0
 __driver_attach+0x14c/0x150
 bus_for_each_dev+0xd8/0x138
 driver_attach+0x30/0x40
 bus_add_driver+0x278/0x3a0
 driver_register+0xb4/0x198
 __platform_driver_register+0x7c/0x88
 cdns3_driver_platform_register+0x1c/0x24
 do_one_initcall+0x90/0x1b8
 kernel_init_freeable+0x238/0x2d8
 kernel_init+0x10/0x118
 ret_from_fork+0x10/0x18

The buggy address belongs to the object at ffff80081f881100
 which belongs to the cache kmalloc-4096 of size 4096
The buggy address is located 1696 bytes inside of
 4096-byte region [ffff80081f881100, ffff80081f882100)
The buggy address belongs to the page:
page:ffff7e00207e2000 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x1fffc00000008100(slab|head)
raw: 1fffc00000008100 0000000000000000 0000000000000000 0000000180070007
raw: dead000000000100 dead000000000200 ffff800822003200 0000000000000000
page dumped because: kasan: bad access detected

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
(cherry picked from commit 68e0107f55ad121ac07f7660f63d42522ba2f64f)
 2019-11-25 15:56:15 +08:00
Peter Chen c90aced5e2 MLK-20599-2 usb: cdns3: gadget: fix link test TD 7.37 
USB3 device should accept LGO_U1 request after receiving SET_CONFIGURATION.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
(cherry picked from commit 979c91e49c68901f13b2d74900ff920ee77ad22e)
 2019-11-25 15:56:14 +08:00
Peter Chen b7dbdb1c09 MLK-20599-1 usb: cdns3: gadget: fix link test TD 7.23 
The USB compliance link test TD 7.23 requires the U1 exit time
is from 900ns to 1.2us, the current code is 744ns, the default
value is 1.104us, so changing it as default value.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
(cherry picked from commit ec499d83ba324ad834e92fd6a59ea872c37d9b41)
 2019-11-25 15:56:14 +08:00
Li Jun 7299512a54 MLK-19254 usb: cdns3: gadget: set gadget state to be USB_STATE_NOTATTACHED after stop 
Update gadget state to be USB_STATE_NOTATTACHED after stop gaget.

Signed-off-by: Li Jun <jun.li@nxp.com>
(cherry picked from commit 15a7227b63897b28f30a6220baf33a7373db341c)
 2019-11-25 15:56:09 +08:00
Peter Chen 321003929c MLK-18609-8 usb: cdns3: gadget: do not support multiple requests for ep0 
Current code does not support queuing multiple requests for ep0, return
-EOPNOTSUPP if that happens.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:09 +08:00
Peter Chen c025f313c2 MLK-18609-7 usb: cdns3: gadget: only unmap buffer for demand request 
We only unmap the request which is demanded from the gadget driver.

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:08 +08:00
Peter Chen 1a804f47d9 MLK-18609-6 usb: cdns3: gadget: need to prepare setup packet after status 
We need to prepare setup packet no matter configuration is set or
not.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:05 +08:00
Peter Chen 2be0b1e63a MLK-18609-5 usb: cdns3: gadget: implement setup status completion properly 
For CDNS3 gadget, there is NO setup status completion interrupt, but
software has related request and completion handler for EP0 setup
status. In previous design, it executes ->completion before .ep0_queue
back, and causes cdev->setup_pending and cdev->os_desc_pending
incorrect, the dequeue is executed wrongly.

In this commit, we postpone ->comletion to workqueue or the next
EP0 interrupt, it makes sure the ->completion is executed after
.ep0_queue.

[  220.785184] android_work: did not send uevent (0 0           (null))
[  220.792651] Bad mode in Error handler detected on CPU2, code 0xbf000002 -- SError
06-28 02:47:13.145  3946  3946 I zygote64: Deoptimizing void com.android.systemui.statusbar.stack.NotificationStackScrollLayout.updateContentHeight() due to JIT inline cache
[  220.815371] Internal error: Oops - bad mode: 0 [#1] PREEMPT SMP
[  220.821312] Modules linked in:
[  220.824389] CPU: 2 PID: 1 Comm: init Not tainted 4.9.105-644221-ga78d348 #8
[  220.831362] Hardware name: Freescale i.MX8QXP MEK (DT)
[  220.836504] task: ffff80083a0e0000 task.stack: ffff80083a0e8000
[  220.842431] PC is at 0x4ec908
[  220.845398] LR is at 0x454a30
[  220.848363] pc : [<00000000004ec908>] lr : [<0000000000454a30>] pstate: 40000000
[  220.855762] sp : 0000ffffe0c35ca0
[  220.859072] x29: 0000ffffe0c35cc0 x28: 00000000ffffffff
[  220.864397] x27: 00000000ffffffff x26: 0000000000000001
[  220.869722] x25: 0000ffff7f6446a9 x24: 000000000057da40
[  220.875047] x23: 0000000000088241 x22: 0000ffff7f6446c0
[  220.880373] x21: 0000ffff7f6446c1 x20: 0000000000000009
[  220.885698] x19: 0000000000000004 x18: 00000000020f06cc
[  220.891024] x17: aaaaaaaaaaaaaaab x16: 0000000000000000
[  220.896349] x15: 000000000000005c x14: 0000000000000000
[  220.901675] x13: 4344552f31672f74 x12: 0000ffffe0c35c88
[  220.907000] x11: 0000ffffe0c35cd0 x10: 0000000000000004
[  220.912325] x9 : 0000000000000000 x8 : 0000000000000040
[  220.917651] x7 : 7f7f7f7f7f7f7f7f x6 : 655e666d68736860
[  220.922976] x5 : 0000000000000000 x4 : 0000000000000000
[  220.928302] x3 : 0000000000000180 x2 : 0000000000000004
[  220.933627] x1 : 0000ffff7f6446c1 x0 : 0000000000000004
[  220.938952]
[  220.940440] Process init (pid: 1, stack limit = 0xffff80083a0e8000)

Reported-by: Andy Tian <yang.tian@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:04 +08:00
Peter Chen c0d42a86b7 MLK-18609-4 usb: cdns3: gadget: refine de-init process 
- The gadget speed should be reset to USB_SPEED_UNKNOWN at any de-init
  process
- The TRB buffer should be free when the gadget is removed

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
 2019-11-25 15:56:04 +08:00