If CONFIG_DEBUG_SHIRQ config option is enabled in kernel, shared
irq interrupt handler can be called from free_irq context and
accessing the freed dwc->ev_buf pointer in irq handler.
Hence fix this issue by explicitly checking for dwc->ev_buf pointer
in dwc3_check_event_buf() function.
Change-Id: I3311aa36408f17fb2560ad02c0929c52e96cc7e8
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Upon USB core generating an erratic error event, the
dwc3-msm driver resets and restarts the core. Even
after this if core could not recover, the driver
keep on trying the same in a infinite loop. This could
lead to the hogging of system resources leading to
system failure. Prevent this by trying a maximum of three
times to recover upon erratic error event.
An example of continuous generation of error events is
a DCP charger detected as SDP by the PMIC and core entering
device mode. In this case, the core could not recover
even after several tries.
Change-Id: Ic2f2f10e6bcc7480be5116746072b0fb1651ce10
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Add new IPC log buffer to log the events in the cycle
of requests like queue, mapping the associated buffer,
unmapping it and finally dequeuing it.
This logging will help us in debugging the SMMU faults
for which the traces has to be enabled. These logs
helps to trace the faulty address in the first incident.
The logs can be accessed on the target using the command
echo 0 > /proc/sys/kernel/kptr_restrict
cat /sys/kernel/debug/ipc_logging/a600000.dwc3.ep_events/log.
Change-Id: Icc7063da7a251902cbb257022eaff6656e972a07
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
USB controller registers can be accessed when USB session
is not active or USB is in low power mode. This results
in unclocked register access. Prevent this by checking
the USB LPM status before accessing the registers.
Change-Id: I5a31bda1d88ac65b28afc2b545a44b4574b8548a
Signed-off-by: Elson Roy Serrao <eserrao@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
If cable disconnects before data stage completion dwc3_remove_requests()
gets called for ep0 in and out but dwc3_ep0_complete_data() does not
get called. dwc3_ep0_complete_data() function resets TRB enqueue count
to 0. As a result upon next cable connect start transfer is called with
wrong TRB address because trb_enqueue is set to 1. Since this TRB was
completed in the past, HWO bit is cleared for this TRB. This results into
usb enumeration failure due to control transfer stall. Fix this issue
by issuing end transfer command on control endpoints after ep0 requests
are removed for IN and OUT and reset trb_enqueue counters to 0.
Change-Id: Ic5364f11372d85ec7c133024dc48bbc5d848ebf4
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Consider a case of quick pull-up disable after pull-up is enabled.
If a SETUP packet comes after bus reset event followed by connection
done event, there is a possibility of race between
composite_dev_cleanup() freeing cdev->req called from
configfs_composite_unbind() and composite_setup() storing req pointer
to stack. This causes use after free of cdev->req. Fix this issue by
disabling the irq before clearing the run-stop bit so that interrupt
handling for setup packet is prevented. In order to prevent running
bottom half check pullups_connected flag in dwc3_interrupt and ack
the generated events and return. Also flush the bottom half work
if there was any work pending before disabling dwc3 irq.
Change-Id: I979da8536bd6766153e25cf6120f00f348427a72
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
gadget_driver can become null if gadget_stop is called while any other
gadget callbacks are in progress. As gadget callbacks needs to release
spinlock before the callback, store the local copy of gadget_driver to
avoid the race with gadget_stop.
Change-Id: I7f0cbf9af3e3b286f2826647f08215f29f699de1
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Spurious suspend event may arrive before CONNECT DONE, which
may unnecessarily notify to the charger to reduce current
draw to 2mA, only to revert back to 100mA on the subsequent
reset & connection. Instead, only enable the SUSPEND event
interrupt after the initial CONNECT DONE event is handled.
Change-Id: I41e2ff5d9b693757e06059c98fbe8b3a3878abdd
Signed-off-by: Jack Pham <jackp@codeaurora.org>
debugfs_create_dir() returns NULL when second directory is created
with same name gsi-epin. Without checking return value
dwc3_debugfs_create_endpoint_dir() creates endpoint files with parent
as NULL. This would create files in root dir /sys/kernel/debug which
remains there even after calling debugfs_remove_recursive() from
dwc3_debugfs_exit(). Due to probe deferral dwc3 endpoints get freed
up and re-allocated. As a result accessing endpoint files created in
root dir causes access to stale dwc3 endpoint pointer. Hence check
return value for debugfs_create_dir and do not create files for NULL
parent.
Change-Id: I44b65b77f35be1a52e71db2184a359887c25c8c9
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
When dwc3_gadget_pullup() is called to perform a device-initiated
disconnect, the driver must ensure that no transfers are in progress
before clearing the run/stop bit. Currently there is a check which
ensures ep0 is in EP0_SETUP_PHASE and if not simply waits for any
pending control transfer to conclude and return to that initial state.
However, since this is done before the dwc->lock is acquired, this
allows for a race in which a new ep0 transfer gets started and we
receive another SETUP packet from the host before proceeding to take
the lock.
To fix this, simply don't allow a new ep0 transfer to start if
dwc->softconnect is false.
Change-Id: Ie79c99bfa2b305ef44695d01b3f9395253aaf8f8
Signed-off-by: Jack Pham <jackp@codeaurora.org>
If gadget driver's request for removing pull_up fails due to
EP0 not in setup phase, then driver ends up bailing out
without removing it PM usage_count vote.
This will prevent DWC3 from entering low power mode and
subsequent start_peripheral/host would also won't be
allowed as LPM entry is mandatory for that.
Change-Id: Id1dde0dcf379a1f6b9567d63c0b1d31445c30d0d
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
During Halt Endpoint CH9 test with RNDIS composition
NULL pointer dereference is occurring in
__dwc3_gadget_ep_set_halt function which is trying to
access trb_pool which is already freed. In this case
set_alt 0 is getting called before__dwc3_gadget_ep_set_halt.
As a part of set_alt, ipa_disconnect_handler is getting
called which is freeing the trbs. __dwc3_gadget_ep_set_halt
function is called as a part of std_request from Host side
to halt endpoint. This change adds a NULL check before accessing
trb_pool.
Change-Id: Id51494310f713b9c593e29449442661a1170ee6f
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
In case a SUSPEND (L2 or U3) event is detected but the device is
not yet enumerated/configured, the device must still follow USB
power rules and limit its current draw to ISUSP (2.5mA). Notify
the gadget when this happens, which in turn will notify the
charger driver.
Change-Id: I10d890aabd78d841027b370eb62005d2e35e2a38
Signed-off-by: Jack Pham <jackp@codeaurora.org>
DWC3 driver uses wakeup_source and allows pm_suspend only after
entering low power mode as part of runtime suspend. This prevents
PM suspend in host mode if connected device's driver doesn't
support runtime or selective suspend.
For platforms such as automotive, add support in driver where
user can specify using dtsi attribute to not use wakeup source in
host mode. It will allow system to enter deep sleep or pm_suspend
irrespective of runtime PM state of XHCI. The connected devices
are also reset-resumed on PM resume.
On high level below are the changes in default behavior:
-Do not use wakeup_source for DWC3 when operating in host mode.
-For host mode, devices will suspend upon PM suspend and
reset-resumed on PM resume.
Change-Id: I8a3d744a1d9d714f17a0cfe4ff5b69b04d9f763f
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
When the setup packet comes right before the disconnect notification
there is a possible race between clearing the run stop bit and
enqueuing the setup packet. This results in controller halt failure.
Add a vbus_active check before enqueuing the packet to fix this issue.
Change-Id: I3921a1fa92a0f5c6892f1cc3ffe9dda6366b72b1
Signed-off-by: Elson Roy Serrao <eserrao@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
There is possible race between pull up disable vs ep_queue() API.
Pull up disable sends END transfer command to per endpoint, and give
back started request and pending request back to function driver.
dwc3_gadget_giveback() API does release spinlock which may allow
ep_queue() or completion handling to queue next request. This results
into TRB pending without invoking end transfer command, whereas request
is being given back to function driver and being freed. Hence on setting
next pull up enable, USB controller accesses previous stale TRB causing
unmapped page fault. Fix this issue by checking pull up disable or not
while handling ep_queue().
Change-Id: I391aed05cbfe183cd3e2fe2f1aa335e4fd9ec37c
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
This change fixes below issues:
1. registering UDC driver with udc core with dwc3 probe itself, so USB
composition script can find UDC device while trying to select UDC.
2. creation of required USB endpoints related debugfs entries useful for
debugging.
3. USB high speed only functionality fallback mechanism when USB super
speed phy is not initialized.
Change-Id: I893e6221ceb6af448695f5399e857be0c25f41b1
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
dwc3_calc_trbs_left function is calling dwc3_ep_prev_trb
which can return NULL if trb pool is empty. This change adds
check for the return value of dwc3_ep_prev_trb function to
avoid NULL pointer dereference.
Change-Id: Id11d5ffd23da7c070d5e0b26842d8738b073b212
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
There is a possibility of race between endpoint transfer
completion context and stop active transfer context. As
a result dwc3_gadget_ep_cleanup_completed_requests() iterates
over started_list using list_for_each_safe while
dwc3_remove_requests() is deleting req from started list.
While iterating over current list node list_for_each_safe caches
next list node. If the cached list node is getting deleted by
dwc3_remove_requests() then request for same list node would be
given back as part of endpoint transfer completion. This result
into list_del corruption because list node is getting deleted
twice. Fix this issue by iterating started_list using while loop
and always accessing first node from list head.
Change-Id: I64104a43ade015923deeb1f230a17dea08817052
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
There still exists a small window in which dwc3_gadget_pullup()
is called while a new control transfer setup packet had newly
arrived. In the case where it needs to be delegated to the gadget
driver, it releases dwc3->lock and allows pullup() to proceed to
call run_stop() to attempt to stop the controller. The lock will
get released again when calling dwc3_stop_active_transfers()
which allows the gadget driver to meanwhile call ep_queue() for
a three-stage control transfer and sneak in a Start Transfer. By
the time the DCTL register is written, the controller will fail
to halt due to having an outstanding transfer in progress.
CPU0 CPU1
...dwc3->lock held...
dwc3_ep0_inspect_setup() dwc3_gadget_pullup()
dwc3_ep0_delegate_req() spin_lock_irq_save()
spin_unlock() ... unblocked
composite_setup() dwc3_gadget_run_stop()
usb_ep_queue() dwc3_stop_active_transfers()
dwc3_gadget_ep0_queue() dwc3_gadget_remove_requests()
spin_lock_irqsave() dwc3_gadget_giveback()
... unblocked spin_unlock()
__dwc3_ep0_do_control_data() spin_lock()
issues Start Transfer
spin_unlock_irqrestore() ... unblocked
spin_lock() clear DCTL_RUN_STOP
... wait for DSTS_DEVCTRLHLT
time out
This change attempts to fix the issue by additionally checking
the dwc->ep0_next_event state in dwc3_gadget_pullup() to catch
the case when a SETUP packet had just been received and handled
by dwc3_ep0_inspect_setup but is still waiting to proceed to
either a DATA or STATUS stage. This allows pullup() to wait for
completion of the transfer before moving on to clear run/stop.
Change-Id: Ib2da3c86213ade1a61fb82f95a1f7c9534d9df3f
Signed-off-by: Jack Pham <jackp@codeaurora.org>
if USB bus reset is received from Host in middle of control transfer
request, SW needs to complete pending control transfer and setup core
for next setup stage as per data book. Hence check ep0 state during
reset interrupt handling and make sure active transfers on ep0 out/in
endpoint are stopped by queuing ENDXFER command for that endpoint
and restart ep0 out again to receive next setup packet.
Change-Id: Idf8adf3c2416e7945d879bf88c321e1eea3c31d4
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
According to the databook ep0 should be in setup
phase during reset. If host issues reset between
control transfers, ep0 will be in an invalid state.
Fix this my issuing stall and restart on ep0 if it
is not in setup phase.
CRs-Fixed: 2136658
Change-Id: I6dc20c2735a6ce772533ccb5b63ba5d1b01f89d7
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
USB IN/INT endpoint stalls when performing TX FIFO resize functionality
when IN/INT endpoint is already active i.e. usb endpoint is enabled and
usb request is pending with it. Fix this issue by making sure that TX
FIFO resize is performed before enabling endpoint which shall happen
after set_alt(1) and before any function queues request with its
allocated USB endpoint.
This commit also squashes the following commits from previous kernels:
Revert "usb: dwc3: drop FIFO resizing logic"
dwc3: gadget: Improve TX FIFO resize functionality
dwc3: gadget: Use default TX FIFO size as 1024 bytes with each IN eps
usb: gadget: Use mult as 3 for GSI related USB IN endpoint always
USB: dwc3: gadget: Fix TxFIFO resizing logic
dwc3: Preserve TxFIFO of IN/INT EP for UDC without tx-fifo-resize
dwc3: gadget: Use TXFIFO register based on used dwc3 version
dwc3: gadget: Increase TXFIFO size as 6KB for GSI IN endpoint
usb: dwc3: Change TXFIFO size for GSI IN EP based on controller
usb: dwc3: gadget: Fix TXFIFO resize logic for non-zero EPs
usb: dwc3: Increase the TxFIFO resize factor
Change-Id: I13a590f87ab8492f7c95a15b2da9f00c9c63c4f9
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
This change adds the following QTI MSM platform specific features
to the USB DWC3 core & gadget drivers:
- BAM/DBM endpoint support
- GSI endpoint support
- low power mode
- glue layer notifications
- high speed-only fallback
- additional debug logging
Change-Id: I0f733d05f3f88a4a734d8489b5eb548391ab3af3
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Correct the icc src/dst read logic from dtsi file for geni
common driver for single path scenario by using the existing
dual path src/dst read logic.
Change-Id: I82773544d6da3841085160146e98085aee6e2682
Signed-off-by: Prudhvi Yarlagadda <pyarlaga@codeaurora.org>
This change adds USB QDSS function driver which allows communication
between USB BAM and QDSS BAM for QDSS debug functionality over USB.
This snapshot is taken as of msm-4.19 kernel commit <b318a6e04625>
("Merge "msm: ipa4: Fix to use common PM handle for coalescing and
default pipe"").
Change-Id: I07919f9453552bec5e420afad32a1bc65c761fd7
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Enable support for QCOM clock drivers on Lahaina.
Change-Id: If6595fa38103c44dfa131ee6cd9039f63e9ee659
Signed-off-by: Mike Tipton <mdtipton@codeaurora.org>
This snapshot is taken as of msm-4.19 'commit <d2f41beab007i>
("Merge "msm: npu: Add bandwidth monitor support"")'.
In addition to update the license year.
Change-Id: I71f5eb30687eca3eae7c122ee419a2f7bee41adc
Signed-off-by: Jay Jayanna <jayanna@codeaurora.org>
