linux-toradex.git/drivers/usb/musb, branch v3.14.52

usb: musb: host: rely on port_mode to call musb_start()

2015-08-03T16:29:55+00:00

commit be9d39881fc4fa39a64b6eed6bab5d9ee5125344 upstream.

Currently, we're calling musb_start() twice for DRD ports
in some situations. This has been observed to cause enumeration
issues after suspend/resume cycles with AM335x.

In order to fix the problem, we just have to fix the check
on musb_has_gadget() so that it only returns true if
current mode is Host and ignore the fact that we have or
not a gadget driver loaded.

Fixes: ae44df2e21b5 (usb: musb: call musb_start() only once in OTG mode)
Cc: Sebastian Andrzej Siewior 
Tested-by: Sekhar Nori 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: use new USB_RESUME_TIMEOUT

2015-05-13T12:16:58+00:00

commit 309be239369609929d5d3833ee043f7c5afc95d1 upstream.

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Based on original work by Bin Liu >

Cc: Bin Liu 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: stuff leak of struct usb_hcd

2015-01-27T16:18:57+00:00

commit 68693b8ea4e284c46bff919ac62bd9ccdfdbb6ba upstream.

since the split of host+gadget mode in commit 74c2e9360058 ("usb: musb:
factor out hcd initalization") we leak the usb_hcd struct. We call now
musb_host_cleanup() which does basically usb_remove_hcd() and also sets
the hcd variable to NULL. Doing so makes the finall call to
musb_host_free() basically a nop and the usb_hcd remains around for ever
without anowner.
This patch drops that NULL assignment for that reason.

Fixes: 74c2e9360058 ("usb: musb: factor out hcd initalization")
Cc: Daniel Mack 
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: dsps: start OTG timer on resume again

2014-11-14T17:00:05+00:00

commit 53185b3a441a6cc9bb3f57e924342d249138dcd6 upstream.

Commit 468bcc2a2ca ("usb: musb: dsps: kill OTG timer on suspend") stopped
the timer in suspend path but forgot the re-enable it in the resume
path. This patch fixes the behaviour.

Fixes 468bcc2a2ca "usb: musb: dsps: kill OTG timer on suspend"
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: cppi41: restart hrtimer only if not yet done

2014-11-14T17:00:05+00:00

commit d2e6d62c9cbbc2da4211f672dbeea08960e29a80 upstream.

commit c58d80f52 ("usb: musb: Ensure that cppi41 timer gets armed on
premature DMA TX irq") fixed hrtimer scheduling bug. There is one left
which does not trigger that often.
The following scenario is still possible:

    lock(&x->lock);
    hrtimer_start(&x->t);
    unlock(&x->lock);

expires:
    t->function();
                                lock(&x->lock);
    lock(&x->lock);             if (!hrtimer_queued(&x->t))
                                        hrtimer_start(&x->t);
                                unlock(&x->lock);

    if (!list_empty(x->early_tx_list))
           ret = HRTIMER_RESTART;
->         hrtimer_forward_now(...)
    } else
           ret = HRTIMER_NORESTART;

    unlock(&x->lock);

and the timer callback returns HRTIMER_RESTART for an armed timer. This
is wrong and we run into the BUG_ON() in __run_hrtimer().
This can happens on SMP or PREEMPT-RT.
The patch fixes the problem by only starting the timer if the timer is
not yet queued.

Reported-by: Torben Hohn 
Signed-off-by: Thomas Gleixner 
[bigeasy: collected information and created a patch + description based
          on it]
Signed-off-by: Sebastian Andrzej Siewior 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: dsps: kill OTG timer on suspend

2014-10-15T06:36:43+00:00

commit 468bcc2a2ca071f652009d2d20d97f2437630cae upstream.

if we don't make sure to kill the timer, it could
expire after we have already gated our clocks.

That will trigger a Data Abort exception because
we would try to access register while clock is gated.

Fix that bug.

Fixes 869c597 (usb: musb: dsps: add support for suspend and resume)
Tested-by: Dave Gerlach 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: Fix panic upon musb_am335x module removal

2014-07-09T18:18:24+00:00

commit 7adb5c876e9c0677078a1e1094c6eafd29c30b74 upstream.

At probe time, the musb_am335x driver register its childs by
calling of_platform_populate(), which registers all childs in
the devicetree hierarchy recursively.

On the other side, the driver's remove() function uses of_device_unregister()
to remove each child of musb_am335x's.

However, when musb_dsps is loaded, its devices are attached to the musb_am335x
device as musb_am335x childs. Hence, musb_am335x remove() will attempt to
unregister the devices registered by musb_dsps, which produces a kernel panic.

In other words, the childs in the "struct device" hierarchy are not the same
as the childs in the "devicetree" hierarchy.

Ideally, we should enforce the removal of the devices registered by
musb_am335x *only*, instead of all its child devices. However, because of the
recursive nature of of_platform_populate, this doesn't seem possible.

Therefore, as the only solution at hand, this commit disables musb_am335x
driver removal capability, preventing it from being ever removed. This was
originally suggested by Sebastian Siewior:

https://www.mail-archive.com/linux-omap@vger.kernel.org/msg104946.html

And for reference, here's the panic upon module removal:

musb-hdrc musb-hdrc.0.auto: remove, state 4
usb usb1: USB disconnect, device number 1
musb-hdrc musb-hdrc.0.auto: USB bus 1 deregistered
Unable to handle kernel NULL pointer dereference at virtual address 0000008c
pgd = de11c000
[0000008c] *pgd=9e174831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] ARM
Modules linked in: musb_am335x(-) musb_dsps musb_hdrc usbcore usb_common
CPU: 0 PID: 623 Comm: modprobe Not tainted 3.15.0-rc4-00001-g24efd13 #69
task: de1b7500 ti: de122000 task.ti: de122000
PC is at am335x_shutdown+0x10/0x28
LR is at am335x_shutdown+0xc/0x28
pc : []    lr : []    psr: a0000013
sp : de123df8  ip : 00000004  fp : 00028f00
r10: 00000000  r9 : de122000  r8 : c000e6c4
r7 : de0e3c10  r6 : de0e3800  r5 : de624010  r4 : de1ec750
r3 : de0e3810  r2 : 00000000  r1 : 00000001  r0 : 00000000
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 9e11c019  DAC: 00000015
Process modprobe (pid: 623, stack limit = 0xde122240)
Stack: (0xde123df8 to 0xde124000)
3de0:                                                       de0e3810 bf054488
3e00: bf05444c de624010 60000013 bf043650 000012fc de624010 de0e3810 bf043a20
3e20: de0e3810 bf04b240 c0635b88 c02ca37c c02ca364 c02c8db0 de1b7500 de0e3844
3e40: de0e3810 c02c8e28 c0635b88 de02824c de0e3810 c02c884c de0e3800 de0e3810
3e60: de0e3818 c02c5b20 bf05417c de0e3800 de0e3800 c0635b88 de0f2410 c02ca838
3e80: bf05417c de0e3800 bf055438 c02ca8cc de0e3c10 bf054194 de0e3c10 c02ca37c
3ea0: c02ca364 c02c8db0 de1b7500 de0e3c44 de0e3c10 c02c8e28 c0635b88 de02824c
3ec0: de0e3c10 c02c884c de0e3c10 de0e3c10 de0e3c18 c02c5b20 de0e3c10 de0e3c10
3ee0: 00000000 bf059000 a0000013 c02c5bc0 00000000 bf05900c de0e3c10 c02c5c48
3f00: de0dd0c0 de1ec970 de0f2410 bf05929c de0f2444 bf05902c de0f2410 c02ca37c
3f20: c02ca364 c02c8db0 bf05929c de0f2410 bf05929c c02c94c8 bf05929c 00000000
3f40: 00000800 c02c8ab4 bf0592e0 c007fc40 c00dd820 6273756d 336d615f 00783533
3f60: c064a0ac de1b7500 de122000 de1b7500 c000e590 00000001 c000e6c4 c0060160
3f80: 00028e70 00028e70 00028ea4 00000081 60000010 00028e70 00028e70 00028ea4
3fa0: 00000081 c000e500 00028e70 00028e70 00028ea4 00000800 becb59f8 00027608
3fc0: 00028e70 00028e70 00028ea4 00000081 00000001 00000001 00000000 00028f00
3fe0: b6e6b6f0 becb59d4 000160e8 b6e6b6fc 60000010 00028ea4 00000000 00000000
[] (am335x_shutdown) from [] (dsps_musb_exit+0x3c/0x4c [musb_dsps])
[] (dsps_musb_exit [musb_dsps]) from [] (musb_shutdown+0x80/0x90 [musb_hdrc])
[] (musb_shutdown [musb_hdrc]) from [] (musb_remove+0x24/0x68 [musb_hdrc])
[] (musb_remove [musb_hdrc]) from [] (platform_drv_remove+0x18/0x1c)
[] (platform_drv_remove) from [] (__device_release_driver+0x70/0xc8)
[] (__device_release_driver) from [] (device_release_driver+0x20/0x2c)
[] (device_release_driver) from [] (bus_remove_device+0xdc/0x10c)
[] (bus_remove_device) from [] (device_del+0x104/0x198)
[] (device_del) from [] (platform_device_del+0x14/0x9c)
[] (platform_device_del) from [] (platform_device_unregister+0xc/0x20)
[] (platform_device_unregister) from [] (dsps_remove+0x18/0x38 [musb_dsps])
[] (dsps_remove [musb_dsps]) from [] (platform_drv_remove+0x18/0x1c)
[] (platform_drv_remove) from [] (__device_release_driver+0x70/0xc8)
[] (__device_release_driver) from [] (device_release_driver+0x20/0x2c)
[] (device_release_driver) from [] (bus_remove_device+0xdc/0x10c)
[] (bus_remove_device) from [] (device_del+0x104/0x198)
[] (device_del) from [] (device_unregister+0xc/0x20)
[] (device_unregister) from [] (of_remove_populated_child+0xc/0x14 [musb_am335x])
[] (of_remove_populated_child [musb_am335x]) from [] (device_for_each_child+0x44/0x70)
[] (device_for_each_child) from [] (am335x_child_remove+0x18/0x30 [musb_am335x])
[] (am335x_child_remove [musb_am335x]) from [] (platform_drv_remove+0x18/0x1c)
[] (platform_drv_remove) from [] (__device_release_driver+0x70/0xc8)
[] (__device_release_driver) from [] (driver_detach+0xb4/0xb8)
[] (driver_detach) from [] (bus_remove_driver+0x4c/0xa0)
[] (bus_remove_driver) from [] (SyS_delete_module+0x128/0x1cc)
[] (SyS_delete_module) from [] (ret_fast_syscall+0x0/0x48)

Fixes: 97238b35d5bb ("usb: musb: dsps: use proper child nodes")
Acked-by: George Cherian 
Signed-off-by: Ezequiel Garcia 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: Ensure that cppi41 timer gets armed on premature DMA TX irq

2014-07-09T18:18:23+00:00

commit c58d80f523ffc15ef4d062fc7aeb03793fe39701 upstream.

Some TI chips raise the DMA complete interrupt before the actual
transfer has been completed. The code tries to busy wait for a few
microseconds and if that fails it arms an hrtimer to recheck. So far
so good, but that has the following issue:

CPU 0					CPU1

start_next_transfer(RQ1);

DMA interrupt
  if (premature_irq(RQ1))
    if (!hrtimer_active(timer))
       hrtimer_start(timer);

hrtimer expires
  timer->state = CALLBACK_RUNNING;
  timer->fn()
    cppi41_recheck_tx_req()
      complete_request(RQ1);
      if (requests_pending())
        start_next_transfer(RQ2);

					DMA interrupt
					  if (premature_irq(RQ2))
					    if (!hrtimer_active(timer))
					       hrtimer_start(timer);
  timer->state = INACTIVE;

The premature interrupt of request2 on CPU1 does not arm the timer and
therefor the request completion never happens because it checks for
!hrtimer_active(). hrtimer_active() evaluates:

  timer->state != HRTIMER_STATE_INACTIVE

which of course evaluates to true in the above case as timer->state is
CALLBACK_RUNNING.

That's clearly documented:

 * A timer is active, when it is enqueued into the rbtree or the
 * callback function is running or it's in the state of being migrated
 * to another cpu.

But that's not what the code wants to check. The code wants to check
whether the timer is queued, i.e. whether its armed and waiting for
expiry.

We have a helper function for this: hrtimer_is_queued(). This
evaluates:

  timer->state & HRTIMER_STATE_QUEUED

So in the above case this evaluates to false and therefor forces the
DMA interrupt on CPU1 to call hrtimer_start().

Use hrtimer_is_queued() instead of hrtimer_active() and evrything is
good.

Reported-by: Torben Hohn 
Signed-off-by: Thomas Gleixner 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: ux500: don't propagate the OF node

2014-07-09T18:18:23+00:00

commit 82363cf2eeafeea6ba88849f5e2febdc8a05943f upstream.

There is a regression in the upcoming v3.16-rc1, that is caused
by a problem that has been around for a while but now finally
hangs the system. The bootcrawl looks like this:

pinctrl-nomadik soc:pinctrl: pin GPIO256_AF28 already
requested by a03e0000.usb_per5; cannot claim for musb-hdrc.0.auto
pinctrl-nomadik soc:pinctrl: pin-256 (musb-hdrc.0.auto) status -22
pinctrl-nomadik soc:pinctrl: could not request pin 256
(GPIO256_AF28) from group usb_a_1  on device pinctrl-nomadik
musb-hdrc musb-hdrc.0.auto: Error applying setting, reverse
things back
HS USB OTG: no transceiver configured
musb-hdrc musb-hdrc.0.auto: musb_init_controller failed
with status -517
platform musb-hdrc.0.auto: Driver musb-hdrc requests
probe deferral
(...)

The ux500 MUSB driver propagates the OF node to the dynamically
created musb-hdrc device, which is incorrect as it makes the OF
core believe there are two devices spun from the very same
DT node, which confuses other parts of the device core, notably
the pin control subsystem, which will try to apply all the pin
control settings also to the HDRC device as it gets
instantiated. (The OMAP2430 for example, does not set the
of_node member.)

Cc: Arnd Bergmann 
Acked-by: Lee Jones 
Signed-off-by: Linus Walleij 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman

usb: musb: fix PHY power on/off

2014-05-06T14:59:33+00:00

commit 3063a12be2b07c64e9802708a19489342e64c1a3 upstream.

commi 30a70b0 (usb: musb: fix obex in g_nokia.ko
causing kernel panic) removed phy_power_on()
and phy_power_off() calls from runtime PM callbacks
but it failed to note that the driver depended
on pm_runtime_get_sync() calls to power up the PHY,
thus leaving some platforms without any means to
have a working PHY.

Fix that by enabling the phy during omap2430_musb_init()
and killing it in omap2430_musb_exit().

Fixes: 30a70b0 (usb: musb: fix obex in g_nokia.ko causing kernel panic)
Cc: Pali Rohár 
Cc: Ivaylo Dimitrov 
Reported-by: Michael Scott 
Tested-by: Michael Scott 
Tested-by: Stefan Roese 
Reported-by: Rabin Vincent 
Signed-off-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman