While running reboot tests w/ a specific set of USB devices (and
slub_debug enabled), I found that once every few hours my device would
be crashed with a stack that looked like this:
[ 14.012445] BUG: spinlock bad magic on CPU#0, modprobe/2091
[ 14.012460] lock: 0xffffffc0cb055978, .magic: ffffffc0, .owner: cryption contexts: %lu/%lu
[ 14.012460] /1025536097, .owner_cpu: 0
[ 14.012466] CPU: 0 PID: 2091 Comm: modprobe Not tainted 4.4.79 #352
[ 14.012468] Hardware name: Google Kevin (DT)
[ 14.012471] Call trace:
[ 14.012483] [<....>] dump_backtrace+0x0/0x160
[ 14.012487] [<....>] show_stack+0x20/0x28
[ 14.012494] [<....>] dump_stack+0xb4/0xf0
[ 14.012500] [<....>] spin_dump+0x8c/0x98
[ 14.012504] [<....>] spin_bug+0x30/0x3c
[ 14.012508] [<....>] do_raw_spin_lock+0x40/0x164
[ 14.012515] [<....>] _raw_spin_lock_irqsave+0x64/0x74
[ 14.012521] [<....>] __wake_up+0x2c/0x60
[ 14.012528] [<....>] async_completed+0x2d0/0x300
[ 14.012534] [<....>] __usb_hcd_giveback_urb+0xc4/0x138
[ 14.012538] [<....>] usb_hcd_giveback_urb+0x54/0xf0
[ 14.012544] [<....>] xhci_irq+0x1314/0x1348
[ 14.012548] [<....>] usb_hcd_irq+0x40/0x50
[ 14.012553] [<....>] handle_irq_event_percpu+0x1b4/0x3f0
[ 14.012556] [<....>] handle_irq_event+0x4c/0x7c
[ 14.012561] [<....>] handle_fasteoi_irq+0x158/0x1c8
[ 14.012564] [<....>] generic_handle_irq+0x30/0x44
[ 14.012568] [<....>] __handle_domain_irq+0x90/0xbc
[ 14.012572] [<....>] gic_handle_irq+0xcc/0x18c
Investigation using kgdb() found that the wait queue that was passed
into wake_up() had been freed (it was filled with slub_debug poison).
I analyzed and instrumented the code and reproduced. My current
belief is that this is happening:
1. async_completed() is called (from IRQ). Moves "as" onto the
completed list.
2. On another CPU, proc_reapurbnonblock_compat() calls
async_getcompleted(). Blocks on spinlock.
3. async_completed() releases the lock; keeps running; gets blocked
midway through wake_up().
4. proc_reapurbnonblock_compat() => async_getcompleted() gets the
lock; removes "as" from completed list and frees it.
5. usbdev_release() is called. Frees "ps".
6. async_completed() finally continues running wake_up(). ...but
wake_up() has a pointer to the freed "ps".
The instrumentation that led me to believe this was based on adding
some trace_printk() calls in a select few functions and then using
kdb's "ftdump" at crash time. The trace follows (NOTE: in the trace
below I cheated a little bit and added a udelay(1000) in
async_completed() after releasing the spinlock because I wanted it to
trigger quicker):
<...>-2104 0d.h2 13759034us!: async_completed at start: as=ffffffc0cc638200
mtpd-2055 3.... 13759356us : async_getcompleted before spin_lock_irqsave
mtpd-2055 3d..1 13759362us : async_getcompleted after list_del_init: as=ffffffc0cc638200
mtpd-2055 3.... 13759371us+: proc_reapurbnonblock_compat: free_async(ffffffc0cc638200)
mtpd-2055 3.... 13759422us+: async_getcompleted before spin_lock_irqsave
mtpd-2055 3.... 13759479us : usbdev_release at start: ps=ffffffc0cc042080
mtpd-2055 3.... 13759487us : async_getcompleted before spin_lock_irqsave
mtpd-2055 3.... 13759497us!: usbdev_release after kfree(ps): ps=ffffffc0cc042080
<...>-2104 0d.h2 13760294us : async_completed before wake_up(): as=ffffffc0cc638200
To fix this problem we can just move the wake_up() under the ps->lock.
There should be no issues there that I'm aware of.
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The musb_dsps driver is special in that the parent (glue) device's
driver is accessing registers mapped by the child. The clock is however
shared and is managed by the grandparent device.
Since commit 869c597829 ("usb: musb: dsps: add support for suspend and
resume") the dsps driver has been accessing these registers as part of
suspend and resume.
The parent driver obviously cannot runtime resume the child during
system suspend and is currently relying on the fact that the child will
be RPM_ACTIVE throughout suspend. The suspend implementation also makes
sure to check that the child is indeed present (and hence the clock
enabled) before accessing the registers.
Let's add an explicit runtime resume of the glue device itself to enable
the clock before doing the register accesses in case these assumptions ever
change (i.e. if the child is left runtime suspended).
Note that the glue-timer cancellation is moved after the child-presence
check to keep error handling simple. This should be fine as the timer is
not setup until the controller is being registered and at that time
glue->musb and its driver data have already been initialised.
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Daniel Mack <zonque@gmail.com>
Cc: Tony Lindgren <tony@atomide.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Make sure that the controller is runtime resumed when system suspending
to avoid an external abort when accessing the interrupt registers:
Unhandled fault: external abort on non-linefetch (0x1008) at 0xd025840a
...
[<c05481a4>] (musb_default_readb) from [<c0545abc>] (musb_disable_interrupts+0x84/0xa8)
[<c0545abc>] (musb_disable_interrupts) from [<c0546b08>] (musb_suspend+0x38/0xb8)
[<c0546b08>] (musb_suspend) from [<c04a57f8>] (platform_pm_suspend+0x3c/0x64)
This is easily reproduced on a BBB by enabling the peripheral port only
(as the host port may enable the shared clock) and keeping it
disconnected so that the controller is runtime suspended. (Well, you
would also need to the not-yet-merged am33xx-suspend patches by Dave
Gerlach to be able to suspend the BBB.)
This is a regression that was introduced by commit 1c4d0b4e18 ("usb:
musb: Remove pm_runtime_set_irq_safe") which allowed the parent glue
device to runtime suspend and thereby exposed a couple of older issues:
Register accesses without explicitly making sure the controller is
runtime resumed during suspend was first introduced by commit c338412b5d
("usb: musb: unconditionally save and restore the context on suspend")
in 3.14.
Commit a1fc1920aa ("usb: musb: core: make sure musb is in RPM_ACTIVE on
resume") later started setting the RPM status to active during resume,
and this was also implicitly relying on the parent always being active.
Since commit 71723f9546 ("PM / runtime: print error when activating a
child to unactive parent") this now also results in the following
warning:
musb-hdrc musb-hdrc.0: runtime PM trying to activate child device
musb-hdrc.0 but parent (47401400.usb) is not active
This patch has been verified on 4.13-rc2, 4.12 and 4.9 using a BBB
(the dsps glue would always be active also in 4.8).
Fixes: c338412b5d ("usb: musb: unconditionally save and restore the context on suspend")
Fixes: a1fc1920aa ("usb: musb: core: make sure musb is in RPM_ACTIVE on resume")
Fixes: 1c4d0b4e18 ("usb: musb: Remove pm_runtime_set_irq_safe")
Cc: stable <stable@vger.kernel.org> # 4.8+
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Daniel Mack <zonque@gmail.com>
Cc: Dave Gerlach <d-gerlach@ti.com>
Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Tony Lindgren <tony@atomide.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The fifo memory allocation in mode_2_cfg[] doesn't utilize all the 4KB
memory.
Increse some endpoint fifo buffers to fully use all the 4KB memory. Now
we can support more webcam usecases on DA8xx.
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
There are multiple places in usb core or controller driver which returns
-EMSGSIZE when a class driver queueing urb failed, so the "Message too
long" log doesn't help much for understanding the error.
Let the musb driver to specifically print a error message when
musb_urb_enqueue() returns -EMSGSIZE.
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Print an error message with qh maxpacket size and hb_mult when hwep
allocation failed, so we have a better idea why it is failed.
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add helper function musb_ep_xfertype_string() to return the ep transfer
type string.
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Casting between an 'int' and a pointer causes a warning on
64-bit architectures in compile-testing this driver:
drivers/phy/ralink/phy-ralink-usb.c: In function 'ralink_usb_phy_probe':
drivers/phy/ralink/phy-ralink-usb.c:195:13: error: cast from pointer to
integer of different size [-Werror=pointer-to-int-cast]
This changes the code to cast to uintptr_t instead. This is
guaranteed to do what we want on all architectures and avoids
the warning.
Fixes: 2411a736ff ("phy: ralink-usb: add driver for Mediatek/Ralink")
Acked-by: John Crispin <john@phrozen.org>
Tested-by Harvey Hunt <harvey.hunt@imgtec.com>
Reviewed-by Harvey Hunt <harvey.hunt@imgtec.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All of these Tegra SoC generations have a ChipIdea UDC IP block that can
be used for device mode communication with a host. Implement rudimentary
support that doesn't allow switching between host and device modes.
Tested-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Thierry Reding <treding@nvidia.com>
[digetx@gmail.com: rebased patches and added DMA alignment quirk for Tegra20]
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
NVIDIA Tegra20 UDC can't cope with unaligned DMA and require a USB gadget
quirk that avoids SKB buffer alignment to be set in order to make Ethernet
Gadget working. Later Tegra generations do not require that quirk. Let's
add a new platform data flag that allows to enable USB gadget quirk for
platforms that require it.
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Kishon writes:
phy: for 4.14
*) Add USB PHY driver for Ralink SoC
*) Make phy-mt65xx-usb3 driver support PCIe and SATA phy
*) Add mediatek directory and rename phy-mt65xx-usb3 to phy-mtk-tphy.c
since it now supports USB3.0, PCIe and SATA PHYs
*) Make sun4i-usb-phy driver support USB PHYs for A83T SoC
*) Make phy-qcom-qmp driver support USB PHYs for IPQ8074 SoC
*) Make rockchip-inno-usb2 driver support usb2-phy for rv1108 SoC
*) Minor fixes in phy drivers
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Felipe writes:
usb: changes for v4.14 merge window
Not a big pull request this time around. Only 49 non-merge
commits. This pull request is, however, all over the place. Most of
the changes are in the bdc driver adding support for USB Phy layer and
PM.
Renesas adds support for R-Car H3 ES2.0 and R-Car M3-W SoCs.
Also here is PM_RUNTIME support for dwc3-keystone.
UDC Core got a DMA unmap fix to make sure we only unmap requests that
were, indeed, mapped.
Other than these, we have a lot of cleanups, many of them adding
'const' to several places.
We want to timeout with try set to zero so this should be a pre-op
instead of post-op.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
The "check" variable isn't necessarily initialized when we print it out
in the debugging messages. It's a pretty haphazard affair and it
doesn't matter very much what we initialize "check" to.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
In order to silent the 'W=1' compile warning:
drivers/phy/rockchip/phy-rockchip-typec.c: In function 'tcphy_get_mode':
drivers/phy/rockchip/phy-rockchip-typec.c:625:7: warning: variable 'dfp'
set but not used [-Wunused-but-set-variable]
Cc: Chris Zhong <zyw@rock-chips.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
This adds support usb2-phy for rv1108 SoCs and amend phy Documentation.
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Add otg-mux property to support multiplexed interrupt in otg-port
on some Rockchip SoC (e.g RV1108).
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
The otg-id/otg-bvalid/linestate interrupts are multiplexed together
in otg-port on some Rockchip SoC (e.g RV1108), this patch add support
for it.
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Add rockchip,usbgrf property to support the registers of usb-phy
that are distributed in grf and usbgrf on some special Rockchip
SoCs (e.g RV1108).
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
The registers of usb-phy are distributed in grf and usbgrf on some
Rockchip SoCs (e.g RV1108), this patch add a new rockchip,usbgrf
property to support this companion grf design.
Signed-off-by: Frank Wang <frank.wang@rock-chips.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
The A83T has 3 USB PHYs, 1 for OTG, 1 for standard USB, 1 for USB HSIC.
The phy initialization procedure is very different from other SoCs, but
the PMU bits are the same, with additional bits for HSIC.
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Tested-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
On the Allwinner A83T SoC, the last USB PHY is an HSIC PHY. It requires
two clocks instead of one.
On all Allwinner SoCs that share the common USB PHY design supported by
the phy-sun4i-usb driver, the first PHY is always tied to OTG, and there
is at most one HSIC PHY, typically the last.
In this patch we take advantage of these known constraints and store an
index in the compatible-string-related config structure describing which
PHY is HSIC, needing the extra hsic_12M clock.
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
