Linux 4.1.43
* tag 'v4.1.43': (182 commits)
Linux 4.1.43
HID: core: prevent out-of-bound readings
ipvs: SNAT packet replies only for NATed connections
Revert "dmaengine: ep93xx: Don't drain the transfers in terminate_all()"
staging: comedi: ni_mio_common: fix E series ni_ai_insn_read() data
kvm: vmx: Do not disable intercepts for BNDCFGS
tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
PM / QoS: return -EINVAL for bogus strings
sched/topology: Optimize build_group_mask()
sched/topology: Fix overlapping sched_group_mask
crypto: caam - fix signals handling
crypto: atmel - only treat EBUSY as transient if backlog
crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
Add "shutdown" to "struct class".
mnt: Make propagate_umount less slow for overlapping mount propagation trees
mnt: In propgate_umount handle visiting mounts in any order
mnt: In umount propagation reparent in a separate pass
vt: fix unchecked __put_user() in tioclinux ioctls
exec: Limit arg stack to at most 75% of _STK_LIM
s390: reduce ELF_ET_DYN_BASE
...
Linux 4.1.41
* tag 'v4.1.41': (473 commits)
Linux 4.1.41
mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp
xc2028: Fix use-after-free bug properly
iio: proximity: as3935: fix as3935_write
ipx: call ipxitf_put() in ioctl error path
sched/fair: Initialize throttle_count for new task-groups lazily
sched/fair: Do not announce throttled next buddy in dequeue_task_fair()
iio: dac: ad7303: fix channel description
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
ARM: tegra: paz00: Mark panel regulator as enabled on boot
fs/xattr.c: zero out memory copied to userspace in getxattr
vfio/type1: Remove locked page accounting workqueue
crypto: algif_aead - Require setkey before accept(2)
staging: gdm724x: gdm_mux: fix use-after-free on module unload
drm/ttm: fix use-after-free races in vm fault handling
f2fs: sanity check segment count
ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
ipv6: initialize route null entry in addrconf_init()
rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
...
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
* imx/imx_4.1.15_2.0.0_ga: (157 commits)
MLK-14762 ARM: dts: imx6sll-evk: correct gpio pin for lcd power control
MLK-14285-3 usb: phy: mxs: optimize disconnect line condition
MLK-14285-2 usb: chipidea: set mode for usb phy driver
MLK-14285-1 usb: phy: add usb mode for usb_phy
MLK-14747 driver: cpufreq: Correct dc regulator voltage on imx6ull
MLK-14720 epdc: correct WFE setting when bypass legacy process
MLK-13801-02 ARM: dts: Correct the gpt timer clock source on imx6ul/ull/sll
MLK-13801-01 ARM: imx: add gpt_3m clock on imx6sll
MLK-14680 pxp/epdc: add LUT cancellation feature
MLK-14518-2 pxp: set data path for pxp after reset
MLK-14518-1 pxp: initialize pxp according to recommended flow
MLK-14516 epdc: bypass pxp legacy process when there's no transformation
MLK-14369 epdc: sync LUT status to PXP before enable collision detection
MLK-13198 pxp: imx7d: fix error histogram status report issue
MLK-13917 pxp: fix build error for pxp library in user space
MLK-13862-2 epdc/pxp: imx6ull/imx6sll: enhance the LUT cleanup flow to avoid stalling display
MLK-13862-1 epdc/pxp: imx7d: enhance the LUT cleanup flow to avoid stalling display
MLK-14697 ARM: dts: imx: update the setpoint data of imx6sll
MXSCM-266 arm: dts: increase lpddr2 voltage to 1.25V
MXSCM-265: dts: place imx6sxscm dtb files under CONFIG_SOC_IMX6SX
...
[ Upstream commit 3243367b209faed5c320a4e5f9a565ee2a2ba958 ]
Some USB 2.0 devices erroneously report millisecond values in
bInterval. The generic config code manages to catch most of them,
but in some cases it's not completely enough.
The case at stake here is a USB 2.0 braille device, which wants to
announce 10ms and thus sets bInterval to 10, but with the USB 2.0
computation that yields to 64ms. It happens that one can type fast
enough to reach this interval and get the device buffers overflown,
leading to problematic latencies. The generic config code does not
catch this case because the 64ms is considered a sane enough value.
This change thus adds a USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL quirk
to mark devices which actually report milliseconds in bInterval,
and marks Vario Ultra devices as needing it.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
USB phy driver may need to know the current working mode of
the controller, and does some different settings according to
host mode or device mode.
Signed-off-by: Li Jun <jun.li@nxp.com>
(cherry picked from commit 2286cb30feedd6f4a5cb82a0f0af5aa3a04ab698)
Linux 4.1.33
* tag 'v4.1.33': (1760 commits)
Linux 4.1.33
Revert "ARC: mm: don't loose PTE_SPECIAL in pte_modify()"
x86/AMD: Apply erratum 665 on machines without a BIOS fix
x86/paravirt: Do not trace _paravirt_ident_*() functions
ovl: listxattr: use strnlen()
ovl: remove posix_acl_default from workdir
serial: 8250: added acces i/o products quad and octal serial cards
sysfs: correctly handle read offset on PREALLOC attrs
sysfs: correctly handle short reads on PREALLOC attrs.
kernfs: don't depend on d_find_any_alias() when generating notifications
dm crypt: fix free of bad values after tfm allocation failure
dm crypt: fix error with too large bios
dm log writes: fix check of kthread_run() return value
dm log writes: fix bug with too large bios
dm log writes: move IO accounting earlier to fix error path
NFSv4.x: Fix a refcount leak in nfs_callback_up_net
xfs: prevent dropping ioend completions during buftarg wait
xfs: fix superblock inprogress check
USB: serial: option: add WeTelecom 0x6802 and 0x6803 products
USB: avoid left shift by -1
...
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
[ Upstream commit feb26ac31a2a5cb88d86680d9a94916a6343e9e6 ]
The XHCI controller presents two USB buses to the system - one for USB2
and one for USB3. The hub init code (hub_port_init) is reentrant but
only locks one bus per thread, leading to a race condition failure when
two threads attempt to simultaneously initialise a USB2 and USB3 device:
[ 8.034843] xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command
[ 13.183701] usb 3-3: device descriptor read/all, error -110
On a test system this failure occurred on 6% of all boots.
The call traces at the point of failure are:
Call Trace:
[<ffffffff81b9bab7>] schedule+0x37/0x90
[<ffffffff817da7cd>] usb_kill_urb+0x8d/0xd0
[<ffffffff8111e5e0>] ? wake_up_atomic_t+0x30/0x30
[<ffffffff817dafbe>] usb_start_wait_urb+0xbe/0x150
[<ffffffff817db10c>] usb_control_msg+0xbc/0xf0
[<ffffffff817d07de>] hub_port_init+0x51e/0xb70
[<ffffffff817d4697>] hub_event+0x817/0x1570
[<ffffffff810f3e6f>] process_one_work+0x1ff/0x620
[<ffffffff810f3dcf>] ? process_one_work+0x15f/0x620
[<ffffffff810f4684>] worker_thread+0x64/0x4b0
[<ffffffff810f4620>] ? rescuer_thread+0x390/0x390
[<ffffffff810fa7f5>] kthread+0x105/0x120
[<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
[<ffffffff81ba183f>] ret_from_fork+0x3f/0x70
[<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
Call Trace:
[<ffffffff817fd36d>] xhci_setup_device+0x53d/0xa40
[<ffffffff817fd87e>] xhci_address_device+0xe/0x10
[<ffffffff817d047f>] hub_port_init+0x1bf/0xb70
[<ffffffff811247ed>] ? trace_hardirqs_on+0xd/0x10
[<ffffffff817d4697>] hub_event+0x817/0x1570
[<ffffffff810f3e6f>] process_one_work+0x1ff/0x620
[<ffffffff810f3dcf>] ? process_one_work+0x15f/0x620
[<ffffffff810f4684>] worker_thread+0x64/0x4b0
[<ffffffff810f4620>] ? rescuer_thread+0x390/0x390
[<ffffffff810fa7f5>] kthread+0x105/0x120
[<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
[<ffffffff81ba183f>] ret_from_fork+0x3f/0x70
[<ffffffff810fa6f0>] ? kthread_create_on_node+0x200/0x200
Which results from the two call chains:
hub_port_init
usb_get_device_descriptor
usb_get_descriptor
usb_control_msg
usb_internal_control_msg
usb_start_wait_urb
usb_submit_urb / wait_for_completion_timeout / usb_kill_urb
hub_port_init
hub_set_address
xhci_address_device
xhci_setup_device
Mathias Nyman explains the current behaviour violates the XHCI spec:
hub_port_reset() will end up moving the corresponding xhci device slot
to default state.
As hub_port_reset() is called several times in hub_port_init() it
sounds reasonable that we could end up with two threads having their
xhci device slots in default state at the same time, which according to
xhci 4.5.3 specs still is a big no no:
"Note: Software shall not transition more than one Device Slot to the
Default State at a time"
So both threads fail at their next task after this.
One fails to read the descriptor, and the other fails addressing the
device.
Fix this in hub_port_init by locking the USB controller (instead of an
individual bus) to prevent simultaneous initialisation of both buses.
Fixes: 638139eb95 ("usb: hub: allow to process more usb hub events in parallel")
Link: https://lkml.org/lkml/2016/2/8/312
Link: https://lkml.org/lkml/2016/2/4/748
Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
[ Upstream commit 1dfddff5fcd869fcab0c52fafae099dfa435a935 ]
NCM buffer sizes are negotiated with the device independently of
the network device MTU. The RX buffers are allocated by the
usbnet framework based on the rx_urb_size value set by cdc_ncm. A
single RX buffer can hold a number of MTU sized packets.
The default usbnet change_mtu ndo only modifies rx_urb_size if it
is equal to hard_mtu. And the cdc_ncm driver will set rx_urb_size
and hard_mtu independently of each other, based on dwNtbInMaxSize
and dwNtbOutMaxSize respectively. It was therefore assumed that
usbnet_change_mtu() would never touch rx_urb_size. This failed to
consider the case where dwNtbInMaxSize and dwNtbOutMaxSize happens
to be equal.
Fix by implementing an NCM specific change_mtu ndo, modifying the
netdev MTU without touching the buffer size settings.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ad87e03213b552a5c33d5e1e7a19a73768397010 upstream.
Some USB device / host controller combinations seem to have problems
with Link Power Management. For example, Steinar found that his xHCI
controller wouldn't handle bandwidth calculations correctly for two
video cards simultaneously when LPM was enabled, even though the bus
had plenty of bandwidth available.
This patch introduces a new quirk flag for devices that should remain
disabled for LPM, and creates quirk entries for Steinar's devices.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Steinar H. Gunderson <sgunderson@bigfoot.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change behavior during registration of gadgets and
gadget drivers in udc-core. Instead of previous
approach when for successful probe of usb gadget driver
at least one usb gadget should be already registered
use another one where gadget drivers and gadgets
can be registered in udc-core independently.
Independent registration of gadgets and gadget drivers
is useful for built-in into kernel gadget and gadget
driver case - because it's possible that gadget is
really probed only on late_init stage (due to deferred
probe) whereas gadget driver's probe is silently failed
on module_init stage due to no any UDC added.
Also it is useful for modules case - now there is no
difference what module to insert first: gadget module
or gadget driver one.
Tested-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
[simplified code as requested by Alan Stern and Felipe Balbi,
fixed checkpatch issues]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Introduce new 'udc_name' member to usb_gadget_driver structure.
The 'udc_name' is a name of UDC that usb_gadget_driver should
be bound to. If udc_name is NULL, it will be bound to any
available UDC.
Tested-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
HNP polling need a one byte buffer for usb control transfer via DMA read,
currently using a data field in a structure for DMA buffer may cause cache
incoherent issue, because the cache line for the DMA buffer also contains
other data in this structure, while dma from device is outstanding, the
access on other data in the same cache line will cause we get the old data
before DMA. This patch change the host_request_flag to be a pointer, its
memory will be allocated through kmalloc by controller driver, with this
way, the DMA buffer can be properly aligned and padded.
Signed-off-by: Li Jun <jun.li@freescale.com>
- Replace all "transceiver" with "phy"
- Replace one "OTG controller" with "phy"
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
i.MX7D has a silicon issue on full speed termination after A device ends
a session, which causes it can not detect data pulse from B device if
A device isn't in low power mode, this patch work around it by override
Termsel bit to be 1 for FS mode termination. After A device detects data
pulse or turns on vbus, this override will be cleared and disabled.
Signed-off-by: Li Jun <jun.li@freescale.com>
(cherry picked from commit 1ec37968c892efbb1925784446a75d35e8bda228)
HNP polling uses a kernel stack variable when sending the HNP polling
control message, which causes dma-debug to complain, fix it by adding
host_req_flag to otg_fsm struct, so it's done by kmallocing.
Signed-off-by: Li Jun <jun.li@freescale.com>
(cherry picked from commit 05b5f53b2c4d71761454b47852d5c5a48c5cc93a)
B-device detects that bus is idle for more than TB_AIDL_BDIS min and begins HNP
by turning off pullup on DP, this allows the bus to discharge to the SE0 state.
This timer was missed and failed with one PET test, this patch is to fix this
timing issue.
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit 338efb70f6400d0930e6c8d53b2f4293a80db6d1)
This patch adds a flag hnp_polling to indicate if HNP polling is supported.
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit b19d4b1110fe1fb2ec3141233781a1e016c9a9cf)
(cherry picked from commit cad8ae2986ab0b70d0f13b96c98f340564213d4c)
After B device as host enumerates A peripheral and sets configuration,
B host should start to hand host role back to A device when this timer
expires.
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit 3f4a8c8a20ef69721f9e7886b8d245036d41d91a)
(cherry picked from commit 72b535f92ea078d8c3bd73186763bcb2f39106bb)
This patch adds flag otg_hnp_reqd in struct otg_fsm to indicate A device
as host wants to start HNP sequence.
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit 92382e06c6902731b05dcbb0db4f0ebfa486969f)
(cherry picked from commit 8e3f26a58f995711a81b401af26fbe5ed12e17f4)
This patch adds a timer for chipidea otg fsm driver to start data pulse
after A host ends the session.
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit 35e92b59080b58925c3b96e36511056cb51d4a00)
(cherry picked from commit eeded24ce2d20b1c19d5c666e916f41995cf2385)
This patch adds flag otg_srp_reqd in struct otg_fsm to indicate A device
as host wants B-UUT to do SRP once it ends the session.
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit 8e5f1b6b12ec77ec591909b09727049ffff37b9c)
(cherry picked from commit 7eaf8cf8ff375917e9972cca69bcecd6d807e6db)
This patch adds 2 variables: tst_maint and otg_vbus_off, tst_maint is to check if
current session for test device; otg_vbus_off is to notify if A device need turn
off vbus immediately after B device disconnects.
The otg test device handling is added into ehset driver, for that device,
A-device should start a timer for maintain the session, and set otg_vbus_off
flag according to its bcdDevice value.
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit 78a2c14bdea4b8e334c7e0afad074b61b71193cb)
(cherry picked from commit b854141cc5a7150751e7f7fd2dfb10a415cfea10)
For some platforms, time delay is required between putting PHY into low power
mode and gate PHY clock.
Signed-off-by: Li Jun <jun.li@freescale.com>
(cherry picked from commit ec0f2d7c8198f368d97ef070186c1b3b5a78bbea)
The glue layer may need to know current available role, add
ci_hdrc_query_available_role for that.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit 5c340402131ca6eacaeb122deb1ee59bcea2778c)
When the port goes to suspend or finishes resme, it needs to
notify PHY, it is not a standard EHCI operation, so we add a
quirk for it.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit 4ffe8d85d4eed813b43cbd37e5241a8a0069021d)
This patch adds OTG status selector request sending function, can be used
to poll peripheral if it wants to be host.
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit aeb26447ee561dcd525448a8542a1912a581a1e8)
This patch starts HNP polling timer when otg is set to be a_host
or b_host.
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit e19d0282ed6e2587187ee6329c33332b1e320672)
This patch adds host_request_flag in usb_gadget to store host request
information from application.
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit eeeb09c86010e72153fbe15b0b67eefd160a0344)
This patch adds a timer to delay turn on vbus after detecting data pulse
from B-device, this is required by OTG SRP timing.
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit f02ee3e93715c41f5b1e11140f36e350c7ed4d6b)
They are used to notify PHY that the controller enters suspend
or finishes resume.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit 737908259ccc3c3166a51ed8e3638ac1f1730e08)
This patch adds support of power lost during system sleep in otg fsm mode.
Signed-off-by: Li Jun <b47624@freescale.com>
(cherry picked from commit 493f3c4f04f48240dacc49f84db57e7ecf90161b)
- Change .notify's return value from void to int, update msm notify_event
return value accordingly.
- Add CI_HDRC_CONTROLLER_VBUS_EVENT and
CI_HDRC_CONTROLLER_CHARGER_POST_EVENT to finish the USB charger
detection flow.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <jun.li@freescale.com>
The user can adjust it through dts or platform data
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit 4c16a2a7f8d6c8ba9c4aefaa126a5961a4decde3)
The users can change it through dts or platform data if they
want to change the default value.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit ebcf71aedb6d9cd4eacffd3480b6349daf157ffb)
The system bus and chipidea IP have different limitations for
both host and device mode.
For example, with below errata, we need to enable SDIS(Stream Disable
Mode) at host mode. But we don't want it for device mode at the
same system.
TAR 9000378958
Title: Non-Double Word Aligned Buffer Address Sometimes Causes Host to
Hang on OUT Retry
Impacted Configuration: Host mode, all transfer types
Description:
The host core operating in streaming mode may under run while sending
the data packet of an OUT transaction. This under run can occur if
there are unexpected system delays in fetching the remaining packet
data from memory. The host forces a bad CRC on the packet, the device
detects the error and discards the packet. The host then retries a Bulk,
Interrupt, or Control transfer if an under run occurs according to the
USB specification. During simulations, it was found that the host does
not issue the retry of the failed bulk OUT. It does not issue any other
transactions except SOF packets that have incorrect frame numbers.
The second failure mode occurs if the under run occurs on an ISO OUT
transaction and the next ISO transaction is a zero byte packet. The host
does not issue any transactions (including SOFs). The device detects a
Suspend condition, reverts to full speed, and waits for resume signaling.
A third failure mode occurs when the host under runs on an ISO OUT and
the next ISO in the schedule is an ISO OUT with two max packets of 1024
bytes each. The host should issue MDATA for the first OUT followed by
DATA1 for the second. However, it drops the MDATA transaction, and
issues the DATA1 transaction.
The system impact of this bug is the same regardless of the failure mode
observed. The host core hangs, the ehci_ctrl state machine waits for the
protocol engine to send the completion status for the corrupted
transaction, which never occurs. No indication is sent to the host
controller driver, no register bits change and no interrupts occur.
Eventually the requesting application times out.
Detailed internal behavior:
The EHCI control state machine (ehci_ctrl) in the DMA block is responsible
for parsing the schedules and initiating all transactions. The ehci_ctrl
state machine passes the transaction details to the protocol block by
writing the transaction information in to the TxFIFO. It then asserts
the pe_hst_run_pkt signal to inform the host protocol state machine
(pe_hst_state) that there is a packet in the TxFIFO.
A tag of 0x0 indicates a start of packet with the data providing the
following information:
35:32 Tag
31:30 Reserved
29:23 Endpoint (lowest 4 bits)
22:16 Address
15:10 Reserved
9:8 Endpoint speed
7:6 Endpoint type
5:6 Data Toggle
3:0 PID
The pe_hst_state reads the packet information and constructs the packet
and issues it to the PHY interface.
The ehci_ctrl state machine writes the start transaction information in
to the TxFIFO as 0x03002910c for the OUT packet that had the under run
error. However, it writes 0xC3002910C for the retry of the Out
transaction, which is incorrect.
The pe_hst_state enters a bus timeout state after sending the bad CRC
for the packet that under ran. It then purges any data that was back
filled in to the TxFIFO for the packet that under ran. The pe_hst_state
machine stops purging the TxFIFO when it is empty or if it reads a
location that has a tag of 0x0, indicating a start of packet command.
The pe_hst_state reads 0xC3002910C and discards it as it does not decode
to a start of packet command. It continues to purge the OUT data that
has been pre-buffered for the OUT retry . The pe_hst_state detects the
hst_packet_run signal and attempts to read the PID and address
information from the TxFIFO. This location has packet data and so does
not decode to a valid PID and so falls through to the PE_HST_SOF_LOAD
state where the frame_num_counter is updated. The frame_num_counter
is updated with the data in the TxFIFO. In this case, the data is
incorrect as the ehci_ctrl state machine did not initiate the load.
The hst_pe_state machine detects the SOF request signal and sends an
SOF with the bad frame number. Meanwhile, the ehci_ctrl state machine
waits indefinitely in the run_pkt state waiting for the completion
status from pe_hst_state machine, which will never happen.
The ISO failure case is similar except that there is no retry for ISO.
The ehci_ctrl state machine moves to the next transfer in the periodic
schedule. If the under run occurs on the last entry of the periodic
list then it moves to the Async schedule.
In the case of ISO OUT simulations, the next ISO is a zero byte OUT
and again the start of packet command gets corrupted. The TxFIFO is
empty when the hst_pe_state attempts to read the Address and PID
information as the transaction is a zero byte packet. This results
in the hst_pe_state machine staying in the GET_PID state, which means
that it does not issue any transactions (including SOFs). The device
detects a Suspend condition and reverts to full speed mode and waits
for a Resume or Reset signal.
The EHCI specification allows a Non-DoubleWord (32 bits) offset to
be used as a current offset for Buffer Pointer Page 0 of the qTD.
In Non-DoubleWord aligned cases, the core reads the packet data
from the AHB memory, performs the alignment operation before writing
it in to the TxFIFO as a 32 bit data word. An End Of Packet tag (EOP)
is written to the TxFIFO after all the packet data has been written
in to the TxFIFO. The alignment function is reset to Idle by the EOP
tag. The corruption of the start of packet command arises because the
packet buffer for the OUT transaction that under ran is not aligned
to a DoubleWord, and hence no EOP tag is written to the TxFIFO. The
alignment function is still active when the start packet information
is written in to the TxFIFO for the retry of the bulk packet or for
the next transaction in the case of an under run on an ISO. This
results in the corruption of the start tag and the transaction
information.
Click for waveform showing the command 0x 0000300291 being written in
to the TX FIFO for the Out that under ran.
Click for waveform showing the command 0xC3002910C written to the
TxFIFO instead of 0x 0000300291
Versions affected: Versions 2.10a and previous versions
How discovered: Customer simulation
Workaround:
1- The EHCI specification allows a non-DoubleWord offset to be used
as a current offset for Buffer Pointer Page 0 of the qTD. However,
if a DoubleWord offset is used then this issue does not arise.
2- Use non streaming mode to eliminate under runs.
Resolution:
The fix involves changes to the traffic state machine in the
vusb_hs_dma_traf block. The ehci_ctrl state machine updates the context
information by encoding the transaction results on the
hst_op_context_update signals at the end of a transaction. The signal
hst_op_context_update is added to the traffic state machine, and the
tx_fifo_under_ran_r signal is generated if the transaction results in
an under run error. Click for waveform
The traffic state machine then traverses to the do_eop states if the
tx_fifo_under_ran error is asserted. Thus an EOP tag is written in to
the TxFIFO as shown in this waveform .
The EOP tag resets the align state machine to the Idle state ensuring
that the next command written by the echi_ctrl state machine does not
get corrupted.
File(s) modified:
RTL code fixed: …..
Method of reproducing: This failure cannot be reproduced in the current
test bench.
Date Found: March 2010
Date Fixed: June 2010
Update information:
Added the RTL code fix
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit 05292aed5cb82e8bb6846f2f808310d699f7000f)
Allocate usb otg descriptor and initialize it according to gadget's otg
capabilities, if usb_otg_caps is not set, keep settings as current gadget
drivers. With this 2 new interfaces, gadget can use usb_otg_descriptor
for OTG 1.x, and usb_otg20_descriptor for OTG 2.0 or above, and otg
features can be decided by the combination of usb hardware property
and driver config.
Signed-off-by: Li Jun <jun.li@freescale.com>
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 371fae666a460d6452c6329253211f77b59894b5)
Init and update otg capabilities by DT, set gadget's otg capabilities
accordingly.
Acked-by: Peter Chen <peter.chen@freescale.com>
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Li Jun <jun.li@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 8b22c5d6f38ebe82a78fb5e46d674ec838c38078)
Check property of usb hardware to update otg version and disable SRP, HNP
and ADP if its disable flag is present.
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Li Jun <jun.li@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit 695585918d95dcb97d2f2c72e888ecdc7afff75a)
Add usb_otg_caps pointer to usb_gadget structure to indicate its
otg capabilities.
Signed-off-by: Macpaul Lin <macpaul@gmail.com>
Signed-off-by: Li Jun <jun.li@freescale.com>
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit e262a7812ff8a971e1b7a8ba18b1ba7f68b28c46)
This patch adds a structure usb_otg_caps to cover all otg related
capabilities of the device, including otg revision, and if hnp/srp/adp
is supported.
Signed-off-by: Li Jun <jun.li@freescale.com>
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
(cherry picked from commit c0b79dc778505ba458b2d650b2c4628eccd2aa5d)
ITC (Interrupt Threshold Control) is used to set the maximum rate at which
the host/device controller will issue interrupts. The default value is 8 (1ms)
for it. EHCI core will modify it to 1, but device mode keeps it as default
value.
In some use cases like Android ADB, it only has one usb request for each
direction, and maximum payload data is only 4KB, so the speed is 4MB/s
at most, it needs controller to trigger interrupt as fast as possible
to increase the speed. The USB performance will be better if the interrupt
can be triggered faster.
Reduce ITC value is benefit for USB performance, but the interrupt number
is increased at the same time, it may increase cpu utilization too.
Most of use case cares about performance, but some may care about
cpu utilization, so, we leave a platform interface for user.
We set ITC as 1 (1 micro-frame) as default value which is aligned
with ehci core default value.
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit 2a7ef1e9520906172e636e134d596dd47886aaca)
The register of ttctrl.ttha describes like below:
- Internal TT Hub Address Representation
- RW
- Default = 0000000b
This field is used to match against the Hub Address field in QH & siTD
to determine if the packet is routed to the internal TT for directly
attached FS/LS devices. If the Hub Address in the QH or siTD does not
match this address then the packet will be broadcast on the High Speed
ports destined for a downstream High Speed hub with the address in the QH/siTD.
In silicon RTL, this entry only affects QH and siTD, and the hub.addr at
both QH and siTD are 0 in ehci core for chipidea (with hcd->has_tt = 1).
So, for QH, if the "usage_tt" flag at RTL is 0, set CI_HDRC_SET_NON_ZERO_TTHA
will not affect QH (with non-hs device); for siTD, set this flag
will change remaining space requirement for the last transaction from 1023
bytes to 188 bytes, it can increase the number of transactions within one
frame, ehci periodic schedule code will not queue the packet if the frame space
is full, so it is safe to set this flag for siTD.
With this flag, it can fix the problem Alan Stern reported below:
http://www.spinics.net/lists/linux-usb/msg123125.html
And may fix Michael Tessier's problem too.
http://www.spinics.net/lists/linux-usb/msg118679.html
CC: stern@rowland.harvard.edu
CC: michael.tessier@axiontech.ca
Signed-off-by: Peter Chen <peter.chen@freescale.com>
(cherry picked from commit a6f53b94080ec683e57c051f9ee09cdb37be85ab)
cdc_ncm disagrees with usbnet about how much framing overhead should
be counted in the tx_bytes statistics, and tries 'fix' this by
decrementing tx_bytes on the transmit path. But statistics must never
be decremented except due to roll-over; this will thoroughly confuse
user-space. Also, tx_bytes is only incremented by usbnet in the
completion path.
Fix this by requiring drivers that set FLAG_MULTI_FRAME to set a
tx_bytes delta along with the tx_packets count.
Fixes: beeecd42c3 ("net: cdc_ncm/cdc_mbim: adding NCM protocol statistics")
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Currently the usbnet core does not update the tx_packets statistic for
drivers with FLAG_MULTI_PACKET and there is no hook in the TX
completion path where they could do this.
cdc_ncm and dependent drivers are bumping tx_packets stat on the
transmit path while asix and sr9800 aren't updating it at all.
Add a packet count in struct skb_data so these drivers can fill it
in, initialise it to 1 for other drivers, and add the packet count
to the tx_packets statistic on completion.
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Tested-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
B_DATA_PLS(data-line pulse time) and B_SSEND_SRP(session end to SRP init) are
also from OTG&EH 2.0 Specification and they are not chipidea specific.
Signed-off-by: Li Jun <jun.li@freescale.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
