summaryrefslogtreecommitdiff
path: root/drivers/usb/cdns3
AgeCommit message (Collapse)Author
2020-11-10Merge tag 'v5.4.76' into 5.4-2.1.x-imxAndrey Zhizhikin
This is the 5.4.76 stable release Conflicts: - drivers/tty/serial/fsl_lpuart.c: Fix merge conflict of upstream patches [86875e1d6426] and [8febdfb5973d], which contradicted with patch [cde0cb39c0e8e] from NXP. Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
2020-11-10usb: cdns3: gadget: suspicious implicit sign extensionPeter Chen
[ Upstream commit 5fca3f062879f8e5214c56f3e3e2be6727900f5d ] The code: trb->length = cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) | TRB_LEN(length)); TRB_BURST_LEN(priv_ep->trb_burst_size) may be overflow for int 32 if priv_ep->trb_burst_size is equal or larger than 0x80; Below is the Coverity warning: sign_extension: Suspicious implicit sign extension: priv_ep->trb_burst_size with type u8 (8 bits, unsigned) is promoted in priv_ep->trb_burst_size << 24 to type int (32 bits, signed), then sign-extended to type unsigned long (64 bits, unsigned). If priv_ep->trb_burst_size << 24 is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. To fix it, it needs to add an explicit cast to unsigned int type for ((p) << 24). Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29usb: cdns3: gadget: free interrupt after gadget has deletedPeter Chen
commit 98df91f8840cf750a0bc7c4c5d6b6085bac945b3 upstream. The interrupt may occur during the gadget deletion, it fixes the below oops. [ 2394.974604] configfs-gadget gadget: suspend [ 2395.042578] configfs-gadget 5b130000.usb: unregistering UDC driver [g1] [ 2395.382562] irq 229: nobody cared (try booting with the "irqpoll" option) [ 2395.389362] CPU: 0 PID: 301 Comm: kworker/u12:6 Not tainted 5.8.0-rc3-next-20200703-00060-g2f13b83cbf30-dirty #456 [ 2395.399712] Hardware name: Freescale i.MX8QM MEK (DT) [ 2395.404782] Workqueue: 2-0051 tcpm_state_machine_work [ 2395.409832] Call trace: [ 2395.412289] dump_backtrace+0x0/0x1d0 [ 2395.415950] show_stack+0x1c/0x28 [ 2395.419271] dump_stack+0xbc/0x118 [ 2395.422678] __report_bad_irq+0x50/0xe0 [ 2395.426513] note_interrupt+0x2cc/0x38c [ 2395.430355] handle_irq_event_percpu+0x88/0x90 [ 2395.434800] handle_irq_event+0x4c/0xe8 [ 2395.438640] handle_fasteoi_irq+0xbc/0x168 [ 2395.442740] generic_handle_irq+0x34/0x48 [ 2395.446752] __handle_domain_irq+0x68/0xc0 [ 2395.450846] gic_handle_irq+0x64/0x150 [ 2395.454596] el1_irq+0xb8/0x180 [ 2395.457733] __do_softirq+0xac/0x3b8 [ 2395.461310] irq_exit+0xc0/0xe0 [ 2395.464448] __handle_domain_irq+0x6c/0xc0 [ 2395.468540] gic_handle_irq+0x64/0x150 [ 2395.472295] el1_irq+0xb8/0x180 [ 2395.475436] _raw_spin_unlock_irqrestore+0x14/0x48 [ 2395.480232] usb_gadget_disconnect+0x120/0x140 [ 2395.484678] usb_gadget_remove_driver+0xb4/0xd0 [ 2395.489208] usb_del_gadget+0x6c/0xc8 [ 2395.492872] cdns3_gadget_exit+0x5c/0x120 [ 2395.496882] cdns3_role_stop+0x60/0x90 [ 2395.500634] cdns3_role_set+0x64/0xd8 [ 2395.504301] usb_role_switch_set_role.part.0+0x3c/0x90 [ 2395.509444] usb_role_switch_set_role+0x20/0x30 [ 2395.513978] tcpm_mux_set+0x60/0xf8 [ 2395.517470] tcpm_reset_port+0xa4/0xf0 [ 2395.521222] tcpm_detach.part.0+0x44/0x50 [ 2395.525227] tcpm_state_machine_work+0x8b0/0x2360 [ 2395.529932] process_one_work+0x1c8/0x470 [ 2395.533939] worker_thread+0x50/0x420 [ 2395.537603] kthread+0x148/0x168 [ 2395.540830] ret_from_fork+0x10/0x18 [ 2395.544399] handlers: [ 2395.546671] [<000000008dea28da>] cdns3_wakeup_irq [ 2395.551375] [<000000009fee5c61>] cdns3_drd_irq threaded [<000000005148eaec>] cdns3_drd_thread_irq [ 2395.560255] Disabling IRQ #229 [ 2395.563454] configfs-gadget gadget: unbind function 'Mass Storage Function'/000000000132f835 [ 2395.563657] configfs-gadget gadget: unbind [ 2395.563917] udc 5b130000.usb: releasing '5b130000.usb' Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: <stable@vger.kernel.org> Acked-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-03Merge tag 'v5.4.62' into 5.4-2.1.x-imxAndrey Zhizhikin
This is the 5.4.62 stable release Conflicts (manual resolve): - drivers/usb/dwc3/gadget.c Fix a hickup during applying of the patch 4bc5d90a7dce1 from upstream, that version is taken over the NXP one. Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
2020-09-03usb: cdns3: gadget: always zeroed TRB buffer when enable endpointSasha Levin
[ Upstream commit 95f5acfc4f58f01a22b66d8c9c0ffb72aa96271c ] During the endpoint dequeue operation, it changes dequeued TRB as link TRB, when the endpoint is disabled and re-enabled, the DMA fetches the TRB before the link TRB, after it handles current TRB, the DMA pointer will advance to the TRB after link TRB, but enqueue and dequene variables don't know it due to no hardware interrupt at the time, when the next TRB is added to link TRB position, the DMA will not handle this TRB due to its pointer is already at the next TRB. See the trace log like below: file-storage-675 [001] d..1 86.585657: usb_ep_queue: ep0: req 00000000df9b3a4f length 0/0 sgs 0/0 stream 0 zsI status 0 --> 0 file-storage-675 [001] d..1 86.585663: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr (null)], flags:0 SID: 0 file-storage-675 [001] d..1 86.585671: cdns3_prepare_trb: ep1out: trb 000000007f770303, dma buf: 0xbd195800, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0 file-storage-675 [001] d..1 86.585676: cdns3_ring: Ring contents for ep1out: Ring deq index: 0, trb: 000000007f770303 (virt), 0xc4003000 (dma) Ring enq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma) free trbs: 38, CCS=1, PCS=1 @0x00000000c4003000 bd195800 80020400 00000425 @0x00000000c400300c c4003018 80020400 00001811 @0x00000000c4003018 bcfcc000 0000001f 00000426 @0x00000000c4003024 bcfce800 0000001f 00000426 ... irq/144-5b13000-698 [000] d... 87.619286: usb_gadget_giveback_request: ep1in: req 0000000031b832eb length 13/13 sgs 0/0 stream 0 zsI status 0 --> 0 file-storage-675 [001] d..1 87.619287: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr 0x80020400c400300c], flags:0 SID: 0 file-storage-675 [001] d..1 87.619294: cdns3_prepare_trb: ep1out: trb 0000000049c1ba21, dma buf: 0xbd198000, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0 file-storage-675 [001] d..1 87.619297: cdns3_ring: Ring contents for ep1out: Ring deq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma) Ring enq index: 2, trb: 0000000059b34b67 (virt), 0xc4003018 (dma) free trbs: 38, CCS=1, PCS=1 @0x00000000c4003000 bd195800 0000001f 00000427 @0x00000000c400300c bd198000 80020400 00000425 @0x00000000c4003018 bcfcc000 0000001f 00000426 @0x00000000c4003024 bcfce800 0000001f 00000426 ... file-storage-675 [001] d..1 87.619305: cdns3_doorbell_epx: ep1out, ep_trbaddr c4003018 file-storage-675 [001] .... 87.619308: usb_ep_queue: ep1out: req 000000002ebce364 length 0/1024 sgs 0/0 stream 0 zsI status -115 --> 0 irq/144-5b13000-698 [000] d..1 87.619315: cdns3_epx_irq: IRQ for ep1out: 01000c80 TRBERR , ep_traddr: c4003018 ep_last_sid: 00000000 use_streams: 0 irq/144-5b13000-698 [000] d..1 87.619395: cdns3_usb_irq: IRQ 00000008 = Hot Reset Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation") Cc: stable <stable@vger.kernel.org> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-11Merge tag 'v5.4.54' into 5.4-2.1.x-imxAndrey Zhizhikin
This is the 5.4.54 stable release Conflicts: drivers/net/ethernet/freescale/enetc/enetc_pf.c Commit [e8b86b4d87e3abe890ca91f12f8e43fef75bbddc] from upstream solves the kernel panic in case if probing fails. NXP has a clean-up logic implemented different, where the MDIO remove would be invoked in any failure case. Keep the NXP logic in place. drivers/usb/cdns3/ep0.c Merge commit [103a90ad4e647dd6e4d4e149dc2edf8744c2bc4d] from upstream to handle endian misalignments respectively. Signed-off-by: Andrey Zhizhikin <andrey.z@gmail.com>
2020-08-11Merge tag 'v5.4.50' into 5.4-2.1.x-imxAndrey Zhizhikin
This is the 5.4.50 stable release Conflicts (manual resolve): arch/arm64/boot/dts/freescale/imx8mm-evk.dts: arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts: NXP patches kept to provide proper LDO setup: imx8mm-evk.dts: 975d8ab07267ded741c4c5d7500e524c85ab40d3 imx8mn-ddr4-evk.dts: e8e35fd0e759965809f3dca5979a908a09286198 drivers/net/ethernet/freescale/enetc/enetc.c Commit [ce06fcb6a66d22b080385768113ee28bf3593984] from upstream merged, base NXP version kept drivers/usb/cdns3/ep0.c Manual merge of commit [be8df027079b856a89e85778330394cea2b0b290] from upstream to protect cdns3_check_new_setup Signed-off-by: Andrey Zhizhikin <andrey.z@gmail.com>
2020-07-29usb: cdns3: trace: fix some endian issuesPeter Chen
[ Upstream commit 65b7cf48c211ece5e2560a334eb9608e48775a8f ] It is found by sparse. Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-07-29usb: cdns3: ep0: fix some endian issuesPeter Chen
[ Upstream commit 9f81d45c79271def8a9b90447b04b9c6323291f9 ] It is found by sparse. Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-30usb: cdns3: ep0: add spinlock for cdns3_check_new_setupPeter Chen
commit 2587a029fa2a877d0a8dda955ef1b24c94b4bd0e upstream. The other thread may access other endpoints when the cdns3_check_new_setup is handling, add spinlock to protect it. Cc: <stable@vger.kernel.org> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Reviewed-by: Pawel Laszczak <pawell@cadence.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-30usb: cdns3: ep0: fix the test mode set incorrectlyPeter Chen
commit b51e1cf64f93acebb6d8afbacd648a6ecefc39b4 upstream. The 'tmode' is ctrl->wIndex, changing it as the real test mode value for register assignment. Cc: <stable@vger.kernel.org> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-30usb: cdns3: trace: using correct dir valuePeter Chen
commit ba3a80fe0fb67d8790f62b7bc60df97406d89871 upstream. It should use the correct direction value from register, not depends on previous software setting. It fixed the EP number wrong issue at trace when the TRBERR interrupt occurs for EP0IN. When the EP0IN IOC has finished, software prepares the setup packet request, the expected direction is OUT, but at that time, the TRBERR for EP0IN may occur since it is DMULT mode, the DMA does not stop until TRBERR has met. Cc: <stable@vger.kernel.org> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Reviewed-by: Pawel Laszczak <pawell@cadence.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20usb: cdns3: gadget: prev_req->trb is NULL for ep0Peter Chen
commit 95cd7dc47abd71d1a0c9c43594ff2fa32552f46c upstream. And there are no multiple TRBs on EP0 and WA1 workaround, so it doesn't need to change TRB for EP0. It fixes below oops. configfs-gadget gadget: high-speed config #1: b android_work: sent uevent USB_STATE=CONFIGURED Unable to handle kernel read from unreadable memory at virtual address 0000000000000008 Mem abort info: android_work: sent uevent USB_STATE=DISCONNECTED ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b5bb7000 [0000000000000008] pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 430 Comm: HwBinder:401_1 Not tainted 5.4.24-06071-g6fa8921409c1-dirty #77 Hardware name: Freescale i.MX8QXP MEK (DT) pstate: 60400085 (nZCv daIf +PAN -UAO) pc : cdns3_gadget_ep_dequeue+0x1d4/0x270 lr : cdns3_gadget_ep_dequeue+0x48/0x270 sp : ffff800012763ba0 x29: ffff800012763ba0 x28: ffff00082c653c00 x27: 0000000000000000 x26: ffff000068fa7b00 x25: ffff0000699b2000 x24: ffff00082c6ac000 x23: ffff000834f0a480 x22: ffff000834e87b9c x21: 0000000000000000 x20: ffff000834e87800 x19: ffff000069eddc00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000001 x11: ffff80001180fbe8 x10: 0000000000000001 x9 : ffff800012101558 x8 : 0000000000000001 x7 : 0000000000000006 x6 : ffff000835d9c668 x5 : ffff000834f0a4c8 x4 : 0000000096000000 x3 : 0000000000001810 x2 : 0000000000000000 x1 : ffff800024bd001c x0 : 0000000000000001 Call trace: cdns3_gadget_ep_dequeue+0x1d4/0x270 usb_ep_dequeue+0x34/0xf8 composite_dev_cleanup+0x154/0x170 configfs_composite_unbind+0x6c/0xa8 usb_gadget_remove_driver+0x44/0x70 usb_gadget_unregister_driver+0x74/0xe0 unregister_gadget+0x28/0x58 gadget_dev_desc_UDC_store+0x80/0x110 configfs_write_file+0x1e0/0x2a0 __vfs_write+0x48/0x90 vfs_write+0xe4/0x1c8 ksys_write+0x78/0x100 __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x74/0x168 el0_svc_handler+0x34/0xa0 el0_svc+0x8/0xc Code: 52830203 b9407660 f94042e4 11000400 (b9400841) ---[ end trace 1574516e4c1772ca ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0002,20002008 Memory Limit: none Rebooting in 5 seconds.. Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation") Cc: stable <stable@vger.kernel.org> Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-12MLK-23913-7 usb: cdns3: ep0: re-init request list at cdns3_ep0_configPeter Chen
It is better to re-init request list for EP0 when the EP0 begins to uses. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-05-12MLK-23913-6 usb: cdns3: gadget: refine the stop flowPeter Chen
The new usb_gadget_disconnect API includes both calling class driver's disconnect and calling .pullup at udc driver, so we could simply your udc driver handling. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-05-12MLK-23913-5 usb: cdns3: gadget: clear the interrupt status when disconnect ↵Peter Chen
the host We do not want to handle any interrupts after usb_gadget_disconnect is called. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-05-12MLK-23913-4 usb: cdns3: gadget: set fast access bitPeter Chen
Below is the recommendation from Cadence designer: Using this bit to be sure that PHY clock is keeping up in active state. It's good to keep Fast Access bit enabled as long as there is any access to USB register. It is used to fix the potential ARM core hang when visit controller register after DEVDS is set. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-05-12MLK-23913-3 usb: cdns3: gadget: prev_req->trb is NULL for ep0Peter Chen
And there are no multiple TRBs on EP0 and WA1 workaround, so it doesn't need to change TRB for EP0. It fixes below oops. configfs-gadget gadget: high-speed config #1: b android_work: sent uevent USB_STATE=CONFIGURED Unable to handle kernel read from unreadable memory at virtual address 0000000000000008 Mem abort info: android_work: sent uevent USB_STATE=DISCONNECTED ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b5bb7000 [0000000000000008] pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 430 Comm: HwBinder:401_1 Not tainted 5.4.24-06071-g6fa8921409c1-dirty #77 Hardware name: Freescale i.MX8QXP MEK (DT) pstate: 60400085 (nZCv daIf +PAN -UAO) pc : cdns3_gadget_ep_dequeue+0x1d4/0x270 lr : cdns3_gadget_ep_dequeue+0x48/0x270 sp : ffff800012763ba0 x29: ffff800012763ba0 x28: ffff00082c653c00 x27: 0000000000000000 x26: ffff000068fa7b00 x25: ffff0000699b2000 x24: ffff00082c6ac000 x23: ffff000834f0a480 x22: ffff000834e87b9c x21: 0000000000000000 x20: ffff000834e87800 x19: ffff000069eddc00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000001 x11: ffff80001180fbe8 x10: 0000000000000001 x9 : ffff800012101558 x8 : 0000000000000001 x7 : 0000000000000006 x6 : ffff000835d9c668 x5 : ffff000834f0a4c8 x4 : 0000000096000000 x3 : 0000000000001810 x2 : 0000000000000000 x1 : ffff800024bd001c x0 : 0000000000000001 Call trace: cdns3_gadget_ep_dequeue+0x1d4/0x270 usb_ep_dequeue+0x34/0xf8 composite_dev_cleanup+0x154/0x170 configfs_composite_unbind+0x6c/0xa8 usb_gadget_remove_driver+0x44/0x70 usb_gadget_unregister_driver+0x74/0xe0 unregister_gadget+0x28/0x58 gadget_dev_desc_UDC_store+0x80/0x110 configfs_write_file+0x1e0/0x2a0 __vfs_write+0x48/0x90 vfs_write+0xe4/0x1c8 ksys_write+0x78/0x100 __arm64_sys_write+0x24/0x30 el0_svc_common.constprop.0+0x74/0x168 el0_svc_handler+0x34/0xa0 el0_svc+0x8/0xc Code: 52830203 b9407660 f94042e4 11000400 (b9400841) ---[ end trace 1574516e4c1772ca ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0002,20002008 Memory Limit: none Rebooting in 5 seconds.. Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation") Cc: stable <stable@vger.kernel.org> Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-05-12MLK-23913-2 usb: cdns3: gadget: assign interrupt number to gadget structurePeter Chen
Assign interrupt number to USB gadget structure. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-04-27MLK-23809-2 usb: cdns3: gadget: delete useless parameter 'is_short'Peter Chen
In cdns3_transfer_completed, it uses is_short to judge if current request is short transfer to calculate req->actual correctly, but is_short variable may for previous transfer, it causes req->actual calculation wrong for current transfer. Eg, the previous transfer is non-short tranfer, and the current one is short transfer, the req->actual will accumulate the non-transfered TRB's length. In fact, below condition already stands for short trasnfer for scatter list: if (priv_req->num_of_trb > 1 && le32_to_cpu(trb->control) & TRB_SMM) So we could (need) to delete the parameter 'is_short' Reviewed-by: Jun Li <jun.li@nxp.com> Reported-by: Faqiang Zhu <faqiang.zhu@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-04-27MLK-23809-1 usb: cdns3: gadget: calculate actual length correctlyPeter Chen
For each request, it needs to clear transfer_end, otherwise, the second transfer's actual transfer length will not report to class driver if the first transfer is short and both the two transfers are handled in the same threaded irq handler. Reviewed-by: Jun Li <jun.li@nxp.com> Reported-by: Faqiang Zhu <faqiang.zhu@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-03-27MLK-23677-1 usb: cdns3: gadget: the initialize value for trb->length should ↵Peter Chen
be zero With commit d2e892c29de0 ("MLK-23595-1 usb: cdns3: gadget: calculate TDL per TD"), the first trb->length assignment is moved before the do-while loop, but only considering DEV_VER_V2 situation, in fact, we need to initialize trb->length for all situations. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-03-19MLK-23595-5 usb: cdns3: gadget: sg_support is only for DEV_VER_V2Peter Chen
The scatter buffer list support earlies for DEV_VER_V2 is not good enough, software can't know short transfer well per transfer. So, we only support sg for DEV_VER_V2. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-03-19MLK-23595-4 usb: cdns3: gadget: calculate short transfer req->actual correctlyPeter Chen
For short transfer, every TRB was finished in TD according to DMA pointer, but the Transfer Length for TRBs which were not handled were not updated, so we can't calculte these TRBs. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-03-19MLK-23595-3 usb: cdns3: gadget: improve the dump TRB at cdns3_ep_run_transferPeter Chen
We need to dump all TRBs for this transfer, but ont only the last one. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-03-19MLK-23595-2 usb: cdns3: gadget: add CHAIN and ISP bit for sg listPeter Chen
For sg buffer list use case, we need to add ISP for each TRB, and add CHAIN bit for each TRB except for the last TRB. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-03-19MLK-23595-1 usb: cdns3: gadget: calculate TDL per TDPeter Chen
TDL is for TD length, so we need to calculate this value per TD, but not for TRB, and the TDL is only needed for the first TRB in TD. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-03-12usb: cdns3: gadget: toggle cycle bit before reset endpointPeter Chen
commit 4bf2dd65135a2d7fe202f7c10d65b51bcf645ac6 upstream. If there are TRBs pending during reset endpoint operation, the DMA will advance after reset operation, but it isn't expected, since the data is not yet available (For OUT, the data is not yet available). After the data is ready, there won't be any interrupt since the EP_TRADDR already points to next TRB entry and doorbell is not set. To fix it, it toggles cycle bit before reset operation, and restores it after reset, it could avoid unexpected DMA advance due to cycle bit is for software during the endpoint reset operation. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Signed-off-by: Peter Chen <peter.chen@nxp.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200219141455.23257-3-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-12usb: cdns3: gadget: link trb should point to next requestPeter Chen
commit 8a7c47fb7285b23ca259c888016513d5566fa9e8 upstream. It has marked the dequeue trb as link trb, but its next segment pointer is still itself, it causes the transfer can't go on. Fix it by set its pointer as the trb address for the next request. Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation") Signed-off-by: Peter Chen <peter.chen@nxp.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200219141455.23257-2-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-28MLK-23349-7 usb: cdns3: don't return -EINVAL if request role is the same ↵Peter Chen
with current role It should not return -EINVAL if the request role is the same with current role, return non-error and without do anything instead. If the user input is neither "host" nor "gadget", return -EINVAL. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-02-28MLK-23349-4 usb: cdns3: ep0: toggle cycle bit before reset endpointPeter Chen
If there are TRBs pending during reset endpoint operation, the DMA will advance after reset operation, but it isn't expected, since the data is not yet available (For OUT, the data is not yet available). After the data is ready, there won't be any interrupt since the EP_TRADDR already points to next TRB entry and doorbell is not set. To fix it, it toggles cycle bit before reset operation, and restores it after reset, itt could avoid unexpected DMA advance later due to TRB content is changed during the reset. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-02-28MLK-23349-3 usb: cdns3: gadget: link trb should point to next requestPeter Chen
It has marked the dequeue trb as link trb, but its next segment pointer is still itself, it causes the transfer can't go on. Fix it by set its pointer as the trb address for the next request. Reviewed-by: Jun Li <jun.li@nxp.com> Fixes: f616c3bda47e ("usb: cdns3: Fix dequeue implementation") Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-02-28usb: cdns3: Fix dequeue implementation.Pawel Laszczak
Dequeuing implementation in cdns3_gadget_ep_dequeue gets first request from deferred_req_list and changed TRB associated with it to LINK TRB. This approach is incorrect because deferred_req_list contains requests that have not been placed on hardware RING. In this case driver should just giveback this request to gadget driver. The patch implements new approach that first checks where dequeuing request is located and only when it's on Transfer Ring then changes TRB associated with it to LINK TRB. During processing completed transfers such LINK TRB will be ignored. Reported-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Pawel Laszczak <pawell@cadence.com> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Reviewed-by: Peter Chen <peter.chen@nxp.com> Link: https://lore.kernel.org/r/1570958420-22196-1-git-send-email-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-20MLK-23181-5 usb: cdns3: gadget: need to handle sg case for ↵Peter Chen
cdns3_descmiss_copy_data Add sg request case for cdns3_descmiss_copy_data. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-01-20MLK-23181-4 usb: cdns3: gadget: enlarge TRB ringPeter Chen
At android ADB use case, we find the TRB ring is prepared very fast, and it reaches empty very soon, enlarge it avoid empty trb ring situation. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-01-20MLK-23181-3 usb: cdns3: gadget: handle multiple trb request properlyPeter Chen
We use polling EP_TRADDR to judge if the trb has finished, so for request which includes multiple trb, we may quit the trb judgement in the middle of request, in that case, we can't giveback the request. We should only giveback the request when all the TRB in this request has finished. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-01-20MLK-23181-2 usb: cdns3: gadget: add one missing condition for ↵Peter Chen
cdns3_request_handled If the dequeue pointer advances to the first trb, but the priv_req->end_trb is the last trb, we consider the trb this dequeue pointer points doesn't belong to this request. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-01-20MLK-23181-1 usb: cdns3: gadget: using num_mapped_sgs for scatter listPeter Chen
For some systems, the iommu or swiotlb is used, the sg list may not the same between before and after DMA map. So we should use num_mapped_sgs for DMA since it is the final DMA mapped sg list for hardware. Reviewed-by: Jun Li <jun.li@nxp.com> Reported-by: Zhang Sanshan <pete.zhang@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2020-01-14usb: cdns3: should not use the same dev_id for shared interrupt handlerPeter Chen
commit af58e1fca9840192f14b6f03c59595d64bff9127 upstream. Both drd and gadget interrupt handler use the struct cdns3 pointer as dev_id, it causes devm_free_irq at cdns3_gadget_exit doesn't free gadget's interrupt handler, it freed drd's handler. So, when the host interrupt occurs, the gadget's interrupt hanlder is still called, and causes below oops. To fix it, we use gadget's private data priv_dev as interrupt dev_id for gadget. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000380 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000971d79000 [0000000000000380] pgd=0000000971d6f003, pud=0000000971d6e003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: mxc_jpeg_encdec crct10dif_ce fsl_imx8_ddr_perf CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-03486-g69f4e7d9c54a-dirty #254 Hardware name: Freescale i.MX8QM MEK (DT) pstate: 00000085 (nzcv daIf -PAN -UAO) pc : cdns3_device_irq_handler+0x1c/0xb8 lr : __handle_irq_event_percpu+0x78/0x2c0 sp : ffff800010003e30 x29: ffff800010003e30 x28: ffff8000129bb000 x27: ffff8000126e9000 x26: ffff0008f61b5600 x25: ffff800011fe1018 x24: ffff8000126ea120 x23: ffff800010003f04 x22: 0000000000000000 x21: 0000000000000093 x20: ffff0008f61b5600 x19: ffff0008f5061a80 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 003d090000000000 x13: 00003d0900000000 x12: 0000000000000000 x11: 00003d0900000000 x10: 0000000000000040 x9 : ffff800012708cb8 x8 : ffff800012708cb0 x7 : ffff0008f7c7a9d0 x6 : 0000000000000000 x5 : ffff0008f7c7a910 x4 : ffff8008ed359000 x3 : ffff800010003f40 x2 : 0000000000000000 x1 : ffff0008f5061a80 x0 : ffff800010161a60 Call trace: cdns3_device_irq_handler+0x1c/0xb8 __handle_irq_event_percpu+0x78/0x2c0 handle_irq_event_percpu+0x40/0x98 handle_irq_event+0x4c/0xd0 handle_fasteoi_irq+0xbc/0x168 generic_handle_irq+0x34/0x50 __handle_domain_irq+0x6c/0xc0 gic_handle_irq+0xd4/0x174 el1_irq+0xb8/0x180 arch_cpu_idle+0x3c/0x230 default_idle_call+0x38/0x40 do_idle+0x20c/0x298 cpu_startup_entry+0x28/0x48 rest_init+0xdc/0xe8 arch_call_rest_init+0x14/0x1c start_kernel+0x48c/0x4b8 Code: aa0103f3 aa1e03e0 d503201f f9409662 (f941c040) ---[ end trace 091dcf4dee011b0e ]--- Kernel panic - not syncing: Fatal exception in interrupt SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0002,2100600c Memory Limit: none ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: <stable@vger.kernel.org> #v5.4 Signed-off-by: Peter Chen <peter.chen@nxp.com> Link: https://lore.kernel.org/r/1577437804-18146-1-git-send-email-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18LF-468-1 usb: cdns3: gadget: handle trb correctly at sg casePeter Chen
At current transfer complete handler, it doesn't consider sg (scatter buffer list) case, and only handles single trb request. In fact, we need to handle every trbs in request, and giveback the request after all trbs are handled. Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-29LF-252 usb: cdns3: gadget: fix the issue for DMA scatter buffer listPeter Chen
If the DMA buffer is sgatter list, current TD organization is wrong. Fix this in this commit. We triggered this issue due to the f_fs begins to use scatter buffer list as data buffer. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-27MLK-22878 usb: cdns3: gadget: add imx8qxp C0 supportPeter Chen
We use controller version to differetiate between B0 (0x00024502) and C0 (0x0002450C). The controller uses TDL check to avoid "NO NAK" issue at B0 if there is not buffer for OUT, this issue is described at "Work around 2" at the begin of gadget.c At default, the TDL value is 0, so it always NAK host's OUT token. When the TD is added, the TDL value is non-zero, it will respond NAK/ACK according to OUT FIFO's situation. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-26MA-15789-1 usb: cdns3: gadget: move USB interrupt handling to thread irqPeter Chen
Since the endpoint interrupt handling is at thread irq, to align with it, move USB interrupt handling to thread irq, otherwise, it may has lock recursion issue. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-25MLK-22527-2 usb: cdns3: quit if the port is woken up during suspendingPeter Chen
If the port receives the resume during the suspending, it needs to quit instead of going on, it could keep controller status correct, and eliminating below timeout warning message. cdns-usb3 5b110000.usb3: wait lpm_clk_req timeout cdns-usb3 5b110000.usb3: wait phy_refclk_req timeout Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-25MLK-22527-1 usb: cdns3: gadget: quit functional halt if there are pending ↵Peter Chen
requests If the non-control endpoints want to halt, but there are pending requests on this endpoint, we need to return -EAGAIN, otherwise, the controller may be in stuck if we stall the doolbell'ed endpoint. With this change, we could pass the USB certification MSC test. Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-25MLK-16735-2 usb: host: add XHCI_CDNS_HOST flagPeter Chen
The NXP Cadence XHCI host has the same issue with Intel's, it is triggered by reboot test, the test case is described at this jira ticket. Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-25MLK-22366-8 usb: cdns3: ep0: check gadget private data pointer before ↵Peter Chen
calling composite_setup At very rare cases, the cdev at compsite driver will be NULL when the interrupt occurs, see below oops. The root cause has not found, to avoid NULL pointer, we could add one checker before calling composite API. libprocessgroup: Successfully killed process cgroup uid 0 pid 10441 in 41ms using random self ethernet address using random host ethernet address init: Service 'adbd' (pid 10441) received signal 9 init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:14) init: Received control message 'start' for 'adbd' from pid: 3215 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx) init: starting service 'adbd'... init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000 read descriptors read strings usb0: HOST MAC 1a:7c:d4:da:d4:57 usb0: MAC 6e:64:d4:2b:a2:01 init: Received control message 'start' for 'adbd' from pid: 3345 (system_server) android_work: did not send uevent (0 0 (null)) read descriptors read strings android_work: sent uevent USB_STATE=CONNECTED configfs-gadget gadget: high-speed config #1: b android_work: sent uevent USB_STATE=CONFIGURED android_work: sent uevent USB_STATE=DISCONNECTED read descriptors read strings android_work: sent uevent USB_STATE=CONNECTED configfs-gadget gadget: high-speed config #1: b android_work: sent uevent USB_STATE=CONFIGURED Unable to handle kernel NULL pointer dereference at virtual address 00000090 android_work: sent uevent USB_STATE=DISCONNECTED Mem abort info: Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgd = ffff80082c136000 [0000000000000090] *pgd=00000008ac177003, *pud=00000008ac178003, *pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: wlan CPU: 3 PID: 2329 Comm: irq/37-5b110000 Tainted: G W 4.14.98-07849-g5336857 #3 Hardware name: Freescale i.MX8QXP MEK (DT) task: ffff80083b3e8000 task.stack: ffff00000b318000 PC is at _raw_spin_lock_irqsave+0x1c/0x50 LR is at android_setup+0x34/0x13c pc : [<ffff000009009d30>] lr : [<ffff000008a03288>] pstate: 800001c5 sp : ffff00000b31bc30 x29: ffff00000b31bc30 x28: ffff80083ae4a6a4 x27: 0000000000000001 x26: 0000000000000140 x25: ffff000008145bc8 x24: ffff8008360ed010 x23: 0000000000000000 x22: 0000000000000090 x21: ffff80083b3e8000 x20: ffff00000a8ee000 x19: fffffffffffffbd8 x18: 0000000000000008 x17: 0000f63c442ded10 x16: ffff000008173bf8 x15: 00006436c9000000 x14: 002756cd00000000 x13: 00e80008a2b0df53 x12: 0000000000000018 x11: 000000082cd330c0 x10: 0000000000000a30 x9 : ffff00000b31bd00 x8 : ffff80083b3e8a90 x7 : 0000000082bdc457 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000001c0 x2 : ffff80083b3e8000 x1 : 0000000000000001 x0 : 0000000000000090 X2: 0xffff80083b3e7f80: 7f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8000 00000020 00000000 ffffffff ffffffff 00000002 00000000 00000000 00000000 8020 0b318000 ffff0000 00000003 00208040 00000000 00000000 00000000 00000000 8040 00000001 00000003 00000006 00000000 00082641 00000001 31296200 ffff8008 8060 00000003 00000001 00000031 00000078 00000031 00000032 09031e38 ffff0000 X8: 0xffff80083b3e8a10: 8a10 00000000 00000000 3ae46f80 ffff8008 00000001 00000000 00000000 00000000 8a30 2ccd0e00 ffff8008 3b3e8000 ffff8008 3b3e8000 ffff8008 09873000 ffff0000 8a50 367af800 ffff8008 00000000 00000000 3b3e8648 ffff8008 09c7e000 ffff0000 8a70 3ff67800 ffff8008 09031d48 ffff0000 0b31bd00 ffff0000 0b31bd00 ffff0000 8a90 080861bc ffff0000 00000000 00000000 00000000 00000000 00000000 00000000 8ab0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8ad0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8af0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 X19: 0xfffffffffffffb58: fb58 ******** ******** ******** ******** ******** ******** ******** ******** fb78 ******** ******** ******** ******** ******** ******** ******** ******** fb98 ******** ******** ******** ******** ******** ******** ******** ******** fbb8 ******** ******** ******** ******** ******** ******** ******** ******** fbd8 ******** ******** ******** ******** ******** ******** ******** ******** fbf8 ******** ******** ******** ******** ******** ******** ******** ******** fc18 ******** ******** ******** ******** ******** ******** ******** ******** fc38 ******** ******** ******** ******** ******** ******** ******** ******** X21: 0xffff80083b3e7f80: 7f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8000 00000020 00000000 ffffffff ffffffff 00000002 00000000 00000000 00000000 8020 0b318000 ffff0000 00000003 00208040 00000000 00000000 00000000 00000000 8040 00000001 00000003 00000006 00000000 00082641 00000001 31296200 ffff8008 8060 00000003 00000001 00000031 00000078 00000031 00000032 09031e38 ffff0000 X24: 0xffff8008360ecf90: cf90 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 cfb0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 cfd0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 cff0 00000000 00000000 00000000 00000000 3ae4c010 ffff8008 3ae4c010 ffff8008 d010 00000000 00000000 360ed018 ffff8008 360ed018 ffff8008 08a067ec ffff0000 d030 36191400 ffff8008 091c3650 ffff0000 3bf5d618 ffff8008 3bf5d730 ffff8008 d050 361a0430 ffff8008 00000000 00000005 00000000 00000000 095d0150 ffff0000 d070 3ae4c010 ffff8008 361a0500 ffff8008 095c9850 ffff0000 36191428 ffff8008 X28: 0xffff80083ae4a624: a624 00000000 00000000 00000025 0000010f 00000000 3ae4a600 ffff8008 09d8fad0 a644 ffff0000 3a088000 ffff8008 3ab11780 ffff8008 00000000 00000000 09886bb0 a664 ffff0000 081486a4 ffff0000 3ae46a80 ffff8008 00000000 00000000 00000000 a684 00000000 00011a91 00000000 00082641 00000001 00000001 0000f49b 8000f49b a6a4 352b352b 00000000 00000000 00000000 00000000 00000000 00000000 00000000 a6c4 00000000 00000000 00000000 00000001 00000000 f2def2de 00000000 3ae4a6e0 a6e4 ffff8008 3ae4a6e0 ffff8008 00000001 00000000 00000000 00000000 361a0700 a704 ffff8008 00000000 00000000 00000000 00000000 3ab11400 ffff8008 3ae4a720 Process irq/37-5b110000 (pid: 2329, stack limit = 0xffff00000b318000) Call trace: Exception stack(0xffff00000b31baf0 to 0xffff00000b31bc30) bae0: 0000000000000090 0000000000000001 bb00: ffff80083b3e8000 00000000000001c0 0000000000000000 0000000000000000 bb20: 0000000000000001 0000000082bdc457 ffff80083b3e8a90 ffff00000b31bd00 bb40: 0000000000000a30 000000082cd330c0 0000000000000018 00e80008a2b0df53 bb60: 002756cd00000000 00006436c9000000 ffff000008173bf8 0000f63c442ded10 bb80: 0000000000000008 fffffffffffffbd8 ffff00000a8ee000 ffff80083b3e8000 bba0: 0000000000000090 0000000000000000 ffff8008360ed010 ffff000008145bc8 bbc0: 0000000000000140 0000000000000001 ffff80083ae4a6a4 ffff00000b31bc30 bbe0: ffff000008a03288 ffff00000b31bc30 ffff000009009d30 00000000800001c5 bc00: ffff80083b3e8648 ffff000009c7e000 ffffffffffffffff ffff80083b3e8000 bc20: ffff00000b31bc30 ffff000009009d30 [<ffff000009009d30>] _raw_spin_lock_irqsave+0x1c/0x50 [<ffff0000089bd9b0>] cdns3_ep0_delegate_req+0x4c/0x80 [<ffff0000089be004>] cdns3_check_ep0_interrupt_proceed+0x33c/0x654 [<ffff0000089bca44>] cdns3_device_thread_irq_handler+0x4b0/0x4bc [<ffff0000089b77b4>] cdns3_thread_irq+0x48/0x68 [<ffff000008145bf0>] irq_thread_fn+0x28/0x88 [<ffff000008145e38>] irq_thread+0x13c/0x228 [<ffff0000080fed70>] kthread+0x104/0x130 [<ffff000008085064>] ret_from_fork+0x10/0x18 Code: b9401041 11000421 b9001041 f9800011 (885ffc01) ---[ end trace 497c9866542e50ab ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0802008 Memory Limit: none Rebooting in 5 seconds.. Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-25MLK-22366-7 usb: cdns3: gadget: quit if endpoint has already disabledPeter Chen
It fixed below oops: audit: audit_lost=500851 audit_rate_limit=5 audit_backlog_limit=64 audit: rate limit exceeded libprocessgroup: Successfully killed process cgroup uid 0 pid 25371 in 49ms init: Service 'adbd' (pid 25371) received signal 9 init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:14) init: Received control message 'start' for 'adbd' from pid: 3308 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx) init: starting service 'adbd'... init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000 read descriptors read strings init: Received control message 'start' for 'adbd' from pid: 3447 (system_server) android_work: did not send uevent (0 0 (null)) audit: audit_lost=500888 audit_rate_limit=5 audit_backlog_limit=64 audit: rate limit exceeded read descriptors read strings android_work: did not send uevent (0 0 (null)) audit: audit_lost=500925 audit_rate_limit=5 audit_backlog_limit=64 audit: rate limit exceeded using random self ethernet address using random host ethernet address read descriptors read strings usb0: HOST MAC 32:e7:67:29:5f:d8 usb0: MAC 02:5c:48:b3:2b:d7 android_work: sent uevent USB_STATE=CONNECTED configfs-gadget gadget: high-speed config #1: b android_work: sent uevent USB_STATE=CONFIGURED Unable to handle kernel NULL pointer dereference at virtual address 00000002 Mem abort info: Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgd = ffff8008f7bed000 [0000000000000002] *pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 3326 Comm: Binder:3276_2 Not tainted 4.14.98-07848-gfb2a5a8 #1 Hardware name: Freescale i.MX8QM MEK (DT) task: ffff8008f77f3800 task.stack: ffff00000b378000 PC is at __cdns3_gadget_ep_queue.isra.18+0x238/0x524 LR is at cdns3_gadget_ep_queue+0x44/0xd8 pc : [<ffff0000089bbf90>] lr : [<ffff0000089bc2c0>] pstate: 400001c5 sp : ffff00000b37ba40 x29: ffff00000b37ba40 x28: ffff8008f235fa00 x27: ffff8008f2f11600 x26: ffff8008f2dee118 x25: ffff8008f2df0000 x24: 0000000000000000 x23: ffff000009c8e000 x22: ffff8008f2df0000 x21: 0000000000000000 x20: ffff8008f2dee118 x19: ffff8008f1f1ac00 x18: 0000fcc72810fc1a x17: 0000fcc729e2d0e0 x16: ffff0000082b4430 x15: 0000000000000000 x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000020 x11: 0000000000000020 x10: 0101010101010101 x9 : 0000000000000000 x8 : 0000000000000024 x7 : 0000000040000000 x6 : 0000000000000020 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000140 x2 : 0000000000000000 x1 : ffff8008f1f1ac00 x0 : ffff8008f7738010 X0: 0xffff8008f7737f90: 7f90 f75baef8 ffff8008 00000000 00000000 3305708c 00000000 f7332aa0 ffff8008 7fb0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fd0 00005408 00000001 a1ff0014 00000000 00000000 00000000 00000000 00000000 7ff0 00000000 00000000 00000000 00000000 f7548780 ffff8008 ffffffff 00000000 8010 09dc50d8 ffff0000 f76fc800 ffff8008 f7548780 ffff8008 f7738428 ffff8008 8030 f76e7c28 ffff8008 09dc50e8 ffff0000 f6e6ae80 ffff8008 09dc4ac8 ffff0000 8050 f753e660 ffff8008 00000007 00000007 00000000 00000000 00000000 00000000 8070 00000000 00000000 00000000 00000000 f7738080 ffff8008 f7738080 ffff8008 X1: 0xffff8008f1f1ab80: ab80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 aba0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 abc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 abe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ac00 ec128080 ffff8008 0000062a 00000000 f5383800 00000000 00000000 00000000 ac20 00000000 00000000 00000000 00000000 08a179d8 ffff0000 e85aeb00 ffff8008 ac40 f1f1ac40 ffff8008 f1f1ac40 ffff8008 ffffff8d 00000000 f2dee118 ffff8008 ac60 0afdb024 ffff0000 00000003 00000003 00000000 00000000 00000000 00000000 X19: 0xffff8008f1f1ab80: ab80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 aba0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 abc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 abe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 ac00 ec128080 ffff8008 0000062a 00000000 f5383800 00000000 00000000 00000000 ac20 00000000 00000000 00000000 00000000 08a179d8 ffff0000 e85aeb00 ffff8008 ac40 f1f1ac40 ffff8008 f1f1ac40 ffff8008 ffffff8d 00000000 f2dee118 ffff8008 ac60 0afdb024 ffff0000 00000003 00000003 00000000 00000000 00000000 00000000 X20: 0xffff8008f2dee098: e098 ae000000 00000000 f2df0000 ffff8008 00307065 00000000 00000000 00000000 e0b8 00000000 00000010 00000000 00000000 00000080 00000000 00000002 00000000 e0d8 00000000 00000000 00000002 00000000 00000000 00000000 00000000 00000000 e0f8 00000000 00000000 f2dee200 ffff8008 f2dee000 ffff8008 087793a4 ffff0000 e118 f0475900 ffff8008 f2dee1a8 ffff8008 091c36b0 ffff0000 f2dee230 ffff8008 e138 f2df0048 ffff8008 0000002e 02000000 000f0400 00000101 00000000 00000000 e158 00000000 00000000 f2dee160 ffff8008 f2dee160 ffff8008 f2dee170 ffff8008 e178 f2dee170 ffff8008 f2dee180 ffff8008 f2dee180 ffff8008 0afdb000 ffff0000 X22: 0xffff8008f2deff80: ff80 f33b40a0 ffff8008 f3dd6810 ffff8008 f03f8de8 ffff8008 00000000 00000000 ffa0 27ac430e 00000000 00000000 00000000 f2aec128 ffff8008 f32e0680 ffff8008 ffc0 00000000 00000000 f3623400 ffff8008 000000ac 00000001 41e80011 00000000 ffe0 f3b18000 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000 0000 f7738010 ffff8008 f7738010 ffff8008 000000c0 00000000 f2df0018 ffff8008 0020 f2df0018 ffff8008 08a077e4 ffff0000 f2d42c00 ffff8008 091c3650 ffff0000 0040 f2dee018 ffff8008 f2dee130 ffff8008 f2deee30 ffff8008 00000003 00000005 0060 00000007 00000000 095d1550 ffff0000 f7738010 ffff8008 f2deef00 ffff8008 X25: 0xffff8008f2deff80: ff80 f33b40a0 ffff8008 f3dd6810 ffff8008 f03f8de8 ffff8008 00000000 00000000 ffa0 27ac430e 00000000 00000000 00000000 f2aec128 ffff8008 f32e0680 ffff8008 ffc0 00000000 00000000 f3623400 ffff8008 000000ac 00000001 41e80011 00000000 ffe0 f3b18000 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000 0000 f7738010 ffff8008 f7738010 ffff8008 000000c0 00000000 f2df0018 ffff8008 0020 f2df0018 ffff8008 08a077e4 ffff0000 f2d42c00 ffff8008 091c3650 ffff0000 0040 f2dee018 ffff8008 f2dee130 ffff8008 f2deee30 ffff8008 00000003 00000005 0060 00000007 00000000 095d1550 ffff0000 f7738010 ffff8008 f2deef00 ffff8008 X26: 0xffff8008f2dee098: e098 ae000000 00000000 f2df0000 ffff8008 00307065 00000000 00000000 00000000 e0b8 00000000 00000010 00000000 00000000 00000080 00000000 00000002 00000000 e0d8 00000000 00000000 00000002 00000000 00000000 00000000 00000000 00000000 e0f8 00000000 00000000 f2dee200 ffff8008 f2dee000 ffff8008 087793a4 ffff0000 e118 f0475900 ffff8008 f2dee1a8 ffff8008 091c36b0 ffff0000 f2dee230 ffff8008 e138 f2df0048 ffff8008 0000002e 02000000 000f0400 00000101 00000000 00000000 e158 00000000 00000000 f2dee160 ffff8008 f2dee160 ffff8008 f2dee170 ffff8008 e178 f2dee170 ffff8008 f2dee180 ffff8008 f2dee180 ffff8008 0afdb000 ffff0000 X27: 0xffff8008f2f11580: 1580 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 15a0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 15c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 15e0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1600 f0475000 ffff8008 00000003 00000000 f235fa00 ffff8008 00000000 00000000 1620 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1640 00000000 00000000 00000000 00000000 00000002 00000000 00000000 00000000 1660 00000000 00000000 00000000 00000000 08e3b158 ffff0000 f2f11600 ffff8008 X28: 0xffff8008f235f980: f980 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 f9a0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 f9c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 f9e0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 fa00 00000000 00000000 09f6e3d8 ffff0000 00000000 00000000 f2f11600 ffff8008 fa20 00000000 00000000 00000000 00000000 812aa8c0 812aa8c0 00ffffff ff2aa8c0 fa40 00001800 00000080 30627375 00000000 00000000 00000000 00000000 00000000 fa60 0046ac7c 00000001 0046ac7c 00000001 00000000 00000000 00000000 00000000 Process Binder:3276_2 (pid: 3326, stack limit = 0xffff00000b378000) Call trace: Exception stack(0xffff00000b37b900 to 0xffff00000b37ba40) b900: ffff8008f7738010 ffff8008f1f1ac00 0000000000000000 0000000000000140 b920: 0000000000000000 0000000000000000 0000000000000020 0000000040000000 b940: 0000000000000024 0000000000000000 0101010101010101 0000000000000020 b960: 0000000000000020 0000000000000000 ffffffffffffffff 0000000000000000 b980: ffff0000082b4430 0000fcc729e2d0e0 0000fcc72810fc1a ffff8008f1f1ac00 b9a0: ffff8008f2dee118 0000000000000000 ffff8008f2df0000 ffff000009c8e000 b9c0: 0000000000000000 ffff8008f2df0000 ffff8008f2dee118 ffff8008f2f11600 b9e0: ffff8008f235fa00 ffff00000b37ba40 ffff0000089bc2c0 ffff00000b37ba40 ba00: ffff0000089bbf90 00000000400001c5 ffff00000b37ba20 ffff00000827c354 ba20: 0000ffffffffffff ffff000008d578c4 ffff00000b37ba40 ffff0000089bbf90 [<ffff0000089bbf90>] __cdns3_gadget_ep_queue.isra.18+0x238/0x524 [<ffff0000089bc2c0>] cdns3_gadget_ep_queue+0x44/0xd8 [<ffff000008a06f70>] usb_ep_queue+0x5c/0xfc [<ffff000008a1762c>] rx_submit+0xec/0x1bc [<ffff000008a1775c>] rx_fill+0x60/0xb4 [<ffff000008a17c7c>] eth_open+0x64/0x78 [<ffff000008d72cf4>] __dev_open+0xe0/0x164 [<ffff000008d73128>] __dev_change_flags+0x160/0x18c [<ffff000008d73174>] dev_change_flags+0x20/0x5c [<ffff000008e359f0>] devinet_ioctl+0x68c/0x724 [<ffff000008e37cc4>] inet_ioctl+0x8c/0xa8 [<ffff000008d48a48>] sock_do_ioctl+0x34/0x70 [<ffff000008d49da0>] sock_ioctl+0x21c/0x320 [<ffff0000082b3b98>] do_vfs_ioctl+0xbc/0x954 [<ffff0000082b44b4>] SyS_ioctl+0x84/0x98 Exception stack(0xffff00000b37bec0 to 0xffff00000b37c000) bec0: 000000000000003d 0000000000008914 0000fcc728110840 0000000000000003 bee0: 0000fcc728110850 6f43ffffffffffff 0000000000000000 0000000000800000 bf00: 000000000000001d 0000fcc7281107f8 0000fcc7281107f8 0000fcc728110840 bf20: 0000fcc728110458 0000000000000028 ffffffffffffffff 00002d18ec000000 bf40: 0000fcc72962af68 0000fcc729e2d0e0 0000fcc72810fc1a 0000fcc728111588 bf60: 0000fcc72962b000 0000ab36f6e99ac5 0000ab36f6e99a8e 0000000000000008 bf80: 0000ab36f6e99ac8 0000fcc728111588 0000ab36f6e99c0e 0000000000000006 bfa0: 0000fcc72902b108 0000fcc728110830 0000fcc729e2d16c 0000fcc728110740 bfc0: 0000fcc729e73758 00000000a0000000 000000000000003d 000000000000001d bfe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [<ffff000008083ac0>] el0_svc_naked+0x34/0x38 Code: d503201f f9401e82 aa1303e1 f94006c0 (39c00842) ---[ end trace f7b45310362d53ac ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs SMP: failed to stop secondary CPUs 0,2,4 Kernel Offset: disabled CPU features: 0x180200c Memory Limit: none Rebooting in 5 seconds.. SMP: stopping secondary CPUs SMP: failed to stop secondary CPUs 0,2,4 Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-25MLK-22366-6 usb: cdns3: gadget: do not call disconnect if it is not configuredPeter Chen
Fix below oops: init: Received control message 'start' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx) init: starting service 'adbd'... init: Created socket '/dev/socket/adbd', mode 660, user 1000, group 1000 read descriptors read strings android_work: did not send uevent (0 0 (null)) android_work: sent uevent USB_STATE=CONNECTED android_work: sent uevent USB_STATE=DISCONNECTED configfs-gadget gadget: high-speed config #1: b android_work: sent uevent USB_STATE=CONNECTED android_work: sent uevent USB_STATE=CONFIGURED init: Received control message 'start' for 'adbd' from pid: 3499 (system_server) init: Received control message 'stop' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx) android_work: sent uevent USB_STATE=DISCONNECTED audit: audit_lost=179935 audit_rate_limit=5 audit_backlog_limit=64 audit: rate limit exceeded read descriptors read strings android_work: did not send uevent (0 0 (null)) audit: audit_lost=179970 audit_rate_limit=5 audit_backlog_limit=64 audit: rate limit exceeded using random self ethernet address using random host ethernet address read descriptors read strings usb0: HOST MAC f2:80:c5:eb:a1:fd usb0: MAC 92:da:4f:13:01:73 android_work: did not send uevent (0 0 (null)) audit: audit_lost=180005 audit_rate_limit=5 audit_backlog_limit=64 audit: rate limit exceeded read descriptors read strings android_work: did not send uevent (0 0 (null)) android_work: sent uevent USB_STATE=CONNECTED android_work: sent uevent USB_STATE=DISCONNECTED init: Received control message 'start' for 'adbd' from pid: 3499 (system_server) composite_disconnect: Calling disconnect on a Gadget that is not connected android_work: did not send uevent (0 0 (null)) init: Received control message 'stop' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx) init: Sending signal 9 to service 'adbd' (pid 22343) process group... ------------[ cut here ]------------ audit: audit_lost=180038 audit_rate_limit=5 audit_backlog_limit=64 audit: rate limit exceeded WARNING: CPU: 0 PID: 3468 at /home/tianyang/maddev_pie9.0/vendor/nxp-opensource/kernel_imx/drivers/usb/gadget/composite.c:2009 composite_disconnect+0x80/0x88 Modules linked in: CPU: 0 PID: 3468 Comm: HWC-UEvent-Thre Not tainted 4.14.98-07846-g0b40a9b-dirty #16 Hardware name: Freescale i.MX8QM MEK (DT) task: ffff8008f2349c00 task.stack: ffff00000b0a8000 PC is at composite_disconnect+0x80/0x88 LR is at composite_disconnect+0x80/0x88 pc : [<ffff0000089ff9b0>] lr : [<ffff0000089ff9b0>] pstate: 600001c5 sp : ffff000008003dd0 x29: ffff000008003dd0 x28: ffff8008f2349c00 x27: ffff000009885018 x26: ffff000008004000 Timeout for IPC response! x25: ffff000009885018 x24: ffff000009c8e280 x23: ffff8008f2d98010 x22: 00000000000001c0 x21: ffff8008f2d98394 x20: ffff8008f2d98010 x19: 0000000000000000 x18: 0000e3956f4f075a fxos8700 4-001e: i2c block read acc failed x17: 0000e395735727e8 x16: ffff00000829f4d4 x15: ffffffffffffffff x14: 7463656e6e6f6320 x13: 746f6e2009090920 x12: 7369207461687420 x11: 7465676461472061 x10: 206e6f207463656e x9 : 6e6f637369642067 x8 : ffff000009c8e280 x7 : ffff0000086ca6cc x6 : ffff000009f15e78 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffffffffffffffff x2 : c3f28b86000c3900 x1 : c3f28b86000c3900 x0 : 000000000000004e X20: 0xffff8008f2d97f90: 7f90 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fb0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 libprocessgroup: Failed to kill process cgroup uid 0 pid 22343 in 215ms, 1 processes remain 7fd0 Timeout for IPC response! 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 using random self ethernet address 7ff0 00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008 8010 00000100 00000000 f2d98018 ffff8008 f2d98018 ffff8008 08a067dc using random host ethernet address ffff0000 8030 f206d800 ffff8008 091c3650 ffff0000 f7957b18 ffff8008 f7957730 ffff8008 8050 f716a630 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000 8070 f76c8010 ffff8008 f716a800 ffff8008 095cac68 ffff0000 f206d828 ffff8008 X21: 0xffff8008f2d98314: 8314 ffff8008 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8334 00000000 00000000 00000000 00000000 00000000 08a04cf4 ffff0000 00000000 8354 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8374 00000000 00000000 00000000 00001001 00000000 00000000 00000000 00000000 8394 e4bbe4bb 0f230000 ffff0000 0afae000 ffff0000 ae001000 00000000 f206d400 Timeout for IPC response! 83b4 ffff8008 00000000 00000000 f7957b18 ffff8008 f7957718 ffff8008 f7957018 83d4 ffff8008 f7957118 ffff8008 f7957618 ffff8008 f7957818 ffff8008 f7957918 83f4 ffff8008 f7957d18 ffff8008 00000000 00000000 00000000 00000000 00000000 X23: 0xffff8008f2d97f90: 7f90 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fb0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7fd0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 7ff0 00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008 8010 00000100 00000000 f2d98018 ffff8008 f2d98018 ffff8008 08a067dc ffff0000 8030 f206d800 ffff8008 091c3650 ffff0000 f7957b18 ffff8008 f7957730 ffff8008 8050 f716a630 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000 8070 f76c8010 ffff8008 f716a800 ffff8008 095cac68 ffff0000 f206d828 ffff8008 X28: 0xffff8008f2349b80: 9b80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9ba0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9bc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9be0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9c00 00000022 00000000 ffffffff ffffffff 00010001 00000000 00000000 00000000 9c20 0b0a8000 ffff0000 00000002 00404040 00000000 00000000 00000000 00000000 9c40 00000001 00000000 00000001 00000000 001ebd44 00000001 f390b800 ffff8008 9c60 00000000 00000001 00000070 00000070 00000070 00000000 09031d48 ffff0000 Call trace: Exception stack(0xffff000008003c90 to 0xffff000008003dd0) 3c80: 000000000000004e c3f28b86000c3900 3ca0: c3f28b86000c3900 ffffffffffffffff 0000000000000000 0000000000000000 3cc0: ffff000009f15e78 ffff0000086ca6cc ffff000009c8e280 6e6f637369642067 3ce0: 206e6f207463656e 7465676461472061 7369207461687420 746f6e2009090920 3d00: 7463656e6e6f6320 ffffffffffffffff ffff00000829f4d4 0000e395735727e8 3d20: 0000e3956f4f075a 0000000000000000 ffff8008f2d98010 ffff8008f2d98394 3d40: 00000000000001c0 ffff8008f2d98010 ffff000009c8e280 ffff000009885018 3d60: ffff000008004000 ffff000009885018 ffff8008f2349c00 ffff000008003dd0 3d80: ffff0000089ff9b0 ffff000008003dd0 ffff0000089ff9b0 00000000600001c5 3da0: ffff8008f33f2cd8 0000000000000000 0000ffffffffffff 0000000000000000 init: Received control message 'start' for 'adbd' from pid: 3359 (/vendor/bin/hw/android.hardware.usb@1.1-service.imx) 3dc0: ffff000008003dd0 ffff0000089ff9b0 [<ffff0000089ff9b0>] composite_disconnect+0x80/0x88 [<ffff000008a044d4>] android_disconnect+0x3c/0x68 [<ffff0000089ba9f8>] cdns3_device_irq_handler+0xfc/0x2c8 [<ffff0000089b84c0>] cdns3_irq+0x44/0x94 [<ffff00000814494c>] __handle_irq_event_percpu+0x60/0x24c [<ffff000008144c0c>] handle_irq_event+0x58/0xc0 [<ffff00000814873c>] handle_fasteoi_irq+0x98/0x180 [<ffff000008143a10>] generic_handle_irq+0x24/0x38 [<ffff000008144170>] __handle_domain_irq+0x60/0xac [<ffff0000080819c4>] gic_handle_irq+0xd4/0x17c Exception stack(0xffff00000b0ab950 to 0xffff00000b0aba90) Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-25MLK-22366-5 usb: cdns3: ep0: check NULL pointer before calling composite_setupPeter Chen
Fix below oops at stress USB switch test at android: read strings audit: rate limit exceeded android_work: did not send uevent (0 0 (null)) android_work: did not send uevent (0 0 (null)) android_work: sent uevent USB_STATE=CONNECTED configfs-gadget gadget: super-speed config #1: b android_work: sent uevent USB_STATE=CONFIGURED init: Received control message 'start' for 'adbd' from pid: 3515 (system_server) Unable to handle kernel NULL pointer dereference at virtual address 0000002a init: Received control message 'stop' for 'adbd' from pid: 3375 (/vendor/bin/hw/android.hardware.usb@1.1-servic) Mem abort info: Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgd = ffff8008f1b7f000 [000000000000002a] *pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 4 PID: 2457 Comm: irq/125-5b11000 Not tainted 4.14.98-07846-g0b40a9b-dirty #16 Hardware name: Freescale i.MX8QM MEK (DT) task: ffff8008f2a98000 task.stack: ffff00000b7b8000 PC is at composite_setup+0x44/0x1508 LR is at android_setup+0xb8/0x13c pc : [<ffff0000089ffb3c>] lr : [<ffff000008a032fc>] pstate: 800001c5 sp : ffff00000b7bbb80 x29: ffff00000b7bbb80 x28: ffff8008f2a3c010 x27: 0000000000000001 x26: 0000000000000000 [1232/1897] audit: audit_lost=25791 audit_rate_limit=5 audit_backlog_limit=64 x25: 00000000ffffffa1 x24: ffff8008f2a3c010 audit: rate limit exceeded x23: 0000000000000409 x22: ffff000009c8e000 x21: ffff8008f7a8b428 x20: ffff00000afae000 x19: ffff0000089ff000 x18: 0000000000000000 x17: 0000000000000000 x16: ffff0000082b7c9c x15: 0000000000000000 x14: f1866f5b952aca46 x13: e35502e30d44349c x12: 0000000000000008 x11: 0000000000000008 x10: 0000000000000a30 x9 : ffff00000b7bbd00 x8 : ffff8008f2a98a90 x7 : ffff8008f27a9c90 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : ffff0000089ff8d0 x0 : 732a010310b9ed00 X7: 0xffff8008f27a9c10: 9c10 00000002 00000000 00000001 00000000 13110000 ffff0000 00000002 00208040 9c30 00000000 00000000 00000000 00000000 00000000 00000005 00000029 00000000 9c50 00051778 00000001 f27a8e00 ffff8008 00000005 00000000 00000078 00000078 9c70 00000078 00000000 09031d48 ffff0000 00100000 00000000 00400000 00000000 9c90 00000001 00000000 00000000 00000000 00000000 00000000 ffefb1a0 ffff8008 9cb0 f27a9ca8 ffff8008 00000000 00000000 b9d88037 00000173 1618a3eb 00000001 9cd0 870a792a 0000002e 16188fe6 00000001 0000242b 00000000 00000000 00000000 using random self ethernet address 9cf0 019a4646 00000000 000547f3 00000000 ecfd6c33 00000002 00000000 using random host ethernet address 00000000 X8: 0xffff8008f2a98a10: 8a10 00000000 00000000 f7788d00 ffff8008 00000001 00000000 00000000 00000000 8a30 eb218000 ffff8008 f2a98000 ffff8008 f2a98000 ffff8008 09885000 ffff0000 8a50 f34df480 ffff8008 00000000 00000000 f2a98648 ffff8008 09c8e000 ffff0000 8a70 fff2c800 ffff8008 09031d48 ffff0000 0b7bbd00 ffff0000 0b7bbd00 ffff0000 8a90 080861bc ffff0000 00000000 00000000 00000000 00000000 00000000 00000000 8ab0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8ad0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 8af0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 X21: 0xffff8008f7a8b3a8: b3a8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 b3c8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 b3e8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 b408 00000000 00000000 00000000 00000000 00000000 00000000 00000001 00000000 b428 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 b448 0053004d 00540046 00300031 00010030 eb07b520 ffff8008 20011201 00000003 b468 e418d109 0104404e 00010302 00000000 eb07b558 ffff8008 eb07b558 ffff8008 b488 f7a8b488 ffff8008 f7a8b488 ffff8008 f7a8b300 ffff8008 00000000 00000000 X24: 0xffff8008f2a3bf90: bf90 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfb0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfd0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bff0 00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008 c010 00000000 00000000 f2a3c018 ffff8008 f2a3c018 ffff8008 08a067dc ffff0000 c030 f2a5a000 ffff8008 091c3650 ffff0000 f716fd18 ffff8008 f716fe30 ffff8008 c050 f2ce4a30 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000 c070 f76c8010 ffff8008 f2ce4b00 ffff8008 095cac68 ffff0000 f2a5a028 ffff8008 X28: 0xffff8008f2a3bf90: bf90 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfb0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfd0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bff0 00000000 00000000 00000000 00000000 f76c8010 ffff8008 f76c8010 ffff8008 c010 00000000 00000000 f2a3c018 ffff8008 f2a3c018 ffff8008 08a067dc ffff0000 c030 f2a5a000 ffff8008 091c3650 ffff0000 f716fd18 ffff8008 f716fe30 ffff8008 c050 f2ce4a30 ffff8008 00000000 00000005 00000000 00000000 095d1568 ffff0000 c070 f76c8010 ffff8008 f2ce4b00 ffff8008 095cac68 ffff0000 f2a5a028 ffff8008 Process irq/125-5b11000 (pid: 2457, stack limit = 0xffff00000b7b8000) Call trace: Exception stack(0xffff00000b7bba40 to 0xffff00000b7bbb80) ba40: 732a010310b9ed00 ffff0000089ff8d0 0000000000000006 0000000000000000 ba60: 0000000000000001 0000000000000000 0000000000000001 ffff8008f27a9c90 ba80: ffff8008f2a98a90 ffff00000b7bbd00 0000000000000a30 0000000000000008 baa0: 0000000000000008 e35502e30d44349c f1866f5b952aca46 0000000000000000 bac0: ffff0000082b7c9c 0000000000000000 0000000000000000 ffff0000089ff000 bae0: ffff00000afae000 ffff8008f7a8b428 ffff000009c8e000 0000000000000409 bb00: ffff8008f2a3c010 00000000ffffffa1 0000000000000000 0000000000000001 bb20: ffff8008f2a3c010 ffff00000b7bbb80 ffff000008a032fc ffff00000b7bbb80 bb40: ffff0000089ffb3c 00000000800001c5 ffff00000b7bbb80 732a010310b9ed00 bb60: ffffffffffffffff ffff0000080f777c ffff00000b7bbb80 ffff0000089ffb3c [<ffff0000089ffb3c>] composite_setup+0x44/0x1508 [<ffff000008a032fc>] android_setup+0xb8/0x13c [<ffff0000089bd9a8>] cdns3_ep0_delegate_req+0x44/0x70 [<ffff0000089bdff4>] cdns3_check_ep0_interrupt_proceed+0x33c/0x654 [<ffff0000089bca44>] cdns3_device_thread_irq_handler+0x4b0/0x4bc [<ffff0000089b77b4>] cdns3_thread_irq+0x48/0x68 [<ffff000008145bf0>] irq_thread_fn+0x28/0x88 [<ffff000008145e38>] irq_thread+0x13c/0x228 [<ffff0000080fed70>] kthread+0x104/0x130 [<ffff000008085064>] ret_from_fork+0x10/0x18 Code: 91234261 f94006ba f90057a0 79400a97 (3940ab40) ---[ end trace e8f0a7c675a161ca ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x180200c Memory Limit: none Rebooting in 5 seconds.. Signed-off-by: Peter Chen <peter.chen@nxp.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-06-13 12:42:52 +0000