linux.git/drivers/usb/dwc2, branch v4.18

usb: dwc2: Fix inefficient copy of unaligned buffers

2018-07-17T07:12:52+00:00

Make sure only to copy any actual data rather than the whole buffer,
when releasing the temporary buffer used for unaligned non-isochronous
transfers.

Taken directly from commit 0efd937e27d5e ("USB: ehci-tegra: fix inefficient
copy of unaligned buffers")

Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM)

Reviewed-by: Douglas Anderson 
Signed-off-by: Antti Seppälä 
Signed-off-by: Felipe Balbi

usb: dwc2: Fix DMA alignment to start at allocated boundary

2018-07-17T07:12:52+00:00

The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more
supported way") introduced a common way to align DMA allocations.
The code in the commit aligns the struct dma_aligned_buffer but the
actual DMA address pointed by data[0] gets aligned to an offset from
the allocated boundary by the kmalloc_ptr and the old_xfer_buffer
pointers.

This is against the recommendation in Documentation/DMA-API.txt which
states:

  Therefore, it is recommended that driver writers who don't take
  special care to determine the cache line size at run time only map
  virtual regions that begin and end on page boundaries (which are
  guaranteed also to be cache line boundaries).

The effect of this is that architectures with non-coherent DMA caches
may run into memory corruption or kernel crashes with Unhandled
kernel unaligned accesses exceptions.

Fix the alignment by positioning the DMA area in front of the allocation
and use memory at the end of the area for storing the orginal
transfer_buffer pointer. This may have the added benefit of increased
performance as the DMA area is now fully aligned on all architectures.

Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM).

Fixes: 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more supported way")
Cc: 
Reviewed-by: Douglas Anderson 
Signed-off-by: Antti Seppälä 
Signed-off-by: Felipe Balbi

usb: dwc2: avoid NULL dereferences

2018-07-17T07:12:51+00:00

For unidirectional endpoints, the endpoint pointer will be NULL for the
unused direction.  Check that the endpoint is active before
dereferencing this pointer.

Fixes: 1b4977c793d3 ("usb: dwc2: Update dwc2_handle_incomplete_isoc_in() function")
Fixes: 689efb2619b5 ("usb: dwc2: Update dwc2_handle_incomplete_isoc_out() function")
Fixes: d84845522d93 ("usb: dwc2: Update GINTSTS_GOUTNAKEFF interrupt handling")
Signed-off-by: John Keeping 
Signed-off-by: Felipe Balbi

usb: dwc2: host: do not delay retries for CONTROL IN transfers

2018-07-17T07:12:51+00:00

When handling split transactions we will try to delay retry after
getting a NAK from the device. This works well for BULK transfers that
can be polled for essentially forever. Unfortunately, on slower systems
at boot time, when the kernel is busy enumerating all the devices (USB
or not), we issue a bunch of control requests (reading device
descriptors, etc). If we get a NAK for the IN part of the control
request and delay retry for too long (because the system is busy), we
may confuse the device when we finally get to reissue SSPLIT/CSPLIT IN
and the device will respond with STALL. As a result we end up with
failure to get device descriptor and will fail to enumerate the device:

[    3.428801] usb 2-1.2.1: new full-speed USB device number 9 using dwc2
[    3.508576] usb 2-1.2.1: device descriptor read/8, error -32
[    3.699150] usb 2-1.2.1: device descriptor read/8, error -32
[    3.891653] usb 2-1.2.1: new full-speed USB device number 10 using dwc2
[    3.968859] usb 2-1.2.1: device descriptor read/8, error -32
...

Let's not delay retries of split CONTROL IN transfers, as this allows us
to reliably enumerate devices at boot time.

Fixes: 38d2b5fb75c1 ("usb: dwc2: host: Don't retry NAKed transactions right away")
Reviewed-by: Douglas Anderson 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Felipe Balbi

dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation

2018-06-19T09:48:14+00:00

PID bitfield in descriptor should be set based on particular request
length, not based on EP's mc value. PID value can't be set to 0 even
request length is 0.

Signed-off-by: Minas Harutyunyan 
Signed-off-by: Felipe Balbi

usb: gadget: dwc2: fix memory leak in gadget_init()

2018-06-19T09:48:14+00:00

Freed allocated request for ep0 to prevent memory leak in case when
dwc2_driver_probe() failed.

Cc: Stefan Wahren 
Cc: Marek Szyprowski 
Tested-by: Stefan Wahren 
Tested-by: Marek Szyprowski 
Acked-by: Minas Harutyunyan 
Signed-off-by: Grigor Tovmasyan 
Signed-off-by: Felipe Balbi

usb: dwc2: fix isoc split in transfer with no data

2018-06-19T09:48:13+00:00

If isoc split in transfer with no data (the length of DATA0
packet is zero), we can't simply return immediately. Because
the DATA0 can be the first transaction or the second transaction
for the isoc split in transaction. If the DATA0 packet with no
data is in the first transaction, we can return immediately.
But if the DATA0 packet with no data is in the second transaction
of isoc split in transaction sequence, we need to increase the
qtd->isoc_frame_index and giveback urb to device driver if needed,
otherwise, the MDATA packet will be lost.

A typical test case is that connect the dwc2 controller with an
usb hs Hub (GL852G-12), and plug an usb fs audio device (Plantronics
headset) into the downstream port of Hub. Then use the usb mic
to record, we can find noise when playback.

In the case, the isoc split in transaction sequence like this:

- SSPLIT IN transaction
- CSPLIT IN transaction
  - MDATA packet (176 bytes)
- CSPLIT IN transaction
  - DATA0 packet (0 byte)

This patch use both the length of DATA0 and qtd->isoc_split_offset
to check if the DATA0 is in the second transaction.

Tested-by: Gevorg Sahakyan 
Tested-by: Heiko Stuebner 
Acked-by: Minas Harutyunyan hminas@synopsys.com>
Signed-off-by: William Wu 
Signed-off-by: Felipe Balbi

usb: dwc2: alloc dma aligned buffer for isoc split in

2018-06-19T09:48:13+00:00

The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in
a more supported way") rips out a lot of code to simply the
allocation of aligned DMA. However, it also introduces a new
issue when use isoc split in transfer.

In my test case, I connect the dwc2 controller with an usb hs
Hub (GL852G-12), and plug an usb fs audio device (Plantronics
headset) into the downstream port of Hub. Then use the usb mic
to record, we can find noise when playback.

It's because that the usb Hub uses an MDATA for the first
transaction and a DATA0 for the second transaction for the isoc
split in transaction. An typical isoc split in transaction sequence
like this:

- SSPLIT IN transaction
- CSPLIT IN transaction
  - MDATA packet
- CSPLIT IN transaction
  - DATA0 packet

The DMA address of MDATA (urb->dma) is always DWORD-aligned, but
the DMA address of DATA0 (urb->dma + qtd->isoc_split_offset) may
not be DWORD-aligned, it depends on the qtd->isoc_split_offset (the
length of MDATA). In my test case, the length of MDATA is usually
unaligned, this cause DATA0 packet transmission error.

This patch use kmem_cache to allocate aligned DMA buf for isoc
split in transaction. Note that according to usb 2.0 spec, the
maximum data payload size is 1023 bytes for each fs isoc ep,
and the maximum allowable interrupt data payload size is 64 bytes
or less for fs interrupt ep. So we set the size of object to be
1024 bytes in the kmem cache.

Tested-by: Gevorg Sahakyan 
Tested-by: Heiko Stuebner 
Acked-by: Minas Harutyunyan hminas@synopsys.com>
Signed-off-by: William Wu 
Reviewed-by: Douglas Anderson 
Signed-off-by: Felipe Balbi

usb: dwc2: fix the incorrect bitmaps for the ports of multi_tt hub

2018-06-19T09:48:13+00:00

The dwc2_get_ls_map() use ttport to reference into the
bitmap if we're on a multi_tt hub. But the bitmaps index
from 0 to (hub->maxchild - 1), while the ttport index from
1 to hub->maxchild. This will cause invalid memory access
when the number of ttport is hub->maxchild.

Without this patch, I can easily meet a Kernel panic issue
if connect a low-speed USB mouse with the max port of FE2.1
multi-tt hub (1a40:0201) on rk3288 platform.

Fixes: 9f9f09b048f5 ("usb: dwc2: host: Totally redo the microframe scheduler")
Cc: 
Reviewed-by: Douglas Anderson 
Acked-by: Minas Harutyunyan hminas@synopsys.com>
Signed-off-by: William Wu 
Signed-off-by: Felipe Balbi

usb: dwc2: Fix host exit from hibernation flow.

2018-06-19T09:48:12+00:00

In case when a hub is connected to DWC2 host
auto suspend occurs and host goes to
hibernation. When any device connected to hub
host hibernation exiting incorrectly.

- Added dwc2_hcd_rem_wakeup() function call to
  exit from suspend state by remote wakeup.

- Increase timeout value for port suspend bit to be set.

Acked-by: Minas Harutyunyan 
Signed-off-by: Artur Petrosyan 
Signed-off-by: Felipe Balbi