Commit graph

564,222 commits

Author SHA1 Message Date
Michael Opdenacker
0db090d542 ARM: at91/dt: fix "disabled" property on at91rm9200
Fix instances of "disable" instead of "disabled"
in the at91rm9200 dtsi.

Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
2015-10-19 17:57:41 +02:00
Alexandre Belloni
620f503322 ARM: at91/dt: use syscon for PMC
The PMC is not only used to drive the clocks but also has some registers
related to other functions. One of those is for example the USB gadget
bias.
Using a syscon allows to properly separate those functions.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
2015-10-19 17:57:41 +02:00
Ville Syrjälä
606bb5e0b2 drm/i915: Use round to closest when computing the CEA 1.001 pixel clocks
drm_edid.c now computes the alternate CEA clocks using
DIV_ROUND_CLOSEST(), so follow suit in the N/CTS setup to make sure we
pick the right setting for the mode.

Unfortunately we can't actually use DIV_ROUND_CLOSEST() here due to the
({}) construct used, so just stick in raw numbers instead.

Cc: Clint Taylor <clinton.a.taylor@intel.com>
Cc: Libin Yang <libin.yang@intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2015-10-19 17:56:02 +02:00
Tony Lindgren
57df538085 ARM: OMAP2+: Fix imprecise external abort caused by bogus SRAM init
Some omaps are producing imprecise external aborts because we are
wrongly trying to init SRAM for device tree based booting. Only
omap3 is still using the legacy SRAM code, so we need to make it
omap3 specific. Otherwise we can get errors like this on at least
dm814x:

Unhandled fault: imprecise external abort (0xc06) at 0xc08b156c
...
(omap_rev) from [<c08b12e0>] (omap_sram_init+0xf8/0x3e0)
(omap_sram_init) from [<c08aca0c>] (omap_sdrc_init+0x10/0xb0)
(omap_sdrc_init) from [<c08b581c>] (pdata_quirks_init+0x18/0x44)
(pdata_quirks_init) from [<c08b5478>] (omap_generic_init+0x10/0x1c)
(omap_generic_init) from [<c08a57e0>] (customize_machine+0x1c/0x40)
(customize_machine) from [<c00098a4>] (do_one_initcall+0x80/0x1dc)
(do_one_initcall) from [<c08a2ec4>] (kernel_init_freeable+0x218/0x2e8)
(kernel_init_freeable) from [<c063a554>] (kernel_init+0x8/0xec)
(kernel_init) from [<c000f890>] (ret_from_fork+0x14/0x24)

Let's fix the issue by making sure omap_sdrc_init only gets called for
omap3. To do that, we need to have compatible "ti,omap3" in the dts
files. And let's also use "ti,omap3630" instead of "ti,omap36xx" like
we're supposed to.

Signed-off-by: Tony Lindgren <tony@atomide.com>
2015-10-19 08:55:46 -07:00
Rajesh Bhagat
607e266c47 ARM: dts: ls1021a: Add quirk for Erratum A009116
Add "snps,quirk-frame-length-adjustment" property to
USB3 node for erratum A009116. This property provides
value of GFLADJ_30MHZ for post silicon frame length
adjustment.

Signed-off-by: Nikhil Badola <nikhil.badola@freescale.com>
Signed-off-by: Rajesh Bhagat <rajesh.bhagat@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:43 +08:00
Laurent Pinchart
9a9214598a ARM: imx6sx-sdb: Fix typo in regulator enable GPIO property
The property name should be "gpio", not "gpios". Fix it.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:43 +08:00
Michael Opdenacker
a452afa317 ARM: dts: imx6: phyFLEX: fix typo in "pinctrl-names"
Fix a typo, replacing "pinctrl-name" by "pinctrl-names"
in the Phytec phyFLEX-i.MX6 Quad dtsi.

Also fix a typo in the board name

Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:42 +08:00
Shengjiu Wang
833f2cbf70 ARM: dts: imx6: change the core clock of spdif
The correct core clock of spdif is SPDIF_GCLK, which is added to
clock tree. So the dts also need to be updated.

Signed-off-by: Shengjiu Wang <shengjiu.wang@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:42 +08:00
Stefan Agner
654252659e ARM: dts: vf-colibri: enable NAND flash controller
Enable NAND access by adding pinmux and NAND flash controller node
to device tree. The NAND chips currently used on the Colibri VF61
requires 8-bit ECC per 512 byte page, hence specify 32-bit ECC
strength per 2k page size.

Reviewed-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:24 +08:00
Stefan Agner
baeeb541e6 ARM: dts: vf610twr: add NAND flash controller peripherial
This adds the NAND flash controller (NFC) peripherial. The driver
supports the SLC NAND chips found on Freescale's Vybrid Tower System
Module. The Micron NAND chip on the module needs 4-bit ECC per 512
byte page. Use 24-bit ECC per 2k page, which is supported by the
driver.

Signed-off-by: Bill Pringlemeir <bpringlemeir@nbsps.com>
Reviewed-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:24 +08:00
Gary Bisson
397a7d4535 ARM: dts: imx: add Boundary Devices Nitrogen6_Lite board
Based on an i.MX6 Solo with 512MB DDR3.

http://boundarydevices.com/product/nitrogen6_lite/

Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:24 +08:00
Gary Bisson
b32e700256 ARM: dts: imx: add Boundary Devices Nitrogen6_Max board
Based on i.MX6 Quad with 4GB of DDR3.

http://boundarydevices.com/product/nitrogen6max/

Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:23 +08:00
Gary Bisson
4629cb7f47 ARM: dts: imx6dl-nitrogen6x: change manufacturer to Boundary Devices
Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:23 +08:00
Gary Bisson
64618e71da ARM: dts: imx6q-nitrogen6x: change manufacturer to Boundary Devices
Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:22 +08:00
Gary Bisson
16fa43988c of: Add Boundary Devices Inc. vendor prefix
This patch adds the vendor prefix for Boundary Devices Inc. which is a
supplier of ARM-based single board computers and System-on-Modules for
the general embedded market.

Website: http://boundarydevices.com/

Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:22 +08:00
Gary Bisson
95a9e6cb9f ARM: dts: imx6qdl-sabrelite: relicense under GPLv2/X11
Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:22 +08:00
Gary Bisson
a0689609f0 ARM: dts: imx6qdl-nitrogen6x: relicense under GPLv2/X11
Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:21 +08:00
Gary Bisson
f12fb7a27a ARM: dts: imx6qdl-nitrogen6x: add wifi wl1271 support
Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:21 +08:00
Gary Bisson
140fa36f04 ARM: dts: imx6dql-nitrogen6x: add touchscreen support
This patch adds the different touchscreens that can be connected using
the displays available for this board.
http://boundarydevices.com/product-category/displays/

Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:20 +08:00
Gary Bisson
d0ddcc5310 ARM: dts: imx6qdl-sabrelite: add Okaya LCD panel
This patch adds support for the 7" LCD display available for Sabrelite:
http://boundarydevices.com/product/7-800x480-display/

Also add label to backlight_lcd and connect it to the panel.

Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:20 +08:00
Gary Bisson
9c3d8fa060 ARM: dts: imx6qdl-nitrogen6x: add Okaya LCD panel
This patch adds support for the 7" LCD display available for Nitrogen6x:
http://boundarydevices.com/product/7-800x480-display/

Also add label to backlight_lcd and connect it to the panel.

Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:20 +08:00
Sanchayan Maity
6e994c5a1d ARM: dts: vf500-colibri: Add device tree node for touchscreen support
Add device tree node for touchscreen support on Colibri VF50. The
touchscreen functionality on VF50 uses the ADC channels of Vybrid
and some GPIOs. Also add pinctrl nodes for proper pinmux.

Signed-off-by: Sanchayan Maity <maitysanchayan@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:19 +08:00
Vladimir Zapolskiy
b2bbb1669d ARM: dts: i.MX35: fix cpu compatible value
The change corrects cpu compatible property to a defined one,
see Documentation/devicetree/bindings/arm/cpus.txt

Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Cc: Sascha Hauer <kernel@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:19 +08:00
Vladimir Zapolskiy
bc6cde3589 ARM: dts: i.MX31: fix cpu compatible value
The change corrects cpu compatible property to a defined one,
see Documentation/devicetree/bindings/arm/cpus.txt

Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Cc: Sascha Hauer <kernel@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:18 +08:00
Adrian Alonso
149c08e075 ARM: dts: imx: imx7d add iomuxc lpsr device node
Add device tree node to support iomuxc-lpsr controller, fsl,input-sel
phandle allows to get input select register base address which is
shared from main iomuxc controller.

Signed-off-by: Adrian Alonso <aalonso@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:18 +08:00
Fugang Duan
47bcc8c07a ARM: dts: imx7d-sdb: add fec1 and fec2 support
Enable fec1 and fec2 for i.MX7d-sdb board.

Signed-off-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:18 +08:00
Adrian Alonso
5b8e6ed482 ARM: dts: imx7d-pinfunc: add gpio1 pad iomux settings
- Add imx7 SoC GPIO1 pad iomuxc settings
  <mux_reg conf_reg input_reg mux_mode input_val>
- Fix UART input select daisy chain setting values

Signed-off-by: Adrian Alonso <aalonso@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:17 +08:00
Yuan Yao
60f0ea12d5 ARM: dts: Add node for ina220 on LS1021ATWR
The INA220 monitors both shunt drop and supply voltage.

Signed-off-by: Yuan Yao <yao.yuan@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:17 +08:00
Alison Wang
70b5ea9728 ARM: ls1021a: Add dma-coherent property for eTSEC nodes
This patch adds dma-coherent property for eTSEC nodes, so
coherent DMA operations are supported.

Signed-off-by: Alison Wang <alison.wang@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:16 +08:00
Fabio Estevam
a81fd34da0 ARM: dts: imx7d-sdb: Add USB support
Add support for USBOTG1 and USBOTG2.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:16 +08:00
Fabio Estevam
60f5a22382 ARM: dts: imx7d: Add USB support
Add USB OTG and Host support.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:15 +08:00
Fugang Duan
0f629217cf ARM: dts: imx7d: add fec1 and fec2 support for i.MX7d soc
Add fec1 and fec2 nodes for i.MX7d soc.

Signed-off-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:15 +08:00
Horia Geantă
816aa61c33 ARM: dts: ls1021a: add crypto node
Signed-off-by: Horia Geantă <horia.geanta@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:14 +08:00
Haibo Chen
d272c07b53 ARM: dts: imx6ul-14x14-evk.dts: add tsc support
Add touch screen surpport for i.MX6UL-EVK board.

Signed-off-by: Haibo Chen <haibo.chen@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:14 +08:00
Haibo Chen
3add09695b ARM: dts: imx6ul.dtsi: add TSC support
Add imx6ul touchscreen controller support.

TSC module need ADC2 module to measure the touchscreen
coordinate value. This patch put TSC and ADC2 together,
make ADC2 module only be used for TSC, can't be used as
a normal ADC.

Signed-off-by: Haibo Chen <haibo.chen@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:14 +08:00
Fabio Estevam
208c9fe215 ARM: dts: imx7d: Add PWM support
Add the PWM1-4 nodes.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:13 +08:00
Fabio Estevam
1387349d0a ARM: dts: imx6sl: Complete the dcp node
The DCP block present on MX6SL is compatible with the one on MX28,
so add the compatible string and also complete the interrupt entries.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:13 +08:00
Rafał Miłecki
79826ac6bb ARM: dts: imx: add "jedec,spi-nor" flash compatible binding
Starting with commit 8947e396a8 ("Documentation: dt: mtd: replace
"nor-jedec" binding with "jedec, spi-nor"") we have "jedec,spi-nor"
binding indicating support for JEDEC identification.

Use it for all flashes that are supposed to support READ ID op according
to the datasheets.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:12 +08:00
Stefan Wahren
a7be1e6877 ARM: mxs: enable ocotp for i.MX23 and i.MX28
This patch enables On Chip OTP support for i.MX23 and i.MX28 SoCs,
but keeps the old compatible string.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:12 +08:00
Haibo Chen
f651d7816b ARM: dts: imx7d-sdb: add eMMC5.0 support
imx7d-sdb board has a eMMC5.0 on usdhc3. This eMMC support HS400.
This patch add usdhc3 support for HS400

Signed-off-by: Haibo Chen <haibo.chen@freescale.com>
Acked-by: Dong Aisheng <aisheng.dong@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:12 +08:00
Anson Huang
ab0a05d818 ARM: dts: imx6ul: add pm_power_off support
i.MX6UL can be powered off by programming SNVS.

When long press ON/OFF button(5 seconds),
PMIC_ON_REQ pin will be set to low and external
PMIC will be powered off.

And system can be powered on by long press ON/OFF
button again.

Signed-off-by: Anson Huang <b20788@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:11 +08:00
Anson Huang
51a374438c ARM: dts: imx6ul: add mmdc support for i.mx6ul
Add MMDC support for i.MX6UL.

Signed-off-by: Anson Huang <b20788@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:11 +08:00
Anson Huang
322d09d6ea ARM: dts: imx6ul: add sram support for i.mx6ul
Add SRAM support for i.MX6UL, it has 128KB ocram
starting from 0x900000.

Signed-off-by: Anson Huang <b20788@freescale.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2015-10-19 22:45:10 +08:00
Shawn Guo
62b91605c8 The i.MX clock updates for 4.4:
- A couple of fixes on i.MX31 and i.MX35 clock initialization functions
    which makes mxc_timer_init() currently be called twice for DT boot.
  - Increase i.MX6UL AXI bus clock rate to 264MHz which is the optimal
    design target.
  - Add a few missing clocks, ADC clock for i.MX7D, OCOTP clock for
    Vybrid, and SPDIF_GCLK for i.MX6.
  - A series from Lucas to fix early debug UART clock setup.  This is
    currently a one-off fix for i.MX platform, and can be extended to
    become a generic solution later.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJWIRFyAAoJEFBXWFqHsHzOE7wH/25WaamOOOL3vGVCBeIs2+aB
 nibCEKCPGu2/b1YN+BEQMlh+K7d59Ogd0xVtTkLEGhIBW+LF5zDpsd6jNl7Ts6PQ
 5w3gG7K/NqPzIXlgo+z5Oa4UI1DlDemcA1xihR+hFWjLQb8DBmnusK52ctS5MLfP
 6SoepDWHJvtuAfoL/3ytNTi/xCW12sEVkzRV7QbG9GV2UmUgF2AVWKBkH+c28vnP
 dyt2Cyrr4+9ov6p0k0OJnHDv1AxkkNlHh0G33pZMZmnqcn/ZagmdH2GReGWZi6PM
 XLMY/piEK7zzryJ51hL9AGZi7so1LWs27kBtYo9r7bN9/cG4kaENGw6Du1jEf4I=
 =OBCO
 -----END PGP SIGNATURE-----

Merge tag 'imx-clk-4.4' into imx/dt

The i.MX clock updates for 4.4:
 - A couple of fixes on i.MX31 and i.MX35 clock initialization functions
   which makes mxc_timer_init() currently be called twice for DT boot.
 - Increase i.MX6UL AXI bus clock rate to 264MHz which is the optimal
   design target.
 - Add a few missing clocks, ADC clock for i.MX7D, OCOTP clock for
   Vybrid, and SPDIF_GCLK for i.MX6.
 - A series from Lucas to fix early debug UART clock setup.  This is
   currently a one-off fix for i.MX platform, and can be extended to
   become a generic solution later.
2015-10-19 22:45:01 +08:00
Manikanta Pubbisetty
bc6f9ae604 ath10k: make fw stats prints specific to firmware version
The patch makes debug stats prints fw specific by adding a new member
in wmi_ops. That way it's easier to add fw_stats support to 10.4 firmware.

Signed-off-by: Manikanta Pubbisetty <c_mpubbi@qti.qualcomm.com>
Signed-off-by: Tamizh Chelvam <c_traja@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-10-19 17:42:03 +03:00
Anilkumar Kolli
1aaf8efba0 ath10k: disable PCI PS for QCA988X and QCA99X0
This patch disables PCI PS for QCA988X and QCA99X0, Since PCI PS is
validated for QCA6174, let it be enabled only for QCA6174. It would be
better to execute PCI PS related functions only for the supported devices.

PCI time out issue is observed with QCA99X0 on x86 platform, We will
disable PCI PS for QCA988X and QCA99X0 until PCI PS is properly implemented.

Taking and releasing ps_lock is causing higher CPU consumption. Michal Kazior
suggested ps_lock overhead to be reworked so that ath10k_pci_wake/sleep
functions are called less often, i.e. move the powersave logic up (only during
irq handling, tx path, submitting fw commands) but that's a bigger change and
can be implemented later.

Signed-off-by: Anilkumar Kolli <akolli@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-10-19 17:38:01 +03:00
Mian Yousaf Kaukab
81e9d14a53 usb: gadget: net2280: restore ep_cfg after defect7374 workaround
Defect 7374 workaround enables all GPEP as endpoint 0. Restore
endpoint number when defect 7374 workaround is disabled. Otherwise,
check to match USB endpoint number to hardware endpoint number in
net2280_enable() fails.

Cc: <stable@vger.kernel.org> # 4.2
Reported-by: Paul Jones <p.jones@teclyn.com>
Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-19 09:25:53 -05:00
Doug Anderson
dc87308469 usb: dwc2: host: Fix use after free w/ simultaneous irqs
While plugging / unplugging on a DWC2 host port with "slub_debug=FZPUA"
enabled, I found a crash that was quite obviously a use after free.

It appears that in some cases when we handle the various sub-cases of
HCINT we may end up freeing the QTD.  If there is more than one bit set
in HCINT we may then end up continuing to use the QTD, which is bad.
Let's be paranoid and check for this after each sub-case.  This should
be safe since we officially have the "hsotg->lock" (it was grabbed in
dwc2_handle_hcd_intr).

The specific crash I found was:
 Unable to handle kernel paging request at virtual address 6b6b6b9f

At the time of the crash, the kernel reported:
 (dwc2_hc_nak_intr+0x5c/0x198)
 (dwc2_handle_hcd_intr+0xa84/0xbf8)
 (_dwc2_hcd_irq+0x1c/0x20)
 (usb_hcd_irq+0x34/0x48)

Popping into kgdb found that "*qtd" was filled with "0x6b", AKA qtd had
been freed and filled with slub_debug poison.

kgdb gave a little better stack crawl:
 0 dwc2_hc_nak_intr (hsotg=hsotg@entry=0xec42e058,
     chan=chan@entry=0xec546dc0, chnum=chnum@entry=4,
     qtd=qtd@entry=0xec679600) at drivers/usb/dwc2/hcd_intr.c:1237
 1 dwc2_hc_n_intr (chnum=4, hsotg=0xec42e058) at
     drivers/usb/dwc2/hcd_intr.c:2041
 2 dwc2_hc_intr (hsotg=0xec42e058) at drivers/usb/dwc2/hcd_intr.c:2078
 3 dwc2_handle_hcd_intr (hsotg=0xec42e058) at
     drivers/usb/dwc2/hcd_intr.c:2128
 4 _dwc2_hcd_irq (hcd=<optimized out>) at drivers/usb/dwc2/hcd.c:2837
 5 usb_hcd_irq (irq=<optimized out>, __hcd=<optimized out>) at
     drivers/usb/core/hcd.c:2353

Popping up to frame #1 (dwc2_hc_n_intr) found:
 (gdb) print /x hcint
 $12 = 0x12

AKA:
 #define HCINTMSK_CHHLTD  (1 << 1)
 #define HCINTMSK_NAK     (1 << 4)

Further debugging found that by simulating receiving those two
interrupts at the same time it was trivial to replicate the
use-after-free.  See <http://crosreview.com/305712> for a patch and
instructions.  This lead to getting the following stack crawl of the
actual free:
 0  arch_kgdb_breakpoint () at arch/arm/include/asm/outercache.h:103
 1  kgdb_breakpoint () at kernel/debug/debug_core.c:1054
 2  dwc2_hcd_qtd_unlink_and_free (hsotg=<optimized out>, qh=<optimized
      out>, qtd=0xe4479a00) at drivers/usb/dwc2/hcd.h:488
 3  dwc2_deactivate_qh (free_qtd=<optimized out>, qh=0xe5efa280,
      hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:671
 4  dwc2_release_channel (hsotg=hsotg@entry=0xed424618,
      chan=chan@entry=0xed5be000, qtd=<optimized out>,
      halt_status=<optimized out>) at drivers/usb/dwc2/hcd_intr.c:742
 5  dwc2_halt_channel (hsotg=0xed424618, chan=0xed5be000, qtd=<optimized
      out>, halt_status=<optimized out>) at
      drivers/usb/dwc2/hcd_intr.c:804
 6  dwc2_complete_non_periodic_xfer (chnum=<optimized out>,
      halt_status=<optimized out>, qtd=<optimized out>, chan=<optimized
      out>, hsotg=<optimized out>) at drivers/usb/dwc2/hcd_intr.c:889
 7  dwc2_hc_xfercomp_intr (hsotg=hsotg@entry=0xed424618,
      chan=chan@entry=0xed5be000, chnum=chnum@entry=6,
      qtd=qtd@entry=0xe4479a00) at drivers/usb/dwc2/hcd_intr.c:1065
 8  dwc2_hc_chhltd_intr_dma (qtd=0xe4479a00, chnum=6, chan=0xed5be000,
      hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:1823
 9  dwc2_hc_chhltd_intr (qtd=0xe4479a00, chnum=6, chan=0xed5be000,
      hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:1944
 10 dwc2_hc_n_intr (chnum=6, hsotg=0xed424618) at
      drivers/usb/dwc2/hcd_intr.c:2052
 11 dwc2_hc_intr (hsotg=0xed424618) at drivers/usb/dwc2/hcd_intr.c:2097
 12 dwc2_handle_hcd_intr (hsotg=0xed424618) at
      drivers/usb/dwc2/hcd_intr.c:2147
 13 _dwc2_hcd_irq (hcd=<optimized out>) at drivers/usb/dwc2/hcd.c:2837
 14 usb_hcd_irq (irq=<optimized out>, __hcd=<optimized out>) at
      drivers/usb/core/hcd.c:2353

Though we could add specific code to handle this case, adding the
general purpose code to check for all cases where qtd might be freed
seemed safer.

Acked-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-19 09:22:46 -05:00
Geliang Tang
ebd2938577 usb: gadget: fix a trivial typo
s/regsiter/register/

Signed-off-by: Geliang Tang <geliangtang@163.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2015-10-19 09:20:05 -05:00
Sudeep Dutt
b9997e385e iommu/vt-d: Use dev_err(..) in intel_svm_device_to_iommu(..)
This will give a little bit of assistance to those developing drivers
using SVM. It might cause a slight annoyance to end-users whose kernel
disables the IOMMU when drivers are trying to use it. But the fix there
is to fix the kernel to enable the IOMMU.

Signed-off-by: Sudeep Dutt <sudeep.dutt@intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
2015-10-19 15:03:00 +01:00