Re: [PATCH v4] usb: gadget: configfs: Fix KASAN use-after-free
On Thu, 2021-03-11 at 14:42 +0800, Macpaul Lin wrote:
> From: Jim Lin
>
> When gadget is disconnected, running sequence is like this.
> . composite_disconnect
> . Call trace:
> usb_string_copy+0xd0/0x128
> gadget_config_name_configuration_store+0x4
> gadget_config_name_attr_store+0x40/0x50
> configfs_write_file+0x198/0x1f4
> vfs_write+0x100/0x220
> SyS_write+0x58/0xa8
> . configfs_composite_unbind
> . configfs_composite_bind
>
> In configfs_composite_bind, it has
> "cn->strings.s = cn->configuration;"
>
> When usb_string_copy is invoked. it would
> allocate memory, copy input string, release previous pointed memory space,
> and use new allocated memory.
>
> When gadget is connected, host sends down request to get information.
> Call trace:
> usb_gadget_get_string+0xec/0x168
> lookup_string+0x64/0x98
> composite_setup+0xa34/0x1ee8
>
> If gadget is disconnected and connected quickly, in the failed case,
> cn->configuration memory has been released by usb_string_copy kfree but
> configfs_composite_bind hasn't been run in time to assign new allocated
> "cn->configuration" pointer to "cn->strings.s".
>
> When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling
> memory is accessed, "BUG: KASAN: use-after-free" error occurs.
>
> Signed-off-by: Jim Lin
> Signed-off-by: Macpaul Lin
> Cc: sta...@vger.kernel.org
> ---
> Changes in v2:
> Changes in v3:
> - Change commit description
> Changes in v4:
> - Fix build error and adapt patch to kernel-5.12-rc1.
>Replace definition "MAX_USB_STRING_WITH_NULL_LEN" with
>"USB_MAX_STRING_WITH_NULL_LEN".
> - Note: The patch v2 and v3 has been verified by
>Thadeu Lima de Souza Cascardo
>http://spinics.net/lists/kernel/msg3840792.html
Dear Cascardo,
Would you please help to confirm if you've tested it on Linux PC,
Chrome OS, or an Android OS?
Thanks!
Macpaul Lin
>and
>Macpaul Lin on Android kernels.
>http://lkml.org/lkml/2020/6/11/8
> - The patch is suggested to be applied to LTS versions.
>
> drivers/usb/gadget/configfs.c | 14 ++
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 0d56f33..15a607c 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -97,6 +97,8 @@ struct gadget_config_name {
> struct list_head list;
> };
>
> +#define USB_MAX_STRING_WITH_NULL_LEN (USB_MAX_STRING_LEN+1)
> +
> static int usb_string_copy(const char *s, char **s_copy)
> {
> int ret;
> @@ -106,12 +108,16 @@ static int usb_string_copy(const char *s, char **s_copy)
> if (ret > USB_MAX_STRING_LEN)
> return -EOVERFLOW;
>
> - str = kstrdup(s, GFP_KERNEL);
> - if (!str)
> - return -ENOMEM;
> + if (copy) {
> + str = copy;
> + } else {
> + str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);
> + if (!str)
> + return -ENOMEM;
> + }
> + strcpy(str, s);
> if (str[ret - 1] == '\n')
> str[ret - 1] = '\0';
> - kfree(copy);
> *s_copy = str;
> return 0;
> }
[PATCH v4] usb: gadget: configfs: Fix KASAN use-after-free
From: Jim Lin
When gadget is disconnected, running sequence is like this.
. composite_disconnect
. Call trace:
usb_string_copy+0xd0/0x128
gadget_config_name_configuration_store+0x4
gadget_config_name_attr_store+0x40/0x50
configfs_write_file+0x198/0x1f4
vfs_write+0x100/0x220
SyS_write+0x58/0xa8
. configfs_composite_unbind
. configfs_composite_bind
In configfs_composite_bind, it has
"cn->strings.s = cn->configuration;"
When usb_string_copy is invoked. it would
allocate memory, copy input string, release previous pointed memory space,
and use new allocated memory.
When gadget is connected, host sends down request to get information.
Call trace:
usb_gadget_get_string+0xec/0x168
lookup_string+0x64/0x98
composite_setup+0xa34/0x1ee8
If gadget is disconnected and connected quickly, in the failed case,
cn->configuration memory has been released by usb_string_copy kfree but
configfs_composite_bind hasn't been run in time to assign new allocated
"cn->configuration" pointer to "cn->strings.s".
When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling
memory is accessed, "BUG: KASAN: use-after-free" error occurs.
Signed-off-by: Jim Lin
Signed-off-by: Macpaul Lin
Cc: sta...@vger.kernel.org
---
Changes in v2:
Changes in v3:
- Change commit description
Changes in v4:
- Fix build error and adapt patch to kernel-5.12-rc1.
Replace definition "MAX_USB_STRING_WITH_NULL_LEN" with
"USB_MAX_STRING_WITH_NULL_LEN".
- Note: The patch v2 and v3 has been verified by
Thadeu Lima de Souza Cascardo
http://spinics.net/lists/kernel/msg3840792.html
and
Macpaul Lin on Android kernels.
http://lkml.org/lkml/2020/6/11/8
- The patch is suggested to be applied to LTS versions.
drivers/usb/gadget/configfs.c | 14 ++
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 0d56f33..15a607c 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -97,6 +97,8 @@ struct gadget_config_name {
struct list_head list;
};
+#define USB_MAX_STRING_WITH_NULL_LEN (USB_MAX_STRING_LEN+1)
+
static int usb_string_copy(const char *s, char **s_copy)
{
int ret;
@@ -106,12 +108,16 @@ static int usb_string_copy(const char *s, char **s_copy)
if (ret > USB_MAX_STRING_LEN)
return -EOVERFLOW;
- str = kstrdup(s, GFP_KERNEL);
- if (!str)
- return -ENOMEM;
+ if (copy) {
+ str = copy;
+ } else {
+ str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);
+ if (!str)
+ return -ENOMEM;
+ }
+ strcpy(str, s);
if (str[ret - 1] == '\n')
str[ret - 1] = '\0';
- kfree(copy);
*s_copy = str;
return 0;
}
--
1.7.9.5
[PATCH v10 1/4] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC
From: Mars Cheng This patch adds MT6765 smi binding document Signed-off-by: Mars Cheng Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin Acked-by: Rob Herring --- .../bindings/memory-controllers/mediatek,smi-common.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml index a08a32340987..4a4f4377576f 100644 --- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml +++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml @@ -31,6 +31,7 @@ properties: - enum: - mediatek,mt2701-smi-common - mediatek,mt2712-smi-common + - mediatek,mt6765-smi-common - mediatek,mt6779-smi-common - mediatek,mt8167-smi-common - mediatek,mt8173-smi-common -- 2.18.0
[PATCH v10 0/4] Add basic SoC support for mt6765
This patch adds basic SoC support for Mediatek's new 8-core SoC, MT6765, which is mainly for smartphone application. Changes in V10: [v10,1/4] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC - No Change. [v10,2/4] soc: mediatek: add MT6765 scpsys and subdomain support - No Change. [v10,3/4] arm64: dts: mediatek: add mt6765 support - Remove interrupt in mmsys node. - Replace smi_common@14002000 to smi@14002000 [v10,4/4] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks - No Change. Changes in V9: 1. Origin V8 patchset: https://patchwork.kernel.org/cover/11396015/ [v9,1/4] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC - No Change. [v9,2/4] soc: mediatek: add MT6765 scpsys and subdomain support - Fix build error based on 5.11-rc1 because - bp_table has been deprecated. - basic_clk_id has been renamed to clk_id. - correct the number order in marco GENMASK(). Note: mediatek is working on porting mt6765's scpsys to driver "mtk-pm-domains", however we think supporting for "mtk-scpsys" is required before new glue is available. [v9,3/4] arm64: dts: mediatek: add mt6765 support - No Change. [v9,4/4] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks - No Change. Changes in V8: 1. Origin V7 patchset: https://patchwork.kernel.org/cover/11370105/ Split origin V7 patchset into 2 patchset, keep remain patches #2, #5, #6, and #7 in the same order as this V8 patchset. [v7,2/7] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC [v7,5/7] soc: mediatek: add MT6765 scpsys and subdomain support [v7,6/7] arm64: dts: mediatek: add mt6765 support [v7,7/7] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks Changes in V7: 1. Adapt V6's patchset to latest kernel tree 5.5-rc1. Origin V6 patchset: https://patchwork.kernel.org/cover/11041963/ 2. Correct 2 clock-controller type in documentation: mipi0 and venc_gcon. [v7 1/7] dt-bindings: clock: mediatek: document clk bindings 3. Remove V6's patch 03 because it has been taken into 5.5-next-soc [v6, 03/08] dt-bindings: mediatek: add MT6765 power dt-bindings 3. Update Reviewed-by: Rob Herring for [v6, 04/08] clk: mediatek: add mt6765 clock IDs --> [v7, 03/07] clk: mediatek: add mt6765 clock IDs 4. Update SPDX tag for [v6, 05/08] clk: mediatek: Add MT6765 clock support --> [v7, 04/07] clk: mediatek: Add MT6765 clock support Changes in V6: 1. Adapt V5's patchset to latest kernel tree. Origin V5 patchset. https://lore.kernel.org/patchwork/cover/963612/ 2. Due to clk's common code has been submit by other platform, this patch set will have dependencies with the following patchsets as the following orders. 2.a. [v8,00/21] MT8183 IOMMU SUPPORT https://patchwork.kernel.org/cover/11023585/ 2.b. [v11,0/6] Add basic node support for Mediatek MT8183 SoC https://patchwork.kernel.org/cover/10962385/ 2.c. [v6,00/14] Mediatek MT8183 scpsys support https://patchwork.kernel.org/cover/11005751/ 3. Correct power related patches into dt-binding patches. 4. Re-order V5's 4/11, 6/11, and 7/11 due clk common code change and make dependencies in order. 5. Update some commit message in clk related patches. Changes in V5: 1. add clk support Changes in V4: 1. add gic's settings in reg properties 2. remove some patches about dt-bindings since GKH already took them Changes in V3: 1. split dt-binding document patchs 2. fix mt6765.dtsi warnings with W=12 3. remove uncessary PPI affinity for timer 4. add gicc base for gic dt node Changes in V2: 1. fix clk properties in uart dts node 2. fix typo in submit title 3. add simple-bus in mt6765.dtsi 4. use correct SPDX license format Mars Cheng (3): dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC soc: mediatek: add MT6765 scpsys and subdomain support arm64: dts: mediatek: add mt6765 support Owen Chen (1): arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks .../mediatek,smi-common.yaml | 1 + arch/arm64/boot/dts/mediatek/Makefile | 1 + arch/arm64/boot/dts/mediatek/mt6765-evb.dts | 33 +++ arch/arm64/boot/dts/mediatek/mt6765.dtsi | 252 ++ arch/arm64/configs/defconfig | 6 + drivers/soc/mediatek/mtk-scpsys.c | 91 +++ 6 files changed, 384 insertions(+) create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi -- 2.18.0
[PATCH v10 2/4] soc: mediatek: add MT6765 scpsys and subdomain support
From: Mars Cheng
This adds scpsys support for MT6765
Add subdomain support for MT6765:
isp, mm, connsys, mfg, and cam.
Signed-off-by: Mars Cheng
Signed-off-by: Owen Chen
Signed-off-by: Macpaul Lin
---
drivers/soc/mediatek/mtk-scpsys.c | 91 +++
1 file changed, 91 insertions(+)
diff --git a/drivers/soc/mediatek/mtk-scpsys.c
b/drivers/soc/mediatek/mtk-scpsys.c
index ca75b14931ec..fc8d3858f1b4 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -15,6 +15,7 @@
#include
#include
+#include
#include
#include
#include
@@ -750,6 +751,81 @@ static const struct scp_subdomain scp_subdomain_mt2712[] =
{
{MT2712_POWER_DOMAIN_MFG_SC2, MT2712_POWER_DOMAIN_MFG_SC3},
};
+/*
+ * MT6765 power domain support
+ */
+#define SPM_PWR_STATUS_MT6765 0x0180
+#define SPM_PWR_STATUS_2ND_MT6765 0x0184
+
+static const struct scp_domain_data scp_domain_data_mt6765[] = {
+ [MT6765_POWER_DOMAIN_VCODEC] = {
+ .name = "vcodec",
+ .sta_mask = BIT(26),
+ .ctl_offs = 0x300,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+ [MT6765_POWER_DOMAIN_ISP] = {
+ .name = "isp",
+ .sta_mask = BIT(5),
+ .ctl_offs = 0x308,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+ [MT6765_POWER_DOMAIN_MM] = {
+ .name = "mm",
+ .sta_mask = BIT(3),
+ .ctl_offs = 0x30C,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ .clk_id = {CLK_MM},
+ },
+ [MT6765_POWER_DOMAIN_CONN] = {
+ .name = "conn",
+ .sta_mask = BIT(1),
+ .ctl_offs = 0x32C,
+ .sram_pdn_bits = 0,
+ .sram_pdn_ack_bits = 0,
+ },
+ [MT6765_POWER_DOMAIN_MFG_ASYNC] = {
+ .name = "mfg_async",
+ .sta_mask = BIT(23),
+ .ctl_offs = 0x334,
+ .sram_pdn_bits = 0,
+ .sram_pdn_ack_bits = 0,
+ .clk_id = {CLK_MFG},
+ },
+ [MT6765_POWER_DOMAIN_MFG] = {
+ .name = "mfg",
+ .sta_mask = BIT(4),
+ .ctl_offs = 0x338,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+ [MT6765_POWER_DOMAIN_CAM] = {
+ .name = "cam",
+ .sta_mask = BIT(25),
+ .ctl_offs = 0x344,
+ .sram_pdn_bits = GENMASK(9, 8),
+ .sram_pdn_ack_bits = GENMASK(13, 12),
+ },
+ [MT6765_POWER_DOMAIN_MFG_CORE0] = {
+ .name = "mfg_core0",
+ .sta_mask = BIT(7),
+ .ctl_offs = 0x34C,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+};
+
+static const struct scp_subdomain scp_subdomain_mt6765[] = {
+ {MT6765_POWER_DOMAIN_MM, MT6765_POWER_DOMAIN_CAM},
+ {MT6765_POWER_DOMAIN_MM, MT6765_POWER_DOMAIN_ISP},
+ {MT6765_POWER_DOMAIN_MM, MT6765_POWER_DOMAIN_VCODEC},
+ {MT6765_POWER_DOMAIN_MFG_ASYNC, MT6765_POWER_DOMAIN_MFG},
+ {MT6765_POWER_DOMAIN_MFG, MT6765_POWER_DOMAIN_MFG_CORE0},
+};
+
/*
* MT6797 power domain support
*/
@@ -1033,6 +1109,18 @@ static const struct scp_soc_data mt2712_data = {
.bus_prot_reg_update = false,
};
+static const struct scp_soc_data mt6765_data = {
+ .domains = scp_domain_data_mt6765,
+ .num_domains = ARRAY_SIZE(scp_domain_data_mt6765),
+ .subdomains = scp_subdomain_mt6765,
+ .num_subdomains = ARRAY_SIZE(scp_subdomain_mt6765),
+ .regs = {
+ .pwr_sta_offs = SPM_PWR_STATUS_MT6765,
+ .pwr_sta2nd_offs = SPM_PWR_STATUS_2ND_MT6765,
+ },
+ .bus_prot_reg_update = true,
+};
+
static const struct scp_soc_data mt6797_data = {
.domains = scp_domain_data_mt6797,
.num_domains = ARRAY_SIZE(scp_domain_data_mt6797),
@@ -1088,6 +1176,9 @@ static const struct of_device_id of_scpsys_match_tbl[] = {
}, {
.compatible = "mediatek,mt2712-scpsys",
.data = _data,
+ }, {
+ .compatible = "mediatek,mt6765-scpsys",
+ .data = _data,
}, {
.compatible = "mediatek,mt6797-scpsys",
.data = _data,
--
2.18.0
[PATCH v10 3/4] arm64: dts: mediatek: add mt6765 support
From: Mars Cheng
Add basic chip support for Mediatek 6765, include
uart node with correct uart clocks, pwrap device
Add clock controller nodes, include topckgen, infracfg,
apmixedsys and subsystem.
Signed-off-by: Mars Cheng
Signed-off-by: Owen Chen
Signed-off-by: Macpaul Lin
Acked-by: Marc Zyngier
---
arch/arm64/boot/dts/mediatek/Makefile | 1 +
arch/arm64/boot/dts/mediatek/mt6765-evb.dts | 33 +++
arch/arm64/boot/dts/mediatek/mt6765.dtsi| 252
3 files changed, 286 insertions(+)
create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts
create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi
diff --git a/arch/arm64/boot/dts/mediatek/Makefile
b/arch/arm64/boot/dts/mediatek/Makefile
index deba27ab7657..176c817f9f9a 100644
--- a/arch/arm64/boot/dts/mediatek/Makefile
+++ b/arch/arm64/boot/dts/mediatek/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
dtb-$(CONFIG_ARCH_MEDIATEK) += mt2712-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6755-evb.dtb
+dtb-$(CONFIG_ARCH_MEDIATEK) += mt6765-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6779-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6795-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6797-evb.dtb
diff --git a/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
b/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
new file mode 100644
index ..36dddff2b7f8
--- /dev/null
+++ b/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * dts file for Mediatek MT6765
+ *
+ * (C) Copyright 2018. Mediatek, Inc.
+ *
+ * Mars Cheng
+ */
+
+/dts-v1/;
+#include "mt6765.dtsi"
+
+/ {
+ model = "MediaTek MT6765 EVB";
+ compatible = "mediatek,mt6765-evb", "mediatek,mt6765";
+
+ aliases {
+ serial0 =
+ };
+
+ memory@4000 {
+ device_type = "memory";
+ reg = <0 0x4000 0 0x1e80>;
+ };
+
+ chosen {
+ stdout-path = "serial0:921600n8";
+ };
+};
+
+ {
+ status = "okay";
+};
diff --git a/arch/arm64/boot/dts/mediatek/mt6765.dtsi
b/arch/arm64/boot/dts/mediatek/mt6765.dtsi
new file mode 100644
index ..21683f3e1a3f
--- /dev/null
+++ b/arch/arm64/boot/dts/mediatek/mt6765.dtsi
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * dts file for Mediatek MT6765
+ *
+ * (C) Copyright 2018. Mediatek, Inc.
+ *
+ * Mars Cheng
+ */
+
+#include
+#include
+#include
+
+/ {
+ compatible = "mediatek,mt6765";
+ interrupt-parent = <>;
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+ };
+
+ cpus {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ cpu@0 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x000>;
+ };
+
+ cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x001>;
+ };
+
+ cpu@2 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x002>;
+ };
+
+ cpu@3 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x003>;
+ };
+
+ cpu@100 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x100>;
+ };
+
+ cpu@101 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x101>;
+ };
+
+ cpu@102 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x102>;
+ };
+
+ cpu@103 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci&qu
[PATCH v10 4/4] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks
From: Owen Chen Enable MT6765 clock configs, include topckgen, apmixedsys, infracfg, and subsystem clocks. Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin --- arch/arm64/configs/defconfig | 6 ++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig index d612f633b771..553137e81b8e 100644 --- a/arch/arm64/configs/defconfig +++ b/arch/arm64/configs/defconfig @@ -622,6 +622,12 @@ CONFIG_REGULATOR_RK808=y CONFIG_REGULATOR_S2MPS11=y CONFIG_REGULATOR_TPS65132=m CONFIG_REGULATOR_VCTRL=m +CONFIG_COMMON_CLK_MT6765_AUDIOSYS=y +CONFIG_COMMON_CLK_MT6765_CAMSYS=y +CONFIG_COMMON_CLK_MT6765_MMSYS=y +CONFIG_COMMON_CLK_MT6765_IMGSYS=y +CONFIG_COMMON_CLK_MT6765_VCODECSYS=y +CONFIG_COMMON_CLK_MT6765_MIPI0ASYS=y CONFIG_RC_CORE=m CONFIG_RC_DECODERS=y CONFIG_RC_DEVICES=y -- 2.18.0
Re: [PATCH v8 3/4] arm64: dts: mediatek: add mt6765 support
On Wed, 2021-03-10 at 00:08 +0800, Chun-Kuang Hu wrote:
> Hi, Macpaul:
>
> Macpaul Lin 於 2020年2月21日 週五 下午6:22寫道：
> >
> > From: Mars Cheng
> >
> > Add basic chip support for Mediatek 6765, include
> > uart node with correct uart clocks, pwrap device
> >
> > Add clock controller nodes, include topckgen, infracfg,
> > apmixedsys and subsystem.
> >
> > Signed-off-by: Mars Cheng
> > Signed-off-by: Owen Chen
> > Signed-off-by: Macpaul Lin
> > Acked-by: Marc Zyngier
> > ---
> > arch/arm64/boot/dts/mediatek/Makefile |1 +
> > arch/arm64/boot/dts/mediatek/mt6765-evb.dts | 33
> > arch/arm64/boot/dts/mediatek/mt6765.dtsi| 253
> > +++
> > 3 files changed, 287 insertions(+)
> > create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts
> > create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi
[deleted]
> > +
> > + mmsys_config: syscon@1400 {
> > + compatible = "mediatek,mt6765-mmsys", "syscon";
> > + reg = <0 0x1400 0 0x1000>;
> > + interrupts = ;
>
> I does not see interrupts property in binding document [1], please add
> this in binding document first.
> I'm curious about this interrupt. In which condition would it be triggered?
>
> [1]
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/devicetree/bindings/arm/mediatek/mediatek,mmsys.txt?h=v5.12-rc2
>
> Regards,
> Chun-Kuang.
Thanks for reminding.
I'll remove interrupts binding in next version and leave it for mmsys
driver owner to update when the configuration of mmsys driver is
enabled.
[...]
> > + smi_common: smi_common@14002000 {
> > + compatible = "mediatek,mt6765-smi-common", "syscon";
> > + reg = <0 0x14002000 0 0x1000>;
> > + };
> > +
@Yong Wu
Thanks for reviewing here, I'll replace smi_common@14002000 to
smi@14002000
Regards,
Macpaul Lin
[PATCH v9 3/4] arm64: dts: mediatek: add mt6765 support
From: Mars Cheng
Add basic chip support for Mediatek 6765, include
uart node with correct uart clocks, pwrap device
Add clock controller nodes, include topckgen, infracfg,
apmixedsys and subsystem.
Signed-off-by: Mars Cheng
Signed-off-by: Owen Chen
Signed-off-by: Macpaul Lin
Acked-by: Marc Zyngier
---
arch/arm64/boot/dts/mediatek/Makefile | 1 +
arch/arm64/boot/dts/mediatek/mt6765-evb.dts | 33 +++
arch/arm64/boot/dts/mediatek/mt6765.dtsi| 253
3 files changed, 287 insertions(+)
create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts
create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi
diff --git a/arch/arm64/boot/dts/mediatek/Makefile
b/arch/arm64/boot/dts/mediatek/Makefile
index deba27ab7657..176c817f9f9a 100644
--- a/arch/arm64/boot/dts/mediatek/Makefile
+++ b/arch/arm64/boot/dts/mediatek/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
dtb-$(CONFIG_ARCH_MEDIATEK) += mt2712-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6755-evb.dtb
+dtb-$(CONFIG_ARCH_MEDIATEK) += mt6765-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6779-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6795-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6797-evb.dtb
diff --git a/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
b/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
new file mode 100644
index ..36dddff2b7f8
--- /dev/null
+++ b/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * dts file for Mediatek MT6765
+ *
+ * (C) Copyright 2018. Mediatek, Inc.
+ *
+ * Mars Cheng
+ */
+
+/dts-v1/;
+#include "mt6765.dtsi"
+
+/ {
+ model = "MediaTek MT6765 EVB";
+ compatible = "mediatek,mt6765-evb", "mediatek,mt6765";
+
+ aliases {
+ serial0 =
+ };
+
+ memory@4000 {
+ device_type = "memory";
+ reg = <0 0x4000 0 0x1e80>;
+ };
+
+ chosen {
+ stdout-path = "serial0:921600n8";
+ };
+};
+
+ {
+ status = "okay";
+};
diff --git a/arch/arm64/boot/dts/mediatek/mt6765.dtsi
b/arch/arm64/boot/dts/mediatek/mt6765.dtsi
new file mode 100644
index ..2662470fe607
--- /dev/null
+++ b/arch/arm64/boot/dts/mediatek/mt6765.dtsi
@@ -0,0 +1,253 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * dts file for Mediatek MT6765
+ *
+ * (C) Copyright 2018. Mediatek, Inc.
+ *
+ * Mars Cheng
+ */
+
+#include
+#include
+#include
+
+/ {
+ compatible = "mediatek,mt6765";
+ interrupt-parent = <>;
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+ };
+
+ cpus {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ cpu@0 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x000>;
+ };
+
+ cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x001>;
+ };
+
+ cpu@2 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x002>;
+ };
+
+ cpu@3 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x003>;
+ };
+
+ cpu@100 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x100>;
+ };
+
+ cpu@101 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x101>;
+ };
+
+ cpu@102 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x102>;
+ };
+
+ cpu@103 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci&qu
[PATCH v9 2/4] soc: mediatek: add MT6765 scpsys and subdomain support
From: Mars Cheng
This adds scpsys support for MT6765
Add subdomain support for MT6765:
isp, mm, connsys, mfg, and cam.
Signed-off-by: Mars Cheng
Signed-off-by: Owen Chen
Signed-off-by: Macpaul Lin
---
drivers/soc/mediatek/mtk-scpsys.c | 91 +++
1 file changed, 91 insertions(+)
diff --git a/drivers/soc/mediatek/mtk-scpsys.c
b/drivers/soc/mediatek/mtk-scpsys.c
index ca75b14931ec..fc8d3858f1b4 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -15,6 +15,7 @@
#include
#include
+#include
#include
#include
#include
@@ -750,6 +751,81 @@ static const struct scp_subdomain scp_subdomain_mt2712[] =
{
{MT2712_POWER_DOMAIN_MFG_SC2, MT2712_POWER_DOMAIN_MFG_SC3},
};
+/*
+ * MT6765 power domain support
+ */
+#define SPM_PWR_STATUS_MT6765 0x0180
+#define SPM_PWR_STATUS_2ND_MT6765 0x0184
+
+static const struct scp_domain_data scp_domain_data_mt6765[] = {
+ [MT6765_POWER_DOMAIN_VCODEC] = {
+ .name = "vcodec",
+ .sta_mask = BIT(26),
+ .ctl_offs = 0x300,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+ [MT6765_POWER_DOMAIN_ISP] = {
+ .name = "isp",
+ .sta_mask = BIT(5),
+ .ctl_offs = 0x308,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+ [MT6765_POWER_DOMAIN_MM] = {
+ .name = "mm",
+ .sta_mask = BIT(3),
+ .ctl_offs = 0x30C,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ .clk_id = {CLK_MM},
+ },
+ [MT6765_POWER_DOMAIN_CONN] = {
+ .name = "conn",
+ .sta_mask = BIT(1),
+ .ctl_offs = 0x32C,
+ .sram_pdn_bits = 0,
+ .sram_pdn_ack_bits = 0,
+ },
+ [MT6765_POWER_DOMAIN_MFG_ASYNC] = {
+ .name = "mfg_async",
+ .sta_mask = BIT(23),
+ .ctl_offs = 0x334,
+ .sram_pdn_bits = 0,
+ .sram_pdn_ack_bits = 0,
+ .clk_id = {CLK_MFG},
+ },
+ [MT6765_POWER_DOMAIN_MFG] = {
+ .name = "mfg",
+ .sta_mask = BIT(4),
+ .ctl_offs = 0x338,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+ [MT6765_POWER_DOMAIN_CAM] = {
+ .name = "cam",
+ .sta_mask = BIT(25),
+ .ctl_offs = 0x344,
+ .sram_pdn_bits = GENMASK(9, 8),
+ .sram_pdn_ack_bits = GENMASK(13, 12),
+ },
+ [MT6765_POWER_DOMAIN_MFG_CORE0] = {
+ .name = "mfg_core0",
+ .sta_mask = BIT(7),
+ .ctl_offs = 0x34C,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+};
+
+static const struct scp_subdomain scp_subdomain_mt6765[] = {
+ {MT6765_POWER_DOMAIN_MM, MT6765_POWER_DOMAIN_CAM},
+ {MT6765_POWER_DOMAIN_MM, MT6765_POWER_DOMAIN_ISP},
+ {MT6765_POWER_DOMAIN_MM, MT6765_POWER_DOMAIN_VCODEC},
+ {MT6765_POWER_DOMAIN_MFG_ASYNC, MT6765_POWER_DOMAIN_MFG},
+ {MT6765_POWER_DOMAIN_MFG, MT6765_POWER_DOMAIN_MFG_CORE0},
+};
+
/*
* MT6797 power domain support
*/
@@ -1033,6 +1109,18 @@ static const struct scp_soc_data mt2712_data = {
.bus_prot_reg_update = false,
};
+static const struct scp_soc_data mt6765_data = {
+ .domains = scp_domain_data_mt6765,
+ .num_domains = ARRAY_SIZE(scp_domain_data_mt6765),
+ .subdomains = scp_subdomain_mt6765,
+ .num_subdomains = ARRAY_SIZE(scp_subdomain_mt6765),
+ .regs = {
+ .pwr_sta_offs = SPM_PWR_STATUS_MT6765,
+ .pwr_sta2nd_offs = SPM_PWR_STATUS_2ND_MT6765,
+ },
+ .bus_prot_reg_update = true,
+};
+
static const struct scp_soc_data mt6797_data = {
.domains = scp_domain_data_mt6797,
.num_domains = ARRAY_SIZE(scp_domain_data_mt6797),
@@ -1088,6 +1176,9 @@ static const struct of_device_id of_scpsys_match_tbl[] = {
}, {
.compatible = "mediatek,mt2712-scpsys",
.data = _data,
+ }, {
+ .compatible = "mediatek,mt6765-scpsys",
+ .data = _data,
}, {
.compatible = "mediatek,mt6797-scpsys",
.data = _data,
--
2.18.0
[PATCH v9 0/4] Add basic SoC support for mt6765
This patch adds basic SoC support for Mediatek's new 8-core SoC, MT6765, which is mainly for smartphone application. Changes in V9: 1. Origin V8 patchset: https://patchwork.kernel.org/cover/11396015/ [v9,1/4] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC - No Change. [v9,2/4] soc: mediatek: add MT6765 scpsys and subdomain support - Fix build error based on 5.11-rc1 because - bp_table has been deprecated. - basic_clk_id has been renamed to clk_id. - correct the number order in marco GENMASK(). Note: mediatek is working on porting mt6765's scpsys to driver "mtk-pm-domains", however we think supporting for "mtk-scpsys" is required before new glue is available. [v9,3/4] arm64: dts: mediatek: add mt6765 support - No Change. [v9,4/4] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks - No Change. Changes in V8: 1. Origin V7 patchset: https://patchwork.kernel.org/cover/11370105/ Split origin V7 patchset into 2 patchset, keep remain patches #2, #5, #6, and #7 in the same order as this V8 patchset. [v7,2/7] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC [v7,5/7] soc: mediatek: add MT6765 scpsys and subdomain support [v7,6/7] arm64: dts: mediatek: add mt6765 support [v7,7/7] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks Changes in V7: 1. Adapt V6's patchset to latest kernel tree 5.5-rc1. Origin V6 patchset: https://patchwork.kernel.org/cover/11041963/ 2. Correct 2 clock-controller type in documentation: mipi0 and venc_gcon. [v7 1/7] dt-bindings: clock: mediatek: document clk bindings 3. Remove V6's patch 03 because it has been taken into 5.5-next-soc [v6, 03/08] dt-bindings: mediatek: add MT6765 power dt-bindings 3. Update Reviewed-by: Rob Herring for [v6, 04/08] clk: mediatek: add mt6765 clock IDs --> [v7, 03/07] clk: mediatek: add mt6765 clock IDs 4. Update SPDX tag for [v6, 05/08] clk: mediatek: Add MT6765 clock support --> [v7, 04/07] clk: mediatek: Add MT6765 clock support Changes in V6: 1. Adapt V5's patchset to latest kernel tree. Origin V5 patchset. https://lore.kernel.org/patchwork/cover/963612/ 2. Due to clk's common code has been submit by other platform, this patch set will have dependencies with the following patchsets as the following orders. 2.a. [v8,00/21] MT8183 IOMMU SUPPORT https://patchwork.kernel.org/cover/11023585/ 2.b. [v11,0/6] Add basic node support for Mediatek MT8183 SoC https://patchwork.kernel.org/cover/10962385/ 2.c. [v6,00/14] Mediatek MT8183 scpsys support https://patchwork.kernel.org/cover/11005751/ 3. Correct power related patches into dt-binding patches. 4. Re-order V5's 4/11, 6/11, and 7/11 due clk common code change and make dependencies in order. 5. Update some commit message in clk related patches. Changes in V5: 1. add clk support Changes in V4: 1. add gic's settings in reg properties 2. remove some patches about dt-bindings since GKH already took them Changes in V3: 1. split dt-binding document patchs 2. fix mt6765.dtsi warnings with W=12 3. remove uncessary PPI affinity for timer 4. add gicc base for gic dt node Changes in V2: 1. fix clk properties in uart dts node 2. fix typo in submit title 3. add simple-bus in mt6765.dtsi 4. use correct SPDX license format Mars Cheng (3): dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC soc: mediatek: add MT6765 scpsys and subdomain support arm64: dts: mediatek: add mt6765 support Owen Chen (1): arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks .../memory-controllers/mediatek,smi-common.txt |1 + arch/arm64/boot/dts/mediatek/Makefile |1 + arch/arm64/boot/dts/mediatek/mt6765-evb.dts| 33 +++ arch/arm64/boot/dts/mediatek/mt6765.dtsi | 253 arch/arm64/configs/defconfig |6 + drivers/soc/mediatek/mtk-scpsys.c | 130 ++ 6 files changed, 424 insertions(+) create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi -- 1.7.9.5
[PATCH v9 4/4] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks
From: Owen Chen Enable MT6765 clock configs, include topckgen, apmixedsys, infracfg, and subsystem clocks. Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin --- arch/arm64/configs/defconfig | 6 ++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig index d612f633b771..553137e81b8e 100644 --- a/arch/arm64/configs/defconfig +++ b/arch/arm64/configs/defconfig @@ -622,6 +622,12 @@ CONFIG_REGULATOR_RK808=y CONFIG_REGULATOR_S2MPS11=y CONFIG_REGULATOR_TPS65132=m CONFIG_REGULATOR_VCTRL=m +CONFIG_COMMON_CLK_MT6765_AUDIOSYS=y +CONFIG_COMMON_CLK_MT6765_CAMSYS=y +CONFIG_COMMON_CLK_MT6765_MMSYS=y +CONFIG_COMMON_CLK_MT6765_IMGSYS=y +CONFIG_COMMON_CLK_MT6765_VCODECSYS=y +CONFIG_COMMON_CLK_MT6765_MIPI0ASYS=y CONFIG_RC_CORE=m CONFIG_RC_DECODERS=y CONFIG_RC_DEVICES=y -- 2.18.0
[PATCH v9 1/4] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC
From: Mars Cheng This patch adds MT6765 smi binding document Signed-off-by: Mars Cheng Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin Acked-by: Rob Herring --- .../bindings/memory-controllers/mediatek,smi-common.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml index a08a32340987..4a4f4377576f 100644 --- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml +++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml @@ -31,6 +31,7 @@ properties: - enum: - mediatek,mt2701-smi-common - mediatek,mt2712-smi-common + - mediatek,mt6765-smi-common - mediatek,mt6779-smi-common - mediatek,mt8167-smi-common - mediatek,mt8173-smi-common -- 2.18.0
[PATCH RESEND v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
From: Eddie Hung
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung
Signed-off-by: Macpaul Lin
Reviewed-by: Peter Chen
Cc: sta...@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 56051bb..d9743f4 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct
config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(>lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(>lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
1.7.9.5
Re: [PATCH v3] ALSA: usb-audio: disable 96khz support for HUAWEI USB-C HEADSET
On Tue, 2020-11-10 at 17:04 +0800, Macpaul Lin wrote: > The HUAWEI USB-C headset (VID:0x12d1, PID:0x3a07) reported it supports > 96khz. However there will be some random issue under 96khz. > Not sure if there is any alternate setting could be applied. > Hence 48khz is suggested to be applied at this moment. > > Signed-off-by: Macpaul Lin > Signed-off-by: Eddie Hung > Cc: sta...@vger.kernel.org > --- > Changes for v2: > - Fix build error. > - Add Cc: sta...@vger.kernel.org > Changes for v3: > - Replace "udev" with "chip->dev" according to Takashi's suggestion. Thanks. > > sound/usb/format.c |5 + > 1 file changed, 5 insertions(+) > > diff --git a/sound/usb/format.c b/sound/usb/format.c > index 1b28d01..0aff774 100644 > --- a/sound/usb/format.c > +++ b/sound/usb/format.c > @@ -217,6 +217,11 @@ static int parse_audio_format_rates_v1(struct > snd_usb_audio *chip, struct audiof > (chip->usb_id == USB_ID(0x041e, 0x4064) || >chip->usb_id == USB_ID(0x041e, 0x4068))) > rate = 8000; > + /* Huawei headset can't support 96kHz fully */ > + if (rate == 96000 && > + chip->usb_id == USB_ID(0x12d1, 0x3a07) && > + le16_to_cpu(chip->dev->descriptor.bcdDevice) == > 0x49) > + continue; > > fp->rate_table[fp->nr_rates] = rate; > if (!fp->rate_min || rate < fp->rate_min) Sorry for bothering again, please hold-on this patch. I'm still trying to clarify if there is another approach for this interoperability issue. I'll update this thread once the result has came out. Thanks Macpaul Lin
[PATCH v3] ALSA: usb-audio: disable 96khz support for HUAWEI USB-C HEADSET
The HUAWEI USB-C headset (VID:0x12d1, PID:0x3a07) reported it supports 96khz. However there will be some random issue under 96khz. Not sure if there is any alternate setting could be applied. Hence 48khz is suggested to be applied at this moment. Signed-off-by: Macpaul Lin Signed-off-by: Eddie Hung Cc: sta...@vger.kernel.org --- Changes for v2: - Fix build error. - Add Cc: sta...@vger.kernel.org Changes for v3: - Replace "udev" with "chip->dev" according to Takashi's suggestion. Thanks. sound/usb/format.c |5 + 1 file changed, 5 insertions(+) diff --git a/sound/usb/format.c b/sound/usb/format.c index 1b28d01..0aff774 100644 --- a/sound/usb/format.c +++ b/sound/usb/format.c @@ -217,6 +217,11 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof (chip->usb_id == USB_ID(0x041e, 0x4064) || chip->usb_id == USB_ID(0x041e, 0x4068))) rate = 8000; + /* Huawei headset can't support 96kHz fully */ + if (rate == 96000 && + chip->usb_id == USB_ID(0x12d1, 0x3a07) && + le16_to_cpu(chip->dev->descriptor.bcdDevice) == 0x49) + continue; fp->rate_table[fp->nr_rates] = rate; if (!fp->rate_min || rate < fp->rate_min) -- 1.7.9.5
Re: [PATCH v2] ALSA: usb-audio: disable 96khz support for HUAWEI USB-C HEADSET
On Tue, 2020-11-10 at 09:50 +0100, Greg KH wrote:
> On Tue, Nov 10, 2020 at 04:42:54PM +0800, Macpaul Lin wrote:
> > The HUAWEI USB-C headset (VID:0x12d1, PID:0x3a07) reported it supports
> > 96khz. However there will be some random issue under 96khz.
> > Not sure if there is any alternate setting could be applied.
> > Hence 48khz is suggested to be applied at this moment.
> >
> > Signed-off-by: Macpaul Lin
> > Signed-off-by: Eddie Hung
> > Cc: sta...@vger.kernel.org
> > ---
> > Changes for v2:
> > - Fix build error.
> > - Add Cc: sta...@vger.kernel.org
> >
> > sound/usb/format.c |6 ++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/sound/usb/format.c b/sound/usb/format.c
> > index 1b28d01..7a4837b 100644
> > --- a/sound/usb/format.c
> > +++ b/sound/usb/format.c
> > @@ -202,6 +202,7 @@ static int parse_audio_format_rates_v1(struct
> > snd_usb_audio *chip, struct audiof
> > fp->rate_min = fp->rate_max = 0;
> > for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
> > unsigned int rate = combine_triple([idx]);
> > + struct usb_device *udev = chip->dev;
> > if (!rate)
> > continue;
> > /* C-Media CM6501 mislabels its 96 kHz altsetting */
>
> Did you run this patch through checkpatch.pl?
>
I've ran checkpatch for this patch v2, and it shown
"total: 0 errors, 0 warnings". We're using 5.9-rc1 internal.
However, I'll send patch v3 according to Takashi's suggestion.
Thanks
Macpaul Lin
[PATCH v2] ALSA: usb-audio: disable 96khz support for HUAWEI USB-C HEADSET
The HUAWEI USB-C headset (VID:0x12d1, PID:0x3a07) reported it supports
96khz. However there will be some random issue under 96khz.
Not sure if there is any alternate setting could be applied.
Hence 48khz is suggested to be applied at this moment.
Signed-off-by: Macpaul Lin
Signed-off-by: Eddie Hung
Cc: sta...@vger.kernel.org
---
Changes for v2:
- Fix build error.
- Add Cc: sta...@vger.kernel.org
sound/usb/format.c |6 ++
1 file changed, 6 insertions(+)
diff --git a/sound/usb/format.c b/sound/usb/format.c
index 1b28d01..7a4837b 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -202,6 +202,7 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio
*chip, struct audiof
fp->rate_min = fp->rate_max = 0;
for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
unsigned int rate = combine_triple([idx]);
+ struct usb_device *udev = chip->dev;
if (!rate)
continue;
/* C-Media CM6501 mislabels its 96 kHz altsetting */
@@ -217,6 +218,11 @@ static int parse_audio_format_rates_v1(struct
snd_usb_audio *chip, struct audiof
(chip->usb_id == USB_ID(0x041e, 0x4064) ||
chip->usb_id == USB_ID(0x041e, 0x4068)))
rate = 8000;
+ /* Huawei headset can't support 96kHz fully */
+ if (rate == 96000 &&
+ chip->usb_id == USB_ID(0x12d1, 0x3a07) &&
+ le16_to_cpu(udev->descriptor.bcdDevice) == 0x49)
+ continue;
fp->rate_table[fp->nr_rates] = rate;
if (!fp->rate_min || rate < fp->rate_min)
--
1.7.9.5
Re: [PATCH] ALSA: usb-audio: disable 96khz support for HUAWEI USB-C HEADSET
On Tue, 2020-11-10 at 09:12 +0100, Takashi Iwai wrote: > On Tue, 10 Nov 2020 09:04:03 +0100, > Macpaul Lin wrote: > > > > The HUAWEI USB-C headset (VID:0x12d1, PID:0x3a07) reported it supports > > 96khz. However there will be some random issue under 96khz. > > Not sure if there is any alternate setting could be applied. > > Hence 48khz is suggested to be applied at this moment. > > > > Signed-off-by: Macpaul Lin > > Signed-off-by: Eddie Hung > > --- > > sound/usb/format.c |5 + > > 1 file changed, 5 insertions(+) > > > > diff --git a/sound/usb/format.c b/sound/usb/format.c > > index 1b28d01..6f6e79b 100644 > > --- a/sound/usb/format.c > > +++ b/sound/usb/format.c > > @@ -217,6 +217,11 @@ static int parse_audio_format_rates_v1(struct > > snd_usb_audio *chip, struct audiof > > (chip->usb_id == USB_ID(0x041e, 0x4064) || > > chip->usb_id == USB_ID(0x041e, 0x4068))) > > rate = 8000; > > + /* Huawei headset can't support 96kHz fully */ > > + if (rate == 96000 && > > + chip->usb_id == USB_ID(0x12d1, 0x3a07) && > > + le16_to_cpu(udev->descriptor.bcdDevice) == 0x49) > > This causes the compile error due to the unknown udev. > Is this bcdDevice check mandatory? This means firmware version of the headset as far as I know.. Sorry I'll check the compile error and resend later. > > thanks, > > Takashi Thanks Macpaul Lin
[PATCH] ALSA: usb-audio: disable 96khz support for HUAWEI USB-C HEADSET
The HUAWEI USB-C headset (VID:0x12d1, PID:0x3a07) reported it supports 96khz. However there will be some random issue under 96khz. Not sure if there is any alternate setting could be applied. Hence 48khz is suggested to be applied at this moment. Signed-off-by: Macpaul Lin Signed-off-by: Eddie Hung --- sound/usb/format.c |5 + 1 file changed, 5 insertions(+) diff --git a/sound/usb/format.c b/sound/usb/format.c index 1b28d01..6f6e79b 100644 --- a/sound/usb/format.c +++ b/sound/usb/format.c @@ -217,6 +217,11 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof (chip->usb_id == USB_ID(0x041e, 0x4064) || chip->usb_id == USB_ID(0x041e, 0x4068))) rate = 8000; + /* Huawei headset can't support 96kHz fully */ + if (rate == 96000 && + chip->usb_id == USB_ID(0x12d1, 0x3a07) && + le16_to_cpu(udev->descriptor.bcdDevice) == 0x49) + continue; fp->rate_table[fp->nr_rates] = rate; if (!fp->rate_min || rate < fp->rate_min) -- 1.7.9.5
[PATCH v3 2/2] usb: host: XHCI: xhci-mtk.c: support mediatek,str-clock-on
Some platform dose not support turn off clock when system suspending.
We add an option "mediatek,str-clock-on" for distinquish these platforms.
When "mediatek,str-clock-on" has been set, xhci-mtk driver will skip
turning clock on and off during system suspend and resume.
Fixes: 0cbd4b34cda9 ("xhci: mediatek: support MTK xHCI host controller")
Signed-off-by: Macpaul Lin
Cc: sta...@vger.kernel.org
---
Changes for v3:
- Add "Fixes" tag as a bug fix on phone system.
Changes for v2:
- Replace "mediatek,keep-clock-on" to "mediatek,str-clock-on" which implies
this option related to STR functions.
drivers/usb/host/xhci-mtk.c |9 +++--
drivers/usb/host/xhci-mtk.h |1 +
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 4311d4c..77b0d7a 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -464,6 +464,9 @@ static int xhci_mtk_probe(struct platform_device *pdev)
of_property_read_u32(node, "mediatek,u3p-dis-msk",
>u3p_dis_msk);
+ /* STR: keep clock on when suspending on some platform */
+ mtk->str_clk_on = of_property_read_bool(node, "mediatek,str-clock-on");
+
ret = usb_wakeup_of_property_parse(mtk, node);
if (ret) {
dev_err(dev, "failed to parse uwk property\n");
@@ -624,7 +627,8 @@ static int __maybe_unused xhci_mtk_suspend(struct device
*dev)
del_timer_sync(>shared_hcd->rh_timer);
xhci_mtk_host_disable(mtk);
- xhci_mtk_clks_disable(mtk);
+ if (!mtk->str_clk_on)
+ xhci_mtk_clks_disable(mtk);
usb_wakeup_set(mtk, true);
return 0;
}
@@ -636,7 +640,8 @@ static int __maybe_unused xhci_mtk_resume(struct device
*dev)
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
usb_wakeup_set(mtk, false);
- xhci_mtk_clks_enable(mtk);
+ if (!mtk->str_clk_on)
+ xhci_mtk_clks_enable(mtk);
xhci_mtk_host_enable(mtk);
xhci_dbg(xhci, "%s: restart port polling\n", __func__);
diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h
index a93cfe8..4039b025 100644
--- a/drivers/usb/host/xhci-mtk.h
+++ b/drivers/usb/host/xhci-mtk.h
@@ -152,6 +152,7 @@ struct xhci_hcd_mtk {
struct regmap *uwk;
u32 uwk_reg_base;
u32 uwk_vers;
+ bool str_clk_on;
};
static inline struct xhci_hcd_mtk *hcd_to_mtk(struct usb_hcd *hcd)
--
1.7.9.5
[PATCH v3 1/2] dt-bindings: usb: mediatek,mtk-xhci: add str-clock-on
Option "mediatek,str-clock-on" means to keep clock on during system
suspend and resume. Some platform will flush register settings if clock has
been disabled when system is suspended. Set this option to avoid clock off.
Fixes: 0cbd4b34cda9 ("xhci: mediatek: support MTK xHCI host controller")
Signed-off-by: Macpaul Lin
Cc: sta...@vger.kernel.org
---
Changes for v3:
- Remove unnecessary Change-Id in commit message.
- Add "Fixes" tag as a bug fix on phone system.
Changes for v2:
- Rename "mediatek,keep-clock-on" to "mediatek,str-clock-on" which implies
this option related to STR functions.
- After discussion with Chunfeng, resend dt-bindings descritption based on
mediatek,mtk-xhci.txt instead of yaml format.
.../devicetree/bindings/usb/mediatek,mtk-xhci.txt |3 +++
1 file changed, 3 insertions(+)
diff --git a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt
b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt
index 42d8814..fc93bcf 100644
--- a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt
+++ b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt
@@ -37,6 +37,9 @@ Required properties:
Optional properties:
- wakeup-source : enable USB remote wakeup;
+ - mediatek,str-clock-on: Keep clock on during system suspend and resume.
+ Some platform will flush register settings if clock has been disabled
+ when system is suspended.
- mediatek,syscon-wakeup : phandle to syscon used to access the register
of the USB wakeup glue layer between xHCI and SPM; it depends on
"wakeup-source", and has two arguments:
--
1.7.9.5
Re: [PATCH v2 1/2] dt-bindings: usb: mediatek,mtk-xhci: add str-clock-on
On Fri, 2020-11-06 at 17:46 +0800, Macpaul Lin wrote: > Option "mediatek,str-clock-on" means to keep clock on during system > suspend and resume. Some platform will flush register settings if clock has > been disabled when system is suspended. Set this option to avoid clock off. > > Change-Id: Id841f58e9d7fb3656511072b3eb14d0d355e2dd5 Sorry I've found a Change-ID tag here, I'll send patch v3. > Signed-off-by: Macpaul Lin > --- > Changes for v2: > - Rename "mediatek,keep-clock-on" to "mediatek,str-clock-on" which implies > this option related to STR functions. > - After discussion with Chunfeng, resend dt-bindings descritption based on > mediatek,mtk-xhci.txt instead of yaml format. > > .../devicetree/bindings/usb/mediatek,mtk-xhci.txt |3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt > b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt > index 42d8814..fc93bcf 100644 > --- a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt > +++ b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt > @@ -37,6 +37,9 @@ Required properties: > > Optional properties: > - wakeup-source : enable USB remote wakeup; > + - mediatek,str-clock-on: Keep clock on during system suspend and resume. > + Some platform will flush register settings if clock has been disabled > + when system is suspended. > - mediatek,syscon-wakeup : phandle to syscon used to access the register > of the USB wakeup glue layer between xHCI and SPM; it depends on > "wakeup-source", and has two arguments: Thanks Macpaul Lin
[PATCH v2 2/2] usb: host: XHCI: xhci-mtk.c: support mediatek,str-clock-on
Some platform dose not support turn off clock when system suspending.
We add an option "mediatek,str-clock-on" for distinquish these platforms.
When "mediatek,str-clock-on" has been set, xhci-mtk driver will skip
turning clock on and off during system suspend and resume.
Signed-off-by: Macpaul Lin
---
Changes for v2:
- Replace "mediatek,keep-clock-on" to "mediatek,str-clock-on" which implies
this option related to STR functions.
drivers/usb/host/xhci-mtk.c |9 +++--
drivers/usb/host/xhci-mtk.h |1 +
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 4311d4c..77b0d7a 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -464,6 +464,9 @@ static int xhci_mtk_probe(struct platform_device *pdev)
of_property_read_u32(node, "mediatek,u3p-dis-msk",
>u3p_dis_msk);
+ /* STR: keep clock on when suspending on some platform */
+ mtk->str_clk_on = of_property_read_bool(node, "mediatek,str-clock-on");
+
ret = usb_wakeup_of_property_parse(mtk, node);
if (ret) {
dev_err(dev, "failed to parse uwk property\n");
@@ -624,7 +627,8 @@ static int __maybe_unused xhci_mtk_suspend(struct device
*dev)
del_timer_sync(>shared_hcd->rh_timer);
xhci_mtk_host_disable(mtk);
- xhci_mtk_clks_disable(mtk);
+ if (!mtk->str_clk_on)
+ xhci_mtk_clks_disable(mtk);
usb_wakeup_set(mtk, true);
return 0;
}
@@ -636,7 +640,8 @@ static int __maybe_unused xhci_mtk_resume(struct device
*dev)
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
usb_wakeup_set(mtk, false);
- xhci_mtk_clks_enable(mtk);
+ if (!mtk->str_clk_on)
+ xhci_mtk_clks_enable(mtk);
xhci_mtk_host_enable(mtk);
xhci_dbg(xhci, "%s: restart port polling\n", __func__);
diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h
index a93cfe8..4039b025 100644
--- a/drivers/usb/host/xhci-mtk.h
+++ b/drivers/usb/host/xhci-mtk.h
@@ -152,6 +152,7 @@ struct xhci_hcd_mtk {
struct regmap *uwk;
u32 uwk_reg_base;
u32 uwk_vers;
+ bool str_clk_on;
};
static inline struct xhci_hcd_mtk *hcd_to_mtk(struct usb_hcd *hcd)
--
1.7.9.5
[PATCH v2 1/2] dt-bindings: usb: mediatek,mtk-xhci: add str-clock-on
Option "mediatek,str-clock-on" means to keep clock on during system suspend and resume. Some platform will flush register settings if clock has been disabled when system is suspended. Set this option to avoid clock off. Change-Id: Id841f58e9d7fb3656511072b3eb14d0d355e2dd5 Signed-off-by: Macpaul Lin --- Changes for v2: - Rename "mediatek,keep-clock-on" to "mediatek,str-clock-on" which implies this option related to STR functions. - After discussion with Chunfeng, resend dt-bindings descritption based on mediatek,mtk-xhci.txt instead of yaml format. .../devicetree/bindings/usb/mediatek,mtk-xhci.txt |3 +++ 1 file changed, 3 insertions(+) diff --git a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt index 42d8814..fc93bcf 100644 --- a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt +++ b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt @@ -37,6 +37,9 @@ Required properties: Optional properties: - wakeup-source : enable USB remote wakeup; + - mediatek,str-clock-on: Keep clock on during system suspend and resume. + Some platform will flush register settings if clock has been disabled + when system is suspended. - mediatek,syscon-wakeup : phandle to syscon used to access the register of the USB wakeup glue layer between xHCI and SPM; it depends on "wakeup-source", and has two arguments: -- 1.7.9.5
Re: [PATCH 1/2] dt-bindings: usb: mediatek,mtk-xhci: add keep-clock-on
On Wed, 2020-11-04 at 16:39 -0600, Rob Herring wrote: > On Mon, Nov 02, 2020 at 03:18:48PM +0800, Macpaul Lin wrote: > > Option "mediatek,keep-clock-on" means to keep clock on during system > > suspend and resume. Some platform will flush register settings if clock has > > been disabled when system is suspended. Set this option to avoid clock off. > > > > Signed-off-by: Macpaul Lin > > --- > > .../devicetree/bindings/usb/mediatek,mtk-xhci.yaml |7 +++ > > 1 file changed, 7 insertions(+) > > > > diff --git a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml > > b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml > > index ea696c8..a956dde 100644 > > --- a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml > > +++ b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml > > @@ -104,6 +104,12 @@ properties: > > description: enable USB remote wakeup, see power/wakeup-source.txt > > type: boolean > > > > + mediatek,keep-clock-on: > > +description: | > > + Keep clock on during system suspend and resume. Some platform will > > flush > > + register settings if clock has been disabled when system is > > suspended. > > +type: boolean > > + > > This should be implied by the compatible string. This should be an property according to system-wide design. Mtk-xhci may be applied to different product lines for the same platform (IC). Suspend on phone system is different to tablet or laptop. Phone's power management module will turn off XHCI's power once the clock has been turned off. For example, the headset plugged into phone won't do disconnect and re-enumeration during system suspend. Click a button on the headset to wake-up phone is necessary, and then, XHCI needs ready to work immediately. If the IC has been applied to a tablet or laptop product. When system is suspending, the headset will be disconnected. The headset will do re-enumerate when system is waking up. In this kind of applications, the power of XHCI can be turned off with clock. > >mediatek,syscon-wakeup: > > $ref: /schemas/types.yaml#/definitions/phandle-array > > maxItems: 1 > > @@ -175,6 +181,7 @@ examples: > > imod-interval-ns = <1>; > > mediatek,syscon-wakeup = < 0x400 1>; > > wakeup-source; > > +mediatek,keep-clock-on; > > usb3-lpm-capable; > > }; > > ... > > -- > > 1.7.9.5 After a discussion with Chunfeng, I'll send a new version for Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.txt because the YAML file still need to be revised. The property "mediatek,keep-clock-on" will be renamed to "mediatek,str-clock-on" for implying it relates to suspend/resume capability. Thanks. Macpaul Lin
[RESEND PATCH v4] usb: mtu3: fix panic in mtu3_gadget_stop()
This patch fixes a possible issue when mtu3_gadget_stop()
already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().
[] notifier_call_chain+0xa4/0x128
[] __atomic_notifier_call_chain+0x84/0x138
[] notify_die+0xb0/0x120
[] die+0x1f8/0x5d0
[] __do_kernel_fault+0x19c/0x280
[] do_bad_area+0x44/0x140
[] do_translation_fault+0x4c/0x90
[] do_mem_abort+0xb8/0x258
[] el1_da+0x24/0x3c
[] mtu3_gadget_disconnect+0xac/0x128
[] mtu3_irq+0x34c/0xc18
[] __handle_irq_event_percpu+0x2ac/0xcd0
[] handle_irq_event_percpu+0x80/0x138
[] handle_irq_event+0xac/0x148
[] handle_fasteoi_irq+0x234/0x568
[] generic_handle_irq+0x48/0x68
[] __handle_domain_irq+0x264/0x1740
[] gic_handle_irq+0x14c/0x250
[] el1_irq+0xec/0x194
[] dma_pool_alloc+0x6e4/0xae0
[] cmdq_mbox_pool_alloc_impl+0xb0/0x238
[] cmdq_pkt_alloc_buf+0x2dc/0x7c0
[] cmdq_pkt_add_cmd_buffer+0x178/0x270
[] cmdq_pkt_perf_begin+0x108/0x148
[] cmdq_pkt_create+0x178/0x1f0
[] mtk_crtc_config_default_path+0x328/0x7a0
[] mtk_drm_idlemgr_kick+0xa6c/0x1460
[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
[] drm_atomic_helper_commit_planes+0x154/0x878
[] mtk_atomic_complete.isra.16+0xe80/0x19c8
[] mtk_atomic_commit+0x258/0x898
[] drm_atomic_commit+0xcc/0x108
[] drm_mode_atomic_ioctl+0x1c20/0x2580
[] drm_ioctl_kernel+0x118/0x1b0
[] drm_ioctl+0x5c0/0x920
[] do_vfs_ioctl+0x188/0x1820
[] SyS_ioctl+0x8c/0xa0
Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
Signed-off-by: Macpaul Lin
Acked-by: Chunfeng Yun
Cc: sta...@vger.kernel.org
---
RESEND for v4:
- Resend this patch by plain-text instead of MTK IT's default (base64)
outgoing SMTP settings.
- Add Acked-by: Chunfeng Yun
Changes for v4:
- Add a "Fixes:" line. Thanks Felipe.
Changes for v3:
- Call synchronize_irq() in mtu3_gadget_stop() instead of remembering
callback function in mtu3_gadget_disconnect().
Thanks for Alan's suggestion.
Changes for v2:
- Check mtu_gadget_driver out of spin_lock might still not work.
We use a temporary pointer to remember the callback function.
drivers/usb/mtu3/mtu3_gadget.c |1 +
1 file changed, 1 insertions(+)
diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
index 1de5c9a..1ab3d3a 100644
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -564,6 +564,7 @@ static int mtu3_gadget_stop(struct usb_gadget *g)
spin_unlock_irqrestore(>lock, flags);
+ synchronize_irq(mtu->irq);
return 0;
}
--
1.7.9.5
[PATCH 2/2] usb: host: XHCI: xhci-mtk.c: support mediatek,keep-clock-on
Some platform dose not support turn off clock when system suspending.
We add an option "mediatek,keep-clock-on" for distinquish these platforms.
When "mediatek,keep-clock-on" has been set, xhci-mtk driver will skip
turning clock on and off during system suspend and resume.
Signed-off-by: Macpaul Lin
---
drivers/usb/host/xhci-mtk.c |9 +++--
drivers/usb/host/xhci-mtk.h |1 +
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 4311d4c..c6c2804 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -464,6 +464,9 @@ static int xhci_mtk_probe(struct platform_device *pdev)
of_property_read_u32(node, "mediatek,u3p-dis-msk",
>u3p_dis_msk);
+ /* keep clock on when suspending on some platform */
+ mtk->keep_clk_on = of_property_read_bool(node,
"mediatek,keep-clock-on");
+
ret = usb_wakeup_of_property_parse(mtk, node);
if (ret) {
dev_err(dev, "failed to parse uwk property\n");
@@ -624,7 +627,8 @@ static int __maybe_unused xhci_mtk_suspend(struct device
*dev)
del_timer_sync(>shared_hcd->rh_timer);
xhci_mtk_host_disable(mtk);
- xhci_mtk_clks_disable(mtk);
+ if (!mtk->keep_clk_on)
+ xhci_mtk_clks_disable(mtk);
usb_wakeup_set(mtk, true);
return 0;
}
@@ -636,7 +640,8 @@ static int __maybe_unused xhci_mtk_resume(struct device
*dev)
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
usb_wakeup_set(mtk, false);
- xhci_mtk_clks_enable(mtk);
+ if (!mtk->keep_clk_on)
+ xhci_mtk_clks_enable(mtk);
xhci_mtk_host_enable(mtk);
xhci_dbg(xhci, "%s: restart port polling\n", __func__);
diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h
index a93cfe8..37639c5 100644
--- a/drivers/usb/host/xhci-mtk.h
+++ b/drivers/usb/host/xhci-mtk.h
@@ -152,6 +152,7 @@ struct xhci_hcd_mtk {
struct regmap *uwk;
u32 uwk_reg_base;
u32 uwk_vers;
+ bool keep_clk_on;
};
static inline struct xhci_hcd_mtk *hcd_to_mtk(struct usb_hcd *hcd)
--
1.7.9.5
[PATCH 1/2] dt-bindings: usb: mediatek,mtk-xhci: add keep-clock-on
Option "mediatek,keep-clock-on" means to keep clock on during system suspend and resume. Some platform will flush register settings if clock has been disabled when system is suspended. Set this option to avoid clock off. Signed-off-by: Macpaul Lin --- .../devicetree/bindings/usb/mediatek,mtk-xhci.yaml |7 +++ 1 file changed, 7 insertions(+) diff --git a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml index ea696c8..a956dde 100644 --- a/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml +++ b/Documentation/devicetree/bindings/usb/mediatek,mtk-xhci.yaml @@ -104,6 +104,12 @@ properties: description: enable USB remote wakeup, see power/wakeup-source.txt type: boolean + mediatek,keep-clock-on: +description: | + Keep clock on during system suspend and resume. Some platform will flush + register settings if clock has been disabled when system is suspended. +type: boolean + mediatek,syscon-wakeup: $ref: /schemas/types.yaml#/definitions/phandle-array maxItems: 1 @@ -175,6 +181,7 @@ examples: imod-interval-ns = <1>; mediatek,syscon-wakeup = < 0x400 1>; wakeup-source; +mediatek,keep-clock-on; usb3-lpm-capable; }; ... -- 1.7.9.5
[RESEND PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
From: Eddie Hung
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung
Signed-off-by: Macpaul Lin
Reviewed-by: Peter Chen
Cc: sta...@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index cbff3b02840d..8501b27f3c95 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -230,9 +230,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct
config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(>lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(>lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.26.2
Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
On Thu, 2020-10-29 at 01:55 +0800, Macpaul Lin wrote:
> From: Eddie Hung
>
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung
> Signed-off-by: Macpaul Lin
> Reviewed-by: Peter Chen
> Cc: sta...@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 56051bb..d9743f4 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct
> config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(>lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(>lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
Sorry, it looks like still a base64 encoded mail.
I'll feedback to our IT department again.
Please ignore this mail.
Thanks
Macpaul Lin
[PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
From: Eddie Hung
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung
Signed-off-by: Macpaul Lin
Reviewed-by: Peter Chen
Cc: sta...@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 56051bb..d9743f4 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct
config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(>lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(>lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
1.7.9.5
Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote:
> From: Eddie Hung
> There is a use-after-free issue, if access udc_name
> in function gadget_dev_desc_UDC_store after another context
> free udc_name in function unregister_gadget.
>
> Context 1:
> gadget_dev_desc_UDC_store()->unregister_gadget()->
> free udc_name->set udc_name to NULL
>
> Context 2:
> gadget_dev_desc_UDC_show()-> access udc_name
>
> Call trace:
> dump_backtrace+0x0/0x340
> show_stack+0x14/0x1c
> dump_stack+0xe4/0x134
> print_address_description+0x78/0x478
> __kasan_report+0x270/0x2ec
> kasan_report+0x10/0x18
> __asan_report_load1_noabort+0x18/0x20
> string+0xf4/0x138
> vsnprintf+0x428/0x14d0
> sprintf+0xe4/0x12c
> gadget_dev_desc_UDC_show+0x54/0x64
> configfs_read_file+0x210/0x3a0
> __vfs_read+0xf0/0x49c
> vfs_read+0x130/0x2b4
> SyS_read+0x114/0x208
> el0_svc_naked+0x34/0x38
>
> Add mutex_lock to protect this kind of scenario.
>
> Signed-off-by: Eddie Hung
> Signed-off-by: Macpaul Lin
> Reviewed-by: Peter Chen
> Cc: sta...@vger.kernel.org
> ---
> Changes for v2:
> - Fix typo %s/contex/context, Thanks Peter.
>
> drivers/usb/gadget/configfs.c | 11 +--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index 9dc06a4e1b30..21110b2865b9 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct
> config_item *item,
>
> static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
> {
> - char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
> + struct gadget_info *gi = to_gadget_info(item);
> + char *udc_name;
> + int ret;
> +
> + mutex_lock(>lock);
> + udc_name = gi->composite.gadget_driver.udc_name;
> + ret = sprintf(page, "%s\n", udc_name ?: "");
> + mutex_unlock(>lock);
>
> - return sprintf(page, "%s\n", udc_name ?: "");
> + return ret;
> }
>
> static int unregister_gadget(struct gadget_info *gi)
Just want to remind we have a fix here for usb/gadget/configfs.c.
If the patch need to be further revised, please let us know.
Thanks!
Macpaul Lin
[PATCH v4] usb: mtu3: fix panic in mtu3_gadget_stop()
This patch fixes a possible issue when mtu3_gadget_stop()
already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().
[] notifier_call_chain+0xa4/0x128
[] __atomic_notifier_call_chain+0x84/0x138
[] notify_die+0xb0/0x120
[] die+0x1f8/0x5d0
[] __do_kernel_fault+0x19c/0x280
[] do_bad_area+0x44/0x140
[] do_translation_fault+0x4c/0x90
[] do_mem_abort+0xb8/0x258
[] el1_da+0x24/0x3c
[] mtu3_gadget_disconnect+0xac/0x128
[] mtu3_irq+0x34c/0xc18
[] __handle_irq_event_percpu+0x2ac/0xcd0
[] handle_irq_event_percpu+0x80/0x138
[] handle_irq_event+0xac/0x148
[] handle_fasteoi_irq+0x234/0x568
[] generic_handle_irq+0x48/0x68
[] __handle_domain_irq+0x264/0x1740
[] gic_handle_irq+0x14c/0x250
[] el1_irq+0xec/0x194
[] dma_pool_alloc+0x6e4/0xae0
[] cmdq_mbox_pool_alloc_impl+0xb0/0x238
[] cmdq_pkt_alloc_buf+0x2dc/0x7c0
[] cmdq_pkt_add_cmd_buffer+0x178/0x270
[] cmdq_pkt_perf_begin+0x108/0x148
[] cmdq_pkt_create+0x178/0x1f0
[] mtk_crtc_config_default_path+0x328/0x7a0
[] mtk_drm_idlemgr_kick+0xa6c/0x1460
[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
[] drm_atomic_helper_commit_planes+0x154/0x878
[] mtk_atomic_complete.isra.16+0xe80/0x19c8
[] mtk_atomic_commit+0x258/0x898
[] drm_atomic_commit+0xcc/0x108
[] drm_mode_atomic_ioctl+0x1c20/0x2580
[] drm_ioctl_kernel+0x118/0x1b0
[] drm_ioctl+0x5c0/0x920
[] do_vfs_ioctl+0x188/0x1820
[] SyS_ioctl+0x8c/0xa0
Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
Signed-off-by: Macpaul Lin
Cc: sta...@vger.kernel.org
---
Changes for v4:
- Add a "Fixes:" line. Thanks Felipe.
Changes for v3:
- Call synchronize_irq() in mtu3_gadget_stop() instead of remembering
callback function in mtu3_gadget_disconnect().
Thanks for Alan's suggestion.
Changes for v2:
- Check mtu_gadget_driver out of spin_lock might still not work.
We use a temporary pointer to remember the callback function.
drivers/usb/mtu3/mtu3_gadget.c |1 +
1 file changed, 1 insertions(+)
diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
index 1de5c9a..1ab3d3a 100644
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -564,6 +564,7 @@ static int mtu3_gadget_stop(struct usb_gadget *g)
spin_unlock_irqrestore(>lock, flags);
+ synchronize_irq(mtu->irq);
return 0;
}
--
1.7.9.5
[PATCH v3] usb: mtu3: fix panic in mtu3_gadget_stop()
This patch fixes a possible issue when mtu3_gadget_stop() already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect(). [] notifier_call_chain+0xa4/0x128 [] __atomic_notifier_call_chain+0x84/0x138 [] notify_die+0xb0/0x120 [] die+0x1f8/0x5d0 [] __do_kernel_fault+0x19c/0x280 [] do_bad_area+0x44/0x140 [] do_translation_fault+0x4c/0x90 [] do_mem_abort+0xb8/0x258 [] el1_da+0x24/0x3c [] mtu3_gadget_disconnect+0xac/0x128 [] mtu3_irq+0x34c/0xc18 [] __handle_irq_event_percpu+0x2ac/0xcd0 [] handle_irq_event_percpu+0x80/0x138 [] handle_irq_event+0xac/0x148 [] handle_fasteoi_irq+0x234/0x568 [] generic_handle_irq+0x48/0x68 [] __handle_domain_irq+0x264/0x1740 [] gic_handle_irq+0x14c/0x250 [] el1_irq+0xec/0x194 [] dma_pool_alloc+0x6e4/0xae0 [] cmdq_mbox_pool_alloc_impl+0xb0/0x238 [] cmdq_pkt_alloc_buf+0x2dc/0x7c0 [] cmdq_pkt_add_cmd_buffer+0x178/0x270 [] cmdq_pkt_perf_begin+0x108/0x148 [] cmdq_pkt_create+0x178/0x1f0 [] mtk_crtc_config_default_path+0x328/0x7a0 [] mtk_drm_idlemgr_kick+0xa6c/0x1460 [] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68 [] drm_atomic_helper_commit_planes+0x154/0x878 [] mtk_atomic_complete.isra.16+0xe80/0x19c8 [] mtk_atomic_commit+0x258/0x898 [] drm_atomic_commit+0xcc/0x108 [] drm_mode_atomic_ioctl+0x1c20/0x2580 [] drm_ioctl_kernel+0x118/0x1b0 [] drm_ioctl+0x5c0/0x920 [] do_vfs_ioctl+0x188/0x1820 [] SyS_ioctl+0x8c/0xa0 Signed-off-by: Macpaul Lin Cc: sta...@vger.kernel.org --- Changes for v3: - Call synchronize_irq() in mtu3_gadget_stop() instead of remembering callback function in mtu3_gadget_disconnect(). Thanks for Alan's suggestion. Changes for v2: - Check mtu_gadget_driver out of spin_lock might still not work. We use a temporary pointer to remember the callback function. drivers/usb/mtu3/mtu3_gadget.c |1 + 1 file changed, 1 insertions(+) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index 1de5c9a..1ab3d3a 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -564,6 +564,7 @@ static int mtu3_gadget_stop(struct usb_gadget *g) spin_unlock_irqrestore(>lock, flags); + synchronize_irq(mtu->irq); return 0; } -- 1.7.9.5
[PATCH v2] usb: mtu3: fix panic in mtu3_gadget_disconnect()
This patch fixes a possible issue when mtu3_gadget_stop()
already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().
[] notifier_call_chain+0xa4/0x128
[] __atomic_notifier_call_chain+0x84/0x138
[] notify_die+0xb0/0x120
[] die+0x1f8/0x5d0
[] __do_kernel_fault+0x19c/0x280
[] do_bad_area+0x44/0x140
[] do_translation_fault+0x4c/0x90
[] do_mem_abort+0xb8/0x258
[] el1_da+0x24/0x3c
[] mtu3_gadget_disconnect+0xac/0x128
[] mtu3_irq+0x34c/0xc18
[] __handle_irq_event_percpu+0x2ac/0xcd0
[] handle_irq_event_percpu+0x80/0x138
[] handle_irq_event+0xac/0x148
[] handle_fasteoi_irq+0x234/0x568
[] generic_handle_irq+0x48/0x68
[] __handle_domain_irq+0x264/0x1740
[] gic_handle_irq+0x14c/0x250
[] el1_irq+0xec/0x194
[] dma_pool_alloc+0x6e4/0xae0
[] cmdq_mbox_pool_alloc_impl+0xb0/0x238
[] cmdq_pkt_alloc_buf+0x2dc/0x7c0
[] cmdq_pkt_add_cmd_buffer+0x178/0x270
[] cmdq_pkt_perf_begin+0x108/0x148
[] cmdq_pkt_create+0x178/0x1f0
[] mtk_crtc_config_default_path+0x328/0x7a0
[] mtk_drm_idlemgr_kick+0xa6c/0x1460
[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
[] drm_atomic_helper_commit_planes+0x154/0x878
[] mtk_atomic_complete.isra.16+0xe80/0x19c8
[] mtk_atomic_commit+0x258/0x898
[] drm_atomic_commit+0xcc/0x108
[] drm_mode_atomic_ioctl+0x1c20/0x2580
[] drm_ioctl_kernel+0x118/0x1b0
[] drm_ioctl+0x5c0/0x920
[] do_vfs_ioctl+0x188/0x1820
[] SyS_ioctl+0x8c/0xa0
Signed-off-by: Macpaul Lin
Cc: sta...@vger.kernel.org
---
Changes for v2:
- Check mtu_gadget_driver out of spin_lock might still not work.
We use a temporary pointer to keep the callback function.
drivers/usb/mtu3/mtu3_gadget.c | 9 -
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
index 68ea4395f871..40cb6626f496 100644
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -840,10 +840,17 @@ void mtu3_gadget_suspend(struct mtu3 *mtu)
/* called when VBUS drops below session threshold, and in other cases */
void mtu3_gadget_disconnect(struct mtu3 *mtu)
{
+ struct usb_gadget_driver *driver;
+
dev_dbg(mtu->dev, "gadget DISCONNECT\n");
if (mtu->gadget_driver && mtu->gadget_driver->disconnect) {
+ driver = mtu->gadget_driver;
spin_unlock(>lock);
- mtu->gadget_driver->disconnect(>g);
+ /*
+* avoid kernel panic because mtu3_gadget_stop() assigned NULL
+* to mtu->gadget_driver.
+*/
+ driver->disconnect(>g);
spin_lock(>lock);
}
--
2.18.0
[PATCH] usb: mtu3: fix panic in mtu3_gadget_disconnect()
This patch fixes a possible issue when mtu3_gadget_stop()
already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().
Backtrace:
[] notifier_call_chain+0xa4/0x128
[] __atomic_notifier_call_chain+0x84/0x138
[] notify_die+0xb0/0x120
[] die+0x1f8/0x5d0
[] __do_kernel_fault+0x19c/0x280
[] do_bad_area+0x44/0x140
[] do_translation_fault+0x4c/0x90
[] do_mem_abort+0xb8/0x258
[] el1_da+0x24/0x3c
[] mtu3_gadget_disconnect+0xac/0x128
[] mtu3_irq+0x34c/0xc18
[] __handle_irq_event_percpu+0x2ac/0xcd0
[] handle_irq_event_percpu+0x80/0x138
[] handle_irq_event+0xac/0x148
[] handle_fasteoi_irq+0x234/0x568
[] generic_handle_irq+0x48/0x68
[] __handle_domain_irq+0x264/0x1740
[] gic_handle_irq+0x14c/0x250
[] el1_irq+0xec/0x194
[] dma_pool_alloc+0x6e4/0xae0
[] cmdq_mbox_pool_alloc_impl+0xb0/0x238
[] cmdq_pkt_alloc_buf+0x2dc/0x7c0
[] cmdq_pkt_add_cmd_buffer+0x178/0x270
[] cmdq_pkt_perf_begin+0x108/0x148
[] cmdq_pkt_create+0x178/0x1f0
[] mtk_crtc_config_default_path+0x328/0x7a0
[] mtk_drm_idlemgr_kick+0xa6c/0x1460
[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
[] drm_atomic_helper_commit_planes+0x154/0x878
[] mtk_atomic_complete.isra.16+0xe80/0x19c8
[] mtk_atomic_commit+0x258/0x898
[] drm_atomic_commit+0xcc/0x108
[] drm_mode_atomic_ioctl+0x1c20/0x2580
[] drm_ioctl_kernel+0x118/0x1b0
[] drm_ioctl+0x5c0/0x920
[] do_vfs_ioctl+0x188/0x1820
[] SyS_ioctl+0x8c/0xa0
Signed-off-by: Macpaul Lin
Cc: sta...@vger.kernel.org
---
drivers/usb/mtu3/mtu3_gadget.c | 7 ++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
index 68ea4395f871..f20fb83b3239 100644
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -843,7 +843,12 @@ void mtu3_gadget_disconnect(struct mtu3 *mtu)
dev_dbg(mtu->dev, "gadget DISCONNECT\n");
if (mtu->gadget_driver && mtu->gadget_driver->disconnect) {
spin_unlock(>lock);
- mtu->gadget_driver->disconnect(>g);
+ /*
+* avoid kernel panic because mtu3_gadget_stop() assigned NULL
+* to mtu->gadget_driver.
+*/
+ if (mtu->gadget_driver && mtu->gadget_driver->disconnect)
+ mtu->gadget_driver->disconnect(>g);
spin_lock(>lock);
}
--
2.18.0
Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
On Tue, 2020-07-21 at 13:33 +0200, Greg Kroah-Hartman wrote: > On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote: > > On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote: > > > From: Eddie Hung > > > > > > > Well, it's strange, I simply replaced the uploader's name to my > > colleague, git send-email pop up this line automatically. > > > > Shouldn't I do that kind of change. It did not happened before. > > Do I need to change it back and update patch v3? > > Who is the real author of this, Eddie or you? If Eddie, this is > correct, if you, it is not. > > thanks, > > greg k-h It is Eddie! I just changed the uploader to the correct author from my working tree! Thanks! Regards, Macpaul Lin
Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote: > From: Eddie Hung > Well, it's strange, I simply replaced the uploader's name to my colleague, git send-email pop up this line automatically. Shouldn't I do that kind of change. It did not happened before. Do I need to change it back and update patch v3? > There is a use-after-free issue, if access udc_name > in function gadget_dev_desc_UDC_store after another context > free udc_name in function unregister_gadget. > > Context 1: > gadget_dev_desc_UDC_store()->unregister_gadget()-> > free udc_name->set udc_name to NULL > > Context 2: > gadget_dev_desc_UDC_show()-> access udc_name > > Call trace: > dump_backtrace+0x0/0x340 > show_stack+0x14/0x1c > dump_stack+0xe4/0x134 > print_address_description+0x78/0x478 > __kasan_report+0x270/0x2ec > kasan_report+0x10/0x18 > __asan_report_load1_noabort+0x18/0x20 > string+0xf4/0x138 > vsnprintf+0x428/0x14d0 > sprintf+0xe4/0x12c > gadget_dev_desc_UDC_show+0x54/0x64 > configfs_read_file+0x210/0x3a0 > __vfs_read+0xf0/0x49c > vfs_read+0x130/0x2b4 > SyS_read+0x114/0x208 > el0_svc_naked+0x34/0x38 > > Add mutex_lock to protect this kind of scenario. > > Signed-off-by: Eddie Hung > Signed-off-by: Macpaul Lin > Reviewed-by: Peter Chen > Cc: sta...@vger.kernel.org > --- > Changes for v2: > - Fix typo %s/contex/context, Thanks Peter. > > drivers/usb/gadget/configfs.c | 11 +-- > 1 file changed, 9 insertions(+), 2 deletions(-) Thanks. Macpaul Lin
[PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name
From: Eddie Hung
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Context 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung
Signed-off-by: Macpaul Lin
Reviewed-by: Peter Chen
Cc: sta...@vger.kernel.org
---
Changes for v2:
- Fix typo %s/contex/context, Thanks Peter.
drivers/usb/gadget/configfs.c | 11 +--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 9dc06a4e1b30..21110b2865b9 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct
config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(>lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(>lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.18.0
[PATCH] usb: gadget: configfs: Fix use-after-free issue with udc_name
There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.
Contex 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL
Contex 2:
gadget_dev_desc_UDC_show()-> access udc_name
Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38
Add mutex_lock to protect this kind of scenario.
Signed-off-by: Eddie Hung
Signed-off-by: Macpaul Lin
Cc: sta...@vger.kernel.org
---
drivers/usb/gadget/configfs.c | 11 +--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 9dc06a4e1b30..21110b2865b9 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -221,9 +221,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct
config_item *item,
static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
{
- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
+ struct gadget_info *gi = to_gadget_info(item);
+ char *udc_name;
+ int ret;
+
+ mutex_lock(>lock);
+ udc_name = gi->composite.gadget_driver.udc_name;
+ ret = sprintf(page, "%s\n", udc_name ?: "");
+ mutex_unlock(>lock);
- return sprintf(page, "%s\n", udc_name ?: "");
+ return ret;
}
static int unregister_gadget(struct gadget_info *gi)
--
2.18.0
[PATCH] sound: usb: quirks: add quirk for Samsung USBC Headset (AKG)
We've found Samsung USBC Headset (AKG) (VID: 0x04e8, PID: 0xa051) need a tiny delay after each class compliant request. Otherwise the device might not be able to be recognized each times. Signed-off-by: Chihhao Chen Signed-off-by: Macpaul Lin Cc: sta...@vger.kernel.org --- sound/usb/quirks.c |8 1 file changed, 8 insertions(+) diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index bca0179..ebba29a 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -1673,6 +1673,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe, chip->usb_id == USB_ID(0x0951, 0x16ad)) && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) usleep_range(1000, 2000); + + /* +* Samsung USBC Headset (AKG) need a tiny delay after each +* class compliant request. (Model number: AAM625R or AAM627R) +*/ + if (chip->usb_id == USB_ID(0x04e8, 0xa051) && + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + usleep_range(5000, 6000); } /* -- 1.7.9.5
Re: [PATCH v8 0/4] Add basic SoC support for mt6765
On Fri, 2020-02-21 at 18:12 +0800, Macpaul Lin wrote: > This patch adds basic SoC support for Mediatek's new 8-core SoC, > MT6765, which is mainly for smartphone application. > > Changes in V8: > 1. Origin V7 patchset: >https://patchwork.kernel.org/cover/11370105/ >Split origin V7 patchset into 2 patchset, >keep remain patches #2, #5, #6, and #7 in the same order as this >V8 patchset. >[v7,2/7] dt-bindings: mediatek: Add smi dts binding for Mediatek > MT6765 SoC >[v7,5/7] soc: mediatek: add MT6765 scpsys and subdomain support >[v7,6/7] arm64: dts: mediatek: add mt6765 support >[v7,7/7] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks > > Changes in V7: > 1. Adapt V6's patchset to latest kernel tree 5.5-rc1. >Origin V6 patchset: >https://patchwork.kernel.org/cover/11041963/ > 2. Correct 2 clock-controller type in documentation: >mipi0 and venc_gcon. >[v7 1/7] dt-bindings: clock: mediatek: document clk bindings > 3. Remove V6's patch 03 because it has been taken into 5.5-next-soc >[v6, 03/08] dt-bindings: mediatek: add MT6765 power dt-bindings > 3. Update Reviewed-by: Rob Herring for >[v6, 04/08] clk: mediatek: add mt6765 clock IDs >--> [v7, 03/07] clk: mediatek: add mt6765 clock IDs > 4. Update SPDX tag for >[v6, 05/08] clk: mediatek: Add MT6765 clock support >--> [v7, 04/07] clk: mediatek: Add MT6765 clock support > > Changes in V6: > 1. Adapt V5's patchset to latest kernel tree. >Origin V5 patchset. >https://lore.kernel.org/patchwork/cover/963612/ > 2. Due to clk's common code has been submit by other platform, >this patch set will have dependencies with the following patchsets >as the following orders. >2.a. [v8,00/21] MT8183 IOMMU SUPPORT > https://patchwork.kernel.org/cover/11023585/ >2.b. [v11,0/6] Add basic node support for Mediatek MT8183 SoC > https://patchwork.kernel.org/cover/10962385/ >2.c. [v6,00/14] Mediatek MT8183 scpsys support > https://patchwork.kernel.org/cover/11005751/ > 3. Correct power related patches into dt-binding patches. > 4. Re-order V5's 4/11, 6/11, and 7/11 due clk common code change >and make dependencies in order. > 5. Update some commit message in clk related patches. > > Changes in V5: > 1. add clk support > > Changes in V4: > 1. add gic's settings in reg properties > 2. remove some patches about dt-bindings since GKH already took them > > Changes in V3: > 1. split dt-binding document patchs > 2. fix mt6765.dtsi warnings with W=12 > 3. remove uncessary PPI affinity for timer > 4. add gicc base for gic dt node > > Changes in V2: > 1. fix clk properties in uart dts node > 2. fix typo in submit title > 3. add simple-bus in mt6765.dtsi > 4. use correct SPDX license format > > Mars Cheng (3): > dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC > soc: mediatek: add MT6765 scpsys and subdomain support > arm64: dts: mediatek: add mt6765 support > > Owen Chen (1): > arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks > > .../memory-controllers/mediatek,smi-common.txt |1 + > arch/arm64/boot/dts/mediatek/Makefile |1 + > arch/arm64/boot/dts/mediatek/mt6765-evb.dts| 33 +++ > arch/arm64/boot/dts/mediatek/mt6765.dtsi | 253 > > arch/arm64/configs/defconfig |6 + > drivers/soc/mediatek/mtk-scpsys.c | 130 ++ > 6 files changed, 424 insertions(+) > create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts > create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi > Dear Matthias and Rob, Just a remind of these patches related to MT6765. Thanks for Stephen's help, the other clock related patches of MT6765 has been already merged into 5.8-rc1. I've tested these v8 patches of MT6765 on 5.8-rc1 and seems they were able to be applied. Could you kindly help to check if these patches were qualified to be merged into your tree? Thanks a lot! Best regards, Macpaul Lin
Re: [PATCH] clk: mediatek: Remove ifr{0,1}_cfg_regs structures
On Tue, 2020-06-09 at 14:18 -0700, Stephen Boyd wrote:
> These aren't used and the macros that reference them aren't used either.
> Remove the dead code to avoid compile warnings.
>
> Cc: Owen Chen
> Cc: Mars Cheng
> Cc: Macpaul Lin
> Fixes: 1aca9939bf72 ("clk: mediatek: Add MT6765 clock support")
> Reported-by: kbuild test robot
> Signed-off-by: Stephen Boyd
> ---
> drivers/clk/mediatek/clk-mt6765.c | 30 --
> 1 file changed, 30 deletions(-)
>
> diff --git a/drivers/clk/mediatek/clk-mt6765.c
> b/drivers/clk/mediatek/clk-mt6765.c
> index 3ec53cb62ece..db8db1b3b79d 100644
> --- a/drivers/clk/mediatek/clk-mt6765.c
> +++ b/drivers/clk/mediatek/clk-mt6765.c
> @@ -534,18 +534,6 @@ static const struct mtk_gate top_clks[] = {
> GATE_TOP2(CLK_TOP_APLL12_DIV3, "apll12_div3", "aud_1_ck", 5),
> };
>
> -static const struct mtk_gate_regs ifr0_cg_regs = {
> - .set_ofs = 0x200,
> - .clr_ofs = 0x200,
> - .sta_ofs = 0x200,
> -};
> -
> -static const struct mtk_gate_regs ifr1_cg_regs = {
> - .set_ofs = 0x74,
> - .clr_ofs = 0x74,
> - .sta_ofs = 0x74,
> -};
> -
> static const struct mtk_gate_regs ifr2_cg_regs = {
> .set_ofs = 0x80,
> .clr_ofs = 0x84,
> @@ -570,24 +558,6 @@ static const struct mtk_gate_regs ifr5_cg_regs = {
> .sta_ofs = 0xc8,
> };
>
> -#define GATE_IFR0(_id, _name, _parent, _shift) { \
> - .id = _id, \
> - .name = _name, \
> - .parent_name = _parent, \
> - .regs = _cg_regs, \
> - .shift = _shift,\
> - .ops = _clk_gate_ops_no_setclr_inv, \
> - }
> -
> -#define GATE_IFR1(_id, _name, _parent, _shift) { \
> - .id = _id, \
> - .name = _name, \
> - .parent_name = _parent, \
> - .regs = _cg_regs, \
> - .shift = _shift,\
> - .ops = _clk_gate_ops_no_setclr, \
> - }
> -
> #define GATE_IFR2(_id, _name, _parent, _shift) { \
> .id = _id, \
> .name = _name, \
Thank you so much!
Owen and I were busy in other issues hence cannot help fix this issue
in time.
Thanks a lot!
BR,
Macpaul Lin
[PATCH v3] usb: replace hardcode maximum usb string length by definition
Replace hardcode maximum usb string length (126 bytes) by definition
"MAX_USB_STRING_LEN".
Signed-off-by: Macpaul Lin
Acked-by: Alan Stern
---
Changes for v2:
- Add definition "MAX_USB_STRING_LEN" in ch9.h instead of in usb.h.
Thanks for Alan's suggestion.
Changes for v3:
- Rebase to 5.8-rc1 and resolve conflict.
drivers/usb/gadget/composite.c |4 ++--
drivers/usb/gadget/configfs.c |2 +-
drivers/usb/gadget/usbstring.c |4 ++--
include/uapi/linux/usb/ch9.h |3 +++
4 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index cb4950c..d0de016 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1041,7 +1041,7 @@ static void collect_langs(struct usb_gadget_strings **sp,
__le16 *buf)
while (*sp) {
s = *sp;
language = cpu_to_le16(s->language);
- for (tmp = buf; *tmp && tmp < [126]; tmp++) {
+ for (tmp = buf; *tmp && tmp < [MAX_USB_STRING_LEN]; tmp++) {
if (*tmp == language)
goto repeat;
}
@@ -1116,7 +1116,7 @@ static int get_string(struct usb_composite_dev *cdev,
collect_langs(sp, s->wData);
}
- for (len = 0; len <= 126 && s->wData[len]; len++)
+ for (len = 0; len <= MAX_USB_STRING_LEN && s->wData[len]; len++)
continue;
if (!len)
return -EINVAL;
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 32b637e..70dd4ba 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -115,7 +115,7 @@ static int usb_string_copy(const char *s, char **s_copy)
char *str;
char *copy = *s_copy;
ret = strlen(s);
- if (ret > 126)
+ if (ret > MAX_USB_STRING_LEN)
return -EOVERFLOW;
str = kstrdup(s, GFP_KERNEL);
diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
index 7c24d1c..8a8d647 100644
--- a/drivers/usb/gadget/usbstring.c
+++ b/drivers/usb/gadget/usbstring.c
@@ -55,9 +55,9 @@
return -EINVAL;
/* string descriptors have length, tag, then UTF16-LE text */
- len = min ((size_t) 126, strlen (s->s));
+ len = min((size_t)MAX_USB_STRING_LEN, strlen(s->s));
len = utf8s_to_utf16s(s->s, len, UTF16_LITTLE_ENDIAN,
- (wchar_t *) [2], 126);
+ (wchar_t *) [2], MAX_USB_STRING_LEN);
if (len < 0)
return -EINVAL;
buf [0] = (len + 1) * 2;
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index 2b623f3..cc02d05 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -364,6 +364,9 @@ struct usb_config_descriptor {
/*-*/
+/* USB String descriptors can contain at most 126 characters. */
+#define MAX_USB_STRING_LEN 126
+
/* USB_DT_STRING: String descriptor */
struct usb_string_descriptor {
__u8 bLength;
--
1.7.9.5
[PATCH v3] usb: gadget: u_serial: improve performance for large data
Nowadays some embedded systems use VCOM to transfer large log and data.
Take LTE MODEM as an example, during the long debugging stage, large
log and data were transfer through VCOM when doing field try or in
operator's lab. Here we suggest slightly increase the transfer buffer
in u_serial.c for performance improving.
Signed-off-by: Macpaul Lin
---
Changes for v2:
- Drop previous patch for adding flag which indicates hardware capability in
gadget.h and in DMA engine according to Alan's suggestion. Thanks.
- Replace requested buffer size "REQ_BUF_SIZE" instead of checking hardware
capability.
- Refine commit messages.
Changes for v3:
- Code: no change.
Commit: Add missing change log in v2.
drivers/usb/gadget/function/u_serial.c |5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/u_serial.c
b/drivers/usb/gadget/function/u_serial.c
index 3cfc6e2..d7912a9 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -80,6 +80,7 @@
#define QUEUE_SIZE 16
#define WRITE_BUF_SIZE 8192/* TX only */
#define GS_CONSOLE_BUF_SIZE8192
+#define REQ_BUF_SIZE 4096
/* console info */
struct gs_console {
@@ -247,7 +248,7 @@ static int gs_start_tx(struct gs_port *port)
break;
req = list_entry(pool->next, struct usb_request, list);
- len = gs_send_packet(port, req->buf, in->maxpacket);
+ len = gs_send_packet(port, req->buf, REQ_BUF_SIZE);
if (len == 0) {
wake_up_interruptible(>drain_wait);
break;
@@ -514,7 +515,7 @@ static int gs_alloc_requests(struct usb_ep *ep, struct
list_head *head,
* be as speedy as we might otherwise be.
*/
for (i = 0; i < n; i++) {
- req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC);
+ req = gs_alloc_req(ep, REQ_BUF_SIZE, GFP_ATOMIC);
if (!req)
return list_empty(head) ? -ENOMEM : 0;
req->complete = fn;
--
1.7.9.5
Re: [PATCH v2] usb: gadget: u_serial: improve performance for large data
On Wed, 2020-06-17 at 07:14 +0200, Greg Kroah-Hartman wrote: > On Wed, Jun 17, 2020 at 10:46:47AM +0800, Macpaul Lin wrote: > > Nowadays some embedded systems use VCOM to transfer large log and data. > > Take LTE MODEM as an example, during the long debugging stage, large > > log and data were transfer through VCOM when doing field try or in > > operator's lab. Here we suggest slightly increase the transfer buffer > > in u_serial.c for performance improving. > > > > Signed-off-by: Macpaul Lin > > --- > > drivers/usb/gadget/function/u_serial.c |5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > What changed from v1? Always put that below the --- line as the > documentation asks for. > > v3? Sorry, I just forget to add change log, I'll send v3 later. Thanks! BR, Macpaul Lin
[PATCH v2] usb: gadget: u_serial: improve performance for large data
Nowadays some embedded systems use VCOM to transfer large log and data.
Take LTE MODEM as an example, during the long debugging stage, large
log and data were transfer through VCOM when doing field try or in
operator's lab. Here we suggest slightly increase the transfer buffer
in u_serial.c for performance improving.
Signed-off-by: Macpaul Lin
---
drivers/usb/gadget/function/u_serial.c |5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/u_serial.c
b/drivers/usb/gadget/function/u_serial.c
index 3cfc6e2..d7912a9 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -80,6 +80,7 @@
#define QUEUE_SIZE 16
#define WRITE_BUF_SIZE 8192/* TX only */
#define GS_CONSOLE_BUF_SIZE8192
+#define REQ_BUF_SIZE 4096
/* console info */
struct gs_console {
@@ -247,7 +248,7 @@ static int gs_start_tx(struct gs_port *port)
break;
req = list_entry(pool->next, struct usb_request, list);
- len = gs_send_packet(port, req->buf, in->maxpacket);
+ len = gs_send_packet(port, req->buf, REQ_BUF_SIZE);
if (len == 0) {
wake_up_interruptible(>drain_wait);
break;
@@ -514,7 +515,7 @@ static int gs_alloc_requests(struct usb_ep *ep, struct
list_head *head,
* be as speedy as we might otherwise be.
*/
for (i = 0; i < n; i++) {
- req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC);
+ req = gs_alloc_req(ep, REQ_BUF_SIZE, GFP_ATOMIC);
if (!req)
return list_empty(head) ? -ENOMEM : 0;
req->complete = fn;
--
1.7.9.5
Re: [PATCH 1/2] usb: gadget: introduce flag for large request
Alan Stern 於 2020年6月16日 週二 下午10:05寫道： > > On Tue, Jun 16, 2020 at 08:34:43PM +0800, Macpaul Lin wrote: > > Some USB hardware like DMA engine can help to process (split) the data > > of each URB request into small packets. For example, the max packet size > > of high speed is 512 bytes. These kinds of hardware can help to split > > the continue Tx/Rx data requests into packets just at the max packet > > size during transmission. Hence upper layer software can reduce some > > effort for queueing many requests back and forth for larger data. > > > > Here we introduce "can_exceed_maxp" flag in gadget when these kinds of > > hardware is ready to support these operations. > > This isn't needed. All UDC drivers must be able to support requests that > are larger than the maxpacket size. > > Alan Stern Thanks for your reply, could we just modify the patch 2 (u_serial.c) for improving better performance? I'm not sure why there was a restriction about max packet. Isn't there any historical reason? -- Best regards, Macpaul Lin
[PATCH 1/2] usb: gadget: introduce flag for large request
Some USB hardware like DMA engine can help to process (split) the data
of each URB request into small packets. For example, the max packet size
of high speed is 512 bytes. These kinds of hardware can help to split
the continue Tx/Rx data requests into packets just at the max packet
size during transmission. Hence upper layer software can reduce some
effort for queueing many requests back and forth for larger data.
Here we introduce "can_exceed_maxp" flag in gadget when these kinds of
hardware is ready to support these operations.
Signed-off-by: Macpaul Lin
---
drivers/usb/mtu3/mtu3_qmu.c | 11 ++-
include/linux/usb/gadget.h |1 +
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c
index 3f414f9..2b51a20 100644
--- a/drivers/usb/mtu3/mtu3_qmu.c
+++ b/drivers/usb/mtu3/mtu3_qmu.c
@@ -620,7 +620,7 @@ irqreturn_t mtu3_qmu_isr(struct mtu3 *mtu)
int mtu3_qmu_init(struct mtu3 *mtu)
{
-
+ int i;
compiletime_assert(QMU_GPD_SIZE == 16, "QMU_GPD size SHOULD be 16B");
mtu->qmu_gpd_pool = dma_pool_create("QMU_GPD", mtu->dev,
@@ -629,10 +629,19 @@ int mtu3_qmu_init(struct mtu3 *mtu)
if (!mtu->qmu_gpd_pool)
return -ENOMEM;
+ /* Let gadget know we can process request larger than max packet */
+ for (i = 1; i < mtu->num_eps; i++)
+ mtu->ep_array[i].ep.can_exceed_maxp = 1;
+
return 0;
}
void mtu3_qmu_exit(struct mtu3 *mtu)
{
+ int i;
dma_pool_destroy(mtu->qmu_gpd_pool);
+
+ /* Disable large request support */
+ for (i = 1; i < mtu->num_eps; i++)
+ mtu->ep_array[i].ep.can_exceed_maxp = 0;
}
diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
index 6a17817..60e0645 100644
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -236,6 +236,7 @@ struct usb_ep {
unsignedmax_streams:16;
unsignedmult:2;
unsignedmaxburst:5;
+ unsignedcan_exceed_maxp:1;
u8 address;
const struct usb_endpoint_descriptor*desc;
const struct usb_ss_ep_comp_descriptor *comp_desc;
--
1.7.9.5
[PATCH 2/2] usb: gadget: u_serial: improve performance for large data
If the hardware (like DMA engine) could support large usb request exceeds
maximum packet size, use larger buffer when performing Rx/Tx could reduce
request numbers and improve performance.
Signed-off-by: Macpaul Lin
---
drivers/usb/gadget/function/u_serial.c |9 +++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/u_serial.c
b/drivers/usb/gadget/function/u_serial.c
index 3cfc6e2..cdcc070 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -80,6 +80,8 @@
#define QUEUE_SIZE 16
#define WRITE_BUF_SIZE 8192/* TX only */
#define GS_CONSOLE_BUF_SIZE8192
+/* for hardware can do more than max packet */
+#define REQ_BUF_SIZE 4096
/* console info */
struct gs_console {
@@ -247,7 +249,8 @@ static int gs_start_tx(struct gs_port *port)
break;
req = list_entry(pool->next, struct usb_request, list);
- len = gs_send_packet(port, req->buf, in->maxpacket);
+ len = gs_send_packet(port, req->buf, in->can_exceed_maxp ?
+ REQ_BUF_SIZE : in->maxpacket);
if (len == 0) {
wake_up_interruptible(>drain_wait);
break;
@@ -514,7 +517,9 @@ static int gs_alloc_requests(struct usb_ep *ep, struct
list_head *head,
* be as speedy as we might otherwise be.
*/
for (i = 0; i < n; i++) {
- req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC);
+ req = gs_alloc_req(ep, ep->can_exceed_maxp ?
+ REQ_BUF_SIZE : ep->maxpacket,
+ GFP_ATOMIC);
if (!req)
return list_empty(head) ? -ENOMEM : 0;
req->complete = fn;
--
1.7.9.5
[PATCH] usb: gadget: u_serial.h: increase MAX_U_SERIAL_PORTS to 8
Mediatek's LTE modem needs up to 8 ports to connect to PC for logging
and debugging under some scenarios. Hence we suggest to increase the
definition of MAX_U_SERIAL_PORTS to 8 for some complex embedded systems.
Signed-off-by: Macpaul Lin
---
drivers/usb/gadget/function/u_serial.h |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/u_serial.h
b/drivers/usb/gadget/function/u_serial.h
index e5b08ab..7d61113 100644
--- a/drivers/usb/gadget/function/u_serial.h
+++ b/drivers/usb/gadget/function/u_serial.h
@@ -12,7 +12,7 @@
#include
#include
-#define MAX_U_SERIAL_PORTS 4
+#define MAX_U_SERIAL_PORTS 8
struct f_serial_opts {
struct usb_function_instance func_inst;
--
1.7.9.5
[PATCH v2] usb: replace hardcode maximum usb string length by definition
Replace hardcode maximum usb string length (126 bytes) by definition
"MAX_USB_STRING_LEN".
Signed-off-by: Macpaul Lin
---
Changes for v2:
- Add definition "MAX_USB_STRING_LEN" in ch9.h instead of in usb.h.
Thanks for Alan's suggestion.
drivers/usb/gadget/composite.c |4 ++--
drivers/usb/gadget/configfs.c |2 +-
drivers/usb/gadget/usbstring.c |4 ++--
include/uapi/linux/usb/ch9.h |3 +++
4 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index cb4950c..d0de016 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1041,7 +1041,7 @@ static void collect_langs(struct usb_gadget_strings **sp,
__le16 *buf)
while (*sp) {
s = *sp;
language = cpu_to_le16(s->language);
- for (tmp = buf; *tmp && tmp < [126]; tmp++) {
+ for (tmp = buf; *tmp && tmp < [MAX_USB_STRING_LEN]; tmp++) {
if (*tmp == language)
goto repeat;
}
@@ -1116,7 +1116,7 @@ static int get_string(struct usb_composite_dev *cdev,
collect_langs(sp, s->wData);
}
- for (len = 0; len <= 126 && s->wData[len]; len++)
+ for (len = 0; len <= MAX_USB_STRING_LEN && s->wData[len]; len++)
continue;
if (!len)
return -EINVAL;
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 32b637e..70dd4ba 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -115,7 +115,7 @@ static int usb_string_copy(const char *s, char **s_copy)
char *str;
char *copy = *s_copy;
ret = strlen(s);
- if (ret > 126)
+ if (ret > MAX_USB_STRING_LEN)
return -EOVERFLOW;
str = kstrdup(s, GFP_KERNEL);
diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
index 7c24d1c..8a8d647 100644
--- a/drivers/usb/gadget/usbstring.c
+++ b/drivers/usb/gadget/usbstring.c
@@ -55,9 +55,9 @@
return -EINVAL;
/* string descriptors have length, tag, then UTF16-LE text */
- len = min((size_t) 126, strlen (s->s));
+ len = min((size_t)MAX_USB_STRING_LEN, strlen(s->s));
len = utf8s_to_utf16s(s->s, len, UTF16_LITTLE_ENDIAN,
- (wchar_t *) [2], 126);
+ (wchar_t *) [2], MAX_USB_STRING_LEN);
if (len < 0)
return -EINVAL;
buf [0] = (len + 1) * 2;
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index 2b623f3..cc02d05 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -364,6 +364,9 @@ struct usb_config_descriptor {
/*-*/
+/* USB String descriptors can contain at most 126 characters. */
+#define MAX_USB_STRING_LEN 126
+
/* USB_DT_STRING: String descriptor */
struct usb_string_descriptor {
__u8 bLength;
--
1.7.9.5
[PATCH] usb: replace hardcoded maximum usb string length by definition
Replace hardcoded maximum usb string length (126 bytes) by definition
"MAX_USB_STRING_LEN".
Signed-off-by: Macpaul Lin
---
drivers/usb/gadget/composite.c |4 ++--
drivers/usb/gadget/configfs.c |3 ++-
drivers/usb/gadget/usbstring.c |5 +++--
include/linux/usb.h|2 ++
4 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index cb4950c..d0de016 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1041,7 +1041,7 @@ static void collect_langs(struct usb_gadget_strings **sp,
__le16 *buf)
while (*sp) {
s = *sp;
language = cpu_to_le16(s->language);
- for (tmp = buf; *tmp && tmp < [126]; tmp++) {
+ for (tmp = buf; *tmp && tmp < [MAX_USB_STRING_LEN]; tmp++) {
if (*tmp == language)
goto repeat;
}
@@ -1116,7 +1116,7 @@ static int get_string(struct usb_composite_dev *cdev,
collect_langs(sp, s->wData);
}
- for (len = 0; len <= 126 && s->wData[len]; len++)
+ for (len = 0; len <= MAX_USB_STRING_LEN && s->wData[len]; len++)
continue;
if (!len)
return -EINVAL;
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 32b637e..c9d61ac 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -4,6 +4,7 @@
#include
#include
#include
+#include
#include
#include
#include "configfs.h"
@@ -115,7 +116,7 @@ static int usb_string_copy(const char *s, char **s_copy)
char *str;
char *copy = *s_copy;
ret = strlen(s);
- if (ret > 126)
+ if (ret > MAX_USB_STRING_LEN)
return -EOVERFLOW;
str = kstrdup(s, GFP_KERNEL);
diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
index 7c24d1c..c125d59 100644
--- a/drivers/usb/gadget/usbstring.c
+++ b/drivers/usb/gadget/usbstring.c
@@ -11,6 +11,7 @@
#include
#include
+#include
#include
#include
@@ -55,9 +56,9 @@
return -EINVAL;
/* string descriptors have length, tag, then UTF16-LE text */
- len = min ((size_t) 126, strlen (s->s));
+ len = min((size_t)MAX_USB_STRING_LEN, strlen(s->s));
len = utf8s_to_utf16s(s->s, len, UTF16_LITTLE_ENDIAN,
- (wchar_t *) [2], 126);
+ (wchar_t *) [2], MAX_USB_STRING_LEN);
if (len < 0)
return -EINVAL;
buf [0] = (len + 1) * 2;
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 9f3c721..df4a9cb 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1815,6 +1815,8 @@ static inline int usb_get_ptm_status(struct usb_device
*dev, void *data)
0, data);
}
+/* USB String descriptors can contain at most 126 characters. */
+#define MAX_USB_STRING_LEN 126
extern int usb_string(struct usb_device *dev, int index,
char *buf, size_t size);
--
1.7.9.5
Re: [PATCH v2] usb/gadget/function: introduce Built-in CDROM support
On Wed, 2020-06-10 at 10:31 -0400, Alan Stern wrote:
> On Wed, Jun 10, 2020 at 02:15:18PM +0800, Macpaul Lin wrote:
> > Introduce Built-In CDROM (BICR) support.
> > This feature depends on USB_CONFIGFS_MASS_STORAGE option.
> >
> > 1. Some settings and new function is introduced for BICR.
> > 2. Some work around for adapting Android settings is introduced as well.
>
> You're going to have to give a much better explanation of what this
> does. For people who don't know what Built-In CDROM support is, what
> you wrote is meaningless.
>
> For example, how is BICR support different from the CDROM support
> already present in the driver? And what's so special about it that it
> needs its own kconfig setting?
>
> > @@ -369,6 +372,10 @@ static void set_bulk_out_req_length(struct fsg_common
> > *common,
> > if (rem > 0)
> > length += common->bulk_out_maxpacket - rem;
> > bh->outreq->length = length;
> > +
> > + /* some USB 2.0 hardware requires this setting */
> > + if (common->bicr)
> > + bh->outreq->short_not_ok = 1;
>
> How is this connected with BICR? If some USB 2.0 hardware requires this
> setting, shouldn't it always be turned on?
>
> Besides, why does some hardware require this? What goes wrong if
> short_not_ok is set to 0? If it causes problems, why didn't we become
> aware of them many years ago?
Thanks for Alan and Greg's suggestion, we will check these issues and
see if a better solution could be work out.
> > @@ -527,7 +534,16 @@ static int fsg_setup(struct usb_function *f,
> > w_length != 1)
> > return -EDOM;
> > VDBG(fsg, "get max LUN\n");
> > - *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
> > + if (IS_ENABLED(USB_CONFIGFS_BICR) && fsg->common->bicr) {
> > + /*
> > +* When Built-In CDROM is enabled,
> > +* we share only one LUN.
> > +*/
> > + *(u8 *)req->buf = 0;
> > + } else {
> > + *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
> > + }
>
> This is a very strange way of enforcing a single-LUN restriction. Why
> do it here? A much more logical place would be where cfg->nluns is set
> up originally.
>
> > + INFO(fsg, "get max LUN = %d\n", *(u8 *)req->buf);
>
> This debugging line isn't needed.
>
> > /* Respond with data/status */
> > req->length = min((u16)1, w_length);
> > @@ -1329,7 +1345,7 @@ static int do_start_stop(struct fsg_common *common)
> > }
> >
> > /* Are we allowed to unload the media? */
> > - if (curlun->prevent_medium_removal) {
> > + if (!curlun->nofua && curlun->prevent_medium_removal) {
>
> How is nofua connected to BICR? Or to prevent_medium_removal?
>
> > LDBG(curlun, "unload attempt prevented\n");
> > curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
> > return -EINVAL;
> > @@ -2692,6 +2708,7 @@ int fsg_common_set_cdev(struct fsg_common *common,
> > common->ep0 = cdev->gadget->ep0;
> > common->ep0req = cdev->req;
> > common->cdev = cdev;
> > + common->bicr = 0;
> >
> > us = usb_gstrings_attach(cdev, fsg_strings_array,
> > ARRAY_SIZE(fsg_strings));
> > @@ -2895,6 +2912,33 @@ static void fsg_common_release(struct fsg_common
> > *common)
> > kfree(common);
> > }
> >
> > +#ifdef CONFIG_USB_CONFIGFS_BICR
> > +ssize_t fsg_bicr_show(struct fsg_common *common, char *buf)
> > +{
> > + return sprintf(buf, "%d\n", common->bicr);
> > +}
> > +
> > +ssize_t fsg_bicr_store(struct fsg_common *common, const char *buf, size_t
> > size)
> > +{
> > + int ret;
> > +
> > + ret = kstrtou8(buf, 10, >bicr);
> > + if (ret)
> > + return -EINVAL;
> > +
> > + /* Set Lun[0] is a CDROM when enable bicr.*/
> > + if (!strcmp(buf, "1"))
> > + common->luns[0]->cdrom = 1;
> > + else {
> > + common->luns[0]->cdrom = 0;
> > + common->luns[0]->blkbits = 0;
> > + common->luns[0]->blksize = 0;
> > + common->luns[0]->num_sectors = 0;
> > + }
> > +
> > + ret
Re: [PATCH v2] usb: gadget: configfs: Fix KASAN use-after-free
On Thu, 2017-09-01 at 10:25:32 -0700, Kees Cook wrote:
> Subject: Re: [PATCH v2] usb: gadget: configfs: Fix KASAN use-after-free
> To: Jim Lin
> Cc: Felipe Balbi , , LKML
> , Greg KH ,
> Steve Beattie
>
>
> On Tue, Jan 17, 2017 at 1:29 AM, Jim Lin wrote:
> > When gadget is disconnected, running sequence is like this.
> > . composite_disconnect
> > . Call trace:
> > usb_string_copy+0xd0/0x128
> > gadget_config_name_configuration_store+0x4
> > gadget_config_name_attr_store+0x40/0x50
> > configfs_write_file+0x198/0x1f4
> > vfs_write+0x100/0x220
> > SyS_write+0x58/0xa8
> > . configfs_composite_unbind
> > . configfs_composite_bind
> >
> > In configfs_composite_bind, it has
> > "cn->strings.s = cn->configuration;"
> >
> > When usb_string_copy is invoked. it would
> > allocate memory, copy input string, release previous pointed memory space,
> > and use new allocated memory.
> >
> > When gadget is connected, host sends down request to get information.
> > Call trace:
> > usb_gadget_get_string+0xec/0x168
> > lookup_string+0x64/0x98
> > composite_setup+0xa34/0x1ee8
> > android_setup+0xb4/0x140
> >
> > If gadget is disconnected and connected quickly, in the failed case,
> > cn->configuration memory has been released by usb_string_copy kfree but
> > configfs_composite_bind hasn't been run in time to assign new allocated
> > "cn->configuration" pointer to "cn->strings.s".
> >
> > When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling
> > memory is accessed, "BUG: KASAN: use-after-free" error occurs.
> >
> > Signed-off-by: Jim Lin
>
> Hi! What's the current state of this patch?
Mediatek is using this bug fix in Android kernel 3.18, 4.4, 4.9, 4.14
and 4.19. Kernel code nowadays.
Since there are news that Google is planning to use Generic Kernel Image
(GKI) for future Android. Should this patch be refined and adapt into
Linux?
Dear Jim and Siqi, according to Felipe's mail before, do you have
environments to test it on a Linux environment like on PC? Maybe on some
embedded environment not using Android or Chromium OS? I don't have that
kind of environment in my office hence I just couldn't provide a help to
do the test.
> > ---
> > Changes in v2:
> > Rephrase commit description
> >
> > drivers/usb/gadget/configfs.c | 15 +++
> > 1 file changed, 11 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> > index 78c4497..39fea62 100644
> > --- a/drivers/usb/gadget/configfs.c
> > +++ b/drivers/usb/gadget/configfs.c
> > @@ -106,6 +106,9 @@ struct gadget_config_name {
> > struct list_head list;
> > };
> >
> > +#define MAX_USB_STRING_LEN 126
> > +#define MAX_USB_STRING_WITH_NULL_LEN (MAX_USB_STRING_LEN+1)
> > +
> > static int usb_string_copy(const char *s, char **s_copy)
> > {
> > int ret;
> > @@ -115,12 +118,16 @@ static int usb_string_copy(const char *s, char
> > **s_copy)
> > if (ret > 126)
>
> This should be MAX_USB_STRING_LEN, yes?
>
> > return -EOVERFLOW;
> >
> > - str = kstrdup(s, GFP_KERNEL);
> > - if (!str)
> > - return -ENOMEM;
> > + if (copy) {
> > + str = copy;
> > + } else {
> > + str = kmalloc(MAX_USB_STRING_WITH_NULL_LEN, GFP_KERNEL);
> > + if (!str)
> > + return -ENOMEM;
> > + }
> > + strcpy(str, s);
> > if (str[ret - 1] == '\n')
> > str[ret - 1] = '\0';
> > - kfree(copy);
> > *s_copy = str;
> > return 0;
> > }
> > --
> > 2.7.4
> >
>
> -Kees
Thank you very much.
Macpaul Lin
[PATCH v2] usb/gadget/function: introduce Built-in CDROM support
Introduce Built-In CDROM (BICR) support.
This feature depends on USB_CONFIGFS_MASS_STORAGE option.
1. Some settings and new function is introduced for BICR.
2. Some work around for adapting Android settings is introduced as well.
Signed-off-by: Justin Hsieh
Signed-off-by: Hakieyin Hsieh
Signed-off-by: Macpaul Lin
---
Changes for v2:
- Thanks for Peter's review.
- Fix typo in commit message.
- use variable common->bicr instead of IS_ENABLED().
- Fix #ifdef CONFIG_USB_CONFIGFS_BICR.
drivers/usb/gadget/Kconfig | 16 +++
drivers/usb/gadget/function/f_mass_storage.c | 49 +++-
drivers/usb/gadget/function/f_mass_storage.h | 5 +-
drivers/usb/gadget/function/storage_common.c | 23 +
4 files changed, 90 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 4dc4d48fe6a6..686ba01bedb5 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -188,6 +188,9 @@ config USB_F_RNDIS
config USB_F_MASS_STORAGE
tristate
+config USB_F_BICR
+ tristate
+
config USB_F_FS
tristate
@@ -357,6 +360,19 @@ config USB_CONFIGFS_MASS_STORAGE
device (in much the same way as the "loop" device driver),
specified as a module parameter or sysfs option.
+config USB_CONFIGFS_BICR
+ bool "Built-In CDROM emulation"
+ depends on USB_CONFIGFS
+ depends on BLOCK
+ depends on USB_CONFIGFS_MASS_STORAGE
+ select USB_F_BICR
+ help
+ The Build-In CDROM Gadget acts as a CDROM emulation disk drive.
+ It is based on kernel option "USB_CONFIGFS_MASS_STORAGE".
+ As its storage repository it can use a regular file or a block
+ device (in much the same way as the "loop" device driver),
+ specified as a module parameter or sysfs option.
+
config USB_CONFIGFS_F_LB_SS
bool "Loopback and sourcesink function (for testing)"
depends on USB_CONFIGFS
diff --git a/drivers/usb/gadget/function/f_mass_storage.c
b/drivers/usb/gadget/function/f_mass_storage.c
index 33c2264a0e35..9de1cd465635 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -315,6 +315,9 @@ struct fsg_common {
void*private_data;
char inquiry_string[INQUIRY_STRING_LEN];
+
+ /* For build-in CDROM */
+ u8 bicr;
};
struct fsg_dev {
@@ -369,6 +372,10 @@ static void set_bulk_out_req_length(struct fsg_common
*common,
if (rem > 0)
length += common->bulk_out_maxpacket - rem;
bh->outreq->length = length;
+
+ /* some USB 2.0 hardware requires this setting */
+ if (common->bicr)
+ bh->outreq->short_not_ok = 1;
}
@@ -527,7 +534,16 @@ static int fsg_setup(struct usb_function *f,
w_length != 1)
return -EDOM;
VDBG(fsg, "get max LUN\n");
- *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
+ if (IS_ENABLED(USB_CONFIGFS_BICR) && fsg->common->bicr) {
+ /*
+* When Built-In CDROM is enabled,
+* we share only one LUN.
+*/
+ *(u8 *)req->buf = 0;
+ } else {
+ *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
+ }
+ INFO(fsg, "get max LUN = %d\n", *(u8 *)req->buf);
/* Respond with data/status */
req->length = min((u16)1, w_length);
@@ -1329,7 +1345,7 @@ static int do_start_stop(struct fsg_common *common)
}
/* Are we allowed to unload the media? */
- if (curlun->prevent_medium_removal) {
+ if (!curlun->nofua && curlun->prevent_medium_removal) {
LDBG(curlun, "unload attempt prevented\n");
curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
return -EINVAL;
@@ -2692,6 +2708,7 @@ int fsg_common_set_cdev(struct fsg_common *common,
common->ep0 = cdev->gadget->ep0;
common->ep0req = cdev->req;
common->cdev = cdev;
+ common->bicr = 0;
us = usb_gstrings_attach(cdev, fsg_strings_array,
ARRAY_SIZE(fsg_strings));
@@ -2895,6 +2912,33 @@ static void fsg_common_release(struct fsg_common *common)
kfree(common);
}
+#ifdef CONFIG_USB_CONFIGFS_BICR
+ssize_t fsg_bicr_show(struct fsg_common *common, char *buf)
+{
+ return sprintf(buf, "%d\n", common->bicr);
+}
+
+ssize_t fsg_bicr_store(struct fsg_common *common, const char *buf, size_t size)
+{
+ int ret;
+
+ ret = kstrtou8(buf, 10, >bi
[PATCH] usb/gadget/function: introduce Built-in CDROM support
Introduce Built-In CDROM (BICR) support.
This feature depends on USB_CONFIGFS_MASS_STORAGE option.
1. Some settings and new function is introduced for BICR.
2. Some work around for adapting Android settings is intorduced as well.
Signed-off-by: Justin Hsieh
Signed-off-by: Hakieyin Hsieh
Signed-off-by: Macpaul Lin
---
drivers/usb/gadget/Kconfig | 16 +++
drivers/usb/gadget/function/f_mass_storage.c | 49 +++-
drivers/usb/gadget/function/f_mass_storage.h | 5 +-
drivers/usb/gadget/function/storage_common.c | 23 +
4 files changed, 90 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 4dc4d48fe6a6..686ba01bedb5 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -188,6 +188,9 @@ config USB_F_RNDIS
config USB_F_MASS_STORAGE
tristate
+config USB_F_BICR
+ tristate
+
config USB_F_FS
tristate
@@ -357,6 +360,19 @@ config USB_CONFIGFS_MASS_STORAGE
device (in much the same way as the "loop" device driver),
specified as a module parameter or sysfs option.
+config USB_CONFIGFS_BICR
+ bool "Built-In CDROM emulation"
+ depends on USB_CONFIGFS
+ depends on BLOCK
+ depends on USB_CONFIGFS_MASS_STORAGE
+ select USB_F_BICR
+ help
+ The Build-In CDROM Gadget acts as a CDROM emulation disk drive.
+ It is based on kernel option "USB_CONFIGFS_MASS_STORAGE".
+ As its storage repository it can use a regular file or a block
+ device (in much the same way as the "loop" device driver),
+ specified as a module parameter or sysfs option.
+
config USB_CONFIGFS_F_LB_SS
bool "Loopback and sourcesink function (for testing)"
depends on USB_CONFIGFS
diff --git a/drivers/usb/gadget/function/f_mass_storage.c
b/drivers/usb/gadget/function/f_mass_storage.c
index 33c2264a0e35..9de1cd465635 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -315,6 +315,9 @@ struct fsg_common {
void*private_data;
char inquiry_string[INQUIRY_STRING_LEN];
+
+ /* For build-in CDROM */
+ u8 bicr;
};
struct fsg_dev {
@@ -369,6 +372,10 @@ static void set_bulk_out_req_length(struct fsg_common
*common,
if (rem > 0)
length += common->bulk_out_maxpacket - rem;
bh->outreq->length = length;
+
+ /* some USB 2.0 hardware requires this setting */
+ if (IS_ENABLED(USB_CONFIGFS_BICR))
+ bh->outreq->short_not_ok = 1;
}
@@ -527,7 +534,16 @@ static int fsg_setup(struct usb_function *f,
w_length != 1)
return -EDOM;
VDBG(fsg, "get max LUN\n");
- *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
+ if (IS_ENABLED(USB_CONFIGFS_BICR) && fsg->common->bicr) {
+ /*
+* When Built-In CDROM is enabled,
+* we share only one LUN.
+*/
+ *(u8 *)req->buf = 0;
+ } else {
+ *(u8 *)req->buf = _fsg_common_get_max_lun(fsg->common);
+ }
+ INFO(fsg, "get max LUN = %d\n", *(u8 *)req->buf);
/* Respond with data/status */
req->length = min((u16)1, w_length);
@@ -1329,7 +1345,7 @@ static int do_start_stop(struct fsg_common *common)
}
/* Are we allowed to unload the media? */
- if (curlun->prevent_medium_removal) {
+ if (!curlun->nofua && curlun->prevent_medium_removal) {
LDBG(curlun, "unload attempt prevented\n");
curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
return -EINVAL;
@@ -2692,6 +2708,7 @@ int fsg_common_set_cdev(struct fsg_common *common,
common->ep0 = cdev->gadget->ep0;
common->ep0req = cdev->req;
common->cdev = cdev;
+ common->bicr = 0;
us = usb_gstrings_attach(cdev, fsg_strings_array,
ARRAY_SIZE(fsg_strings));
@@ -2895,6 +2912,33 @@ static void fsg_common_release(struct fsg_common *common)
kfree(common);
}
+#ifdef USB_CONFIGFS_BICR
+ssize_t fsg_bicr_show(struct fsg_common *common, char *buf)
+{
+ return sprintf(buf, "%d\n", common->bicr);
+}
+
+ssize_t fsg_bicr_store(struct fsg_common *common, const char *buf, size_t size)
+{
+ int ret;
+
+ ret = kstrtou8(buf, 10, >bicr);
+ if (ret)
+ return -EINVAL;
+
+ /* Set Lun[0] is a CDROM when enable bicr.*/
+ if (!strcmp(buf, "1"))
+ common->luns[0]->cdro
Re: linux-next: build failure after merge of the sound-current tree
On Fri, 2020-06-05 at 08:43 +1000, Stephen Rothwell wrote:
> Hi all,
>
> After merging the sound-current tree, today's linux-next build (arm
> multi_v7_defconfig) failed like this:
>
> /home/sfr/next/next/sound/usb/card.c: In function 'snd_usb_autoresume':
> /home/sfr/next/next/sound/usb/card.c:841:29: error: expected ';' before ')'
> token
> 841 |atomic_dec(>active))
> | ^
> | ;
>
> Caused by commit
>
> 3398e5c7b038 ("ALSA: usb-audio: Manage auto-pm of all bundled interfaces")
>
> I have reverted that commit for today.
>
Sorry I've tested its function by "patch back" to older kernel version
4.14.
After checking the latest patch again, there is indeed a typo here.
Thanks
Macpaul Lin
[PATCH v4] usb: host: xhci-mtk: avoid runtime suspend when removing hcd
When runtime suspend was enabled, runtime suspend might happen when xhci is removing hcd. This might cause kernel panic when hcd has been freed but runtime pm suspend related handle need to reference it. Signed-off-by: Macpaul Lin Reviewed-by: Chunfeng Yun Cc: sta...@vger.kernel.org --- Changes for v3: - Replace better sequence for disabling the pm_runtime suspend. Changes for v4: - Thanks for Sergei's review, typo in commit description has been corrected. drivers/usb/host/xhci-mtk.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c index bfbdb3c..641d24e 100644 --- a/drivers/usb/host/xhci-mtk.c +++ b/drivers/usb/host/xhci-mtk.c @@ -587,6 +587,9 @@ static int xhci_mtk_remove(struct platform_device *dev) struct xhci_hcd *xhci = hcd_to_xhci(hcd); struct usb_hcd *shared_hcd = xhci->shared_hcd; + pm_runtime_put_noidle(>dev); + pm_runtime_disable(>dev); + usb_remove_hcd(shared_hcd); xhci->shared_hcd = NULL; device_init_wakeup(>dev, false); @@ -597,8 +600,6 @@ static int xhci_mtk_remove(struct platform_device *dev) xhci_mtk_sch_exit(mtk); xhci_mtk_clks_disable(mtk); xhci_mtk_ldos_disable(mtk); - pm_runtime_put_sync(>dev); - pm_runtime_disable(>dev); return 0; } -- 1.7.9.5
Re: [PATCH] sound: usb: pcm: fix incorrect power state when playing sound after PM_AUTO suspend
On Wed, 2020-06-03 at 14:47 +0200, Takashi Iwai wrote: > On Wed, 03 Jun 2020 14:39:24 +0200, > Macpaul Lin wrote: > > > > On Wed, 2020-06-03 at 10:45 +0200, Takashi Iwai wrote: > > > On Wed, 03 Jun 2020 08:54:51 +0200, > > > Takashi Iwai wrote: > > > > > > > > On Wed, 03 Jun 2020 08:28:09 +0200, > > > > Takashi Iwai wrote: > > > > > > > > > > And, the most suspicious case is the last one, > > > > > chip->num_suspended-intf. It means that the device has multiple > > > > > USB interfaces and they went to suspend, while the resume isn't > > > > > performed for the all suspended interfaces in return. > > > > > > > > If this is the cause, a patch like below might help. > > > > It gets/puts the all assigned interfaced instead of only the primary > > > > one. > > > > > > ... and considering of the problem again, rather the patch below might > > > be the right answer. Now the driver tries to remember at which state > > > it entered into the system-suspend. Upon resume, in return, when the > > > state reaches back to that point, set the card state to D0. > > > > > > The previous patch can be applied on the top, too, and it might be > > > worth to apply both. > > > > > > Let me know if any of those actually helps. > > > > > > > > > Takashi > > > > Thanks for your response so quickly. > > I've just test this patch since it looks like enough for the issue. > > Good to hear! > > > This patch worked since the flag system_suspend will be set at the same > > time when power state has been changed. I have 2 interface with the head > > set. But actually the problem happened when primary one is suspended. > > Currently the autosuspend is set only to the primary interface; IOW, > the other interfaces will never get autosuspend, and the another > suspend-all-intf patch should improve that situation. But it won't > fix your actual bug, obviously :) > > > So I didn't test the earlier patch "suspend all interface instead of > > only the primary one." > > Could you try it one on top of the last patch? At least I'd like to > see whether it causes any regression. I've tried both of these 2 patches together, and it looks okay. > > Will you resend this patch officially later? I think this solution is > > required to send to stable, too. It's better to have it for other stable > > kernel versions include android's. > > Yes, that's a general bug and worth to be merged quickly. > I'm going to submit a proper patch soon later. > > > thanks, > > Takashi > Thanks! Macpaul Lin
[PATCH v3] usb: host: xhci-mtk: avoid runtime suspend when removing hcd
When runtime suspend was enabled, runtime suspend might happened when xhci is removing hcd. This might cause kernel panic when hcd has been freed but runtime pm suspend related handle need to reference it. Signed-off-by: Macpaul Lin Reviewed-by: Chunfeng Yun --- Changes for v3: - Replace better sequence for disabling the pm_runtime suspend. drivers/usb/host/xhci-mtk.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c index bfbdb3c..641d24e 100644 --- a/drivers/usb/host/xhci-mtk.c +++ b/drivers/usb/host/xhci-mtk.c @@ -587,6 +587,9 @@ static int xhci_mtk_remove(struct platform_device *dev) struct xhci_hcd *xhci = hcd_to_xhci(hcd); struct usb_hcd *shared_hcd = xhci->shared_hcd; + pm_runtime_put_noidle(>dev); + pm_runtime_disable(>dev); + usb_remove_hcd(shared_hcd); xhci->shared_hcd = NULL; device_init_wakeup(>dev, false); @@ -597,8 +600,6 @@ static int xhci_mtk_remove(struct platform_device *dev) xhci_mtk_sch_exit(mtk); xhci_mtk_clks_disable(mtk); xhci_mtk_ldos_disable(mtk); - pm_runtime_put_sync(>dev); - pm_runtime_disable(>dev); return 0; } -- 1.7.9.5
Re: [PATCH] usb: host: xhci-mtk: avoid runtime suspend when removing hcd
On Wed, 2020-06-03 at 14:47 +0300, Mathias Nyman wrote: > On 29.5.2020 7.29, Macpaul Lin wrote: > > When runtime suspend was enabled, runtime suspend might happened > > when xhci is removing hcd. This might cause kernel panic when hcd > > has been freed but runtime pm suspend related handle need to > > reference it. > > > > Change-Id: I70a5dc8006207caeecbac6955ce8e5345dcc70e6 > > Signed-off-by: Macpaul Lin > > --- > > drivers/usb/host/xhci-mtk.c |5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c > > index bfbdb3c..641d24e 100644 > > --- a/drivers/usb/host/xhci-mtk.c > > +++ b/drivers/usb/host/xhci-mtk.c > > @@ -587,6 +587,9 @@ static int xhci_mtk_remove(struct platform_device *dev) > > struct xhci_hcd *xhci = hcd_to_xhci(hcd); > > struct usb_hcd *shared_hcd = xhci->shared_hcd; > > > > + pm_runtime_put_sync(>dev); > > Might runtime suspend here. > It's a lot better than before, no panic as hcd isn't released, but a bit > unnecessary. > > how about this sequence instead: > pm_runtime_disable() > pm_runtime_put_noidle() > > > + pm_runtime_disable(>dev); > > + > > -Mathias Thanks for your suggestion! Will it better to put no idle before disable? pm_runtime_put_noidle() pm_runtime_disable() I've found pm_runtime_put_noidle is called in pm_runtime_disable() when there is a pending request. I will send patch v3 as noidle() called earlier than disable(). Please help to comment it if disable() should go before. Thanks! Macpaul Lin
Re: [PATCH] sound: usb: pcm: fix incorrect power state when playing sound after PM_AUTO suspend
On Wed, 2020-06-03 at 10:45 +0200, Takashi Iwai wrote:
> On Wed, 03 Jun 2020 08:54:51 +0200,
> Takashi Iwai wrote:
> >
> > On Wed, 03 Jun 2020 08:28:09 +0200,
> > Takashi Iwai wrote:
> > >
> > > And, the most suspicious case is the last one,
> > > chip->num_suspended-intf. It means that the device has multiple
> > > USB interfaces and they went to suspend, while the resume isn't
> > > performed for the all suspended interfaces in return.
> >
> > If this is the cause, a patch like below might help.
> > It gets/puts the all assigned interfaced instead of only the primary
> > one.
>
> ... and considering of the problem again, rather the patch below might
> be the right answer. Now the driver tries to remember at which state
> it entered into the system-suspend. Upon resume, in return, when the
> state reaches back to that point, set the card state to D0.
>
> The previous patch can be applied on the top, too, and it might be
> worth to apply both.
>
> Let me know if any of those actually helps.
>
>
> Takashi
Thanks for your response so quickly.
I've just test this patch since it looks like enough for the issue.
This patch worked since the flag system_suspend will be set at the same
time when power state has been changed. I have 2 interface with the head
set. But actually the problem happened when primary one is suspended.
So I didn't test the earlier patch "suspend all interface instead of
only the primary one."
Will you resend this patch officially later? I think this solution is
required to send to stable, too. It's better to have it for other stable
kernel versions include android's.
> ---
> diff --git a/sound/usb/card.c b/sound/usb/card.c
> --- a/sound/usb/card.c
> +++ b/sound/usb/card.c
> @@ -843,9 +843,6 @@ static int usb_audio_suspend(struct usb_interface *intf,
> pm_message_t message)
> if (chip == (void *)-1L)
> return 0;
>
> - chip->autosuspended = !!PMSG_IS_AUTO(message);
> - if (!chip->autosuspended)
> - snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot);
> if (!chip->num_suspended_intf++) {
> list_for_each_entry(as, >pcm_list, list) {
> snd_usb_pcm_suspend(as);
> @@ -858,6 +855,11 @@ static int usb_audio_suspend(struct usb_interface *intf,
> pm_message_t message)
> snd_usb_mixer_suspend(mixer);
> }
>
> + if (!PMSG_IS_AUTO(message) && !chip->system_suspend) {
> + snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot);
> + chip->system_suspend = chip->num_suspended_intf;
> + }
> +
> return 0;
> }
>
> @@ -871,10 +873,10 @@ static int __usb_audio_resume(struct usb_interface
> *intf, bool reset_resume)
>
> if (chip == (void *)-1L)
> return 0;
> - if (--chip->num_suspended_intf)
> - return 0;
>
> atomic_inc(>active); /* avoid autopm */
> + if (chip->num_suspended_intf > 1)
> + goto out;
>
> list_for_each_entry(as, >pcm_list, list) {
> err = snd_usb_pcm_resume(as);
> @@ -896,9 +898,12 @@ static int __usb_audio_resume(struct usb_interface
> *intf, bool reset_resume)
> snd_usbmidi_resume(p);
> }
>
> - if (!chip->autosuspended)
> + out:
> + if (chip->num_suspended_intf == chip->system_suspend) {
> snd_power_change_state(chip->card, SNDRV_CTL_POWER_D0);
> - chip->autosuspended = 0;
> + chip->system_suspend = 0;
> + }
> + chip->num_suspended_intf--;
>
> err_out:
> atomic_dec(>active); /* allow autopm after this point */
> diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
> index 1c892c7f14d7..e0ebfb25fbd5 100644
> --- a/sound/usb/usbaudio.h
> +++ b/sound/usb/usbaudio.h
> @@ -26,7 +26,7 @@ struct snd_usb_audio {
> struct usb_interface *pm_intf;
> u32 usb_id;
> struct mutex mutex;
> - unsigned int autosuspended:1;
> + unsigned int system_suspend;
> atomic_t active;
> atomic_t shutdown;
> atomic_t usage_count;
>
> ___
Thank you very much!
Best regards,
Macpaul Lin
Re: [PATCH] sound: usb: pcm: fix incorrect power state when playing sound after PM_AUTO suspend
On Tue, 2020-06-02 at 14:46 +0200, Takashi Iwai wrote: > On Tue, 02 Jun 2020 13:53:41 +0200, > Macpaul Lin wrote: > > > > This patch fix incorrect power state changed by usb_audio_suspend() > > when CONFIG_PM is enabled. > > > > After receiving suspend PM message with auto flag, usb_audio_suspend() > > change card's power state to SNDRV_CTL_POWER_D3hot. Only when the other > > resume PM message with auto flag can change power state to > > SNDRV_CTL_POWER_D0 in __usb_audio_resume(). > > > > However, when system is not under auto suspend, resume PM message with > > auto flag might not be able to receive on time which cause the power > > state was incorrect. At this time, if a player starts to play sound, > > will cause snd_usb_pcm_open() to access the card and setup_hw_info() will > > resume the card. > > > > But even the card is back to work and all function normal, the power > > state is still in SNDRV_CTL_POWER_D3hot. > > Hm, in exactly which situation does this happen? I still don't get > it. Could you elaborate how to trigger this? I'm not sure if this will happen on laptop or on PC. We've found this issue on Android phone (I'm not sure if each Android phone can reproduce this.). After booting the android phone, insert type-c headset without charging and play music at any duration, say, 1 second, then stop. Put phone away to idle about 17~18 minutes. Wait auto pm happened and the power state change to SNDRV_CTL_POWER_D3hot in sound/usb/card.c. Then wake up the phone, play music again. Then you'll probably found the music was not playing and the progress bar keep at the same position. It only happen when power state is SNDRV_CTL_POWER_D3hot. If not (the power state is SNDRV_CTL_POWER_D0), repeat the steps for several times, then it will be produced at some time. When it happened, sound_usb_pcm_open() will wake up the sound card by setup_hw_info()->__usb_audio_resume(). However, the card and the interface is function properly right now, the power state keeps remain SNDRV_CTL_POWER_D3hot. The suggestive parameter settings from upper sound request will be pending since later snd_power_wait() call will still wait the card awaken. Ideally, auto PM should be recovered by sound card itself. But once the card is awaken at this circumstance, it looks like there are not more auto pm event. And the sound system of this interface will stuck here forever until user plug out the headset (reset the hardware). The root cause is that once the card has been resumed, it should inform auto pm change the state back into SNDRV_CTL_POWER_D0 and mark the device is using by some one. > > Which cause the infinite loop > > happened in snd_power_wait() to check the power state. Thus the > > successive setting ioctl cannot be passed to card. > > > > Hence we suggest to change power state to SNDRV_CTL_POWER_D0 when card > > has been resumed successfully. > > This doesn't look like a right solution for the problem, sorry. > The card PM status must be recovered to D0 when the autoresume > succeeds. If not, something is broken there, and it must be fixed > instead of fiddling the status flag externally. Yes, I agreed, but after checking the code in sound drivers, it looks like there is only chance that auto pm triggered by low-level code in sound/usb/card.c. In kernel 4.14, auto pm suspend is triggered by snd_pcm_suspend_all(). In later kernel, it is triggered by snd_usb_pcm_suspend(). However, it looks like there are no any resume trigger to recover auto pm state when the card has been waken by sound_usb_pcm_open(). The remain resume trigger in sound/core/pcm_native.c were all static. I've tried to use these resume function in sound/usb/card.c but it seems cannot get better result than changing the power state when sound card is in use. I've replied another mail earlier includes debug patch and the other work around to verify this issue. The issue has been found on kernel-4.14, but check the code logic here in sound/usb/card.c and sound/usb/pcm.c, I think the same problem still existed in 4.19, 5.4 (used by android), and in current kernel tree. > thanks, > > Takashi If the above explanation were not clear enough, I'll try my best to explain it in more detail. Maybe the better way is to send both auto pm resume and runtime resume when sound_usb_pcm_open() is called. But according to the current codes in card.c, we might need to call __usb_audio_resume() twice in setup_hw_info(). Thanks Macpaul Lin
Re: [PATCH] sound: usb: pcm: fix incorrect power state when playing sound after PM_AUTO suspend
On Tue, 2020-06-02 at 19:53 +0800, Macpaul Lin wrote:
> This patch fix incorrect power state changed by usb_audio_suspend()
> when CONFIG_PM is enabled.
>
> After receiving suspend PM message with auto flag, usb_audio_suspend()
> change card's power state to SNDRV_CTL_POWER_D3hot. Only when the other
> resume PM message with auto flag can change power state to
> SNDRV_CTL_POWER_D0 in __usb_audio_resume().
>
> However, when system is not under auto suspend, resume PM message with
> auto flag might not be able to receive on time which cause the power
> state was incorrect. At this time, if a player starts to play sound,
> will cause snd_usb_pcm_open() to access the card and setup_hw_info() will
> resume the card.
>
> But even the card is back to work and all function normal, the power
> state is still in SNDRV_CTL_POWER_D3hot. Which cause the infinite loop
> happened in snd_power_wait() to check the power state. Thus the
> successive setting ioctl cannot be passed to card.
>
> Hence we suggest to change power state to SNDRV_CTL_POWER_D0 when card
> has been resumed successfully.
>
> Signed-off-by: Macpaul Lin
> ---
> sound/usb/pcm.c | 11 +++linux-...@vger.kernel.org,
> 1 file changed, 11 insertions(+)
>
> diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
> index a4e4064..d667ecb 100644
> --- a/sound/usb/pcm.c
> +++ b/sound/usb/pcm.c
> @@ -1322,6 +1322,17 @@ static int setup_hw_info(struct snd_pcm_runtime
> *runtime, struct snd_usb_substre
> if (err < 0)
> return err;
>
> + /* fix incorrect power state when resuming by open and later ioctls */
> + if (IS_ENABLED(CONFIG_PM) &&
> + snd_power_get_state(subs->stream->chip->card)
> + == SNDRV_CTL_POWER_D3hot) {
> + /* set these variables for power state correction */
> + subs->stream->chip->autosuspended = 0;
> + subs->stream->chip->num_suspended_intf = 1;
> + dev_info(>dev->dev,
> + "change power state from D3hot to D0\n");
> + }
> +
> return snd_usb_autoresume(subs->stream->chip);
> }
>
The issue was found on kernel 4.14 (android tree). The test is to add
debug log in sound/core/init.c to check if the power state is
SNDRV_CTL_POWER_D3hot.
diff --git a/sound/core/init.c b/sound/core/init.c
index b02a997..a0bee76 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -1011,6 +1011,8 @@ int snd_power_wait(struct snd_card *card, unsigned
int power_state)
if (snd_power_get_state(card) == power_state)
break;
set_current_state(TASK_UNINTERRUPTIBLE);
+ pr_info("%s snd_power_get_state[%x]\n", __func__,
+ snd_power_get_state(card));
schedule_timeout(30 * HZ);
}
remove_wait_queue(>power_sleep, );
After applied a work around by forcing the power state, pcm related
ioctl and parameter settings can be set to usb sound card correctly.
Otherwise a infinite loop will happened in snd_power_wait().
Here is the origin work around for verifying this power state issue on
kernel 4.14.
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 933adcd7af81..9acd50dd7155 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1274,6 +1274,16 @@ static int setup_hw_info(struct snd_pcm_runtime
*runtime, struct snd_usb_substre
if (err < 0)
return err;
+ /* avoid incorrect power state when executing IOCTL */
+ if (IS_ENABLED(CONFIG_PM) &&
+ snd_power_get_state(subs->stream->chip->card)
+ == SNDRV_CTL_POWER_D3hot) {
+ dev_info(>dev->dev,
+ "change power state from D3hot to D0\n");
+ snd_power_change_state(subs->stream->chip->card,
+ SNDRV_CTL_POWER_D0);
+ }
+
param_period_time_if_needed = SNDRV_PCM_HW_PARAM_PERIOD_TIME;
if (subs->speed == USB_SPEED_FULL)
/* full speed devices have fixed data packet interval */
However, the patch I've send is meant to make sure the power state will
be corrected before snd_usb_autoresume(), It should be adapt to kernel
4.14 and later.
Thanks.
Macpaul Lin
[PATCH] sound: usb: pcm: fix incorrect power state when playing sound after PM_AUTO suspend
This patch fix incorrect power state changed by usb_audio_suspend()
when CONFIG_PM is enabled.
After receiving suspend PM message with auto flag, usb_audio_suspend()
change card's power state to SNDRV_CTL_POWER_D3hot. Only when the other
resume PM message with auto flag can change power state to
SNDRV_CTL_POWER_D0 in __usb_audio_resume().
However, when system is not under auto suspend, resume PM message with
auto flag might not be able to receive on time which cause the power
state was incorrect. At this time, if a player starts to play sound,
will cause snd_usb_pcm_open() to access the card and setup_hw_info() will
resume the card.
But even the card is back to work and all function normal, the power
state is still in SNDRV_CTL_POWER_D3hot. Which cause the infinite loop
happened in snd_power_wait() to check the power state. Thus the
successive setting ioctl cannot be passed to card.
Hence we suggest to change power state to SNDRV_CTL_POWER_D0 when card
has been resumed successfully.
Signed-off-by: Macpaul Lin
---
sound/usb/pcm.c | 11 +++
1 file changed, 11 insertions(+)
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index a4e4064..d667ecb 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1322,6 +1322,17 @@ static int setup_hw_info(struct snd_pcm_runtime
*runtime, struct snd_usb_substre
if (err < 0)
return err;
+ /* fix incorrect power state when resuming by open and later ioctls */
+ if (IS_ENABLED(CONFIG_PM) &&
+ snd_power_get_state(subs->stream->chip->card)
+ == SNDRV_CTL_POWER_D3hot) {
+ /* set these variables for power state correction */
+ subs->stream->chip->autosuspended = 0;
+ subs->stream->chip->num_suspended_intf = 1;
+ dev_info(>dev->dev,
+ "change power state from D3hot to D0\n");
+ }
+
return snd_usb_autoresume(subs->stream->chip);
}
--
1.7.9.5
[PATCH v2] usb: host: xhci-mtk: avoid runtime suspend when removing hcd
When runtime suspend was enabled, runtime suspend might happened when xhci is removing hcd. This might cause kernel panic when hcd has been freed but runtime pm suspend related handle need to reference it. Signed-off-by: Macpaul Lin --- drivers/usb/host/xhci-mtk.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c index bfbdb3c..641d24e 100644 --- a/drivers/usb/host/xhci-mtk.c +++ b/drivers/usb/host/xhci-mtk.c @@ -587,6 +587,9 @@ static int xhci_mtk_remove(struct platform_device *dev) struct xhci_hcd *xhci = hcd_to_xhci(hcd); struct usb_hcd *shared_hcd = xhci->shared_hcd; + pm_runtime_put_sync(>dev); + pm_runtime_disable(>dev); + usb_remove_hcd(shared_hcd); xhci->shared_hcd = NULL; device_init_wakeup(>dev, false); @@ -597,8 +600,6 @@ static int xhci_mtk_remove(struct platform_device *dev) xhci_mtk_sch_exit(mtk); xhci_mtk_clks_disable(mtk); xhci_mtk_ldos_disable(mtk); - pm_runtime_put_sync(>dev); - pm_runtime_disable(>dev); return 0; } -- 1.7.9.5
[PATCH] usb: host: xhci-mtk: avoid runtime suspend when removing hcd
When runtime suspend was enabled, runtime suspend might happened when xhci is removing hcd. This might cause kernel panic when hcd has been freed but runtime pm suspend related handle need to reference it. Change-Id: I70a5dc8006207caeecbac6955ce8e5345dcc70e6 Signed-off-by: Macpaul Lin --- drivers/usb/host/xhci-mtk.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c index bfbdb3c..641d24e 100644 --- a/drivers/usb/host/xhci-mtk.c +++ b/drivers/usb/host/xhci-mtk.c @@ -587,6 +587,9 @@ static int xhci_mtk_remove(struct platform_device *dev) struct xhci_hcd *xhci = hcd_to_xhci(hcd); struct usb_hcd *shared_hcd = xhci->shared_hcd; + pm_runtime_put_sync(>dev); + pm_runtime_disable(>dev); + usb_remove_hcd(shared_hcd); xhci->shared_hcd = NULL; device_init_wakeup(>dev, false); @@ -597,8 +600,6 @@ static int xhci_mtk_remove(struct platform_device *dev) xhci_mtk_sch_exit(mtk); xhci_mtk_clks_disable(mtk); xhci_mtk_ldos_disable(mtk); - pm_runtime_put_sync(>dev); - pm_runtime_disable(>dev); return 0; } -- 1.7.9.5
[PATCH] usb: gadget: u_serial: fix coverity warning: negative index at array
This issue has been reported by coverity scanner.
Replace "int portnum" by "unsigned int", this void negative index at
array.
Signed-off-by: Stan Lu
Signed-off-by: Macpaul Lin
---
drivers/usb/gadget/function/u_serial.c |4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/u_serial.c
b/drivers/usb/gadget/function/u_serial.c
index 8167d37..53951f2 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -587,7 +587,7 @@ static int gs_start_io(struct gs_port *port)
*/
static int gs_open(struct tty_struct *tty, struct file *file)
{
- int port_num = tty->index;
+ unsigned intport_num = tty->index;
struct gs_port *port;
int status = 0;
@@ -1211,7 +1211,7 @@ int gserial_alloc_line_no_console(unsigned char *line_num)
struct gs_port *port;
struct device *tty_dev;
int ret;
- int port_num;
+ unsigned intport_num;
coding.dwDTERate = cpu_to_le32(9600);
coding.bCharFormat = 8;
--
1.7.9.5
[PATCH] usb: musb: mediatek: add reset FADDR to zero in reset interrupt handle
When receiving reset interrupt, FADDR need to be reset to zero in
periphearl mode. Otherwise ep0 cannot do enumeration when re-pluging USB
cable.
Signed-off-by: Macpaul Lin
---
drivers/usb/musb/mediatek.c |6 ++
1 file changed, 6 insertions(+)
diff --git a/drivers/usb/musb/mediatek.c b/drivers/usb/musb/mediatek.c
index 6196b0e..eebeadd 100644
--- a/drivers/usb/musb/mediatek.c
+++ b/drivers/usb/musb/mediatek.c
@@ -208,6 +208,12 @@ static irqreturn_t generic_interrupt(int irq, void *__hci)
musb->int_rx = musb_clearw(musb->mregs, MUSB_INTRRX);
musb->int_tx = musb_clearw(musb->mregs, MUSB_INTRTX);
+ if ((musb->int_usb & MUSB_INTR_RESET) && !is_host_active(musb)) {
+ /* ep0 FADDR must be 0 when (re)entering peripheral mode */
+ musb_ep_select(musb->mregs, 0);
+ musb_writeb(musb->mregs, MUSB_FADDR, 0);
+ }
+
if (musb->int_usb || musb->int_tx || musb->int_rx)
retval = musb_interrupt(musb);
--
1.7.9.5
[PATCH v6 8/8] arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks
From: Owen Chen Enable MT6765 clock configs, include topckgen, apmixedsys, infracfg, and subsystem clocks. Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin --- arch/arm64/configs/defconfig | 6 ++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig index 4d583514258c..7ab4d09120bb 100644 --- a/arch/arm64/configs/defconfig +++ b/arch/arm64/configs/defconfig @@ -455,6 +455,12 @@ CONFIG_REGULATOR_QCOM_SMD_RPM=y CONFIG_REGULATOR_QCOM_SPMI=y CONFIG_REGULATOR_RK808=y CONFIG_REGULATOR_S2MPS11=y +CONFIG_COMMON_CLK_MT6765_AUDIOSYS=y +CONFIG_COMMON_CLK_MT6765_CAMSYS=y +CONFIG_COMMON_CLK_MT6765_MMSYS=y +CONFIG_COMMON_CLK_MT6765_IMGSYS=y +CONFIG_COMMON_CLK_MT6765_VCODECSYS=y +CONFIG_COMMON_CLK_MT6765_MIPI0ASYS=y CONFIG_REGULATOR_VCTRL=m CONFIG_RC_CORE=m CONFIG_RC_DECODERS=y -- 2.18.0
[PATCH v6 7/8] arm64: dts: mediatek: add mt6765 support
From: Mars Cheng
Add basic chip support for Mediatek 6765, include
uart node with correct uart clocks, pwrap device
Add clock controller nodes, include topckgen, infracfg,
apmixedsys and subsystem.
Signed-off-by: Mars Cheng
Signed-off-by: Owen Chen
Signed-off-by: Macpaul Lin
Acked-by: Marc Zyngier
---
arch/arm64/boot/dts/mediatek/Makefile | 1 +
arch/arm64/boot/dts/mediatek/mt6765-evb.dts | 33 +++
arch/arm64/boot/dts/mediatek/mt6765.dtsi| 253
3 files changed, 287 insertions(+)
create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts
create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi
diff --git a/arch/arm64/boot/dts/mediatek/Makefile
b/arch/arm64/boot/dts/mediatek/Makefile
index 458bbc422a94..22bdf1a99a62 100644
--- a/arch/arm64/boot/dts/mediatek/Makefile
+++ b/arch/arm64/boot/dts/mediatek/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
dtb-$(CONFIG_ARCH_MEDIATEK) += mt2712-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6755-evb.dtb
+dtb-$(CONFIG_ARCH_MEDIATEK) += mt6765-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6795-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6797-evb.dtb
dtb-$(CONFIG_ARCH_MEDIATEK) += mt6797-x20-dev.dtb
diff --git a/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
b/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
new file mode 100644
index ..36dddff2b7f8
--- /dev/null
+++ b/arch/arm64/boot/dts/mediatek/mt6765-evb.dts
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * dts file for Mediatek MT6765
+ *
+ * (C) Copyright 2018. Mediatek, Inc.
+ *
+ * Mars Cheng
+ */
+
+/dts-v1/;
+#include "mt6765.dtsi"
+
+/ {
+ model = "MediaTek MT6765 EVB";
+ compatible = "mediatek,mt6765-evb", "mediatek,mt6765";
+
+ aliases {
+ serial0 =
+ };
+
+ memory@4000 {
+ device_type = "memory";
+ reg = <0 0x4000 0 0x1e80>;
+ };
+
+ chosen {
+ stdout-path = "serial0:921600n8";
+ };
+};
+
+ {
+ status = "okay";
+};
diff --git a/arch/arm64/boot/dts/mediatek/mt6765.dtsi
b/arch/arm64/boot/dts/mediatek/mt6765.dtsi
new file mode 100644
index ..2662470fe607
--- /dev/null
+++ b/arch/arm64/boot/dts/mediatek/mt6765.dtsi
@@ -0,0 +1,253 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * dts file for Mediatek MT6765
+ *
+ * (C) Copyright 2018. Mediatek, Inc.
+ *
+ * Mars Cheng
+ */
+
+#include
+#include
+#include
+
+/ {
+ compatible = "mediatek,mt6765";
+ interrupt-parent = <>;
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+ };
+
+ cpus {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ cpu@0 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x000>;
+ };
+
+ cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x001>;
+ };
+
+ cpu@2 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x002>;
+ };
+
+ cpu@3 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x003>;
+ };
+
+ cpu@100 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x100>;
+ };
+
+ cpu@101 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x101>;
+ };
+
+ cpu@102 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "psci";
+ reg = <0x102>;
+ };
+
+ cpu@103 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ enable-method = "p
[PATCH v6 6/8] soc: mediatek: add MT6765 scpsys and subdomain support
From: Mars Cheng
This adds scpsys support for MT6765
Add subdomain support for MT6765:
isp, mm, connsys, mfg, and cam.
Signed-off-by: Mars Cheng
Signed-off-by: Owen Chen
Signed-off-by: Macpaul Lin
---
drivers/soc/mediatek/mtk-scpsys.c | 130 ++
1 file changed, 130 insertions(+)
diff --git a/drivers/soc/mediatek/mtk-scpsys.c
b/drivers/soc/mediatek/mtk-scpsys.c
index ea5a221a16e9..ff124c514e9c 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -16,6 +16,7 @@
#include
#include
+#include
#include
#include
#include
@@ -869,6 +870,120 @@ static const struct scp_subdomain scp_subdomain_mt2712[]
= {
{MT2712_POWER_DOMAIN_MFG_SC2, MT2712_POWER_DOMAIN_MFG_SC3},
};
+/*
+ * MT6765 power domain support
+ */
+#define SPM_PWR_STATUS_MT6765 0x0180
+#define SPM_PWR_STATUS_2ND_MT6765 0x0184
+
+static const struct scp_domain_data scp_domain_data_mt6765[] = {
+ [MT6765_POWER_DOMAIN_VCODEC] = {
+ .name = "vcodec",
+ .sta_mask = BIT(26),
+ .ctl_offs = 0x300,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ },
+ [MT6765_POWER_DOMAIN_ISP] = {
+ .name = "isp",
+ .sta_mask = BIT(5),
+ .ctl_offs = 0x308,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ .subsys_clk_prefix = "isp",
+ .bp_table = {
+ BUS_PROT(IFR_TYPE, 0x2A8, 0x2AC, 0, 0x258,
+ BIT(20), BIT(20)),
+ BUS_PROT(SMI_TYPE, 0x3C4, 0x3C8, 0, 0x3C0,
+ BIT(2), BIT(2)),
+ },
+ },
+ [MT6765_POWER_DOMAIN_MM] = {
+ .name = "mm",
+ .sta_mask = BIT(3),
+ .ctl_offs = 0x30C,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ .basic_clk_id = {"mm"},
+ .subsys_clk_prefix = "mm",
+ .bp_table = {
+ BUS_PROT(IFR_TYPE, 0x2A8, 0x2AC, 0, 0x258,
+ BIT(16) | BIT(17), BIT(16) | BIT(17)),
+ BUS_PROT(IFR_TYPE, 0x2A0, 0x2A4, 0, 0x228,
+ BIT(10) | BIT(11), BIT(10) | BIT(11)),
+ BUS_PROT(IFR_TYPE, 0x2A0, 0x2A4, 0, 0x228,
+ BIT(1) | BIT(2), BIT(1) | BIT(2)),
+ },
+ },
+ [MT6765_POWER_DOMAIN_CONN] = {
+ .name = "conn",
+ .sta_mask = BIT(1),
+ .ctl_offs = 0x32C,
+ .sram_pdn_bits = 0,
+ .sram_pdn_ack_bits = 0,
+ .bp_table = {
+ BUS_PROT(IFR_TYPE, 0x2A0, 0x2A4, 0, 0x228,
+ BIT(13), BIT(13)),
+ BUS_PROT(IFR_TYPE, 0x2A8, 0x2AC, 0, 0x258,
+ BIT(18), BIT(18)),
+ BUS_PROT(IFR_TYPE, 0x2A0, 0x2A4, 0, 0x228,
+ BIT(14) | BIT(16), BIT(14) | BIT(16)),
+ },
+ },
+ [MT6765_POWER_DOMAIN_MFG_ASYNC] = {
+ .name = "mfg_async",
+ .sta_mask = BIT(23),
+ .ctl_offs = 0x334,
+ .sram_pdn_bits = 0,
+ .sram_pdn_ack_bits = 0,
+ .basic_clk_id = {"mfg"},
+ },
+ [MT6765_POWER_DOMAIN_MFG] = {
+ .name = "mfg",
+ .sta_mask = BIT(4),
+ .ctl_offs = 0x338,
+ .sram_pdn_bits = GENMASK(8, 8),
+ .sram_pdn_ack_bits = GENMASK(12, 12),
+ .bp_table = {
+ BUS_PROT(IFR_TYPE, 0x2A0, 0x2A4, 0, 0x228,
+ BIT(25), BIT(25)),
+ BUS_PROT(IFR_TYPE, 0x2A0, 0x2A4, 0, 0x228,
+ BIT(21) | BIT(22), BIT(21) | BIT(22)),
+ }
+ },
+ [MT6765_POWER_DOMAIN_CAM] = {
+ .name = "cam",
+ .sta_mask = BIT(25),
+ .ctl_offs = 0x344,
+ .sram_pdn_bits = GENMASK(8, 9),
+ .sram_pdn_ack_bits = GENMASK(12, 13),
+ .subsys_clk_prefix = "cam",
+ .bp_table = {
+ BUS_PROT(IFR_TYPE, 0x2A8, 0x2AC, 0, 0x258,
+ BIT(19) | BIT(21), BIT(19) | BIT(21)),
+ BUS_PROT(IFR_TYPE, 0x2A0, 0x2A4, 0, 0x228,
+ BIT(20), BIT(20)),
+ BUS_PROT(SMI_TYPE, 0x3C4, 0x3C8, 0, 0x3C0,
+ BIT(3), BIT(3)),
+ }
+ },
+ [MT6765_POWER_DOMAIN_M
[PATCH v6 4/8] clk: mediatek: add mt6765 clock IDs
From: Mars Cheng Add MT6765 clock dt-bindings, include topckgen, apmixedsys, infracfg, mcucfg and subsystem clocks. Signed-off-by: Mars Cheng Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin --- include/dt-bindings/clock/mt6765-clk.h | 313 + 1 file changed, 313 insertions(+) create mode 100644 include/dt-bindings/clock/mt6765-clk.h diff --git a/include/dt-bindings/clock/mt6765-clk.h b/include/dt-bindings/clock/mt6765-clk.h new file mode 100644 index ..eb97e568518e --- /dev/null +++ b/include/dt-bindings/clock/mt6765-clk.h @@ -0,0 +1,313 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#ifndef _DT_BINDINGS_CLK_MT6765_H +#define _DT_BINDINGS_CLK_MT6765_H + +/* FIX Clks */ +#define CLK_TOP_CLK26M 0 + +/* APMIXEDSYS */ +#define CLK_APMIXED_ARMPLL_L 0 +#define CLK_APMIXED_ARMPLL 1 +#define CLK_APMIXED_CCIPLL 2 +#define CLK_APMIXED_MAINPLL3 +#define CLK_APMIXED_MFGPLL 4 +#define CLK_APMIXED_MMPLL 5 +#define CLK_APMIXED_UNIV2PLL 6 +#define CLK_APMIXED_MSDCPLL7 +#define CLK_APMIXED_APLL1 8 +#define CLK_APMIXED_MPLL 9 +#define CLK_APMIXED_ULPOSC110 +#define CLK_APMIXED_ULPOSC211 +#define CLK_APMIXED_SSUSB26M 12 +#define CLK_APMIXED_APPLL26M 13 +#define CLK_APMIXED_MIPIC0_26M 14 +#define CLK_APMIXED_MDPLLGP26M 15 +#define CLK_APMIXED_MMSYS_F26M 16 +#define CLK_APMIXED_UFS26M 17 +#define CLK_APMIXED_MIPIC1_26M 18 +#define CLK_APMIXED_MEMPLL26M 19 +#define CLK_APMIXED_CLKSQ_LVPLL_26M20 +#define CLK_APMIXED_MIPID0_26M 21 +#define CLK_APMIXED_NR_CLK 22 + +/* TOPCKGEN */ +#define CLK_TOP_SYSPLL 0 +#define CLK_TOP_SYSPLL_D2 1 +#define CLK_TOP_SYSPLL1_D2 2 +#define CLK_TOP_SYSPLL1_D4 3 +#define CLK_TOP_SYSPLL1_D8 4 +#define CLK_TOP_SYSPLL1_D165 +#define CLK_TOP_SYSPLL_D3 6 +#define CLK_TOP_SYSPLL2_D2 7 +#define CLK_TOP_SYSPLL2_D4 8 +#define CLK_TOP_SYSPLL2_D8 9 +#define CLK_TOP_SYSPLL_D5 10 +#define CLK_TOP_SYSPLL3_D2 11 +#define CLK_TOP_SYSPLL3_D4 12 +#define CLK_TOP_SYSPLL_D7 13 +#define CLK_TOP_SYSPLL4_D2 14 +#define CLK_TOP_SYSPLL4_D4 15 +#define CLK_TOP_USB20_192M 16 +#define CLK_TOP_USB20_192M_D4 17 +#define CLK_TOP_USB20_192M_D8 18 +#define CLK_TOP_USB20_192M_D16 19 +#define CLK_TOP_USB20_192M_D32 20 +#define CLK_TOP_UNIVPLL21 +#define CLK_TOP_UNIVPLL_D2 22 +#define CLK_TOP_UNIVPLL1_D223 +#define CLK_TOP_UNIVPLL1_D424 +#define CLK_TOP_UNIVPLL_D3 25 +#define CLK_TOP_UNIVPLL2_D226 +#define CLK_TOP_UNIVPLL2_D427 +#define CLK_TOP_UNIVPLL2_D828 +#define CLK_TOP_UNIVPLL2_D32 29 +#define CLK_TOP_UNIVPLL_D5 30 +#define CLK_TOP_UNIVPLL3_D231 +#define CLK_TOP_UNIVPLL3_D432 +#define CLK_TOP_MMPLL 33 +#define CLK_TOP_MMPLL_D2 34 +#define CLK_TOP_MPLL 35 +#define CLK_TOP_DA_MPLL_104M_DIV 36 +#define CLK_TOP_DA_MPLL_52M_DIV37 +#define CLK_TOP_MFGPLL 38 +#define CLK_TOP_MSDCPLL39 +#define CLK_TOP_MSDCPLL_D2 40 +#define CLK_TOP_APLL1 41 +#define CLK_TOP_APLL1_D2 42 +#define CLK_TOP_APLL1_D4 43 +#define CLK_TOP_APLL1_D8 44 +#define CLK_TOP_ULPOSC145 +#define CLK_TOP_ULPOSC1_D2 46 +#define CLK_TOP_ULPOSC1_D4 47 +#define CLK_TOP_ULPOSC1_D8 48 +#define CLK_TOP_ULPOSC1_D1649 +#define CLK_TOP_ULPOSC1_D3250 +#define CLK_TOP_DMPLL 51 +#define CLK_TOP_F_FRTC 52 +#define CLK_TOP_F_F26M 53 +#define CLK_TOP_AXI54 +#define CLK_TOP_MM 55 +#define CLK_TOP_SCP56 +#define CLK_TOP_MFG57 +#define CLK_TOP_F_FUART58 +#define CLK_TOP_SPI59 +#define CLK_TOP_MSDC50_0 60 +#define CLK_TOP_MSDC30_1 61 +#define CLK_TOP_AUDIO 62 +#define CLK_TOP_AUD_1 63 +#define CLK_TOP_AUD_ENGEN1 64 +#define CLK_TOP_F_FDISP_PWM65 +#define CLK_TOP_SSPM 66 +#define CLK_TOP_DXCC 67 +#define CLK_TOP_I2C68 +#define CLK_TOP_F_FPWM 69 +#define CLK_TOP_F_FSENINF 70 +#define CLK_TOP_AES_FDE71 +#define CLK_TOP_F_BIST2FPC 72 +#define CLK_TOP_ARMPLL_DIVIDER_PLL0
[PATCH v6 5/8] clk: mediatek: Add MT6765 clock support
From: Owen Chen Add MT6765 clock support, include topckgen, apmixedsys, infracfg, mcucfg and subsystem clocks. Signed-off-by: Owen Chen Signed-off-by: Mars Cheng Signed-off-by: Macpaul Lin --- drivers/clk/mediatek/Kconfig | 86 ++ drivers/clk/mediatek/Makefile| 7 + drivers/clk/mediatek/clk-mt6765-audio.c | 109 +++ drivers/clk/mediatek/clk-mt6765-cam.c| 83 ++ drivers/clk/mediatek/clk-mt6765-img.c| 79 ++ drivers/clk/mediatek/clk-mt6765-mipi0a.c | 77 ++ drivers/clk/mediatek/clk-mt6765-mm.c | 105 +++ drivers/clk/mediatek/clk-mt6765-vcodec.c | 79 ++ drivers/clk/mediatek/clk-mt6765.c| 961 +++ 9 files changed, 1586 insertions(+) create mode 100644 drivers/clk/mediatek/clk-mt6765-audio.c create mode 100644 drivers/clk/mediatek/clk-mt6765-cam.c create mode 100644 drivers/clk/mediatek/clk-mt6765-img.c create mode 100644 drivers/clk/mediatek/clk-mt6765-mipi0a.c create mode 100644 drivers/clk/mediatek/clk-mt6765-mm.c create mode 100644 drivers/clk/mediatek/clk-mt6765-vcodec.c create mode 100644 drivers/clk/mediatek/clk-mt6765.c diff --git a/drivers/clk/mediatek/Kconfig b/drivers/clk/mediatek/Kconfig index 4d8a9aef95f6..1a8db28f9d10 100644 --- a/drivers/clk/mediatek/Kconfig +++ b/drivers/clk/mediatek/Kconfig @@ -116,6 +116,92 @@ config COMMON_CLK_MT2712_VENCSYS ---help--- This driver supports MediaTek MT2712 vencsys clocks. +config COMMON_CLK_MT6765 + bool "Clock driver for MediaTek MT6765" + depends on (ARCH_MEDIATEK && ARM64) || COMPILE_TEST + select COMMON_CLK_MEDIATEK + default ARCH_MEDIATEK && ARM64 + help + This driver supports MediaTek MT6765 basic clocks. + +config COMMON_CLK_MT6765_AUDIOSYS + bool "Clock driver for MediaTek MT6765 audiosys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 audiosys clocks. + +config COMMON_CLK_MT6765_CAMSYS + bool "Clock driver for MediaTek MT6765 camsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 camsys clocks. + +config COMMON_CLK_MT6765_GCESYS + bool "Clock driver for MediaTek MT6765 gcesys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 gcesys clocks. + +config COMMON_CLK_MT6765_MMSYS + bool "Clock driver for MediaTek MT6765 mmsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mmsys clocks. + +config COMMON_CLK_MT6765_IMGSYS + bool "Clock driver for MediaTek MT6765 imgsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 imgsys clocks. + +config COMMON_CLK_MT6765_VCODECSYS + bool "Clock driver for MediaTek MT6765 vcodecsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 vcodecsys clocks. + +config COMMON_CLK_MT6765_MFGSYS + bool "Clock driver for MediaTek MT6765 mfgsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mfgsys clocks. + +config COMMON_CLK_MT6765_MIPI0ASYS + bool "Clock driver for MediaTek MT6765 mipi0asys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mipi0asys clocks. + +config COMMON_CLK_MT6765_MIPI0BSYS + bool "Clock driver for MediaTek MT6765 mipi0bsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mipi0bsys clocks. + +config COMMON_CLK_MT6765_MIPI1ASYS + bool "Clock driver for MediaTek MT6765 mipi1asys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mipi1asys clocks. + +config COMMON_CLK_MT6765_MIPI1BSYS + bool "Clock driver for MediaTek MT6765 mipi1bsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mipi1bsys clocks. + +config COMMON_CLK_MT6765_MIPI2ASYS + bool "Clock driver for MediaTek MT6765 mipi2asys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mipi2asys clocks. + +config COMMON_CLK_MT6765_MIPI2BSYS + bool "Clock driver for MediaTek MT6765 mipi2bsys" + depends on COMMON_CLK_MT6765 + help + This driver supports MediaTek MT6765 mipi2bsys clocks. + config COMMON_CLK_MT6797 bool "Clock driver for MediaTek MT6797" depends on (ARCH_MEDIATEK && ARM64) || COMPILE_TEST diff --git a/drivers/clk/mediatek/Makefile b/drivers/clk/mediatek/Makefile index f74937b35f68..c368442914a8 100644 --- a/drivers/clk/mediatek/Makefile +++ b/drivers/clk/mediatek/Makefile @@ -1,6 +1,13 @@ # SPDX-License-Identifier: GPL-
[PATCH v6 3/8] dt-bindings: mediatek: add MT6765 power dt-bindings
From: Mars Cheng This adds power dt-bindings for MT6765 Signed-off-by: Mars Cheng Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin Reviewed-by: Rob Herring --- .../devicetree/bindings/soc/mediatek/scpsys.txt| 6 ++ include/dt-bindings/power/mt6765-power.h | 14 ++ 2 files changed, 20 insertions(+) create mode 100644 include/dt-bindings/power/mt6765-power.h diff --git a/Documentation/devicetree/bindings/soc/mediatek/scpsys.txt b/Documentation/devicetree/bindings/soc/mediatek/scpsys.txt index 00eab7e6ff22..6109b4992522 100644 --- a/Documentation/devicetree/bindings/soc/mediatek/scpsys.txt +++ b/Documentation/devicetree/bindings/soc/mediatek/scpsys.txt @@ -10,6 +10,7 @@ domain control. The driver implements the Generic PM domain bindings described in power/power_domain.txt. It provides the power domains defined in - include/dt-bindings/power/mt8173-power.h +- include/dt-bindings/power/mt6765-power.h - include/dt-bindings/power/mt6797-power.h - include/dt-bindings/power/mt2701-power.h - include/dt-bindings/power/mt2712-power.h @@ -20,6 +21,7 @@ Required properties: - compatible: Should be one of: - "mediatek,mt2701-scpsys" - "mediatek,mt2712-scpsys" + - "mediatek,mt6765-scpsys" - "mediatek,mt6797-scpsys" - "mediatek,mt7622-scpsys" - "mediatek,mt7623-scpsys", "mediatek,mt2701-scpsys": For MT7623 SoC @@ -38,6 +40,10 @@ Required properties: enabled before releasing bus protection. Required clocks for MT2701 or MT7623: "mm", "mfg", "ethif" Required clocks for MT2712: "mm", "mfg", "venc", "jpgdec", "audio", "vdec" + Required clocks for MT6765: MUX: "mm", "mfg" + CG: "mm-0", "mm-1", "mm-2", "mm-3", "isp-0", + "isp-1", "cam-0", "cam-1", "cam-2", + "cam-3","cam-4" Required clocks for MT6797: "mm", "mfg", "vdec" Required clocks for MT7622 or MT7629: "hif_sel" Required clocks for MT7623A: "ethif" diff --git a/include/dt-bindings/power/mt6765-power.h b/include/dt-bindings/power/mt6765-power.h new file mode 100644 index ..d347b4ee9eed --- /dev/null +++ b/include/dt-bindings/power/mt6765-power.h @@ -0,0 +1,14 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _DT_BINDINGS_POWER_MT6765_POWER_H +#define _DT_BINDINGS_POWER_MT6765_POWER_H + +#define MT6765_POWER_DOMAIN_CONN 0 +#define MT6765_POWER_DOMAIN_MM 1 +#define MT6765_POWER_DOMAIN_MFG_ASYNC 2 +#define MT6765_POWER_DOMAIN_ISP3 +#define MT6765_POWER_DOMAIN_MFG4 +#define MT6765_POWER_DOMAIN_MFG_CORE0 5 +#define MT6765_POWER_DOMAIN_CAM6 +#define MT6765_POWER_DOMAIN_VCODEC 7 + +#endif /* _DT_BINDINGS_POWER_MT6765_POWER_H */ -- 2.18.0
[PATCH v6 2/8] dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC
From: Mars Cheng This patch adds MT6765 smi binding document Signed-off-by: Mars Cheng Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin Acked-by: Rob Herring --- .../bindings/memory-controllers/mediatek,smi-common.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.txt b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.txt index 01744ec6a75b..f7122d88a885 100644 --- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.txt +++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.txt @@ -18,6 +18,7 @@ Required properties: - compatible : must be one of : "mediatek,mt2701-smi-common" "mediatek,mt2712-smi-common" + "mediatek,mt6765-smi-common", "syscon" "mediatek,mt7623-smi-common", "mediatek,mt2701-smi-common" "mediatek,mt8173-smi-common" "mediatek,mt8183-smi-common", "syscon" -- 2.18.0
[PATCH v6 1/8] dt-bindings: clock: mediatek: document clk bindings for Mediatek MT6765 SoC
From: Mars Cheng This patch adds the binding documentation for apmixedsys, audsys, camsys, imgsys, infracfg, mipi0a, topckgen, vcodecsys Signed-off-by: Mars Cheng Signed-off-by: Owen Chen Signed-off-by: Macpaul Lin --- .../arm/mediatek/mediatek,apmixedsys.txt | 1 + .../bindings/arm/mediatek/mediatek,audsys.txt | 1 + .../bindings/arm/mediatek/mediatek,camsys.txt | 1 + .../bindings/arm/mediatek/mediatek,imgsys.txt | 1 + .../arm/mediatek/mediatek,infracfg.txt| 1 + .../bindings/arm/mediatek/mediatek,mipi0a.txt | 28 +++ .../bindings/arm/mediatek/mediatek,mmsys.txt | 1 + .../arm/mediatek/mediatek,pericfg.txt | 1 + .../arm/mediatek/mediatek,topckgen.txt| 1 + .../arm/mediatek/mediatek,vcodecsys.txt | 27 ++ 10 files changed, 63 insertions(+) create mode 100644 Documentation/devicetree/bindings/arm/mediatek/mediatek,mipi0a.txt create mode 100644 Documentation/devicetree/bindings/arm/mediatek/mediatek,vcodecsys.txt diff --git a/Documentation/devicetree/bindings/arm/mediatek/mediatek,apmixedsys.txt b/Documentation/devicetree/bindings/arm/mediatek/mediatek,apmixedsys.txt index 161e63a6c254..5f2757e0f844 100644 --- a/Documentation/devicetree/bindings/arm/mediatek/mediatek,apmixedsys.txt +++ b/Documentation/devicetree/bindings/arm/mediatek/mediatek,apmixedsys.txt @@ -8,6 +8,7 @@ Required Properties: - compatible: Should be one of: - "mediatek,mt2701-apmixedsys" - "mediatek,mt2712-apmixedsys", "syscon" + - "mediatek,mt6765-apmixedsys", "syscon" - "mediatek,mt6797-apmixedsys" - "mediatek,mt7622-apmixedsys" - "mediatek,mt7623-apmixedsys", "mediatek,mt2701-apmixedsys" diff --git a/Documentation/devicetree/bindings/arm/mediatek/mediatek,audsys.txt b/Documentation/devicetree/bindings/arm/mediatek/mediatek,audsys.txt index f3cef1a6d95c..243db5275438 100644 --- a/Documentation/devicetree/bindings/arm/mediatek/mediatek,audsys.txt +++ b/Documentation/devicetree/bindings/arm/mediatek/mediatek,audsys.txt @@ -7,6 +7,7 @@ Required Properties: - compatible: Should be one of: - "mediatek,mt2701-audsys", "syscon" + - "mediatek,mt6765-audsys", "syscon" - "mediatek,mt7622-audsys", "syscon" - "mediatek,mt7623-audsys", "mediatek,mt2701-audsys", "syscon" - "mediatek,mt8183-audiosys", "syscon" diff --git a/Documentation/devicetree/bindings/arm/mediatek/mediatek,camsys.txt b/Documentation/devicetree/bindings/arm/mediatek/mediatek,camsys.txt index d8930f64aa98..17acc4c5402c 100644 --- a/Documentation/devicetree/bindings/arm/mediatek/mediatek,camsys.txt +++ b/Documentation/devicetree/bindings/arm/mediatek/mediatek,camsys.txt @@ -6,6 +6,7 @@ The MediaTek camsys controller provides various clocks to the system. Required Properties: - compatible: Should be one of: + - "mediatek,mt6765-camsys", "syscon" - "mediatek,mt8183-camsys", "syscon" - #clock-cells: Must be 1 diff --git a/Documentation/devicetree/bindings/arm/mediatek/mediatek,imgsys.txt b/Documentation/devicetree/bindings/arm/mediatek/mediatek,imgsys.txt index e3bc4a1e7a6e..4e7b617acfb6 100644 --- a/Documentation/devicetree/bindings/arm/mediatek/mediatek,imgsys.txt +++ b/Documentation/devicetree/bindings/arm/mediatek/mediatek,imgsys.txt @@ -8,6 +8,7 @@ Required Properties: - compatible: Should be one of: - "mediatek,mt2701-imgsys", "syscon" - "mediatek,mt2712-imgsys", "syscon" + - "mediatek,mt6765-imgsys", "syscon" - "mediatek,mt6797-imgsys", "syscon" - "mediatek,mt7623-imgsys", "mediatek,mt2701-imgsys", "syscon" - "mediatek,mt8173-imgsys", "syscon" diff --git a/Documentation/devicetree/bindings/arm/mediatek/mediatek,infracfg.txt b/Documentation/devicetree/bindings/arm/mediatek/mediatek,infracfg.txt index a90913988d7e..6a6ffb61dd29 100644 --- a/Documentation/devicetree/bindings/arm/mediatek/mediatek,infracfg.txt +++ b/Documentation/devicetree/bindings/arm/mediatek/mediatek,infracfg.txt @@ -9,6 +9,7 @@ Required Properties: - compatible: Should be one of: - "mediatek,mt2701-infracfg", "syscon" - "mediatek,mt2712-infracfg", "syscon" + - "mediatek,mt6765-infracfg", "syscon" - "mediatek,mt6797-infracfg", "syscon" - "mediatek,mt7622-infracfg", "syscon" - "mediatek,mt7623-infracfg", "mediatek,mt2701-infracfg", "syscon" diff --git a/Documentation/devicetree/bindings/arm/mediatek/mediatek,mipi0a.txt b/Do
[PATCH v6 0/8] Add basic SoC support for mt6765
This patch adds basic SoC support for Mediatek's new 8-core SoC, MT6765, which is mainly for smartphone application. Changes in V6: 1. Adapt V5's patchset to latest kernel tree. Origin V5 patchset. https://lore.kernel.org/patchwork/cover/963612/ 2. Due to clk's common code has been submit by other platform, this patch set will have dependencies with the following patchsets as the following orders. 2.a. [v8,00/21] MT8183 IOMMU SUPPORT https://patchwork.kernel.org/cover/11023585/ 2.b. [v11,0/6] Add basic node support for Mediatek MT8183 SoC https://patchwork.kernel.org/cover/10962385/ 2.c. [v6,00/14] Mediatek MT8183 scpsys support https://patchwork.kernel.org/cover/11005751/ 3. Correct power related patches into dt-binding patches. 4. Re-order V5's 4/11, 6/11, and 7/11 due clk common code change and make dependencies in order. 5. Update some commit message in clk related patches. Changes in V5: 1. add clk support Changes in V4: 1. add gic's settings in reg properties 2. remove some patches about dt-bindings since GKH already took them Changes in V3: 1. split dt-binding document patchs 2. fix mt6765.dtsi warnings with W=12 3. remove uncessary PPI affinity for timer 4. add gicc base for gic dt node Changes in V2: 1. fix clk properties in uart dts node 2. fix typo in submit title 3. add simple-bus in mt6765.dtsi 4. use correct SPDX license format Mars Cheng (6): dt-bindings: clock: mediatek: document clk bindings for Mediatek MT6765 SoC dt-bindings: mediatek: Add smi dts binding for Mediatek MT6765 SoC dt-bindings: mediatek: add MT6765 power dt-bindings clk: mediatek: add mt6765 clock IDs soc: mediatek: add MT6765 scpsys and subdomain support arm64: dts: mediatek: add mt6765 support Owen Chen (2): clk: mediatek: Add MT6765 clock support arm64: defconfig: add CONFIG_COMMON_CLK_MT6765_XXX clocks .../arm/mediatek/mediatek,apmixedsys.txt | 1 + .../bindings/arm/mediatek/mediatek,audsys.txt | 1 + .../bindings/arm/mediatek/mediatek,camsys.txt | 1 + .../bindings/arm/mediatek/mediatek,imgsys.txt | 1 + .../arm/mediatek/mediatek,infracfg.txt| 1 + .../bindings/arm/mediatek/mediatek,mipi0a.txt | 28 + .../bindings/arm/mediatek/mediatek,mmsys.txt | 1 + .../arm/mediatek/mediatek,pericfg.txt | 1 + .../arm/mediatek/mediatek,topckgen.txt| 1 + .../arm/mediatek/mediatek,vcodecsys.txt | 27 + .../mediatek,smi-common.txt | 1 + .../bindings/soc/mediatek/scpsys.txt | 6 + arch/arm64/boot/dts/mediatek/Makefile | 1 + arch/arm64/boot/dts/mediatek/mt6765-evb.dts | 33 + arch/arm64/boot/dts/mediatek/mt6765.dtsi | 253 + arch/arm64/configs/defconfig | 6 + drivers/clk/mediatek/Kconfig | 86 ++ drivers/clk/mediatek/Makefile | 7 + drivers/clk/mediatek/clk-mt6765-audio.c | 109 ++ drivers/clk/mediatek/clk-mt6765-cam.c | 83 ++ drivers/clk/mediatek/clk-mt6765-img.c | 79 ++ drivers/clk/mediatek/clk-mt6765-mipi0a.c | 77 ++ drivers/clk/mediatek/clk-mt6765-mm.c | 105 ++ drivers/clk/mediatek/clk-mt6765-vcodec.c | 79 ++ drivers/clk/mediatek/clk-mt6765.c | 961 ++ drivers/soc/mediatek/mtk-scpsys.c | 130 +++ include/dt-bindings/clock/mt6765-clk.h| 313 ++ include/dt-bindings/power/mt6765-power.h | 14 + 28 files changed, 2406 insertions(+) create mode 100644 Documentation/devicetree/bindings/arm/mediatek/mediatek,mipi0a.txt create mode 100644 Documentation/devicetree/bindings/arm/mediatek/mediatek,vcodecsys.txt create mode 100644 arch/arm64/boot/dts/mediatek/mt6765-evb.dts create mode 100644 arch/arm64/boot/dts/mediatek/mt6765.dtsi create mode 100644 drivers/clk/mediatek/clk-mt6765-audio.c create mode 100644 drivers/clk/mediatek/clk-mt6765-cam.c create mode 100644 drivers/clk/mediatek/clk-mt6765-img.c create mode 100644 drivers/clk/mediatek/clk-mt6765-mipi0a.c create mode 100644 drivers/clk/mediatek/clk-mt6765-mm.c create mode 100644 drivers/clk/mediatek/clk-mt6765-vcodec.c create mode 100644 drivers/clk/mediatek/clk-mt6765.c create mode 100644 include/dt-bindings/clock/mt6765-clk.h create mode 100644 include/dt-bindings/power/mt6765-power.h -- 2.18.0
[PATCH] mtu3: fix setup packet response for HNP and SRP request
1. Add OTG_HNP_REQD and OTG_SRP_REQD definitions in ch9.h.
2. When OTG_HNP_REQD and OTG_SRP_REQD has been received,
usb hardware must not enter TEST mode but need to response setup packet.
3. Add otg_srp_reqd and otg_hnp_reqd in struct ssusb_mtk for futher
implementation.
Signed-off-by: Macpaul Lin
---
drivers/usb/mtu3/mtu3.h| 4
drivers/usb/mtu3/mtu3_gadget_ep0.c | 13 +
include/uapi/linux/usb/ch9.h | 5 +
3 files changed, 22 insertions(+)
diff --git a/drivers/usb/mtu3/mtu3.h b/drivers/usb/mtu3/mtu3.h
index 76ecf12fdf62..bb8a31bc6e4d 100644
--- a/drivers/usb/mtu3/mtu3.h
+++ b/drivers/usb/mtu3/mtu3.h
@@ -226,6 +226,8 @@ struct otg_switch_mtk {
* @dma_clk: dma_bus_ck clock for AXI bus etc
* @dr_mode: works in which mode:
* host only, device only or dual-role mode
+ * @otg_srp_reqd: used for SRP request handling.
+ * @otg_hnp_reqd: used for HNP request handling.
* @u2_ports: number of usb2.0 host ports
* @u3_ports: number of usb3.0 host ports
* @u3p_dis_msk: mask of disabling usb3 ports, for example, bit0==1 to
@@ -252,6 +254,8 @@ struct ssusb_mtk {
/* otg */
struct otg_switch_mtk otg_switch;
enum usb_dr_mode dr_mode;
+ bool otg_srp_reqd;
+ bool otg_hnp_reqd;
bool is_host;
int u2_ports;
int u3_ports;
diff --git a/drivers/usb/mtu3/mtu3_gadget_ep0.c
b/drivers/usb/mtu3/mtu3_gadget_ep0.c
index 4da216c99726..1247c43a63e6 100644
--- a/drivers/usb/mtu3/mtu3_gadget_ep0.c
+++ b/drivers/usb/mtu3/mtu3_gadget_ep0.c
@@ -285,11 +285,24 @@ static int handle_test_mode(struct mtu3 *mtu, struct
usb_ctrlrequest *setup)
dev_dbg(mtu->dev, "TEST_PACKET\n");
mtu->test_mode_nr = TEST_PACKET_MODE;
break;
+ case OTG_SRP_REQD:
+ dev_dbg(mtu->dev, "OTG_SRP_REQD\n");
+ mtu->ssusb->otg_srp_reqd = 1;
+ break;
+ case OTG_HNP_REQD:
+ dev_dbg(mtu->dev, "OTG_HNP_REQD\n");
+ mtu->ssusb->otg_hnp_reqd = 1;
+ break;
default:
handled = -EINVAL;
goto out;
}
+ if (mtu->ssusb->otg_srp_reqd || mtu->ssusb->otg_hnp_reqd) {
+ mtu->ep0_state = MU3D_EP0_STATE_SETUP;
+ goto out;
+ }
+
mtu->test_mode = true;
/* no TX completion interrupt, and need restart platform after test */
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index d5a5caec8fbc..545918c83fd1 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -143,6 +143,11 @@
#defineTEST_SE0_NAK3
#defineTEST_PACKET 4
#defineTEST_FORCE_EN 5
+/*
+ * OTG HNP and SRP REQD
+ */
+#defineOTG_SRP_REQD6
+#defineOTG_HNP_REQD7
/* Status Type */
#define USB_STATUS_TYPE_STANDARD 0
--
2.18.0
Re: [PATCH v3] usb: gadget: configfs: Fix KASAN use-after-free
Hi Jim, > Jim Lin <ji...@nvidia.com> writes: > > When gadget is disconnected, running sequence is like this. > > . composite_disconnect > > . Call trace: > > usb_string_copy+0xd0/0x128 > > gadget_config_name_configuration_store+0x4 > > gadget_config_name_attr_store+0x40/0x50 > > configfs_write_file+0x198/0x1f4 > > vfs_write+0x100/0x220 > > SyS_write+0x58/0xa8 > > . configfs_composite_unbind > > . configfs_composite_bind > > [deleted] > > When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling > > memory is accessed, "BUG: KASAN: use-after-free" error occurs. > > > > Signed-off-by: Jim Lin <ji...@nvidia.com> > > --- > > Changes in v2: > > Changes in v3: > > Change commit description > > well, I need to be sure you tested this with Linus' tree. The reason I'm > asking is because this could be a bug caused by Android changes. From > your previous patch, the problem started with android_setup(). > > Please test with v4.10-rc4 and any configfs-based gadget. > > -- > balbi I've got the similar problem on Android, however, Linux guys require you and other people to test your patch on pure Linux. Since Linux is exactly a "PC" based OS, only common patches should be commit to Linux code base. Except the bug is quite common in 3 OS, in "Linux PC" and in "Android Linux" or "Chromium OS". I'm not sure about the difference between Chromium OS and Linux PC. According to CVE report, it looks like the change is from Chromium OS? Dose Nvidia has a pure Linux software team can verify your patch on your platform? I think if you can prove the result is okay on Linux PC or on Chromium OS will help. -- Best regards, Macpaul Lin
Re: [PATCH v3] usb: gadget: configfs: Fix KASAN use-after-free
Hi Jim, > Jim Lin writes: > > When gadget is disconnected, running sequence is like this. > > . composite_disconnect > > . Call trace: > > usb_string_copy+0xd0/0x128 > > gadget_config_name_configuration_store+0x4 > > gadget_config_name_attr_store+0x40/0x50 > > configfs_write_file+0x198/0x1f4 > > vfs_write+0x100/0x220 > > SyS_write+0x58/0xa8 > > . configfs_composite_unbind > > . configfs_composite_bind > > [deleted] > > When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling > > memory is accessed, "BUG: KASAN: use-after-free" error occurs. > > > > Signed-off-by: Jim Lin > > --- > > Changes in v2: > > Changes in v3: > > Change commit description > > well, I need to be sure you tested this with Linus' tree. The reason I'm > asking is because this could be a bug caused by Android changes. From > your previous patch, the problem started with android_setup(). > > Please test with v4.10-rc4 and any configfs-based gadget. > > -- > balbi I've got the similar problem on Android, however, Linux guys require you and other people to test your patch on pure Linux. Since Linux is exactly a "PC" based OS, only common patches should be commit to Linux code base. Except the bug is quite common in 3 OS, in "Linux PC" and in "Android Linux" or "Chromium OS". I'm not sure about the difference between Chromium OS and Linux PC. According to CVE report, it looks like the change is from Chromium OS? Dose Nvidia has a pure Linux software team can verify your patch on your platform? I think if you can prove the result is okay on Linux PC or on Chromium OS will help. -- Best regards, Macpaul Lin
