Age | Commit message (Collapse) | Author |
|
Change-Id: I815d41ce0f0d7e35d7b8bd133a3f203e24e69943
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
|
|
modify head file to match the change of camera engine
Change-Id: Ia139e733f766cf9cbb02e80ceda81a1817b3acbf
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
|
|
According to the hardware test, change the tx pin drive strength
to 4ma, and mdc/mdio 2ma.
Change-Id: Ia5ab1728c9e9ecbfa7207217649588f600070ae4
Signed-off-by: David Wu <david.wu@rock-chips.com>
|
|
drivers/power/rk817_battery.c:3254:12: warning: 'rk817_bat_pm_resume' defined but not used [-Wunused-function]
error, forbidden warning:rk817_battery.c:3254
static int rk817_bat_pm_resume(struct device *dev)
^~~~~~~~~~~~~~~~~~~
drivers/power/rk817_battery.c:3037:13: warning: 'rk817_bat_pm_suspend' defined but not used [-Wunused-function]
error, forbidden warning:rk817_battery.c:3037
static int rk817_bat_pm_suspend(struct device *dev)
Change-Id: I8cb39c95688e16027257c09a20eaeb100bd1024b
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
|
|
we replace cru assigned clock node in rk1808-evb-x4 dts, and now clk_32k_ioe
is setted in this node, so we need to add this back in rk1808-evb-x4.dts,
otherwise the SOC can not boot normally.
Change-Id: I06a55bea97e0ef260f2549349b3211a311a913ae
Signed-off-by: Lin Huang <hl@rock-chips.com>
|
|
There was a typo when generating endpoint name which
would be very confusing when debugging. Fix it.
Change-Id: If29433f427499674b7604b399cbc3ac6e6bf7b1f
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit 696fe69d7e631f00f23b0ef1694d9b90058dca54)
|
|
comfirm in MT29F16G08ABABA
Change-Id: I6b1179e7e835b77176aaa0292b162ab08bb38fb7
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
|
|
Change-Id: Ic7a9437eee6d9d12d25ce7fb1171faf1624d3681
Signed-off-by: Xiaotan Luo <lxt@rock-chips.com>
|
|
Many devices require MCLK to work, So add mclk
Change-Id: I666e46c8968330afd81506d0c64769b59ad0837d
Signed-off-by: Xiaotan Luo <lxt@rock-chips.com>
|
|
To support preisp post-processing and camera hal1,
let driver probe ok when no sensor device is connected.
Change-Id: I1830420f448b47a0bd327ee3950da0eb7af8d3fb
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
|
|
include/uapi/linux/media-bus-format.h
Change-Id: I1da14bc81a8652dcac5f0b85035f8f1bf6e71bfe
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
|
|
Change-Id: Ie5942b90dccec5cec74d1f1f2cbef835d95bdfd9
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
|
|
Change-Id: I31892fe22db329deaca8d9e1eb4085d530b65d6f
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
|
|
The output timing described at [1], focus at s888 mode and
s888 dummy mode:
[1] https://patchwork.kernel.org/patch/9992241/
Change-Id: I1bcc6d64ede243d89807acc7e842bcc7fd120c26
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
|
|
If enable ramfs function, init ramfs async,
can reduce kernel init time.
Change-Id: I95d8ca6d8b9c4e9c738c635c5ee56391cbbe7c16
Signed-off-by: Liao Huaping <huaping.liao@rock-chips.com>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
|
|
fix the following error on RK1808.
error: implicit declaration of function 'kzalloc' [-Werror=implicit-function-declaration]
inf = kzalloc(sizeof(*inf), GFP_KERNEL);
error: implicit declaration of function 'kfree' [-Werror=implicit-function-declaration]
kfree(inf);
Change-Id: Ie46828b03a45cc523b8503fb62caeccee165142f
Signed-off-by: Hu Kejun <william.hu@rock-chips.com>
|
|
Change-Id: Ia6f19841a86983dd3b8896cf4f598180076ecc7b
Signed-off-by: Wang Panzhenzhuan <randy.wang@rock-chips.com>
|
|
Change-Id: I5213a7be831e7a5166231f4e7179ce4a564a14fb
Signed-off-by: Shixiang Zheng <shixiang.zheng@rock-chips.com>
|
|
Change-Id: I8c4ac43cd2ff560f2f94a01570ec82b143a7966a
Signed-off-by: Longjian Lin <llj@rock-chips.com>
|
|
The DWC3 rockchip driver provides a sysfs interface "dwc3_mode"
to force Peripheral mode or Host mode. It has a problem to force
to Host mode when the DWC3 works as Peripheral mode and connects
to Host (e.g. PC USB Port).
This issue can be reproduced on RK1808 EVB follow these steps:
1. Set dr_mode = "otg" in DTS dwc3 node;
2. Start the system, and connect the RK1808 USB 3.0 to PC USB.
3. Make sure that PC has recognized the USB device, and then
force DWC3 to Host mode via "dwc3_mode".
echo "host" > /sys/devices/platform/usb/dwc3_mode
And plug in an USB 2.0 Device to RK1808 USB 3.0 Port, then
we can see the following error log:
rockchip-dwc3 usb: Peripheral disconnect timeout
rockchip-dwc3 usb: USB unconnectedxhci-hcd
xhci-hcd.3.auto: xHCI Host Controller
xhci-hcd xhci-hcd.3.auto: new USB bus registered, assigned bus number 3
xhci-hcd xhci-hcd.3.auto: hcc params 0x0220fe64 hci version 0x110 quirks 0x04010010
...
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 1 port detected
rockchip-dwc3 usb: USB HOST connected
rockchip-dwc3 usb: set new mode successfully
usb 3-1: new high-speed USB device number 2 using xhci-hcd
usb 3-1: new high-speed USB device number 3 using xhci-hcd
usb usb3-port1: attempt power cycle
usb 3-1: new full-speed USB device number 4 using xhci-hcd
usb 3-1: Device not responding to setup address
usb 3-1: Device not responding to setup address
usb 3-1: device not accepting address 4, error -71
It's because that in this test case, the dr_mode is original otg
mode, and the current code only call phy_set_mode() to disconnect
the peripheral from PC host if the dr_mode is peripheral mode.
This cause dwc3_rockchip_otg_extcon_evt_work() wait peripheral
disconnect timeout, and DWC3 fail to do runtime suspend and resume
to initialized the DWC3 core register again.
This patch call phy_set_mode() to disconnect the peripheral if
the current dr_mode is peripheral or otg when force to host mode.
Change-Id: I733d364046abcb616cf3d99ed57ab8604a87eef6
Signed-off-by: William Wu <william.wu@rock-chips.com>
|
|
In dwc3_rockchip_async_probe(), if it tries to get hcd in
peripheral only mode (dr_mode = "peripheral"), a NULL pointer
deference will happen. Because hcd only be allocated and
initialized in host mode or otg mode.
We can reproduce this issue when set dr_mode to peripheral
in DTS, like rk3399pro-npu.dtsi, and get the following panic
log on RK1808 EVB:
Unable to handle kernel NULL pointer dereference at virtual address 000000b0
pgd = ffffff8008b0b000
[000000b0] *pgd=000000007fffe003, *pud=000000007fffe003, *pmd=0000000000000000
Internal error: Oops: 96000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 29 Comm: kworker/u4:1 Not tainted 4.4.167 #493
Hardware name: Rockchip RK1808 EVB V10 Board (DT)
Workqueue: events_unbound async_run_entry_fn
task: ffffffc07cd29580 task.stack: ffffffc07cd40000
PC is at dwc3_rockchip_async_probe+0x28/0x1c8
LR is at async_run_entry_fn+0x48/0x100
pc : [<ffffff80083adf5c>] lr : [<ffffff80080b445c>] pstate: 60000045
sp : ffffffc07cd43d10
...
[<ffffff80083adf5c>] dwc3_rockchip_async_probe+0x28/0x1c8
[<ffffff80080b445c>] async_run_entry_fn+0x48/0x100
[<ffffff80080acca8>] process_one_work+0x1b8/0x2b8
[<ffffff80080ad94c>] worker_thread+0x304/0x418
[<ffffff80080b206c>] kthread+0xd0/0xd8
[<ffffff8008082e80>] ret_from_fork+0x10/0x50
Fixes: f2a2b34e456b ("usb: dwc3: rockchip: use async_schedule for initial dwc3")
Change-Id: I740936e43bc4ea2b5a056d6d9dcaf18466006f0c
Signed-off-by: William Wu <william.wu@rock-chips.com>
|
|
Change-Id: Ie3b576f3ab8a04c4c81debfd04844b8d2ef7fd73
Signed-off-by: Weixin Zhou <zwx@rock-chips.com>
|
|
Change-Id: I1242fc127da02dff5d0e02418c2a540d21983430
Signed-off-by: Liang Chen <cl@rock-chips.com>
Signed-off-by: Weixin Zhou <zwx@rock-chips.com>
|
|
Change-Id: I7a22e2436c37a9c990fd7bf76aa6ddfdc1964241
Signed-off-by: Wyon Bi <bivvy.bi@rock-chips.com>
|
|
rk3326-evb-ai-va-v11-linux board
Change-Id: I6f554b92dc09dec640025f973548d71b89142bec
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
|
|
- Remove useless codecs/spdif.
- Enable PDM/multi-codecs/multi-dais.
Change-Id: I178e9fe186263722bc27d2c26170db24c08d623f
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
|
|
Change-Id: Iead1a3bc4695a7209f3d4bd82c49a00b2a8a4940
Signed-off-by: Lin Huang <hl@rock-chips.com>
|
|
we use pdm mic as rk1808 evb board default mic array,
so enable pdm.
Change-Id: I45c4904fe865813185ab327da347d0b52418ef1c
Signed-off-by: Lin Huang <hl@rock-chips.com>
|
|
Change-Id: I83a7762c23a4caaa5d3d3cd5e8e79b288f8662b4
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
|
|
The only way of stopping the watchdog is by resetting it.
Add the watchdog op for stopping the device and reset if
a reset line is provided.
At same time WDOG_HW_RUNNING should be remove from dw_wdt_start.
As commented by Guenter Roeck:
dw_wdt sets WDOG_HW_RUNNING in its open function. Result is
that the kref_get() in watchdog_open() won't be executed. But then
kref_put() in close will be called since the watchdog now does stop.
This causes the imbalance.
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Cc: Wim Van Sebroeck <wim@iguana.be>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: linux-watchdog@vger.kernel.org
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
(cherry picked from commit 1bfe8889380890efe4943d125124f5a7b48571b0)
Conflicts:
drivers/watchdog/dw_wdt.c
Change-Id: Ia6f4e16011b61f78c09b5c54669ddd18678357b9
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
|
|
The dw_wdt has an external reset line, that can keep the device in reset
and therefore rendering it useless and also is the only way of stopping
the watchdog once it was started.
Get the reset lines for this core from the devicetree. As these lines are
optional, use devm_reset_control_get_optional_shared. If the reset line
is not specified in the devicetree, the reset framework will just skip
deasserting and continue.
This way all users of the driver will continue to function without
any harm, even if the reset line is not specified in the devicetree.
Signed-off-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Cc: linux-watchdog@vger.kernel.org
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
(cherry picked from commit 65a3b6935d920a37820226864eb607467e49ba50)
Conflicts:
drivers/watchdog/dw_wdt.c
Change-Id: Iffbc95931869a5d595a348b6c08ee7da5a1e64e4
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
|
|
Warning awaits elimination, it's normal.
[ 14.568343] g_gc_superblock_free 260 40 0 2f 2f
[ 14.597317] lpa=c779, ppa=130000
[ 14.921319] g_gc_superblock_free 1ee 40 0 3 3
Change-Id: I4b3721310fcd833152ff8a7576c997b2202bc4f0
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
|
|
Change-Id: I3ef0b265b1cabe152961985621336294f88bb1a7
Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
|
|
Change-Id: I66e3d7caa7b8591bd5af8d481ba773f5e38e9471
Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
|
|
Parse boot mode on system bootup, and export it to
userspace by sysfs: sys/kernel/boot_mode
Change-Id: I0158fc28f4dae51c798806006e49cead4ce2e923
Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
|
|
Coverity reports:
divide_by_zero: In expression readl(dw_wdt->regs + 8) /
clk_get_rate(dw_wdt->clk), division by expression clk_get_rate(dw_wdt->clk)
which may be zero has undefined behavior.
The clock used for the watchdog timer won't change its rate, so read it
only once during probe. Also validate it and abort the probe function
with an error if it is 0.
Cc: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
(cherry picked from commit c97344f73fdc35b27c7315c5e7c5decd4ce10467)
Conflicts:
drivers/watchdog/dw_wdt.c
[due to missing:
f29a72c24ad49 "watchdog: dw_wdt: Convert to use watchdog infrastructure"
and local version of:
3024e0d13b0f3 "watchdog: dw_wdt: fix signedness bug in dw_wdt_top_in_seconds()"]
Change-Id: Iea745e27224532bf4da560e5952b372289d1c6ae
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
|
|
Some platforms lose this state in suspend. It should be safe to do this
unconditionally.
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
(am from https://patchwork.kernel.org/patch/10273165/)
Conflicts:
small context changes
BUG=b:74204857
TEST=force watchdog event before/after suspend/resume on kevin and scarlet;
check timing
Reviewed-on: https://chromium-review.googlesource.com/958089
Commit-Ready: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Change-Id: I7a0e4d6c87ed3eeb3c41d9dcff014fd5f7cddef5
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
|
|
RK3399 has rst_pulse_length in CONTROL_REG[4:2], determining the length
of pulse to issue for system reset. We shouldn't clobber this value,
because that might make the system reset ineffective. On RK3399, we're
seeing that a value of 000b (meaning 2 cycles) yields an unreliable
(partial?) reset, and so we only fully reset after the watchdog fires a
second time. If we retain the system default (010b, or 8 clock cycles),
then the watchdog reset is much more reliable.
Read-modify-write retains the system value and improves reset
reliability.
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
(am from https://patchwork.kernel.org/patch/10273163/)
Conflicts:
core watchdog frameworks were reworked, so this moved from an
open() function to a start() function
BUG=b:74204857
TEST=force watchdog event before/after suspend/resume on kevin and scarlet;
check timing
Reviewed-on: https://chromium-review.googlesource.com/958088
Commit-Ready: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Change-Id: I18d5ec3604a44a671ba79ceea1821e733bf051fe
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
|
|
Change-Id: Iffa5b17de436ad26c718725168b5eab11e4ebbfc
Signed-off-by: Wyon Bi <bivvy.bi@rock-chips.com>
|
|
Change-Id: Ib4eb985b1c3aacf6e51d593fcf71cd46e1dc0b82
Signed-off-by: Wyon Bi <bivvy.bi@rock-chips.com>
|
|
Fix display abnormal caused by DDR frequency conversion.
Change-Id: Iaa3bf6177d42f8ac5f9078b58a138f48d5c1d874
Signed-off-by: Wyon Bi <bivvy.bi@rock-chips.com>
|
|
fireprime is using rk818, which need a battery node for fuel gauge,
or else the input current will be limit to 500mA.
Change-Id: Ie80dbc103d1ac57b704235a9b618b7e9db44c953
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
|
|
This issue was caused by two cards using the same dai(cpu_dai/codec_dai).
the second one will fail to register as a card, then will release the
same dai resource, leading to the first card crash.
[ 79.032274] Unable to handle kernel paging request at virtual address ffffffffffffffe0
[ 79.035543] Hardware name: Rockchip RK3399 Excavator Board edp (Android) (DT)
[ 79.036171] task: ffffffc0dd126c00 task.stack: ffffffc0d109c000
[ 79.036717] PC is at dapm_widget_invalidate_output_paths+0x98/0xe0
[ 79.037268] LR is at soc_dapm_dai_stream_event+0x60/0x9c
[ 79.184613] Call trace:
[ 79.192401] [<ffffff80088e9028>] dapm_widget_invalidate_output_paths+0x98/0xe0
[ 79.193044] [<ffffff80088ea0d0>] soc_dapm_dai_stream_event+0x60/0x9c
[ 79.193611] [<ffffff80088eeb9c>] snd_soc_dapm_stream_event+0x44/0x94
[ 79.194175] [<ffffff80088e515c>] snd_soc_suspend+0x23c/0x2fc
[ 79.194686] [<ffffff800852d1f0>] platform_pm_suspend+0x38/0x54
[ 79.195208] [<ffffff8008536e88>] dpm_run_callback+0x110/0x1bc
[ 79.195726] [<ffffff8008537578>] __device_suspend+0x164/0x2a4
[ 79.196242] [<ffffff80085392b0>] dpm_suspend+0x70/0x338
[ 79.196713] [<ffffff8008539ab0>] dpm_suspend_start+0x64/0x68
[ 79.197226] [<ffffff80080f0b9c>] suspend_devices_and_enter+0x74/0x2d8
[ 79.197800] [<ffffff80080f140c>] pm_suspend+0x60c/0x668
[ 79.198272] [<ffffff80080ef7b4>] state_store+0x50/0x84
[ 79.198734] [<ffffff800839d128>] kobj_attr_store+0x14/0x24
[ 79.199234] [<ffffff8008232fd8>] sysfs_kf_write+0x38/0x50
[ 79.199718] [<ffffff8008232208>] kernfs_fop_write+0x124/0x180
[ 79.200237] [<ffffff80081bf76c>] __vfs_write+0x38/0xfc
[ 79.200695] [<ffffff80081bffd4>] vfs_write+0x9c/0x170
[ 79.201153] [<ffffff80081c0a18>] SyS_write+0x5c/0xbc
[ 79.201604] [<ffffff80080832f0>] el0_svc_naked+0x24/0x28
[ 79.202079] Code: 54000081 f9408000 d1040000 17ffffef (39406025)
[ 79.202693] ---[ end trace dec5980253348a7f ]---
Change-Id: I6bbbeefaa68a7d5dfccc1bba57d61216b4be1035
Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
|
|
Change-Id: I7c3c7bf4b3c720fce366767d4725ea4a82e0652b
Signed-off-by: Alex Zhao <zzc@rock-chips.com>
|
|
dwc2_hsotg_ep_disable
Check if endpoint is enabled during dwc2_hsotg_ep_disable() function
processing and call dwc2_hsotg_ep_stop_xfr() to disable it and flush
associated FIFO.
Move dwc2_hsotg_ep_stop_xfr() and dwc2_hsotg_wait_bit_set() functions
upper before dwc2_hsotg_ep_enable and dwc2_hsotg_ep_disable function
definitions.
Change-Id: Ieafe29703e167c72ad8a6aa8e437bd13c395a602
Signed-off-by: Vahram Aharonyan <vahrama@synopsys.com>
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit a4f827714539a7cb76fa1ac55954b184071999eb)
|
|
Correct dwc2_hsotg_ep_stop_xfr() function to follow dwc2 programming
guide for setting NAK on specific endpoint, disabling it and flushing
corresponding FIFO.
Current code does not take into account whether core acts in shared or
dedicated FIFO mode, current endpoint is periodic or not. It does not
clear EPDISBLD interrupt after programming of DXEPCTL_EPDIS, does not
flush shared TX FIFO and tries to clear global out NAK in wrong manner
instead of setting DCTL_CGOUTNAK.
Change-Id: I4066fab83cf31a6c074a3d4456fdaa8144132926
Signed-off-by: Vahram Aharonyan <vahrama@synopsys.com>
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit ae79dd5dddb6fa4051c96c7f14116ded9e0dbdd7)
|
|
Poweroff vcc1v8_dvp, vdd1v5_dvp, vccio_sd, vcc3v3_sd
in rk809 sleep mode.
Change-Id: I3c3194449cd0ed17df84c9c03ad2ae4d2f3f720d
Signed-off-by: XiaoDong Huang <derrick.huang@rock-chips.com>
|
|
We find that the UAC2 gadget can't be recognized on Windows 10.
It's because that the descriptors of UAC2 doesn't meet the
requirements of Windows.
According to the USB Audio 2.0 Drivers of Windows [1], if the
bmAttributes of OUT-EP in the audio stream interface is set
to asynchronous (use USB_ENDPOINT_SYNC_ASYNC), then a feedback
endpoint must be implemented in the respective alternate setting
of the AS interface. The Windows driver does not support implicit
feedback.
However, it's difficult to implement the feedback endpoint now.
So the patch changes the bmAttributes of OUT-EP to adaptive, and
changes the bmAttributes of IN-EP to synchronous at the same time.
This patch also sets the wTerminalType of terminal descriptor to
microphone and speaker by default.
With this patch, we also fix the wTotalLength of the ac_hdr_desc.
[1] https://docs.microsoft.com/en-us/windows-hardware/drivers/audio/usb-2-0-audio-drivers
Change-Id: I3597d5f321235fcbce56dbfbfe95172d02e58892
Signed-off-by: William Wu <william.wu@rock-chips.com>
|
|
Via p_chmask/c_chmask the user can define whether uac2 shall support
playback and/or capture. This has only effect on the created ALSA device,
but not on the USB descriptor. This patch adds playback/capture descriptors
dependent on that parameter.
Conflicts:
drivers/usb/gadget/function/f_uac2.c
Change-Id: I396b4238e6a8f2b4a32a57780acea4f23dc0c081
Signed-off-by: Andreas Pape <apape@de.adit-jv.com>
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit 3fa4eaa6c08206b5fa6a8ba49b891d6aab243f52)
|
|
spinlock
The change protects almost the whole body of u_audio_iso_complete()
function by PCM stream lock, this is mainly sufficient to avoid a race
between USB request completion and stream termination, the change
prevents a possibility of invalid memory access in interrupt context
by memcpy():
Unable to handle kernel paging request at virtual address 00004e80
pgd = c0004000
[00004e80] *pgd=00000000
Internal error: Oops: 817 [#1] PREEMPT SMP ARM
CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G C 3.14.54+ #117
task: da180b80 ti: da192000 task.ti: da192000
PC is at memcpy+0x50/0x330
LR is at 0xcdd92b0e
pc : [<c029ef30>] lr : [<cdd92b0e>] psr: 20000193
sp : da193ce4 ip : dd86ae26 fp : 0000b180
r10: daf81680 r9 : 00000000 r8 : d58a01ea
r7 : 2c0b43e4 r6 : acdfb08b r5 : 01a271cf r4 : 87389377
r3 : 69469782 r2 : 00000020 r1 : daf82fe0 r0 : 00004e80
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c5387d Table: 2b70804a DAC: 00000015
Process ksoftirqd/0 (pid: 3, stack limit = 0xda192238)
Also added a check for potential !runtime condition, commonly it is
done by PCM_RUNTIME_CHECK(substream) in the beginning, however this
does not completely prevent from oopses in u_audio_iso_complete(),
because the proper protection scheme must be implemented in PCM
library functions.
An example of *not fixed* oops due to substream->runtime->*
dereference by snd_pcm_running(substream) from
snd_pcm_period_elapsed(), where substream->runtime is gone while
waiting the substream lock:
Unable to handle kernel paging request at virtual address 6b6b6b6b
pgd = db7e4000
[6b6b6b6b] *pgd=00000000
CPU: 0 PID: 193 Comm: klogd Tainted: G C 3.14.54+ #118
task: db5ac500 ti: db60c000 task.ti: db60c000
PC is at snd_pcm_period_elapsed+0x48/0xd8 [snd_pcm]
LR is at snd_pcm_period_elapsed+0x40/0xd8 [snd_pcm]
pc : [<>] lr : [<>] psr: 60000193
Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c5387d Table: 2b7e404a DAC: 00000015
Process klogd (pid: 193, stack limit = 0xdb60c238)
[<>] (snd_pcm_period_elapsed [snd_pcm]) from [<>] (udc_irq+0x500/0xbbc)
[<>] (udc_irq) from [<>] (ci_irq+0x280/0x304)
[<>] (ci_irq) from [<>] (handle_irq_event_percpu+0xa4/0x40c)
[<>] (handle_irq_event_percpu) from [<>] (handle_irq_event+0x3c/0x5c)
[<>] (handle_irq_event) from [<>] (handle_fasteoi_irq+0xc4/0x110)
[<>] (handle_fasteoi_irq) from [<>] (generic_handle_irq+0x20/0x30)
[<>] (generic_handle_irq) from [<>] (handle_IRQ+0x80/0xc0)
[<>] (handle_IRQ) from [<>] (gic_handle_irq+0x3c/0x60)
[<>] (gic_handle_irq) from [<>] (__irq_svc+0x44/0x78)
Change-Id: I0b0e20f1aaf7c093c7fc198128186cfb637bdbf4
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[erosca: W/o this patch, with minimal instrumentation [1], I can
consistently reproduce BUG: KASAN: use-after-free [2]]
[1] Instrumentation to reproduce issue [2]:
diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index a72295c953bb..bd0b308024fe 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -16,6 +16,7 @@
#include <sound/core.h>
#include <sound/pcm.h>
#include <sound/pcm_params.h>
+#include <linux/delay.h>
#include "u_audio.h"
@@ -147,6 +148,8 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
spin_unlock_irqrestore(&prm->lock, flags);
+ udelay(500); //delay here to increase probability of parallel activities
+
/* Pack USB load in ALSA ring buffer */
pending = prm->dma_bytes - hw_ptr;
[2] After applying [1], below BUG occurs on Rcar-H3-Salvator-X board:
==================================================================
BUG: KASAN: use-after-free in u_audio_iso_complete+0x24c/0x520 [u_audio]
Read of size 8 at addr ffff8006cafcc248 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G WC 4.14.47+ #160
Hardware name: Renesas Salvator-X board based on r8a7795 ES2.0+ (DT)
Call trace:
[<ffff2000080925ac>] dump_backtrace+0x0/0x364
[<ffff200008092924>] show_stack+0x14/0x1c
[<ffff200008f8dbcc>] dump_stack+0x108/0x174
[<ffff2000083c71b8>] print_address_description+0x7c/0x32c
[<ffff2000083c78e8>] kasan_report+0x324/0x354
[<ffff2000083c6114>] __asan_load8+0x24/0x94
[<ffff2000021d1b34>] u_audio_iso_complete+0x24c/0x520 [u_audio]
[<ffff20000152fe50>] usb_gadget_giveback_request+0x480/0x4d0 [udc_core]
[<ffff200001860ab8>] usbhsg_queue_done+0x100/0x130 [renesas_usbhs]
[<ffff20000185f814>] usbhsf_pkt_handler+0x1a4/0x298 [renesas_usbhs]
[<ffff20000185fb38>] usbhsf_irq_ready+0x128/0x178 [renesas_usbhs]
[<ffff200001859cc8>] usbhs_interrupt+0x440/0x490 [renesas_usbhs]
[<ffff2000081a0288>] __handle_irq_event_percpu+0x594/0xa58
[<ffff2000081a07d0>] handle_irq_event_percpu+0x84/0x12c
[<ffff2000081a0928>] handle_irq_event+0xb0/0x10c
[<ffff2000081a8384>] handle_fasteoi_irq+0x1e0/0x2ec
[<ffff20000819e5f8>] generic_handle_irq+0x2c/0x44
[<ffff20000819f0d0>] __handle_domain_irq+0x190/0x194
[<ffff20000808177c>] gic_handle_irq+0x80/0xac
Exception stack(0xffff200009e97c80 to 0xffff200009e97dc0)
7c80: 0000000000000000 0000000000000000 0000000000000003 ffff200008179298
7ca0: ffff20000ae1c180 dfff200000000000 0000000000000000 ffff2000081f9a88
7cc0: ffff200009eb5960 ffff200009e97cf0 0000000000001600 ffff0400041b064b
7ce0: 0000000000000000 0000000000000002 0000000200000001 0000000000000001
7d00: ffff20000842197c 0000ffff958c4970 0000000000000000 ffff8006da0d5b80
7d20: ffff8006d4678498 0000000000000000 000000126bde0a8b ffff8006d4678480
7d40: 0000000000000000 000000126bdbea64 ffff200008fd0000 ffff8006fffff980
7d60: 00000000495f0018 ffff200009e97dc0 ffff200008b6c4ec ffff200009e97dc0
7d80: ffff200008b6c4f0 0000000020000145 ffff8006da0d5b80 ffff8006d4678498
7da0: ffffffffffffffff ffff8006d4678498 ffff200009e97dc0 ffff200008b6c4f0
[<ffff200008084034>] el1_irq+0xb4/0x12c
[<ffff200008b6c4f0>] cpuidle_enter_state+0x818/0x844
[<ffff200008b6c59c>] cpuidle_enter+0x18/0x20
[<ffff20000815f2e4>] call_cpuidle+0x98/0x9c
[<ffff20000815f674>] do_idle+0x214/0x264
[<ffff20000815facc>] cpu_startup_entry+0x20/0x24
[<ffff200008fb09d8>] rest_init+0x30c/0x320
[<ffff2000095f1338>] start_kernel+0x570/0x5b0
---<-snip->---
Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
(cherry picked from commit 56bc61587daadef67712068f251c4ef2e3932d94)
|