Display tearing functionality on SXR devices makes use of
both bulk-in and bulk-out endpoints of cdev driver
to acquire real time audio/video data from usb host.
Currently if the userspace application making use of cdev
driver requests 50KB of data from host, the cdev_read function
queues multiple usb requests to host till it gets 50KB of data.
In Display Tearing, although the userspace application requests
50KB of data per frame, the actual amount sent by host for every
frame is variable and can be less than the requested amount. If
host is sending packets of size less that requested amount per frame,
driver ends up appending multiple frames in a single cdev_read call
and returns corrupt information to userspace causing low frame
rate on display.
To resolve this add a configfs property to specify the buffer size
for every usb request on out ep and a flag to specify if we need
single packet mode. If single packet mode is enabled, only one usb
request is queued on out endpoint per cdev_read call and buffer
corresponding to that request contains only one frame of data coming
from host. The driver appends data from one usb request in read_queued
pool to userspace buffer to avoid corrupting video frame information.
CRs-Fixed: 3038067
Change-Id: I1ba0b954d14f187eeddc511f4ac199784248b33b
Signed-off-by: Ligui Deng <ldeng@codeaurora.org>
Consider a scenario when a device which supports auto suspend is
connected to DUT and auto suspend happened. Now, as the device is
disconnected to DUT. Resume_work is called due to extcon notification
of disconnect and then again suspend is expected to schedule. As
a part of disconnect, pwr event irq and DP_HS_PHY_IRQ also got
triggered and now since usb is in lpm, resume work got scheduled
twice. This resume work flushed sm_work which is stuck because
disable_irq call is waiting for pwr_irq call which called resume_work
to complete. This is clearly a circular dependency because
resume work will flush sm_work which is waiting for pwr_irq_thread
to be complete because disable_irq in msm_suspend waits for
pwr_irq_handler to complete.
Solve this by replacing disable_irq api with disable_irq_nosync
so that it doesn't block control suspend.
Below are the sequence of events.
usb is auto suspended with device connected to DUT.
Now device is disconnected from DUT and hence resume
hanppens first and then suspend.
dwc3_resume_work is called due to extcon as a part of
disconnect then suspend will be scheduled.
When dwc3 is still in lpm, i.e dwc3_resume_work did
not take effect yet.
Now power event irq is fired because of which resume
work runs.
This resume work flushes sm work. Which is currently
executing msm_suspend where disable_irq is waiting
for power_irq call to finish which is waiting for
sm_work to finish.
Change-Id: Ibf6e73663d4acaf997291e7eff6577adeaad6e8a
Signed-off-by: Rohith Kollalsi <quic_rkollals@quicinc.com>
Enable more basic controls for Camera Terminal and Processing Unit
Change-Id: Ia3627731e05afa57c770439b958c9af51e42c630
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Currently, the f_mtp driver marks the mtp_tx_req_len to 1M.
As a result, file transfer from device to host PC fails for
devices using ChipIdea controller since it does not allow request
length greater than 16k for IN Endpoint. Hence, to allow such
file transfers, limit Tx req length to 16k.
Change-Id: Ib9ca95880ca0b1a2f0c66817e54e9a7b2af53fe6
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
[ppratap@codeaurora.org : replace DBG with mtp_log]
Signed-off-by: Pratham Pratap <ppratap@codeaurora.org>
static variable for irq_counter/perf_mode fail for multiple controller,
change to allocate them for each controller instance.
irq_cnt will record irq number for each perf work schedule duration,
it will clear when work execution/cancel.
Change-Id: I1e07277fcd609b37728a9a716cdf5f75ccc35d9b
Signed-off-by: Linyu Yuan <linyyuan@codeaurora.org>
Currently usb speed override functionality doesn't work as expected
when usb role switch based notification is used. Hence move usb speed
override functionality out side edev check within dwc3_resume_work()
API. Also update maximum_speed as max hw supported speed out side
edev check.
Change-Id: I69b066721490277b77333d2caf820b6c87703501
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Currently MTP driver is handling OS descriptors which
causes CTS test failures(android.adb.cts.AdbHostTest) if
MTP is in the default composition.
Fix this by skipping the handling of OS descriptors in
MTP driver and let composite driver take care of it for
the whole configuration.
Change-Id: I77902108c3a550997dfd56b9b3127900c724f066
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Currently driver is checking for VBUS state after accessing register
in msm_otg_suspend() routine. In case of CDP, there will be race between
msm_otg_suspend() and driving DP pulse. This could cause accessing
register in msm_otg_suspend() while clocks are off as part of sequence
to drive pulse on D+ line and later it is checking for VBUS state high
to abort suspend sequence. Hence fix it by checking for VBUS state
before accessing registers in msm_otg_suspend().
Change-Id: I95ad5339b21647e3971908d15f2eabe0c6311800
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Currently driver is checking only charger type from internal variable
in msm_otg_suspend(), which is valid for PHY based charger detection.
If PMIC charger does charger detection, that charger type will not be
updated and result in allowing low power mode sequence even VBUS is
active. Hence fix it by checking psy_type as well to avoid allowing
low power mode sequence while VBUS is active.
Change-Id: I8cb47912867b15ebdc30bc15b58ff99026a1e180
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Currently driver is calling API to apply pulse from vbus notifier, but
it might lead to race condition during bootup and result in unclocked
access. Hence avoid applying DP pulse during bootup from vbus notifier
callback. Also enable LDOs and clocks only if usb is in lpm, else apply
DP pulse without enabling LDOs and clocks again.
Change-Id: I987d93de5261147481f3856254941091dedba108
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Consider a case where ffs_data_new is getting called from
ffs_fs_get_tree and ffs_data_new returns error pointer since
the function (e.g. adb) is already mounted. The driver is only
checking for the NULL return value for ffs but in this case it
will not be NULL, which will fail the check and driver will go
ahead accessing invalid pointer which can lead to inconsistencies.
Fix this by having NULL as well as error pointer check for ffs.
Change-Id: Idad5a0b91148325258ea3f545d4da71644c7fc53
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Currently the phy driver is asserting and deasserting
usb phy reset signal to reset qusb phy. This changes adds
a wrapper function around the assert and deassert of usb
phy reset signal to make the code more readable and remove
code duplicacy.
Change-Id: I4fa03ae2d6bccf7386fcf3a7aa5df0345054147d
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Consider a case where SVDM message sent on SOP' failed
before starting the power negotiation with the sink.
Currently pd driver will not be freeing vdm_tx and
will be kept around till we reach PE_SRC_Ready state. Now
the same will be sent on SOP instead of SOP' and also with
wrong SVDM version which was kept for the first SVDM msg,
because of Commit I0bafb619e0a("usb: pd: Correctly handle
SVDM versions), causing the other partner to NAK it.
Fix this by clearing the vdm_tx if SVDM message is sent
on SOP'(intended of e-mark cable) which has been failed.
Change-Id: I729a66058ea8829625185483cbec87b435ee66fc
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Currently PHY driver relies on regulators(vdd, 1p8, 3p1) to be
disabled for the PHY to come out of high-Z state when charger
driver is done with APSD. This works for the platforms having
single instance of PHY.
Consider a case where there are two instances of the same phy
(primary and secondary) and both are sharing the same resources
(regulators - vdd, 1p8, 3p1). If the platform is configured in
such a way that the secondary instance is always powered on
(e.g. host mode) and booted up with charger(DCP) connected on
the primary port, when charger is disconnected after bootup,
dpdm_regulator_disable will be called from charger driver which
will disable regulator but the regulators will not be disabled
since the secondary instance still has vote for regulators.
This will lead the primary instance to be in high-Z state even
though nothing is connected and causes extra power consumption.
Fix this by resetting the phy before turning off the regulators
in dpdm_regulator_disable for snps/qusb phys.
Change-Id: If96a878448144e446d12acf136c9c6d8fa9432cb
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Diag char driver calls usb_diag_request_size() to get max request
size supported by underlying USB hardware. If there is race between
disable() and this API call, it results in accessing NULL pointer
dereference. Hence fix this by returning zero in case ctxt is NULL.
Change-Id: I51274db0af4cfbc8ba975744f55ad17ec311e32e
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
ChipIdea controller can be queued a maximum packet size of 16KB.
If a request larger than this size arrives on IN endpoint,
request is failed. Fix this by limiting the max request size to
16k if the controller is ChipIdea.
Change-Id: Iac696addc9b1ca50e78ae66f73f5b66bd3100c1c
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
configfs_composite_unbind sets the gadget data
to null. Therefore, add check in android_disconnect
function to make sure that cdev is not NULL. This
prevents NULL pointer dereference upon accessing
cdev.
Change-Id: Ib59cdd88557d917c85d8d33968efc295bcef2280
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
When qdss open and close are called back to back at a high rate,
connect_work that gets queued in qdss open can execute after
qdss close. For qdss HW path the connect work that gets scheduled
as part of the next qdss open results in ep config failure as the
ep is already configured during previous connect work. Now before
queuing the request if there is a qdss close it would reset the dbm
ep configuration thus routing this request via software path instead
of dbm path. The subsequent dequeue would lead to a NULL pointer
dereference of completion callback. Fix this by flushing connect_work
as part of qdss close for graceful termination.
Change-Id: I8edf73ea1f87e297297828e6e25c7c14a422ec3a
Signed-off-by: Elson Roy Serrao <eserrao@codeaurora.org>
Commit 2df1806a2b ("usb: f_fs: Avoid use-after-free of
ffs_data") added an early return from the ffs_func_unbind
if refcount becomes zero without actually freeing the
descriptors and the eps. Now during next connect, func_bind
fails as the eps are not marked NULL. Fix this by removing
the early return and adding a judgement for refcount to
avoid ffs_data pointer use-after-free.
Change-Id: I95648335bd14ab65909c9598eca3bf72a1cc8d5e
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
The 'wceis' flag used to indicate the device as wireless controller.
Set the default value is true as this is what we want in most of the
cases.
Change-Id: Idc03717526350421d94b9445333b36823a372aad
Signed-off-by: Liangliang Lu <luliang@codeaurora.org>
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Consider a case, where ffs_func_unbind was called twice due to some
reason and the opts->refcnt becomes NULL causing functionfs_unbind
to happen. This will free the ffs_data structure but later in the
function it is being used to add ffs_event which can lead to UAF
scenario. Avoid this by returning early from ffs_func_unbind function.
While we are at it, let's say ffs_epfile_io (which will be called from
ffs_epfile_read_iter) is called after functionfs_unbind happened then
there is a possibility the driver may end up using already freed
ffs_data. Fix it by initializing the variable after the FFS_ACTIVE
check.
Change-Id: Ic04857f95a6756d2d177bfbc382a11ffd651ef62
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
Currently support to enable/disable dplus hsphy irq and dminus hsphy
irq in case of resume/suspend is present only for pdc interrupts.
This support should be present even for non pdc interrupts if the
platform uses snps usb hs phy. Absence of this support leads to
dp/dm hsphy irq not being fired and usb stuck in lpm in host mode
eventhough there is a disconnect or remote wakeup issued from
hs/fs device connected to it. Hence add support to enable/disable
dp hsphy irq and dm hsphy irq for platforms that use snps hs phy.
On platforms which use snps phy and mpm interrupts, dp/dm lines are
directly connected to gic when cpu is active, mpm is involved only
when cpu is not active. Now in cpu active case, in host mode if usb
goes to lpm with hs/fs/ls device connected and unplug/remote wakeup
is issued, dp falling edge is monitored in software to detect that.
But GIC is not capable of detecting a falling edge. Hence this
change adds support to program power event irq to wakeup the system
in this case. Note that GIC takes care of dp rising edge wakeup
events like usb connect over otg when usb is in lpm and in host
mode. Only in case where dp falling edge is monitored i.e in case
of hs/fs/ls device connect and usb enteres lpm, then power event
irq is used to detect wakeup event as GIC cannot detect falling
edge.
Change-Id: I085b86c7df52daeedfb35cb71657c5163c2d5aaa
Signed-off-by: Rohith Kollalsi <rkollals@codeaurora.org>
Platforms using Synopsys SS phy are enabling pwr_evt_irq for
wakeup events in host mode as a part of dwc3_msm_suspend, but
before all the resources have been relinquished. So it is
possible that an IRQ is fired before dwc->in_lpm could be set to
1. Because of this, the pwr_event_handler will try to read
STAT_REG without issuing resume_work leading to unclocked access.
Fix this by enabling pwr_evt_irq only after in_lpm flag is set to
1, hence ensuring resume when the irq is fired.
Change-Id: I9772f427ecd10c2922c998cf0d57734362413051
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
While booting up with charger connected, there is a chance
that msm_otg_reset getting called two times from two paths,
one from apsd re-run and another as part of udc_bind. This
could create a race condition leading to clocks being not
enabled while accessing registers causing to NOC error.
Fix this by introducing mutex lock in msm_otg_reset for
protecting both the thread's execution.
Change-Id: Ie20eded91bbe37f1ed672b7b926f6e5f31fb0235
Signed-off-by: Udipto Goswami <ugoswami@codeaurora.org>
Increase number of requests for UAC2 driver from 2 to 32 to reduce
missed isoc events with isochronous endpoints.
Change-Id: I918f4c9564f1697fd69f135f38f3fc116b3c0900
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
While starting transfer for isochrnous endpoints, make sure first
request is queued for 16 microframes ahead in future. Also set
PENDING_REQUEST flag before giving back usb request if started_list
is empty to avoid queuing in same context. Else it leads to request
getting queued for micro frame interval which might have expired and
resulting USB HW retiring TRB without sending data to host.
Change-Id: Ia5e4512fa2a3ae6637f2be7ef2f102c26d56213c
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Increase number of UVC requests from 16 to 64 to avoid video quality
issues for video streaming over USB.
Change-Id: I8ebdf1bdc3d3d30da5ba3e768a11268200f66d28
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Increase TX Fifo size for isochronous endpoint in case maxburst
is greater than 6 for better performance.
Change-Id: I0da45f5a9e2f77947a67776b3e41fd2bb920fca2
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Enable required basic controls for Camera Terminal and Processing Unit.
Change-Id: Ibff376cab41a709c073655ba2415274eacc37544
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Commit 3741fb2cfb88 ("coresight: byte-cntr: Free USB requests when
disconnected") introduced a regression which leads qdss_disable &
qdss_close paths to race between them.
If qdss_disable path is processing, it would queue disconnect_work
which will notify the bypass notifier of USB_DISCONNECT and it will
call free_req. Within same time frame if qdss_close is called,
it will try to go ahead dequeue the request and wait_for_completion.
But since free_req got called, it will free the qreq instance which
wait_for_completion uses resulting in kernel panic.
Fix this by checking for ep_dequeue status if dequeue was success
then only wait_for_completion. Also taking the list operation under
qdss->lock in order to avoid any races between qdss_write as well.
Change-Id: I7bf9eab4296a509f5b459fa7768987c4a1f1287f
Signed-off-by: Udipto Goswami <ugoswami@codeaurora.org>
With the configfs filesystem it’s possible to manipulate kernel
object by creating/deleting folders into /config path. Here port
object is created by a mkdir and leads to allocate this object,
while the rmdir system call leads to free this object.
If one thread does these two operations of creation and deletion
of the folder and one tries to open it, it can lead to a
race condition where port object can be freed by the time
it is used in f_cdev_open leading to use after free error.
Fix this by using embedded struct device and the refcounting
mechanism built-in which increases and decreases refcount upon
creation and deletion of port and port will be freed when
reference count is zero ensuring that "port" object survives
until the last user releases it.
Change-Id: I88701ef161c9f3215631da81c3a8d4c980d12b25
Signed-off-by: Rohith Kollalsi <rkollals@codeaurora.org>
Some UDC may require allocation of some extra bytes for
TX buffer due to hardware requirement. Add necessary
changes for the same.
Change-Id: Ia0ec21bbbe7d514f840f482d0e063559d4231338
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
If composition switch happens while epfile_io() is in progress,
there is a chance that gadget pointer is accessed after unbind(),
which could be NULL. This could cause accessing NULL pointer and
results in panic. Fix the issue by accessing member variables from
local copy instead of directly accessing from ffs->gadget.
Change-Id: Iec61725da9c82e8c06e66acb8a6bdbc98ff9444a
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB AXI prefetch requires additional 256 bytes than actual required
buffer size for USB IN endpoint. But Currently driver is allocating
for USB OUT endpoint. Hence fix this by allocating extra buffer for
USB IN endpoint only.
Change-Id: I3c2d299d8dce3d826b153856e2cd8366b33a2dd6
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Some UDC may require allocation of some extra bytes for
the TX buffer due to hardware requirement. Add necessary
changes for the same.
Change-Id: I06bc5e5bbf154e335868bb65158bd4e03ab855e9
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Some UDC may require allocation of some extra bytes for
TX buffer due to hardware requirement. Add necessary
changes for the same.
Change-Id: I186cfc876f52e694113b895dfc4044948cb1fb2d
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
This change adds USB RMNET function driver which allows communication
between USB BAM and IPA BAM for RMNET and DPL functionalities over USB.
This snapshot is taken as of msm-4.14 'commit 973e6f5c37fc (ARM: dts:
msm: support A/B OTA for LW.2.0 ")'.
This change adding changes to use cdev device instead of misc device
and also fixes different coding style related warnings.
Change-Id: I899cb02386c0ce63212989710ad2fe111da63ac8
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
A device that is not probed via DT nodes needs to setup its DMA
operations with an explicit call to arch_setup_dma_ops. The child
and grandchild gadget devices of msm_otg are not populated via DT
nodes. This patch adds the above method for these devices.
Change-Id: Ida9d63dce2cbb8c61c65cb95e0ea5f10860e8edc
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
