From b7bdcb79de6de32e40dcc85a5e8c669bec2483d5 Mon Sep 17 00:00:00 2001 From: Dmitry Krivoschekov Date: Sat, 21 Feb 2009 15:30:15 -0800 Subject: USB: musb: fix musb_host_tx() for shared endpoint FIFO The input queue should be used for TX on endpoints which share FIFO hardware. The host TX path wasn't doing that. Shared FIFOs are most often configured for periodic endpoints, which are mostly used for RX/IN transfers ... that's probably how this bug managed to linger for a long time. [ dbrownell@users.sourceforge.net: update patch description ] Signed-off-by: Dmitry Krivoschekov Signed-off-by: Sergei Shtylyov Acked-by: David Brownell Cc: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_host.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/usb/musb/musb_host.c') diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index a035ceccf95..b47ca948bcf 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -1161,7 +1161,8 @@ void musb_host_tx(struct musb *musb, u8 epnum) struct urb *urb; struct musb_hw_ep *hw_ep = musb->endpoints + epnum; void __iomem *epio = hw_ep->regs; - struct musb_qh *qh = hw_ep->out_qh; + struct musb_qh *qh = hw_ep->is_shared_fifo ? hw_ep->in_qh + : hw_ep->out_qh; u32 status = 0; void __iomem *mbase = musb->mregs; struct dma_channel *dma; -- cgit v1.2.3 From a2fd814e6a9e172f7077b68a2a9391bbde777a92 Mon Sep 17 00:00:00 2001 From: Sergei Shtylyov Date: Sat, 21 Feb 2009 15:30:45 -0800 Subject: USB: musb: fix urb_dequeue() method The urb_dequeue() method forgets to unlink 'struct musb_qh' from the control or bulk schedules when the URB being cancelled is the only one queued to its endpoint. That will cause musb_advance_schedule() to block once it reaches 'struct musb_qh' with now empty URB list, so URBs queued for other endpoints after the one being dequeued will not be served. Fix by unlinking the QH from the list except when it's already being handled (typically by musb_giveback). Since a QH with an empty URB list is now supposed to be freed, do that. And remove a now-useless check from musb_advance_schedule(). [ dbrownell@users.sourceforge.net: update patch description, and fold in a dequeue() comment patch ] Signed-off-by: Sergei Shtylyov Signed-off-by: David Brownell Cc: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_host.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'drivers/usb/musb/musb_host.c') diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index b47ca948bcf..e32323938e9 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -432,7 +432,7 @@ musb_advance_schedule(struct musb *musb, struct urb *urb, else qh = musb_giveback(qh, urb, urb->status); - if (qh && qh->is_ready && !list_empty(&qh->hep->urb_list)) { + if (qh != NULL && qh->is_ready) { DBG(4, "... next ep%d %cX urb %p\n", hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh)); @@ -2038,9 +2038,9 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) goto done; /* Any URB not actively programmed into endpoint hardware can be - * immediately given back. Such an URB must be at the head of its + * immediately given back; that's any URB not at the head of an * endpoint queue, unless someday we get real DMA queues. And even - * then, it might not be known to the hardware... + * if it's at the head, it might not be known to the hardware... * * Otherwise abort current transfer, pending dma, etc.; urb->status * has already been updated. This is a synchronous abort; it'd be @@ -2079,6 +2079,15 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) qh->is_ready = 0; __musb_giveback(musb, urb, 0); qh->is_ready = ready; + + /* If nothing else (usually musb_giveback) is using it + * and its URB list has emptied, recycle this qh. + */ + if (ready && list_empty(&qh->hep->urb_list)) { + qh->hep->hcpriv = NULL; + list_del(&qh->ring); + kfree(qh); + } } else ret = musb_cleanup_urb(urb, qh, urb->pipe & USB_DIR_IN); done: -- cgit v1.2.3 From dc61d238b8c850c34632ae1fbbdea529f8c41d16 Mon Sep 17 00:00:00 2001 From: Sergei Shtylyov Date: Sat, 21 Feb 2009 15:31:01 -0800 Subject: USB: musb: host endpoint_disable() oops fixes The musb_h_disable() routine can oops in some cases: - It's not safe to read hep->hcpriv outside musb->lock, since it gets changed on completion IRQ paths. - The list iterators aren't safe to use in that way; just remove the first element while !list_empty(), so deletions on other code paths can't make trouble. We need two "scrub the list" loops because only one branch should touch hardware and advance the schedule. [ dbrownell@users.sourceforge.net: massively simplify patch description; add key points as code comments ] Signed-off-by: Sergei Shtylyov Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_host.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-) (limited to 'drivers/usb/musb/musb_host.c') diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index e32323938e9..c74ebadd4b9 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -2103,15 +2103,16 @@ musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep) unsigned long flags; struct musb *musb = hcd_to_musb(hcd); u8 is_in = epnum & USB_DIR_IN; - struct musb_qh *qh = hep->hcpriv; - struct urb *urb, *tmp; + struct musb_qh *qh; + struct urb *urb; struct list_head *sched; - if (!qh) - return; - spin_lock_irqsave(&musb->lock, flags); + qh = hep->hcpriv; + if (qh == NULL) + goto exit; + switch (qh->type) { case USB_ENDPOINT_XFER_CONTROL: sched = &musb->control; @@ -2145,13 +2146,28 @@ musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep) /* cleanup */ musb_cleanup_urb(urb, qh, urb->pipe & USB_DIR_IN); - } else - urb = NULL; - /* then just nuke all the others */ - list_for_each_entry_safe_from(urb, tmp, &hep->urb_list, urb_list) - musb_giveback(qh, urb, -ESHUTDOWN); + /* Then nuke all the others ... and advance the + * queue on hw_ep (e.g. bulk ring) when we're done. + */ + while (!list_empty(&hep->urb_list)) { + urb = next_urb(qh); + urb->status = -ESHUTDOWN; + musb_advance_schedule(musb, urb, qh->hw_ep, is_in); + } + } else { + /* Just empty the queue; the hardware is busy with + * other transfers, and since !qh->is_ready nothing + * will activate any of these as it advances. + */ + while (!list_empty(&hep->urb_list)) + __musb_giveback(musb, next_urb(qh), -ESHUTDOWN); + hep->hcpriv = NULL; + list_del(&qh->ring); + kfree(qh); + } +exit: spin_unlock_irqrestore(&musb->lock, flags); } -- cgit v1.2.3 From 51d9f3e100a8f8cc2be89d5f13d37de61e2da38a Mon Sep 17 00:00:00 2001 From: Sergei Shtylyov Date: Sat, 21 Feb 2009 15:31:13 -0800 Subject: USB: musb: fix data toggle saving with shared FIFO For some strange reason the host side musb_giveback() decides that it's always got an IN transfer when the hardware endpoint is using a shared FIFO. This causes musb_save_toggle() to read the toggle state from the RXCSR register instead of TXCSR, and may also cause unneeded reloading of RX endpoint registers. Signed-off-by: Sergei Shtylyov Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_host.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'drivers/usb/musb/musb_host.c') diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index c74ebadd4b9..fc79e76b384 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -335,16 +335,11 @@ musb_save_toggle(struct musb_hw_ep *ep, int is_in, struct urb *urb) static struct musb_qh * musb_giveback(struct musb_qh *qh, struct urb *urb, int status) { - int is_in; struct musb_hw_ep *ep = qh->hw_ep; struct musb *musb = ep->musb; + int is_in = usb_pipein(urb->pipe); int ready = qh->is_ready; - if (ep->is_shared_fifo) - is_in = 1; - else - is_in = usb_pipein(urb->pipe); - /* save toggle eagerly, for paranoia */ switch (qh->type) { case USB_ENDPOINT_XFER_BULK: -- cgit v1.2.3 From 3ecdb9acf343bbcf2bb2c287dc524ab709cfad7e Mon Sep 17 00:00:00 2001 From: Sergei Shtylyov Date: Sat, 21 Feb 2009 15:31:23 -0800 Subject: USB: musb: be careful with 64K+ transfer lengths, host side Feeding 32-bit length cast down to 'u16' to min() to calculate the FIFO count in musb_host_tx() risks sending a short packet prematurely for transfer sizes over 64 KB. Similarly, although data transfer size shouldn't exceed 65535 bytes for the control endpoint, making musb_h_ep0_continue() more robust WRT URBs with possibly oversized buffer will not hurt either... Signed-off-by: Sergei Shtylyov Signed-off-by: David Brownell Cc: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_host.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'drivers/usb/musb/musb_host.c') diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index fc79e76b384..23d3890fd54 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -937,8 +937,8 @@ static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb) switch (musb->ep0_stage) { case MUSB_EP0_IN: fifo_dest = urb->transfer_buffer + urb->actual_length; - fifo_count = min(len, ((u16) (urb->transfer_buffer_length - - urb->actual_length))); + fifo_count = min_t(size_t, len, urb->transfer_buffer_length - + urb->actual_length); if (fifo_count < len) urb->status = -EOVERFLOW; @@ -971,10 +971,9 @@ static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb) } /* FALLTHROUGH */ case MUSB_EP0_OUT: - fifo_count = min(qh->maxpacket, ((u16) - (urb->transfer_buffer_length - - urb->actual_length))); - + fifo_count = min_t(size_t, qh->maxpacket, + urb->transfer_buffer_length - + urb->actual_length); if (fifo_count) { fifo_dest = (u8 *) (urb->transfer_buffer + urb->actual_length); @@ -1304,7 +1303,8 @@ void musb_host_tx(struct musb *musb, u8 epnum) * packets before updating TXCSR ... other docs disagree ... */ /* PIO: start next packet in this URB */ - wLength = min(qh->maxpacket, (u16) wLength); + if (wLength > qh->maxpacket) + wLength = qh->maxpacket; musb_write_fifo(hw_ep, wLength, buf); qh->segsize = wLength; -- cgit v1.2.3 From 136733d6124a152ed2b61c3d38008c6581fc8685 Mon Sep 17 00:00:00 2001 From: Sergei Shtylyov Date: Sat, 21 Feb 2009 15:31:35 -0800 Subject: USB: musb: use right poll limit for low speed devices Remove wrongly applied upper limit on the interrupt transfer interval for low speed devices (not much of an error per se, according to USB specs). Signed-off-by: Sergei Shtylyov Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_host.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) (limited to 'drivers/usb/musb/musb_host.c') diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index 23d3890fd54..6dbbd0786a6 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -1863,19 +1863,21 @@ static int musb_urb_enqueue( } qh->type_reg = type_reg; - /* precompute rxinterval/txinterval register */ - interval = min((u8)16, epd->bInterval); /* log encoding */ + /* Precompute RXINTERVAL/TXINTERVAL register */ switch (qh->type) { case USB_ENDPOINT_XFER_INT: - /* fullspeed uses linear encoding */ - if (USB_SPEED_FULL == urb->dev->speed) { - interval = epd->bInterval; - if (!interval) - interval = 1; + /* + * Full/low speeds use the linear encoding, + * high speed uses the logarithmic encoding. + */ + if (urb->dev->speed <= USB_SPEED_FULL) { + interval = max_t(u8, epd->bInterval, 1); + break; } /* FALLTHROUGH */ case USB_ENDPOINT_XFER_ISOC: - /* iso always uses log encoding */ + /* ISO always uses logarithmic encoding */ + interval = min_t(u8, epd->bInterval, 16); break; default: /* REVISIT we actually want to use NAK limits, hinting to the -- cgit v1.2.3