You cannot test an unsigned member of a struct for being negative, the
test will always fail. Instead assign the return value of
fdtdec_get_int, which returns an int, to a temporary variable declared
as an int, so that it can be tested for being negative before being
assigned to the unsigned struct member.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
epnum is used as an index into an array. The limit check for this index
should be performed before using it to access an element in the array to
prevent possible bounds overrun.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
A null check for the variable 'data' was introduced before dereferencing
it for set_phy_power but other uses were not so protected. Add the null
check for other dereferences of 'data'.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
The variable node is assigned to the return value of a function that
returns an int. It is tested for being negative and then passed as an
argument to a function that takes an int. So 'node' should not be
declared as unsigned. Correct it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Combining two bits into a mask to be used so that the same write code
can be used to set or reset bits in a register clearly needs to use the
binary 'or' operator, not the binary 'and'. Fix it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
When a variable needs a null check before it is dreferenced ensure that
this is done even in the case of assignment on declaration. This was not
happening for lurb_priv so correct it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
fsl_fdt_fixup_usb_erratum uses strcmp to detect an error but then
returns 'err' without it being set to an error. Calling code may not
detect that an error occurred leading to a silent failure. Instead just
return -EINVAL.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
THe variable node is assigned to the return value of a function that
returns an int. It is tested for being negative and then passed as an
argument to a function that takes an int. So 'node' should not be
declared as unsigned. Correct it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
These files had '#include<file.h>' rather than '#include <file.h>' which
while functional is not the correct style.
Signed-off-by: Tom Rini <trini@konsulko.com>
A few of the USB musb-new host glue drivers cannot build without access
to some platform specific header files. Express those requirements in
Kconfig as well.
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
A few of the USB host drivers cannot build without access to some
platform specific header files. Express those requirements in Kconfig as
well.
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
This driver was never enabled by any platforms after being added to the
tree over 5 years ago. Remove it.
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
This driver is unused since the removal of the bcm28155_ap board in
commit 0f6807e77b ("arm: Remove bcm28155_ap board"). Remove it.
Fixes: 0f6807e77b ("arm: Remove bcm28155_ap board")
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
This driver requires some mach-at91 specific header files in order to build.
Express that requirement in Kconfig as well.
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
A few of the platform specific DWC3 host glue drivers cannot build
without access to some platform specific header files. Express those
requirements in Kconfig as well.
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
Anshul Dalal <anshuld@ti.com> says:
On various TI's K3 platforms boot failure was observed on SPI NOR since the
commit 5609f200d0 ("arm: Kconfig: enable LTO for ARCH_K3"). This issue was
root caused to stack corruption by the 'udma_transfer' function. Where the local
variable 'paddr' of type 'dma_addr_t' was being written to as a 64-bit value
which overwrote the stack frame of the caller (dma_memcpy) as only 32-bits had
been reserved for paddr on the stack, specifically the r4 register in the frame
of dma_memcpy was being overwritten with a 0.
drivers/dma/ti/k3-udma.c:2192:
int udma_transfer(...)
{
...
dma_addr_t paddr = 0;
...
/* paddr was written to as 64-bit value here */
udma_poll_completion(uc, &paddr);
}
drivers/dma/dma-uclass.c:234:
int dma_memcpy(...)
{
dma_addr_t destination;
dma_addr_t source;
int ret;
...
/* This call resolves to udma_transfer */
ret = ops->transfer(...);
...
dma_unmap_single(destination, ...);
dma_unmap_single(...);
return ret;
}
Enabling LTO changed how gcc mapped local variables of dma_memcpy to CPU
registers, where earlier the bug was hidden since the overwritten register
'r4' was allotted to 'ret' but was allotted to 'destination' once LTO was
enabled. And since the overwritten value was 0, the bug remained undetected
as it just meant ret was 0, but having 'destination' set to 0 caused
dma_unmap_single to fail silently leading to boot failures.
The fix entails enabling DMA_ADDR_T_64BIT which changes dma_addr_t from u32 to
u64 for the R5 SPL thus reserving enough space for 'paddr' to prevent the
overflow.
Link: https://lore.kernel.org/r/20250903115207.572304-1-anshuld@ti.com
dma_addr_t is used to store any valid DMA address which might not
necessarily be the same size as host architecture's word size. Though
various typecasts in k3's dma and usb driver expect dma_addr_t to be the
same size as the word size.
This leads the compiler to throw a "cast from pointer to integer of
different size" warning when the condition is not met, for example when
enabling CONFIG_DMA_ADDR_T_64BIT for the R5 core.
Therefore this patch fixes the typecasts by using 'uintptr_t' as an
intermediary type which is guaranteed to be the same size as void* on
the host architecture. Thus, eliminating the compiler warning.
Signed-off-by: Anshul Dalal <anshuld@ti.com>
Like Rockchip RK3328, RK3568 and RK3588, the RK3528 also have a single
node to represent the glue and ctrl for USB 3.0.
Use rk_ops as driver data to select correct ctrl node for RK3528 DWC3.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Like Rockchip RK3328, RK3568 and RK3588, the RK3576 also have a single
node to represent the glue and ctrl for USB 3.0.
Use rk_ops as driver data to select correct ctrl node for RK3576 DWC3.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Use 0x350e as the default USB Product ID for Rockchip RK3576, same PID
being used by the BootROM when the device is in MASKROM mode.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
The rockchip usb gadget driver cannot build without platform specific
headers being available. Express that requirement in Kconfig as well.
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
The call to cdns3_gadget_ep_free_request will free priv_req so do the
call to list_del_init which accesses the memory pointed to by priv_req
before the free.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Use GUSBCFG_FORCEHOSTMODE to detected the HOST forced mode as it is done
in the Linux driver drivers/usb/dwc2/core.c:dwc2_core_reset().
The host polling must be executed only if the current mode is host,
either due to the force HOST mode (which persists after core reset)
or the connector id pin.
The GUSBCFG_FORCEDEVMODE bits is used to force the device mode (for
example used on STM32MP1x platform) and when it is activated the DWC2 reset
failed with the trace:
"dwc2_core_reset: Waiting for GINTSTS_CURMODE_HOST timeout"
Fixes: c5d685b899 ("usb: dwc2: Unify flush and reset logic with v4.20a support")
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Junhui Liu <junhui.liu@pigmoral.tech>
Tested-by: Patrice Chotard <patrice.chotard@foss.st.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
When the usb node is defined dr_mode="otg" ehci_usb_phy_mode() is called
to determine the mode from status registers.
The IMX95RM does not currently define the USBNC STATUS register but it is
assumed to be an omission as the first three registers are defined.
It has been expirimentally verified that the USBNC_PHY_STATUS register
at offset 0x23C bit4 (USBNC_PHYSTATUS_ID_DIG) reads 0 when USB_ID is GND
and 1 when floating.
Use is_imx9() as this driver works for i.MX91, i.MX93 and i.MX95 and all
of these determine the role based on the USBNC_PHY_STATUS register.
Fixes: 801b5fafd3 "(usb: ehci-mx6: Add i.MX95 support")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Alice Guo <alice.guo@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Lukasz Czechowski <lukasz.czechowski@thaumatec.com> says:
This patch series extends the usb_onboard_hub driver to allow for
support of more types of onboard hub devices, and adds the Cypress HX3
hub family.
First patch in the series updates the bind function, so that it no
longer uses hardcoded compatible strings.
Next patch simplifies the code, by removing unnecessary dm_gpio function
call.
Third patch updates the remove function, which allows the prevent issues
with usb devices reenumeration, in case of calling "usb reset". Although
the issue could still occur in case of invalid initial state of reset
gpio, it is minimized with no impact on main usb_hub driver.
Fourth patch extends the driver with support for multiple power
supplies, the same way it is done in kernel driver. Finally, last patch
provides hub data and of_match table entries for Cypress HX3
Link: https://lore.kernel.org/r/20250722-usb_onboard_hub_cypress_hx3-v4-0-91c3ee958c0e@thaumatec.com
The reset GPIO is obtained during driver probing by the function
devm_gpiod_get_optional, which means the GPIO will be automatically
freed when the device is removed. Because of this, explicit call
to free the reset GPIO in hub remove function is not needed.
To support the Managed device resources, the DEVRES config must
be enabled, otherwise the devres functions fall back to non-managed
variants. Set the necessary dependency to DEVRES in Kconfig.
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Lukasz Czechowski <lukasz.czechowski@thaumatec.com>
The only thing needed from DWC3 glue layer for Exynos850 is to enable
USB clocks. The generic glue layer driver already does that. Add
Exynos850 dwc3 compatible string to enable support for this chip.
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Signed-off-by: Minkyu Kang <mk7.kang@samsung.com>
Rasmus Villemoes <ravi@prevas.dk> says:
While looking through list.h, I saw that the regular list_* helpers
(and one of the hlist_* ones) still contain the prefetch() that was
removed in linux 14 years ago. It doesn't do anything, but makes the
macros harder to read, so get rid of it, and the fallback, no-op
definition that they relied on. That requires removing a few uses
outside list.h as well.
checkpatch warns about some whitespace issues in list.h, but as I've
copied whole kerneldoc+#define blocks directly from the linux kernel,
I think it's better to just accept that so that we don't introduce
needless diffs. The "macro argument reuse" arguments should also be
ignored, as e.g. the "member" arguments are obviously always just bare
identifiers, and the "pos" arguments must be assigned to multiple
times.
Link: https://lore.kernel.org/r/20250507121246.518691-1-ravi@prevas.dk
These all end up using the no-op prefetch() defined in linux/list.h,
because the only possible real implementation is in
arch/mips/include/asm/processor.h, which is behing
CONFIG_CPU_HAS_PREFETCH which is nowhere defined.
In order to be able to drop that fallback definition from list.h,
first remove all uses.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Contrary to the datasheet, setting both DETACH and PULLD_DIS bits to 1
does not always drive the DP and DM lines to high-impedance. This
prevents the host from reliably detecting a USB disconnect and subsequent
reconnect.
The symptom is that the first gadget command (e.g., dhcp) succeeds, while
subsequent commands (e.g., nfs) fail.
Disabling and re-enabling the controller entirely, instead of toggling the
PULLD_DIS bit, reliably generates a disconnect event.
The Linux driver works correctly because gadget_disconnect/gadget_connect
are always followed by gadget_udc_start/gadget_udc_stop. In U-Boot
pullup() is used solely.
This behavior has been observed on the SAM9X60-Curiosity and
AT91SAM9G25-EK boards and has been reported to Microchip.
Signed-off-by: Zixun LI <admin@hifiphile.com>
Link: https://lore.kernel.org/r/20250602-pullup-v1-1-edcde5a050dd@hifiphile.com
[mkorpershoek: reworded commit title + comment to usba_udc_pullup()]
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Remove duplicate .ops assignment that was overriding the correct
ti_musb_gadget_ops with musb_usb_ops (host ops) in the ti_musb_peripheral
driver. This was causing U-Boot crashes when trying to call the
handle_interrupts operation since the wrong ops structure was being used.
Fixes: 7d98dbcc3d ("usb: musb-new: Add support for DM_USB")
Fixes: 281eaf1ed8 ("usb: gadget: musb: Convert interrupt handling to usb_gadget_generic_ops")
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://lore.kernel.org/r/20250611171031.840277-1-kory.maincent@bootlin.com
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
This function is currently a misnomer at times as we have cases where it
passes arguments to the image. In preparation for making that be a more
common case rename this function to jump_to_image(...). In order to do
this, rename jump_to_image in board_init_r(...) to jumper so that we do
not have a conflict.
Signed-off-by: Simon Glass <sjg@chromium.org>
[trini: Reword the commit message, adding missing cases of
jump_to_image_no_args()]
Signed-off-by: Tom Rini <trini@konsulko.com>
