When aborting a Transfer Descriptor (TD), the xHCI driver updates the
device dequeue pointer by converting the virtual enqueue TRB pointer
into a DMA address.
Previously, the code OR-ed the ring's Dequeue Cycle State (DCS) bit into
the virtual TRB pointer before passing it to xhci_trb_virt_to_dma().
This produced an unaligned virtual address (e.g. ending in 0x...1).
Inside xhci_trb_virt_to_dma(), the offset calculation:
segment_offset = trb - seg->trbs;
operated on this unaligned pointer, resulting in an incorrect TRB index.
In wraparound cases, this caused the bounds check to fail and the
function to return 0.
As a result, a SET_DEQ_PTR command was issued with a DMA address of 0x0,
leading to controller hangs and transfer timeouts, most commonly when
aborting TDs near the end of a ring segment (e.g. index 63).
Fix this by translating the aligned virtual TRB pointer to a DMA address
first, and only then applying the DCS bit to the resulting physical
address.
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: ANANDHAKRISHNAN S <anandhakrishnan.s@dicortech.com>
With commit 5663b137e6 ("arm: Remove edminiv2 board") the last
ARCH_ORION5X platform was removed. Remove the rest of the architecture
code which is now unused.
Reviewed-by: Tony Dinh <mibodhi@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
We have been getting a lot more patches from Qualcomm engineers, largely
focusing on IoT, router, and automotive platforms (those with QCS, IPQ,
and SA prefixes specifically).
Quite a variety of changes here:
- Watchdog overflow fix
- Hardcoded fastboot buffer addresses for a few board (hoppefully
temporary until fastboot is updated to read $fastboot_addr_r)
- Enable memory protection (MMU_MGPROT) for ARCH_SNAPDRAGON
- pinctrl support for the QCS615 soc
- various USB/phy fixes including phy config for msm8996/qcs615
- mmc and i2c clock configuration fixes
- significant fixes for rpmh and regulator drivers
- added config fragment for pixel devices
- sa8775p clock fixes
- support for "flattened" dwc3 DT that recently landed upstream for
sc7280 (qcs6490) and a few other platforms
Qualcomm devicetrees are moving away from having a glue node with dwc3
as a subnode and now may just have a single flattened node.
Rockchip already have a glue_get_ctrl_dev op which returns the node for
the glue device itself, commonise this and reuse it for the new Qualcomm
node.
Lastly adjust the qscratch base address since it now requires an offset
from the dwc3 base.
Link: https://patch.msgid.link/20260116-casey-usb-role-switch-v2-1-83a1a6501a11@linaro.org
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
u-boot-dfu-20260116
CI: https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/29018
Android:
* Fix missing dependency for BOOTMETH_ANDROID
* Add bootconfig support
* Add 'get ramdisk' command to abootimg
DFU:
* Improve error handling in dfu_fill_entity()
USB Gadget:
* ci_udc: Ensure ci_ep->desc is valid before using it
* ci_udc: Add additional debug prints
The Linux support for dwc3 on Apple silicon SoCs switched to using a
apple specific glue driver [1] that uses it own compatible string. The
glue driver handles platform specific requirements on the interaction
between dwc3 and the USB2/USB3 PHY and reset-controller for USB role
switches and plug events.
To keep USB working as before when the nodes still carried "snps,dwc3"
as compatible add "apple,t8103-dwc3" to the of match table. Eventually
it is probably advisable to add a dwc3-apple glue driver and write code
for the currently empty Apple Type-C PHY driver in phy-apple-atc.c.
Link: https://lore.kernel.org/asahi/20251015-b4-aplpe-dwc3-v2-0-cbd65a2d511a@kernel.org/ [1]
Reviewed-by: Neal Gompa <neal@gompa.dev>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Janne Grunau <j@jannau.net>
Tom Rini <trini@konsulko.com> says:
As seen by a number of patches fixing memory leaks, U-Boot has a problem
with developer expectations around devm_kmalloc and friends. Namely,
whereas in Linux these memory allocations will be freed automatically in
most cases, in U-Boot this is only true if DEVRES is enabled. Now,
intentionally, in xPL phases, we do not (and do not offer as an option)
enabling DEVRES. However in full U-Boot this is left either to the user,
or some drivers have select'd DEVRES on their own. This inconsistency is
a problem. This series goes and deals with two small issues that were
shown by having all drivers that use devm_.alloc to allocate memory also
select DEVRES and then we make DEVRES no longer be a prompted option and
instead select'd as needed. We do not make this unconditional as it
would result in growing the resulting binary on the many platforms which
have no users of the devm_.alloc family of functions.
Link: https://lore.kernel.org/r/20251227223833.3019311-1-trini@konsulko.com
The devm alloc functions that we have may follow the Linux kernel model
where allocations are (almost always) automatically free()'d. However,
quite often we don't enable, in full U-Boot, the tracking and free()'ing
functionality. This in turn leads to memory leaks because the driver
author expects that since the functions have the same name as in the
Linux Kernel they have the same behavior. In turn we then get
functionally correct commits such as commit 00e1fed93c ("firmware:
ti_sci: Fix memory leaks in devm_ti_sci_get_of_resource") that manually
add these calls. Rather than manually tracking allocations and
implementing free()s, rework things so that we follow expectations by
enabling the DEVRES functionality (outside of xPL phases).
This turns DEVRES from a prompted symbol to a symbol that must be
select'd, and we now remove our non-managed alloc/free functions from
outside of xPL builds.
Reviewed-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
There are two places where ci_ep->desc could be accessed despite it is
not valid at that moment. Either the endpoint has not been enabled yet
or it has been disabled meanwhile (The ethernet gadged behaves this way
at least.). That results in dereferencing a null pointer.
Moreover, the patch gets rid of possible outstanding requests if the
endpoint's state changes to disabled.
Signed-off-by: Petr Beneš <petr.benes@ysoft.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://lore.kernel.org/r/20251218142737.3169753-1-petr.benes@ysoft.com
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Exynos7870's DWC3 glue layer is quite simple, consisting of a few
clocks, which is handled by this driver. Add the compatible string in
here.
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Kaustabh Chakraborty <kauschluss@disroot.org>
Documentation [1] states that the default value of the dr_mode property
is "otg". It also isn't marked a mandatory node, so it may or may not be
set. So, accordingly if dr_mode is not mentioned in the devicetree node,
OTG mode must be assumed.
In this driver however, this case is not handled. If dr_mode is not
mentioned, USB_DR_MODE_UNKNOWN is set. The logic implemented raises an
error, instead of falling back to USB_DR_MODE_OTG. Correct this to
conform to the specification.
Link: https://git.kernel.org/pub/scm/linux/kernel/git/devicetree/devicetree-rebasing.git/tree/Bindings/usb/usb-drd.yaml?h=v6.18-dts [1]
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Kaustabh Chakraborty <kauschluss@disroot.org>
We should avoid overwhelming users with non-essential messages.
The message 'Starting the controller' is not written for EHCI.
We should not write it for XHCI either.
Adjust the Python test accordingly.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
We should avoid overwhelming users with non-essential messages.
'Register NbrPorts' is a debug message for EHCI. Do the same for XHCI.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
This driver cannot build when DM_USB_GADGET is enabled as both options
control building of files that use the same global namespace and
functionality. In this case make CI_UDC depend on DM_USB_GADGET being
disabled as non-DM support is the legacy choice.
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
All instances of the U_BOOT_DRIVER must use a unique name or they will
lead to link time failures due to name space conflicts when both are
present. Most of the XHCI drivers follow pattern of xhci_xxx in their
name, but a few used "usb_xhci". Change these to follow the pattern of
the rest of the XHCI glue drivers.
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
The DWC2 OTG driver depends on an ARM-specific header file to compile,
so make it depend on ARM.
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
The last of the users of the legacy musb drivers have been
migrated so now remove the old musb stack, all users should
now be using the new musb stack if they need this functionality.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
[trini: Remove a Makefile reference that was missed in v1]
Signed-off-by: Tom Rini <trini@konsulko.com>
It makes no sense to ask about nor enable SPL_USB_GADGET without
SPL_FRAMEWORK being enabled. Attempting to do so leads to Kconfig noting
dependency issues. Add the missing dependency.
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Since the EHCI USB driver is shared across i.MX91, i.MX93, i.MX94, and
i.MX95, the condition check is updated to use IMX9.
Signed-off-by: Alice Guo <alice.guo@nxp.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
If OF_CONTROL is on, ti-musb.c registers a "ti-musb-wrapper" driver
that requires UCLASS_MISC. Hence, select MISC if both OF_CONTROL
and USB_MUSB_TI are selected.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
A variety of Qualcomm features/fixes for this cycle, notably with a few
new platforms gaining support:
* Initial support for SDM670 (similar to SDM845), SM6350, and SM7150
platforms is added
* USB and UART issues on MSM8916 are addressed (improving stability/
reliability)
* Firmware loading is implemented for the GENI serial engine, this is
used on some platforms to load firmware for i2c/spi/uart to work
Some additional patches like binman support for building MBN files still
need some additional work.
CI: 8ef6ac07b3/pipelines
You cannot test an unsigned member of a struct for being negative, the
test will always fail. Instead assign the return value of
fdtdec_get_int, which returns an int, to a temporary variable declared
as an int, so that it can be tested for being negative before being
assigned to the unsigned struct member.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
epnum is used as an index into an array. The limit check for this index
should be performed before using it to access an element in the array to
prevent possible bounds overrun.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
A null check for the variable 'data' was introduced before dereferencing
it for set_phy_power but other uses were not so protected. Add the null
check for other dereferences of 'data'.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
The variable node is assigned to the return value of a function that
returns an int. It is tested for being negative and then passed as an
argument to a function that takes an int. So 'node' should not be
declared as unsigned. Correct it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Combining two bits into a mask to be used so that the same write code
can be used to set or reset bits in a register clearly needs to use the
binary 'or' operator, not the binary 'and'. Fix it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
When a variable needs a null check before it is dreferenced ensure that
this is done even in the case of assignment on declaration. This was not
happening for lurb_priv so correct it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
fsl_fdt_fixup_usb_erratum uses strcmp to detect an error but then
returns 'err' without it being set to an error. Calling code may not
detect that an error occurred leading to a silent failure. Instead just
return -EINVAL.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
THe variable node is assigned to the return value of a function that
returns an int. It is tested for being negative and then passed as an
argument to a function that takes an int. So 'node' should not be
declared as unsigned. Correct it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
These files had '#include<file.h>' rather than '#include <file.h>' which
while functional is not the correct style.
Signed-off-by: Tom Rini <trini@konsulko.com>
A few of the USB musb-new host glue drivers cannot build without access
to some platform specific header files. Express those requirements in
Kconfig as well.
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
