AM62A3: Enabling USB testmode with devmem2 register writes

Gunter Schmer

Genius 13897 points

Part Number: AM62A3

Tool/software:

Hi,

one of our customers is trying to enable USB test mode on the AM62A USB on the xhci0 instance.

They are currently using these commands

am62ax xhci0 test packet
=======================
devmem2 0x31000420 w 0xA0               # PORTSC, PP='0'
devmem2 0x31000020 w 0x4                # USBCMD, clear bit0 (Run/Stop)
devmem2 0x31000424 w 0x40000000         # POERPMSC, set testmode

am62ax xhci1 test packet
=======================
devmem2 0x31100420 w 0xA0
devmem2 0x31100020 w 0x4
devmem2 0x31100424 w 0x40000000

However one of the registers 0x31000424 cannot be accessed somehow.

echo host > /sys/kernel/debug/usb/31000000.usb/mode
[ 1002.887632] dwc3 31000000.usb: request 00000000249a968f was not queued to ep0out
[ 1002.897985] android_work: sent uevent USB_STATE=DISCONNECTED
[ 1002.998541] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[ 1002.998569] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 1
[ 1002.998708] xhci-hcd xhci-hcd.2.auto: USB3 root hub has no ports
[ 1002.998715] xhci-hcd xhci-hcd.2.auto: hcc params 0x0258fe6d hci version 0x110 quirks 0x0000008000010010
[ 1002.998756] xhci-hcd xhci-hcd.2.auto: irq 264, io mem 0x31000000
[ 1002.999596] hub 1-0:1.0: USB hub found
[ 1002.999638] hub 1-0:1.0: 1 port detected

First register

devmem2 0x31000420 w 0xA0
devmem2 0x31000424 w 0x/dev/mem opened.
Memory mapped at address 0xffff83e14000.
Value at address 0x31000420 (0xffff83e14420): 0xA0002A0
Written 0xA0; readback 0xA0

Second register
devmem2 0x31000020 w 0x4
/dev/mem opened.
Memory mapped at address 0xffff962be000.
Value at address 0x31000020 (0xffff962be020): 0x5
Written 0x4; readback 0x4

Third register

devmem2 0x31000424 w 0x40000000
/dev/mem opened.
[ 1010.633870] audit: type=1701 audit(1016.340:4): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=483 comm="devmem2" exe="/usr/bin/devmem2" sig=7 res=1
Memory mapped at address 0xffff9a9aa000.
Bus error (core dumped)

The problem is not only writing to this address, even reading, it crashes:

devmem2 0x31000424
/dev/mem opened.
[ 1421.145698] audit: type=1701 audit(1426.852:5): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=493 comm="devmem2" exe="/usr/bin/devmem2" sig=7 res=1
Memory mapped at address 0xffff9f620000.
Bus error (core dumped)

Please let us know what the issue could be.

Thanks!

--Gunter

1 month ago

0 Bin Liu 1 month ago

TI__Guru*** 143436 points

Hi Gunter,

Gunter Schmer said:
echo host > /sys/kernel/debug/usb/31000000.usb/mode

I never used this commend to configure the USB port to host mode, and not sure what it is doing exactly.

Can you please modify the kernel device tree to set dr_mode = "host" in &usb0 node, then run the 3 devmem2 commands? This dr_mode setting in kernel devicetree will configure the USB0 port to host mode.

0 Armando Uribe De Leon 1 month ago in reply to Bin Liu

Prodigy 40 points

Hi Bin Liu,

I did try that too.

Same result, I forced host mode from the device tree. Accessing that last register triggers an exception; the memory simply cant be accessed in any way.

Device tree config:

        usbss0: dwc3-usb@f900000 {
                compatible = "ti,am62-usb";
                reg = <0x00 0x0f900000 0x00 0x800>,
                      <0x00 0x0f908000 0x00 0x400>;
                clocks = <&k3_clks 161 3>;
                clock-names = "ref";
                ti,syscon-phy-pll-refclk = <&usb0_phy_ctrl 0x0>;
                #address-cells = <2>;
                #size-cells = <2>;
                power-domains = <&k3_pds 178 TI_SCI_PD_EXCLUSIVE>;
                ranges;
                status = "okay";

                usb0: usb@31000000 {
                        compatible = "snps,dwc3";
                        reg =<0x00 0x31000000 0x00 0x50000>;
                        interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>, /* irq.0 */
                                     <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>; /* irq.0 */
                        interrupt-names = "host", "peripheral";
                        maximum-speed = "high-speed";
                        //dr_mode = "otg";
                        dr_mode = "host";
                        status = "okay";
                };
        };

test:

cat /sys/firmware/devicetree/base/bus@f0000/dwc3-usb@f900000/usb@31000000/dr_mode
host

devmem does not do anything that fancy:

map_base = mmap(0, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, target & ~MAP_MASK);

read_result = *((unsigned long *) virt_addr);

does this register exist?

0x31000424

Maybe for this platform PMSC register is in a different offset/bank?

Armando

0 Bin Liu 1 month ago in reply to Armando Uribe De Leon

TI__Guru*** 143436 points

Hi Armando,

I just tried the 3 devmem2 commands on my SK-AM62A EVM with Processor SDK v9.1 Linux image, but I don't see this bus error problem.

Gunter Schmer said:
echo host > /sys/kernel/debug/usb/31000000.usb/mode
[ 1002.887632] dwc3 31000000.usb: request 00000000249a968f was not queued to ep0out
[ 1002.897985] android_work: sent uevent USB_STATE=DISCONNECTED

I don't find android_work in the kernel source code. What kernel do you use?

0 Armando Uribe De Leon 1 month ago in reply to Bin Liu

Prodigy 40 points

Hi Bin Liu

We are using TI's Linux Kernel based on:

VERSION = 6
PATCHLEVEL = 1
SUBLEVEL = 80
EXTRAVERSION =
NAME = Curry Ramen

The logs you see there are coming from Android's ADB (drivers/usbgadget/configfs.c)

TI's kernel does not support adb; so I added some changes to support it.

On the second test I performed I forced usb mode as host; hence adb gadget should not interfere. Anyway do you think I should remove USB GADGET kernel defconfigs?

Armando

0 Bin Liu 1 month ago in reply to Armando Uribe De Leon

TI__Guru*** 143436 points

Hi Armando,

I cannot think of any reason why the 3rd register write would fail while the first 2 writes passed, so it is worth to try to just use the kernel defconfig in the SDk without any change, which would be close to what I did.

I also noticed the output format of your devmem2 command is different from mine, so it seems you don't use the Linux rootfs provided in the SDK. So also might want to switch the SDK rootfs to see if the devmem2 program makes difference.

0 Armando Uribe De Leon 1 month ago in reply to Bin Liu

Prodigy 40 points

Bin Liu

I see, I am more inclined to believe the devmem2 is the culprit here. Let me test that.

Thanks

0 Armando Uribe De Leon 1 month ago in reply to Armando Uribe De Leon

Prodigy 40 points

Hi Bin Liu

I got the devmem2 tool (and the neeeded runtime libs) from SDK 10.00.00.08 and now reading and writhen the 3 registers works

devmem2 0x31000420 w 0xA0
/dev/mem opened.
Memory mapped at address 0xffffa24ac000.
Read at address 0x31000420 (0xffffa24ac420): 0x0A0002A0
Write at address 0x31000420 (0xffffa24ac420): 0x000000A0, readback 0x000000A0

devmem2 0x31000020 w 0x4
/dev/mem opened.
Memory mapped at address 0xffffa17bc000.
Read at address 0x31000020 (0xffffa17bc020): 0x00000005
Write at address 0x31000020 (0xffffa17bc020): 0x00000004, readback 0x00000004

devmem2 0x31000424 w 0x40000000
/dev/mem opened.
Memory mapped at address 0xffffbcbcd000.
Read at address 0x31000424 (0xffffbcbcd424): 0x00000000
Write at address 0x31000424 (0xffffbcbcd424): 0x40000000, readback 0x40000000

Do you know where exactly TI's SDK is getting devtool2 source from? I need to build it from our environment

Kernel changes are not affecting this. its only the specific devmem2 flavor you guys got.

Thanks

0 Bin Liu 1 month ago in reply to Armando Uribe De Leon

TI__Guru*** 143436 points

Hi Armando,

Glad to see the root cause is identified. The link below shows the source of devmem2 on github.

https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/devmem2/devmem2_2.0.bb?h=master

Processors

Processors forum

AM62A3: Enabling USB testmode with devmem2 register writes