The zero-length packet is the sendor tells the receiver that there
is no more data, so it is only needed at the TX side.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

We can support USB OTG 1.3 USB_DEVICE_A_HNP_SUPPORT request when
the driver supports OTG FSM mode.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

Convert endpoint configuration to new capabilities model.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Since some chipidea based controller is not otg capable, add ci->is_otg
condition when setting is_otg flag for gadget.
Signed-off-by: NLi Jun <jun.li@freescale.com>
Reviewed-by: NRoger Quadros <rogerq@ti.com>
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Init and update otg capabilities by DT, set gadget's otg capabilities
accordingly.
Acked-by: NPeter Chen <peter.chen@freescale.com>
Reviewed-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NLi Jun <jun.li@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

By pass pullup DP in OTG fsm mode when do gadget connect, to let it handled
by OTG state machine.

This patch can fix the problem you found with my HNP polling patchset after
below 3 patches introduced:
467a78c8 usb: chipidea: udc: apply new usb_udc_vbus_handler interface
628ef0d2 usb: udc: add usb_udc_vbus_handler
dfea9c94 usb: udc: store usb_udc pointer in struct usb_gadget

Problem:
- Connect USB cable and MicroAB cable between two boards
- Boot up two boards
- load g_mass_storage at B-device side, the enumeration will success,
and A will see a usb mass-storage device
- load g_mass_storage at A-device side, the problem has occurred, the
connection will be lost at the beginning, then connect again.

This patch is based on
commit eff933c1d3a2e046492b3dfc86db813856553a29
(chipidea: pci: make it depends on NOP_USB_XCEIV)
on branch peter-usb-dev of
git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb.gitSigned-off-by: NLi Jun <jun.li@freescale.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

It can move all pullup/pulldown operation control to udc-core
through usb_gadget_connect/usb_gadget_disconnect according to
vbus status.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

At chipidea revision 2.40a, there is a below errata:

9000531823  B2-Medium  Adding a dTD to a Primed Endpoint May Not Get Recognized

Title: Adding a dTD to a Primed Endpoint May Not Get Recognized

Impacted Configuration: All device mode configurations.

Description:
There is an issue with the add dTD tripwire semaphore (ATDTW bit in USBCMD register)
that can cause the controller to ignore a dTD that is added to a primed endpoint.
When this happens, the software can read the tripwire bit and the status bit at '1'
even though the endpoint is unprimed.

After executing a dTD, the device controller endpoint state machine executes a final
read of the dTD terminate bit to check if the application added a dTD to the linked
list at the last moment. This read is done in the finpkt_read_latest_next_td (44) state.
After the read is performed, if the terminate bit is still set, the state machine moves
to unprime the endpoint. The decision to unprime the endpoint is done in the
checkqh_decision (59) state, based on the value of the terminate bit.
Before reaching the checkqh_decision state, the state machine traverses the
writeqhtd_status (57), writeqh_status (56), and release_prime_mask (42) states.
As shown in the waveform, the ep_addtd_tripwire_clr signal is not set to clear
the tripwire bit in these states.

Workaround:
The software must implement a periodic poll cycle, and check for each dTD
pending on execution (Active = 1), if the enpoint is primed. It can do this by reading
the corresponding bits in the ENDPTPRIME and ENDPTSTAT registers. If these bits are
read at 0, the software needs to re-prime the endpoint by writing 1 to the corresponding
bit in the ENDPTPRIME register. This can be done for every microframe, every frame or
with a larger interval, depending on the urgency of transfer execution for the application.
Tested-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NSanchayan Maity <maitysanchayan@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Some gadget driver (like uac1) will try to enable endpoint again even
the ep is not empty, it will cause the ep reset again and may affect
the dTD list which has already queued.

It returns -EBUSY immediately, and indicate the endpoint is in use.
In this way, the ep's behavior will not be affected, and the gadget
driver is also notified.

Cc: Xuebing Wang <xbing6@gmail.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds response to a_alt_hnp_support set feature request from legacy
A device, that is, B-device can provide a message to the user indicating that
the user needs to connect the B-device to an alternate port on the A-device.
A device sets this feature indicates to the B-device that it is connected
to an A-device port that is not capable of HNP, but that the A-device does have
an alternate port that is capable of HNP.

[Peter]
Without this patch, the OTG B device can't be enumerated on
non-HNP port at A device, see below log:
[    2.287464] usb 1-1: Dual-Role OTG device on non-HNP port
[    2.293105] usb 1-1: can't set HNP mode: -32
[    2.417422] usb 1-1: new high-speed USB device number 4 using ci_hdrc
[    2.460635] usb 1-1: Dual-Role OTG device on non-HNP port
[    2.466424] usb 1-1: can't set HNP mode: -32
[    2.587464] usb 1-1: new high-speed USB device number 5 using ci_hdrc
[    2.630649] usb 1-1: Dual-Role OTG device on non-HNP port
[    2.636436] usb 1-1: can't set HNP mode: -32
[    2.641003] usb usb1-port1: unable to enumerate USB device

Cc: stable <stable@vger.kernel.org>
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The gadget power property will be used at get_status request.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The hw_device_reset is dedicated to be used at device mode initializaiton,
so delete the parameter 'mode'. For host driver, the ehci driver will
handle all things.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Replace usb_gadget_driver's disconnect with udc-core's reset notifier at
bus reset handler.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch modify the generic code handling PHYs to allow them to be
supplied from the drivers. This adds checks to ensure no PHY was already
there when looking for one in the generic code. This also makes sure we
do not modify its state in the generic HCD functions, it was provided by
the driver.
Signed-off-by: NAntoine Tenart <antoine.tenart@free-electrons.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

now that no UDC driver relies on the extra
'driver' argument to ->udc_stop(), we can
safely remove it.

This commit is based on previous work by
Robert Baldyga <r.baldyga@samsung.com> which
can be found at [1]; however that patch turned
out to have a high probability of regressing
many UDC drivers because of a blind search & replace
s/driver/$udc->driver/ which caused the 'driver'
argument to stop_activity() to be a valid non-NULL
pointer when it should be NULL, thus causing UDCs
to mistakenly call gadget driver's ->disconnect()
callback.

[1] http://markmail.org/message/x5zneg4xea4zntabAcked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Use the recently introduced usb_gadget_giveback_request() in favor of
direct invocation of the completion routine.

All places in drivers/usb/ matching "[-.]complete(" were replaced with a
call to usb_gadget_giveback_request(). This was compile-tested with all
ARM drivers enabled and runtime-tested for musb.
Signed-off-by: NMichal Sojka <sojka@merica.cz>
Acked-by: NFelipe Balbi <balbi@ti.com>
Tested-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There are 2 methods for ZLP (zero-length packet) generation:
1) In software
2) Automatic generation by device controller

1) is implemented in UDC driver and it attaches ZLP to IN packet if
   descriptor->size < wLength
2) can be enabled/disabled by setting ZLT bit in the QH

When gadget ffs is connected to ubuntu host, the host sends
get descriptor request and wLength in setup packet is 255 while the
size of descriptor which will be sent by gadget in IN packet is
64 byte. So the composite driver sets req->zero = 1.
In UDC driver following code will be executed then

        if (hwreq->req.zero && hwreq->req.length
            && (hwreq->req.length % hwep->ep.maxpacket == 0))
                add_td_to_list(hwep, hwreq, 0);

Case-A:
So in case of ubuntu host, UDC driver will attach a ZLP to the IN packet.
ubuntu host will request 255 byte in IN request, gadget will send 64 byte
with ZLP and host will come to know that there is no more data.
But hold on, by default ZLT=0 for endpoint 0 so hardware also tries to
automatically generate the ZLP which blocks enumeration for ~6 seconds due
to endpoint 0 STALL, NAKs are sent to host for any requests (OUT/PING)

Case-B:
In case when gadget ffs is connected to Apple device, Apple device sends
setup packet with wLength=64. So descriptor->size = 64 and wLength=64
therefore req->zero = 0 and UDC driver will not attach any ZLP to the
IN packet. Apple device requests 64 bytes, gets 64 bytes and doesn't
further request for IN data. But ZLT=0 by default for endpoint 0 so
hardware tries to automatically generate the ZLP which blocks enumeration
for ~6 seconds due to endpoint 0 STALL, NAKs are sent to host for any
requests (OUT/PING)

According to USB2.0 specs:

    8.5.3.2 Variable-length Data Stage
    A control pipe may have a variable-length data phase in which the
    host requests more data than is contained in the specified data
    structure. When all of the data structure is returned to the host,
    the function should indicate that the Data stage is ended by
    returning a packet that is shorter than the MaxPacketSize for the
    pipe. If the data structure is an exact multiple of wMaxPacketSize
    for the pipe, the function will return a zero-length packet to indicate
    the end of the Data stage.

In Case-A mentioned above:
If we disable software ZLP generation & ZLT=0 for endpoint 0 OR if software
ZLP generation is not disabled but we set ZLT=1 for endpoint 0 then
enumeration doesn't block for 6 seconds.

In Case-B mentioned above:
If we disable software ZLP generation & ZLT=0 for endpoint then enumeration
still blocks due to ZLP automatically generated by hardware and host not needing
it. But if we keep software ZLP generation enabled but we set ZLT=1 for
endpoint 0 then enumeration doesn't block for 6 seconds.

So the proper solution for this issue seems to disable automatic ZLP generation
by hardware (i.e by setting ZLT=1 for endpoint 0) and let software (UDC driver)
handle the ZLP generation based on req->zero field.

Cc: stable@vger.kernel.org
Signed-off-by: NAbbas Raza <Abbas_Raza@mentor.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We need to delete un-finished td from current request's td list
at ep_dequeue API, otherwise, this non-user td will be remained
at td list before this request is freed. So if we do ep_queue->
ep_dequeue->ep_queue sequence, when the complete interrupt for
the second ep_queue comes, we search td list for this request,
the first td (added by the first ep_queue) will be handled, and
its status is still active, so we will consider the this transfer
still not be completed, but in fact, it has completed. It causes
the peripheral side considers it never receives current data for
this transfer.

We met this problem when do "Error Recovery Test - Device Configured"
test item for USBCV2 MSC test, the host has never received ACK for
the IN token for CSW due to peripheral considers it does not get this
CBW, the USBCV test log like belows:

--------------------------------------------------------------------------
INFO
Issuing BOT MSC Reset, reset should always succeed
INFO
Retrieving status on CBW endpoint
INFO
CBW endpoint status = 0x0
INFO
Retrieving status on CSW endpoint
INFO
CSW endpoint status = 0x0
INFO
Issuing required command (Test Unit Ready) to verify device has recovered
INFO
Issuing CBW (attempt #1):
INFO
|----- CBW LUN                  = 0x0
INFO
|----- CBW Flags                = 0x0
INFO
|----- CBW Data Transfer Length = 0x0
INFO
|----- CBW CDB Length           = 0x6
INFO
|----- CBW CDB-00 = 0x0
INFO
|----- CBW CDB-01 = 0x0
INFO
|----- CBW CDB-02 = 0x0
INFO
|----- CBW CDB-03 = 0x0
INFO
|----- CBW CDB-04 = 0x0
INFO
|----- CBW CDB-05 = 0x0
INFO
Issuing CSW : try 1
INFO
CSW Bulk Request timed out!
ERROR
Failed CSW phase : should have been success or stall
FAIL
(5.3.4) The CSW status value must be 0x00, 0x01, or 0x02.
ERROR
BOTCommonMSCRequest failed:  error=80004000

Cc: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Cc: stable@vger.kernel.org
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Update device states according to ch9 in USB 2.0 specification
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Delete useless code
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

USB OTG interrupt handling and fsm transitions according to USB OTG
and EH 2.0.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add b_hnp_enable request handling and enable gadget->is_otg
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch moves usb interrupt enable and status register read functions
from udc driver to core driver to use them in all ci drivers.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Use a more general way to read and write otgsc register.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Matthieu CASTET and Michael Grzeschik mentioned isr_tr_complete_handler
is a bit messy at below:
http://marc.info/?l=linux-usb&m=139047775001152&w=2

This commit creates a new function isr_setup_packet_handler to handle
setup packet, it makes isr_tr_complete_handler easy to read.

This is no functional change at this commit, tested with g_mass_storage
and g_ether.

Cc: Michael Grzeschik <mgr@pengutronix.de>
Cc: Matthieu CASTET <matthieu.castet@parrot.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- delete the warning message at interrupt handler, and adds judgement at
ep_enable, if non-ep0 requests ctrl transfer, it will indicate an error.
- delete hw_test_and_clear_setup_status which is a broken code
- Tested with g_mass_storage, g_ncm, g_ether

Cc: matthieu.castet@parrot.com
Reported-by: NMichael Grzeschik <mgr@pengutronix.de>
Acked-by: NMichael Grzeschik <mgr@pengutronix.de>
Tested-by: NMichael Grzeschik <mgr@pengutronix.de>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- Delete global_phy due to we can get the phy from phy layer now
- using devm_usb_get_phy to instead of usb_get_phy
- delete the otg_set_peripheral, which should be handled by otg layer
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

ENDPTFLUSH and ENDPTPRIME registers are set by software and clear
by hardware. There is a bit for each endpoint. When we are setting
a bit for an endpoint we should make sure we do not touch other
endpoint bit. There is a race condition if the hardware clear the
bit between the read and the write in hw_write.

Cc: stable <stable@vger.kernel.org> # 3.11+
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NMatthieu CASTET <matthieu.castet@parrot.com>
Tested-by: NMichael Grzeschik <mgrzeschik@pengutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We have met a bug that the high bandwidth ISO-TX transfer has failed
at the last packet if it is less than 1024, the TD status shows it
is "Transaction Error".

The root cause of this problem is: the mult value at qh is not correct
for current TD's transfer length. We use TD list to queue un-transfer
TDs, and change mult for new adding TDs. If new adding TDs transfer length
less than 1024, but the queued un-transfer TDs transfer length is larger
than 1024, the transfer error will occur, and vice versa.
Usually, this problem occurs at the last packet, and the first packet for
new frame.

We fixed this problem by setting Mult at QH as the largest value (3), and
set MultO (Multiplier Override) at TD according to every transfer length.
It can cover both hardware version less than 2.3 (the real mult is MultO
if it is not 0) and 2.3+ (the real mult is min(qh.mult, td.multo)).

Since the MultO bits are only existed at TX TD, we keep the ISO-RX behavior
unchanged.

For stable tree: 3.11+.

Cc: stable <stable@vger.kernel.org>
Cc: Michael Grzeschik <m.grzeschik@pengutronix.de>
Reported-by: NMatthieu Vanin <b47495@freescale.com>
Tested-by: NMatthieu Vanin <b47495@freescale.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds "maxpacket_limit" to struct usb_ep. This field contains
maximum value of maxpacket supported by driver, and is set in driver probe.
This value should be used by autoconfig() function, because value of field
"maxpacket" is set to value from endpoint descriptor when endpoint becomes
enabled. So when autoconfig() function will be called again for this endpoint,
"maxpacket" value will contain wMaxPacketSize from descriptior instead of
maximum packet size for this endpoint.

For this reason this patch adds new field "maxpacket_limit" which contains
value of maximum packet size (which defines maximum endpoint capabilities).
This value is used in ep_matches() function used by autoconfig().

Value of "maxpacket_limit" should be set in UDC driver probe function, using
usb_ep_set_maxpacket_limit() function, defined in gadget.h. This function
set choosen value to both "maxpacket_limit" and "maxpacket" fields.

This patch modifies UDC drivers by adding support for maxpacket_limit.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

If we connect Male-A-To-Male-A cable between otg-host and host pc,
the ci->vbus_active is set wrongly, and cause the controller run
at peripheral mode when we load gadget module (ci_udc_start will be run),
but the software runs at host mode due to id = 0. The ehci_irq
can't handle suspend (USBi_SLI) interrupt which is enabled for
peripheral mode, it causes no one will handle irq error.

This patch is needed for 3.12 stable

Cc: stable <stable@vger.kernel.org>
Acked-by: NMichael Grzeschik <mgr@pengutronix.de>
Reported-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fixing the below dump:

root@freescale ~$ modprobe g_serial
g_serial gadget: Gadget Serial v2.4
g_serial gadget: g_serial ready
BUG: sleeping function called from invalid context at /home/b29397/work/projects/upstream/usb/usb/drivers/base/power/runtime.c:952
in_atomic(): 1, irqs_disabled(): 128, pid: 805, name: modprobe
2 locks held by modprobe/805:
 #0:  (udc_lock){+.+.+.}, at: [<7f000a74>] usb_gadget_probe_driver+0x44/0xb4 [udc_core]
 #1:  (&(&ci->lock)->rlock){......}, at: [<7f033488>] ci_udc_start+0x94/0x110 [ci_hdrc]
irq event stamp: 3878
hardirqs last  enabled at (3877): [<806b6720>] _raw_spin_unlock_irqrestore+0x40/0x6c
hardirqs last disabled at (3878): [<806b6474>] _raw_spin_lock_irqsave+0x2c/0xa8
softirqs last  enabled at (3872): [<8002ec0c>] __do_softirq+0x1c8/0x2e8
softirqs last disabled at (3857): [<8002f180>] irq_exit+0xbc/0x110
CPU: 0 PID: 805 Comm: modprobe Not tainted 3.11.0-next-20130910+ #85
[<80016b94>] (unwind_backtrace+0x0/0xf8) from [<80012e0c>] (show_stack+0x20/0x24)
[<80012e0c>] (show_stack+0x20/0x24) from [<806af554>] (dump_stack+0x9c/0xc4)
[<806af554>] (dump_stack+0x9c/0xc4) from [<8005940c>] (__might_sleep+0xf4/0x134)
[<8005940c>] (__might_sleep+0xf4/0x134) from [<803a04a4>] (__pm_runtime_resume+0x94/0xa0)
[<803a04a4>] (__pm_runtime_resume+0x94/0xa0) from [<7f0334a4>] (ci_udc_start+0xb0/0x110 [ci_hdrc])
[<7f0334a4>] (ci_udc_start+0xb0/0x110 [ci_hdrc]) from [<7f0009b4>] (udc_bind_to_driver+0x5c/0xd8 [udc_core])
[<7f0009b4>] (udc_bind_to_driver+0x5c/0xd8 [udc_core]) from [<7f000ab0>] (usb_gadget_probe_driver+0x80/0xb4 [udc_core])
[<7f000ab0>] (usb_gadget_probe_driver+0x80/0xb4 [udc_core]) from [<7f008618>] (usb_composite_probe+0xac/0xd8 [libcomposite])
[<7f008618>] (usb_composite_probe+0xac/0xd8 [libcomposite]) from [<7f04b168>] (init+0x8c/0xb4 [g_serial])
[<7f04b168>] (init+0x8c/0xb4 [g_serial]) from [<800088e8>] (do_one_initcall+0x108/0x16c)
[<800088e8>] (do_one_initcall+0x108/0x16c) from [<8008e518>] (load_module+0x1b00/0x20a4)
[<8008e518>] (load_module+0x1b00/0x20a4) from [<8008eba8>] (SyS_init_module+0xec/0x100)
[<8008eba8>] (SyS_init_module+0xec/0x100) from [<8000ec40>] (ret_fast_syscall+0x0/0x48)
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

After configuration, the host also possible sends bus reset
at any time, at such situation, it will trigger below spinlock
recursion dump. This commit unlocks the spinlock before calling
gadget's disconnect.

BUG: spinlock recursion on CPU#0, swapper/0/0
 lock: 0xbf128014, .magic: dead4ead, .owner: swapper/0/0, .owner_cpu: 0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.11.0-next-20130910+ #106
[<80014e20>] (unwind_backtrace+0x0/0xec) from [<80011a6c>] (show_stack+0x10/0x14)
[<80011a6c>] (show_stack+0x10/0x14) from [<805c143c>] (dump_stack+0x94/0xbc)
[<805c143c>] (dump_stack+0x94/0xbc) from [<80282cf8>] (do_raw_spin_lock+0x16c/0x18c)
[<80282cf8>] (do_raw_spin_lock+0x16c/0x18c) from [<805c77e0>] (_raw_spin_lock_irqsave+0x50/0x5c)
[<805c77e0>] (_raw_spin_lock_irqsave+0x50/0x5c) from [<803cff88>] (ep_disable+0x24/0x110)
[<803cff88>] (ep_disable+0x24/0x110) from [<7f015d50>] (gserial_disconnect+0xa0/0x15c [u_serial])
[<7f015d50>] (gserial_disconnect+0xa0/0x15c [u_serial]) from [<7f01c06c>] (acm_disable+0xc/0x30 [usb_f_acm])
[<7f01c06c>] (acm_disable+0xc/0x30 [usb_f_acm]) from [<7f001478>] (reset_config.isra.10+0x34/0x5c [libcomposite])
[<7f001478>] (reset_config.isra.10+0x34/0x5c [libcomposite]) from [<7f0014d4>] (composite_disconnect+0x34/0x5c [libcomposite])
[<7f0014d4>] (composite_disconnect+0x34/0x5c [libcomposite]) from [<803d1024>] (udc_irq+0x770/0xce4)
[<803d1024>] (udc_irq+0x770/0xce4) from [<803cdcc0>] (ci_irq+0x98/0x164)
[<803cdcc0>] (ci_irq+0x98/0x164) from [<8007edfc>] (handle_irq_event_percpu+0x50/0x17c)
[<8007edfc>] (handle_irq_event_percpu+0x50/0x17c) from [<8007ef64>] (handle_irq_event+0x3c/0x5c)
[<8007ef64>] (handle_irq_event+0x3c/0x5c) from [<80081e98>] (handle_fasteoi_irq+0x98/0x168)
[<80081e98>] (handle_fasteoi_irq+0x98/0x168) from [<8007e598>] (generic_handle_irq+0x28/0x3c)
[<8007e598>] (generic_handle_irq+0x28/0x3c) from [<8000edf4>] (handle_IRQ+0x4c/0xb4)
[<8000edf4>] (handle_IRQ+0x4c/0xb4) from [<800085bc>] (gic_handle_irq+0x28/0x5c)
[<800085bc>] (gic_handle_irq+0x28/0x5c) from [<800125c0>] (__irq_svc+0x40/0x54)
Exception stack(0x8083bf68 to 0x8083bfb0)
bf60:                   81533b80 00000000 00096234 8001d760 8088e12c 00000000
bf80: 8083a000 8083a000 8084290c 805cb414 808428ac 8083a000 00000001 8083bfb0
bfa0: 8000f138 8000f13c 60000013 ffffffff
[<800125c0>] (__irq_svc+0x40/0x54) from [<8000f13c>] (arch_cpu_idle+0x30/0x3c)
[<8000f13c>] (arch_cpu_idle+0x30/0x3c) from [<8005eb94>] (cpu_startup_entry+0xf4/0x148)
[<8005eb94>] (cpu_startup_entry+0xf4/0x148) from [<807f1a2c>] (start_kernel+0x2c4/0x318)
BUG: spinlock lockup suspected on CPU#0, swapper/0/0
 lock: 0xbf128014, .magic: dead4ead, .owner: swapper/0/0, .owner_cpu: 0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.11.0-next-20130910+ #106
[<80014e20>] (unwind_backtrace+0x0/0xec) from [<80011a6c>] (show_stack+0x10/0x14)
[<80011a6c>] (show_stack+0x10/0x14) from [<805c143c>] (dump_stack+0x94/0xbc)
[<805c143c>] (dump_stack+0x94/0xbc) from [<80282c94>] (do_raw_spin_lock+0x108/0x18c)
[<80282c94>] (do_raw_spin_lock+0x108/0x18c) from [<805c77e0>] (_raw_spin_lock_irqsave+0x50/0x5c)
[<805c77e0>] (_raw_spin_lock_irqsave+0x50/0x5c) from [<803cff88>] (ep_disable+0x24/0x110)
[<803cff88>] (ep_disable+0x24/0x110) from [<7f015d50>] (gserial_disconnect+0xa0/0x15c [u_serial])
[<7f015d50>] (gserial_disconnect+0xa0/0x15c [u_serial]) from [<7f01c06c>] (acm_disable+0xc/0x30 [usb_f_acm])
[<7f01c06c>] (acm_disable+0xc/0x30 [usb_f_acm]) from [<7f001478>] (reset_config.isra.10+0x34/0x5c [libcomposite])
[<7f001478>] (reset_config.isra.10+0x34/0x5c [libcomposite]) from [<7f0014d4>] (composite_disconnect+0x34/0x5c [libcomposite])
[<7f0014d4>] (composite_disconnect+0x34/0x5c [libcomposite]) from [<803d1024>] (udc_irq+0x770/0xce4)
[<803d1024>] (udc_irq+0x770/0xce4) from [<803cdcc0>] (ci_irq+0x98/0x164)
[<803cdcc0>] (ci_irq+0x98/0x164) from [<8007edfc>] (handle_irq_event_percpu+0x50/0x17c)
[<8007edfc>] (handle_irq_event_percpu+0x50/0x17c) from [<8007ef64>] (handle_irq_event+0x3c/0x5c)
[<8007ef64>] (handle_irq_event+0x3c/0x5c) from [<80081e98>] (handle_fasteoi_irq+0x98/0x168)
[<80081e98>] (handle_fasteoi_irq+0x98/0x168) from [<8007e598>] (generic_handle_irq+0x28/0x3c)
[<8007e598>] (generic_handle_irq+0x28/0x3c) from [<8000edf4>] (handle_IRQ+0x4c/0xb4)
[<8000edf4>] (handle_IRQ+0x4c/0xb4) from [<800085bc>] (gic_handle_irq+0x28/0x5c)
[<800085bc>] (gic_handle_irq+0x28/0x5c) from [<800125c0>] (__irq_svc+0x40/0x54)
Exception stack(0x8083bf68 to 0x8083bfb0)
bf60:                   81533b80 00000000 00096234 8001d760 8088e12c 00000000
bf80: 8083a000 8083a000 8084290c 805cb414 808428ac 8083a000 00000001 8083bfb0
bfa0: 8000f138 8000f13c 60000013 ffffffff
[<800125c0>] (__irq_svc+0x40/0x54) from [<8000f13c>] (arch_cpu_idle+0x30/0x3c)
[<8000f13c>] (arch_cpu_idle+0x30/0x3c) from [<8005eb94>] (cpu_startup_entry+0xf4/0x148)
[<8005eb94>] (cpu_startup_entry+0xf4/0x148) from [<807f1a2c>] (start_kernel+0x2c4/0x318)
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

PHY operations are common, so move them to core.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There is a pending TD which is not freed after request finishes,
we do this due to a controller bug. This TD needs to be freed when
the driver is removed. It prints below error message when unload
chipidea driver at current code:
"ci_hdrc ci_hdrc.0: dma_pool_destroy ci_hw_td, b0001000 busy"
It indicates the buffer at dma pool are still in use.

This commit will free the pending TD at driver's removal procedure,
it can fix the problem described above.
Acked-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

When we rmmod gadget, the ci->driver needs to be cleared.
Otherwise, when we plug in usb cable again, the driver will
consider gadget is there, and go to enumeration procedure,
but in fact, it was removed.

ci_hdrc ci_hdrc.0: Connected to host
Unable to handle kernel paging request at virtual address 7f02a42c
pgd = 80004000
[7f02a42c] *pgd=3f13d811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] SMP ARM
Modules linked in: usb_f_acm u_serial libcomposite configfs [last unloaded: g_serial]
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.10.0+ #42
task: 807dba88 ti: 807d0000 task.ti: 807d0000
PC is at udc_irq+0x8fc/0xea4
LR is at l2x0_cache_sync+0x5c/0x6c
pc : [<803de7f4>]    lr : [<8001d0f0>]    psr: 20000193
sp : 807d1d98  ip : 807d1d80  fp : 807d1df4
r10: af809900  r9 : 808184d4  r8 : 00080001
r7 : 00082001  r6 : afb711f8  r5 : afb71010  r4 : ffffffea
r3 : 7f02a41c  r2 : afb71010  r1 : 807d1dc0  r0 : afb71068
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c53c7d  Table: 3f01804a  DAC: 00000017
Process swapper/0 (pid: 0, stack limit = 0x807d0238)
Stack: (0x807d1d98 to 0x807d2000)
1d80:                                                       00000000 afb71014
1da0: 000040f6 00000000 00000001 00000000 00007530 00000000 afb71010 001dcd65
1dc0: 01000680 00400000 807d1e2c afb71010 0000004e 00000000 00000000 0000004b
1de0: 808184d4 af809900 807d1e0c 807d1df8 803dbc24 803ddf04 afba75c0 0000004e
1e00: 807d1e44 807d1e10 8007a19c 803dbb9c 8108e7e0 8108e7e0 9ceddce0 af809900
1e20: 0000004e 807d0000 0000004b 00000000 00000010 00000000 807d1e5c 807d1e48
1e40: 8007a334 8007a154 af809900 0000004e 807d1e74 807d1e60 8007d3b4 8007a2f0
1e60: 0000004b 807cce3c 807d1e8c 807d1e78 80079b08 8007d300 00000180 807d8ba0
1e80: 807d1eb4 807d1e90 8000eef4 80079aec 00000000 f400010c 807d8ce4 807d1ed8
1ea0: f4000100 96d5c75d 807d1ed4 807d1eb8 80008600 8000eeac 8042699c 60000013
1ec0: ffffffff 807d1f0c 807d1f54 807d1ed8 8000e180 800085dc 807d1f20 00000046
1ee0: 9cedd275 00000010 8108f080 807de294 00000001 807de248 96d5c75d 00000010
1f00: 00000000 807d1f54 00000000 807d1f20 8005ff54 8042699c 60000013 ffffffff
1f20: 9cedd275 00000010 00000005 8108f080 8108f080 00000001 807de248 8086bd00
1f40: 807d0000 00000001 807d1f7c 807d1f58 80426af0 80426950 807d0000 00000000
1f60: 808184c0 808184c0 807d8954 805b886c 807d1f8c 807d1f80 8000f294 80426a44
1f80: 807d1fac 807d1f90 8005f110 8000f288 807d1fac 807d8908 805b4748 807dc86c
1fa0: 807d1fbc 807d1fb0 805aa58c 8005f068 807d1ff4 807d1fc0 8077c860 805aa530
1fc0: ffffffff ffffffff 8077c330 00000000 00000000 807bef88 00000000 10c53c7d
1fe0: 807d88d0 807bef84 00000000 807d1ff8 10008074 8077c594 00000000 00000000
Backtrace:
[<803ddef8>] (udc_irq+0x0/0xea4) from [<803dbc24>] (ci_irq+0x94/0x14c)
[<803dbb90>] (ci_irq+0x0/0x14c) from [<8007a19c>] (handle_irq_event_percpu+0x54/0x19c)
 r5:0000004e r4:afba75c0
 [<8007a148>] (handle_irq_event_percpu+0x0/0x19c) from [<8007a334>] (handle_irq_event+0x50/0x70)
[<8007a2e4>] (handle_irq_event+0x0/0x70) from [<8007d3b4>] (handle_fasteoi_irq+0xc0/0x16c)
 r5:0000004e r4:af809900
 [<8007d2f4>] (handle_fasteoi_irq+0x0/0x16c) from [<80079b08>] (generic_handle_irq+0x28/0x38)
 r5:807cce3c r4:0000004b
 [<80079ae0>] (generic_handle_irq+0x0/0x38) from [<8000eef4>] (handle_IRQ+0x54/0xb4)
 r4:807d8ba0 r3:00000180
 [<8000eea0>] (handle_IRQ+0x0/0xb4) from [<80008600>] (gic_handle_irq+0x30/0x64)
 r8:96d5c75d r7:f4000100 r6:807d1ed8 r5:807d8ce4 r4:f400010c
 r3:00000000
 [<800085d0>] (gic_handle_irq+0x0/0x64) from [<8000e180>] (__irq_svc+0x40/0x54)
Exception stack(0x807d1ed8 to 0x807d1f20)
1ec0:                                                       807d1f20 00000046
1ee0: 9cedd275 00000010 8108f080 807de294 00000001 807de248 96d5c75d 00000010
1f00: 00000000 807d1f54 00000000 807d1f20 8005ff54 8042699c 60000013 ffffffff
 r7:807d1f0c r6:ffffffff r5:60000013 r4:8042699c
 [<80426944>] (cpuidle_enter_state+0x0/0xf4) from [<80426af0>] (cpuidle_idle_call+0xb8/0x174)
 r9:00000001 r8:807d0000 r7:8086bd00 r6:807de248 r5:00000001
 r4:8108f080
 [<80426a38>] (cpuidle_idle_call+0x0/0x174) from [<8000f294>] (arch_cpu_idle+0x18/0x5c)
[<8000f27c>] (arch_cpu_idle+0x0/0x5c) from [<8005f110>] (cpu_startup_entry+0xb4/0x148)
[<8005f05c>] (cpu_startup_entry+0x0/0x148) from [<805aa58c>] (rest_init+0x68/0x80)
 r7:807dc86c
 [<805aa524>] (rest_init+0x0/0x80) from [<8077c860>] (start_kernel+0x2d8/0x334)
[<8077c588>] (start_kernel+0x0/0x334) from [<10008074>] (0x10008074)
Code: e59031e0 e51b203c e24b1034 e2820058 (e5933010)
---[ end trace f874b2c5533c04bc ]---
Kernel panic - not syncing: Fatal exception in interrupt
Tested-by: NMarek Vasut <marex@denx.de>
Acked-by: NShawn Guo <shawn.guo@linaro.org>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The udc-core will call gadget's driver->disconnect, so we should avoid
calling gadget's disconnect again at ci_udc_stop in case the gadget's
unbind free some structs which is still used at gadget's disconnect.
Tested-by: NMarek Vasut <marex@denx.de>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There is a pending TD which is not freed after request finishes,
we do this due to a controller bug. This TD needs to be freed when
the driver is removed. It prints below error message when unload
chipidea driver at current code:
"ci_hdrc ci_hdrc.0: dma_pool_destroy ci_hw_td, b0001000 busy"
It indicates the buffer at dma pool are still in use.

This commit will free the pending TD at driver's removal procedure,
it can fix the problem described above.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

For chipidea, the IP must know vbus before the controller
begins to run. So the .pullup should only be called when
the vbus is there.
Tested-by: NMarek Vasut <marex@denx.de>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently, the controller only runs when the ci->vbus_active is true.
So the flag CI_HDRC_PULLUP_ON_VBUS is useless no longer.
If the user doesn't have otgsc, he/she needs to change ci_handle_vbus_change
to update ci->vbus_active.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>