According to xHCI spec section 4.6.1.1 and section 4.6.1.2,
after aborting a command on the command ring, xHC will
generate a command completion event with its completion
code set to Command Ring Stopped at least. If a command is
currently executing at the time of aborting a command, xHC
also generate a command completion event with its completion
code set to Command Abort. When the command ring is stopped,
software may remove, add, or rearrage Command Descriptors.

To cancel a command, software will initialize a command
descriptor for the cancel command, and add it into a
cancel_cmd_list of xhci. When the command ring is stopped,
software will find the command trbs described by command
descriptors in cancel_cmd_list and modify it to No Op
command. If software can't find the matched trbs, we can
think it had been finished.

This patch should be backported to kernels as old as 3.0, that contain
the commit 7ed603ec "xhci: Add an
assertion to check for virt_dev=0 bug." That commit papers over a NULL
pointer dereference, and this patch fixes the underlying issue that
caused the NULL pointer dereference.
Signed-off-by: NElric Fu <elricfu1@gmail.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: NMiroslav Sabljic <miroslav.sabljic@avl.com>
Cc: stable@vger.kernel.org

The patch is used to cancel command when the command isn't
acknowledged and a timeout occurs.

This patch should be backported to kernels as old as 3.0, that contain
the commit 7ed603ec "xhci: Add an
assertion to check for virt_dev=0 bug." That commit papers over a NULL
pointer dereference, and this patch fixes the underlying issue that
caused the NULL pointer dereference.
Signed-off-by: NElric Fu <elricfu1@gmail.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: NMiroslav Sabljic <miroslav.sabljic@avl.com>
Cc: stable@vger.kernel.org

Software have to abort command ring and cancel command
when a command is failed or hang. Otherwise, the command
ring will hang up and can't handle the others. An example
of a command that may hang is the Address Device Command,
because waiting for a SET_ADDRESS request to be acknowledged
by a USB device is outside of the xHC's ability to control.

To cancel a command, software will initialize a command
descriptor for the cancel command, and add it into a
cancel_cmd_list of xhci.

Sarah: Fixed missing newline on "Have the command ring been stopped?"
debugging statement.

This patch should be backported to kernels as old as 3.0, that contain
the commit 7ed603ec "xhci: Add an
assertion to check for virt_dev=0 bug." That commit papers over a NULL
pointer dereference, and this patch fixes the underlying issue that
caused the NULL pointer dereference.
Signed-off-by: NElric Fu <elricfu1@gmail.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: NMiroslav Sabljic <miroslav.sabljic@avl.com>
Cc: stable@vger.kernel.org

Adding cmd_ring_state for command ring. It helps to verify
the current command ring state for controlling the command
ring operations.

This patch should be backported to kernels as old as 3.0.  The commit
7ed603ec "xhci: Add an assertion to
check for virt_dev=0 bug." papers over the NULL pointer dereference that
I now believe is related to a timed out Set Address command.  This (and
the four patches that follow it) contain the real fix that also allows
VIA USB 3.0 hubs to consistently re-enumerate during the plug/unplug
stress tests.
Signed-off-by: NElric Fu <elricfu1@gmail.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: NMiroslav Sabljic <miroslav.sabljic@avl.com>
Cc: stable@vger.kernel.org

It's not needed, and commented out, so just remove it.

Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

If VERBOSE_DEBUG was enabled, lots of build errors happend (obviously no
one uses this mode.)  So fix that up, and get rid of the dbg() call, and
use dev_dbg() like the rest of the driver does.

Cc: Duncan Sands <duncan.sands@free.fr>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This adds a driver for the zte_ev set of usb to serial devices.  It is
based on a patch floating around the internet that modified the generic
usb-serial driver to only work for this type of device.

I've left comments in the code that I think show the data commands being
sent to the device, which I'm guessing come from a usb analyzer.  Maybe
they can help others out as well.

Many thanks to nirinA raseliarison for pointing the original patch out
to me, and for testing that the driver works properly.
Tested-by: NnirinA raseliarison <nirina.raseliarison@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now that we have a printk modifier for data streams, use it instead of
rolling our own.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- let role driver handle irq before ID change check; this gives the
  role driver a chance to handle disconnect;
- disable irq during switch role; no role driver to handle irq in
  the period.
Tested-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch turns on debugging output if CONFIG_USB_CHIPIDEA_DEBUG is
enabled.
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Tested-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Using vbus valid interrupt to detect vbus.
Tested-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

In order to avoid re-queueing of the role changing work, we need to clear
the ID change interrupt bit right in the irq handler.
Tested-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The ID pin needs 1ms debounce time, even at probe time. We delay 2ms
to be on the safe side.
Tested-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Some controllers may not need to setup pinctrl, so we don't fail the
probe if pinctrl get/select failed.
Tested-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

i.MX usb controllers share non-core registers, which may include
SoC specific controls. We turn it into a usbmisc device and usbmisc
driver set operations needed by ci13xxx_imx driver.

For example, Sabrelite board has bad over-current design, we can
usbmisc to disable over-current detection.
Acked-by: NSascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

These chipidea stable patches are needed for other chipidea patches to be
applied properly.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

When attaching an imx28 or imx53 in USB gadget mode to a Windows host and
starting a rndis connection we see this message every 4-10 seconds:

    g_ether gadget: high speed config #2: RNDIS

Analysis shows that each time this message is printed, the rndis connection is
re-establish due to a reset because of a stalled endpoint (ep 0, dir 1). The
endpoint is stalled because the reqeust complete bit on that endpoint is set,
but in isr_tr_complete_low() the endpoint request list (mEp->qh.queue) is
empty.

This patch removed this check, because the code doesn't take the following
situation into account:

The loop over all endpoints in isr_tr_complete_handler() will call ep_nuke() on
both ep0/dir0 and ep/dir1 in the first loop. Pending reqeusts will be flushed
and completed here. There seems to be a race condition, the request is nuked,
but the request complete bit will be set, too. The subsequent check (in
ep0/dir1's loop cycle) for endpoint request list (mEp->qh.queue) empty will
fail.

Both other mainline chipidea drivers (mv_udc_core.c and fsl_udc_core.c) don't
have this check.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

If udc_start() fails the qh_pool dma-pool cannot be closed because
it's still in use. This patch factors out the dma_pool_free() loop
into destroy_eps() and calls it in the error path of udc_start(),
too.

Cc: stable <stable@vger.kernel.org>
Reviewed-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch fixes the error path of udc_start(). Now NULL is used to
unset the peripheral with otg_set_peripheral().

Cc: stable <stable@vger.kernel.org>
Reviewed-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add function to physicaly enable or disable of pullup connection on the USB-D+
line. The uvc gaget will fail, if this function is not implemented.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch changes the setup of the endpoint maxpacket size. All non control
endpoints are initialized with an undefined ((unsigned short)~0) maxpacket
size. The maxpacket size of Endpoint 0 will be kept at CTRL_PAYLOAD_MAX.

Some gadget drivers check for the maxpacket size before they enable the
endpoint, which leads to a wrong state in these drivers.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit ff823c79 ("usb: move children
to struct usb_port") forgot to consider the hub_disconnect sequence,
which releases ports before quiescing the hub, which will lead to a
use-after-free, since hub_quiesce() will try to disconnect ports'
children, which are already deallocated. Simple modprobe dummy_hcd &&
rmmod dummy_hcd will illustrate the problem.

This patch moves deallocation of hub's ports after hub_quiesce() call
in hub_disconnect().

Cc: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: musb: patches for v3.7 merge window

Here we have a bunch of miscellaneous cleanups and fixes
to the musb driver. It fixes a bunch of mistakes errors
which nobody has triggered before, so I'm not Ccing stable
tree.

We are finally improving OMAP's VBUS/ID Mailbox usage so
that we can introduce our PHY drivers properly. Also, we're
adding support for multiple instances of the MUSB IP in
the same SoC, as seen on some platforms from TI which
have 2 MUSB instances.

Other than that, we have some small fixes like not kicking
DMA for a zero byte transfer, or properly handling NAK timeout
on MUSB's host side, and the enabling of DMA Mode1 for any
transfers which are aligned to wMaxPacketSize.

All patches have been pending on mailing list for a long time
and I don't expect any big surprises with this pull request.

usb: dwc3: patches for v3.7 merge window

Some much needed changes for our dwc3 driver. First there's a
rework on the ep0 handling due to some Silicon issue we uncovered
which affects all users of this IP core (there's a missing
XferNotReady(DATA) event in some conditions). This issue which
show up as a SETUP transfers which wouldn't complete ever and
we would fail TD 7.06 of the Link Layer Test from USB-IF and
Lecroy's USB3 Exerciser.

We also fix a long standing bug regarding EP0 enable sequencing
where we weren't setting a particular bit (Ignore Sequence
Number). Since we never saw any problems caused by that, it
didn't deserve being sent to stable tree.

On this pull request we also fix Burst Size initialization which
should be done only in SuperSpeed and we were mistakenly setting
Burst Size to the maximum value on non-SuperSpeed mode. Again,
since we never saw any problems caused by that, we're not sending
this patch to stable.

There's also a memory ordering fix regarding usage of bitmaps in
dwc3 driver.

You will also find some sparse warnings fix, a fix for missed
isochronous packets when the endpoint is already busy, and a
fix for synchronization delay on dwc3_stop_active_transfer().

usb: xceiv: patches for v3.7 merge window

nop xceiv got its own header to avoid polluting otg.h. It has also
learned to work as USB2 and USB3 phys so we can use it on USB3
controllers.

Together with those two changes to nop xceiv, we're adding basic
PHY support to dwc3 driver, this is to allow platforms which actually
have a SW-controllable PHY talk to them through dwc3 driver.

We're adding a new phy driver for the OMAP architecture. This driver
is for the PHY found in OMAP4 SoCs, and a new phy driver for the
marvell architecture. An extra phy driver - for Tegra SoCs - is now
moving from arch/arm/mach-tegra* to drivers/usb/phy.

Also here, there's the creation of <linux/usb/phy.h> which should be
used from now on for PHY drivers, even those which don't support
OTG.

Merge tag 'gadget-for-v3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

usb: gadget: patches for v3.7 merge window

This pull request is large but the biggest part is the first part
of the cleanup on the gadget framework so we have a saner setup
to add configfs support for v3.8.

We have also some more conversions to the new udc_start/udc_stop
which makes us closer from dropping the old interfaces.

USB_GADGET_DUALSPEED and USB_GADGET_SUPERSPEED are finally gone,
thanks to Michal for his awesome work.

Other than that, we have the usual set of miscellaneous changes
and cleanups involving improvements to debug messages, removal
of duplicated includes, moving dereference after NULL test,
making renesas_hsbhs' irq handler Shared, unused code being dropped,
prevention of sleep-inside-spinlock bugs and a race condition fix
on udc-core.

As NOP device node is now added in am33xx tree so remove the call
which creates the NOP platform_device.
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NSanthapuri, Damodar <damodar.santhapuri@ti.com>
Signed-off-by: NRavi Babu <ravibabu@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Added device tree support for dsps musb glue driver and updated the
Documentation with device tree binding information.
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NSanthapuri, Damodar <damodar.santhapuri@ti.com>
Signed-off-by: NRavi Babu <ravibabu@ti.com>
[afzal@ti.com: use '-' instead of '_' for dt properties]
Signed-off-by: NAfzal Mohammed <afzal@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

AM335x and TI81xx platform has dual musb controller so updating the
musb_dspc.c to support the same.

Changes:
        - Moved otg_workaround timer to glue structure
        - Moved static local variable last_timer to glue structure
        - PHY on/off related cleanups
Signed-off-by: NRavi Babu <ravibabu@ti.com>
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NSanthapuri, Damodar <damodar.santhapuri@ti.com>
[afzal@ti.com: remove control module related modifications]
Signed-off-by: NAfzal Mohammed <afzal@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Moved global variable "musb_debugfs_root" and static variable
"old_state" to 'struct musb' to help support multi instance of
musb controller as present on AM335x platform.

Also removed the global variable "orig_dma_mask" and filled the
dev->dma_mask with parent device's dma_mask.
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NSanthapuri, Damodar <damodar.santhapuri@ti.com>
Signed-off-by: NRavi Babu <ravibabu@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Added musb_ida in musb_core.c to manage the multi core ids.
Signed-off-by: NRavi Babu <ravibabu@ti.com>
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NSanthapuri, Damodar <damodar.santhapuri@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Added device tree support for omap musb driver and updated the
Documentation with device tree binding information.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The glue layer should directly write to mailbox register (present in
control module) instead of calling phy layer to write to mailbox
register. Writing to mailbox register notifies the core of events like
device connect/disconnect.

Currently writing to control module register is taken care in this
driver which will be removed once the control module driver is in place.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The mailbox register for usb otg in omap is present in control module.
On detection of any events VBUS or ID, this register should be written
to send the notification to musb core.

Till we have a separate control module driver to write to control module,
omap2430 will handle the register writes to control module by itself. So
a new address space to represent this control module register is added
to usb_otg_hs.
Acked-by: NBenoit Cousson <b-cousson@ti.com>
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Because the IRQF_DISABLED as the flag is now a NOOP and has been
deprecated and in hardirq context the interrupt is disabled.

so in usb/host code:
Removing the usage of flag IRQF_DISABLED;
Removing the calling local_irq save/restore actions in irq
handler usb_hcd_irq();
Signed-off-by: Nliu chuansheng <chuansheng.liu@intel.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NLan Tianyu <tianyu.lan@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds two sysfs files for each usb hub port to allow userspace
to control the port power policy.

For an upcoming Intel xHCI roothub, this will translate into ACPI calls
to completely power off or power on the port.  As a reminder, when these
ports are completely powered off, the USB host and device will see a
physical disconnect.  All future USB device connections will be lost,
and the device will not be able to signal a remote wakeup.

The control sysfs file can be written to with two options:
"on" - port power must be on.
"off" - port must be off.

The state sysfs file reports usb port's power state:
"on" - powered on
"off" - powered off
"error" - can't get power state

For now, let userspace dictate the port power off policy.  Future
patches may add an in-kernel policy.
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NLan Tianyu <tianyu.lan@intel.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Alan Stern pointed out that a USB port could potentially get powered off
when the attached USB device is in the middle of enumerating, due to
race conditions:
	http://marc.info/?l=linux-usb&m=134130616707548&w=2

If that happens, we need to ensure the enumeration fails.  If a call to
usb_get_descriptor() fails for a reason other than a Stall, return an
error.  That should handle the case where the port is powered off.
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NLan Tianyu <tianyu.lan@intel.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Upcoming Intel systems will have an ACPI method to control whether a USB
port can be completely powered off.  The implication of powering off a
USB port is that the device and host sees a physical disconnect, and
subsequent port connections and remote wakeups will be lost.

Add a new function, usb_acpi_power_manageable(), that can be used to
find whether the usb port has ACPI power resources that can be used to
power on and off the port on these machines. Also add a new function
called usb_acpi_set_power_state() that controls the port power via these
ACPI methods.

When the USB core calls into the xHCI hub driver to power off a port,
check whether the port can be completely powered off via this new ACPI
mechanism.  If so, call into these new ACPI methods.  Also use the ACPI
methods when the USB core asks to power on a port.
Signed-off-by: NLan Tianyu <tianyu.lan@intel.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>