In hardware_enqueue code adds one extra td with dma_pool_alloc if
mReq->req.zero is true. When _ep_nuke will be called for that endpoint,
dma_pool_free will not be called to free that memory again. That patch
fixes this.

Cc: stable <stable@vger.kernel.org> # v3.5
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The udc uses an shared dma memory space between hard and software. This
memory layout is described in ci13xxx_qh and ci13xxx_td which are marked
with the attribute ((packed)).

The compiler currently does not know about the alignment of the memory
layout, and will create strb and ldrb operations.

The Datasheet of the synopsys core describes, that some operations on
the mapped memory need to be atomic double word operations. I.e. the
next pointer addressing in the qhead, as otherwise the hardware will
read wrong data and totally stuck.

This is also possible while working with the current active td queue,
and preparing the td->ptr.next in software while the hardware is still
working with the current active td which is supposed to be changed:

writeb(0xde, &td->ptr.next + 0x0); /* strb */
writeb(0xad, &td->ptr.next + 0x1); /* strb */

<----- hardware reads value of td->ptr.next and get stuck!

writeb(0xbe, &td->ptr.next + 0x2); /* strb */
writeb(0xef, &td->ptr.next + 0x3); /* strb */

This appeares on armv5 machines where the hardware does not support
unaligned 32bit operations.

This patch adds the attribute ((aligned(4))) to the structures to tell
the compiler to use 32bit operations. It also adds an wmb() for the
prepared TD data before it gets enqueued into the qhead.

Cc: stable <stable@vger.kernel.org> # v3.5
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

A static count of transfer descriptors was used everywhere in the driver
with the fixed number 5. This patch adds a define, named TD_PAGE_COUNT,
and replaces all users of this value. This way its possible to have only
one parameter to change and limit the amount of buffer pointers per TD.
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There is no need to call ep_queue unlocked inside the own driver. We
move its functionionality into an unlocked version.

This patch removes potential unlocked timeslots inside
isr_setup_status_phase and isr_get_status_response, in which the lock
got released just before acquired again inside usb_ep_queue.
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Reviewed-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It is not safe to truncate requests to the maximum possible size the
controller can handle with one td and to keep working. That patch fixes
that with proper error handling instead.
Reported-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch changes the read of the td status to one atomic operation to
analyse coherent bits.
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
[Alex: fixed backwards endianness conversion]
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Its not necessary and also not specified in the datasheet to change the
ZLT flag before every ep_prime. This patch moves this to the ep_enable
and applies it only for non configuration endpoints.
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch reworks the cap value from several read
and write operations to one single operation.
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
[Alex: removed useless isoc-related bit of code]
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The datasheet of the synopsys core describes only to overwrite the
active and halted bits in the qhead before priming any endpoint.
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
[Alex: fixed a case of line-too-long]
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Convert between big-endian and little-endian format when accessing the usb
controller structures which are little-endian by specification.
Fix cases where the little-endian memory layout is taken for granted.
The patch doesn't have any effect on the already supported little-endian
architectures.
Signed-off-by: NSvetoslav Neykov <svetoslav@neykov.name>
[Alex: minor cosmetic fixes]
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

chipidea's ffs_nr() is pretty much what __ffs() does.

Use that one instead.
Signed-off-by: NFelipe Balbi <balbi@ti.com>
[rebased on top of debug infrastructure rework]
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Create and remove debugfs entries in hdrc probe/remove instead of
start/stop of the device controller. Gadget specific will not export
anything while the controller is in host mode.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently, we have a bunch of files in sysfs that display all sorts of
debugging information for the device controller, so they have to move to
debugfs where they belong. The "registers" interface have been removed,
since it doesn't fit into the current driver design as is and it's hardly
a good idea to touch the registers from userspace anyway.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

As part of the legacy from the original driver design, we retain home-grown
tracing infrastructure, complete with own ring buffer and timestamps,
which among other things has a performance penalty. This patch removes it.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There are several problems with this patch:
  + in introduces a sparse warning for a condition that's always negative,
  + and because of that, it actually doesn't do anything useful,
  + and vbus detection belongs to otg, not device function anyway.

This reverts commit 8c4fc031.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
[Alex: amended the above text]
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Some headers included in udc core code are not actually needed, remove
them and add irqreturn.h, which was implicitly included via irq.h.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

udc-core provides a better way to handle release
methods, let's use it.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

udc-core now sets dma-related and parent fields
for us, we don't need to do it ourselves.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

We don't need the ->register_my_device flag
anymore because all UDC drivers have been
properly converted.

Let's remove every history of it.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

By simply setting a flag, we can drop some
boilerplate code.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Don't register anything non-generic under
the gadget's device as we don't really *own*
it.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Using vbus valid interrupt to detect vbus.
Tested-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

When attaching an imx28 or imx53 in USB gadget mode to a Windows host and
starting a rndis connection we see this message every 4-10 seconds:

    g_ether gadget: high speed config #2: RNDIS

Analysis shows that each time this message is printed, the rndis connection is
re-establish due to a reset because of a stalled endpoint (ep 0, dir 1). The
endpoint is stalled because the reqeust complete bit on that endpoint is set,
but in isr_tr_complete_low() the endpoint request list (mEp->qh.queue) is
empty.

This patch removed this check, because the code doesn't take the following
situation into account:

The loop over all endpoints in isr_tr_complete_handler() will call ep_nuke() on
both ep0/dir0 and ep/dir1 in the first loop. Pending reqeusts will be flushed
and completed here. There seems to be a race condition, the request is nuked,
but the request complete bit will be set, too. The subsequent check (in
ep0/dir1's loop cycle) for endpoint request list (mEp->qh.queue) empty will
fail.

Both other mainline chipidea drivers (mv_udc_core.c and fsl_udc_core.c) don't
have this check.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

If udc_start() fails the qh_pool dma-pool cannot be closed because
it's still in use. This patch factors out the dma_pool_free() loop
into destroy_eps() and calls it in the error path of udc_start(),
too.

Cc: stable <stable@vger.kernel.org>
Reviewed-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch fixes the error path of udc_start(). Now NULL is used to
unset the peripheral with otg_set_peripheral().

Cc: stable <stable@vger.kernel.org>
Reviewed-by: NRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add function to physicaly enable or disable of pullup connection on the USB-D+
line. The uvc gaget will fail, if this function is not implemented.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch changes the setup of the endpoint maxpacket size. All non control
endpoints are initialized with an undefined ((unsigned short)~0) maxpacket
size. The maxpacket size of Endpoint 0 will be kept at CTRL_PAYLOAD_MAX.

Some gadget drivers check for the maxpacket size before they enable the
endpoint, which leads to a wrong state in these drivers.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Sometimes, the driver bindings may know what phy they use.
For example, when using device tree, the usb controller may have a
phandler pointing to usb phy.
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Reviewed-by: NMarek Vasut <marex@denx.de>
Acked-by: NFelipe Balbi <balbi@ti.com>
Tested-by: NSubodh Nijsure <snijsure@grid-net.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

struct ci13xxx represent the controller, which may be device or host,
so name its variables as ci.
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: NMarek Vasut <marex@denx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch rename struct ci13xxx_udc_driver and var with the type.

ci13xxx_platform_data reflect it's passed from platfrom driver.
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

As reported by Dan Carpenter, there is a NULL check in udc_start() that
follows a dereference of the pointer that's being checked. However, at
that point udc pointer shouldn't ever be NULL and if it is, the dereference
should cause an oops.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NRichard Zhao <richard.zhao@freescale.com>
Acked-by: NMarek Vasut <marex@denx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

usb_get_phy will return -ENODEV if it's not able to find the phy. Hence
fixed all the callers of usb_get_phy to check for this error condition
instead of relying on a non-zero value as success condition.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Add a linked list for keeping multiple PHY instances with different
types so that we can have separate USB2 and USB3 PHYs on one single
board. _get_phy_ has been changed so that the controller gets
the transceiver by type. _remove_phy_ has been added to let the phy
be removed from the phy list.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

_transceiver() in otg.c is replaced with _phy. usb_set_transceiver is
replaced with usb_add_phy to make it similar to other usb standard
function names like usb_add_hcd.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

It was used as a shorthand for gadget's device in request mapping/unmapping
code, but now it's not used any more.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We're one of the remaining drivers to map/unmap requests by hand. Switch
to using generic gadget routines for that instead.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This adds EHCI host support to the chipidea driver. We want it to be
part of the hdrc driver and not a standalone (sub-)driver module, as
the structure of ehci-hcd.c suggests, so for chipidea controller we
hack it to not provide platform-related code, but only the ehci hcd.

The ehci-platform driver won't work for us here too, because the
controller uses the same registers for both device and host mode and
also otg-related bits, so it's not really possible to put ehci registers
into a separate resource.

This is not a pretty solution, but the alternative is exporting symbols
from the chipidea driver to a ehci-chipidea driver and doing all the
module refcounting.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Some of the bits of USBMODE register are defined in <usb/ehci_def.h>,
use them instead of having our own definitions.
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently, gadget can't be NULL in _gadget_stop_activity().
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Reported-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Move spin_lock under the done label, so the
lock will also be pulled in the error paths.
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
[rebased on top of the patchset]
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>