After commit b09b5224 ("usb: chipidea: implement platform shutdown
callback") and commit 43a40457 ("usb: chipidea: host: set host to
be null after hcd is freed") a NULL pointer dereference is caused
on i.MX23 during shutdown. So ensure that role is set to CI_ROLE_END and
we finish interrupt handling before the hcd is deallocated. This avoids
the NULL pointer dereference.
Suggested-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Fixes: b09b5224 ("usb: chipidea: implement platform shutdown callback")
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

According to Documentation/CodingStyle:

"The preferred form for passing a size of a struct is the following:

	p = kmalloc(sizeof(*p), ...);
"
, so do as suggested to improve readability.
Signed-off-by: NFabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

No need to split the dma_pool_zalloc() line into two as it can
perfectly fit into a single line.
Signed-off-by: NFabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

We can make the code simpler by using dma_pool_zalloc() instead
of calling dma_pool_alloc() and then a memset().
Signed-off-by: NFabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

The Chipidea EHCI core seems to behave sanely and doesn't need
the IO watchdog. This kills off 10 non-deferrable wakeup events
per second when the controller is otherwise idle.
Signed-off-by: NLucas Stach <l.stach@pengutronix.de>
Tested-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

This driver make assumptions about the value of the direction flags.
So better use them in comparisons to improve the readability.
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

imx usb over current polarity is low active by default, with
over-current-active-high property added, user can config it to be high
active. Meanwhile keep this setting unchanged for existing platforms
so new platform must set the right value for active low by its usbmisc
init function if over current is enabled.
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

The endpoint fifo is already flushed in _ep_nuke so there
is no need to flush it twice.
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

Since there should be a write barrier before every call of
hw_ep_prime we could move it into hw_ep_prime.
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

Problems with the signal integrity of the high speed USB data lines or
noise on reference ground lines can cause the i.MX6 USB controller to
violate USB specs and exhibit unexpected behavior.

It was observed that USBi_UI interrupts were triggered first and when
isr_setup_status_phase was called, ci->status was NULL, which lead to a
NULL pointer dereference kernel panic.

This patch fixes the kernel panic, emits a warning once and returns
-EPIPE to halt the device and let the host get stalled.
It also adds a comment to point people, who are experiencing this issue,
to their USB hardware design.

Cc: <stable@vger.kernel.org> #4.1+
Signed-off-by: NClemens Gruber <clemens.gruber@pqgruber.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

When the controller is configured to be dual role and it's in host mode,
if bind udc and gadgt driver, those gadget operations will do gadget
disconnect and finally pull down DP line, which will break host function.

Cc: <stable@vger.kernel.org> # 4.1+
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

Chipidea driver has been updated a lot, and more functions are supported,
update Kconfig help text accordingly.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

For each platform devices which is created by device tree, the default
DMA mask is set by of_dma_configure when the device are created. So
delete the redundant code at driver.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

B-device detects that bus is idle for more than TB_AIDL_BDIS min and
begins HNP by turning off pullup on DP, this allows the bus to discharge
to the SE0 state. This timer was missed and failed with PET test:
6.8.5 B-UUT HNP of USB OTG and EH automated compliance plan v1.2,
this patch is to fix this timing issue.
Acked-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Enable HNP polling support for chipidea gadget and allocate memory
for host request flag when otg fsm init.
Acked-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Set host_request_flag if the current peripheral wants to take host role
via changing a_bus_req or b_bus_req by user application.
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Since gadget driver will handle this request, so controller driver bypass
it.
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Avoid printing an error if adding the device failes with return
value EPROBE_DEFFER. This may happen e.g. due to missing GPIO for
the vbus-supply regulator.
Signed-off-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

This reverts commit e765bfb7.

In the most of cases, we only use one transaction per frame and the
frame rate may be high, If the platforms want to support multiple
transactions but less frame rate cases like [1] and [2], it can set
"non-zero-ttctrl-ttha" at dts.

[1] http://www.spinics.net/lists/linux-usb/msg123125.html
[2] http://www.spinics.net/lists/linux-usb/msg118679.htmlSigned-off-by: NPeter Chen <peter.chen@nxp.com>

In chipidea IP RTL, there is a very limited design for siTD, the detail
like below:
There is no Max Packet Size at siTD, so it uses one constant for both
Max Packet Size for packet and the packet size for the last transaction
when considering schedule.
If the ttctrl.ttha does not match against Hub Address field in siTD,
this constant is 188 bytes, else this constant is 1023 bytes.

If the ttctrl.ttha is non-zero value, RTL will use 188 as this constant,
so it will lose the data if the packet size is larger than 188 bytes, eg,
if we playback a wav which format is 48khz, 16 bits, 2 channels, the
packet size will be 192bytes, but the controller will only send 188 bytes
for this packet, the noise will be heared using USB audio card.
The use case is single transaction, but higher frame rate.

If the ttctr.ttha is zero value, we can send 1023 bytes within one
transaction, but the controller will not accept the coming tranaction
if it considers the schedule time is less than 1023 bytes. So the
limitation is we can't schedule as many as transactions within frame.
If the total bytes is already 256 bytes for previous transactions within
frame, it can't accept another transaction. The use case is multiple
transactions, but less frame rate.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

retval is assigned to be -EOVERFLOW but is overwritten later before
it's used, remove this unused value assignment.
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

Until now the imx23 uses the imx27 platform flag. But the
imx23 needs the flag CI_HDRC_TURN_VBUS_EARLY_ON, too. So
fix this by adding a separate platform flag.
Suggested-by: NPeter Chen <peter.chen@nxp.com>
Signed-off-by: NStefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

If we use USB ID pin as wakeup source, and there is a USB block
device on this USB OTG (ID) cable, the system will be deadlock
after system resume.

The root cause for this problem is: the workqueue ci_otg may try
to remove hcd before the driver resume has finished, and hcd will
disconnect the device on it, then, it will call device_release_driver,
and holds the device lock "dev->mutex", but it is never unlocked since
it waits workqueue writeback to run to flush the block information, but
the workqueue writeback is freezable, it is not thawed before driver
resume has finished.

When the driver (device: sd 0:0:0:0:) resume goes to dpm_complete, it
tries to get its device lock "dev->mutex", but it can't get it forever,
then the deadlock occurs. Below call stacks show the situation.

So, in order to fix this problem, we need to change workqueue ci_otg
as freezable, then the work item in this workqueue will be run after
driver's resume, this workqueue will not be blocked forever like above
case since the workqueue writeback has been thawed too.

Tested at: i.mx6qdl-sabresd and i.mx6sx-sdb.

[  555.178869] kworker/u2:13   D c07de74c     0   826      2 0x00000000
[  555.185310] Workqueue: ci_otg ci_otg_work
[  555.189353] Backtrace:
[  555.191849] [<c07de4fc>] (__schedule) from [<c07dec6c>] (schedule+0x48/0xa0)
[  555.198912]  r10:ee471ba0 r9:00000000 r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4
[  555.206867]  r4:ee470000
[  555.209453] [<c07dec24>] (schedule) from [<c07e2fc4>] (schedule_timeout+0x15c/0x1e0)
[  555.217212]  r4:7fffffff r3:edc2b000
[  555.220862] [<c07e2e68>] (schedule_timeout) from [<c07df6c8>] (wait_for_common+0x94/0x144)
[  555.229140]  r8:00000000 r7:00000002 r6:ee470000 r5:ee471ba4 r4:7fffffff
[  555.235980] [<c07df634>] (wait_for_common) from [<c07df790>] (wait_for_completion+0x18/0x1c)
[  555.244430]  r10:00000001 r9:c0b5563c r8:c0042e48 r7:ef086000 r6:eea4372c r5:ef131b00
[  555.252383]  r4:00000000
[  555.254970] [<c07df778>] (wait_for_completion) from [<c0043cb8>] (flush_work+0x19c/0x234)
[  555.263177] [<c0043b1c>] (flush_work) from [<c0043fac>] (flush_delayed_work+0x48/0x4c)
[  555.271106]  r8:ed5b5000 r7:c0b38a3c r6:eea439cc r5:eea4372c r4:eea4372c
[  555.277958] [<c0043f64>] (flush_delayed_work) from [<c00eae18>] (bdi_unregister+0x84/0xec)
[  555.286236]  r4:eea43520 r3:20000153
[  555.289885] [<c00ead94>] (bdi_unregister) from [<c02c2154>] (blk_cleanup_queue+0x180/0x29c)
[  555.298250]  r5:eea43808 r4:eea43400
[  555.301909] [<c02c1fd4>] (blk_cleanup_queue) from [<c0417914>] (__scsi_remove_device+0x48/0xb8)
[  555.310623]  r7:00000000 r6:20000153 r5:ededa950 r4:ededa800
[  555.316403] [<c04178cc>] (__scsi_remove_device) from [<c0415e90>] (scsi_forget_host+0x64/0x68)
[  555.325028]  r5:ededa800 r4:ed5b5000
[  555.328689] [<c0415e2c>] (scsi_forget_host) from [<c0409828>] (scsi_remove_host+0x78/0x104)
[  555.337054]  r5:ed5b5068 r4:ed5b5000
[  555.340709] [<c04097b0>] (scsi_remove_host) from [<c04cdfcc>] (usb_stor_disconnect+0x50/0xb4)
[  555.349247]  r6:ed5b56e4 r5:ed5b5818 r4:ed5b5690 r3:00000008
[  555.355025] [<c04cdf7c>] (usb_stor_disconnect) from [<c04b3bc8>] (usb_unbind_interface+0x78/0x25c)
[  555.363997]  r8:c13919b4 r7:edd3c000 r6:edd3c020 r5:ee551c68 r4:ee551c00 r3:c04cdf7c
[  555.371892] [<c04b3b50>] (usb_unbind_interface) from [<c03dc248>] (__device_release_driver+0x8c/0x118)
[  555.381213]  r10:00000001 r9:edd90c00 r8:c13919b4 r7:ee551c68 r6:c0b546e0 r5:c0b5563c
[  555.389167]  r4:edd3c020
[  555.391752] [<c03dc1bc>] (__device_release_driver) from [<c03dc2fc>] (device_release_driver+0x28/0x34)
[  555.401071]  r5:edd3c020 r4:edd3c054
[  555.404721] [<c03dc2d4>] (device_release_driver) from [<c03db304>] (bus_remove_device+0xe0/0x110)
[  555.413607]  r5:edd3c020 r4:ef17f04c
[  555.417253] [<c03db224>] (bus_remove_device) from [<c03d8128>] (device_del+0x114/0x21c)
[  555.425270]  r6:edd3c028 r5:edd3c020 r4:ee551c00 r3:00000000
[  555.431045] [<c03d8014>] (device_del) from [<c04b1560>] (usb_disable_device+0xa4/0x1e8)
[  555.439061]  r8:edd3c000 r7:eded8000 r6:00000000 r5:00000001 r4:ee551c00
[  555.445906] [<c04b14bc>] (usb_disable_device) from [<c04a8e54>] (usb_disconnect+0x74/0x224)
[  555.454271]  r9:edd90c00 r8:ee551000 r7:ee551c68 r6:ee551c9c r5:ee551c00 r4:00000001
[  555.462156] [<c04a8de0>] (usb_disconnect) from [<c04a8fb8>] (usb_disconnect+0x1d8/0x224)
[  555.470259]  r10:00000001 r9:edd90000 r8:ee471e2c r7:ee551468 r6:ee55149c r5:ee551400
[  555.478213]  r4:00000001
[  555.480797] [<c04a8de0>] (usb_disconnect) from [<c04ae5ec>] (usb_remove_hcd+0xa0/0x1ac)
[  555.488813]  r10:00000001 r9:ee471eb0 r8:00000000 r7:ef3d9500 r6:eded810c r5:eded80b0
[  555.496765]  r4:eded8000
[  555.499351] [<c04ae54c>] (usb_remove_hcd) from [<c04d4158>] (host_stop+0x28/0x64)
[  555.506847]  r6:eeb50010 r5:eded8000 r4:eeb51010
[  555.511563] [<c04d4130>] (host_stop) from [<c04d09b8>] (ci_otg_work+0xc4/0x124)
[  555.518885]  r6:00000001 r5:eeb50010 r4:eeb502a0 r3:c04d4130
[  555.524665] [<c04d08f4>] (ci_otg_work) from [<c00454f0>] (process_one_work+0x194/0x420)
[  555.532682]  r6:ef086000 r5:eeb502a0 r4:edc44480
[  555.537393] [<c004535c>] (process_one_work) from [<c00457b0>] (worker_thread+0x34/0x514)
[  555.545496]  r10:edc44480 r9:ef086000 r8:c0b1a100 r7:ef086034 r6:00000088 r5:edc44498
[  555.553450]  r4:ef086000
[  555.556032] [<c004577c>] (worker_thread) from [<c004bab4>] (kthread+0xdc/0xf8)
[  555.563268]  r10:00000000 r9:00000000 r8:00000000 r7:c004577c r6:edc44480 r5:eddc15c0
[  555.571221]  r4:00000000
[  555.573804] [<c004b9d8>] (kthread) from [<c000fef0>] (ret_from_fork+0x14/0x24)
[  555.581040]  r7:00000000 r6:00000000 r5:c004b9d8 r4:eddc15c0

[  553.429383] sh              D c07de74c     0   694    691 0x00000000
[  553.435801] Backtrace:
[  553.438295] [<c07de4fc>] (__schedule) from [<c07dec6c>] (schedule+0x48/0xa0)
[  553.445358]  r10:edd3c054 r9:edd3c078 r8:edddbd50 r7:edcbbc00 r6:c1377c34 r5:60000153
[  553.453313]  r4:eddda000
[  553.455896] [<c07dec24>] (schedule) from [<c07deff8>] (schedule_preempt_disabled+0x10/0x14)
[  553.464261]  r4:edd3c058 r3:0000000a
[  553.467910] [<c07defe8>] (schedule_preempt_disabled) from [<c07e0bbc>] (mutex_lock_nested+0x1a0/0x3e8)
[  553.477254] [<c07e0a1c>] (mutex_lock_nested) from [<c03e927c>] (dpm_complete+0xc0/0x1b0)
[  553.485358]  r10:00561408 r9:edd3c054 r8:c0b4863c r7:edddbd90 r6:c0b485d8 r5:edd3c020
[  553.493313]  r4:edd3c0d0
[  553.495896] [<c03e91bc>] (dpm_complete) from [<c03e9388>] (dpm_resume_end+0x1c/0x20)
[  553.503652]  r9:00000000 r8:c0b1a9d0 r7:c1334ec0 r6:c1334edc r5:00000003 r4:00000010
[  553.511544] [<c03e936c>] (dpm_resume_end) from [<c0079894>] (suspend_devices_and_enter+0x158/0x504)
[  553.520604]  r4:00000000 r3:c1334efc
[  553.524250] [<c007973c>] (suspend_devices_and_enter) from [<c0079e74>] (pm_suspend+0x234/0x2cc)
[  553.532961]  r10:00561408 r9:ed6b7300 r8:00000004 r7:c1334eec r6:00000000 r5:c1334ee8
[  553.540914]  r4:00000003
[  553.543493] [<c0079c40>] (pm_suspend) from [<c0078a6c>] (state_store+0x6c/0xc0)

[  555.703684] 7 locks held by kworker/u2:13/826:
[  555.708140]  #0:  ("%s""ci_otg"){++++.+}, at: [<c0045484>] process_one_work+0x128/0x420
[  555.716277]  #1:  ((&ci->work)){+.+.+.}, at: [<c0045484>] process_one_work+0x128/0x420
[  555.724317]  #2:  (usb_bus_list_lock){+.+.+.}, at: [<c04ae5e4>] usb_remove_hcd+0x98/0x1ac
[  555.732626]  #3:  (&dev->mutex){......}, at: [<c04a8e28>] usb_disconnect+0x48/0x224
[  555.740403]  #4:  (&dev->mutex){......}, at: [<c04a8e28>] usb_disconnect+0x48/0x224
[  555.748179]  #5:  (&dev->mutex){......}, at: [<c03dc2f4>] device_release_driver+0x20/0x34
[  555.756487]  #6:  (&shost->scan_mutex){+.+.+.}, at: [<c04097d0>] scsi_remove_host+0x20/0x104

Cc: <stable@vger.kernel.org> #v3.14+
Cc: Jun Li <jun.li@nxp.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

The write value is 8bit, but currently writing a larger number (eg a doubled
digit) is not errored but instead gets cast and sets off an action probably
undesired.
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

In case of error, the function usb_phy_generic_register()
returns ERR_PTR() and never returns NULL. The NULL test in
the return value check should be replaced with IS_ERR().
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>

The write value is 8bit, but currently writing a larger number
(eg a doubled digit) is not errored but instead gets cast and
sets off an action probably undesired.
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
(Change the style of commit log to fix checkpatch.pl warning)

Use list_for_each_entry() instead of list_for_each() to simplify
the code.
Signed-off-by: NGeliang Tang <geliangtang@163.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Directly manipulate the controller regsiter to suspend the usb bus
for HNP is not the proper way, this should be done through the usbcore
by usb autosuspend. So to start HNP, autosuspend support should be
added for OTG devices interface driver if it's not enabled.
Signed-off-by: NLi Jun <jun.li@freescale.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

Set ci->hcd and ci->otg.host to be null in host_stop since the
hcd already freed.
Signed-off-by: NLi Jun <jun.li@freescale.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

call to of_find_property() before of_property_read_u32() is unnecessary.
of_property_read_u32() anyway calls to of_find_property() only.
Signed-off-by: NSaurabh Sengar <saurabh.truth@gmail.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

disable wakeup irq during shutdown, otherwise kexec fails for
kernels that setup irq handlers before resetting the hardware
Signed-off-by: NAndreas Fenkart <andreas.fenkart@dev.digitalstrom.org>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

Since this configuration option has deleted, cleans up all
its references.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Reported-by: NValentin Rothberg <valentinrothberg@gmail.com>

Since we have dynamic debug support, delete static debug for chipidea
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

Since we need to mount debugfs to show/store the things we
want to debug, it is duplicated to add another configuration
to enable it. Meanwhile, with CONFIG_USB_CHIPIDEA_DEBUG,
we can't support chipidea debugfs at runtime.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Cc: Jun Li <jun.li@freescale.com>

_hardware_enqueue() didn't check for errors when using
add_td_to_list() which can fail if dma_pool_alloc fails, thus
causing a kernel panic when lastnode->ptr is NULL.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

Update comments to reflect current state of functions.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>

This patch sets the AHBMODE to allow for posted data writes.  This
results in higher performance.
Signed-off-by: NAndy Gross <agross@codeaurora.org>
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

replace dma_pool_alloc and memset with a single call to dma_pool_zalloc
Signed-off-by: NSaurabh Sengar <saurabh.truth@gmail.com>
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This allows to write

  drm-$(CONFIG_AGP) += drm_agpsupport.o

without having to handle CONFIG_AGP=y vs. CONFIG_AGP=m. Only support
this syntax for modules, since built-in code depending on something
modular cannot work and init/Makefile actually relies on the current
semantics. There are a few drivers which adapted to the current
semantics out of necessity; these are fixed to also work when the
respective subsystem is modular.

Acked-by: Peter Chen <peter.chen@freescale.com> [chipidea]
Signed-off-by: NMichal Marek <mmarek@suse.com>

of_match_device could return NULL, and so cause a NULL pointer
dereference later.

Reported-by: coverity (CID 1324138)
Signed-off-by: NLABBE Corentin <clabbe.montjoie@gmail.com>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>