USB: ci13xxx_udc: Convert ATDTW loop into finite one

Currently while queueing requests to HW, waiting in infinite
loop till ATDTW bit set for HW semaphore to be released by HW
to avoid race conditions between HW and SW. This could lead to
watchdog timer expiry if bus infrastructure is stuck. Hence
convert this loop into finite loop of 100msec which is atmost
required for USB HW to release HW semaphore as per HW team.

CRs-Fixed: 368769
Change-Id: Ibb2ab281f22230cf40574554273c3e4faf453b50
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
usb: gadget: Initialize non zero ep max packet size to 0xFFFF

usb device controller driver initializes all endpoint's max packet
size to 64 bytes. At the time of function driver bind gadget
framework chooses endpoint by comparing it with endpoint
descriptor of the function driver in ep_matches(). Driver bind
fails for the function driver having isochronous endpoints, as
ep max packet size is less than endpoint descriptor's max packet
size. Hence set ep max packet size to 0xFFFF for non-zero
endpoint which will be set to endpoint descriptor's max packet
size when endpoint is enabled at the time of enumeration.

Change-Id: I9fc0a19bd4502812b8659222d60274ad8b9fef34
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>

b/6968587
USB: ci13xxx_udc: Set QMULT for ISO endpoints

Currently not setting QMULT for ISO endpoints. Set this
value appropriately  to indicate to the USB controller the
number of transactions to be done in microframe.

Change-Id: If80c003464024f8dfebcda13fefb33744618d043
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

b/6968587
USB: ci13xxx_udc: Fix ENDPOINT PRIME failure issue

while queueing requests to USB HW, waiting till EP PRIME bit
get cleared after setting it leads to wathdog timeout. Fix
this by implementing timer based solution instead of infinite
PRIME check loop.
(cherry picked from commit 9e4a5053b0f25cb18ed394fa517be620db673d44)
(cherry picked from commit dcfe03cd167f1b4916de85ce0a0a5516191741cc)
CRs-Fixed: 397907
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

Change-Id: Iad7504c77c02870d9fa3b7b9decf13afcf2c9e12
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
USB: ci13xxx_udc: Fix possible NULL pointer dereference

Don't access dev->platform_data before checking dev against NULL.

CRs-fixed: 440043
(cherry picked from commit bb4cd9eb06da6275256dee09a88c472b90d191a8)

Change-Id: I6270aef1cc364fac58be0d216e2255592306a28f
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Add timeout of 100ms for endpoint flush loop

Currently completion of endpoint flush operation is checked after
setting that endpoint bit with ENDPTFLUSH register and polling the
same to get it clear. It has been observed that sometime this flush
operation takes huge amount of time which results into watchdog
timeout issue due to this busy loop without any time-out. Hence add
time-out of 100ms for endpoint flush operation completion and also
add 100us delay before checking ENDPTFLUSH register for endpoint bit
clear or not.

Also print important usb status register and flushed endpoint dtds
at the time of issue.

CRs-Fixed: 409382
Change-Id: I7ae57cc436077f8a03051b92750bdca9a571da2b
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
USB: ci13xxx_udc: Don't flush and disable all endpoints during disconnect

Flushing and disabling all endpoints during disconnect in controller
driver is simply wasteful and unnecessary.  Flushing endpoints before
notifying disconnect to composite driver will have side effects too.
The active endpoints will be disabled by function drivers when they
notified about disconnect.

The current code use 100 msec timeout for flush operation.  If controller
driver flush and disable all endpoints, the worst case timeout will be
added up to several seconds.  This is leading to watch dog timeout.

CRs-Fixed: 431623
Change-Id: If6a2e87006cda367c2eb4def616e9672e13eadf5
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Avoid flushing endpoint twice during disable

The ep_disable() function nukes all pending requests before
disabling the endpoint in hardware.  The endpoint is flushed
during nuking.  Don't flush the endpoint again.

(cherry picked from commit a89f80f9942e5dc2796ad742f9d01f6aa68e1267)

CRs-Fixed: 445916
Change-Id: I84020dceef751dbdde1233068a414a72d1c1b609
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Don't flush inactive endpoints

The endpoint must be flushed prior to retiring pending requests.
This is done during disabling an endpoint.  Don't flush an endpoint
if there are no pending requests.  According databook flushing
endpoint may take large amount of time.  This optimization will
make USB disconnect/reset processing a little bit faster.

(cherry picked from commit 58db2c1f94451d7a352d2ad1a1b1e9732f4f0a11)

CRs-Fixed: 445916
Change-Id: I2a8b185d7f6f295485bc1d1b1794f42471149491
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Skip flushing endpoints upon failure

Flushing an endpoint involve polling ENDPTFLUSH and ENDPTSTAT
registers.  The worst case timeout is 100 msec for each endpoint.
The reason for failure is unknown.  When flushing an endpoint
fails, successive flushing of remaining endpoints are also failing.
Hence skip flushing remaining endpoints.  Reset this condition
upon USB bus reset.

(cherry picked from commit 2a630fb9b83b31e607ef61f3b61959cc1b095349)

CRs-Fixed: 445916
Change-Id: I54cf860c0d290ffa3fc0d7e41af32b4be48937ef
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Add module param to enable streaming mode

The streaming mode is disabled by default for ci13xxx_msm.  Add
a module param to enable streaming.  This module param overrides
flag.

This allows user space to enable streaming mode for selected USB
compositions.

CRs-Fixed: 429212
Change-Id: I50c55c005d1eccec094195e3394bfb9415d94596
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Add support for large requests

Spanning large request into multiple dTDs will fail with short
packets.  Instead queue one dTD at a time.  This patch has
the following limitations.

1. Large requests are supported only on Bulk OUT endpoints. This
feature is mainly required for MTP driver to achieve better write
throughputs. The VFS performs well with larger buffers.

2. To keep it simple, don't allow queuing while processing large
request. Don't allow larger request queuing while the queue is
busy.

CRs-Fixed: 449733
Change-Id: I262a62af3316d673a97f11842290609092c6e7df
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: f_rndis: Check if cdev is NULL before accessing

RNDIS control path completion handlers are getting called after setting
cdev to NULL during disconnect as part of composition switch and this
is leading to a crash. Avoid this crash, by checking, if cdev is NULL
before accessing. Also don't queue request's to DCD, if composition switch
is in progress.

CRs-Fixed: 433534
Change-Id: Ic0790415ec3eaf866af2895370249e45adcbba5d
Signed-off-by: Chiranjeevi Velempati <cvelempa@codeaurora.org>
(cherry picked from commit 46874732be9d6997ff3bceaf97f07911f9f22440)
USB: ci13xxx_udc: Don't wait infinitely in bus reset

The current code infinitely waits for all bits in PRIME register to be
cleared by the controller during bus reset.  In some error scenarios,
controller is not clearing PRIME register contents.  When this happens
the target crashes due to watchdog bark.  Convert this infinite loop
to finite loop.  Also convert controller reset loop to finite loop.

CRs-Fixed: 465922
Change-Id: I2e13ad8f53e8dbb2b9939dd13bf3ef8091d55058
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Flush ep0 even when queue is empty

The endpoint must be flushed before retiring pending requests. The
current code skips flushing an endpoint if there are no pending
requests.  Flushing ep0 for every setup packet is some how resolving
the race between transfer completion interrupt and transfer descriptors
updates to the system memory in the controller.  Always allow flushing
ep0 endpoint.  This patch resolves USB disconnect issue during RNDIS
high bandwidth tests.

CRs-Fixed: 466538
Change-Id: Ia89b2dc8ff831641dafb91196e3af5271ac66cfd
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: Dump usb info during memory access violation

USB is accessing an invalid memory which results in EBI error.
To find the endpoint information and the address being accessed,
dump all the usb request info required for debugging memory access
violation issue from APP's proc using the trace framework.

CRs-Fixed: 430455
Change-Id: Ie99c31f43dfa9858a9ec2756903574888629e341
Signed-off-by: Chiranjeevi Velempati <cvelempa@codeaurora.org>
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>

Conflicts:
	arch/arm/mach-msm/ebi_erp.c
USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
ci13xxx_udc: Draw 100mA of current in unconfigured state

As a part of usb enumeration, udc driver is currently notifying the pmic
to draw 0mA of current during usb reset. The pmic driver notifies the
charger driver that usb is in suspend state if <=2mA is notified.
In 8930 targets with real battery connected, USB-CV Enumeration tests
fail after some iterations. The failure logs show an error in SOF frame
number and unexpected chirp sequence.

As a part of USB Reset, instead of notifying PMIC to draw 0mA current,
if we notify to draw 100mA current, then the USB-CV Ch-9 Enumeration
failures are not seen. It seems there is some interference when PMIC stops
charging during USB reset and causing the unexpected chirp sequence
during USB Reset.

In any case, as a part of USB reset or unconfigured state, device can draw
upto 100mA of current from USB bus. Hence notify charging driver with
100mA current draw as a part of USB reset interrupt.

CRs-Fixed: 477655
Change-Id: I2658bd570c500c62705e0c07384d6b5c900f407d
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: ci13xxx_udc: Fix kernel panic during composition switch

The control endpoint requests are not nuked properly during
composition switch.  The stale request is getting completed
during enumeration of the new composition.  Kernel panics if
completion handler access already freed data.  This is happening
with RNDIS interface.

The Android composite driver dequeue the control request before
removing the composition.  The current code returns immediately
if the queue is empty.  The control endpoint queues are handled
differently.  The EP0 IN endpoint is only exposed to the composite
driver.  The controller driver takes care of queuing the request
on EP0 IN or EP0 OUT based on control transfer direction.  When
the composite driver dequeue request on control endpoint, check
both direction endpoints queues.

When USB bus is reset, nuke the control endpoints.  Flushing the
endpoint will not call completion handler.

Test endpoint queue list, request list, endpoint descriptor and
soft pull up status under spinlock to prevent any races between
dequeue and queue paths.

CRs-Fixed: 474578
Change-Id: I3d7ca4be4d6cee65707879c6c9b501f442e53018
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
ci13xxx_udc: Acquire spinlock before calling ep_nuke()

The commit b0ad433 (USB: ci13xxx_udc: Fix kernel panic during
composition switch) adds ep_nuke() function in gadget_stop_activity().

_ep_nuke() releases and re-acquires spinlock on every entry of the
function. Acquiring spinlock before calling _ep_nuke() is necessary,
else it may end up in unlocking the lock twice, as it is already
unlocked before calling _ep_nuke(), which may lead to crash.

Hence, acquire spinlocks before calling _ep_nuke() function.

CRs-Fixed: 486502
Change-Id: Ia80b9facb8e592f8fb41879dc08f9f1a04a20b48
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>