USB: ci13xxx_udc: Don't wait infinitely in bus reset

The current code infinitely waits for all bits in PRIME register to be
cleared by the controller during bus reset.  In some error scenarios,
controller is not clearing PRIME register contents.  When this happens
the target crashes due to watchdog bark.  Convert this infinite loop
to finite loop.  Also convert controller reset loop to finite loop.

CRs-Fixed: 465922
Change-Id: I2e13ad8f53e8dbb2b9939dd13bf3ef8091d55058
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc: Flush ep0 even when queue is empty

The endpoint must be flushed before retiring pending requests. The
current code skips flushing an endpoint if there are no pending
requests.  Flushing ep0 for every setup packet is some how resolving
the race between transfer completion interrupt and transfer descriptors
updates to the system memory in the controller.  Always allow flushing
ep0 endpoint.  This patch resolves USB disconnect issue during RNDIS
high bandwidth tests.

CRs-Fixed: 466538
Change-Id: Ia89b2dc8ff831641dafb91196e3af5271ac66cfd
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: Dump usb info during memory access violation

USB is accessing an invalid memory which results in EBI error.
To find the endpoint information and the address being accessed,
dump all the usb request info required for debugging memory access
violation issue from APP's proc using the trace framework.

CRs-Fixed: 430455
Change-Id: Ie99c31f43dfa9858a9ec2756903574888629e341
Signed-off-by: Chiranjeevi Velempati <cvelempa@codeaurora.org>
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
ci13xxx_udc: Draw 100mA of current in unconfigured state

As a part of usb enumeration, udc driver is currently notifying the pmic
to draw 0mA of current during usb reset. The pmic driver notifies the
charger driver that usb is in suspend state if <=2mA is notified.
In 8930 targets with real battery connected, USB-CV Enumeration tests
fail after some iterations. The failure logs show an error in SOF frame
number and unexpected chirp sequence.

As a part of USB Reset, instead of notifying PMIC to draw 0mA current,
if we notify to draw 100mA current, then the USB-CV Ch-9 Enumeration
failures are not seen. It seems there is some interference when PMIC stops
charging during USB reset and causing the unexpected chirp sequence
during USB Reset.

In any case, as a part of USB reset or unconfigured state, device can draw
upto 100mA of current from USB bus. Hence notify charging driver with
100mA current draw as a part of USB reset interrupt.

CRs-Fixed: 477655
Change-Id: I2658bd570c500c62705e0c07384d6b5c900f407d
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: ci13xxx_udc: Fix kernel panic during composition switch

The control endpoint requests are not nuked properly during
composition switch.  The stale request is getting completed
during enumeration of the new composition.  Kernel panics if
completion handler access already freed data.  This is happening
with RNDIS interface.

The Android composite driver dequeue the control request before
removing the composition.  The current code returns immediately
if the queue is empty.  The control endpoint queues are handled
differently.  The EP0 IN endpoint is only exposed to the composite
driver.  The controller driver takes care of queuing the request
on EP0 IN or EP0 OUT based on control transfer direction.  When
the composite driver dequeue request on control endpoint, check
both direction endpoints queues.

When USB bus is reset, nuke the control endpoints.  Flushing the
endpoint will not call completion handler.

Test endpoint queue list, request list, endpoint descriptor and
soft pull up status under spinlock to prevent any races between
dequeue and queue paths.

CRs-Fixed: 474578
Change-Id: I3d7ca4be4d6cee65707879c6c9b501f442e53018
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
ci13xxx_udc: Acquire spinlock before calling ep_nuke()

The commit b0ad433 (USB: ci13xxx_udc: Fix kernel panic during
composition switch) adds ep_nuke() function in gadget_stop_activity().

_ep_nuke() releases and re-acquires spinlock on every entry of the
function. Acquiring spinlock before calling _ep_nuke() is necessary,
else it may end up in unlocking the lock twice, as it is already
unlocked before calling _ep_nuke(), which may lead to crash.

Hence, acquire spinlocks before calling _ep_nuke() function.

CRs-Fixed: 486502
Change-Id: Ia80b9facb8e592f8fb41879dc08f9f1a04a20b48
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: ci13xxx_udc:  Retire pending requests while flushing an endpoint

Rmnet and dun function drivers are designed to start fresh upon MODEM
restart.  The current code is flushing endpoints without freeing
requests.  New requests are allocated again after MODEM is powered up.
All accumulated requests are freed only upon cable disconnect.  If
MODEM is restarted multiple times without disconnecting the cable, we
are running low memory issues.

A pending request can not be freed without dequeuing it.  Dequeuing
all requests in a loop is a heavy operation and involves changing
multiple function drivers.  All pending requests are retired upon
disabling an endpoint.  But an endpoint can not be disabled in
configured state.  Hence retire pending requests while flushing an
endpoint.

CRs-Fixed: 489047
Change-Id: I3440a204ad8c4beb043b1068cb1d3965be96e9b7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: chipidea: udc: fix memory access of shared memory on armv5 machines

The udc uses an shared dma memory space between hard and software. This
memory layout is described in ci13xxx_qh and ci13xxx_td which are marked
with the attribute ((packed)).

The compiler currently does not know about the alignment of the memory
layout, and will create strb and ldrb operations.

The Datasheet of the synopsys core describes, that some operations on
the mapped memory need to be atomic double word operations. I.e. the
next pointer addressing in the qhead, as otherwise the hardware will
read wrong data and totally stuck.

This is also possible while working with the current active td queue,
and preparing the td->ptr.next in software while the hardware is still
working with the current active td which is supposed to be changed:

writeb(0xde, &td->ptr.next + 0x0); /* strb */
writeb(0xad, &td->ptr.next + 0x1); /* strb */

<----- hardware reads value of td->ptr.next and get stuck!

writeb(0xbe, &td->ptr.next + 0x2); /* strb */
writeb(0xef, &td->ptr.next + 0x3); /* strb */

This appeares on armv5 machines where the hardware does not support
unaligned 32bit operations.

This patch adds the attribute ((aligned(4))) to the structures to tell
the compiler to use 32bit operations. It also adds an wmb() for the
prepared TD data before it gets enqueued into the qhead.

CRs-Fixed: 494323
Change-Id: I3fc2e0f662076572d61f97ed708026be3cd3e59c
Cc: stable <stable@vger.kernel.org> # v3.5
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: a9c174302b1590ef3ead485d804a303c5f89174b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
[pkondeti@codeaurora.org: resolved merge conflicts]
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm_fb:HDMI: Wrong vic is selected in case of 480p.

For dual aspect-ration timings, HDMI driver always selects
the vic for 16:9 aspect ratio. So if no vic is specified by
userspace then select the best format from EDID.

Change-Id: I8f8ed690ae72c1d44260213c8f188e97cb203242
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
msm: 8064: Modify Wifi/BT initialization

Configure platform condition for apq8064_dma only.

Change-Id: I9d4d67f7fcdea738a4b00ba6a0fd6d8f72f4bcae
Signed-off-by: Ming-yi Lin <mylin@codeaurora.org>
Merge "msm: 8064: Modify Wifi/BT initialization"
Merge "msm_fb:HDMI: Wrong vic is selected in case of 480p."
Merge "USB: ci13xxx_udc: Don't wait infinitely in bus reset"
Merge "USB: ci13xxx_udc: Flush ep0 even when queue is empty"
Merge "USB: Dump usb info during memory access violation"
Merge "USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared"
Merge "ci13xxx_udc: Draw 100mA of current in unconfigured state"
Merge "USB: ci13xxx_udc: Fix kernel panic during composition switch"
Merge "ci13xxx_udc: Acquire spinlock before calling ep_nuke()"