USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: chipidea: udc: fix memory access of shared memory on armv5 machines

The udc uses an shared dma memory space between hard and software. This
memory layout is described in ci13xxx_qh and ci13xxx_td which are marked
with the attribute ((packed)).

The compiler currently does not know about the alignment of the memory
layout, and will create strb and ldrb operations.

The Datasheet of the synopsys core describes, that some operations on
the mapped memory need to be atomic double word operations. I.e. the
next pointer addressing in the qhead, as otherwise the hardware will
read wrong data and totally stuck.

This is also possible while working with the current active td queue,
and preparing the td->ptr.next in software while the hardware is still
working with the current active td which is supposed to be changed:

writeb(0xde, &td->ptr.next + 0x0); /* strb */
writeb(0xad, &td->ptr.next + 0x1); /* strb */

<----- hardware reads value of td->ptr.next and get stuck!

writeb(0xbe, &td->ptr.next + 0x2); /* strb */
writeb(0xef, &td->ptr.next + 0x3); /* strb */

This appeares on armv5 machines where the hardware does not support
unaligned 32bit operations.

This patch adds the attribute ((aligned(4))) to the structures to tell
the compiler to use 32bit operations. It also adds an wmb() for the
prepared TD data before it gets enqueued into the qhead.

CRs-Fixed: 494323
Change-Id: I3fc2e0f662076572d61f97ed708026be3cd3e59c
Cc: stable <stable@vger.kernel.org> # v3.5
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: a9c174302b1590ef3ead485d804a303c5f89174b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
[pkondeti@codeaurora.org: resolved merge conflicts]
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
tspp: Improve GPIO configuration mechanism

The TSPP driver requires using 3 or 4 GPIOs per TSIF instance,
depending on the TSIF operation mode. The driver used to configure
all the GPIOs regardless of TSIF instance and mode.
This commit changes the driver's GPIO configuration mechanism to
take into account the TSIF instance and mode, and use only the relevant
GPIOs. This is required by customers who may now utilize the unused GPIOs
for other purposes.

Change-Id: I0bdc7d227d5da08d7398cee37ec60cd72ca350bf
Signed-off-by: Liron Kuch <lkuch@codeaurora.org>
Signed-off-by: Abhinav Gurram <c_abhina@codeaurora.org>
ASoC: msm: qdsp6: Fix for volume command timeout issue.

CMD_RUN command sent from multi channel pcm playback driver
is sent as a no wait command.
But it sets the cmd_state variable used to track DSP cmd
response.In some race condtion it might result in the earlier
command sent before CMD_RUN to timeout as the check for cmd_state
variable would fail.
Hence ensure that cmd_state is not updated for no wait commands.

Change-Id: I7233d292d55945449f80a937e33c9b54393eaa19
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
Merge "USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared"
Merge "usb: chipidea: udc: fix memory access of shared memory on armv5 machines"
Merge "tspp: Improve GPIO configuration mechanism"
audio: cs8427: set validity bit based on c-bit pcm flag

- Set validity bit based on c-bit value as per IEC60958
  specification.

Change-Id: I88f9a4170bb4dfb9e38bcffc3fa7687ab98b27c7
Signed-off-by: Dhananjay Kumar <dhakumar@codeaurora.org>
Merge "ASoC: msm: qdsp6: Fix for volume command timeout issue."
Merge "audio: cs8427: set validity bit based on c-bit pcm flag"
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

CRs-Fixed: 504011
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
ASoC: msm: Update ECNS RX mixer control with new devices.

- Add mixer control for HDMI RX and SECONDARY_I2S to
enable ECNS on Rx path.

CRs-Fixed: 507460
Change-Id: Iba78258d0233e2a0930d9a62da1ec98905c189ff
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>
Merge "ASoC: msm: Update ECNS RX mixer control with new devices."
media : dvb : mpq : video :Data corrupt flag notification

send data corrupt flag notification to dvb node only
when video driver receive decode not correct frame from
core. In case of approximate decode correct frame reset
this flag.

Change-Id: I3b626f7bf54c5e1ff1278595dd9684bf3079480c
Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>
Merge "media : dvb : mpq : video :Data corrupt flag notification"
Merge "ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS"