few new revisions of the core have been released,
add them to our list of revisions so we can apply
workarounds if necessary.
Signed-off-by: Felipe Balbi <balbi@ti.com>

commit 388e5c51 (usb: dwc3: remove dwc3 dependency
on host AND gadget.) created the possibility for
host-only and peripheral-only dwc3 builds but
left a possible randconfig build error when host-only
builds are selected.

Cc: <stable@vger.kernel.org> # v3.8+
Reported-by: Jim Davis <jim.epost@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

we need to pre-start stream transfers otherwise we
will never know when to start them.
Signed-off-by: Felipe Balbi <balbi@ti.com>

When going into bus suspend/resume we _must_
call gadget driver's ->suspend/->resume callbacks
accordingly. This patch implements that very feature
which has been missing forever.
Signed-off-by: Felipe Balbi <balbi@ti.com>

It's not always we need to force a transfer to be removed
from the core's internal cache. This extra argument will
help differentiating those two cases.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

During superspeed, HIRD threshold should always
be zero. Curent driver wasn't making sure that
was the case.
Signed-off-by: Felipe Balbi <balbi@ti.com>

if we have hibernation configured, Databook
instructs us to set KEEP_CONNECT bit together
with RUN_STOP bit, in step 9 of section 12.3.6.1
Initialization for Hibernation Support.
Signed-off-by: Felipe Balbi <balbi@ti.com>

no functional changes, just converting spaces
into tab.
Signed-off-by: Felipe Balbi <balbi@ti.com>

We must read HWPARAMS4 register to figure out
how many scratch buffers we should allocate.

Later patch will use "Set Scratchpad Buffer
Array" command to pass the pointer to the
IP so it can be used during hibernation.
Signed-off-by: Felipe Balbi <balbi@ti.com>

That argument will be used in later patches when we
have working hibernation support. For now, always
pass it as false.

The idea of this patch is to decrease to size of
following patches and slowly add hibernation building
blocks to the gadget side of dwc3 so that it becomes
very easy to review the actual hibernation code.

[ balbi@ti.com : rewrote patch on top of current
	tree. Added commit log. ]
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This function will be used during hibernation to get
the current link state. It will be needed at least
for Hibernation support.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This extra field will save endpoint state when we're
about to enter hibernation. It will be used later
to restore the endpoint state when resuming.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

this will tell driver that this version
of the core was configured with hibernation
feature enabled.
Signed-off-by: Felipe Balbi <balbi@ti.com>

move 1-bit flags to the bottom of the structure,
sort all bit flags alphabetically, add documentation
which was missing.
Signed-off-by: Felipe Balbi <balbi@ti.com>

Revision 2.20a of the core has a known issue
which would generate bogus hibernation events
_and_ random failures on USB CV TD.9.23 test
case.

The suggested workaround is to ignore hibernation
events which don't match currently connected
speed.
Signed-off-by: Felipe Balbi <balbi@ti.com>

Revisions between 2.10a and 2.50a (included) have
a known issue which may cause xHCI compliance tests
to fail and/or quality issues with Isochronous
transactions.

Note that this issue only impacts certain configurations
of those revisions, namely the ones which have clock
gating enabled.

The suggested workaround is to disable clock gating in
known broken revisions, make sure HW LPM is disabled
and set GCTL.SOFITPSYNC to 1.
Signed-off-by: Felipe Balbi <balbi@ti.com>

This bit is necessary for implemeting workaround
for known issue with some revisions of this core.
Signed-off-by: Felipe Balbi <balbi@ti.com>

by setting IOC always, we can recycle TRBs a
lot sooner at the expense of some increased
CPU load.

The extra load seems to be quite minimal on
OMAP5 devices (instead of 1 IRQ for one MSC
transfer, we get
CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS).
Signed-off-by: Felipe Balbi <balbi@ti.com>

This patch fixes problem with unnecessary usb_ep_set_maxpacket_limit() usage.
It should not be used in at91udc_probe() function, where maxpacket values are
set for field "maxpacket" of struct at91_ep, which is representation of
endpoint in driver internals. Function usb_ep_set_maxpacket_limit() is called
in udc_reinit() function, where struct usb_ep instances are initialised with
values set previously in struct at91_ep instances. So it's very important to
initialise it properly.
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

If NO_DMA=y:

    drivers/built-in.o: In function `txstate':
    musb_gadget.c:(.text+0x35955a): undefined reference to `dma_unmap_single'
    musb_gadget.c:(.text+0x35957e): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `musb_g_giveback':
    (.text+0x359672): undefined reference to `dma_mapping_error'
    drivers/built-in.o: In function `musb_g_giveback':
    (.text+0x3596ba): undefined reference to `dma_unmap_single'
    drivers/built-in.o: In function `musb_g_giveback':
    (.text+0x3596e0): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `rxstate':
    musb_gadget.c:(.text+0x3599d0): undefined reference to `dma_unmap_single'
    musb_gadget.c:(.text+0x3599f6): undefined reference to `dma_sync_single_for_cpu'
    drivers/built-in.o: In function `musb_gadget_queue':
    musb_gadget.c:(.text+0x35a8c0): undefined reference to `dma_map_single'
    musb_gadget.c:(.text+0x35a8d0): undefined reference to `dma_mapping_error'
    musb_gadget.c:(.text+0x35a906): undefined reference to `dma_sync_single_for_cpu'
    musb_gadget.c:(.text+0x35a9a0): undefined reference to `dma_unmap_single'
    musb_gadget.c:(.text+0x35a9c8): undefined reference to `dma_sync_single_for_cpu'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The probe() method has the 'dev' local variable declared and used but strangely
not in all cases where it should be...
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

instead of relying on the otg pointer, which
can be NULL in certain cases, we can use the
gadget and host pointers we already hold inside
struct musb.

Cc: <stable@vger.kernel.org>
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

debugfs files to show the contents of important dsps registers.
Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Around DWC USB3 2.30a release another bit has been added to the
Device-Specific Event (DEVT) Event Information (EvtInfo) bitfield.

Because of that, what used to be 8 bits long, has become 9 bits long.

Per dwc3 2.30a+ spec in the Device-Specific Event (DEVT), the field of
Event Information Bits(EvtInfo) uses [24:16] bits, and it has 9 bits
not 8 bits. And the following reserved field uses [31:25] bits not
[31:24] bits, and it has 7 bits.

So in dwc3_event_devt, the bit mask should be:
event_info	[24:16]		9 bits
reserved31_25	[31:25]		7 bits

This patch makes sure that newer core releases will work fine with
Linux and that we will decode the event information properly on new
core releases.

[ balbi@ti.com : improve commit log a bit ]

Cc: <stable@vger.kernel.org>
Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Debugfs function return an ERR_PTR if they compiled out.  We don't need
to test for that here because if the debugfs file are compiled out then
it is ok to pass an ERR_PTR to debugfs_create_file() since it will just
be a no-op stub.

Debugfs return NULLs on error, but we don't need to test for that either
because debugfs_create_file() will accept NULL pointers.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The SoCs earlier than sama5d3, they have the same number endpoints
and DMA channels. In driver code, they use the same definition
USBA_NR_ENDPOINTS for both endpoints and dma channels. However,
in sama5d3, it has different number for endpoints and DMA channels.
So, define a new macro USBA_NR_DMAs for DMA channels. And the
USBA_NR_ENDPOINS is not used anymore, remove it at the same time.
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

In sama5d3 SoC, there are 16 endpoints, which is different with
earlier SoCs (only have 7 endpoints). The USBA_NR_ENDPOINTS macro
is not suitable for sama5d3. So, get the endpoints number through
the udc->num_ep, which get from platform data for non-dt kernel,
or parse from dt node.
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This patch adds asynchronous I/O support for FunctionFS endpoint files.
It adds ffs_epfile_aio_write() and ffs_epfile_aio_read() functions responsible
for preparing AIO operations.

It also modifies ffs_epfile_io() function, adding aio handling code. Instead
of extending list of parameters of this function, there is new struct
ffs_io_data which contains all information needed to perform I/O operation.
Pointer to this struct replaces "buf" and "len" parameters of ffs_epfile_io()
function. Allocated buffer is freed immediately only after sync operation,
because in async IO it's freed in complete funcion. For each async operation
an USB request is allocated, because it allows to have more than one request
queued on single endpoint.

According to changes in ffs_epfile_io() function, functions ffs_epfile_write()
and ffs_epfile_read() are updated to use new API.

For asynchronous I/O operations there is new request complete function named
ffs_epfile_async_io_complete(), which completes AIO operation, and frees
used memory.
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This patch adds poll function for file representing ep0.

Ability of read from or write to ep0 file is related with actual state of ffs:
- When desctiptors or strings are not written yet, POLLOUT flag is set.
- If there is any event to read, POLLIN flag is set.
- If setup request was read, POLLIN and POLLOUT flag is set, to allow
  send response (by performing I/O operation consistent with setup request
  direction) or set stall (by performing I/O operation opposite  setup
  request direction).
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This patch fixes __ffs_ep0_queue_wait() function, which now returns number of
bytes transferred in USB request or error code in case of failure. This is
needed by ffs_ep0_read() function, when read data is copied to userspace.

It also cleans up code by removing usused variable ep0req_status.
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The FFS_SETUP_STATUS macro could be trivialy replaced with an static
inline function but more importantly its name was tad confusing.
The name suggested it was a simple accessor macro but it actually
did change the state of the ffs_data structure perfomring
a FFS_SETUP_CANCELLED -> FFS_NO_SETUP transition.  The name of the
function -- ffs_setup_state_clear_cancelled -- should better
describe what the function actually does.
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Since “cancelled” is spelled with two “l”s, rename FFS_SETUP_CANCELED
to FFS_SETUP_CANCELLED.
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Consistently prefix function name with underscore if the function has to
be called with ffs_lock taken.
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

ffs_alloc_dev and ffs_free_dev are used only in f_fs.c,
so make them static.
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Remove trailing whitespace
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

ffs_dev->ffs_release_dev_callback should be accessed only if ffs_dev
is not NULL.
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Replace kzalloc by devm_kzalloc and remove the kfree() calls.
Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

devm_ioremap_resource does sanity checks on the given resource. No need to
duplicate this in the driver.
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

When s3c_hsotg_ep_sethalt() function is called for ep0 it should be stalled
in the same way that it is in s3c_hsotg_process_control() function, because
SET_HALT for ep0 is delayed response for setup request. Endpoint 0, if
halted, it doesn't need CLEAR_HALT because it clears "stalled" state
automatically when next setup request is received.

For this reason this patch moves code setting ep0 to "stalled" state to new
function named s3c_hsotg_stall_ep0() which is called in
s3c_hsotg_process_control() function as an immediate response for setup
request, and in s3c_hsotg_ep_sethalt() function as a delayed response for
setup request.
Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

When read data from g_printer, we see a Segmentation fault. eg:

Unable to handle kernel paging request at virtual address bf048000 pgd
= cf038000 [bf048000] *pgd=8e8cf811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT ARM Modules linked in: bluetooth
rfcomm g_printer
CPU: 0    Not tainted  (3.4.43-WR5.0.1.9_standard #1)
PC is at __copy_to_user_std+0x310/0x3a8 LR is at 0x4c808010
pc : [<c036e990>]    lr : [<4c808010>]    psr: 20000013
sp : cf883ea8  ip : 80801018  fp : cf883f24
r10: bf04706c  r9 : 18a21205  r8 : 21953888
r7 : 201588aa  r6 : 5109aa16  r5 : 0705aaa2  r4 : 5140aa8a
r3 : 0000004c  r2 : 00000fdc  r1 : bf048000  r0 : bef5fc3c
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 8f038019  DAC: 00000015 Process
g_printer_test. (pid: 661, stack limit = 0xcf8822e8)
Stack: (0xcf883ea8 to 0xcf884000)
3ea0:                   bf047068 00001fff bef5ecb9 cf882000 00001fff bef5ecb9
3ec0: 00001fff 00000000 cf2e8724 bf044d3c 80000013 80000013 00000001
bf04706c
3ee0: cf883f24 cf883ef0 c012e5ac c0324388 c007c8ac c0046298 00008180
cf29b900
3f00: 00002000 bef5ecb8 cf883f68 00000003 cf882000 cf29b900 cf883f54
cf883f28
3f20: c012ea08 bf044b0c c000eb88 00000000 cf883f7c 00000000 00000000
00002000
3f40: bef5ecb8 00000003 cf883fa4 cf883f58 c012eae8 c012e960 00000001
bef60cb8
3f60: 000000a8 c000eb88 00000000 00000000 cf883fa4 00000000 c014329c
00000000
3f80: 000000d4 41af63f0 00000003 c000eb88 cf882000 00000000 00000000
cf883fa8
3fa0: c000e920 c012eaa4 00000000 000000d4 00000003 bef5ecb8 00002000
bef5ecb8
3fc0: 00000000 000000d4 41af63f0 00000003 b6f534c0 00000000 419f9000
00000000
3fe0: 00000000 bef5ecac 000086d9 41a986bc 60000010 00000003 0109608a
0088828a
Code: f5d1f07c e8b100f0 e1a03c2e e2522020 (e8b15300) ---[ end trace
97e2618e250e3377 ]--- Segmentation fault

The root cause is the dev->rx_buffers list has been broken.
When we call printer_read(), the following call tree is triggered:

printer_read()
	|
	+---setup_rx_reqs(req)
	|	|
	|	+---usb_ep_queue(req)
	|	|	|
	|	|	+---...
	|	|		|
	|	|		+---rx_complete(req).
	|	|
	|	+---add the req to dev->rx_reqs_active
	|
	+---while(!list_empty(&dev->rx_buffers)))

The route happens when we don't use DMA or fail to start DMA in USB
driver. We can see: in the case, in rx_complete() it will add the req
to dev->rx_buffers. meanwhile we see that we will also add the req to
dev->rx_reqs_active after usb_ep_queue() return, so this adding will
break the dev->rx_buffers out.

After, when we call list_empty() to check dev->rx_buffers in while(),
due to can't check correctly dev->rx_buffers, so the Segmentation fault
occurs when copy_to_user() is called.
Signed-off-by: wenlin.kang <wenlin.kang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>