Now that we have a list of cancelled requests, we can skip over TRBs
when END_TRANSFER command completes.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Whenever we have a request in flight, we can move it to the cancelled
list and later simply iterate over that list and skip over any TRBs we
find.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This list will host cancelled requests who still have TRBs being
processed.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Extract the logic for skipping over TRBs to its own function. This
makes the code slightly more readable and makes it easier to move this
call to its final resting place as a following patch.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Now that we track how many TRBs a request uses, it's easier to skip
over them in case of a call to usb_ep_dequeue(). Let's do so and
simplify the code a bit.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This will help us remove the wait_event() from our ->dequeue().
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Both flags are used for the same purpose in dwc3: appending an extra
TRB at the end to deal with controller requirements. By combining both
flags into one, we make it clear that the situation is the same and
that they should be treated equally.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In DWC_usb31 version 1.70a-ea06 and prior, for highspeed and fullspeed
isochronous IN, BIT[15:14] of the 16-bit microframe number reported by
the XferNotReady event are invalid. The driver uses this number to
schedule the isochronous transfer and passes it to the START TRANSFER
command. Because this number is invalid, the command may fail. If
BIT[15:14] matches the internal 16-bit microframe, the START TRANSFER
command will pass and the transfer will start at the scheduled time, if
it is off by 1, the command will still pass, but the transfer will start
2 seconds in the future. For all other conditions, the START TRANSFER
command will fail with bus-expiry.

In order to workaround this issue, we can test for the correct
combination of BIT[15:14] by sending START TRANSFER commands with
different values of BIT[15:14]: 'b00, 'b01, 'b10, and 'b11. Each
combination is 2^14 uframe apart (or 2 seconds). 4 seconds into the
future will result in a bus-expiry status. As the result, within the 4
possible combinations for BIT[15:14], there will be 2 successful and 2
failure START COMMAND status. One of the 2 successful command status
will result in a 2-second delay start. The smaller BIT[15:14] value is
the correct combination.

Since there are only 4 outcomes and the results are ordered, we can
simply test 2 START TRANSFER commands with BIT[15:14] combinations 'b00
and 'b01 to deduce the smaller successful combination.

Let test0 = test status for combination 'b00 and test1 = test status for
'b01 of BIT[15:14]. The correct combination is as follow:

if test0 fails and test1 passes, BIT[15:14] is 'b01
if test0 fails and test1 fails, BIT[15:14] is 'b10
if test0 passes and test1 fails, BIT[15:14] is 'b11
if test0 passes and test1 passes, BIT[15:14] is 'b00

Synopsys STAR 9001202023: Wrong microframe number for isochronous IN
endpoints.
Signed-off-by: NThinh Nguyen <thinhn@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

When chaining ISOC TRBs together, only the first ISOC TRB should be of
type ISOC_FIRST, all others should be of type ISOC. This patch fixes
that.

Fixes: c6267a51 ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Current check for the last extra TRB for zero and unaligned transfers
does not account for isoc OUT. The last TRB of the Buffer Descriptor for
isoc OUT transfers will be retired with HWO=0. As a result, we won't
return early. The req->remaining will be updated to include the BUFSIZ
count of the extra TRB, and the actual number of transferred bytes
calculation will be wrong.

To fix this, check whether it's a short or zero packet and the last TRB
chain bit to return early.

Fixes: c6267a51 ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
Cc: <stable@vger.kernel.org>
Signed-off-by: NThinh Nguyen <thinhn@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

When operating in USB 2.0 speeds (HS/FS), if GUSB2PHYCFG.ENBLSLPM or
GUSB2PHYCFG.SUSPHY is set, it must be cleared before issuing an endpoint
command.

Current implementation only save and restore GUSB2PHYCFG.SUSPHY
configuration. We must save and clear both GUSB2PHYCFG.ENBLSLPM and
GUSB2PHYCFG.SUSPHY settings. Restore them after the command is
completed.

DWC_usb3 3.30a and DWC_usb31 1.90a programming guide section 3.2.2
Signed-off-by: NThinh Nguyen <thinhn@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Fix kernel-doc warning:

../drivers/usb/dwc3/gadget.c:510: warning: Excess function parameter 'dwc' description in 'dwc3_gadget_start_config'
Signed-off-by: NRandy Dunlap <rdunlap@infradead.org>
Cc: Felipe Balbi <balbi@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

endpoint->maxpacket is not updated after setting the
usb_set_maxpacket_limit() on endpoint enable. The MaxPacketSize can be
different than the endpoint->maxpacket_limit.

DWC3 has been consistently using MaxPacketSize from the endpoint's
descriptor, so let's keep it consistent and use the MaxPacketSize from
the endpoint's descriptor instead.
Signed-off-by: NThinh Nguyen <thinhn@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

dwc3_ep_dequeue() waits for completion of End Transfer command using
wait_event_lock_irq(), which will release the dwc3->lock while waiting
and reacquire after completion. This allows a potential race condition
with ep_disable() which also removes all requests from started_list
and pending_list.

The check for NULL r->trb should catch this but currently it exits to
the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its
list entry was already removed, if CONFIG_DEBUG_LIST is enabled a
'list_del corruption' bug is thrown since its next/prev pointers are
already LIST_POISON1/2. If r->trb is NULL it should simply exit to
'out0'.

Fixes: cf3113d8 ("usb: dwc3: gadget: properly increment dequeue pointer on ep_dequeue")
Cc: stable@vger.kernel.org # v4.12+
Signed-off-by: NMayank Rana <mrana@codeaurora.org>
Signed-off-by: NJack Pham <jackp@codeaurora.org>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Fixes the following sparse warning:

drivers/usb/dwc3/gadget.c:169:6: warning:
 symbol 'dwc3_gadget_del_and_unmap_request' was not declared. Should it be static?
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We dont' need to touch req->direction or req->epnum from
ep_queue(). It's enough that we initialize both fields from
alloc_request() and just keep them for the entire lifetime of the
request.

No functional changes.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Instead of *always* calling dwc3_gadget_ep_get_transfer_index() after
sending a Start Transfer command, we can call it once from
dwc3_send_gadget_ep_cmd() itself.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Instead of returning resource index number just to assign it to a
field inside 'dep' which was passed as argument, we can assing
dep->resource_index from inside dwc3_gadget_ep_get_transfer_index()
itself.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We will *always* start transfer to the next uFrame number aligned to
dep->interval.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In case we have many started requests and one of them in the middle is
completed with Missed Isoc, let's not End Transfer as that would
result in us loosing (possibly) many more intervals.

Instead, let's allow the controller to go through its list of started
requests.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Avoid a prototype when the function can be defined earlier. No
functional changes, cleanup only.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Instead of having a prototype for a function that's defined a few
lines down, let's just move definition to the place where prototype
was.

No functional changes, cleanup only.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In a few places, the argument is completely unnecessary. On places
where it's needed, we can get it from dep->dwc.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Those two arguments refer to a single bitfield in the register. In
order to simplify the code, we can combine them into a single argument
and expect caller to pass the correct action argument at all times.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This just makes it slightly easier to read. No functional changes.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

No functional changes, it just makes the code slightly easier to read.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Code is just as readable without it.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We can declare it inside list_for_each_entry_safe() loop and reduce
its scope.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Misc cleanup. No functional changes.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We will only have event status of IOC when IOC bit is set in
TRB. There's no need to check both bits.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We know that only OUT endpoints can trigger SHORT. We also know that
count MUST be > 0 whenever SHORT triggers.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We can just call reclaim_trb_linear instead of reimplementing it.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Minor cleanup, no functional changes.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We are trying to kick transfers on Isochronous endpoints in a more
controlled manner now. And this ended up rendering this piece of code
unnecessary.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

instead of having one big loop, let's split it down into two smaller
handlers: one for linear buffers and one for scatterlist.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Just a minor simplification, no functional changes.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

After all the previous changes, it's now a lot clearer how isoc
transfers should be managed. We don't need to try to End Transfers
from ep_queue since that's already done by cleanup_requests.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Now, this part of the code is duplicated and brings no extra value to
the driver. Let's remove it.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In case we get an event with status set to Missed Isoc, this means we
have missed an isochronous interval and should issue End Transfer
command and wait for the following XferNotReady.

Let's do that early, rather than late.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

It's only written to, never read. We can remove it now.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>