xref: /linux/drivers/usb/musb/musb_gadget.c (revision 4413e16d9d21673bb5048a2e542f1aaa00015c2e)
1 /*
2  * MUSB OTG driver peripheral support
3  *
4  * Copyright 2005 Mentor Graphics Corporation
5  * Copyright (C) 2005-2006 by Texas Instruments
6  * Copyright (C) 2006-2007 Nokia Corporation
7  * Copyright (C) 2009 MontaVista Software, Inc. <source@mvista.com>
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License
11  * version 2 as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful, but
14  * WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
21  * 02110-1301 USA
22  *
23  * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
24  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
26  * NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
29  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
30  * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <linux/kernel.h>
37 #include <linux/list.h>
38 #include <linux/timer.h>
39 #include <linux/module.h>
40 #include <linux/smp.h>
41 #include <linux/spinlock.h>
42 #include <linux/delay.h>
43 #include <linux/dma-mapping.h>
44 #include <linux/slab.h>
45 
46 #include "musb_core.h"
47 
48 
49 /* MUSB PERIPHERAL status 3-mar-2006:
50  *
51  * - EP0 seems solid.  It passes both USBCV and usbtest control cases.
52  *   Minor glitches:
53  *
54  *     + remote wakeup to Linux hosts work, but saw USBCV failures;
55  *       in one test run (operator error?)
56  *     + endpoint halt tests -- in both usbtest and usbcv -- seem
57  *       to break when dma is enabled ... is something wrongly
58  *       clearing SENDSTALL?
59  *
60  * - Mass storage behaved ok when last tested.  Network traffic patterns
61  *   (with lots of short transfers etc) need retesting; they turn up the
62  *   worst cases of the DMA, since short packets are typical but are not
63  *   required.
64  *
65  * - TX/IN
66  *     + both pio and dma behave in with network and g_zero tests
67  *     + no cppi throughput issues other than no-hw-queueing
68  *     + failed with FLAT_REG (DaVinci)
69  *     + seems to behave with double buffering, PIO -and- CPPI
70  *     + with gadgetfs + AIO, requests got lost?
71  *
72  * - RX/OUT
73  *     + both pio and dma behave in with network and g_zero tests
74  *     + dma is slow in typical case (short_not_ok is clear)
75  *     + double buffering ok with PIO
76  *     + double buffering *FAILS* with CPPI, wrong data bytes sometimes
77  *     + request lossage observed with gadgetfs
78  *
79  * - ISO not tested ... might work, but only weakly isochronous
80  *
81  * - Gadget driver disabling of softconnect during bind() is ignored; so
82  *   drivers can't hold off host requests until userspace is ready.
83  *   (Workaround:  they can turn it off later.)
84  *
85  * - PORTABILITY (assumes PIO works):
86  *     + DaVinci, basically works with cppi dma
87  *     + OMAP 2430, ditto with mentor dma
88  *     + TUSB 6010, platform-specific dma in the works
89  */
90 
91 /* ----------------------------------------------------------------------- */
92 
93 #define is_buffer_mapped(req) (is_dma_capable() && \
94 					(req->map_state != UN_MAPPED))
95 
96 /* Maps the buffer to dma  */
97 
98 static inline void map_dma_buffer(struct musb_request *request,
99 			struct musb *musb, struct musb_ep *musb_ep)
100 {
101 	int compatible = true;
102 	struct dma_controller *dma = musb->dma_controller;
103 
104 	request->map_state = UN_MAPPED;
105 
106 	if (!is_dma_capable() || !musb_ep->dma)
107 		return;
108 
109 	/* Check if DMA engine can handle this request.
110 	 * DMA code must reject the USB request explicitly.
111 	 * Default behaviour is to map the request.
112 	 */
113 	if (dma->is_compatible)
114 		compatible = dma->is_compatible(musb_ep->dma,
115 				musb_ep->packet_sz, request->request.buf,
116 				request->request.length);
117 	if (!compatible)
118 		return;
119 
120 	if (request->request.dma == DMA_ADDR_INVALID) {
121 		request->request.dma = dma_map_single(
122 				musb->controller,
123 				request->request.buf,
124 				request->request.length,
125 				request->tx
126 					? DMA_TO_DEVICE
127 					: DMA_FROM_DEVICE);
128 		request->map_state = MUSB_MAPPED;
129 	} else {
130 		dma_sync_single_for_device(musb->controller,
131 			request->request.dma,
132 			request->request.length,
133 			request->tx
134 				? DMA_TO_DEVICE
135 				: DMA_FROM_DEVICE);
136 		request->map_state = PRE_MAPPED;
137 	}
138 }
139 
140 /* Unmap the buffer from dma and maps it back to cpu */
141 static inline void unmap_dma_buffer(struct musb_request *request,
142 				struct musb *musb)
143 {
144 	if (!is_buffer_mapped(request))
145 		return;
146 
147 	if (request->request.dma == DMA_ADDR_INVALID) {
148 		dev_vdbg(musb->controller,
149 				"not unmapping a never mapped buffer\n");
150 		return;
151 	}
152 	if (request->map_state == MUSB_MAPPED) {
153 		dma_unmap_single(musb->controller,
154 			request->request.dma,
155 			request->request.length,
156 			request->tx
157 				? DMA_TO_DEVICE
158 				: DMA_FROM_DEVICE);
159 		request->request.dma = DMA_ADDR_INVALID;
160 	} else { /* PRE_MAPPED */
161 		dma_sync_single_for_cpu(musb->controller,
162 			request->request.dma,
163 			request->request.length,
164 			request->tx
165 				? DMA_TO_DEVICE
166 				: DMA_FROM_DEVICE);
167 	}
168 	request->map_state = UN_MAPPED;
169 }
170 
171 /*
172  * Immediately complete a request.
173  *
174  * @param request the request to complete
175  * @param status the status to complete the request with
176  * Context: controller locked, IRQs blocked.
177  */
178 void musb_g_giveback(
179 	struct musb_ep		*ep,
180 	struct usb_request	*request,
181 	int			status)
182 __releases(ep->musb->lock)
183 __acquires(ep->musb->lock)
184 {
185 	struct musb_request	*req;
186 	struct musb		*musb;
187 	int			busy = ep->busy;
188 
189 	req = to_musb_request(request);
190 
191 	list_del(&req->list);
192 	if (req->request.status == -EINPROGRESS)
193 		req->request.status = status;
194 	musb = req->musb;
195 
196 	ep->busy = 1;
197 	spin_unlock(&musb->lock);
198 	unmap_dma_buffer(req, musb);
199 	if (request->status == 0)
200 		dev_dbg(musb->controller, "%s done request %p,  %d/%d\n",
201 				ep->end_point.name, request,
202 				req->request.actual, req->request.length);
203 	else
204 		dev_dbg(musb->controller, "%s request %p, %d/%d fault %d\n",
205 				ep->end_point.name, request,
206 				req->request.actual, req->request.length,
207 				request->status);
208 	req->request.complete(&req->ep->end_point, &req->request);
209 	spin_lock(&musb->lock);
210 	ep->busy = busy;
211 }
212 
213 /* ----------------------------------------------------------------------- */
214 
215 /*
216  * Abort requests queued to an endpoint using the status. Synchronous.
217  * caller locked controller and blocked irqs, and selected this ep.
218  */
219 static void nuke(struct musb_ep *ep, const int status)
220 {
221 	struct musb		*musb = ep->musb;
222 	struct musb_request	*req = NULL;
223 	void __iomem *epio = ep->musb->endpoints[ep->current_epnum].regs;
224 
225 	ep->busy = 1;
226 
227 	if (is_dma_capable() && ep->dma) {
228 		struct dma_controller	*c = ep->musb->dma_controller;
229 		int value;
230 
231 		if (ep->is_in) {
232 			/*
233 			 * The programming guide says that we must not clear
234 			 * the DMAMODE bit before DMAENAB, so we only
235 			 * clear it in the second write...
236 			 */
237 			musb_writew(epio, MUSB_TXCSR,
238 				    MUSB_TXCSR_DMAMODE | MUSB_TXCSR_FLUSHFIFO);
239 			musb_writew(epio, MUSB_TXCSR,
240 					0 | MUSB_TXCSR_FLUSHFIFO);
241 		} else {
242 			musb_writew(epio, MUSB_RXCSR,
243 					0 | MUSB_RXCSR_FLUSHFIFO);
244 			musb_writew(epio, MUSB_RXCSR,
245 					0 | MUSB_RXCSR_FLUSHFIFO);
246 		}
247 
248 		value = c->channel_abort(ep->dma);
249 		dev_dbg(musb->controller, "%s: abort DMA --> %d\n",
250 				ep->name, value);
251 		c->channel_release(ep->dma);
252 		ep->dma = NULL;
253 	}
254 
255 	while (!list_empty(&ep->req_list)) {
256 		req = list_first_entry(&ep->req_list, struct musb_request, list);
257 		musb_g_giveback(ep, &req->request, status);
258 	}
259 }
260 
261 /* ----------------------------------------------------------------------- */
262 
263 /* Data transfers - pure PIO, pure DMA, or mixed mode */
264 
265 /*
266  * This assumes the separate CPPI engine is responding to DMA requests
267  * from the usb core ... sequenced a bit differently from mentor dma.
268  */
269 
270 static inline int max_ep_writesize(struct musb *musb, struct musb_ep *ep)
271 {
272 	if (can_bulk_split(musb, ep->type))
273 		return ep->hw_ep->max_packet_sz_tx;
274 	else
275 		return ep->packet_sz;
276 }
277 
278 
279 #ifdef CONFIG_USB_INVENTRA_DMA
280 
281 /* Peripheral tx (IN) using Mentor DMA works as follows:
282 	Only mode 0 is used for transfers <= wPktSize,
283 	mode 1 is used for larger transfers,
284 
285 	One of the following happens:
286 	- Host sends IN token which causes an endpoint interrupt
287 		-> TxAvail
288 			-> if DMA is currently busy, exit.
289 			-> if queue is non-empty, txstate().
290 
291 	- Request is queued by the gadget driver.
292 		-> if queue was previously empty, txstate()
293 
294 	txstate()
295 		-> start
296 		  /\	-> setup DMA
297 		  |     (data is transferred to the FIFO, then sent out when
298 		  |	IN token(s) are recd from Host.
299 		  |		-> DMA interrupt on completion
300 		  |		   calls TxAvail.
301 		  |		      -> stop DMA, ~DMAENAB,
302 		  |		      -> set TxPktRdy for last short pkt or zlp
303 		  |		      -> Complete Request
304 		  |		      -> Continue next request (call txstate)
305 		  |___________________________________|
306 
307  * Non-Mentor DMA engines can of course work differently, such as by
308  * upleveling from irq-per-packet to irq-per-buffer.
309  */
310 
311 #endif
312 
313 /*
314  * An endpoint is transmitting data. This can be called either from
315  * the IRQ routine or from ep.queue() to kickstart a request on an
316  * endpoint.
317  *
318  * Context: controller locked, IRQs blocked, endpoint selected
319  */
320 static void txstate(struct musb *musb, struct musb_request *req)
321 {
322 	u8			epnum = req->epnum;
323 	struct musb_ep		*musb_ep;
324 	void __iomem		*epio = musb->endpoints[epnum].regs;
325 	struct usb_request	*request;
326 	u16			fifo_count = 0, csr;
327 	int			use_dma = 0;
328 
329 	musb_ep = req->ep;
330 
331 	/* Check if EP is disabled */
332 	if (!musb_ep->desc) {
333 		dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
334 						musb_ep->end_point.name);
335 		return;
336 	}
337 
338 	/* we shouldn't get here while DMA is active ... but we do ... */
339 	if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
340 		dev_dbg(musb->controller, "dma pending...\n");
341 		return;
342 	}
343 
344 	/* read TXCSR before */
345 	csr = musb_readw(epio, MUSB_TXCSR);
346 
347 	request = &req->request;
348 	fifo_count = min(max_ep_writesize(musb, musb_ep),
349 			(int)(request->length - request->actual));
350 
351 	if (csr & MUSB_TXCSR_TXPKTRDY) {
352 		dev_dbg(musb->controller, "%s old packet still ready , txcsr %03x\n",
353 				musb_ep->end_point.name, csr);
354 		return;
355 	}
356 
357 	if (csr & MUSB_TXCSR_P_SENDSTALL) {
358 		dev_dbg(musb->controller, "%s stalling, txcsr %03x\n",
359 				musb_ep->end_point.name, csr);
360 		return;
361 	}
362 
363 	dev_dbg(musb->controller, "hw_ep%d, maxpacket %d, fifo count %d, txcsr %03x\n",
364 			epnum, musb_ep->packet_sz, fifo_count,
365 			csr);
366 
367 #ifndef	CONFIG_MUSB_PIO_ONLY
368 	if (is_buffer_mapped(req)) {
369 		struct dma_controller	*c = musb->dma_controller;
370 		size_t request_size;
371 
372 		/* setup DMA, then program endpoint CSR */
373 		request_size = min_t(size_t, request->length - request->actual,
374 					musb_ep->dma->max_len);
375 
376 		use_dma = (request->dma != DMA_ADDR_INVALID && request_size);
377 
378 		/* MUSB_TXCSR_P_ISO is still set correctly */
379 
380 #if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_UX500_DMA)
381 		{
382 			if (request_size < musb_ep->packet_sz)
383 				musb_ep->dma->desired_mode = 0;
384 			else
385 				musb_ep->dma->desired_mode = 1;
386 
387 			use_dma = use_dma && c->channel_program(
388 					musb_ep->dma, musb_ep->packet_sz,
389 					musb_ep->dma->desired_mode,
390 					request->dma + request->actual, request_size);
391 			if (use_dma) {
392 				if (musb_ep->dma->desired_mode == 0) {
393 					/*
394 					 * We must not clear the DMAMODE bit
395 					 * before the DMAENAB bit -- and the
396 					 * latter doesn't always get cleared
397 					 * before we get here...
398 					 */
399 					csr &= ~(MUSB_TXCSR_AUTOSET
400 						| MUSB_TXCSR_DMAENAB);
401 					musb_writew(epio, MUSB_TXCSR, csr
402 						| MUSB_TXCSR_P_WZC_BITS);
403 					csr &= ~MUSB_TXCSR_DMAMODE;
404 					csr |= (MUSB_TXCSR_DMAENAB |
405 							MUSB_TXCSR_MODE);
406 					/* against programming guide */
407 				} else {
408 					csr |= (MUSB_TXCSR_DMAENAB
409 							| MUSB_TXCSR_DMAMODE
410 							| MUSB_TXCSR_MODE);
411 					if (!musb_ep->hb_mult)
412 						csr |= MUSB_TXCSR_AUTOSET;
413 				}
414 				csr &= ~MUSB_TXCSR_P_UNDERRUN;
415 
416 				musb_writew(epio, MUSB_TXCSR, csr);
417 			}
418 		}
419 
420 #elif defined(CONFIG_USB_TI_CPPI_DMA)
421 		/* program endpoint CSR first, then setup DMA */
422 		csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
423 		csr |= MUSB_TXCSR_DMAENAB | MUSB_TXCSR_DMAMODE |
424 		       MUSB_TXCSR_MODE;
425 		musb_writew(epio, MUSB_TXCSR,
426 			(MUSB_TXCSR_P_WZC_BITS & ~MUSB_TXCSR_P_UNDERRUN)
427 				| csr);
428 
429 		/* ensure writebuffer is empty */
430 		csr = musb_readw(epio, MUSB_TXCSR);
431 
432 		/* NOTE host side sets DMAENAB later than this; both are
433 		 * OK since the transfer dma glue (between CPPI and Mentor
434 		 * fifos) just tells CPPI it could start.  Data only moves
435 		 * to the USB TX fifo when both fifos are ready.
436 		 */
437 
438 		/* "mode" is irrelevant here; handle terminating ZLPs like
439 		 * PIO does, since the hardware RNDIS mode seems unreliable
440 		 * except for the last-packet-is-already-short case.
441 		 */
442 		use_dma = use_dma && c->channel_program(
443 				musb_ep->dma, musb_ep->packet_sz,
444 				0,
445 				request->dma + request->actual,
446 				request_size);
447 		if (!use_dma) {
448 			c->channel_release(musb_ep->dma);
449 			musb_ep->dma = NULL;
450 			csr &= ~MUSB_TXCSR_DMAENAB;
451 			musb_writew(epio, MUSB_TXCSR, csr);
452 			/* invariant: prequest->buf is non-null */
453 		}
454 #elif defined(CONFIG_USB_TUSB_OMAP_DMA)
455 		use_dma = use_dma && c->channel_program(
456 				musb_ep->dma, musb_ep->packet_sz,
457 				request->zero,
458 				request->dma + request->actual,
459 				request_size);
460 #endif
461 	}
462 #endif
463 
464 	if (!use_dma) {
465 		/*
466 		 * Unmap the dma buffer back to cpu if dma channel
467 		 * programming fails
468 		 */
469 		unmap_dma_buffer(req, musb);
470 
471 		musb_write_fifo(musb_ep->hw_ep, fifo_count,
472 				(u8 *) (request->buf + request->actual));
473 		request->actual += fifo_count;
474 		csr |= MUSB_TXCSR_TXPKTRDY;
475 		csr &= ~MUSB_TXCSR_P_UNDERRUN;
476 		musb_writew(epio, MUSB_TXCSR, csr);
477 	}
478 
479 	/* host may already have the data when this message shows... */
480 	dev_dbg(musb->controller, "%s TX/IN %s len %d/%d, txcsr %04x, fifo %d/%d\n",
481 			musb_ep->end_point.name, use_dma ? "dma" : "pio",
482 			request->actual, request->length,
483 			musb_readw(epio, MUSB_TXCSR),
484 			fifo_count,
485 			musb_readw(epio, MUSB_TXMAXP));
486 }
487 
488 /*
489  * FIFO state update (e.g. data ready).
490  * Called from IRQ,  with controller locked.
491  */
492 void musb_g_tx(struct musb *musb, u8 epnum)
493 {
494 	u16			csr;
495 	struct musb_request	*req;
496 	struct usb_request	*request;
497 	u8 __iomem		*mbase = musb->mregs;
498 	struct musb_ep		*musb_ep = &musb->endpoints[epnum].ep_in;
499 	void __iomem		*epio = musb->endpoints[epnum].regs;
500 	struct dma_channel	*dma;
501 
502 	musb_ep_select(mbase, epnum);
503 	req = next_request(musb_ep);
504 	request = &req->request;
505 
506 	csr = musb_readw(epio, MUSB_TXCSR);
507 	dev_dbg(musb->controller, "<== %s, txcsr %04x\n", musb_ep->end_point.name, csr);
508 
509 	dma = is_dma_capable() ? musb_ep->dma : NULL;
510 
511 	/*
512 	 * REVISIT: for high bandwidth, MUSB_TXCSR_P_INCOMPTX
513 	 * probably rates reporting as a host error.
514 	 */
515 	if (csr & MUSB_TXCSR_P_SENTSTALL) {
516 		csr |=	MUSB_TXCSR_P_WZC_BITS;
517 		csr &= ~MUSB_TXCSR_P_SENTSTALL;
518 		musb_writew(epio, MUSB_TXCSR, csr);
519 		return;
520 	}
521 
522 	if (csr & MUSB_TXCSR_P_UNDERRUN) {
523 		/* We NAKed, no big deal... little reason to care. */
524 		csr |=	 MUSB_TXCSR_P_WZC_BITS;
525 		csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
526 		musb_writew(epio, MUSB_TXCSR, csr);
527 		dev_vdbg(musb->controller, "underrun on ep%d, req %p\n",
528 				epnum, request);
529 	}
530 
531 	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
532 		/*
533 		 * SHOULD NOT HAPPEN... has with CPPI though, after
534 		 * changing SENDSTALL (and other cases); harmless?
535 		 */
536 		dev_dbg(musb->controller, "%s dma still busy?\n", musb_ep->end_point.name);
537 		return;
538 	}
539 
540 	if (request) {
541 		u8	is_dma = 0;
542 
543 		if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
544 			is_dma = 1;
545 			csr |= MUSB_TXCSR_P_WZC_BITS;
546 			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
547 				 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
548 			musb_writew(epio, MUSB_TXCSR, csr);
549 			/* Ensure writebuffer is empty. */
550 			csr = musb_readw(epio, MUSB_TXCSR);
551 			request->actual += musb_ep->dma->actual_len;
552 			dev_dbg(musb->controller, "TXCSR%d %04x, DMA off, len %zu, req %p\n",
553 				epnum, csr, musb_ep->dma->actual_len, request);
554 		}
555 
556 		/*
557 		 * First, maybe a terminating short packet. Some DMA
558 		 * engines might handle this by themselves.
559 		 */
560 		if ((request->zero && request->length
561 			&& (request->length % musb_ep->packet_sz == 0)
562 			&& (request->actual == request->length))
563 #if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_UX500_DMA)
564 			|| (is_dma && (!dma->desired_mode ||
565 				(request->actual &
566 					(musb_ep->packet_sz - 1))))
567 #endif
568 		) {
569 			/*
570 			 * On DMA completion, FIFO may not be
571 			 * available yet...
572 			 */
573 			if (csr & MUSB_TXCSR_TXPKTRDY)
574 				return;
575 
576 			dev_dbg(musb->controller, "sending zero pkt\n");
577 			musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_MODE
578 					| MUSB_TXCSR_TXPKTRDY);
579 			request->zero = 0;
580 		}
581 
582 		if (request->actual == request->length) {
583 			musb_g_giveback(musb_ep, request, 0);
584 			/*
585 			 * In the giveback function the MUSB lock is
586 			 * released and acquired after sometime. During
587 			 * this time period the INDEX register could get
588 			 * changed by the gadget_queue function especially
589 			 * on SMP systems. Reselect the INDEX to be sure
590 			 * we are reading/modifying the right registers
591 			 */
592 			musb_ep_select(mbase, epnum);
593 			req = musb_ep->desc ? next_request(musb_ep) : NULL;
594 			if (!req) {
595 				dev_dbg(musb->controller, "%s idle now\n",
596 					musb_ep->end_point.name);
597 				return;
598 			}
599 		}
600 
601 		txstate(musb, req);
602 	}
603 }
604 
605 /* ------------------------------------------------------------ */
606 
607 #ifdef CONFIG_USB_INVENTRA_DMA
608 
609 /* Peripheral rx (OUT) using Mentor DMA works as follows:
610 	- Only mode 0 is used.
611 
612 	- Request is queued by the gadget class driver.
613 		-> if queue was previously empty, rxstate()
614 
615 	- Host sends OUT token which causes an endpoint interrupt
616 	  /\      -> RxReady
617 	  |	      -> if request queued, call rxstate
618 	  |		/\	-> setup DMA
619 	  |		|	     -> DMA interrupt on completion
620 	  |		|		-> RxReady
621 	  |		|		      -> stop DMA
622 	  |		|		      -> ack the read
623 	  |		|		      -> if data recd = max expected
624 	  |		|				by the request, or host
625 	  |		|				sent a short packet,
626 	  |		|				complete the request,
627 	  |		|				and start the next one.
628 	  |		|_____________________________________|
629 	  |					 else just wait for the host
630 	  |					    to send the next OUT token.
631 	  |__________________________________________________|
632 
633  * Non-Mentor DMA engines can of course work differently.
634  */
635 
636 #endif
637 
638 /*
639  * Context: controller locked, IRQs blocked, endpoint selected
640  */
641 static void rxstate(struct musb *musb, struct musb_request *req)
642 {
643 	const u8		epnum = req->epnum;
644 	struct usb_request	*request = &req->request;
645 	struct musb_ep		*musb_ep;
646 	void __iomem		*epio = musb->endpoints[epnum].regs;
647 	unsigned		len = 0;
648 	u16			fifo_count;
649 	u16			csr = musb_readw(epio, MUSB_RXCSR);
650 	struct musb_hw_ep	*hw_ep = &musb->endpoints[epnum];
651 	u8			use_mode_1;
652 
653 	if (hw_ep->is_shared_fifo)
654 		musb_ep = &hw_ep->ep_in;
655 	else
656 		musb_ep = &hw_ep->ep_out;
657 
658 	fifo_count = musb_ep->packet_sz;
659 
660 	/* Check if EP is disabled */
661 	if (!musb_ep->desc) {
662 		dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
663 						musb_ep->end_point.name);
664 		return;
665 	}
666 
667 	/* We shouldn't get here while DMA is active, but we do... */
668 	if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
669 		dev_dbg(musb->controller, "DMA pending...\n");
670 		return;
671 	}
672 
673 	if (csr & MUSB_RXCSR_P_SENDSTALL) {
674 		dev_dbg(musb->controller, "%s stalling, RXCSR %04x\n",
675 		    musb_ep->end_point.name, csr);
676 		return;
677 	}
678 
679 	if (is_cppi_enabled() && is_buffer_mapped(req)) {
680 		struct dma_controller	*c = musb->dma_controller;
681 		struct dma_channel	*channel = musb_ep->dma;
682 
683 		/* NOTE:  CPPI won't actually stop advancing the DMA
684 		 * queue after short packet transfers, so this is almost
685 		 * always going to run as IRQ-per-packet DMA so that
686 		 * faults will be handled correctly.
687 		 */
688 		if (c->channel_program(channel,
689 				musb_ep->packet_sz,
690 				!request->short_not_ok,
691 				request->dma + request->actual,
692 				request->length - request->actual)) {
693 
694 			/* make sure that if an rxpkt arrived after the irq,
695 			 * the cppi engine will be ready to take it as soon
696 			 * as DMA is enabled
697 			 */
698 			csr &= ~(MUSB_RXCSR_AUTOCLEAR
699 					| MUSB_RXCSR_DMAMODE);
700 			csr |= MUSB_RXCSR_DMAENAB | MUSB_RXCSR_P_WZC_BITS;
701 			musb_writew(epio, MUSB_RXCSR, csr);
702 			return;
703 		}
704 	}
705 
706 	if (csr & MUSB_RXCSR_RXPKTRDY) {
707 		fifo_count = musb_readw(epio, MUSB_RXCOUNT);
708 
709 		/*
710 		 *  use mode 1 only if we expect data of at least ep packet_sz
711 		 *  and have not yet received a short packet
712 		 */
713 		if ((request->length - request->actual >= musb_ep->packet_sz) &&
714 			(fifo_count >= musb_ep->packet_sz))
715 			use_mode_1 = 1;
716 		else
717 			use_mode_1 = 0;
718 
719 		if (request->actual < request->length) {
720 #ifdef CONFIG_USB_INVENTRA_DMA
721 			if (is_buffer_mapped(req)) {
722 				struct dma_controller	*c;
723 				struct dma_channel	*channel;
724 				int			use_dma = 0;
725 				int transfer_size;
726 
727 				c = musb->dma_controller;
728 				channel = musb_ep->dma;
729 
730 				/* Experimental: Mode1 works with mass storage use cases */
731 				if (use_mode_1) {
732 					csr |= MUSB_RXCSR_AUTOCLEAR;
733 					musb_writew(epio, MUSB_RXCSR, csr);
734 					csr |= MUSB_RXCSR_DMAENAB;
735 					musb_writew(epio, MUSB_RXCSR, csr);
736 
737 					/*
738 					 * this special sequence (enabling and then
739 					 * disabling MUSB_RXCSR_DMAMODE) is required
740 					 * to get DMAReq to activate
741 					 */
742 					musb_writew(epio, MUSB_RXCSR,
743 						csr | MUSB_RXCSR_DMAMODE);
744 					musb_writew(epio, MUSB_RXCSR, csr);
745 
746 					transfer_size = min(request->length - request->actual,
747 							channel->max_len);
748 					musb_ep->dma->desired_mode = 1;
749 
750 				} else {
751 					if (!musb_ep->hb_mult &&
752 						musb_ep->hw_ep->rx_double_buffered)
753 						csr |= MUSB_RXCSR_AUTOCLEAR;
754 					csr |= MUSB_RXCSR_DMAENAB;
755 					musb_writew(epio, MUSB_RXCSR, csr);
756 
757 					transfer_size = min(request->length - request->actual,
758 							(unsigned)fifo_count);
759 					musb_ep->dma->desired_mode = 0;
760 				}
761 
762 				use_dma = c->channel_program(
763 						channel,
764 						musb_ep->packet_sz,
765 						channel->desired_mode,
766 						request->dma
767 						+ request->actual,
768 						transfer_size);
769 
770 				if (use_dma)
771 					return;
772 			}
773 #elif defined(CONFIG_USB_UX500_DMA)
774 			if ((is_buffer_mapped(req)) &&
775 				(request->actual < request->length)) {
776 
777 				struct dma_controller *c;
778 				struct dma_channel *channel;
779 				int transfer_size = 0;
780 
781 				c = musb->dma_controller;
782 				channel = musb_ep->dma;
783 
784 				/* In case first packet is short */
785 				if (fifo_count < musb_ep->packet_sz)
786 					transfer_size = fifo_count;
787 				else if (request->short_not_ok)
788 					transfer_size =	min(request->length -
789 							request->actual,
790 							channel->max_len);
791 				else
792 					transfer_size = min(request->length -
793 							request->actual,
794 							(unsigned)fifo_count);
795 
796 				csr &= ~MUSB_RXCSR_DMAMODE;
797 				csr |= (MUSB_RXCSR_DMAENAB |
798 					MUSB_RXCSR_AUTOCLEAR);
799 
800 				musb_writew(epio, MUSB_RXCSR, csr);
801 
802 				if (transfer_size <= musb_ep->packet_sz) {
803 					musb_ep->dma->desired_mode = 0;
804 				} else {
805 					musb_ep->dma->desired_mode = 1;
806 					/* Mode must be set after DMAENAB */
807 					csr |= MUSB_RXCSR_DMAMODE;
808 					musb_writew(epio, MUSB_RXCSR, csr);
809 				}
810 
811 				if (c->channel_program(channel,
812 							musb_ep->packet_sz,
813 							channel->desired_mode,
814 							request->dma
815 							+ request->actual,
816 							transfer_size))
817 
818 					return;
819 			}
820 #endif	/* Mentor's DMA */
821 
822 			len = request->length - request->actual;
823 			dev_dbg(musb->controller, "%s OUT/RX pio fifo %d/%d, maxpacket %d\n",
824 					musb_ep->end_point.name,
825 					fifo_count, len,
826 					musb_ep->packet_sz);
827 
828 			fifo_count = min_t(unsigned, len, fifo_count);
829 
830 #ifdef	CONFIG_USB_TUSB_OMAP_DMA
831 			if (tusb_dma_omap() && is_buffer_mapped(req)) {
832 				struct dma_controller *c = musb->dma_controller;
833 				struct dma_channel *channel = musb_ep->dma;
834 				u32 dma_addr = request->dma + request->actual;
835 				int ret;
836 
837 				ret = c->channel_program(channel,
838 						musb_ep->packet_sz,
839 						channel->desired_mode,
840 						dma_addr,
841 						fifo_count);
842 				if (ret)
843 					return;
844 			}
845 #endif
846 			/*
847 			 * Unmap the dma buffer back to cpu if dma channel
848 			 * programming fails. This buffer is mapped if the
849 			 * channel allocation is successful
850 			 */
851 			 if (is_buffer_mapped(req)) {
852 				unmap_dma_buffer(req, musb);
853 
854 				/*
855 				 * Clear DMAENAB and AUTOCLEAR for the
856 				 * PIO mode transfer
857 				 */
858 				csr &= ~(MUSB_RXCSR_DMAENAB | MUSB_RXCSR_AUTOCLEAR);
859 				musb_writew(epio, MUSB_RXCSR, csr);
860 			}
861 
862 			musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
863 					(request->buf + request->actual));
864 			request->actual += fifo_count;
865 
866 			/* REVISIT if we left anything in the fifo, flush
867 			 * it and report -EOVERFLOW
868 			 */
869 
870 			/* ack the read! */
871 			csr |= MUSB_RXCSR_P_WZC_BITS;
872 			csr &= ~MUSB_RXCSR_RXPKTRDY;
873 			musb_writew(epio, MUSB_RXCSR, csr);
874 		}
875 	}
876 
877 	/* reach the end or short packet detected */
878 	if (request->actual == request->length ||
879 	    fifo_count < musb_ep->packet_sz)
880 		musb_g_giveback(musb_ep, request, 0);
881 }
882 
883 /*
884  * Data ready for a request; called from IRQ
885  */
886 void musb_g_rx(struct musb *musb, u8 epnum)
887 {
888 	u16			csr;
889 	struct musb_request	*req;
890 	struct usb_request	*request;
891 	void __iomem		*mbase = musb->mregs;
892 	struct musb_ep		*musb_ep;
893 	void __iomem		*epio = musb->endpoints[epnum].regs;
894 	struct dma_channel	*dma;
895 	struct musb_hw_ep	*hw_ep = &musb->endpoints[epnum];
896 
897 	if (hw_ep->is_shared_fifo)
898 		musb_ep = &hw_ep->ep_in;
899 	else
900 		musb_ep = &hw_ep->ep_out;
901 
902 	musb_ep_select(mbase, epnum);
903 
904 	req = next_request(musb_ep);
905 	if (!req)
906 		return;
907 
908 	request = &req->request;
909 
910 	csr = musb_readw(epio, MUSB_RXCSR);
911 	dma = is_dma_capable() ? musb_ep->dma : NULL;
912 
913 	dev_dbg(musb->controller, "<== %s, rxcsr %04x%s %p\n", musb_ep->end_point.name,
914 			csr, dma ? " (dma)" : "", request);
915 
916 	if (csr & MUSB_RXCSR_P_SENTSTALL) {
917 		csr |= MUSB_RXCSR_P_WZC_BITS;
918 		csr &= ~MUSB_RXCSR_P_SENTSTALL;
919 		musb_writew(epio, MUSB_RXCSR, csr);
920 		return;
921 	}
922 
923 	if (csr & MUSB_RXCSR_P_OVERRUN) {
924 		/* csr |= MUSB_RXCSR_P_WZC_BITS; */
925 		csr &= ~MUSB_RXCSR_P_OVERRUN;
926 		musb_writew(epio, MUSB_RXCSR, csr);
927 
928 		dev_dbg(musb->controller, "%s iso overrun on %p\n", musb_ep->name, request);
929 		if (request->status == -EINPROGRESS)
930 			request->status = -EOVERFLOW;
931 	}
932 	if (csr & MUSB_RXCSR_INCOMPRX) {
933 		/* REVISIT not necessarily an error */
934 		dev_dbg(musb->controller, "%s, incomprx\n", musb_ep->end_point.name);
935 	}
936 
937 	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
938 		/* "should not happen"; likely RXPKTRDY pending for DMA */
939 		dev_dbg(musb->controller, "%s busy, csr %04x\n",
940 			musb_ep->end_point.name, csr);
941 		return;
942 	}
943 
944 	if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
945 		csr &= ~(MUSB_RXCSR_AUTOCLEAR
946 				| MUSB_RXCSR_DMAENAB
947 				| MUSB_RXCSR_DMAMODE);
948 		musb_writew(epio, MUSB_RXCSR,
949 			MUSB_RXCSR_P_WZC_BITS | csr);
950 
951 		request->actual += musb_ep->dma->actual_len;
952 
953 		dev_dbg(musb->controller, "RXCSR%d %04x, dma off, %04x, len %zu, req %p\n",
954 			epnum, csr,
955 			musb_readw(epio, MUSB_RXCSR),
956 			musb_ep->dma->actual_len, request);
957 
958 #if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_TUSB_OMAP_DMA) || \
959 	defined(CONFIG_USB_UX500_DMA)
960 		/* Autoclear doesn't clear RxPktRdy for short packets */
961 		if ((dma->desired_mode == 0 && !hw_ep->rx_double_buffered)
962 				|| (dma->actual_len
963 					& (musb_ep->packet_sz - 1))) {
964 			/* ack the read! */
965 			csr &= ~MUSB_RXCSR_RXPKTRDY;
966 			musb_writew(epio, MUSB_RXCSR, csr);
967 		}
968 
969 		/* incomplete, and not short? wait for next IN packet */
970 		if ((request->actual < request->length)
971 				&& (musb_ep->dma->actual_len
972 					== musb_ep->packet_sz)) {
973 			/* In double buffer case, continue to unload fifo if
974  			 * there is Rx packet in FIFO.
975  			 **/
976 			csr = musb_readw(epio, MUSB_RXCSR);
977 			if ((csr & MUSB_RXCSR_RXPKTRDY) &&
978 				hw_ep->rx_double_buffered)
979 				goto exit;
980 			return;
981 		}
982 #endif
983 		musb_g_giveback(musb_ep, request, 0);
984 		/*
985 		 * In the giveback function the MUSB lock is
986 		 * released and acquired after sometime. During
987 		 * this time period the INDEX register could get
988 		 * changed by the gadget_queue function especially
989 		 * on SMP systems. Reselect the INDEX to be sure
990 		 * we are reading/modifying the right registers
991 		 */
992 		musb_ep_select(mbase, epnum);
993 
994 		req = next_request(musb_ep);
995 		if (!req)
996 			return;
997 	}
998 #if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_TUSB_OMAP_DMA) || \
999 	defined(CONFIG_USB_UX500_DMA)
1000 exit:
1001 #endif
1002 	/* Analyze request */
1003 	rxstate(musb, req);
1004 }
1005 
1006 /* ------------------------------------------------------------ */
1007 
1008 static int musb_gadget_enable(struct usb_ep *ep,
1009 			const struct usb_endpoint_descriptor *desc)
1010 {
1011 	unsigned long		flags;
1012 	struct musb_ep		*musb_ep;
1013 	struct musb_hw_ep	*hw_ep;
1014 	void __iomem		*regs;
1015 	struct musb		*musb;
1016 	void __iomem	*mbase;
1017 	u8		epnum;
1018 	u16		csr;
1019 	unsigned	tmp;
1020 	int		status = -EINVAL;
1021 
1022 	if (!ep || !desc)
1023 		return -EINVAL;
1024 
1025 	musb_ep = to_musb_ep(ep);
1026 	hw_ep = musb_ep->hw_ep;
1027 	regs = hw_ep->regs;
1028 	musb = musb_ep->musb;
1029 	mbase = musb->mregs;
1030 	epnum = musb_ep->current_epnum;
1031 
1032 	spin_lock_irqsave(&musb->lock, flags);
1033 
1034 	if (musb_ep->desc) {
1035 		status = -EBUSY;
1036 		goto fail;
1037 	}
1038 	musb_ep->type = usb_endpoint_type(desc);
1039 
1040 	/* check direction and (later) maxpacket size against endpoint */
1041 	if (usb_endpoint_num(desc) != epnum)
1042 		goto fail;
1043 
1044 	/* REVISIT this rules out high bandwidth periodic transfers */
1045 	tmp = usb_endpoint_maxp(desc);
1046 	if (tmp & ~0x07ff) {
1047 		int ok;
1048 
1049 		if (usb_endpoint_dir_in(desc))
1050 			ok = musb->hb_iso_tx;
1051 		else
1052 			ok = musb->hb_iso_rx;
1053 
1054 		if (!ok) {
1055 			dev_dbg(musb->controller, "no support for high bandwidth ISO\n");
1056 			goto fail;
1057 		}
1058 		musb_ep->hb_mult = (tmp >> 11) & 3;
1059 	} else {
1060 		musb_ep->hb_mult = 0;
1061 	}
1062 
1063 	musb_ep->packet_sz = tmp & 0x7ff;
1064 	tmp = musb_ep->packet_sz * (musb_ep->hb_mult + 1);
1065 
1066 	/* enable the interrupts for the endpoint, set the endpoint
1067 	 * packet size (or fail), set the mode, clear the fifo
1068 	 */
1069 	musb_ep_select(mbase, epnum);
1070 	if (usb_endpoint_dir_in(desc)) {
1071 		u16 int_txe = musb_readw(mbase, MUSB_INTRTXE);
1072 
1073 		if (hw_ep->is_shared_fifo)
1074 			musb_ep->is_in = 1;
1075 		if (!musb_ep->is_in)
1076 			goto fail;
1077 
1078 		if (tmp > hw_ep->max_packet_sz_tx) {
1079 			dev_dbg(musb->controller, "packet size beyond hardware FIFO size\n");
1080 			goto fail;
1081 		}
1082 
1083 		int_txe |= (1 << epnum);
1084 		musb_writew(mbase, MUSB_INTRTXE, int_txe);
1085 
1086 		/* REVISIT if can_bulk_split(), use by updating "tmp";
1087 		 * likewise high bandwidth periodic tx
1088 		 */
1089 		/* Set TXMAXP with the FIFO size of the endpoint
1090 		 * to disable double buffering mode.
1091 		 */
1092 		if (musb->double_buffer_not_ok)
1093 			musb_writew(regs, MUSB_TXMAXP, hw_ep->max_packet_sz_tx);
1094 		else
1095 			musb_writew(regs, MUSB_TXMAXP, musb_ep->packet_sz
1096 					| (musb_ep->hb_mult << 11));
1097 
1098 		csr = MUSB_TXCSR_MODE | MUSB_TXCSR_CLRDATATOG;
1099 		if (musb_readw(regs, MUSB_TXCSR)
1100 				& MUSB_TXCSR_FIFONOTEMPTY)
1101 			csr |= MUSB_TXCSR_FLUSHFIFO;
1102 		if (musb_ep->type == USB_ENDPOINT_XFER_ISOC)
1103 			csr |= MUSB_TXCSR_P_ISO;
1104 
1105 		/* set twice in case of double buffering */
1106 		musb_writew(regs, MUSB_TXCSR, csr);
1107 		/* REVISIT may be inappropriate w/o FIFONOTEMPTY ... */
1108 		musb_writew(regs, MUSB_TXCSR, csr);
1109 
1110 	} else {
1111 		u16 int_rxe = musb_readw(mbase, MUSB_INTRRXE);
1112 
1113 		if (hw_ep->is_shared_fifo)
1114 			musb_ep->is_in = 0;
1115 		if (musb_ep->is_in)
1116 			goto fail;
1117 
1118 		if (tmp > hw_ep->max_packet_sz_rx) {
1119 			dev_dbg(musb->controller, "packet size beyond hardware FIFO size\n");
1120 			goto fail;
1121 		}
1122 
1123 		int_rxe |= (1 << epnum);
1124 		musb_writew(mbase, MUSB_INTRRXE, int_rxe);
1125 
1126 		/* REVISIT if can_bulk_combine() use by updating "tmp"
1127 		 * likewise high bandwidth periodic rx
1128 		 */
1129 		/* Set RXMAXP with the FIFO size of the endpoint
1130 		 * to disable double buffering mode.
1131 		 */
1132 		if (musb->double_buffer_not_ok)
1133 			musb_writew(regs, MUSB_RXMAXP, hw_ep->max_packet_sz_tx);
1134 		else
1135 			musb_writew(regs, MUSB_RXMAXP, musb_ep->packet_sz
1136 					| (musb_ep->hb_mult << 11));
1137 
1138 		/* force shared fifo to OUT-only mode */
1139 		if (hw_ep->is_shared_fifo) {
1140 			csr = musb_readw(regs, MUSB_TXCSR);
1141 			csr &= ~(MUSB_TXCSR_MODE | MUSB_TXCSR_TXPKTRDY);
1142 			musb_writew(regs, MUSB_TXCSR, csr);
1143 		}
1144 
1145 		csr = MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_CLRDATATOG;
1146 		if (musb_ep->type == USB_ENDPOINT_XFER_ISOC)
1147 			csr |= MUSB_RXCSR_P_ISO;
1148 		else if (musb_ep->type == USB_ENDPOINT_XFER_INT)
1149 			csr |= MUSB_RXCSR_DISNYET;
1150 
1151 		/* set twice in case of double buffering */
1152 		musb_writew(regs, MUSB_RXCSR, csr);
1153 		musb_writew(regs, MUSB_RXCSR, csr);
1154 	}
1155 
1156 	/* NOTE:  all the I/O code _should_ work fine without DMA, in case
1157 	 * for some reason you run out of channels here.
1158 	 */
1159 	if (is_dma_capable() && musb->dma_controller) {
1160 		struct dma_controller	*c = musb->dma_controller;
1161 
1162 		musb_ep->dma = c->channel_alloc(c, hw_ep,
1163 				(desc->bEndpointAddress & USB_DIR_IN));
1164 	} else
1165 		musb_ep->dma = NULL;
1166 
1167 	musb_ep->desc = desc;
1168 	musb_ep->busy = 0;
1169 	musb_ep->wedged = 0;
1170 	status = 0;
1171 
1172 	pr_debug("%s periph: enabled %s for %s %s, %smaxpacket %d\n",
1173 			musb_driver_name, musb_ep->end_point.name,
1174 			({ char *s; switch (musb_ep->type) {
1175 			case USB_ENDPOINT_XFER_BULK:	s = "bulk"; break;
1176 			case USB_ENDPOINT_XFER_INT:	s = "int"; break;
1177 			default:			s = "iso"; break;
1178 			}; s; }),
1179 			musb_ep->is_in ? "IN" : "OUT",
1180 			musb_ep->dma ? "dma, " : "",
1181 			musb_ep->packet_sz);
1182 
1183 	schedule_work(&musb->irq_work);
1184 
1185 fail:
1186 	spin_unlock_irqrestore(&musb->lock, flags);
1187 	return status;
1188 }
1189 
1190 /*
1191  * Disable an endpoint flushing all requests queued.
1192  */
1193 static int musb_gadget_disable(struct usb_ep *ep)
1194 {
1195 	unsigned long	flags;
1196 	struct musb	*musb;
1197 	u8		epnum;
1198 	struct musb_ep	*musb_ep;
1199 	void __iomem	*epio;
1200 	int		status = 0;
1201 
1202 	musb_ep = to_musb_ep(ep);
1203 	musb = musb_ep->musb;
1204 	epnum = musb_ep->current_epnum;
1205 	epio = musb->endpoints[epnum].regs;
1206 
1207 	spin_lock_irqsave(&musb->lock, flags);
1208 	musb_ep_select(musb->mregs, epnum);
1209 
1210 	/* zero the endpoint sizes */
1211 	if (musb_ep->is_in) {
1212 		u16 int_txe = musb_readw(musb->mregs, MUSB_INTRTXE);
1213 		int_txe &= ~(1 << epnum);
1214 		musb_writew(musb->mregs, MUSB_INTRTXE, int_txe);
1215 		musb_writew(epio, MUSB_TXMAXP, 0);
1216 	} else {
1217 		u16 int_rxe = musb_readw(musb->mregs, MUSB_INTRRXE);
1218 		int_rxe &= ~(1 << epnum);
1219 		musb_writew(musb->mregs, MUSB_INTRRXE, int_rxe);
1220 		musb_writew(epio, MUSB_RXMAXP, 0);
1221 	}
1222 
1223 	musb_ep->desc = NULL;
1224 	musb_ep->end_point.desc = NULL;
1225 
1226 	/* abort all pending DMA and requests */
1227 	nuke(musb_ep, -ESHUTDOWN);
1228 
1229 	schedule_work(&musb->irq_work);
1230 
1231 	spin_unlock_irqrestore(&(musb->lock), flags);
1232 
1233 	dev_dbg(musb->controller, "%s\n", musb_ep->end_point.name);
1234 
1235 	return status;
1236 }
1237 
1238 /*
1239  * Allocate a request for an endpoint.
1240  * Reused by ep0 code.
1241  */
1242 struct usb_request *musb_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
1243 {
1244 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1245 	struct musb		*musb = musb_ep->musb;
1246 	struct musb_request	*request = NULL;
1247 
1248 	request = kzalloc(sizeof *request, gfp_flags);
1249 	if (!request) {
1250 		dev_dbg(musb->controller, "not enough memory\n");
1251 		return NULL;
1252 	}
1253 
1254 	request->request.dma = DMA_ADDR_INVALID;
1255 	request->epnum = musb_ep->current_epnum;
1256 	request->ep = musb_ep;
1257 
1258 	return &request->request;
1259 }
1260 
1261 /*
1262  * Free a request
1263  * Reused by ep0 code.
1264  */
1265 void musb_free_request(struct usb_ep *ep, struct usb_request *req)
1266 {
1267 	kfree(to_musb_request(req));
1268 }
1269 
1270 static LIST_HEAD(buffers);
1271 
1272 struct free_record {
1273 	struct list_head	list;
1274 	struct device		*dev;
1275 	unsigned		bytes;
1276 	dma_addr_t		dma;
1277 };
1278 
1279 /*
1280  * Context: controller locked, IRQs blocked.
1281  */
1282 void musb_ep_restart(struct musb *musb, struct musb_request *req)
1283 {
1284 	dev_dbg(musb->controller, "<== %s request %p len %u on hw_ep%d\n",
1285 		req->tx ? "TX/IN" : "RX/OUT",
1286 		&req->request, req->request.length, req->epnum);
1287 
1288 	musb_ep_select(musb->mregs, req->epnum);
1289 	if (req->tx)
1290 		txstate(musb, req);
1291 	else
1292 		rxstate(musb, req);
1293 }
1294 
1295 static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
1296 			gfp_t gfp_flags)
1297 {
1298 	struct musb_ep		*musb_ep;
1299 	struct musb_request	*request;
1300 	struct musb		*musb;
1301 	int			status = 0;
1302 	unsigned long		lockflags;
1303 
1304 	if (!ep || !req)
1305 		return -EINVAL;
1306 	if (!req->buf)
1307 		return -ENODATA;
1308 
1309 	musb_ep = to_musb_ep(ep);
1310 	musb = musb_ep->musb;
1311 
1312 	request = to_musb_request(req);
1313 	request->musb = musb;
1314 
1315 	if (request->ep != musb_ep)
1316 		return -EINVAL;
1317 
1318 	dev_dbg(musb->controller, "<== to %s request=%p\n", ep->name, req);
1319 
1320 	/* request is mine now... */
1321 	request->request.actual = 0;
1322 	request->request.status = -EINPROGRESS;
1323 	request->epnum = musb_ep->current_epnum;
1324 	request->tx = musb_ep->is_in;
1325 
1326 	map_dma_buffer(request, musb, musb_ep);
1327 
1328 	spin_lock_irqsave(&musb->lock, lockflags);
1329 
1330 	/* don't queue if the ep is down */
1331 	if (!musb_ep->desc) {
1332 		dev_dbg(musb->controller, "req %p queued to %s while ep %s\n",
1333 				req, ep->name, "disabled");
1334 		status = -ESHUTDOWN;
1335 		goto cleanup;
1336 	}
1337 
1338 	/* add request to the list */
1339 	list_add_tail(&request->list, &musb_ep->req_list);
1340 
1341 	/* it this is the head of the queue, start i/o ... */
1342 	if (!musb_ep->busy && &request->list == musb_ep->req_list.next)
1343 		musb_ep_restart(musb, request);
1344 
1345 cleanup:
1346 	spin_unlock_irqrestore(&musb->lock, lockflags);
1347 	return status;
1348 }
1349 
1350 static int musb_gadget_dequeue(struct usb_ep *ep, struct usb_request *request)
1351 {
1352 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1353 	struct musb_request	*req = to_musb_request(request);
1354 	struct musb_request	*r;
1355 	unsigned long		flags;
1356 	int			status = 0;
1357 	struct musb		*musb = musb_ep->musb;
1358 
1359 	if (!ep || !request || to_musb_request(request)->ep != musb_ep)
1360 		return -EINVAL;
1361 
1362 	spin_lock_irqsave(&musb->lock, flags);
1363 
1364 	list_for_each_entry(r, &musb_ep->req_list, list) {
1365 		if (r == req)
1366 			break;
1367 	}
1368 	if (r != req) {
1369 		dev_dbg(musb->controller, "request %p not queued to %s\n", request, ep->name);
1370 		status = -EINVAL;
1371 		goto done;
1372 	}
1373 
1374 	/* if the hardware doesn't have the request, easy ... */
1375 	if (musb_ep->req_list.next != &req->list || musb_ep->busy)
1376 		musb_g_giveback(musb_ep, request, -ECONNRESET);
1377 
1378 	/* ... else abort the dma transfer ... */
1379 	else if (is_dma_capable() && musb_ep->dma) {
1380 		struct dma_controller	*c = musb->dma_controller;
1381 
1382 		musb_ep_select(musb->mregs, musb_ep->current_epnum);
1383 		if (c->channel_abort)
1384 			status = c->channel_abort(musb_ep->dma);
1385 		else
1386 			status = -EBUSY;
1387 		if (status == 0)
1388 			musb_g_giveback(musb_ep, request, -ECONNRESET);
1389 	} else {
1390 		/* NOTE: by sticking to easily tested hardware/driver states,
1391 		 * we leave counting of in-flight packets imprecise.
1392 		 */
1393 		musb_g_giveback(musb_ep, request, -ECONNRESET);
1394 	}
1395 
1396 done:
1397 	spin_unlock_irqrestore(&musb->lock, flags);
1398 	return status;
1399 }
1400 
1401 /*
1402  * Set or clear the halt bit of an endpoint. A halted enpoint won't tx/rx any
1403  * data but will queue requests.
1404  *
1405  * exported to ep0 code
1406  */
1407 static int musb_gadget_set_halt(struct usb_ep *ep, int value)
1408 {
1409 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1410 	u8			epnum = musb_ep->current_epnum;
1411 	struct musb		*musb = musb_ep->musb;
1412 	void __iomem		*epio = musb->endpoints[epnum].regs;
1413 	void __iomem		*mbase;
1414 	unsigned long		flags;
1415 	u16			csr;
1416 	struct musb_request	*request;
1417 	int			status = 0;
1418 
1419 	if (!ep)
1420 		return -EINVAL;
1421 	mbase = musb->mregs;
1422 
1423 	spin_lock_irqsave(&musb->lock, flags);
1424 
1425 	if ((USB_ENDPOINT_XFER_ISOC == musb_ep->type)) {
1426 		status = -EINVAL;
1427 		goto done;
1428 	}
1429 
1430 	musb_ep_select(mbase, epnum);
1431 
1432 	request = next_request(musb_ep);
1433 	if (value) {
1434 		if (request) {
1435 			dev_dbg(musb->controller, "request in progress, cannot halt %s\n",
1436 			    ep->name);
1437 			status = -EAGAIN;
1438 			goto done;
1439 		}
1440 		/* Cannot portably stall with non-empty FIFO */
1441 		if (musb_ep->is_in) {
1442 			csr = musb_readw(epio, MUSB_TXCSR);
1443 			if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
1444 				dev_dbg(musb->controller, "FIFO busy, cannot halt %s\n", ep->name);
1445 				status = -EAGAIN;
1446 				goto done;
1447 			}
1448 		}
1449 	} else
1450 		musb_ep->wedged = 0;
1451 
1452 	/* set/clear the stall and toggle bits */
1453 	dev_dbg(musb->controller, "%s: %s stall\n", ep->name, value ? "set" : "clear");
1454 	if (musb_ep->is_in) {
1455 		csr = musb_readw(epio, MUSB_TXCSR);
1456 		csr |= MUSB_TXCSR_P_WZC_BITS
1457 			| MUSB_TXCSR_CLRDATATOG;
1458 		if (value)
1459 			csr |= MUSB_TXCSR_P_SENDSTALL;
1460 		else
1461 			csr &= ~(MUSB_TXCSR_P_SENDSTALL
1462 				| MUSB_TXCSR_P_SENTSTALL);
1463 		csr &= ~MUSB_TXCSR_TXPKTRDY;
1464 		musb_writew(epio, MUSB_TXCSR, csr);
1465 	} else {
1466 		csr = musb_readw(epio, MUSB_RXCSR);
1467 		csr |= MUSB_RXCSR_P_WZC_BITS
1468 			| MUSB_RXCSR_FLUSHFIFO
1469 			| MUSB_RXCSR_CLRDATATOG;
1470 		if (value)
1471 			csr |= MUSB_RXCSR_P_SENDSTALL;
1472 		else
1473 			csr &= ~(MUSB_RXCSR_P_SENDSTALL
1474 				| MUSB_RXCSR_P_SENTSTALL);
1475 		musb_writew(epio, MUSB_RXCSR, csr);
1476 	}
1477 
1478 	/* maybe start the first request in the queue */
1479 	if (!musb_ep->busy && !value && request) {
1480 		dev_dbg(musb->controller, "restarting the request\n");
1481 		musb_ep_restart(musb, request);
1482 	}
1483 
1484 done:
1485 	spin_unlock_irqrestore(&musb->lock, flags);
1486 	return status;
1487 }
1488 
1489 /*
1490  * Sets the halt feature with the clear requests ignored
1491  */
1492 static int musb_gadget_set_wedge(struct usb_ep *ep)
1493 {
1494 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1495 
1496 	if (!ep)
1497 		return -EINVAL;
1498 
1499 	musb_ep->wedged = 1;
1500 
1501 	return usb_ep_set_halt(ep);
1502 }
1503 
1504 static int musb_gadget_fifo_status(struct usb_ep *ep)
1505 {
1506 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1507 	void __iomem		*epio = musb_ep->hw_ep->regs;
1508 	int			retval = -EINVAL;
1509 
1510 	if (musb_ep->desc && !musb_ep->is_in) {
1511 		struct musb		*musb = musb_ep->musb;
1512 		int			epnum = musb_ep->current_epnum;
1513 		void __iomem		*mbase = musb->mregs;
1514 		unsigned long		flags;
1515 
1516 		spin_lock_irqsave(&musb->lock, flags);
1517 
1518 		musb_ep_select(mbase, epnum);
1519 		/* FIXME return zero unless RXPKTRDY is set */
1520 		retval = musb_readw(epio, MUSB_RXCOUNT);
1521 
1522 		spin_unlock_irqrestore(&musb->lock, flags);
1523 	}
1524 	return retval;
1525 }
1526 
1527 static void musb_gadget_fifo_flush(struct usb_ep *ep)
1528 {
1529 	struct musb_ep	*musb_ep = to_musb_ep(ep);
1530 	struct musb	*musb = musb_ep->musb;
1531 	u8		epnum = musb_ep->current_epnum;
1532 	void __iomem	*epio = musb->endpoints[epnum].regs;
1533 	void __iomem	*mbase;
1534 	unsigned long	flags;
1535 	u16		csr, int_txe;
1536 
1537 	mbase = musb->mregs;
1538 
1539 	spin_lock_irqsave(&musb->lock, flags);
1540 	musb_ep_select(mbase, (u8) epnum);
1541 
1542 	/* disable interrupts */
1543 	int_txe = musb_readw(mbase, MUSB_INTRTXE);
1544 	musb_writew(mbase, MUSB_INTRTXE, int_txe & ~(1 << epnum));
1545 
1546 	if (musb_ep->is_in) {
1547 		csr = musb_readw(epio, MUSB_TXCSR);
1548 		if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
1549 			csr |= MUSB_TXCSR_FLUSHFIFO | MUSB_TXCSR_P_WZC_BITS;
1550 			/*
1551 			 * Setting both TXPKTRDY and FLUSHFIFO makes controller
1552 			 * to interrupt current FIFO loading, but not flushing
1553 			 * the already loaded ones.
1554 			 */
1555 			csr &= ~MUSB_TXCSR_TXPKTRDY;
1556 			musb_writew(epio, MUSB_TXCSR, csr);
1557 			/* REVISIT may be inappropriate w/o FIFONOTEMPTY ... */
1558 			musb_writew(epio, MUSB_TXCSR, csr);
1559 		}
1560 	} else {
1561 		csr = musb_readw(epio, MUSB_RXCSR);
1562 		csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_P_WZC_BITS;
1563 		musb_writew(epio, MUSB_RXCSR, csr);
1564 		musb_writew(epio, MUSB_RXCSR, csr);
1565 	}
1566 
1567 	/* re-enable interrupt */
1568 	musb_writew(mbase, MUSB_INTRTXE, int_txe);
1569 	spin_unlock_irqrestore(&musb->lock, flags);
1570 }
1571 
1572 static const struct usb_ep_ops musb_ep_ops = {
1573 	.enable		= musb_gadget_enable,
1574 	.disable	= musb_gadget_disable,
1575 	.alloc_request	= musb_alloc_request,
1576 	.free_request	= musb_free_request,
1577 	.queue		= musb_gadget_queue,
1578 	.dequeue	= musb_gadget_dequeue,
1579 	.set_halt	= musb_gadget_set_halt,
1580 	.set_wedge	= musb_gadget_set_wedge,
1581 	.fifo_status	= musb_gadget_fifo_status,
1582 	.fifo_flush	= musb_gadget_fifo_flush
1583 };
1584 
1585 /* ----------------------------------------------------------------------- */
1586 
1587 static int musb_gadget_get_frame(struct usb_gadget *gadget)
1588 {
1589 	struct musb	*musb = gadget_to_musb(gadget);
1590 
1591 	return (int)musb_readw(musb->mregs, MUSB_FRAME);
1592 }
1593 
1594 static int musb_gadget_wakeup(struct usb_gadget *gadget)
1595 {
1596 	struct musb	*musb = gadget_to_musb(gadget);
1597 	void __iomem	*mregs = musb->mregs;
1598 	unsigned long	flags;
1599 	int		status = -EINVAL;
1600 	u8		power, devctl;
1601 	int		retries;
1602 
1603 	spin_lock_irqsave(&musb->lock, flags);
1604 
1605 	switch (musb->xceiv->state) {
1606 	case OTG_STATE_B_PERIPHERAL:
1607 		/* NOTE:  OTG state machine doesn't include B_SUSPENDED;
1608 		 * that's part of the standard usb 1.1 state machine, and
1609 		 * doesn't affect OTG transitions.
1610 		 */
1611 		if (musb->may_wakeup && musb->is_suspended)
1612 			break;
1613 		goto done;
1614 	case OTG_STATE_B_IDLE:
1615 		/* Start SRP ... OTG not required. */
1616 		devctl = musb_readb(mregs, MUSB_DEVCTL);
1617 		dev_dbg(musb->controller, "Sending SRP: devctl: %02x\n", devctl);
1618 		devctl |= MUSB_DEVCTL_SESSION;
1619 		musb_writeb(mregs, MUSB_DEVCTL, devctl);
1620 		devctl = musb_readb(mregs, MUSB_DEVCTL);
1621 		retries = 100;
1622 		while (!(devctl & MUSB_DEVCTL_SESSION)) {
1623 			devctl = musb_readb(mregs, MUSB_DEVCTL);
1624 			if (retries-- < 1)
1625 				break;
1626 		}
1627 		retries = 10000;
1628 		while (devctl & MUSB_DEVCTL_SESSION) {
1629 			devctl = musb_readb(mregs, MUSB_DEVCTL);
1630 			if (retries-- < 1)
1631 				break;
1632 		}
1633 
1634 		spin_unlock_irqrestore(&musb->lock, flags);
1635 		otg_start_srp(musb->xceiv->otg);
1636 		spin_lock_irqsave(&musb->lock, flags);
1637 
1638 		/* Block idling for at least 1s */
1639 		musb_platform_try_idle(musb,
1640 			jiffies + msecs_to_jiffies(1 * HZ));
1641 
1642 		status = 0;
1643 		goto done;
1644 	default:
1645 		dev_dbg(musb->controller, "Unhandled wake: %s\n",
1646 			otg_state_string(musb->xceiv->state));
1647 		goto done;
1648 	}
1649 
1650 	status = 0;
1651 
1652 	power = musb_readb(mregs, MUSB_POWER);
1653 	power |= MUSB_POWER_RESUME;
1654 	musb_writeb(mregs, MUSB_POWER, power);
1655 	dev_dbg(musb->controller, "issue wakeup\n");
1656 
1657 	/* FIXME do this next chunk in a timer callback, no udelay */
1658 	mdelay(2);
1659 
1660 	power = musb_readb(mregs, MUSB_POWER);
1661 	power &= ~MUSB_POWER_RESUME;
1662 	musb_writeb(mregs, MUSB_POWER, power);
1663 done:
1664 	spin_unlock_irqrestore(&musb->lock, flags);
1665 	return status;
1666 }
1667 
1668 static int
1669 musb_gadget_set_self_powered(struct usb_gadget *gadget, int is_selfpowered)
1670 {
1671 	struct musb	*musb = gadget_to_musb(gadget);
1672 
1673 	musb->is_self_powered = !!is_selfpowered;
1674 	return 0;
1675 }
1676 
1677 static void musb_pullup(struct musb *musb, int is_on)
1678 {
1679 	u8 power;
1680 
1681 	power = musb_readb(musb->mregs, MUSB_POWER);
1682 	if (is_on)
1683 		power |= MUSB_POWER_SOFTCONN;
1684 	else
1685 		power &= ~MUSB_POWER_SOFTCONN;
1686 
1687 	/* FIXME if on, HdrcStart; if off, HdrcStop */
1688 
1689 	dev_dbg(musb->controller, "gadget D+ pullup %s\n",
1690 		is_on ? "on" : "off");
1691 	musb_writeb(musb->mregs, MUSB_POWER, power);
1692 }
1693 
1694 #if 0
1695 static int musb_gadget_vbus_session(struct usb_gadget *gadget, int is_active)
1696 {
1697 	dev_dbg(musb->controller, "<= %s =>\n", __func__);
1698 
1699 	/*
1700 	 * FIXME iff driver's softconnect flag is set (as it is during probe,
1701 	 * though that can clear it), just musb_pullup().
1702 	 */
1703 
1704 	return -EINVAL;
1705 }
1706 #endif
1707 
1708 static int musb_gadget_vbus_draw(struct usb_gadget *gadget, unsigned mA)
1709 {
1710 	struct musb	*musb = gadget_to_musb(gadget);
1711 
1712 	if (!musb->xceiv->set_power)
1713 		return -EOPNOTSUPP;
1714 	return usb_phy_set_power(musb->xceiv, mA);
1715 }
1716 
1717 static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
1718 {
1719 	struct musb	*musb = gadget_to_musb(gadget);
1720 	unsigned long	flags;
1721 
1722 	is_on = !!is_on;
1723 
1724 	pm_runtime_get_sync(musb->controller);
1725 
1726 	/* NOTE: this assumes we are sensing vbus; we'd rather
1727 	 * not pullup unless the B-session is active.
1728 	 */
1729 	spin_lock_irqsave(&musb->lock, flags);
1730 	if (is_on != musb->softconnect) {
1731 		musb->softconnect = is_on;
1732 		musb_pullup(musb, is_on);
1733 	}
1734 	spin_unlock_irqrestore(&musb->lock, flags);
1735 
1736 	pm_runtime_put(musb->controller);
1737 
1738 	return 0;
1739 }
1740 
1741 static int musb_gadget_start(struct usb_gadget *g,
1742 		struct usb_gadget_driver *driver);
1743 static int musb_gadget_stop(struct usb_gadget *g,
1744 		struct usb_gadget_driver *driver);
1745 
1746 static const struct usb_gadget_ops musb_gadget_operations = {
1747 	.get_frame		= musb_gadget_get_frame,
1748 	.wakeup			= musb_gadget_wakeup,
1749 	.set_selfpowered	= musb_gadget_set_self_powered,
1750 	/* .vbus_session		= musb_gadget_vbus_session, */
1751 	.vbus_draw		= musb_gadget_vbus_draw,
1752 	.pullup			= musb_gadget_pullup,
1753 	.udc_start		= musb_gadget_start,
1754 	.udc_stop		= musb_gadget_stop,
1755 };
1756 
1757 /* ----------------------------------------------------------------------- */
1758 
1759 /* Registration */
1760 
1761 /* Only this registration code "knows" the rule (from USB standards)
1762  * about there being only one external upstream port.  It assumes
1763  * all peripheral ports are external...
1764  */
1765 
1766 static void musb_gadget_release(struct device *dev)
1767 {
1768 	/* kref_put(WHAT) */
1769 	dev_dbg(dev, "%s\n", __func__);
1770 }
1771 
1772 
1773 static void __devinit
1774 init_peripheral_ep(struct musb *musb, struct musb_ep *ep, u8 epnum, int is_in)
1775 {
1776 	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1777 
1778 	memset(ep, 0, sizeof *ep);
1779 
1780 	ep->current_epnum = epnum;
1781 	ep->musb = musb;
1782 	ep->hw_ep = hw_ep;
1783 	ep->is_in = is_in;
1784 
1785 	INIT_LIST_HEAD(&ep->req_list);
1786 
1787 	sprintf(ep->name, "ep%d%s", epnum,
1788 			(!epnum || hw_ep->is_shared_fifo) ? "" : (
1789 				is_in ? "in" : "out"));
1790 	ep->end_point.name = ep->name;
1791 	INIT_LIST_HEAD(&ep->end_point.ep_list);
1792 	if (!epnum) {
1793 		ep->end_point.maxpacket = 64;
1794 		ep->end_point.ops = &musb_g_ep0_ops;
1795 		musb->g.ep0 = &ep->end_point;
1796 	} else {
1797 		if (is_in)
1798 			ep->end_point.maxpacket = hw_ep->max_packet_sz_tx;
1799 		else
1800 			ep->end_point.maxpacket = hw_ep->max_packet_sz_rx;
1801 		ep->end_point.ops = &musb_ep_ops;
1802 		list_add_tail(&ep->end_point.ep_list, &musb->g.ep_list);
1803 	}
1804 }
1805 
1806 /*
1807  * Initialize the endpoints exposed to peripheral drivers, with backlinks
1808  * to the rest of the driver state.
1809  */
1810 static inline void __devinit musb_g_init_endpoints(struct musb *musb)
1811 {
1812 	u8			epnum;
1813 	struct musb_hw_ep	*hw_ep;
1814 	unsigned		count = 0;
1815 
1816 	/* initialize endpoint list just once */
1817 	INIT_LIST_HEAD(&(musb->g.ep_list));
1818 
1819 	for (epnum = 0, hw_ep = musb->endpoints;
1820 			epnum < musb->nr_endpoints;
1821 			epnum++, hw_ep++) {
1822 		if (hw_ep->is_shared_fifo /* || !epnum */) {
1823 			init_peripheral_ep(musb, &hw_ep->ep_in, epnum, 0);
1824 			count++;
1825 		} else {
1826 			if (hw_ep->max_packet_sz_tx) {
1827 				init_peripheral_ep(musb, &hw_ep->ep_in,
1828 							epnum, 1);
1829 				count++;
1830 			}
1831 			if (hw_ep->max_packet_sz_rx) {
1832 				init_peripheral_ep(musb, &hw_ep->ep_out,
1833 							epnum, 0);
1834 				count++;
1835 			}
1836 		}
1837 	}
1838 }
1839 
1840 /* called once during driver setup to initialize and link into
1841  * the driver model; memory is zeroed.
1842  */
1843 int __devinit musb_gadget_setup(struct musb *musb)
1844 {
1845 	int status;
1846 
1847 	/* REVISIT minor race:  if (erroneously) setting up two
1848 	 * musb peripherals at the same time, only the bus lock
1849 	 * is probably held.
1850 	 */
1851 
1852 	musb->g.ops = &musb_gadget_operations;
1853 	musb->g.max_speed = USB_SPEED_HIGH;
1854 	musb->g.speed = USB_SPEED_UNKNOWN;
1855 
1856 	/* this "gadget" abstracts/virtualizes the controller */
1857 	dev_set_name(&musb->g.dev, "gadget");
1858 	musb->g.dev.parent = musb->controller;
1859 	musb->g.dev.dma_mask = musb->controller->dma_mask;
1860 	musb->g.dev.release = musb_gadget_release;
1861 	musb->g.name = musb_driver_name;
1862 
1863 	musb->g.is_otg = 1;
1864 
1865 	musb_g_init_endpoints(musb);
1866 
1867 	musb->is_active = 0;
1868 	musb_platform_try_idle(musb, 0);
1869 
1870 	status = device_register(&musb->g.dev);
1871 	if (status != 0) {
1872 		put_device(&musb->g.dev);
1873 		return status;
1874 	}
1875 	status = usb_add_gadget_udc(musb->controller, &musb->g);
1876 	if (status)
1877 		goto err;
1878 
1879 	return 0;
1880 err:
1881 	musb->g.dev.parent = NULL;
1882 	device_unregister(&musb->g.dev);
1883 	return status;
1884 }
1885 
1886 void musb_gadget_cleanup(struct musb *musb)
1887 {
1888 	usb_del_gadget_udc(&musb->g);
1889 	if (musb->g.dev.parent)
1890 		device_unregister(&musb->g.dev);
1891 }
1892 
1893 /*
1894  * Register the gadget driver. Used by gadget drivers when
1895  * registering themselves with the controller.
1896  *
1897  * -EINVAL something went wrong (not driver)
1898  * -EBUSY another gadget is already using the controller
1899  * -ENOMEM no memory to perform the operation
1900  *
1901  * @param driver the gadget driver
1902  * @return <0 if error, 0 if everything is fine
1903  */
1904 static int musb_gadget_start(struct usb_gadget *g,
1905 		struct usb_gadget_driver *driver)
1906 {
1907 	struct musb		*musb = gadget_to_musb(g);
1908 	struct usb_otg		*otg = musb->xceiv->otg;
1909 	struct usb_hcd		*hcd = musb_to_hcd(musb);
1910 	unsigned long		flags;
1911 	int			retval = 0;
1912 
1913 	if (driver->max_speed < USB_SPEED_HIGH) {
1914 		retval = -EINVAL;
1915 		goto err;
1916 	}
1917 
1918 	pm_runtime_get_sync(musb->controller);
1919 
1920 	dev_dbg(musb->controller, "registering driver %s\n", driver->function);
1921 
1922 	musb->softconnect = 0;
1923 	musb->gadget_driver = driver;
1924 
1925 	spin_lock_irqsave(&musb->lock, flags);
1926 	musb->is_active = 1;
1927 
1928 	otg_set_peripheral(otg, &musb->g);
1929 	musb->xceiv->state = OTG_STATE_B_IDLE;
1930 	spin_unlock_irqrestore(&musb->lock, flags);
1931 
1932 	/* REVISIT:  funcall to other code, which also
1933 	 * handles power budgeting ... this way also
1934 	 * ensures HdrcStart is indirectly called.
1935 	 */
1936 	retval = usb_add_hcd(hcd, 0, 0);
1937 	if (retval < 0) {
1938 		dev_dbg(musb->controller, "add_hcd failed, %d\n", retval);
1939 		goto err;
1940 	}
1941 
1942 	if ((musb->xceiv->last_event == USB_EVENT_ID)
1943 				&& otg->set_vbus)
1944 		otg_set_vbus(otg, 1);
1945 
1946 	hcd->self.uses_pio_for_control = 1;
1947 
1948 	if (musb->xceiv->last_event == USB_EVENT_NONE)
1949 		pm_runtime_put(musb->controller);
1950 
1951 	return 0;
1952 
1953 err:
1954 	return retval;
1955 }
1956 
1957 static void stop_activity(struct musb *musb, struct usb_gadget_driver *driver)
1958 {
1959 	int			i;
1960 	struct musb_hw_ep	*hw_ep;
1961 
1962 	/* don't disconnect if it's not connected */
1963 	if (musb->g.speed == USB_SPEED_UNKNOWN)
1964 		driver = NULL;
1965 	else
1966 		musb->g.speed = USB_SPEED_UNKNOWN;
1967 
1968 	/* deactivate the hardware */
1969 	if (musb->softconnect) {
1970 		musb->softconnect = 0;
1971 		musb_pullup(musb, 0);
1972 	}
1973 	musb_stop(musb);
1974 
1975 	/* killing any outstanding requests will quiesce the driver;
1976 	 * then report disconnect
1977 	 */
1978 	if (driver) {
1979 		for (i = 0, hw_ep = musb->endpoints;
1980 				i < musb->nr_endpoints;
1981 				i++, hw_ep++) {
1982 			musb_ep_select(musb->mregs, i);
1983 			if (hw_ep->is_shared_fifo /* || !epnum */) {
1984 				nuke(&hw_ep->ep_in, -ESHUTDOWN);
1985 			} else {
1986 				if (hw_ep->max_packet_sz_tx)
1987 					nuke(&hw_ep->ep_in, -ESHUTDOWN);
1988 				if (hw_ep->max_packet_sz_rx)
1989 					nuke(&hw_ep->ep_out, -ESHUTDOWN);
1990 			}
1991 		}
1992 	}
1993 }
1994 
1995 /*
1996  * Unregister the gadget driver. Used by gadget drivers when
1997  * unregistering themselves from the controller.
1998  *
1999  * @param driver the gadget driver to unregister
2000  */
2001 static int musb_gadget_stop(struct usb_gadget *g,
2002 		struct usb_gadget_driver *driver)
2003 {
2004 	struct musb	*musb = gadget_to_musb(g);
2005 	unsigned long	flags;
2006 
2007 	if (musb->xceiv->last_event == USB_EVENT_NONE)
2008 		pm_runtime_get_sync(musb->controller);
2009 
2010 	/*
2011 	 * REVISIT always use otg_set_peripheral() here too;
2012 	 * this needs to shut down the OTG engine.
2013 	 */
2014 
2015 	spin_lock_irqsave(&musb->lock, flags);
2016 
2017 	musb_hnp_stop(musb);
2018 
2019 	(void) musb_gadget_vbus_draw(&musb->g, 0);
2020 
2021 	musb->xceiv->state = OTG_STATE_UNDEFINED;
2022 	stop_activity(musb, driver);
2023 	otg_set_peripheral(musb->xceiv->otg, NULL);
2024 
2025 	dev_dbg(musb->controller, "unregistering driver %s\n", driver->function);
2026 
2027 	musb->is_active = 0;
2028 	musb_platform_try_idle(musb, 0);
2029 	spin_unlock_irqrestore(&musb->lock, flags);
2030 
2031 	usb_remove_hcd(musb_to_hcd(musb));
2032 	/*
2033 	 * FIXME we need to be able to register another
2034 	 * gadget driver here and have everything work;
2035 	 * that currently misbehaves.
2036 	 */
2037 
2038 	pm_runtime_put(musb->controller);
2039 
2040 	return 0;
2041 }
2042 
2043 /* ----------------------------------------------------------------------- */
2044 
2045 /* lifecycle operations called through plat_uds.c */
2046 
2047 void musb_g_resume(struct musb *musb)
2048 {
2049 	musb->is_suspended = 0;
2050 	switch (musb->xceiv->state) {
2051 	case OTG_STATE_B_IDLE:
2052 		break;
2053 	case OTG_STATE_B_WAIT_ACON:
2054 	case OTG_STATE_B_PERIPHERAL:
2055 		musb->is_active = 1;
2056 		if (musb->gadget_driver && musb->gadget_driver->resume) {
2057 			spin_unlock(&musb->lock);
2058 			musb->gadget_driver->resume(&musb->g);
2059 			spin_lock(&musb->lock);
2060 		}
2061 		break;
2062 	default:
2063 		WARNING("unhandled RESUME transition (%s)\n",
2064 				otg_state_string(musb->xceiv->state));
2065 	}
2066 }
2067 
2068 /* called when SOF packets stop for 3+ msec */
2069 void musb_g_suspend(struct musb *musb)
2070 {
2071 	u8	devctl;
2072 
2073 	devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
2074 	dev_dbg(musb->controller, "devctl %02x\n", devctl);
2075 
2076 	switch (musb->xceiv->state) {
2077 	case OTG_STATE_B_IDLE:
2078 		if ((devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS)
2079 			musb->xceiv->state = OTG_STATE_B_PERIPHERAL;
2080 		break;
2081 	case OTG_STATE_B_PERIPHERAL:
2082 		musb->is_suspended = 1;
2083 		if (musb->gadget_driver && musb->gadget_driver->suspend) {
2084 			spin_unlock(&musb->lock);
2085 			musb->gadget_driver->suspend(&musb->g);
2086 			spin_lock(&musb->lock);
2087 		}
2088 		break;
2089 	default:
2090 		/* REVISIT if B_HOST, clear DEVCTL.HOSTREQ;
2091 		 * A_PERIPHERAL may need care too
2092 		 */
2093 		WARNING("unhandled SUSPEND transition (%s)\n",
2094 				otg_state_string(musb->xceiv->state));
2095 	}
2096 }
2097 
2098 /* Called during SRP */
2099 void musb_g_wakeup(struct musb *musb)
2100 {
2101 	musb_gadget_wakeup(&musb->g);
2102 }
2103 
2104 /* called when VBUS drops below session threshold, and in other cases */
2105 void musb_g_disconnect(struct musb *musb)
2106 {
2107 	void __iomem	*mregs = musb->mregs;
2108 	u8	devctl = musb_readb(mregs, MUSB_DEVCTL);
2109 
2110 	dev_dbg(musb->controller, "devctl %02x\n", devctl);
2111 
2112 	/* clear HR */
2113 	musb_writeb(mregs, MUSB_DEVCTL, devctl & MUSB_DEVCTL_SESSION);
2114 
2115 	/* don't draw vbus until new b-default session */
2116 	(void) musb_gadget_vbus_draw(&musb->g, 0);
2117 
2118 	musb->g.speed = USB_SPEED_UNKNOWN;
2119 	if (musb->gadget_driver && musb->gadget_driver->disconnect) {
2120 		spin_unlock(&musb->lock);
2121 		musb->gadget_driver->disconnect(&musb->g);
2122 		spin_lock(&musb->lock);
2123 	}
2124 
2125 	switch (musb->xceiv->state) {
2126 	default:
2127 		dev_dbg(musb->controller, "Unhandled disconnect %s, setting a_idle\n",
2128 			otg_state_string(musb->xceiv->state));
2129 		musb->xceiv->state = OTG_STATE_A_IDLE;
2130 		MUSB_HST_MODE(musb);
2131 		break;
2132 	case OTG_STATE_A_PERIPHERAL:
2133 		musb->xceiv->state = OTG_STATE_A_WAIT_BCON;
2134 		MUSB_HST_MODE(musb);
2135 		break;
2136 	case OTG_STATE_B_WAIT_ACON:
2137 	case OTG_STATE_B_HOST:
2138 	case OTG_STATE_B_PERIPHERAL:
2139 	case OTG_STATE_B_IDLE:
2140 		musb->xceiv->state = OTG_STATE_B_IDLE;
2141 		break;
2142 	case OTG_STATE_B_SRP_INIT:
2143 		break;
2144 	}
2145 
2146 	musb->is_active = 0;
2147 }
2148 
2149 void musb_g_reset(struct musb *musb)
2150 __releases(musb->lock)
2151 __acquires(musb->lock)
2152 {
2153 	void __iomem	*mbase = musb->mregs;
2154 	u8		devctl = musb_readb(mbase, MUSB_DEVCTL);
2155 	u8		power;
2156 
2157 	dev_dbg(musb->controller, "<== %s addr=%x driver '%s'\n",
2158 			(devctl & MUSB_DEVCTL_BDEVICE)
2159 				? "B-Device" : "A-Device",
2160 			musb_readb(mbase, MUSB_FADDR),
2161 			musb->gadget_driver
2162 				? musb->gadget_driver->driver.name
2163 				: NULL
2164 			);
2165 
2166 	/* report disconnect, if we didn't already (flushing EP state) */
2167 	if (musb->g.speed != USB_SPEED_UNKNOWN)
2168 		musb_g_disconnect(musb);
2169 
2170 	/* clear HR */
2171 	else if (devctl & MUSB_DEVCTL_HR)
2172 		musb_writeb(mbase, MUSB_DEVCTL, MUSB_DEVCTL_SESSION);
2173 
2174 
2175 	/* what speed did we negotiate? */
2176 	power = musb_readb(mbase, MUSB_POWER);
2177 	musb->g.speed = (power & MUSB_POWER_HSMODE)
2178 			? USB_SPEED_HIGH : USB_SPEED_FULL;
2179 
2180 	/* start in USB_STATE_DEFAULT */
2181 	musb->is_active = 1;
2182 	musb->is_suspended = 0;
2183 	MUSB_DEV_MODE(musb);
2184 	musb->address = 0;
2185 	musb->ep0_state = MUSB_EP0_STAGE_SETUP;
2186 
2187 	musb->may_wakeup = 0;
2188 	musb->g.b_hnp_enable = 0;
2189 	musb->g.a_alt_hnp_support = 0;
2190 	musb->g.a_hnp_support = 0;
2191 
2192 	/* Normal reset, as B-Device;
2193 	 * or else after HNP, as A-Device
2194 	 */
2195 	if (devctl & MUSB_DEVCTL_BDEVICE) {
2196 		musb->xceiv->state = OTG_STATE_B_PERIPHERAL;
2197 		musb->g.is_a_peripheral = 0;
2198 	} else {
2199 		musb->xceiv->state = OTG_STATE_A_PERIPHERAL;
2200 		musb->g.is_a_peripheral = 1;
2201 	}
2202 
2203 	/* start with default limits on VBUS power draw */
2204 	(void) musb_gadget_vbus_draw(&musb->g, 8);
2205 }
2206