xref: /linux/drivers/usb/musb/musb_gadget.c (revision ca55b2fef3a9373fcfc30f82fd26bc7fccbda732)
1 /*
2  * MUSB OTG driver peripheral support
3  *
4  * Copyright 2005 Mentor Graphics Corporation
5  * Copyright (C) 2005-2006 by Texas Instruments
6  * Copyright (C) 2006-2007 Nokia Corporation
7  * Copyright (C) 2009 MontaVista Software, Inc. <source@mvista.com>
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License
11  * version 2 as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful, but
14  * WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
21  * 02110-1301 USA
22  *
23  * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
24  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
26  * NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
29  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
30  * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <linux/kernel.h>
37 #include <linux/list.h>
38 #include <linux/timer.h>
39 #include <linux/module.h>
40 #include <linux/smp.h>
41 #include <linux/spinlock.h>
42 #include <linux/delay.h>
43 #include <linux/dma-mapping.h>
44 #include <linux/slab.h>
45 
46 #include "musb_core.h"
47 
48 
49 /* ----------------------------------------------------------------------- */
50 
51 #define is_buffer_mapped(req) (is_dma_capable() && \
52 					(req->map_state != UN_MAPPED))
53 
54 /* Maps the buffer to dma  */
55 
56 static inline void map_dma_buffer(struct musb_request *request,
57 			struct musb *musb, struct musb_ep *musb_ep)
58 {
59 	int compatible = true;
60 	struct dma_controller *dma = musb->dma_controller;
61 
62 	request->map_state = UN_MAPPED;
63 
64 	if (!is_dma_capable() || !musb_ep->dma)
65 		return;
66 
67 	/* Check if DMA engine can handle this request.
68 	 * DMA code must reject the USB request explicitly.
69 	 * Default behaviour is to map the request.
70 	 */
71 	if (dma->is_compatible)
72 		compatible = dma->is_compatible(musb_ep->dma,
73 				musb_ep->packet_sz, request->request.buf,
74 				request->request.length);
75 	if (!compatible)
76 		return;
77 
78 	if (request->request.dma == DMA_ADDR_INVALID) {
79 		dma_addr_t dma_addr;
80 		int ret;
81 
82 		dma_addr = dma_map_single(
83 				musb->controller,
84 				request->request.buf,
85 				request->request.length,
86 				request->tx
87 					? DMA_TO_DEVICE
88 					: DMA_FROM_DEVICE);
89 		ret = dma_mapping_error(musb->controller, dma_addr);
90 		if (ret)
91 			return;
92 
93 		request->request.dma = dma_addr;
94 		request->map_state = MUSB_MAPPED;
95 	} else {
96 		dma_sync_single_for_device(musb->controller,
97 			request->request.dma,
98 			request->request.length,
99 			request->tx
100 				? DMA_TO_DEVICE
101 				: DMA_FROM_DEVICE);
102 		request->map_state = PRE_MAPPED;
103 	}
104 }
105 
106 /* Unmap the buffer from dma and maps it back to cpu */
107 static inline void unmap_dma_buffer(struct musb_request *request,
108 				struct musb *musb)
109 {
110 	struct musb_ep *musb_ep = request->ep;
111 
112 	if (!is_buffer_mapped(request) || !musb_ep->dma)
113 		return;
114 
115 	if (request->request.dma == DMA_ADDR_INVALID) {
116 		dev_vdbg(musb->controller,
117 				"not unmapping a never mapped buffer\n");
118 		return;
119 	}
120 	if (request->map_state == MUSB_MAPPED) {
121 		dma_unmap_single(musb->controller,
122 			request->request.dma,
123 			request->request.length,
124 			request->tx
125 				? DMA_TO_DEVICE
126 				: DMA_FROM_DEVICE);
127 		request->request.dma = DMA_ADDR_INVALID;
128 	} else { /* PRE_MAPPED */
129 		dma_sync_single_for_cpu(musb->controller,
130 			request->request.dma,
131 			request->request.length,
132 			request->tx
133 				? DMA_TO_DEVICE
134 				: DMA_FROM_DEVICE);
135 	}
136 	request->map_state = UN_MAPPED;
137 }
138 
139 /*
140  * Immediately complete a request.
141  *
142  * @param request the request to complete
143  * @param status the status to complete the request with
144  * Context: controller locked, IRQs blocked.
145  */
146 void musb_g_giveback(
147 	struct musb_ep		*ep,
148 	struct usb_request	*request,
149 	int			status)
150 __releases(ep->musb->lock)
151 __acquires(ep->musb->lock)
152 {
153 	struct musb_request	*req;
154 	struct musb		*musb;
155 	int			busy = ep->busy;
156 
157 	req = to_musb_request(request);
158 
159 	list_del(&req->list);
160 	if (req->request.status == -EINPROGRESS)
161 		req->request.status = status;
162 	musb = req->musb;
163 
164 	ep->busy = 1;
165 	spin_unlock(&musb->lock);
166 
167 	if (!dma_mapping_error(&musb->g.dev, request->dma))
168 		unmap_dma_buffer(req, musb);
169 
170 	if (request->status == 0)
171 		dev_dbg(musb->controller, "%s done request %p,  %d/%d\n",
172 				ep->end_point.name, request,
173 				req->request.actual, req->request.length);
174 	else
175 		dev_dbg(musb->controller, "%s request %p, %d/%d fault %d\n",
176 				ep->end_point.name, request,
177 				req->request.actual, req->request.length,
178 				request->status);
179 	usb_gadget_giveback_request(&req->ep->end_point, &req->request);
180 	spin_lock(&musb->lock);
181 	ep->busy = busy;
182 }
183 
184 /* ----------------------------------------------------------------------- */
185 
186 /*
187  * Abort requests queued to an endpoint using the status. Synchronous.
188  * caller locked controller and blocked irqs, and selected this ep.
189  */
190 static void nuke(struct musb_ep *ep, const int status)
191 {
192 	struct musb		*musb = ep->musb;
193 	struct musb_request	*req = NULL;
194 	void __iomem *epio = ep->musb->endpoints[ep->current_epnum].regs;
195 
196 	ep->busy = 1;
197 
198 	if (is_dma_capable() && ep->dma) {
199 		struct dma_controller	*c = ep->musb->dma_controller;
200 		int value;
201 
202 		if (ep->is_in) {
203 			/*
204 			 * The programming guide says that we must not clear
205 			 * the DMAMODE bit before DMAENAB, so we only
206 			 * clear it in the second write...
207 			 */
208 			musb_writew(epio, MUSB_TXCSR,
209 				    MUSB_TXCSR_DMAMODE | MUSB_TXCSR_FLUSHFIFO);
210 			musb_writew(epio, MUSB_TXCSR,
211 					0 | MUSB_TXCSR_FLUSHFIFO);
212 		} else {
213 			musb_writew(epio, MUSB_RXCSR,
214 					0 | MUSB_RXCSR_FLUSHFIFO);
215 			musb_writew(epio, MUSB_RXCSR,
216 					0 | MUSB_RXCSR_FLUSHFIFO);
217 		}
218 
219 		value = c->channel_abort(ep->dma);
220 		dev_dbg(musb->controller, "%s: abort DMA --> %d\n",
221 				ep->name, value);
222 		c->channel_release(ep->dma);
223 		ep->dma = NULL;
224 	}
225 
226 	while (!list_empty(&ep->req_list)) {
227 		req = list_first_entry(&ep->req_list, struct musb_request, list);
228 		musb_g_giveback(ep, &req->request, status);
229 	}
230 }
231 
232 /* ----------------------------------------------------------------------- */
233 
234 /* Data transfers - pure PIO, pure DMA, or mixed mode */
235 
236 /*
237  * This assumes the separate CPPI engine is responding to DMA requests
238  * from the usb core ... sequenced a bit differently from mentor dma.
239  */
240 
241 static inline int max_ep_writesize(struct musb *musb, struct musb_ep *ep)
242 {
243 	if (can_bulk_split(musb, ep->type))
244 		return ep->hw_ep->max_packet_sz_tx;
245 	else
246 		return ep->packet_sz;
247 }
248 
249 /*
250  * An endpoint is transmitting data. This can be called either from
251  * the IRQ routine or from ep.queue() to kickstart a request on an
252  * endpoint.
253  *
254  * Context: controller locked, IRQs blocked, endpoint selected
255  */
256 static void txstate(struct musb *musb, struct musb_request *req)
257 {
258 	u8			epnum = req->epnum;
259 	struct musb_ep		*musb_ep;
260 	void __iomem		*epio = musb->endpoints[epnum].regs;
261 	struct usb_request	*request;
262 	u16			fifo_count = 0, csr;
263 	int			use_dma = 0;
264 
265 	musb_ep = req->ep;
266 
267 	/* Check if EP is disabled */
268 	if (!musb_ep->desc) {
269 		dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
270 						musb_ep->end_point.name);
271 		return;
272 	}
273 
274 	/* we shouldn't get here while DMA is active ... but we do ... */
275 	if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
276 		dev_dbg(musb->controller, "dma pending...\n");
277 		return;
278 	}
279 
280 	/* read TXCSR before */
281 	csr = musb_readw(epio, MUSB_TXCSR);
282 
283 	request = &req->request;
284 	fifo_count = min(max_ep_writesize(musb, musb_ep),
285 			(int)(request->length - request->actual));
286 
287 	if (csr & MUSB_TXCSR_TXPKTRDY) {
288 		dev_dbg(musb->controller, "%s old packet still ready , txcsr %03x\n",
289 				musb_ep->end_point.name, csr);
290 		return;
291 	}
292 
293 	if (csr & MUSB_TXCSR_P_SENDSTALL) {
294 		dev_dbg(musb->controller, "%s stalling, txcsr %03x\n",
295 				musb_ep->end_point.name, csr);
296 		return;
297 	}
298 
299 	dev_dbg(musb->controller, "hw_ep%d, maxpacket %d, fifo count %d, txcsr %03x\n",
300 			epnum, musb_ep->packet_sz, fifo_count,
301 			csr);
302 
303 #ifndef	CONFIG_MUSB_PIO_ONLY
304 	if (is_buffer_mapped(req)) {
305 		struct dma_controller	*c = musb->dma_controller;
306 		size_t request_size;
307 
308 		/* setup DMA, then program endpoint CSR */
309 		request_size = min_t(size_t, request->length - request->actual,
310 					musb_ep->dma->max_len);
311 
312 		use_dma = (request->dma != DMA_ADDR_INVALID && request_size);
313 
314 		/* MUSB_TXCSR_P_ISO is still set correctly */
315 
316 		if (musb_dma_inventra(musb) || musb_dma_ux500(musb)) {
317 			if (request_size < musb_ep->packet_sz)
318 				musb_ep->dma->desired_mode = 0;
319 			else
320 				musb_ep->dma->desired_mode = 1;
321 
322 			use_dma = use_dma && c->channel_program(
323 					musb_ep->dma, musb_ep->packet_sz,
324 					musb_ep->dma->desired_mode,
325 					request->dma + request->actual, request_size);
326 			if (use_dma) {
327 				if (musb_ep->dma->desired_mode == 0) {
328 					/*
329 					 * We must not clear the DMAMODE bit
330 					 * before the DMAENAB bit -- and the
331 					 * latter doesn't always get cleared
332 					 * before we get here...
333 					 */
334 					csr &= ~(MUSB_TXCSR_AUTOSET
335 						| MUSB_TXCSR_DMAENAB);
336 					musb_writew(epio, MUSB_TXCSR, csr
337 						| MUSB_TXCSR_P_WZC_BITS);
338 					csr &= ~MUSB_TXCSR_DMAMODE;
339 					csr |= (MUSB_TXCSR_DMAENAB |
340 							MUSB_TXCSR_MODE);
341 					/* against programming guide */
342 				} else {
343 					csr |= (MUSB_TXCSR_DMAENAB
344 							| MUSB_TXCSR_DMAMODE
345 							| MUSB_TXCSR_MODE);
346 					/*
347 					 * Enable Autoset according to table
348 					 * below
349 					 * bulk_split hb_mult	Autoset_Enable
350 					 *	0	0	Yes(Normal)
351 					 *	0	>0	No(High BW ISO)
352 					 *	1	0	Yes(HS bulk)
353 					 *	1	>0	Yes(FS bulk)
354 					 */
355 					if (!musb_ep->hb_mult ||
356 						(musb_ep->hb_mult &&
357 						 can_bulk_split(musb,
358 						    musb_ep->type)))
359 						csr |= MUSB_TXCSR_AUTOSET;
360 				}
361 				csr &= ~MUSB_TXCSR_P_UNDERRUN;
362 
363 				musb_writew(epio, MUSB_TXCSR, csr);
364 			}
365 		}
366 
367 		if (is_cppi_enabled(musb)) {
368 			/* program endpoint CSR first, then setup DMA */
369 			csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
370 			csr |= MUSB_TXCSR_DMAENAB | MUSB_TXCSR_DMAMODE |
371 				MUSB_TXCSR_MODE;
372 			musb_writew(epio, MUSB_TXCSR, (MUSB_TXCSR_P_WZC_BITS &
373 						~MUSB_TXCSR_P_UNDERRUN) | csr);
374 
375 			/* ensure writebuffer is empty */
376 			csr = musb_readw(epio, MUSB_TXCSR);
377 
378 			/*
379 			 * NOTE host side sets DMAENAB later than this; both are
380 			 * OK since the transfer dma glue (between CPPI and
381 			 * Mentor fifos) just tells CPPI it could start. Data
382 			 * only moves to the USB TX fifo when both fifos are
383 			 * ready.
384 			 */
385 			/*
386 			 * "mode" is irrelevant here; handle terminating ZLPs
387 			 * like PIO does, since the hardware RNDIS mode seems
388 			 * unreliable except for the
389 			 * last-packet-is-already-short case.
390 			 */
391 			use_dma = use_dma && c->channel_program(
392 					musb_ep->dma, musb_ep->packet_sz,
393 					0,
394 					request->dma + request->actual,
395 					request_size);
396 			if (!use_dma) {
397 				c->channel_release(musb_ep->dma);
398 				musb_ep->dma = NULL;
399 				csr &= ~MUSB_TXCSR_DMAENAB;
400 				musb_writew(epio, MUSB_TXCSR, csr);
401 				/* invariant: prequest->buf is non-null */
402 			}
403 		} else if (tusb_dma_omap(musb))
404 			use_dma = use_dma && c->channel_program(
405 					musb_ep->dma, musb_ep->packet_sz,
406 					request->zero,
407 					request->dma + request->actual,
408 					request_size);
409 	}
410 #endif
411 
412 	if (!use_dma) {
413 		/*
414 		 * Unmap the dma buffer back to cpu if dma channel
415 		 * programming fails
416 		 */
417 		unmap_dma_buffer(req, musb);
418 
419 		musb_write_fifo(musb_ep->hw_ep, fifo_count,
420 				(u8 *) (request->buf + request->actual));
421 		request->actual += fifo_count;
422 		csr |= MUSB_TXCSR_TXPKTRDY;
423 		csr &= ~MUSB_TXCSR_P_UNDERRUN;
424 		musb_writew(epio, MUSB_TXCSR, csr);
425 	}
426 
427 	/* host may already have the data when this message shows... */
428 	dev_dbg(musb->controller, "%s TX/IN %s len %d/%d, txcsr %04x, fifo %d/%d\n",
429 			musb_ep->end_point.name, use_dma ? "dma" : "pio",
430 			request->actual, request->length,
431 			musb_readw(epio, MUSB_TXCSR),
432 			fifo_count,
433 			musb_readw(epio, MUSB_TXMAXP));
434 }
435 
436 /*
437  * FIFO state update (e.g. data ready).
438  * Called from IRQ,  with controller locked.
439  */
440 void musb_g_tx(struct musb *musb, u8 epnum)
441 {
442 	u16			csr;
443 	struct musb_request	*req;
444 	struct usb_request	*request;
445 	u8 __iomem		*mbase = musb->mregs;
446 	struct musb_ep		*musb_ep = &musb->endpoints[epnum].ep_in;
447 	void __iomem		*epio = musb->endpoints[epnum].regs;
448 	struct dma_channel	*dma;
449 
450 	musb_ep_select(mbase, epnum);
451 	req = next_request(musb_ep);
452 	request = &req->request;
453 
454 	csr = musb_readw(epio, MUSB_TXCSR);
455 	dev_dbg(musb->controller, "<== %s, txcsr %04x\n", musb_ep->end_point.name, csr);
456 
457 	dma = is_dma_capable() ? musb_ep->dma : NULL;
458 
459 	/*
460 	 * REVISIT: for high bandwidth, MUSB_TXCSR_P_INCOMPTX
461 	 * probably rates reporting as a host error.
462 	 */
463 	if (csr & MUSB_TXCSR_P_SENTSTALL) {
464 		csr |=	MUSB_TXCSR_P_WZC_BITS;
465 		csr &= ~MUSB_TXCSR_P_SENTSTALL;
466 		musb_writew(epio, MUSB_TXCSR, csr);
467 		return;
468 	}
469 
470 	if (csr & MUSB_TXCSR_P_UNDERRUN) {
471 		/* We NAKed, no big deal... little reason to care. */
472 		csr |=	 MUSB_TXCSR_P_WZC_BITS;
473 		csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
474 		musb_writew(epio, MUSB_TXCSR, csr);
475 		dev_vdbg(musb->controller, "underrun on ep%d, req %p\n",
476 				epnum, request);
477 	}
478 
479 	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
480 		/*
481 		 * SHOULD NOT HAPPEN... has with CPPI though, after
482 		 * changing SENDSTALL (and other cases); harmless?
483 		 */
484 		dev_dbg(musb->controller, "%s dma still busy?\n", musb_ep->end_point.name);
485 		return;
486 	}
487 
488 	if (request) {
489 		u8	is_dma = 0;
490 		bool	short_packet = false;
491 
492 		if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
493 			is_dma = 1;
494 			csr |= MUSB_TXCSR_P_WZC_BITS;
495 			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
496 				 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
497 			musb_writew(epio, MUSB_TXCSR, csr);
498 			/* Ensure writebuffer is empty. */
499 			csr = musb_readw(epio, MUSB_TXCSR);
500 			request->actual += musb_ep->dma->actual_len;
501 			dev_dbg(musb->controller, "TXCSR%d %04x, DMA off, len %zu, req %p\n",
502 				epnum, csr, musb_ep->dma->actual_len, request);
503 		}
504 
505 		/*
506 		 * First, maybe a terminating short packet. Some DMA
507 		 * engines might handle this by themselves.
508 		 */
509 		if ((request->zero && request->length)
510 			&& (request->length % musb_ep->packet_sz == 0)
511 			&& (request->actual == request->length))
512 				short_packet = true;
513 
514 		if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
515 			(is_dma && (!dma->desired_mode ||
516 				(request->actual &
517 					(musb_ep->packet_sz - 1)))))
518 				short_packet = true;
519 
520 		if (short_packet) {
521 			/*
522 			 * On DMA completion, FIFO may not be
523 			 * available yet...
524 			 */
525 			if (csr & MUSB_TXCSR_TXPKTRDY)
526 				return;
527 
528 			dev_dbg(musb->controller, "sending zero pkt\n");
529 			musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_MODE
530 					| MUSB_TXCSR_TXPKTRDY);
531 			request->zero = 0;
532 		}
533 
534 		if (request->actual == request->length) {
535 			musb_g_giveback(musb_ep, request, 0);
536 			/*
537 			 * In the giveback function the MUSB lock is
538 			 * released and acquired after sometime. During
539 			 * this time period the INDEX register could get
540 			 * changed by the gadget_queue function especially
541 			 * on SMP systems. Reselect the INDEX to be sure
542 			 * we are reading/modifying the right registers
543 			 */
544 			musb_ep_select(mbase, epnum);
545 			req = musb_ep->desc ? next_request(musb_ep) : NULL;
546 			if (!req) {
547 				dev_dbg(musb->controller, "%s idle now\n",
548 					musb_ep->end_point.name);
549 				return;
550 			}
551 		}
552 
553 		txstate(musb, req);
554 	}
555 }
556 
557 /* ------------------------------------------------------------ */
558 
559 /*
560  * Context: controller locked, IRQs blocked, endpoint selected
561  */
562 static void rxstate(struct musb *musb, struct musb_request *req)
563 {
564 	const u8		epnum = req->epnum;
565 	struct usb_request	*request = &req->request;
566 	struct musb_ep		*musb_ep;
567 	void __iomem		*epio = musb->endpoints[epnum].regs;
568 	unsigned		len = 0;
569 	u16			fifo_count;
570 	u16			csr = musb_readw(epio, MUSB_RXCSR);
571 	struct musb_hw_ep	*hw_ep = &musb->endpoints[epnum];
572 	u8			use_mode_1;
573 
574 	if (hw_ep->is_shared_fifo)
575 		musb_ep = &hw_ep->ep_in;
576 	else
577 		musb_ep = &hw_ep->ep_out;
578 
579 	fifo_count = musb_ep->packet_sz;
580 
581 	/* Check if EP is disabled */
582 	if (!musb_ep->desc) {
583 		dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
584 						musb_ep->end_point.name);
585 		return;
586 	}
587 
588 	/* We shouldn't get here while DMA is active, but we do... */
589 	if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
590 		dev_dbg(musb->controller, "DMA pending...\n");
591 		return;
592 	}
593 
594 	if (csr & MUSB_RXCSR_P_SENDSTALL) {
595 		dev_dbg(musb->controller, "%s stalling, RXCSR %04x\n",
596 		    musb_ep->end_point.name, csr);
597 		return;
598 	}
599 
600 	if (is_cppi_enabled(musb) && is_buffer_mapped(req)) {
601 		struct dma_controller	*c = musb->dma_controller;
602 		struct dma_channel	*channel = musb_ep->dma;
603 
604 		/* NOTE:  CPPI won't actually stop advancing the DMA
605 		 * queue after short packet transfers, so this is almost
606 		 * always going to run as IRQ-per-packet DMA so that
607 		 * faults will be handled correctly.
608 		 */
609 		if (c->channel_program(channel,
610 				musb_ep->packet_sz,
611 				!request->short_not_ok,
612 				request->dma + request->actual,
613 				request->length - request->actual)) {
614 
615 			/* make sure that if an rxpkt arrived after the irq,
616 			 * the cppi engine will be ready to take it as soon
617 			 * as DMA is enabled
618 			 */
619 			csr &= ~(MUSB_RXCSR_AUTOCLEAR
620 					| MUSB_RXCSR_DMAMODE);
621 			csr |= MUSB_RXCSR_DMAENAB | MUSB_RXCSR_P_WZC_BITS;
622 			musb_writew(epio, MUSB_RXCSR, csr);
623 			return;
624 		}
625 	}
626 
627 	if (csr & MUSB_RXCSR_RXPKTRDY) {
628 		fifo_count = musb_readw(epio, MUSB_RXCOUNT);
629 
630 		/*
631 		 * Enable Mode 1 on RX transfers only when short_not_ok flag
632 		 * is set. Currently short_not_ok flag is set only from
633 		 * file_storage and f_mass_storage drivers
634 		 */
635 
636 		if (request->short_not_ok && fifo_count == musb_ep->packet_sz)
637 			use_mode_1 = 1;
638 		else
639 			use_mode_1 = 0;
640 
641 		if (request->actual < request->length) {
642 			if (!is_buffer_mapped(req))
643 				goto buffer_aint_mapped;
644 
645 			if (musb_dma_inventra(musb)) {
646 				struct dma_controller	*c;
647 				struct dma_channel	*channel;
648 				int			use_dma = 0;
649 				unsigned int transfer_size;
650 
651 				c = musb->dma_controller;
652 				channel = musb_ep->dma;
653 
654 	/* We use DMA Req mode 0 in rx_csr, and DMA controller operates in
655 	 * mode 0 only. So we do not get endpoint interrupts due to DMA
656 	 * completion. We only get interrupts from DMA controller.
657 	 *
658 	 * We could operate in DMA mode 1 if we knew the size of the tranfer
659 	 * in advance. For mass storage class, request->length = what the host
660 	 * sends, so that'd work.  But for pretty much everything else,
661 	 * request->length is routinely more than what the host sends. For
662 	 * most these gadgets, end of is signified either by a short packet,
663 	 * or filling the last byte of the buffer.  (Sending extra data in
664 	 * that last pckate should trigger an overflow fault.)  But in mode 1,
665 	 * we don't get DMA completion interrupt for short packets.
666 	 *
667 	 * Theoretically, we could enable DMAReq irq (MUSB_RXCSR_DMAMODE = 1),
668 	 * to get endpoint interrupt on every DMA req, but that didn't seem
669 	 * to work reliably.
670 	 *
671 	 * REVISIT an updated g_file_storage can set req->short_not_ok, which
672 	 * then becomes usable as a runtime "use mode 1" hint...
673 	 */
674 
675 				/* Experimental: Mode1 works with mass storage use cases */
676 				if (use_mode_1) {
677 					csr |= MUSB_RXCSR_AUTOCLEAR;
678 					musb_writew(epio, MUSB_RXCSR, csr);
679 					csr |= MUSB_RXCSR_DMAENAB;
680 					musb_writew(epio, MUSB_RXCSR, csr);
681 
682 					/*
683 					 * this special sequence (enabling and then
684 					 * disabling MUSB_RXCSR_DMAMODE) is required
685 					 * to get DMAReq to activate
686 					 */
687 					musb_writew(epio, MUSB_RXCSR,
688 						csr | MUSB_RXCSR_DMAMODE);
689 					musb_writew(epio, MUSB_RXCSR, csr);
690 
691 					transfer_size = min_t(unsigned int,
692 							request->length -
693 							request->actual,
694 							channel->max_len);
695 					musb_ep->dma->desired_mode = 1;
696 				} else {
697 					if (!musb_ep->hb_mult &&
698 						musb_ep->hw_ep->rx_double_buffered)
699 						csr |= MUSB_RXCSR_AUTOCLEAR;
700 					csr |= MUSB_RXCSR_DMAENAB;
701 					musb_writew(epio, MUSB_RXCSR, csr);
702 
703 					transfer_size = min(request->length - request->actual,
704 							(unsigned)fifo_count);
705 					musb_ep->dma->desired_mode = 0;
706 				}
707 
708 				use_dma = c->channel_program(
709 						channel,
710 						musb_ep->packet_sz,
711 						channel->desired_mode,
712 						request->dma
713 						+ request->actual,
714 						transfer_size);
715 
716 				if (use_dma)
717 					return;
718 			}
719 
720 			if ((musb_dma_ux500(musb)) &&
721 				(request->actual < request->length)) {
722 
723 				struct dma_controller *c;
724 				struct dma_channel *channel;
725 				unsigned int transfer_size = 0;
726 
727 				c = musb->dma_controller;
728 				channel = musb_ep->dma;
729 
730 				/* In case first packet is short */
731 				if (fifo_count < musb_ep->packet_sz)
732 					transfer_size = fifo_count;
733 				else if (request->short_not_ok)
734 					transfer_size =	min_t(unsigned int,
735 							request->length -
736 							request->actual,
737 							channel->max_len);
738 				else
739 					transfer_size = min_t(unsigned int,
740 							request->length -
741 							request->actual,
742 							(unsigned)fifo_count);
743 
744 				csr &= ~MUSB_RXCSR_DMAMODE;
745 				csr |= (MUSB_RXCSR_DMAENAB |
746 					MUSB_RXCSR_AUTOCLEAR);
747 
748 				musb_writew(epio, MUSB_RXCSR, csr);
749 
750 				if (transfer_size <= musb_ep->packet_sz) {
751 					musb_ep->dma->desired_mode = 0;
752 				} else {
753 					musb_ep->dma->desired_mode = 1;
754 					/* Mode must be set after DMAENAB */
755 					csr |= MUSB_RXCSR_DMAMODE;
756 					musb_writew(epio, MUSB_RXCSR, csr);
757 				}
758 
759 				if (c->channel_program(channel,
760 							musb_ep->packet_sz,
761 							channel->desired_mode,
762 							request->dma
763 							+ request->actual,
764 							transfer_size))
765 
766 					return;
767 			}
768 
769 			len = request->length - request->actual;
770 			dev_dbg(musb->controller, "%s OUT/RX pio fifo %d/%d, maxpacket %d\n",
771 					musb_ep->end_point.name,
772 					fifo_count, len,
773 					musb_ep->packet_sz);
774 
775 			fifo_count = min_t(unsigned, len, fifo_count);
776 
777 			if (tusb_dma_omap(musb)) {
778 				struct dma_controller *c = musb->dma_controller;
779 				struct dma_channel *channel = musb_ep->dma;
780 				u32 dma_addr = request->dma + request->actual;
781 				int ret;
782 
783 				ret = c->channel_program(channel,
784 						musb_ep->packet_sz,
785 						channel->desired_mode,
786 						dma_addr,
787 						fifo_count);
788 				if (ret)
789 					return;
790 			}
791 
792 			/*
793 			 * Unmap the dma buffer back to cpu if dma channel
794 			 * programming fails. This buffer is mapped if the
795 			 * channel allocation is successful
796 			 */
797 			unmap_dma_buffer(req, musb);
798 
799 			/*
800 			 * Clear DMAENAB and AUTOCLEAR for the
801 			 * PIO mode transfer
802 			 */
803 			csr &= ~(MUSB_RXCSR_DMAENAB | MUSB_RXCSR_AUTOCLEAR);
804 			musb_writew(epio, MUSB_RXCSR, csr);
805 
806 buffer_aint_mapped:
807 			musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
808 					(request->buf + request->actual));
809 			request->actual += fifo_count;
810 
811 			/* REVISIT if we left anything in the fifo, flush
812 			 * it and report -EOVERFLOW
813 			 */
814 
815 			/* ack the read! */
816 			csr |= MUSB_RXCSR_P_WZC_BITS;
817 			csr &= ~MUSB_RXCSR_RXPKTRDY;
818 			musb_writew(epio, MUSB_RXCSR, csr);
819 		}
820 	}
821 
822 	/* reach the end or short packet detected */
823 	if (request->actual == request->length ||
824 	    fifo_count < musb_ep->packet_sz)
825 		musb_g_giveback(musb_ep, request, 0);
826 }
827 
828 /*
829  * Data ready for a request; called from IRQ
830  */
831 void musb_g_rx(struct musb *musb, u8 epnum)
832 {
833 	u16			csr;
834 	struct musb_request	*req;
835 	struct usb_request	*request;
836 	void __iomem		*mbase = musb->mregs;
837 	struct musb_ep		*musb_ep;
838 	void __iomem		*epio = musb->endpoints[epnum].regs;
839 	struct dma_channel	*dma;
840 	struct musb_hw_ep	*hw_ep = &musb->endpoints[epnum];
841 
842 	if (hw_ep->is_shared_fifo)
843 		musb_ep = &hw_ep->ep_in;
844 	else
845 		musb_ep = &hw_ep->ep_out;
846 
847 	musb_ep_select(mbase, epnum);
848 
849 	req = next_request(musb_ep);
850 	if (!req)
851 		return;
852 
853 	request = &req->request;
854 
855 	csr = musb_readw(epio, MUSB_RXCSR);
856 	dma = is_dma_capable() ? musb_ep->dma : NULL;
857 
858 	dev_dbg(musb->controller, "<== %s, rxcsr %04x%s %p\n", musb_ep->end_point.name,
859 			csr, dma ? " (dma)" : "", request);
860 
861 	if (csr & MUSB_RXCSR_P_SENTSTALL) {
862 		csr |= MUSB_RXCSR_P_WZC_BITS;
863 		csr &= ~MUSB_RXCSR_P_SENTSTALL;
864 		musb_writew(epio, MUSB_RXCSR, csr);
865 		return;
866 	}
867 
868 	if (csr & MUSB_RXCSR_P_OVERRUN) {
869 		/* csr |= MUSB_RXCSR_P_WZC_BITS; */
870 		csr &= ~MUSB_RXCSR_P_OVERRUN;
871 		musb_writew(epio, MUSB_RXCSR, csr);
872 
873 		dev_dbg(musb->controller, "%s iso overrun on %p\n", musb_ep->name, request);
874 		if (request->status == -EINPROGRESS)
875 			request->status = -EOVERFLOW;
876 	}
877 	if (csr & MUSB_RXCSR_INCOMPRX) {
878 		/* REVISIT not necessarily an error */
879 		dev_dbg(musb->controller, "%s, incomprx\n", musb_ep->end_point.name);
880 	}
881 
882 	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
883 		/* "should not happen"; likely RXPKTRDY pending for DMA */
884 		dev_dbg(musb->controller, "%s busy, csr %04x\n",
885 			musb_ep->end_point.name, csr);
886 		return;
887 	}
888 
889 	if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
890 		csr &= ~(MUSB_RXCSR_AUTOCLEAR
891 				| MUSB_RXCSR_DMAENAB
892 				| MUSB_RXCSR_DMAMODE);
893 		musb_writew(epio, MUSB_RXCSR,
894 			MUSB_RXCSR_P_WZC_BITS | csr);
895 
896 		request->actual += musb_ep->dma->actual_len;
897 
898 		dev_dbg(musb->controller, "RXCSR%d %04x, dma off, %04x, len %zu, req %p\n",
899 			epnum, csr,
900 			musb_readw(epio, MUSB_RXCSR),
901 			musb_ep->dma->actual_len, request);
902 
903 #if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_TUSB_OMAP_DMA) || \
904 	defined(CONFIG_USB_UX500_DMA)
905 		/* Autoclear doesn't clear RxPktRdy for short packets */
906 		if ((dma->desired_mode == 0 && !hw_ep->rx_double_buffered)
907 				|| (dma->actual_len
908 					& (musb_ep->packet_sz - 1))) {
909 			/* ack the read! */
910 			csr &= ~MUSB_RXCSR_RXPKTRDY;
911 			musb_writew(epio, MUSB_RXCSR, csr);
912 		}
913 
914 		/* incomplete, and not short? wait for next IN packet */
915 		if ((request->actual < request->length)
916 				&& (musb_ep->dma->actual_len
917 					== musb_ep->packet_sz)) {
918 			/* In double buffer case, continue to unload fifo if
919  			 * there is Rx packet in FIFO.
920  			 **/
921 			csr = musb_readw(epio, MUSB_RXCSR);
922 			if ((csr & MUSB_RXCSR_RXPKTRDY) &&
923 				hw_ep->rx_double_buffered)
924 				goto exit;
925 			return;
926 		}
927 #endif
928 		musb_g_giveback(musb_ep, request, 0);
929 		/*
930 		 * In the giveback function the MUSB lock is
931 		 * released and acquired after sometime. During
932 		 * this time period the INDEX register could get
933 		 * changed by the gadget_queue function especially
934 		 * on SMP systems. Reselect the INDEX to be sure
935 		 * we are reading/modifying the right registers
936 		 */
937 		musb_ep_select(mbase, epnum);
938 
939 		req = next_request(musb_ep);
940 		if (!req)
941 			return;
942 	}
943 #if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_TUSB_OMAP_DMA) || \
944 	defined(CONFIG_USB_UX500_DMA)
945 exit:
946 #endif
947 	/* Analyze request */
948 	rxstate(musb, req);
949 }
950 
951 /* ------------------------------------------------------------ */
952 
953 static int musb_gadget_enable(struct usb_ep *ep,
954 			const struct usb_endpoint_descriptor *desc)
955 {
956 	unsigned long		flags;
957 	struct musb_ep		*musb_ep;
958 	struct musb_hw_ep	*hw_ep;
959 	void __iomem		*regs;
960 	struct musb		*musb;
961 	void __iomem	*mbase;
962 	u8		epnum;
963 	u16		csr;
964 	unsigned	tmp;
965 	int		status = -EINVAL;
966 
967 	if (!ep || !desc)
968 		return -EINVAL;
969 
970 	musb_ep = to_musb_ep(ep);
971 	hw_ep = musb_ep->hw_ep;
972 	regs = hw_ep->regs;
973 	musb = musb_ep->musb;
974 	mbase = musb->mregs;
975 	epnum = musb_ep->current_epnum;
976 
977 	spin_lock_irqsave(&musb->lock, flags);
978 
979 	if (musb_ep->desc) {
980 		status = -EBUSY;
981 		goto fail;
982 	}
983 	musb_ep->type = usb_endpoint_type(desc);
984 
985 	/* check direction and (later) maxpacket size against endpoint */
986 	if (usb_endpoint_num(desc) != epnum)
987 		goto fail;
988 
989 	/* REVISIT this rules out high bandwidth periodic transfers */
990 	tmp = usb_endpoint_maxp(desc);
991 	if (tmp & ~0x07ff) {
992 		int ok;
993 
994 		if (usb_endpoint_dir_in(desc))
995 			ok = musb->hb_iso_tx;
996 		else
997 			ok = musb->hb_iso_rx;
998 
999 		if (!ok) {
1000 			dev_dbg(musb->controller, "no support for high bandwidth ISO\n");
1001 			goto fail;
1002 		}
1003 		musb_ep->hb_mult = (tmp >> 11) & 3;
1004 	} else {
1005 		musb_ep->hb_mult = 0;
1006 	}
1007 
1008 	musb_ep->packet_sz = tmp & 0x7ff;
1009 	tmp = musb_ep->packet_sz * (musb_ep->hb_mult + 1);
1010 
1011 	/* enable the interrupts for the endpoint, set the endpoint
1012 	 * packet size (or fail), set the mode, clear the fifo
1013 	 */
1014 	musb_ep_select(mbase, epnum);
1015 	if (usb_endpoint_dir_in(desc)) {
1016 
1017 		if (hw_ep->is_shared_fifo)
1018 			musb_ep->is_in = 1;
1019 		if (!musb_ep->is_in)
1020 			goto fail;
1021 
1022 		if (tmp > hw_ep->max_packet_sz_tx) {
1023 			dev_dbg(musb->controller, "packet size beyond hardware FIFO size\n");
1024 			goto fail;
1025 		}
1026 
1027 		musb->intrtxe |= (1 << epnum);
1028 		musb_writew(mbase, MUSB_INTRTXE, musb->intrtxe);
1029 
1030 		/* REVISIT if can_bulk_split(), use by updating "tmp";
1031 		 * likewise high bandwidth periodic tx
1032 		 */
1033 		/* Set TXMAXP with the FIFO size of the endpoint
1034 		 * to disable double buffering mode.
1035 		 */
1036 		if (musb->double_buffer_not_ok) {
1037 			musb_writew(regs, MUSB_TXMAXP, hw_ep->max_packet_sz_tx);
1038 		} else {
1039 			if (can_bulk_split(musb, musb_ep->type))
1040 				musb_ep->hb_mult = (hw_ep->max_packet_sz_tx /
1041 							musb_ep->packet_sz) - 1;
1042 			musb_writew(regs, MUSB_TXMAXP, musb_ep->packet_sz
1043 					| (musb_ep->hb_mult << 11));
1044 		}
1045 
1046 		csr = MUSB_TXCSR_MODE | MUSB_TXCSR_CLRDATATOG;
1047 		if (musb_readw(regs, MUSB_TXCSR)
1048 				& MUSB_TXCSR_FIFONOTEMPTY)
1049 			csr |= MUSB_TXCSR_FLUSHFIFO;
1050 		if (musb_ep->type == USB_ENDPOINT_XFER_ISOC)
1051 			csr |= MUSB_TXCSR_P_ISO;
1052 
1053 		/* set twice in case of double buffering */
1054 		musb_writew(regs, MUSB_TXCSR, csr);
1055 		/* REVISIT may be inappropriate w/o FIFONOTEMPTY ... */
1056 		musb_writew(regs, MUSB_TXCSR, csr);
1057 
1058 	} else {
1059 
1060 		if (hw_ep->is_shared_fifo)
1061 			musb_ep->is_in = 0;
1062 		if (musb_ep->is_in)
1063 			goto fail;
1064 
1065 		if (tmp > hw_ep->max_packet_sz_rx) {
1066 			dev_dbg(musb->controller, "packet size beyond hardware FIFO size\n");
1067 			goto fail;
1068 		}
1069 
1070 		musb->intrrxe |= (1 << epnum);
1071 		musb_writew(mbase, MUSB_INTRRXE, musb->intrrxe);
1072 
1073 		/* REVISIT if can_bulk_combine() use by updating "tmp"
1074 		 * likewise high bandwidth periodic rx
1075 		 */
1076 		/* Set RXMAXP with the FIFO size of the endpoint
1077 		 * to disable double buffering mode.
1078 		 */
1079 		if (musb->double_buffer_not_ok)
1080 			musb_writew(regs, MUSB_RXMAXP, hw_ep->max_packet_sz_tx);
1081 		else
1082 			musb_writew(regs, MUSB_RXMAXP, musb_ep->packet_sz
1083 					| (musb_ep->hb_mult << 11));
1084 
1085 		/* force shared fifo to OUT-only mode */
1086 		if (hw_ep->is_shared_fifo) {
1087 			csr = musb_readw(regs, MUSB_TXCSR);
1088 			csr &= ~(MUSB_TXCSR_MODE | MUSB_TXCSR_TXPKTRDY);
1089 			musb_writew(regs, MUSB_TXCSR, csr);
1090 		}
1091 
1092 		csr = MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_CLRDATATOG;
1093 		if (musb_ep->type == USB_ENDPOINT_XFER_ISOC)
1094 			csr |= MUSB_RXCSR_P_ISO;
1095 		else if (musb_ep->type == USB_ENDPOINT_XFER_INT)
1096 			csr |= MUSB_RXCSR_DISNYET;
1097 
1098 		/* set twice in case of double buffering */
1099 		musb_writew(regs, MUSB_RXCSR, csr);
1100 		musb_writew(regs, MUSB_RXCSR, csr);
1101 	}
1102 
1103 	/* NOTE:  all the I/O code _should_ work fine without DMA, in case
1104 	 * for some reason you run out of channels here.
1105 	 */
1106 	if (is_dma_capable() && musb->dma_controller) {
1107 		struct dma_controller	*c = musb->dma_controller;
1108 
1109 		musb_ep->dma = c->channel_alloc(c, hw_ep,
1110 				(desc->bEndpointAddress & USB_DIR_IN));
1111 	} else
1112 		musb_ep->dma = NULL;
1113 
1114 	musb_ep->desc = desc;
1115 	musb_ep->busy = 0;
1116 	musb_ep->wedged = 0;
1117 	status = 0;
1118 
1119 	pr_debug("%s periph: enabled %s for %s %s, %smaxpacket %d\n",
1120 			musb_driver_name, musb_ep->end_point.name,
1121 			({ char *s; switch (musb_ep->type) {
1122 			case USB_ENDPOINT_XFER_BULK:	s = "bulk"; break;
1123 			case USB_ENDPOINT_XFER_INT:	s = "int"; break;
1124 			default:			s = "iso"; break;
1125 			} s; }),
1126 			musb_ep->is_in ? "IN" : "OUT",
1127 			musb_ep->dma ? "dma, " : "",
1128 			musb_ep->packet_sz);
1129 
1130 	schedule_work(&musb->irq_work);
1131 
1132 fail:
1133 	spin_unlock_irqrestore(&musb->lock, flags);
1134 	return status;
1135 }
1136 
1137 /*
1138  * Disable an endpoint flushing all requests queued.
1139  */
1140 static int musb_gadget_disable(struct usb_ep *ep)
1141 {
1142 	unsigned long	flags;
1143 	struct musb	*musb;
1144 	u8		epnum;
1145 	struct musb_ep	*musb_ep;
1146 	void __iomem	*epio;
1147 	int		status = 0;
1148 
1149 	musb_ep = to_musb_ep(ep);
1150 	musb = musb_ep->musb;
1151 	epnum = musb_ep->current_epnum;
1152 	epio = musb->endpoints[epnum].regs;
1153 
1154 	spin_lock_irqsave(&musb->lock, flags);
1155 	musb_ep_select(musb->mregs, epnum);
1156 
1157 	/* zero the endpoint sizes */
1158 	if (musb_ep->is_in) {
1159 		musb->intrtxe &= ~(1 << epnum);
1160 		musb_writew(musb->mregs, MUSB_INTRTXE, musb->intrtxe);
1161 		musb_writew(epio, MUSB_TXMAXP, 0);
1162 	} else {
1163 		musb->intrrxe &= ~(1 << epnum);
1164 		musb_writew(musb->mregs, MUSB_INTRRXE, musb->intrrxe);
1165 		musb_writew(epio, MUSB_RXMAXP, 0);
1166 	}
1167 
1168 	musb_ep->desc = NULL;
1169 	musb_ep->end_point.desc = NULL;
1170 
1171 	/* abort all pending DMA and requests */
1172 	nuke(musb_ep, -ESHUTDOWN);
1173 
1174 	schedule_work(&musb->irq_work);
1175 
1176 	spin_unlock_irqrestore(&(musb->lock), flags);
1177 
1178 	dev_dbg(musb->controller, "%s\n", musb_ep->end_point.name);
1179 
1180 	return status;
1181 }
1182 
1183 /*
1184  * Allocate a request for an endpoint.
1185  * Reused by ep0 code.
1186  */
1187 struct usb_request *musb_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
1188 {
1189 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1190 	struct musb		*musb = musb_ep->musb;
1191 	struct musb_request	*request = NULL;
1192 
1193 	request = kzalloc(sizeof *request, gfp_flags);
1194 	if (!request) {
1195 		dev_dbg(musb->controller, "not enough memory\n");
1196 		return NULL;
1197 	}
1198 
1199 	request->request.dma = DMA_ADDR_INVALID;
1200 	request->epnum = musb_ep->current_epnum;
1201 	request->ep = musb_ep;
1202 
1203 	return &request->request;
1204 }
1205 
1206 /*
1207  * Free a request
1208  * Reused by ep0 code.
1209  */
1210 void musb_free_request(struct usb_ep *ep, struct usb_request *req)
1211 {
1212 	kfree(to_musb_request(req));
1213 }
1214 
1215 static LIST_HEAD(buffers);
1216 
1217 struct free_record {
1218 	struct list_head	list;
1219 	struct device		*dev;
1220 	unsigned		bytes;
1221 	dma_addr_t		dma;
1222 };
1223 
1224 /*
1225  * Context: controller locked, IRQs blocked.
1226  */
1227 void musb_ep_restart(struct musb *musb, struct musb_request *req)
1228 {
1229 	dev_dbg(musb->controller, "<== %s request %p len %u on hw_ep%d\n",
1230 		req->tx ? "TX/IN" : "RX/OUT",
1231 		&req->request, req->request.length, req->epnum);
1232 
1233 	musb_ep_select(musb->mregs, req->epnum);
1234 	if (req->tx)
1235 		txstate(musb, req);
1236 	else
1237 		rxstate(musb, req);
1238 }
1239 
1240 static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
1241 			gfp_t gfp_flags)
1242 {
1243 	struct musb_ep		*musb_ep;
1244 	struct musb_request	*request;
1245 	struct musb		*musb;
1246 	int			status = 0;
1247 	unsigned long		lockflags;
1248 
1249 	if (!ep || !req)
1250 		return -EINVAL;
1251 	if (!req->buf)
1252 		return -ENODATA;
1253 
1254 	musb_ep = to_musb_ep(ep);
1255 	musb = musb_ep->musb;
1256 
1257 	request = to_musb_request(req);
1258 	request->musb = musb;
1259 
1260 	if (request->ep != musb_ep)
1261 		return -EINVAL;
1262 
1263 	dev_dbg(musb->controller, "<== to %s request=%p\n", ep->name, req);
1264 
1265 	/* request is mine now... */
1266 	request->request.actual = 0;
1267 	request->request.status = -EINPROGRESS;
1268 	request->epnum = musb_ep->current_epnum;
1269 	request->tx = musb_ep->is_in;
1270 
1271 	map_dma_buffer(request, musb, musb_ep);
1272 
1273 	spin_lock_irqsave(&musb->lock, lockflags);
1274 
1275 	/* don't queue if the ep is down */
1276 	if (!musb_ep->desc) {
1277 		dev_dbg(musb->controller, "req %p queued to %s while ep %s\n",
1278 				req, ep->name, "disabled");
1279 		status = -ESHUTDOWN;
1280 		unmap_dma_buffer(request, musb);
1281 		goto unlock;
1282 	}
1283 
1284 	/* add request to the list */
1285 	list_add_tail(&request->list, &musb_ep->req_list);
1286 
1287 	/* it this is the head of the queue, start i/o ... */
1288 	if (!musb_ep->busy && &request->list == musb_ep->req_list.next)
1289 		musb_ep_restart(musb, request);
1290 
1291 unlock:
1292 	spin_unlock_irqrestore(&musb->lock, lockflags);
1293 	return status;
1294 }
1295 
1296 static int musb_gadget_dequeue(struct usb_ep *ep, struct usb_request *request)
1297 {
1298 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1299 	struct musb_request	*req = to_musb_request(request);
1300 	struct musb_request	*r;
1301 	unsigned long		flags;
1302 	int			status = 0;
1303 	struct musb		*musb = musb_ep->musb;
1304 
1305 	if (!ep || !request || to_musb_request(request)->ep != musb_ep)
1306 		return -EINVAL;
1307 
1308 	spin_lock_irqsave(&musb->lock, flags);
1309 
1310 	list_for_each_entry(r, &musb_ep->req_list, list) {
1311 		if (r == req)
1312 			break;
1313 	}
1314 	if (r != req) {
1315 		dev_dbg(musb->controller, "request %p not queued to %s\n", request, ep->name);
1316 		status = -EINVAL;
1317 		goto done;
1318 	}
1319 
1320 	/* if the hardware doesn't have the request, easy ... */
1321 	if (musb_ep->req_list.next != &req->list || musb_ep->busy)
1322 		musb_g_giveback(musb_ep, request, -ECONNRESET);
1323 
1324 	/* ... else abort the dma transfer ... */
1325 	else if (is_dma_capable() && musb_ep->dma) {
1326 		struct dma_controller	*c = musb->dma_controller;
1327 
1328 		musb_ep_select(musb->mregs, musb_ep->current_epnum);
1329 		if (c->channel_abort)
1330 			status = c->channel_abort(musb_ep->dma);
1331 		else
1332 			status = -EBUSY;
1333 		if (status == 0)
1334 			musb_g_giveback(musb_ep, request, -ECONNRESET);
1335 	} else {
1336 		/* NOTE: by sticking to easily tested hardware/driver states,
1337 		 * we leave counting of in-flight packets imprecise.
1338 		 */
1339 		musb_g_giveback(musb_ep, request, -ECONNRESET);
1340 	}
1341 
1342 done:
1343 	spin_unlock_irqrestore(&musb->lock, flags);
1344 	return status;
1345 }
1346 
1347 /*
1348  * Set or clear the halt bit of an endpoint. A halted enpoint won't tx/rx any
1349  * data but will queue requests.
1350  *
1351  * exported to ep0 code
1352  */
1353 static int musb_gadget_set_halt(struct usb_ep *ep, int value)
1354 {
1355 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1356 	u8			epnum = musb_ep->current_epnum;
1357 	struct musb		*musb = musb_ep->musb;
1358 	void __iomem		*epio = musb->endpoints[epnum].regs;
1359 	void __iomem		*mbase;
1360 	unsigned long		flags;
1361 	u16			csr;
1362 	struct musb_request	*request;
1363 	int			status = 0;
1364 
1365 	if (!ep)
1366 		return -EINVAL;
1367 	mbase = musb->mregs;
1368 
1369 	spin_lock_irqsave(&musb->lock, flags);
1370 
1371 	if ((USB_ENDPOINT_XFER_ISOC == musb_ep->type)) {
1372 		status = -EINVAL;
1373 		goto done;
1374 	}
1375 
1376 	musb_ep_select(mbase, epnum);
1377 
1378 	request = next_request(musb_ep);
1379 	if (value) {
1380 		if (request) {
1381 			dev_dbg(musb->controller, "request in progress, cannot halt %s\n",
1382 			    ep->name);
1383 			status = -EAGAIN;
1384 			goto done;
1385 		}
1386 		/* Cannot portably stall with non-empty FIFO */
1387 		if (musb_ep->is_in) {
1388 			csr = musb_readw(epio, MUSB_TXCSR);
1389 			if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
1390 				dev_dbg(musb->controller, "FIFO busy, cannot halt %s\n", ep->name);
1391 				status = -EAGAIN;
1392 				goto done;
1393 			}
1394 		}
1395 	} else
1396 		musb_ep->wedged = 0;
1397 
1398 	/* set/clear the stall and toggle bits */
1399 	dev_dbg(musb->controller, "%s: %s stall\n", ep->name, value ? "set" : "clear");
1400 	if (musb_ep->is_in) {
1401 		csr = musb_readw(epio, MUSB_TXCSR);
1402 		csr |= MUSB_TXCSR_P_WZC_BITS
1403 			| MUSB_TXCSR_CLRDATATOG;
1404 		if (value)
1405 			csr |= MUSB_TXCSR_P_SENDSTALL;
1406 		else
1407 			csr &= ~(MUSB_TXCSR_P_SENDSTALL
1408 				| MUSB_TXCSR_P_SENTSTALL);
1409 		csr &= ~MUSB_TXCSR_TXPKTRDY;
1410 		musb_writew(epio, MUSB_TXCSR, csr);
1411 	} else {
1412 		csr = musb_readw(epio, MUSB_RXCSR);
1413 		csr |= MUSB_RXCSR_P_WZC_BITS
1414 			| MUSB_RXCSR_FLUSHFIFO
1415 			| MUSB_RXCSR_CLRDATATOG;
1416 		if (value)
1417 			csr |= MUSB_RXCSR_P_SENDSTALL;
1418 		else
1419 			csr &= ~(MUSB_RXCSR_P_SENDSTALL
1420 				| MUSB_RXCSR_P_SENTSTALL);
1421 		musb_writew(epio, MUSB_RXCSR, csr);
1422 	}
1423 
1424 	/* maybe start the first request in the queue */
1425 	if (!musb_ep->busy && !value && request) {
1426 		dev_dbg(musb->controller, "restarting the request\n");
1427 		musb_ep_restart(musb, request);
1428 	}
1429 
1430 done:
1431 	spin_unlock_irqrestore(&musb->lock, flags);
1432 	return status;
1433 }
1434 
1435 /*
1436  * Sets the halt feature with the clear requests ignored
1437  */
1438 static int musb_gadget_set_wedge(struct usb_ep *ep)
1439 {
1440 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1441 
1442 	if (!ep)
1443 		return -EINVAL;
1444 
1445 	musb_ep->wedged = 1;
1446 
1447 	return usb_ep_set_halt(ep);
1448 }
1449 
1450 static int musb_gadget_fifo_status(struct usb_ep *ep)
1451 {
1452 	struct musb_ep		*musb_ep = to_musb_ep(ep);
1453 	void __iomem		*epio = musb_ep->hw_ep->regs;
1454 	int			retval = -EINVAL;
1455 
1456 	if (musb_ep->desc && !musb_ep->is_in) {
1457 		struct musb		*musb = musb_ep->musb;
1458 		int			epnum = musb_ep->current_epnum;
1459 		void __iomem		*mbase = musb->mregs;
1460 		unsigned long		flags;
1461 
1462 		spin_lock_irqsave(&musb->lock, flags);
1463 
1464 		musb_ep_select(mbase, epnum);
1465 		/* FIXME return zero unless RXPKTRDY is set */
1466 		retval = musb_readw(epio, MUSB_RXCOUNT);
1467 
1468 		spin_unlock_irqrestore(&musb->lock, flags);
1469 	}
1470 	return retval;
1471 }
1472 
1473 static void musb_gadget_fifo_flush(struct usb_ep *ep)
1474 {
1475 	struct musb_ep	*musb_ep = to_musb_ep(ep);
1476 	struct musb	*musb = musb_ep->musb;
1477 	u8		epnum = musb_ep->current_epnum;
1478 	void __iomem	*epio = musb->endpoints[epnum].regs;
1479 	void __iomem	*mbase;
1480 	unsigned long	flags;
1481 	u16		csr;
1482 
1483 	mbase = musb->mregs;
1484 
1485 	spin_lock_irqsave(&musb->lock, flags);
1486 	musb_ep_select(mbase, (u8) epnum);
1487 
1488 	/* disable interrupts */
1489 	musb_writew(mbase, MUSB_INTRTXE, musb->intrtxe & ~(1 << epnum));
1490 
1491 	if (musb_ep->is_in) {
1492 		csr = musb_readw(epio, MUSB_TXCSR);
1493 		if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
1494 			csr |= MUSB_TXCSR_FLUSHFIFO | MUSB_TXCSR_P_WZC_BITS;
1495 			/*
1496 			 * Setting both TXPKTRDY and FLUSHFIFO makes controller
1497 			 * to interrupt current FIFO loading, but not flushing
1498 			 * the already loaded ones.
1499 			 */
1500 			csr &= ~MUSB_TXCSR_TXPKTRDY;
1501 			musb_writew(epio, MUSB_TXCSR, csr);
1502 			/* REVISIT may be inappropriate w/o FIFONOTEMPTY ... */
1503 			musb_writew(epio, MUSB_TXCSR, csr);
1504 		}
1505 	} else {
1506 		csr = musb_readw(epio, MUSB_RXCSR);
1507 		csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_P_WZC_BITS;
1508 		musb_writew(epio, MUSB_RXCSR, csr);
1509 		musb_writew(epio, MUSB_RXCSR, csr);
1510 	}
1511 
1512 	/* re-enable interrupt */
1513 	musb_writew(mbase, MUSB_INTRTXE, musb->intrtxe);
1514 	spin_unlock_irqrestore(&musb->lock, flags);
1515 }
1516 
1517 static const struct usb_ep_ops musb_ep_ops = {
1518 	.enable		= musb_gadget_enable,
1519 	.disable	= musb_gadget_disable,
1520 	.alloc_request	= musb_alloc_request,
1521 	.free_request	= musb_free_request,
1522 	.queue		= musb_gadget_queue,
1523 	.dequeue	= musb_gadget_dequeue,
1524 	.set_halt	= musb_gadget_set_halt,
1525 	.set_wedge	= musb_gadget_set_wedge,
1526 	.fifo_status	= musb_gadget_fifo_status,
1527 	.fifo_flush	= musb_gadget_fifo_flush
1528 };
1529 
1530 /* ----------------------------------------------------------------------- */
1531 
1532 static int musb_gadget_get_frame(struct usb_gadget *gadget)
1533 {
1534 	struct musb	*musb = gadget_to_musb(gadget);
1535 
1536 	return (int)musb_readw(musb->mregs, MUSB_FRAME);
1537 }
1538 
1539 static int musb_gadget_wakeup(struct usb_gadget *gadget)
1540 {
1541 	struct musb	*musb = gadget_to_musb(gadget);
1542 	void __iomem	*mregs = musb->mregs;
1543 	unsigned long	flags;
1544 	int		status = -EINVAL;
1545 	u8		power, devctl;
1546 	int		retries;
1547 
1548 	spin_lock_irqsave(&musb->lock, flags);
1549 
1550 	switch (musb->xceiv->otg->state) {
1551 	case OTG_STATE_B_PERIPHERAL:
1552 		/* NOTE:  OTG state machine doesn't include B_SUSPENDED;
1553 		 * that's part of the standard usb 1.1 state machine, and
1554 		 * doesn't affect OTG transitions.
1555 		 */
1556 		if (musb->may_wakeup && musb->is_suspended)
1557 			break;
1558 		goto done;
1559 	case OTG_STATE_B_IDLE:
1560 		/* Start SRP ... OTG not required. */
1561 		devctl = musb_readb(mregs, MUSB_DEVCTL);
1562 		dev_dbg(musb->controller, "Sending SRP: devctl: %02x\n", devctl);
1563 		devctl |= MUSB_DEVCTL_SESSION;
1564 		musb_writeb(mregs, MUSB_DEVCTL, devctl);
1565 		devctl = musb_readb(mregs, MUSB_DEVCTL);
1566 		retries = 100;
1567 		while (!(devctl & MUSB_DEVCTL_SESSION)) {
1568 			devctl = musb_readb(mregs, MUSB_DEVCTL);
1569 			if (retries-- < 1)
1570 				break;
1571 		}
1572 		retries = 10000;
1573 		while (devctl & MUSB_DEVCTL_SESSION) {
1574 			devctl = musb_readb(mregs, MUSB_DEVCTL);
1575 			if (retries-- < 1)
1576 				break;
1577 		}
1578 
1579 		spin_unlock_irqrestore(&musb->lock, flags);
1580 		otg_start_srp(musb->xceiv->otg);
1581 		spin_lock_irqsave(&musb->lock, flags);
1582 
1583 		/* Block idling for at least 1s */
1584 		musb_platform_try_idle(musb,
1585 			jiffies + msecs_to_jiffies(1 * HZ));
1586 
1587 		status = 0;
1588 		goto done;
1589 	default:
1590 		dev_dbg(musb->controller, "Unhandled wake: %s\n",
1591 			usb_otg_state_string(musb->xceiv->otg->state));
1592 		goto done;
1593 	}
1594 
1595 	status = 0;
1596 
1597 	power = musb_readb(mregs, MUSB_POWER);
1598 	power |= MUSB_POWER_RESUME;
1599 	musb_writeb(mregs, MUSB_POWER, power);
1600 	dev_dbg(musb->controller, "issue wakeup\n");
1601 
1602 	/* FIXME do this next chunk in a timer callback, no udelay */
1603 	mdelay(2);
1604 
1605 	power = musb_readb(mregs, MUSB_POWER);
1606 	power &= ~MUSB_POWER_RESUME;
1607 	musb_writeb(mregs, MUSB_POWER, power);
1608 done:
1609 	spin_unlock_irqrestore(&musb->lock, flags);
1610 	return status;
1611 }
1612 
1613 static int
1614 musb_gadget_set_self_powered(struct usb_gadget *gadget, int is_selfpowered)
1615 {
1616 	gadget->is_selfpowered = !!is_selfpowered;
1617 	return 0;
1618 }
1619 
1620 static void musb_pullup(struct musb *musb, int is_on)
1621 {
1622 	u8 power;
1623 
1624 	power = musb_readb(musb->mregs, MUSB_POWER);
1625 	if (is_on)
1626 		power |= MUSB_POWER_SOFTCONN;
1627 	else
1628 		power &= ~MUSB_POWER_SOFTCONN;
1629 
1630 	/* FIXME if on, HdrcStart; if off, HdrcStop */
1631 
1632 	dev_dbg(musb->controller, "gadget D+ pullup %s\n",
1633 		is_on ? "on" : "off");
1634 	musb_writeb(musb->mregs, MUSB_POWER, power);
1635 }
1636 
1637 #if 0
1638 static int musb_gadget_vbus_session(struct usb_gadget *gadget, int is_active)
1639 {
1640 	dev_dbg(musb->controller, "<= %s =>\n", __func__);
1641 
1642 	/*
1643 	 * FIXME iff driver's softconnect flag is set (as it is during probe,
1644 	 * though that can clear it), just musb_pullup().
1645 	 */
1646 
1647 	return -EINVAL;
1648 }
1649 #endif
1650 
1651 static int musb_gadget_vbus_draw(struct usb_gadget *gadget, unsigned mA)
1652 {
1653 	struct musb	*musb = gadget_to_musb(gadget);
1654 
1655 	if (!musb->xceiv->set_power)
1656 		return -EOPNOTSUPP;
1657 	return usb_phy_set_power(musb->xceiv, mA);
1658 }
1659 
1660 static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
1661 {
1662 	struct musb	*musb = gadget_to_musb(gadget);
1663 	unsigned long	flags;
1664 
1665 	is_on = !!is_on;
1666 
1667 	pm_runtime_get_sync(musb->controller);
1668 
1669 	/* NOTE: this assumes we are sensing vbus; we'd rather
1670 	 * not pullup unless the B-session is active.
1671 	 */
1672 	spin_lock_irqsave(&musb->lock, flags);
1673 	if (is_on != musb->softconnect) {
1674 		musb->softconnect = is_on;
1675 		musb_pullup(musb, is_on);
1676 	}
1677 	spin_unlock_irqrestore(&musb->lock, flags);
1678 
1679 	pm_runtime_put(musb->controller);
1680 
1681 	return 0;
1682 }
1683 
1684 #ifdef CONFIG_BLACKFIN
1685 static struct usb_ep *musb_match_ep(struct usb_gadget *g,
1686 		struct usb_endpoint_descriptor *desc,
1687 		struct usb_ss_ep_comp_descriptor *ep_comp)
1688 {
1689 	struct usb_ep *ep = NULL;
1690 
1691 	switch (usb_endpoint_type(desc)) {
1692 	case USB_ENDPOINT_XFER_ISOC:
1693 	case USB_ENDPOINT_XFER_BULK:
1694 		if (usb_endpoint_dir_in(desc))
1695 			ep = gadget_find_ep_by_name(g, "ep5in");
1696 		else
1697 			ep = gadget_find_ep_by_name(g, "ep6out");
1698 		break;
1699 	case USB_ENDPOINT_XFER_INT:
1700 		if (usb_endpoint_dir_in(desc))
1701 			ep = gadget_find_ep_by_name(g, "ep1in");
1702 		else
1703 			ep = gadget_find_ep_by_name(g, "ep2out");
1704 		break;
1705 	default:
1706 		break;
1707 	}
1708 
1709 	if (ep && usb_gadget_ep_match_desc(g, ep, desc, ep_comp))
1710 		return ep;
1711 
1712 	return NULL;
1713 }
1714 #else
1715 #define musb_match_ep NULL
1716 #endif
1717 
1718 static int musb_gadget_start(struct usb_gadget *g,
1719 		struct usb_gadget_driver *driver);
1720 static int musb_gadget_stop(struct usb_gadget *g);
1721 
1722 static const struct usb_gadget_ops musb_gadget_operations = {
1723 	.get_frame		= musb_gadget_get_frame,
1724 	.wakeup			= musb_gadget_wakeup,
1725 	.set_selfpowered	= musb_gadget_set_self_powered,
1726 	/* .vbus_session		= musb_gadget_vbus_session, */
1727 	.vbus_draw		= musb_gadget_vbus_draw,
1728 	.pullup			= musb_gadget_pullup,
1729 	.udc_start		= musb_gadget_start,
1730 	.udc_stop		= musb_gadget_stop,
1731 	.match_ep		= musb_match_ep,
1732 };
1733 
1734 /* ----------------------------------------------------------------------- */
1735 
1736 /* Registration */
1737 
1738 /* Only this registration code "knows" the rule (from USB standards)
1739  * about there being only one external upstream port.  It assumes
1740  * all peripheral ports are external...
1741  */
1742 
1743 static void
1744 init_peripheral_ep(struct musb *musb, struct musb_ep *ep, u8 epnum, int is_in)
1745 {
1746 	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1747 
1748 	memset(ep, 0, sizeof *ep);
1749 
1750 	ep->current_epnum = epnum;
1751 	ep->musb = musb;
1752 	ep->hw_ep = hw_ep;
1753 	ep->is_in = is_in;
1754 
1755 	INIT_LIST_HEAD(&ep->req_list);
1756 
1757 	sprintf(ep->name, "ep%d%s", epnum,
1758 			(!epnum || hw_ep->is_shared_fifo) ? "" : (
1759 				is_in ? "in" : "out"));
1760 	ep->end_point.name = ep->name;
1761 	INIT_LIST_HEAD(&ep->end_point.ep_list);
1762 	if (!epnum) {
1763 		usb_ep_set_maxpacket_limit(&ep->end_point, 64);
1764 		ep->end_point.caps.type_control = true;
1765 		ep->end_point.ops = &musb_g_ep0_ops;
1766 		musb->g.ep0 = &ep->end_point;
1767 	} else {
1768 		if (is_in)
1769 			usb_ep_set_maxpacket_limit(&ep->end_point, hw_ep->max_packet_sz_tx);
1770 		else
1771 			usb_ep_set_maxpacket_limit(&ep->end_point, hw_ep->max_packet_sz_rx);
1772 		ep->end_point.caps.type_iso = true;
1773 		ep->end_point.caps.type_bulk = true;
1774 		ep->end_point.caps.type_int = true;
1775 		ep->end_point.ops = &musb_ep_ops;
1776 		list_add_tail(&ep->end_point.ep_list, &musb->g.ep_list);
1777 	}
1778 
1779 	if (!epnum || hw_ep->is_shared_fifo) {
1780 		ep->end_point.caps.dir_in = true;
1781 		ep->end_point.caps.dir_out = true;
1782 	} else if (is_in)
1783 		ep->end_point.caps.dir_in = true;
1784 	else
1785 		ep->end_point.caps.dir_out = true;
1786 }
1787 
1788 /*
1789  * Initialize the endpoints exposed to peripheral drivers, with backlinks
1790  * to the rest of the driver state.
1791  */
1792 static inline void musb_g_init_endpoints(struct musb *musb)
1793 {
1794 	u8			epnum;
1795 	struct musb_hw_ep	*hw_ep;
1796 	unsigned		count = 0;
1797 
1798 	/* initialize endpoint list just once */
1799 	INIT_LIST_HEAD(&(musb->g.ep_list));
1800 
1801 	for (epnum = 0, hw_ep = musb->endpoints;
1802 			epnum < musb->nr_endpoints;
1803 			epnum++, hw_ep++) {
1804 		if (hw_ep->is_shared_fifo /* || !epnum */) {
1805 			init_peripheral_ep(musb, &hw_ep->ep_in, epnum, 0);
1806 			count++;
1807 		} else {
1808 			if (hw_ep->max_packet_sz_tx) {
1809 				init_peripheral_ep(musb, &hw_ep->ep_in,
1810 							epnum, 1);
1811 				count++;
1812 			}
1813 			if (hw_ep->max_packet_sz_rx) {
1814 				init_peripheral_ep(musb, &hw_ep->ep_out,
1815 							epnum, 0);
1816 				count++;
1817 			}
1818 		}
1819 	}
1820 }
1821 
1822 /* called once during driver setup to initialize and link into
1823  * the driver model; memory is zeroed.
1824  */
1825 int musb_gadget_setup(struct musb *musb)
1826 {
1827 	int status;
1828 
1829 	/* REVISIT minor race:  if (erroneously) setting up two
1830 	 * musb peripherals at the same time, only the bus lock
1831 	 * is probably held.
1832 	 */
1833 
1834 	musb->g.ops = &musb_gadget_operations;
1835 	musb->g.max_speed = USB_SPEED_HIGH;
1836 	musb->g.speed = USB_SPEED_UNKNOWN;
1837 
1838 	MUSB_DEV_MODE(musb);
1839 	musb->xceiv->otg->default_a = 0;
1840 	musb->xceiv->otg->state = OTG_STATE_B_IDLE;
1841 
1842 	/* this "gadget" abstracts/virtualizes the controller */
1843 	musb->g.name = musb_driver_name;
1844 #if IS_ENABLED(CONFIG_USB_MUSB_DUAL_ROLE)
1845 	musb->g.is_otg = 1;
1846 #elif IS_ENABLED(CONFIG_USB_MUSB_GADGET)
1847 	musb->g.is_otg = 0;
1848 #endif
1849 
1850 	musb_g_init_endpoints(musb);
1851 
1852 	musb->is_active = 0;
1853 	musb_platform_try_idle(musb, 0);
1854 
1855 	status = usb_add_gadget_udc(musb->controller, &musb->g);
1856 	if (status)
1857 		goto err;
1858 
1859 	return 0;
1860 err:
1861 	musb->g.dev.parent = NULL;
1862 	device_unregister(&musb->g.dev);
1863 	return status;
1864 }
1865 
1866 void musb_gadget_cleanup(struct musb *musb)
1867 {
1868 	if (musb->port_mode == MUSB_PORT_MODE_HOST)
1869 		return;
1870 	usb_del_gadget_udc(&musb->g);
1871 }
1872 
1873 /*
1874  * Register the gadget driver. Used by gadget drivers when
1875  * registering themselves with the controller.
1876  *
1877  * -EINVAL something went wrong (not driver)
1878  * -EBUSY another gadget is already using the controller
1879  * -ENOMEM no memory to perform the operation
1880  *
1881  * @param driver the gadget driver
1882  * @return <0 if error, 0 if everything is fine
1883  */
1884 static int musb_gadget_start(struct usb_gadget *g,
1885 		struct usb_gadget_driver *driver)
1886 {
1887 	struct musb		*musb = gadget_to_musb(g);
1888 	struct usb_otg		*otg = musb->xceiv->otg;
1889 	unsigned long		flags;
1890 	int			retval = 0;
1891 
1892 	if (driver->max_speed < USB_SPEED_HIGH) {
1893 		retval = -EINVAL;
1894 		goto err;
1895 	}
1896 
1897 	pm_runtime_get_sync(musb->controller);
1898 
1899 	musb->softconnect = 0;
1900 	musb->gadget_driver = driver;
1901 
1902 	spin_lock_irqsave(&musb->lock, flags);
1903 	musb->is_active = 1;
1904 
1905 	otg_set_peripheral(otg, &musb->g);
1906 	musb->xceiv->otg->state = OTG_STATE_B_IDLE;
1907 	spin_unlock_irqrestore(&musb->lock, flags);
1908 
1909 	musb_start(musb);
1910 
1911 	/* REVISIT:  funcall to other code, which also
1912 	 * handles power budgeting ... this way also
1913 	 * ensures HdrcStart is indirectly called.
1914 	 */
1915 	if (musb->xceiv->last_event == USB_EVENT_ID)
1916 		musb_platform_set_vbus(musb, 1);
1917 
1918 	if (musb->xceiv->last_event == USB_EVENT_NONE)
1919 		pm_runtime_put(musb->controller);
1920 
1921 	return 0;
1922 
1923 err:
1924 	return retval;
1925 }
1926 
1927 /*
1928  * Unregister the gadget driver. Used by gadget drivers when
1929  * unregistering themselves from the controller.
1930  *
1931  * @param driver the gadget driver to unregister
1932  */
1933 static int musb_gadget_stop(struct usb_gadget *g)
1934 {
1935 	struct musb	*musb = gadget_to_musb(g);
1936 	unsigned long	flags;
1937 
1938 	if (musb->xceiv->last_event == USB_EVENT_NONE)
1939 		pm_runtime_get_sync(musb->controller);
1940 
1941 	/*
1942 	 * REVISIT always use otg_set_peripheral() here too;
1943 	 * this needs to shut down the OTG engine.
1944 	 */
1945 
1946 	spin_lock_irqsave(&musb->lock, flags);
1947 
1948 	musb_hnp_stop(musb);
1949 
1950 	(void) musb_gadget_vbus_draw(&musb->g, 0);
1951 
1952 	musb->xceiv->otg->state = OTG_STATE_UNDEFINED;
1953 	musb_stop(musb);
1954 	otg_set_peripheral(musb->xceiv->otg, NULL);
1955 
1956 	musb->is_active = 0;
1957 	musb->gadget_driver = NULL;
1958 	musb_platform_try_idle(musb, 0);
1959 	spin_unlock_irqrestore(&musb->lock, flags);
1960 
1961 	/*
1962 	 * FIXME we need to be able to register another
1963 	 * gadget driver here and have everything work;
1964 	 * that currently misbehaves.
1965 	 */
1966 
1967 	pm_runtime_put(musb->controller);
1968 
1969 	return 0;
1970 }
1971 
1972 /* ----------------------------------------------------------------------- */
1973 
1974 /* lifecycle operations called through plat_uds.c */
1975 
1976 void musb_g_resume(struct musb *musb)
1977 {
1978 	musb->is_suspended = 0;
1979 	switch (musb->xceiv->otg->state) {
1980 	case OTG_STATE_B_IDLE:
1981 		break;
1982 	case OTG_STATE_B_WAIT_ACON:
1983 	case OTG_STATE_B_PERIPHERAL:
1984 		musb->is_active = 1;
1985 		if (musb->gadget_driver && musb->gadget_driver->resume) {
1986 			spin_unlock(&musb->lock);
1987 			musb->gadget_driver->resume(&musb->g);
1988 			spin_lock(&musb->lock);
1989 		}
1990 		break;
1991 	default:
1992 		WARNING("unhandled RESUME transition (%s)\n",
1993 				usb_otg_state_string(musb->xceiv->otg->state));
1994 	}
1995 }
1996 
1997 /* called when SOF packets stop for 3+ msec */
1998 void musb_g_suspend(struct musb *musb)
1999 {
2000 	u8	devctl;
2001 
2002 	devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
2003 	dev_dbg(musb->controller, "devctl %02x\n", devctl);
2004 
2005 	switch (musb->xceiv->otg->state) {
2006 	case OTG_STATE_B_IDLE:
2007 		if ((devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS)
2008 			musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL;
2009 		break;
2010 	case OTG_STATE_B_PERIPHERAL:
2011 		musb->is_suspended = 1;
2012 		if (musb->gadget_driver && musb->gadget_driver->suspend) {
2013 			spin_unlock(&musb->lock);
2014 			musb->gadget_driver->suspend(&musb->g);
2015 			spin_lock(&musb->lock);
2016 		}
2017 		break;
2018 	default:
2019 		/* REVISIT if B_HOST, clear DEVCTL.HOSTREQ;
2020 		 * A_PERIPHERAL may need care too
2021 		 */
2022 		WARNING("unhandled SUSPEND transition (%s)\n",
2023 				usb_otg_state_string(musb->xceiv->otg->state));
2024 	}
2025 }
2026 
2027 /* Called during SRP */
2028 void musb_g_wakeup(struct musb *musb)
2029 {
2030 	musb_gadget_wakeup(&musb->g);
2031 }
2032 
2033 /* called when VBUS drops below session threshold, and in other cases */
2034 void musb_g_disconnect(struct musb *musb)
2035 {
2036 	void __iomem	*mregs = musb->mregs;
2037 	u8	devctl = musb_readb(mregs, MUSB_DEVCTL);
2038 
2039 	dev_dbg(musb->controller, "devctl %02x\n", devctl);
2040 
2041 	/* clear HR */
2042 	musb_writeb(mregs, MUSB_DEVCTL, devctl & MUSB_DEVCTL_SESSION);
2043 
2044 	/* don't draw vbus until new b-default session */
2045 	(void) musb_gadget_vbus_draw(&musb->g, 0);
2046 
2047 	musb->g.speed = USB_SPEED_UNKNOWN;
2048 	if (musb->gadget_driver && musb->gadget_driver->disconnect) {
2049 		spin_unlock(&musb->lock);
2050 		musb->gadget_driver->disconnect(&musb->g);
2051 		spin_lock(&musb->lock);
2052 	}
2053 
2054 	switch (musb->xceiv->otg->state) {
2055 	default:
2056 		dev_dbg(musb->controller, "Unhandled disconnect %s, setting a_idle\n",
2057 			usb_otg_state_string(musb->xceiv->otg->state));
2058 		musb->xceiv->otg->state = OTG_STATE_A_IDLE;
2059 		MUSB_HST_MODE(musb);
2060 		break;
2061 	case OTG_STATE_A_PERIPHERAL:
2062 		musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON;
2063 		MUSB_HST_MODE(musb);
2064 		break;
2065 	case OTG_STATE_B_WAIT_ACON:
2066 	case OTG_STATE_B_HOST:
2067 	case OTG_STATE_B_PERIPHERAL:
2068 	case OTG_STATE_B_IDLE:
2069 		musb->xceiv->otg->state = OTG_STATE_B_IDLE;
2070 		break;
2071 	case OTG_STATE_B_SRP_INIT:
2072 		break;
2073 	}
2074 
2075 	musb->is_active = 0;
2076 }
2077 
2078 void musb_g_reset(struct musb *musb)
2079 __releases(musb->lock)
2080 __acquires(musb->lock)
2081 {
2082 	void __iomem	*mbase = musb->mregs;
2083 	u8		devctl = musb_readb(mbase, MUSB_DEVCTL);
2084 	u8		power;
2085 
2086 	dev_dbg(musb->controller, "<== %s driver '%s'\n",
2087 			(devctl & MUSB_DEVCTL_BDEVICE)
2088 				? "B-Device" : "A-Device",
2089 			musb->gadget_driver
2090 				? musb->gadget_driver->driver.name
2091 				: NULL
2092 			);
2093 
2094 	/* report reset, if we didn't already (flushing EP state) */
2095 	if (musb->gadget_driver && musb->g.speed != USB_SPEED_UNKNOWN) {
2096 		spin_unlock(&musb->lock);
2097 		usb_gadget_udc_reset(&musb->g, musb->gadget_driver);
2098 		spin_lock(&musb->lock);
2099 	}
2100 
2101 	/* clear HR */
2102 	else if (devctl & MUSB_DEVCTL_HR)
2103 		musb_writeb(mbase, MUSB_DEVCTL, MUSB_DEVCTL_SESSION);
2104 
2105 
2106 	/* what speed did we negotiate? */
2107 	power = musb_readb(mbase, MUSB_POWER);
2108 	musb->g.speed = (power & MUSB_POWER_HSMODE)
2109 			? USB_SPEED_HIGH : USB_SPEED_FULL;
2110 
2111 	/* start in USB_STATE_DEFAULT */
2112 	musb->is_active = 1;
2113 	musb->is_suspended = 0;
2114 	MUSB_DEV_MODE(musb);
2115 	musb->address = 0;
2116 	musb->ep0_state = MUSB_EP0_STAGE_SETUP;
2117 
2118 	musb->may_wakeup = 0;
2119 	musb->g.b_hnp_enable = 0;
2120 	musb->g.a_alt_hnp_support = 0;
2121 	musb->g.a_hnp_support = 0;
2122 	musb->g.quirk_zlp_not_supp = 1;
2123 
2124 	/* Normal reset, as B-Device;
2125 	 * or else after HNP, as A-Device
2126 	 */
2127 	if (!musb->g.is_otg) {
2128 		/* USB device controllers that are not OTG compatible
2129 		 * may not have DEVCTL register in silicon.
2130 		 * In that case, do not rely on devctl for setting
2131 		 * peripheral mode.
2132 		 */
2133 		musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL;
2134 		musb->g.is_a_peripheral = 0;
2135 	} else if (devctl & MUSB_DEVCTL_BDEVICE) {
2136 		musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL;
2137 		musb->g.is_a_peripheral = 0;
2138 	} else {
2139 		musb->xceiv->otg->state = OTG_STATE_A_PERIPHERAL;
2140 		musb->g.is_a_peripheral = 1;
2141 	}
2142 
2143 	/* start with default limits on VBUS power draw */
2144 	(void) musb_gadget_vbus_draw(&musb->g, 8);
2145 }
2146