1/*
2 * MUSB OTG driver peripheral support
3 *
4 * Copyright 2005 Mentor Graphics Corporation
5 * Copyright (C) 2005-2006 by Texas Instruments
6 * Copyright (C) 2006-2007 Nokia Corporation
7 * Copyright (C) 2009 MontaVista Software, Inc. <source@mvista.com>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * version 2 as published by the Free Software Foundation.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16 * General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
21 * 02110-1301 USA
22 *
23 * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
24 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
26 * NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
29 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
30 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36#include <linux/kernel.h>
37#include <linux/list.h>
38#include <linux/timer.h>
39#include <linux/module.h>
40#include <linux/smp.h>
41#include <linux/spinlock.h>
42#include <linux/delay.h>
43#include <linux/dma-mapping.h>
44#include <linux/slab.h>
45
46#include "musb_core.h"
47
48
49/* MUSB PERIPHERAL status 3-mar-2006:
50 *
51 * - EP0 seems solid.  It passes both USBCV and usbtest control cases.
52 *   Minor glitches:
53 *
54 *     + remote wakeup to Linux hosts work, but saw USBCV failures;
55 *       in one test run (operator error?)
56 *     + endpoint halt tests -- in both usbtest and usbcv -- seem
57 *       to break when dma is enabled ... is something wrongly
58 *       clearing SENDSTALL?
59 *
60 * - Mass storage behaved ok when last tested.  Network traffic patterns
61 *   (with lots of short transfers etc) need retesting; they turn up the
62 *   worst cases of the DMA, since short packets are typical but are not
63 *   required.
64 *
65 * - TX/IN
66 *     + both pio and dma behave in with network and g_zero tests
67 *     + no cppi throughput issues other than no-hw-queueing
68 *     + failed with FLAT_REG (DaVinci)
69 *     + seems to behave with double buffering, PIO -and- CPPI
70 *     + with gadgetfs + AIO, requests got lost?
71 *
72 * - RX/OUT
73 *     + both pio and dma behave in with network and g_zero tests
74 *     + dma is slow in typical case (short_not_ok is clear)
75 *     + double buffering ok with PIO
76 *     + double buffering *FAILS* with CPPI, wrong data bytes sometimes
77 *     + request lossage observed with gadgetfs
78 *
79 * - ISO not tested ... might work, but only weakly isochronous
80 *
81 * - Gadget driver disabling of softconnect during bind() is ignored; so
82 *   drivers can't hold off host requests until userspace is ready.
83 *   (Workaround:  they can turn it off later.)
84 *
85 * - PORTABILITY (assumes PIO works):
86 *     + DaVinci, basically works with cppi dma
87 *     + OMAP 2430, ditto with mentor dma
88 *     + TUSB 6010, platform-specific dma in the works
89 */
90
91/* ----------------------------------------------------------------------- */
92
93#define is_buffer_mapped(req) (is_dma_capable() && \
94					(req->map_state != UN_MAPPED))
95
96/* Maps the buffer to dma  */
97
98static inline void map_dma_buffer(struct musb_request *request,
99			struct musb *musb, struct musb_ep *musb_ep)
100{
101	int compatible = true;
102	struct dma_controller *dma = musb->dma_controller;
103
104	request->map_state = UN_MAPPED;
105
106	if (!is_dma_capable() || !musb_ep->dma)
107		return;
108
109	/* Check if DMA engine can handle this request.
110	 * DMA code must reject the USB request explicitly.
111	 * Default behaviour is to map the request.
112	 */
113	if (dma->is_compatible)
114		compatible = dma->is_compatible(musb_ep->dma,
115				musb_ep->packet_sz, request->request.buf,
116				request->request.length);
117	if (!compatible)
118		return;
119
120	if (request->request.dma == DMA_ADDR_INVALID) {
121		request->request.dma = dma_map_single(
122				musb->controller,
123				request->request.buf,
124				request->request.length,
125				request->tx
126					? DMA_TO_DEVICE
127					: DMA_FROM_DEVICE);
128		request->map_state = MUSB_MAPPED;
129	} else {
130		dma_sync_single_for_device(musb->controller,
131			request->request.dma,
132			request->request.length,
133			request->tx
134				? DMA_TO_DEVICE
135				: DMA_FROM_DEVICE);
136		request->map_state = PRE_MAPPED;
137	}
138}
139
140/* Unmap the buffer from dma and maps it back to cpu */
141static inline void unmap_dma_buffer(struct musb_request *request,
142				struct musb *musb)
143{
144	if (!is_buffer_mapped(request))
145		return;
146
147	if (request->request.dma == DMA_ADDR_INVALID) {
148		dev_vdbg(musb->controller,
149				"not unmapping a never mapped buffer\n");
150		return;
151	}
152	if (request->map_state == MUSB_MAPPED) {
153		dma_unmap_single(musb->controller,
154			request->request.dma,
155			request->request.length,
156			request->tx
157				? DMA_TO_DEVICE
158				: DMA_FROM_DEVICE);
159		request->request.dma = DMA_ADDR_INVALID;
160	} else { /* PRE_MAPPED */
161		dma_sync_single_for_cpu(musb->controller,
162			request->request.dma,
163			request->request.length,
164			request->tx
165				? DMA_TO_DEVICE
166				: DMA_FROM_DEVICE);
167	}
168	request->map_state = UN_MAPPED;
169}
170
171/*
172 * Immediately complete a request.
173 *
174 * @param request the request to complete
175 * @param status the status to complete the request with
176 * Context: controller locked, IRQs blocked.
177 */
178void musb_g_giveback(
179	struct musb_ep		*ep,
180	struct usb_request	*request,
181	int			status)
182__releases(ep->musb->lock)
183__acquires(ep->musb->lock)
184{
185	struct musb_request	*req;
186	struct musb		*musb;
187	int			busy = ep->busy;
188
189	req = to_musb_request(request);
190
191	list_del(&req->list);
192	if (req->request.status == -EINPROGRESS)
193		req->request.status = status;
194	musb = req->musb;
195
196	ep->busy = 1;
197	spin_unlock(&musb->lock);
198	unmap_dma_buffer(req, musb);
199	if (request->status == 0)
200		dev_dbg(musb->controller, "%s done request %p,  %d/%d\n",
201				ep->end_point.name, request,
202				req->request.actual, req->request.length);
203	else
204		dev_dbg(musb->controller, "%s request %p, %d/%d fault %d\n",
205				ep->end_point.name, request,
206				req->request.actual, req->request.length,
207				request->status);
208	req->request.complete(&req->ep->end_point, &req->request);
209	spin_lock(&musb->lock);
210	ep->busy = busy;
211}
212
213/* ----------------------------------------------------------------------- */
214
215/*
216 * Abort requests queued to an endpoint using the status. Synchronous.
217 * caller locked controller and blocked irqs, and selected this ep.
218 */
219static void nuke(struct musb_ep *ep, const int status)
220{
221	struct musb		*musb = ep->musb;
222	struct musb_request	*req = NULL;
223	void __iomem *epio = ep->musb->endpoints[ep->current_epnum].regs;
224
225	ep->busy = 1;
226
227	if (is_dma_capable() && ep->dma) {
228		struct dma_controller	*c = ep->musb->dma_controller;
229		int value;
230
231		if (ep->is_in) {
232			/*
233			 * The programming guide says that we must not clear
234			 * the DMAMODE bit before DMAENAB, so we only
235			 * clear it in the second write...
236			 */
237			musb_writew(epio, MUSB_TXCSR,
238				    MUSB_TXCSR_DMAMODE | MUSB_TXCSR_FLUSHFIFO);
239			musb_writew(epio, MUSB_TXCSR,
240					0 | MUSB_TXCSR_FLUSHFIFO);
241		} else {
242			musb_writew(epio, MUSB_RXCSR,
243					0 | MUSB_RXCSR_FLUSHFIFO);
244			musb_writew(epio, MUSB_RXCSR,
245					0 | MUSB_RXCSR_FLUSHFIFO);
246		}
247
248		value = c->channel_abort(ep->dma);
249		dev_dbg(musb->controller, "%s: abort DMA --> %d\n",
250				ep->name, value);
251		c->channel_release(ep->dma);
252		ep->dma = NULL;
253	}
254
255	while (!list_empty(&ep->req_list)) {
256		req = list_first_entry(&ep->req_list, struct musb_request, list);
257		musb_g_giveback(ep, &req->request, status);
258	}
259}
260
261/* ----------------------------------------------------------------------- */
262
263/* Data transfers - pure PIO, pure DMA, or mixed mode */
264
265/*
266 * This assumes the separate CPPI engine is responding to DMA requests
267 * from the usb core ... sequenced a bit differently from mentor dma.
268 */
269
270static inline int max_ep_writesize(struct musb *musb, struct musb_ep *ep)
271{
272	if (can_bulk_split(musb, ep->type))
273		return ep->hw_ep->max_packet_sz_tx;
274	else
275		return ep->packet_sz;
276}
277
278
279#ifdef CONFIG_USB_INVENTRA_DMA
280
281/* Peripheral tx (IN) using Mentor DMA works as follows:
282	Only mode 0 is used for transfers <= wPktSize,
283	mode 1 is used for larger transfers,
284
285	One of the following happens:
286	- Host sends IN token which causes an endpoint interrupt
287		-> TxAvail
288			-> if DMA is currently busy, exit.
289			-> if queue is non-empty, txstate().
290
291	- Request is queued by the gadget driver.
292		-> if queue was previously empty, txstate()
293
294	txstate()
295		-> start
296		  /\	-> setup DMA
297		  |     (data is transferred to the FIFO, then sent out when
298		  |	IN token(s) are recd from Host.
299		  |		-> DMA interrupt on completion
300		  |		   calls TxAvail.
301		  |		      -> stop DMA, ~DMAENAB,
302		  |		      -> set TxPktRdy for last short pkt or zlp
303		  |		      -> Complete Request
304		  |		      -> Continue next request (call txstate)
305		  |___________________________________|
306
307 * Non-Mentor DMA engines can of course work differently, such as by
308 * upleveling from irq-per-packet to irq-per-buffer.
309 */
310
311#endif
312
313/*
314 * An endpoint is transmitting data. This can be called either from
315 * the IRQ routine or from ep.queue() to kickstart a request on an
316 * endpoint.
317 *
318 * Context: controller locked, IRQs blocked, endpoint selected
319 */
320static void txstate(struct musb *musb, struct musb_request *req)
321{
322	u8			epnum = req->epnum;
323	struct musb_ep		*musb_ep;
324	void __iomem		*epio = musb->endpoints[epnum].regs;
325	struct usb_request	*request;
326	u16			fifo_count = 0, csr;
327	int			use_dma = 0;
328
329	musb_ep = req->ep;
330
331	/* we shouldn't get here while DMA is active ... but we do ... */
332	if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
333		dev_dbg(musb->controller, "dma pending...\n");
334		return;
335	}
336
337	/* read TXCSR before */
338	csr = musb_readw(epio, MUSB_TXCSR);
339
340	request = &req->request;
341	fifo_count = min(max_ep_writesize(musb, musb_ep),
342			(int)(request->length - request->actual));
343
344	if (csr & MUSB_TXCSR_TXPKTRDY) {
345		dev_dbg(musb->controller, "%s old packet still ready , txcsr %03x\n",
346				musb_ep->end_point.name, csr);
347		return;
348	}
349
350	if (csr & MUSB_TXCSR_P_SENDSTALL) {
351		dev_dbg(musb->controller, "%s stalling, txcsr %03x\n",
352				musb_ep->end_point.name, csr);
353		return;
354	}
355
356	dev_dbg(musb->controller, "hw_ep%d, maxpacket %d, fifo count %d, txcsr %03x\n",
357			epnum, musb_ep->packet_sz, fifo_count,
358			csr);
359
360#ifndef	CONFIG_MUSB_PIO_ONLY
361	if (is_buffer_mapped(req)) {
362		struct dma_controller	*c = musb->dma_controller;
363		size_t request_size;
364
365		/* setup DMA, then program endpoint CSR */
366		request_size = min_t(size_t, request->length - request->actual,
367					musb_ep->dma->max_len);
368
369		use_dma = (request->dma != DMA_ADDR_INVALID);
370
371		/* MUSB_TXCSR_P_ISO is still set correctly */
372
373#if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_UX500_DMA)
374		{
375			if (request_size < musb_ep->packet_sz)
376				musb_ep->dma->desired_mode = 0;
377			else
378				musb_ep->dma->desired_mode = 1;
379
380			use_dma = use_dma && c->channel_program(
381					musb_ep->dma, musb_ep->packet_sz,
382					musb_ep->dma->desired_mode,
383					request->dma + request->actual, request_size);
384			if (use_dma) {
385				if (musb_ep->dma->desired_mode == 0) {
386					/*
387					 * We must not clear the DMAMODE bit
388					 * before the DMAENAB bit -- and the
389					 * latter doesn't always get cleared
390					 * before we get here...
391					 */
392					csr &= ~(MUSB_TXCSR_AUTOSET
393						| MUSB_TXCSR_DMAENAB);
394					musb_writew(epio, MUSB_TXCSR, csr
395						| MUSB_TXCSR_P_WZC_BITS);
396					csr &= ~MUSB_TXCSR_DMAMODE;
397					csr |= (MUSB_TXCSR_DMAENAB |
398							MUSB_TXCSR_MODE);
399					/* against programming guide */
400				} else {
401					csr |= (MUSB_TXCSR_DMAENAB
402							| MUSB_TXCSR_DMAMODE
403							| MUSB_TXCSR_MODE);
404					if (!musb_ep->hb_mult)
405						csr |= MUSB_TXCSR_AUTOSET;
406				}
407				csr &= ~MUSB_TXCSR_P_UNDERRUN;
408
409				musb_writew(epio, MUSB_TXCSR, csr);
410			}
411		}
412
413#elif defined(CONFIG_USB_TI_CPPI_DMA)
414		/* program endpoint CSR first, then setup DMA */
415		csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
416		csr |= MUSB_TXCSR_DMAENAB | MUSB_TXCSR_DMAMODE |
417		       MUSB_TXCSR_MODE;
418		musb_writew(epio, MUSB_TXCSR,
419			(MUSB_TXCSR_P_WZC_BITS & ~MUSB_TXCSR_P_UNDERRUN)
420				| csr);
421
422		/* ensure writebuffer is empty */
423		csr = musb_readw(epio, MUSB_TXCSR);
424
425		/* NOTE host side sets DMAENAB later than this; both are
426		 * OK since the transfer dma glue (between CPPI and Mentor
427		 * fifos) just tells CPPI it could start.  Data only moves
428		 * to the USB TX fifo when both fifos are ready.
429		 */
430
431		/* "mode" is irrelevant here; handle terminating ZLPs like
432		 * PIO does, since the hardware RNDIS mode seems unreliable
433		 * except for the last-packet-is-already-short case.
434		 */
435		use_dma = use_dma && c->channel_program(
436				musb_ep->dma, musb_ep->packet_sz,
437				0,
438				request->dma + request->actual,
439				request_size);
440		if (!use_dma) {
441			c->channel_release(musb_ep->dma);
442			musb_ep->dma = NULL;
443			csr &= ~MUSB_TXCSR_DMAENAB;
444			musb_writew(epio, MUSB_TXCSR, csr);
445			/* invariant: prequest->buf is non-null */
446		}
447#elif defined(CONFIG_USB_TUSB_OMAP_DMA)
448		use_dma = use_dma && c->channel_program(
449				musb_ep->dma, musb_ep->packet_sz,
450				request->zero,
451				request->dma + request->actual,
452				request_size);
453#endif
454	}
455#endif
456
457	if (!use_dma) {
458		/*
459		 * Unmap the dma buffer back to cpu if dma channel
460		 * programming fails
461		 */
462		unmap_dma_buffer(req, musb);
463
464		musb_write_fifo(musb_ep->hw_ep, fifo_count,
465				(u8 *) (request->buf + request->actual));
466		request->actual += fifo_count;
467		csr |= MUSB_TXCSR_TXPKTRDY;
468		csr &= ~MUSB_TXCSR_P_UNDERRUN;
469		musb_writew(epio, MUSB_TXCSR, csr);
470	}
471
472	/* host may already have the data when this message shows... */
473	dev_dbg(musb->controller, "%s TX/IN %s len %d/%d, txcsr %04x, fifo %d/%d\n",
474			musb_ep->end_point.name, use_dma ? "dma" : "pio",
475			request->actual, request->length,
476			musb_readw(epio, MUSB_TXCSR),
477			fifo_count,
478			musb_readw(epio, MUSB_TXMAXP));
479}
480
481/*
482 * FIFO state update (e.g. data ready).
483 * Called from IRQ,  with controller locked.
484 */
485void musb_g_tx(struct musb *musb, u8 epnum)
486{
487	u16			csr;
488	struct musb_request	*req;
489	struct usb_request	*request;
490	u8 __iomem		*mbase = musb->mregs;
491	struct musb_ep		*musb_ep = &musb->endpoints[epnum].ep_in;
492	void __iomem		*epio = musb->endpoints[epnum].regs;
493	struct dma_channel	*dma;
494
495	musb_ep_select(mbase, epnum);
496	req = next_request(musb_ep);
497	request = &req->request;
498
499	csr = musb_readw(epio, MUSB_TXCSR);
500	dev_dbg(musb->controller, "<== %s, txcsr %04x\n", musb_ep->end_point.name, csr);
501
502	dma = is_dma_capable() ? musb_ep->dma : NULL;
503
504	/*
505	 * REVISIT: for high bandwidth, MUSB_TXCSR_P_INCOMPTX
506	 * probably rates reporting as a host error.
507	 */
508	if (csr & MUSB_TXCSR_P_SENTSTALL) {
509		csr |=	MUSB_TXCSR_P_WZC_BITS;
510		csr &= ~MUSB_TXCSR_P_SENTSTALL;
511		musb_writew(epio, MUSB_TXCSR, csr);
512		return;
513	}
514
515	if (csr & MUSB_TXCSR_P_UNDERRUN) {
516		/* We NAKed, no big deal... little reason to care. */
517		csr |=	 MUSB_TXCSR_P_WZC_BITS;
518		csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
519		musb_writew(epio, MUSB_TXCSR, csr);
520		dev_vdbg(musb->controller, "underrun on ep%d, req %p\n",
521				epnum, request);
522	}
523
524	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
525		/*
526		 * SHOULD NOT HAPPEN... has with CPPI though, after
527		 * changing SENDSTALL (and other cases); harmless?
528		 */
529		dev_dbg(musb->controller, "%s dma still busy?\n", musb_ep->end_point.name);
530		return;
531	}
532
533	if (request) {
534		u8	is_dma = 0;
535
536		if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
537			is_dma = 1;
538			csr |= MUSB_TXCSR_P_WZC_BITS;
539			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
540				 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
541			musb_writew(epio, MUSB_TXCSR, csr);
542			/* Ensure writebuffer is empty. */
543			csr = musb_readw(epio, MUSB_TXCSR);
544			request->actual += musb_ep->dma->actual_len;
545			dev_dbg(musb->controller, "TXCSR%d %04x, DMA off, len %zu, req %p\n",
546				epnum, csr, musb_ep->dma->actual_len, request);
547		}
548
549		/*
550		 * First, maybe a terminating short packet. Some DMA
551		 * engines might handle this by themselves.
552		 */
553		if ((request->zero && request->length
554			&& (request->length % musb_ep->packet_sz == 0)
555			&& (request->actual == request->length))
556#if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_UX500_DMA)
557			|| (is_dma && (!dma->desired_mode ||
558				(request->actual &
559					(musb_ep->packet_sz - 1))))
560#endif
561		) {
562			/*
563			 * On DMA completion, FIFO may not be
564			 * available yet...
565			 */
566			if (csr & MUSB_TXCSR_TXPKTRDY)
567				return;
568
569			dev_dbg(musb->controller, "sending zero pkt\n");
570			musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_MODE
571					| MUSB_TXCSR_TXPKTRDY);
572			request->zero = 0;
573		}
574
575		if (request->actual == request->length) {
576			musb_g_giveback(musb_ep, request, 0);
577			/*
578			 * In the giveback function the MUSB lock is
579			 * released and acquired after sometime. During
580			 * this time period the INDEX register could get
581			 * changed by the gadget_queue function especially
582			 * on SMP systems. Reselect the INDEX to be sure
583			 * we are reading/modifying the right registers
584			 */
585			musb_ep_select(mbase, epnum);
586			req = musb_ep->desc ? next_request(musb_ep) : NULL;
587			if (!req) {
588				dev_dbg(musb->controller, "%s idle now\n",
589					musb_ep->end_point.name);
590				return;
591			}
592		}
593
594		txstate(musb, req);
595	}
596}
597
598/* ------------------------------------------------------------ */
599
600#ifdef CONFIG_USB_INVENTRA_DMA
601
602/* Peripheral rx (OUT) using Mentor DMA works as follows:
603	- Only mode 0 is used.
604
605	- Request is queued by the gadget class driver.
606		-> if queue was previously empty, rxstate()
607
608	- Host sends OUT token which causes an endpoint interrupt
609	  /\      -> RxReady
610	  |	      -> if request queued, call rxstate
611	  |		/\	-> setup DMA
612	  |		|	     -> DMA interrupt on completion
613	  |		|		-> RxReady
614	  |		|		      -> stop DMA
615	  |		|		      -> ack the read
616	  |		|		      -> if data recd = max expected
617	  |		|				by the request, or host
618	  |		|				sent a short packet,
619	  |		|				complete the request,
620	  |		|				and start the next one.
621	  |		|_____________________________________|
622	  |					 else just wait for the host
623	  |					    to send the next OUT token.
624	  |__________________________________________________|
625
626 * Non-Mentor DMA engines can of course work differently.
627 */
628
629#endif
630
631/*
632 * Context: controller locked, IRQs blocked, endpoint selected
633 */
634static void rxstate(struct musb *musb, struct musb_request *req)
635{
636	const u8		epnum = req->epnum;
637	struct usb_request	*request = &req->request;
638	struct musb_ep		*musb_ep;
639	void __iomem		*epio = musb->endpoints[epnum].regs;
640	unsigned		fifo_count = 0;
641	u16			len;
642	u16			csr = musb_readw(epio, MUSB_RXCSR);
643	struct musb_hw_ep	*hw_ep = &musb->endpoints[epnum];
644	u8			use_mode_1;
645
646	if (hw_ep->is_shared_fifo)
647		musb_ep = &hw_ep->ep_in;
648	else
649		musb_ep = &hw_ep->ep_out;
650
651	len = musb_ep->packet_sz;
652
653	/* We shouldn't get here while DMA is active, but we do... */
654	if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
655		dev_dbg(musb->controller, "DMA pending...\n");
656		return;
657	}
658
659	if (csr & MUSB_RXCSR_P_SENDSTALL) {
660		dev_dbg(musb->controller, "%s stalling, RXCSR %04x\n",
661		    musb_ep->end_point.name, csr);
662		return;
663	}
664
665	if (is_cppi_enabled() && is_buffer_mapped(req)) {
666		struct dma_controller	*c = musb->dma_controller;
667		struct dma_channel	*channel = musb_ep->dma;
668
669		/* NOTE:  CPPI won't actually stop advancing the DMA
670		 * queue after short packet transfers, so this is almost
671		 * always going to run as IRQ-per-packet DMA so that
672		 * faults will be handled correctly.
673		 */
674		if (c->channel_program(channel,
675				musb_ep->packet_sz,
676				!request->short_not_ok,
677				request->dma + request->actual,
678				request->length - request->actual)) {
679
680			/* make sure that if an rxpkt arrived after the irq,
681			 * the cppi engine will be ready to take it as soon
682			 * as DMA is enabled
683			 */
684			csr &= ~(MUSB_RXCSR_AUTOCLEAR
685					| MUSB_RXCSR_DMAMODE);
686			csr |= MUSB_RXCSR_DMAENAB | MUSB_RXCSR_P_WZC_BITS;
687			musb_writew(epio, MUSB_RXCSR, csr);
688			return;
689		}
690	}
691
692	if (csr & MUSB_RXCSR_RXPKTRDY) {
693		len = musb_readw(epio, MUSB_RXCOUNT);
694
695		/*
696		 * Enable Mode 1 on RX transfers only when short_not_ok flag
697		 * is set. Currently short_not_ok flag is set only from
698		 * file_storage and f_mass_storage drivers
699		 */
700
701		if (request->short_not_ok && len == musb_ep->packet_sz)
702			use_mode_1 = 1;
703		else
704			use_mode_1 = 0;
705
706		if (request->actual < request->length) {
707#ifdef CONFIG_USB_INVENTRA_DMA
708			if (is_buffer_mapped(req)) {
709				struct dma_controller	*c;
710				struct dma_channel	*channel;
711				int			use_dma = 0;
712
713				c = musb->dma_controller;
714				channel = musb_ep->dma;
715
716	/* We use DMA Req mode 0 in rx_csr, and DMA controller operates in
717	 * mode 0 only. So we do not get endpoint interrupts due to DMA
718	 * completion. We only get interrupts from DMA controller.
719	 *
720	 * We could operate in DMA mode 1 if we knew the size of the tranfer
721	 * in advance. For mass storage class, request->length = what the host
722	 * sends, so that'd work.  But for pretty much everything else,
723	 * request->length is routinely more than what the host sends. For
724	 * most these gadgets, end of is signified either by a short packet,
725	 * or filling the last byte of the buffer.  (Sending extra data in
726	 * that last pckate should trigger an overflow fault.)  But in mode 1,
727	 * we don't get DMA completion interrupt for short packets.
728	 *
729	 * Theoretically, we could enable DMAReq irq (MUSB_RXCSR_DMAMODE = 1),
730	 * to get endpoint interrupt on every DMA req, but that didn't seem
731	 * to work reliably.
732	 *
733	 * REVISIT an updated g_file_storage can set req->short_not_ok, which
734	 * then becomes usable as a runtime "use mode 1" hint...
735	 */
736
737				/* Experimental: Mode1 works with mass storage use cases */
738				if (use_mode_1) {
739					csr |= MUSB_RXCSR_AUTOCLEAR;
740					musb_writew(epio, MUSB_RXCSR, csr);
741					csr |= MUSB_RXCSR_DMAENAB;
742					musb_writew(epio, MUSB_RXCSR, csr);
743
744					/*
745					 * this special sequence (enabling and then
746					 * disabling MUSB_RXCSR_DMAMODE) is required
747					 * to get DMAReq to activate
748					 */
749					musb_writew(epio, MUSB_RXCSR,
750						csr | MUSB_RXCSR_DMAMODE);
751					musb_writew(epio, MUSB_RXCSR, csr);
752
753				} else {
754					if (!musb_ep->hb_mult &&
755						musb_ep->hw_ep->rx_double_buffered)
756						csr |= MUSB_RXCSR_AUTOCLEAR;
757					csr |= MUSB_RXCSR_DMAENAB;
758					musb_writew(epio, MUSB_RXCSR, csr);
759				}
760
761				if (request->actual < request->length) {
762					int transfer_size = 0;
763					if (use_mode_1) {
764						transfer_size = min(request->length - request->actual,
765								channel->max_len);
766						musb_ep->dma->desired_mode = 1;
767					} else {
768						transfer_size = min(request->length - request->actual,
769								(unsigned)len);
770						musb_ep->dma->desired_mode = 0;
771					}
772
773					use_dma = c->channel_program(
774							channel,
775							musb_ep->packet_sz,
776							channel->desired_mode,
777							request->dma
778							+ request->actual,
779							transfer_size);
780				}
781
782				if (use_dma)
783					return;
784			}
785#elif defined(CONFIG_USB_UX500_DMA)
786			if ((is_buffer_mapped(req)) &&
787				(request->actual < request->length)) {
788
789				struct dma_controller *c;
790				struct dma_channel *channel;
791				int transfer_size = 0;
792
793				c = musb->dma_controller;
794				channel = musb_ep->dma;
795
796				/* In case first packet is short */
797				if (len < musb_ep->packet_sz)
798					transfer_size = len;
799				else if (request->short_not_ok)
800					transfer_size =	min(request->length -
801							request->actual,
802							channel->max_len);
803				else
804					transfer_size = min(request->length -
805							request->actual,
806							(unsigned)len);
807
808				csr &= ~MUSB_RXCSR_DMAMODE;
809				csr |= (MUSB_RXCSR_DMAENAB |
810					MUSB_RXCSR_AUTOCLEAR);
811
812				musb_writew(epio, MUSB_RXCSR, csr);
813
814				if (transfer_size <= musb_ep->packet_sz) {
815					musb_ep->dma->desired_mode = 0;
816				} else {
817					musb_ep->dma->desired_mode = 1;
818					/* Mode must be set after DMAENAB */
819					csr |= MUSB_RXCSR_DMAMODE;
820					musb_writew(epio, MUSB_RXCSR, csr);
821				}
822
823				if (c->channel_program(channel,
824							musb_ep->packet_sz,
825							channel->desired_mode,
826							request->dma
827							+ request->actual,
828							transfer_size))
829
830					return;
831			}
832#endif	/* Mentor's DMA */
833
834			fifo_count = request->length - request->actual;
835			dev_dbg(musb->controller, "%s OUT/RX pio fifo %d/%d, maxpacket %d\n",
836					musb_ep->end_point.name,
837					len, fifo_count,
838					musb_ep->packet_sz);
839
840			fifo_count = min_t(unsigned, len, fifo_count);
841
842#ifdef	CONFIG_USB_TUSB_OMAP_DMA
843			if (tusb_dma_omap() && is_buffer_mapped(req)) {
844				struct dma_controller *c = musb->dma_controller;
845				struct dma_channel *channel = musb_ep->dma;
846				u32 dma_addr = request->dma + request->actual;
847				int ret;
848
849				ret = c->channel_program(channel,
850						musb_ep->packet_sz,
851						channel->desired_mode,
852						dma_addr,
853						fifo_count);
854				if (ret)
855					return;
856			}
857#endif
858			/*
859			 * Unmap the dma buffer back to cpu if dma channel
860			 * programming fails. This buffer is mapped if the
861			 * channel allocation is successful
862			 */
863			 if (is_buffer_mapped(req)) {
864				unmap_dma_buffer(req, musb);
865
866				/*
867				 * Clear DMAENAB and AUTOCLEAR for the
868				 * PIO mode transfer
869				 */
870				csr &= ~(MUSB_RXCSR_DMAENAB | MUSB_RXCSR_AUTOCLEAR);
871				musb_writew(epio, MUSB_RXCSR, csr);
872			}
873
874			musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
875					(request->buf + request->actual));
876			request->actual += fifo_count;
877
878			/* REVISIT if we left anything in the fifo, flush
879			 * it and report -EOVERFLOW
880			 */
881
882			/* ack the read! */
883			csr |= MUSB_RXCSR_P_WZC_BITS;
884			csr &= ~MUSB_RXCSR_RXPKTRDY;
885			musb_writew(epio, MUSB_RXCSR, csr);
886		}
887	}
888
889	/* reach the end or short packet detected */
890	if (request->actual == request->length || len < musb_ep->packet_sz)
891		musb_g_giveback(musb_ep, request, 0);
892}
893
894/*
895 * Data ready for a request; called from IRQ
896 */
897void musb_g_rx(struct musb *musb, u8 epnum)
898{
899	u16			csr;
900	struct musb_request	*req;
901	struct usb_request	*request;
902	void __iomem		*mbase = musb->mregs;
903	struct musb_ep		*musb_ep;
904	void __iomem		*epio = musb->endpoints[epnum].regs;
905	struct dma_channel	*dma;
906	struct musb_hw_ep	*hw_ep = &musb->endpoints[epnum];
907
908	if (hw_ep->is_shared_fifo)
909		musb_ep = &hw_ep->ep_in;
910	else
911		musb_ep = &hw_ep->ep_out;
912
913	musb_ep_select(mbase, epnum);
914
915	req = next_request(musb_ep);
916	if (!req)
917		return;
918
919	request = &req->request;
920
921	csr = musb_readw(epio, MUSB_RXCSR);
922	dma = is_dma_capable() ? musb_ep->dma : NULL;
923
924	dev_dbg(musb->controller, "<== %s, rxcsr %04x%s %p\n", musb_ep->end_point.name,
925			csr, dma ? " (dma)" : "", request);
926
927	if (csr & MUSB_RXCSR_P_SENTSTALL) {
928		csr |= MUSB_RXCSR_P_WZC_BITS;
929		csr &= ~MUSB_RXCSR_P_SENTSTALL;
930		musb_writew(epio, MUSB_RXCSR, csr);
931		return;
932	}
933
934	if (csr & MUSB_RXCSR_P_OVERRUN) {
935		/* csr |= MUSB_RXCSR_P_WZC_BITS; */
936		csr &= ~MUSB_RXCSR_P_OVERRUN;
937		musb_writew(epio, MUSB_RXCSR, csr);
938
939		dev_dbg(musb->controller, "%s iso overrun on %p\n", musb_ep->name, request);
940		if (request->status == -EINPROGRESS)
941			request->status = -EOVERFLOW;
942	}
943	if (csr & MUSB_RXCSR_INCOMPRX) {
944		/* REVISIT not necessarily an error */
945		dev_dbg(musb->controller, "%s, incomprx\n", musb_ep->end_point.name);
946	}
947
948	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
949		/* "should not happen"; likely RXPKTRDY pending for DMA */
950		dev_dbg(musb->controller, "%s busy, csr %04x\n",
951			musb_ep->end_point.name, csr);
952		return;
953	}
954
955	if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
956		csr &= ~(MUSB_RXCSR_AUTOCLEAR
957				| MUSB_RXCSR_DMAENAB
958				| MUSB_RXCSR_DMAMODE);
959		musb_writew(epio, MUSB_RXCSR,
960			MUSB_RXCSR_P_WZC_BITS | csr);
961
962		request->actual += musb_ep->dma->actual_len;
963
964		dev_dbg(musb->controller, "RXCSR%d %04x, dma off, %04x, len %zu, req %p\n",
965			epnum, csr,
966			musb_readw(epio, MUSB_RXCSR),
967			musb_ep->dma->actual_len, request);
968
969#if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_TUSB_OMAP_DMA) || \
970	defined(CONFIG_USB_UX500_DMA)
971		/* Autoclear doesn't clear RxPktRdy for short packets */
972		if ((dma->desired_mode == 0 && !hw_ep->rx_double_buffered)
973				|| (dma->actual_len
974					& (musb_ep->packet_sz - 1))) {
975			/* ack the read! */
976			csr &= ~MUSB_RXCSR_RXPKTRDY;
977			musb_writew(epio, MUSB_RXCSR, csr);
978		}
979
980		/* incomplete, and not short? wait for next IN packet */
981		if ((request->actual < request->length)
982				&& (musb_ep->dma->actual_len
983					== musb_ep->packet_sz)) {
984			/* In double buffer case, continue to unload fifo if
985 			 * there is Rx packet in FIFO.
986 			 **/
987			csr = musb_readw(epio, MUSB_RXCSR);
988			if ((csr & MUSB_RXCSR_RXPKTRDY) &&
989				hw_ep->rx_double_buffered)
990				goto exit;
991			return;
992		}
993#endif
994		musb_g_giveback(musb_ep, request, 0);
995		/*
996		 * In the giveback function the MUSB lock is
997		 * released and acquired after sometime. During
998		 * this time period the INDEX register could get
999		 * changed by the gadget_queue function especially
1000		 * on SMP systems. Reselect the INDEX to be sure
1001		 * we are reading/modifying the right registers
1002		 */
1003		musb_ep_select(mbase, epnum);
1004
1005		req = next_request(musb_ep);
1006		if (!req)
1007			return;
1008	}
1009#if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_TUSB_OMAP_DMA) || \
1010	defined(CONFIG_USB_UX500_DMA)
1011exit:
1012#endif
1013	/* Analyze request */
1014	rxstate(musb, req);
1015}
1016
1017/* ------------------------------------------------------------ */
1018
1019static int musb_gadget_enable(struct usb_ep *ep,
1020			const struct usb_endpoint_descriptor *desc)
1021{
1022	unsigned long		flags;
1023	struct musb_ep		*musb_ep;
1024	struct musb_hw_ep	*hw_ep;
1025	void __iomem		*regs;
1026	struct musb		*musb;
1027	void __iomem	*mbase;
1028	u8		epnum;
1029	u16		csr;
1030	unsigned	tmp;
1031	int		status = -EINVAL;
1032
1033	if (!ep || !desc)
1034		return -EINVAL;
1035
1036	musb_ep = to_musb_ep(ep);
1037	hw_ep = musb_ep->hw_ep;
1038	regs = hw_ep->regs;
1039	musb = musb_ep->musb;
1040	mbase = musb->mregs;
1041	epnum = musb_ep->current_epnum;
1042
1043	spin_lock_irqsave(&musb->lock, flags);
1044
1045	if (musb_ep->desc) {
1046		status = -EBUSY;
1047		goto fail;
1048	}
1049	musb_ep->type = usb_endpoint_type(desc);
1050
1051	/* check direction and (later) maxpacket size against endpoint */
1052	if (usb_endpoint_num(desc) != epnum)
1053		goto fail;
1054
1055	/* REVISIT this rules out high bandwidth periodic transfers */
1056	tmp = usb_endpoint_maxp(desc);
1057	if (tmp & ~0x07ff) {
1058		int ok;
1059
1060		if (usb_endpoint_dir_in(desc))
1061			ok = musb->hb_iso_tx;
1062		else
1063			ok = musb->hb_iso_rx;
1064
1065		if (!ok) {
1066			dev_dbg(musb->controller, "no support for high bandwidth ISO\n");
1067			goto fail;
1068		}
1069		musb_ep->hb_mult = (tmp >> 11) & 3;
1070	} else {
1071		musb_ep->hb_mult = 0;
1072	}
1073
1074	musb_ep->packet_sz = tmp & 0x7ff;
1075	tmp = musb_ep->packet_sz * (musb_ep->hb_mult + 1);
1076
1077	/* enable the interrupts for the endpoint, set the endpoint
1078	 * packet size (or fail), set the mode, clear the fifo
1079	 */
1080	musb_ep_select(mbase, epnum);
1081	if (usb_endpoint_dir_in(desc)) {
1082		u16 int_txe = musb_readw(mbase, MUSB_INTRTXE);
1083
1084		if (hw_ep->is_shared_fifo)
1085			musb_ep->is_in = 1;
1086		if (!musb_ep->is_in)
1087			goto fail;
1088
1089		if (tmp > hw_ep->max_packet_sz_tx) {
1090			dev_dbg(musb->controller, "packet size beyond hardware FIFO size\n");
1091			goto fail;
1092		}
1093
1094		int_txe |= (1 << epnum);
1095		musb_writew(mbase, MUSB_INTRTXE, int_txe);
1096
1097		/* REVISIT if can_bulk_split(), use by updating "tmp";
1098		 * likewise high bandwidth periodic tx
1099		 */
1100		/* Set TXMAXP with the FIFO size of the endpoint
1101		 * to disable double buffering mode.
1102		 */
1103		if (musb->double_buffer_not_ok)
1104			musb_writew(regs, MUSB_TXMAXP, hw_ep->max_packet_sz_tx);
1105		else
1106			musb_writew(regs, MUSB_TXMAXP, musb_ep->packet_sz
1107					| (musb_ep->hb_mult << 11));
1108
1109		csr = MUSB_TXCSR_MODE | MUSB_TXCSR_CLRDATATOG;
1110		if (musb_readw(regs, MUSB_TXCSR)
1111				& MUSB_TXCSR_FIFONOTEMPTY)
1112			csr |= MUSB_TXCSR_FLUSHFIFO;
1113		if (musb_ep->type == USB_ENDPOINT_XFER_ISOC)
1114			csr |= MUSB_TXCSR_P_ISO;
1115
1116		/* set twice in case of double buffering */
1117		musb_writew(regs, MUSB_TXCSR, csr);
1118		/* REVISIT may be inappropriate w/o FIFONOTEMPTY ... */
1119		musb_writew(regs, MUSB_TXCSR, csr);
1120
1121	} else {
1122		u16 int_rxe = musb_readw(mbase, MUSB_INTRRXE);
1123
1124		if (hw_ep->is_shared_fifo)
1125			musb_ep->is_in = 0;
1126		if (musb_ep->is_in)
1127			goto fail;
1128
1129		if (tmp > hw_ep->max_packet_sz_rx) {
1130			dev_dbg(musb->controller, "packet size beyond hardware FIFO size\n");
1131			goto fail;
1132		}
1133
1134		int_rxe |= (1 << epnum);
1135		musb_writew(mbase, MUSB_INTRRXE, int_rxe);
1136
1137		/* REVISIT if can_bulk_combine() use by updating "tmp"
1138		 * likewise high bandwidth periodic rx
1139		 */
1140		/* Set RXMAXP with the FIFO size of the endpoint
1141		 * to disable double buffering mode.
1142		 */
1143		if (musb->double_buffer_not_ok)
1144			musb_writew(regs, MUSB_RXMAXP, hw_ep->max_packet_sz_tx);
1145		else
1146			musb_writew(regs, MUSB_RXMAXP, musb_ep->packet_sz
1147					| (musb_ep->hb_mult << 11));
1148
1149		/* force shared fifo to OUT-only mode */
1150		if (hw_ep->is_shared_fifo) {
1151			csr = musb_readw(regs, MUSB_TXCSR);
1152			csr &= ~(MUSB_TXCSR_MODE | MUSB_TXCSR_TXPKTRDY);
1153			musb_writew(regs, MUSB_TXCSR, csr);
1154		}
1155
1156		csr = MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_CLRDATATOG;
1157		if (musb_ep->type == USB_ENDPOINT_XFER_ISOC)
1158			csr |= MUSB_RXCSR_P_ISO;
1159		else if (musb_ep->type == USB_ENDPOINT_XFER_INT)
1160			csr |= MUSB_RXCSR_DISNYET;
1161
1162		/* set twice in case of double buffering */
1163		musb_writew(regs, MUSB_RXCSR, csr);
1164		musb_writew(regs, MUSB_RXCSR, csr);
1165	}
1166
1167	/* NOTE:  all the I/O code _should_ work fine without DMA, in case
1168	 * for some reason you run out of channels here.
1169	 */
1170	if (is_dma_capable() && musb->dma_controller) {
1171		struct dma_controller	*c = musb->dma_controller;
1172
1173		musb_ep->dma = c->channel_alloc(c, hw_ep,
1174				(desc->bEndpointAddress & USB_DIR_IN));
1175	} else
1176		musb_ep->dma = NULL;
1177
1178	musb_ep->desc = desc;
1179	musb_ep->busy = 0;
1180	musb_ep->wedged = 0;
1181	status = 0;
1182
1183	pr_debug("%s periph: enabled %s for %s %s, %smaxpacket %d\n",
1184			musb_driver_name, musb_ep->end_point.name,
1185			({ char *s; switch (musb_ep->type) {
1186			case USB_ENDPOINT_XFER_BULK:	s = "bulk"; break;
1187			case USB_ENDPOINT_XFER_INT:	s = "int"; break;
1188			default:			s = "iso"; break;
1189			}; s; }),
1190			musb_ep->is_in ? "IN" : "OUT",
1191			musb_ep->dma ? "dma, " : "",
1192			musb_ep->packet_sz);
1193
1194	schedule_work(&musb->irq_work);
1195
1196fail:
1197	spin_unlock_irqrestore(&musb->lock, flags);
1198	return status;
1199}
1200
1201/*
1202 * Disable an endpoint flushing all requests queued.
1203 */
1204static int musb_gadget_disable(struct usb_ep *ep)
1205{
1206	unsigned long	flags;
1207	struct musb	*musb;
1208	u8		epnum;
1209	struct musb_ep	*musb_ep;
1210	void __iomem	*epio;
1211	int		status = 0;
1212
1213	musb_ep = to_musb_ep(ep);
1214	musb = musb_ep->musb;
1215	epnum = musb_ep->current_epnum;
1216	epio = musb->endpoints[epnum].regs;
1217
1218	spin_lock_irqsave(&musb->lock, flags);
1219	musb_ep_select(musb->mregs, epnum);
1220
1221	/* zero the endpoint sizes */
1222	if (musb_ep->is_in) {
1223		u16 int_txe = musb_readw(musb->mregs, MUSB_INTRTXE);
1224		int_txe &= ~(1 << epnum);
1225		musb_writew(musb->mregs, MUSB_INTRTXE, int_txe);
1226		musb_writew(epio, MUSB_TXMAXP, 0);
1227	} else {
1228		u16 int_rxe = musb_readw(musb->mregs, MUSB_INTRRXE);
1229		int_rxe &= ~(1 << epnum);
1230		musb_writew(musb->mregs, MUSB_INTRRXE, int_rxe);
1231		musb_writew(epio, MUSB_RXMAXP, 0);
1232	}
1233
1234	musb_ep->desc = NULL;
1235	musb_ep->end_point.desc = NULL;
1236
1237	/* abort all pending DMA and requests */
1238	nuke(musb_ep, -ESHUTDOWN);
1239
1240	schedule_work(&musb->irq_work);
1241
1242	spin_unlock_irqrestore(&(musb->lock), flags);
1243
1244	dev_dbg(musb->controller, "%s\n", musb_ep->end_point.name);
1245
1246	return status;
1247}
1248
1249/*
1250 * Allocate a request for an endpoint.
1251 * Reused by ep0 code.
1252 */
1253struct usb_request *musb_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
1254{
1255	struct musb_ep		*musb_ep = to_musb_ep(ep);
1256	struct musb		*musb = musb_ep->musb;
1257	struct musb_request	*request = NULL;
1258
1259	request = kzalloc(sizeof *request, gfp_flags);
1260	if (!request) {
1261		dev_dbg(musb->controller, "not enough memory\n");
1262		return NULL;
1263	}
1264
1265	request->request.dma = DMA_ADDR_INVALID;
1266	request->epnum = musb_ep->current_epnum;
1267	request->ep = musb_ep;
1268
1269	return &request->request;
1270}
1271
1272/*
1273 * Free a request
1274 * Reused by ep0 code.
1275 */
1276void musb_free_request(struct usb_ep *ep, struct usb_request *req)
1277{
1278	kfree(to_musb_request(req));
1279}
1280
1281static LIST_HEAD(buffers);
1282
1283struct free_record {
1284	struct list_head	list;
1285	struct device		*dev;
1286	unsigned		bytes;
1287	dma_addr_t		dma;
1288};
1289
1290/*
1291 * Context: controller locked, IRQs blocked.
1292 */
1293void musb_ep_restart(struct musb *musb, struct musb_request *req)
1294{
1295	dev_dbg(musb->controller, "<== %s request %p len %u on hw_ep%d\n",
1296		req->tx ? "TX/IN" : "RX/OUT",
1297		&req->request, req->request.length, req->epnum);
1298
1299	musb_ep_select(musb->mregs, req->epnum);
1300	if (req->tx)
1301		txstate(musb, req);
1302	else
1303		rxstate(musb, req);
1304}
1305
1306static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
1307			gfp_t gfp_flags)
1308{
1309	struct musb_ep		*musb_ep;
1310	struct musb_request	*request;
1311	struct musb		*musb;
1312	int			status = 0;
1313	unsigned long		lockflags;
1314
1315	if (!ep || !req)
1316		return -EINVAL;
1317	if (!req->buf)
1318		return -ENODATA;
1319
1320	musb_ep = to_musb_ep(ep);
1321	musb = musb_ep->musb;
1322
1323	request = to_musb_request(req);
1324	request->musb = musb;
1325
1326	if (request->ep != musb_ep)
1327		return -EINVAL;
1328
1329	dev_dbg(musb->controller, "<== to %s request=%p\n", ep->name, req);
1330
1331	/* request is mine now... */
1332	request->request.actual = 0;
1333	request->request.status = -EINPROGRESS;
1334	request->epnum = musb_ep->current_epnum;
1335	request->tx = musb_ep->is_in;
1336
1337	map_dma_buffer(request, musb, musb_ep);
1338
1339	spin_lock_irqsave(&musb->lock, lockflags);
1340
1341	/* don't queue if the ep is down */
1342	if (!musb_ep->desc) {
1343		dev_dbg(musb->controller, "req %p queued to %s while ep %s\n",
1344				req, ep->name, "disabled");
1345		status = -ESHUTDOWN;
1346		goto cleanup;
1347	}
1348
1349	/* add request to the list */
1350	list_add_tail(&request->list, &musb_ep->req_list);
1351
1352	/* it this is the head of the queue, start i/o ... */
1353	if (!musb_ep->busy && &request->list == musb_ep->req_list.next)
1354		musb_ep_restart(musb, request);
1355
1356cleanup:
1357	spin_unlock_irqrestore(&musb->lock, lockflags);
1358	return status;
1359}
1360
1361static int musb_gadget_dequeue(struct usb_ep *ep, struct usb_request *request)
1362{
1363	struct musb_ep		*musb_ep = to_musb_ep(ep);
1364	struct musb_request	*req = to_musb_request(request);
1365	struct musb_request	*r;
1366	unsigned long		flags;
1367	int			status = 0;
1368	struct musb		*musb = musb_ep->musb;
1369
1370	if (!ep || !request || to_musb_request(request)->ep != musb_ep)
1371		return -EINVAL;
1372
1373	spin_lock_irqsave(&musb->lock, flags);
1374
1375	list_for_each_entry(r, &musb_ep->req_list, list) {
1376		if (r == req)
1377			break;
1378	}
1379	if (r != req) {
1380		dev_dbg(musb->controller, "request %p not queued to %s\n", request, ep->name);
1381		status = -EINVAL;
1382		goto done;
1383	}
1384
1385	/* if the hardware doesn't have the request, easy ... */
1386	if (musb_ep->req_list.next != &req->list || musb_ep->busy)
1387		musb_g_giveback(musb_ep, request, -ECONNRESET);
1388
1389	/* ... else abort the dma transfer ... */
1390	else if (is_dma_capable() && musb_ep->dma) {
1391		struct dma_controller	*c = musb->dma_controller;
1392
1393		musb_ep_select(musb->mregs, musb_ep->current_epnum);
1394		if (c->channel_abort)
1395			status = c->channel_abort(musb_ep->dma);
1396		else
1397			status = -EBUSY;
1398		if (status == 0)
1399			musb_g_giveback(musb_ep, request, -ECONNRESET);
1400	} else {
1401		/* NOTE: by sticking to easily tested hardware/driver states,
1402		 * we leave counting of in-flight packets imprecise.
1403		 */
1404		musb_g_giveback(musb_ep, request, -ECONNRESET);
1405	}
1406
1407done:
1408	spin_unlock_irqrestore(&musb->lock, flags);
1409	return status;
1410}
1411
1412/*
1413 * Set or clear the halt bit of an endpoint. A halted enpoint won't tx/rx any
1414 * data but will queue requests.
1415 *
1416 * exported to ep0 code
1417 */
1418static int musb_gadget_set_halt(struct usb_ep *ep, int value)
1419{
1420	struct musb_ep		*musb_ep = to_musb_ep(ep);
1421	u8			epnum = musb_ep->current_epnum;
1422	struct musb		*musb = musb_ep->musb;
1423	void __iomem		*epio = musb->endpoints[epnum].regs;
1424	void __iomem		*mbase;
1425	unsigned long		flags;
1426	u16			csr;
1427	struct musb_request	*request;
1428	int			status = 0;
1429
1430	if (!ep)
1431		return -EINVAL;
1432	mbase = musb->mregs;
1433
1434	spin_lock_irqsave(&musb->lock, flags);
1435
1436	if ((USB_ENDPOINT_XFER_ISOC == musb_ep->type)) {
1437		status = -EINVAL;
1438		goto done;
1439	}
1440
1441	musb_ep_select(mbase, epnum);
1442
1443	request = next_request(musb_ep);
1444	if (value) {
1445		if (request) {
1446			dev_dbg(musb->controller, "request in progress, cannot halt %s\n",
1447			    ep->name);
1448			status = -EAGAIN;
1449			goto done;
1450		}
1451		/* Cannot portably stall with non-empty FIFO */
1452		if (musb_ep->is_in) {
1453			csr = musb_readw(epio, MUSB_TXCSR);
1454			if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
1455				dev_dbg(musb->controller, "FIFO busy, cannot halt %s\n", ep->name);
1456				status = -EAGAIN;
1457				goto done;
1458			}
1459		}
1460	} else
1461		musb_ep->wedged = 0;
1462
1463	/* set/clear the stall and toggle bits */
1464	dev_dbg(musb->controller, "%s: %s stall\n", ep->name, value ? "set" : "clear");
1465	if (musb_ep->is_in) {
1466		csr = musb_readw(epio, MUSB_TXCSR);
1467		csr |= MUSB_TXCSR_P_WZC_BITS
1468			| MUSB_TXCSR_CLRDATATOG;
1469		if (value)
1470			csr |= MUSB_TXCSR_P_SENDSTALL;
1471		else
1472			csr &= ~(MUSB_TXCSR_P_SENDSTALL
1473				| MUSB_TXCSR_P_SENTSTALL);
1474		csr &= ~MUSB_TXCSR_TXPKTRDY;
1475		musb_writew(epio, MUSB_TXCSR, csr);
1476	} else {
1477		csr = musb_readw(epio, MUSB_RXCSR);
1478		csr |= MUSB_RXCSR_P_WZC_BITS
1479			| MUSB_RXCSR_FLUSHFIFO
1480			| MUSB_RXCSR_CLRDATATOG;
1481		if (value)
1482			csr |= MUSB_RXCSR_P_SENDSTALL;
1483		else
1484			csr &= ~(MUSB_RXCSR_P_SENDSTALL
1485				| MUSB_RXCSR_P_SENTSTALL);
1486		musb_writew(epio, MUSB_RXCSR, csr);
1487	}
1488
1489	/* maybe start the first request in the queue */
1490	if (!musb_ep->busy && !value && request) {
1491		dev_dbg(musb->controller, "restarting the request\n");
1492		musb_ep_restart(musb, request);
1493	}
1494
1495done:
1496	spin_unlock_irqrestore(&musb->lock, flags);
1497	return status;
1498}
1499
1500/*
1501 * Sets the halt feature with the clear requests ignored
1502 */
1503static int musb_gadget_set_wedge(struct usb_ep *ep)
1504{
1505	struct musb_ep		*musb_ep = to_musb_ep(ep);
1506
1507	if (!ep)
1508		return -EINVAL;
1509
1510	musb_ep->wedged = 1;
1511
1512	return usb_ep_set_halt(ep);
1513}
1514
1515static int musb_gadget_fifo_status(struct usb_ep *ep)
1516{
1517	struct musb_ep		*musb_ep = to_musb_ep(ep);
1518	void __iomem		*epio = musb_ep->hw_ep->regs;
1519	int			retval = -EINVAL;
1520
1521	if (musb_ep->desc && !musb_ep->is_in) {
1522		struct musb		*musb = musb_ep->musb;
1523		int			epnum = musb_ep->current_epnum;
1524		void __iomem		*mbase = musb->mregs;
1525		unsigned long		flags;
1526
1527		spin_lock_irqsave(&musb->lock, flags);
1528
1529		musb_ep_select(mbase, epnum);
1530		/* FIXME return zero unless RXPKTRDY is set */
1531		retval = musb_readw(epio, MUSB_RXCOUNT);
1532
1533		spin_unlock_irqrestore(&musb->lock, flags);
1534	}
1535	return retval;
1536}
1537
1538static void musb_gadget_fifo_flush(struct usb_ep *ep)
1539{
1540	struct musb_ep	*musb_ep = to_musb_ep(ep);
1541	struct musb	*musb = musb_ep->musb;
1542	u8		epnum = musb_ep->current_epnum;
1543	void __iomem	*epio = musb->endpoints[epnum].regs;
1544	void __iomem	*mbase;
1545	unsigned long	flags;
1546	u16		csr, int_txe;
1547
1548	mbase = musb->mregs;
1549
1550	spin_lock_irqsave(&musb->lock, flags);
1551	musb_ep_select(mbase, (u8) epnum);
1552
1553	/* disable interrupts */
1554	int_txe = musb_readw(mbase, MUSB_INTRTXE);
1555	musb_writew(mbase, MUSB_INTRTXE, int_txe & ~(1 << epnum));
1556
1557	if (musb_ep->is_in) {
1558		csr = musb_readw(epio, MUSB_TXCSR);
1559		if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
1560			csr |= MUSB_TXCSR_FLUSHFIFO | MUSB_TXCSR_P_WZC_BITS;
1561			/*
1562			 * Setting both TXPKTRDY and FLUSHFIFO makes controller
1563			 * to interrupt current FIFO loading, but not flushing
1564			 * the already loaded ones.
1565			 */
1566			csr &= ~MUSB_TXCSR_TXPKTRDY;
1567			musb_writew(epio, MUSB_TXCSR, csr);
1568			/* REVISIT may be inappropriate w/o FIFONOTEMPTY ... */
1569			musb_writew(epio, MUSB_TXCSR, csr);
1570		}
1571	} else {
1572		csr = musb_readw(epio, MUSB_RXCSR);
1573		csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_P_WZC_BITS;
1574		musb_writew(epio, MUSB_RXCSR, csr);
1575		musb_writew(epio, MUSB_RXCSR, csr);
1576	}
1577
1578	/* re-enable interrupt */
1579	musb_writew(mbase, MUSB_INTRTXE, int_txe);
1580	spin_unlock_irqrestore(&musb->lock, flags);
1581}
1582
1583static const struct usb_ep_ops musb_ep_ops = {
1584	.enable		= musb_gadget_enable,
1585	.disable	= musb_gadget_disable,
1586	.alloc_request	= musb_alloc_request,
1587	.free_request	= musb_free_request,
1588	.queue		= musb_gadget_queue,
1589	.dequeue	= musb_gadget_dequeue,
1590	.set_halt	= musb_gadget_set_halt,
1591	.set_wedge	= musb_gadget_set_wedge,
1592	.fifo_status	= musb_gadget_fifo_status,
1593	.fifo_flush	= musb_gadget_fifo_flush
1594};
1595
1596/* ----------------------------------------------------------------------- */
1597
1598static int musb_gadget_get_frame(struct usb_gadget *gadget)
1599{
1600	struct musb	*musb = gadget_to_musb(gadget);
1601
1602	return (int)musb_readw(musb->mregs, MUSB_FRAME);
1603}
1604
1605static int musb_gadget_wakeup(struct usb_gadget *gadget)
1606{
1607	struct musb	*musb = gadget_to_musb(gadget);
1608	void __iomem	*mregs = musb->mregs;
1609	unsigned long	flags;
1610	int		status = -EINVAL;
1611	u8		power, devctl;
1612	int		retries;
1613
1614	spin_lock_irqsave(&musb->lock, flags);
1615
1616	switch (musb->xceiv->state) {
1617	case OTG_STATE_B_PERIPHERAL:
1618		/* NOTE:  OTG state machine doesn't include B_SUSPENDED;
1619		 * that's part of the standard usb 1.1 state machine, and
1620		 * doesn't affect OTG transitions.
1621		 */
1622		if (musb->may_wakeup && musb->is_suspended)
1623			break;
1624		goto done;
1625	case OTG_STATE_B_IDLE:
1626		/* Start SRP ... OTG not required. */
1627		devctl = musb_readb(mregs, MUSB_DEVCTL);
1628		dev_dbg(musb->controller, "Sending SRP: devctl: %02x\n", devctl);
1629		devctl |= MUSB_DEVCTL_SESSION;
1630		musb_writeb(mregs, MUSB_DEVCTL, devctl);
1631		devctl = musb_readb(mregs, MUSB_DEVCTL);
1632		retries = 100;
1633		while (!(devctl & MUSB_DEVCTL_SESSION)) {
1634			devctl = musb_readb(mregs, MUSB_DEVCTL);
1635			if (retries-- < 1)
1636				break;
1637		}
1638		retries = 10000;
1639		while (devctl & MUSB_DEVCTL_SESSION) {
1640			devctl = musb_readb(mregs, MUSB_DEVCTL);
1641			if (retries-- < 1)
1642				break;
1643		}
1644
1645		spin_unlock_irqrestore(&musb->lock, flags);
1646		otg_start_srp(musb->xceiv->otg);
1647		spin_lock_irqsave(&musb->lock, flags);
1648
1649		/* Block idling for at least 1s */
1650		musb_platform_try_idle(musb,
1651			jiffies + msecs_to_jiffies(1 * HZ));
1652
1653		status = 0;
1654		goto done;
1655	default:
1656		dev_dbg(musb->controller, "Unhandled wake: %s\n",
1657			otg_state_string(musb->xceiv->state));
1658		goto done;
1659	}
1660
1661	status = 0;
1662
1663	power = musb_readb(mregs, MUSB_POWER);
1664	power |= MUSB_POWER_RESUME;
1665	musb_writeb(mregs, MUSB_POWER, power);
1666	dev_dbg(musb->controller, "issue wakeup\n");
1667
1668	/* FIXME do this next chunk in a timer callback, no udelay */
1669	mdelay(2);
1670
1671	power = musb_readb(mregs, MUSB_POWER);
1672	power &= ~MUSB_POWER_RESUME;
1673	musb_writeb(mregs, MUSB_POWER, power);
1674done:
1675	spin_unlock_irqrestore(&musb->lock, flags);
1676	return status;
1677}
1678
1679static int
1680musb_gadget_set_self_powered(struct usb_gadget *gadget, int is_selfpowered)
1681{
1682	struct musb	*musb = gadget_to_musb(gadget);
1683
1684	musb->is_self_powered = !!is_selfpowered;
1685	return 0;
1686}
1687
1688static void musb_pullup(struct musb *musb, int is_on)
1689{
1690	u8 power;
1691
1692	power = musb_readb(musb->mregs, MUSB_POWER);
1693	if (is_on)
1694		power |= MUSB_POWER_SOFTCONN;
1695	else
1696		power &= ~MUSB_POWER_SOFTCONN;
1697
1698	/* FIXME if on, HdrcStart; if off, HdrcStop */
1699
1700	dev_dbg(musb->controller, "gadget D+ pullup %s\n",
1701		is_on ? "on" : "off");
1702	musb_writeb(musb->mregs, MUSB_POWER, power);
1703}
1704
1705#if 0
1706static int musb_gadget_vbus_session(struct usb_gadget *gadget, int is_active)
1707{
1708	dev_dbg(musb->controller, "<= %s =>\n", __func__);
1709
1710	/*
1711	 * FIXME iff driver's softconnect flag is set (as it is during probe,
1712	 * though that can clear it), just musb_pullup().
1713	 */
1714
1715	return -EINVAL;
1716}
1717#endif
1718
1719static int musb_gadget_vbus_draw(struct usb_gadget *gadget, unsigned mA)
1720{
1721	struct musb	*musb = gadget_to_musb(gadget);
1722
1723	if (!musb->xceiv->set_power)
1724		return -EOPNOTSUPP;
1725	return usb_phy_set_power(musb->xceiv, mA);
1726}
1727
1728static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
1729{
1730	struct musb	*musb = gadget_to_musb(gadget);
1731	unsigned long	flags;
1732
1733	is_on = !!is_on;
1734
1735	pm_runtime_get_sync(musb->controller);
1736
1737	/* NOTE: this assumes we are sensing vbus; we'd rather
1738	 * not pullup unless the B-session is active.
1739	 */
1740	spin_lock_irqsave(&musb->lock, flags);
1741	if (is_on != musb->softconnect) {
1742		musb->softconnect = is_on;
1743		musb_pullup(musb, is_on);
1744	}
1745	spin_unlock_irqrestore(&musb->lock, flags);
1746
1747	pm_runtime_put(musb->controller);
1748
1749	return 0;
1750}
1751
1752static int musb_gadget_start(struct usb_gadget *g,
1753		struct usb_gadget_driver *driver);
1754static int musb_gadget_stop(struct usb_gadget *g,
1755		struct usb_gadget_driver *driver);
1756
1757static const struct usb_gadget_ops musb_gadget_operations = {
1758	.get_frame		= musb_gadget_get_frame,
1759	.wakeup			= musb_gadget_wakeup,
1760	.set_selfpowered	= musb_gadget_set_self_powered,
1761	/* .vbus_session		= musb_gadget_vbus_session, */
1762	.vbus_draw		= musb_gadget_vbus_draw,
1763	.pullup			= musb_gadget_pullup,
1764	.udc_start		= musb_gadget_start,
1765	.udc_stop		= musb_gadget_stop,
1766};
1767
1768/* ----------------------------------------------------------------------- */
1769
1770/* Registration */
1771
1772/* Only this registration code "knows" the rule (from USB standards)
1773 * about there being only one external upstream port.  It assumes
1774 * all peripheral ports are external...
1775 */
1776
1777static void musb_gadget_release(struct device *dev)
1778{
1779	/* kref_put(WHAT) */
1780	dev_dbg(dev, "%s\n", __func__);
1781}
1782
1783
1784static void __devinit
1785init_peripheral_ep(struct musb *musb, struct musb_ep *ep, u8 epnum, int is_in)
1786{
1787	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1788
1789	memset(ep, 0, sizeof *ep);
1790
1791	ep->current_epnum = epnum;
1792	ep->musb = musb;
1793	ep->hw_ep = hw_ep;
1794	ep->is_in = is_in;
1795
1796	INIT_LIST_HEAD(&ep->req_list);
1797
1798	sprintf(ep->name, "ep%d%s", epnum,
1799			(!epnum || hw_ep->is_shared_fifo) ? "" : (
1800				is_in ? "in" : "out"));
1801	ep->end_point.name = ep->name;
1802	INIT_LIST_HEAD(&ep->end_point.ep_list);
1803	if (!epnum) {
1804		ep->end_point.maxpacket = 64;
1805		ep->end_point.ops = &musb_g_ep0_ops;
1806		musb->g.ep0 = &ep->end_point;
1807	} else {
1808		if (is_in)
1809			ep->end_point.maxpacket = hw_ep->max_packet_sz_tx;
1810		else
1811			ep->end_point.maxpacket = hw_ep->max_packet_sz_rx;
1812		ep->end_point.ops = &musb_ep_ops;
1813		list_add_tail(&ep->end_point.ep_list, &musb->g.ep_list);
1814	}
1815}
1816
1817/*
1818 * Initialize the endpoints exposed to peripheral drivers, with backlinks
1819 * to the rest of the driver state.
1820 */
1821static inline void __devinit musb_g_init_endpoints(struct musb *musb)
1822{
1823	u8			epnum;
1824	struct musb_hw_ep	*hw_ep;
1825	unsigned		count = 0;
1826
1827	/* initialize endpoint list just once */
1828	INIT_LIST_HEAD(&(musb->g.ep_list));
1829
1830	for (epnum = 0, hw_ep = musb->endpoints;
1831			epnum < musb->nr_endpoints;
1832			epnum++, hw_ep++) {
1833		if (hw_ep->is_shared_fifo /* || !epnum */) {
1834			init_peripheral_ep(musb, &hw_ep->ep_in, epnum, 0);
1835			count++;
1836		} else {
1837			if (hw_ep->max_packet_sz_tx) {
1838				init_peripheral_ep(musb, &hw_ep->ep_in,
1839							epnum, 1);
1840				count++;
1841			}
1842			if (hw_ep->max_packet_sz_rx) {
1843				init_peripheral_ep(musb, &hw_ep->ep_out,
1844							epnum, 0);
1845				count++;
1846			}
1847		}
1848	}
1849}
1850
1851/* called once during driver setup to initialize and link into
1852 * the driver model; memory is zeroed.
1853 */
1854int __devinit musb_gadget_setup(struct musb *musb)
1855{
1856	int status;
1857
1858	/* REVISIT minor race:  if (erroneously) setting up two
1859	 * musb peripherals at the same time, only the bus lock
1860	 * is probably held.
1861	 */
1862
1863	musb->g.ops = &musb_gadget_operations;
1864	musb->g.max_speed = USB_SPEED_HIGH;
1865	musb->g.speed = USB_SPEED_UNKNOWN;
1866
1867	/* this "gadget" abstracts/virtualizes the controller */
1868	dev_set_name(&musb->g.dev, "gadget");
1869	musb->g.dev.parent = musb->controller;
1870	musb->g.dev.dma_mask = musb->controller->dma_mask;
1871	musb->g.dev.release = musb_gadget_release;
1872	musb->g.name = musb_driver_name;
1873
1874	if (is_otg_enabled(musb))
1875		musb->g.is_otg = 1;
1876
1877	musb_g_init_endpoints(musb);
1878
1879	musb->is_active = 0;
1880	musb_platform_try_idle(musb, 0);
1881
1882	status = device_register(&musb->g.dev);
1883	if (status != 0) {
1884		put_device(&musb->g.dev);
1885		return status;
1886	}
1887	status = usb_add_gadget_udc(musb->controller, &musb->g);
1888	if (status)
1889		goto err;
1890
1891	return 0;
1892err:
1893	musb->g.dev.parent = NULL;
1894	device_unregister(&musb->g.dev);
1895	return status;
1896}
1897
1898void musb_gadget_cleanup(struct musb *musb)
1899{
1900	usb_del_gadget_udc(&musb->g);
1901	if (musb->g.dev.parent)
1902		device_unregister(&musb->g.dev);
1903}
1904
1905/*
1906 * Register the gadget driver. Used by gadget drivers when
1907 * registering themselves with the controller.
1908 *
1909 * -EINVAL something went wrong (not driver)
1910 * -EBUSY another gadget is already using the controller
1911 * -ENOMEM no memory to perform the operation
1912 *
1913 * @param driver the gadget driver
1914 * @return <0 if error, 0 if everything is fine
1915 */
1916static int musb_gadget_start(struct usb_gadget *g,
1917		struct usb_gadget_driver *driver)
1918{
1919	struct musb		*musb = gadget_to_musb(g);
1920	struct usb_otg		*otg = musb->xceiv->otg;
1921	unsigned long		flags;
1922	int			retval = -EINVAL;
1923
1924	if (driver->max_speed < USB_SPEED_HIGH)
1925		goto err0;
1926
1927	pm_runtime_get_sync(musb->controller);
1928
1929	dev_dbg(musb->controller, "registering driver %s\n", driver->function);
1930
1931	musb->softconnect = 0;
1932	musb->gadget_driver = driver;
1933
1934	spin_lock_irqsave(&musb->lock, flags);
1935	musb->is_active = 1;
1936
1937	otg_set_peripheral(otg, &musb->g);
1938	musb->xceiv->state = OTG_STATE_B_IDLE;
1939
1940	/*
1941	 * FIXME this ignores the softconnect flag.  Drivers are
1942	 * allowed hold the peripheral inactive until for example
1943	 * userspace hooks up printer hardware or DSP codecs, so
1944	 * hosts only see fully functional devices.
1945	 */
1946
1947	if (!is_otg_enabled(musb))
1948		musb_start(musb);
1949
1950	spin_unlock_irqrestore(&musb->lock, flags);
1951
1952	if (is_otg_enabled(musb)) {
1953		struct usb_hcd	*hcd = musb_to_hcd(musb);
1954
1955		dev_dbg(musb->controller, "OTG startup...\n");
1956
1957		/* REVISIT:  funcall to other code, which also
1958		 * handles power budgeting ... this way also
1959		 * ensures HdrcStart is indirectly called.
1960		 */
1961		retval = usb_add_hcd(musb_to_hcd(musb), 0, 0);
1962		if (retval < 0) {
1963			dev_dbg(musb->controller, "add_hcd failed, %d\n", retval);
1964			goto err2;
1965		}
1966
1967		if ((musb->xceiv->last_event == USB_EVENT_ID)
1968					&& otg->set_vbus)
1969			otg_set_vbus(otg, 1);
1970
1971		hcd->self.uses_pio_for_control = 1;
1972	}
1973	if (musb->xceiv->last_event == USB_EVENT_NONE)
1974		pm_runtime_put(musb->controller);
1975
1976	return 0;
1977
1978err2:
1979	if (!is_otg_enabled(musb))
1980		musb_stop(musb);
1981err0:
1982	return retval;
1983}
1984
1985static void stop_activity(struct musb *musb, struct usb_gadget_driver *driver)
1986{
1987	int			i;
1988	struct musb_hw_ep	*hw_ep;
1989
1990	/* don't disconnect if it's not connected */
1991	if (musb->g.speed == USB_SPEED_UNKNOWN)
1992		driver = NULL;
1993	else
1994		musb->g.speed = USB_SPEED_UNKNOWN;
1995
1996	/* deactivate the hardware */
1997	if (musb->softconnect) {
1998		musb->softconnect = 0;
1999		musb_pullup(musb, 0);
2000	}
2001	musb_stop(musb);
2002
2003	/* killing any outstanding requests will quiesce the driver;
2004	 * then report disconnect
2005	 */
2006	if (driver) {
2007		for (i = 0, hw_ep = musb->endpoints;
2008				i < musb->nr_endpoints;
2009				i++, hw_ep++) {
2010			musb_ep_select(musb->mregs, i);
2011			if (hw_ep->is_shared_fifo /* || !epnum */) {
2012				nuke(&hw_ep->ep_in, -ESHUTDOWN);
2013			} else {
2014				if (hw_ep->max_packet_sz_tx)
2015					nuke(&hw_ep->ep_in, -ESHUTDOWN);
2016				if (hw_ep->max_packet_sz_rx)
2017					nuke(&hw_ep->ep_out, -ESHUTDOWN);
2018			}
2019		}
2020	}
2021}
2022
2023/*
2024 * Unregister the gadget driver. Used by gadget drivers when
2025 * unregistering themselves from the controller.
2026 *
2027 * @param driver the gadget driver to unregister
2028 */
2029static int musb_gadget_stop(struct usb_gadget *g,
2030		struct usb_gadget_driver *driver)
2031{
2032	struct musb	*musb = gadget_to_musb(g);
2033	unsigned long	flags;
2034
2035	if (musb->xceiv->last_event == USB_EVENT_NONE)
2036		pm_runtime_get_sync(musb->controller);
2037
2038	/*
2039	 * REVISIT always use otg_set_peripheral() here too;
2040	 * this needs to shut down the OTG engine.
2041	 */
2042
2043	spin_lock_irqsave(&musb->lock, flags);
2044
2045	musb_hnp_stop(musb);
2046
2047	(void) musb_gadget_vbus_draw(&musb->g, 0);
2048
2049	musb->xceiv->state = OTG_STATE_UNDEFINED;
2050	stop_activity(musb, driver);
2051	otg_set_peripheral(musb->xceiv->otg, NULL);
2052
2053	dev_dbg(musb->controller, "unregistering driver %s\n", driver->function);
2054
2055	musb->is_active = 0;
2056	musb_platform_try_idle(musb, 0);
2057	spin_unlock_irqrestore(&musb->lock, flags);
2058
2059	if (is_otg_enabled(musb)) {
2060		usb_remove_hcd(musb_to_hcd(musb));
2061		/* FIXME we need to be able to register another
2062		 * gadget driver here and have everything work;
2063		 * that currently misbehaves.
2064		 */
2065	}
2066
2067	if (!is_otg_enabled(musb))
2068		musb_stop(musb);
2069
2070	pm_runtime_put(musb->controller);
2071
2072	return 0;
2073}
2074
2075/* ----------------------------------------------------------------------- */
2076
2077/* lifecycle operations called through plat_uds.c */
2078
2079void musb_g_resume(struct musb *musb)
2080{
2081	musb->is_suspended = 0;
2082	switch (musb->xceiv->state) {
2083	case OTG_STATE_B_IDLE:
2084		break;
2085	case OTG_STATE_B_WAIT_ACON:
2086	case OTG_STATE_B_PERIPHERAL:
2087		musb->is_active = 1;
2088		if (musb->gadget_driver && musb->gadget_driver->resume) {
2089			spin_unlock(&musb->lock);
2090			musb->gadget_driver->resume(&musb->g);
2091			spin_lock(&musb->lock);
2092		}
2093		break;
2094	default:
2095		WARNING("unhandled RESUME transition (%s)\n",
2096				otg_state_string(musb->xceiv->state));
2097	}
2098}
2099
2100/* called when SOF packets stop for 3+ msec */
2101void musb_g_suspend(struct musb *musb)
2102{
2103	u8	devctl;
2104
2105	devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
2106	dev_dbg(musb->controller, "devctl %02x\n", devctl);
2107
2108	switch (musb->xceiv->state) {
2109	case OTG_STATE_B_IDLE:
2110		if ((devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS)
2111			musb->xceiv->state = OTG_STATE_B_PERIPHERAL;
2112		break;
2113	case OTG_STATE_B_PERIPHERAL:
2114		musb->is_suspended = 1;
2115		if (musb->gadget_driver && musb->gadget_driver->suspend) {
2116			spin_unlock(&musb->lock);
2117			musb->gadget_driver->suspend(&musb->g);
2118			spin_lock(&musb->lock);
2119		}
2120		break;
2121	default:
2122		/* REVISIT if B_HOST, clear DEVCTL.HOSTREQ;
2123		 * A_PERIPHERAL may need care too
2124		 */
2125		WARNING("unhandled SUSPEND transition (%s)\n",
2126				otg_state_string(musb->xceiv->state));
2127	}
2128}
2129
2130/* Called during SRP */
2131void musb_g_wakeup(struct musb *musb)
2132{
2133	musb_gadget_wakeup(&musb->g);
2134}
2135
2136/* called when VBUS drops below session threshold, and in other cases */
2137void musb_g_disconnect(struct musb *musb)
2138{
2139	void __iomem	*mregs = musb->mregs;
2140	u8	devctl = musb_readb(mregs, MUSB_DEVCTL);
2141
2142	dev_dbg(musb->controller, "devctl %02x\n", devctl);
2143
2144	/* clear HR */
2145	musb_writeb(mregs, MUSB_DEVCTL, devctl & MUSB_DEVCTL_SESSION);
2146
2147	/* don't draw vbus until new b-default session */
2148	(void) musb_gadget_vbus_draw(&musb->g, 0);
2149
2150	musb->g.speed = USB_SPEED_UNKNOWN;
2151	if (musb->gadget_driver && musb->gadget_driver->disconnect) {
2152		spin_unlock(&musb->lock);
2153		musb->gadget_driver->disconnect(&musb->g);
2154		spin_lock(&musb->lock);
2155	}
2156
2157	switch (musb->xceiv->state) {
2158	default:
2159		dev_dbg(musb->controller, "Unhandled disconnect %s, setting a_idle\n",
2160			otg_state_string(musb->xceiv->state));
2161		musb->xceiv->state = OTG_STATE_A_IDLE;
2162		MUSB_HST_MODE(musb);
2163		break;
2164	case OTG_STATE_A_PERIPHERAL:
2165		musb->xceiv->state = OTG_STATE_A_WAIT_BCON;
2166		MUSB_HST_MODE(musb);
2167		break;
2168	case OTG_STATE_B_WAIT_ACON:
2169	case OTG_STATE_B_HOST:
2170	case OTG_STATE_B_PERIPHERAL:
2171	case OTG_STATE_B_IDLE:
2172		musb->xceiv->state = OTG_STATE_B_IDLE;
2173		break;
2174	case OTG_STATE_B_SRP_INIT:
2175		break;
2176	}
2177
2178	musb->is_active = 0;
2179}
2180
2181void musb_g_reset(struct musb *musb)
2182__releases(musb->lock)
2183__acquires(musb->lock)
2184{
2185	void __iomem	*mbase = musb->mregs;
2186	u8		devctl = musb_readb(mbase, MUSB_DEVCTL);
2187	u8		power;
2188
2189	dev_dbg(musb->controller, "<== %s addr=%x driver '%s'\n",
2190			(devctl & MUSB_DEVCTL_BDEVICE)
2191				? "B-Device" : "A-Device",
2192			musb_readb(mbase, MUSB_FADDR),
2193			musb->gadget_driver
2194				? musb->gadget_driver->driver.name
2195				: NULL
2196			);
2197
2198	/* report disconnect, if we didn't already (flushing EP state) */
2199	if (musb->g.speed != USB_SPEED_UNKNOWN)
2200		musb_g_disconnect(musb);
2201
2202	/* clear HR */
2203	else if (devctl & MUSB_DEVCTL_HR)
2204		musb_writeb(mbase, MUSB_DEVCTL, MUSB_DEVCTL_SESSION);
2205
2206
2207	/* what speed did we negotiate? */
2208	power = musb_readb(mbase, MUSB_POWER);
2209	musb->g.speed = (power & MUSB_POWER_HSMODE)
2210			? USB_SPEED_HIGH : USB_SPEED_FULL;
2211
2212	/* start in USB_STATE_DEFAULT */
2213	musb->is_active = 1;
2214	musb->is_suspended = 0;
2215	MUSB_DEV_MODE(musb);
2216	musb->address = 0;
2217	musb->ep0_state = MUSB_EP0_STAGE_SETUP;
2218
2219	musb->may_wakeup = 0;
2220	musb->g.b_hnp_enable = 0;
2221	musb->g.a_alt_hnp_support = 0;
2222	musb->g.a_hnp_support = 0;
2223
2224	/* Normal reset, as B-Device;
2225	 * or else after HNP, as A-Device
2226	 */
2227	if (devctl & MUSB_DEVCTL_BDEVICE) {
2228		musb->xceiv->state = OTG_STATE_B_PERIPHERAL;
2229		musb->g.is_a_peripheral = 0;
2230	} else if (is_otg_enabled(musb)) {
2231		musb->xceiv->state = OTG_STATE_A_PERIPHERAL;
2232		musb->g.is_a_peripheral = 1;
2233	} else
2234		WARN_ON(1);
2235
2236	/* start with default limits on VBUS power draw */
2237	(void) musb_gadget_vbus_draw(&musb->g,
2238			is_otg_enabled(musb) ? 8 : 100);
2239}
2240