drivers/usb/gadget/udc/bdc/bdc_ep.c

   1 /*
   2  * bdc_ep.c - BRCM BDC USB3.0 device controller endpoint related functions
   3  *
   4  * Copyright (C) 2014 Broadcom Corporation
   5  *
   6  * Author: Ashwini Pahuja
   7  *
   8  * Based on drivers under drivers/usb/
   9  *
  10  * This program is free software; you can redistribute it and/or modify it
  11  * under the terms of the GNU General Public License as published by the
  12  * Free Software Foundation; either version 2 of the License, or (at your
  13  * option) any later version.
  14  *
  15  */
  16 #include <linux/module.h>
  17 #include <linux/pci.h>
  18 #include <linux/dma-mapping.h>
  19 #include <linux/kernel.h>
  20 #include <linux/delay.h>
  21 #include <linux/dmapool.h>
  22 #include <linux/ioport.h>
  23 #include <linux/sched.h>
  24 #include <linux/slab.h>
  25 #include <linux/errno.h>
  26 #include <linux/init.h>
  27 #include <linux/timer.h>
  28 #include <linux/list.h>
  29 #include <linux/interrupt.h>
  30 #include <linux/moduleparam.h>
  31 #include <linux/device.h>
  32 #include <linux/usb/ch9.h>
  33 #include <linux/usb/gadget.h>
  34 #include <linux/usb/otg.h>
  35 #include <linux/pm.h>
  36 #include <linux/io.h>
  37 #include <linux/irq.h>
  38 #include <asm/unaligned.h>
  39 #include <linux/platform_device.h>
  40 #include <linux/usb/composite.h>
  41
  42 #include "bdc.h"
  43 #include "bdc_ep.h"
  44 #include "bdc_cmd.h"
  45 #include "bdc_dbg.h"
  46
  47 static const char * const ep0_state_string[] =  {
  48         "WAIT_FOR_SETUP",
  49         "WAIT_FOR_DATA_START",
  50         "WAIT_FOR_DATA_XMIT",
  51         "WAIT_FOR_STATUS_START",
  52         "WAIT_FOR_STATUS_XMIT",
  53         "STATUS_PENDING"
  54 };
  55
  56 /* Free the bdl during ep disable */
  57 static void ep_bd_list_free(struct bdc_ep *ep, u32 num_tabs)
  58 {
  59         struct bd_list *bd_list = &ep->bd_list;
  60         struct bdc *bdc = ep->bdc;
  61         struct bd_table *bd_table;
  62         int index;
  63
  64         dev_dbg(bdc->dev, "%s ep:%s num_tabs:%d\n",
  65                                  __func__, ep->name, num_tabs);
  66
  67         if (!bd_list->bd_table_array) {
  68                 dev_dbg(bdc->dev, "%s already freed\n", ep->name);
  69                 return;
  70         }
  71         for (index = 0; index < num_tabs; index++) {
  72                 /*
  73                  * check if the bd_table struct is allocated ?
  74                  * if yes, then check if bd memory has been allocated, then
  75                  * free the dma_pool and also the bd_table struct memory
  76                 */
  77                 bd_table = bd_list->bd_table_array[index];
  78                 dev_dbg(bdc->dev, "bd_table:%p index:%d\n", bd_table, index);
  79                 if (!bd_table) {
  80                         dev_dbg(bdc->dev, "bd_table not allocated\n");
  81                         continue;
  82                 }
  83                 if (!bd_table->start_bd) {
  84                         dev_dbg(bdc->dev, "bd dma pool not allocted\n");
  85                         continue;
  86                 }
  87
  88                 dev_dbg(bdc->dev,
  89                                 "Free dma pool start_bd:%p dma:%llx\n",
  90                                 bd_table->start_bd,
  91                                 (unsigned long long)bd_table->dma);
  92
  93                 dma_pool_free(bdc->bd_table_pool,
  94                                 bd_table->start_bd,
  95                                 bd_table->dma);
  96                 /* Free the bd_table structure */
  97                 kfree(bd_table);
  98         }
  99         /* Free the bd table array */
 100         kfree(ep->bd_list.bd_table_array);
 101 }
 102
 103 /*
 104  * chain the tables, by insteting a chain bd at the end of prev_table, pointing
 105  * to next_table
 106  */
 107 static inline void chain_table(struct bd_table *prev_table,
 108                                         struct bd_table *next_table,
 109                                         u32 bd_p_tab)
 110 {
 111         /* Chain the prev table to next table */
 112         prev_table->start_bd[bd_p_tab-1].offset[0] =
 113                                 cpu_to_le32(lower_32_bits(next_table->dma));
 114
 115         prev_table->start_bd[bd_p_tab-1].offset[1] =
 116                                 cpu_to_le32(upper_32_bits(next_table->dma));
 117
 118         prev_table->start_bd[bd_p_tab-1].offset[2] =
 119                                 0x0;
 120
 121         prev_table->start_bd[bd_p_tab-1].offset[3] =
 122                                 cpu_to_le32(MARK_CHAIN_BD);
 123 }
 124
 125 /* Allocate the bdl for ep, during config ep */
 126 static int ep_bd_list_alloc(struct bdc_ep *ep)
 127 {
 128         struct bd_table *prev_table = NULL;
 129         int index, num_tabs, bd_p_tab;
 130         struct bdc *bdc = ep->bdc;
 131         struct bd_table *bd_table;
 132         dma_addr_t dma;
 133
 134         if (usb_endpoint_xfer_isoc(ep->desc))
 135                 num_tabs = NUM_TABLES_ISOCH;
 136         else
 137                 num_tabs = NUM_TABLES;
 138
 139         bd_p_tab = NUM_BDS_PER_TABLE;
 140         /* if there is only 1 table in bd list then loop chain to self */
 141         dev_dbg(bdc->dev,
 142                 "%s ep:%p num_tabs:%d\n",
 143                 __func__, ep, num_tabs);
 144
 145         /* Allocate memory for table array */
 146         ep->bd_list.bd_table_array = kzalloc(
 147                                         num_tabs * sizeof(struct bd_table *),
 148                                         GFP_ATOMIC);
 149         if (!ep->bd_list.bd_table_array)
 150                 return -ENOMEM;
 151
 152         /* Allocate memory for each table */
 153         for (index = 0; index < num_tabs; index++) {
 154                 /* Allocate memory for bd_table structure */
 155                 bd_table = kzalloc(sizeof(struct bd_table), GFP_ATOMIC);
 156                 if (!bd_table)
 157                         goto fail;
 158
 159                 bd_table->start_bd = dma_pool_alloc(bdc->bd_table_pool,
 160                                                         GFP_ATOMIC,
 161                                                         &dma);
 162                 if (!bd_table->start_bd) {
 163                         kfree(bd_table);
 164                         goto fail;
 165                 }
 166
 167                 bd_table->dma = dma;
 168
 169                 dev_dbg(bdc->dev,
 170                         "index:%d start_bd:%p dma=%08llx prev_table:%p\n",
 171                         index, bd_table->start_bd,
 172                         (unsigned long long)bd_table->dma, prev_table);
 173
 174                 ep->bd_list.bd_table_array[index] = bd_table;
 175                 memset(bd_table->start_bd, 0, bd_p_tab * sizeof(struct bdc_bd));
 176                 if (prev_table)
 177                         chain_table(prev_table, bd_table, bd_p_tab);
 178
 179                 prev_table = bd_table;
 180         }
 181         chain_table(prev_table, ep->bd_list.bd_table_array[0], bd_p_tab);
 182         /* Memory allocation is successful, now init the internal fields */
 183         ep->bd_list.num_tabs = num_tabs;
 184         ep->bd_list.max_bdi  = (num_tabs * bd_p_tab) - 1;
 185         ep->bd_list.num_tabs = num_tabs;
 186         ep->bd_list.num_bds_table = bd_p_tab;
 187         ep->bd_list.eqp_bdi = 0;
 188         ep->bd_list.hwd_bdi = 0;
 189
 190         return 0;
 191 fail:
 192         /* Free the bd_table_array, bd_table struct, bd's */
 193         ep_bd_list_free(ep, num_tabs);
 194
 195         return -ENOMEM;
 196 }
 197
 198 /* returns how many bd's are need for this transfer */
 199 static inline int bd_needed_req(struct bdc_req *req)
 200 {
 201         int bd_needed = 0;
 202         int remaining;
 203
 204         /* 1 bd needed for 0 byte transfer */
 205         if (req->usb_req.length == 0)
 206                 return 1;
 207
 208         /* remaining bytes after tranfering all max BD size BD's */
 209         remaining = req->usb_req.length % BD_MAX_BUFF_SIZE;
 210         if (remaining)
 211                 bd_needed++;
 212
 213         /* How many maximum BUFF size BD's ? */
 214         remaining = req->usb_req.length / BD_MAX_BUFF_SIZE;
 215         bd_needed += remaining;
 216
 217         return bd_needed;
 218 }
 219
 220 /* returns the bd index(bdi) corresponding to bd dma address */
 221 static int bd_add_to_bdi(struct bdc_ep *ep, dma_addr_t bd_dma_addr)
 222 {
 223         struct bd_list *bd_list = &ep->bd_list;
 224         dma_addr_t dma_first_bd, dma_last_bd;
 225         struct bdc *bdc = ep->bdc;
 226         struct bd_table *bd_table;
 227         bool found = false;
 228         int tbi, bdi;
 229
 230         dma_first_bd = dma_last_bd = 0;
 231         dev_dbg(bdc->dev, "%s  %llx\n",
 232                         __func__, (unsigned long long)bd_dma_addr);
 233         /*
 234          * Find in which table this bd_dma_addr belongs?, go through the table
 235          * array and compare addresses of first and last address of bd of each
 236          * table
 237          */
 238         for (tbi = 0; tbi < bd_list->num_tabs; tbi++) {
 239                 bd_table = bd_list->bd_table_array[tbi];
 240                 dma_first_bd = bd_table->dma;
 241                 dma_last_bd = bd_table->dma +
 242                                         (sizeof(struct bdc_bd) *
 243                                         (bd_list->num_bds_table - 1));
 244                 dev_dbg(bdc->dev, "dma_first_bd:%llx dma_last_bd:%llx\n",
 245                                         (unsigned long long)dma_first_bd,
 246                                         (unsigned long long)dma_last_bd);
 247                 if (bd_dma_addr >= dma_first_bd && bd_dma_addr <= dma_last_bd) {
 248                         found = true;
 249                         break;
 250                 }
 251         }
 252         if (unlikely(!found)) {
 253                 dev_err(bdc->dev, "%s FATAL err, bd not found\n", __func__);
 254                 return -EINVAL;
 255         }
 256         /* Now we know the table, find the bdi */
 257         bdi = (bd_dma_addr - dma_first_bd) / sizeof(struct bdc_bd);
 258
 259         /* return the global bdi, to compare with ep eqp_bdi */
 260         return (bdi + (tbi * bd_list->num_bds_table));
 261 }
 262
 263 /* returns the table index(tbi) of the given bdi */
 264 static int bdi_to_tbi(struct bdc_ep *ep, int bdi)
 265 {
 266         int tbi;
 267
 268         tbi = bdi / ep->bd_list.num_bds_table;
 269         dev_vdbg(ep->bdc->dev,
 270                 "bdi:%d num_bds_table:%d tbi:%d\n",
 271                 bdi, ep->bd_list.num_bds_table, tbi);
 272
 273         return tbi;
 274 }
 275
 276 /* Find the bdi last bd in the transfer */
 277 static inline int find_end_bdi(struct bdc_ep *ep, int next_hwd_bdi)
 278 {
 279         int end_bdi;
 280
 281         end_bdi = next_hwd_bdi - 1;
 282         if (end_bdi < 0)
 283                 end_bdi = ep->bd_list.max_bdi - 1;
 284          else if ((end_bdi % (ep->bd_list.num_bds_table-1)) == 0)
 285                 end_bdi--;
 286
 287         return end_bdi;
 288 }
 289
 290 /*
 291  * How many transfer bd's are available on this ep bdl, chain bds are not
 292  * counted in available bds
 293  */
 294 static int bd_available_ep(struct bdc_ep *ep)
 295 {
 296         struct bd_list *bd_list = &ep->bd_list;
 297         int available1, available2;
 298         struct bdc *bdc = ep->bdc;
 299         int chain_bd1, chain_bd2;
 300         int available_bd = 0;
 301
 302         available1 = available2 = chain_bd1 = chain_bd2 = 0;
 303         /* if empty then we have all bd's available - number of chain bd's */
 304         if (bd_list->eqp_bdi == bd_list->hwd_bdi)
 305                 return bd_list->max_bdi - bd_list->num_tabs;
 306
 307         /*
 308          * Depending upon where eqp and dqp pointers are, caculate number
 309          * of avaialble bd's
 310          */
 311         if (bd_list->hwd_bdi < bd_list->eqp_bdi) {
 312                 /* available bd's are from eqp..max_bds + 0..dqp - chain_bds */
 313                 available1 = bd_list->max_bdi - bd_list->eqp_bdi;
 314                 available2 = bd_list->hwd_bdi;
 315                 chain_bd1 = available1 / bd_list->num_bds_table;
 316                 chain_bd2 = available2 / bd_list->num_bds_table;
 317                 dev_vdbg(bdc->dev, "chain_bd1:%d chain_bd2:%d\n",
 318                                                 chain_bd1, chain_bd2);
 319                 available_bd = available1 + available2 - chain_bd1 - chain_bd2;
 320         } else {
 321                 /* available bd's are from eqp..dqp - number of chain bd's */
 322                 available1 = bd_list->hwd_bdi -  bd_list->eqp_bdi;
 323                 /* if gap between eqp and dqp is less than NUM_BDS_PER_TABLE */
 324                 if ((bd_list->hwd_bdi - bd_list->eqp_bdi)
 325                                         <= bd_list->num_bds_table) {
 326                         /* If there any chain bd in between */
 327                         if (!(bdi_to_tbi(ep, bd_list->hwd_bdi)
 328                                         == bdi_to_tbi(ep, bd_list->eqp_bdi))) {
 329                                 available_bd = available1 - 1;
 330                         }
 331                 } else {
 332                         chain_bd1 = available1 / bd_list->num_bds_table;
 333                         available_bd = available1 - chain_bd1;
 334                 }
 335         }
 336         /*
 337          * we need to keep one extra bd to check if ring is full or empty so
 338          * reduce by 1
 339          */
 340         available_bd--;
 341         dev_vdbg(bdc->dev, "available_bd:%d\n", available_bd);
 342
 343         return available_bd;
 344 }
 345
 346 /* Notify the hardware after queueing the bd to bdl */
 347 void bdc_notify_xfr(struct bdc *bdc, u32 epnum)
 348 {
 349         struct bdc_ep *ep = bdc->bdc_ep_array[epnum];
 350
 351         dev_vdbg(bdc->dev, "%s epnum:%d\n", __func__, epnum);
 352         /*
 353          * We don't have anyway to check if ep state is running,
 354          * except the software flags.
 355          */
 356         if (unlikely(ep->flags & BDC_EP_STOP))
 357                 ep->flags &= ~BDC_EP_STOP;
 358
 359         bdc_writel(bdc->regs, BDC_XSFNTF, epnum);
 360 }
 361
 362 /* returns the bd corresponding to bdi */
 363 static struct bdc_bd *bdi_to_bd(struct bdc_ep *ep, int bdi)
 364 {
 365         int tbi = bdi_to_tbi(ep, bdi);
 366         int local_bdi = 0;
 367
 368         local_bdi = bdi - (tbi * ep->bd_list.num_bds_table);
 369         dev_vdbg(ep->bdc->dev,
 370                 "%s bdi:%d local_bdi:%d\n",
 371                  __func__, bdi, local_bdi);
 372
 373         return (ep->bd_list.bd_table_array[tbi]->start_bd + local_bdi);
 374 }
 375
 376 /* Advance the enqueue pointer */
 377 static void ep_bdlist_eqp_adv(struct bdc_ep *ep)
 378 {
 379         ep->bd_list.eqp_bdi++;
 380         /* if it's chain bd, then move to next */
 381         if (((ep->bd_list.eqp_bdi + 1) % ep->bd_list.num_bds_table) == 0)
 382                 ep->bd_list.eqp_bdi++;
 383
 384         /* if the eqp is pointing to last + 1 then move back to 0 */
 385         if (ep->bd_list.eqp_bdi == (ep->bd_list.max_bdi + 1))
 386                 ep->bd_list.eqp_bdi = 0;
 387 }
 388
 389 /* Setup the first bd for ep0 transfer */
 390 static int setup_first_bd_ep0(struct bdc *bdc, struct bdc_req *req, u32 *dword3)
 391 {
 392         u16 wValue;
 393         u32 req_len;
 394
 395         req->ep->dir = 0;
 396         req_len = req->usb_req.length;
 397         switch (bdc->ep0_state) {
 398         case WAIT_FOR_DATA_START:
 399                 *dword3 |= BD_TYPE_DS;
 400                 if (bdc->setup_pkt.bRequestType & USB_DIR_IN)
 401                         *dword3 |= BD_DIR_IN;
 402
 403                 /* check if zlp will be needed */
 404                 wValue = le16_to_cpu(bdc->setup_pkt.wValue);
 405                 if ((wValue > req_len) &&
 406                                 (req_len % bdc->gadget.ep0->maxpacket == 0)) {
 407                         dev_dbg(bdc->dev, "ZLP needed wVal:%d len:%d MaxP:%d\n",
 408                                         wValue, req_len,
 409                                         bdc->gadget.ep0->maxpacket);
 410                         bdc->zlp_needed = true;
 411                 }
 412                 break;
 413
 414         case WAIT_FOR_STATUS_START:
 415                 *dword3 |= BD_TYPE_SS;
 416                 if (!le16_to_cpu(bdc->setup_pkt.wLength) ||
 417                                 !(bdc->setup_pkt.bRequestType & USB_DIR_IN))
 418                         *dword3 |= BD_DIR_IN;
 419                 break;
 420         default:
 421                 dev_err(bdc->dev,
 422                         "Unknown ep0 state for queueing bd ep0_state:%s\n",
 423                         ep0_state_string[bdc->ep0_state]);
 424                 return -EINVAL;
 425         }
 426
 427         return 0;
 428 }
 429
 430 /* Setup the bd dma descriptor for a given request */
 431 static int setup_bd_list_xfr(struct bdc *bdc, struct bdc_req *req, int num_bds)
 432 {
 433         dma_addr_t buf_add = req->usb_req.dma;
 434         u32 maxp, tfs, dword2, dword3;
 435         struct bd_transfer *bd_xfr;
 436         struct bd_list *bd_list;
 437         struct bdc_ep *ep;
 438         struct bdc_bd *bd;
 439         int ret, bdnum;
 440         u32 req_len;
 441
 442         ep = req->ep;
 443         bd_list = &ep->bd_list;
 444         bd_xfr = &req->bd_xfr;
 445         bd_xfr->req = req;
 446         bd_xfr->start_bdi = bd_list->eqp_bdi;
 447         bd = bdi_to_bd(ep, bd_list->eqp_bdi);
 448         req_len = req->usb_req.length;
 449         maxp = usb_endpoint_maxp(ep->desc) & 0x7ff;
 450         tfs = roundup(req->usb_req.length, maxp);
 451         tfs = tfs/maxp;
 452         dev_vdbg(bdc->dev, "%s ep:%s num_bds:%d tfs:%d r_len:%d bd:%p\n",
 453                                 __func__, ep->name, num_bds, tfs, req_len, bd);
 454
 455         for (bdnum = 0; bdnum < num_bds; bdnum++) {
 456                 dword2 = dword3 = 0;
 457                 /* First bd */
 458                 if (!bdnum) {
 459                         dword3 |= BD_SOT|BD_SBF|(tfs<<BD_TFS_SHIFT);
 460                         dword2 |= BD_LTF;
 461                         /* format of first bd for ep0 is different than other */
 462                         if (ep->ep_num == 1) {
 463                                 ret = setup_first_bd_ep0(bdc, req, &dword3);
 464                                 if (ret)
 465                                         return ret;
 466                         }
 467                 }
 468                 if (!req->ep->dir)
 469                         dword3 |= BD_ISP;
 470
 471                 if (req_len > BD_MAX_BUFF_SIZE) {
 472                         dword2 |= BD_MAX_BUFF_SIZE;
 473                         req_len -= BD_MAX_BUFF_SIZE;
 474                 } else {
 475                         /* this should be the last bd */
 476                         dword2 |= req_len;
 477                         dword3 |= BD_IOC;
 478                         dword3 |= BD_EOT;
 479                 }
 480                 /* Currently only 1 INT target is supported */
 481                 dword2 |= BD_INTR_TARGET(0);
 482                 bd = bdi_to_bd(ep, ep->bd_list.eqp_bdi);
 483                 if (unlikely(!bd)) {
 484                         dev_err(bdc->dev, "Err bd pointing to wrong addr\n");
 485                         return -EINVAL;
 486                 }
 487                 /* write bd */
 488                 bd->offset[0] = cpu_to_le32(lower_32_bits(buf_add));
 489                 bd->offset[1] = cpu_to_le32(upper_32_bits(buf_add));
 490                 bd->offset[2] = cpu_to_le32(dword2);
 491                 bd->offset[3] = cpu_to_le32(dword3);
 492                 /* advance eqp pointer */
 493                 ep_bdlist_eqp_adv(ep);
 494                 /* advance the buff pointer */
 495                 buf_add += BD_MAX_BUFF_SIZE;
 496                 dev_vdbg(bdc->dev, "buf_add:%08llx req_len:%d bd:%p eqp:%d\n",
 497                                 (unsigned long long)buf_add, req_len, bd,
 498                                                         ep->bd_list.eqp_bdi);
 499                 bd = bdi_to_bd(ep, ep->bd_list.eqp_bdi);
 500                 bd->offset[3] = cpu_to_le32(BD_SBF);
 501         }
 502         /* clear the STOP BD fetch bit from the first bd of this xfr */
 503         bd = bdi_to_bd(ep, bd_xfr->start_bdi);
 504         bd->offset[3] &= cpu_to_le32(~BD_SBF);
 505         /* the new eqp will be next hw dqp */
 506         bd_xfr->num_bds  = num_bds;
 507         bd_xfr->next_hwd_bdi = ep->bd_list.eqp_bdi;
 508         /* everything is written correctly before notifying the HW */
 509         wmb();
 510
 511         return 0;
 512 }
 513
 514 /* Queue the xfr */
 515 static int bdc_queue_xfr(struct bdc *bdc, struct bdc_req *req)
 516 {
 517         int num_bds, bd_available;
 518         struct bdc_ep *ep;
 519         int ret;
 520
 521         ep = req->ep;
 522         dev_dbg(bdc->dev, "%s req:%p\n", __func__, req);
 523         dev_dbg(bdc->dev, "eqp_bdi:%d hwd_bdi:%d\n",
 524                         ep->bd_list.eqp_bdi, ep->bd_list.hwd_bdi);
 525
 526         num_bds =  bd_needed_req(req);
 527         bd_available = bd_available_ep(ep);
 528
 529         /* how many bd's are avaialble on ep */
 530         if (num_bds > bd_available)
 531                 return -ENOMEM;
 532
 533         ret = setup_bd_list_xfr(bdc, req, num_bds);
 534         if (ret)
 535                 return ret;
 536         list_add_tail(&req->queue, &ep->queue);
 537         bdc_dbg_bd_list(bdc, ep);
 538         bdc_notify_xfr(bdc, ep->ep_num);
 539
 540         return 0;
 541 }
 542
 543 /* callback to gadget layer when xfr completes */
 544 static void bdc_req_complete(struct bdc_ep *ep, struct bdc_req *req,
 545                                                 int status)
 546 {
 547         struct bdc *bdc = ep->bdc;
 548
 549         if (req == NULL)
 550                 return;
 551
 552         dev_dbg(bdc->dev, "%s ep:%s status:%d\n", __func__, ep->name, status);
 553         list_del(&req->queue);
 554         req->usb_req.status = status;
 555         usb_gadget_unmap_request(&bdc->gadget, &req->usb_req, ep->dir);
 556         if (req->usb_req.complete) {
 557                 spin_unlock(&bdc->lock);
 558                 usb_gadget_giveback_request(&ep->usb_ep, &req->usb_req);
 559                 spin_lock(&bdc->lock);
 560         }
 561 }
 562
 563 /* Disable the endpoint */
 564 int bdc_ep_disable(struct bdc_ep *ep)
 565 {
 566         struct bdc_req *req;
 567         struct bdc *bdc;
 568         int ret;
 569
 570         ret = 0;
 571         bdc = ep->bdc;
 572         dev_dbg(bdc->dev, "%s() ep->ep_num=%d\n", __func__, ep->ep_num);
 573         /* Stop the endpoint */
 574         ret = bdc_stop_ep(bdc, ep->ep_num);
 575
 576         /*
 577          * Intentionally don't check the ret value of stop, it can fail in
 578          * disconnect scenarios, continue with dconfig
 579          */
 580         /* de-queue any pending requests */
 581         while (!list_empty(&ep->queue)) {
 582                 req = list_entry(ep->queue.next, struct bdc_req,
 583                                 queue);
 584                 bdc_req_complete(ep, req, -ESHUTDOWN);
 585         }
 586         /* deconfigure the endpoint */
 587         ret = bdc_dconfig_ep(bdc, ep);
 588         if (ret)
 589                 dev_warn(bdc->dev,
 590                         "dconfig fail but continue with memory free");
 591
 592         ep->flags = 0;
 593         /* ep0 memory is not freed, but reused on next connect sr */
 594         if (ep->ep_num == 1)
 595                 return 0;
 596
 597         /* Free the bdl memory */
 598         ep_bd_list_free(ep, ep->bd_list.num_tabs);
 599         ep->desc = NULL;
 600         ep->comp_desc = NULL;
 601         ep->usb_ep.desc = NULL;
 602         ep->ep_type = 0;
 603
 604         return ret;
 605 }
 606
 607 /* Enable the ep */
 608 int bdc_ep_enable(struct bdc_ep *ep)
 609 {
 610         struct bdc *bdc;
 611         int ret = 0;
 612
 613         bdc = ep->bdc;
 614         dev_dbg(bdc->dev, "%s NUM_TABLES:%d %d\n",
 615                                         __func__, NUM_TABLES, NUM_TABLES_ISOCH);
 616
 617         ret = ep_bd_list_alloc(ep);
 618         if (ret) {
 619                 dev_err(bdc->dev, "ep bd list allocation failed:%d\n", ret);
 620                 return -ENOMEM;
 621         }
 622         bdc_dbg_bd_list(bdc, ep);
 623         /* only for ep0: config ep is called for ep0 from connect event */
 624         if (ep->ep_num == 1)
 625                 return ret;
 626
 627         /* Issue a configure endpoint command */
 628         ret = bdc_config_ep(bdc, ep);
 629         if (ret)
 630                 return ret;
 631
 632         ep->usb_ep.maxpacket = usb_endpoint_maxp(ep->desc);
 633         ep->usb_ep.desc = ep->desc;
 634         ep->usb_ep.comp_desc = ep->comp_desc;
 635         ep->ep_type = usb_endpoint_type(ep->desc);
 636         ep->flags |= BDC_EP_ENABLED;
 637
 638         return 0;
 639 }
 640
 641 /* EP0 related code */
 642
 643 /* Queue a status stage BD */
 644 static int ep0_queue_status_stage(struct bdc *bdc)
 645 {
 646         struct bdc_req *status_req;
 647         struct bdc_ep *ep;
 648
 649         status_req = &bdc->status_req;
 650         ep = bdc->bdc_ep_array[1];
 651         status_req->ep = ep;
 652         status_req->usb_req.length = 0;
 653         status_req->usb_req.status = -EINPROGRESS;
 654         status_req->usb_req.actual = 0;
 655         status_req->usb_req.complete = NULL;
 656         bdc_queue_xfr(bdc, status_req);
 657
 658         return 0;
 659 }
 660
 661 /* Queue xfr on ep0 */
 662 static int ep0_queue(struct bdc_ep *ep, struct bdc_req *req)
 663 {
 664         struct bdc *bdc;
 665         int ret;
 666
 667         bdc = ep->bdc;
 668         dev_dbg(bdc->dev, "%s()\n", __func__);
 669         req->usb_req.actual = 0;
 670         req->usb_req.status = -EINPROGRESS;
 671         req->epnum = ep->ep_num;
 672
 673         if (bdc->delayed_status) {
 674                 bdc->delayed_status = false;
 675                 /* if status stage was delayed? */
 676                 if (bdc->ep0_state == WAIT_FOR_STATUS_START) {
 677                         /* Queue a status stage BD */
 678                         ep0_queue_status_stage(bdc);
 679                         bdc->ep0_state = WAIT_FOR_STATUS_XMIT;
 680                         return 0;
 681                 }
 682         } else {
 683                 /*
 684                  * if delayed status is false and 0 length transfer is requested
 685                  * i.e. for status stage of some setup request, then just
 686                  * return from here the status stage is queued independently
 687                  */
 688                 if (req->usb_req.length == 0)
 689                         return 0;
 690
 691         }
 692         ret = usb_gadget_map_request(&bdc->gadget, &req->usb_req, ep->dir);
 693         if (ret) {
 694                 dev_err(bdc->dev, "dma mapping failed %s\n", ep->name);
 695                 return ret;
 696         }
 697
 698         return bdc_queue_xfr(bdc, req);
 699 }
 700
 701 /* Queue data stage */
 702 static int ep0_queue_data_stage(struct bdc *bdc)
 703 {
 704         struct usb_request *ep0_usb_req;
 705         struct bdc_ep *ep;
 706
 707         dev_dbg(bdc->dev, "%s\n", __func__);
 708         ep0_usb_req = &bdc->ep0_req.usb_req;
 709         ep = bdc->bdc_ep_array[1];
 710         bdc->ep0_req.ep = ep;
 711         bdc->ep0_req.usb_req.complete = NULL;
 712
 713         return ep0_queue(ep, &bdc->ep0_req);
 714 }
 715
 716 /* Queue req on ep */
 717 static int ep_queue(struct bdc_ep *ep, struct bdc_req *req)
 718 {
 719         struct bdc *bdc;
 720         int ret = 0;
 721
 722         if (!req || !ep->usb_ep.desc)
 723                 return -EINVAL;
 724
 725         bdc = ep->bdc;
 726
 727         req->usb_req.actual = 0;
 728         req->usb_req.status = -EINPROGRESS;
 729         req->epnum = ep->ep_num;
 730
 731         ret = usb_gadget_map_request(&bdc->gadget, &req->usb_req, ep->dir);
 732         if (ret) {
 733                 dev_err(bdc->dev, "dma mapping failed\n");
 734                 return ret;
 735         }
 736
 737         return bdc_queue_xfr(bdc, req);
 738 }
 739
 740 /* Dequeue a request from ep */
 741 static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req)
 742 {
 743         int start_bdi, end_bdi, tbi, eqp_bdi, curr_hw_dqpi;
 744         bool start_pending, end_pending;
 745         bool first_remove = false;
 746         struct bdc_req *first_req;
 747         struct bdc_bd *bd_start;
 748         struct bd_table *table;
 749         dma_addr_t next_bd_dma;
 750         u64   deq_ptr_64 = 0;
 751         struct bdc  *bdc;
 752         u32    tmp_32;
 753         int ret;
 754
 755         bdc = ep->bdc;
 756         start_pending = end_pending = false;
 757         eqp_bdi = ep->bd_list.eqp_bdi - 1;
 758
 759         if (eqp_bdi < 0)
 760                 eqp_bdi = ep->bd_list.max_bdi;
 761
 762         start_bdi = req->bd_xfr.start_bdi;
 763         end_bdi = find_end_bdi(ep, req->bd_xfr.next_hwd_bdi);
 764
 765         dev_dbg(bdc->dev, "%s ep:%s start:%d end:%d\n",
 766                                         __func__, ep->name, start_bdi, end_bdi);
 767         dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n",
 768                                                 ep, (void *)ep->usb_ep.desc);
 769         /* if still connected, stop the ep to see where the HW is ? */
 770         if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) {
 771                 ret = bdc_stop_ep(bdc, ep->ep_num);
 772                 /* if there is an issue, then no need to go further */
 773                 if (ret)
 774                         return 0;
 775         } else
 776                 return 0;
 777
 778         /*
 779          * After endpoint is stopped, there can be 3 cases, the request
 780          * is processed, pending or in the middle of processing
 781          */
 782
 783         /* The current hw dequeue pointer */
 784         tmp_32 = bdc_readl(bdc->regs, BDC_EPSTS0(0));
 785         deq_ptr_64 = tmp_32;
 786         tmp_32 = bdc_readl(bdc->regs, BDC_EPSTS1(0));
 787         deq_ptr_64 |= ((u64)tmp_32 << 32);
 788
 789         /* we have the dma addr of next bd that will be fetched by hardware */
 790         curr_hw_dqpi = bd_add_to_bdi(ep, deq_ptr_64);
 791         if (curr_hw_dqpi < 0)
 792                 return curr_hw_dqpi;
 793
 794         /*
 795          * curr_hw_dqpi points to actual dqp of HW and HW owns bd's from
 796          * curr_hw_dqbdi..eqp_bdi.
 797          */
 798
 799         /* Check if start_bdi and end_bdi are in range of HW owned BD's */
 800         if (curr_hw_dqpi > eqp_bdi) {
 801                 /* there is a wrap from last to 0 */
 802                 if (start_bdi >= curr_hw_dqpi || start_bdi <= eqp_bdi) {
 803                         start_pending = true;
 804                         end_pending = true;
 805                 } else if (end_bdi >= curr_hw_dqpi || end_bdi <= eqp_bdi) {
 806                                 end_pending = true;
 807                 }
 808         } else {
 809                 if (start_bdi >= curr_hw_dqpi) {
 810                         start_pending = true;
 811                         end_pending = true;
 812                 } else if (end_bdi >= curr_hw_dqpi) {
 813                         end_pending = true;
 814                 }
 815         }
 816         dev_dbg(bdc->dev,
 817                 "start_pending:%d end_pending:%d speed:%d\n",
 818                 start_pending, end_pending, bdc->gadget.speed);
 819
 820         /* If both start till end are processes, we cannot deq req */
 821         if (!start_pending && !end_pending)
 822                 return -EINVAL;
 823
 824         /*
 825          * if ep_dequeue is called after disconnect then just return
 826          * success from here
 827          */
 828         if (bdc->gadget.speed == USB_SPEED_UNKNOWN)
 829                 return 0;
 830         tbi = bdi_to_tbi(ep, req->bd_xfr.next_hwd_bdi);
 831         table = ep->bd_list.bd_table_array[tbi];
 832         next_bd_dma =  table->dma +
 833                         sizeof(struct bdc_bd)*(req->bd_xfr.next_hwd_bdi -
 834                                         tbi * ep->bd_list.num_bds_table);
 835
 836         first_req = list_first_entry(&ep->queue, struct bdc_req,
 837                         queue);
 838
 839         if (req == first_req)
 840                 first_remove = true;
 841
 842         /*
 843          * Due to HW limitation we need to bypadd chain bd's and issue ep_bla,
 844          * incase if start is pending this is the first request in the list
 845          * then issue ep_bla instead of marking as chain bd
 846          */
 847         if (start_pending && !first_remove) {
 848                 /*
 849                  * Mark the start bd as Chain bd, and point the chain
 850                  * bd to next_bd_dma
 851                  */
 852                 bd_start = bdi_to_bd(ep, start_bdi);
 853                 bd_start->offset[0] = cpu_to_le32(lower_32_bits(next_bd_dma));
 854                 bd_start->offset[1] = cpu_to_le32(upper_32_bits(next_bd_dma));
 855                 bd_start->offset[2] = 0x0;
 856                 bd_start->offset[3] = cpu_to_le32(MARK_CHAIN_BD);
 857                 bdc_dbg_bd_list(bdc, ep);
 858         } else if (end_pending) {
 859                 /*
 860                  * The transfer is stopped in the middle, move the
 861                  * HW deq pointer to next_bd_dma
 862                  */
 863                 ret = bdc_ep_bla(bdc, ep, next_bd_dma);
 864                 if (ret) {
 865                         dev_err(bdc->dev, "error in ep_bla:%d\n", ret);
 866                         return ret;
 867                 }
 868         }
 869
 870         return 0;
 871 }
 872
 873 /* Halt/Clear the ep based on value */
 874 static int ep_set_halt(struct bdc_ep *ep, u32 value)
 875 {
 876         struct bdc *bdc;
 877         int ret;
 878
 879         bdc = ep->bdc;
 880         dev_dbg(bdc->dev, "%s ep:%s value=%d\n", __func__, ep->name, value);
 881
 882         if (value) {
 883                 dev_dbg(bdc->dev, "Halt\n");
 884                 if (ep->ep_num == 1)
 885                         bdc->ep0_state = WAIT_FOR_SETUP;
 886
 887                 ret = bdc_ep_set_stall(bdc, ep->ep_num);
 888                 if (ret)
 889                         dev_err(bdc->dev, "failed to set STALL on %s\n",
 890                                 ep->name);
 891                 else
 892                         ep->flags |= BDC_EP_STALL;
 893         } else {
 894                 /* Clear */
 895                 dev_dbg(bdc->dev, "Before Clear\n");
 896                 ret = bdc_ep_clear_stall(bdc, ep->ep_num);
 897                 if (ret)
 898                         dev_err(bdc->dev, "failed to clear STALL on %s\n",
 899                                 ep->name);
 900                 else
 901                         ep->flags &= ~BDC_EP_STALL;
 902                 dev_dbg(bdc->dev, "After  Clear\n");
 903         }
 904
 905         return ret;
 906 }
 907
 908 /* Free all the ep */
 909 void bdc_free_ep(struct bdc *bdc)
 910 {
 911         struct bdc_ep *ep;
 912         u8      epnum;
 913
 914         dev_dbg(bdc->dev, "%s\n", __func__);
 915         for (epnum = 1; epnum < bdc->num_eps; epnum++) {
 916                 ep = bdc->bdc_ep_array[epnum];
 917                 if (!ep)
 918                         continue;
 919
 920                 if (ep->flags & BDC_EP_ENABLED)
 921                         ep_bd_list_free(ep, ep->bd_list.num_tabs);
 922
 923                 /* ep0 is not in this gadget list */
 924                 if (epnum != 1)
 925                         list_del(&ep->usb_ep.ep_list);
 926
 927                 kfree(ep);
 928         }
 929 }
 930
 931 /* USB2 spec, section 7.1.20 */
 932 static int bdc_set_test_mode(struct bdc *bdc)
 933 {
 934         u32 usb2_pm;
 935
 936         usb2_pm = bdc_readl(bdc->regs, BDC_USPPM2);
 937         usb2_pm &= ~BDC_PTC_MASK;
 938         dev_dbg(bdc->dev, "%s\n", __func__);
 939         switch (bdc->test_mode) {
 940         case TEST_J:
 941         case TEST_K:
 942         case TEST_SE0_NAK:
 943         case TEST_PACKET:
 944         case TEST_FORCE_EN:
 945                 usb2_pm |= bdc->test_mode << 28;
 946                 break;
 947         default:
 948                 return -EINVAL;
 949         }
 950         dev_dbg(bdc->dev, "usb2_pm=%08x", usb2_pm);
 951         bdc_writel(bdc->regs, BDC_USPPM2, usb2_pm);
 952
 953         return 0;
 954 }
 955
 956 /*
 957  * Helper function to handle Transfer status report with status as either
 958  * success or short
 959  */
 960 static void handle_xsr_succ_status(struct bdc *bdc, struct bdc_ep *ep,
 961                                                         struct bdc_sr *sreport)
 962 {
 963         int short_bdi, start_bdi, end_bdi, max_len_bds, chain_bds;
 964         struct bd_list *bd_list = &ep->bd_list;
 965         int actual_length, length_short;
 966         struct bd_transfer *bd_xfr;
 967         struct bdc_bd *short_bd;
 968         struct bdc_req *req;
 969         u64   deq_ptr_64 = 0;
 970         int status = 0;
 971         int sr_status;
 972         u32    tmp_32;
 973
 974         dev_dbg(bdc->dev, "%s  ep:%p\n", __func__, ep);
 975         bdc_dbg_srr(bdc, 0);
 976         /* do not process thie sr if ignore flag is set */
 977         if (ep->ignore_next_sr) {
 978                 ep->ignore_next_sr = false;
 979                 return;
 980         }
 981
 982         if (unlikely(list_empty(&ep->queue))) {
 983                 dev_warn(bdc->dev, "xfr srr with no BD's queued\n");
 984                 return;
 985         }
 986         req = list_entry(ep->queue.next, struct bdc_req,
 987                         queue);
 988
 989         bd_xfr = &req->bd_xfr;
 990         sr_status = XSF_STS(le32_to_cpu(sreport->offset[3]));
 991
 992         /*
 993          * sr_status is short and this transfer has more than 1 bd then it needs
 994          * special handling,  this is only applicable for bulk and ctrl
 995          */
 996         if (sr_status == XSF_SHORT &&  bd_xfr->num_bds > 1) {
 997                 /*
 998                  * This is multi bd xfr, lets see which bd
 999                  * caused short transfer and how many bytes have been
1000                  * transferred so far.
1001                  */
1002                 tmp_32 = le32_to_cpu(sreport->offset[0]);
1003                 deq_ptr_64 = tmp_32;
1004                 tmp_32 = le32_to_cpu(sreport->offset[1]);
1005                 deq_ptr_64 |= ((u64)tmp_32 << 32);
1006                 short_bdi = bd_add_to_bdi(ep, deq_ptr_64);
1007                 if (unlikely(short_bdi < 0))
1008                         dev_warn(bdc->dev, "bd doesn't exist?\n");
1009
1010                 start_bdi =  bd_xfr->start_bdi;
1011                 /*
1012                  * We know the start_bdi and short_bdi, how many xfr
1013                  * bds in between
1014                  */
1015                 if (start_bdi <= short_bdi) {
1016                         max_len_bds = short_bdi - start_bdi;
1017                         if (max_len_bds <= bd_list->num_bds_table) {
1018                                 if (!(bdi_to_tbi(ep, start_bdi) ==
1019                                                 bdi_to_tbi(ep, short_bdi)))
1020                                         max_len_bds--;
1021                         } else {
1022                                 chain_bds = max_len_bds/bd_list->num_bds_table;
1023                                 max_len_bds -= chain_bds;
1024                         }
1025                 } else {
1026                         /* there is a wrap in the ring within a xfr */
1027                         chain_bds = (bd_list->max_bdi - start_bdi)/
1028                                                         bd_list->num_bds_table;
1029                         chain_bds += short_bdi/bd_list->num_bds_table;
1030                         max_len_bds = bd_list->max_bdi - start_bdi;
1031                         max_len_bds += short_bdi;
1032                         max_len_bds -= chain_bds;
1033                 }
1034                 /* max_len_bds is the number of full length bds */
1035                 end_bdi = find_end_bdi(ep, bd_xfr->next_hwd_bdi);
1036                 if (!(end_bdi == short_bdi))
1037                         ep->ignore_next_sr = true;
1038
1039                 actual_length = max_len_bds * BD_MAX_BUFF_SIZE;
1040                 short_bd = bdi_to_bd(ep, short_bdi);
1041                 /* length queued */
1042                 length_short = le32_to_cpu(short_bd->offset[2]) & 0x1FFFFF;
1043                 /* actual length trensfered */
1044                 length_short -= SR_BD_LEN(le32_to_cpu(sreport->offset[2]));
1045                 actual_length += length_short;
1046                 req->usb_req.actual = actual_length;
1047         } else {
1048                 req->usb_req.actual = req->usb_req.length -
1049                         SR_BD_LEN(le32_to_cpu(sreport->offset[2]));
1050                 dev_dbg(bdc->dev,
1051                         "len=%d actual=%d bd_xfr->next_hwd_bdi:%d\n",
1052                         req->usb_req.length, req->usb_req.actual,
1053                         bd_xfr->next_hwd_bdi);
1054         }
1055
1056         /* Update the dequeue pointer */
1057         ep->bd_list.hwd_bdi = bd_xfr->next_hwd_bdi;
1058         if (req->usb_req.actual < req->usb_req.length) {
1059                 dev_dbg(bdc->dev, "short xfr on %d\n", ep->ep_num);
1060                 if (req->usb_req.short_not_ok)
1061                         status = -EREMOTEIO;
1062         }
1063         bdc_req_complete(ep, bd_xfr->req, status);
1064 }
1065
1066 /* EP0 setup related packet handlers */
1067
1068 /*
1069  * Setup packet received, just store the packet and process on next DS or SS
1070  * started SR
1071  */
1072 void bdc_xsf_ep0_setup_recv(struct bdc *bdc, struct bdc_sr *sreport)
1073 {
1074         struct usb_ctrlrequest *setup_pkt;
1075         u32 len;
1076
1077         dev_dbg(bdc->dev,
1078                 "%s ep0_state:%s\n",
1079                 __func__, ep0_state_string[bdc->ep0_state]);
1080         /* Store received setup packet */
1081         setup_pkt = &bdc->setup_pkt;
1082         memcpy(setup_pkt, &sreport->offset[0], sizeof(*setup_pkt));
1083         len = le16_to_cpu(setup_pkt->wLength);
1084         if (!len)
1085                 bdc->ep0_state = WAIT_FOR_STATUS_START;
1086         else
1087                 bdc->ep0_state = WAIT_FOR_DATA_START;
1088
1089
1090         dev_dbg(bdc->dev,
1091                 "%s exit ep0_state:%s\n",
1092                 __func__, ep0_state_string[bdc->ep0_state]);
1093 }
1094
1095 /* Stall ep0 */
1096 static void ep0_stall(struct bdc *bdc)
1097 {
1098         struct bdc_ep   *ep = bdc->bdc_ep_array[1];
1099         struct bdc_req *req;
1100
1101         dev_dbg(bdc->dev, "%s\n", __func__);
1102         bdc->delayed_status = false;
1103         ep_set_halt(ep, 1);
1104
1105         /* de-queue any pendig requests */
1106         while (!list_empty(&ep->queue)) {
1107                 req = list_entry(ep->queue.next, struct bdc_req,
1108                                 queue);
1109                 bdc_req_complete(ep, req, -ESHUTDOWN);
1110         }
1111 }
1112
1113 /* SET_ADD handlers */
1114 static int ep0_set_address(struct bdc *bdc, struct usb_ctrlrequest *ctrl)
1115 {
1116         enum usb_device_state state = bdc->gadget.state;
1117         int ret = 0;
1118         u32 addr;
1119
1120         addr = le16_to_cpu(ctrl->wValue);
1121         dev_dbg(bdc->dev,
1122                 "%s addr:%d dev state:%d\n",
1123                 __func__, addr, state);
1124
1125         if (addr > 127)
1126                 return -EINVAL;
1127
1128         switch (state) {
1129         case USB_STATE_DEFAULT:
1130         case USB_STATE_ADDRESS:
1131                 /* Issue Address device command */
1132                 ret = bdc_address_device(bdc, addr);
1133                 if (ret)
1134                         return ret;
1135
1136                 if (addr)
1137                         usb_gadget_set_state(&bdc->gadget, USB_STATE_ADDRESS);
1138                 else
1139                         usb_gadget_set_state(&bdc->gadget, USB_STATE_DEFAULT);
1140
1141                 bdc->dev_addr = addr;
1142                 break;
1143         default:
1144                 dev_warn(bdc->dev,
1145                         "SET Address in wrong device state %d\n",
1146                         state);
1147                 ret = -EINVAL;
1148         }
1149
1150         return ret;
1151 }
1152
1153 /* Handler for SET/CLEAR FEATURE requests for device */
1154 static int ep0_handle_feature_dev(struct bdc *bdc, u16 wValue,
1155                                                         u16 wIndex, bool set)
1156 {
1157         enum usb_device_state state = bdc->gadget.state;
1158         u32     usppms = 0;
1159
1160         dev_dbg(bdc->dev, "%s set:%d dev state:%d\n",
1161                                         __func__, set, state);
1162         switch (wValue) {
1163         case USB_DEVICE_REMOTE_WAKEUP:
1164                 dev_dbg(bdc->dev, "USB_DEVICE_REMOTE_WAKEUP\n");
1165                 if (set)
1166                         bdc->devstatus |= REMOTE_WAKE_ENABLE;
1167                 else
1168                         bdc->devstatus &= ~REMOTE_WAKE_ENABLE;
1169                 break;
1170
1171         case USB_DEVICE_TEST_MODE:
1172                 dev_dbg(bdc->dev, "USB_DEVICE_TEST_MODE\n");
1173                 if ((wIndex & 0xFF) ||
1174                                 (bdc->gadget.speed != USB_SPEED_HIGH) || !set)
1175                         return -EINVAL;
1176
1177                 bdc->test_mode = wIndex >> 8;
1178                 break;
1179
1180         case USB_DEVICE_U1_ENABLE:
1181                 dev_dbg(bdc->dev, "USB_DEVICE_U1_ENABLE\n");
1182
1183                 if (bdc->gadget.speed != USB_SPEED_SUPER ||
1184                                                 state != USB_STATE_CONFIGURED)
1185                         return -EINVAL;
1186
1187                 usppms =  bdc_readl(bdc->regs, BDC_USPPMS);
1188                 if (set) {
1189                         /* clear previous u1t */
1190                         usppms &= ~BDC_U1T(BDC_U1T_MASK);
1191                         usppms |= BDC_U1T(U1_TIMEOUT);
1192                         usppms |= BDC_U1E | BDC_PORT_W1S;
1193                         bdc->devstatus |= (1 << USB_DEV_STAT_U1_ENABLED);
1194                 } else {
1195                         usppms &= ~BDC_U1E;
1196                         usppms |= BDC_PORT_W1S;
1197                         bdc->devstatus &= ~(1 << USB_DEV_STAT_U1_ENABLED);
1198                 }
1199                 bdc_writel(bdc->regs, BDC_USPPMS, usppms);
1200                 break;
1201
1202         case USB_DEVICE_U2_ENABLE:
1203                 dev_dbg(bdc->dev, "USB_DEVICE_U2_ENABLE\n");
1204
1205                 if (bdc->gadget.speed != USB_SPEED_SUPER ||
1206                                                 state != USB_STATE_CONFIGURED)
1207                         return -EINVAL;
1208
1209                 usppms = bdc_readl(bdc->regs, BDC_USPPMS);
1210                 if (set) {
1211                         usppms |= BDC_U2E;
1212                         usppms |= BDC_U2A;
1213                         bdc->devstatus |= (1 << USB_DEV_STAT_U2_ENABLED);
1214                 } else {
1215                         usppms &= ~BDC_U2E;
1216                         usppms &= ~BDC_U2A;
1217                         bdc->devstatus &= ~(1 << USB_DEV_STAT_U2_ENABLED);
1218                 }
1219                 bdc_writel(bdc->regs, BDC_USPPMS, usppms);
1220                 break;
1221
1222         case USB_DEVICE_LTM_ENABLE:
1223                 dev_dbg(bdc->dev, "USB_DEVICE_LTM_ENABLE?\n");
1224                 if (bdc->gadget.speed != USB_SPEED_SUPER ||
1225                                                 state != USB_STATE_CONFIGURED)
1226                         return -EINVAL;
1227                 break;
1228         default:
1229                 dev_err(bdc->dev, "Unknown wValue:%d\n", wValue);
1230                 return -EOPNOTSUPP;
1231         } /* USB_RECIP_DEVICE end */
1232
1233         return 0;
1234 }
1235
1236 /* SET/CLEAR FEATURE handler */
1237 static int ep0_handle_feature(struct bdc *bdc,
1238                               struct usb_ctrlrequest *setup_pkt, bool set)
1239 {
1240         enum usb_device_state state = bdc->gadget.state;
1241         struct bdc_ep *ep;
1242         u16 wValue;
1243         u16 wIndex;
1244         int epnum;
1245
1246         wValue = le16_to_cpu(setup_pkt->wValue);
1247         wIndex = le16_to_cpu(setup_pkt->wIndex);
1248
1249         dev_dbg(bdc->dev,
1250                 "%s wValue=%d wIndex=%d devstate=%08x speed=%d set=%d",
1251                 __func__, wValue, wIndex, state,
1252                 bdc->gadget.speed, set);
1253
1254         switch (setup_pkt->bRequestType & USB_RECIP_MASK) {
1255         case USB_RECIP_DEVICE:
1256                 return ep0_handle_feature_dev(bdc, wValue, wIndex, set);
1257         case USB_RECIP_INTERFACE:
1258                 dev_dbg(bdc->dev, "USB_RECIP_INTERFACE\n");
1259                 /* USB3 spec, sec 9.4.9 */
1260                 if (wValue != USB_INTRF_FUNC_SUSPEND)
1261                         return -EINVAL;
1262                 /* USB3 spec, Table 9-8 */
1263                 if (set) {
1264                         if (wIndex & USB_INTRF_FUNC_SUSPEND_RW) {
1265                                 dev_dbg(bdc->dev, "SET REMOTE_WAKEUP\n");
1266                                 bdc->devstatus |= REMOTE_WAKE_ENABLE;
1267                         } else {
1268                                 dev_dbg(bdc->dev, "CLEAR REMOTE_WAKEUP\n");
1269                                 bdc->devstatus &= ~REMOTE_WAKE_ENABLE;
1270                         }
1271                 }
1272                 break;
1273
1274         case USB_RECIP_ENDPOINT:
1275                 dev_dbg(bdc->dev, "USB_RECIP_ENDPOINT\n");
1276                 if (wValue != USB_ENDPOINT_HALT)
1277                         return -EINVAL;
1278
1279                 epnum = wIndex & USB_ENDPOINT_NUMBER_MASK;
1280                 if (epnum) {
1281                         if ((wIndex & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
1282                                 epnum = epnum * 2 + 1;
1283                         else
1284                                 epnum *= 2;
1285                 } else {
1286                         epnum = 1; /*EP0*/
1287                 }
1288                 /*
1289                  * If CLEAR_FEATURE on ep0 then don't do anything as the stall
1290                  * condition on ep0 has already been cleared when SETUP packet
1291                  * was received.
1292                  */
1293                 if (epnum == 1 && !set) {
1294                         dev_dbg(bdc->dev, "ep0 stall already cleared\n");
1295                         return 0;
1296                 }
1297                 dev_dbg(bdc->dev, "epnum=%d\n", epnum);
1298                 ep = bdc->bdc_ep_array[epnum];
1299                 if (!ep)
1300                         return -EINVAL;
1301
1302                 return ep_set_halt(ep, set);
1303         default:
1304                 dev_err(bdc->dev, "Unknown recipient\n");
1305                 return -EINVAL;
1306         }
1307
1308         return 0;
1309 }
1310
1311 /* GET_STATUS request handler */
1312 static int ep0_handle_status(struct bdc *bdc,
1313                              struct usb_ctrlrequest *setup_pkt)
1314 {
1315         enum usb_device_state state = bdc->gadget.state;
1316         struct bdc_ep *ep;
1317         u16 usb_status = 0;
1318         u32 epnum;
1319         u16 wIndex;
1320
1321         /* USB2.0 spec sec 9.4.5 */
1322         if (state == USB_STATE_DEFAULT)
1323                 return -EINVAL;
1324         wIndex = le16_to_cpu(setup_pkt->wIndex);
1325         dev_dbg(bdc->dev, "%s\n", __func__);
1326         usb_status = bdc->devstatus;
1327         switch (setup_pkt->bRequestType & USB_RECIP_MASK) {
1328         case USB_RECIP_DEVICE:
1329                 dev_dbg(bdc->dev,
1330                         "USB_RECIP_DEVICE devstatus:%08x\n",
1331                         bdc->devstatus);
1332                 /* USB3 spec, sec 9.4.5 */
1333                 if (bdc->gadget.speed == USB_SPEED_SUPER)
1334                         usb_status &= ~REMOTE_WAKE_ENABLE;
1335                 break;
1336
1337         case USB_RECIP_INTERFACE:
1338                 dev_dbg(bdc->dev, "USB_RECIP_INTERFACE\n");
1339                 if (bdc->gadget.speed == USB_SPEED_SUPER) {
1340                         /*
1341                          * This should come from func for Func remote wkup
1342                          * usb_status |=1;
1343                          */
1344                         if (bdc->devstatus & REMOTE_WAKE_ENABLE)
1345                                 usb_status |= REMOTE_WAKE_ENABLE;
1346                 } else {
1347                         usb_status = 0;
1348                 }
1349
1350                 break;
1351
1352         case USB_RECIP_ENDPOINT:
1353                 dev_dbg(bdc->dev, "USB_RECIP_ENDPOINT\n");
1354                 epnum = wIndex & USB_ENDPOINT_NUMBER_MASK;
1355                 if (epnum) {
1356                         if ((wIndex & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
1357                                 epnum = epnum*2 + 1;
1358                         else
1359                                 epnum *= 2;
1360                 } else {
1361                         epnum = 1; /* EP0 */
1362                 }
1363
1364                 ep = bdc->bdc_ep_array[epnum];
1365                 if (!ep) {
1366                         dev_err(bdc->dev, "ISSUE, GET_STATUS for invalid EP ?");
1367                         return -EINVAL;
1368                 }
1369                 if (ep->flags & BDC_EP_STALL)
1370                         usb_status |= 1 << USB_ENDPOINT_HALT;
1371
1372                 break;
1373         default:
1374                 dev_err(bdc->dev, "Unknown recipient for get_status\n");
1375                 return -EINVAL;
1376         }
1377         /* prepare a data stage for GET_STATUS */
1378         dev_dbg(bdc->dev, "usb_status=%08x\n", usb_status);
1379         *(__le16 *)bdc->ep0_response_buff = cpu_to_le16(usb_status);
1380         bdc->ep0_req.usb_req.length = 2;
1381         bdc->ep0_req.usb_req.buf = &bdc->ep0_response_buff;
1382         ep0_queue_data_stage(bdc);
1383
1384         return 0;
1385 }
1386
1387 static void ep0_set_sel_cmpl(struct usb_ep *_ep, struct usb_request *_req)
1388 {
1389         /* ep0_set_sel_cmpl */
1390 }
1391
1392 /* Queue data stage to handle 6 byte SET_SEL request */
1393 static int ep0_set_sel(struct bdc *bdc,
1394                              struct usb_ctrlrequest *setup_pkt)
1395 {
1396         struct bdc_ep   *ep;
1397         u16     wLength;
1398         u16     wValue;
1399
1400         dev_dbg(bdc->dev, "%s\n", __func__);
1401         wValue = le16_to_cpu(setup_pkt->wValue);
1402         wLength = le16_to_cpu(setup_pkt->wLength);
1403         if (unlikely(wLength != 6)) {
1404                 dev_err(bdc->dev, "%s Wrong wLength:%d\n", __func__, wLength);
1405                 return -EINVAL;
1406         }
1407         ep = bdc->bdc_ep_array[1];
1408         bdc->ep0_req.ep = ep;
1409         bdc->ep0_req.usb_req.length = 6;
1410         bdc->ep0_req.usb_req.buf = bdc->ep0_response_buff;
1411         bdc->ep0_req.usb_req.complete = ep0_set_sel_cmpl;
1412         ep0_queue_data_stage(bdc);
1413
1414         return 0;
1415 }
1416
1417 /*
1418  * Queue a 0 byte bd only if wLength is more than the length and and length is
1419  * a multiple of MaxPacket then queue 0 byte BD
1420  */
1421 static int ep0_queue_zlp(struct bdc *bdc)
1422 {
1423         int ret;
1424
1425         dev_dbg(bdc->dev, "%s\n", __func__);
1426         bdc->ep0_req.ep = bdc->bdc_ep_array[1];
1427         bdc->ep0_req.usb_req.length = 0;
1428         bdc->ep0_req.usb_req.complete = NULL;
1429         bdc->ep0_state = WAIT_FOR_DATA_START;
1430         ret = bdc_queue_xfr(bdc, &bdc->ep0_req);
1431         if (ret) {
1432                 dev_err(bdc->dev, "err queueing zlp :%d\n", ret);
1433                 return ret;
1434         }
1435         bdc->ep0_state = WAIT_FOR_DATA_XMIT;
1436
1437         return 0;
1438 }
1439
1440 /* Control request handler */
1441 static int handle_control_request(struct bdc *bdc)
1442 {
1443         enum usb_device_state state = bdc->gadget.state;
1444         struct usb_ctrlrequest *setup_pkt;
1445         int delegate_setup = 0;
1446         int ret = 0;
1447         int config = 0;
1448
1449         setup_pkt = &bdc->setup_pkt;
1450         dev_dbg(bdc->dev, "%s\n", __func__);
1451         if ((setup_pkt->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
1452                 switch (setup_pkt->bRequest) {
1453                 case USB_REQ_SET_ADDRESS:
1454                         dev_dbg(bdc->dev, "USB_REQ_SET_ADDRESS\n");
1455                         ret = ep0_set_address(bdc, setup_pkt);
1456                         bdc->devstatus &= DEVSTATUS_CLEAR;
1457                         break;
1458
1459                 case USB_REQ_SET_CONFIGURATION:
1460                         dev_dbg(bdc->dev, "USB_REQ_SET_CONFIGURATION\n");
1461                         if (state == USB_STATE_ADDRESS) {
1462                                 usb_gadget_set_state(&bdc->gadget,
1463                                                         USB_STATE_CONFIGURED);
1464                         } else if (state == USB_STATE_CONFIGURED) {
1465                                 /*
1466                                  * USB2 spec sec 9.4.7, if wValue is 0 then dev
1467                                  * is moved to addressed state
1468                                  */
1469                                 config = le16_to_cpu(setup_pkt->wValue);
1470                                 if (!config)
1471                                         usb_gadget_set_state(
1472                                                         &bdc->gadget,
1473                                                         USB_STATE_ADDRESS);
1474                         }
1475                         delegate_setup = 1;
1476                         break;
1477
1478                 case USB_REQ_SET_FEATURE:
1479                         dev_dbg(bdc->dev, "USB_REQ_SET_FEATURE\n");
1480                         ret = ep0_handle_feature(bdc, setup_pkt, 1);
1481                         break;
1482
1483                 case USB_REQ_CLEAR_FEATURE:
1484                         dev_dbg(bdc->dev, "USB_REQ_CLEAR_FEATURE\n");
1485                         ret = ep0_handle_feature(bdc, setup_pkt, 0);
1486                         break;
1487
1488                 case USB_REQ_GET_STATUS:
1489                         dev_dbg(bdc->dev, "USB_REQ_GET_STATUS\n");
1490                         ret = ep0_handle_status(bdc, setup_pkt);
1491                         break;
1492
1493                 case USB_REQ_SET_SEL:
1494                         dev_dbg(bdc->dev, "USB_REQ_SET_SEL\n");
1495                         ret = ep0_set_sel(bdc, setup_pkt);
1496                         break;
1497
1498                 case USB_REQ_SET_ISOCH_DELAY:
1499                         dev_warn(bdc->dev,
1500                         "USB_REQ_SET_ISOCH_DELAY not handled\n");
1501                         ret = 0;
1502                         break;
1503                 default:
1504                         delegate_setup = 1;
1505                 }
1506         } else {
1507                 delegate_setup = 1;
1508         }
1509
1510         if (delegate_setup) {
1511                 spin_unlock(&bdc->lock);
1512                 ret = bdc->gadget_driver->setup(&bdc->gadget, setup_pkt);
1513                 spin_lock(&bdc->lock);
1514         }
1515
1516         return ret;
1517 }
1518
1519 /* EP0: Data stage started */
1520 void bdc_xsf_ep0_data_start(struct bdc *bdc, struct bdc_sr *sreport)
1521 {
1522         struct bdc_ep *ep;
1523         int ret = 0;
1524
1525         dev_dbg(bdc->dev, "%s\n", __func__);
1526         ep = bdc->bdc_ep_array[1];
1527         /* If ep0 was stalled, the clear it first */
1528         if (ep->flags & BDC_EP_STALL) {
1529                 ret = ep_set_halt(ep, 0);
1530                 if (ret)
1531                         goto err;
1532         }
1533         if (bdc->ep0_state != WAIT_FOR_DATA_START)
1534                 dev_warn(bdc->dev,
1535                         "Data stage not expected ep0_state:%s\n",
1536                         ep0_state_string[bdc->ep0_state]);
1537
1538         ret = handle_control_request(bdc);
1539         if (ret == USB_GADGET_DELAYED_STATUS) {
1540                 /*
1541                  * The ep0 state will remain WAIT_FOR_DATA_START till
1542                  * we received ep_queue on ep0
1543                  */
1544                 bdc->delayed_status = true;
1545                 return;
1546         }
1547         if (!ret) {
1548                 bdc->ep0_state = WAIT_FOR_DATA_XMIT;
1549                 dev_dbg(bdc->dev,
1550                         "ep0_state:%s", ep0_state_string[bdc->ep0_state]);
1551                 return;
1552         }
1553 err:
1554         ep0_stall(bdc);
1555 }
1556
1557 /* EP0: status stage started */
1558 void bdc_xsf_ep0_status_start(struct bdc *bdc, struct bdc_sr *sreport)
1559 {
1560         struct usb_ctrlrequest *setup_pkt;
1561         struct bdc_ep *ep;
1562         int ret = 0;
1563
1564         dev_dbg(bdc->dev,
1565                 "%s ep0_state:%s",
1566                 __func__, ep0_state_string[bdc->ep0_state]);
1567         ep = bdc->bdc_ep_array[1];
1568
1569         /* check if ZLP was queued? */
1570         if (bdc->zlp_needed)
1571                 bdc->zlp_needed = false;
1572
1573         if (ep->flags & BDC_EP_STALL) {
1574                 ret = ep_set_halt(ep, 0);
1575                 if (ret)
1576                         goto err;
1577         }
1578
1579         if ((bdc->ep0_state != WAIT_FOR_STATUS_START) &&
1580                                 (bdc->ep0_state != WAIT_FOR_DATA_XMIT))
1581                 dev_err(bdc->dev,
1582                         "Status stage recv but ep0_state:%s\n",
1583                         ep0_state_string[bdc->ep0_state]);
1584
1585         /* check if data stage is in progress ? */
1586         if (bdc->ep0_state == WAIT_FOR_DATA_XMIT) {
1587                 bdc->ep0_state = STATUS_PENDING;
1588                 /* Status stage will be queued upon Data stage transmit event */
1589                 dev_dbg(bdc->dev,
1590                         "status started but data  not transmitted yet\n");
1591                 return;
1592         }
1593         setup_pkt = &bdc->setup_pkt;
1594
1595         /*
1596          * 2 stage setup then only process the setup, for 3 stage setup the date
1597          * stage is already handled
1598          */
1599         if (!le16_to_cpu(setup_pkt->wLength)) {
1600                 ret = handle_control_request(bdc);
1601                 if (ret == USB_GADGET_DELAYED_STATUS) {
1602                         bdc->delayed_status = true;
1603                         /* ep0_state will remain WAIT_FOR_STATUS_START */
1604                         return;
1605                 }
1606         }
1607         if (!ret) {
1608                 /* Queue a status stage BD */
1609                 ep0_queue_status_stage(bdc);
1610                 bdc->ep0_state = WAIT_FOR_STATUS_XMIT;
1611                 dev_dbg(bdc->dev,
1612                         "ep0_state:%s", ep0_state_string[bdc->ep0_state]);
1613                 return;
1614         }
1615 err:
1616         ep0_stall(bdc);
1617 }
1618
1619 /* Helper function to update ep0 upon SR with xsf_succ or xsf_short */
1620 static void ep0_xsf_complete(struct bdc *bdc, struct bdc_sr *sreport)
1621 {
1622         dev_dbg(bdc->dev, "%s\n", __func__);
1623         switch (bdc->ep0_state) {
1624         case WAIT_FOR_DATA_XMIT:
1625                 bdc->ep0_state = WAIT_FOR_STATUS_START;
1626                 break;
1627         case WAIT_FOR_STATUS_XMIT:
1628                 bdc->ep0_state = WAIT_FOR_SETUP;
1629                 if (bdc->test_mode) {
1630                         int ret;
1631
1632                         dev_dbg(bdc->dev, "test_mode:%d\n", bdc->test_mode);
1633                         ret = bdc_set_test_mode(bdc);
1634                         if (ret < 0) {
1635                                 dev_err(bdc->dev, "Err in setting Test mode\n");
1636                                 return;
1637                         }
1638                         bdc->test_mode = 0;
1639                 }
1640                 break;
1641         case STATUS_PENDING:
1642                 bdc_xsf_ep0_status_start(bdc, sreport);
1643                 break;
1644
1645         default:
1646                 dev_err(bdc->dev,
1647                         "Unknown ep0_state:%s\n",
1648                         ep0_state_string[bdc->ep0_state]);
1649
1650         }
1651 }
1652
1653 /* xfr completion status report handler */
1654 void bdc_sr_xsf(struct bdc *bdc, struct bdc_sr *sreport)
1655 {
1656         struct bdc_ep *ep;
1657         u32 sr_status;
1658         u8 ep_num;
1659
1660         ep_num = (le32_to_cpu(sreport->offset[3])>>4) & 0x1f;
1661         ep = bdc->bdc_ep_array[ep_num];
1662         if (!ep || !(ep->flags & BDC_EP_ENABLED)) {
1663                 dev_err(bdc->dev, "xsf for ep not enabled\n");
1664                 return;
1665         }
1666         /*
1667          * check if this transfer is after link went from U3->U0 due
1668          * to remote wakeup
1669          */
1670         if (bdc->devstatus & FUNC_WAKE_ISSUED) {
1671                 bdc->devstatus &= ~(FUNC_WAKE_ISSUED);
1672                 dev_dbg(bdc->dev, "%s clearing FUNC_WAKE_ISSUED flag\n",
1673                                                                 __func__);
1674         }
1675         sr_status = XSF_STS(le32_to_cpu(sreport->offset[3]));
1676         dev_dbg_ratelimited(bdc->dev, "%s sr_status=%d ep:%s\n",
1677                                         __func__, sr_status, ep->name);
1678
1679         switch (sr_status) {
1680         case XSF_SUCC:
1681         case XSF_SHORT:
1682                 handle_xsr_succ_status(bdc, ep, sreport);
1683                 if (ep_num == 1)
1684                         ep0_xsf_complete(bdc, sreport);
1685                 break;
1686
1687         case XSF_SETUP_RECV:
1688         case XSF_DATA_START:
1689         case XSF_STATUS_START:
1690                 if (ep_num != 1) {
1691                         dev_err(bdc->dev,
1692                                 "ep0 related packets on non ep0 endpoint");
1693                         return;
1694                 }
1695                 bdc->sr_xsf_ep0[sr_status - XSF_SETUP_RECV](bdc, sreport);
1696                 break;
1697
1698         case XSF_BABB:
1699                 if (ep_num == 1) {
1700                         dev_dbg(bdc->dev, "Babble on ep0 zlp_need:%d\n",
1701                                                         bdc->zlp_needed);
1702                         /*
1703                          * If the last completed transfer had wLength >Data Len,
1704                          * and Len is multiple of MaxPacket,then queue ZLP
1705                          */
1706                         if (bdc->zlp_needed) {
1707                                 /* queue 0 length bd */
1708                                 ep0_queue_zlp(bdc);
1709                                 return;
1710                         }
1711                 }
1712                 dev_warn(bdc->dev, "Babble on ep not handled\n");
1713                 break;
1714         default:
1715                 dev_warn(bdc->dev, "sr status not handled:%x\n", sr_status);
1716                 break;
1717         }
1718 }
1719
1720 static int bdc_gadget_ep_queue(struct usb_ep *_ep,
1721                                 struct usb_request *_req, gfp_t gfp_flags)
1722 {
1723         struct bdc_req *req;
1724         unsigned long flags;
1725         struct bdc_ep *ep;
1726         struct bdc *bdc;
1727         int ret;
1728
1729         if (!_ep || !_ep->desc)
1730                 return -ESHUTDOWN;
1731
1732         if (!_req || !_req->complete || !_req->buf)
1733                 return -EINVAL;
1734
1735         ep = to_bdc_ep(_ep);
1736         req = to_bdc_req(_req);
1737         bdc = ep->bdc;
1738         dev_dbg(bdc->dev, "%s ep:%p req:%p\n", __func__, ep, req);
1739         dev_dbg(bdc->dev, "queuing request %p to %s length %d zero:%d\n",
1740                                 _req, ep->name, _req->length, _req->zero);
1741
1742         if (!ep->usb_ep.desc) {
1743                 dev_warn(bdc->dev,
1744                         "trying to queue req %p to disabled %s\n",
1745                         _req, ep->name);
1746                 return -ESHUTDOWN;
1747         }
1748
1749         if (_req->length > MAX_XFR_LEN) {
1750                 dev_warn(bdc->dev,
1751                         "req length > supported MAX:%d requested:%d\n",
1752                         MAX_XFR_LEN, _req->length);
1753                 return -EOPNOTSUPP;
1754         }
1755         spin_lock_irqsave(&bdc->lock, flags);
1756         if (ep == bdc->bdc_ep_array[1])
1757                 ret = ep0_queue(ep, req);
1758         else
1759                 ret = ep_queue(ep, req);
1760
1761         spin_unlock_irqrestore(&bdc->lock, flags);
1762
1763         return ret;
1764 }
1765
1766 static int bdc_gadget_ep_dequeue(struct usb_ep *_ep,
1767                                   struct usb_request *_req)
1768 {
1769         struct bdc_req *req;
1770         unsigned long flags;
1771         struct bdc_ep *ep;
1772         struct bdc *bdc;
1773         int ret;
1774
1775         if (!_ep || !_req)
1776                 return -EINVAL;
1777
1778         ep = to_bdc_ep(_ep);
1779         req = to_bdc_req(_req);
1780         bdc = ep->bdc;
1781         dev_dbg(bdc->dev, "%s ep:%s req:%p\n", __func__, ep->name, req);
1782         bdc_dbg_bd_list(bdc, ep);
1783         spin_lock_irqsave(&bdc->lock, flags);
1784         /* make sure it's still queued on this endpoint */
1785         list_for_each_entry(req, &ep->queue, queue) {
1786                 if (&req->usb_req == _req)
1787                         break;
1788         }
1789         if (&req->usb_req != _req) {
1790                 spin_unlock_irqrestore(&bdc->lock, flags);
1791                 dev_err(bdc->dev, "usb_req !=req n");
1792                 return -EINVAL;
1793         }
1794         ret = ep_dequeue(ep, req);
1795         if (ret) {
1796                 ret = -EOPNOTSUPP;
1797                 goto err;
1798         }
1799         bdc_req_complete(ep, req, -ECONNRESET);
1800
1801 err:
1802         bdc_dbg_bd_list(bdc, ep);
1803         spin_unlock_irqrestore(&bdc->lock, flags);
1804
1805         return ret;
1806 }
1807
1808 static int bdc_gadget_ep_set_halt(struct usb_ep *_ep, int value)
1809 {
1810         unsigned long flags;
1811         struct bdc_ep *ep;
1812         struct bdc *bdc;
1813         int ret;
1814
1815         ep = to_bdc_ep(_ep);
1816         bdc = ep->bdc;
1817         dev_dbg(bdc->dev, "%s ep:%s value=%d\n", __func__, ep->name, value);
1818         spin_lock_irqsave(&bdc->lock, flags);
1819         if (usb_endpoint_xfer_isoc(ep->usb_ep.desc))
1820                 ret = -EINVAL;
1821         else if (!list_empty(&ep->queue))
1822                 ret = -EAGAIN;
1823         else
1824                 ret = ep_set_halt(ep, value);
1825
1826         spin_unlock_irqrestore(&bdc->lock, flags);
1827
1828         return ret;
1829 }
1830
1831 static struct usb_request *bdc_gadget_alloc_request(struct usb_ep *_ep,
1832                                                      gfp_t gfp_flags)
1833 {
1834         struct bdc_req *req;
1835         struct bdc_ep *ep;
1836
1837         req = kzalloc(sizeof(*req), gfp_flags);
1838         if (!req)
1839                 return NULL;
1840
1841         ep = to_bdc_ep(_ep);
1842         req->ep = ep;
1843         req->epnum = ep->ep_num;
1844         req->usb_req.dma = DMA_ADDR_INVALID;
1845         dev_dbg(ep->bdc->dev, "%s ep:%s req:%p\n", __func__, ep->name, req);
1846
1847         return &req->usb_req;
1848 }
1849
1850 static void bdc_gadget_free_request(struct usb_ep *_ep,
1851                                      struct usb_request *_req)
1852 {
1853         struct bdc_req *req;
1854
1855         req = to_bdc_req(_req);
1856         kfree(req);
1857 }
1858
1859 /* endpoint operations */
1860
1861 /* configure endpoint and also allocate resources */
1862 static int bdc_gadget_ep_enable(struct usb_ep *_ep,
1863                                  const struct usb_endpoint_descriptor *desc)
1864 {
1865         unsigned long flags;
1866         struct bdc_ep *ep;
1867         struct bdc *bdc;
1868         int ret;
1869
1870         if (!_ep || !desc || desc->bDescriptorType != USB_DT_ENDPOINT) {
1871                 pr_debug("bdc_gadget_ep_enable invalid parameters\n");
1872                 return -EINVAL;
1873         }
1874
1875         if (!desc->wMaxPacketSize) {
1876                 pr_debug("bdc_gadget_ep_enable missing wMaxPacketSize\n");
1877                 return -EINVAL;
1878         }
1879
1880         ep = to_bdc_ep(_ep);
1881         bdc = ep->bdc;
1882
1883         /* Sanity check, upper layer will not send enable for ep0 */
1884         if (ep == bdc->bdc_ep_array[1])
1885                 return -EINVAL;
1886
1887         if (!bdc->gadget_driver
1888             || bdc->gadget.speed == USB_SPEED_UNKNOWN) {
1889                 return -ESHUTDOWN;
1890         }
1891
1892         dev_dbg(bdc->dev, "%s Enabling %s\n", __func__, ep->name);
1893         spin_lock_irqsave(&bdc->lock, flags);
1894         ep->desc = desc;
1895         ep->comp_desc = _ep->comp_desc;
1896         ret = bdc_ep_enable(ep);
1897         spin_unlock_irqrestore(&bdc->lock, flags);
1898
1899         return ret;
1900 }
1901
1902 static int bdc_gadget_ep_disable(struct usb_ep *_ep)
1903 {
1904         unsigned long flags;
1905         struct bdc_ep *ep;
1906         struct bdc *bdc;
1907         int ret;
1908
1909         if (!_ep) {
1910                 pr_debug("bdc: invalid parameters\n");
1911                 return -EINVAL;
1912         }
1913         ep = to_bdc_ep(_ep);
1914         bdc = ep->bdc;
1915
1916         /* Upper layer will not call this for ep0, but do a sanity check */
1917         if (ep == bdc->bdc_ep_array[1]) {
1918                 dev_warn(bdc->dev, "%s called for ep0\n", __func__);
1919                 return -EINVAL;
1920         }
1921         dev_dbg(bdc->dev,
1922                 "%s() ep:%s ep->flags:%08x\n",
1923                 __func__, ep->name, ep->flags);
1924
1925         if (!(ep->flags & BDC_EP_ENABLED)) {
1926                 if (bdc->gadget.speed != USB_SPEED_UNKNOWN)
1927                         dev_warn(bdc->dev, "%s is already disabled\n",
1928                                  ep->name);
1929                 return 0;
1930         }
1931         spin_lock_irqsave(&bdc->lock, flags);
1932         ret = bdc_ep_disable(ep);
1933         spin_unlock_irqrestore(&bdc->lock, flags);
1934
1935         return ret;
1936 }
1937
1938 static const struct usb_ep_ops bdc_gadget_ep_ops = {
1939         .enable = bdc_gadget_ep_enable,
1940         .disable = bdc_gadget_ep_disable,
1941         .alloc_request = bdc_gadget_alloc_request,
1942         .free_request = bdc_gadget_free_request,
1943         .queue = bdc_gadget_ep_queue,
1944         .dequeue = bdc_gadget_ep_dequeue,
1945         .set_halt = bdc_gadget_ep_set_halt
1946 };
1947
1948 /* dir = 1 is IN */
1949 static int init_ep(struct bdc *bdc, u32 epnum, u32 dir)
1950 {
1951         struct bdc_ep *ep;
1952
1953         dev_dbg(bdc->dev, "%s epnum=%d dir=%d\n", __func__, epnum, dir);
1954         ep = kzalloc(sizeof(*ep), GFP_KERNEL);
1955         if (!ep)
1956                 return -ENOMEM;
1957
1958         ep->bdc = bdc;
1959         ep->dir = dir;
1960
1961         if (dir)
1962                 ep->usb_ep.caps.dir_in = true;
1963         else
1964                 ep->usb_ep.caps.dir_out = true;
1965
1966         /* ep->ep_num is the index inside bdc_ep */
1967         if (epnum == 1) {
1968                 ep->ep_num = 1;
1969                 bdc->bdc_ep_array[ep->ep_num] = ep;
1970                 snprintf(ep->name, sizeof(ep->name), "ep%d", epnum - 1);
1971                 usb_ep_set_maxpacket_limit(&ep->usb_ep, EP0_MAX_PKT_SIZE);
1972                 ep->usb_ep.caps.type_control = true;
1973                 ep->comp_desc = NULL;
1974                 bdc->gadget.ep0 = &ep->usb_ep;
1975         } else {
1976                 if (dir)
1977                         ep->ep_num = epnum * 2 - 1;
1978                 else
1979                         ep->ep_num = epnum * 2 - 2;
1980
1981                 bdc->bdc_ep_array[ep->ep_num] = ep;
1982                 snprintf(ep->name, sizeof(ep->name), "ep%d%s", epnum - 1,
1983                          dir & 1 ? "in" : "out");
1984
1985                 usb_ep_set_maxpacket_limit(&ep->usb_ep, 1024);
1986                 ep->usb_ep.caps.type_iso = true;
1987                 ep->usb_ep.caps.type_bulk = true;
1988                 ep->usb_ep.caps.type_int = true;
1989                 ep->usb_ep.max_streams = 0;
1990                 list_add_tail(&ep->usb_ep.ep_list, &bdc->gadget.ep_list);
1991         }
1992         ep->usb_ep.ops = &bdc_gadget_ep_ops;
1993         ep->usb_ep.name = ep->name;
1994         ep->flags = 0;
1995         ep->ignore_next_sr = false;
1996         dev_dbg(bdc->dev, "ep=%p ep->usb_ep.name=%s epnum=%d ep->epnum=%d\n",
1997                                 ep, ep->usb_ep.name, epnum, ep->ep_num);
1998
1999         INIT_LIST_HEAD(&ep->queue);
2000
2001         return 0;
2002 }
2003
2004 /* Init all ep */
2005 int bdc_init_ep(struct bdc *bdc)
2006 {
2007         u8 epnum;
2008         int ret;
2009
2010         dev_dbg(bdc->dev, "%s()\n", __func__);
2011         INIT_LIST_HEAD(&bdc->gadget.ep_list);
2012         /* init ep0 */
2013         ret = init_ep(bdc, 1, 0);
2014         if (ret) {
2015                 dev_err(bdc->dev, "init ep ep0 fail %d\n", ret);
2016                 return ret;
2017         }
2018
2019         for (epnum = 2; epnum <= bdc->num_eps / 2; epnum++) {
2020                 /* OUT */
2021                 ret = init_ep(bdc, epnum, 0);
2022                 if (ret) {
2023                         dev_err(bdc->dev,
2024                                 "init ep failed for:%d error: %d\n",
2025                                 epnum, ret);
2026                         return ret;
2027                 }
2028
2029                 /* IN */
2030                 ret = init_ep(bdc, epnum, 1);
2031                 if (ret) {
2032                         dev_err(bdc->dev,
2033                                 "init ep failed for:%d error: %d\n",
2034                                 epnum, ret);
2035                         return ret;
2036                 }
2037         }
2038
2039         return 0;
2040 }