1// SPDX-License-Identifier: GPL-2.0+
2/*
3 * Handles the Intel 27x USB Device Controller (UDC)
4 *
5 * Inspired by original driver by Frank Becker, David Brownell, and others.
6 * Copyright (C) 2008 Robert Jarzmik
7 */
8#include <linux/module.h>
9#include <linux/kernel.h>
10#include <linux/types.h>
11#include <linux/errno.h>
12#include <linux/err.h>
13#include <linux/platform_device.h>
14#include <linux/delay.h>
15#include <linux/list.h>
16#include <linux/interrupt.h>
17#include <linux/proc_fs.h>
18#include <linux/clk.h>
19#include <linux/irq.h>
20#include <linux/gpio.h>
21#include <linux/gpio/consumer.h>
22#include <linux/slab.h>
23#include <linux/prefetch.h>
24#include <linux/byteorder/generic.h>
25#include <linux/platform_data/pxa2xx_udc.h>
26#include <linux/of.h>
27#include <linux/of_gpio.h>
28
29#include <linux/usb.h>
30#include <linux/usb/ch9.h>
31#include <linux/usb/gadget.h>
32#include <linux/usb/phy.h>
33
34#include "pxa27x_udc.h"
35
36/*
37 * This driver handles the USB Device Controller (UDC) in Intel's PXA 27x
38 * series processors.
39 *
40 * Such controller drivers work with a gadget driver.  The gadget driver
41 * returns descriptors, implements configuration and data protocols used
42 * by the host to interact with this device, and allocates endpoints to
43 * the different protocol interfaces.  The controller driver virtualizes
44 * usb hardware so that the gadget drivers will be more portable.
45 *
46 * This UDC hardware wants to implement a bit too much USB protocol. The
47 * biggest issues are:  that the endpoints have to be set up before the
48 * controller can be enabled (minor, and not uncommon); and each endpoint
49 * can only have one configuration, interface and alternative interface
50 * number (major, and very unusual). Once set up, these cannot be changed
51 * without a controller reset.
52 *
53 * The workaround is to setup all combinations necessary for the gadgets which
54 * will work with this driver. This is done in pxa_udc structure, statically.
55 * See pxa_udc, udc_usb_ep versus pxa_ep, and matching function find_pxa_ep.
56 * (You could modify this if needed.  Some drivers have a "fifo_mode" module
57 * parameter to facilitate such changes.)
58 *
59 * The combinations have been tested with these gadgets :
60 *  - zero gadget
61 *  - file storage gadget
62 *  - ether gadget
63 *
64 * The driver doesn't use DMA, only IO access and IRQ callbacks. No use is
65 * made of UDC's double buffering either. USB "On-The-Go" is not implemented.
66 *
67 * All the requests are handled the same way :
68 *  - the drivers tries to handle the request directly to the IO
69 *  - if the IO fifo is not big enough, the remaining is send/received in
70 *    interrupt handling.
71 */
72
73#define	DRIVER_VERSION	"2008-04-18"
74#define	DRIVER_DESC	"PXA 27x USB Device Controller driver"
75
76static const char driver_name[] = "pxa27x_udc";
77static struct pxa_udc *the_controller;
78
79static void handle_ep(struct pxa_ep *ep);
80
81/*
82 * Debug filesystem
83 */
84#ifdef CONFIG_USB_GADGET_DEBUG_FS
85
86#include <linux/debugfs.h>
87#include <linux/uaccess.h>
88#include <linux/seq_file.h>
89
90static int state_dbg_show(struct seq_file *s, void *p)
91{
92	struct pxa_udc *udc = s->private;
93	u32 tmp;
94
95	if (!udc->driver)
96		return -ENODEV;
97
98	/* basic device status */
99	seq_printf(s, DRIVER_DESC "\n"
100		   "%s version: %s\n"
101		   "Gadget driver: %s\n",
102		   driver_name, DRIVER_VERSION,
103		   udc->driver ? udc->driver->driver.name : "(none)");
104
105	tmp = udc_readl(udc, UDCCR);
106	seq_printf(s,
107		   "udccr=0x%0x(%s%s%s%s%s%s%s%s%s%s), con=%d,inter=%d,altinter=%d\n",
108		   tmp,
109		   (tmp & UDCCR_OEN) ? " oen":"",
110		   (tmp & UDCCR_AALTHNP) ? " aalthnp":"",
111		   (tmp & UDCCR_AHNP) ? " rem" : "",
112		   (tmp & UDCCR_BHNP) ? " rstir" : "",
113		   (tmp & UDCCR_DWRE) ? " dwre" : "",
114		   (tmp & UDCCR_SMAC) ? " smac" : "",
115		   (tmp & UDCCR_EMCE) ? " emce" : "",
116		   (tmp & UDCCR_UDR) ? " udr" : "",
117		   (tmp & UDCCR_UDA) ? " uda" : "",
118		   (tmp & UDCCR_UDE) ? " ude" : "",
119		   (tmp & UDCCR_ACN) >> UDCCR_ACN_S,
120		   (tmp & UDCCR_AIN) >> UDCCR_AIN_S,
121		   (tmp & UDCCR_AAISN) >> UDCCR_AAISN_S);
122	/* registers for device and ep0 */
123	seq_printf(s, "udcicr0=0x%08x udcicr1=0x%08x\n",
124		   udc_readl(udc, UDCICR0), udc_readl(udc, UDCICR1));
125	seq_printf(s, "udcisr0=0x%08x udcisr1=0x%08x\n",
126		   udc_readl(udc, UDCISR0), udc_readl(udc, UDCISR1));
127	seq_printf(s, "udcfnr=%d\n", udc_readl(udc, UDCFNR));
128	seq_printf(s, "irqs: reset=%lu, suspend=%lu, resume=%lu, reconfig=%lu\n",
129		   udc->stats.irqs_reset, udc->stats.irqs_suspend,
130		   udc->stats.irqs_resume, udc->stats.irqs_reconfig);
131
132	return 0;
133}
134DEFINE_SHOW_ATTRIBUTE(state_dbg);
135
136static int queues_dbg_show(struct seq_file *s, void *p)
137{
138	struct pxa_udc *udc = s->private;
139	struct pxa_ep *ep;
140	struct pxa27x_request *req;
141	int i, maxpkt;
142
143	if (!udc->driver)
144		return -ENODEV;
145
146	/* dump endpoint queues */
147	for (i = 0; i < NR_PXA_ENDPOINTS; i++) {
148		ep = &udc->pxa_ep[i];
149		maxpkt = ep->fifo_size;
150		seq_printf(s,  "%-12s max_pkt=%d %s\n",
151			   EPNAME(ep), maxpkt, "pio");
152
153		if (list_empty(&ep->queue)) {
154			seq_puts(s, "\t(nothing queued)\n");
155			continue;
156		}
157
158		list_for_each_entry(req, &ep->queue, queue) {
159			seq_printf(s,  "\treq %p len %d/%d buf %p\n",
160				   &req->req, req->req.actual,
161				   req->req.length, req->req.buf);
162		}
163	}
164
165	return 0;
166}
167DEFINE_SHOW_ATTRIBUTE(queues_dbg);
168
169static int eps_dbg_show(struct seq_file *s, void *p)
170{
171	struct pxa_udc *udc = s->private;
172	struct pxa_ep *ep;
173	int i;
174	u32 tmp;
175
176	if (!udc->driver)
177		return -ENODEV;
178
179	ep = &udc->pxa_ep[0];
180	tmp = udc_ep_readl(ep, UDCCSR);
181	seq_printf(s, "udccsr0=0x%03x(%s%s%s%s%s%s%s)\n",
182		   tmp,
183		   (tmp & UDCCSR0_SA) ? " sa" : "",
184		   (tmp & UDCCSR0_RNE) ? " rne" : "",
185		   (tmp & UDCCSR0_FST) ? " fst" : "",
186		   (tmp & UDCCSR0_SST) ? " sst" : "",
187		   (tmp & UDCCSR0_DME) ? " dme" : "",
188		   (tmp & UDCCSR0_IPR) ? " ipr" : "",
189		   (tmp & UDCCSR0_OPC) ? " opc" : "");
190	for (i = 0; i < NR_PXA_ENDPOINTS; i++) {
191		ep = &udc->pxa_ep[i];
192		tmp = i? udc_ep_readl(ep, UDCCR) : udc_readl(udc, UDCCR);
193		seq_printf(s, "%-12s: IN %lu(%lu reqs), OUT %lu(%lu reqs), irqs=%lu, udccr=0x%08x, udccsr=0x%03x, udcbcr=%d\n",
194			   EPNAME(ep),
195			   ep->stats.in_bytes, ep->stats.in_ops,
196			   ep->stats.out_bytes, ep->stats.out_ops,
197			   ep->stats.irqs,
198			   tmp, udc_ep_readl(ep, UDCCSR),
199			   udc_ep_readl(ep, UDCBCR));
200	}
201
202	return 0;
203}
204DEFINE_SHOW_ATTRIBUTE(eps_dbg);
205
206static void pxa_init_debugfs(struct pxa_udc *udc)
207{
208	struct dentry *root;
209
210	root = debugfs_create_dir(udc->gadget.name, usb_debug_root);
211	debugfs_create_file("udcstate", 0400, root, udc, &state_dbg_fops);
212	debugfs_create_file("queues", 0400, root, udc, &queues_dbg_fops);
213	debugfs_create_file("epstate", 0400, root, udc, &eps_dbg_fops);
214}
215
216static void pxa_cleanup_debugfs(struct pxa_udc *udc)
217{
218	debugfs_lookup_and_remove(udc->gadget.name, usb_debug_root);
219}
220
221#else
222static inline void pxa_init_debugfs(struct pxa_udc *udc)
223{
224}
225
226static inline void pxa_cleanup_debugfs(struct pxa_udc *udc)
227{
228}
229#endif
230
231/**
232 * is_match_usb_pxa - check if usb_ep and pxa_ep match
233 * @udc_usb_ep: usb endpoint
234 * @ep: pxa endpoint
235 * @config: configuration required in pxa_ep
236 * @interface: interface required in pxa_ep
237 * @altsetting: altsetting required in pxa_ep
238 *
239 * Returns 1 if all criteria match between pxa and usb endpoint, 0 otherwise
240 */
241static int is_match_usb_pxa(struct udc_usb_ep *udc_usb_ep, struct pxa_ep *ep,
242		int config, int interface, int altsetting)
243{
244	if (usb_endpoint_num(&udc_usb_ep->desc) != ep->addr)
245		return 0;
246	if (usb_endpoint_dir_in(&udc_usb_ep->desc) != ep->dir_in)
247		return 0;
248	if (usb_endpoint_type(&udc_usb_ep->desc) != ep->type)
249		return 0;
250	if ((ep->config != config) || (ep->interface != interface)
251			|| (ep->alternate != altsetting))
252		return 0;
253	return 1;
254}
255
256/**
257 * find_pxa_ep - find pxa_ep structure matching udc_usb_ep
258 * @udc: pxa udc
259 * @udc_usb_ep: udc_usb_ep structure
260 *
261 * Match udc_usb_ep and all pxa_ep available, to see if one matches.
262 * This is necessary because of the strong pxa hardware restriction requiring
263 * that once pxa endpoints are initialized, their configuration is freezed, and
264 * no change can be made to their address, direction, or in which configuration,
265 * interface or altsetting they are active ... which differs from more usual
266 * models which have endpoints be roughly just addressable fifos, and leave
267 * configuration events up to gadget drivers (like all control messages).
268 *
269 * Note that there is still a blurred point here :
270 *   - we rely on UDCCR register "active interface" and "active altsetting".
271 *     This is a nonsense in regard of USB spec, where multiple interfaces are
272 *     active at the same time.
273 *   - if we knew for sure that the pxa can handle multiple interface at the
274 *     same time, assuming Intel's Developer Guide is wrong, this function
275 *     should be reviewed, and a cache of couples (iface, altsetting) should
276 *     be kept in the pxa_udc structure. In this case this function would match
277 *     against the cache of couples instead of the "last altsetting" set up.
278 *
279 * Returns the matched pxa_ep structure or NULL if none found
280 */
281static struct pxa_ep *find_pxa_ep(struct pxa_udc *udc,
282		struct udc_usb_ep *udc_usb_ep)
283{
284	int i;
285	struct pxa_ep *ep;
286	int cfg = udc->config;
287	int iface = udc->last_interface;
288	int alt = udc->last_alternate;
289
290	if (udc_usb_ep == &udc->udc_usb_ep[0])
291		return &udc->pxa_ep[0];
292
293	for (i = 1; i < NR_PXA_ENDPOINTS; i++) {
294		ep = &udc->pxa_ep[i];
295		if (is_match_usb_pxa(udc_usb_ep, ep, cfg, iface, alt))
296			return ep;
297	}
298	return NULL;
299}
300
301/**
302 * update_pxa_ep_matches - update pxa_ep cached values in all udc_usb_ep
303 * @udc: pxa udc
304 *
305 * Context: interrupt handler
306 *
307 * Updates all pxa_ep fields in udc_usb_ep structures, if this field was
308 * previously set up (and is not NULL). The update is necessary is a
309 * configuration change or altsetting change was issued by the USB host.
310 */
311static void update_pxa_ep_matches(struct pxa_udc *udc)
312{
313	int i;
314	struct udc_usb_ep *udc_usb_ep;
315
316	for (i = 1; i < NR_USB_ENDPOINTS; i++) {
317		udc_usb_ep = &udc->udc_usb_ep[i];
318		if (udc_usb_ep->pxa_ep)
319			udc_usb_ep->pxa_ep = find_pxa_ep(udc, udc_usb_ep);
320	}
321}
322
323/**
324 * pio_irq_enable - Enables irq generation for one endpoint
325 * @ep: udc endpoint
326 */
327static void pio_irq_enable(struct pxa_ep *ep)
328{
329	struct pxa_udc *udc = ep->dev;
330	int index = EPIDX(ep);
331	u32 udcicr0 = udc_readl(udc, UDCICR0);
332	u32 udcicr1 = udc_readl(udc, UDCICR1);
333
334	if (index < 16)
335		udc_writel(udc, UDCICR0, udcicr0 | (3 << (index * 2)));
336	else
337		udc_writel(udc, UDCICR1, udcicr1 | (3 << ((index - 16) * 2)));
338}
339
340/**
341 * pio_irq_disable - Disables irq generation for one endpoint
342 * @ep: udc endpoint
343 */
344static void pio_irq_disable(struct pxa_ep *ep)
345{
346	struct pxa_udc *udc = ep->dev;
347	int index = EPIDX(ep);
348	u32 udcicr0 = udc_readl(udc, UDCICR0);
349	u32 udcicr1 = udc_readl(udc, UDCICR1);
350
351	if (index < 16)
352		udc_writel(udc, UDCICR0, udcicr0 & ~(3 << (index * 2)));
353	else
354		udc_writel(udc, UDCICR1, udcicr1 & ~(3 << ((index - 16) * 2)));
355}
356
357/**
358 * udc_set_mask_UDCCR - set bits in UDCCR
359 * @udc: udc device
360 * @mask: bits to set in UDCCR
361 *
362 * Sets bits in UDCCR, leaving DME and FST bits as they were.
363 */
364static inline void udc_set_mask_UDCCR(struct pxa_udc *udc, int mask)
365{
366	u32 udccr = udc_readl(udc, UDCCR);
367	udc_writel(udc, UDCCR,
368			(udccr & UDCCR_MASK_BITS) | (mask & UDCCR_MASK_BITS));
369}
370
371/**
372 * udc_clear_mask_UDCCR - clears bits in UDCCR
373 * @udc: udc device
374 * @mask: bit to clear in UDCCR
375 *
376 * Clears bits in UDCCR, leaving DME and FST bits as they were.
377 */
378static inline void udc_clear_mask_UDCCR(struct pxa_udc *udc, int mask)
379{
380	u32 udccr = udc_readl(udc, UDCCR);
381	udc_writel(udc, UDCCR,
382			(udccr & UDCCR_MASK_BITS) & ~(mask & UDCCR_MASK_BITS));
383}
384
385/**
386 * ep_write_UDCCSR - set bits in UDCCSR
387 * @ep: udc endpoint
388 * @mask: bits to set in UDCCR
389 *
390 * Sets bits in UDCCSR (UDCCSR0 and UDCCSR*).
391 *
392 * A specific case is applied to ep0 : the ACM bit is always set to 1, for
393 * SET_INTERFACE and SET_CONFIGURATION.
394 */
395static inline void ep_write_UDCCSR(struct pxa_ep *ep, int mask)
396{
397	if (is_ep0(ep))
398		mask |= UDCCSR0_ACM;
399	udc_ep_writel(ep, UDCCSR, mask);
400}
401
402/**
403 * ep_count_bytes_remain - get how many bytes in udc endpoint
404 * @ep: udc endpoint
405 *
406 * Returns number of bytes in OUT fifos. Broken for IN fifos (-EOPNOTSUPP)
407 */
408static int ep_count_bytes_remain(struct pxa_ep *ep)
409{
410	if (ep->dir_in)
411		return -EOPNOTSUPP;
412	return udc_ep_readl(ep, UDCBCR) & 0x3ff;
413}
414
415/**
416 * ep_is_empty - checks if ep has byte ready for reading
417 * @ep: udc endpoint
418 *
419 * If endpoint is the control endpoint, checks if there are bytes in the
420 * control endpoint fifo. If endpoint is a data endpoint, checks if bytes
421 * are ready for reading on OUT endpoint.
422 *
423 * Returns 0 if ep not empty, 1 if ep empty, -EOPNOTSUPP if IN endpoint
424 */
425static int ep_is_empty(struct pxa_ep *ep)
426{
427	int ret;
428
429	if (!is_ep0(ep) && ep->dir_in)
430		return -EOPNOTSUPP;
431	if (is_ep0(ep))
432		ret = !(udc_ep_readl(ep, UDCCSR) & UDCCSR0_RNE);
433	else
434		ret = !(udc_ep_readl(ep, UDCCSR) & UDCCSR_BNE);
435	return ret;
436}
437
438/**
439 * ep_is_full - checks if ep has place to write bytes
440 * @ep: udc endpoint
441 *
442 * If endpoint is not the control endpoint and is an IN endpoint, checks if
443 * there is place to write bytes into the endpoint.
444 *
445 * Returns 0 if ep not full, 1 if ep full, -EOPNOTSUPP if OUT endpoint
446 */
447static int ep_is_full(struct pxa_ep *ep)
448{
449	if (is_ep0(ep))
450		return (udc_ep_readl(ep, UDCCSR) & UDCCSR0_IPR);
451	if (!ep->dir_in)
452		return -EOPNOTSUPP;
453	return (!(udc_ep_readl(ep, UDCCSR) & UDCCSR_BNF));
454}
455
456/**
457 * epout_has_pkt - checks if OUT endpoint fifo has a packet available
458 * @ep: pxa endpoint
459 *
460 * Returns 1 if a complete packet is available, 0 if not, -EOPNOTSUPP for IN ep.
461 */
462static int epout_has_pkt(struct pxa_ep *ep)
463{
464	if (!is_ep0(ep) && ep->dir_in)
465		return -EOPNOTSUPP;
466	if (is_ep0(ep))
467		return (udc_ep_readl(ep, UDCCSR) & UDCCSR0_OPC);
468	return (udc_ep_readl(ep, UDCCSR) & UDCCSR_PC);
469}
470
471/**
472 * set_ep0state - Set ep0 automata state
473 * @udc: udc device
474 * @state: state
475 */
476static void set_ep0state(struct pxa_udc *udc, int state)
477{
478	struct pxa_ep *ep = &udc->pxa_ep[0];
479	char *old_stname = EP0_STNAME(udc);
480
481	udc->ep0state = state;
482	ep_dbg(ep, "state=%s->%s, udccsr0=0x%03x, udcbcr=%d\n", old_stname,
483		EP0_STNAME(udc), udc_ep_readl(ep, UDCCSR),
484		udc_ep_readl(ep, UDCBCR));
485}
486
487/**
488 * ep0_idle - Put control endpoint into idle state
489 * @dev: udc device
490 */
491static void ep0_idle(struct pxa_udc *dev)
492{
493	set_ep0state(dev, WAIT_FOR_SETUP);
494}
495
496/**
497 * inc_ep_stats_reqs - Update ep stats counts
498 * @ep: physical endpoint
499 * @is_in: ep direction (USB_DIR_IN or 0)
500 *
501 */
502static void inc_ep_stats_reqs(struct pxa_ep *ep, int is_in)
503{
504	if (is_in)
505		ep->stats.in_ops++;
506	else
507		ep->stats.out_ops++;
508}
509
510/**
511 * inc_ep_stats_bytes - Update ep stats counts
512 * @ep: physical endpoint
513 * @count: bytes transferred on endpoint
514 * @is_in: ep direction (USB_DIR_IN or 0)
515 */
516static void inc_ep_stats_bytes(struct pxa_ep *ep, int count, int is_in)
517{
518	if (is_in)
519		ep->stats.in_bytes += count;
520	else
521		ep->stats.out_bytes += count;
522}
523
524/**
525 * pxa_ep_setup - Sets up an usb physical endpoint
526 * @ep: pxa27x physical endpoint
527 *
528 * Find the physical pxa27x ep, and setup its UDCCR
529 */
530static void pxa_ep_setup(struct pxa_ep *ep)
531{
532	u32 new_udccr;
533
534	new_udccr = ((ep->config << UDCCONR_CN_S) & UDCCONR_CN)
535		| ((ep->interface << UDCCONR_IN_S) & UDCCONR_IN)
536		| ((ep->alternate << UDCCONR_AISN_S) & UDCCONR_AISN)
537		| ((EPADDR(ep) << UDCCONR_EN_S) & UDCCONR_EN)
538		| ((EPXFERTYPE(ep) << UDCCONR_ET_S) & UDCCONR_ET)
539		| ((ep->dir_in) ? UDCCONR_ED : 0)
540		| ((ep->fifo_size << UDCCONR_MPS_S) & UDCCONR_MPS)
541		| UDCCONR_EE;
542
543	udc_ep_writel(ep, UDCCR, new_udccr);
544}
545
546/**
547 * pxa_eps_setup - Sets up all usb physical endpoints
548 * @dev: udc device
549 *
550 * Setup all pxa physical endpoints, except ep0
551 */
552static void pxa_eps_setup(struct pxa_udc *dev)
553{
554	unsigned int i;
555
556	dev_dbg(dev->dev, "%s: dev=%p\n", __func__, dev);
557
558	for (i = 1; i < NR_PXA_ENDPOINTS; i++)
559		pxa_ep_setup(&dev->pxa_ep[i]);
560}
561
562/**
563 * pxa_ep_alloc_request - Allocate usb request
564 * @_ep: usb endpoint
565 * @gfp_flags:
566 *
567 * For the pxa27x, these can just wrap kmalloc/kfree.  gadget drivers
568 * must still pass correctly initialized endpoints, since other controller
569 * drivers may care about how it's currently set up (dma issues etc).
570  */
571static struct usb_request *
572pxa_ep_alloc_request(struct usb_ep *_ep, gfp_t gfp_flags)
573{
574	struct pxa27x_request *req;
575
576	req = kzalloc(sizeof *req, gfp_flags);
577	if (!req)
578		return NULL;
579
580	INIT_LIST_HEAD(&req->queue);
581	req->in_use = 0;
582	req->udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
583
584	return &req->req;
585}
586
587/**
588 * pxa_ep_free_request - Free usb request
589 * @_ep: usb endpoint
590 * @_req: usb request
591 *
592 * Wrapper around kfree to free _req
593 */
594static void pxa_ep_free_request(struct usb_ep *_ep, struct usb_request *_req)
595{
596	struct pxa27x_request *req;
597
598	req = container_of(_req, struct pxa27x_request, req);
599	WARN_ON(!list_empty(&req->queue));
600	kfree(req);
601}
602
603/**
604 * ep_add_request - add a request to the endpoint's queue
605 * @ep: usb endpoint
606 * @req: usb request
607 *
608 * Context: ep->lock held
609 *
610 * Queues the request in the endpoint's queue, and enables the interrupts
611 * on the endpoint.
612 */
613static void ep_add_request(struct pxa_ep *ep, struct pxa27x_request *req)
614{
615	if (unlikely(!req))
616		return;
617	ep_vdbg(ep, "req:%p, lg=%d, udccsr=0x%03x\n", req,
618		req->req.length, udc_ep_readl(ep, UDCCSR));
619
620	req->in_use = 1;
621	list_add_tail(&req->queue, &ep->queue);
622	pio_irq_enable(ep);
623}
624
625/**
626 * ep_del_request - removes a request from the endpoint's queue
627 * @ep: usb endpoint
628 * @req: usb request
629 *
630 * Context: ep->lock held
631 *
632 * Unqueue the request from the endpoint's queue. If there are no more requests
633 * on the endpoint, and if it's not the control endpoint, interrupts are
634 * disabled on the endpoint.
635 */
636static void ep_del_request(struct pxa_ep *ep, struct pxa27x_request *req)
637{
638	if (unlikely(!req))
639		return;
640	ep_vdbg(ep, "req:%p, lg=%d, udccsr=0x%03x\n", req,
641		req->req.length, udc_ep_readl(ep, UDCCSR));
642
643	list_del_init(&req->queue);
644	req->in_use = 0;
645	if (!is_ep0(ep) && list_empty(&ep->queue))
646		pio_irq_disable(ep);
647}
648
649/**
650 * req_done - Complete an usb request
651 * @ep: pxa physical endpoint
652 * @req: pxa request
653 * @status: usb request status sent to gadget API
654 * @pflags: flags of previous spinlock_irq_save() or NULL if no lock held
655 *
656 * Context: ep->lock held if flags not NULL, else ep->lock released
657 *
658 * Retire a pxa27x usb request. Endpoint must be locked.
659 */
660static void req_done(struct pxa_ep *ep, struct pxa27x_request *req, int status,
661	unsigned long *pflags)
662{
663	unsigned long	flags;
664
665	ep_del_request(ep, req);
666	if (likely(req->req.status == -EINPROGRESS))
667		req->req.status = status;
668	else
669		status = req->req.status;
670
671	if (status && status != -ESHUTDOWN)
672		ep_dbg(ep, "complete req %p stat %d len %u/%u\n",
673			&req->req, status,
674			req->req.actual, req->req.length);
675
676	if (pflags)
677		spin_unlock_irqrestore(&ep->lock, *pflags);
678	local_irq_save(flags);
679	usb_gadget_giveback_request(&req->udc_usb_ep->usb_ep, &req->req);
680	local_irq_restore(flags);
681	if (pflags)
682		spin_lock_irqsave(&ep->lock, *pflags);
683}
684
685/**
686 * ep_end_out_req - Ends endpoint OUT request
687 * @ep: physical endpoint
688 * @req: pxa request
689 * @pflags: flags of previous spinlock_irq_save() or NULL if no lock held
690 *
691 * Context: ep->lock held or released (see req_done())
692 *
693 * Ends endpoint OUT request (completes usb request).
694 */
695static void ep_end_out_req(struct pxa_ep *ep, struct pxa27x_request *req,
696	unsigned long *pflags)
697{
698	inc_ep_stats_reqs(ep, !USB_DIR_IN);
699	req_done(ep, req, 0, pflags);
700}
701
702/**
703 * ep0_end_out_req - Ends control endpoint OUT request (ends data stage)
704 * @ep: physical endpoint
705 * @req: pxa request
706 * @pflags: flags of previous spinlock_irq_save() or NULL if no lock held
707 *
708 * Context: ep->lock held or released (see req_done())
709 *
710 * Ends control endpoint OUT request (completes usb request), and puts
711 * control endpoint into idle state
712 */
713static void ep0_end_out_req(struct pxa_ep *ep, struct pxa27x_request *req,
714	unsigned long *pflags)
715{
716	set_ep0state(ep->dev, OUT_STATUS_STAGE);
717	ep_end_out_req(ep, req, pflags);
718	ep0_idle(ep->dev);
719}
720
721/**
722 * ep_end_in_req - Ends endpoint IN request
723 * @ep: physical endpoint
724 * @req: pxa request
725 * @pflags: flags of previous spinlock_irq_save() or NULL if no lock held
726 *
727 * Context: ep->lock held or released (see req_done())
728 *
729 * Ends endpoint IN request (completes usb request).
730 */
731static void ep_end_in_req(struct pxa_ep *ep, struct pxa27x_request *req,
732	unsigned long *pflags)
733{
734	inc_ep_stats_reqs(ep, USB_DIR_IN);
735	req_done(ep, req, 0, pflags);
736}
737
738/**
739 * ep0_end_in_req - Ends control endpoint IN request (ends data stage)
740 * @ep: physical endpoint
741 * @req: pxa request
742 * @pflags: flags of previous spinlock_irq_save() or NULL if no lock held
743 *
744 * Context: ep->lock held or released (see req_done())
745 *
746 * Ends control endpoint IN request (completes usb request), and puts
747 * control endpoint into status state
748 */
749static void ep0_end_in_req(struct pxa_ep *ep, struct pxa27x_request *req,
750	unsigned long *pflags)
751{
752	set_ep0state(ep->dev, IN_STATUS_STAGE);
753	ep_end_in_req(ep, req, pflags);
754}
755
756/**
757 * nuke - Dequeue all requests
758 * @ep: pxa endpoint
759 * @status: usb request status
760 *
761 * Context: ep->lock released
762 *
763 * Dequeues all requests on an endpoint. As a side effect, interrupts will be
764 * disabled on that endpoint (because no more requests).
765 */
766static void nuke(struct pxa_ep *ep, int status)
767{
768	struct pxa27x_request	*req;
769	unsigned long		flags;
770
771	spin_lock_irqsave(&ep->lock, flags);
772	while (!list_empty(&ep->queue)) {
773		req = list_entry(ep->queue.next, struct pxa27x_request, queue);
774		req_done(ep, req, status, &flags);
775	}
776	spin_unlock_irqrestore(&ep->lock, flags);
777}
778
779/**
780 * read_packet - transfer 1 packet from an OUT endpoint into request
781 * @ep: pxa physical endpoint
782 * @req: usb request
783 *
784 * Takes bytes from OUT endpoint and transfers them info the usb request.
785 * If there is less space in request than bytes received in OUT endpoint,
786 * bytes are left in the OUT endpoint.
787 *
788 * Returns how many bytes were actually transferred
789 */
790static int read_packet(struct pxa_ep *ep, struct pxa27x_request *req)
791{
792	u32 *buf;
793	int bytes_ep, bufferspace, count, i;
794
795	bytes_ep = ep_count_bytes_remain(ep);
796	bufferspace = req->req.length - req->req.actual;
797
798	buf = (u32 *)(req->req.buf + req->req.actual);
799	prefetchw(buf);
800
801	if (likely(!ep_is_empty(ep)))
802		count = min(bytes_ep, bufferspace);
803	else /* zlp */
804		count = 0;
805
806	for (i = count; i > 0; i -= 4)
807		*buf++ = udc_ep_readl(ep, UDCDR);
808	req->req.actual += count;
809
810	ep_write_UDCCSR(ep, UDCCSR_PC);
811
812	return count;
813}
814
815/**
816 * write_packet - transfer 1 packet from request into an IN endpoint
817 * @ep: pxa physical endpoint
818 * @req: usb request
819 * @max: max bytes that fit into endpoint
820 *
821 * Takes bytes from usb request, and transfers them into the physical
822 * endpoint. If there are no bytes to transfer, doesn't write anything
823 * to physical endpoint.
824 *
825 * Returns how many bytes were actually transferred.
826 */
827static int write_packet(struct pxa_ep *ep, struct pxa27x_request *req,
828			unsigned int max)
829{
830	int length, count, remain, i;
831	u32 *buf;
832	u8 *buf_8;
833
834	buf = (u32 *)(req->req.buf + req->req.actual);
835	prefetch(buf);
836
837	length = min(req->req.length - req->req.actual, max);
838	req->req.actual += length;
839
840	remain = length & 0x3;
841	count = length & ~(0x3);
842	for (i = count; i > 0 ; i -= 4)
843		udc_ep_writel(ep, UDCDR, *buf++);
844
845	buf_8 = (u8 *)buf;
846	for (i = remain; i > 0; i--)
847		udc_ep_writeb(ep, UDCDR, *buf_8++);
848
849	ep_vdbg(ep, "length=%d+%d, udccsr=0x%03x\n", count, remain,
850		udc_ep_readl(ep, UDCCSR));
851
852	return length;
853}
854
855/**
856 * read_fifo - Transfer packets from OUT endpoint into usb request
857 * @ep: pxa physical endpoint
858 * @req: usb request
859 *
860 * Context: interrupt handler
861 *
862 * Unload as many packets as possible from the fifo we use for usb OUT
863 * transfers and put them into the request. Caller should have made sure
864 * there's at least one packet ready.
865 * Doesn't complete the request, that's the caller's job
866 *
867 * Returns 1 if the request completed, 0 otherwise
868 */
869static int read_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
870{
871	int count, is_short, completed = 0;
872
873	while (epout_has_pkt(ep)) {
874		count = read_packet(ep, req);
875		inc_ep_stats_bytes(ep, count, !USB_DIR_IN);
876
877		is_short = (count < ep->fifo_size);
878		ep_dbg(ep, "read udccsr:%03x, count:%d bytes%s req %p %d/%d\n",
879			udc_ep_readl(ep, UDCCSR), count, is_short ? "/S" : "",
880			&req->req, req->req.actual, req->req.length);
881
882		/* completion */
883		if (is_short || req->req.actual == req->req.length) {
884			completed = 1;
885			break;
886		}
887		/* finished that packet.  the next one may be waiting... */
888	}
889	return completed;
890}
891
892/**
893 * write_fifo - transfer packets from usb request into an IN endpoint
894 * @ep: pxa physical endpoint
895 * @req: pxa usb request
896 *
897 * Write to an IN endpoint fifo, as many packets as possible.
898 * irqs will use this to write the rest later.
899 * caller guarantees at least one packet buffer is ready (or a zlp).
900 * Doesn't complete the request, that's the caller's job
901 *
902 * Returns 1 if request fully transferred, 0 if partial transfer
903 */
904static int write_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
905{
906	unsigned max;
907	int count, is_short, is_last = 0, completed = 0, totcount = 0;
908	u32 udccsr;
909
910	max = ep->fifo_size;
911	do {
912		udccsr = udc_ep_readl(ep, UDCCSR);
913		if (udccsr & UDCCSR_PC) {
914			ep_vdbg(ep, "Clearing Transmit Complete, udccsr=%x\n",
915				udccsr);
916			ep_write_UDCCSR(ep, UDCCSR_PC);
917		}
918		if (udccsr & UDCCSR_TRN) {
919			ep_vdbg(ep, "Clearing Underrun on, udccsr=%x\n",
920				udccsr);
921			ep_write_UDCCSR(ep, UDCCSR_TRN);
922		}
923
924		count = write_packet(ep, req, max);
925		inc_ep_stats_bytes(ep, count, USB_DIR_IN);
926		totcount += count;
927
928		/* last packet is usually short (or a zlp) */
929		if (unlikely(count < max)) {
930			is_last = 1;
931			is_short = 1;
932		} else {
933			if (likely(req->req.length > req->req.actual)
934					|| req->req.zero)
935				is_last = 0;
936			else
937				is_last = 1;
938			/* interrupt/iso maxpacket may not fill the fifo */
939			is_short = unlikely(max < ep->fifo_size);
940		}
941
942		if (is_short)
943			ep_write_UDCCSR(ep, UDCCSR_SP);
944
945		/* requests complete when all IN data is in the FIFO */
946		if (is_last) {
947			completed = 1;
948			break;
949		}
950	} while (!ep_is_full(ep));
951
952	ep_dbg(ep, "wrote count:%d bytes%s%s, left:%d req=%p\n",
953			totcount, is_last ? "/L" : "", is_short ? "/S" : "",
954			req->req.length - req->req.actual, &req->req);
955
956	return completed;
957}
958
959/**
960 * read_ep0_fifo - Transfer packets from control endpoint into usb request
961 * @ep: control endpoint
962 * @req: pxa usb request
963 *
964 * Special ep0 version of the above read_fifo. Reads as many bytes from control
965 * endpoint as can be read, and stores them into usb request (limited by request
966 * maximum length).
967 *
968 * Returns 0 if usb request only partially filled, 1 if fully filled
969 */
970static int read_ep0_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
971{
972	int count, is_short, completed = 0;
973
974	while (epout_has_pkt(ep)) {
975		count = read_packet(ep, req);
976		ep_write_UDCCSR(ep, UDCCSR0_OPC);
977		inc_ep_stats_bytes(ep, count, !USB_DIR_IN);
978
979		is_short = (count < ep->fifo_size);
980		ep_dbg(ep, "read udccsr:%03x, count:%d bytes%s req %p %d/%d\n",
981			udc_ep_readl(ep, UDCCSR), count, is_short ? "/S" : "",
982			&req->req, req->req.actual, req->req.length);
983
984		if (is_short || req->req.actual >= req->req.length) {
985			completed = 1;
986			break;
987		}
988	}
989
990	return completed;
991}
992
993/**
994 * write_ep0_fifo - Send a request to control endpoint (ep0 in)
995 * @ep: control endpoint
996 * @req: request
997 *
998 * Context: interrupt handler
999 *
1000 * Sends a request (or a part of the request) to the control endpoint (ep0 in).
1001 * If the request doesn't fit, the remaining part will be sent from irq.
1002 * The request is considered fully written only if either :
1003 *   - last write transferred all remaining bytes, but fifo was not fully filled
1004 *   - last write was a 0 length write
1005 *
1006 * Returns 1 if request fully written, 0 if request only partially sent
1007 */
1008static int write_ep0_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
1009{
1010	unsigned	count;
1011	int		is_last, is_short;
1012
1013	count = write_packet(ep, req, EP0_FIFO_SIZE);
1014	inc_ep_stats_bytes(ep, count, USB_DIR_IN);
1015
1016	is_short = (count < EP0_FIFO_SIZE);
1017	is_last = ((count == 0) || (count < EP0_FIFO_SIZE));
1018
1019	/* Sends either a short packet or a 0 length packet */
1020	if (unlikely(is_short))
1021		ep_write_UDCCSR(ep, UDCCSR0_IPR);
1022
1023	ep_dbg(ep, "in %d bytes%s%s, %d left, req=%p, udccsr0=0x%03x\n",
1024		count, is_short ? "/S" : "", is_last ? "/L" : "",
1025		req->req.length - req->req.actual,
1026		&req->req, udc_ep_readl(ep, UDCCSR));
1027
1028	return is_last;
1029}
1030
1031/**
1032 * pxa_ep_queue - Queue a request into an IN endpoint
1033 * @_ep: usb endpoint
1034 * @_req: usb request
1035 * @gfp_flags: flags
1036 *
1037 * Context: thread context or from the interrupt handler in the
1038 * special case of ep0 setup :
1039 *   (irq->handle_ep0_ctrl_req->gadget_setup->pxa_ep_queue)
1040 *
1041 * Returns 0 if succedeed, error otherwise
1042 */
1043static int pxa_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
1044			gfp_t gfp_flags)
1045{
1046	struct udc_usb_ep	*udc_usb_ep;
1047	struct pxa_ep		*ep;
1048	struct pxa27x_request	*req;
1049	struct pxa_udc		*dev;
1050	unsigned long		flags;
1051	int			rc = 0;
1052	int			is_first_req;
1053	unsigned		length;
1054	int			recursion_detected;
1055
1056	req = container_of(_req, struct pxa27x_request, req);
1057	udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
1058
1059	if (unlikely(!_req || !_req->complete || !_req->buf))
1060		return -EINVAL;
1061
1062	if (unlikely(!_ep))
1063		return -EINVAL;
1064
1065	ep = udc_usb_ep->pxa_ep;
1066	if (unlikely(!ep))
1067		return -EINVAL;
1068
1069	dev = ep->dev;
1070	if (unlikely(!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)) {
1071		ep_dbg(ep, "bogus device state\n");
1072		return -ESHUTDOWN;
1073	}
1074
1075	/* iso is always one packet per request, that's the only way
1076	 * we can report per-packet status.  that also helps with dma.
1077	 */
1078	if (unlikely(EPXFERTYPE_is_ISO(ep)
1079			&& req->req.length > ep->fifo_size))
1080		return -EMSGSIZE;
1081
1082	spin_lock_irqsave(&ep->lock, flags);
1083	recursion_detected = ep->in_handle_ep;
1084
1085	is_first_req = list_empty(&ep->queue);
1086	ep_dbg(ep, "queue req %p(first=%s), len %d buf %p\n",
1087			_req, is_first_req ? "yes" : "no",
1088			_req->length, _req->buf);
1089
1090	if (!ep->enabled) {
1091		_req->status = -ESHUTDOWN;
1092		rc = -ESHUTDOWN;
1093		goto out_locked;
1094	}
1095
1096	if (req->in_use) {
1097		ep_err(ep, "refusing to queue req %p (already queued)\n", req);
1098		goto out_locked;
1099	}
1100
1101	length = _req->length;
1102	_req->status = -EINPROGRESS;
1103	_req->actual = 0;
1104
1105	ep_add_request(ep, req);
1106	spin_unlock_irqrestore(&ep->lock, flags);
1107
1108	if (is_ep0(ep)) {
1109		switch (dev->ep0state) {
1110		case WAIT_ACK_SET_CONF_INTERF:
1111			if (length == 0) {
1112				ep_end_in_req(ep, req, NULL);
1113			} else {
1114				ep_err(ep, "got a request of %d bytes while"
1115					"in state WAIT_ACK_SET_CONF_INTERF\n",
1116					length);
1117				ep_del_request(ep, req);
1118				rc = -EL2HLT;
1119			}
1120			ep0_idle(ep->dev);
1121			break;
1122		case IN_DATA_STAGE:
1123			if (!ep_is_full(ep))
1124				if (write_ep0_fifo(ep, req))
1125					ep0_end_in_req(ep, req, NULL);
1126			break;
1127		case OUT_DATA_STAGE:
1128			if ((length == 0) || !epout_has_pkt(ep))
1129				if (read_ep0_fifo(ep, req))
1130					ep0_end_out_req(ep, req, NULL);
1131			break;
1132		default:
1133			ep_err(ep, "odd state %s to send me a request\n",
1134				EP0_STNAME(ep->dev));
1135			ep_del_request(ep, req);
1136			rc = -EL2HLT;
1137			break;
1138		}
1139	} else {
1140		if (!recursion_detected)
1141			handle_ep(ep);
1142	}
1143
1144out:
1145	return rc;
1146out_locked:
1147	spin_unlock_irqrestore(&ep->lock, flags);
1148	goto out;
1149}
1150
1151/**
1152 * pxa_ep_dequeue - Dequeue one request
1153 * @_ep: usb endpoint
1154 * @_req: usb request
1155 *
1156 * Return 0 if no error, -EINVAL or -ECONNRESET otherwise
1157 */
1158static int pxa_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
1159{
1160	struct pxa_ep		*ep;
1161	struct udc_usb_ep	*udc_usb_ep;
1162	struct pxa27x_request	*req = NULL, *iter;
1163	unsigned long		flags;
1164	int			rc = -EINVAL;
1165
1166	if (!_ep)
1167		return rc;
1168	udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
1169	ep = udc_usb_ep->pxa_ep;
1170	if (!ep || is_ep0(ep))
1171		return rc;
1172
1173	spin_lock_irqsave(&ep->lock, flags);
1174
1175	/* make sure it's actually queued on this endpoint */
1176	list_for_each_entry(iter, &ep->queue, queue) {
1177		if (&iter->req != _req)
1178			continue;
1179		req = iter;
1180		rc = 0;
1181		break;
1182	}
1183
1184	spin_unlock_irqrestore(&ep->lock, flags);
1185	if (!rc)
1186		req_done(ep, req, -ECONNRESET, NULL);
1187	return rc;
1188}
1189
1190/**
1191 * pxa_ep_set_halt - Halts operations on one endpoint
1192 * @_ep: usb endpoint
1193 * @value:
1194 *
1195 * Returns 0 if no error, -EINVAL, -EROFS, -EAGAIN otherwise
1196 */
1197static int pxa_ep_set_halt(struct usb_ep *_ep, int value)
1198{
1199	struct pxa_ep		*ep;
1200	struct udc_usb_ep	*udc_usb_ep;
1201	unsigned long flags;
1202	int rc;
1203
1204
1205	if (!_ep)
1206		return -EINVAL;
1207	udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
1208	ep = udc_usb_ep->pxa_ep;
1209	if (!ep || is_ep0(ep))
1210		return -EINVAL;
1211
1212	if (value == 0) {
1213		/*
1214		 * This path (reset toggle+halt) is needed to implement
1215		 * SET_INTERFACE on normal hardware.  but it can't be
1216		 * done from software on the PXA UDC, and the hardware
1217		 * forgets to do it as part of SET_INTERFACE automagic.
1218		 */
1219		ep_dbg(ep, "only host can clear halt\n");
1220		return -EROFS;
1221	}
1222
1223	spin_lock_irqsave(&ep->lock, flags);
1224
1225	rc = -EAGAIN;
1226	if (ep->dir_in	&& (ep_is_full(ep) || !list_empty(&ep->queue)))
1227		goto out;
1228
1229	/* FST, FEF bits are the same for control and non control endpoints */
1230	rc = 0;
1231	ep_write_UDCCSR(ep, UDCCSR_FST | UDCCSR_FEF);
1232	if (is_ep0(ep))
1233		set_ep0state(ep->dev, STALL);
1234
1235out:
1236	spin_unlock_irqrestore(&ep->lock, flags);
1237	return rc;
1238}
1239
1240/**
1241 * pxa_ep_fifo_status - Get how many bytes in physical endpoint
1242 * @_ep: usb endpoint
1243 *
1244 * Returns number of bytes in OUT fifos. Broken for IN fifos.
1245 */
1246static int pxa_ep_fifo_status(struct usb_ep *_ep)
1247{
1248	struct pxa_ep		*ep;
1249	struct udc_usb_ep	*udc_usb_ep;
1250
1251	if (!_ep)
1252		return -ENODEV;
1253	udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
1254	ep = udc_usb_ep->pxa_ep;
1255	if (!ep || is_ep0(ep))
1256		return -ENODEV;
1257
1258	if (ep->dir_in)
1259		return -EOPNOTSUPP;
1260	if (ep->dev->gadget.speed == USB_SPEED_UNKNOWN || ep_is_empty(ep))
1261		return 0;
1262	else
1263		return ep_count_bytes_remain(ep) + 1;
1264}
1265
1266/**
1267 * pxa_ep_fifo_flush - Flushes one endpoint
1268 * @_ep: usb endpoint
1269 *
1270 * Discards all data in one endpoint(IN or OUT), except control endpoint.
1271 */
1272static void pxa_ep_fifo_flush(struct usb_ep *_ep)
1273{
1274	struct pxa_ep		*ep;
1275	struct udc_usb_ep	*udc_usb_ep;
1276	unsigned long		flags;
1277
1278	if (!_ep)
1279		return;
1280	udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
1281	ep = udc_usb_ep->pxa_ep;
1282	if (!ep || is_ep0(ep))
1283		return;
1284
1285	spin_lock_irqsave(&ep->lock, flags);
1286
1287	if (unlikely(!list_empty(&ep->queue)))
1288		ep_dbg(ep, "called while queue list not empty\n");
1289	ep_dbg(ep, "called\n");
1290
1291	/* for OUT, just read and discard the FIFO contents. */
1292	if (!ep->dir_in) {
1293		while (!ep_is_empty(ep))
1294			udc_ep_readl(ep, UDCDR);
1295	} else {
1296		/* most IN status is the same, but ISO can't stall */
1297		ep_write_UDCCSR(ep,
1298				UDCCSR_PC | UDCCSR_FEF | UDCCSR_TRN
1299				| (EPXFERTYPE_is_ISO(ep) ? 0 : UDCCSR_SST));
1300	}
1301
1302	spin_unlock_irqrestore(&ep->lock, flags);
1303}
1304
1305/**
1306 * pxa_ep_enable - Enables usb endpoint
1307 * @_ep: usb endpoint
1308 * @desc: usb endpoint descriptor
1309 *
1310 * Nothing much to do here, as ep configuration is done once and for all
1311 * before udc is enabled. After udc enable, no physical endpoint configuration
1312 * can be changed.
1313 * Function makes sanity checks and flushes the endpoint.
1314 */
1315static int pxa_ep_enable(struct usb_ep *_ep,
1316	const struct usb_endpoint_descriptor *desc)
1317{
1318	struct pxa_ep		*ep;
1319	struct udc_usb_ep	*udc_usb_ep;
1320	struct pxa_udc		*udc;
1321
1322	if (!_ep || !desc)
1323		return -EINVAL;
1324
1325	udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
1326	if (udc_usb_ep->pxa_ep) {
1327		ep = udc_usb_ep->pxa_ep;
1328		ep_warn(ep, "usb_ep %s already enabled, doing nothing\n",
1329			_ep->name);
1330	} else {
1331		ep = find_pxa_ep(udc_usb_ep->dev, udc_usb_ep);
1332	}
1333
1334	if (!ep || is_ep0(ep)) {
1335		dev_err(udc_usb_ep->dev->dev,
1336			"unable to match pxa_ep for ep %s\n",
1337			_ep->name);
1338		return -EINVAL;
1339	}
1340
1341	if ((desc->bDescriptorType != USB_DT_ENDPOINT)
1342			|| (ep->type != usb_endpoint_type(desc))) {
1343		ep_err(ep, "type mismatch\n");
1344		return -EINVAL;
1345	}
1346
1347	if (ep->fifo_size < usb_endpoint_maxp(desc)) {
1348		ep_err(ep, "bad maxpacket\n");
1349		return -ERANGE;
1350	}
1351
1352	udc_usb_ep->pxa_ep = ep;
1353	udc = ep->dev;
1354
1355	if (!udc->driver || udc->gadget.speed == USB_SPEED_UNKNOWN) {
1356		ep_err(ep, "bogus device state\n");
1357		return -ESHUTDOWN;
1358	}
1359
1360	ep->enabled = 1;
1361
1362	/* flush fifo (mostly for OUT buffers) */
1363	pxa_ep_fifo_flush(_ep);
1364
1365	ep_dbg(ep, "enabled\n");
1366	return 0;
1367}
1368
1369/**
1370 * pxa_ep_disable - Disable usb endpoint
1371 * @_ep: usb endpoint
1372 *
1373 * Same as for pxa_ep_enable, no physical endpoint configuration can be
1374 * changed.
1375 * Function flushes the endpoint and related requests.
1376 */
1377static int pxa_ep_disable(struct usb_ep *_ep)
1378{
1379	struct pxa_ep		*ep;
1380	struct udc_usb_ep	*udc_usb_ep;
1381
1382	if (!_ep)
1383		return -EINVAL;
1384
1385	udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
1386	ep = udc_usb_ep->pxa_ep;
1387	if (!ep || is_ep0(ep) || !list_empty(&ep->queue))
1388		return -EINVAL;
1389
1390	ep->enabled = 0;
1391	nuke(ep, -ESHUTDOWN);
1392
1393	pxa_ep_fifo_flush(_ep);
1394	udc_usb_ep->pxa_ep = NULL;
1395
1396	ep_dbg(ep, "disabled\n");
1397	return 0;
1398}
1399
1400static const struct usb_ep_ops pxa_ep_ops = {
1401	.enable		= pxa_ep_enable,
1402	.disable	= pxa_ep_disable,
1403
1404	.alloc_request	= pxa_ep_alloc_request,
1405	.free_request	= pxa_ep_free_request,
1406
1407	.queue		= pxa_ep_queue,
1408	.dequeue	= pxa_ep_dequeue,
1409
1410	.set_halt	= pxa_ep_set_halt,
1411	.fifo_status	= pxa_ep_fifo_status,
1412	.fifo_flush	= pxa_ep_fifo_flush,
1413};
1414
1415/**
1416 * dplus_pullup - Connect or disconnect pullup resistor to D+ pin
1417 * @udc: udc device
1418 * @on: 0 if disconnect pullup resistor, 1 otherwise
1419 * Context: any
1420 *
1421 * Handle D+ pullup resistor, make the device visible to the usb bus, and
1422 * declare it as a full speed usb device
1423 */
1424static void dplus_pullup(struct pxa_udc *udc, int on)
1425{
1426	if (udc->gpiod) {
1427		gpiod_set_value(udc->gpiod, on);
1428	} else if (udc->udc_command) {
1429		if (on)
1430			udc->udc_command(PXA2XX_UDC_CMD_CONNECT);
1431		else
1432			udc->udc_command(PXA2XX_UDC_CMD_DISCONNECT);
1433	}
1434	udc->pullup_on = on;
1435}
1436
1437/**
1438 * pxa_udc_get_frame - Returns usb frame number
1439 * @_gadget: usb gadget
1440 */
1441static int pxa_udc_get_frame(struct usb_gadget *_gadget)
1442{
1443	struct pxa_udc *udc = to_gadget_udc(_gadget);
1444
1445	return (udc_readl(udc, UDCFNR) & 0x7ff);
1446}
1447
1448/**
1449 * pxa_udc_wakeup - Force udc device out of suspend
1450 * @_gadget: usb gadget
1451 *
1452 * Returns 0 if successful, error code otherwise
1453 */
1454static int pxa_udc_wakeup(struct usb_gadget *_gadget)
1455{
1456	struct pxa_udc *udc = to_gadget_udc(_gadget);
1457
1458	/* host may not have enabled remote wakeup */
1459	if ((udc_readl(udc, UDCCR) & UDCCR_DWRE) == 0)
1460		return -EHOSTUNREACH;
1461	udc_set_mask_UDCCR(udc, UDCCR_UDR);
1462	return 0;
1463}
1464
1465static void udc_enable(struct pxa_udc *udc);
1466static void udc_disable(struct pxa_udc *udc);
1467
1468/**
1469 * should_enable_udc - Tells if UDC should be enabled
1470 * @udc: udc device
1471 * Context: any
1472 *
1473 * The UDC should be enabled if :
1474 *  - the pullup resistor is connected
1475 *  - and a gadget driver is bound
1476 *  - and vbus is sensed (or no vbus sense is available)
1477 *
1478 * Returns 1 if UDC should be enabled, 0 otherwise
1479 */
1480static int should_enable_udc(struct pxa_udc *udc)
1481{
1482	int put_on;
1483
1484	put_on = ((udc->pullup_on) && (udc->driver));
1485	put_on &= ((udc->vbus_sensed) || (IS_ERR_OR_NULL(udc->transceiver)));
1486	return put_on;
1487}
1488
1489/**
1490 * should_disable_udc - Tells if UDC should be disabled
1491 * @udc: udc device
1492 * Context: any
1493 *
1494 * The UDC should be disabled if :
1495 *  - the pullup resistor is not connected
1496 *  - or no gadget driver is bound
1497 *  - or no vbus is sensed (when vbus sesing is available)
1498 *
1499 * Returns 1 if UDC should be disabled
1500 */
1501static int should_disable_udc(struct pxa_udc *udc)
1502{
1503	int put_off;
1504
1505	put_off = ((!udc->pullup_on) || (!udc->driver));
1506	put_off |= ((!udc->vbus_sensed) && (!IS_ERR_OR_NULL(udc->transceiver)));
1507	return put_off;
1508}
1509
1510/**
1511 * pxa_udc_pullup - Offer manual D+ pullup control
1512 * @_gadget: usb gadget using the control
1513 * @is_active: 0 if disconnect, else connect D+ pullup resistor
1514 *
1515 * Context: task context, might sleep
1516 *
1517 * Returns 0 if OK, -EOPNOTSUPP if udc driver doesn't handle D+ pullup
1518 */
1519static int pxa_udc_pullup(struct usb_gadget *_gadget, int is_active)
1520{
1521	struct pxa_udc *udc = to_gadget_udc(_gadget);
1522
1523	if (!udc->gpiod && !udc->udc_command)
1524		return -EOPNOTSUPP;
1525
1526	dplus_pullup(udc, is_active);
1527
1528	if (should_enable_udc(udc))
1529		udc_enable(udc);
1530	if (should_disable_udc(udc))
1531		udc_disable(udc);
1532	return 0;
1533}
1534
1535/**
1536 * pxa_udc_vbus_session - Called by external transceiver to enable/disable udc
1537 * @_gadget: usb gadget
1538 * @is_active: 0 if should disable the udc, 1 if should enable
1539 *
1540 * Enables the udc, and optionnaly activates D+ pullup resistor. Or disables the
1541 * udc, and deactivates D+ pullup resistor.
1542 *
1543 * Returns 0
1544 */
1545static int pxa_udc_vbus_session(struct usb_gadget *_gadget, int is_active)
1546{
1547	struct pxa_udc *udc = to_gadget_udc(_gadget);
1548
1549	udc->vbus_sensed = is_active;
1550	if (should_enable_udc(udc))
1551		udc_enable(udc);
1552	if (should_disable_udc(udc))
1553		udc_disable(udc);
1554
1555	return 0;
1556}
1557
1558/**
1559 * pxa_udc_vbus_draw - Called by gadget driver after SET_CONFIGURATION completed
1560 * @_gadget: usb gadget
1561 * @mA: current drawn
1562 *
1563 * Context: task context, might sleep
1564 *
1565 * Called after a configuration was chosen by a USB host, to inform how much
1566 * current can be drawn by the device from VBus line.
1567 *
1568 * Returns 0 or -EOPNOTSUPP if no transceiver is handling the udc
1569 */
1570static int pxa_udc_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
1571{
1572	struct pxa_udc *udc;
1573
1574	udc = to_gadget_udc(_gadget);
1575	if (!IS_ERR_OR_NULL(udc->transceiver))
1576		return usb_phy_set_power(udc->transceiver, mA);
1577	return -EOPNOTSUPP;
1578}
1579
1580/**
1581 * pxa_udc_phy_event - Called by phy upon VBus event
1582 * @nb: notifier block
1583 * @action: phy action, is vbus connect or disconnect
1584 * @data: the usb_gadget structure in pxa_udc
1585 *
1586 * Called by the USB Phy when a cable connect or disconnect is sensed.
1587 *
1588 * Returns 0
1589 */
1590static int pxa_udc_phy_event(struct notifier_block *nb, unsigned long action,
1591			     void *data)
1592{
1593	struct usb_gadget *gadget = data;
1594
1595	switch (action) {
1596	case USB_EVENT_VBUS:
1597		usb_gadget_vbus_connect(gadget);
1598		return NOTIFY_OK;
1599	case USB_EVENT_NONE:
1600		usb_gadget_vbus_disconnect(gadget);
1601		return NOTIFY_OK;
1602	default:
1603		return NOTIFY_DONE;
1604	}
1605}
1606
1607static struct notifier_block pxa27x_udc_phy = {
1608	.notifier_call = pxa_udc_phy_event,
1609};
1610
1611static int pxa27x_udc_start(struct usb_gadget *g,
1612		struct usb_gadget_driver *driver);
1613static int pxa27x_udc_stop(struct usb_gadget *g);
1614
1615static const struct usb_gadget_ops pxa_udc_ops = {
1616	.get_frame	= pxa_udc_get_frame,
1617	.wakeup		= pxa_udc_wakeup,
1618	.pullup		= pxa_udc_pullup,
1619	.vbus_session	= pxa_udc_vbus_session,
1620	.vbus_draw	= pxa_udc_vbus_draw,
1621	.udc_start	= pxa27x_udc_start,
1622	.udc_stop	= pxa27x_udc_stop,
1623};
1624
1625/**
1626 * udc_disable - disable udc device controller
1627 * @udc: udc device
1628 * Context: any
1629 *
1630 * Disables the udc device : disables clocks, udc interrupts, control endpoint
1631 * interrupts.
1632 */
1633static void udc_disable(struct pxa_udc *udc)
1634{
1635	if (!udc->enabled)
1636		return;
1637
1638	udc_writel(udc, UDCICR0, 0);
1639	udc_writel(udc, UDCICR1, 0);
1640
1641	udc_clear_mask_UDCCR(udc, UDCCR_UDE);
1642
1643	ep0_idle(udc);
1644	udc->gadget.speed = USB_SPEED_UNKNOWN;
1645	clk_disable(udc->clk);
1646
1647	udc->enabled = 0;
1648}
1649
1650/**
1651 * udc_init_data - Initialize udc device data structures
1652 * @dev: udc device
1653 *
1654 * Initializes gadget endpoint list, endpoints locks. No action is taken
1655 * on the hardware.
1656 */
1657static void udc_init_data(struct pxa_udc *dev)
1658{
1659	int i;
1660	struct pxa_ep *ep;
1661
1662	/* device/ep0 records init */
1663	INIT_LIST_HEAD(&dev->gadget.ep_list);
1664	INIT_LIST_HEAD(&dev->gadget.ep0->ep_list);
1665	dev->udc_usb_ep[0].pxa_ep = &dev->pxa_ep[0];
1666	dev->gadget.quirk_altset_not_supp = 1;
1667	ep0_idle(dev);
1668
1669	/* PXA endpoints init */
1670	for (i = 0; i < NR_PXA_ENDPOINTS; i++) {
1671		ep = &dev->pxa_ep[i];
1672
1673		ep->enabled = is_ep0(ep);
1674		INIT_LIST_HEAD(&ep->queue);
1675		spin_lock_init(&ep->lock);
1676	}
1677
1678	/* USB endpoints init */
1679	for (i = 1; i < NR_USB_ENDPOINTS; i++) {
1680		list_add_tail(&dev->udc_usb_ep[i].usb_ep.ep_list,
1681				&dev->gadget.ep_list);
1682		usb_ep_set_maxpacket_limit(&dev->udc_usb_ep[i].usb_ep,
1683					   dev->udc_usb_ep[i].usb_ep.maxpacket);
1684	}
1685}
1686
1687/**
1688 * udc_enable - Enables the udc device
1689 * @udc: udc device
1690 *
1691 * Enables the udc device : enables clocks, udc interrupts, control endpoint
1692 * interrupts, sets usb as UDC client and setups endpoints.
1693 */
1694static void udc_enable(struct pxa_udc *udc)
1695{
1696	if (udc->enabled)
1697		return;
1698
1699	clk_enable(udc->clk);
1700	udc_writel(udc, UDCICR0, 0);
1701	udc_writel(udc, UDCICR1, 0);
1702	udc_clear_mask_UDCCR(udc, UDCCR_UDE);
1703
1704	ep0_idle(udc);
1705	udc->gadget.speed = USB_SPEED_FULL;
1706	memset(&udc->stats, 0, sizeof(udc->stats));
1707
1708	pxa_eps_setup(udc);
1709	udc_set_mask_UDCCR(udc, UDCCR_UDE);
1710	ep_write_UDCCSR(&udc->pxa_ep[0], UDCCSR0_ACM);
1711	udelay(2);
1712	if (udc_readl(udc, UDCCR) & UDCCR_EMCE)
1713		dev_err(udc->dev, "Configuration errors, udc disabled\n");
1714
1715	/*
1716	 * Caller must be able to sleep in order to cope with startup transients
1717	 */
1718	msleep(100);
1719
1720	/* enable suspend/resume and reset irqs */
1721	udc_writel(udc, UDCICR1,
1722			UDCICR1_IECC | UDCICR1_IERU
1723			| UDCICR1_IESU | UDCICR1_IERS);
1724
1725	/* enable ep0 irqs */
1726	pio_irq_enable(&udc->pxa_ep[0]);
1727
1728	udc->enabled = 1;
1729}
1730
1731/**
1732 * pxa27x_udc_start - Register gadget driver
1733 * @g: gadget
1734 * @driver: gadget driver
1735 *
1736 * When a driver is successfully registered, it will receive control requests
1737 * including set_configuration(), which enables non-control requests.  Then
1738 * usb traffic follows until a disconnect is reported.  Then a host may connect
1739 * again, or the driver might get unbound.
1740 *
1741 * Note that the udc is not automatically enabled. Check function
1742 * should_enable_udc().
1743 *
1744 * Returns 0 if no error, -EINVAL, -ENODEV, -EBUSY otherwise
1745 */
1746static int pxa27x_udc_start(struct usb_gadget *g,
1747		struct usb_gadget_driver *driver)
1748{
1749	struct pxa_udc *udc = to_pxa(g);
1750	int retval;
1751
1752	/* first hook up the driver ... */
1753	udc->driver = driver;
1754
1755	if (!IS_ERR_OR_NULL(udc->transceiver)) {
1756		retval = otg_set_peripheral(udc->transceiver->otg,
1757						&udc->gadget);
1758		if (retval) {
1759			dev_err(udc->dev, "can't bind to transceiver\n");
1760			goto fail;
1761		}
1762	}
1763
1764	if (should_enable_udc(udc))
1765		udc_enable(udc);
1766	return 0;
1767
1768fail:
1769	udc->driver = NULL;
1770	return retval;
1771}
1772
1773/**
1774 * stop_activity - Stops udc endpoints
1775 * @udc: udc device
1776 *
1777 * Disables all udc endpoints (even control endpoint), report disconnect to
1778 * the gadget user.
1779 */
1780static void stop_activity(struct pxa_udc *udc)
1781{
1782	int i;
1783
1784	udc->gadget.speed = USB_SPEED_UNKNOWN;
1785
1786	for (i = 0; i < NR_USB_ENDPOINTS; i++)
1787		pxa_ep_disable(&udc->udc_usb_ep[i].usb_ep);
1788}
1789
1790/**
1791 * pxa27x_udc_stop - Unregister the gadget driver
1792 * @g: gadget
1793 *
1794 * Returns 0 if no error, -ENODEV, -EINVAL otherwise
1795 */
1796static int pxa27x_udc_stop(struct usb_gadget *g)
1797{
1798	struct pxa_udc *udc = to_pxa(g);
1799
1800	stop_activity(udc);
1801	udc_disable(udc);
1802
1803	udc->driver = NULL;
1804
1805	if (!IS_ERR_OR_NULL(udc->transceiver))
1806		return otg_set_peripheral(udc->transceiver->otg, NULL);
1807	return 0;
1808}
1809
1810/**
1811 * handle_ep0_ctrl_req - handle control endpoint control request
1812 * @udc: udc device
1813 * @req: control request
1814 */
1815static void handle_ep0_ctrl_req(struct pxa_udc *udc,
1816				struct pxa27x_request *req)
1817{
1818	struct pxa_ep *ep = &udc->pxa_ep[0];
1819	union {
1820		struct usb_ctrlrequest	r;
1821		u32			word[2];
1822	} u;
1823	int i;
1824	int have_extrabytes = 0;
1825	unsigned long flags;
1826
1827	nuke(ep, -EPROTO);
1828	spin_lock_irqsave(&ep->lock, flags);
1829
1830	/*
1831	 * In the PXA320 manual, in the section about Back-to-Back setup
1832	 * packets, it describes this situation.  The solution is to set OPC to
1833	 * get rid of the status packet, and then continue with the setup
1834	 * packet. Generalize to pxa27x CPUs.
1835	 */
1836	if (epout_has_pkt(ep) && (ep_count_bytes_remain(ep) == 0))
1837		ep_write_UDCCSR(ep, UDCCSR0_OPC);
1838
1839	/* read SETUP packet */
1840	for (i = 0; i < 2; i++) {
1841		if (unlikely(ep_is_empty(ep)))
1842			goto stall;
1843		u.word[i] = udc_ep_readl(ep, UDCDR);
1844	}
1845
1846	have_extrabytes = !ep_is_empty(ep);
1847	while (!ep_is_empty(ep)) {
1848		i = udc_ep_readl(ep, UDCDR);
1849		ep_err(ep, "wrong to have extra bytes for setup : 0x%08x\n", i);
1850	}
1851
1852	ep_dbg(ep, "SETUP %02x.%02x v%04x i%04x l%04x\n",
1853		u.r.bRequestType, u.r.bRequest,
1854		le16_to_cpu(u.r.wValue), le16_to_cpu(u.r.wIndex),
1855		le16_to_cpu(u.r.wLength));
1856	if (unlikely(have_extrabytes))
1857		goto stall;
1858
1859	if (u.r.bRequestType & USB_DIR_IN)
1860		set_ep0state(udc, IN_DATA_STAGE);
1861	else
1862		set_ep0state(udc, OUT_DATA_STAGE);
1863
1864	/* Tell UDC to enter Data Stage */
1865	ep_write_UDCCSR(ep, UDCCSR0_SA | UDCCSR0_OPC);
1866
1867	spin_unlock_irqrestore(&ep->lock, flags);
1868	i = udc->driver->setup(&udc->gadget, &u.r);
1869	spin_lock_irqsave(&ep->lock, flags);
1870	if (i < 0)
1871		goto stall;
1872out:
1873	spin_unlock_irqrestore(&ep->lock, flags);
1874	return;
1875stall:
1876	ep_dbg(ep, "protocol STALL, udccsr0=%03x err %d\n",
1877		udc_ep_readl(ep, UDCCSR), i);
1878	ep_write_UDCCSR(ep, UDCCSR0_FST | UDCCSR0_FTF);
1879	set_ep0state(udc, STALL);
1880	goto out;
1881}
1882
1883/**
1884 * handle_ep0 - Handle control endpoint data transfers
1885 * @udc: udc device
1886 * @fifo_irq: 1 if triggered by fifo service type irq
1887 * @opc_irq: 1 if triggered by output packet complete type irq
1888 *
1889 * Context : interrupt handler
1890 *
1891 * Tries to transfer all pending request data into the endpoint and/or
1892 * transfer all pending data in the endpoint into usb requests.
1893 * Handles states of ep0 automata.
1894 *
1895 * PXA27x hardware handles several standard usb control requests without
1896 * driver notification.  The requests fully handled by hardware are :
1897 *  SET_ADDRESS, SET_FEATURE, CLEAR_FEATURE, GET_CONFIGURATION, GET_INTERFACE,
1898 *  GET_STATUS
1899 * The requests handled by hardware, but with irq notification are :
1900 *  SYNCH_FRAME, SET_CONFIGURATION, SET_INTERFACE
1901 * The remaining standard requests really handled by handle_ep0 are :
1902 *  GET_DESCRIPTOR, SET_DESCRIPTOR, specific requests.
1903 * Requests standardized outside of USB 2.0 chapter 9 are handled more
1904 * uniformly, by gadget drivers.
1905 *
1906 * The control endpoint state machine is _not_ USB spec compliant, it's even
1907 * hardly compliant with Intel PXA270 developers guide.
1908 * The key points which inferred this state machine are :
1909 *   - on every setup token, bit UDCCSR0_SA is raised and held until cleared by
1910 *     software.
1911 *   - on every OUT packet received, UDCCSR0_OPC is raised and held until
1912 *     cleared by software.
1913 *   - clearing UDCCSR0_OPC always flushes ep0. If in setup stage, never do it
1914 *     before reading ep0.
1915 *     This is true only for PXA27x. This is not true anymore for PXA3xx family
1916 *     (check Back-to-Back setup packet in developers guide).
1917 *   - irq can be called on a "packet complete" event (opc_irq=1), while
1918 *     UDCCSR0_OPC is not yet raised (delta can be as big as 100ms
1919 *     from experimentation).
1920 *   - as UDCCSR0_SA can be activated while in irq handling, and clearing
1921 *     UDCCSR0_OPC would flush the setup data, we almost never clear UDCCSR0_OPC
1922 *     => we never actually read the "status stage" packet of an IN data stage
1923 *     => this is not documented in Intel documentation
1924 *   - hardware as no idea of STATUS STAGE, it only handle SETUP STAGE and DATA
1925 *     STAGE. The driver add STATUS STAGE to send last zero length packet in
1926 *     OUT_STATUS_STAGE.
1927 *   - special attention was needed for IN_STATUS_STAGE. If a packet complete
1928 *     event is detected, we terminate the status stage without ackowledging the
1929 *     packet (not to risk to loose a potential SETUP packet)
1930 */
1931static void handle_ep0(struct pxa_udc *udc, int fifo_irq, int opc_irq)
1932{
1933	u32			udccsr0;
1934	struct pxa_ep		*ep = &udc->pxa_ep[0];
1935	struct pxa27x_request	*req = NULL;
1936	int			completed = 0;
1937
1938	if (!list_empty(&ep->queue))
1939		req = list_entry(ep->queue.next, struct pxa27x_request, queue);
1940
1941	udccsr0 = udc_ep_readl(ep, UDCCSR);
1942	ep_dbg(ep, "state=%s, req=%p, udccsr0=0x%03x, udcbcr=%d, irq_msk=%x\n",
1943		EP0_STNAME(udc), req, udccsr0, udc_ep_readl(ep, UDCBCR),
1944		(fifo_irq << 1 | opc_irq));
1945
1946	if (udccsr0 & UDCCSR0_SST) {
1947		ep_dbg(ep, "clearing stall status\n");
1948		nuke(ep, -EPIPE);
1949		ep_write_UDCCSR(ep, UDCCSR0_SST);
1950		ep0_idle(udc);
1951	}
1952
1953	if (udccsr0 & UDCCSR0_SA) {
1954		nuke(ep, 0);
1955		set_ep0state(udc, SETUP_STAGE);
1956	}
1957
1958	switch (udc->ep0state) {
1959	case WAIT_FOR_SETUP:
1960		/*
1961		 * Hardware bug : beware, we cannot clear OPC, since we would
1962		 * miss a potential OPC irq for a setup packet.
1963		 * So, we only do ... nothing, and hope for a next irq with
1964		 * UDCCSR0_SA set.
1965		 */
1966		break;
1967	case SETUP_STAGE:
1968		udccsr0 &= UDCCSR0_CTRL_REQ_MASK;
1969		if (likely(udccsr0 == UDCCSR0_CTRL_REQ_MASK))
1970			handle_ep0_ctrl_req(udc, req);
1971		break;
1972	case IN_DATA_STAGE:			/* GET_DESCRIPTOR */
1973		if (epout_has_pkt(ep))
1974			ep_write_UDCCSR(ep, UDCCSR0_OPC);
1975		if (req && !ep_is_full(ep))
1976			completed = write_ep0_fifo(ep, req);
1977		if (completed)
1978			ep0_end_in_req(ep, req, NULL);
1979		break;
1980	case OUT_DATA_STAGE:			/* SET_DESCRIPTOR */
1981		if (epout_has_pkt(ep) && req)
1982			completed = read_ep0_fifo(ep, req);
1983		if (completed)
1984			ep0_end_out_req(ep, req, NULL);
1985		break;
1986	case STALL:
1987		ep_write_UDCCSR(ep, UDCCSR0_FST);
1988		break;
1989	case IN_STATUS_STAGE:
1990		/*
1991		 * Hardware bug : beware, we cannot clear OPC, since we would
1992		 * miss a potential PC irq for a setup packet.
1993		 * So, we only put the ep0 into WAIT_FOR_SETUP state.
1994		 */
1995		if (opc_irq)
1996			ep0_idle(udc);
1997		break;
1998	case OUT_STATUS_STAGE:
1999	case WAIT_ACK_SET_CONF_INTERF:
2000		ep_warn(ep, "should never get in %s state here!!!\n",
2001				EP0_STNAME(ep->dev));
2002		ep0_idle(udc);
2003		break;
2004	}
2005}
2006
2007/**
2008 * handle_ep - Handle endpoint data tranfers
2009 * @ep: pxa physical endpoint
2010 *
2011 * Tries to transfer all pending request data into the endpoint and/or
2012 * transfer all pending data in the endpoint into usb requests.
2013 *
2014 * Is always called from the interrupt handler. ep->lock must not be held.
2015 */
2016static void handle_ep(struct pxa_ep *ep)
2017{
2018	struct pxa27x_request	*req;
2019	int completed;
2020	u32 udccsr;
2021	int is_in = ep->dir_in;
2022	int loop = 0;
2023	unsigned long		flags;
2024
2025	spin_lock_irqsave(&ep->lock, flags);
2026	if (ep->in_handle_ep)
2027		goto recursion_detected;
2028	ep->in_handle_ep = 1;
2029
2030	do {
2031		completed = 0;
2032		udccsr = udc_ep_readl(ep, UDCCSR);
2033
2034		if (likely(!list_empty(&ep->queue)))
2035			req = list_entry(ep->queue.next,
2036					struct pxa27x_request, queue);
2037		else
2038			req = NULL;
2039
2040		ep_dbg(ep, "req:%p, udccsr 0x%03x loop=%d\n",
2041				req, udccsr, loop++);
2042
2043		if (unlikely(udccsr & (UDCCSR_SST | UDCCSR_TRN)))
2044			udc_ep_writel(ep, UDCCSR,
2045					udccsr & (UDCCSR_SST | UDCCSR_TRN));
2046		if (!req)
2047			break;
2048
2049		if (unlikely(is_in)) {
2050			if (likely(!ep_is_full(ep)))
2051				completed = write_fifo(ep, req);
2052		} else {
2053			if (likely(epout_has_pkt(ep)))
2054				completed = read_fifo(ep, req);
2055		}
2056
2057		if (completed) {
2058			if (is_in)
2059				ep_end_in_req(ep, req, &flags);
2060			else
2061				ep_end_out_req(ep, req, &flags);
2062		}
2063	} while (completed);
2064
2065	ep->in_handle_ep = 0;
2066recursion_detected:
2067	spin_unlock_irqrestore(&ep->lock, flags);
2068}
2069
2070/**
2071 * pxa27x_change_configuration - Handle SET_CONF usb request notification
2072 * @udc: udc device
2073 * @config: usb configuration
2074 *
2075 * Post the request to upper level.
2076 * Don't use any pxa specific harware configuration capabilities
2077 */
2078static void pxa27x_change_configuration(struct pxa_udc *udc, int config)
2079{
2080	struct usb_ctrlrequest req ;
2081
2082	dev_dbg(udc->dev, "config=%d\n", config);
2083
2084	udc->config = config;
2085	udc->last_interface = 0;
2086	udc->last_alternate = 0;
2087
2088	req.bRequestType = 0;
2089	req.bRequest = USB_REQ_SET_CONFIGURATION;
2090	req.wValue = config;
2091	req.wIndex = 0;
2092	req.wLength = 0;
2093
2094	set_ep0state(udc, WAIT_ACK_SET_CONF_INTERF);
2095	udc->driver->setup(&udc->gadget, &req);
2096	ep_write_UDCCSR(&udc->pxa_ep[0], UDCCSR0_AREN);
2097}
2098
2099/**
2100 * pxa27x_change_interface - Handle SET_INTERF usb request notification
2101 * @udc: udc device
2102 * @iface: interface number
2103 * @alt: alternate setting number
2104 *
2105 * Post the request to upper level.
2106 * Don't use any pxa specific harware configuration capabilities
2107 */
2108static void pxa27x_change_interface(struct pxa_udc *udc, int iface, int alt)
2109{
2110	struct usb_ctrlrequest  req;
2111
2112	dev_dbg(udc->dev, "interface=%d, alternate setting=%d\n", iface, alt);
2113
2114	udc->last_interface = iface;
2115	udc->last_alternate = alt;
2116
2117	req.bRequestType = USB_RECIP_INTERFACE;
2118	req.bRequest = USB_REQ_SET_INTERFACE;
2119	req.wValue = alt;
2120	req.wIndex = iface;
2121	req.wLength = 0;
2122
2123	set_ep0state(udc, WAIT_ACK_SET_CONF_INTERF);
2124	udc->driver->setup(&udc->gadget, &req);
2125	ep_write_UDCCSR(&udc->pxa_ep[0], UDCCSR0_AREN);
2126}
2127
2128/*
2129 * irq_handle_data - Handle data transfer
2130 * @irq: irq IRQ number
2131 * @udc: dev pxa_udc device structure
2132 *
2133 * Called from irq handler, transferts data to or from endpoint to queue
2134 */
2135static void irq_handle_data(int irq, struct pxa_udc *udc)
2136{
2137	int i;
2138	struct pxa_ep *ep;
2139	u32 udcisr0 = udc_readl(udc, UDCISR0) & UDCCISR0_EP_MASK;
2140	u32 udcisr1 = udc_readl(udc, UDCISR1) & UDCCISR1_EP_MASK;
2141
2142	if (udcisr0 & UDCISR_INT_MASK) {
2143		udc->pxa_ep[0].stats.irqs++;
2144		udc_writel(udc, UDCISR0, UDCISR_INT(0, UDCISR_INT_MASK));
2145		handle_ep0(udc, !!(udcisr0 & UDCICR_FIFOERR),
2146				!!(udcisr0 & UDCICR_PKTCOMPL));
2147	}
2148
2149	udcisr0 >>= 2;
2150	for (i = 1; udcisr0 != 0 && i < 16; udcisr0 >>= 2, i++) {
2151		if (!(udcisr0 & UDCISR_INT_MASK))
2152			continue;
2153
2154		udc_writel(udc, UDCISR0, UDCISR_INT(i, UDCISR_INT_MASK));
2155
2156		WARN_ON(i >= ARRAY_SIZE(udc->pxa_ep));
2157		if (i < ARRAY_SIZE(udc->pxa_ep)) {
2158			ep = &udc->pxa_ep[i];
2159			ep->stats.irqs++;
2160			handle_ep(ep);
2161		}
2162	}
2163
2164	for (i = 16; udcisr1 != 0 && i < 24; udcisr1 >>= 2, i++) {
2165		udc_writel(udc, UDCISR1, UDCISR_INT(i - 16, UDCISR_INT_MASK));
2166		if (!(udcisr1 & UDCISR_INT_MASK))
2167			continue;
2168
2169		WARN_ON(i >= ARRAY_SIZE(udc->pxa_ep));
2170		if (i < ARRAY_SIZE(udc->pxa_ep)) {
2171			ep = &udc->pxa_ep[i];
2172			ep->stats.irqs++;
2173			handle_ep(ep);
2174		}
2175	}
2176
2177}
2178
2179/**
2180 * irq_udc_suspend - Handle IRQ "UDC Suspend"
2181 * @udc: udc device
2182 */
2183static void irq_udc_suspend(struct pxa_udc *udc)
2184{
2185	udc_writel(udc, UDCISR1, UDCISR1_IRSU);
2186	udc->stats.irqs_suspend++;
2187
2188	if (udc->gadget.speed != USB_SPEED_UNKNOWN
2189			&& udc->driver && udc->driver->suspend)
2190		udc->driver->suspend(&udc->gadget);
2191	ep0_idle(udc);
2192}
2193
2194/**
2195  * irq_udc_resume - Handle IRQ "UDC Resume"
2196  * @udc: udc device
2197  */
2198static void irq_udc_resume(struct pxa_udc *udc)
2199{
2200	udc_writel(udc, UDCISR1, UDCISR1_IRRU);
2201	udc->stats.irqs_resume++;
2202
2203	if (udc->gadget.speed != USB_SPEED_UNKNOWN
2204			&& udc->driver && udc->driver->resume)
2205		udc->driver->resume(&udc->gadget);
2206}
2207
2208/**
2209 * irq_udc_reconfig - Handle IRQ "UDC Change Configuration"
2210 * @udc: udc device
2211 */
2212static void irq_udc_reconfig(struct pxa_udc *udc)
2213{
2214	unsigned config, interface, alternate, config_change;
2215	u32 udccr = udc_readl(udc, UDCCR);
2216
2217	udc_writel(udc, UDCISR1, UDCISR1_IRCC);
2218	udc->stats.irqs_reconfig++;
2219
2220	config = (udccr & UDCCR_ACN) >> UDCCR_ACN_S;
2221	config_change = (config != udc->config);
2222	pxa27x_change_configuration(udc, config);
2223
2224	interface = (udccr & UDCCR_AIN) >> UDCCR_AIN_S;
2225	alternate = (udccr & UDCCR_AAISN) >> UDCCR_AAISN_S;
2226	pxa27x_change_interface(udc, interface, alternate);
2227
2228	if (config_change)
2229		update_pxa_ep_matches(udc);
2230	udc_set_mask_UDCCR(udc, UDCCR_SMAC);
2231}
2232
2233/**
2234 * irq_udc_reset - Handle IRQ "UDC Reset"
2235 * @udc: udc device
2236 */
2237static void irq_udc_reset(struct pxa_udc *udc)
2238{
2239	u32 udccr = udc_readl(udc, UDCCR);
2240	struct pxa_ep *ep = &udc->pxa_ep[0];
2241
2242	dev_info(udc->dev, "USB reset\n");
2243	udc_writel(udc, UDCISR1, UDCISR1_IRRS);
2244	udc->stats.irqs_reset++;
2245
2246	if ((udccr & UDCCR_UDA) == 0) {
2247		dev_dbg(udc->dev, "USB reset start\n");
2248		stop_activity(udc);
2249	}
2250	udc->gadget.speed = USB_SPEED_FULL;
2251	memset(&udc->stats, 0, sizeof udc->stats);
2252
2253	nuke(ep, -EPROTO);
2254	ep_write_UDCCSR(ep, UDCCSR0_FTF | UDCCSR0_OPC);
2255	ep0_idle(udc);
2256}
2257
2258/**
2259 * pxa_udc_irq - Main irq handler
2260 * @irq: irq number
2261 * @_dev: udc device
2262 *
2263 * Handles all udc interrupts
2264 */
2265static irqreturn_t pxa_udc_irq(int irq, void *_dev)
2266{
2267	struct pxa_udc *udc = _dev;
2268	u32 udcisr0 = udc_readl(udc, UDCISR0);
2269	u32 udcisr1 = udc_readl(udc, UDCISR1);
2270	u32 udccr = udc_readl(udc, UDCCR);
2271	u32 udcisr1_spec;
2272
2273	dev_vdbg(udc->dev, "Interrupt, UDCISR0:0x%08x, UDCISR1:0x%08x, "
2274		 "UDCCR:0x%08x\n", udcisr0, udcisr1, udccr);
2275
2276	udcisr1_spec = udcisr1 & 0xf8000000;
2277	if (unlikely(udcisr1_spec & UDCISR1_IRSU))
2278		irq_udc_suspend(udc);
2279	if (unlikely(udcisr1_spec & UDCISR1_IRRU))
2280		irq_udc_resume(udc);
2281	if (unlikely(udcisr1_spec & UDCISR1_IRCC))
2282		irq_udc_reconfig(udc);
2283	if (unlikely(udcisr1_spec & UDCISR1_IRRS))
2284		irq_udc_reset(udc);
2285
2286	if ((udcisr0 & UDCCISR0_EP_MASK) | (udcisr1 & UDCCISR1_EP_MASK))
2287		irq_handle_data(irq, udc);
2288
2289	return IRQ_HANDLED;
2290}
2291
2292static struct pxa_udc memory = {
2293	.gadget = {
2294		.ops		= &pxa_udc_ops,
2295		.ep0		= &memory.udc_usb_ep[0].usb_ep,
2296		.name		= driver_name,
2297		.dev = {
2298			.init_name	= "gadget",
2299		},
2300	},
2301
2302	.udc_usb_ep = {
2303		USB_EP_CTRL,
2304		USB_EP_OUT_BULK(1),
2305		USB_EP_IN_BULK(2),
2306		USB_EP_IN_ISO(3),
2307		USB_EP_OUT_ISO(4),
2308		USB_EP_IN_INT(5),
2309	},
2310
2311	.pxa_ep = {
2312		PXA_EP_CTRL,
2313		/* Endpoints for gadget zero */
2314		PXA_EP_OUT_BULK(1, 1, 3, 0, 0),
2315		PXA_EP_IN_BULK(2,  2, 3, 0, 0),
2316		/* Endpoints for ether gadget, file storage gadget */
2317		PXA_EP_OUT_BULK(3, 1, 1, 0, 0),
2318		PXA_EP_IN_BULK(4,  2, 1, 0, 0),
2319		PXA_EP_IN_ISO(5,   3, 1, 0, 0),
2320		PXA_EP_OUT_ISO(6,  4, 1, 0, 0),
2321		PXA_EP_IN_INT(7,   5, 1, 0, 0),
2322		/* Endpoints for RNDIS, serial */
2323		PXA_EP_OUT_BULK(8, 1, 2, 0, 0),
2324		PXA_EP_IN_BULK(9,  2, 2, 0, 0),
2325		PXA_EP_IN_INT(10,  5, 2, 0, 0),
2326		/*
2327		 * All the following endpoints are only for completion.  They
2328		 * won't never work, as multiple interfaces are really broken on
2329		 * the pxa.
2330		*/
2331		PXA_EP_OUT_BULK(11, 1, 2, 1, 0),
2332		PXA_EP_IN_BULK(12,  2, 2, 1, 0),
2333		/* Endpoint for CDC Ether */
2334		PXA_EP_OUT_BULK(13, 1, 1, 1, 1),
2335		PXA_EP_IN_BULK(14,  2, 1, 1, 1),
2336	}
2337};
2338
2339#if defined(CONFIG_OF)
2340static const struct of_device_id udc_pxa_dt_ids[] = {
2341	{ .compatible = "marvell,pxa270-udc" },
2342	{}
2343};
2344MODULE_DEVICE_TABLE(of, udc_pxa_dt_ids);
2345#endif
2346
2347/**
2348 * pxa_udc_probe - probes the udc device
2349 * @pdev: platform device
2350 *
2351 * Perform basic init : allocates udc clock, creates sysfs files, requests
2352 * irq.
2353 */
2354static int pxa_udc_probe(struct platform_device *pdev)
2355{
2356	struct pxa_udc *udc = &memory;
2357	int retval = 0, gpio;
2358	struct pxa2xx_udc_mach_info *mach = dev_get_platdata(&pdev->dev);
2359	unsigned long gpio_flags;
2360
2361	if (mach) {
2362		gpio_flags = mach->gpio_pullup_inverted ? GPIOF_ACTIVE_LOW : 0;
2363		gpio = mach->gpio_pullup;
2364		if (gpio_is_valid(gpio)) {
2365			retval = devm_gpio_request_one(&pdev->dev, gpio,
2366						       gpio_flags,
2367						       "USB D+ pullup");
2368			if (retval)
2369				return retval;
2370			udc->gpiod = gpio_to_desc(mach->gpio_pullup);
2371		}
2372		udc->udc_command = mach->udc_command;
2373	} else {
2374		udc->gpiod = devm_gpiod_get(&pdev->dev, NULL, GPIOD_ASIS);
2375	}
2376
2377	udc->regs = devm_platform_ioremap_resource(pdev, 0);
2378	if (IS_ERR(udc->regs))
2379		return PTR_ERR(udc->regs);
2380	udc->irq = platform_get_irq(pdev, 0);
2381	if (udc->irq < 0)
2382		return udc->irq;
2383
2384	udc->dev = &pdev->dev;
2385	if (of_have_populated_dt()) {
2386		udc->transceiver =
2387			devm_usb_get_phy_by_phandle(udc->dev, "phys", 0);
2388		if (IS_ERR(udc->transceiver))
2389			return PTR_ERR(udc->transceiver);
2390	} else {
2391		udc->transceiver = usb_get_phy(USB_PHY_TYPE_USB2);
2392	}
2393
2394	if (IS_ERR(udc->gpiod)) {
2395		dev_err(&pdev->dev, "Couldn't find or request D+ gpio : %ld\n",
2396			PTR_ERR(udc->gpiod));
2397		return PTR_ERR(udc->gpiod);
2398	}
2399	if (udc->gpiod)
2400		gpiod_direction_output(udc->gpiod, 0);
2401
2402	udc->clk = devm_clk_get(&pdev->dev, NULL);
2403	if (IS_ERR(udc->clk))
2404		return PTR_ERR(udc->clk);
2405
2406	retval = clk_prepare(udc->clk);
2407	if (retval)
2408		return retval;
2409
2410	udc->vbus_sensed = 0;
2411
2412	the_controller = udc;
2413	platform_set_drvdata(pdev, udc);
2414	udc_init_data(udc);
2415
2416	/* irq setup after old hardware state is cleaned up */
2417	retval = devm_request_irq(&pdev->dev, udc->irq, pxa_udc_irq,
2418				  IRQF_SHARED, driver_name, udc);
2419	if (retval != 0) {
2420		dev_err(udc->dev, "%s: can't get irq %i, err %d\n",
2421			driver_name, udc->irq, retval);
2422		goto err;
2423	}
2424
2425	if (!IS_ERR_OR_NULL(udc->transceiver))
2426		usb_register_notifier(udc->transceiver, &pxa27x_udc_phy);
2427	retval = usb_add_gadget_udc(&pdev->dev, &udc->gadget);
2428	if (retval)
2429		goto err_add_gadget;
2430
2431	pxa_init_debugfs(udc);
2432	if (should_enable_udc(udc))
2433		udc_enable(udc);
2434	return 0;
2435
2436err_add_gadget:
2437	if (!IS_ERR_OR_NULL(udc->transceiver))
2438		usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
2439err:
2440	clk_unprepare(udc->clk);
2441	return retval;
2442}
2443
2444/**
2445 * pxa_udc_remove - removes the udc device driver
2446 * @_dev: platform device
2447 */
2448static void pxa_udc_remove(struct platform_device *_dev)
2449{
2450	struct pxa_udc *udc = platform_get_drvdata(_dev);
2451
2452	usb_del_gadget_udc(&udc->gadget);
2453	pxa_cleanup_debugfs(udc);
2454
2455	if (!IS_ERR_OR_NULL(udc->transceiver)) {
2456		usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
2457		usb_put_phy(udc->transceiver);
2458	}
2459
2460	udc->transceiver = NULL;
2461	the_controller = NULL;
2462	clk_unprepare(udc->clk);
2463}
2464
2465static void pxa_udc_shutdown(struct platform_device *_dev)
2466{
2467	struct pxa_udc *udc = platform_get_drvdata(_dev);
2468
2469	if (udc_readl(udc, UDCCR) & UDCCR_UDE)
2470		udc_disable(udc);
2471}
2472
2473#ifdef CONFIG_PM
2474/**
2475 * pxa_udc_suspend - Suspend udc device
2476 * @_dev: platform device
2477 * @state: suspend state
2478 *
2479 * Suspends udc : saves configuration registers (UDCCR*), then disables the udc
2480 * device.
2481 */
2482static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
2483{
2484	struct pxa_udc *udc = platform_get_drvdata(_dev);
2485	struct pxa_ep *ep;
2486
2487	ep = &udc->pxa_ep[0];
2488	udc->udccsr0 = udc_ep_readl(ep, UDCCSR);
2489
2490	udc_disable(udc);
2491	udc->pullup_resume = udc->pullup_on;
2492	dplus_pullup(udc, 0);
2493
2494	if (udc->driver)
2495		udc->driver->disconnect(&udc->gadget);
2496
2497	return 0;
2498}
2499
2500/**
2501 * pxa_udc_resume - Resume udc device
2502 * @_dev: platform device
2503 *
2504 * Resumes udc : restores configuration registers (UDCCR*), then enables the udc
2505 * device.
2506 */
2507static int pxa_udc_resume(struct platform_device *_dev)
2508{
2509	struct pxa_udc *udc = platform_get_drvdata(_dev);
2510	struct pxa_ep *ep;
2511
2512	ep = &udc->pxa_ep[0];
2513	udc_ep_writel(ep, UDCCSR, udc->udccsr0 & (UDCCSR0_FST | UDCCSR0_DME));
2514
2515	dplus_pullup(udc, udc->pullup_resume);
2516	if (should_enable_udc(udc))
2517		udc_enable(udc);
2518	/*
2519	 * We do not handle OTG yet.
2520	 *
2521	 * OTGPH bit is set when sleep mode is entered.
2522	 * it indicates that OTG pad is retaining its state.
2523	 * Upon exit from sleep mode and before clearing OTGPH,
2524	 * Software must configure the USB OTG pad, UDC, and UHC
2525	 * to the state they were in before entering sleep mode.
2526	 */
2527	pxa27x_clear_otgph();
2528
2529	return 0;
2530}
2531#endif
2532
2533/* work with hotplug and coldplug */
2534MODULE_ALIAS("platform:pxa27x-udc");
2535
2536static struct platform_driver udc_driver = {
2537	.driver		= {
2538		.name	= "pxa27x-udc",
2539		.of_match_table = of_match_ptr(udc_pxa_dt_ids),
2540	},
2541	.probe		= pxa_udc_probe,
2542	.remove_new	= pxa_udc_remove,
2543	.shutdown	= pxa_udc_shutdown,
2544#ifdef CONFIG_PM
2545	.suspend	= pxa_udc_suspend,
2546	.resume		= pxa_udc_resume
2547#endif
2548};
2549
2550module_platform_driver(udc_driver);
2551
2552MODULE_DESCRIPTION(DRIVER_DESC);
2553MODULE_AUTHOR("Robert Jarzmik");
2554MODULE_LICENSE("GPL");
2555