drivers/usb/gadget/udc/bdc/bdc_ep.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * bdc_ep.c - BRCM BDC USB3.0 device controller endpoint related functions
   4  *
   5  * Copyright (C) 2014 Broadcom Corporation
   6  *
   7  * Author: Ashwini Pahuja
   8  *
   9  * Based on drivers under drivers/usb/
  10  */
  11 #include <linux/module.h>
  12 #include <linux/pci.h>
  13 #include <linux/dma-mapping.h>
  14 #include <linux/kernel.h>
  15 #include <linux/delay.h>
  16 #include <linux/dmapool.h>
  17 #include <linux/ioport.h>
  18 #include <linux/sched.h>
  19 #include <linux/slab.h>
  20 #include <linux/errno.h>
  21 #include <linux/init.h>
  22 #include <linux/timer.h>
  23 #include <linux/list.h>
  24 #include <linux/interrupt.h>
  25 #include <linux/moduleparam.h>
  26 #include <linux/device.h>
  27 #include <linux/usb/ch9.h>
  28 #include <linux/usb/gadget.h>
  29 #include <linux/usb/otg.h>
  30 #include <linux/pm.h>
  31 #include <linux/io.h>
  32 #include <linux/irq.h>
  33 #include <asm/unaligned.h>
  34 #include <linux/platform_device.h>
  35 #include <linux/usb/composite.h>
  36
  37 #include "bdc.h"
  38 #include "bdc_ep.h"
  39 #include "bdc_cmd.h"
  40 #include "bdc_dbg.h"
  41
  42 static const char * const ep0_state_string[] =  {
  43         "WAIT_FOR_SETUP",
  44         "WAIT_FOR_DATA_START",
  45         "WAIT_FOR_DATA_XMIT",
  46         "WAIT_FOR_STATUS_START",
  47         "WAIT_FOR_STATUS_XMIT",
  48         "STATUS_PENDING"
  49 };
  50
  51 /* Free the bdl during ep disable */
  52 static void ep_bd_list_free(struct bdc_ep *ep, u32 num_tabs)
  53 {
  54         struct bd_list *bd_list = &ep->bd_list;
  55         struct bdc *bdc = ep->bdc;
  56         struct bd_table *bd_table;
  57         int index;
  58
  59         dev_dbg(bdc->dev, "%s ep:%s num_tabs:%d\n",
  60                                  __func__, ep->name, num_tabs);
  61
  62         if (!bd_list->bd_table_array) {
  63                 dev_dbg(bdc->dev, "%s already freed\n", ep->name);
  64                 return;
  65         }
  66         for (index = 0; index < num_tabs; index++) {
  67                 /*
  68                  * check if the bd_table struct is allocated ?
  69                  * if yes, then check if bd memory has been allocated, then
  70                  * free the dma_pool and also the bd_table struct memory
  71                 */
  72                 bd_table = bd_list->bd_table_array[index];
  73                 dev_dbg(bdc->dev, "bd_table:%p index:%d\n", bd_table, index);
  74                 if (!bd_table) {
  75                         dev_dbg(bdc->dev, "bd_table not allocated\n");
  76                         continue;
  77                 }
  78                 if (!bd_table->start_bd) {
  79                         dev_dbg(bdc->dev, "bd dma pool not allocated\n");
  80                         continue;
  81                 }
  82
  83                 dev_dbg(bdc->dev,
  84                                 "Free dma pool start_bd:%p dma:%llx\n",
  85                                 bd_table->start_bd,
  86                                 (unsigned long long)bd_table->dma);
  87
  88                 dma_pool_free(bdc->bd_table_pool,
  89                                 bd_table->start_bd,
  90                                 bd_table->dma);
  91                 /* Free the bd_table structure */
  92                 kfree(bd_table);
  93         }
  94         /* Free the bd table array */
  95         kfree(ep->bd_list.bd_table_array);
  96 }
  97
  98 /*
  99  * chain the tables, by insteting a chain bd at the end of prev_table, pointing
 100  * to next_table
 101  */
 102 static inline void chain_table(struct bd_table *prev_table,
 103                                         struct bd_table *next_table,
 104                                         u32 bd_p_tab)
 105 {
 106         /* Chain the prev table to next table */
 107         prev_table->start_bd[bd_p_tab-1].offset[0] =
 108                                 cpu_to_le32(lower_32_bits(next_table->dma));
 109
 110         prev_table->start_bd[bd_p_tab-1].offset[1] =
 111                                 cpu_to_le32(upper_32_bits(next_table->dma));
 112
 113         prev_table->start_bd[bd_p_tab-1].offset[2] =
 114                                 0x0;
 115
 116         prev_table->start_bd[bd_p_tab-1].offset[3] =
 117                                 cpu_to_le32(MARK_CHAIN_BD);
 118 }
 119
 120 /* Allocate the bdl for ep, during config ep */
 121 static int ep_bd_list_alloc(struct bdc_ep *ep)
 122 {
 123         struct bd_table *prev_table = NULL;
 124         int index, num_tabs, bd_p_tab;
 125         struct bdc *bdc = ep->bdc;
 126         struct bd_table *bd_table;
 127         dma_addr_t dma;
 128
 129         if (usb_endpoint_xfer_isoc(ep->desc))
 130                 num_tabs = NUM_TABLES_ISOCH;
 131         else
 132                 num_tabs = NUM_TABLES;
 133
 134         bd_p_tab = NUM_BDS_PER_TABLE;
 135         /* if there is only 1 table in bd list then loop chain to self */
 136         dev_dbg(bdc->dev,
 137                 "%s ep:%p num_tabs:%d\n",
 138                 __func__, ep, num_tabs);
 139
 140         /* Allocate memory for table array */
 141         ep->bd_list.bd_table_array = kcalloc(num_tabs,
 142                                              sizeof(struct bd_table *),
 143                                              GFP_ATOMIC);
 144         if (!ep->bd_list.bd_table_array)
 145                 return -ENOMEM;
 146
 147         /* Allocate memory for each table */
 148         for (index = 0; index < num_tabs; index++) {
 149                 /* Allocate memory for bd_table structure */
 150                 bd_table = kzalloc(sizeof(struct bd_table), GFP_ATOMIC);
 151                 if (!bd_table)
 152                         goto fail;
 153
 154                 bd_table->start_bd = dma_pool_zalloc(bdc->bd_table_pool,
 155                                                         GFP_ATOMIC,
 156                                                         &dma);
 157                 if (!bd_table->start_bd) {
 158                         kfree(bd_table);
 159                         goto fail;
 160                 }
 161
 162                 bd_table->dma = dma;
 163
 164                 dev_dbg(bdc->dev,
 165                         "index:%d start_bd:%p dma=%08llx prev_table:%p\n",
 166                         index, bd_table->start_bd,
 167                         (unsigned long long)bd_table->dma, prev_table);
 168
 169                 ep->bd_list.bd_table_array[index] = bd_table;
 170                 if (prev_table)
 171                         chain_table(prev_table, bd_table, bd_p_tab);
 172
 173                 prev_table = bd_table;
 174         }
 175         chain_table(prev_table, ep->bd_list.bd_table_array[0], bd_p_tab);
 176         /* Memory allocation is successful, now init the internal fields */
 177         ep->bd_list.num_tabs = num_tabs;
 178         ep->bd_list.max_bdi  = (num_tabs * bd_p_tab) - 1;
 179         ep->bd_list.num_tabs = num_tabs;
 180         ep->bd_list.num_bds_table = bd_p_tab;
 181         ep->bd_list.eqp_bdi = 0;
 182         ep->bd_list.hwd_bdi = 0;
 183
 184         return 0;
 185 fail:
 186         /* Free the bd_table_array, bd_table struct, bd's */
 187         ep_bd_list_free(ep, num_tabs);
 188
 189         return -ENOMEM;
 190 }
 191
 192 /* returns how many bd's are need for this transfer */
 193 static inline int bd_needed_req(struct bdc_req *req)
 194 {
 195         int bd_needed = 0;
 196         int remaining;
 197
 198         /* 1 bd needed for 0 byte transfer */
 199         if (req->usb_req.length == 0)
 200                 return 1;
 201
 202         /* remaining bytes after tranfering all max BD size BD's */
 203         remaining = req->usb_req.length % BD_MAX_BUFF_SIZE;
 204         if (remaining)
 205                 bd_needed++;
 206
 207         /* How many maximum BUFF size BD's ? */
 208         remaining = req->usb_req.length / BD_MAX_BUFF_SIZE;
 209         bd_needed += remaining;
 210
 211         return bd_needed;
 212 }
 213
 214 /* returns the bd index(bdi) corresponding to bd dma address */
 215 static int bd_add_to_bdi(struct bdc_ep *ep, dma_addr_t bd_dma_addr)
 216 {
 217         struct bd_list *bd_list = &ep->bd_list;
 218         dma_addr_t dma_first_bd, dma_last_bd;
 219         struct bdc *bdc = ep->bdc;
 220         struct bd_table *bd_table;
 221         bool found = false;
 222         int tbi, bdi;
 223
 224         dma_first_bd = dma_last_bd = 0;
 225         dev_dbg(bdc->dev, "%s  %llx\n",
 226                         __func__, (unsigned long long)bd_dma_addr);
 227         /*
 228          * Find in which table this bd_dma_addr belongs?, go through the table
 229          * array and compare addresses of first and last address of bd of each
 230          * table
 231          */
 232         for (tbi = 0; tbi < bd_list->num_tabs; tbi++) {
 233                 bd_table = bd_list->bd_table_array[tbi];
 234                 dma_first_bd = bd_table->dma;
 235                 dma_last_bd = bd_table->dma +
 236                                         (sizeof(struct bdc_bd) *
 237                                         (bd_list->num_bds_table - 1));
 238                 dev_dbg(bdc->dev, "dma_first_bd:%llx dma_last_bd:%llx\n",
 239                                         (unsigned long long)dma_first_bd,
 240                                         (unsigned long long)dma_last_bd);
 241                 if (bd_dma_addr >= dma_first_bd && bd_dma_addr <= dma_last_bd) {
 242                         found = true;
 243                         break;
 244                 }
 245         }
 246         if (unlikely(!found)) {
 247                 dev_err(bdc->dev, "%s FATAL err, bd not found\n", __func__);
 248                 return -EINVAL;
 249         }
 250         /* Now we know the table, find the bdi */
 251         bdi = (bd_dma_addr - dma_first_bd) / sizeof(struct bdc_bd);
 252
 253         /* return the global bdi, to compare with ep eqp_bdi */
 254         return (bdi + (tbi * bd_list->num_bds_table));
 255 }
 256
 257 /* returns the table index(tbi) of the given bdi */
 258 static int bdi_to_tbi(struct bdc_ep *ep, int bdi)
 259 {
 260         int tbi;
 261
 262         tbi = bdi / ep->bd_list.num_bds_table;
 263         dev_vdbg(ep->bdc->dev,
 264                 "bdi:%d num_bds_table:%d tbi:%d\n",
 265                 bdi, ep->bd_list.num_bds_table, tbi);
 266
 267         return tbi;
 268 }
 269
 270 /* Find the bdi last bd in the transfer */
 271 static inline int find_end_bdi(struct bdc_ep *ep, int next_hwd_bdi)
 272 {
 273         int end_bdi;
 274
 275         end_bdi = next_hwd_bdi - 1;
 276         if (end_bdi < 0)
 277                 end_bdi = ep->bd_list.max_bdi - 1;
 278          else if ((end_bdi % (ep->bd_list.num_bds_table-1)) == 0)
 279                 end_bdi--;
 280
 281         return end_bdi;
 282 }
 283
 284 /*
 285  * How many transfer bd's are available on this ep bdl, chain bds are not
 286  * counted in available bds
 287  */
 288 static int bd_available_ep(struct bdc_ep *ep)
 289 {
 290         struct bd_list *bd_list = &ep->bd_list;
 291         int available1, available2;
 292         struct bdc *bdc = ep->bdc;
 293         int chain_bd1, chain_bd2;
 294         int available_bd = 0;
 295
 296         available1 = available2 = chain_bd1 = chain_bd2 = 0;
 297         /* if empty then we have all bd's available - number of chain bd's */
 298         if (bd_list->eqp_bdi == bd_list->hwd_bdi)
 299                 return bd_list->max_bdi - bd_list->num_tabs;
 300
 301         /*
 302          * Depending upon where eqp and dqp pointers are, caculate number
 303          * of avaialble bd's
 304          */
 305         if (bd_list->hwd_bdi < bd_list->eqp_bdi) {
 306                 /* available bd's are from eqp..max_bds + 0..dqp - chain_bds */
 307                 available1 = bd_list->max_bdi - bd_list->eqp_bdi;
 308                 available2 = bd_list->hwd_bdi;
 309                 chain_bd1 = available1 / bd_list->num_bds_table;
 310                 chain_bd2 = available2 / bd_list->num_bds_table;
 311                 dev_vdbg(bdc->dev, "chain_bd1:%d chain_bd2:%d\n",
 312                                                 chain_bd1, chain_bd2);
 313                 available_bd = available1 + available2 - chain_bd1 - chain_bd2;
 314         } else {
 315                 /* available bd's are from eqp..dqp - number of chain bd's */
 316                 available1 = bd_list->hwd_bdi -  bd_list->eqp_bdi;
 317                 /* if gap between eqp and dqp is less than NUM_BDS_PER_TABLE */
 318                 if ((bd_list->hwd_bdi - bd_list->eqp_bdi)
 319                                         <= bd_list->num_bds_table) {
 320                         /* If there any chain bd in between */
 321                         if (!(bdi_to_tbi(ep, bd_list->hwd_bdi)
 322                                         == bdi_to_tbi(ep, bd_list->eqp_bdi))) {
 323                                 available_bd = available1 - 1;
 324                         }
 325                 } else {
 326                         chain_bd1 = available1 / bd_list->num_bds_table;
 327                         available_bd = available1 - chain_bd1;
 328                 }
 329         }
 330         /*
 331          * we need to keep one extra bd to check if ring is full or empty so
 332          * reduce by 1
 333          */
 334         available_bd--;
 335         dev_vdbg(bdc->dev, "available_bd:%d\n", available_bd);
 336
 337         return available_bd;
 338 }
 339
 340 /* Notify the hardware after queueing the bd to bdl */
 341 void bdc_notify_xfr(struct bdc *bdc, u32 epnum)
 342 {
 343         struct bdc_ep *ep = bdc->bdc_ep_array[epnum];
 344
 345         dev_vdbg(bdc->dev, "%s epnum:%d\n", __func__, epnum);
 346         /*
 347          * We don't have anyway to check if ep state is running,
 348          * except the software flags.
 349          */
 350         if (unlikely(ep->flags & BDC_EP_STOP))
 351                 ep->flags &= ~BDC_EP_STOP;
 352
 353         bdc_writel(bdc->regs, BDC_XSFNTF, epnum);
 354 }
 355
 356 /* returns the bd corresponding to bdi */
 357 static struct bdc_bd *bdi_to_bd(struct bdc_ep *ep, int bdi)
 358 {
 359         int tbi = bdi_to_tbi(ep, bdi);
 360         int local_bdi = 0;
 361
 362         local_bdi = bdi - (tbi * ep->bd_list.num_bds_table);
 363         dev_vdbg(ep->bdc->dev,
 364                 "%s bdi:%d local_bdi:%d\n",
 365                  __func__, bdi, local_bdi);
 366
 367         return (ep->bd_list.bd_table_array[tbi]->start_bd + local_bdi);
 368 }
 369
 370 /* Advance the enqueue pointer */
 371 static void ep_bdlist_eqp_adv(struct bdc_ep *ep)
 372 {
 373         ep->bd_list.eqp_bdi++;
 374         /* if it's chain bd, then move to next */
 375         if (((ep->bd_list.eqp_bdi + 1) % ep->bd_list.num_bds_table) == 0)
 376                 ep->bd_list.eqp_bdi++;
 377
 378         /* if the eqp is pointing to last + 1 then move back to 0 */
 379         if (ep->bd_list.eqp_bdi == (ep->bd_list.max_bdi + 1))
 380                 ep->bd_list.eqp_bdi = 0;
 381 }
 382
 383 /* Setup the first bd for ep0 transfer */
 384 static int setup_first_bd_ep0(struct bdc *bdc, struct bdc_req *req, u32 *dword3)
 385 {
 386         u16 wValue;
 387         u32 req_len;
 388
 389         req->ep->dir = 0;
 390         req_len = req->usb_req.length;
 391         switch (bdc->ep0_state) {
 392         case WAIT_FOR_DATA_START:
 393                 *dword3 |= BD_TYPE_DS;
 394                 if (bdc->setup_pkt.bRequestType & USB_DIR_IN)
 395                         *dword3 |= BD_DIR_IN;
 396
 397                 /* check if zlp will be needed */
 398                 wValue = le16_to_cpu(bdc->setup_pkt.wValue);
 399                 if ((wValue > req_len) &&
 400                                 (req_len % bdc->gadget.ep0->maxpacket == 0)) {
 401                         dev_dbg(bdc->dev, "ZLP needed wVal:%d len:%d MaxP:%d\n",
 402                                         wValue, req_len,
 403                                         bdc->gadget.ep0->maxpacket);
 404                         bdc->zlp_needed = true;
 405                 }
 406                 break;
 407
 408         case WAIT_FOR_STATUS_START:
 409                 *dword3 |= BD_TYPE_SS;
 410                 if (!le16_to_cpu(bdc->setup_pkt.wLength) ||
 411                                 !(bdc->setup_pkt.bRequestType & USB_DIR_IN))
 412                         *dword3 |= BD_DIR_IN;
 413                 break;
 414         default:
 415                 dev_err(bdc->dev,
 416                         "Unknown ep0 state for queueing bd ep0_state:%s\n",
 417                         ep0_state_string[bdc->ep0_state]);
 418                 return -EINVAL;
 419         }
 420
 421         return 0;
 422 }
 423
 424 /* Setup the bd dma descriptor for a given request */
 425 static int setup_bd_list_xfr(struct bdc *bdc, struct bdc_req *req, int num_bds)
 426 {
 427         dma_addr_t buf_add = req->usb_req.dma;
 428         u32 maxp, tfs, dword2, dword3;
 429         struct bd_transfer *bd_xfr;
 430         struct bd_list *bd_list;
 431         struct bdc_ep *ep;
 432         struct bdc_bd *bd;
 433         int ret, bdnum;
 434         u32 req_len;
 435
 436         ep = req->ep;
 437         bd_list = &ep->bd_list;
 438         bd_xfr = &req->bd_xfr;
 439         bd_xfr->req = req;
 440         bd_xfr->start_bdi = bd_list->eqp_bdi;
 441         bd = bdi_to_bd(ep, bd_list->eqp_bdi);
 442         req_len = req->usb_req.length;
 443         maxp = usb_endpoint_maxp(ep->desc);
 444         tfs = roundup(req->usb_req.length, maxp);
 445         tfs = tfs/maxp;
 446         dev_vdbg(bdc->dev, "%s ep:%s num_bds:%d tfs:%d r_len:%d bd:%p\n",
 447                                 __func__, ep->name, num_bds, tfs, req_len, bd);
 448
 449         for (bdnum = 0; bdnum < num_bds; bdnum++) {
 450                 dword2 = dword3 = 0;
 451                 /* First bd */
 452                 if (!bdnum) {
 453                         dword3 |= BD_SOT|BD_SBF|(tfs<<BD_TFS_SHIFT);
 454                         dword2 |= BD_LTF;
 455                         /* format of first bd for ep0 is different than other */
 456                         if (ep->ep_num == 1) {
 457                                 ret = setup_first_bd_ep0(bdc, req, &dword3);
 458                                 if (ret)
 459                                         return ret;
 460                         }
 461                 }
 462                 if (!req->ep->dir)
 463                         dword3 |= BD_ISP;
 464
 465                 if (req_len > BD_MAX_BUFF_SIZE) {
 466                         dword2 |= BD_MAX_BUFF_SIZE;
 467                         req_len -= BD_MAX_BUFF_SIZE;
 468                 } else {
 469                         /* this should be the last bd */
 470                         dword2 |= req_len;
 471                         dword3 |= BD_IOC;
 472                         dword3 |= BD_EOT;
 473                 }
 474                 /* Currently only 1 INT target is supported */
 475                 dword2 |= BD_INTR_TARGET(0);
 476                 bd = bdi_to_bd(ep, ep->bd_list.eqp_bdi);
 477                 if (unlikely(!bd)) {
 478                         dev_err(bdc->dev, "Err bd pointing to wrong addr\n");
 479                         return -EINVAL;
 480                 }
 481                 /* write bd */
 482                 bd->offset[0] = cpu_to_le32(lower_32_bits(buf_add));
 483                 bd->offset[1] = cpu_to_le32(upper_32_bits(buf_add));
 484                 bd->offset[2] = cpu_to_le32(dword2);
 485                 bd->offset[3] = cpu_to_le32(dword3);
 486                 /* advance eqp pointer */
 487                 ep_bdlist_eqp_adv(ep);
 488                 /* advance the buff pointer */
 489                 buf_add += BD_MAX_BUFF_SIZE;
 490                 dev_vdbg(bdc->dev, "buf_add:%08llx req_len:%d bd:%p eqp:%d\n",
 491                                 (unsigned long long)buf_add, req_len, bd,
 492                                                         ep->bd_list.eqp_bdi);
 493                 bd = bdi_to_bd(ep, ep->bd_list.eqp_bdi);
 494                 bd->offset[3] = cpu_to_le32(BD_SBF);
 495         }
 496         /* clear the STOP BD fetch bit from the first bd of this xfr */
 497         bd = bdi_to_bd(ep, bd_xfr->start_bdi);
 498         bd->offset[3] &= cpu_to_le32(~BD_SBF);
 499         /* the new eqp will be next hw dqp */
 500         bd_xfr->num_bds  = num_bds;
 501         bd_xfr->next_hwd_bdi = ep->bd_list.eqp_bdi;
 502         /* everything is written correctly before notifying the HW */
 503         wmb();
 504
 505         return 0;
 506 }
 507
 508 /* Queue the xfr */
 509 static int bdc_queue_xfr(struct bdc *bdc, struct bdc_req *req)
 510 {
 511         int num_bds, bd_available;
 512         struct bdc_ep *ep;
 513         int ret;
 514
 515         ep = req->ep;
 516         dev_dbg(bdc->dev, "%s req:%p\n", __func__, req);
 517         dev_dbg(bdc->dev, "eqp_bdi:%d hwd_bdi:%d\n",
 518                         ep->bd_list.eqp_bdi, ep->bd_list.hwd_bdi);
 519
 520         num_bds =  bd_needed_req(req);
 521         bd_available = bd_available_ep(ep);
 522
 523         /* how many bd's are avaialble on ep */
 524         if (num_bds > bd_available)
 525                 return -ENOMEM;
 526
 527         ret = setup_bd_list_xfr(bdc, req, num_bds);
 528         if (ret)
 529                 return ret;
 530         list_add_tail(&req->queue, &ep->queue);
 531         bdc_dbg_bd_list(bdc, ep);
 532         bdc_notify_xfr(bdc, ep->ep_num);
 533
 534         return 0;
 535 }
 536
 537 /* callback to gadget layer when xfr completes */
 538 static void bdc_req_complete(struct bdc_ep *ep, struct bdc_req *req,
 539                                                 int status)
 540 {
 541         struct bdc *bdc = ep->bdc;
 542
 543         if (req == NULL  || &req->queue == NULL || &req->usb_req == NULL)
 544                 return;
 545
 546         dev_dbg(bdc->dev, "%s ep:%s status:%d\n", __func__, ep->name, status);
 547         list_del(&req->queue);
 548         req->usb_req.status = status;
 549         usb_gadget_unmap_request(&bdc->gadget, &req->usb_req, ep->dir);
 550         if (req->usb_req.complete) {
 551                 spin_unlock(&bdc->lock);
 552                 usb_gadget_giveback_request(&ep->usb_ep, &req->usb_req);
 553                 spin_lock(&bdc->lock);
 554         }
 555 }
 556
 557 /* Disable the endpoint */
 558 int bdc_ep_disable(struct bdc_ep *ep)
 559 {
 560         struct bdc_req *req;
 561         struct bdc *bdc;
 562         int ret;
 563
 564         ret = 0;
 565         bdc = ep->bdc;
 566         dev_dbg(bdc->dev, "%s() ep->ep_num=%d\n", __func__, ep->ep_num);
 567         /* Stop the endpoint */
 568         ret = bdc_stop_ep(bdc, ep->ep_num);
 569
 570         /*
 571          * Intentionally don't check the ret value of stop, it can fail in
 572          * disconnect scenarios, continue with dconfig
 573          */
 574         /* de-queue any pending requests */
 575         while (!list_empty(&ep->queue)) {
 576                 req = list_entry(ep->queue.next, struct bdc_req,
 577                                 queue);
 578                 bdc_req_complete(ep, req, -ESHUTDOWN);
 579         }
 580         /* deconfigure the endpoint */
 581         ret = bdc_dconfig_ep(bdc, ep);
 582         if (ret)
 583                 dev_warn(bdc->dev,
 584                         "dconfig fail but continue with memory free");
 585
 586         ep->flags = 0;
 587         /* ep0 memory is not freed, but reused on next connect sr */
 588         if (ep->ep_num == 1)
 589                 return 0;
 590
 591         /* Free the bdl memory */
 592         ep_bd_list_free(ep, ep->bd_list.num_tabs);
 593         ep->desc = NULL;
 594         ep->comp_desc = NULL;
 595         ep->usb_ep.desc = NULL;
 596         ep->ep_type = 0;
 597
 598         return ret;
 599 }
 600
 601 /* Enable the ep */
 602 int bdc_ep_enable(struct bdc_ep *ep)
 603 {
 604         struct bdc *bdc;
 605         int ret = 0;
 606
 607         bdc = ep->bdc;
 608         dev_dbg(bdc->dev, "%s NUM_TABLES:%d %d\n",
 609                                         __func__, NUM_TABLES, NUM_TABLES_ISOCH);
 610
 611         ret = ep_bd_list_alloc(ep);
 612         if (ret) {
 613                 dev_err(bdc->dev, "ep bd list allocation failed:%d\n", ret);
 614                 return -ENOMEM;
 615         }
 616         bdc_dbg_bd_list(bdc, ep);
 617         /* only for ep0: config ep is called for ep0 from connect event */
 618         ep->flags |= BDC_EP_ENABLED;
 619         if (ep->ep_num == 1)
 620                 return ret;
 621
 622         /* Issue a configure endpoint command */
 623         ret = bdc_config_ep(bdc, ep);
 624         if (ret)
 625                 return ret;
 626
 627         ep->usb_ep.maxpacket = usb_endpoint_maxp(ep->desc);
 628         ep->usb_ep.desc = ep->desc;
 629         ep->usb_ep.comp_desc = ep->comp_desc;
 630         ep->ep_type = usb_endpoint_type(ep->desc);
 631         ep->flags |= BDC_EP_ENABLED;
 632
 633         return 0;
 634 }
 635
 636 /* EP0 related code */
 637
 638 /* Queue a status stage BD */
 639 static int ep0_queue_status_stage(struct bdc *bdc)
 640 {
 641         struct bdc_req *status_req;
 642         struct bdc_ep *ep;
 643
 644         status_req = &bdc->status_req;
 645         ep = bdc->bdc_ep_array[1];
 646         status_req->ep = ep;
 647         status_req->usb_req.length = 0;
 648         status_req->usb_req.status = -EINPROGRESS;
 649         status_req->usb_req.actual = 0;
 650         status_req->usb_req.complete = NULL;
 651         bdc_queue_xfr(bdc, status_req);
 652
 653         return 0;
 654 }
 655
 656 /* Queue xfr on ep0 */
 657 static int ep0_queue(struct bdc_ep *ep, struct bdc_req *req)
 658 {
 659         struct bdc *bdc;
 660         int ret;
 661
 662         bdc = ep->bdc;
 663         dev_dbg(bdc->dev, "%s()\n", __func__);
 664         req->usb_req.actual = 0;
 665         req->usb_req.status = -EINPROGRESS;
 666         req->epnum = ep->ep_num;
 667
 668         if (bdc->delayed_status) {
 669                 bdc->delayed_status = false;
 670                 /* if status stage was delayed? */
 671                 if (bdc->ep0_state == WAIT_FOR_STATUS_START) {
 672                         /* Queue a status stage BD */
 673                         ep0_queue_status_stage(bdc);
 674                         bdc->ep0_state = WAIT_FOR_STATUS_XMIT;
 675                         return 0;
 676                 }
 677         } else {
 678                 /*
 679                  * if delayed status is false and 0 length transfer is requested
 680                  * i.e. for status stage of some setup request, then just
 681                  * return from here the status stage is queued independently
 682                  */
 683                 if (req->usb_req.length == 0)
 684                         return 0;
 685
 686         }
 687         ret = usb_gadget_map_request(&bdc->gadget, &req->usb_req, ep->dir);
 688         if (ret) {
 689                 dev_err(bdc->dev, "dma mapping failed %s\n", ep->name);
 690                 return ret;
 691         }
 692
 693         return bdc_queue_xfr(bdc, req);
 694 }
 695
 696 /* Queue data stage */
 697 static int ep0_queue_data_stage(struct bdc *bdc)
 698 {
 699         struct bdc_ep *ep;
 700
 701         dev_dbg(bdc->dev, "%s\n", __func__);
 702         ep = bdc->bdc_ep_array[1];
 703         bdc->ep0_req.ep = ep;
 704         bdc->ep0_req.usb_req.complete = NULL;
 705
 706         return ep0_queue(ep, &bdc->ep0_req);
 707 }
 708
 709 /* Queue req on ep */
 710 static int ep_queue(struct bdc_ep *ep, struct bdc_req *req)
 711 {
 712         struct bdc *bdc;
 713         int ret = 0;
 714
 715         if (!req || !ep->usb_ep.desc)
 716                 return -EINVAL;
 717
 718         bdc = ep->bdc;
 719
 720         req->usb_req.actual = 0;
 721         req->usb_req.status = -EINPROGRESS;
 722         req->epnum = ep->ep_num;
 723
 724         ret = usb_gadget_map_request(&bdc->gadget, &req->usb_req, ep->dir);
 725         if (ret) {
 726                 dev_err(bdc->dev, "dma mapping failed\n");
 727                 return ret;
 728         }
 729
 730         return bdc_queue_xfr(bdc, req);
 731 }
 732
 733 /* Dequeue a request from ep */
 734 static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req)
 735 {
 736         int start_bdi, end_bdi, tbi, eqp_bdi, curr_hw_dqpi;
 737         bool start_pending, end_pending;
 738         bool first_remove = false;
 739         struct bdc_req *first_req;
 740         struct bdc_bd *bd_start;
 741         struct bd_table *table;
 742         dma_addr_t next_bd_dma;
 743         u64   deq_ptr_64 = 0;
 744         struct bdc  *bdc;
 745         u32    tmp_32;
 746         int ret;
 747
 748         bdc = ep->bdc;
 749         start_pending = end_pending = false;
 750         eqp_bdi = ep->bd_list.eqp_bdi - 1;
 751
 752         if (eqp_bdi < 0)
 753                 eqp_bdi = ep->bd_list.max_bdi;
 754
 755         start_bdi = req->bd_xfr.start_bdi;
 756         end_bdi = find_end_bdi(ep, req->bd_xfr.next_hwd_bdi);
 757
 758         dev_dbg(bdc->dev, "%s ep:%s start:%d end:%d\n",
 759                                         __func__, ep->name, start_bdi, end_bdi);
 760         dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n",
 761                                                 ep, (void *)ep->usb_ep.desc);
 762         /* Stop the ep to see where the HW is ? */
 763         ret = bdc_stop_ep(bdc, ep->ep_num);
 764         /* if there is an issue with stopping ep, then no need to go further */
 765         if (ret)
 766                 return 0;
 767
 768         /*
 769          * After endpoint is stopped, there can be 3 cases, the request
 770          * is processed, pending or in the middle of processing
 771          */
 772
 773         /* The current hw dequeue pointer */
 774         tmp_32 = bdc_readl(bdc->regs, BDC_EPSTS0);
 775         deq_ptr_64 = tmp_32;
 776         tmp_32 = bdc_readl(bdc->regs, BDC_EPSTS1);
 777         deq_ptr_64 |= ((u64)tmp_32 << 32);
 778
 779         /* we have the dma addr of next bd that will be fetched by hardware */
 780         curr_hw_dqpi = bd_add_to_bdi(ep, deq_ptr_64);
 781         if (curr_hw_dqpi < 0)
 782                 return curr_hw_dqpi;
 783
 784         /*
 785          * curr_hw_dqpi points to actual dqp of HW and HW owns bd's from
 786          * curr_hw_dqbdi..eqp_bdi.
 787          */
 788
 789         /* Check if start_bdi and end_bdi are in range of HW owned BD's */
 790         if (curr_hw_dqpi > eqp_bdi) {
 791                 /* there is a wrap from last to 0 */
 792                 if (start_bdi >= curr_hw_dqpi || start_bdi <= eqp_bdi) {
 793                         start_pending = true;
 794                         end_pending = true;
 795                 } else if (end_bdi >= curr_hw_dqpi || end_bdi <= eqp_bdi) {
 796                                 end_pending = true;
 797                 }
 798         } else {
 799                 if (start_bdi >= curr_hw_dqpi) {
 800                         start_pending = true;
 801                         end_pending = true;
 802                 } else if (end_bdi >= curr_hw_dqpi) {
 803                         end_pending = true;
 804                 }
 805         }
 806         dev_dbg(bdc->dev,
 807                 "start_pending:%d end_pending:%d speed:%d\n",
 808                 start_pending, end_pending, bdc->gadget.speed);
 809
 810         /* If both start till end are processes, we cannot deq req */
 811         if (!start_pending && !end_pending)
 812                 return -EINVAL;
 813
 814         /*
 815          * if ep_dequeue is called after disconnect then just return
 816          * success from here
 817          */
 818         if (bdc->gadget.speed == USB_SPEED_UNKNOWN)
 819                 return 0;
 820         tbi = bdi_to_tbi(ep, req->bd_xfr.next_hwd_bdi);
 821         table = ep->bd_list.bd_table_array[tbi];
 822         next_bd_dma =  table->dma +
 823                         sizeof(struct bdc_bd)*(req->bd_xfr.next_hwd_bdi -
 824                                         tbi * ep->bd_list.num_bds_table);
 825
 826         first_req = list_first_entry(&ep->queue, struct bdc_req,
 827                         queue);
 828
 829         if (req == first_req)
 830                 first_remove = true;
 831
 832         /*
 833          * Due to HW limitation we need to bypadd chain bd's and issue ep_bla,
 834          * incase if start is pending this is the first request in the list
 835          * then issue ep_bla instead of marking as chain bd
 836          */
 837         if (start_pending && !first_remove) {
 838                 /*
 839                  * Mark the start bd as Chain bd, and point the chain
 840                  * bd to next_bd_dma
 841                  */
 842                 bd_start = bdi_to_bd(ep, start_bdi);
 843                 bd_start->offset[0] = cpu_to_le32(lower_32_bits(next_bd_dma));
 844                 bd_start->offset[1] = cpu_to_le32(upper_32_bits(next_bd_dma));
 845                 bd_start->offset[2] = 0x0;
 846                 bd_start->offset[3] = cpu_to_le32(MARK_CHAIN_BD);
 847                 bdc_dbg_bd_list(bdc, ep);
 848         } else if (end_pending) {
 849                 /*
 850                  * The transfer is stopped in the middle, move the
 851                  * HW deq pointer to next_bd_dma
 852                  */
 853                 ret = bdc_ep_bla(bdc, ep, next_bd_dma);
 854                 if (ret) {
 855                         dev_err(bdc->dev, "error in ep_bla:%d\n", ret);
 856                         return ret;
 857                 }
 858         }
 859
 860         return 0;
 861 }
 862
 863 /* Halt/Clear the ep based on value */
 864 static int ep_set_halt(struct bdc_ep *ep, u32 value)
 865 {
 866         struct bdc *bdc;
 867         int ret;
 868
 869         bdc = ep->bdc;
 870         dev_dbg(bdc->dev, "%s ep:%s value=%d\n", __func__, ep->name, value);
 871
 872         if (value) {
 873                 dev_dbg(bdc->dev, "Halt\n");
 874                 if (ep->ep_num == 1)
 875                         bdc->ep0_state = WAIT_FOR_SETUP;
 876
 877                 ret = bdc_ep_set_stall(bdc, ep->ep_num);
 878                 if (ret)
 879                         dev_err(bdc->dev, "failed to set STALL on %s\n",
 880                                 ep->name);
 881                 else
 882                         ep->flags |= BDC_EP_STALL;
 883         } else {
 884                 /* Clear */
 885                 dev_dbg(bdc->dev, "Before Clear\n");
 886                 ret = bdc_ep_clear_stall(bdc, ep->ep_num);
 887                 if (ret)
 888                         dev_err(bdc->dev, "failed to clear STALL on %s\n",
 889                                 ep->name);
 890                 else
 891                         ep->flags &= ~BDC_EP_STALL;
 892                 dev_dbg(bdc->dev, "After  Clear\n");
 893         }
 894
 895         return ret;
 896 }
 897
 898 /* Free all the ep */
 899 void bdc_free_ep(struct bdc *bdc)
 900 {
 901         struct bdc_ep *ep;
 902         u8      epnum;
 903
 904         dev_dbg(bdc->dev, "%s\n", __func__);
 905         for (epnum = 1; epnum < bdc->num_eps; epnum++) {
 906                 ep = bdc->bdc_ep_array[epnum];
 907                 if (!ep)
 908                         continue;
 909
 910                 if (ep->flags & BDC_EP_ENABLED)
 911                         ep_bd_list_free(ep, ep->bd_list.num_tabs);
 912
 913                 /* ep0 is not in this gadget list */
 914                 if (epnum != 1)
 915                         list_del(&ep->usb_ep.ep_list);
 916
 917                 kfree(ep);
 918         }
 919 }
 920
 921 /* USB2 spec, section 7.1.20 */
 922 static int bdc_set_test_mode(struct bdc *bdc)
 923 {
 924         u32 usb2_pm;
 925
 926         usb2_pm = bdc_readl(bdc->regs, BDC_USPPM2);
 927         usb2_pm &= ~BDC_PTC_MASK;
 928         dev_dbg(bdc->dev, "%s\n", __func__);
 929         switch (bdc->test_mode) {
 930         case TEST_J:
 931         case TEST_K:
 932         case TEST_SE0_NAK:
 933         case TEST_PACKET:
 934         case TEST_FORCE_EN:
 935                 usb2_pm |= bdc->test_mode << 28;
 936                 break;
 937         default:
 938                 return -EINVAL;
 939         }
 940         dev_dbg(bdc->dev, "usb2_pm=%08x", usb2_pm);
 941         bdc_writel(bdc->regs, BDC_USPPM2, usb2_pm);
 942
 943         return 0;
 944 }
 945
 946 /*
 947  * Helper function to handle Transfer status report with status as either
 948  * success or short
 949  */
 950 static void handle_xsr_succ_status(struct bdc *bdc, struct bdc_ep *ep,
 951                                                         struct bdc_sr *sreport)
 952 {
 953         int short_bdi, start_bdi, end_bdi, max_len_bds, chain_bds;
 954         struct bd_list *bd_list = &ep->bd_list;
 955         int actual_length, length_short;
 956         struct bd_transfer *bd_xfr;
 957         struct bdc_bd *short_bd;
 958         struct bdc_req *req;
 959         u64   deq_ptr_64 = 0;
 960         int status = 0;
 961         int sr_status;
 962         u32    tmp_32;
 963
 964         dev_dbg(bdc->dev, "%s  ep:%p\n", __func__, ep);
 965         bdc_dbg_srr(bdc, 0);
 966         /* do not process thie sr if ignore flag is set */
 967         if (ep->ignore_next_sr) {
 968                 ep->ignore_next_sr = false;
 969                 return;
 970         }
 971
 972         if (unlikely(list_empty(&ep->queue))) {
 973                 dev_warn(bdc->dev, "xfr srr with no BD's queued\n");
 974                 return;
 975         }
 976         req = list_entry(ep->queue.next, struct bdc_req,
 977                         queue);
 978
 979         bd_xfr = &req->bd_xfr;
 980         sr_status = XSF_STS(le32_to_cpu(sreport->offset[3]));
 981
 982         /*
 983          * sr_status is short and this transfer has more than 1 bd then it needs
 984          * special handling,  this is only applicable for bulk and ctrl
 985          */
 986         if (sr_status == XSF_SHORT &&  bd_xfr->num_bds > 1) {
 987                 /*
 988                  * This is multi bd xfr, lets see which bd
 989                  * caused short transfer and how many bytes have been
 990                  * transferred so far.
 991                  */
 992                 tmp_32 = le32_to_cpu(sreport->offset[0]);
 993                 deq_ptr_64 = tmp_32;
 994                 tmp_32 = le32_to_cpu(sreport->offset[1]);
 995                 deq_ptr_64 |= ((u64)tmp_32 << 32);
 996                 short_bdi = bd_add_to_bdi(ep, deq_ptr_64);
 997                 if (unlikely(short_bdi < 0))
 998                         dev_warn(bdc->dev, "bd doesn't exist?\n");
 999
1000                 start_bdi =  bd_xfr->start_bdi;
1001                 /*
1002                  * We know the start_bdi and short_bdi, how many xfr
1003                  * bds in between
1004                  */
1005                 if (start_bdi <= short_bdi) {
1006                         max_len_bds = short_bdi - start_bdi;
1007                         if (max_len_bds <= bd_list->num_bds_table) {
1008                                 if (!(bdi_to_tbi(ep, start_bdi) ==
1009                                                 bdi_to_tbi(ep, short_bdi)))
1010                                         max_len_bds--;
1011                         } else {
1012                                 chain_bds = max_len_bds/bd_list->num_bds_table;
1013                                 max_len_bds -= chain_bds;
1014                         }
1015                 } else {
1016                         /* there is a wrap in the ring within a xfr */
1017                         chain_bds = (bd_list->max_bdi - start_bdi)/
1018                                                         bd_list->num_bds_table;
1019                         chain_bds += short_bdi/bd_list->num_bds_table;
1020                         max_len_bds = bd_list->max_bdi - start_bdi;
1021                         max_len_bds += short_bdi;
1022                         max_len_bds -= chain_bds;
1023                 }
1024                 /* max_len_bds is the number of full length bds */
1025                 end_bdi = find_end_bdi(ep, bd_xfr->next_hwd_bdi);
1026                 if (!(end_bdi == short_bdi))
1027                         ep->ignore_next_sr = true;
1028
1029                 actual_length = max_len_bds * BD_MAX_BUFF_SIZE;
1030                 short_bd = bdi_to_bd(ep, short_bdi);
1031                 /* length queued */
1032                 length_short = le32_to_cpu(short_bd->offset[2]) & 0x1FFFFF;
1033                 /* actual length trensfered */
1034                 length_short -= SR_BD_LEN(le32_to_cpu(sreport->offset[2]));
1035                 actual_length += length_short;
1036                 req->usb_req.actual = actual_length;
1037         } else {
1038                 req->usb_req.actual = req->usb_req.length -
1039                         SR_BD_LEN(le32_to_cpu(sreport->offset[2]));
1040                 dev_dbg(bdc->dev,
1041                         "len=%d actual=%d bd_xfr->next_hwd_bdi:%d\n",
1042                         req->usb_req.length, req->usb_req.actual,
1043                         bd_xfr->next_hwd_bdi);
1044         }
1045
1046         /* Update the dequeue pointer */
1047         ep->bd_list.hwd_bdi = bd_xfr->next_hwd_bdi;
1048         if (req->usb_req.actual < req->usb_req.length) {
1049                 dev_dbg(bdc->dev, "short xfr on %d\n", ep->ep_num);
1050                 if (req->usb_req.short_not_ok)
1051                         status = -EREMOTEIO;
1052         }
1053         bdc_req_complete(ep, bd_xfr->req, status);
1054 }
1055
1056 /* EP0 setup related packet handlers */
1057
1058 /*
1059  * Setup packet received, just store the packet and process on next DS or SS
1060  * started SR
1061  */
1062 void bdc_xsf_ep0_setup_recv(struct bdc *bdc, struct bdc_sr *sreport)
1063 {
1064         struct usb_ctrlrequest *setup_pkt;
1065         u32 len;
1066
1067         dev_dbg(bdc->dev,
1068                 "%s ep0_state:%s\n",
1069                 __func__, ep0_state_string[bdc->ep0_state]);
1070         /* Store received setup packet */
1071         setup_pkt = &bdc->setup_pkt;
1072         memcpy(setup_pkt, &sreport->offset[0], sizeof(*setup_pkt));
1073         len = le16_to_cpu(setup_pkt->wLength);
1074         if (!len)
1075                 bdc->ep0_state = WAIT_FOR_STATUS_START;
1076         else
1077                 bdc->ep0_state = WAIT_FOR_DATA_START;
1078
1079
1080         dev_dbg(bdc->dev,
1081                 "%s exit ep0_state:%s\n",
1082                 __func__, ep0_state_string[bdc->ep0_state]);
1083 }
1084
1085 /* Stall ep0 */
1086 static void ep0_stall(struct bdc *bdc)
1087 {
1088         struct bdc_ep   *ep = bdc->bdc_ep_array[1];
1089         struct bdc_req *req;
1090
1091         dev_dbg(bdc->dev, "%s\n", __func__);
1092         bdc->delayed_status = false;
1093         ep_set_halt(ep, 1);
1094
1095         /* de-queue any pendig requests */
1096         while (!list_empty(&ep->queue)) {
1097                 req = list_entry(ep->queue.next, struct bdc_req,
1098                                 queue);
1099                 bdc_req_complete(ep, req, -ESHUTDOWN);
1100         }
1101 }
1102
1103 /* SET_ADD handlers */
1104 static int ep0_set_address(struct bdc *bdc, struct usb_ctrlrequest *ctrl)
1105 {
1106         enum usb_device_state state = bdc->gadget.state;
1107         int ret = 0;
1108         u32 addr;
1109
1110         addr = le16_to_cpu(ctrl->wValue);
1111         dev_dbg(bdc->dev,
1112                 "%s addr:%d dev state:%d\n",
1113                 __func__, addr, state);
1114
1115         if (addr > 127)
1116                 return -EINVAL;
1117
1118         switch (state) {
1119         case USB_STATE_DEFAULT:
1120         case USB_STATE_ADDRESS:
1121                 /* Issue Address device command */
1122                 ret = bdc_address_device(bdc, addr);
1123                 if (ret)
1124                         return ret;
1125
1126                 if (addr)
1127                         usb_gadget_set_state(&bdc->gadget, USB_STATE_ADDRESS);
1128                 else
1129                         usb_gadget_set_state(&bdc->gadget, USB_STATE_DEFAULT);
1130
1131                 bdc->dev_addr = addr;
1132                 break;
1133         default:
1134                 dev_warn(bdc->dev,
1135                         "SET Address in wrong device state %d\n",
1136                         state);
1137                 ret = -EINVAL;
1138         }
1139
1140         return ret;
1141 }
1142
1143 /* Handler for SET/CLEAR FEATURE requests for device */
1144 static int ep0_handle_feature_dev(struct bdc *bdc, u16 wValue,
1145                                                         u16 wIndex, bool set)
1146 {
1147         enum usb_device_state state = bdc->gadget.state;
1148         u32     usppms = 0;
1149
1150         dev_dbg(bdc->dev, "%s set:%d dev state:%d\n",
1151                                         __func__, set, state);
1152         switch (wValue) {
1153         case USB_DEVICE_REMOTE_WAKEUP:
1154                 dev_dbg(bdc->dev, "USB_DEVICE_REMOTE_WAKEUP\n");
1155                 if (set)
1156                         bdc->devstatus |= REMOTE_WAKE_ENABLE;
1157                 else
1158                         bdc->devstatus &= ~REMOTE_WAKE_ENABLE;
1159                 break;
1160
1161         case USB_DEVICE_TEST_MODE:
1162                 dev_dbg(bdc->dev, "USB_DEVICE_TEST_MODE\n");
1163                 if ((wIndex & 0xFF) ||
1164                                 (bdc->gadget.speed != USB_SPEED_HIGH) || !set)
1165                         return -EINVAL;
1166
1167                 bdc->test_mode = wIndex >> 8;
1168                 break;
1169
1170         case USB_DEVICE_U1_ENABLE:
1171                 dev_dbg(bdc->dev, "USB_DEVICE_U1_ENABLE\n");
1172
1173                 if (bdc->gadget.speed != USB_SPEED_SUPER ||
1174                                                 state != USB_STATE_CONFIGURED)
1175                         return -EINVAL;
1176
1177                 usppms =  bdc_readl(bdc->regs, BDC_USPPMS);
1178                 if (set) {
1179                         /* clear previous u1t */
1180                         usppms &= ~BDC_U1T(BDC_U1T_MASK);
1181                         usppms |= BDC_U1T(U1_TIMEOUT);
1182                         usppms |= BDC_U1E | BDC_PORT_W1S;
1183                         bdc->devstatus |= (1 << USB_DEV_STAT_U1_ENABLED);
1184                 } else {
1185                         usppms &= ~BDC_U1E;
1186                         usppms |= BDC_PORT_W1S;
1187                         bdc->devstatus &= ~(1 << USB_DEV_STAT_U1_ENABLED);
1188                 }
1189                 bdc_writel(bdc->regs, BDC_USPPMS, usppms);
1190                 break;
1191
1192         case USB_DEVICE_U2_ENABLE:
1193                 dev_dbg(bdc->dev, "USB_DEVICE_U2_ENABLE\n");
1194
1195                 if (bdc->gadget.speed != USB_SPEED_SUPER ||
1196                                                 state != USB_STATE_CONFIGURED)
1197                         return -EINVAL;
1198
1199                 usppms = bdc_readl(bdc->regs, BDC_USPPMS);
1200                 if (set) {
1201                         usppms |= BDC_U2E;
1202                         usppms |= BDC_U2A;
1203                         bdc->devstatus |= (1 << USB_DEV_STAT_U2_ENABLED);
1204                 } else {
1205                         usppms &= ~BDC_U2E;
1206                         usppms &= ~BDC_U2A;
1207                         bdc->devstatus &= ~(1 << USB_DEV_STAT_U2_ENABLED);
1208                 }
1209                 bdc_writel(bdc->regs, BDC_USPPMS, usppms);
1210                 break;
1211
1212         case USB_DEVICE_LTM_ENABLE:
1213                 dev_dbg(bdc->dev, "USB_DEVICE_LTM_ENABLE?\n");
1214                 if (bdc->gadget.speed != USB_SPEED_SUPER ||
1215                                                 state != USB_STATE_CONFIGURED)
1216                         return -EINVAL;
1217                 break;
1218         default:
1219                 dev_err(bdc->dev, "Unknown wValue:%d\n", wValue);
1220                 return -EOPNOTSUPP;
1221         } /* USB_RECIP_DEVICE end */
1222
1223         return 0;
1224 }
1225
1226 /* SET/CLEAR FEATURE handler */
1227 static int ep0_handle_feature(struct bdc *bdc,
1228                               struct usb_ctrlrequest *setup_pkt, bool set)
1229 {
1230         enum usb_device_state state = bdc->gadget.state;
1231         struct bdc_ep *ep;
1232         u16 wValue;
1233         u16 wIndex;
1234         int epnum;
1235
1236         wValue = le16_to_cpu(setup_pkt->wValue);
1237         wIndex = le16_to_cpu(setup_pkt->wIndex);
1238
1239         dev_dbg(bdc->dev,
1240                 "%s wValue=%d wIndex=%d devstate=%08x speed=%d set=%d",
1241                 __func__, wValue, wIndex, state,
1242                 bdc->gadget.speed, set);
1243
1244         switch (setup_pkt->bRequestType & USB_RECIP_MASK) {
1245         case USB_RECIP_DEVICE:
1246                 return ep0_handle_feature_dev(bdc, wValue, wIndex, set);
1247         case USB_RECIP_INTERFACE:
1248                 dev_dbg(bdc->dev, "USB_RECIP_INTERFACE\n");
1249                 /* USB3 spec, sec 9.4.9 */
1250                 if (wValue != USB_INTRF_FUNC_SUSPEND)
1251                         return -EINVAL;
1252                 /* USB3 spec, Table 9-8 */
1253                 if (set) {
1254                         if (wIndex & USB_INTRF_FUNC_SUSPEND_RW) {
1255                                 dev_dbg(bdc->dev, "SET REMOTE_WAKEUP\n");
1256                                 bdc->devstatus |= REMOTE_WAKE_ENABLE;
1257                         } else {
1258                                 dev_dbg(bdc->dev, "CLEAR REMOTE_WAKEUP\n");
1259                                 bdc->devstatus &= ~REMOTE_WAKE_ENABLE;
1260                         }
1261                 }
1262                 break;
1263
1264         case USB_RECIP_ENDPOINT:
1265                 dev_dbg(bdc->dev, "USB_RECIP_ENDPOINT\n");
1266                 if (wValue != USB_ENDPOINT_HALT)
1267                         return -EINVAL;
1268
1269                 epnum = wIndex & USB_ENDPOINT_NUMBER_MASK;
1270                 if (epnum) {
1271                         if ((wIndex & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
1272                                 epnum = epnum * 2 + 1;
1273                         else
1274                                 epnum *= 2;
1275                 } else {
1276                         epnum = 1; /*EP0*/
1277                 }
1278                 /*
1279                  * If CLEAR_FEATURE on ep0 then don't do anything as the stall
1280                  * condition on ep0 has already been cleared when SETUP packet
1281                  * was received.
1282                  */
1283                 if (epnum == 1 && !set) {
1284                         dev_dbg(bdc->dev, "ep0 stall already cleared\n");
1285                         return 0;
1286                 }
1287                 dev_dbg(bdc->dev, "epnum=%d\n", epnum);
1288                 ep = bdc->bdc_ep_array[epnum];
1289                 if (!ep)
1290                         return -EINVAL;
1291
1292                 return ep_set_halt(ep, set);
1293         default:
1294                 dev_err(bdc->dev, "Unknown recipient\n");
1295                 return -EINVAL;
1296         }
1297
1298         return 0;
1299 }
1300
1301 /* GET_STATUS request handler */
1302 static int ep0_handle_status(struct bdc *bdc,
1303                              struct usb_ctrlrequest *setup_pkt)
1304 {
1305         enum usb_device_state state = bdc->gadget.state;
1306         struct bdc_ep *ep;
1307         u16 usb_status = 0;
1308         u32 epnum;
1309         u16 wIndex;
1310
1311         /* USB2.0 spec sec 9.4.5 */
1312         if (state == USB_STATE_DEFAULT)
1313                 return -EINVAL;
1314         wIndex = le16_to_cpu(setup_pkt->wIndex);
1315         dev_dbg(bdc->dev, "%s\n", __func__);
1316         usb_status = bdc->devstatus;
1317         switch (setup_pkt->bRequestType & USB_RECIP_MASK) {
1318         case USB_RECIP_DEVICE:
1319                 dev_dbg(bdc->dev,
1320                         "USB_RECIP_DEVICE devstatus:%08x\n",
1321                         bdc->devstatus);
1322                 /* USB3 spec, sec 9.4.5 */
1323                 if (bdc->gadget.speed == USB_SPEED_SUPER)
1324                         usb_status &= ~REMOTE_WAKE_ENABLE;
1325                 break;
1326
1327         case USB_RECIP_INTERFACE:
1328                 dev_dbg(bdc->dev, "USB_RECIP_INTERFACE\n");
1329                 if (bdc->gadget.speed == USB_SPEED_SUPER) {
1330                         /*
1331                          * This should come from func for Func remote wkup
1332                          * usb_status |=1;
1333                          */
1334                         if (bdc->devstatus & REMOTE_WAKE_ENABLE)
1335                                 usb_status |= REMOTE_WAKE_ENABLE;
1336                 } else {
1337                         usb_status = 0;
1338                 }
1339
1340                 break;
1341
1342         case USB_RECIP_ENDPOINT:
1343                 dev_dbg(bdc->dev, "USB_RECIP_ENDPOINT\n");
1344                 epnum = wIndex & USB_ENDPOINT_NUMBER_MASK;
1345                 if (epnum) {
1346                         if ((wIndex & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
1347                                 epnum = epnum*2 + 1;
1348                         else
1349                                 epnum *= 2;
1350                 } else {
1351                         epnum = 1; /* EP0 */
1352                 }
1353
1354                 ep = bdc->bdc_ep_array[epnum];
1355                 if (!ep) {
1356                         dev_err(bdc->dev, "ISSUE, GET_STATUS for invalid EP ?");
1357                         return -EINVAL;
1358                 }
1359                 if (ep->flags & BDC_EP_STALL)
1360                         usb_status |= 1 << USB_ENDPOINT_HALT;
1361
1362                 break;
1363         default:
1364                 dev_err(bdc->dev, "Unknown recipient for get_status\n");
1365                 return -EINVAL;
1366         }
1367         /* prepare a data stage for GET_STATUS */
1368         dev_dbg(bdc->dev, "usb_status=%08x\n", usb_status);
1369         *(__le16 *)bdc->ep0_response_buff = cpu_to_le16(usb_status);
1370         bdc->ep0_req.usb_req.length = 2;
1371         bdc->ep0_req.usb_req.buf = &bdc->ep0_response_buff;
1372         ep0_queue_data_stage(bdc);
1373
1374         return 0;
1375 }
1376
1377 static void ep0_set_sel_cmpl(struct usb_ep *_ep, struct usb_request *_req)
1378 {
1379         /* ep0_set_sel_cmpl */
1380 }
1381
1382 /* Queue data stage to handle 6 byte SET_SEL request */
1383 static int ep0_set_sel(struct bdc *bdc,
1384                              struct usb_ctrlrequest *setup_pkt)
1385 {
1386         struct bdc_ep   *ep;
1387         u16     wLength;
1388
1389         dev_dbg(bdc->dev, "%s\n", __func__);
1390         wLength = le16_to_cpu(setup_pkt->wLength);
1391         if (unlikely(wLength != 6)) {
1392                 dev_err(bdc->dev, "%s Wrong wLength:%d\n", __func__, wLength);
1393                 return -EINVAL;
1394         }
1395         ep = bdc->bdc_ep_array[1];
1396         bdc->ep0_req.ep = ep;
1397         bdc->ep0_req.usb_req.length = 6;
1398         bdc->ep0_req.usb_req.buf = bdc->ep0_response_buff;
1399         bdc->ep0_req.usb_req.complete = ep0_set_sel_cmpl;
1400         ep0_queue_data_stage(bdc);
1401
1402         return 0;
1403 }
1404
1405 /*
1406  * Queue a 0 byte bd only if wLength is more than the length and and length is
1407  * a multiple of MaxPacket then queue 0 byte BD
1408  */
1409 static int ep0_queue_zlp(struct bdc *bdc)
1410 {
1411         int ret;
1412
1413         dev_dbg(bdc->dev, "%s\n", __func__);
1414         bdc->ep0_req.ep = bdc->bdc_ep_array[1];
1415         bdc->ep0_req.usb_req.length = 0;
1416         bdc->ep0_req.usb_req.complete = NULL;
1417         bdc->ep0_state = WAIT_FOR_DATA_START;
1418         ret = bdc_queue_xfr(bdc, &bdc->ep0_req);
1419         if (ret) {
1420                 dev_err(bdc->dev, "err queueing zlp :%d\n", ret);
1421                 return ret;
1422         }
1423         bdc->ep0_state = WAIT_FOR_DATA_XMIT;
1424
1425         return 0;
1426 }
1427
1428 /* Control request handler */
1429 static int handle_control_request(struct bdc *bdc)
1430 {
1431         enum usb_device_state state = bdc->gadget.state;
1432         struct usb_ctrlrequest *setup_pkt;
1433         int delegate_setup = 0;
1434         int ret = 0;
1435         int config = 0;
1436
1437         setup_pkt = &bdc->setup_pkt;
1438         dev_dbg(bdc->dev, "%s\n", __func__);
1439         if ((setup_pkt->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
1440                 switch (setup_pkt->bRequest) {
1441                 case USB_REQ_SET_ADDRESS:
1442                         dev_dbg(bdc->dev, "USB_REQ_SET_ADDRESS\n");
1443                         ret = ep0_set_address(bdc, setup_pkt);
1444                         bdc->devstatus &= DEVSTATUS_CLEAR;
1445                         break;
1446
1447                 case USB_REQ_SET_CONFIGURATION:
1448                         dev_dbg(bdc->dev, "USB_REQ_SET_CONFIGURATION\n");
1449                         if (state == USB_STATE_ADDRESS) {
1450                                 usb_gadget_set_state(&bdc->gadget,
1451                                                         USB_STATE_CONFIGURED);
1452                         } else if (state == USB_STATE_CONFIGURED) {
1453                                 /*
1454                                  * USB2 spec sec 9.4.7, if wValue is 0 then dev
1455                                  * is moved to addressed state
1456                                  */
1457                                 config = le16_to_cpu(setup_pkt->wValue);
1458                                 if (!config)
1459                                         usb_gadget_set_state(
1460                                                         &bdc->gadget,
1461                                                         USB_STATE_ADDRESS);
1462                         }
1463                         delegate_setup = 1;
1464                         break;
1465
1466                 case USB_REQ_SET_FEATURE:
1467                         dev_dbg(bdc->dev, "USB_REQ_SET_FEATURE\n");
1468                         ret = ep0_handle_feature(bdc, setup_pkt, 1);
1469                         break;
1470
1471                 case USB_REQ_CLEAR_FEATURE:
1472                         dev_dbg(bdc->dev, "USB_REQ_CLEAR_FEATURE\n");
1473                         ret = ep0_handle_feature(bdc, setup_pkt, 0);
1474                         break;
1475
1476                 case USB_REQ_GET_STATUS:
1477                         dev_dbg(bdc->dev, "USB_REQ_GET_STATUS\n");
1478                         ret = ep0_handle_status(bdc, setup_pkt);
1479                         break;
1480
1481                 case USB_REQ_SET_SEL:
1482                         dev_dbg(bdc->dev, "USB_REQ_SET_SEL\n");
1483                         ret = ep0_set_sel(bdc, setup_pkt);
1484                         break;
1485
1486                 case USB_REQ_SET_ISOCH_DELAY:
1487                         dev_warn(bdc->dev,
1488                         "USB_REQ_SET_ISOCH_DELAY not handled\n");
1489                         ret = 0;
1490                         break;
1491                 default:
1492                         delegate_setup = 1;
1493                 }
1494         } else {
1495                 delegate_setup = 1;
1496         }
1497
1498         if (delegate_setup) {
1499                 spin_unlock(&bdc->lock);
1500                 ret = bdc->gadget_driver->setup(&bdc->gadget, setup_pkt);
1501                 spin_lock(&bdc->lock);
1502         }
1503
1504         return ret;
1505 }
1506
1507 /* EP0: Data stage started */
1508 void bdc_xsf_ep0_data_start(struct bdc *bdc, struct bdc_sr *sreport)
1509 {
1510         struct bdc_ep *ep;
1511         int ret = 0;
1512
1513         dev_dbg(bdc->dev, "%s\n", __func__);
1514         ep = bdc->bdc_ep_array[1];
1515         /* If ep0 was stalled, the clear it first */
1516         if (ep->flags & BDC_EP_STALL) {
1517                 ret = ep_set_halt(ep, 0);
1518                 if (ret)
1519                         goto err;
1520         }
1521         if (bdc->ep0_state != WAIT_FOR_DATA_START)
1522                 dev_warn(bdc->dev,
1523                         "Data stage not expected ep0_state:%s\n",
1524                         ep0_state_string[bdc->ep0_state]);
1525
1526         ret = handle_control_request(bdc);
1527         if (ret == USB_GADGET_DELAYED_STATUS) {
1528                 /*
1529                  * The ep0 state will remain WAIT_FOR_DATA_START till
1530                  * we received ep_queue on ep0
1531                  */
1532                 bdc->delayed_status = true;
1533                 return;
1534         }
1535         if (!ret) {
1536                 bdc->ep0_state = WAIT_FOR_DATA_XMIT;
1537                 dev_dbg(bdc->dev,
1538                         "ep0_state:%s", ep0_state_string[bdc->ep0_state]);
1539                 return;
1540         }
1541 err:
1542         ep0_stall(bdc);
1543 }
1544
1545 /* EP0: status stage started */
1546 void bdc_xsf_ep0_status_start(struct bdc *bdc, struct bdc_sr *sreport)
1547 {
1548         struct usb_ctrlrequest *setup_pkt;
1549         struct bdc_ep *ep;
1550         int ret = 0;
1551
1552         dev_dbg(bdc->dev,
1553                 "%s ep0_state:%s",
1554                 __func__, ep0_state_string[bdc->ep0_state]);
1555         ep = bdc->bdc_ep_array[1];
1556
1557         /* check if ZLP was queued? */
1558         if (bdc->zlp_needed)
1559                 bdc->zlp_needed = false;
1560
1561         if (ep->flags & BDC_EP_STALL) {
1562                 ret = ep_set_halt(ep, 0);
1563                 if (ret)
1564                         goto err;
1565         }
1566
1567         if ((bdc->ep0_state != WAIT_FOR_STATUS_START) &&
1568                                 (bdc->ep0_state != WAIT_FOR_DATA_XMIT))
1569                 dev_err(bdc->dev,
1570                         "Status stage recv but ep0_state:%s\n",
1571                         ep0_state_string[bdc->ep0_state]);
1572
1573         /* check if data stage is in progress ? */
1574         if (bdc->ep0_state == WAIT_FOR_DATA_XMIT) {
1575                 bdc->ep0_state = STATUS_PENDING;
1576                 /* Status stage will be queued upon Data stage transmit event */
1577                 dev_dbg(bdc->dev,
1578                         "status started but data  not transmitted yet\n");
1579                 return;
1580         }
1581         setup_pkt = &bdc->setup_pkt;
1582
1583         /*
1584          * 2 stage setup then only process the setup, for 3 stage setup the date
1585          * stage is already handled
1586          */
1587         if (!le16_to_cpu(setup_pkt->wLength)) {
1588                 ret = handle_control_request(bdc);
1589                 if (ret == USB_GADGET_DELAYED_STATUS) {
1590                         bdc->delayed_status = true;
1591                         /* ep0_state will remain WAIT_FOR_STATUS_START */
1592                         return;
1593                 }
1594         }
1595         if (!ret) {
1596                 /* Queue a status stage BD */
1597                 ep0_queue_status_stage(bdc);
1598                 bdc->ep0_state = WAIT_FOR_STATUS_XMIT;
1599                 dev_dbg(bdc->dev,
1600                         "ep0_state:%s", ep0_state_string[bdc->ep0_state]);
1601                 return;
1602         }
1603 err:
1604         ep0_stall(bdc);
1605 }
1606
1607 /* Helper function to update ep0 upon SR with xsf_succ or xsf_short */
1608 static void ep0_xsf_complete(struct bdc *bdc, struct bdc_sr *sreport)
1609 {
1610         dev_dbg(bdc->dev, "%s\n", __func__);
1611         switch (bdc->ep0_state) {
1612         case WAIT_FOR_DATA_XMIT:
1613                 bdc->ep0_state = WAIT_FOR_STATUS_START;
1614                 break;
1615         case WAIT_FOR_STATUS_XMIT:
1616                 bdc->ep0_state = WAIT_FOR_SETUP;
1617                 if (bdc->test_mode) {
1618                         int ret;
1619
1620                         dev_dbg(bdc->dev, "test_mode:%d\n", bdc->test_mode);
1621                         ret = bdc_set_test_mode(bdc);
1622                         if (ret < 0) {
1623                                 dev_err(bdc->dev, "Err in setting Test mode\n");
1624                                 return;
1625                         }
1626                         bdc->test_mode = 0;
1627                 }
1628                 break;
1629         case STATUS_PENDING:
1630                 bdc_xsf_ep0_status_start(bdc, sreport);
1631                 break;
1632
1633         default:
1634                 dev_err(bdc->dev,
1635                         "Unknown ep0_state:%s\n",
1636                         ep0_state_string[bdc->ep0_state]);
1637
1638         }
1639 }
1640
1641 /* xfr completion status report handler */
1642 void bdc_sr_xsf(struct bdc *bdc, struct bdc_sr *sreport)
1643 {
1644         struct bdc_ep *ep;
1645         u32 sr_status;
1646         u8 ep_num;
1647
1648         ep_num = (le32_to_cpu(sreport->offset[3])>>4) & 0x1f;
1649         ep = bdc->bdc_ep_array[ep_num];
1650         if (!ep || !(ep->flags & BDC_EP_ENABLED)) {
1651                 dev_err(bdc->dev, "xsf for ep not enabled\n");
1652                 return;
1653         }
1654         /*
1655          * check if this transfer is after link went from U3->U0 due
1656          * to remote wakeup
1657          */
1658         if (bdc->devstatus & FUNC_WAKE_ISSUED) {
1659                 bdc->devstatus &= ~(FUNC_WAKE_ISSUED);
1660                 dev_dbg(bdc->dev, "%s clearing FUNC_WAKE_ISSUED flag\n",
1661                                                                 __func__);
1662         }
1663         sr_status = XSF_STS(le32_to_cpu(sreport->offset[3]));
1664         dev_dbg_ratelimited(bdc->dev, "%s sr_status=%d ep:%s\n",
1665                                         __func__, sr_status, ep->name);
1666
1667         switch (sr_status) {
1668         case XSF_SUCC:
1669         case XSF_SHORT:
1670                 handle_xsr_succ_status(bdc, ep, sreport);
1671                 if (ep_num == 1)
1672                         ep0_xsf_complete(bdc, sreport);
1673                 break;
1674
1675         case XSF_SETUP_RECV:
1676         case XSF_DATA_START:
1677         case XSF_STATUS_START:
1678                 if (ep_num != 1) {
1679                         dev_err(bdc->dev,
1680                                 "ep0 related packets on non ep0 endpoint");
1681                         return;
1682                 }
1683                 bdc->sr_xsf_ep0[sr_status - XSF_SETUP_RECV](bdc, sreport);
1684                 break;
1685
1686         case XSF_BABB:
1687                 if (ep_num == 1) {
1688                         dev_dbg(bdc->dev, "Babble on ep0 zlp_need:%d\n",
1689                                                         bdc->zlp_needed);
1690                         /*
1691                          * If the last completed transfer had wLength >Data Len,
1692                          * and Len is multiple of MaxPacket,then queue ZLP
1693                          */
1694                         if (bdc->zlp_needed) {
1695                                 /* queue 0 length bd */
1696                                 ep0_queue_zlp(bdc);
1697                                 return;
1698                         }
1699                 }
1700                 dev_warn(bdc->dev, "Babble on ep not handled\n");
1701                 break;
1702         default:
1703                 dev_warn(bdc->dev, "sr status not handled:%x\n", sr_status);
1704                 break;
1705         }
1706 }
1707
1708 static int bdc_gadget_ep_queue(struct usb_ep *_ep,
1709                                 struct usb_request *_req, gfp_t gfp_flags)
1710 {
1711         struct bdc_req *req;
1712         unsigned long flags;
1713         struct bdc_ep *ep;
1714         struct bdc *bdc;
1715         int ret;
1716
1717         if (!_ep || !_ep->desc)
1718                 return -ESHUTDOWN;
1719
1720         if (!_req || !_req->complete || !_req->buf)
1721                 return -EINVAL;
1722
1723         ep = to_bdc_ep(_ep);
1724         req = to_bdc_req(_req);
1725         bdc = ep->bdc;
1726         dev_dbg(bdc->dev, "%s ep:%p req:%p\n", __func__, ep, req);
1727         dev_dbg(bdc->dev, "queuing request %p to %s length %d zero:%d\n",
1728                                 _req, ep->name, _req->length, _req->zero);
1729
1730         if (!ep->usb_ep.desc) {
1731                 dev_warn(bdc->dev,
1732                         "trying to queue req %p to disabled %s\n",
1733                         _req, ep->name);
1734                 return -ESHUTDOWN;
1735         }
1736
1737         if (_req->length > MAX_XFR_LEN) {
1738                 dev_warn(bdc->dev,
1739                         "req length > supported MAX:%d requested:%d\n",
1740                         MAX_XFR_LEN, _req->length);
1741                 return -EOPNOTSUPP;
1742         }
1743         spin_lock_irqsave(&bdc->lock, flags);
1744         if (ep == bdc->bdc_ep_array[1])
1745                 ret = ep0_queue(ep, req);
1746         else
1747                 ret = ep_queue(ep, req);
1748
1749         spin_unlock_irqrestore(&bdc->lock, flags);
1750
1751         return ret;
1752 }
1753
1754 static int bdc_gadget_ep_dequeue(struct usb_ep *_ep,
1755                                   struct usb_request *_req)
1756 {
1757         struct bdc_req *req;
1758         unsigned long flags;
1759         struct bdc_ep *ep;
1760         struct bdc *bdc;
1761         int ret;
1762
1763         if (!_ep || !_req)
1764                 return -EINVAL;
1765
1766         ep = to_bdc_ep(_ep);
1767         req = to_bdc_req(_req);
1768         bdc = ep->bdc;
1769         dev_dbg(bdc->dev, "%s ep:%s req:%p\n", __func__, ep->name, req);
1770         bdc_dbg_bd_list(bdc, ep);
1771         spin_lock_irqsave(&bdc->lock, flags);
1772         /* make sure it's still queued on this endpoint */
1773         list_for_each_entry(req, &ep->queue, queue) {
1774                 if (&req->usb_req == _req)
1775                         break;
1776         }
1777         if (&req->usb_req != _req) {
1778                 spin_unlock_irqrestore(&bdc->lock, flags);
1779                 dev_err(bdc->dev, "usb_req !=req n");
1780                 return -EINVAL;
1781         }
1782         ret = ep_dequeue(ep, req);
1783         if (ret) {
1784                 ret = -EOPNOTSUPP;
1785                 goto err;
1786         }
1787         bdc_req_complete(ep, req, -ECONNRESET);
1788
1789 err:
1790         bdc_dbg_bd_list(bdc, ep);
1791         spin_unlock_irqrestore(&bdc->lock, flags);
1792
1793         return ret;
1794 }
1795
1796 static int bdc_gadget_ep_set_halt(struct usb_ep *_ep, int value)
1797 {
1798         unsigned long flags;
1799         struct bdc_ep *ep;
1800         struct bdc *bdc;
1801         int ret;
1802
1803         ep = to_bdc_ep(_ep);
1804         bdc = ep->bdc;
1805         dev_dbg(bdc->dev, "%s ep:%s value=%d\n", __func__, ep->name, value);
1806         spin_lock_irqsave(&bdc->lock, flags);
1807         if (usb_endpoint_xfer_isoc(ep->usb_ep.desc))
1808                 ret = -EINVAL;
1809         else if (!list_empty(&ep->queue))
1810                 ret = -EAGAIN;
1811         else
1812                 ret = ep_set_halt(ep, value);
1813
1814         spin_unlock_irqrestore(&bdc->lock, flags);
1815
1816         return ret;
1817 }
1818
1819 static struct usb_request *bdc_gadget_alloc_request(struct usb_ep *_ep,
1820                                                      gfp_t gfp_flags)
1821 {
1822         struct bdc_req *req;
1823         struct bdc_ep *ep;
1824
1825         req = kzalloc(sizeof(*req), gfp_flags);
1826         if (!req)
1827                 return NULL;
1828
1829         ep = to_bdc_ep(_ep);
1830         req->ep = ep;
1831         req->epnum = ep->ep_num;
1832         req->usb_req.dma = DMA_ADDR_INVALID;
1833         dev_dbg(ep->bdc->dev, "%s ep:%s req:%p\n", __func__, ep->name, req);
1834
1835         return &req->usb_req;
1836 }
1837
1838 static void bdc_gadget_free_request(struct usb_ep *_ep,
1839                                      struct usb_request *_req)
1840 {
1841         struct bdc_req *req;
1842
1843         req = to_bdc_req(_req);
1844         kfree(req);
1845 }
1846
1847 /* endpoint operations */
1848
1849 /* configure endpoint and also allocate resources */
1850 static int bdc_gadget_ep_enable(struct usb_ep *_ep,
1851                                  const struct usb_endpoint_descriptor *desc)
1852 {
1853         unsigned long flags;
1854         struct bdc_ep *ep;
1855         struct bdc *bdc;
1856         int ret;
1857
1858         if (!_ep || !desc || desc->bDescriptorType != USB_DT_ENDPOINT) {
1859                 pr_debug("bdc_gadget_ep_enable invalid parameters\n");
1860                 return -EINVAL;
1861         }
1862
1863         if (!desc->wMaxPacketSize) {
1864                 pr_debug("bdc_gadget_ep_enable missing wMaxPacketSize\n");
1865                 return -EINVAL;
1866         }
1867
1868         ep = to_bdc_ep(_ep);
1869         bdc = ep->bdc;
1870
1871         /* Sanity check, upper layer will not send enable for ep0 */
1872         if (ep == bdc->bdc_ep_array[1])
1873                 return -EINVAL;
1874
1875         if (!bdc->gadget_driver
1876             || bdc->gadget.speed == USB_SPEED_UNKNOWN) {
1877                 return -ESHUTDOWN;
1878         }
1879
1880         dev_dbg(bdc->dev, "%s Enabling %s\n", __func__, ep->name);
1881         spin_lock_irqsave(&bdc->lock, flags);
1882         ep->desc = desc;
1883         ep->comp_desc = _ep->comp_desc;
1884         ret = bdc_ep_enable(ep);
1885         spin_unlock_irqrestore(&bdc->lock, flags);
1886
1887         return ret;
1888 }
1889
1890 static int bdc_gadget_ep_disable(struct usb_ep *_ep)
1891 {
1892         unsigned long flags;
1893         struct bdc_ep *ep;
1894         struct bdc *bdc;
1895         int ret;
1896
1897         if (!_ep) {
1898                 pr_debug("bdc: invalid parameters\n");
1899                 return -EINVAL;
1900         }
1901         ep = to_bdc_ep(_ep);
1902         bdc = ep->bdc;
1903
1904         /* Upper layer will not call this for ep0, but do a sanity check */
1905         if (ep == bdc->bdc_ep_array[1]) {
1906                 dev_warn(bdc->dev, "%s called for ep0\n", __func__);
1907                 return -EINVAL;
1908         }
1909         dev_dbg(bdc->dev,
1910                 "%s() ep:%s ep->flags:%08x\n",
1911                 __func__, ep->name, ep->flags);
1912
1913         if (!(ep->flags & BDC_EP_ENABLED)) {
1914                 dev_warn(bdc->dev, "%s is already disabled\n", ep->name);
1915                 return 0;
1916         }
1917         spin_lock_irqsave(&bdc->lock, flags);
1918         ret = bdc_ep_disable(ep);
1919         spin_unlock_irqrestore(&bdc->lock, flags);
1920
1921         return ret;
1922 }
1923
1924 static const struct usb_ep_ops bdc_gadget_ep_ops = {
1925         .enable = bdc_gadget_ep_enable,
1926         .disable = bdc_gadget_ep_disable,
1927         .alloc_request = bdc_gadget_alloc_request,
1928         .free_request = bdc_gadget_free_request,
1929         .queue = bdc_gadget_ep_queue,
1930         .dequeue = bdc_gadget_ep_dequeue,
1931         .set_halt = bdc_gadget_ep_set_halt
1932 };
1933
1934 /* dir = 1 is IN */
1935 static int init_ep(struct bdc *bdc, u32 epnum, u32 dir)
1936 {
1937         struct bdc_ep *ep;
1938
1939         dev_dbg(bdc->dev, "%s epnum=%d dir=%d\n", __func__, epnum, dir);
1940         ep = kzalloc(sizeof(*ep), GFP_KERNEL);
1941         if (!ep)
1942                 return -ENOMEM;
1943
1944         ep->bdc = bdc;
1945         ep->dir = dir;
1946
1947         if (dir)
1948                 ep->usb_ep.caps.dir_in = true;
1949         else
1950                 ep->usb_ep.caps.dir_out = true;
1951
1952         /* ep->ep_num is the index inside bdc_ep */
1953         if (epnum == 1) {
1954                 ep->ep_num = 1;
1955                 bdc->bdc_ep_array[ep->ep_num] = ep;
1956                 snprintf(ep->name, sizeof(ep->name), "ep%d", epnum - 1);
1957                 usb_ep_set_maxpacket_limit(&ep->usb_ep, EP0_MAX_PKT_SIZE);
1958                 ep->usb_ep.caps.type_control = true;
1959                 ep->comp_desc = NULL;
1960                 bdc->gadget.ep0 = &ep->usb_ep;
1961         } else {
1962                 if (dir)
1963                         ep->ep_num = epnum * 2 - 1;
1964                 else
1965                         ep->ep_num = epnum * 2 - 2;
1966
1967                 bdc->bdc_ep_array[ep->ep_num] = ep;
1968                 snprintf(ep->name, sizeof(ep->name), "ep%d%s", epnum - 1,
1969                          dir & 1 ? "in" : "out");
1970
1971                 usb_ep_set_maxpacket_limit(&ep->usb_ep, 1024);
1972                 ep->usb_ep.caps.type_iso = true;
1973                 ep->usb_ep.caps.type_bulk = true;
1974                 ep->usb_ep.caps.type_int = true;
1975                 ep->usb_ep.max_streams = 0;
1976                 list_add_tail(&ep->usb_ep.ep_list, &bdc->gadget.ep_list);
1977         }
1978         ep->usb_ep.ops = &bdc_gadget_ep_ops;
1979         ep->usb_ep.name = ep->name;
1980         ep->flags = 0;
1981         ep->ignore_next_sr = false;
1982         dev_dbg(bdc->dev, "ep=%p ep->usb_ep.name=%s epnum=%d ep->epnum=%d\n",
1983                                 ep, ep->usb_ep.name, epnum, ep->ep_num);
1984
1985         INIT_LIST_HEAD(&ep->queue);
1986
1987         return 0;
1988 }
1989
1990 /* Init all ep */
1991 int bdc_init_ep(struct bdc *bdc)
1992 {
1993         u8 epnum;
1994         int ret;
1995
1996         dev_dbg(bdc->dev, "%s()\n", __func__);
1997         INIT_LIST_HEAD(&bdc->gadget.ep_list);
1998         /* init ep0 */
1999         ret = init_ep(bdc, 1, 0);
2000         if (ret) {
2001                 dev_err(bdc->dev, "init ep ep0 fail %d\n", ret);
2002                 return ret;
2003         }
2004
2005         for (epnum = 2; epnum <= bdc->num_eps / 2; epnum++) {
2006                 /* OUT */
2007                 ret = init_ep(bdc, epnum, 0);
2008                 if (ret) {
2009                         dev_err(bdc->dev,
2010                                 "init ep failed for:%d error: %d\n",
2011                                 epnum, ret);
2012                         return ret;
2013                 }
2014
2015                 /* IN */
2016                 ret = init_ep(bdc, epnum, 1);
2017                 if (ret) {
2018                         dev_err(bdc->dev,
2019                                 "init ep failed for:%d error: %d\n",
2020                                 epnum, ret);
2021                         return ret;
2022                 }
2023         }
2024
2025         return 0;
2026 }