1/*
2 * driver/usb/gadget/fsl_qe_udc.c
3 *
4 * Copyright (c) 2006-2008 Freescale Semiconductor, Inc. All rights reserved.
5 *
6 * 	Xie Xiaobo <X.Xie@freescale.com>
7 * 	Li Yang <leoli@freescale.com>
8 * 	Based on bareboard code from Shlomi Gridish.
9 *
10 * Description:
11 * Freescle QE/CPM USB Pheripheral Controller Driver
12 * The controller can be found on MPC8360, MPC8272, and etc.
13 * MPC8360 Rev 1.1 may need QE mircocode update
14 *
15 * This program is free software; you can redistribute it and/or modify it
16 * under the terms of the GNU General Public License as published by the
17 * Free Software Foundation;  either version 2 of the License, or (at your
18 * option) any later version.
19 */
20
21#undef USB_TRACE
22
23#include <linux/module.h>
24#include <linux/kernel.h>
25#include <linux/ioport.h>
26#include <linux/types.h>
27#include <linux/errno.h>
28#include <linux/err.h>
29#include <linux/slab.h>
30#include <linux/list.h>
31#include <linux/interrupt.h>
32#include <linux/io.h>
33#include <linux/moduleparam.h>
34#include <linux/of_address.h>
35#include <linux/of_irq.h>
36#include <linux/of_platform.h>
37#include <linux/dma-mapping.h>
38#include <linux/usb/ch9.h>
39#include <linux/usb/gadget.h>
40#include <linux/usb/otg.h>
41#include <asm/qe.h>
42#include <asm/cpm.h>
43#include <asm/dma.h>
44#include <asm/reg.h>
45#include "fsl_qe_udc.h"
46
47#define DRIVER_DESC     "Freescale QE/CPM USB Device Controller driver"
48#define DRIVER_AUTHOR   "Xie XiaoBo"
49#define DRIVER_VERSION  "1.0"
50
51#define DMA_ADDR_INVALID        (~(dma_addr_t)0)
52
53static const char driver_name[] = "fsl_qe_udc";
54static const char driver_desc[] = DRIVER_DESC;
55
56/*ep name is important in gadget, it should obey the convention of ep_match()*/
57static const char *const ep_name[] = {
58	"ep0-control", /* everyone has ep0 */
59	/* 3 configurable endpoints */
60	"ep1",
61	"ep2",
62	"ep3",
63};
64
65static struct usb_endpoint_descriptor qe_ep0_desc = {
66	.bLength =		USB_DT_ENDPOINT_SIZE,
67	.bDescriptorType =	USB_DT_ENDPOINT,
68
69	.bEndpointAddress =	0,
70	.bmAttributes =		USB_ENDPOINT_XFER_CONTROL,
71	.wMaxPacketSize =	USB_MAX_CTRL_PAYLOAD,
72};
73
74/********************************************************************
75 *      Internal Used Function Start
76********************************************************************/
77/*-----------------------------------------------------------------
78 * done() - retire a request; caller blocked irqs
79 *--------------------------------------------------------------*/
80static void done(struct qe_ep *ep, struct qe_req *req, int status)
81{
82	struct qe_udc *udc = ep->udc;
83	unsigned char stopped = ep->stopped;
84
85	/* the req->queue pointer is used by ep_queue() func, in which
86	 * the request will be added into a udc_ep->queue 'd tail
87	 * so here the req will be dropped from the ep->queue
88	 */
89	list_del_init(&req->queue);
90
91	/* req.status should be set as -EINPROGRESS in ep_queue() */
92	if (req->req.status == -EINPROGRESS)
93		req->req.status = status;
94	else
95		status = req->req.status;
96
97	if (req->mapped) {
98		dma_unmap_single(udc->gadget.dev.parent,
99			req->req.dma, req->req.length,
100			ep_is_in(ep)
101				? DMA_TO_DEVICE
102				: DMA_FROM_DEVICE);
103		req->req.dma = DMA_ADDR_INVALID;
104		req->mapped = 0;
105	} else
106		dma_sync_single_for_cpu(udc->gadget.dev.parent,
107			req->req.dma, req->req.length,
108			ep_is_in(ep)
109				? DMA_TO_DEVICE
110				: DMA_FROM_DEVICE);
111
112	if (status && (status != -ESHUTDOWN))
113		dev_vdbg(udc->dev, "complete %s req %p stat %d len %u/%u\n",
114			ep->ep.name, &req->req, status,
115			req->req.actual, req->req.length);
116
117	/* don't modify queue heads during completion callback */
118	ep->stopped = 1;
119	spin_unlock(&udc->lock);
120
121	usb_gadget_giveback_request(&ep->ep, &req->req);
122
123	spin_lock(&udc->lock);
124
125	ep->stopped = stopped;
126}
127
128/*-----------------------------------------------------------------
129 * nuke(): delete all requests related to this ep
130 *--------------------------------------------------------------*/
131static void nuke(struct qe_ep *ep, int status)
132{
133	/* Whether this eq has request linked */
134	while (!list_empty(&ep->queue)) {
135		struct qe_req *req = NULL;
136		req = list_entry(ep->queue.next, struct qe_req, queue);
137
138		done(ep, req, status);
139	}
140}
141
142/*---------------------------------------------------------------------------*
143 * USB and Endpoint manipulate process, include parameter and register       *
144 *---------------------------------------------------------------------------*/
145/* @value: 1--set stall 0--clean stall */
146static int qe_eprx_stall_change(struct qe_ep *ep, int value)
147{
148	u16 tem_usep;
149	u8 epnum = ep->epnum;
150	struct qe_udc *udc = ep->udc;
151
152	tem_usep = in_be16(&udc->usb_regs->usb_usep[epnum]);
153	tem_usep = tem_usep & ~USB_RHS_MASK;
154	if (value == 1)
155		tem_usep |= USB_RHS_STALL;
156	else if (ep->dir == USB_DIR_IN)
157		tem_usep |= USB_RHS_IGNORE_OUT;
158
159	out_be16(&udc->usb_regs->usb_usep[epnum], tem_usep);
160	return 0;
161}
162
163static int qe_eptx_stall_change(struct qe_ep *ep, int value)
164{
165	u16 tem_usep;
166	u8 epnum = ep->epnum;
167	struct qe_udc *udc = ep->udc;
168
169	tem_usep = in_be16(&udc->usb_regs->usb_usep[epnum]);
170	tem_usep = tem_usep & ~USB_THS_MASK;
171	if (value == 1)
172		tem_usep |= USB_THS_STALL;
173	else if (ep->dir == USB_DIR_OUT)
174		tem_usep |= USB_THS_IGNORE_IN;
175
176	out_be16(&udc->usb_regs->usb_usep[epnum], tem_usep);
177
178	return 0;
179}
180
181static int qe_ep0_stall(struct qe_udc *udc)
182{
183	qe_eptx_stall_change(&udc->eps[0], 1);
184	qe_eprx_stall_change(&udc->eps[0], 1);
185	udc->ep0_state = WAIT_FOR_SETUP;
186	udc->ep0_dir = 0;
187	return 0;
188}
189
190static int qe_eprx_nack(struct qe_ep *ep)
191{
192	u8 epnum = ep->epnum;
193	struct qe_udc *udc = ep->udc;
194
195	if (ep->state == EP_STATE_IDLE) {
196		/* Set the ep's nack */
197		clrsetbits_be16(&udc->usb_regs->usb_usep[epnum],
198				USB_RHS_MASK, USB_RHS_NACK);
199
200		/* Mask Rx and Busy interrupts */
201		clrbits16(&udc->usb_regs->usb_usbmr,
202				(USB_E_RXB_MASK | USB_E_BSY_MASK));
203
204		ep->state = EP_STATE_NACK;
205	}
206	return 0;
207}
208
209static int qe_eprx_normal(struct qe_ep *ep)
210{
211	struct qe_udc *udc = ep->udc;
212
213	if (ep->state == EP_STATE_NACK) {
214		clrsetbits_be16(&udc->usb_regs->usb_usep[ep->epnum],
215				USB_RTHS_MASK, USB_THS_IGNORE_IN);
216
217		/* Unmask RX interrupts */
218		out_be16(&udc->usb_regs->usb_usber,
219				USB_E_BSY_MASK | USB_E_RXB_MASK);
220		setbits16(&udc->usb_regs->usb_usbmr,
221				(USB_E_RXB_MASK | USB_E_BSY_MASK));
222
223		ep->state = EP_STATE_IDLE;
224		ep->has_data = 0;
225	}
226
227	return 0;
228}
229
230static int qe_ep_cmd_stoptx(struct qe_ep *ep)
231{
232	if (ep->udc->soc_type == PORT_CPM)
233		cpm_command(CPM_USB_STOP_TX | (ep->epnum << CPM_USB_EP_SHIFT),
234				CPM_USB_STOP_TX_OPCODE);
235	else
236		qe_issue_cmd(QE_USB_STOP_TX, QE_CR_SUBBLOCK_USB,
237				ep->epnum, 0);
238
239	return 0;
240}
241
242static int qe_ep_cmd_restarttx(struct qe_ep *ep)
243{
244	if (ep->udc->soc_type == PORT_CPM)
245		cpm_command(CPM_USB_RESTART_TX | (ep->epnum <<
246				CPM_USB_EP_SHIFT), CPM_USB_RESTART_TX_OPCODE);
247	else
248		qe_issue_cmd(QE_USB_RESTART_TX, QE_CR_SUBBLOCK_USB,
249				ep->epnum, 0);
250
251	return 0;
252}
253
254static int qe_ep_flushtxfifo(struct qe_ep *ep)
255{
256	struct qe_udc *udc = ep->udc;
257	int i;
258
259	i = (int)ep->epnum;
260
261	qe_ep_cmd_stoptx(ep);
262	out_8(&udc->usb_regs->usb_uscom,
263		USB_CMD_FLUSH_FIFO | (USB_CMD_EP_MASK & (ep->epnum)));
264	out_be16(&udc->ep_param[i]->tbptr, in_be16(&udc->ep_param[i]->tbase));
265	out_be32(&udc->ep_param[i]->tstate, 0);
266	out_be16(&udc->ep_param[i]->tbcnt, 0);
267
268	ep->c_txbd = ep->txbase;
269	ep->n_txbd = ep->txbase;
270	qe_ep_cmd_restarttx(ep);
271	return 0;
272}
273
274static int qe_ep_filltxfifo(struct qe_ep *ep)
275{
276	struct qe_udc *udc = ep->udc;
277
278	out_8(&udc->usb_regs->usb_uscom,
279			USB_CMD_STR_FIFO | (USB_CMD_EP_MASK & (ep->epnum)));
280	return 0;
281}
282
283static int qe_epbds_reset(struct qe_udc *udc, int pipe_num)
284{
285	struct qe_ep *ep;
286	u32 bdring_len;
287	struct qe_bd __iomem *bd;
288	int i;
289
290	ep = &udc->eps[pipe_num];
291
292	if (ep->dir == USB_DIR_OUT)
293		bdring_len = USB_BDRING_LEN_RX;
294	else
295		bdring_len = USB_BDRING_LEN;
296
297	bd = ep->rxbase;
298	for (i = 0; i < (bdring_len - 1); i++) {
299		out_be32((u32 __iomem *)bd, R_E | R_I);
300		bd++;
301	}
302	out_be32((u32 __iomem *)bd, R_E | R_I | R_W);
303
304	bd = ep->txbase;
305	for (i = 0; i < USB_BDRING_LEN_TX - 1; i++) {
306		out_be32(&bd->buf, 0);
307		out_be32((u32 __iomem *)bd, 0);
308		bd++;
309	}
310	out_be32((u32 __iomem *)bd, T_W);
311
312	return 0;
313}
314
315static int qe_ep_reset(struct qe_udc *udc, int pipe_num)
316{
317	struct qe_ep *ep;
318	u16 tmpusep;
319
320	ep = &udc->eps[pipe_num];
321	tmpusep = in_be16(&udc->usb_regs->usb_usep[pipe_num]);
322	tmpusep &= ~USB_RTHS_MASK;
323
324	switch (ep->dir) {
325	case USB_DIR_BOTH:
326		qe_ep_flushtxfifo(ep);
327		break;
328	case USB_DIR_OUT:
329		tmpusep |= USB_THS_IGNORE_IN;
330		break;
331	case USB_DIR_IN:
332		qe_ep_flushtxfifo(ep);
333		tmpusep |= USB_RHS_IGNORE_OUT;
334		break;
335	default:
336		break;
337	}
338	out_be16(&udc->usb_regs->usb_usep[pipe_num], tmpusep);
339
340	qe_epbds_reset(udc, pipe_num);
341
342	return 0;
343}
344
345static int qe_ep_toggledata01(struct qe_ep *ep)
346{
347	ep->data01 ^= 0x1;
348	return 0;
349}
350
351static int qe_ep_bd_init(struct qe_udc *udc, unsigned char pipe_num)
352{
353	struct qe_ep *ep = &udc->eps[pipe_num];
354	unsigned long tmp_addr = 0;
355	struct usb_ep_para __iomem *epparam;
356	int i;
357	struct qe_bd __iomem *bd;
358	int bdring_len;
359
360	if (ep->dir == USB_DIR_OUT)
361		bdring_len = USB_BDRING_LEN_RX;
362	else
363		bdring_len = USB_BDRING_LEN;
364
365	epparam = udc->ep_param[pipe_num];
366	/* alloc multi-ram for BD rings and set the ep parameters */
367	tmp_addr = cpm_muram_alloc(sizeof(struct qe_bd) * (bdring_len +
368				USB_BDRING_LEN_TX), QE_ALIGNMENT_OF_BD);
369	if (IS_ERR_VALUE(tmp_addr))
370		return -ENOMEM;
371
372	out_be16(&epparam->rbase, (u16)tmp_addr);
373	out_be16(&epparam->tbase, (u16)(tmp_addr +
374				(sizeof(struct qe_bd) * bdring_len)));
375
376	out_be16(&epparam->rbptr, in_be16(&epparam->rbase));
377	out_be16(&epparam->tbptr, in_be16(&epparam->tbase));
378
379	ep->rxbase = cpm_muram_addr(tmp_addr);
380	ep->txbase = cpm_muram_addr(tmp_addr + (sizeof(struct qe_bd)
381				* bdring_len));
382	ep->n_rxbd = ep->rxbase;
383	ep->e_rxbd = ep->rxbase;
384	ep->n_txbd = ep->txbase;
385	ep->c_txbd = ep->txbase;
386	ep->data01 = 0; /* data0 */
387
388	/* Init TX and RX bds */
389	bd = ep->rxbase;
390	for (i = 0; i < bdring_len - 1; i++) {
391		out_be32(&bd->buf, 0);
392		out_be32((u32 __iomem *)bd, 0);
393		bd++;
394	}
395	out_be32(&bd->buf, 0);
396	out_be32((u32 __iomem *)bd, R_W);
397
398	bd = ep->txbase;
399	for (i = 0; i < USB_BDRING_LEN_TX - 1; i++) {
400		out_be32(&bd->buf, 0);
401		out_be32((u32 __iomem *)bd, 0);
402		bd++;
403	}
404	out_be32(&bd->buf, 0);
405	out_be32((u32 __iomem *)bd, T_W);
406
407	return 0;
408}
409
410static int qe_ep_rxbd_update(struct qe_ep *ep)
411{
412	unsigned int size;
413	int i;
414	unsigned int tmp;
415	struct qe_bd __iomem *bd;
416	unsigned int bdring_len;
417
418	if (ep->rxbase == NULL)
419		return -EINVAL;
420
421	bd = ep->rxbase;
422
423	ep->rxframe = kmalloc(sizeof(*ep->rxframe), GFP_ATOMIC);
424	if (ep->rxframe == NULL) {
425		dev_err(ep->udc->dev, "malloc rxframe failed\n");
426		return -ENOMEM;
427	}
428
429	qe_frame_init(ep->rxframe);
430
431	if (ep->dir == USB_DIR_OUT)
432		bdring_len = USB_BDRING_LEN_RX;
433	else
434		bdring_len = USB_BDRING_LEN;
435
436	size = (ep->ep.maxpacket + USB_CRC_SIZE + 2) * (bdring_len + 1);
437	ep->rxbuffer = kzalloc(size, GFP_ATOMIC);
438	if (ep->rxbuffer == NULL) {
439		dev_err(ep->udc->dev, "malloc rxbuffer failed,size=%d\n",
440				size);
441		kfree(ep->rxframe);
442		return -ENOMEM;
443	}
444
445	ep->rxbuf_d = virt_to_phys((void *)ep->rxbuffer);
446	if (ep->rxbuf_d == DMA_ADDR_INVALID) {
447		ep->rxbuf_d = dma_map_single(ep->udc->gadget.dev.parent,
448					ep->rxbuffer,
449					size,
450					DMA_FROM_DEVICE);
451		ep->rxbufmap = 1;
452	} else {
453		dma_sync_single_for_device(ep->udc->gadget.dev.parent,
454					ep->rxbuf_d, size,
455					DMA_FROM_DEVICE);
456		ep->rxbufmap = 0;
457	}
458
459	size = ep->ep.maxpacket + USB_CRC_SIZE + 2;
460	tmp = ep->rxbuf_d;
461	tmp = (u32)(((tmp >> 2) << 2) + 4);
462
463	for (i = 0; i < bdring_len - 1; i++) {
464		out_be32(&bd->buf, tmp);
465		out_be32((u32 __iomem *)bd, (R_E | R_I));
466		tmp = tmp + size;
467		bd++;
468	}
469	out_be32(&bd->buf, tmp);
470	out_be32((u32 __iomem *)bd, (R_E | R_I | R_W));
471
472	return 0;
473}
474
475static int qe_ep_register_init(struct qe_udc *udc, unsigned char pipe_num)
476{
477	struct qe_ep *ep = &udc->eps[pipe_num];
478	struct usb_ep_para __iomem *epparam;
479	u16 usep, logepnum;
480	u16 tmp;
481	u8 rtfcr = 0;
482
483	epparam = udc->ep_param[pipe_num];
484
485	usep = 0;
486	logepnum = (ep->ep.desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
487	usep |= (logepnum << USB_EPNUM_SHIFT);
488
489	switch (ep->ep.desc->bmAttributes & 0x03) {
490	case USB_ENDPOINT_XFER_BULK:
491		usep |= USB_TRANS_BULK;
492		break;
493	case USB_ENDPOINT_XFER_ISOC:
494		usep |=  USB_TRANS_ISO;
495		break;
496	case USB_ENDPOINT_XFER_INT:
497		usep |= USB_TRANS_INT;
498		break;
499	default:
500		usep |= USB_TRANS_CTR;
501		break;
502	}
503
504	switch (ep->dir) {
505	case USB_DIR_OUT:
506		usep |= USB_THS_IGNORE_IN;
507		break;
508	case USB_DIR_IN:
509		usep |= USB_RHS_IGNORE_OUT;
510		break;
511	default:
512		break;
513	}
514	out_be16(&udc->usb_regs->usb_usep[pipe_num], usep);
515
516	rtfcr = 0x30;
517	out_8(&epparam->rbmr, rtfcr);
518	out_8(&epparam->tbmr, rtfcr);
519
520	tmp = (u16)(ep->ep.maxpacket + USB_CRC_SIZE);
521	/* MRBLR must be divisble by 4 */
522	tmp = (u16)(((tmp >> 2) << 2) + 4);
523	out_be16(&epparam->mrblr, tmp);
524
525	return 0;
526}
527
528static int qe_ep_init(struct qe_udc *udc,
529		      unsigned char pipe_num,
530		      const struct usb_endpoint_descriptor *desc)
531{
532	struct qe_ep *ep = &udc->eps[pipe_num];
533	unsigned long flags;
534	int reval = 0;
535	u16 max = 0;
536
537	max = usb_endpoint_maxp(desc);
538
539	/* check the max package size validate for this endpoint */
540	/* Refer to USB2.0 spec table 9-13,
541	*/
542	if (pipe_num != 0) {
543		switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
544		case USB_ENDPOINT_XFER_BULK:
545			if (strstr(ep->ep.name, "-iso")
546					|| strstr(ep->ep.name, "-int"))
547				goto en_done;
548			switch (udc->gadget.speed) {
549			case USB_SPEED_HIGH:
550			if ((max == 128) || (max == 256) || (max == 512))
551				break;
552			default:
553				switch (max) {
554				case 4:
555				case 8:
556				case 16:
557				case 32:
558				case 64:
559					break;
560				default:
561				case USB_SPEED_LOW:
562					goto en_done;
563				}
564			}
565			break;
566		case USB_ENDPOINT_XFER_INT:
567			if (strstr(ep->ep.name, "-iso"))	/* bulk is ok */
568				goto en_done;
569			switch (udc->gadget.speed) {
570			case USB_SPEED_HIGH:
571				if (max <= 1024)
572					break;
573			case USB_SPEED_FULL:
574				if (max <= 64)
575					break;
576			default:
577				if (max <= 8)
578					break;
579				goto en_done;
580			}
581			break;
582		case USB_ENDPOINT_XFER_ISOC:
583			if (strstr(ep->ep.name, "-bulk")
584				|| strstr(ep->ep.name, "-int"))
585				goto en_done;
586			switch (udc->gadget.speed) {
587			case USB_SPEED_HIGH:
588				if (max <= 1024)
589					break;
590			case USB_SPEED_FULL:
591				if (max <= 1023)
592					break;
593			default:
594				goto en_done;
595			}
596			break;
597		case USB_ENDPOINT_XFER_CONTROL:
598			if (strstr(ep->ep.name, "-iso")
599				|| strstr(ep->ep.name, "-int"))
600				goto en_done;
601			switch (udc->gadget.speed) {
602			case USB_SPEED_HIGH:
603			case USB_SPEED_FULL:
604				switch (max) {
605				case 1:
606				case 2:
607				case 4:
608				case 8:
609				case 16:
610				case 32:
611				case 64:
612					break;
613				default:
614					goto en_done;
615				}
616			case USB_SPEED_LOW:
617				switch (max) {
618				case 1:
619				case 2:
620				case 4:
621				case 8:
622					break;
623				default:
624					goto en_done;
625				}
626			default:
627				goto en_done;
628			}
629			break;
630
631		default:
632			goto en_done;
633		}
634	} /* if ep0*/
635
636	spin_lock_irqsave(&udc->lock, flags);
637
638	/* initialize ep structure */
639	ep->ep.maxpacket = max;
640	ep->tm = (u8)(desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
641	ep->ep.desc = desc;
642	ep->stopped = 0;
643	ep->init = 1;
644
645	if (pipe_num == 0) {
646		ep->dir = USB_DIR_BOTH;
647		udc->ep0_dir = USB_DIR_OUT;
648		udc->ep0_state = WAIT_FOR_SETUP;
649	} else	{
650		switch (desc->bEndpointAddress & USB_ENDPOINT_DIR_MASK) {
651		case USB_DIR_OUT:
652			ep->dir = USB_DIR_OUT;
653			break;
654		case USB_DIR_IN:
655			ep->dir = USB_DIR_IN;
656		default:
657			break;
658		}
659	}
660
661	/* hardware special operation */
662	qe_ep_bd_init(udc, pipe_num);
663	if ((ep->tm == USBP_TM_CTL) || (ep->dir == USB_DIR_OUT)) {
664		reval = qe_ep_rxbd_update(ep);
665		if (reval)
666			goto en_done1;
667	}
668
669	if ((ep->tm == USBP_TM_CTL) || (ep->dir == USB_DIR_IN)) {
670		ep->txframe = kmalloc(sizeof(*ep->txframe), GFP_ATOMIC);
671		if (ep->txframe == NULL) {
672			dev_err(udc->dev, "malloc txframe failed\n");
673			goto en_done2;
674		}
675		qe_frame_init(ep->txframe);
676	}
677
678	qe_ep_register_init(udc, pipe_num);
679
680	/* Now HW will be NAKing transfers to that EP,
681	 * until a buffer is queued to it. */
682	spin_unlock_irqrestore(&udc->lock, flags);
683
684	return 0;
685en_done2:
686	kfree(ep->rxbuffer);
687	kfree(ep->rxframe);
688en_done1:
689	spin_unlock_irqrestore(&udc->lock, flags);
690en_done:
691	dev_err(udc->dev, "failed to initialize %s\n", ep->ep.name);
692	return -ENODEV;
693}
694
695static inline void qe_usb_enable(struct qe_udc *udc)
696{
697	setbits8(&udc->usb_regs->usb_usmod, USB_MODE_EN);
698}
699
700static inline void qe_usb_disable(struct qe_udc *udc)
701{
702	clrbits8(&udc->usb_regs->usb_usmod, USB_MODE_EN);
703}
704
705/*----------------------------------------------------------------------------*
706 *		USB and EP basic manipulate function end		      *
707 *----------------------------------------------------------------------------*/
708
709
710/******************************************************************************
711		UDC transmit and receive process
712 ******************************************************************************/
713static void recycle_one_rxbd(struct qe_ep *ep)
714{
715	u32 bdstatus;
716
717	bdstatus = in_be32((u32 __iomem *)ep->e_rxbd);
718	bdstatus = R_I | R_E | (bdstatus & R_W);
719	out_be32((u32 __iomem *)ep->e_rxbd, bdstatus);
720
721	if (bdstatus & R_W)
722		ep->e_rxbd = ep->rxbase;
723	else
724		ep->e_rxbd++;
725}
726
727static void recycle_rxbds(struct qe_ep *ep, unsigned char stopatnext)
728{
729	u32 bdstatus;
730	struct qe_bd __iomem *bd, *nextbd;
731	unsigned char stop = 0;
732
733	nextbd = ep->n_rxbd;
734	bd = ep->e_rxbd;
735	bdstatus = in_be32((u32 __iomem *)bd);
736
737	while (!(bdstatus & R_E) && !(bdstatus & BD_LENGTH_MASK) && !stop) {
738		bdstatus = R_E | R_I | (bdstatus & R_W);
739		out_be32((u32 __iomem *)bd, bdstatus);
740
741		if (bdstatus & R_W)
742			bd = ep->rxbase;
743		else
744			bd++;
745
746		bdstatus = in_be32((u32 __iomem *)bd);
747		if (stopatnext && (bd == nextbd))
748			stop = 1;
749	}
750
751	ep->e_rxbd = bd;
752}
753
754static void ep_recycle_rxbds(struct qe_ep *ep)
755{
756	struct qe_bd __iomem *bd = ep->n_rxbd;
757	u32 bdstatus;
758	u8 epnum = ep->epnum;
759	struct qe_udc *udc = ep->udc;
760
761	bdstatus = in_be32((u32 __iomem *)bd);
762	if (!(bdstatus & R_E) && !(bdstatus & BD_LENGTH_MASK)) {
763		bd = ep->rxbase +
764				((in_be16(&udc->ep_param[epnum]->rbptr) -
765				  in_be16(&udc->ep_param[epnum]->rbase))
766				 >> 3);
767		bdstatus = in_be32((u32 __iomem *)bd);
768
769		if (bdstatus & R_W)
770			bd = ep->rxbase;
771		else
772			bd++;
773
774		ep->e_rxbd = bd;
775		recycle_rxbds(ep, 0);
776		ep->e_rxbd = ep->n_rxbd;
777	} else
778		recycle_rxbds(ep, 1);
779
780	if (in_be16(&udc->usb_regs->usb_usber) & USB_E_BSY_MASK)
781		out_be16(&udc->usb_regs->usb_usber, USB_E_BSY_MASK);
782
783	if (ep->has_data <= 0 && (!list_empty(&ep->queue)))
784		qe_eprx_normal(ep);
785
786	ep->localnack = 0;
787}
788
789static void setup_received_handle(struct qe_udc *udc,
790					struct usb_ctrlrequest *setup);
791static int qe_ep_rxframe_handle(struct qe_ep *ep);
792static void ep0_req_complete(struct qe_udc *udc, struct qe_req *req);
793/* when BD PID is setup, handle the packet */
794static int ep0_setup_handle(struct qe_udc *udc)
795{
796	struct qe_ep *ep = &udc->eps[0];
797	struct qe_frame *pframe;
798	unsigned int fsize;
799	u8 *cp;
800
801	pframe = ep->rxframe;
802	if ((frame_get_info(pframe) & PID_SETUP)
803			&& (udc->ep0_state == WAIT_FOR_SETUP)) {
804		fsize = frame_get_length(pframe);
805		if (unlikely(fsize != 8))
806			return -EINVAL;
807		cp = (u8 *)&udc->local_setup_buff;
808		memcpy(cp, pframe->data, fsize);
809		ep->data01 = 1;
810
811		/* handle the usb command base on the usb_ctrlrequest */
812		setup_received_handle(udc, &udc->local_setup_buff);
813		return 0;
814	}
815	return -EINVAL;
816}
817
818static int qe_ep0_rx(struct qe_udc *udc)
819{
820	struct qe_ep *ep = &udc->eps[0];
821	struct qe_frame *pframe;
822	struct qe_bd __iomem *bd;
823	u32 bdstatus, length;
824	u32 vaddr;
825
826	pframe = ep->rxframe;
827
828	if (ep->dir == USB_DIR_IN) {
829		dev_err(udc->dev, "ep0 not a control endpoint\n");
830		return -EINVAL;
831	}
832
833	bd = ep->n_rxbd;
834	bdstatus = in_be32((u32 __iomem *)bd);
835	length = bdstatus & BD_LENGTH_MASK;
836
837	while (!(bdstatus & R_E) && length) {
838		if ((bdstatus & R_F) && (bdstatus & R_L)
839			&& !(bdstatus & R_ERROR)) {
840			if (length == USB_CRC_SIZE) {
841				udc->ep0_state = WAIT_FOR_SETUP;
842				dev_vdbg(udc->dev,
843					"receive a ZLP in status phase\n");
844			} else {
845				qe_frame_clean(pframe);
846				vaddr = (u32)phys_to_virt(in_be32(&bd->buf));
847				frame_set_data(pframe, (u8 *)vaddr);
848				frame_set_length(pframe,
849						(length - USB_CRC_SIZE));
850				frame_set_status(pframe, FRAME_OK);
851				switch (bdstatus & R_PID) {
852				case R_PID_SETUP:
853					frame_set_info(pframe, PID_SETUP);
854					break;
855				case R_PID_DATA1:
856					frame_set_info(pframe, PID_DATA1);
857					break;
858				default:
859					frame_set_info(pframe, PID_DATA0);
860					break;
861				}
862
863				if ((bdstatus & R_PID) == R_PID_SETUP)
864					ep0_setup_handle(udc);
865				else
866					qe_ep_rxframe_handle(ep);
867			}
868		} else {
869			dev_err(udc->dev, "The receive frame with error!\n");
870		}
871
872		/* note: don't clear the rxbd's buffer address */
873		recycle_one_rxbd(ep);
874
875		/* Get next BD */
876		if (bdstatus & R_W)
877			bd = ep->rxbase;
878		else
879			bd++;
880
881		bdstatus = in_be32((u32 __iomem *)bd);
882		length = bdstatus & BD_LENGTH_MASK;
883
884	}
885
886	ep->n_rxbd = bd;
887
888	return 0;
889}
890
891static int qe_ep_rxframe_handle(struct qe_ep *ep)
892{
893	struct qe_frame *pframe;
894	u8 framepid = 0;
895	unsigned int fsize;
896	u8 *cp;
897	struct qe_req *req;
898
899	pframe = ep->rxframe;
900
901	if (frame_get_info(pframe) & PID_DATA1)
902		framepid = 0x1;
903
904	if (framepid != ep->data01) {
905		dev_err(ep->udc->dev, "the data01 error!\n");
906		return -EIO;
907	}
908
909	fsize = frame_get_length(pframe);
910	if (list_empty(&ep->queue)) {
911		dev_err(ep->udc->dev, "the %s have no requeue!\n", ep->name);
912	} else {
913		req = list_entry(ep->queue.next, struct qe_req, queue);
914
915		cp = (u8 *)(req->req.buf) + req->req.actual;
916		if (cp) {
917			memcpy(cp, pframe->data, fsize);
918			req->req.actual += fsize;
919			if ((fsize < ep->ep.maxpacket) ||
920					(req->req.actual >= req->req.length)) {
921				if (ep->epnum == 0)
922					ep0_req_complete(ep->udc, req);
923				else
924					done(ep, req, 0);
925				if (list_empty(&ep->queue) && ep->epnum != 0)
926					qe_eprx_nack(ep);
927			}
928		}
929	}
930
931	qe_ep_toggledata01(ep);
932
933	return 0;
934}
935
936static void ep_rx_tasklet(unsigned long data)
937{
938	struct qe_udc *udc = (struct qe_udc *)data;
939	struct qe_ep *ep;
940	struct qe_frame *pframe;
941	struct qe_bd __iomem *bd;
942	unsigned long flags;
943	u32 bdstatus, length;
944	u32 vaddr, i;
945
946	spin_lock_irqsave(&udc->lock, flags);
947
948	for (i = 1; i < USB_MAX_ENDPOINTS; i++) {
949		ep = &udc->eps[i];
950
951		if (ep->dir == USB_DIR_IN || ep->enable_tasklet == 0) {
952			dev_dbg(udc->dev,
953				"This is a transmit ep or disable tasklet!\n");
954			continue;
955		}
956
957		pframe = ep->rxframe;
958		bd = ep->n_rxbd;
959		bdstatus = in_be32((u32 __iomem *)bd);
960		length = bdstatus & BD_LENGTH_MASK;
961
962		while (!(bdstatus & R_E) && length) {
963			if (list_empty(&ep->queue)) {
964				qe_eprx_nack(ep);
965				dev_dbg(udc->dev,
966					"The rxep have noreq %d\n",
967					ep->has_data);
968				break;
969			}
970
971			if ((bdstatus & R_F) && (bdstatus & R_L)
972				&& !(bdstatus & R_ERROR)) {
973				qe_frame_clean(pframe);
974				vaddr = (u32)phys_to_virt(in_be32(&bd->buf));
975				frame_set_data(pframe, (u8 *)vaddr);
976				frame_set_length(pframe,
977						(length - USB_CRC_SIZE));
978				frame_set_status(pframe, FRAME_OK);
979				switch (bdstatus & R_PID) {
980				case R_PID_DATA1:
981					frame_set_info(pframe, PID_DATA1);
982					break;
983				case R_PID_SETUP:
984					frame_set_info(pframe, PID_SETUP);
985					break;
986				default:
987					frame_set_info(pframe, PID_DATA0);
988					break;
989				}
990				/* handle the rx frame */
991				qe_ep_rxframe_handle(ep);
992			} else {
993				dev_err(udc->dev,
994					"error in received frame\n");
995			}
996			/* note: don't clear the rxbd's buffer address */
997			/*clear the length */
998			out_be32((u32 __iomem *)bd, bdstatus & BD_STATUS_MASK);
999			ep->has_data--;
1000			if (!(ep->localnack))
1001				recycle_one_rxbd(ep);
1002
1003			/* Get next BD */
1004			if (bdstatus & R_W)
1005				bd = ep->rxbase;
1006			else
1007				bd++;
1008
1009			bdstatus = in_be32((u32 __iomem *)bd);
1010			length = bdstatus & BD_LENGTH_MASK;
1011		}
1012
1013		ep->n_rxbd = bd;
1014
1015		if (ep->localnack)
1016			ep_recycle_rxbds(ep);
1017
1018		ep->enable_tasklet = 0;
1019	} /* for i=1 */
1020
1021	spin_unlock_irqrestore(&udc->lock, flags);
1022}
1023
1024static int qe_ep_rx(struct qe_ep *ep)
1025{
1026	struct qe_udc *udc;
1027	struct qe_frame *pframe;
1028	struct qe_bd __iomem *bd;
1029	u16 swoffs, ucoffs, emptybds;
1030
1031	udc = ep->udc;
1032	pframe = ep->rxframe;
1033
1034	if (ep->dir == USB_DIR_IN) {
1035		dev_err(udc->dev, "transmit ep in rx function\n");
1036		return -EINVAL;
1037	}
1038
1039	bd = ep->n_rxbd;
1040
1041	swoffs = (u16)(bd - ep->rxbase);
1042	ucoffs = (u16)((in_be16(&udc->ep_param[ep->epnum]->rbptr) -
1043			in_be16(&udc->ep_param[ep->epnum]->rbase)) >> 3);
1044	if (swoffs < ucoffs)
1045		emptybds = USB_BDRING_LEN_RX - ucoffs + swoffs;
1046	else
1047		emptybds = swoffs - ucoffs;
1048
1049	if (emptybds < MIN_EMPTY_BDS) {
1050		qe_eprx_nack(ep);
1051		ep->localnack = 1;
1052		dev_vdbg(udc->dev, "%d empty bds, send NACK\n", emptybds);
1053	}
1054	ep->has_data = USB_BDRING_LEN_RX - emptybds;
1055
1056	if (list_empty(&ep->queue)) {
1057		qe_eprx_nack(ep);
1058		dev_vdbg(udc->dev, "The rxep have no req queued with %d BDs\n",
1059				ep->has_data);
1060		return 0;
1061	}
1062
1063	tasklet_schedule(&udc->rx_tasklet);
1064	ep->enable_tasklet = 1;
1065
1066	return 0;
1067}
1068
1069/* send data from a frame, no matter what tx_req */
1070static int qe_ep_tx(struct qe_ep *ep, struct qe_frame *frame)
1071{
1072	struct qe_udc *udc = ep->udc;
1073	struct qe_bd __iomem *bd;
1074	u16 saveusbmr;
1075	u32 bdstatus, pidmask;
1076	u32 paddr;
1077
1078	if (ep->dir == USB_DIR_OUT) {
1079		dev_err(udc->dev, "receive ep passed to tx function\n");
1080		return -EINVAL;
1081	}
1082
1083	/* Disable the Tx interrupt */
1084	saveusbmr = in_be16(&udc->usb_regs->usb_usbmr);
1085	out_be16(&udc->usb_regs->usb_usbmr,
1086			saveusbmr & ~(USB_E_TXB_MASK | USB_E_TXE_MASK));
1087
1088	bd = ep->n_txbd;
1089	bdstatus = in_be32((u32 __iomem *)bd);
1090
1091	if (!(bdstatus & (T_R | BD_LENGTH_MASK))) {
1092		if (frame_get_length(frame) == 0) {
1093			frame_set_data(frame, udc->nullbuf);
1094			frame_set_length(frame, 2);
1095			frame->info |= (ZLP | NO_CRC);
1096			dev_vdbg(udc->dev, "the frame size = 0\n");
1097		}
1098		paddr = virt_to_phys((void *)frame->data);
1099		out_be32(&bd->buf, paddr);
1100		bdstatus = (bdstatus&T_W);
1101		if (!(frame_get_info(frame) & NO_CRC))
1102			bdstatus |= T_R | T_I | T_L | T_TC
1103					| frame_get_length(frame);
1104		else
1105			bdstatus |= T_R | T_I | T_L | frame_get_length(frame);
1106
1107		/* if the packet is a ZLP in status phase */
1108		if ((ep->epnum == 0) && (udc->ep0_state == DATA_STATE_NEED_ZLP))
1109			ep->data01 = 0x1;
1110
1111		if (ep->data01) {
1112			pidmask = T_PID_DATA1;
1113			frame->info |= PID_DATA1;
1114		} else {
1115			pidmask = T_PID_DATA0;
1116			frame->info |= PID_DATA0;
1117		}
1118		bdstatus |= T_CNF;
1119		bdstatus |= pidmask;
1120		out_be32((u32 __iomem *)bd, bdstatus);
1121		qe_ep_filltxfifo(ep);
1122
1123		/* enable the TX interrupt */
1124		out_be16(&udc->usb_regs->usb_usbmr, saveusbmr);
1125
1126		qe_ep_toggledata01(ep);
1127		if (bdstatus & T_W)
1128			ep->n_txbd = ep->txbase;
1129		else
1130			ep->n_txbd++;
1131
1132		return 0;
1133	} else {
1134		out_be16(&udc->usb_regs->usb_usbmr, saveusbmr);
1135		dev_vdbg(udc->dev, "The tx bd is not ready!\n");
1136		return -EBUSY;
1137	}
1138}
1139
1140/* when a bd was transmitted, the function can
1141 * handle the tx_req, not include ep0           */
1142static int txcomplete(struct qe_ep *ep, unsigned char restart)
1143{
1144	if (ep->tx_req != NULL) {
1145		struct qe_req *req = ep->tx_req;
1146		unsigned zlp = 0, last_len = 0;
1147
1148		last_len = min_t(unsigned, req->req.length - ep->sent,
1149				ep->ep.maxpacket);
1150
1151		if (!restart) {
1152			int asent = ep->last;
1153			ep->sent += asent;
1154			ep->last -= asent;
1155		} else {
1156			ep->last = 0;
1157		}
1158
1159		/* zlp needed when req->re.zero is set */
1160		if (req->req.zero) {
1161			if (last_len == 0 ||
1162				(req->req.length % ep->ep.maxpacket) != 0)
1163				zlp = 0;
1164			else
1165				zlp = 1;
1166		} else
1167			zlp = 0;
1168
1169		/* a request already were transmitted completely */
1170		if (((ep->tx_req->req.length - ep->sent) <= 0) && !zlp) {
1171			done(ep, ep->tx_req, 0);
1172			ep->tx_req = NULL;
1173			ep->last = 0;
1174			ep->sent = 0;
1175		}
1176	}
1177
1178	/* we should gain a new tx_req fot this endpoint */
1179	if (ep->tx_req == NULL) {
1180		if (!list_empty(&ep->queue)) {
1181			ep->tx_req = list_entry(ep->queue.next,	struct qe_req,
1182							queue);
1183			ep->last = 0;
1184			ep->sent = 0;
1185		}
1186	}
1187
1188	return 0;
1189}
1190
1191/* give a frame and a tx_req, send some data */
1192static int qe_usb_senddata(struct qe_ep *ep, struct qe_frame *frame)
1193{
1194	unsigned int size;
1195	u8 *buf;
1196
1197	qe_frame_clean(frame);
1198	size = min_t(u32, (ep->tx_req->req.length - ep->sent),
1199				ep->ep.maxpacket);
1200	buf = (u8 *)ep->tx_req->req.buf + ep->sent;
1201	if (buf && size) {
1202		ep->last = size;
1203		ep->tx_req->req.actual += size;
1204		frame_set_data(frame, buf);
1205		frame_set_length(frame, size);
1206		frame_set_status(frame, FRAME_OK);
1207		frame_set_info(frame, 0);
1208		return qe_ep_tx(ep, frame);
1209	}
1210	return -EIO;
1211}
1212
1213/* give a frame struct,send a ZLP */
1214static int sendnulldata(struct qe_ep *ep, struct qe_frame *frame, uint infor)
1215{
1216	struct qe_udc *udc = ep->udc;
1217
1218	if (frame == NULL)
1219		return -ENODEV;
1220
1221	qe_frame_clean(frame);
1222	frame_set_data(frame, (u8 *)udc->nullbuf);
1223	frame_set_length(frame, 2);
1224	frame_set_status(frame, FRAME_OK);
1225	frame_set_info(frame, (ZLP | NO_CRC | infor));
1226
1227	return qe_ep_tx(ep, frame);
1228}
1229
1230static int frame_create_tx(struct qe_ep *ep, struct qe_frame *frame)
1231{
1232	struct qe_req *req = ep->tx_req;
1233	int reval;
1234
1235	if (req == NULL)
1236		return -ENODEV;
1237
1238	if ((req->req.length - ep->sent) > 0)
1239		reval = qe_usb_senddata(ep, frame);
1240	else
1241		reval = sendnulldata(ep, frame, 0);
1242
1243	return reval;
1244}
1245
1246/* if direction is DIR_IN, the status is Device->Host
1247 * if direction is DIR_OUT, the status transaction is Device<-Host
1248 * in status phase, udc create a request and gain status */
1249static int ep0_prime_status(struct qe_udc *udc, int direction)
1250{
1251
1252	struct qe_ep *ep = &udc->eps[0];
1253
1254	if (direction == USB_DIR_IN) {
1255		udc->ep0_state = DATA_STATE_NEED_ZLP;
1256		udc->ep0_dir = USB_DIR_IN;
1257		sendnulldata(ep, ep->txframe, SETUP_STATUS | NO_REQ);
1258	} else {
1259		udc->ep0_dir = USB_DIR_OUT;
1260		udc->ep0_state = WAIT_FOR_OUT_STATUS;
1261	}
1262
1263	return 0;
1264}
1265
1266/* a request complete in ep0, whether gadget request or udc request */
1267static void ep0_req_complete(struct qe_udc *udc, struct qe_req *req)
1268{
1269	struct qe_ep *ep = &udc->eps[0];
1270	/* because usb and ep's status already been set in ch9setaddress() */
1271
1272	switch (udc->ep0_state) {
1273	case DATA_STATE_XMIT:
1274		done(ep, req, 0);
1275		/* receive status phase */
1276		if (ep0_prime_status(udc, USB_DIR_OUT))
1277			qe_ep0_stall(udc);
1278		break;
1279
1280	case DATA_STATE_NEED_ZLP:
1281		done(ep, req, 0);
1282		udc->ep0_state = WAIT_FOR_SETUP;
1283		break;
1284
1285	case DATA_STATE_RECV:
1286		done(ep, req, 0);
1287		/* send status phase */
1288		if (ep0_prime_status(udc, USB_DIR_IN))
1289			qe_ep0_stall(udc);
1290		break;
1291
1292	case WAIT_FOR_OUT_STATUS:
1293		done(ep, req, 0);
1294		udc->ep0_state = WAIT_FOR_SETUP;
1295		break;
1296
1297	case WAIT_FOR_SETUP:
1298		dev_vdbg(udc->dev, "Unexpected interrupt\n");
1299		break;
1300
1301	default:
1302		qe_ep0_stall(udc);
1303		break;
1304	}
1305}
1306
1307static int ep0_txcomplete(struct qe_ep *ep, unsigned char restart)
1308{
1309	struct qe_req *tx_req = NULL;
1310	struct qe_frame *frame = ep->txframe;
1311
1312	if ((frame_get_info(frame) & (ZLP | NO_REQ)) == (ZLP | NO_REQ)) {
1313		if (!restart)
1314			ep->udc->ep0_state = WAIT_FOR_SETUP;
1315		else
1316			sendnulldata(ep, ep->txframe, SETUP_STATUS | NO_REQ);
1317		return 0;
1318	}
1319
1320	tx_req = ep->tx_req;
1321	if (tx_req != NULL) {
1322		if (!restart) {
1323			int asent = ep->last;
1324			ep->sent += asent;
1325			ep->last -= asent;
1326		} else {
1327			ep->last = 0;
1328		}
1329
1330		/* a request already were transmitted completely */
1331		if ((ep->tx_req->req.length - ep->sent) <= 0) {
1332			ep->tx_req->req.actual = (unsigned int)ep->sent;
1333			ep0_req_complete(ep->udc, ep->tx_req);
1334			ep->tx_req = NULL;
1335			ep->last = 0;
1336			ep->sent = 0;
1337		}
1338	} else {
1339		dev_vdbg(ep->udc->dev, "the ep0_controller have no req\n");
1340	}
1341
1342	return 0;
1343}
1344
1345static int ep0_txframe_handle(struct qe_ep *ep)
1346{
1347	/* if have error, transmit again */
1348	if (frame_get_status(ep->txframe) & FRAME_ERROR) {
1349		qe_ep_flushtxfifo(ep);
1350		dev_vdbg(ep->udc->dev, "The EP0 transmit data have error!\n");
1351		if (frame_get_info(ep->txframe) & PID_DATA0)
1352			ep->data01 = 0;
1353		else
1354			ep->data01 = 1;
1355
1356		ep0_txcomplete(ep, 1);
1357	} else
1358		ep0_txcomplete(ep, 0);
1359
1360	frame_create_tx(ep, ep->txframe);
1361	return 0;
1362}
1363
1364static int qe_ep0_txconf(struct qe_ep *ep)
1365{
1366	struct qe_bd __iomem *bd;
1367	struct qe_frame *pframe;
1368	u32 bdstatus;
1369
1370	bd = ep->c_txbd;
1371	bdstatus = in_be32((u32 __iomem *)bd);
1372	while (!(bdstatus & T_R) && (bdstatus & ~T_W)) {
1373		pframe = ep->txframe;
1374
1375		/* clear and recycle the BD */
1376		out_be32((u32 __iomem *)bd, bdstatus & T_W);
1377		out_be32(&bd->buf, 0);
1378		if (bdstatus & T_W)
1379			ep->c_txbd = ep->txbase;
1380		else
1381			ep->c_txbd++;
1382
1383		if (ep->c_txbd == ep->n_txbd) {
1384			if (bdstatus & DEVICE_T_ERROR) {
1385				frame_set_status(pframe, FRAME_ERROR);
1386				if (bdstatus & T_TO)
1387					pframe->status |= TX_ER_TIMEOUT;
1388				if (bdstatus & T_UN)
1389					pframe->status |= TX_ER_UNDERUN;
1390			}
1391			ep0_txframe_handle(ep);
1392		}
1393
1394		bd = ep->c_txbd;
1395		bdstatus = in_be32((u32 __iomem *)bd);
1396	}
1397
1398	return 0;
1399}
1400
1401static int ep_txframe_handle(struct qe_ep *ep)
1402{
1403	if (frame_get_status(ep->txframe) & FRAME_ERROR) {
1404		qe_ep_flushtxfifo(ep);
1405		dev_vdbg(ep->udc->dev, "The EP0 transmit data have error!\n");
1406		if (frame_get_info(ep->txframe) & PID_DATA0)
1407			ep->data01 = 0;
1408		else
1409			ep->data01 = 1;
1410
1411		txcomplete(ep, 1);
1412	} else
1413		txcomplete(ep, 0);
1414
1415	frame_create_tx(ep, ep->txframe); /* send the data */
1416	return 0;
1417}
1418
1419/* confirm the already trainsmited bd */
1420static int qe_ep_txconf(struct qe_ep *ep)
1421{
1422	struct qe_bd __iomem *bd;
1423	struct qe_frame *pframe = NULL;
1424	u32 bdstatus;
1425	unsigned char breakonrxinterrupt = 0;
1426
1427	bd = ep->c_txbd;
1428	bdstatus = in_be32((u32 __iomem *)bd);
1429	while (!(bdstatus & T_R) && (bdstatus & ~T_W)) {
1430		pframe = ep->txframe;
1431		if (bdstatus & DEVICE_T_ERROR) {
1432			frame_set_status(pframe, FRAME_ERROR);
1433			if (bdstatus & T_TO)
1434				pframe->status |= TX_ER_TIMEOUT;
1435			if (bdstatus & T_UN)
1436				pframe->status |= TX_ER_UNDERUN;
1437		}
1438
1439		/* clear and recycle the BD */
1440		out_be32((u32 __iomem *)bd, bdstatus & T_W);
1441		out_be32(&bd->buf, 0);
1442		if (bdstatus & T_W)
1443			ep->c_txbd = ep->txbase;
1444		else
1445			ep->c_txbd++;
1446
1447		/* handle the tx frame */
1448		ep_txframe_handle(ep);
1449		bd = ep->c_txbd;
1450		bdstatus = in_be32((u32 __iomem *)bd);
1451	}
1452	if (breakonrxinterrupt)
1453		return -EIO;
1454	else
1455		return 0;
1456}
1457
1458/* Add a request in queue, and try to transmit a packet */
1459static int ep_req_send(struct qe_ep *ep, struct qe_req *req)
1460{
1461	int reval = 0;
1462
1463	if (ep->tx_req == NULL) {
1464		ep->sent = 0;
1465		ep->last = 0;
1466		txcomplete(ep, 0); /* can gain a new tx_req */
1467		reval = frame_create_tx(ep, ep->txframe);
1468	}
1469	return reval;
1470}
1471
1472/* Maybe this is a good ideal */
1473static int ep_req_rx(struct qe_ep *ep, struct qe_req *req)
1474{
1475	struct qe_udc *udc = ep->udc;
1476	struct qe_frame *pframe = NULL;
1477	struct qe_bd __iomem *bd;
1478	u32 bdstatus, length;
1479	u32 vaddr, fsize;
1480	u8 *cp;
1481	u8 finish_req = 0;
1482	u8 framepid;
1483
1484	if (list_empty(&ep->queue)) {
1485		dev_vdbg(udc->dev, "the req already finish!\n");
1486		return 0;
1487	}
1488	pframe = ep->rxframe;
1489
1490	bd = ep->n_rxbd;
1491	bdstatus = in_be32((u32 __iomem *)bd);
1492	length = bdstatus & BD_LENGTH_MASK;
1493
1494	while (!(bdstatus & R_E) && length) {
1495		if (finish_req)
1496			break;
1497		if ((bdstatus & R_F) && (bdstatus & R_L)
1498					&& !(bdstatus & R_ERROR)) {
1499			qe_frame_clean(pframe);
1500			vaddr = (u32)phys_to_virt(in_be32(&bd->buf));
1501			frame_set_data(pframe, (u8 *)vaddr);
1502			frame_set_length(pframe, (length - USB_CRC_SIZE));
1503			frame_set_status(pframe, FRAME_OK);
1504			switch (bdstatus & R_PID) {
1505			case R_PID_DATA1:
1506				frame_set_info(pframe, PID_DATA1); break;
1507			default:
1508				frame_set_info(pframe, PID_DATA0); break;
1509			}
1510			/* handle the rx frame */
1511
1512			if (frame_get_info(pframe) & PID_DATA1)
1513				framepid = 0x1;
1514			else
1515				framepid = 0;
1516
1517			if (framepid != ep->data01) {
1518				dev_vdbg(udc->dev, "the data01 error!\n");
1519			} else {
1520				fsize = frame_get_length(pframe);
1521
1522				cp = (u8 *)(req->req.buf) + req->req.actual;
1523				if (cp) {
1524					memcpy(cp, pframe->data, fsize);
1525					req->req.actual += fsize;
1526					if ((fsize < ep->ep.maxpacket)
1527						|| (req->req.actual >=
1528							req->req.length)) {
1529						finish_req = 1;
1530						done(ep, req, 0);
1531						if (list_empty(&ep->queue))
1532							qe_eprx_nack(ep);
1533					}
1534				}
1535				qe_ep_toggledata01(ep);
1536			}
1537		} else {
1538			dev_err(udc->dev, "The receive frame with error!\n");
1539		}
1540
1541		/* note: don't clear the rxbd's buffer address *
1542		 * only Clear the length */
1543		out_be32((u32 __iomem *)bd, (bdstatus & BD_STATUS_MASK));
1544		ep->has_data--;
1545
1546		/* Get next BD */
1547		if (bdstatus & R_W)
1548			bd = ep->rxbase;
1549		else
1550			bd++;
1551
1552		bdstatus = in_be32((u32 __iomem *)bd);
1553		length = bdstatus & BD_LENGTH_MASK;
1554	}
1555
1556	ep->n_rxbd = bd;
1557	ep_recycle_rxbds(ep);
1558
1559	return 0;
1560}
1561
1562/* only add the request in queue */
1563static int ep_req_receive(struct qe_ep *ep, struct qe_req *req)
1564{
1565	if (ep->state == EP_STATE_NACK) {
1566		if (ep->has_data <= 0) {
1567			/* Enable rx and unmask rx interrupt */
1568			qe_eprx_normal(ep);
1569		} else {
1570			/* Copy the exist BD data */
1571			ep_req_rx(ep, req);
1572		}
1573	}
1574
1575	return 0;
1576}
1577
1578/********************************************************************
1579	Internal Used Function End
1580********************************************************************/
1581
1582/*-----------------------------------------------------------------------
1583	Endpoint Management Functions For Gadget
1584 -----------------------------------------------------------------------*/
1585static int qe_ep_enable(struct usb_ep *_ep,
1586			 const struct usb_endpoint_descriptor *desc)
1587{
1588	struct qe_udc *udc;
1589	struct qe_ep *ep;
1590	int retval = 0;
1591	unsigned char epnum;
1592
1593	ep = container_of(_ep, struct qe_ep, ep);
1594
1595	/* catch various bogus parameters */
1596	if (!_ep || !desc || _ep->name == ep_name[0] ||
1597			(desc->bDescriptorType != USB_DT_ENDPOINT))
1598		return -EINVAL;
1599
1600	udc = ep->udc;
1601	if (!udc->driver || (udc->gadget.speed == USB_SPEED_UNKNOWN))
1602		return -ESHUTDOWN;
1603
1604	epnum = (u8)desc->bEndpointAddress & 0xF;
1605
1606	retval = qe_ep_init(udc, epnum, desc);
1607	if (retval != 0) {
1608		cpm_muram_free(cpm_muram_offset(ep->rxbase));
1609		dev_dbg(udc->dev, "enable ep%d failed\n", ep->epnum);
1610		return -EINVAL;
1611	}
1612	dev_dbg(udc->dev, "enable ep%d successful\n", ep->epnum);
1613	return 0;
1614}
1615
1616static int qe_ep_disable(struct usb_ep *_ep)
1617{
1618	struct qe_udc *udc;
1619	struct qe_ep *ep;
1620	unsigned long flags;
1621	unsigned int size;
1622
1623	ep = container_of(_ep, struct qe_ep, ep);
1624	udc = ep->udc;
1625
1626	if (!_ep || !ep->ep.desc) {
1627		dev_dbg(udc->dev, "%s not enabled\n", _ep ? ep->ep.name : NULL);
1628		return -EINVAL;
1629	}
1630
1631	spin_lock_irqsave(&udc->lock, flags);
1632	/* Nuke all pending requests (does flush) */
1633	nuke(ep, -ESHUTDOWN);
1634	ep->ep.desc = NULL;
1635	ep->stopped = 1;
1636	ep->tx_req = NULL;
1637	qe_ep_reset(udc, ep->epnum);
1638	spin_unlock_irqrestore(&udc->lock, flags);
1639
1640	cpm_muram_free(cpm_muram_offset(ep->rxbase));
1641
1642	if (ep->dir == USB_DIR_OUT)
1643		size = (ep->ep.maxpacket + USB_CRC_SIZE + 2) *
1644				(USB_BDRING_LEN_RX + 1);
1645	else
1646		size = (ep->ep.maxpacket + USB_CRC_SIZE + 2) *
1647				(USB_BDRING_LEN + 1);
1648
1649	if (ep->dir != USB_DIR_IN) {
1650		kfree(ep->rxframe);
1651		if (ep->rxbufmap) {
1652			dma_unmap_single(udc->gadget.dev.parent,
1653					ep->rxbuf_d, size,
1654					DMA_FROM_DEVICE);
1655			ep->rxbuf_d = DMA_ADDR_INVALID;
1656		} else {
1657			dma_sync_single_for_cpu(
1658					udc->gadget.dev.parent,
1659					ep->rxbuf_d, size,
1660					DMA_FROM_DEVICE);
1661		}
1662		kfree(ep->rxbuffer);
1663	}
1664
1665	if (ep->dir != USB_DIR_OUT)
1666		kfree(ep->txframe);
1667
1668	dev_dbg(udc->dev, "disabled %s OK\n", _ep->name);
1669	return 0;
1670}
1671
1672static struct usb_request *qe_alloc_request(struct usb_ep *_ep,	gfp_t gfp_flags)
1673{
1674	struct qe_req *req;
1675
1676	req = kzalloc(sizeof(*req), gfp_flags);
1677	if (!req)
1678		return NULL;
1679
1680	req->req.dma = DMA_ADDR_INVALID;
1681
1682	INIT_LIST_HEAD(&req->queue);
1683
1684	return &req->req;
1685}
1686
1687static void qe_free_request(struct usb_ep *_ep, struct usb_request *_req)
1688{
1689	struct qe_req *req;
1690
1691	req = container_of(_req, struct qe_req, req);
1692
1693	if (_req)
1694		kfree(req);
1695}
1696
1697static int __qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req)
1698{
1699	struct qe_ep *ep = container_of(_ep, struct qe_ep, ep);
1700	struct qe_req *req = container_of(_req, struct qe_req, req);
1701	struct qe_udc *udc;
1702	int reval;
1703
1704	udc = ep->udc;
1705	/* catch various bogus parameters */
1706	if (!_req || !req->req.complete || !req->req.buf
1707			|| !list_empty(&req->queue)) {
1708		dev_dbg(udc->dev, "bad params\n");
1709		return -EINVAL;
1710	}
1711	if (!_ep || (!ep->ep.desc && ep_index(ep))) {
1712		dev_dbg(udc->dev, "bad ep\n");
1713		return -EINVAL;
1714	}
1715
1716	if (!udc->driver || udc->gadget.speed == USB_SPEED_UNKNOWN)
1717		return -ESHUTDOWN;
1718
1719	req->ep = ep;
1720
1721	/* map virtual address to hardware */
1722	if (req->req.dma == DMA_ADDR_INVALID) {
1723		req->req.dma = dma_map_single(ep->udc->gadget.dev.parent,
1724					req->req.buf,
1725					req->req.length,
1726					ep_is_in(ep)
1727					? DMA_TO_DEVICE :
1728					DMA_FROM_DEVICE);
1729		req->mapped = 1;
1730	} else {
1731		dma_sync_single_for_device(ep->udc->gadget.dev.parent,
1732					req->req.dma, req->req.length,
1733					ep_is_in(ep)
1734					? DMA_TO_DEVICE :
1735					DMA_FROM_DEVICE);
1736		req->mapped = 0;
1737	}
1738
1739	req->req.status = -EINPROGRESS;
1740	req->req.actual = 0;
1741
1742	list_add_tail(&req->queue, &ep->queue);
1743	dev_vdbg(udc->dev, "gadget have request in %s! %d\n",
1744			ep->name, req->req.length);
1745
1746	/* push the request to device */
1747	if (ep_is_in(ep))
1748		reval = ep_req_send(ep, req);
1749
1750	/* EP0 */
1751	if (ep_index(ep) == 0 && req->req.length > 0) {
1752		if (ep_is_in(ep))
1753			udc->ep0_state = DATA_STATE_XMIT;
1754		else
1755			udc->ep0_state = DATA_STATE_RECV;
1756	}
1757
1758	if (ep->dir == USB_DIR_OUT)
1759		reval = ep_req_receive(ep, req);
1760
1761	return 0;
1762}
1763
1764/* queues (submits) an I/O request to an endpoint */
1765static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
1766		       gfp_t gfp_flags)
1767{
1768	struct qe_ep *ep = container_of(_ep, struct qe_ep, ep);
1769	struct qe_udc *udc = ep->udc;
1770	unsigned long flags;
1771	int ret;
1772
1773	spin_lock_irqsave(&udc->lock, flags);
1774	ret = __qe_ep_queue(_ep, _req);
1775	spin_unlock_irqrestore(&udc->lock, flags);
1776	return ret;
1777}
1778
1779/* dequeues (cancels, unlinks) an I/O request from an endpoint */
1780static int qe_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
1781{
1782	struct qe_ep *ep = container_of(_ep, struct qe_ep, ep);
1783	struct qe_req *req;
1784	unsigned long flags;
1785
1786	if (!_ep || !_req)
1787		return -EINVAL;
1788
1789	spin_lock_irqsave(&ep->udc->lock, flags);
1790
1791	/* make sure it's actually queued on this endpoint */
1792	list_for_each_entry(req, &ep->queue, queue) {
1793		if (&req->req == _req)
1794			break;
1795	}
1796
1797	if (&req->req != _req) {
1798		spin_unlock_irqrestore(&ep->udc->lock, flags);
1799		return -EINVAL;
1800	}
1801
1802	done(ep, req, -ECONNRESET);
1803
1804	spin_unlock_irqrestore(&ep->udc->lock, flags);
1805	return 0;
1806}
1807
1808/*-----------------------------------------------------------------
1809 * modify the endpoint halt feature
1810 * @ep: the non-isochronous endpoint being stalled
1811 * @value: 1--set halt  0--clear halt
1812 * Returns zero, or a negative error code.
1813*----------------------------------------------------------------*/
1814static int qe_ep_set_halt(struct usb_ep *_ep, int value)
1815{
1816	struct qe_ep *ep;
1817	unsigned long flags;
1818	int status = -EOPNOTSUPP;
1819	struct qe_udc *udc;
1820
1821	ep = container_of(_ep, struct qe_ep, ep);
1822	if (!_ep || !ep->ep.desc) {
1823		status = -EINVAL;
1824		goto out;
1825	}
1826
1827	udc = ep->udc;
1828	/* Attempt to halt IN ep will fail if any transfer requests
1829	 * are still queue */
1830	if (value && ep_is_in(ep) && !list_empty(&ep->queue)) {
1831		status = -EAGAIN;
1832		goto out;
1833	}
1834
1835	status = 0;
1836	spin_lock_irqsave(&ep->udc->lock, flags);
1837	qe_eptx_stall_change(ep, value);
1838	qe_eprx_stall_change(ep, value);
1839	spin_unlock_irqrestore(&ep->udc->lock, flags);
1840
1841	if (ep->epnum == 0) {
1842		udc->ep0_state = WAIT_FOR_SETUP;
1843		udc->ep0_dir = 0;
1844	}
1845
1846	/* set data toggle to DATA0 on clear halt */
1847	if (value == 0)
1848		ep->data01 = 0;
1849out:
1850	dev_vdbg(udc->dev, "%s %s halt stat %d\n", ep->ep.name,
1851			value ?  "set" : "clear", status);
1852
1853	return status;
1854}
1855
1856static struct usb_ep_ops qe_ep_ops = {
1857	.enable = qe_ep_enable,
1858	.disable = qe_ep_disable,
1859
1860	.alloc_request = qe_alloc_request,
1861	.free_request = qe_free_request,
1862
1863	.queue = qe_ep_queue,
1864	.dequeue = qe_ep_dequeue,
1865
1866	.set_halt = qe_ep_set_halt,
1867};
1868
1869/*------------------------------------------------------------------------
1870	Gadget Driver Layer Operations
1871 ------------------------------------------------------------------------*/
1872
1873/* Get the current frame number */
1874static int qe_get_frame(struct usb_gadget *gadget)
1875{
1876	struct qe_udc *udc = container_of(gadget, struct qe_udc, gadget);
1877	u16 tmp;
1878
1879	tmp = in_be16(&udc->usb_param->frame_n);
1880	if (tmp & 0x8000)
1881		tmp = tmp & 0x07ff;
1882	else
1883		tmp = -EINVAL;
1884
1885	return (int)tmp;
1886}
1887
1888static int fsl_qe_start(struct usb_gadget *gadget,
1889		struct usb_gadget_driver *driver);
1890static int fsl_qe_stop(struct usb_gadget *gadget);
1891
1892/* defined in usb_gadget.h */
1893static const struct usb_gadget_ops qe_gadget_ops = {
1894	.get_frame = qe_get_frame,
1895	.udc_start = fsl_qe_start,
1896	.udc_stop = fsl_qe_stop,
1897};
1898
1899/*-------------------------------------------------------------------------
1900	USB ep0 Setup process in BUS Enumeration
1901 -------------------------------------------------------------------------*/
1902static int udc_reset_ep_queue(struct qe_udc *udc, u8 pipe)
1903{
1904	struct qe_ep *ep = &udc->eps[pipe];
1905
1906	nuke(ep, -ECONNRESET);
1907	ep->tx_req = NULL;
1908	return 0;
1909}
1910
1911static int reset_queues(struct qe_udc *udc)
1912{
1913	u8 pipe;
1914
1915	for (pipe = 0; pipe < USB_MAX_ENDPOINTS; pipe++)
1916		udc_reset_ep_queue(udc, pipe);
1917
1918	/* report disconnect; the driver is already quiesced */
1919	spin_unlock(&udc->lock);
1920	usb_gadget_udc_reset(&udc->gadget, udc->driver);
1921	spin_lock(&udc->lock);
1922
1923	return 0;
1924}
1925
1926static void ch9setaddress(struct qe_udc *udc, u16 value, u16 index,
1927			u16 length)
1928{
1929	/* Save the new address to device struct */
1930	udc->device_address = (u8) value;
1931	/* Update usb state */
1932	udc->usb_state = USB_STATE_ADDRESS;
1933
1934	/* Status phase , send a ZLP */
1935	if (ep0_prime_status(udc, USB_DIR_IN))
1936		qe_ep0_stall(udc);
1937}
1938
1939static void ownercomplete(struct usb_ep *_ep, struct usb_request *_req)
1940{
1941	struct qe_req *req = container_of(_req, struct qe_req, req);
1942
1943	req->req.buf = NULL;
1944	kfree(req);
1945}
1946
1947static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
1948			u16 index, u16 length)
1949{
1950	u16 usb_status = 0;
1951	struct qe_req *req;
1952	struct qe_ep *ep;
1953	int status = 0;
1954
1955	ep = &udc->eps[0];
1956	if ((request_type & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
1957		/* Get device status */
1958		usb_status = 1 << USB_DEVICE_SELF_POWERED;
1959	} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_INTERFACE) {
1960		/* Get interface status */
1961		/* We don't have interface information in udc driver */
1962		usb_status = 0;
1963	} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
1964		/* Get endpoint status */
1965		int pipe = index & USB_ENDPOINT_NUMBER_MASK;
1966		struct qe_ep *target_ep = &udc->eps[pipe];
1967		u16 usep;
1968
1969		/* stall if endpoint doesn't exist */
1970		if (!target_ep->ep.desc)
1971			goto stall;
1972
1973		usep = in_be16(&udc->usb_regs->usb_usep[pipe]);
1974		if (index & USB_DIR_IN) {
1975			if (target_ep->dir != USB_DIR_IN)
1976				goto stall;
1977			if ((usep & USB_THS_MASK) == USB_THS_STALL)
1978				usb_status = 1 << USB_ENDPOINT_HALT;
1979		} else {
1980			if (target_ep->dir != USB_DIR_OUT)
1981				goto stall;
1982			if ((usep & USB_RHS_MASK) == USB_RHS_STALL)
1983				usb_status = 1 << USB_ENDPOINT_HALT;
1984		}
1985	}
1986
1987	req = container_of(qe_alloc_request(&ep->ep, GFP_KERNEL),
1988					struct qe_req, req);
1989	req->req.length = 2;
1990	req->req.buf = udc->statusbuf;
1991	*(u16 *)req->req.buf = cpu_to_le16(usb_status);
1992	req->req.status = -EINPROGRESS;
1993	req->req.actual = 0;
1994	req->req.complete = ownercomplete;
1995
1996	udc->ep0_dir = USB_DIR_IN;
1997
1998	/* data phase */
1999	status = __qe_ep_queue(&ep->ep, &req->req);
2000
2001	if (status == 0)
2002		return;
2003stall:
2004	dev_err(udc->dev, "Can't respond to getstatus request \n");
2005	qe_ep0_stall(udc);
2006}
2007
2008/* only handle the setup request, suppose the device in normal status */
2009static void setup_received_handle(struct qe_udc *udc,
2010				struct usb_ctrlrequest *setup)
2011{
2012	/* Fix Endian (udc->local_setup_buff is cpu Endian now)*/
2013	u16 wValue = le16_to_cpu(setup->wValue);
2014	u16 wIndex = le16_to_cpu(setup->wIndex);
2015	u16 wLength = le16_to_cpu(setup->wLength);
2016
2017	/* clear the previous request in the ep0 */
2018	udc_reset_ep_queue(udc, 0);
2019
2020	if (setup->bRequestType & USB_DIR_IN)
2021		udc->ep0_dir = USB_DIR_IN;
2022	else
2023		udc->ep0_dir = USB_DIR_OUT;
2024
2025	switch (setup->bRequest) {
2026	case USB_REQ_GET_STATUS:
2027		/* Data+Status phase form udc */
2028		if ((setup->bRequestType & (USB_DIR_IN | USB_TYPE_MASK))
2029					!= (USB_DIR_IN | USB_TYPE_STANDARD))
2030			break;
2031		ch9getstatus(udc, setup->bRequestType, wValue, wIndex,
2032					wLength);
2033		return;
2034
2035	case USB_REQ_SET_ADDRESS:
2036		/* Status phase from udc */
2037		if (setup->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
2038						USB_RECIP_DEVICE))
2039			break;
2040		ch9setaddress(udc, wValue, wIndex, wLength);
2041		return;
2042
2043	case USB_REQ_CLEAR_FEATURE:
2044	case USB_REQ_SET_FEATURE:
2045		/* Requests with no data phase, status phase from udc */
2046		if ((setup->bRequestType & USB_TYPE_MASK)
2047					!= USB_TYPE_STANDARD)
2048			break;
2049
2050		if ((setup->bRequestType & USB_RECIP_MASK)
2051				== USB_RECIP_ENDPOINT) {
2052			int pipe = wIndex & USB_ENDPOINT_NUMBER_MASK;
2053			struct qe_ep *ep;
2054
2055			if (wValue != 0 || wLength != 0
2056				|| pipe > USB_MAX_ENDPOINTS)
2057				break;
2058			ep = &udc->eps[pipe];
2059
2060			spin_unlock(&udc->lock);
2061			qe_ep_set_halt(&ep->ep,
2062					(setup->bRequest == USB_REQ_SET_FEATURE)
2063						? 1 : 0);
2064			spin_lock(&udc->lock);
2065		}
2066
2067		ep0_prime_status(udc, USB_DIR_IN);
2068
2069		return;
2070
2071	default:
2072		break;
2073	}
2074
2075	if (wLength) {
2076		/* Data phase from gadget, status phase from udc */
2077		if (setup->bRequestType & USB_DIR_IN) {
2078			udc->ep0_state = DATA_STATE_XMIT;
2079			udc->ep0_dir = USB_DIR_IN;
2080		} else {
2081			udc->ep0_state = DATA_STATE_RECV;
2082			udc->ep0_dir = USB_DIR_OUT;
2083		}
2084		spin_unlock(&udc->lock);
2085		if (udc->driver->setup(&udc->gadget,
2086					&udc->local_setup_buff) < 0)
2087			qe_ep0_stall(udc);
2088		spin_lock(&udc->lock);
2089	} else {
2090		/* No data phase, IN status from gadget */
2091		udc->ep0_dir = USB_DIR_IN;
2092		spin_unlock(&udc->lock);
2093		if (udc->driver->setup(&udc->gadget,
2094					&udc->local_setup_buff) < 0)
2095			qe_ep0_stall(udc);
2096		spin_lock(&udc->lock);
2097		udc->ep0_state = DATA_STATE_NEED_ZLP;
2098	}
2099}
2100
2101/*-------------------------------------------------------------------------
2102	USB Interrupt handlers
2103 -------------------------------------------------------------------------*/
2104static void suspend_irq(struct qe_udc *udc)
2105{
2106	udc->resume_state = udc->usb_state;
2107	udc->usb_state = USB_STATE_SUSPENDED;
2108
2109	/* report suspend to the driver ,serial.c not support this*/
2110	if (udc->driver->suspend)
2111		udc->driver->suspend(&udc->gadget);
2112}
2113
2114static void resume_irq(struct qe_udc *udc)
2115{
2116	udc->usb_state = udc->resume_state;
2117	udc->resume_state = 0;
2118
2119	/* report resume to the driver , serial.c not support this*/
2120	if (udc->driver->resume)
2121		udc->driver->resume(&udc->gadget);
2122}
2123
2124static void idle_irq(struct qe_udc *udc)
2125{
2126	u8 usbs;
2127
2128	usbs = in_8(&udc->usb_regs->usb_usbs);
2129	if (usbs & USB_IDLE_STATUS_MASK) {
2130		if ((udc->usb_state) != USB_STATE_SUSPENDED)
2131			suspend_irq(udc);
2132	} else {
2133		if (udc->usb_state == USB_STATE_SUSPENDED)
2134			resume_irq(udc);
2135	}
2136}
2137
2138static int reset_irq(struct qe_udc *udc)
2139{
2140	unsigned char i;
2141
2142	if (udc->usb_state == USB_STATE_DEFAULT)
2143		return 0;
2144
2145	qe_usb_disable(udc);
2146	out_8(&udc->usb_regs->usb_usadr, 0);
2147
2148	for (i = 0; i < USB_MAX_ENDPOINTS; i++) {
2149		if (udc->eps[i].init)
2150			qe_ep_reset(udc, i);
2151	}
2152
2153	reset_queues(udc);
2154	udc->usb_state = USB_STATE_DEFAULT;
2155	udc->ep0_state = WAIT_FOR_SETUP;
2156	udc->ep0_dir = USB_DIR_OUT;
2157	qe_usb_enable(udc);
2158	return 0;
2159}
2160
2161static int bsy_irq(struct qe_udc *udc)
2162{
2163	return 0;
2164}
2165
2166static int txe_irq(struct qe_udc *udc)
2167{
2168	return 0;
2169}
2170
2171/* ep0 tx interrupt also in here */
2172static int tx_irq(struct qe_udc *udc)
2173{
2174	struct qe_ep *ep;
2175	struct qe_bd __iomem *bd;
2176	int i, res = 0;
2177
2178	if ((udc->usb_state == USB_STATE_ADDRESS)
2179		&& (in_8(&udc->usb_regs->usb_usadr) == 0))
2180		out_8(&udc->usb_regs->usb_usadr, udc->device_address);
2181
2182	for (i = (USB_MAX_ENDPOINTS-1); ((i >= 0) && (res == 0)); i--) {
2183		ep = &udc->eps[i];
2184		if (ep && ep->init && (ep->dir != USB_DIR_OUT)) {
2185			bd = ep->c_txbd;
2186			if (!(in_be32((u32 __iomem *)bd) & T_R)
2187						&& (in_be32(&bd->buf))) {
2188				/* confirm the transmitted bd */
2189				if (ep->epnum == 0)
2190					res = qe_ep0_txconf(ep);
2191				else
2192					res = qe_ep_txconf(ep);
2193			}
2194		}
2195	}
2196	return res;
2197}
2198
2199
2200/* setup packect's rx is handle in the function too */
2201static void rx_irq(struct qe_udc *udc)
2202{
2203	struct qe_ep *ep;
2204	struct qe_bd __iomem *bd;
2205	int i;
2206
2207	for (i = 0; i < USB_MAX_ENDPOINTS; i++) {
2208		ep = &udc->eps[i];
2209		if (ep && ep->init && (ep->dir != USB_DIR_IN)) {
2210			bd = ep->n_rxbd;
2211			if (!(in_be32((u32 __iomem *)bd) & R_E)
2212						&& (in_be32(&bd->buf))) {
2213				if (ep->epnum == 0) {
2214					qe_ep0_rx(udc);
2215				} else {
2216					/*non-setup package receive*/
2217					qe_ep_rx(ep);
2218				}
2219			}
2220		}
2221	}
2222}
2223
2224static irqreturn_t qe_udc_irq(int irq, void *_udc)
2225{
2226	struct qe_udc *udc = (struct qe_udc *)_udc;
2227	u16 irq_src;
2228	irqreturn_t status = IRQ_NONE;
2229	unsigned long flags;
2230
2231	spin_lock_irqsave(&udc->lock, flags);
2232
2233	irq_src = in_be16(&udc->usb_regs->usb_usber) &
2234		in_be16(&udc->usb_regs->usb_usbmr);
2235	/* Clear notification bits */
2236	out_be16(&udc->usb_regs->usb_usber, irq_src);
2237	/* USB Interrupt */
2238	if (irq_src & USB_E_IDLE_MASK) {
2239		idle_irq(udc);
2240		irq_src &= ~USB_E_IDLE_MASK;
2241		status = IRQ_HANDLED;
2242	}
2243
2244	if (irq_src & USB_E_TXB_MASK) {
2245		tx_irq(udc);
2246		irq_src &= ~USB_E_TXB_MASK;
2247		status = IRQ_HANDLED;
2248	}
2249
2250	if (irq_src & USB_E_RXB_MASK) {
2251		rx_irq(udc);
2252		irq_src &= ~USB_E_RXB_MASK;
2253		status = IRQ_HANDLED;
2254	}
2255
2256	if (irq_src & USB_E_RESET_MASK) {
2257		reset_irq(udc);
2258		irq_src &= ~USB_E_RESET_MASK;
2259		status = IRQ_HANDLED;
2260	}
2261
2262	if (irq_src & USB_E_BSY_MASK) {
2263		bsy_irq(udc);
2264		irq_src &= ~USB_E_BSY_MASK;
2265		status = IRQ_HANDLED;
2266	}
2267
2268	if (irq_src & USB_E_TXE_MASK) {
2269		txe_irq(udc);
2270		irq_src &= ~USB_E_TXE_MASK;
2271		status = IRQ_HANDLED;
2272	}
2273
2274	spin_unlock_irqrestore(&udc->lock, flags);
2275
2276	return status;
2277}
2278
2279/*-------------------------------------------------------------------------
2280	Gadget driver probe and unregister.
2281 --------------------------------------------------------------------------*/
2282static int fsl_qe_start(struct usb_gadget *gadget,
2283		struct usb_gadget_driver *driver)
2284{
2285	struct qe_udc *udc;
2286	unsigned long flags;
2287
2288	udc = container_of(gadget, struct qe_udc, gadget);
2289	/* lock is needed but whether should use this lock or another */
2290	spin_lock_irqsave(&udc->lock, flags);
2291
2292	driver->driver.bus = NULL;
2293	/* hook up the driver */
2294	udc->driver = driver;
2295	udc->gadget.speed = driver->max_speed;
2296
2297	/* Enable IRQ reg and Set usbcmd reg EN bit */
2298	qe_usb_enable(udc);
2299
2300	out_be16(&udc->usb_regs->usb_usber, 0xffff);
2301	out_be16(&udc->usb_regs->usb_usbmr, USB_E_DEFAULT_DEVICE);
2302	udc->usb_state = USB_STATE_ATTACHED;
2303	udc->ep0_state = WAIT_FOR_SETUP;
2304	udc->ep0_dir = USB_DIR_OUT;
2305	spin_unlock_irqrestore(&udc->lock, flags);
2306
2307	return 0;
2308}
2309
2310static int fsl_qe_stop(struct usb_gadget *gadget)
2311{
2312	struct qe_udc *udc;
2313	struct qe_ep *loop_ep;
2314	unsigned long flags;
2315
2316	udc = container_of(gadget, struct qe_udc, gadget);
2317	/* stop usb controller, disable intr */
2318	qe_usb_disable(udc);
2319
2320	/* in fact, no needed */
2321	udc->usb_state = USB_STATE_ATTACHED;
2322	udc->ep0_state = WAIT_FOR_SETUP;
2323	udc->ep0_dir = 0;
2324
2325	/* stand operation */
2326	spin_lock_irqsave(&udc->lock, flags);
2327	udc->gadget.speed = USB_SPEED_UNKNOWN;
2328	nuke(&udc->eps[0], -ESHUTDOWN);
2329	list_for_each_entry(loop_ep, &udc->gadget.ep_list, ep.ep_list)
2330		nuke(loop_ep, -ESHUTDOWN);
2331	spin_unlock_irqrestore(&udc->lock, flags);
2332
2333	udc->driver = NULL;
2334
2335	return 0;
2336}
2337
2338/* udc structure's alloc and setup, include ep-param alloc */
2339static struct qe_udc *qe_udc_config(struct platform_device *ofdev)
2340{
2341	struct qe_udc *udc;
2342	struct device_node *np = ofdev->dev.of_node;
2343	unsigned int tmp_addr = 0;
2344	struct usb_device_para __iomem *usbpram;
2345	unsigned int i;
2346	u64 size;
2347	u32 offset;
2348
2349	udc = kzalloc(sizeof(*udc), GFP_KERNEL);
2350	if (udc == NULL) {
2351		dev_err(&ofdev->dev, "malloc udc failed\n");
2352		goto cleanup;
2353	}
2354
2355	udc->dev = &ofdev->dev;
2356
2357	/* get default address of usb parameter in MURAM from device tree */
2358	offset = *of_get_address(np, 1, &size, NULL);
2359	udc->usb_param = cpm_muram_addr(offset);
2360	memset_io(udc->usb_param, 0, size);
2361
2362	usbpram = udc->usb_param;
2363	out_be16(&usbpram->frame_n, 0);
2364	out_be32(&usbpram->rstate, 0);
2365
2366	tmp_addr = cpm_muram_alloc((USB_MAX_ENDPOINTS *
2367					sizeof(struct usb_ep_para)),
2368					   USB_EP_PARA_ALIGNMENT);
2369	if (IS_ERR_VALUE(tmp_addr))
2370		goto cleanup;
2371
2372	for (i = 0; i < USB_MAX_ENDPOINTS; i++) {
2373		out_be16(&usbpram->epptr[i], (u16)tmp_addr);
2374		udc->ep_param[i] = cpm_muram_addr(tmp_addr);
2375		tmp_addr += 32;
2376	}
2377
2378	memset_io(udc->ep_param[0], 0,
2379			USB_MAX_ENDPOINTS * sizeof(struct usb_ep_para));
2380
2381	udc->resume_state = USB_STATE_NOTATTACHED;
2382	udc->usb_state = USB_STATE_POWERED;
2383	udc->ep0_dir = 0;
2384
2385	spin_lock_init(&udc->lock);
2386	return udc;
2387
2388cleanup:
2389	kfree(udc);
2390	return NULL;
2391}
2392
2393/* USB Controller register init */
2394static int qe_udc_reg_init(struct qe_udc *udc)
2395{
2396	struct usb_ctlr __iomem *qe_usbregs;
2397	qe_usbregs = udc->usb_regs;
2398
2399	/* Spec says that we must enable the USB controller to change mode. */
2400	out_8(&qe_usbregs->usb_usmod, 0x01);
2401	/* Mode changed, now disable it, since muram isn't initialized yet. */
2402	out_8(&qe_usbregs->usb_usmod, 0x00);
2403
2404	/* Initialize the rest. */
2405	out_be16(&qe_usbregs->usb_usbmr, 0);
2406	out_8(&qe_usbregs->usb_uscom, 0);
2407	out_be16(&qe_usbregs->usb_usber, USBER_ALL_CLEAR);
2408
2409	return 0;
2410}
2411
2412static int qe_ep_config(struct qe_udc *udc, unsigned char pipe_num)
2413{
2414	struct qe_ep *ep = &udc->eps[pipe_num];
2415
2416	ep->udc = udc;
2417	strcpy(ep->name, ep_name[pipe_num]);
2418	ep->ep.name = ep_name[pipe_num];
2419
2420	ep->ep.ops = &qe_ep_ops;
2421	ep->stopped = 1;
2422	usb_ep_set_maxpacket_limit(&ep->ep, (unsigned short) ~0);
2423	ep->ep.desc = NULL;
2424	ep->dir = 0xff;
2425	ep->epnum = (u8)pipe_num;
2426	ep->sent = 0;
2427	ep->last = 0;
2428	ep->init = 0;
2429	ep->rxframe = NULL;
2430	ep->txframe = NULL;
2431	ep->tx_req = NULL;
2432	ep->state = EP_STATE_IDLE;
2433	ep->has_data = 0;
2434
2435	/* the queue lists any req for this ep */
2436	INIT_LIST_HEAD(&ep->queue);
2437
2438	/* gagdet.ep_list used for ep_autoconfig so no ep0*/
2439	if (pipe_num != 0)
2440		list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
2441
2442	ep->gadget = &udc->gadget;
2443
2444	return 0;
2445}
2446
2447/*-----------------------------------------------------------------------
2448 *	UDC device Driver operation functions				*
2449 *----------------------------------------------------------------------*/
2450static void qe_udc_release(struct device *dev)
2451{
2452	struct qe_udc *udc = container_of(dev, struct qe_udc, gadget.dev);
2453	int i;
2454
2455	complete(udc->done);
2456	cpm_muram_free(cpm_muram_offset(udc->ep_param[0]));
2457	for (i = 0; i < USB_MAX_ENDPOINTS; i++)
2458		udc->ep_param[i] = NULL;
2459
2460	kfree(udc);
2461}
2462
2463/* Driver probe functions */
2464static const struct of_device_id qe_udc_match[];
2465static int qe_udc_probe(struct platform_device *ofdev)
2466{
2467	struct qe_udc *udc;
2468	const struct of_device_id *match;
2469	struct device_node *np = ofdev->dev.of_node;
2470	struct qe_ep *ep;
2471	unsigned int ret = 0;
2472	unsigned int i;
2473	const void *prop;
2474
2475	match = of_match_device(qe_udc_match, &ofdev->dev);
2476	if (!match)
2477		return -EINVAL;
2478
2479	prop = of_get_property(np, "mode", NULL);
2480	if (!prop || strcmp(prop, "peripheral"))
2481		return -ENODEV;
2482
2483	/* Initialize the udc structure including QH member and other member */
2484	udc = qe_udc_config(ofdev);
2485	if (!udc) {
2486		dev_err(&ofdev->dev, "failed to initialize\n");
2487		return -ENOMEM;
2488	}
2489
2490	udc->soc_type = (unsigned long)match->data;
2491	udc->usb_regs = of_iomap(np, 0);
2492	if (!udc->usb_regs) {
2493		ret = -ENOMEM;
2494		goto err1;
2495	}
2496
2497	/* initialize usb hw reg except for regs for EP,
2498	 * leave usbintr reg untouched*/
2499	qe_udc_reg_init(udc);
2500
2501	/* here comes the stand operations for probe
2502	 * set the qe_udc->gadget.xxx */
2503	udc->gadget.ops = &qe_gadget_ops;
2504
2505	/* gadget.ep0 is a pointer */
2506	udc->gadget.ep0 = &udc->eps[0].ep;
2507
2508	INIT_LIST_HEAD(&udc->gadget.ep_list);
2509
2510	/* modify in register gadget process */
2511	udc->gadget.speed = USB_SPEED_UNKNOWN;
2512
2513	/* name: Identifies the controller hardware type. */
2514	udc->gadget.name = driver_name;
2515	udc->gadget.dev.parent = &ofdev->dev;
2516
2517	/* initialize qe_ep struct */
2518	for (i = 0; i < USB_MAX_ENDPOINTS ; i++) {
2519		/* because the ep type isn't decide here so
2520		 * qe_ep_init() should be called in ep_enable() */
2521
2522		/* setup the qe_ep struct and link ep.ep.list
2523		 * into gadget.ep_list */
2524		qe_ep_config(udc, (unsigned char)i);
2525	}
2526
2527	/* ep0 initialization in here */
2528	ret = qe_ep_init(udc, 0, &qe_ep0_desc);
2529	if (ret)
2530		goto err2;
2531
2532	/* create a buf for ZLP send, need to remain zeroed */
2533	udc->nullbuf = devm_kzalloc(&ofdev->dev, 256, GFP_KERNEL);
2534	if (udc->nullbuf == NULL) {
2535		ret = -ENOMEM;
2536		goto err3;
2537	}
2538
2539	/* buffer for data of get_status request */
2540	udc->statusbuf = devm_kzalloc(&ofdev->dev, 2, GFP_KERNEL);
2541	if (udc->statusbuf == NULL) {
2542		ret = -ENOMEM;
2543		goto err3;
2544	}
2545
2546	udc->nullp = virt_to_phys((void *)udc->nullbuf);
2547	if (udc->nullp == DMA_ADDR_INVALID) {
2548		udc->nullp = dma_map_single(
2549					udc->gadget.dev.parent,
2550					udc->nullbuf,
2551					256,
2552					DMA_TO_DEVICE);
2553		udc->nullmap = 1;
2554	} else {
2555		dma_sync_single_for_device(udc->gadget.dev.parent,
2556					udc->nullp, 256,
2557					DMA_TO_DEVICE);
2558	}
2559
2560	tasklet_init(&udc->rx_tasklet, ep_rx_tasklet,
2561			(unsigned long)udc);
2562	/* request irq and disable DR  */
2563	udc->usb_irq = irq_of_parse_and_map(np, 0);
2564	if (!udc->usb_irq) {
2565		ret = -EINVAL;
2566		goto err_noirq;
2567	}
2568
2569	ret = request_irq(udc->usb_irq, qe_udc_irq, 0,
2570				driver_name, udc);
2571	if (ret) {
2572		dev_err(udc->dev, "cannot request irq %d err %d\n",
2573				udc->usb_irq, ret);
2574		goto err4;
2575	}
2576
2577	ret = usb_add_gadget_udc_release(&ofdev->dev, &udc->gadget,
2578			qe_udc_release);
2579	if (ret)
2580		goto err5;
2581
2582	platform_set_drvdata(ofdev, udc);
2583	dev_info(udc->dev,
2584			"%s USB controller initialized as device\n",
2585			(udc->soc_type == PORT_QE) ? "QE" : "CPM");
2586	return 0;
2587
2588err5:
2589	free_irq(udc->usb_irq, udc);
2590err4:
2591	irq_dispose_mapping(udc->usb_irq);
2592err_noirq:
2593	if (udc->nullmap) {
2594		dma_unmap_single(udc->gadget.dev.parent,
2595			udc->nullp, 256,
2596				DMA_TO_DEVICE);
2597			udc->nullp = DMA_ADDR_INVALID;
2598	} else {
2599		dma_sync_single_for_cpu(udc->gadget.dev.parent,
2600			udc->nullp, 256,
2601				DMA_TO_DEVICE);
2602	}
2603err3:
2604	ep = &udc->eps[0];
2605	cpm_muram_free(cpm_muram_offset(ep->rxbase));
2606	kfree(ep->rxframe);
2607	kfree(ep->rxbuffer);
2608	kfree(ep->txframe);
2609err2:
2610	iounmap(udc->usb_regs);
2611err1:
2612	kfree(udc);
2613	return ret;
2614}
2615
2616#ifdef CONFIG_PM
2617static int qe_udc_suspend(struct platform_device *dev, pm_message_t state)
2618{
2619	return -ENOTSUPP;
2620}
2621
2622static int qe_udc_resume(struct platform_device *dev)
2623{
2624	return -ENOTSUPP;
2625}
2626#endif
2627
2628static int qe_udc_remove(struct platform_device *ofdev)
2629{
2630	struct qe_udc *udc = platform_get_drvdata(ofdev);
2631	struct qe_ep *ep;
2632	unsigned int size;
2633	DECLARE_COMPLETION_ONSTACK(done);
2634
2635	usb_del_gadget_udc(&udc->gadget);
2636
2637	udc->done = &done;
2638	tasklet_disable(&udc->rx_tasklet);
2639
2640	if (udc->nullmap) {
2641		dma_unmap_single(udc->gadget.dev.parent,
2642			udc->nullp, 256,
2643				DMA_TO_DEVICE);
2644			udc->nullp = DMA_ADDR_INVALID;
2645	} else {
2646		dma_sync_single_for_cpu(udc->gadget.dev.parent,
2647			udc->nullp, 256,
2648				DMA_TO_DEVICE);
2649	}
2650
2651	ep = &udc->eps[0];
2652	cpm_muram_free(cpm_muram_offset(ep->rxbase));
2653	size = (ep->ep.maxpacket + USB_CRC_SIZE + 2) * (USB_BDRING_LEN + 1);
2654
2655	kfree(ep->rxframe);
2656	if (ep->rxbufmap) {
2657		dma_unmap_single(udc->gadget.dev.parent,
2658				ep->rxbuf_d, size,
2659				DMA_FROM_DEVICE);
2660		ep->rxbuf_d = DMA_ADDR_INVALID;
2661	} else {
2662		dma_sync_single_for_cpu(udc->gadget.dev.parent,
2663				ep->rxbuf_d, size,
2664				DMA_FROM_DEVICE);
2665	}
2666
2667	kfree(ep->rxbuffer);
2668	kfree(ep->txframe);
2669
2670	free_irq(udc->usb_irq, udc);
2671	irq_dispose_mapping(udc->usb_irq);
2672
2673	tasklet_kill(&udc->rx_tasklet);
2674
2675	iounmap(udc->usb_regs);
2676
2677	/* wait for release() of gadget.dev to free udc */
2678	wait_for_completion(&done);
2679
2680	return 0;
2681}
2682
2683/*-------------------------------------------------------------------------*/
2684static const struct of_device_id qe_udc_match[] = {
2685	{
2686		.compatible = "fsl,mpc8323-qe-usb",
2687		.data = (void *)PORT_QE,
2688	},
2689	{
2690		.compatible = "fsl,mpc8360-qe-usb",
2691		.data = (void *)PORT_QE,
2692	},
2693	{
2694		.compatible = "fsl,mpc8272-cpm-usb",
2695		.data = (void *)PORT_CPM,
2696	},
2697	{},
2698};
2699
2700MODULE_DEVICE_TABLE(of, qe_udc_match);
2701
2702static struct platform_driver udc_driver = {
2703	.driver = {
2704		.name = driver_name,
2705		.of_match_table = qe_udc_match,
2706	},
2707	.probe          = qe_udc_probe,
2708	.remove         = qe_udc_remove,
2709#ifdef CONFIG_PM
2710	.suspend        = qe_udc_suspend,
2711	.resume         = qe_udc_resume,
2712#endif
2713};
2714
2715module_platform_driver(udc_driver);
2716
2717MODULE_DESCRIPTION(DRIVER_DESC);
2718MODULE_AUTHOR(DRIVER_AUTHOR);
2719MODULE_LICENSE("GPL");
2720