drivers/usb/isp1760/isp1760-udc.c

   1 /*
   2  * Driver for the NXP ISP1761 device controller
   3  *
   4  * Copyright 2014 Ideas on Board Oy
   5  *
   6  * Contacts:
   7  *      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License
  11  * version 2 as published by the Free Software Foundation.
  12  */
  13
  14 #include <linux/interrupt.h>
  15 #include <linux/io.h>
  16 #include <linux/kernel.h>
  17 #include <linux/list.h>
  18 #include <linux/module.h>
  19 #include <linux/slab.h>
  20 #include <linux/timer.h>
  21 #include <linux/usb.h>
  22
  23 #include "isp1760-core.h"
  24 #include "isp1760-regs.h"
  25 #include "isp1760-udc.h"
  26
  27 #define ISP1760_VBUS_POLL_INTERVAL      msecs_to_jiffies(500)
  28
  29 struct isp1760_request {
  30         struct usb_request req;
  31         struct list_head queue;
  32         struct isp1760_ep *ep;
  33         unsigned int packet_size;
  34 };
  35
  36 static inline struct isp1760_udc *gadget_to_udc(struct usb_gadget *gadget)
  37 {
  38         return container_of(gadget, struct isp1760_udc, gadget);
  39 }
  40
  41 static inline struct isp1760_ep *ep_to_udc_ep(struct usb_ep *ep)
  42 {
  43         return container_of(ep, struct isp1760_ep, ep);
  44 }
  45
  46 static inline struct isp1760_request *req_to_udc_req(struct usb_request *req)
  47 {
  48         return container_of(req, struct isp1760_request, req);
  49 }
  50
  51 static inline u32 isp1760_udc_read(struct isp1760_udc *udc, u16 reg)
  52 {
  53         return isp1760_read32(udc->regs, reg);
  54 }
  55
  56 static inline void isp1760_udc_write(struct isp1760_udc *udc, u16 reg, u32 val)
  57 {
  58         isp1760_write32(udc->regs, reg, val);
  59 }
  60
  61 /* -----------------------------------------------------------------------------
  62  * Endpoint Management
  63  */
  64
  65 static struct isp1760_ep *isp1760_udc_find_ep(struct isp1760_udc *udc,
  66                                               u16 index)
  67 {
  68         unsigned int i;
  69
  70         if (index == 0)
  71                 return &udc->ep[0];
  72
  73         for (i = 1; i < ARRAY_SIZE(udc->ep); ++i) {
  74                 if (udc->ep[i].addr == index)
  75                         return udc->ep[i].desc ? &udc->ep[i] : NULL;
  76         }
  77
  78         return NULL;
  79 }
  80
  81 static void __isp1760_udc_select_ep(struct isp1760_ep *ep, int dir)
  82 {
  83         isp1760_udc_write(ep->udc, DC_EPINDEX,
  84                           DC_ENDPIDX(ep->addr & USB_ENDPOINT_NUMBER_MASK) |
  85                           (dir == USB_DIR_IN ? DC_EPDIR : 0));
  86 }
  87
  88 /**
  89  * isp1760_udc_select_ep - Select an endpoint for register access
  90  * @ep: The endpoint
  91  *
  92  * The ISP1761 endpoint registers are banked. This function selects the target
  93  * endpoint for banked register access. The selection remains valid until the
  94  * next call to this function, the next direct access to the EPINDEX register
  95  * or the next reset, whichever comes first.
  96  *
  97  * Called with the UDC spinlock held.
  98  */
  99 static void isp1760_udc_select_ep(struct isp1760_ep *ep)
 100 {
 101         __isp1760_udc_select_ep(ep, ep->addr & USB_ENDPOINT_DIR_MASK);
 102 }
 103
 104 /* Called with the UDC spinlock held. */
 105 static void isp1760_udc_ctrl_send_status(struct isp1760_ep *ep, int dir)
 106 {
 107         struct isp1760_udc *udc = ep->udc;
 108
 109         /*
 110          * Proceed to the status stage. The status stage data packet flows in
 111          * the direction opposite to the data stage data packets, we thus need
 112          * to select the OUT/IN endpoint for IN/OUT transfers.
 113          */
 114         isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) |
 115                           (dir == USB_DIR_IN ? 0 : DC_EPDIR));
 116         isp1760_udc_write(udc, DC_CTRLFUNC, DC_STATUS);
 117
 118         /*
 119          * The hardware will terminate the request automatically and go back to
 120          * the setup stage without notifying us.
 121          */
 122         udc->ep0_state = ISP1760_CTRL_SETUP;
 123 }
 124
 125 /* Called without the UDC spinlock held. */
 126 static void isp1760_udc_request_complete(struct isp1760_ep *ep,
 127                                          struct isp1760_request *req,
 128                                          int status)
 129 {
 130         struct isp1760_udc *udc = ep->udc;
 131         unsigned long flags;
 132
 133         dev_dbg(ep->udc->isp->dev, "completing request %p with status %d\n",
 134                 req, status);
 135
 136         req->ep = NULL;
 137         req->req.status = status;
 138         req->req.complete(&ep->ep, &req->req);
 139
 140         spin_lock_irqsave(&udc->lock, flags);
 141
 142         /*
 143          * When completing control OUT requests, move to the status stage after
 144          * calling the request complete callback. This gives the gadget an
 145          * opportunity to stall the control transfer if needed.
 146          */
 147         if (status == 0 && ep->addr == 0 && udc->ep0_dir == USB_DIR_OUT)
 148                 isp1760_udc_ctrl_send_status(ep, USB_DIR_OUT);
 149
 150         spin_unlock_irqrestore(&udc->lock, flags);
 151 }
 152
 153 static void isp1760_udc_ctrl_send_stall(struct isp1760_ep *ep)
 154 {
 155         struct isp1760_udc *udc = ep->udc;
 156         unsigned long flags;
 157
 158         dev_dbg(ep->udc->isp->dev, "%s(ep%02x)\n", __func__, ep->addr);
 159
 160         spin_lock_irqsave(&udc->lock, flags);
 161
 162         /* Stall both the IN and OUT endpoints. */
 163         __isp1760_udc_select_ep(ep, USB_DIR_OUT);
 164         isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
 165         __isp1760_udc_select_ep(ep, USB_DIR_IN);
 166         isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
 167
 168         /* A protocol stall completes the control transaction. */
 169         udc->ep0_state = ISP1760_CTRL_SETUP;
 170
 171         spin_unlock_irqrestore(&udc->lock, flags);
 172 }
 173
 174 /* -----------------------------------------------------------------------------
 175  * Data Endpoints
 176  */
 177
 178 /* Called with the UDC spinlock held. */
 179 static bool isp1760_udc_receive(struct isp1760_ep *ep,
 180                                 struct isp1760_request *req)
 181 {
 182         struct isp1760_udc *udc = ep->udc;
 183         unsigned int len;
 184         u32 *buf;
 185         int i;
 186
 187         isp1760_udc_select_ep(ep);
 188         len = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
 189
 190         dev_dbg(udc->isp->dev, "%s: received %u bytes (%u/%u done)\n",
 191                 __func__, len, req->req.actual, req->req.length);
 192
 193         len = min(len, req->req.length - req->req.actual);
 194
 195         if (!len) {
 196                 /*
 197                  * There's no data to be read from the FIFO, acknowledge the RX
 198                  * interrupt by clearing the buffer.
 199                  *
 200                  * TODO: What if another packet arrives in the meantime ? The
 201                  * datasheet doesn't clearly document how this should be
 202                  * handled.
 203                  */
 204                 isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
 205                 return false;
 206         }
 207
 208         buf = req->req.buf + req->req.actual;
 209
 210         /*
 211          * Make sure not to read more than one extra byte, otherwise data from
 212          * the next packet might be removed from the FIFO.
 213          */
 214         for (i = len; i > 2; i -= 4, ++buf)
 215                 *buf = le32_to_cpu(isp1760_udc_read(udc, DC_DATAPORT));
 216         if (i > 0)
 217                 *(u16 *)buf = le16_to_cpu(readw(udc->regs + DC_DATAPORT));
 218
 219         req->req.actual += len;
 220
 221         /*
 222          * TODO: The short_not_ok flag isn't supported yet, but isn't used by
 223          * any gadget driver either.
 224          */
 225
 226         dev_dbg(udc->isp->dev,
 227                 "%s: req %p actual/length %u/%u maxpacket %u packet size %u\n",
 228                 __func__, req, req->req.actual, req->req.length, ep->maxpacket,
 229                 len);
 230
 231         ep->rx_pending = false;
 232
 233         /*
 234          * Complete the request if all data has been received or if a short
 235          * packet has been received.
 236          */
 237         if (req->req.actual == req->req.length || len < ep->maxpacket) {
 238                 list_del(&req->queue);
 239                 return true;
 240         }
 241
 242         return false;
 243 }
 244
 245 static void isp1760_udc_transmit(struct isp1760_ep *ep,
 246                                  struct isp1760_request *req)
 247 {
 248         struct isp1760_udc *udc = ep->udc;
 249         u32 *buf = req->req.buf + req->req.actual;
 250         int i;
 251
 252         req->packet_size = min(req->req.length - req->req.actual,
 253                                ep->maxpacket);
 254
 255         dev_dbg(udc->isp->dev, "%s: transferring %u bytes (%u/%u done)\n",
 256                 __func__, req->packet_size, req->req.actual,
 257                 req->req.length);
 258
 259         __isp1760_udc_select_ep(ep, USB_DIR_IN);
 260
 261         if (req->packet_size)
 262                 isp1760_udc_write(udc, DC_BUFLEN, req->packet_size);
 263
 264         /*
 265          * Make sure not to write more than one extra byte, otherwise extra data
 266          * will stay in the FIFO and will be transmitted during the next control
 267          * request. The endpoint control CLBUF bit is supposed to allow flushing
 268          * the FIFO for this kind of conditions, but doesn't seem to work.
 269          */
 270         for (i = req->packet_size; i > 2; i -= 4, ++buf)
 271                 isp1760_udc_write(udc, DC_DATAPORT, cpu_to_le32(*buf));
 272         if (i > 0)
 273                 writew(cpu_to_le16(*(u16 *)buf), udc->regs + DC_DATAPORT);
 274
 275         if (ep->addr == 0)
 276                 isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
 277         if (!req->packet_size)
 278                 isp1760_udc_write(udc, DC_CTRLFUNC, DC_VENDP);
 279 }
 280
 281 static void isp1760_ep_rx_ready(struct isp1760_ep *ep)
 282 {
 283         struct isp1760_udc *udc = ep->udc;
 284         struct isp1760_request *req;
 285         bool complete;
 286
 287         spin_lock(&udc->lock);
 288
 289         if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_OUT) {
 290                 spin_unlock(&udc->lock);
 291                 dev_dbg(udc->isp->dev, "%s: invalid ep0 state %u\n", __func__,
 292                         udc->ep0_state);
 293                 return;
 294         }
 295
 296         if (ep->addr != 0 && !ep->desc) {
 297                 spin_unlock(&udc->lock);
 298                 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
 299                         ep->addr);
 300                 return;
 301         }
 302
 303         if (list_empty(&ep->queue)) {
 304                 ep->rx_pending = true;
 305                 spin_unlock(&udc->lock);
 306                 dev_dbg(udc->isp->dev, "%s: ep%02x (%p) has no request queued\n",
 307                         __func__, ep->addr, ep);
 308                 return;
 309         }
 310
 311         req = list_first_entry(&ep->queue, struct isp1760_request,
 312                                queue);
 313         complete = isp1760_udc_receive(ep, req);
 314
 315         spin_unlock(&udc->lock);
 316
 317         if (complete)
 318                 isp1760_udc_request_complete(ep, req, 0);
 319 }
 320
 321 static void isp1760_ep_tx_complete(struct isp1760_ep *ep)
 322 {
 323         struct isp1760_udc *udc = ep->udc;
 324         struct isp1760_request *complete = NULL;
 325         struct isp1760_request *req;
 326         bool need_zlp;
 327
 328         spin_lock(&udc->lock);
 329
 330         if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_IN) {
 331                 spin_unlock(&udc->lock);
 332                 dev_dbg(udc->isp->dev, "TX IRQ: invalid endpoint state %u\n",
 333                         udc->ep0_state);
 334                 return;
 335         }
 336
 337         if (list_empty(&ep->queue)) {
 338                 /*
 339                  * This can happen for the control endpoint when the reply to
 340                  * the GET_STATUS IN control request is sent directly by the
 341                  * setup IRQ handler. Just proceed to the status stage.
 342                  */
 343                 if (ep->addr == 0) {
 344                         isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
 345                         spin_unlock(&udc->lock);
 346                         return;
 347                 }
 348
 349                 spin_unlock(&udc->lock);
 350                 dev_dbg(udc->isp->dev, "%s: ep%02x has no request queued\n",
 351                         __func__, ep->addr);
 352                 return;
 353         }
 354
 355         req = list_first_entry(&ep->queue, struct isp1760_request,
 356                                queue);
 357         req->req.actual += req->packet_size;
 358
 359         need_zlp = req->req.actual == req->req.length &&
 360                    !(req->req.length % ep->maxpacket) &&
 361                    req->packet_size && req->req.zero;
 362
 363         dev_dbg(udc->isp->dev,
 364                 "TX IRQ: req %p actual/length %u/%u maxpacket %u packet size %u zero %u need zlp %u\n",
 365                  req, req->req.actual, req->req.length, ep->maxpacket,
 366                  req->packet_size, req->req.zero, need_zlp);
 367
 368         /*
 369          * Complete the request if all data has been sent and we don't need to
 370          * transmit a zero length packet.
 371          */
 372         if (req->req.actual == req->req.length && !need_zlp) {
 373                 complete = req;
 374                 list_del(&req->queue);
 375
 376                 if (ep->addr == 0)
 377                         isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
 378
 379                 if (!list_empty(&ep->queue))
 380                         req = list_first_entry(&ep->queue,
 381                                                struct isp1760_request, queue);
 382                 else
 383                         req = NULL;
 384         }
 385
 386         /*
 387          * Transmit the next packet or start the next request, if any.
 388          *
 389          * TODO: If the endpoint is stalled the next request shouldn't be
 390          * started, but what about the next packet ?
 391          */
 392         if (req)
 393                 isp1760_udc_transmit(ep, req);
 394
 395         spin_unlock(&udc->lock);
 396
 397         if (complete)
 398                 isp1760_udc_request_complete(ep, complete, 0);
 399 }
 400
 401 static int __isp1760_udc_set_halt(struct isp1760_ep *ep, bool halt)
 402 {
 403         struct isp1760_udc *udc = ep->udc;
 404
 405         dev_dbg(udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
 406                 halt ? "set" : "clear", ep->addr);
 407
 408         if (ep->desc && usb_endpoint_xfer_isoc(ep->desc)) {
 409                 dev_dbg(udc->isp->dev, "%s: ep%02x is isochronous\n", __func__,
 410                         ep->addr);
 411                 return -EINVAL;
 412         }
 413
 414         isp1760_udc_select_ep(ep);
 415         isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
 416
 417         if (ep->addr == 0) {
 418                 /* When halting the control endpoint, stall both IN and OUT. */
 419                 __isp1760_udc_select_ep(ep, USB_DIR_IN);
 420                 isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
 421         } else if (!halt) {
 422                 /* Reset the data PID by cycling the endpoint enable bit. */
 423                 u16 eptype = isp1760_udc_read(udc, DC_EPTYPE);
 424
 425                 isp1760_udc_write(udc, DC_EPTYPE, eptype & ~DC_EPENABLE);
 426                 isp1760_udc_write(udc, DC_EPTYPE, eptype);
 427
 428                 /*
 429                  * Disabling the endpoint emptied the transmit FIFO, fill it
 430                  * again if a request is pending.
 431                  *
 432                  * TODO: Does the gadget framework require synchronizatino with
 433                  * the TX IRQ handler ?
 434                  */
 435                 if ((ep->addr & USB_DIR_IN) && !list_empty(&ep->queue)) {
 436                         struct isp1760_request *req;
 437
 438                         req = list_first_entry(&ep->queue,
 439                                                struct isp1760_request, queue);
 440                         isp1760_udc_transmit(ep, req);
 441                 }
 442         }
 443
 444         ep->halted = halt;
 445
 446         return 0;
 447 }
 448
 449 /* -----------------------------------------------------------------------------
 450  * Control Endpoint
 451  */
 452
 453 static int isp1760_udc_get_status(struct isp1760_udc *udc,
 454                                   const struct usb_ctrlrequest *req)
 455 {
 456         struct isp1760_ep *ep;
 457         u16 status;
 458
 459         if (req->wLength != cpu_to_le16(2) || req->wValue != cpu_to_le16(0))
 460                 return -EINVAL;
 461
 462         switch (req->bRequestType) {
 463         case USB_DIR_IN | USB_RECIP_DEVICE:
 464                 status = udc->devstatus;
 465                 break;
 466
 467         case USB_DIR_IN | USB_RECIP_INTERFACE:
 468                 status = 0;
 469                 break;
 470
 471         case USB_DIR_IN | USB_RECIP_ENDPOINT:
 472                 ep = isp1760_udc_find_ep(udc, le16_to_cpu(req->wIndex));
 473                 if (!ep)
 474                         return -EINVAL;
 475
 476                 status = 0;
 477                 if (ep->halted)
 478                         status |= 1 << USB_ENDPOINT_HALT;
 479                 break;
 480
 481         default:
 482                 return -EINVAL;
 483         }
 484
 485         isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) | DC_EPDIR);
 486         isp1760_udc_write(udc, DC_BUFLEN, 2);
 487
 488         writew(cpu_to_le16(status), udc->regs + DC_DATAPORT);
 489
 490         isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
 491
 492         dev_dbg(udc->isp->dev, "%s: status 0x%04x\n", __func__, status);
 493
 494         return 0;
 495 }
 496
 497 static int isp1760_udc_set_address(struct isp1760_udc *udc, u16 addr)
 498 {
 499         if (addr > 127) {
 500                 dev_dbg(udc->isp->dev, "invalid device address %u\n", addr);
 501                 return -EINVAL;
 502         }
 503
 504         if (udc->gadget.state != USB_STATE_DEFAULT &&
 505             udc->gadget.state != USB_STATE_ADDRESS) {
 506                 dev_dbg(udc->isp->dev, "can't set address in state %u\n",
 507                         udc->gadget.state);
 508                 return -EINVAL;
 509         }
 510
 511         usb_gadget_set_state(&udc->gadget, addr ? USB_STATE_ADDRESS :
 512                              USB_STATE_DEFAULT);
 513
 514         isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN | addr);
 515
 516         spin_lock(&udc->lock);
 517         isp1760_udc_ctrl_send_status(&udc->ep[0], USB_DIR_OUT);
 518         spin_unlock(&udc->lock);
 519
 520         return 0;
 521 }
 522
 523 static bool isp1760_ep0_setup_standard(struct isp1760_udc *udc,
 524                                        struct usb_ctrlrequest *req)
 525 {
 526         bool stall;
 527
 528         switch (req->bRequest) {
 529         case USB_REQ_GET_STATUS:
 530                 return isp1760_udc_get_status(udc, req);
 531
 532         case USB_REQ_CLEAR_FEATURE:
 533                 switch (req->bRequestType) {
 534                 case USB_DIR_OUT | USB_RECIP_DEVICE: {
 535                         /* TODO: Handle remote wakeup feature. */
 536                         return true;
 537                 }
 538
 539                 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
 540                         u16 index = le16_to_cpu(req->wIndex);
 541                         struct isp1760_ep *ep;
 542
 543                         if (req->wLength != cpu_to_le16(0) ||
 544                             req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
 545                                 return true;
 546
 547                         ep = isp1760_udc_find_ep(udc, index);
 548                         if (!ep)
 549                                 return true;
 550
 551                         spin_lock(&udc->lock);
 552
 553                         /*
 554                          * If the endpoint is wedged only the gadget can clear
 555                          * the halt feature. Pretend success in that case, but
 556                          * keep the endpoint halted.
 557                          */
 558                         if (!ep->wedged)
 559                                 stall = __isp1760_udc_set_halt(ep, false);
 560                         else
 561                                 stall = false;
 562
 563                         if (!stall)
 564                                 isp1760_udc_ctrl_send_status(&udc->ep[0],
 565                                                              USB_DIR_OUT);
 566
 567                         spin_unlock(&udc->lock);
 568                         return stall;
 569                 }
 570
 571                 default:
 572                         return true;
 573                 }
 574                 break;
 575
 576         case USB_REQ_SET_FEATURE:
 577                 switch (req->bRequestType) {
 578                 case USB_DIR_OUT | USB_RECIP_DEVICE: {
 579                         /* TODO: Handle remote wakeup and test mode features */
 580                         return true;
 581                 }
 582
 583                 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
 584                         u16 index = le16_to_cpu(req->wIndex);
 585                         struct isp1760_ep *ep;
 586
 587                         if (req->wLength != cpu_to_le16(0) ||
 588                             req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
 589                                 return true;
 590
 591                         ep = isp1760_udc_find_ep(udc, index);
 592                         if (!ep)
 593                                 return true;
 594
 595                         spin_lock(&udc->lock);
 596
 597                         stall = __isp1760_udc_set_halt(ep, true);
 598                         if (!stall)
 599                                 isp1760_udc_ctrl_send_status(&udc->ep[0],
 600                                                              USB_DIR_OUT);
 601
 602                         spin_unlock(&udc->lock);
 603                         return stall;
 604                 }
 605
 606                 default:
 607                         return true;
 608                 }
 609                 break;
 610
 611         case USB_REQ_SET_ADDRESS:
 612                 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
 613                         return true;
 614
 615                 return isp1760_udc_set_address(udc, le16_to_cpu(req->wValue));
 616
 617         case USB_REQ_SET_CONFIGURATION:
 618                 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
 619                         return true;
 620
 621                 if (udc->gadget.state != USB_STATE_ADDRESS &&
 622                     udc->gadget.state != USB_STATE_CONFIGURED)
 623                         return true;
 624
 625                 stall = udc->driver->setup(&udc->gadget, req) < 0;
 626                 if (stall)
 627                         return true;
 628
 629                 usb_gadget_set_state(&udc->gadget, req->wValue ?
 630                                      USB_STATE_CONFIGURED : USB_STATE_ADDRESS);
 631
 632                 /*
 633                  * SET_CONFIGURATION (and SET_INTERFACE) must reset the halt
 634                  * feature on all endpoints. There is however no need to do so
 635                  * explicitly here as the gadget driver will disable and
 636                  * reenable endpoints, clearing the halt feature.
 637                  */
 638                 return false;
 639
 640         default:
 641                 return udc->driver->setup(&udc->gadget, req) < 0;
 642         }
 643 }
 644
 645 static void isp1760_ep0_setup(struct isp1760_udc *udc)
 646 {
 647         union {
 648                 struct usb_ctrlrequest r;
 649                 u32 data[2];
 650         } req;
 651         unsigned int count;
 652         bool stall = false;
 653
 654         spin_lock(&udc->lock);
 655
 656         isp1760_udc_write(udc, DC_EPINDEX, DC_EP0SETUP);
 657
 658         count = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
 659         if (count != sizeof(req)) {
 660                 spin_unlock(&udc->lock);
 661
 662                 dev_err(udc->isp->dev, "invalid length %u for setup packet\n",
 663                         count);
 664
 665                 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
 666                 return;
 667         }
 668
 669         req.data[0] = isp1760_udc_read(udc, DC_DATAPORT);
 670         req.data[1] = isp1760_udc_read(udc, DC_DATAPORT);
 671
 672         if (udc->ep0_state != ISP1760_CTRL_SETUP) {
 673                 spin_unlock(&udc->lock);
 674                 dev_dbg(udc->isp->dev, "unexpected SETUP packet\n");
 675                 return;
 676         }
 677
 678         /* Move to the data stage. */
 679         if (!req.r.wLength)
 680                 udc->ep0_state = ISP1760_CTRL_STATUS;
 681         else if (req.r.bRequestType & USB_DIR_IN)
 682                 udc->ep0_state = ISP1760_CTRL_DATA_IN;
 683         else
 684                 udc->ep0_state = ISP1760_CTRL_DATA_OUT;
 685
 686         udc->ep0_dir = req.r.bRequestType & USB_DIR_IN;
 687         udc->ep0_length = le16_to_cpu(req.r.wLength);
 688
 689         spin_unlock(&udc->lock);
 690
 691         dev_dbg(udc->isp->dev,
 692                 "%s: bRequestType 0x%02x bRequest 0x%02x wValue 0x%04x wIndex 0x%04x wLength 0x%04x\n",
 693                 __func__, req.r.bRequestType, req.r.bRequest,
 694                 le16_to_cpu(req.r.wValue), le16_to_cpu(req.r.wIndex),
 695                 le16_to_cpu(req.r.wLength));
 696
 697         if ((req.r.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
 698                 stall = isp1760_ep0_setup_standard(udc, &req.r);
 699         else
 700                 stall = udc->driver->setup(&udc->gadget, &req.r) < 0;
 701
 702         if (stall)
 703                 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
 704 }
 705
 706 /* -----------------------------------------------------------------------------
 707  * Gadget Endpoint Operations
 708  */
 709
 710 static int isp1760_ep_enable(struct usb_ep *ep,
 711                              const struct usb_endpoint_descriptor *desc)
 712 {
 713         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 714         struct isp1760_udc *udc = uep->udc;
 715         unsigned long flags;
 716         unsigned int type;
 717
 718         dev_dbg(uep->udc->isp->dev, "%s\n", __func__);
 719
 720         /*
 721          * Validate the descriptor. The control endpoint can't be enabled
 722          * manually.
 723          */
 724         if (desc->bDescriptorType != USB_DT_ENDPOINT ||
 725             desc->bEndpointAddress == 0 ||
 726             desc->bEndpointAddress != uep->addr ||
 727             le16_to_cpu(desc->wMaxPacketSize) > ep->maxpacket) {
 728                 dev_dbg(udc->isp->dev,
 729                         "%s: invalid descriptor type %u addr %02x ep addr %02x max packet size %u/%u\n",
 730                         __func__, desc->bDescriptorType,
 731                         desc->bEndpointAddress, uep->addr,
 732                         le16_to_cpu(desc->wMaxPacketSize), ep->maxpacket);
 733                 return -EINVAL;
 734         }
 735
 736         switch (usb_endpoint_type(desc)) {
 737         case USB_ENDPOINT_XFER_ISOC:
 738                 type = DC_ENDPTYP_ISOC;
 739                 break;
 740         case USB_ENDPOINT_XFER_BULK:
 741                 type = DC_ENDPTYP_BULK;
 742                 break;
 743         case USB_ENDPOINT_XFER_INT:
 744                 type = DC_ENDPTYP_INTERRUPT;
 745                 break;
 746         case USB_ENDPOINT_XFER_CONTROL:
 747         default:
 748                 dev_dbg(udc->isp->dev, "%s: control endpoints unsupported\n",
 749                         __func__);
 750                 return -EINVAL;
 751         }
 752
 753         spin_lock_irqsave(&udc->lock, flags);
 754
 755         uep->desc = desc;
 756         uep->maxpacket = le16_to_cpu(desc->wMaxPacketSize);
 757         uep->rx_pending = false;
 758         uep->halted = false;
 759         uep->wedged = false;
 760
 761         isp1760_udc_select_ep(uep);
 762         isp1760_udc_write(udc, DC_EPMAXPKTSZ, uep->maxpacket);
 763         isp1760_udc_write(udc, DC_BUFLEN, uep->maxpacket);
 764         isp1760_udc_write(udc, DC_EPTYPE, DC_EPENABLE | type);
 765
 766         spin_unlock_irqrestore(&udc->lock, flags);
 767
 768         return 0;
 769 }
 770
 771 static int isp1760_ep_disable(struct usb_ep *ep)
 772 {
 773         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 774         struct isp1760_udc *udc = uep->udc;
 775         struct isp1760_request *req, *nreq;
 776         LIST_HEAD(req_list);
 777         unsigned long flags;
 778
 779         dev_dbg(udc->isp->dev, "%s\n", __func__);
 780
 781         spin_lock_irqsave(&udc->lock, flags);
 782
 783         if (!uep->desc) {
 784                 dev_dbg(udc->isp->dev, "%s: endpoint not enabled\n", __func__);
 785                 spin_unlock_irqrestore(&udc->lock, flags);
 786                 return -EINVAL;
 787         }
 788
 789         uep->desc = NULL;
 790         uep->maxpacket = 0;
 791
 792         isp1760_udc_select_ep(uep);
 793         isp1760_udc_write(udc, DC_EPTYPE, 0);
 794
 795         /* TODO Synchronize with the IRQ handler */
 796
 797         list_splice_init(&uep->queue, &req_list);
 798
 799         spin_unlock_irqrestore(&udc->lock, flags);
 800
 801         list_for_each_entry_safe(req, nreq, &req_list, queue) {
 802                 list_del(&req->queue);
 803                 isp1760_udc_request_complete(uep, req, -ESHUTDOWN);
 804         }
 805
 806         return 0;
 807 }
 808
 809 static struct usb_request *isp1760_ep_alloc_request(struct usb_ep *ep,
 810                                                     gfp_t gfp_flags)
 811 {
 812         struct isp1760_request *req;
 813
 814         req = kzalloc(sizeof(*req), gfp_flags);
 815         if (!req)
 816                 return NULL;
 817
 818         return &req->req;
 819 }
 820
 821 static void isp1760_ep_free_request(struct usb_ep *ep, struct usb_request *_req)
 822 {
 823         struct isp1760_request *req = req_to_udc_req(_req);
 824
 825         kfree(req);
 826 }
 827
 828 static int isp1760_ep_queue(struct usb_ep *ep, struct usb_request *_req,
 829                             gfp_t gfp_flags)
 830 {
 831         struct isp1760_request *req = req_to_udc_req(_req);
 832         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 833         struct isp1760_udc *udc = uep->udc;
 834         bool complete = false;
 835         unsigned long flags;
 836         int ret = 0;
 837
 838         _req->status = -EINPROGRESS;
 839         _req->actual = 0;
 840
 841         spin_lock_irqsave(&udc->lock, flags);
 842
 843         dev_dbg(udc->isp->dev,
 844                 "%s: req %p (%u bytes%s) ep %p(0x%02x)\n", __func__, _req,
 845                 _req->length, _req->zero ? " (zlp)" : "", uep, uep->addr);
 846
 847         req->ep = uep;
 848
 849         if (uep->addr == 0) {
 850                 if (_req->length != udc->ep0_length &&
 851                     udc->ep0_state != ISP1760_CTRL_DATA_IN) {
 852                         dev_dbg(udc->isp->dev,
 853                                 "%s: invalid length %u for req %p\n",
 854                                 __func__, _req->length, req);
 855                         ret = -EINVAL;
 856                         goto done;
 857                 }
 858
 859                 switch (udc->ep0_state) {
 860                 case ISP1760_CTRL_DATA_IN:
 861                         dev_dbg(udc->isp->dev, "%s: transmitting req %p\n",
 862                                 __func__, req);
 863
 864                         list_add_tail(&req->queue, &uep->queue);
 865                         isp1760_udc_transmit(uep, req);
 866                         break;
 867
 868                 case ISP1760_CTRL_DATA_OUT:
 869                         list_add_tail(&req->queue, &uep->queue);
 870                         __isp1760_udc_select_ep(uep, USB_DIR_OUT);
 871                         isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
 872                         break;
 873
 874                 case ISP1760_CTRL_STATUS:
 875                         complete = true;
 876                         break;
 877
 878                 default:
 879                         dev_dbg(udc->isp->dev, "%s: invalid ep0 state\n",
 880                                 __func__);
 881                         ret = -EINVAL;
 882                         break;
 883                 }
 884         } else if (uep->desc) {
 885                 bool empty = list_empty(&uep->queue);
 886
 887                 list_add_tail(&req->queue, &uep->queue);
 888                 if ((uep->addr & USB_DIR_IN) && !uep->halted && empty)
 889                         isp1760_udc_transmit(uep, req);
 890                 else if (!(uep->addr & USB_DIR_IN) && uep->rx_pending)
 891                         complete = isp1760_udc_receive(uep, req);
 892         } else {
 893                 dev_dbg(udc->isp->dev,
 894                         "%s: can't queue request to disabled ep%02x\n",
 895                         __func__, uep->addr);
 896                 ret = -ESHUTDOWN;
 897         }
 898
 899 done:
 900         if (ret < 0)
 901                 req->ep = NULL;
 902
 903         spin_unlock_irqrestore(&udc->lock, flags);
 904
 905         if (complete)
 906                 isp1760_udc_request_complete(uep, req, 0);
 907
 908         return ret;
 909 }
 910
 911 static int isp1760_ep_dequeue(struct usb_ep *ep, struct usb_request *_req)
 912 {
 913         struct isp1760_request *req = req_to_udc_req(_req);
 914         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 915         struct isp1760_udc *udc = uep->udc;
 916         unsigned long flags;
 917
 918         dev_dbg(uep->udc->isp->dev, "%s(ep%02x)\n", __func__, uep->addr);
 919
 920         spin_lock_irqsave(&udc->lock, flags);
 921
 922         if (req->ep != uep)
 923                 req = NULL;
 924         else
 925                 list_del(&req->queue);
 926
 927         spin_unlock_irqrestore(&udc->lock, flags);
 928
 929         if (!req)
 930                 return -EINVAL;
 931
 932         isp1760_udc_request_complete(uep, req, -ECONNRESET);
 933         return 0;
 934 }
 935
 936 static int __isp1760_ep_set_halt(struct isp1760_ep *uep, bool stall, bool wedge)
 937 {
 938         struct isp1760_udc *udc = uep->udc;
 939         int ret;
 940
 941         if (!uep->addr) {
 942                 /*
 943                  * Halting the control endpoint is only valid as a delayed error
 944                  * response to a SETUP packet. Make sure EP0 is in the right
 945                  * stage and that the gadget isn't trying to clear the halt
 946                  * condition.
 947                  */
 948                 if (WARN_ON(udc->ep0_state == ISP1760_CTRL_SETUP || !stall ||
 949                              wedge)) {
 950                         return -EINVAL;
 951                 }
 952         }
 953
 954         if (uep->addr && !uep->desc) {
 955                 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
 956                         uep->addr);
 957                 return -EINVAL;
 958         }
 959
 960         if (uep->addr & USB_DIR_IN) {
 961                 /* Refuse to halt IN endpoints with active transfers. */
 962                 if (!list_empty(&uep->queue)) {
 963                         dev_dbg(udc->isp->dev,
 964                                 "%s: ep%02x has request pending\n", __func__,
 965                                 uep->addr);
 966                         return -EAGAIN;
 967                 }
 968         }
 969
 970         ret = __isp1760_udc_set_halt(uep, stall);
 971         if (ret < 0)
 972                 return ret;
 973
 974         if (!uep->addr) {
 975                 /*
 976                  * Stalling EP0 completes the control transaction, move back to
 977                  * the SETUP state.
 978                  */
 979                 udc->ep0_state = ISP1760_CTRL_SETUP;
 980                 return 0;
 981         }
 982
 983         if (wedge)
 984                 uep->wedged = true;
 985         else if (!stall)
 986                 uep->wedged = false;
 987
 988         return 0;
 989 }
 990
 991 static int isp1760_ep_set_halt(struct usb_ep *ep, int value)
 992 {
 993         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 994         unsigned long flags;
 995         int ret;
 996
 997         dev_dbg(uep->udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
 998                 value ? "set" : "clear", uep->addr);
 999
1000         spin_lock_irqsave(&uep->udc->lock, flags);
1001         ret = __isp1760_ep_set_halt(uep, value, false);
1002         spin_unlock_irqrestore(&uep->udc->lock, flags);
1003
1004         return ret;
1005 }
1006
1007 static int isp1760_ep_set_wedge(struct usb_ep *ep)
1008 {
1009         struct isp1760_ep *uep = ep_to_udc_ep(ep);
1010         unsigned long flags;
1011         int ret;
1012
1013         dev_dbg(uep->udc->isp->dev, "%s: set wedge on ep%02x)\n", __func__,
1014                 uep->addr);
1015
1016         spin_lock_irqsave(&uep->udc->lock, flags);
1017         ret = __isp1760_ep_set_halt(uep, true, true);
1018         spin_unlock_irqrestore(&uep->udc->lock, flags);
1019
1020         return ret;
1021 }
1022
1023 static void isp1760_ep_fifo_flush(struct usb_ep *ep)
1024 {
1025         struct isp1760_ep *uep = ep_to_udc_ep(ep);
1026         struct isp1760_udc *udc = uep->udc;
1027         unsigned long flags;
1028
1029         spin_lock_irqsave(&udc->lock, flags);
1030
1031         isp1760_udc_select_ep(uep);
1032
1033         /*
1034          * Set the CLBUF bit twice to flush both buffers in case double
1035          * buffering is enabled.
1036          */
1037         isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1038         isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1039
1040         spin_unlock_irqrestore(&udc->lock, flags);
1041 }
1042
1043 static const struct usb_ep_ops isp1760_ep_ops = {
1044         .enable = isp1760_ep_enable,
1045         .disable = isp1760_ep_disable,
1046         .alloc_request = isp1760_ep_alloc_request,
1047         .free_request = isp1760_ep_free_request,
1048         .queue = isp1760_ep_queue,
1049         .dequeue = isp1760_ep_dequeue,
1050         .set_halt = isp1760_ep_set_halt,
1051         .set_wedge = isp1760_ep_set_wedge,
1052         .fifo_flush = isp1760_ep_fifo_flush,
1053 };
1054
1055 /* -----------------------------------------------------------------------------
1056  * Device States
1057  */
1058
1059 /* Called with the UDC spinlock held. */
1060 static void isp1760_udc_connect(struct isp1760_udc *udc)
1061 {
1062         usb_gadget_set_state(&udc->gadget, USB_STATE_POWERED);
1063         mod_timer(&udc->vbus_timer, jiffies + ISP1760_VBUS_POLL_INTERVAL);
1064 }
1065
1066 /* Called with the UDC spinlock held. */
1067 static void isp1760_udc_disconnect(struct isp1760_udc *udc)
1068 {
1069         if (udc->gadget.state < USB_STATE_POWERED)
1070                 return;
1071
1072         dev_dbg(udc->isp->dev, "Device disconnected in state %u\n",
1073                  udc->gadget.state);
1074
1075         udc->gadget.speed = USB_SPEED_UNKNOWN;
1076         usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1077
1078         if (udc->driver->disconnect)
1079                 udc->driver->disconnect(&udc->gadget);
1080
1081         del_timer(&udc->vbus_timer);
1082
1083         /* TODO Reset all endpoints ? */
1084 }
1085
1086 static void isp1760_udc_init_hw(struct isp1760_udc *udc)
1087 {
1088         /*
1089          * The device controller currently shares its interrupt with the host
1090          * controller, the DC_IRQ polarity and signaling mode are ignored. Set
1091          * the to active-low level-triggered.
1092          *
1093          * Configure the control, in and out pipes to generate interrupts on
1094          * ACK tokens only (and NYET for the out pipe). The default
1095          * configuration also generates an interrupt on the first NACK token.
1096          */
1097         isp1760_udc_write(udc, DC_INTCONF, DC_CDBGMOD_ACK | DC_DDBGMODIN_ACK |
1098                           DC_DDBGMODOUT_ACK_NYET);
1099
1100         isp1760_udc_write(udc, DC_INTENABLE, DC_IEPRXTX(7) | DC_IEPRXTX(6) |
1101                           DC_IEPRXTX(5) | DC_IEPRXTX(4) | DC_IEPRXTX(3) |
1102                           DC_IEPRXTX(2) | DC_IEPRXTX(1) | DC_IEPRXTX(0) |
1103                           DC_IEP0SETUP | DC_IEVBUS | DC_IERESM | DC_IESUSP |
1104                           DC_IEHS_STA | DC_IEBRST);
1105
1106         if (udc->connected)
1107                 isp1760_set_pullup(udc->isp, true);
1108
1109         isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN);
1110 }
1111
1112 static void isp1760_udc_reset(struct isp1760_udc *udc)
1113 {
1114         unsigned long flags;
1115
1116         spin_lock_irqsave(&udc->lock, flags);
1117
1118         /*
1119          * The bus reset has reset most registers to their default value,
1120          * reinitialize the UDC hardware.
1121          */
1122         isp1760_udc_init_hw(udc);
1123
1124         udc->ep0_state = ISP1760_CTRL_SETUP;
1125         udc->gadget.speed = USB_SPEED_FULL;
1126
1127         usb_gadget_udc_reset(&udc->gadget, udc->driver);
1128
1129         spin_unlock_irqrestore(&udc->lock, flags);
1130 }
1131
1132 static void isp1760_udc_suspend(struct isp1760_udc *udc)
1133 {
1134         if (udc->gadget.state < USB_STATE_DEFAULT)
1135                 return;
1136
1137         if (udc->driver->suspend)
1138                 udc->driver->suspend(&udc->gadget);
1139 }
1140
1141 static void isp1760_udc_resume(struct isp1760_udc *udc)
1142 {
1143         if (udc->gadget.state < USB_STATE_DEFAULT)
1144                 return;
1145
1146         if (udc->driver->resume)
1147                 udc->driver->resume(&udc->gadget);
1148 }
1149
1150 /* -----------------------------------------------------------------------------
1151  * Gadget Operations
1152  */
1153
1154 static int isp1760_udc_get_frame(struct usb_gadget *gadget)
1155 {
1156         struct isp1760_udc *udc = gadget_to_udc(gadget);
1157
1158         return isp1760_udc_read(udc, DC_FRAMENUM) & ((1 << 11) - 1);
1159 }
1160
1161 static int isp1760_udc_wakeup(struct usb_gadget *gadget)
1162 {
1163         struct isp1760_udc *udc = gadget_to_udc(gadget);
1164
1165         dev_dbg(udc->isp->dev, "%s\n", __func__);
1166         return -ENOTSUPP;
1167 }
1168
1169 static int isp1760_udc_set_selfpowered(struct usb_gadget *gadget,
1170                                        int is_selfpowered)
1171 {
1172         struct isp1760_udc *udc = gadget_to_udc(gadget);
1173
1174         if (is_selfpowered)
1175                 udc->devstatus |= 1 << USB_DEVICE_SELF_POWERED;
1176         else
1177                 udc->devstatus &= ~(1 << USB_DEVICE_SELF_POWERED);
1178
1179         return 0;
1180 }
1181
1182 static int isp1760_udc_pullup(struct usb_gadget *gadget, int is_on)
1183 {
1184         struct isp1760_udc *udc = gadget_to_udc(gadget);
1185
1186         isp1760_set_pullup(udc->isp, is_on);
1187         udc->connected = is_on;
1188
1189         return 0;
1190 }
1191
1192 static int isp1760_udc_start(struct usb_gadget *gadget,
1193                              struct usb_gadget_driver *driver)
1194 {
1195         struct isp1760_udc *udc = gadget_to_udc(gadget);
1196         unsigned long flags;
1197
1198         /* The hardware doesn't support low speed. */
1199         if (driver->max_speed < USB_SPEED_FULL) {
1200                 dev_err(udc->isp->dev, "Invalid gadget driver\n");
1201                 return -EINVAL;
1202         }
1203
1204         spin_lock_irqsave(&udc->lock, flags);
1205
1206         if (udc->driver) {
1207                 dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
1208                 spin_unlock_irqrestore(&udc->lock, flags);
1209                 return -EBUSY;
1210         }
1211
1212         udc->driver = driver;
1213
1214         spin_unlock_irqrestore(&udc->lock, flags);
1215
1216         dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
1217                 driver->function);
1218
1219         udc->devstatus = 0;
1220         udc->connected = true;
1221
1222         usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1223
1224         /* DMA isn't supported yet, don't enable the DMA clock. */
1225         isp1760_udc_write(udc, DC_MODE, DC_GLINTENA);
1226
1227         isp1760_udc_init_hw(udc);
1228
1229         dev_dbg(udc->isp->dev, "UDC started with driver %s\n",
1230                 driver->function);
1231
1232         return 0;
1233 }
1234
1235 static int isp1760_udc_stop(struct usb_gadget *gadget)
1236 {
1237         struct isp1760_udc *udc = gadget_to_udc(gadget);
1238         unsigned long flags;
1239
1240         dev_dbg(udc->isp->dev, "%s\n", __func__);
1241
1242         del_timer_sync(&udc->vbus_timer);
1243
1244         isp1760_udc_write(udc, DC_MODE, 0);
1245
1246         spin_lock_irqsave(&udc->lock, flags);
1247         udc->driver = NULL;
1248         spin_unlock_irqrestore(&udc->lock, flags);
1249
1250         return 0;
1251 }
1252
1253 static const struct usb_gadget_ops isp1760_udc_ops = {
1254         .get_frame = isp1760_udc_get_frame,
1255         .wakeup = isp1760_udc_wakeup,
1256         .set_selfpowered = isp1760_udc_set_selfpowered,
1257         .pullup = isp1760_udc_pullup,
1258         .udc_start = isp1760_udc_start,
1259         .udc_stop = isp1760_udc_stop,
1260 };
1261
1262 /* -----------------------------------------------------------------------------
1263  * Interrupt Handling
1264  */
1265
1266 static irqreturn_t isp1760_udc_irq(int irq, void *dev)
1267 {
1268         struct isp1760_udc *udc = dev;
1269         unsigned int i;
1270         u32 status;
1271
1272         status = isp1760_udc_read(udc, DC_INTERRUPT)
1273                & isp1760_udc_read(udc, DC_INTENABLE);
1274         isp1760_udc_write(udc, DC_INTERRUPT, status);
1275
1276         if (status & DC_IEVBUS) {
1277                 dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
1278                 /* The VBUS interrupt is only triggered when VBUS appears. */
1279                 spin_lock(&udc->lock);
1280                 isp1760_udc_connect(udc);
1281                 spin_unlock(&udc->lock);
1282         }
1283
1284         if (status & DC_IEBRST) {
1285                 dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
1286
1287                 isp1760_udc_reset(udc);
1288         }
1289
1290         for (i = 0; i <= 7; ++i) {
1291                 struct isp1760_ep *ep = &udc->ep[i*2];
1292
1293                 if (status & DC_IEPTX(i)) {
1294                         dev_dbg(udc->isp->dev, "%s(EPTX%u)\n", __func__, i);
1295                         isp1760_ep_tx_complete(ep);
1296                 }
1297
1298                 if (status & DC_IEPRX(i)) {
1299                         dev_dbg(udc->isp->dev, "%s(EPRX%u)\n", __func__, i);
1300                         isp1760_ep_rx_ready(i ? ep - 1 : ep);
1301                 }
1302         }
1303
1304         if (status & DC_IEP0SETUP) {
1305                 dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
1306
1307                 isp1760_ep0_setup(udc);
1308         }
1309
1310         if (status & DC_IERESM) {
1311                 dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
1312                 isp1760_udc_resume(udc);
1313         }
1314
1315         if (status & DC_IESUSP) {
1316                 dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
1317
1318                 spin_lock(&udc->lock);
1319                 if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1320                         isp1760_udc_disconnect(udc);
1321                 else
1322                         isp1760_udc_suspend(udc);
1323                 spin_unlock(&udc->lock);
1324         }
1325
1326         if (status & DC_IEHS_STA) {
1327                 dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
1328                 udc->gadget.speed = USB_SPEED_HIGH;
1329         }
1330
1331         return status ? IRQ_HANDLED : IRQ_NONE;
1332 }
1333
1334 static void isp1760_udc_vbus_poll(unsigned long data)
1335 {
1336         struct isp1760_udc *udc = (struct isp1760_udc *)data;
1337         unsigned long flags;
1338
1339         spin_lock_irqsave(&udc->lock, flags);
1340
1341         if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1342                 isp1760_udc_disconnect(udc);
1343         else if (udc->gadget.state >= USB_STATE_POWERED)
1344                 mod_timer(&udc->vbus_timer,
1345                           jiffies + ISP1760_VBUS_POLL_INTERVAL);
1346
1347         spin_unlock_irqrestore(&udc->lock, flags);
1348 }
1349
1350 /* -----------------------------------------------------------------------------
1351  * Registration
1352  */
1353
1354 static void isp1760_udc_init_eps(struct isp1760_udc *udc)
1355 {
1356         unsigned int i;
1357
1358         INIT_LIST_HEAD(&udc->gadget.ep_list);
1359
1360         for (i = 0; i < ARRAY_SIZE(udc->ep); ++i) {
1361                 struct isp1760_ep *ep = &udc->ep[i];
1362                 unsigned int ep_num = (i + 1) / 2;
1363                 bool is_in = !(i & 1);
1364
1365                 ep->udc = udc;
1366
1367                 INIT_LIST_HEAD(&ep->queue);
1368
1369                 ep->addr = (ep_num && is_in ? USB_DIR_IN : USB_DIR_OUT)
1370                          | ep_num;
1371                 ep->desc = NULL;
1372
1373                 sprintf(ep->name, "ep%u%s", ep_num,
1374                         ep_num ? (is_in ? "in" : "out") : "");
1375
1376                 ep->ep.ops = &isp1760_ep_ops;
1377                 ep->ep.name = ep->name;
1378
1379                 /*
1380                  * Hardcode the maximum packet sizes for now, to 64 bytes for
1381                  * the control endpoint and 512 bytes for all other endpoints.
1382                  * This fits in the 8kB FIFO without double-buffering.
1383                  */
1384                 if (ep_num == 0) {
1385                         usb_ep_set_maxpacket_limit(&ep->ep, 64);
1386                         ep->ep.caps.type_control = true;
1387                         ep->ep.caps.dir_in = true;
1388                         ep->ep.caps.dir_out = true;
1389                         ep->maxpacket = 64;
1390                         udc->gadget.ep0 = &ep->ep;
1391                 } else {
1392                         usb_ep_set_maxpacket_limit(&ep->ep, 512);
1393                         ep->ep.caps.type_iso = true;
1394                         ep->ep.caps.type_bulk = true;
1395                         ep->ep.caps.type_int = true;
1396                         ep->maxpacket = 0;
1397                         list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
1398                 }
1399
1400                 if (is_in)
1401                         ep->ep.caps.dir_in = true;
1402                 else
1403                         ep->ep.caps.dir_out = true;
1404         }
1405 }
1406
1407 static int isp1760_udc_init(struct isp1760_udc *udc)
1408 {
1409         u16 scratch;
1410         u32 chipid;
1411
1412         /*
1413          * Check that the controller is present by writing to the scratch
1414          * register, modifying the bus pattern by reading from the chip ID
1415          * register, and reading the scratch register value back. The chip ID
1416          * and scratch register contents must match the expected values.
1417          */
1418         isp1760_udc_write(udc, DC_SCRATCH, 0xbabe);
1419         chipid = isp1760_udc_read(udc, DC_CHIPID);
1420         scratch = isp1760_udc_read(udc, DC_SCRATCH);
1421
1422         if (scratch != 0xbabe) {
1423                 dev_err(udc->isp->dev,
1424                         "udc: scratch test failed (0x%04x/0x%08x)\n",
1425                         scratch, chipid);
1426                 return -ENODEV;
1427         }
1428
1429         if (chipid != 0x00011582 && chipid != 0x00158210) {
1430                 dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
1431                 return -ENODEV;
1432         }
1433
1434         /* Reset the device controller. */
1435         isp1760_udc_write(udc, DC_MODE, DC_SFRESET);
1436         usleep_range(10000, 11000);
1437         isp1760_udc_write(udc, DC_MODE, 0);
1438         usleep_range(10000, 11000);
1439
1440         return 0;
1441 }
1442
1443 int isp1760_udc_register(struct isp1760_device *isp, int irq,
1444                          unsigned long irqflags)
1445 {
1446         struct isp1760_udc *udc = &isp->udc;
1447         const char *devname;
1448         int ret;
1449
1450         udc->irq = -1;
1451         udc->isp = isp;
1452         udc->regs = isp->regs;
1453
1454         spin_lock_init(&udc->lock);
1455         setup_timer(&udc->vbus_timer, isp1760_udc_vbus_poll,
1456                     (unsigned long)udc);
1457
1458         ret = isp1760_udc_init(udc);
1459         if (ret < 0)
1460                 return ret;
1461
1462         devname = dev_name(isp->dev);
1463         udc->irqname = kmalloc(strlen(devname) + 7, GFP_KERNEL);
1464         if (!udc->irqname)
1465                 return -ENOMEM;
1466
1467         sprintf(udc->irqname, "%s (udc)", devname);
1468
1469         ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
1470                           udc->irqname, udc);
1471         if (ret < 0)
1472                 goto error;
1473
1474         udc->irq = irq;
1475
1476         /*
1477          * Initialize the gadget static fields and register its device. Gadget
1478          * fields that vary during the life time of the gadget are initialized
1479          * by the UDC core.
1480          */
1481         udc->gadget.ops = &isp1760_udc_ops;
1482         udc->gadget.speed = USB_SPEED_UNKNOWN;
1483         udc->gadget.max_speed = USB_SPEED_HIGH;
1484         udc->gadget.name = "isp1761_udc";
1485
1486         isp1760_udc_init_eps(udc);
1487
1488         ret = usb_add_gadget_udc(isp->dev, &udc->gadget);
1489         if (ret < 0)
1490                 goto error;
1491
1492         return 0;
1493
1494 error:
1495         if (udc->irq >= 0)
1496                 free_irq(udc->irq, udc);
1497         kfree(udc->irqname);
1498
1499         return ret;
1500 }
1501
1502 void isp1760_udc_unregister(struct isp1760_device *isp)
1503 {
1504         struct isp1760_udc *udc = &isp->udc;
1505
1506         if (!udc->isp)
1507                 return;
1508
1509         usb_del_gadget_udc(&udc->gadget);
1510
1511         free_irq(udc->irq, udc);
1512         kfree(udc->irqname);
1513 }