drivers/usb/isp1760/isp1760-udc.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Driver for the NXP ISP1761 device controller
   4  *
   5  * Copyright 2014 Ideas on Board Oy
   6  *
   7  * Contacts:
   8  *      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
   9  */
  10
  11 #include <linux/interrupt.h>
  12 #include <linux/io.h>
  13 #include <linux/kernel.h>
  14 #include <linux/list.h>
  15 #include <linux/module.h>
  16 #include <linux/slab.h>
  17 #include <linux/timer.h>
  18 #include <linux/usb.h>
  19
  20 #include "isp1760-core.h"
  21 #include "isp1760-regs.h"
  22 #include "isp1760-udc.h"
  23
  24 #define ISP1760_VBUS_POLL_INTERVAL      msecs_to_jiffies(500)
  25
  26 struct isp1760_request {
  27         struct usb_request req;
  28         struct list_head queue;
  29         struct isp1760_ep *ep;
  30         unsigned int packet_size;
  31 };
  32
  33 static inline struct isp1760_udc *gadget_to_udc(struct usb_gadget *gadget)
  34 {
  35         return container_of(gadget, struct isp1760_udc, gadget);
  36 }
  37
  38 static inline struct isp1760_ep *ep_to_udc_ep(struct usb_ep *ep)
  39 {
  40         return container_of(ep, struct isp1760_ep, ep);
  41 }
  42
  43 static inline struct isp1760_request *req_to_udc_req(struct usb_request *req)
  44 {
  45         return container_of(req, struct isp1760_request, req);
  46 }
  47
  48 static inline u32 isp1760_udc_read(struct isp1760_udc *udc, u16 reg)
  49 {
  50         return isp1760_read32(udc->regs, reg);
  51 }
  52
  53 static inline void isp1760_udc_write(struct isp1760_udc *udc, u16 reg, u32 val)
  54 {
  55         isp1760_write32(udc->regs, reg, val);
  56 }
  57
  58 /* -----------------------------------------------------------------------------
  59  * Endpoint Management
  60  */
  61
  62 static struct isp1760_ep *isp1760_udc_find_ep(struct isp1760_udc *udc,
  63                                               u16 index)
  64 {
  65         unsigned int i;
  66
  67         if (index == 0)
  68                 return &udc->ep[0];
  69
  70         for (i = 1; i < ARRAY_SIZE(udc->ep); ++i) {
  71                 if (udc->ep[i].addr == index)
  72                         return udc->ep[i].desc ? &udc->ep[i] : NULL;
  73         }
  74
  75         return NULL;
  76 }
  77
  78 static void __isp1760_udc_select_ep(struct isp1760_ep *ep, int dir)
  79 {
  80         isp1760_udc_write(ep->udc, DC_EPINDEX,
  81                           DC_ENDPIDX(ep->addr & USB_ENDPOINT_NUMBER_MASK) |
  82                           (dir == USB_DIR_IN ? DC_EPDIR : 0));
  83 }
  84
  85 /**
  86  * isp1760_udc_select_ep - Select an endpoint for register access
  87  * @ep: The endpoint
  88  *
  89  * The ISP1761 endpoint registers are banked. This function selects the target
  90  * endpoint for banked register access. The selection remains valid until the
  91  * next call to this function, the next direct access to the EPINDEX register
  92  * or the next reset, whichever comes first.
  93  *
  94  * Called with the UDC spinlock held.
  95  */
  96 static void isp1760_udc_select_ep(struct isp1760_ep *ep)
  97 {
  98         __isp1760_udc_select_ep(ep, ep->addr & USB_ENDPOINT_DIR_MASK);
  99 }
 100
 101 /* Called with the UDC spinlock held. */
 102 static void isp1760_udc_ctrl_send_status(struct isp1760_ep *ep, int dir)
 103 {
 104         struct isp1760_udc *udc = ep->udc;
 105
 106         /*
 107          * Proceed to the status stage. The status stage data packet flows in
 108          * the direction opposite to the data stage data packets, we thus need
 109          * to select the OUT/IN endpoint for IN/OUT transfers.
 110          */
 111         isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) |
 112                           (dir == USB_DIR_IN ? 0 : DC_EPDIR));
 113         isp1760_udc_write(udc, DC_CTRLFUNC, DC_STATUS);
 114
 115         /*
 116          * The hardware will terminate the request automatically and go back to
 117          * the setup stage without notifying us.
 118          */
 119         udc->ep0_state = ISP1760_CTRL_SETUP;
 120 }
 121
 122 /* Called without the UDC spinlock held. */
 123 static void isp1760_udc_request_complete(struct isp1760_ep *ep,
 124                                          struct isp1760_request *req,
 125                                          int status)
 126 {
 127         struct isp1760_udc *udc = ep->udc;
 128         unsigned long flags;
 129
 130         dev_dbg(ep->udc->isp->dev, "completing request %p with status %d\n",
 131                 req, status);
 132
 133         req->ep = NULL;
 134         req->req.status = status;
 135         req->req.complete(&ep->ep, &req->req);
 136
 137         spin_lock_irqsave(&udc->lock, flags);
 138
 139         /*
 140          * When completing control OUT requests, move to the status stage after
 141          * calling the request complete callback. This gives the gadget an
 142          * opportunity to stall the control transfer if needed.
 143          */
 144         if (status == 0 && ep->addr == 0 && udc->ep0_dir == USB_DIR_OUT)
 145                 isp1760_udc_ctrl_send_status(ep, USB_DIR_OUT);
 146
 147         spin_unlock_irqrestore(&udc->lock, flags);
 148 }
 149
 150 static void isp1760_udc_ctrl_send_stall(struct isp1760_ep *ep)
 151 {
 152         struct isp1760_udc *udc = ep->udc;
 153         unsigned long flags;
 154
 155         dev_dbg(ep->udc->isp->dev, "%s(ep%02x)\n", __func__, ep->addr);
 156
 157         spin_lock_irqsave(&udc->lock, flags);
 158
 159         /* Stall both the IN and OUT endpoints. */
 160         __isp1760_udc_select_ep(ep, USB_DIR_OUT);
 161         isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
 162         __isp1760_udc_select_ep(ep, USB_DIR_IN);
 163         isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
 164
 165         /* A protocol stall completes the control transaction. */
 166         udc->ep0_state = ISP1760_CTRL_SETUP;
 167
 168         spin_unlock_irqrestore(&udc->lock, flags);
 169 }
 170
 171 /* -----------------------------------------------------------------------------
 172  * Data Endpoints
 173  */
 174
 175 /* Called with the UDC spinlock held. */
 176 static bool isp1760_udc_receive(struct isp1760_ep *ep,
 177                                 struct isp1760_request *req)
 178 {
 179         struct isp1760_udc *udc = ep->udc;
 180         unsigned int len;
 181         u32 *buf;
 182         int i;
 183
 184         isp1760_udc_select_ep(ep);
 185         len = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
 186
 187         dev_dbg(udc->isp->dev, "%s: received %u bytes (%u/%u done)\n",
 188                 __func__, len, req->req.actual, req->req.length);
 189
 190         len = min(len, req->req.length - req->req.actual);
 191
 192         if (!len) {
 193                 /*
 194                  * There's no data to be read from the FIFO, acknowledge the RX
 195                  * interrupt by clearing the buffer.
 196                  *
 197                  * TODO: What if another packet arrives in the meantime ? The
 198                  * datasheet doesn't clearly document how this should be
 199                  * handled.
 200                  */
 201                 isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
 202                 return false;
 203         }
 204
 205         buf = req->req.buf + req->req.actual;
 206
 207         /*
 208          * Make sure not to read more than one extra byte, otherwise data from
 209          * the next packet might be removed from the FIFO.
 210          */
 211         for (i = len; i > 2; i -= 4, ++buf)
 212                 *buf = le32_to_cpu(isp1760_udc_read(udc, DC_DATAPORT));
 213         if (i > 0)
 214                 *(u16 *)buf = le16_to_cpu(readw(udc->regs + DC_DATAPORT));
 215
 216         req->req.actual += len;
 217
 218         /*
 219          * TODO: The short_not_ok flag isn't supported yet, but isn't used by
 220          * any gadget driver either.
 221          */
 222
 223         dev_dbg(udc->isp->dev,
 224                 "%s: req %p actual/length %u/%u maxpacket %u packet size %u\n",
 225                 __func__, req, req->req.actual, req->req.length, ep->maxpacket,
 226                 len);
 227
 228         ep->rx_pending = false;
 229
 230         /*
 231          * Complete the request if all data has been received or if a short
 232          * packet has been received.
 233          */
 234         if (req->req.actual == req->req.length || len < ep->maxpacket) {
 235                 list_del(&req->queue);
 236                 return true;
 237         }
 238
 239         return false;
 240 }
 241
 242 static void isp1760_udc_transmit(struct isp1760_ep *ep,
 243                                  struct isp1760_request *req)
 244 {
 245         struct isp1760_udc *udc = ep->udc;
 246         u32 *buf = req->req.buf + req->req.actual;
 247         int i;
 248
 249         req->packet_size = min(req->req.length - req->req.actual,
 250                                ep->maxpacket);
 251
 252         dev_dbg(udc->isp->dev, "%s: transferring %u bytes (%u/%u done)\n",
 253                 __func__, req->packet_size, req->req.actual,
 254                 req->req.length);
 255
 256         __isp1760_udc_select_ep(ep, USB_DIR_IN);
 257
 258         if (req->packet_size)
 259                 isp1760_udc_write(udc, DC_BUFLEN, req->packet_size);
 260
 261         /*
 262          * Make sure not to write more than one extra byte, otherwise extra data
 263          * will stay in the FIFO and will be transmitted during the next control
 264          * request. The endpoint control CLBUF bit is supposed to allow flushing
 265          * the FIFO for this kind of conditions, but doesn't seem to work.
 266          */
 267         for (i = req->packet_size; i > 2; i -= 4, ++buf)
 268                 isp1760_udc_write(udc, DC_DATAPORT, cpu_to_le32(*buf));
 269         if (i > 0)
 270                 writew(cpu_to_le16(*(u16 *)buf), udc->regs + DC_DATAPORT);
 271
 272         if (ep->addr == 0)
 273                 isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
 274         if (!req->packet_size)
 275                 isp1760_udc_write(udc, DC_CTRLFUNC, DC_VENDP);
 276 }
 277
 278 static void isp1760_ep_rx_ready(struct isp1760_ep *ep)
 279 {
 280         struct isp1760_udc *udc = ep->udc;
 281         struct isp1760_request *req;
 282         bool complete;
 283
 284         spin_lock(&udc->lock);
 285
 286         if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_OUT) {
 287                 spin_unlock(&udc->lock);
 288                 dev_dbg(udc->isp->dev, "%s: invalid ep0 state %u\n", __func__,
 289                         udc->ep0_state);
 290                 return;
 291         }
 292
 293         if (ep->addr != 0 && !ep->desc) {
 294                 spin_unlock(&udc->lock);
 295                 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
 296                         ep->addr);
 297                 return;
 298         }
 299
 300         if (list_empty(&ep->queue)) {
 301                 ep->rx_pending = true;
 302                 spin_unlock(&udc->lock);
 303                 dev_dbg(udc->isp->dev, "%s: ep%02x (%p) has no request queued\n",
 304                         __func__, ep->addr, ep);
 305                 return;
 306         }
 307
 308         req = list_first_entry(&ep->queue, struct isp1760_request,
 309                                queue);
 310         complete = isp1760_udc_receive(ep, req);
 311
 312         spin_unlock(&udc->lock);
 313
 314         if (complete)
 315                 isp1760_udc_request_complete(ep, req, 0);
 316 }
 317
 318 static void isp1760_ep_tx_complete(struct isp1760_ep *ep)
 319 {
 320         struct isp1760_udc *udc = ep->udc;
 321         struct isp1760_request *complete = NULL;
 322         struct isp1760_request *req;
 323         bool need_zlp;
 324
 325         spin_lock(&udc->lock);
 326
 327         if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_IN) {
 328                 spin_unlock(&udc->lock);
 329                 dev_dbg(udc->isp->dev, "TX IRQ: invalid endpoint state %u\n",
 330                         udc->ep0_state);
 331                 return;
 332         }
 333
 334         if (list_empty(&ep->queue)) {
 335                 /*
 336                  * This can happen for the control endpoint when the reply to
 337                  * the GET_STATUS IN control request is sent directly by the
 338                  * setup IRQ handler. Just proceed to the status stage.
 339                  */
 340                 if (ep->addr == 0) {
 341                         isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
 342                         spin_unlock(&udc->lock);
 343                         return;
 344                 }
 345
 346                 spin_unlock(&udc->lock);
 347                 dev_dbg(udc->isp->dev, "%s: ep%02x has no request queued\n",
 348                         __func__, ep->addr);
 349                 return;
 350         }
 351
 352         req = list_first_entry(&ep->queue, struct isp1760_request,
 353                                queue);
 354         req->req.actual += req->packet_size;
 355
 356         need_zlp = req->req.actual == req->req.length &&
 357                    !(req->req.length % ep->maxpacket) &&
 358                    req->packet_size && req->req.zero;
 359
 360         dev_dbg(udc->isp->dev,
 361                 "TX IRQ: req %p actual/length %u/%u maxpacket %u packet size %u zero %u need zlp %u\n",
 362                  req, req->req.actual, req->req.length, ep->maxpacket,
 363                  req->packet_size, req->req.zero, need_zlp);
 364
 365         /*
 366          * Complete the request if all data has been sent and we don't need to
 367          * transmit a zero length packet.
 368          */
 369         if (req->req.actual == req->req.length && !need_zlp) {
 370                 complete = req;
 371                 list_del(&req->queue);
 372
 373                 if (ep->addr == 0)
 374                         isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
 375
 376                 if (!list_empty(&ep->queue))
 377                         req = list_first_entry(&ep->queue,
 378                                                struct isp1760_request, queue);
 379                 else
 380                         req = NULL;
 381         }
 382
 383         /*
 384          * Transmit the next packet or start the next request, if any.
 385          *
 386          * TODO: If the endpoint is stalled the next request shouldn't be
 387          * started, but what about the next packet ?
 388          */
 389         if (req)
 390                 isp1760_udc_transmit(ep, req);
 391
 392         spin_unlock(&udc->lock);
 393
 394         if (complete)
 395                 isp1760_udc_request_complete(ep, complete, 0);
 396 }
 397
 398 static int __isp1760_udc_set_halt(struct isp1760_ep *ep, bool halt)
 399 {
 400         struct isp1760_udc *udc = ep->udc;
 401
 402         dev_dbg(udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
 403                 halt ? "set" : "clear", ep->addr);
 404
 405         if (ep->desc && usb_endpoint_xfer_isoc(ep->desc)) {
 406                 dev_dbg(udc->isp->dev, "%s: ep%02x is isochronous\n", __func__,
 407                         ep->addr);
 408                 return -EINVAL;
 409         }
 410
 411         isp1760_udc_select_ep(ep);
 412         isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
 413
 414         if (ep->addr == 0) {
 415                 /* When halting the control endpoint, stall both IN and OUT. */
 416                 __isp1760_udc_select_ep(ep, USB_DIR_IN);
 417                 isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
 418         } else if (!halt) {
 419                 /* Reset the data PID by cycling the endpoint enable bit. */
 420                 u16 eptype = isp1760_udc_read(udc, DC_EPTYPE);
 421
 422                 isp1760_udc_write(udc, DC_EPTYPE, eptype & ~DC_EPENABLE);
 423                 isp1760_udc_write(udc, DC_EPTYPE, eptype);
 424
 425                 /*
 426                  * Disabling the endpoint emptied the transmit FIFO, fill it
 427                  * again if a request is pending.
 428                  *
 429                  * TODO: Does the gadget framework require synchronizatino with
 430                  * the TX IRQ handler ?
 431                  */
 432                 if ((ep->addr & USB_DIR_IN) && !list_empty(&ep->queue)) {
 433                         struct isp1760_request *req;
 434
 435                         req = list_first_entry(&ep->queue,
 436                                                struct isp1760_request, queue);
 437                         isp1760_udc_transmit(ep, req);
 438                 }
 439         }
 440
 441         ep->halted = halt;
 442
 443         return 0;
 444 }
 445
 446 /* -----------------------------------------------------------------------------
 447  * Control Endpoint
 448  */
 449
 450 static int isp1760_udc_get_status(struct isp1760_udc *udc,
 451                                   const struct usb_ctrlrequest *req)
 452 {
 453         struct isp1760_ep *ep;
 454         u16 status;
 455
 456         if (req->wLength != cpu_to_le16(2) || req->wValue != cpu_to_le16(0))
 457                 return -EINVAL;
 458
 459         switch (req->bRequestType) {
 460         case USB_DIR_IN | USB_RECIP_DEVICE:
 461                 status = udc->devstatus;
 462                 break;
 463
 464         case USB_DIR_IN | USB_RECIP_INTERFACE:
 465                 status = 0;
 466                 break;
 467
 468         case USB_DIR_IN | USB_RECIP_ENDPOINT:
 469                 ep = isp1760_udc_find_ep(udc, le16_to_cpu(req->wIndex));
 470                 if (!ep)
 471                         return -EINVAL;
 472
 473                 status = 0;
 474                 if (ep->halted)
 475                         status |= 1 << USB_ENDPOINT_HALT;
 476                 break;
 477
 478         default:
 479                 return -EINVAL;
 480         }
 481
 482         isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) | DC_EPDIR);
 483         isp1760_udc_write(udc, DC_BUFLEN, 2);
 484
 485         writew(cpu_to_le16(status), udc->regs + DC_DATAPORT);
 486
 487         isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
 488
 489         dev_dbg(udc->isp->dev, "%s: status 0x%04x\n", __func__, status);
 490
 491         return 0;
 492 }
 493
 494 static int isp1760_udc_set_address(struct isp1760_udc *udc, u16 addr)
 495 {
 496         if (addr > 127) {
 497                 dev_dbg(udc->isp->dev, "invalid device address %u\n", addr);
 498                 return -EINVAL;
 499         }
 500
 501         if (udc->gadget.state != USB_STATE_DEFAULT &&
 502             udc->gadget.state != USB_STATE_ADDRESS) {
 503                 dev_dbg(udc->isp->dev, "can't set address in state %u\n",
 504                         udc->gadget.state);
 505                 return -EINVAL;
 506         }
 507
 508         usb_gadget_set_state(&udc->gadget, addr ? USB_STATE_ADDRESS :
 509                              USB_STATE_DEFAULT);
 510
 511         isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN | addr);
 512
 513         spin_lock(&udc->lock);
 514         isp1760_udc_ctrl_send_status(&udc->ep[0], USB_DIR_OUT);
 515         spin_unlock(&udc->lock);
 516
 517         return 0;
 518 }
 519
 520 static bool isp1760_ep0_setup_standard(struct isp1760_udc *udc,
 521                                        struct usb_ctrlrequest *req)
 522 {
 523         bool stall;
 524
 525         switch (req->bRequest) {
 526         case USB_REQ_GET_STATUS:
 527                 return isp1760_udc_get_status(udc, req);
 528
 529         case USB_REQ_CLEAR_FEATURE:
 530                 switch (req->bRequestType) {
 531                 case USB_DIR_OUT | USB_RECIP_DEVICE: {
 532                         /* TODO: Handle remote wakeup feature. */
 533                         return true;
 534                 }
 535
 536                 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
 537                         u16 index = le16_to_cpu(req->wIndex);
 538                         struct isp1760_ep *ep;
 539
 540                         if (req->wLength != cpu_to_le16(0) ||
 541                             req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
 542                                 return true;
 543
 544                         ep = isp1760_udc_find_ep(udc, index);
 545                         if (!ep)
 546                                 return true;
 547
 548                         spin_lock(&udc->lock);
 549
 550                         /*
 551                          * If the endpoint is wedged only the gadget can clear
 552                          * the halt feature. Pretend success in that case, but
 553                          * keep the endpoint halted.
 554                          */
 555                         if (!ep->wedged)
 556                                 stall = __isp1760_udc_set_halt(ep, false);
 557                         else
 558                                 stall = false;
 559
 560                         if (!stall)
 561                                 isp1760_udc_ctrl_send_status(&udc->ep[0],
 562                                                              USB_DIR_OUT);
 563
 564                         spin_unlock(&udc->lock);
 565                         return stall;
 566                 }
 567
 568                 default:
 569                         return true;
 570                 }
 571                 break;
 572
 573         case USB_REQ_SET_FEATURE:
 574                 switch (req->bRequestType) {
 575                 case USB_DIR_OUT | USB_RECIP_DEVICE: {
 576                         /* TODO: Handle remote wakeup and test mode features */
 577                         return true;
 578                 }
 579
 580                 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
 581                         u16 index = le16_to_cpu(req->wIndex);
 582                         struct isp1760_ep *ep;
 583
 584                         if (req->wLength != cpu_to_le16(0) ||
 585                             req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
 586                                 return true;
 587
 588                         ep = isp1760_udc_find_ep(udc, index);
 589                         if (!ep)
 590                                 return true;
 591
 592                         spin_lock(&udc->lock);
 593
 594                         stall = __isp1760_udc_set_halt(ep, true);
 595                         if (!stall)
 596                                 isp1760_udc_ctrl_send_status(&udc->ep[0],
 597                                                              USB_DIR_OUT);
 598
 599                         spin_unlock(&udc->lock);
 600                         return stall;
 601                 }
 602
 603                 default:
 604                         return true;
 605                 }
 606                 break;
 607
 608         case USB_REQ_SET_ADDRESS:
 609                 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
 610                         return true;
 611
 612                 return isp1760_udc_set_address(udc, le16_to_cpu(req->wValue));
 613
 614         case USB_REQ_SET_CONFIGURATION:
 615                 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
 616                         return true;
 617
 618                 if (udc->gadget.state != USB_STATE_ADDRESS &&
 619                     udc->gadget.state != USB_STATE_CONFIGURED)
 620                         return true;
 621
 622                 stall = udc->driver->setup(&udc->gadget, req) < 0;
 623                 if (stall)
 624                         return true;
 625
 626                 usb_gadget_set_state(&udc->gadget, req->wValue ?
 627                                      USB_STATE_CONFIGURED : USB_STATE_ADDRESS);
 628
 629                 /*
 630                  * SET_CONFIGURATION (and SET_INTERFACE) must reset the halt
 631                  * feature on all endpoints. There is however no need to do so
 632                  * explicitly here as the gadget driver will disable and
 633                  * reenable endpoints, clearing the halt feature.
 634                  */
 635                 return false;
 636
 637         default:
 638                 return udc->driver->setup(&udc->gadget, req) < 0;
 639         }
 640 }
 641
 642 static void isp1760_ep0_setup(struct isp1760_udc *udc)
 643 {
 644         union {
 645                 struct usb_ctrlrequest r;
 646                 u32 data[2];
 647         } req;
 648         unsigned int count;
 649         bool stall = false;
 650
 651         spin_lock(&udc->lock);
 652
 653         isp1760_udc_write(udc, DC_EPINDEX, DC_EP0SETUP);
 654
 655         count = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
 656         if (count != sizeof(req)) {
 657                 spin_unlock(&udc->lock);
 658
 659                 dev_err(udc->isp->dev, "invalid length %u for setup packet\n",
 660                         count);
 661
 662                 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
 663                 return;
 664         }
 665
 666         req.data[0] = isp1760_udc_read(udc, DC_DATAPORT);
 667         req.data[1] = isp1760_udc_read(udc, DC_DATAPORT);
 668
 669         if (udc->ep0_state != ISP1760_CTRL_SETUP) {
 670                 spin_unlock(&udc->lock);
 671                 dev_dbg(udc->isp->dev, "unexpected SETUP packet\n");
 672                 return;
 673         }
 674
 675         /* Move to the data stage. */
 676         if (!req.r.wLength)
 677                 udc->ep0_state = ISP1760_CTRL_STATUS;
 678         else if (req.r.bRequestType & USB_DIR_IN)
 679                 udc->ep0_state = ISP1760_CTRL_DATA_IN;
 680         else
 681                 udc->ep0_state = ISP1760_CTRL_DATA_OUT;
 682
 683         udc->ep0_dir = req.r.bRequestType & USB_DIR_IN;
 684         udc->ep0_length = le16_to_cpu(req.r.wLength);
 685
 686         spin_unlock(&udc->lock);
 687
 688         dev_dbg(udc->isp->dev,
 689                 "%s: bRequestType 0x%02x bRequest 0x%02x wValue 0x%04x wIndex 0x%04x wLength 0x%04x\n",
 690                 __func__, req.r.bRequestType, req.r.bRequest,
 691                 le16_to_cpu(req.r.wValue), le16_to_cpu(req.r.wIndex),
 692                 le16_to_cpu(req.r.wLength));
 693
 694         if ((req.r.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
 695                 stall = isp1760_ep0_setup_standard(udc, &req.r);
 696         else
 697                 stall = udc->driver->setup(&udc->gadget, &req.r) < 0;
 698
 699         if (stall)
 700                 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
 701 }
 702
 703 /* -----------------------------------------------------------------------------
 704  * Gadget Endpoint Operations
 705  */
 706
 707 static int isp1760_ep_enable(struct usb_ep *ep,
 708                              const struct usb_endpoint_descriptor *desc)
 709 {
 710         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 711         struct isp1760_udc *udc = uep->udc;
 712         unsigned long flags;
 713         unsigned int type;
 714
 715         dev_dbg(uep->udc->isp->dev, "%s\n", __func__);
 716
 717         /*
 718          * Validate the descriptor. The control endpoint can't be enabled
 719          * manually.
 720          */
 721         if (desc->bDescriptorType != USB_DT_ENDPOINT ||
 722             desc->bEndpointAddress == 0 ||
 723             desc->bEndpointAddress != uep->addr ||
 724             le16_to_cpu(desc->wMaxPacketSize) > ep->maxpacket) {
 725                 dev_dbg(udc->isp->dev,
 726                         "%s: invalid descriptor type %u addr %02x ep addr %02x max packet size %u/%u\n",
 727                         __func__, desc->bDescriptorType,
 728                         desc->bEndpointAddress, uep->addr,
 729                         le16_to_cpu(desc->wMaxPacketSize), ep->maxpacket);
 730                 return -EINVAL;
 731         }
 732
 733         switch (usb_endpoint_type(desc)) {
 734         case USB_ENDPOINT_XFER_ISOC:
 735                 type = DC_ENDPTYP_ISOC;
 736                 break;
 737         case USB_ENDPOINT_XFER_BULK:
 738                 type = DC_ENDPTYP_BULK;
 739                 break;
 740         case USB_ENDPOINT_XFER_INT:
 741                 type = DC_ENDPTYP_INTERRUPT;
 742                 break;
 743         case USB_ENDPOINT_XFER_CONTROL:
 744         default:
 745                 dev_dbg(udc->isp->dev, "%s: control endpoints unsupported\n",
 746                         __func__);
 747                 return -EINVAL;
 748         }
 749
 750         spin_lock_irqsave(&udc->lock, flags);
 751
 752         uep->desc = desc;
 753         uep->maxpacket = le16_to_cpu(desc->wMaxPacketSize);
 754         uep->rx_pending = false;
 755         uep->halted = false;
 756         uep->wedged = false;
 757
 758         isp1760_udc_select_ep(uep);
 759         isp1760_udc_write(udc, DC_EPMAXPKTSZ, uep->maxpacket);
 760         isp1760_udc_write(udc, DC_BUFLEN, uep->maxpacket);
 761         isp1760_udc_write(udc, DC_EPTYPE, DC_EPENABLE | type);
 762
 763         spin_unlock_irqrestore(&udc->lock, flags);
 764
 765         return 0;
 766 }
 767
 768 static int isp1760_ep_disable(struct usb_ep *ep)
 769 {
 770         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 771         struct isp1760_udc *udc = uep->udc;
 772         struct isp1760_request *req, *nreq;
 773         LIST_HEAD(req_list);
 774         unsigned long flags;
 775
 776         dev_dbg(udc->isp->dev, "%s\n", __func__);
 777
 778         spin_lock_irqsave(&udc->lock, flags);
 779
 780         if (!uep->desc) {
 781                 dev_dbg(udc->isp->dev, "%s: endpoint not enabled\n", __func__);
 782                 spin_unlock_irqrestore(&udc->lock, flags);
 783                 return -EINVAL;
 784         }
 785
 786         uep->desc = NULL;
 787         uep->maxpacket = 0;
 788
 789         isp1760_udc_select_ep(uep);
 790         isp1760_udc_write(udc, DC_EPTYPE, 0);
 791
 792         /* TODO Synchronize with the IRQ handler */
 793
 794         list_splice_init(&uep->queue, &req_list);
 795
 796         spin_unlock_irqrestore(&udc->lock, flags);
 797
 798         list_for_each_entry_safe(req, nreq, &req_list, queue) {
 799                 list_del(&req->queue);
 800                 isp1760_udc_request_complete(uep, req, -ESHUTDOWN);
 801         }
 802
 803         return 0;
 804 }
 805
 806 static struct usb_request *isp1760_ep_alloc_request(struct usb_ep *ep,
 807                                                     gfp_t gfp_flags)
 808 {
 809         struct isp1760_request *req;
 810
 811         req = kzalloc(sizeof(*req), gfp_flags);
 812         if (!req)
 813                 return NULL;
 814
 815         return &req->req;
 816 }
 817
 818 static void isp1760_ep_free_request(struct usb_ep *ep, struct usb_request *_req)
 819 {
 820         struct isp1760_request *req = req_to_udc_req(_req);
 821
 822         kfree(req);
 823 }
 824
 825 static int isp1760_ep_queue(struct usb_ep *ep, struct usb_request *_req,
 826                             gfp_t gfp_flags)
 827 {
 828         struct isp1760_request *req = req_to_udc_req(_req);
 829         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 830         struct isp1760_udc *udc = uep->udc;
 831         bool complete = false;
 832         unsigned long flags;
 833         int ret = 0;
 834
 835         _req->status = -EINPROGRESS;
 836         _req->actual = 0;
 837
 838         spin_lock_irqsave(&udc->lock, flags);
 839
 840         dev_dbg(udc->isp->dev,
 841                 "%s: req %p (%u bytes%s) ep %p(0x%02x)\n", __func__, _req,
 842                 _req->length, _req->zero ? " (zlp)" : "", uep, uep->addr);
 843
 844         req->ep = uep;
 845
 846         if (uep->addr == 0) {
 847                 if (_req->length != udc->ep0_length &&
 848                     udc->ep0_state != ISP1760_CTRL_DATA_IN) {
 849                         dev_dbg(udc->isp->dev,
 850                                 "%s: invalid length %u for req %p\n",
 851                                 __func__, _req->length, req);
 852                         ret = -EINVAL;
 853                         goto done;
 854                 }
 855
 856                 switch (udc->ep0_state) {
 857                 case ISP1760_CTRL_DATA_IN:
 858                         dev_dbg(udc->isp->dev, "%s: transmitting req %p\n",
 859                                 __func__, req);
 860
 861                         list_add_tail(&req->queue, &uep->queue);
 862                         isp1760_udc_transmit(uep, req);
 863                         break;
 864
 865                 case ISP1760_CTRL_DATA_OUT:
 866                         list_add_tail(&req->queue, &uep->queue);
 867                         __isp1760_udc_select_ep(uep, USB_DIR_OUT);
 868                         isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
 869                         break;
 870
 871                 case ISP1760_CTRL_STATUS:
 872                         complete = true;
 873                         break;
 874
 875                 default:
 876                         dev_dbg(udc->isp->dev, "%s: invalid ep0 state\n",
 877                                 __func__);
 878                         ret = -EINVAL;
 879                         break;
 880                 }
 881         } else if (uep->desc) {
 882                 bool empty = list_empty(&uep->queue);
 883
 884                 list_add_tail(&req->queue, &uep->queue);
 885                 if ((uep->addr & USB_DIR_IN) && !uep->halted && empty)
 886                         isp1760_udc_transmit(uep, req);
 887                 else if (!(uep->addr & USB_DIR_IN) && uep->rx_pending)
 888                         complete = isp1760_udc_receive(uep, req);
 889         } else {
 890                 dev_dbg(udc->isp->dev,
 891                         "%s: can't queue request to disabled ep%02x\n",
 892                         __func__, uep->addr);
 893                 ret = -ESHUTDOWN;
 894         }
 895
 896 done:
 897         if (ret < 0)
 898                 req->ep = NULL;
 899
 900         spin_unlock_irqrestore(&udc->lock, flags);
 901
 902         if (complete)
 903                 isp1760_udc_request_complete(uep, req, 0);
 904
 905         return ret;
 906 }
 907
 908 static int isp1760_ep_dequeue(struct usb_ep *ep, struct usb_request *_req)
 909 {
 910         struct isp1760_request *req = req_to_udc_req(_req);
 911         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 912         struct isp1760_udc *udc = uep->udc;
 913         unsigned long flags;
 914
 915         dev_dbg(uep->udc->isp->dev, "%s(ep%02x)\n", __func__, uep->addr);
 916
 917         spin_lock_irqsave(&udc->lock, flags);
 918
 919         if (req->ep != uep)
 920                 req = NULL;
 921         else
 922                 list_del(&req->queue);
 923
 924         spin_unlock_irqrestore(&udc->lock, flags);
 925
 926         if (!req)
 927                 return -EINVAL;
 928
 929         isp1760_udc_request_complete(uep, req, -ECONNRESET);
 930         return 0;
 931 }
 932
 933 static int __isp1760_ep_set_halt(struct isp1760_ep *uep, bool stall, bool wedge)
 934 {
 935         struct isp1760_udc *udc = uep->udc;
 936         int ret;
 937
 938         if (!uep->addr) {
 939                 /*
 940                  * Halting the control endpoint is only valid as a delayed error
 941                  * response to a SETUP packet. Make sure EP0 is in the right
 942                  * stage and that the gadget isn't trying to clear the halt
 943                  * condition.
 944                  */
 945                 if (WARN_ON(udc->ep0_state == ISP1760_CTRL_SETUP || !stall ||
 946                              wedge)) {
 947                         return -EINVAL;
 948                 }
 949         }
 950
 951         if (uep->addr && !uep->desc) {
 952                 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
 953                         uep->addr);
 954                 return -EINVAL;
 955         }
 956
 957         if (uep->addr & USB_DIR_IN) {
 958                 /* Refuse to halt IN endpoints with active transfers. */
 959                 if (!list_empty(&uep->queue)) {
 960                         dev_dbg(udc->isp->dev,
 961                                 "%s: ep%02x has request pending\n", __func__,
 962                                 uep->addr);
 963                         return -EAGAIN;
 964                 }
 965         }
 966
 967         ret = __isp1760_udc_set_halt(uep, stall);
 968         if (ret < 0)
 969                 return ret;
 970
 971         if (!uep->addr) {
 972                 /*
 973                  * Stalling EP0 completes the control transaction, move back to
 974                  * the SETUP state.
 975                  */
 976                 udc->ep0_state = ISP1760_CTRL_SETUP;
 977                 return 0;
 978         }
 979
 980         if (wedge)
 981                 uep->wedged = true;
 982         else if (!stall)
 983                 uep->wedged = false;
 984
 985         return 0;
 986 }
 987
 988 static int isp1760_ep_set_halt(struct usb_ep *ep, int value)
 989 {
 990         struct isp1760_ep *uep = ep_to_udc_ep(ep);
 991         unsigned long flags;
 992         int ret;
 993
 994         dev_dbg(uep->udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
 995                 value ? "set" : "clear", uep->addr);
 996
 997         spin_lock_irqsave(&uep->udc->lock, flags);
 998         ret = __isp1760_ep_set_halt(uep, value, false);
 999         spin_unlock_irqrestore(&uep->udc->lock, flags);
1000
1001         return ret;
1002 }
1003
1004 static int isp1760_ep_set_wedge(struct usb_ep *ep)
1005 {
1006         struct isp1760_ep *uep = ep_to_udc_ep(ep);
1007         unsigned long flags;
1008         int ret;
1009
1010         dev_dbg(uep->udc->isp->dev, "%s: set wedge on ep%02x)\n", __func__,
1011                 uep->addr);
1012
1013         spin_lock_irqsave(&uep->udc->lock, flags);
1014         ret = __isp1760_ep_set_halt(uep, true, true);
1015         spin_unlock_irqrestore(&uep->udc->lock, flags);
1016
1017         return ret;
1018 }
1019
1020 static void isp1760_ep_fifo_flush(struct usb_ep *ep)
1021 {
1022         struct isp1760_ep *uep = ep_to_udc_ep(ep);
1023         struct isp1760_udc *udc = uep->udc;
1024         unsigned long flags;
1025
1026         spin_lock_irqsave(&udc->lock, flags);
1027
1028         isp1760_udc_select_ep(uep);
1029
1030         /*
1031          * Set the CLBUF bit twice to flush both buffers in case double
1032          * buffering is enabled.
1033          */
1034         isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1035         isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1036
1037         spin_unlock_irqrestore(&udc->lock, flags);
1038 }
1039
1040 static const struct usb_ep_ops isp1760_ep_ops = {
1041         .enable = isp1760_ep_enable,
1042         .disable = isp1760_ep_disable,
1043         .alloc_request = isp1760_ep_alloc_request,
1044         .free_request = isp1760_ep_free_request,
1045         .queue = isp1760_ep_queue,
1046         .dequeue = isp1760_ep_dequeue,
1047         .set_halt = isp1760_ep_set_halt,
1048         .set_wedge = isp1760_ep_set_wedge,
1049         .fifo_flush = isp1760_ep_fifo_flush,
1050 };
1051
1052 /* -----------------------------------------------------------------------------
1053  * Device States
1054  */
1055
1056 /* Called with the UDC spinlock held. */
1057 static void isp1760_udc_connect(struct isp1760_udc *udc)
1058 {
1059         usb_gadget_set_state(&udc->gadget, USB_STATE_POWERED);
1060         mod_timer(&udc->vbus_timer, jiffies + ISP1760_VBUS_POLL_INTERVAL);
1061 }
1062
1063 /* Called with the UDC spinlock held. */
1064 static void isp1760_udc_disconnect(struct isp1760_udc *udc)
1065 {
1066         if (udc->gadget.state < USB_STATE_POWERED)
1067                 return;
1068
1069         dev_dbg(udc->isp->dev, "Device disconnected in state %u\n",
1070                  udc->gadget.state);
1071
1072         udc->gadget.speed = USB_SPEED_UNKNOWN;
1073         usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1074
1075         if (udc->driver->disconnect)
1076                 udc->driver->disconnect(&udc->gadget);
1077
1078         del_timer(&udc->vbus_timer);
1079
1080         /* TODO Reset all endpoints ? */
1081 }
1082
1083 static void isp1760_udc_init_hw(struct isp1760_udc *udc)
1084 {
1085         /*
1086          * The device controller currently shares its interrupt with the host
1087          * controller, the DC_IRQ polarity and signaling mode are ignored. Set
1088          * the to active-low level-triggered.
1089          *
1090          * Configure the control, in and out pipes to generate interrupts on
1091          * ACK tokens only (and NYET for the out pipe). The default
1092          * configuration also generates an interrupt on the first NACK token.
1093          */
1094         isp1760_udc_write(udc, DC_INTCONF, DC_CDBGMOD_ACK | DC_DDBGMODIN_ACK |
1095                           DC_DDBGMODOUT_ACK_NYET);
1096
1097         isp1760_udc_write(udc, DC_INTENABLE, DC_IEPRXTX(7) | DC_IEPRXTX(6) |
1098                           DC_IEPRXTX(5) | DC_IEPRXTX(4) | DC_IEPRXTX(3) |
1099                           DC_IEPRXTX(2) | DC_IEPRXTX(1) | DC_IEPRXTX(0) |
1100                           DC_IEP0SETUP | DC_IEVBUS | DC_IERESM | DC_IESUSP |
1101                           DC_IEHS_STA | DC_IEBRST);
1102
1103         if (udc->connected)
1104                 isp1760_set_pullup(udc->isp, true);
1105
1106         isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN);
1107 }
1108
1109 static void isp1760_udc_reset(struct isp1760_udc *udc)
1110 {
1111         unsigned long flags;
1112
1113         spin_lock_irqsave(&udc->lock, flags);
1114
1115         /*
1116          * The bus reset has reset most registers to their default value,
1117          * reinitialize the UDC hardware.
1118          */
1119         isp1760_udc_init_hw(udc);
1120
1121         udc->ep0_state = ISP1760_CTRL_SETUP;
1122         udc->gadget.speed = USB_SPEED_FULL;
1123
1124         usb_gadget_udc_reset(&udc->gadget, udc->driver);
1125
1126         spin_unlock_irqrestore(&udc->lock, flags);
1127 }
1128
1129 static void isp1760_udc_suspend(struct isp1760_udc *udc)
1130 {
1131         if (udc->gadget.state < USB_STATE_DEFAULT)
1132                 return;
1133
1134         if (udc->driver->suspend)
1135                 udc->driver->suspend(&udc->gadget);
1136 }
1137
1138 static void isp1760_udc_resume(struct isp1760_udc *udc)
1139 {
1140         if (udc->gadget.state < USB_STATE_DEFAULT)
1141                 return;
1142
1143         if (udc->driver->resume)
1144                 udc->driver->resume(&udc->gadget);
1145 }
1146
1147 /* -----------------------------------------------------------------------------
1148  * Gadget Operations
1149  */
1150
1151 static int isp1760_udc_get_frame(struct usb_gadget *gadget)
1152 {
1153         struct isp1760_udc *udc = gadget_to_udc(gadget);
1154
1155         return isp1760_udc_read(udc, DC_FRAMENUM) & ((1 << 11) - 1);
1156 }
1157
1158 static int isp1760_udc_wakeup(struct usb_gadget *gadget)
1159 {
1160         struct isp1760_udc *udc = gadget_to_udc(gadget);
1161
1162         dev_dbg(udc->isp->dev, "%s\n", __func__);
1163         return -ENOTSUPP;
1164 }
1165
1166 static int isp1760_udc_set_selfpowered(struct usb_gadget *gadget,
1167                                        int is_selfpowered)
1168 {
1169         struct isp1760_udc *udc = gadget_to_udc(gadget);
1170
1171         if (is_selfpowered)
1172                 udc->devstatus |= 1 << USB_DEVICE_SELF_POWERED;
1173         else
1174                 udc->devstatus &= ~(1 << USB_DEVICE_SELF_POWERED);
1175
1176         return 0;
1177 }
1178
1179 static int isp1760_udc_pullup(struct usb_gadget *gadget, int is_on)
1180 {
1181         struct isp1760_udc *udc = gadget_to_udc(gadget);
1182
1183         isp1760_set_pullup(udc->isp, is_on);
1184         udc->connected = is_on;
1185
1186         return 0;
1187 }
1188
1189 static int isp1760_udc_start(struct usb_gadget *gadget,
1190                              struct usb_gadget_driver *driver)
1191 {
1192         struct isp1760_udc *udc = gadget_to_udc(gadget);
1193         unsigned long flags;
1194
1195         /* The hardware doesn't support low speed. */
1196         if (driver->max_speed < USB_SPEED_FULL) {
1197                 dev_err(udc->isp->dev, "Invalid gadget driver\n");
1198                 return -EINVAL;
1199         }
1200
1201         spin_lock_irqsave(&udc->lock, flags);
1202
1203         if (udc->driver) {
1204                 dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
1205                 spin_unlock_irqrestore(&udc->lock, flags);
1206                 return -EBUSY;
1207         }
1208
1209         udc->driver = driver;
1210
1211         spin_unlock_irqrestore(&udc->lock, flags);
1212
1213         dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
1214                 driver->function);
1215
1216         udc->devstatus = 0;
1217         udc->connected = true;
1218
1219         usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1220
1221         /* DMA isn't supported yet, don't enable the DMA clock. */
1222         isp1760_udc_write(udc, DC_MODE, DC_GLINTENA);
1223
1224         isp1760_udc_init_hw(udc);
1225
1226         dev_dbg(udc->isp->dev, "UDC started with driver %s\n",
1227                 driver->function);
1228
1229         return 0;
1230 }
1231
1232 static int isp1760_udc_stop(struct usb_gadget *gadget)
1233 {
1234         struct isp1760_udc *udc = gadget_to_udc(gadget);
1235         unsigned long flags;
1236
1237         dev_dbg(udc->isp->dev, "%s\n", __func__);
1238
1239         del_timer_sync(&udc->vbus_timer);
1240
1241         isp1760_udc_write(udc, DC_MODE, 0);
1242
1243         spin_lock_irqsave(&udc->lock, flags);
1244         udc->driver = NULL;
1245         spin_unlock_irqrestore(&udc->lock, flags);
1246
1247         return 0;
1248 }
1249
1250 static const struct usb_gadget_ops isp1760_udc_ops = {
1251         .get_frame = isp1760_udc_get_frame,
1252         .wakeup = isp1760_udc_wakeup,
1253         .set_selfpowered = isp1760_udc_set_selfpowered,
1254         .pullup = isp1760_udc_pullup,
1255         .udc_start = isp1760_udc_start,
1256         .udc_stop = isp1760_udc_stop,
1257 };
1258
1259 /* -----------------------------------------------------------------------------
1260  * Interrupt Handling
1261  */
1262
1263 static irqreturn_t isp1760_udc_irq(int irq, void *dev)
1264 {
1265         struct isp1760_udc *udc = dev;
1266         unsigned int i;
1267         u32 status;
1268
1269         status = isp1760_udc_read(udc, DC_INTERRUPT)
1270                & isp1760_udc_read(udc, DC_INTENABLE);
1271         isp1760_udc_write(udc, DC_INTERRUPT, status);
1272
1273         if (status & DC_IEVBUS) {
1274                 dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
1275                 /* The VBUS interrupt is only triggered when VBUS appears. */
1276                 spin_lock(&udc->lock);
1277                 isp1760_udc_connect(udc);
1278                 spin_unlock(&udc->lock);
1279         }
1280
1281         if (status & DC_IEBRST) {
1282                 dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
1283
1284                 isp1760_udc_reset(udc);
1285         }
1286
1287         for (i = 0; i <= 7; ++i) {
1288                 struct isp1760_ep *ep = &udc->ep[i*2];
1289
1290                 if (status & DC_IEPTX(i)) {
1291                         dev_dbg(udc->isp->dev, "%s(EPTX%u)\n", __func__, i);
1292                         isp1760_ep_tx_complete(ep);
1293                 }
1294
1295                 if (status & DC_IEPRX(i)) {
1296                         dev_dbg(udc->isp->dev, "%s(EPRX%u)\n", __func__, i);
1297                         isp1760_ep_rx_ready(i ? ep - 1 : ep);
1298                 }
1299         }
1300
1301         if (status & DC_IEP0SETUP) {
1302                 dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
1303
1304                 isp1760_ep0_setup(udc);
1305         }
1306
1307         if (status & DC_IERESM) {
1308                 dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
1309                 isp1760_udc_resume(udc);
1310         }
1311
1312         if (status & DC_IESUSP) {
1313                 dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
1314
1315                 spin_lock(&udc->lock);
1316                 if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1317                         isp1760_udc_disconnect(udc);
1318                 else
1319                         isp1760_udc_suspend(udc);
1320                 spin_unlock(&udc->lock);
1321         }
1322
1323         if (status & DC_IEHS_STA) {
1324                 dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
1325                 udc->gadget.speed = USB_SPEED_HIGH;
1326         }
1327
1328         return status ? IRQ_HANDLED : IRQ_NONE;
1329 }
1330
1331 static void isp1760_udc_vbus_poll(struct timer_list *t)
1332 {
1333         struct isp1760_udc *udc = from_timer(udc, t, vbus_timer);
1334         unsigned long flags;
1335
1336         spin_lock_irqsave(&udc->lock, flags);
1337
1338         if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1339                 isp1760_udc_disconnect(udc);
1340         else if (udc->gadget.state >= USB_STATE_POWERED)
1341                 mod_timer(&udc->vbus_timer,
1342                           jiffies + ISP1760_VBUS_POLL_INTERVAL);
1343
1344         spin_unlock_irqrestore(&udc->lock, flags);
1345 }
1346
1347 /* -----------------------------------------------------------------------------
1348  * Registration
1349  */
1350
1351 static void isp1760_udc_init_eps(struct isp1760_udc *udc)
1352 {
1353         unsigned int i;
1354
1355         INIT_LIST_HEAD(&udc->gadget.ep_list);
1356
1357         for (i = 0; i < ARRAY_SIZE(udc->ep); ++i) {
1358                 struct isp1760_ep *ep = &udc->ep[i];
1359                 unsigned int ep_num = (i + 1) / 2;
1360                 bool is_in = !(i & 1);
1361
1362                 ep->udc = udc;
1363
1364                 INIT_LIST_HEAD(&ep->queue);
1365
1366                 ep->addr = (ep_num && is_in ? USB_DIR_IN : USB_DIR_OUT)
1367                          | ep_num;
1368                 ep->desc = NULL;
1369
1370                 sprintf(ep->name, "ep%u%s", ep_num,
1371                         ep_num ? (is_in ? "in" : "out") : "");
1372
1373                 ep->ep.ops = &isp1760_ep_ops;
1374                 ep->ep.name = ep->name;
1375
1376                 /*
1377                  * Hardcode the maximum packet sizes for now, to 64 bytes for
1378                  * the control endpoint and 512 bytes for all other endpoints.
1379                  * This fits in the 8kB FIFO without double-buffering.
1380                  */
1381                 if (ep_num == 0) {
1382                         usb_ep_set_maxpacket_limit(&ep->ep, 64);
1383                         ep->ep.caps.type_control = true;
1384                         ep->ep.caps.dir_in = true;
1385                         ep->ep.caps.dir_out = true;
1386                         ep->maxpacket = 64;
1387                         udc->gadget.ep0 = &ep->ep;
1388                 } else {
1389                         usb_ep_set_maxpacket_limit(&ep->ep, 512);
1390                         ep->ep.caps.type_iso = true;
1391                         ep->ep.caps.type_bulk = true;
1392                         ep->ep.caps.type_int = true;
1393                         ep->maxpacket = 0;
1394                         list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
1395                 }
1396
1397                 if (is_in)
1398                         ep->ep.caps.dir_in = true;
1399                 else
1400                         ep->ep.caps.dir_out = true;
1401         }
1402 }
1403
1404 static int isp1760_udc_init(struct isp1760_udc *udc)
1405 {
1406         u16 scratch;
1407         u32 chipid;
1408
1409         /*
1410          * Check that the controller is present by writing to the scratch
1411          * register, modifying the bus pattern by reading from the chip ID
1412          * register, and reading the scratch register value back. The chip ID
1413          * and scratch register contents must match the expected values.
1414          */
1415         isp1760_udc_write(udc, DC_SCRATCH, 0xbabe);
1416         chipid = isp1760_udc_read(udc, DC_CHIPID);
1417         scratch = isp1760_udc_read(udc, DC_SCRATCH);
1418
1419         if (scratch != 0xbabe) {
1420                 dev_err(udc->isp->dev,
1421                         "udc: scratch test failed (0x%04x/0x%08x)\n",
1422                         scratch, chipid);
1423                 return -ENODEV;
1424         }
1425
1426         if (chipid != 0x00011582 && chipid != 0x00158210) {
1427                 dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
1428                 return -ENODEV;
1429         }
1430
1431         /* Reset the device controller. */
1432         isp1760_udc_write(udc, DC_MODE, DC_SFRESET);
1433         usleep_range(10000, 11000);
1434         isp1760_udc_write(udc, DC_MODE, 0);
1435         usleep_range(10000, 11000);
1436
1437         return 0;
1438 }
1439
1440 int isp1760_udc_register(struct isp1760_device *isp, int irq,
1441                          unsigned long irqflags)
1442 {
1443         struct isp1760_udc *udc = &isp->udc;
1444         const char *devname;
1445         int ret;
1446
1447         udc->irq = -1;
1448         udc->isp = isp;
1449         udc->regs = isp->regs;
1450
1451         spin_lock_init(&udc->lock);
1452         timer_setup(&udc->vbus_timer, isp1760_udc_vbus_poll, 0);
1453
1454         ret = isp1760_udc_init(udc);
1455         if (ret < 0)
1456                 return ret;
1457
1458         devname = dev_name(isp->dev);
1459         udc->irqname = kmalloc(strlen(devname) + 7, GFP_KERNEL);
1460         if (!udc->irqname)
1461                 return -ENOMEM;
1462
1463         sprintf(udc->irqname, "%s (udc)", devname);
1464
1465         ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
1466                           udc->irqname, udc);
1467         if (ret < 0)
1468                 goto error;
1469
1470         udc->irq = irq;
1471
1472         /*
1473          * Initialize the gadget static fields and register its device. Gadget
1474          * fields that vary during the life time of the gadget are initialized
1475          * by the UDC core.
1476          */
1477         udc->gadget.ops = &isp1760_udc_ops;
1478         udc->gadget.speed = USB_SPEED_UNKNOWN;
1479         udc->gadget.max_speed = USB_SPEED_HIGH;
1480         udc->gadget.name = "isp1761_udc";
1481
1482         isp1760_udc_init_eps(udc);
1483
1484         ret = usb_add_gadget_udc(isp->dev, &udc->gadget);
1485         if (ret < 0)
1486                 goto error;
1487
1488         return 0;
1489
1490 error:
1491         if (udc->irq >= 0)
1492                 free_irq(udc->irq, udc);
1493         kfree(udc->irqname);
1494
1495         return ret;
1496 }
1497
1498 void isp1760_udc_unregister(struct isp1760_device *isp)
1499 {
1500         struct isp1760_udc *udc = &isp->udc;
1501
1502         if (!udc->isp)
1503                 return;
1504
1505         usb_del_gadget_udc(&udc->gadget);
1506
1507         free_irq(udc->irq, udc);
1508         kfree(udc->irqname);
1509 }