linux/drivers/usb/isp1760/isp1760-udc.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * Driver for the NXP ISP1761 device controller
   4 *
   5 * Copyright 2021 Linaro, Rui Miguel Silva
   6 * Copyright 2014 Ideas on Board Oy
   7 *
   8 * Contacts:
   9 *      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  10 *      Rui Miguel Silva <rui.silva@linaro.org>
  11 */
  12
  13#include <linux/interrupt.h>
  14#include <linux/io.h>
  15#include <linux/kernel.h>
  16#include <linux/list.h>
  17#include <linux/module.h>
  18#include <linux/slab.h>
  19#include <linux/timer.h>
  20#include <linux/usb.h>
  21
  22#include "isp1760-core.h"
  23#include "isp1760-regs.h"
  24#include "isp1760-udc.h"
  25
  26#define ISP1760_VBUS_POLL_INTERVAL      msecs_to_jiffies(500)
  27
  28struct isp1760_request {
  29        struct usb_request req;
  30        struct list_head queue;
  31        struct isp1760_ep *ep;
  32        unsigned int packet_size;
  33};
  34
  35static inline struct isp1760_udc *gadget_to_udc(struct usb_gadget *gadget)
  36{
  37        return container_of(gadget, struct isp1760_udc, gadget);
  38}
  39
  40static inline struct isp1760_ep *ep_to_udc_ep(struct usb_ep *ep)
  41{
  42        return container_of(ep, struct isp1760_ep, ep);
  43}
  44
  45static inline struct isp1760_request *req_to_udc_req(struct usb_request *req)
  46{
  47        return container_of(req, struct isp1760_request, req);
  48}
  49
  50static u32 isp1760_udc_read(struct isp1760_udc *udc, u16 field)
  51{
  52        return isp1760_field_read(udc->fields, field);
  53}
  54
  55static void isp1760_udc_write(struct isp1760_udc *udc, u16 field, u32 val)
  56{
  57        isp1760_field_write(udc->fields, field, val);
  58}
  59
  60static u32 isp1760_udc_read_raw(struct isp1760_udc *udc, u16 reg)
  61{
  62        __le32 val;
  63
  64        regmap_raw_read(udc->regs, reg, &val, 4);
  65
  66        return le32_to_cpu(val);
  67}
  68
  69static u16 isp1760_udc_read_raw16(struct isp1760_udc *udc, u16 reg)
  70{
  71        __le16 val;
  72
  73        regmap_raw_read(udc->regs, reg, &val, 2);
  74
  75        return le16_to_cpu(val);
  76}
  77
  78static void isp1760_udc_write_raw(struct isp1760_udc *udc, u16 reg, u32 val)
  79{
  80        __le32 val_le = cpu_to_le32(val);
  81
  82        regmap_raw_write(udc->regs, reg, &val_le, 4);
  83}
  84
  85static void isp1760_udc_write_raw16(struct isp1760_udc *udc, u16 reg, u16 val)
  86{
  87        __le16 val_le = cpu_to_le16(val);
  88
  89        regmap_raw_write(udc->regs, reg, &val_le, 2);
  90}
  91
  92static void isp1760_udc_set(struct isp1760_udc *udc, u32 field)
  93{
  94        isp1760_udc_write(udc, field, 0xFFFFFFFF);
  95}
  96
  97static void isp1760_udc_clear(struct isp1760_udc *udc, u32 field)
  98{
  99        isp1760_udc_write(udc, field, 0);
 100}
 101
 102static bool isp1760_udc_is_set(struct isp1760_udc *udc, u32 field)
 103{
 104        return !!isp1760_udc_read(udc, field);
 105}
 106/* -----------------------------------------------------------------------------
 107 * Endpoint Management
 108 */
 109
 110static struct isp1760_ep *isp1760_udc_find_ep(struct isp1760_udc *udc,
 111                                              u16 index)
 112{
 113        unsigned int i;
 114
 115        if (index == 0)
 116                return &udc->ep[0];
 117
 118        for (i = 1; i < ARRAY_SIZE(udc->ep); ++i) {
 119                if (udc->ep[i].addr == index)
 120                        return udc->ep[i].desc ? &udc->ep[i] : NULL;
 121        }
 122
 123        return NULL;
 124}
 125
 126static void __isp1760_udc_select_ep(struct isp1760_udc *udc,
 127                                    struct isp1760_ep *ep, int dir)
 128{
 129        isp1760_udc_write(udc, DC_ENDPIDX, ep->addr & USB_ENDPOINT_NUMBER_MASK);
 130
 131        if (dir == USB_DIR_IN)
 132                isp1760_udc_set(udc, DC_EPDIR);
 133        else
 134                isp1760_udc_clear(udc, DC_EPDIR);
 135}
 136
 137/**
 138 * isp1760_udc_select_ep - Select an endpoint for register access
 139 * @ep: The endpoint
 140 * @udc: Reference to the device controller
 141 *
 142 * The ISP1761 endpoint registers are banked. This function selects the target
 143 * endpoint for banked register access. The selection remains valid until the
 144 * next call to this function, the next direct access to the EPINDEX register
 145 * or the next reset, whichever comes first.
 146 *
 147 * Called with the UDC spinlock held.
 148 */
 149static void isp1760_udc_select_ep(struct isp1760_udc *udc,
 150                                  struct isp1760_ep *ep)
 151{
 152        __isp1760_udc_select_ep(udc, ep, ep->addr & USB_ENDPOINT_DIR_MASK);
 153}
 154
 155/* Called with the UDC spinlock held. */
 156static void isp1760_udc_ctrl_send_status(struct isp1760_ep *ep, int dir)
 157{
 158        struct isp1760_udc *udc = ep->udc;
 159
 160        /*
 161         * Proceed to the status stage. The status stage data packet flows in
 162         * the direction opposite to the data stage data packets, we thus need
 163         * to select the OUT/IN endpoint for IN/OUT transfers.
 164         */
 165        if (dir == USB_DIR_IN)
 166                isp1760_udc_clear(udc, DC_EPDIR);
 167        else
 168                isp1760_udc_set(udc, DC_EPDIR);
 169
 170        isp1760_udc_write(udc, DC_ENDPIDX, 1);
 171        isp1760_udc_set(udc, DC_STATUS);
 172
 173        /*
 174         * The hardware will terminate the request automatically and go back to
 175         * the setup stage without notifying us.
 176         */
 177        udc->ep0_state = ISP1760_CTRL_SETUP;
 178}
 179
 180/* Called without the UDC spinlock held. */
 181static void isp1760_udc_request_complete(struct isp1760_ep *ep,
 182                                         struct isp1760_request *req,
 183                                         int status)
 184{
 185        struct isp1760_udc *udc = ep->udc;
 186        unsigned long flags;
 187
 188        dev_dbg(ep->udc->isp->dev, "completing request %p with status %d\n",
 189                req, status);
 190
 191        req->ep = NULL;
 192        req->req.status = status;
 193        req->req.complete(&ep->ep, &req->req);
 194
 195        spin_lock_irqsave(&udc->lock, flags);
 196
 197        /*
 198         * When completing control OUT requests, move to the status stage after
 199         * calling the request complete callback. This gives the gadget an
 200         * opportunity to stall the control transfer if needed.
 201         */
 202        if (status == 0 && ep->addr == 0 && udc->ep0_dir == USB_DIR_OUT)
 203                isp1760_udc_ctrl_send_status(ep, USB_DIR_OUT);
 204
 205        spin_unlock_irqrestore(&udc->lock, flags);
 206}
 207
 208static void isp1760_udc_ctrl_send_stall(struct isp1760_ep *ep)
 209{
 210        struct isp1760_udc *udc = ep->udc;
 211        unsigned long flags;
 212
 213        dev_dbg(ep->udc->isp->dev, "%s(ep%02x)\n", __func__, ep->addr);
 214
 215        spin_lock_irqsave(&udc->lock, flags);
 216
 217        /* Stall both the IN and OUT endpoints. */
 218        __isp1760_udc_select_ep(udc, ep, USB_DIR_OUT);
 219        isp1760_udc_set(udc, DC_STALL);
 220        __isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
 221        isp1760_udc_set(udc, DC_STALL);
 222
 223        /* A protocol stall completes the control transaction. */
 224        udc->ep0_state = ISP1760_CTRL_SETUP;
 225
 226        spin_unlock_irqrestore(&udc->lock, flags);
 227}
 228
 229/* -----------------------------------------------------------------------------
 230 * Data Endpoints
 231 */
 232
 233/* Called with the UDC spinlock held. */
 234static bool isp1760_udc_receive(struct isp1760_ep *ep,
 235                                struct isp1760_request *req)
 236{
 237        struct isp1760_udc *udc = ep->udc;
 238        unsigned int len;
 239        u32 *buf;
 240        int i;
 241
 242        isp1760_udc_select_ep(udc, ep);
 243        len = isp1760_udc_read(udc, DC_BUFLEN);
 244
 245        dev_dbg(udc->isp->dev, "%s: received %u bytes (%u/%u done)\n",
 246                __func__, len, req->req.actual, req->req.length);
 247
 248        len = min(len, req->req.length - req->req.actual);
 249
 250        if (!len) {
 251                /*
 252                 * There's no data to be read from the FIFO, acknowledge the RX
 253                 * interrupt by clearing the buffer.
 254                 *
 255                 * TODO: What if another packet arrives in the meantime ? The
 256                 * datasheet doesn't clearly document how this should be
 257                 * handled.
 258                 */
 259                isp1760_udc_set(udc, DC_CLBUF);
 260                return false;
 261        }
 262
 263        buf = req->req.buf + req->req.actual;
 264
 265        /*
 266         * Make sure not to read more than one extra byte, otherwise data from
 267         * the next packet might be removed from the FIFO.
 268         */
 269        for (i = len; i > 2; i -= 4, ++buf)
 270                *buf = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
 271        if (i > 0)
 272                *(u16 *)buf = isp1760_udc_read_raw16(udc, ISP176x_DC_DATAPORT);
 273
 274        req->req.actual += len;
 275
 276        /*
 277         * TODO: The short_not_ok flag isn't supported yet, but isn't used by
 278         * any gadget driver either.
 279         */
 280
 281        dev_dbg(udc->isp->dev,
 282                "%s: req %p actual/length %u/%u maxpacket %u packet size %u\n",
 283                __func__, req, req->req.actual, req->req.length, ep->maxpacket,
 284                len);
 285
 286        ep->rx_pending = false;
 287
 288        /*
 289         * Complete the request if all data has been received or if a short
 290         * packet has been received.
 291         */
 292        if (req->req.actual == req->req.length || len < ep->maxpacket) {
 293                list_del(&req->queue);
 294                return true;
 295        }
 296
 297        return false;
 298}
 299
 300static void isp1760_udc_transmit(struct isp1760_ep *ep,
 301                                 struct isp1760_request *req)
 302{
 303        struct isp1760_udc *udc = ep->udc;
 304        u32 *buf = req->req.buf + req->req.actual;
 305        int i;
 306
 307        req->packet_size = min(req->req.length - req->req.actual,
 308                               ep->maxpacket);
 309
 310        dev_dbg(udc->isp->dev, "%s: transferring %u bytes (%u/%u done)\n",
 311                __func__, req->packet_size, req->req.actual,
 312                req->req.length);
 313
 314        __isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
 315
 316        if (req->packet_size)
 317                isp1760_udc_write(udc, DC_BUFLEN, req->packet_size);
 318
 319        /*
 320         * Make sure not to write more than one extra byte, otherwise extra data
 321         * will stay in the FIFO and will be transmitted during the next control
 322         * request. The endpoint control CLBUF bit is supposed to allow flushing
 323         * the FIFO for this kind of conditions, but doesn't seem to work.
 324         */
 325        for (i = req->packet_size; i > 2; i -= 4, ++buf)
 326                isp1760_udc_write_raw(udc, ISP176x_DC_DATAPORT, *buf);
 327        if (i > 0)
 328                isp1760_udc_write_raw16(udc, ISP176x_DC_DATAPORT, *(u16 *)buf);
 329
 330        if (ep->addr == 0)
 331                isp1760_udc_set(udc, DC_DSEN);
 332        if (!req->packet_size)
 333                isp1760_udc_set(udc, DC_VENDP);
 334}
 335
 336static void isp1760_ep_rx_ready(struct isp1760_ep *ep)
 337{
 338        struct isp1760_udc *udc = ep->udc;
 339        struct isp1760_request *req;
 340        bool complete;
 341
 342        spin_lock(&udc->lock);
 343
 344        if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_OUT) {
 345                spin_unlock(&udc->lock);
 346                dev_dbg(udc->isp->dev, "%s: invalid ep0 state %u\n", __func__,
 347                        udc->ep0_state);
 348                return;
 349        }
 350
 351        if (ep->addr != 0 && !ep->desc) {
 352                spin_unlock(&udc->lock);
 353                dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
 354                        ep->addr);
 355                return;
 356        }
 357
 358        if (list_empty(&ep->queue)) {
 359                ep->rx_pending = true;
 360                spin_unlock(&udc->lock);
 361                dev_dbg(udc->isp->dev, "%s: ep%02x (%p) has no request queued\n",
 362                        __func__, ep->addr, ep);
 363                return;
 364        }
 365
 366        req = list_first_entry(&ep->queue, struct isp1760_request,
 367                               queue);
 368        complete = isp1760_udc_receive(ep, req);
 369
 370        spin_unlock(&udc->lock);
 371
 372        if (complete)
 373                isp1760_udc_request_complete(ep, req, 0);
 374}
 375
 376static void isp1760_ep_tx_complete(struct isp1760_ep *ep)
 377{
 378        struct isp1760_udc *udc = ep->udc;
 379        struct isp1760_request *complete = NULL;
 380        struct isp1760_request *req;
 381        bool need_zlp;
 382
 383        spin_lock(&udc->lock);
 384
 385        if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_IN) {
 386                spin_unlock(&udc->lock);
 387                dev_dbg(udc->isp->dev, "TX IRQ: invalid endpoint state %u\n",
 388                        udc->ep0_state);
 389                return;
 390        }
 391
 392        if (list_empty(&ep->queue)) {
 393                /*
 394                 * This can happen for the control endpoint when the reply to
 395                 * the GET_STATUS IN control request is sent directly by the
 396                 * setup IRQ handler. Just proceed to the status stage.
 397                 */
 398                if (ep->addr == 0) {
 399                        isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
 400                        spin_unlock(&udc->lock);
 401                        return;
 402                }
 403
 404                spin_unlock(&udc->lock);
 405                dev_dbg(udc->isp->dev, "%s: ep%02x has no request queued\n",
 406                        __func__, ep->addr);
 407                return;
 408        }
 409
 410        req = list_first_entry(&ep->queue, struct isp1760_request,
 411                               queue);
 412        req->req.actual += req->packet_size;
 413
 414        need_zlp = req->req.actual == req->req.length &&
 415                   !(req->req.length % ep->maxpacket) &&
 416                   req->packet_size && req->req.zero;
 417
 418        dev_dbg(udc->isp->dev,
 419                "TX IRQ: req %p actual/length %u/%u maxpacket %u packet size %u zero %u need zlp %u\n",
 420                 req, req->req.actual, req->req.length, ep->maxpacket,
 421                 req->packet_size, req->req.zero, need_zlp);
 422
 423        /*
 424         * Complete the request if all data has been sent and we don't need to
 425         * transmit a zero length packet.
 426         */
 427        if (req->req.actual == req->req.length && !need_zlp) {
 428                complete = req;
 429                list_del(&req->queue);
 430
 431                if (ep->addr == 0)
 432                        isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
 433
 434                if (!list_empty(&ep->queue))
 435                        req = list_first_entry(&ep->queue,
 436                                               struct isp1760_request, queue);
 437                else
 438                        req = NULL;
 439        }
 440
 441        /*
 442         * Transmit the next packet or start the next request, if any.
 443         *
 444         * TODO: If the endpoint is stalled the next request shouldn't be
 445         * started, but what about the next packet ?
 446         */
 447        if (req)
 448                isp1760_udc_transmit(ep, req);
 449
 450        spin_unlock(&udc->lock);
 451
 452        if (complete)
 453                isp1760_udc_request_complete(ep, complete, 0);
 454}
 455
 456static int __isp1760_udc_set_halt(struct isp1760_ep *ep, bool halt)
 457{
 458        struct isp1760_udc *udc = ep->udc;
 459
 460        dev_dbg(udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
 461                halt ? "set" : "clear", ep->addr);
 462
 463        if (ep->desc && usb_endpoint_xfer_isoc(ep->desc)) {
 464                dev_dbg(udc->isp->dev, "%s: ep%02x is isochronous\n", __func__,
 465                        ep->addr);
 466                return -EINVAL;
 467        }
 468
 469        isp1760_udc_select_ep(udc, ep);
 470
 471        if (halt)
 472                isp1760_udc_set(udc, DC_STALL);
 473        else
 474                isp1760_udc_clear(udc, DC_STALL);
 475
 476        if (ep->addr == 0) {
 477                /* When halting the control endpoint, stall both IN and OUT. */
 478                __isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
 479                if (halt)
 480                        isp1760_udc_set(udc, DC_STALL);
 481                else
 482                        isp1760_udc_clear(udc, DC_STALL);
 483        } else if (!halt) {
 484                /* Reset the data PID by cycling the endpoint enable bit. */
 485                isp1760_udc_clear(udc, DC_EPENABLE);
 486                isp1760_udc_set(udc, DC_EPENABLE);
 487
 488                /*
 489                 * Disabling the endpoint emptied the transmit FIFO, fill it
 490                 * again if a request is pending.
 491                 *
 492                 * TODO: Does the gadget framework require synchronizatino with
 493                 * the TX IRQ handler ?
 494                 */
 495                if ((ep->addr & USB_DIR_IN) && !list_empty(&ep->queue)) {
 496                        struct isp1760_request *req;
 497
 498                        req = list_first_entry(&ep->queue,
 499                                               struct isp1760_request, queue);
 500                        isp1760_udc_transmit(ep, req);
 501                }
 502        }
 503
 504        ep->halted = halt;
 505
 506        return 0;
 507}
 508
 509/* -----------------------------------------------------------------------------
 510 * Control Endpoint
 511 */
 512
 513static int isp1760_udc_get_status(struct isp1760_udc *udc,
 514                                  const struct usb_ctrlrequest *req)
 515{
 516        struct isp1760_ep *ep;
 517        u16 status;
 518
 519        if (req->wLength != cpu_to_le16(2) || req->wValue != cpu_to_le16(0))
 520                return -EINVAL;
 521
 522        switch (req->bRequestType) {
 523        case USB_DIR_IN | USB_RECIP_DEVICE:
 524                status = udc->devstatus;
 525                break;
 526
 527        case USB_DIR_IN | USB_RECIP_INTERFACE:
 528                status = 0;
 529                break;
 530
 531        case USB_DIR_IN | USB_RECIP_ENDPOINT:
 532                ep = isp1760_udc_find_ep(udc, le16_to_cpu(req->wIndex));
 533                if (!ep)
 534                        return -EINVAL;
 535
 536                status = 0;
 537                if (ep->halted)
 538                        status |= 1 << USB_ENDPOINT_HALT;
 539                break;
 540
 541        default:
 542                return -EINVAL;
 543        }
 544
 545        isp1760_udc_set(udc, DC_EPDIR);
 546        isp1760_udc_write(udc, DC_ENDPIDX, 1);
 547
 548        isp1760_udc_write(udc, DC_BUFLEN, 2);
 549
 550        isp1760_udc_write_raw16(udc, ISP176x_DC_DATAPORT, status);
 551
 552        isp1760_udc_set(udc, DC_DSEN);
 553
 554        dev_dbg(udc->isp->dev, "%s: status 0x%04x\n", __func__, status);
 555
 556        return 0;
 557}
 558
 559static int isp1760_udc_set_address(struct isp1760_udc *udc, u16 addr)
 560{
 561        if (addr > 127) {
 562                dev_dbg(udc->isp->dev, "invalid device address %u\n", addr);
 563                return -EINVAL;
 564        }
 565
 566        if (udc->gadget.state != USB_STATE_DEFAULT &&
 567            udc->gadget.state != USB_STATE_ADDRESS) {
 568                dev_dbg(udc->isp->dev, "can't set address in state %u\n",
 569                        udc->gadget.state);
 570                return -EINVAL;
 571        }
 572
 573        usb_gadget_set_state(&udc->gadget, addr ? USB_STATE_ADDRESS :
 574                             USB_STATE_DEFAULT);
 575
 576        isp1760_udc_write(udc, DC_DEVADDR, addr);
 577        isp1760_udc_set(udc, DC_DEVEN);
 578
 579        spin_lock(&udc->lock);
 580        isp1760_udc_ctrl_send_status(&udc->ep[0], USB_DIR_OUT);
 581        spin_unlock(&udc->lock);
 582
 583        return 0;
 584}
 585
 586static bool isp1760_ep0_setup_standard(struct isp1760_udc *udc,
 587                                       struct usb_ctrlrequest *req)
 588{
 589        bool stall;
 590
 591        switch (req->bRequest) {
 592        case USB_REQ_GET_STATUS:
 593                return isp1760_udc_get_status(udc, req);
 594
 595        case USB_REQ_CLEAR_FEATURE:
 596                switch (req->bRequestType) {
 597                case USB_DIR_OUT | USB_RECIP_DEVICE: {
 598                        /* TODO: Handle remote wakeup feature. */
 599                        return true;
 600                }
 601
 602                case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
 603                        u16 index = le16_to_cpu(req->wIndex);
 604                        struct isp1760_ep *ep;
 605
 606                        if (req->wLength != cpu_to_le16(0) ||
 607                            req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
 608                                return true;
 609
 610                        ep = isp1760_udc_find_ep(udc, index);
 611                        if (!ep)
 612                                return true;
 613
 614                        spin_lock(&udc->lock);
 615
 616                        /*
 617                         * If the endpoint is wedged only the gadget can clear
 618                         * the halt feature. Pretend success in that case, but
 619                         * keep the endpoint halted.
 620                         */
 621                        if (!ep->wedged)
 622                                stall = __isp1760_udc_set_halt(ep, false);
 623                        else
 624                                stall = false;
 625
 626                        if (!stall)
 627                                isp1760_udc_ctrl_send_status(&udc->ep[0],
 628                                                             USB_DIR_OUT);
 629
 630                        spin_unlock(&udc->lock);
 631                        return stall;
 632                }
 633
 634                default:
 635                        return true;
 636                }
 637                break;
 638
 639        case USB_REQ_SET_FEATURE:
 640                switch (req->bRequestType) {
 641                case USB_DIR_OUT | USB_RECIP_DEVICE: {
 642                        /* TODO: Handle remote wakeup and test mode features */
 643                        return true;
 644                }
 645
 646                case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
 647                        u16 index = le16_to_cpu(req->wIndex);
 648                        struct isp1760_ep *ep;
 649
 650                        if (req->wLength != cpu_to_le16(0) ||
 651                            req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
 652                                return true;
 653
 654                        ep = isp1760_udc_find_ep(udc, index);
 655                        if (!ep)
 656                                return true;
 657
 658                        spin_lock(&udc->lock);
 659
 660                        stall = __isp1760_udc_set_halt(ep, true);
 661                        if (!stall)
 662                                isp1760_udc_ctrl_send_status(&udc->ep[0],
 663                                                             USB_DIR_OUT);
 664
 665                        spin_unlock(&udc->lock);
 666                        return stall;
 667                }
 668
 669                default:
 670                        return true;
 671                }
 672                break;
 673
 674        case USB_REQ_SET_ADDRESS:
 675                if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
 676                        return true;
 677
 678                return isp1760_udc_set_address(udc, le16_to_cpu(req->wValue));
 679
 680        case USB_REQ_SET_CONFIGURATION:
 681                if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
 682                        return true;
 683
 684                if (udc->gadget.state != USB_STATE_ADDRESS &&
 685                    udc->gadget.state != USB_STATE_CONFIGURED)
 686                        return true;
 687
 688                stall = udc->driver->setup(&udc->gadget, req) < 0;
 689                if (stall)
 690                        return true;
 691
 692                usb_gadget_set_state(&udc->gadget, req->wValue ?
 693                                     USB_STATE_CONFIGURED : USB_STATE_ADDRESS);
 694
 695                /*
 696                 * SET_CONFIGURATION (and SET_INTERFACE) must reset the halt
 697                 * feature on all endpoints. There is however no need to do so
 698                 * explicitly here as the gadget driver will disable and
 699                 * reenable endpoints, clearing the halt feature.
 700                 */
 701                return false;
 702
 703        default:
 704                return udc->driver->setup(&udc->gadget, req) < 0;
 705        }
 706}
 707
 708static void isp1760_ep0_setup(struct isp1760_udc *udc)
 709{
 710        union {
 711                struct usb_ctrlrequest r;
 712                u32 data[2];
 713        } req;
 714        unsigned int count;
 715        bool stall = false;
 716
 717        spin_lock(&udc->lock);
 718
 719        isp1760_udc_set(udc, DC_EP0SETUP);
 720
 721        count = isp1760_udc_read(udc, DC_BUFLEN);
 722        if (count != sizeof(req)) {
 723                spin_unlock(&udc->lock);
 724
 725                dev_err(udc->isp->dev, "invalid length %u for setup packet\n",
 726                        count);
 727
 728                isp1760_udc_ctrl_send_stall(&udc->ep[0]);
 729                return;
 730        }
 731
 732        req.data[0] = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
 733        req.data[1] = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
 734
 735        if (udc->ep0_state != ISP1760_CTRL_SETUP) {
 736                spin_unlock(&udc->lock);
 737                dev_dbg(udc->isp->dev, "unexpected SETUP packet\n");
 738                return;
 739        }
 740
 741        /* Move to the data stage. */
 742        if (!req.r.wLength)
 743                udc->ep0_state = ISP1760_CTRL_STATUS;
 744        else if (req.r.bRequestType & USB_DIR_IN)
 745                udc->ep0_state = ISP1760_CTRL_DATA_IN;
 746        else
 747                udc->ep0_state = ISP1760_CTRL_DATA_OUT;
 748
 749        udc->ep0_dir = req.r.bRequestType & USB_DIR_IN;
 750        udc->ep0_length = le16_to_cpu(req.r.wLength);
 751
 752        spin_unlock(&udc->lock);
 753
 754        dev_dbg(udc->isp->dev,
 755                "%s: bRequestType 0x%02x bRequest 0x%02x wValue 0x%04x wIndex 0x%04x wLength 0x%04x\n",
 756                __func__, req.r.bRequestType, req.r.bRequest,
 757                le16_to_cpu(req.r.wValue), le16_to_cpu(req.r.wIndex),
 758                le16_to_cpu(req.r.wLength));
 759
 760        if ((req.r.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
 761                stall = isp1760_ep0_setup_standard(udc, &req.r);
 762        else
 763                stall = udc->driver->setup(&udc->gadget, &req.r) < 0;
 764
 765        if (stall)
 766                isp1760_udc_ctrl_send_stall(&udc->ep[0]);
 767}
 768
 769/* -----------------------------------------------------------------------------
 770 * Gadget Endpoint Operations
 771 */
 772
 773static int isp1760_ep_enable(struct usb_ep *ep,
 774                             const struct usb_endpoint_descriptor *desc)
 775{
 776        struct isp1760_ep *uep = ep_to_udc_ep(ep);
 777        struct isp1760_udc *udc = uep->udc;
 778        unsigned long flags;
 779        unsigned int type;
 780
 781        dev_dbg(uep->udc->isp->dev, "%s\n", __func__);
 782
 783        /*
 784         * Validate the descriptor. The control endpoint can't be enabled
 785         * manually.
 786         */
 787        if (desc->bDescriptorType != USB_DT_ENDPOINT ||
 788            desc->bEndpointAddress == 0 ||
 789            desc->bEndpointAddress != uep->addr ||
 790            le16_to_cpu(desc->wMaxPacketSize) > ep->maxpacket) {
 791                dev_dbg(udc->isp->dev,
 792                        "%s: invalid descriptor type %u addr %02x ep addr %02x max packet size %u/%u\n",
 793                        __func__, desc->bDescriptorType,
 794                        desc->bEndpointAddress, uep->addr,
 795                        le16_to_cpu(desc->wMaxPacketSize), ep->maxpacket);
 796                return -EINVAL;
 797        }
 798
 799        switch (usb_endpoint_type(desc)) {
 800        case USB_ENDPOINT_XFER_ISOC:
 801                type = ISP176x_DC_ENDPTYP_ISOC;
 802                break;
 803        case USB_ENDPOINT_XFER_BULK:
 804                type = ISP176x_DC_ENDPTYP_BULK;
 805                break;
 806        case USB_ENDPOINT_XFER_INT:
 807                type = ISP176x_DC_ENDPTYP_INTERRUPT;
 808                break;
 809        case USB_ENDPOINT_XFER_CONTROL:
 810        default:
 811                dev_dbg(udc->isp->dev, "%s: control endpoints unsupported\n",
 812                        __func__);
 813                return -EINVAL;
 814        }
 815
 816        spin_lock_irqsave(&udc->lock, flags);
 817
 818        uep->desc = desc;
 819        uep->maxpacket = le16_to_cpu(desc->wMaxPacketSize);
 820        uep->rx_pending = false;
 821        uep->halted = false;
 822        uep->wedged = false;
 823
 824        isp1760_udc_select_ep(udc, uep);
 825
 826        isp1760_udc_write(udc, DC_FFOSZ, uep->maxpacket);
 827        isp1760_udc_write(udc, DC_BUFLEN, uep->maxpacket);
 828
 829        isp1760_udc_write(udc, DC_ENDPTYP, type);
 830        isp1760_udc_set(udc, DC_EPENABLE);
 831
 832        spin_unlock_irqrestore(&udc->lock, flags);
 833
 834        return 0;
 835}
 836
 837static int isp1760_ep_disable(struct usb_ep *ep)
 838{
 839        struct isp1760_ep *uep = ep_to_udc_ep(ep);
 840        struct isp1760_udc *udc = uep->udc;
 841        struct isp1760_request *req, *nreq;
 842        LIST_HEAD(req_list);
 843        unsigned long flags;
 844
 845        dev_dbg(udc->isp->dev, "%s\n", __func__);
 846
 847        spin_lock_irqsave(&udc->lock, flags);
 848
 849        if (!uep->desc) {
 850                dev_dbg(udc->isp->dev, "%s: endpoint not enabled\n", __func__);
 851                spin_unlock_irqrestore(&udc->lock, flags);
 852                return -EINVAL;
 853        }
 854
 855        uep->desc = NULL;
 856        uep->maxpacket = 0;
 857
 858        isp1760_udc_select_ep(udc, uep);
 859        isp1760_udc_clear(udc, DC_EPENABLE);
 860        isp1760_udc_clear(udc, DC_ENDPTYP);
 861
 862        /* TODO Synchronize with the IRQ handler */
 863
 864        list_splice_init(&uep->queue, &req_list);
 865
 866        spin_unlock_irqrestore(&udc->lock, flags);
 867
 868        list_for_each_entry_safe(req, nreq, &req_list, queue) {
 869                list_del(&req->queue);
 870                isp1760_udc_request_complete(uep, req, -ESHUTDOWN);
 871        }
 872
 873        return 0;
 874}
 875
 876static struct usb_request *isp1760_ep_alloc_request(struct usb_ep *ep,
 877                                                    gfp_t gfp_flags)
 878{
 879        struct isp1760_request *req;
 880
 881        req = kzalloc(sizeof(*req), gfp_flags);
 882        if (!req)
 883                return NULL;
 884
 885        return &req->req;
 886}
 887
 888static void isp1760_ep_free_request(struct usb_ep *ep, struct usb_request *_req)
 889{
 890        struct isp1760_request *req = req_to_udc_req(_req);
 891
 892        kfree(req);
 893}
 894
 895static int isp1760_ep_queue(struct usb_ep *ep, struct usb_request *_req,
 896                            gfp_t gfp_flags)
 897{
 898        struct isp1760_request *req = req_to_udc_req(_req);
 899        struct isp1760_ep *uep = ep_to_udc_ep(ep);
 900        struct isp1760_udc *udc = uep->udc;
 901        bool complete = false;
 902        unsigned long flags;
 903        int ret = 0;
 904
 905        _req->status = -EINPROGRESS;
 906        _req->actual = 0;
 907
 908        spin_lock_irqsave(&udc->lock, flags);
 909
 910        dev_dbg(udc->isp->dev,
 911                "%s: req %p (%u bytes%s) ep %p(0x%02x)\n", __func__, _req,
 912                _req->length, _req->zero ? " (zlp)" : "", uep, uep->addr);
 913
 914        req->ep = uep;
 915
 916        if (uep->addr == 0) {
 917                if (_req->length != udc->ep0_length &&
 918                    udc->ep0_state != ISP1760_CTRL_DATA_IN) {
 919                        dev_dbg(udc->isp->dev,
 920                                "%s: invalid length %u for req %p\n",
 921                                __func__, _req->length, req);
 922                        ret = -EINVAL;
 923                        goto done;
 924                }
 925
 926                switch (udc->ep0_state) {
 927                case ISP1760_CTRL_DATA_IN:
 928                        dev_dbg(udc->isp->dev, "%s: transmitting req %p\n",
 929                                __func__, req);
 930
 931                        list_add_tail(&req->queue, &uep->queue);
 932                        isp1760_udc_transmit(uep, req);
 933                        break;
 934
 935                case ISP1760_CTRL_DATA_OUT:
 936                        list_add_tail(&req->queue, &uep->queue);
 937                        __isp1760_udc_select_ep(udc, uep, USB_DIR_OUT);
 938                        isp1760_udc_set(udc, DC_DSEN);
 939                        break;
 940
 941                case ISP1760_CTRL_STATUS:
 942                        complete = true;
 943                        break;
 944
 945                default:
 946                        dev_dbg(udc->isp->dev, "%s: invalid ep0 state\n",
 947                                __func__);
 948                        ret = -EINVAL;
 949                        break;
 950                }
 951        } else if (uep->desc) {
 952                bool empty = list_empty(&uep->queue);
 953
 954                list_add_tail(&req->queue, &uep->queue);
 955                if ((uep->addr & USB_DIR_IN) && !uep->halted && empty)
 956                        isp1760_udc_transmit(uep, req);
 957                else if (!(uep->addr & USB_DIR_IN) && uep->rx_pending)
 958                        complete = isp1760_udc_receive(uep, req);
 959        } else {
 960                dev_dbg(udc->isp->dev,
 961                        "%s: can't queue request to disabled ep%02x\n",
 962                        __func__, uep->addr);
 963                ret = -ESHUTDOWN;
 964        }
 965
 966done:
 967        if (ret < 0)
 968                req->ep = NULL;
 969
 970        spin_unlock_irqrestore(&udc->lock, flags);
 971
 972        if (complete)
 973                isp1760_udc_request_complete(uep, req, 0);
 974
 975        return ret;
 976}
 977
 978static int isp1760_ep_dequeue(struct usb_ep *ep, struct usb_request *_req)
 979{
 980        struct isp1760_request *req = req_to_udc_req(_req);
 981        struct isp1760_ep *uep = ep_to_udc_ep(ep);
 982        struct isp1760_udc *udc = uep->udc;
 983        unsigned long flags;
 984
 985        dev_dbg(uep->udc->isp->dev, "%s(ep%02x)\n", __func__, uep->addr);
 986
 987        spin_lock_irqsave(&udc->lock, flags);
 988
 989        if (req->ep != uep)
 990                req = NULL;
 991        else
 992                list_del(&req->queue);
 993
 994        spin_unlock_irqrestore(&udc->lock, flags);
 995
 996        if (!req)
 997                return -EINVAL;
 998
 999        isp1760_udc_request_complete(uep, req, -ECONNRESET);
1000        return 0;
1001}
1002
1003static int __isp1760_ep_set_halt(struct isp1760_ep *uep, bool stall, bool wedge)
1004{
1005        struct isp1760_udc *udc = uep->udc;
1006        int ret;
1007
1008        if (!uep->addr) {
1009                /*
1010                 * Halting the control endpoint is only valid as a delayed error
1011                 * response to a SETUP packet. Make sure EP0 is in the right
1012                 * stage and that the gadget isn't trying to clear the halt
1013                 * condition.
1014                 */
1015                if (WARN_ON(udc->ep0_state == ISP1760_CTRL_SETUP || !stall ||
1016                             wedge)) {
1017                        return -EINVAL;
1018                }
1019        }
1020
1021        if (uep->addr && !uep->desc) {
1022                dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
1023                        uep->addr);
1024                return -EINVAL;
1025        }
1026
1027        if (uep->addr & USB_DIR_IN) {
1028                /* Refuse to halt IN endpoints with active transfers. */
1029                if (!list_empty(&uep->queue)) {
1030                        dev_dbg(udc->isp->dev,
1031                                "%s: ep%02x has request pending\n", __func__,
1032                                uep->addr);
1033                        return -EAGAIN;
1034                }
1035        }
1036
1037        ret = __isp1760_udc_set_halt(uep, stall);
1038        if (ret < 0)
1039                return ret;
1040
1041        if (!uep->addr) {
1042                /*
1043                 * Stalling EP0 completes the control transaction, move back to
1044                 * the SETUP state.
1045                 */
1046                udc->ep0_state = ISP1760_CTRL_SETUP;
1047                return 0;
1048        }
1049
1050        if (wedge)
1051                uep->wedged = true;
1052        else if (!stall)
1053                uep->wedged = false;
1054
1055        return 0;
1056}
1057
1058static int isp1760_ep_set_halt(struct usb_ep *ep, int value)
1059{
1060        struct isp1760_ep *uep = ep_to_udc_ep(ep);
1061        unsigned long flags;
1062        int ret;
1063
1064        dev_dbg(uep->udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
1065                value ? "set" : "clear", uep->addr);
1066
1067        spin_lock_irqsave(&uep->udc->lock, flags);
1068        ret = __isp1760_ep_set_halt(uep, value, false);
1069        spin_unlock_irqrestore(&uep->udc->lock, flags);
1070
1071        return ret;
1072}
1073
1074static int isp1760_ep_set_wedge(struct usb_ep *ep)
1075{
1076        struct isp1760_ep *uep = ep_to_udc_ep(ep);
1077        unsigned long flags;
1078        int ret;
1079
1080        dev_dbg(uep->udc->isp->dev, "%s: set wedge on ep%02x)\n", __func__,
1081                uep->addr);
1082
1083        spin_lock_irqsave(&uep->udc->lock, flags);
1084        ret = __isp1760_ep_set_halt(uep, true, true);
1085        spin_unlock_irqrestore(&uep->udc->lock, flags);
1086
1087        return ret;
1088}
1089
1090static void isp1760_ep_fifo_flush(struct usb_ep *ep)
1091{
1092        struct isp1760_ep *uep = ep_to_udc_ep(ep);
1093        struct isp1760_udc *udc = uep->udc;
1094        unsigned long flags;
1095
1096        spin_lock_irqsave(&udc->lock, flags);
1097
1098        isp1760_udc_select_ep(udc, uep);
1099
1100        /*
1101         * Set the CLBUF bit twice to flush both buffers in case double
1102         * buffering is enabled.
1103         */
1104        isp1760_udc_set(udc, DC_CLBUF);
1105        isp1760_udc_set(udc, DC_CLBUF);
1106
1107        spin_unlock_irqrestore(&udc->lock, flags);
1108}
1109
1110static const struct usb_ep_ops isp1760_ep_ops = {
1111        .enable = isp1760_ep_enable,
1112        .disable = isp1760_ep_disable,
1113        .alloc_request = isp1760_ep_alloc_request,
1114        .free_request = isp1760_ep_free_request,
1115        .queue = isp1760_ep_queue,
1116        .dequeue = isp1760_ep_dequeue,
1117        .set_halt = isp1760_ep_set_halt,
1118        .set_wedge = isp1760_ep_set_wedge,
1119        .fifo_flush = isp1760_ep_fifo_flush,
1120};
1121
1122/* -----------------------------------------------------------------------------
1123 * Device States
1124 */
1125
1126/* Called with the UDC spinlock held. */
1127static void isp1760_udc_connect(struct isp1760_udc *udc)
1128{
1129        usb_gadget_set_state(&udc->gadget, USB_STATE_POWERED);
1130        mod_timer(&udc->vbus_timer, jiffies + ISP1760_VBUS_POLL_INTERVAL);
1131}
1132
1133/* Called with the UDC spinlock held. */
1134static void isp1760_udc_disconnect(struct isp1760_udc *udc)
1135{
1136        if (udc->gadget.state < USB_STATE_POWERED)
1137                return;
1138
1139        dev_dbg(udc->isp->dev, "Device disconnected in state %u\n",
1140                 udc->gadget.state);
1141
1142        udc->gadget.speed = USB_SPEED_UNKNOWN;
1143        usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1144
1145        if (udc->driver->disconnect)
1146                udc->driver->disconnect(&udc->gadget);
1147
1148        del_timer(&udc->vbus_timer);
1149
1150        /* TODO Reset all endpoints ? */
1151}
1152
1153static void isp1760_udc_init_hw(struct isp1760_udc *udc)
1154{
1155        u32 intconf = udc->is_isp1763 ? ISP1763_DC_INTCONF : ISP176x_DC_INTCONF;
1156        u32 intena = udc->is_isp1763 ? ISP1763_DC_INTENABLE :
1157                                                ISP176x_DC_INTENABLE;
1158
1159        /*
1160         * The device controller currently shares its interrupt with the host
1161         * controller, the DC_IRQ polarity and signaling mode are ignored. Set
1162         * the to active-low level-triggered.
1163         *
1164         * Configure the control, in and out pipes to generate interrupts on
1165         * ACK tokens only (and NYET for the out pipe). The default
1166         * configuration also generates an interrupt on the first NACK token.
1167         */
1168        isp1760_reg_write(udc->regs, intconf,
1169                          ISP176x_DC_CDBGMOD_ACK | ISP176x_DC_DDBGMODIN_ACK |
1170                          ISP176x_DC_DDBGMODOUT_ACK);
1171
1172        isp1760_reg_write(udc->regs, intena, DC_IEPRXTX(7) |
1173                          DC_IEPRXTX(6) | DC_IEPRXTX(5) | DC_IEPRXTX(4) |
1174                          DC_IEPRXTX(3) | DC_IEPRXTX(2) | DC_IEPRXTX(1) |
1175                          DC_IEPRXTX(0) | ISP176x_DC_IEP0SETUP |
1176                          ISP176x_DC_IEVBUS | ISP176x_DC_IERESM |
1177                          ISP176x_DC_IESUSP | ISP176x_DC_IEHS_STA |
1178                          ISP176x_DC_IEBRST);
1179
1180        if (udc->connected)
1181                isp1760_set_pullup(udc->isp, true);
1182
1183        isp1760_udc_set(udc, DC_DEVEN);
1184}
1185
1186static void isp1760_udc_reset(struct isp1760_udc *udc)
1187{
1188        unsigned long flags;
1189
1190        spin_lock_irqsave(&udc->lock, flags);
1191
1192        /*
1193         * The bus reset has reset most registers to their default value,
1194         * reinitialize the UDC hardware.
1195         */
1196        isp1760_udc_init_hw(udc);
1197
1198        udc->ep0_state = ISP1760_CTRL_SETUP;
1199        udc->gadget.speed = USB_SPEED_FULL;
1200
1201        usb_gadget_udc_reset(&udc->gadget, udc->driver);
1202
1203        spin_unlock_irqrestore(&udc->lock, flags);
1204}
1205
1206static void isp1760_udc_suspend(struct isp1760_udc *udc)
1207{
1208        if (udc->gadget.state < USB_STATE_DEFAULT)
1209                return;
1210
1211        if (udc->driver->suspend)
1212                udc->driver->suspend(&udc->gadget);
1213}
1214
1215static void isp1760_udc_resume(struct isp1760_udc *udc)
1216{
1217        if (udc->gadget.state < USB_STATE_DEFAULT)
1218                return;
1219
1220        if (udc->driver->resume)
1221                udc->driver->resume(&udc->gadget);
1222}
1223
1224/* -----------------------------------------------------------------------------
1225 * Gadget Operations
1226 */
1227
1228static int isp1760_udc_get_frame(struct usb_gadget *gadget)
1229{
1230        struct isp1760_udc *udc = gadget_to_udc(gadget);
1231
1232        return isp1760_udc_read(udc, DC_FRAMENUM);
1233}
1234
1235static int isp1760_udc_wakeup(struct usb_gadget *gadget)
1236{
1237        struct isp1760_udc *udc = gadget_to_udc(gadget);
1238
1239        dev_dbg(udc->isp->dev, "%s\n", __func__);
1240        return -ENOTSUPP;
1241}
1242
1243static int isp1760_udc_set_selfpowered(struct usb_gadget *gadget,
1244                                       int is_selfpowered)
1245{
1246        struct isp1760_udc *udc = gadget_to_udc(gadget);
1247
1248        if (is_selfpowered)
1249                udc->devstatus |= 1 << USB_DEVICE_SELF_POWERED;
1250        else
1251                udc->devstatus &= ~(1 << USB_DEVICE_SELF_POWERED);
1252
1253        return 0;
1254}
1255
1256static int isp1760_udc_pullup(struct usb_gadget *gadget, int is_on)
1257{
1258        struct isp1760_udc *udc = gadget_to_udc(gadget);
1259
1260        isp1760_set_pullup(udc->isp, is_on);
1261        udc->connected = is_on;
1262
1263        return 0;
1264}
1265
1266static int isp1760_udc_start(struct usb_gadget *gadget,
1267                             struct usb_gadget_driver *driver)
1268{
1269        struct isp1760_udc *udc = gadget_to_udc(gadget);
1270        unsigned long flags;
1271
1272        /* The hardware doesn't support low speed. */
1273        if (driver->max_speed < USB_SPEED_FULL) {
1274                dev_err(udc->isp->dev, "Invalid gadget driver\n");
1275                return -EINVAL;
1276        }
1277
1278        spin_lock_irqsave(&udc->lock, flags);
1279
1280        if (udc->driver) {
1281                dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
1282                spin_unlock_irqrestore(&udc->lock, flags);
1283                return -EBUSY;
1284        }
1285
1286        udc->driver = driver;
1287
1288        spin_unlock_irqrestore(&udc->lock, flags);
1289
1290        dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
1291                driver->function);
1292
1293        udc->devstatus = 0;
1294        udc->connected = true;
1295
1296        usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1297
1298        /* DMA isn't supported yet, don't enable the DMA clock. */
1299        isp1760_udc_set(udc, DC_GLINTENA);
1300
1301        isp1760_udc_init_hw(udc);
1302
1303        dev_dbg(udc->isp->dev, "UDC started with driver %s\n",
1304                driver->function);
1305
1306        return 0;
1307}
1308
1309static int isp1760_udc_stop(struct usb_gadget *gadget)
1310{
1311        struct isp1760_udc *udc = gadget_to_udc(gadget);
1312        u32 mode_reg = udc->is_isp1763 ? ISP1763_DC_MODE : ISP176x_DC_MODE;
1313        unsigned long flags;
1314
1315        dev_dbg(udc->isp->dev, "%s\n", __func__);
1316
1317        del_timer_sync(&udc->vbus_timer);
1318
1319        isp1760_reg_write(udc->regs, mode_reg, 0);
1320
1321        spin_lock_irqsave(&udc->lock, flags);
1322        udc->driver = NULL;
1323        spin_unlock_irqrestore(&udc->lock, flags);
1324
1325        return 0;
1326}
1327
1328static const struct usb_gadget_ops isp1760_udc_ops = {
1329        .get_frame = isp1760_udc_get_frame,
1330        .wakeup = isp1760_udc_wakeup,
1331        .set_selfpowered = isp1760_udc_set_selfpowered,
1332        .pullup = isp1760_udc_pullup,
1333        .udc_start = isp1760_udc_start,
1334        .udc_stop = isp1760_udc_stop,
1335};
1336
1337/* -----------------------------------------------------------------------------
1338 * Interrupt Handling
1339 */
1340
1341static u32 isp1760_udc_irq_get_status(struct isp1760_udc *udc)
1342{
1343        u32 status;
1344
1345        if (udc->is_isp1763) {
1346                status = isp1760_reg_read(udc->regs, ISP1763_DC_INTERRUPT)
1347                        & isp1760_reg_read(udc->regs, ISP1763_DC_INTENABLE);
1348                isp1760_reg_write(udc->regs, ISP1763_DC_INTERRUPT, status);
1349        } else {
1350                status = isp1760_reg_read(udc->regs, ISP176x_DC_INTERRUPT)
1351                        & isp1760_reg_read(udc->regs, ISP176x_DC_INTENABLE);
1352                isp1760_reg_write(udc->regs, ISP176x_DC_INTERRUPT, status);
1353        }
1354
1355        return status;
1356}
1357
1358static irqreturn_t isp1760_udc_irq(int irq, void *dev)
1359{
1360        struct isp1760_udc *udc = dev;
1361        unsigned int i;
1362        u32 status;
1363
1364        status = isp1760_udc_irq_get_status(udc);
1365
1366        if (status & DC_IEVBUS) {
1367                dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
1368                /* The VBUS interrupt is only triggered when VBUS appears. */
1369                spin_lock(&udc->lock);
1370                isp1760_udc_connect(udc);
1371                spin_unlock(&udc->lock);
1372        }
1373
1374        if (status & DC_IEBRST) {
1375                dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
1376
1377                isp1760_udc_reset(udc);
1378        }
1379
1380        for (i = 0; i <= 7; ++i) {
1381                struct isp1760_ep *ep = &udc->ep[i*2];
1382
1383                if (status & DC_IEPTX(i)) {
1384                        dev_dbg(udc->isp->dev, "%s(EPTX%u)\n", __func__, i);
1385                        isp1760_ep_tx_complete(ep);
1386                }
1387
1388                if (status & DC_IEPRX(i)) {
1389                        dev_dbg(udc->isp->dev, "%s(EPRX%u)\n", __func__, i);
1390                        isp1760_ep_rx_ready(i ? ep - 1 : ep);
1391                }
1392        }
1393
1394        if (status & DC_IEP0SETUP) {
1395                dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
1396
1397                isp1760_ep0_setup(udc);
1398        }
1399
1400        if (status & DC_IERESM) {
1401                dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
1402                isp1760_udc_resume(udc);
1403        }
1404
1405        if (status & DC_IESUSP) {
1406                dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
1407
1408                spin_lock(&udc->lock);
1409                if (!isp1760_udc_is_set(udc, DC_VBUSSTAT))
1410                        isp1760_udc_disconnect(udc);
1411                else
1412                        isp1760_udc_suspend(udc);
1413                spin_unlock(&udc->lock);
1414        }
1415
1416        if (status & DC_IEHS_STA) {
1417                dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
1418                udc->gadget.speed = USB_SPEED_HIGH;
1419        }
1420
1421        return status ? IRQ_HANDLED : IRQ_NONE;
1422}
1423
1424static void isp1760_udc_vbus_poll(struct timer_list *t)
1425{
1426        struct isp1760_udc *udc = from_timer(udc, t, vbus_timer);
1427        unsigned long flags;
1428
1429        spin_lock_irqsave(&udc->lock, flags);
1430
1431        if (!(isp1760_udc_is_set(udc, DC_VBUSSTAT)))
1432                isp1760_udc_disconnect(udc);
1433        else if (udc->gadget.state >= USB_STATE_POWERED)
1434                mod_timer(&udc->vbus_timer,
1435                          jiffies + ISP1760_VBUS_POLL_INTERVAL);
1436
1437        spin_unlock_irqrestore(&udc->lock, flags);
1438}
1439
1440/* -----------------------------------------------------------------------------
1441 * Registration
1442 */
1443
1444static void isp1760_udc_init_eps(struct isp1760_udc *udc)
1445{
1446        unsigned int i;
1447
1448        INIT_LIST_HEAD(&udc->gadget.ep_list);
1449
1450        for (i = 0; i < ARRAY_SIZE(udc->ep); ++i) {
1451                struct isp1760_ep *ep = &udc->ep[i];
1452                unsigned int ep_num = (i + 1) / 2;
1453                bool is_in = !(i & 1);
1454
1455                ep->udc = udc;
1456
1457                INIT_LIST_HEAD(&ep->queue);
1458
1459                ep->addr = (ep_num && is_in ? USB_DIR_IN : USB_DIR_OUT)
1460                         | ep_num;
1461                ep->desc = NULL;
1462
1463                sprintf(ep->name, "ep%u%s", ep_num,
1464                        ep_num ? (is_in ? "in" : "out") : "");
1465
1466                ep->ep.ops = &isp1760_ep_ops;
1467                ep->ep.name = ep->name;
1468
1469                /*
1470                 * Hardcode the maximum packet sizes for now, to 64 bytes for
1471                 * the control endpoint and 512 bytes for all other endpoints.
1472                 * This fits in the 8kB FIFO without double-buffering.
1473                 */
1474                if (ep_num == 0) {
1475                        usb_ep_set_maxpacket_limit(&ep->ep, 64);
1476                        ep->ep.caps.type_control = true;
1477                        ep->ep.caps.dir_in = true;
1478                        ep->ep.caps.dir_out = true;
1479                        ep->maxpacket = 64;
1480                        udc->gadget.ep0 = &ep->ep;
1481                } else {
1482                        usb_ep_set_maxpacket_limit(&ep->ep, 512);
1483                        ep->ep.caps.type_iso = true;
1484                        ep->ep.caps.type_bulk = true;
1485                        ep->ep.caps.type_int = true;
1486                        ep->maxpacket = 0;
1487                        list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
1488                }
1489
1490                if (is_in)
1491                        ep->ep.caps.dir_in = true;
1492                else
1493                        ep->ep.caps.dir_out = true;
1494        }
1495}
1496
1497static int isp1760_udc_init(struct isp1760_udc *udc)
1498{
1499        u32 mode_reg = udc->is_isp1763 ? ISP1763_DC_MODE : ISP176x_DC_MODE;
1500        u16 scratch;
1501        u32 chipid;
1502
1503        /*
1504         * Check that the controller is present by writing to the scratch
1505         * register, modifying the bus pattern by reading from the chip ID
1506         * register, and reading the scratch register value back. The chip ID
1507         * and scratch register contents must match the expected values.
1508         */
1509        isp1760_udc_write(udc, DC_SCRATCH, 0xbabe);
1510        chipid = isp1760_udc_read(udc, DC_CHIP_ID_HIGH) << 16;
1511        chipid |= isp1760_udc_read(udc, DC_CHIP_ID_LOW);
1512        scratch = isp1760_udc_read(udc, DC_SCRATCH);
1513
1514        if (scratch != 0xbabe) {
1515                dev_err(udc->isp->dev,
1516                        "udc: scratch test failed (0x%04x/0x%08x)\n",
1517                        scratch, chipid);
1518                return -ENODEV;
1519        }
1520
1521        if (chipid != 0x00011582 && chipid != 0x00158210 &&
1522            chipid != 0x00176320) {
1523                dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
1524                return -ENODEV;
1525        }
1526
1527        /* Reset the device controller. */
1528        isp1760_udc_set(udc, DC_SFRESET);
1529        usleep_range(10000, 11000);
1530        isp1760_reg_write(udc->regs, mode_reg, 0);
1531        usleep_range(10000, 11000);
1532
1533        return 0;
1534}
1535
1536int isp1760_udc_register(struct isp1760_device *isp, int irq,
1537                         unsigned long irqflags)
1538{
1539        struct isp1760_udc *udc = &isp->udc;
1540        int ret;
1541
1542        udc->irq = -1;
1543        udc->isp = isp;
1544
1545        spin_lock_init(&udc->lock);
1546        timer_setup(&udc->vbus_timer, isp1760_udc_vbus_poll, 0);
1547
1548        ret = isp1760_udc_init(udc);
1549        if (ret < 0)
1550                return ret;
1551
1552        udc->irqname = kasprintf(GFP_KERNEL, "%s (udc)", dev_name(isp->dev));
1553        if (!udc->irqname)
1554                return -ENOMEM;
1555
1556        ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
1557                          udc->irqname, udc);
1558        if (ret < 0)
1559                goto error;
1560
1561        udc->irq = irq;
1562
1563        /*
1564         * Initialize the gadget static fields and register its device. Gadget
1565         * fields that vary during the life time of the gadget are initialized
1566         * by the UDC core.
1567         */
1568        udc->gadget.ops = &isp1760_udc_ops;
1569        udc->gadget.speed = USB_SPEED_UNKNOWN;
1570        udc->gadget.max_speed = USB_SPEED_HIGH;
1571        udc->gadget.name = "isp1761_udc";
1572
1573        isp1760_udc_init_eps(udc);
1574
1575        ret = usb_add_gadget_udc(isp->dev, &udc->gadget);
1576        if (ret < 0)
1577                goto error;
1578
1579        return 0;
1580
1581error:
1582        if (udc->irq >= 0)
1583                free_irq(udc->irq, udc);
1584        kfree(udc->irqname);
1585
1586        return ret;
1587}
1588
1589void isp1760_udc_unregister(struct isp1760_device *isp)
1590{
1591        struct isp1760_udc *udc = &isp->udc;
1592
1593        if (!udc->isp)
1594                return;
1595
1596        usb_del_gadget_udc(&udc->gadget);
1597
1598        free_irq(udc->irq, udc);
1599        kfree(udc->irqname);
1600}
1601