1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Driver for the NXP ISP1761 device controller
4  *
5  * Copyright 2014 Ideas on Board Oy
6  *
7  * Contacts:
8  *	Laurent Pinchart <laurent.pinchart@ideasonboard.com>
9  */
10 
11 #include <linux/interrupt.h>
12 #include <linux/io.h>
13 #include <linux/kernel.h>
14 #include <linux/list.h>
15 #include <linux/module.h>
16 #include <linux/slab.h>
17 #include <linux/timer.h>
18 #include <linux/usb.h>
19 
20 #include "isp1760-core.h"
21 #include "isp1760-regs.h"
22 #include "isp1760-udc.h"
23 
24 #define ISP1760_VBUS_POLL_INTERVAL	msecs_to_jiffies(500)
25 
26 struct isp1760_request {
27 	struct usb_request req;
28 	struct list_head queue;
29 	struct isp1760_ep *ep;
30 	unsigned int packet_size;
31 };
32 
33 static inline struct isp1760_udc *gadget_to_udc(struct usb_gadget *gadget)
34 {
35 	return container_of(gadget, struct isp1760_udc, gadget);
36 }
37 
38 static inline struct isp1760_ep *ep_to_udc_ep(struct usb_ep *ep)
39 {
40 	return container_of(ep, struct isp1760_ep, ep);
41 }
42 
43 static inline struct isp1760_request *req_to_udc_req(struct usb_request *req)
44 {
45 	return container_of(req, struct isp1760_request, req);
46 }
47 
48 static inline u32 isp1760_udc_read(struct isp1760_udc *udc, u16 reg)
49 {
50 	return isp1760_read32(udc->regs, reg);
51 }
52 
53 static inline void isp1760_udc_write(struct isp1760_udc *udc, u16 reg, u32 val)
54 {
55 	isp1760_write32(udc->regs, reg, val);
56 }
57 
58 /* -----------------------------------------------------------------------------
59  * Endpoint Management
60  */
61 
62 static struct isp1760_ep *isp1760_udc_find_ep(struct isp1760_udc *udc,
63 					      u16 index)
64 {
65 	unsigned int i;
66 
67 	if (index == 0)
68 		return &udc->ep[0];
69 
70 	for (i = 1; i < ARRAY_SIZE(udc->ep); ++i) {
71 		if (udc->ep[i].addr == index)
72 			return udc->ep[i].desc ? &udc->ep[i] : NULL;
73 	}
74 
75 	return NULL;
76 }
77 
78 static void __isp1760_udc_select_ep(struct isp1760_ep *ep, int dir)
79 {
80 	isp1760_udc_write(ep->udc, DC_EPINDEX,
81 			  DC_ENDPIDX(ep->addr & USB_ENDPOINT_NUMBER_MASK) |
82 			  (dir == USB_DIR_IN ? DC_EPDIR : 0));
83 }
84 
85 /**
86  * isp1760_udc_select_ep - Select an endpoint for register access
87  * @ep: The endpoint
88  *
89  * The ISP1761 endpoint registers are banked. This function selects the target
90  * endpoint for banked register access. The selection remains valid until the
91  * next call to this function, the next direct access to the EPINDEX register
92  * or the next reset, whichever comes first.
93  *
94  * Called with the UDC spinlock held.
95  */
96 static void isp1760_udc_select_ep(struct isp1760_ep *ep)
97 {
98 	__isp1760_udc_select_ep(ep, ep->addr & USB_ENDPOINT_DIR_MASK);
99 }
100 
101 /* Called with the UDC spinlock held. */
102 static void isp1760_udc_ctrl_send_status(struct isp1760_ep *ep, int dir)
103 {
104 	struct isp1760_udc *udc = ep->udc;
105 
106 	/*
107 	 * Proceed to the status stage. The status stage data packet flows in
108 	 * the direction opposite to the data stage data packets, we thus need
109 	 * to select the OUT/IN endpoint for IN/OUT transfers.
110 	 */
111 	isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) |
112 			  (dir == USB_DIR_IN ? 0 : DC_EPDIR));
113 	isp1760_udc_write(udc, DC_CTRLFUNC, DC_STATUS);
114 
115 	/*
116 	 * The hardware will terminate the request automatically and go back to
117 	 * the setup stage without notifying us.
118 	 */
119 	udc->ep0_state = ISP1760_CTRL_SETUP;
120 }
121 
122 /* Called without the UDC spinlock held. */
123 static void isp1760_udc_request_complete(struct isp1760_ep *ep,
124 					 struct isp1760_request *req,
125 					 int status)
126 {
127 	struct isp1760_udc *udc = ep->udc;
128 	unsigned long flags;
129 
130 	dev_dbg(ep->udc->isp->dev, "completing request %p with status %d\n",
131 		req, status);
132 
133 	req->ep = NULL;
134 	req->req.status = status;
135 	req->req.complete(&ep->ep, &req->req);
136 
137 	spin_lock_irqsave(&udc->lock, flags);
138 
139 	/*
140 	 * When completing control OUT requests, move to the status stage after
141 	 * calling the request complete callback. This gives the gadget an
142 	 * opportunity to stall the control transfer if needed.
143 	 */
144 	if (status == 0 && ep->addr == 0 && udc->ep0_dir == USB_DIR_OUT)
145 		isp1760_udc_ctrl_send_status(ep, USB_DIR_OUT);
146 
147 	spin_unlock_irqrestore(&udc->lock, flags);
148 }
149 
150 static void isp1760_udc_ctrl_send_stall(struct isp1760_ep *ep)
151 {
152 	struct isp1760_udc *udc = ep->udc;
153 	unsigned long flags;
154 
155 	dev_dbg(ep->udc->isp->dev, "%s(ep%02x)\n", __func__, ep->addr);
156 
157 	spin_lock_irqsave(&udc->lock, flags);
158 
159 	/* Stall both the IN and OUT endpoints. */
160 	__isp1760_udc_select_ep(ep, USB_DIR_OUT);
161 	isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
162 	__isp1760_udc_select_ep(ep, USB_DIR_IN);
163 	isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
164 
165 	/* A protocol stall completes the control transaction. */
166 	udc->ep0_state = ISP1760_CTRL_SETUP;
167 
168 	spin_unlock_irqrestore(&udc->lock, flags);
169 }
170 
171 /* -----------------------------------------------------------------------------
172  * Data Endpoints
173  */
174 
175 /* Called with the UDC spinlock held. */
176 static bool isp1760_udc_receive(struct isp1760_ep *ep,
177 				struct isp1760_request *req)
178 {
179 	struct isp1760_udc *udc = ep->udc;
180 	unsigned int len;
181 	u32 *buf;
182 	int i;
183 
184 	isp1760_udc_select_ep(ep);
185 	len = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
186 
187 	dev_dbg(udc->isp->dev, "%s: received %u bytes (%u/%u done)\n",
188 		__func__, len, req->req.actual, req->req.length);
189 
190 	len = min(len, req->req.length - req->req.actual);
191 
192 	if (!len) {
193 		/*
194 		 * There's no data to be read from the FIFO, acknowledge the RX
195 		 * interrupt by clearing the buffer.
196 		 *
197 		 * TODO: What if another packet arrives in the meantime ? The
198 		 * datasheet doesn't clearly document how this should be
199 		 * handled.
200 		 */
201 		isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
202 		return false;
203 	}
204 
205 	buf = req->req.buf + req->req.actual;
206 
207 	/*
208 	 * Make sure not to read more than one extra byte, otherwise data from
209 	 * the next packet might be removed from the FIFO.
210 	 */
211 	for (i = len; i > 2; i -= 4, ++buf)
212 		*buf = le32_to_cpu(isp1760_udc_read(udc, DC_DATAPORT));
213 	if (i > 0)
214 		*(u16 *)buf = le16_to_cpu(readw(udc->regs + DC_DATAPORT));
215 
216 	req->req.actual += len;
217 
218 	/*
219 	 * TODO: The short_not_ok flag isn't supported yet, but isn't used by
220 	 * any gadget driver either.
221 	 */
222 
223 	dev_dbg(udc->isp->dev,
224 		"%s: req %p actual/length %u/%u maxpacket %u packet size %u\n",
225 		__func__, req, req->req.actual, req->req.length, ep->maxpacket,
226 		len);
227 
228 	ep->rx_pending = false;
229 
230 	/*
231 	 * Complete the request if all data has been received or if a short
232 	 * packet has been received.
233 	 */
234 	if (req->req.actual == req->req.length || len < ep->maxpacket) {
235 		list_del(&req->queue);
236 		return true;
237 	}
238 
239 	return false;
240 }
241 
242 static void isp1760_udc_transmit(struct isp1760_ep *ep,
243 				 struct isp1760_request *req)
244 {
245 	struct isp1760_udc *udc = ep->udc;
246 	u32 *buf = req->req.buf + req->req.actual;
247 	int i;
248 
249 	req->packet_size = min(req->req.length - req->req.actual,
250 			       ep->maxpacket);
251 
252 	dev_dbg(udc->isp->dev, "%s: transferring %u bytes (%u/%u done)\n",
253 		__func__, req->packet_size, req->req.actual,
254 		req->req.length);
255 
256 	__isp1760_udc_select_ep(ep, USB_DIR_IN);
257 
258 	if (req->packet_size)
259 		isp1760_udc_write(udc, DC_BUFLEN, req->packet_size);
260 
261 	/*
262 	 * Make sure not to write more than one extra byte, otherwise extra data
263 	 * will stay in the FIFO and will be transmitted during the next control
264 	 * request. The endpoint control CLBUF bit is supposed to allow flushing
265 	 * the FIFO for this kind of conditions, but doesn't seem to work.
266 	 */
267 	for (i = req->packet_size; i > 2; i -= 4, ++buf)
268 		isp1760_udc_write(udc, DC_DATAPORT, cpu_to_le32(*buf));
269 	if (i > 0)
270 		writew(cpu_to_le16(*(u16 *)buf), udc->regs + DC_DATAPORT);
271 
272 	if (ep->addr == 0)
273 		isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
274 	if (!req->packet_size)
275 		isp1760_udc_write(udc, DC_CTRLFUNC, DC_VENDP);
276 }
277 
278 static void isp1760_ep_rx_ready(struct isp1760_ep *ep)
279 {
280 	struct isp1760_udc *udc = ep->udc;
281 	struct isp1760_request *req;
282 	bool complete;
283 
284 	spin_lock(&udc->lock);
285 
286 	if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_OUT) {
287 		spin_unlock(&udc->lock);
288 		dev_dbg(udc->isp->dev, "%s: invalid ep0 state %u\n", __func__,
289 			udc->ep0_state);
290 		return;
291 	}
292 
293 	if (ep->addr != 0 && !ep->desc) {
294 		spin_unlock(&udc->lock);
295 		dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
296 			ep->addr);
297 		return;
298 	}
299 
300 	if (list_empty(&ep->queue)) {
301 		ep->rx_pending = true;
302 		spin_unlock(&udc->lock);
303 		dev_dbg(udc->isp->dev, "%s: ep%02x (%p) has no request queued\n",
304 			__func__, ep->addr, ep);
305 		return;
306 	}
307 
308 	req = list_first_entry(&ep->queue, struct isp1760_request,
309 			       queue);
310 	complete = isp1760_udc_receive(ep, req);
311 
312 	spin_unlock(&udc->lock);
313 
314 	if (complete)
315 		isp1760_udc_request_complete(ep, req, 0);
316 }
317 
318 static void isp1760_ep_tx_complete(struct isp1760_ep *ep)
319 {
320 	struct isp1760_udc *udc = ep->udc;
321 	struct isp1760_request *complete = NULL;
322 	struct isp1760_request *req;
323 	bool need_zlp;
324 
325 	spin_lock(&udc->lock);
326 
327 	if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_IN) {
328 		spin_unlock(&udc->lock);
329 		dev_dbg(udc->isp->dev, "TX IRQ: invalid endpoint state %u\n",
330 			udc->ep0_state);
331 		return;
332 	}
333 
334 	if (list_empty(&ep->queue)) {
335 		/*
336 		 * This can happen for the control endpoint when the reply to
337 		 * the GET_STATUS IN control request is sent directly by the
338 		 * setup IRQ handler. Just proceed to the status stage.
339 		 */
340 		if (ep->addr == 0) {
341 			isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
342 			spin_unlock(&udc->lock);
343 			return;
344 		}
345 
346 		spin_unlock(&udc->lock);
347 		dev_dbg(udc->isp->dev, "%s: ep%02x has no request queued\n",
348 			__func__, ep->addr);
349 		return;
350 	}
351 
352 	req = list_first_entry(&ep->queue, struct isp1760_request,
353 			       queue);
354 	req->req.actual += req->packet_size;
355 
356 	need_zlp = req->req.actual == req->req.length &&
357 		   !(req->req.length % ep->maxpacket) &&
358 		   req->packet_size && req->req.zero;
359 
360 	dev_dbg(udc->isp->dev,
361 		"TX IRQ: req %p actual/length %u/%u maxpacket %u packet size %u zero %u need zlp %u\n",
362 		 req, req->req.actual, req->req.length, ep->maxpacket,
363 		 req->packet_size, req->req.zero, need_zlp);
364 
365 	/*
366 	 * Complete the request if all data has been sent and we don't need to
367 	 * transmit a zero length packet.
368 	 */
369 	if (req->req.actual == req->req.length && !need_zlp) {
370 		complete = req;
371 		list_del(&req->queue);
372 
373 		if (ep->addr == 0)
374 			isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
375 
376 		if (!list_empty(&ep->queue))
377 			req = list_first_entry(&ep->queue,
378 					       struct isp1760_request, queue);
379 		else
380 			req = NULL;
381 	}
382 
383 	/*
384 	 * Transmit the next packet or start the next request, if any.
385 	 *
386 	 * TODO: If the endpoint is stalled the next request shouldn't be
387 	 * started, but what about the next packet ?
388 	 */
389 	if (req)
390 		isp1760_udc_transmit(ep, req);
391 
392 	spin_unlock(&udc->lock);
393 
394 	if (complete)
395 		isp1760_udc_request_complete(ep, complete, 0);
396 }
397 
398 static int __isp1760_udc_set_halt(struct isp1760_ep *ep, bool halt)
399 {
400 	struct isp1760_udc *udc = ep->udc;
401 
402 	dev_dbg(udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
403 		halt ? "set" : "clear", ep->addr);
404 
405 	if (ep->desc && usb_endpoint_xfer_isoc(ep->desc)) {
406 		dev_dbg(udc->isp->dev, "%s: ep%02x is isochronous\n", __func__,
407 			ep->addr);
408 		return -EINVAL;
409 	}
410 
411 	isp1760_udc_select_ep(ep);
412 	isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
413 
414 	if (ep->addr == 0) {
415 		/* When halting the control endpoint, stall both IN and OUT. */
416 		__isp1760_udc_select_ep(ep, USB_DIR_IN);
417 		isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
418 	} else if (!halt) {
419 		/* Reset the data PID by cycling the endpoint enable bit. */
420 		u16 eptype = isp1760_udc_read(udc, DC_EPTYPE);
421 
422 		isp1760_udc_write(udc, DC_EPTYPE, eptype & ~DC_EPENABLE);
423 		isp1760_udc_write(udc, DC_EPTYPE, eptype);
424 
425 		/*
426 		 * Disabling the endpoint emptied the transmit FIFO, fill it
427 		 * again if a request is pending.
428 		 *
429 		 * TODO: Does the gadget framework require synchronizatino with
430 		 * the TX IRQ handler ?
431 		 */
432 		if ((ep->addr & USB_DIR_IN) && !list_empty(&ep->queue)) {
433 			struct isp1760_request *req;
434 
435 			req = list_first_entry(&ep->queue,
436 					       struct isp1760_request, queue);
437 			isp1760_udc_transmit(ep, req);
438 		}
439 	}
440 
441 	ep->halted = halt;
442 
443 	return 0;
444 }
445 
446 /* -----------------------------------------------------------------------------
447  * Control Endpoint
448  */
449 
450 static int isp1760_udc_get_status(struct isp1760_udc *udc,
451 				  const struct usb_ctrlrequest *req)
452 {
453 	struct isp1760_ep *ep;
454 	u16 status;
455 
456 	if (req->wLength != cpu_to_le16(2) || req->wValue != cpu_to_le16(0))
457 		return -EINVAL;
458 
459 	switch (req->bRequestType) {
460 	case USB_DIR_IN | USB_RECIP_DEVICE:
461 		status = udc->devstatus;
462 		break;
463 
464 	case USB_DIR_IN | USB_RECIP_INTERFACE:
465 		status = 0;
466 		break;
467 
468 	case USB_DIR_IN | USB_RECIP_ENDPOINT:
469 		ep = isp1760_udc_find_ep(udc, le16_to_cpu(req->wIndex));
470 		if (!ep)
471 			return -EINVAL;
472 
473 		status = 0;
474 		if (ep->halted)
475 			status |= 1 << USB_ENDPOINT_HALT;
476 		break;
477 
478 	default:
479 		return -EINVAL;
480 	}
481 
482 	isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) | DC_EPDIR);
483 	isp1760_udc_write(udc, DC_BUFLEN, 2);
484 
485 	writew(cpu_to_le16(status), udc->regs + DC_DATAPORT);
486 
487 	isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
488 
489 	dev_dbg(udc->isp->dev, "%s: status 0x%04x\n", __func__, status);
490 
491 	return 0;
492 }
493 
494 static int isp1760_udc_set_address(struct isp1760_udc *udc, u16 addr)
495 {
496 	if (addr > 127) {
497 		dev_dbg(udc->isp->dev, "invalid device address %u\n", addr);
498 		return -EINVAL;
499 	}
500 
501 	if (udc->gadget.state != USB_STATE_DEFAULT &&
502 	    udc->gadget.state != USB_STATE_ADDRESS) {
503 		dev_dbg(udc->isp->dev, "can't set address in state %u\n",
504 			udc->gadget.state);
505 		return -EINVAL;
506 	}
507 
508 	usb_gadget_set_state(&udc->gadget, addr ? USB_STATE_ADDRESS :
509 			     USB_STATE_DEFAULT);
510 
511 	isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN | addr);
512 
513 	spin_lock(&udc->lock);
514 	isp1760_udc_ctrl_send_status(&udc->ep[0], USB_DIR_OUT);
515 	spin_unlock(&udc->lock);
516 
517 	return 0;
518 }
519 
520 static bool isp1760_ep0_setup_standard(struct isp1760_udc *udc,
521 				       struct usb_ctrlrequest *req)
522 {
523 	bool stall;
524 
525 	switch (req->bRequest) {
526 	case USB_REQ_GET_STATUS:
527 		return isp1760_udc_get_status(udc, req);
528 
529 	case USB_REQ_CLEAR_FEATURE:
530 		switch (req->bRequestType) {
531 		case USB_DIR_OUT | USB_RECIP_DEVICE: {
532 			/* TODO: Handle remote wakeup feature. */
533 			return true;
534 		}
535 
536 		case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
537 			u16 index = le16_to_cpu(req->wIndex);
538 			struct isp1760_ep *ep;
539 
540 			if (req->wLength != cpu_to_le16(0) ||
541 			    req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
542 				return true;
543 
544 			ep = isp1760_udc_find_ep(udc, index);
545 			if (!ep)
546 				return true;
547 
548 			spin_lock(&udc->lock);
549 
550 			/*
551 			 * If the endpoint is wedged only the gadget can clear
552 			 * the halt feature. Pretend success in that case, but
553 			 * keep the endpoint halted.
554 			 */
555 			if (!ep->wedged)
556 				stall = __isp1760_udc_set_halt(ep, false);
557 			else
558 				stall = false;
559 
560 			if (!stall)
561 				isp1760_udc_ctrl_send_status(&udc->ep[0],
562 							     USB_DIR_OUT);
563 
564 			spin_unlock(&udc->lock);
565 			return stall;
566 		}
567 
568 		default:
569 			return true;
570 		}
571 		break;
572 
573 	case USB_REQ_SET_FEATURE:
574 		switch (req->bRequestType) {
575 		case USB_DIR_OUT | USB_RECIP_DEVICE: {
576 			/* TODO: Handle remote wakeup and test mode features */
577 			return true;
578 		}
579 
580 		case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
581 			u16 index = le16_to_cpu(req->wIndex);
582 			struct isp1760_ep *ep;
583 
584 			if (req->wLength != cpu_to_le16(0) ||
585 			    req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
586 				return true;
587 
588 			ep = isp1760_udc_find_ep(udc, index);
589 			if (!ep)
590 				return true;
591 
592 			spin_lock(&udc->lock);
593 
594 			stall = __isp1760_udc_set_halt(ep, true);
595 			if (!stall)
596 				isp1760_udc_ctrl_send_status(&udc->ep[0],
597 							     USB_DIR_OUT);
598 
599 			spin_unlock(&udc->lock);
600 			return stall;
601 		}
602 
603 		default:
604 			return true;
605 		}
606 		break;
607 
608 	case USB_REQ_SET_ADDRESS:
609 		if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
610 			return true;
611 
612 		return isp1760_udc_set_address(udc, le16_to_cpu(req->wValue));
613 
614 	case USB_REQ_SET_CONFIGURATION:
615 		if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
616 			return true;
617 
618 		if (udc->gadget.state != USB_STATE_ADDRESS &&
619 		    udc->gadget.state != USB_STATE_CONFIGURED)
620 			return true;
621 
622 		stall = udc->driver->setup(&udc->gadget, req) < 0;
623 		if (stall)
624 			return true;
625 
626 		usb_gadget_set_state(&udc->gadget, req->wValue ?
627 				     USB_STATE_CONFIGURED : USB_STATE_ADDRESS);
628 
629 		/*
630 		 * SET_CONFIGURATION (and SET_INTERFACE) must reset the halt
631 		 * feature on all endpoints. There is however no need to do so
632 		 * explicitly here as the gadget driver will disable and
633 		 * reenable endpoints, clearing the halt feature.
634 		 */
635 		return false;
636 
637 	default:
638 		return udc->driver->setup(&udc->gadget, req) < 0;
639 	}
640 }
641 
642 static void isp1760_ep0_setup(struct isp1760_udc *udc)
643 {
644 	union {
645 		struct usb_ctrlrequest r;
646 		u32 data[2];
647 	} req;
648 	unsigned int count;
649 	bool stall = false;
650 
651 	spin_lock(&udc->lock);
652 
653 	isp1760_udc_write(udc, DC_EPINDEX, DC_EP0SETUP);
654 
655 	count = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
656 	if (count != sizeof(req)) {
657 		spin_unlock(&udc->lock);
658 
659 		dev_err(udc->isp->dev, "invalid length %u for setup packet\n",
660 			count);
661 
662 		isp1760_udc_ctrl_send_stall(&udc->ep[0]);
663 		return;
664 	}
665 
666 	req.data[0] = isp1760_udc_read(udc, DC_DATAPORT);
667 	req.data[1] = isp1760_udc_read(udc, DC_DATAPORT);
668 
669 	if (udc->ep0_state != ISP1760_CTRL_SETUP) {
670 		spin_unlock(&udc->lock);
671 		dev_dbg(udc->isp->dev, "unexpected SETUP packet\n");
672 		return;
673 	}
674 
675 	/* Move to the data stage. */
676 	if (!req.r.wLength)
677 		udc->ep0_state = ISP1760_CTRL_STATUS;
678 	else if (req.r.bRequestType & USB_DIR_IN)
679 		udc->ep0_state = ISP1760_CTRL_DATA_IN;
680 	else
681 		udc->ep0_state = ISP1760_CTRL_DATA_OUT;
682 
683 	udc->ep0_dir = req.r.bRequestType & USB_DIR_IN;
684 	udc->ep0_length = le16_to_cpu(req.r.wLength);
685 
686 	spin_unlock(&udc->lock);
687 
688 	dev_dbg(udc->isp->dev,
689 		"%s: bRequestType 0x%02x bRequest 0x%02x wValue 0x%04x wIndex 0x%04x wLength 0x%04x\n",
690 		__func__, req.r.bRequestType, req.r.bRequest,
691 		le16_to_cpu(req.r.wValue), le16_to_cpu(req.r.wIndex),
692 		le16_to_cpu(req.r.wLength));
693 
694 	if ((req.r.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
695 		stall = isp1760_ep0_setup_standard(udc, &req.r);
696 	else
697 		stall = udc->driver->setup(&udc->gadget, &req.r) < 0;
698 
699 	if (stall)
700 		isp1760_udc_ctrl_send_stall(&udc->ep[0]);
701 }
702 
703 /* -----------------------------------------------------------------------------
704  * Gadget Endpoint Operations
705  */
706 
707 static int isp1760_ep_enable(struct usb_ep *ep,
708 			     const struct usb_endpoint_descriptor *desc)
709 {
710 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
711 	struct isp1760_udc *udc = uep->udc;
712 	unsigned long flags;
713 	unsigned int type;
714 
715 	dev_dbg(uep->udc->isp->dev, "%s\n", __func__);
716 
717 	/*
718 	 * Validate the descriptor. The control endpoint can't be enabled
719 	 * manually.
720 	 */
721 	if (desc->bDescriptorType != USB_DT_ENDPOINT ||
722 	    desc->bEndpointAddress == 0 ||
723 	    desc->bEndpointAddress != uep->addr ||
724 	    le16_to_cpu(desc->wMaxPacketSize) > ep->maxpacket) {
725 		dev_dbg(udc->isp->dev,
726 			"%s: invalid descriptor type %u addr %02x ep addr %02x max packet size %u/%u\n",
727 			__func__, desc->bDescriptorType,
728 			desc->bEndpointAddress, uep->addr,
729 			le16_to_cpu(desc->wMaxPacketSize), ep->maxpacket);
730 		return -EINVAL;
731 	}
732 
733 	switch (usb_endpoint_type(desc)) {
734 	case USB_ENDPOINT_XFER_ISOC:
735 		type = DC_ENDPTYP_ISOC;
736 		break;
737 	case USB_ENDPOINT_XFER_BULK:
738 		type = DC_ENDPTYP_BULK;
739 		break;
740 	case USB_ENDPOINT_XFER_INT:
741 		type = DC_ENDPTYP_INTERRUPT;
742 		break;
743 	case USB_ENDPOINT_XFER_CONTROL:
744 	default:
745 		dev_dbg(udc->isp->dev, "%s: control endpoints unsupported\n",
746 			__func__);
747 		return -EINVAL;
748 	}
749 
750 	spin_lock_irqsave(&udc->lock, flags);
751 
752 	uep->desc = desc;
753 	uep->maxpacket = le16_to_cpu(desc->wMaxPacketSize);
754 	uep->rx_pending = false;
755 	uep->halted = false;
756 	uep->wedged = false;
757 
758 	isp1760_udc_select_ep(uep);
759 	isp1760_udc_write(udc, DC_EPMAXPKTSZ, uep->maxpacket);
760 	isp1760_udc_write(udc, DC_BUFLEN, uep->maxpacket);
761 	isp1760_udc_write(udc, DC_EPTYPE, DC_EPENABLE | type);
762 
763 	spin_unlock_irqrestore(&udc->lock, flags);
764 
765 	return 0;
766 }
767 
768 static int isp1760_ep_disable(struct usb_ep *ep)
769 {
770 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
771 	struct isp1760_udc *udc = uep->udc;
772 	struct isp1760_request *req, *nreq;
773 	LIST_HEAD(req_list);
774 	unsigned long flags;
775 
776 	dev_dbg(udc->isp->dev, "%s\n", __func__);
777 
778 	spin_lock_irqsave(&udc->lock, flags);
779 
780 	if (!uep->desc) {
781 		dev_dbg(udc->isp->dev, "%s: endpoint not enabled\n", __func__);
782 		spin_unlock_irqrestore(&udc->lock, flags);
783 		return -EINVAL;
784 	}
785 
786 	uep->desc = NULL;
787 	uep->maxpacket = 0;
788 
789 	isp1760_udc_select_ep(uep);
790 	isp1760_udc_write(udc, DC_EPTYPE, 0);
791 
792 	/* TODO Synchronize with the IRQ handler */
793 
794 	list_splice_init(&uep->queue, &req_list);
795 
796 	spin_unlock_irqrestore(&udc->lock, flags);
797 
798 	list_for_each_entry_safe(req, nreq, &req_list, queue) {
799 		list_del(&req->queue);
800 		isp1760_udc_request_complete(uep, req, -ESHUTDOWN);
801 	}
802 
803 	return 0;
804 }
805 
806 static struct usb_request *isp1760_ep_alloc_request(struct usb_ep *ep,
807 						    gfp_t gfp_flags)
808 {
809 	struct isp1760_request *req;
810 
811 	req = kzalloc(sizeof(*req), gfp_flags);
812 	if (!req)
813 		return NULL;
814 
815 	return &req->req;
816 }
817 
818 static void isp1760_ep_free_request(struct usb_ep *ep, struct usb_request *_req)
819 {
820 	struct isp1760_request *req = req_to_udc_req(_req);
821 
822 	kfree(req);
823 }
824 
825 static int isp1760_ep_queue(struct usb_ep *ep, struct usb_request *_req,
826 			    gfp_t gfp_flags)
827 {
828 	struct isp1760_request *req = req_to_udc_req(_req);
829 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
830 	struct isp1760_udc *udc = uep->udc;
831 	bool complete = false;
832 	unsigned long flags;
833 	int ret = 0;
834 
835 	_req->status = -EINPROGRESS;
836 	_req->actual = 0;
837 
838 	spin_lock_irqsave(&udc->lock, flags);
839 
840 	dev_dbg(udc->isp->dev,
841 		"%s: req %p (%u bytes%s) ep %p(0x%02x)\n", __func__, _req,
842 		_req->length, _req->zero ? " (zlp)" : "", uep, uep->addr);
843 
844 	req->ep = uep;
845 
846 	if (uep->addr == 0) {
847 		if (_req->length != udc->ep0_length &&
848 		    udc->ep0_state != ISP1760_CTRL_DATA_IN) {
849 			dev_dbg(udc->isp->dev,
850 				"%s: invalid length %u for req %p\n",
851 				__func__, _req->length, req);
852 			ret = -EINVAL;
853 			goto done;
854 		}
855 
856 		switch (udc->ep0_state) {
857 		case ISP1760_CTRL_DATA_IN:
858 			dev_dbg(udc->isp->dev, "%s: transmitting req %p\n",
859 				__func__, req);
860 
861 			list_add_tail(&req->queue, &uep->queue);
862 			isp1760_udc_transmit(uep, req);
863 			break;
864 
865 		case ISP1760_CTRL_DATA_OUT:
866 			list_add_tail(&req->queue, &uep->queue);
867 			__isp1760_udc_select_ep(uep, USB_DIR_OUT);
868 			isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
869 			break;
870 
871 		case ISP1760_CTRL_STATUS:
872 			complete = true;
873 			break;
874 
875 		default:
876 			dev_dbg(udc->isp->dev, "%s: invalid ep0 state\n",
877 				__func__);
878 			ret = -EINVAL;
879 			break;
880 		}
881 	} else if (uep->desc) {
882 		bool empty = list_empty(&uep->queue);
883 
884 		list_add_tail(&req->queue, &uep->queue);
885 		if ((uep->addr & USB_DIR_IN) && !uep->halted && empty)
886 			isp1760_udc_transmit(uep, req);
887 		else if (!(uep->addr & USB_DIR_IN) && uep->rx_pending)
888 			complete = isp1760_udc_receive(uep, req);
889 	} else {
890 		dev_dbg(udc->isp->dev,
891 			"%s: can't queue request to disabled ep%02x\n",
892 			__func__, uep->addr);
893 		ret = -ESHUTDOWN;
894 	}
895 
896 done:
897 	if (ret < 0)
898 		req->ep = NULL;
899 
900 	spin_unlock_irqrestore(&udc->lock, flags);
901 
902 	if (complete)
903 		isp1760_udc_request_complete(uep, req, 0);
904 
905 	return ret;
906 }
907 
908 static int isp1760_ep_dequeue(struct usb_ep *ep, struct usb_request *_req)
909 {
910 	struct isp1760_request *req = req_to_udc_req(_req);
911 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
912 	struct isp1760_udc *udc = uep->udc;
913 	unsigned long flags;
914 
915 	dev_dbg(uep->udc->isp->dev, "%s(ep%02x)\n", __func__, uep->addr);
916 
917 	spin_lock_irqsave(&udc->lock, flags);
918 
919 	if (req->ep != uep)
920 		req = NULL;
921 	else
922 		list_del(&req->queue);
923 
924 	spin_unlock_irqrestore(&udc->lock, flags);
925 
926 	if (!req)
927 		return -EINVAL;
928 
929 	isp1760_udc_request_complete(uep, req, -ECONNRESET);
930 	return 0;
931 }
932 
933 static int __isp1760_ep_set_halt(struct isp1760_ep *uep, bool stall, bool wedge)
934 {
935 	struct isp1760_udc *udc = uep->udc;
936 	int ret;
937 
938 	if (!uep->addr) {
939 		/*
940 		 * Halting the control endpoint is only valid as a delayed error
941 		 * response to a SETUP packet. Make sure EP0 is in the right
942 		 * stage and that the gadget isn't trying to clear the halt
943 		 * condition.
944 		 */
945 		if (WARN_ON(udc->ep0_state == ISP1760_CTRL_SETUP || !stall ||
946 			     wedge)) {
947 			return -EINVAL;
948 		}
949 	}
950 
951 	if (uep->addr && !uep->desc) {
952 		dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
953 			uep->addr);
954 		return -EINVAL;
955 	}
956 
957 	if (uep->addr & USB_DIR_IN) {
958 		/* Refuse to halt IN endpoints with active transfers. */
959 		if (!list_empty(&uep->queue)) {
960 			dev_dbg(udc->isp->dev,
961 				"%s: ep%02x has request pending\n", __func__,
962 				uep->addr);
963 			return -EAGAIN;
964 		}
965 	}
966 
967 	ret = __isp1760_udc_set_halt(uep, stall);
968 	if (ret < 0)
969 		return ret;
970 
971 	if (!uep->addr) {
972 		/*
973 		 * Stalling EP0 completes the control transaction, move back to
974 		 * the SETUP state.
975 		 */
976 		udc->ep0_state = ISP1760_CTRL_SETUP;
977 		return 0;
978 	}
979 
980 	if (wedge)
981 		uep->wedged = true;
982 	else if (!stall)
983 		uep->wedged = false;
984 
985 	return 0;
986 }
987 
988 static int isp1760_ep_set_halt(struct usb_ep *ep, int value)
989 {
990 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
991 	unsigned long flags;
992 	int ret;
993 
994 	dev_dbg(uep->udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
995 		value ? "set" : "clear", uep->addr);
996 
997 	spin_lock_irqsave(&uep->udc->lock, flags);
998 	ret = __isp1760_ep_set_halt(uep, value, false);
999 	spin_unlock_irqrestore(&uep->udc->lock, flags);
1000 
1001 	return ret;
1002 }
1003 
1004 static int isp1760_ep_set_wedge(struct usb_ep *ep)
1005 {
1006 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
1007 	unsigned long flags;
1008 	int ret;
1009 
1010 	dev_dbg(uep->udc->isp->dev, "%s: set wedge on ep%02x)\n", __func__,
1011 		uep->addr);
1012 
1013 	spin_lock_irqsave(&uep->udc->lock, flags);
1014 	ret = __isp1760_ep_set_halt(uep, true, true);
1015 	spin_unlock_irqrestore(&uep->udc->lock, flags);
1016 
1017 	return ret;
1018 }
1019 
1020 static void isp1760_ep_fifo_flush(struct usb_ep *ep)
1021 {
1022 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
1023 	struct isp1760_udc *udc = uep->udc;
1024 	unsigned long flags;
1025 
1026 	spin_lock_irqsave(&udc->lock, flags);
1027 
1028 	isp1760_udc_select_ep(uep);
1029 
1030 	/*
1031 	 * Set the CLBUF bit twice to flush both buffers in case double
1032 	 * buffering is enabled.
1033 	 */
1034 	isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1035 	isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1036 
1037 	spin_unlock_irqrestore(&udc->lock, flags);
1038 }
1039 
1040 static const struct usb_ep_ops isp1760_ep_ops = {
1041 	.enable = isp1760_ep_enable,
1042 	.disable = isp1760_ep_disable,
1043 	.alloc_request = isp1760_ep_alloc_request,
1044 	.free_request = isp1760_ep_free_request,
1045 	.queue = isp1760_ep_queue,
1046 	.dequeue = isp1760_ep_dequeue,
1047 	.set_halt = isp1760_ep_set_halt,
1048 	.set_wedge = isp1760_ep_set_wedge,
1049 	.fifo_flush = isp1760_ep_fifo_flush,
1050 };
1051 
1052 /* -----------------------------------------------------------------------------
1053  * Device States
1054  */
1055 
1056 /* Called with the UDC spinlock held. */
1057 static void isp1760_udc_connect(struct isp1760_udc *udc)
1058 {
1059 	usb_gadget_set_state(&udc->gadget, USB_STATE_POWERED);
1060 	mod_timer(&udc->vbus_timer, jiffies + ISP1760_VBUS_POLL_INTERVAL);
1061 }
1062 
1063 /* Called with the UDC spinlock held. */
1064 static void isp1760_udc_disconnect(struct isp1760_udc *udc)
1065 {
1066 	if (udc->gadget.state < USB_STATE_POWERED)
1067 		return;
1068 
1069 	dev_dbg(udc->isp->dev, "Device disconnected in state %u\n",
1070 		 udc->gadget.state);
1071 
1072 	udc->gadget.speed = USB_SPEED_UNKNOWN;
1073 	usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1074 
1075 	if (udc->driver->disconnect)
1076 		udc->driver->disconnect(&udc->gadget);
1077 
1078 	del_timer(&udc->vbus_timer);
1079 
1080 	/* TODO Reset all endpoints ? */
1081 }
1082 
1083 static void isp1760_udc_init_hw(struct isp1760_udc *udc)
1084 {
1085 	/*
1086 	 * The device controller currently shares its interrupt with the host
1087 	 * controller, the DC_IRQ polarity and signaling mode are ignored. Set
1088 	 * the to active-low level-triggered.
1089 	 *
1090 	 * Configure the control, in and out pipes to generate interrupts on
1091 	 * ACK tokens only (and NYET for the out pipe). The default
1092 	 * configuration also generates an interrupt on the first NACK token.
1093 	 */
1094 	isp1760_udc_write(udc, DC_INTCONF, DC_CDBGMOD_ACK | DC_DDBGMODIN_ACK |
1095 			  DC_DDBGMODOUT_ACK_NYET);
1096 
1097 	isp1760_udc_write(udc, DC_INTENABLE, DC_IEPRXTX(7) | DC_IEPRXTX(6) |
1098 			  DC_IEPRXTX(5) | DC_IEPRXTX(4) | DC_IEPRXTX(3) |
1099 			  DC_IEPRXTX(2) | DC_IEPRXTX(1) | DC_IEPRXTX(0) |
1100 			  DC_IEP0SETUP | DC_IEVBUS | DC_IERESM | DC_IESUSP |
1101 			  DC_IEHS_STA | DC_IEBRST);
1102 
1103 	if (udc->connected)
1104 		isp1760_set_pullup(udc->isp, true);
1105 
1106 	isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN);
1107 }
1108 
1109 static void isp1760_udc_reset(struct isp1760_udc *udc)
1110 {
1111 	unsigned long flags;
1112 
1113 	spin_lock_irqsave(&udc->lock, flags);
1114 
1115 	/*
1116 	 * The bus reset has reset most registers to their default value,
1117 	 * reinitialize the UDC hardware.
1118 	 */
1119 	isp1760_udc_init_hw(udc);
1120 
1121 	udc->ep0_state = ISP1760_CTRL_SETUP;
1122 	udc->gadget.speed = USB_SPEED_FULL;
1123 
1124 	usb_gadget_udc_reset(&udc->gadget, udc->driver);
1125 
1126 	spin_unlock_irqrestore(&udc->lock, flags);
1127 }
1128 
1129 static void isp1760_udc_suspend(struct isp1760_udc *udc)
1130 {
1131 	if (udc->gadget.state < USB_STATE_DEFAULT)
1132 		return;
1133 
1134 	if (udc->driver->suspend)
1135 		udc->driver->suspend(&udc->gadget);
1136 }
1137 
1138 static void isp1760_udc_resume(struct isp1760_udc *udc)
1139 {
1140 	if (udc->gadget.state < USB_STATE_DEFAULT)
1141 		return;
1142 
1143 	if (udc->driver->resume)
1144 		udc->driver->resume(&udc->gadget);
1145 }
1146 
1147 /* -----------------------------------------------------------------------------
1148  * Gadget Operations
1149  */
1150 
1151 static int isp1760_udc_get_frame(struct usb_gadget *gadget)
1152 {
1153 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1154 
1155 	return isp1760_udc_read(udc, DC_FRAMENUM) & ((1 << 11) - 1);
1156 }
1157 
1158 static int isp1760_udc_wakeup(struct usb_gadget *gadget)
1159 {
1160 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1161 
1162 	dev_dbg(udc->isp->dev, "%s\n", __func__);
1163 	return -ENOTSUPP;
1164 }
1165 
1166 static int isp1760_udc_set_selfpowered(struct usb_gadget *gadget,
1167 				       int is_selfpowered)
1168 {
1169 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1170 
1171 	if (is_selfpowered)
1172 		udc->devstatus |= 1 << USB_DEVICE_SELF_POWERED;
1173 	else
1174 		udc->devstatus &= ~(1 << USB_DEVICE_SELF_POWERED);
1175 
1176 	return 0;
1177 }
1178 
1179 static int isp1760_udc_pullup(struct usb_gadget *gadget, int is_on)
1180 {
1181 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1182 
1183 	isp1760_set_pullup(udc->isp, is_on);
1184 	udc->connected = is_on;
1185 
1186 	return 0;
1187 }
1188 
1189 static int isp1760_udc_start(struct usb_gadget *gadget,
1190 			     struct usb_gadget_driver *driver)
1191 {
1192 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1193 	unsigned long flags;
1194 
1195 	/* The hardware doesn't support low speed. */
1196 	if (driver->max_speed < USB_SPEED_FULL) {
1197 		dev_err(udc->isp->dev, "Invalid gadget driver\n");
1198 		return -EINVAL;
1199 	}
1200 
1201 	spin_lock_irqsave(&udc->lock, flags);
1202 
1203 	if (udc->driver) {
1204 		dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
1205 		spin_unlock_irqrestore(&udc->lock, flags);
1206 		return -EBUSY;
1207 	}
1208 
1209 	udc->driver = driver;
1210 
1211 	spin_unlock_irqrestore(&udc->lock, flags);
1212 
1213 	dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
1214 		driver->function);
1215 
1216 	udc->devstatus = 0;
1217 	udc->connected = true;
1218 
1219 	usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1220 
1221 	/* DMA isn't supported yet, don't enable the DMA clock. */
1222 	isp1760_udc_write(udc, DC_MODE, DC_GLINTENA);
1223 
1224 	isp1760_udc_init_hw(udc);
1225 
1226 	dev_dbg(udc->isp->dev, "UDC started with driver %s\n",
1227 		driver->function);
1228 
1229 	return 0;
1230 }
1231 
1232 static int isp1760_udc_stop(struct usb_gadget *gadget)
1233 {
1234 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1235 	unsigned long flags;
1236 
1237 	dev_dbg(udc->isp->dev, "%s\n", __func__);
1238 
1239 	del_timer_sync(&udc->vbus_timer);
1240 
1241 	isp1760_udc_write(udc, DC_MODE, 0);
1242 
1243 	spin_lock_irqsave(&udc->lock, flags);
1244 	udc->driver = NULL;
1245 	spin_unlock_irqrestore(&udc->lock, flags);
1246 
1247 	return 0;
1248 }
1249 
1250 static const struct usb_gadget_ops isp1760_udc_ops = {
1251 	.get_frame = isp1760_udc_get_frame,
1252 	.wakeup = isp1760_udc_wakeup,
1253 	.set_selfpowered = isp1760_udc_set_selfpowered,
1254 	.pullup = isp1760_udc_pullup,
1255 	.udc_start = isp1760_udc_start,
1256 	.udc_stop = isp1760_udc_stop,
1257 };
1258 
1259 /* -----------------------------------------------------------------------------
1260  * Interrupt Handling
1261  */
1262 
1263 static irqreturn_t isp1760_udc_irq(int irq, void *dev)
1264 {
1265 	struct isp1760_udc *udc = dev;
1266 	unsigned int i;
1267 	u32 status;
1268 
1269 	status = isp1760_udc_read(udc, DC_INTERRUPT)
1270 	       & isp1760_udc_read(udc, DC_INTENABLE);
1271 	isp1760_udc_write(udc, DC_INTERRUPT, status);
1272 
1273 	if (status & DC_IEVBUS) {
1274 		dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
1275 		/* The VBUS interrupt is only triggered when VBUS appears. */
1276 		spin_lock(&udc->lock);
1277 		isp1760_udc_connect(udc);
1278 		spin_unlock(&udc->lock);
1279 	}
1280 
1281 	if (status & DC_IEBRST) {
1282 		dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
1283 
1284 		isp1760_udc_reset(udc);
1285 	}
1286 
1287 	for (i = 0; i <= 7; ++i) {
1288 		struct isp1760_ep *ep = &udc->ep[i*2];
1289 
1290 		if (status & DC_IEPTX(i)) {
1291 			dev_dbg(udc->isp->dev, "%s(EPTX%u)\n", __func__, i);
1292 			isp1760_ep_tx_complete(ep);
1293 		}
1294 
1295 		if (status & DC_IEPRX(i)) {
1296 			dev_dbg(udc->isp->dev, "%s(EPRX%u)\n", __func__, i);
1297 			isp1760_ep_rx_ready(i ? ep - 1 : ep);
1298 		}
1299 	}
1300 
1301 	if (status & DC_IEP0SETUP) {
1302 		dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
1303 
1304 		isp1760_ep0_setup(udc);
1305 	}
1306 
1307 	if (status & DC_IERESM) {
1308 		dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
1309 		isp1760_udc_resume(udc);
1310 	}
1311 
1312 	if (status & DC_IESUSP) {
1313 		dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
1314 
1315 		spin_lock(&udc->lock);
1316 		if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1317 			isp1760_udc_disconnect(udc);
1318 		else
1319 			isp1760_udc_suspend(udc);
1320 		spin_unlock(&udc->lock);
1321 	}
1322 
1323 	if (status & DC_IEHS_STA) {
1324 		dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
1325 		udc->gadget.speed = USB_SPEED_HIGH;
1326 	}
1327 
1328 	return status ? IRQ_HANDLED : IRQ_NONE;
1329 }
1330 
1331 static void isp1760_udc_vbus_poll(struct timer_list *t)
1332 {
1333 	struct isp1760_udc *udc = from_timer(udc, t, vbus_timer);
1334 	unsigned long flags;
1335 
1336 	spin_lock_irqsave(&udc->lock, flags);
1337 
1338 	if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1339 		isp1760_udc_disconnect(udc);
1340 	else if (udc->gadget.state >= USB_STATE_POWERED)
1341 		mod_timer(&udc->vbus_timer,
1342 			  jiffies + ISP1760_VBUS_POLL_INTERVAL);
1343 
1344 	spin_unlock_irqrestore(&udc->lock, flags);
1345 }
1346 
1347 /* -----------------------------------------------------------------------------
1348  * Registration
1349  */
1350 
1351 static void isp1760_udc_init_eps(struct isp1760_udc *udc)
1352 {
1353 	unsigned int i;
1354 
1355 	INIT_LIST_HEAD(&udc->gadget.ep_list);
1356 
1357 	for (i = 0; i < ARRAY_SIZE(udc->ep); ++i) {
1358 		struct isp1760_ep *ep = &udc->ep[i];
1359 		unsigned int ep_num = (i + 1) / 2;
1360 		bool is_in = !(i & 1);
1361 
1362 		ep->udc = udc;
1363 
1364 		INIT_LIST_HEAD(&ep->queue);
1365 
1366 		ep->addr = (ep_num && is_in ? USB_DIR_IN : USB_DIR_OUT)
1367 			 | ep_num;
1368 		ep->desc = NULL;
1369 
1370 		sprintf(ep->name, "ep%u%s", ep_num,
1371 			ep_num ? (is_in ? "in" : "out") : "");
1372 
1373 		ep->ep.ops = &isp1760_ep_ops;
1374 		ep->ep.name = ep->name;
1375 
1376 		/*
1377 		 * Hardcode the maximum packet sizes for now, to 64 bytes for
1378 		 * the control endpoint and 512 bytes for all other endpoints.
1379 		 * This fits in the 8kB FIFO without double-buffering.
1380 		 */
1381 		if (ep_num == 0) {
1382 			usb_ep_set_maxpacket_limit(&ep->ep, 64);
1383 			ep->ep.caps.type_control = true;
1384 			ep->ep.caps.dir_in = true;
1385 			ep->ep.caps.dir_out = true;
1386 			ep->maxpacket = 64;
1387 			udc->gadget.ep0 = &ep->ep;
1388 		} else {
1389 			usb_ep_set_maxpacket_limit(&ep->ep, 512);
1390 			ep->ep.caps.type_iso = true;
1391 			ep->ep.caps.type_bulk = true;
1392 			ep->ep.caps.type_int = true;
1393 			ep->maxpacket = 0;
1394 			list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
1395 		}
1396 
1397 		if (is_in)
1398 			ep->ep.caps.dir_in = true;
1399 		else
1400 			ep->ep.caps.dir_out = true;
1401 	}
1402 }
1403 
1404 static int isp1760_udc_init(struct isp1760_udc *udc)
1405 {
1406 	u16 scratch;
1407 	u32 chipid;
1408 
1409 	/*
1410 	 * Check that the controller is present by writing to the scratch
1411 	 * register, modifying the bus pattern by reading from the chip ID
1412 	 * register, and reading the scratch register value back. The chip ID
1413 	 * and scratch register contents must match the expected values.
1414 	 */
1415 	isp1760_udc_write(udc, DC_SCRATCH, 0xbabe);
1416 	chipid = isp1760_udc_read(udc, DC_CHIPID);
1417 	scratch = isp1760_udc_read(udc, DC_SCRATCH);
1418 
1419 	if (scratch != 0xbabe) {
1420 		dev_err(udc->isp->dev,
1421 			"udc: scratch test failed (0x%04x/0x%08x)\n",
1422 			scratch, chipid);
1423 		return -ENODEV;
1424 	}
1425 
1426 	if (chipid != 0x00011582 && chipid != 0x00158210) {
1427 		dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
1428 		return -ENODEV;
1429 	}
1430 
1431 	/* Reset the device controller. */
1432 	isp1760_udc_write(udc, DC_MODE, DC_SFRESET);
1433 	usleep_range(10000, 11000);
1434 	isp1760_udc_write(udc, DC_MODE, 0);
1435 	usleep_range(10000, 11000);
1436 
1437 	return 0;
1438 }
1439 
1440 int isp1760_udc_register(struct isp1760_device *isp, int irq,
1441 			 unsigned long irqflags)
1442 {
1443 	struct isp1760_udc *udc = &isp->udc;
1444 	int ret;
1445 
1446 	udc->irq = -1;
1447 	udc->isp = isp;
1448 	udc->regs = isp->regs;
1449 
1450 	spin_lock_init(&udc->lock);
1451 	timer_setup(&udc->vbus_timer, isp1760_udc_vbus_poll, 0);
1452 
1453 	ret = isp1760_udc_init(udc);
1454 	if (ret < 0)
1455 		return ret;
1456 
1457 	udc->irqname = kasprintf(GFP_KERNEL, "%s (udc)", dev_name(isp->dev));
1458 	if (!udc->irqname)
1459 		return -ENOMEM;
1460 
1461 	ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
1462 			  udc->irqname, udc);
1463 	if (ret < 0)
1464 		goto error;
1465 
1466 	udc->irq = irq;
1467 
1468 	/*
1469 	 * Initialize the gadget static fields and register its device. Gadget
1470 	 * fields that vary during the life time of the gadget are initialized
1471 	 * by the UDC core.
1472 	 */
1473 	udc->gadget.ops = &isp1760_udc_ops;
1474 	udc->gadget.speed = USB_SPEED_UNKNOWN;
1475 	udc->gadget.max_speed = USB_SPEED_HIGH;
1476 	udc->gadget.name = "isp1761_udc";
1477 
1478 	isp1760_udc_init_eps(udc);
1479 
1480 	ret = usb_add_gadget_udc(isp->dev, &udc->gadget);
1481 	if (ret < 0)
1482 		goto error;
1483 
1484 	return 0;
1485 
1486 error:
1487 	if (udc->irq >= 0)
1488 		free_irq(udc->irq, udc);
1489 	kfree(udc->irqname);
1490 
1491 	return ret;
1492 }
1493 
1494 void isp1760_udc_unregister(struct isp1760_device *isp)
1495 {
1496 	struct isp1760_udc *udc = &isp->udc;
1497 
1498 	if (!udc->isp)
1499 		return;
1500 
1501 	usb_del_gadget_udc(&udc->gadget);
1502 
1503 	free_irq(udc->irq, udc);
1504 	kfree(udc->irqname);
1505 }
1506