1/*
2 * at91_udc -- driver for at91-series USB peripheral controller
3 *
4 * Copyright (C) 2004 by Thomas Rathbone
5 * Copyright (C) 2005 by HP Labs
6 * Copyright (C) 2005 by David Brownell
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the
20 * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
21 * Boston, MA  02111-1307, USA.
22 */
23
24#undef	DEBUG
25#undef	VERBOSE
26#undef	PACKET_TRACE
27
28#include <linux/kernel.h>
29#include <linux/module.h>
30#include <linux/platform_device.h>
31#include <linux/delay.h>
32#include <linux/ioport.h>
33#include <linux/slab.h>
34#include <linux/errno.h>
35#include <linux/init.h>
36#include <linux/list.h>
37#include <linux/interrupt.h>
38#include <linux/proc_fs.h>
39#include <linux/clk.h>
40#include <linux/usb/ch9.h>
41#include <linux/usb_gadget.h>
42
43#include <asm/byteorder.h>
44#include <asm/hardware.h>
45#include <asm/io.h>
46#include <asm/irq.h>
47#include <asm/system.h>
48#include <asm/mach-types.h>
49
50#include <asm/arch/gpio.h>
51#include <asm/arch/board.h>
52#include <asm/arch/cpu.h>
53#include <asm/arch/at91sam9261_matrix.h>
54
55#include "at91_udc.h"
56
57
58/*
59 * This controller is simple and PIO-only.  It's used in many AT91-series
60 * full speed USB controllers, including the at91rm9200 (arm920T, with MMU),
61 * at91sam926x (arm926ejs, with MMU), and several no-mmu versions.
62 *
63 * This driver expects the board has been wired with two GPIOs suppporting
64 * a VBUS sensing IRQ, and a D+ pullup.  (They may be omitted, but the
65 * testing hasn't covered such cases.)
66 *
67 * The pullup is most important (so it's integrated on sam926x parts).  It
68 * provides software control over whether the host enumerates the device.
69 *
70 * The VBUS sensing helps during enumeration, and allows both USB clocks
71 * (and the transceiver) to stay gated off until they're necessary, saving
72 * power.  During USB suspend, the 48 MHz clock is gated off in hardware;
73 * it may also be gated off by software during some Linux sleep states.
74 */
75
76#define	DRIVER_VERSION	"3 May 2006"
77
78static const char driver_name [] = "at91_udc";
79static const char ep0name[] = "ep0";
80
81
82#define at91_udp_read(dev, reg) \
83	__raw_readl((dev)->udp_baseaddr + (reg))
84#define at91_udp_write(dev, reg, val) \
85	__raw_writel((val), (dev)->udp_baseaddr + (reg))
86
87/*-------------------------------------------------------------------------*/
88
89#ifdef CONFIG_USB_GADGET_DEBUG_FILES
90
91#include <linux/seq_file.h>
92
93static const char debug_filename[] = "driver/udc";
94
95#define FOURBITS "%s%s%s%s"
96#define EIGHTBITS FOURBITS FOURBITS
97
98static void proc_ep_show(struct seq_file *s, struct at91_ep *ep)
99{
100	static char		*types[] = {
101		"control", "out-iso", "out-bulk", "out-int",
102		"BOGUS",   "in-iso",  "in-bulk",  "in-int"};
103
104	u32			csr;
105	struct at91_request	*req;
106	unsigned long	flags;
107
108	local_irq_save(flags);
109
110	csr = __raw_readl(ep->creg);
111
112	/* NOTE:  not collecting per-endpoint irq statistics... */
113
114	seq_printf(s, "\n");
115	seq_printf(s, "%s, maxpacket %d %s%s %s%s\n",
116			ep->ep.name, ep->ep.maxpacket,
117			ep->is_in ? "in" : "out",
118			ep->is_iso ? " iso" : "",
119			ep->is_pingpong
120				? (ep->fifo_bank ? "pong" : "ping")
121				: "",
122			ep->stopped ? " stopped" : "");
123	seq_printf(s, "csr %08x rxbytes=%d %s %s %s" EIGHTBITS "\n",
124		csr,
125		(csr & 0x07ff0000) >> 16,
126		(csr & (1 << 15)) ? "enabled" : "disabled",
127		(csr & (1 << 11)) ? "DATA1" : "DATA0",
128		types[(csr & 0x700) >> 8],
129
130		/* iff type is control then print current direction */
131		(!(csr & 0x700))
132			? ((csr & (1 << 7)) ? " IN" : " OUT")
133			: "",
134		(csr & (1 << 6)) ? " rxdatabk1" : "",
135		(csr & (1 << 5)) ? " forcestall" : "",
136		(csr & (1 << 4)) ? " txpktrdy" : "",
137
138		(csr & (1 << 3)) ? " stallsent" : "",
139		(csr & (1 << 2)) ? " rxsetup" : "",
140		(csr & (1 << 1)) ? " rxdatabk0" : "",
141		(csr & (1 << 0)) ? " txcomp" : "");
142	if (list_empty (&ep->queue))
143		seq_printf(s, "\t(queue empty)\n");
144
145	else list_for_each_entry (req, &ep->queue, queue) {
146		unsigned	length = req->req.actual;
147
148		seq_printf(s, "\treq %p len %d/%d buf %p\n",
149				&req->req, length,
150				req->req.length, req->req.buf);
151	}
152	local_irq_restore(flags);
153}
154
155static void proc_irq_show(struct seq_file *s, const char *label, u32 mask)
156{
157	int i;
158
159	seq_printf(s, "%s %04x:%s%s" FOURBITS, label, mask,
160		(mask & (1 << 13)) ? " wakeup" : "",
161		(mask & (1 << 12)) ? " endbusres" : "",
162
163		(mask & (1 << 11)) ? " sofint" : "",
164		(mask & (1 << 10)) ? " extrsm" : "",
165		(mask & (1 << 9)) ? " rxrsm" : "",
166		(mask & (1 << 8)) ? " rxsusp" : "");
167	for (i = 0; i < 8; i++) {
168		if (mask & (1 << i))
169			seq_printf(s, " ep%d", i);
170	}
171	seq_printf(s, "\n");
172}
173
174static int proc_udc_show(struct seq_file *s, void *unused)
175{
176	struct at91_udc	*udc = s->private;
177	struct at91_ep	*ep;
178	u32		tmp;
179
180	seq_printf(s, "%s: version %s\n", driver_name, DRIVER_VERSION);
181
182	seq_printf(s, "vbus %s, pullup %s, %s powered%s, gadget %s\n\n",
183		udc->vbus ? "present" : "off",
184		udc->enabled
185			? (udc->vbus ? "active" : "enabled")
186			: "disabled",
187		udc->selfpowered ? "self" : "VBUS",
188		udc->suspended ? ", suspended" : "",
189		udc->driver ? udc->driver->driver.name : "(none)");
190
191	/* don't access registers when interface isn't clocked */
192	if (!udc->clocked) {
193		seq_printf(s, "(not clocked)\n");
194		return 0;
195	}
196
197	tmp = at91_udp_read(udc, AT91_UDP_FRM_NUM);
198	seq_printf(s, "frame %05x:%s%s frame=%d\n", tmp,
199		(tmp & AT91_UDP_FRM_OK) ? " ok" : "",
200		(tmp & AT91_UDP_FRM_ERR) ? " err" : "",
201		(tmp & AT91_UDP_NUM));
202
203	tmp = at91_udp_read(udc, AT91_UDP_GLB_STAT);
204	seq_printf(s, "glbstate %02x:%s" FOURBITS "\n", tmp,
205		(tmp & AT91_UDP_RMWUPE) ? " rmwupe" : "",
206		(tmp & AT91_UDP_RSMINPR) ? " rsminpr" : "",
207		(tmp & AT91_UDP_ESR) ? " esr" : "",
208		(tmp & AT91_UDP_CONFG) ? " confg" : "",
209		(tmp & AT91_UDP_FADDEN) ? " fadden" : "");
210
211	tmp = at91_udp_read(udc, AT91_UDP_FADDR);
212	seq_printf(s, "faddr   %03x:%s fadd=%d\n", tmp,
213		(tmp & AT91_UDP_FEN) ? " fen" : "",
214		(tmp & AT91_UDP_FADD));
215
216	proc_irq_show(s, "imr   ", at91_udp_read(udc, AT91_UDP_IMR));
217	proc_irq_show(s, "isr   ", at91_udp_read(udc, AT91_UDP_ISR));
218
219	if (udc->enabled && udc->vbus) {
220		proc_ep_show(s, &udc->ep[0]);
221		list_for_each_entry (ep, &udc->gadget.ep_list, ep.ep_list) {
222			if (ep->desc)
223				proc_ep_show(s, ep);
224		}
225	}
226	return 0;
227}
228
229static int proc_udc_open(struct inode *inode, struct file *file)
230{
231	return single_open(file, proc_udc_show, PDE(inode)->data);
232}
233
234static const struct file_operations proc_ops = {
235	.open		= proc_udc_open,
236	.read		= seq_read,
237	.llseek		= seq_lseek,
238	.release	= single_release,
239};
240
241static void create_debug_file(struct at91_udc *udc)
242{
243	struct proc_dir_entry *pde;
244
245	pde = create_proc_entry (debug_filename, 0, NULL);
246	udc->pde = pde;
247	if (pde == NULL)
248		return;
249
250	pde->proc_fops = &proc_ops;
251	pde->data = udc;
252}
253
254static void remove_debug_file(struct at91_udc *udc)
255{
256	if (udc->pde)
257		remove_proc_entry(debug_filename, NULL);
258}
259
260#else
261
262static inline void create_debug_file(struct at91_udc *udc) {}
263static inline void remove_debug_file(struct at91_udc *udc) {}
264
265#endif
266
267
268/*-------------------------------------------------------------------------*/
269
270static void done(struct at91_ep *ep, struct at91_request *req, int status)
271{
272	unsigned	stopped = ep->stopped;
273	struct at91_udc	*udc = ep->udc;
274
275	list_del_init(&req->queue);
276	if (req->req.status == -EINPROGRESS)
277		req->req.status = status;
278	else
279		status = req->req.status;
280	if (status && status != -ESHUTDOWN)
281		VDBG("%s done %p, status %d\n", ep->ep.name, req, status);
282
283	ep->stopped = 1;
284	req->req.complete(&ep->ep, &req->req);
285	ep->stopped = stopped;
286
287	/* ep0 is always ready; other endpoints need a non-empty queue */
288	if (list_empty(&ep->queue) && ep->int_mask != (1 << 0))
289		at91_udp_write(udc, AT91_UDP_IDR, ep->int_mask);
290}
291
292/*-------------------------------------------------------------------------*/
293
294/* bits indicating OUT fifo has data ready */
295#define	RX_DATA_READY	(AT91_UDP_RX_DATA_BK0 | AT91_UDP_RX_DATA_BK1)
296
297/*
298 * Endpoint FIFO CSR bits have a mix of bits, making it unsafe to just write
299 * back most of the value you just read (because of side effects, including
300 * bits that may change after reading and before writing).
301 *
302 * Except when changing a specific bit, always write values which:
303 *  - clear SET_FX bits (setting them could change something)
304 *  - set CLR_FX bits (clearing them could change something)
305 *
306 * There are also state bits like FORCESTALL, EPEDS, DIR, and EPTYPE
307 * that shouldn't normally be changed.
308 *
309 * NOTE at91sam9260 docs mention synch between UDPCK and MCK clock domains,
310 * implying a need to wait for one write to complete (test relevant bits)
311 * before starting the next write.  This shouldn't be an issue given how
312 * infrequently we write, except maybe for write-then-read idioms.
313 */
314#define	SET_FX	(AT91_UDP_TXPKTRDY)
315#define	CLR_FX	(RX_DATA_READY | AT91_UDP_RXSETUP \
316		| AT91_UDP_STALLSENT | AT91_UDP_TXCOMP)
317
318/* pull OUT packet data from the endpoint's fifo */
319static int read_fifo (struct at91_ep *ep, struct at91_request *req)
320{
321	u32 __iomem	*creg = ep->creg;
322	u8 __iomem	*dreg = ep->creg + (AT91_UDP_FDR(0) - AT91_UDP_CSR(0));
323	u32		csr;
324	u8		*buf;
325	unsigned int	count, bufferspace, is_done;
326
327	buf = req->req.buf + req->req.actual;
328	bufferspace = req->req.length - req->req.actual;
329
330	/*
331	 * there might be nothing to read if ep_queue() calls us,
332	 * or if we already emptied both pingpong buffers
333	 */
334rescan:
335	csr = __raw_readl(creg);
336	if ((csr & RX_DATA_READY) == 0)
337		return 0;
338
339	count = (csr & AT91_UDP_RXBYTECNT) >> 16;
340	if (count > ep->ep.maxpacket)
341		count = ep->ep.maxpacket;
342	if (count > bufferspace) {
343		DBG("%s buffer overflow\n", ep->ep.name);
344		req->req.status = -EOVERFLOW;
345		count = bufferspace;
346	}
347	__raw_readsb(dreg, buf, count);
348
349	/* release and swap pingpong mem bank */
350	csr |= CLR_FX;
351	if (ep->is_pingpong) {
352		if (ep->fifo_bank == 0) {
353			csr &= ~(SET_FX | AT91_UDP_RX_DATA_BK0);
354			ep->fifo_bank = 1;
355		} else {
356			csr &= ~(SET_FX | AT91_UDP_RX_DATA_BK1);
357			ep->fifo_bank = 0;
358		}
359	} else
360		csr &= ~(SET_FX | AT91_UDP_RX_DATA_BK0);
361	__raw_writel(csr, creg);
362
363	req->req.actual += count;
364	is_done = (count < ep->ep.maxpacket);
365	if (count == bufferspace)
366		is_done = 1;
367
368	PACKET("%s %p out/%d%s\n", ep->ep.name, &req->req, count,
369			is_done ? " (done)" : "");
370
371	/*
372	 * avoid extra trips through IRQ logic for packets already in
373	 * the fifo ... maybe preventing an extra (expensive) OUT-NAK
374	 */
375	if (is_done)
376		done(ep, req, 0);
377	else if (ep->is_pingpong) {
378		bufferspace -= count;
379		buf += count;
380		goto rescan;
381	}
382
383	return is_done;
384}
385
386/* load fifo for an IN packet */
387static int write_fifo(struct at91_ep *ep, struct at91_request *req)
388{
389	u32 __iomem	*creg = ep->creg;
390	u32		csr = __raw_readl(creg);
391	u8 __iomem	*dreg = ep->creg + (AT91_UDP_FDR(0) - AT91_UDP_CSR(0));
392	unsigned	total, count, is_last;
393
394	/*
395	 * TODO: allow for writing two packets to the fifo ... that'll
396	 * reduce the amount of IN-NAKing, but probably won't affect
397	 * throughput much.  (Unlike preventing OUT-NAKing!)
398	 */
399
400	/*
401	 * If ep_queue() calls us, the queue is empty and possibly in
402	 * odd states like TXCOMP not yet cleared (we do it, saving at
403	 * least one IRQ) or the fifo not yet being free.  Those aren't
404	 * issues normally (IRQ handler fast path).
405	 */
406	if (unlikely(csr & (AT91_UDP_TXCOMP | AT91_UDP_TXPKTRDY))) {
407		if (csr & AT91_UDP_TXCOMP) {
408			csr |= CLR_FX;
409			csr &= ~(SET_FX | AT91_UDP_TXCOMP);
410			__raw_writel(csr, creg);
411			csr = __raw_readl(creg);
412		}
413		if (csr & AT91_UDP_TXPKTRDY)
414			return 0;
415	}
416
417	total = req->req.length - req->req.actual;
418	if (ep->ep.maxpacket < total) {
419		count = ep->ep.maxpacket;
420		is_last = 0;
421	} else {
422		count = total;
423		is_last = (count < ep->ep.maxpacket) || !req->req.zero;
424	}
425
426	/*
427	 * Write the packet, maybe it's a ZLP.
428	 *
429	 * NOTE:  incrementing req->actual before we receive the ACK means
430	 * gadget driver IN bytecounts can be wrong in fault cases.  That's
431	 * fixable with PIO drivers like this one (save "count" here, and
432	 * do the increment later on TX irq), but not for most DMA hardware.
433	 *
434	 * So all gadget drivers must accept that potential error.  Some
435	 * hardware supports precise fifo status reporting, letting them
436	 * recover when the actual bytecount matters (e.g. for USB Test
437	 * and Measurement Class devices).
438	 */
439	__raw_writesb(dreg, req->req.buf + req->req.actual, count);
440	csr &= ~SET_FX;
441	csr |= CLR_FX | AT91_UDP_TXPKTRDY;
442	__raw_writel(csr, creg);
443	req->req.actual += count;
444
445	PACKET("%s %p in/%d%s\n", ep->ep.name, &req->req, count,
446			is_last ? " (done)" : "");
447	if (is_last)
448		done(ep, req, 0);
449	return is_last;
450}
451
452static void nuke(struct at91_ep *ep, int status)
453{
454	struct at91_request *req;
455
456	// terminer chaque requete dans la queue
457	ep->stopped = 1;
458	if (list_empty(&ep->queue))
459		return;
460
461	VDBG("%s %s\n", __FUNCTION__, ep->ep.name);
462	while (!list_empty(&ep->queue)) {
463		req = list_entry(ep->queue.next, struct at91_request, queue);
464		done(ep, req, status);
465	}
466}
467
468/*-------------------------------------------------------------------------*/
469
470static int at91_ep_enable(struct usb_ep *_ep,
471				const struct usb_endpoint_descriptor *desc)
472{
473	struct at91_ep	*ep = container_of(_ep, struct at91_ep, ep);
474	struct at91_udc	*dev = ep->udc;
475	u16		maxpacket;
476	u32		tmp;
477	unsigned long	flags;
478
479	if (!_ep || !ep
480			|| !desc || ep->desc
481			|| _ep->name == ep0name
482			|| desc->bDescriptorType != USB_DT_ENDPOINT
483			|| (maxpacket = le16_to_cpu(desc->wMaxPacketSize)) == 0
484			|| maxpacket > ep->maxpacket) {
485		DBG("bad ep or descriptor\n");
486		return -EINVAL;
487	}
488
489	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN) {
490		DBG("bogus device state\n");
491		return -ESHUTDOWN;
492	}
493
494	tmp = desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
495	switch (tmp) {
496	case USB_ENDPOINT_XFER_CONTROL:
497		DBG("only one control endpoint\n");
498		return -EINVAL;
499	case USB_ENDPOINT_XFER_INT:
500		if (maxpacket > 64)
501			goto bogus_max;
502		break;
503	case USB_ENDPOINT_XFER_BULK:
504		switch (maxpacket) {
505		case 8:
506		case 16:
507		case 32:
508		case 64:
509			goto ok;
510		}
511bogus_max:
512		DBG("bogus maxpacket %d\n", maxpacket);
513		return -EINVAL;
514	case USB_ENDPOINT_XFER_ISOC:
515		if (!ep->is_pingpong) {
516			DBG("iso requires double buffering\n");
517			return -EINVAL;
518		}
519		break;
520	}
521
522ok:
523	local_irq_save(flags);
524
525	/* initialize endpoint to match this descriptor */
526	ep->is_in = (desc->bEndpointAddress & USB_DIR_IN) != 0;
527	ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC);
528	ep->stopped = 0;
529	if (ep->is_in)
530		tmp |= 0x04;
531	tmp <<= 8;
532	tmp |= AT91_UDP_EPEDS;
533	__raw_writel(tmp, ep->creg);
534
535	ep->desc = desc;
536	ep->ep.maxpacket = maxpacket;
537
538	/*
539	 * reset/init endpoint fifo.  NOTE:  leaves fifo_bank alone,
540	 * since endpoint resets don't reset hw pingpong state.
541	 */
542	at91_udp_write(dev, AT91_UDP_RST_EP, ep->int_mask);
543	at91_udp_write(dev, AT91_UDP_RST_EP, 0);
544
545	local_irq_restore(flags);
546	return 0;
547}
548
549static int at91_ep_disable (struct usb_ep * _ep)
550{
551	struct at91_ep	*ep = container_of(_ep, struct at91_ep, ep);
552	struct at91_udc	*udc = ep->udc;
553	unsigned long	flags;
554
555	if (ep == &ep->udc->ep[0])
556		return -EINVAL;
557
558	local_irq_save(flags);
559
560	nuke(ep, -ESHUTDOWN);
561
562	/* restore the endpoint's pristine config */
563	ep->desc = NULL;
564	ep->ep.maxpacket = ep->maxpacket;
565
566	/* reset fifos and endpoint */
567	if (ep->udc->clocked) {
568		at91_udp_write(udc, AT91_UDP_RST_EP, ep->int_mask);
569		at91_udp_write(udc, AT91_UDP_RST_EP, 0);
570		__raw_writel(0, ep->creg);
571	}
572
573	local_irq_restore(flags);
574	return 0;
575}
576
577/*
578 * this is a PIO-only driver, so there's nothing
579 * interesting for request or buffer allocation.
580 */
581
582static struct usb_request *
583at91_ep_alloc_request(struct usb_ep *_ep, unsigned int gfp_flags)
584{
585	struct at91_request *req;
586
587	req = kzalloc(sizeof (struct at91_request), gfp_flags);
588	if (!req)
589		return NULL;
590
591	INIT_LIST_HEAD(&req->queue);
592	return &req->req;
593}
594
595static void at91_ep_free_request(struct usb_ep *_ep, struct usb_request *_req)
596{
597	struct at91_request *req;
598
599	req = container_of(_req, struct at91_request, req);
600	BUG_ON(!list_empty(&req->queue));
601	kfree(req);
602}
603
604static void *at91_ep_alloc_buffer(
605	struct usb_ep *_ep,
606	unsigned bytes,
607	dma_addr_t *dma,
608	gfp_t gfp_flags)
609{
610	*dma = ~0;
611	return kmalloc(bytes, gfp_flags);
612}
613
614static void at91_ep_free_buffer(
615	struct usb_ep *ep,
616	void *buf,
617	dma_addr_t dma,
618	unsigned bytes)
619{
620	kfree(buf);
621}
622
623static int at91_ep_queue(struct usb_ep *_ep,
624			struct usb_request *_req, gfp_t gfp_flags)
625{
626	struct at91_request	*req;
627	struct at91_ep		*ep;
628	struct at91_udc		*dev;
629	int			status;
630	unsigned long		flags;
631
632	req = container_of(_req, struct at91_request, req);
633	ep = container_of(_ep, struct at91_ep, ep);
634
635	if (!_req || !_req->complete
636			|| !_req->buf || !list_empty(&req->queue)) {
637		DBG("invalid request\n");
638		return -EINVAL;
639	}
640
641	if (!_ep || (!ep->desc && ep->ep.name != ep0name)) {
642		DBG("invalid ep\n");
643		return -EINVAL;
644	}
645
646	dev = ep->udc;
647
648	if (!dev || !dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN) {
649		DBG("invalid device\n");
650		return -EINVAL;
651	}
652
653	_req->status = -EINPROGRESS;
654	_req->actual = 0;
655
656	local_irq_save(flags);
657
658	/* try to kickstart any empty and idle queue */
659	if (list_empty(&ep->queue) && !ep->stopped) {
660		int	is_ep0;
661
662		/*
663		 * If this control request has a non-empty DATA stage, this
664		 * will start that stage.  It works just like a non-control
665		 * request (until the status stage starts, maybe early).
666		 *
667		 * If the data stage is empty, then this starts a successful
668		 * IN/STATUS stage.  (Unsuccessful ones use set_halt.)
669		 */
670		is_ep0 = (ep->ep.name == ep0name);
671		if (is_ep0) {
672			u32	tmp;
673
674			if (!dev->req_pending) {
675				status = -EINVAL;
676				goto done;
677			}
678
679			/*
680			 * defer changing CONFG until after the gadget driver
681			 * reconfigures the endpoints.
682			 */
683			if (dev->wait_for_config_ack) {
684				tmp = at91_udp_read(dev, AT91_UDP_GLB_STAT);
685				tmp ^= AT91_UDP_CONFG;
686				VDBG("toggle config\n");
687				at91_udp_write(dev, AT91_UDP_GLB_STAT, tmp);
688			}
689			if (req->req.length == 0) {
690ep0_in_status:
691				PACKET("ep0 in/status\n");
692				status = 0;
693				tmp = __raw_readl(ep->creg);
694				tmp &= ~SET_FX;
695				tmp |= CLR_FX | AT91_UDP_TXPKTRDY;
696				__raw_writel(tmp, ep->creg);
697				dev->req_pending = 0;
698				goto done;
699			}
700		}
701
702		if (ep->is_in)
703			status = write_fifo(ep, req);
704		else {
705			status = read_fifo(ep, req);
706
707			/* IN/STATUS stage is otherwise triggered by irq */
708			if (status && is_ep0)
709				goto ep0_in_status;
710		}
711	} else
712		status = 0;
713
714	if (req && !status) {
715		list_add_tail (&req->queue, &ep->queue);
716		at91_udp_write(dev, AT91_UDP_IER, ep->int_mask);
717	}
718done:
719	local_irq_restore(flags);
720	return (status < 0) ? status : 0;
721}
722
723static int at91_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
724{
725	struct at91_ep	*ep;
726	struct at91_request	*req;
727
728	ep = container_of(_ep, struct at91_ep, ep);
729	if (!_ep || ep->ep.name == ep0name)
730		return -EINVAL;
731
732	/* make sure it's actually queued on this endpoint */
733	list_for_each_entry (req, &ep->queue, queue) {
734		if (&req->req == _req)
735			break;
736	}
737	if (&req->req != _req)
738		return -EINVAL;
739
740	done(ep, req, -ECONNRESET);
741	return 0;
742}
743
744static int at91_ep_set_halt(struct usb_ep *_ep, int value)
745{
746	struct at91_ep	*ep = container_of(_ep, struct at91_ep, ep);
747	struct at91_udc	*udc = ep->udc;
748	u32 __iomem	*creg;
749	u32		csr;
750	unsigned long	flags;
751	int		status = 0;
752
753	if (!_ep || ep->is_iso || !ep->udc->clocked)
754		return -EINVAL;
755
756	creg = ep->creg;
757	local_irq_save(flags);
758
759	csr = __raw_readl(creg);
760
761	/*
762	 * fail with still-busy IN endpoints, ensuring correct sequencing
763	 * of data tx then stall.  note that the fifo rx bytecount isn't
764	 * completely accurate as a tx bytecount.
765	 */
766	if (ep->is_in && (!list_empty(&ep->queue) || (csr >> 16) != 0))
767		status = -EAGAIN;
768	else {
769		csr |= CLR_FX;
770		csr &= ~SET_FX;
771		if (value) {
772			csr |= AT91_UDP_FORCESTALL;
773			VDBG("halt %s\n", ep->ep.name);
774		} else {
775			at91_udp_write(udc, AT91_UDP_RST_EP, ep->int_mask);
776			at91_udp_write(udc, AT91_UDP_RST_EP, 0);
777			csr &= ~AT91_UDP_FORCESTALL;
778		}
779		__raw_writel(csr, creg);
780	}
781
782	local_irq_restore(flags);
783	return status;
784}
785
786static const struct usb_ep_ops at91_ep_ops = {
787	.enable		= at91_ep_enable,
788	.disable	= at91_ep_disable,
789	.alloc_request	= at91_ep_alloc_request,
790	.free_request	= at91_ep_free_request,
791	.alloc_buffer	= at91_ep_alloc_buffer,
792	.free_buffer	= at91_ep_free_buffer,
793	.queue		= at91_ep_queue,
794	.dequeue	= at91_ep_dequeue,
795	.set_halt	= at91_ep_set_halt,
796	// there's only imprecise fifo status reporting
797};
798
799/*-------------------------------------------------------------------------*/
800
801static int at91_get_frame(struct usb_gadget *gadget)
802{
803	struct at91_udc *udc = to_udc(gadget);
804
805	if (!to_udc(gadget)->clocked)
806		return -EINVAL;
807	return at91_udp_read(udc, AT91_UDP_FRM_NUM) & AT91_UDP_NUM;
808}
809
810static int at91_wakeup(struct usb_gadget *gadget)
811{
812	struct at91_udc	*udc = to_udc(gadget);
813	u32		glbstate;
814	int		status = -EINVAL;
815	unsigned long	flags;
816
817	DBG("%s\n", __FUNCTION__ );
818	local_irq_save(flags);
819
820	if (!udc->clocked || !udc->suspended)
821		goto done;
822
823	/* NOTE:  some "early versions" handle ESR differently ... */
824
825	glbstate = at91_udp_read(udc, AT91_UDP_GLB_STAT);
826	if (!(glbstate & AT91_UDP_ESR))
827		goto done;
828	glbstate |= AT91_UDP_ESR;
829	at91_udp_write(udc, AT91_UDP_GLB_STAT, glbstate);
830
831done:
832	local_irq_restore(flags);
833	return status;
834}
835
836/* reinit == restore inital software state */
837static void udc_reinit(struct at91_udc *udc)
838{
839	u32 i;
840
841	INIT_LIST_HEAD(&udc->gadget.ep_list);
842	INIT_LIST_HEAD(&udc->gadget.ep0->ep_list);
843
844	for (i = 0; i < NUM_ENDPOINTS; i++) {
845		struct at91_ep *ep = &udc->ep[i];
846
847		if (i != 0)
848			list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
849		ep->desc = NULL;
850		ep->stopped = 0;
851		ep->fifo_bank = 0;
852		ep->ep.maxpacket = ep->maxpacket;
853		ep->creg = (void __iomem *) udc->udp_baseaddr + AT91_UDP_CSR(i);
854		// initialiser une queue par endpoint
855		INIT_LIST_HEAD(&ep->queue);
856	}
857}
858
859static void stop_activity(struct at91_udc *udc)
860{
861	struct usb_gadget_driver *driver = udc->driver;
862	int i;
863
864	if (udc->gadget.speed == USB_SPEED_UNKNOWN)
865		driver = NULL;
866	udc->gadget.speed = USB_SPEED_UNKNOWN;
867	udc->suspended = 0;
868
869	for (i = 0; i < NUM_ENDPOINTS; i++) {
870		struct at91_ep *ep = &udc->ep[i];
871		ep->stopped = 1;
872		nuke(ep, -ESHUTDOWN);
873	}
874	if (driver)
875		driver->disconnect(&udc->gadget);
876
877	udc_reinit(udc);
878}
879
880static void clk_on(struct at91_udc *udc)
881{
882	if (udc->clocked)
883		return;
884	udc->clocked = 1;
885	clk_enable(udc->iclk);
886	clk_enable(udc->fclk);
887}
888
889static void clk_off(struct at91_udc *udc)
890{
891	if (!udc->clocked)
892		return;
893	udc->clocked = 0;
894	udc->gadget.speed = USB_SPEED_UNKNOWN;
895	clk_disable(udc->fclk);
896	clk_disable(udc->iclk);
897}
898
899/*
900 * activate/deactivate link with host; minimize power usage for
901 * inactive links by cutting clocks and transceiver power.
902 */
903static void pullup(struct at91_udc *udc, int is_on)
904{
905	if (!udc->enabled || !udc->vbus)
906		is_on = 0;
907	DBG("%sactive\n", is_on ? "" : "in");
908
909	if (is_on) {
910		clk_on(udc);
911		at91_udp_write(udc, AT91_UDP_TXVC, 0);
912		if (cpu_is_at91rm9200())
913			at91_set_gpio_value(udc->board.pullup_pin, 1);
914		else if (cpu_is_at91sam9260() || cpu_is_at91sam9263()) {
915			u32	txvc = at91_udp_read(udc, AT91_UDP_TXVC);
916
917			txvc |= AT91_UDP_TXVC_PUON;
918			at91_udp_write(udc, AT91_UDP_TXVC, txvc);
919		} else if (cpu_is_at91sam9261()) {
920			u32	usbpucr;
921
922			usbpucr = at91_sys_read(AT91_MATRIX_USBPUCR);
923			usbpucr |= AT91_MATRIX_USBPUCR_PUON;
924			at91_sys_write(AT91_MATRIX_USBPUCR, usbpucr);
925		}
926	} else {
927		stop_activity(udc);
928		at91_udp_write(udc, AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
929		if (cpu_is_at91rm9200())
930			at91_set_gpio_value(udc->board.pullup_pin, 0);
931		else if (cpu_is_at91sam9260() || cpu_is_at91sam9263()) {
932			u32	txvc = at91_udp_read(udc, AT91_UDP_TXVC);
933
934			txvc &= ~AT91_UDP_TXVC_PUON;
935			at91_udp_write(udc, AT91_UDP_TXVC, txvc);
936		} else if (cpu_is_at91sam9261()) {
937			u32	usbpucr;
938
939			usbpucr = at91_sys_read(AT91_MATRIX_USBPUCR);
940			usbpucr &= ~AT91_MATRIX_USBPUCR_PUON;
941			at91_sys_write(AT91_MATRIX_USBPUCR, usbpucr);
942		}
943		clk_off(udc);
944	}
945}
946
947/* vbus is here!  turn everything on that's ready */
948static int at91_vbus_session(struct usb_gadget *gadget, int is_active)
949{
950	struct at91_udc	*udc = to_udc(gadget);
951	unsigned long	flags;
952
953	// VDBG("vbus %s\n", is_active ? "on" : "off");
954	local_irq_save(flags);
955	udc->vbus = (is_active != 0);
956	if (udc->driver)
957		pullup(udc, is_active);
958	else
959		pullup(udc, 0);
960	local_irq_restore(flags);
961	return 0;
962}
963
964static int at91_pullup(struct usb_gadget *gadget, int is_on)
965{
966	struct at91_udc	*udc = to_udc(gadget);
967	unsigned long	flags;
968
969	local_irq_save(flags);
970	udc->enabled = is_on = !!is_on;
971	pullup(udc, is_on);
972	local_irq_restore(flags);
973	return 0;
974}
975
976static int at91_set_selfpowered(struct usb_gadget *gadget, int is_on)
977{
978	struct at91_udc	*udc = to_udc(gadget);
979	unsigned long	flags;
980
981	local_irq_save(flags);
982	udc->selfpowered = (is_on != 0);
983	local_irq_restore(flags);
984	return 0;
985}
986
987static const struct usb_gadget_ops at91_udc_ops = {
988	.get_frame		= at91_get_frame,
989	.wakeup			= at91_wakeup,
990	.set_selfpowered	= at91_set_selfpowered,
991	.vbus_session		= at91_vbus_session,
992	.pullup			= at91_pullup,
993
994	/*
995	 * VBUS-powered devices may also also want to support bigger
996	 * power budgets after an appropriate SET_CONFIGURATION.
997	 */
998	// .vbus_power		= at91_vbus_power,
999};
1000
1001/*-------------------------------------------------------------------------*/
1002
1003static int handle_ep(struct at91_ep *ep)
1004{
1005	struct at91_request	*req;
1006	u32 __iomem		*creg = ep->creg;
1007	u32			csr = __raw_readl(creg);
1008
1009	if (!list_empty(&ep->queue))
1010		req = list_entry(ep->queue.next,
1011			struct at91_request, queue);
1012	else
1013		req = NULL;
1014
1015	if (ep->is_in) {
1016		if (csr & (AT91_UDP_STALLSENT | AT91_UDP_TXCOMP)) {
1017			csr |= CLR_FX;
1018			csr &= ~(SET_FX | AT91_UDP_STALLSENT | AT91_UDP_TXCOMP);
1019			__raw_writel(csr, creg);
1020		}
1021		if (req)
1022			return write_fifo(ep, req);
1023
1024	} else {
1025		if (csr & AT91_UDP_STALLSENT) {
1026			/* STALLSENT bit == ISOERR */
1027			if (ep->is_iso && req)
1028				req->req.status = -EILSEQ;
1029			csr |= CLR_FX;
1030			csr &= ~(SET_FX | AT91_UDP_STALLSENT);
1031			__raw_writel(csr, creg);
1032			csr = __raw_readl(creg);
1033		}
1034		if (req && (csr & RX_DATA_READY))
1035			return read_fifo(ep, req);
1036	}
1037	return 0;
1038}
1039
1040union setup {
1041	u8			raw[8];
1042	struct usb_ctrlrequest	r;
1043};
1044
1045static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr)
1046{
1047	u32 __iomem	*creg = ep->creg;
1048	u8 __iomem	*dreg = ep->creg + (AT91_UDP_FDR(0) - AT91_UDP_CSR(0));
1049	unsigned	rxcount, i = 0;
1050	u32		tmp;
1051	union setup	pkt;
1052	int		status = 0;
1053
1054	/* read and ack SETUP; hard-fail for bogus packets */
1055	rxcount = (csr & AT91_UDP_RXBYTECNT) >> 16;
1056	if (likely(rxcount == 8)) {
1057		while (rxcount--)
1058			pkt.raw[i++] = __raw_readb(dreg);
1059		if (pkt.r.bRequestType & USB_DIR_IN) {
1060			csr |= AT91_UDP_DIR;
1061			ep->is_in = 1;
1062		} else {
1063			csr &= ~AT91_UDP_DIR;
1064			ep->is_in = 0;
1065		}
1066	} else {
1067		// REVISIT this happens sometimes under load; why??
1068		ERR("SETUP len %d, csr %08x\n", rxcount, csr);
1069		status = -EINVAL;
1070	}
1071	csr |= CLR_FX;
1072	csr &= ~(SET_FX | AT91_UDP_RXSETUP);
1073	__raw_writel(csr, creg);
1074	udc->wait_for_addr_ack = 0;
1075	udc->wait_for_config_ack = 0;
1076	ep->stopped = 0;
1077	if (unlikely(status != 0))
1078		goto stall;
1079
1080#define w_index		le16_to_cpu(pkt.r.wIndex)
1081#define w_value		le16_to_cpu(pkt.r.wValue)
1082#define w_length	le16_to_cpu(pkt.r.wLength)
1083
1084	VDBG("SETUP %02x.%02x v%04x i%04x l%04x\n",
1085			pkt.r.bRequestType, pkt.r.bRequest,
1086			w_value, w_index, w_length);
1087
1088	/*
1089	 * A few standard requests get handled here, ones that touch
1090	 * hardware ... notably for device and endpoint features.
1091	 */
1092	udc->req_pending = 1;
1093	csr = __raw_readl(creg);
1094	csr |= CLR_FX;
1095	csr &= ~SET_FX;
1096	switch ((pkt.r.bRequestType << 8) | pkt.r.bRequest) {
1097
1098	case ((USB_TYPE_STANDARD|USB_RECIP_DEVICE) << 8)
1099			| USB_REQ_SET_ADDRESS:
1100		__raw_writel(csr | AT91_UDP_TXPKTRDY, creg);
1101		udc->addr = w_value;
1102		udc->wait_for_addr_ack = 1;
1103		udc->req_pending = 0;
1104		/* FADDR is set later, when we ack host STATUS */
1105		return;
1106
1107	case ((USB_TYPE_STANDARD|USB_RECIP_DEVICE) << 8)
1108			| USB_REQ_SET_CONFIGURATION:
1109		tmp = at91_udp_read(udc, AT91_UDP_GLB_STAT) & AT91_UDP_CONFG;
1110		if (pkt.r.wValue)
1111			udc->wait_for_config_ack = (tmp == 0);
1112		else
1113			udc->wait_for_config_ack = (tmp != 0);
1114		if (udc->wait_for_config_ack)
1115			VDBG("wait for config\n");
1116		/* CONFG is toggled later, if gadget driver succeeds */
1117		break;
1118
1119	/*
1120	 * Hosts may set or clear remote wakeup status, and
1121	 * devices may report they're VBUS powered.
1122	 */
1123	case ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_DEVICE) << 8)
1124			| USB_REQ_GET_STATUS:
1125		tmp = (udc->selfpowered << USB_DEVICE_SELF_POWERED);
1126		if (at91_udp_read(udc, AT91_UDP_GLB_STAT) & AT91_UDP_ESR)
1127			tmp |= (1 << USB_DEVICE_REMOTE_WAKEUP);
1128		PACKET("get device status\n");
1129		__raw_writeb(tmp, dreg);
1130		__raw_writeb(0, dreg);
1131		goto write_in;
1132		/* then STATUS starts later, automatically */
1133	case ((USB_TYPE_STANDARD|USB_RECIP_DEVICE) << 8)
1134			| USB_REQ_SET_FEATURE:
1135		if (w_value != USB_DEVICE_REMOTE_WAKEUP)
1136			goto stall;
1137		tmp = at91_udp_read(udc, AT91_UDP_GLB_STAT);
1138		tmp |= AT91_UDP_ESR;
1139		at91_udp_write(udc, AT91_UDP_GLB_STAT, tmp);
1140		goto succeed;
1141	case ((USB_TYPE_STANDARD|USB_RECIP_DEVICE) << 8)
1142			| USB_REQ_CLEAR_FEATURE:
1143		if (w_value != USB_DEVICE_REMOTE_WAKEUP)
1144			goto stall;
1145		tmp = at91_udp_read(udc, AT91_UDP_GLB_STAT);
1146		tmp &= ~AT91_UDP_ESR;
1147		at91_udp_write(udc, AT91_UDP_GLB_STAT, tmp);
1148		goto succeed;
1149
1150	/*
1151	 * Interfaces have no feature settings; this is pretty useless.
1152	 * we won't even insist the interface exists...
1153	 */
1154	case ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE) << 8)
1155			| USB_REQ_GET_STATUS:
1156		PACKET("get interface status\n");
1157		__raw_writeb(0, dreg);
1158		__raw_writeb(0, dreg);
1159		goto write_in;
1160		/* then STATUS starts later, automatically */
1161	case ((USB_TYPE_STANDARD|USB_RECIP_INTERFACE) << 8)
1162			| USB_REQ_SET_FEATURE:
1163	case ((USB_TYPE_STANDARD|USB_RECIP_INTERFACE) << 8)
1164			| USB_REQ_CLEAR_FEATURE:
1165		goto stall;
1166
1167	/*
1168	 * Hosts may clear bulk/intr endpoint halt after the gadget
1169	 * driver sets it (not widely used); or set it (for testing)
1170	 */
1171	case ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT) << 8)
1172			| USB_REQ_GET_STATUS:
1173		tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
1174		ep = &udc->ep[tmp];
1175		if (tmp > NUM_ENDPOINTS || (tmp && !ep->desc))
1176			goto stall;
1177
1178		if (tmp) {
1179			if ((w_index & USB_DIR_IN)) {
1180				if (!ep->is_in)
1181					goto stall;
1182			} else if (ep->is_in)
1183				goto stall;
1184		}
1185		PACKET("get %s status\n", ep->ep.name);
1186		if (__raw_readl(ep->creg) & AT91_UDP_FORCESTALL)
1187			tmp = (1 << USB_ENDPOINT_HALT);
1188		else
1189			tmp = 0;
1190		__raw_writeb(tmp, dreg);
1191		__raw_writeb(0, dreg);
1192		goto write_in;
1193		/* then STATUS starts later, automatically */
1194	case ((USB_TYPE_STANDARD|USB_RECIP_ENDPOINT) << 8)
1195			| USB_REQ_SET_FEATURE:
1196		tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
1197		ep = &udc->ep[tmp];
1198		if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
1199			goto stall;
1200		if (!ep->desc || ep->is_iso)
1201			goto stall;
1202		if ((w_index & USB_DIR_IN)) {
1203			if (!ep->is_in)
1204				goto stall;
1205		} else if (ep->is_in)
1206			goto stall;
1207
1208		tmp = __raw_readl(ep->creg);
1209		tmp &= ~SET_FX;
1210		tmp |= CLR_FX | AT91_UDP_FORCESTALL;
1211		__raw_writel(tmp, ep->creg);
1212		goto succeed;
1213	case ((USB_TYPE_STANDARD|USB_RECIP_ENDPOINT) << 8)
1214			| USB_REQ_CLEAR_FEATURE:
1215		tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
1216		ep = &udc->ep[tmp];
1217		if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
1218			goto stall;
1219		if (tmp == 0)
1220			goto succeed;
1221		if (!ep->desc || ep->is_iso)
1222			goto stall;
1223		if ((w_index & USB_DIR_IN)) {
1224			if (!ep->is_in)
1225				goto stall;
1226		} else if (ep->is_in)
1227			goto stall;
1228
1229		at91_udp_write(udc, AT91_UDP_RST_EP, ep->int_mask);
1230		at91_udp_write(udc, AT91_UDP_RST_EP, 0);
1231		tmp = __raw_readl(ep->creg);
1232		tmp |= CLR_FX;
1233		tmp &= ~(SET_FX | AT91_UDP_FORCESTALL);
1234		__raw_writel(tmp, ep->creg);
1235		if (!list_empty(&ep->queue))
1236			handle_ep(ep);
1237		goto succeed;
1238	}
1239
1240#undef w_value
1241#undef w_index
1242#undef w_length
1243
1244	/* pass request up to the gadget driver */
1245	if (udc->driver)
1246		status = udc->driver->setup(&udc->gadget, &pkt.r);
1247	else
1248		status = -ENODEV;
1249	if (status < 0) {
1250stall:
1251		VDBG("req %02x.%02x protocol STALL; stat %d\n",
1252				pkt.r.bRequestType, pkt.r.bRequest, status);
1253		csr |= AT91_UDP_FORCESTALL;
1254		__raw_writel(csr, creg);
1255		udc->req_pending = 0;
1256	}
1257	return;
1258
1259succeed:
1260	/* immediate successful (IN) STATUS after zero length DATA */
1261	PACKET("ep0 in/status\n");
1262write_in:
1263	csr |= AT91_UDP_TXPKTRDY;
1264	__raw_writel(csr, creg);
1265	udc->req_pending = 0;
1266	return;
1267}
1268
1269static void handle_ep0(struct at91_udc *udc)
1270{
1271	struct at91_ep		*ep0 = &udc->ep[0];
1272	u32 __iomem		*creg = ep0->creg;
1273	u32			csr = __raw_readl(creg);
1274	struct at91_request	*req;
1275
1276	if (unlikely(csr & AT91_UDP_STALLSENT)) {
1277		nuke(ep0, -EPROTO);
1278		udc->req_pending = 0;
1279		csr |= CLR_FX;
1280		csr &= ~(SET_FX | AT91_UDP_STALLSENT | AT91_UDP_FORCESTALL);
1281		__raw_writel(csr, creg);
1282		VDBG("ep0 stalled\n");
1283		csr = __raw_readl(creg);
1284	}
1285	if (csr & AT91_UDP_RXSETUP) {
1286		nuke(ep0, 0);
1287		udc->req_pending = 0;
1288		handle_setup(udc, ep0, csr);
1289		return;
1290	}
1291
1292	if (list_empty(&ep0->queue))
1293		req = NULL;
1294	else
1295		req = list_entry(ep0->queue.next, struct at91_request, queue);
1296
1297	/* host ACKed an IN packet that we sent */
1298	if (csr & AT91_UDP_TXCOMP) {
1299		csr |= CLR_FX;
1300		csr &= ~(SET_FX | AT91_UDP_TXCOMP);
1301
1302		/* write more IN DATA? */
1303		if (req && ep0->is_in) {
1304			if (handle_ep(ep0))
1305				udc->req_pending = 0;
1306
1307		/*
1308		 * Ack after:
1309		 *  - last IN DATA packet (including GET_STATUS)
1310		 *  - IN/STATUS for OUT DATA
1311		 *  - IN/STATUS for any zero-length DATA stage
1312		 * except for the IN DATA case, the host should send
1313		 * an OUT status later, which we'll ack.
1314		 */
1315		} else {
1316			udc->req_pending = 0;
1317			__raw_writel(csr, creg);
1318
1319			/*
1320			 * SET_ADDRESS takes effect only after the STATUS
1321			 * (to the original address) gets acked.
1322			 */
1323			if (udc->wait_for_addr_ack) {
1324				u32	tmp;
1325
1326				at91_udp_write(udc, AT91_UDP_FADDR,
1327						AT91_UDP_FEN | udc->addr);
1328				tmp = at91_udp_read(udc, AT91_UDP_GLB_STAT);
1329				tmp &= ~AT91_UDP_FADDEN;
1330				if (udc->addr)
1331					tmp |= AT91_UDP_FADDEN;
1332				at91_udp_write(udc, AT91_UDP_GLB_STAT, tmp);
1333
1334				udc->wait_for_addr_ack = 0;
1335				VDBG("address %d\n", udc->addr);
1336			}
1337		}
1338	}
1339
1340	/* OUT packet arrived ... */
1341	else if (csr & AT91_UDP_RX_DATA_BK0) {
1342		csr |= CLR_FX;
1343		csr &= ~(SET_FX | AT91_UDP_RX_DATA_BK0);
1344
1345		/* OUT DATA stage */
1346		if (!ep0->is_in) {
1347			if (req) {
1348				if (handle_ep(ep0)) {
1349					/* send IN/STATUS */
1350					PACKET("ep0 in/status\n");
1351					csr = __raw_readl(creg);
1352					csr &= ~SET_FX;
1353					csr |= CLR_FX | AT91_UDP_TXPKTRDY;
1354					__raw_writel(csr, creg);
1355					udc->req_pending = 0;
1356				}
1357			} else if (udc->req_pending) {
1358				/*
1359				 * AT91 hardware has a hard time with this
1360				 * "deferred response" mode for control-OUT
1361				 * transfers.  (For control-IN it's fine.)
1362				 *
1363				 * The normal solution leaves OUT data in the
1364				 * fifo until the gadget driver is ready.
1365				 * We couldn't do that here without disabling
1366				 * the IRQ that tells about SETUP packets,
1367				 * e.g. when the host gets impatient...
1368				 *
1369				 * Working around it by copying into a buffer
1370				 * would almost be a non-deferred response,
1371				 * except that it wouldn't permit reliable
1372				 * stalling of the request.  Instead, demand
1373				 * that gadget drivers not use this mode.
1374				 */
1375				DBG("no control-OUT deferred responses!\n");
1376				__raw_writel(csr | AT91_UDP_FORCESTALL, creg);
1377				udc->req_pending = 0;
1378			}
1379
1380		/* STATUS stage for control-IN; ack.  */
1381		} else {
1382			PACKET("ep0 out/status ACK\n");
1383			__raw_writel(csr, creg);
1384
1385			/* "early" status stage */
1386			if (req)
1387				done(ep0, req, 0);
1388		}
1389	}
1390}
1391
1392static irqreturn_t at91_udc_irq (int irq, void *_udc)
1393{
1394	struct at91_udc		*udc = _udc;
1395	u32			rescans = 5;
1396
1397	while (rescans--) {
1398		u32 status;
1399
1400		status = at91_udp_read(udc, AT91_UDP_ISR)
1401			& at91_udp_read(udc, AT91_UDP_IMR);
1402		if (!status)
1403			break;
1404
1405		/* USB reset irq:  not maskable */
1406		if (status & AT91_UDP_ENDBUSRES) {
1407			at91_udp_write(udc, AT91_UDP_IDR, ~MINIMUS_INTERRUPTUS);
1408			at91_udp_write(udc, AT91_UDP_IER, MINIMUS_INTERRUPTUS);
1409			/* Atmel code clears this irq twice */
1410			at91_udp_write(udc, AT91_UDP_ICR, AT91_UDP_ENDBUSRES);
1411			at91_udp_write(udc, AT91_UDP_ICR, AT91_UDP_ENDBUSRES);
1412			VDBG("end bus reset\n");
1413			udc->addr = 0;
1414			stop_activity(udc);
1415
1416			/* enable ep0 */
1417			at91_udp_write(udc, AT91_UDP_CSR(0),
1418					AT91_UDP_EPEDS | AT91_UDP_EPTYPE_CTRL);
1419			udc->gadget.speed = USB_SPEED_FULL;
1420			udc->suspended = 0;
1421			at91_udp_write(udc, AT91_UDP_IER, AT91_UDP_EP(0));
1422
1423			/*
1424			 * NOTE:  this driver keeps clocks off unless the
1425			 * USB host is present.  That saves power, but for
1426			 * boards that don't support VBUS detection, both
1427			 * clocks need to be active most of the time.
1428			 */
1429
1430		/* host initiated suspend (3+ms bus idle) */
1431		} else if (status & AT91_UDP_RXSUSP) {
1432			at91_udp_write(udc, AT91_UDP_IDR, AT91_UDP_RXSUSP);
1433			at91_udp_write(udc, AT91_UDP_IER, AT91_UDP_RXRSM);
1434			at91_udp_write(udc, AT91_UDP_ICR, AT91_UDP_RXSUSP);
1435			// VDBG("bus suspend\n");
1436			if (udc->suspended)
1437				continue;
1438			udc->suspended = 1;
1439
1440			/*
1441			 * NOTE:  when suspending a VBUS-powered device, the
1442			 * gadget driver should switch into slow clock mode
1443			 * and then into standby to avoid drawing more than
1444			 * 500uA power (2500uA for some high-power configs).
1445			 */
1446			if (udc->driver && udc->driver->suspend)
1447				udc->driver->suspend(&udc->gadget);
1448
1449		/* host initiated resume */
1450		} else if (status & AT91_UDP_RXRSM) {
1451			at91_udp_write(udc, AT91_UDP_IDR, AT91_UDP_RXRSM);
1452			at91_udp_write(udc, AT91_UDP_IER, AT91_UDP_RXSUSP);
1453			at91_udp_write(udc, AT91_UDP_ICR, AT91_UDP_RXRSM);
1454			// VDBG("bus resume\n");
1455			if (!udc->suspended)
1456				continue;
1457			udc->suspended = 0;
1458
1459			/*
1460			 * NOTE:  for a VBUS-powered device, the gadget driver
1461			 * would normally want to switch out of slow clock
1462			 * mode into normal mode.
1463			 */
1464			if (udc->driver && udc->driver->resume)
1465				udc->driver->resume(&udc->gadget);
1466
1467		/* endpoint IRQs are cleared by handling them */
1468		} else {
1469			int		i;
1470			unsigned	mask = 1;
1471			struct at91_ep	*ep = &udc->ep[1];
1472
1473			if (status & mask)
1474				handle_ep0(udc);
1475			for (i = 1; i < NUM_ENDPOINTS; i++) {
1476				mask <<= 1;
1477				if (status & mask)
1478					handle_ep(ep);
1479				ep++;
1480			}
1481		}
1482	}
1483
1484	return IRQ_HANDLED;
1485}
1486
1487/*-------------------------------------------------------------------------*/
1488
1489static void nop_release(struct device *dev)
1490{
1491	/* nothing to free */
1492}
1493
1494static struct at91_udc controller = {
1495	.gadget = {
1496		.ops	= &at91_udc_ops,
1497		.ep0	= &controller.ep[0].ep,
1498		.name	= driver_name,
1499		.dev	= {
1500			.bus_id = "gadget",
1501			.release = nop_release,
1502		}
1503	},
1504	.ep[0] = {
1505		.ep = {
1506			.name	= ep0name,
1507			.ops	= &at91_ep_ops,
1508		},
1509		.udc		= &controller,
1510		.maxpacket	= 8,
1511		.int_mask	= 1 << 0,
1512	},
1513	.ep[1] = {
1514		.ep = {
1515			.name	= "ep1",
1516			.ops	= &at91_ep_ops,
1517		},
1518		.udc		= &controller,
1519		.is_pingpong	= 1,
1520		.maxpacket	= 64,
1521		.int_mask	= 1 << 1,
1522	},
1523	.ep[2] = {
1524		.ep = {
1525			.name	= "ep2",
1526			.ops	= &at91_ep_ops,
1527		},
1528		.udc		= &controller,
1529		.is_pingpong	= 1,
1530		.maxpacket	= 64,
1531		.int_mask	= 1 << 2,
1532	},
1533	.ep[3] = {
1534		.ep = {
1535			/* could actually do bulk too */
1536			.name	= "ep3-int",
1537			.ops	= &at91_ep_ops,
1538		},
1539		.udc		= &controller,
1540		.maxpacket	= 8,
1541		.int_mask	= 1 << 3,
1542	},
1543	.ep[4] = {
1544		.ep = {
1545			.name	= "ep4",
1546			.ops	= &at91_ep_ops,
1547		},
1548		.udc		= &controller,
1549		.is_pingpong	= 1,
1550		.maxpacket	= 256,
1551		.int_mask	= 1 << 4,
1552	},
1553	.ep[5] = {
1554		.ep = {
1555			.name	= "ep5",
1556			.ops	= &at91_ep_ops,
1557		},
1558		.udc		= &controller,
1559		.is_pingpong	= 1,
1560		.maxpacket	= 256,
1561		.int_mask	= 1 << 5,
1562	},
1563	/* ep6 and ep7 are also reserved (custom silicon might use them) */
1564};
1565
1566static irqreturn_t at91_vbus_irq(int irq, void *_udc)
1567{
1568	struct at91_udc	*udc = _udc;
1569	unsigned	value;
1570
1571	/* vbus needs at least brief debouncing */
1572	udelay(10);
1573	value = at91_get_gpio_value(udc->board.vbus_pin);
1574	if (value != udc->vbus)
1575		at91_vbus_session(&udc->gadget, value);
1576
1577	return IRQ_HANDLED;
1578}
1579
1580int usb_gadget_register_driver (struct usb_gadget_driver *driver)
1581{
1582	struct at91_udc	*udc = &controller;
1583	int		retval;
1584
1585	if (!driver
1586			|| driver->speed < USB_SPEED_FULL
1587			|| !driver->bind
1588			|| !driver->setup) {
1589		DBG("bad parameter.\n");
1590		return -EINVAL;
1591	}
1592
1593	if (udc->driver) {
1594		DBG("UDC already has a gadget driver\n");
1595		return -EBUSY;
1596	}
1597
1598	udc->driver = driver;
1599	udc->gadget.dev.driver = &driver->driver;
1600	udc->gadget.dev.driver_data = &driver->driver;
1601	udc->enabled = 1;
1602	udc->selfpowered = 1;
1603
1604	retval = driver->bind(&udc->gadget);
1605	if (retval) {
1606		DBG("driver->bind() returned %d\n", retval);
1607		udc->driver = NULL;
1608		udc->gadget.dev.driver = NULL;
1609		udc->gadget.dev.driver_data = NULL;
1610		udc->enabled = 0;
1611		udc->selfpowered = 0;
1612		return retval;
1613	}
1614
1615	local_irq_disable();
1616	pullup(udc, 1);
1617	local_irq_enable();
1618
1619	DBG("bound to %s\n", driver->driver.name);
1620	return 0;
1621}
1622EXPORT_SYMBOL (usb_gadget_register_driver);
1623
1624int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
1625{
1626	struct at91_udc *udc = &controller;
1627
1628	if (!driver || driver != udc->driver || !driver->unbind)
1629		return -EINVAL;
1630
1631	local_irq_disable();
1632	udc->enabled = 0;
1633	at91_udp_write(udc, AT91_UDP_IDR, ~0);
1634	pullup(udc, 0);
1635	local_irq_enable();
1636
1637	driver->unbind(&udc->gadget);
1638	udc->driver = NULL;
1639
1640	DBG("unbound from %s\n", driver->driver.name);
1641	return 0;
1642}
1643EXPORT_SYMBOL (usb_gadget_unregister_driver);
1644
1645/*-------------------------------------------------------------------------*/
1646
1647static void at91udc_shutdown(struct platform_device *dev)
1648{
1649	/* force disconnect on reboot */
1650	pullup(platform_get_drvdata(dev), 0);
1651}
1652
1653static int __init at91udc_probe(struct platform_device *pdev)
1654{
1655	struct device	*dev = &pdev->dev;
1656	struct at91_udc	*udc;
1657	int		retval;
1658	struct resource	*res;
1659
1660	if (!dev->platform_data) {
1661		/* small (so we copy it) but critical! */
1662		DBG("missing platform_data\n");
1663		return -ENODEV;
1664	}
1665
1666	if (pdev->num_resources != 2) {
1667		DBG("invalid num_resources");
1668		return -ENODEV;
1669	}
1670	if ((pdev->resource[0].flags != IORESOURCE_MEM)
1671			|| (pdev->resource[1].flags != IORESOURCE_IRQ)) {
1672		DBG("invalid resource type");
1673		return -ENODEV;
1674	}
1675
1676	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1677	if (!res)
1678		return -ENXIO;
1679
1680	if (!request_mem_region(res->start,
1681			res->end - res->start + 1,
1682			driver_name)) {
1683		DBG("someone's using UDC memory\n");
1684		return -EBUSY;
1685	}
1686
1687	/* init software state */
1688	udc = &controller;
1689	udc->gadget.dev.parent = dev;
1690	udc->board = *(struct at91_udc_data *) dev->platform_data;
1691	udc->pdev = pdev;
1692	udc->enabled = 0;
1693
1694	udc->udp_baseaddr = ioremap(res->start, res->end - res->start + 1);
1695	if (!udc->udp_baseaddr) {
1696		release_mem_region(res->start, res->end - res->start + 1);
1697		return -ENOMEM;
1698	}
1699
1700	udc_reinit(udc);
1701
1702	/* get interface and function clocks */
1703	udc->iclk = clk_get(dev, "udc_clk");
1704	udc->fclk = clk_get(dev, "udpck");
1705	if (IS_ERR(udc->iclk) || IS_ERR(udc->fclk)) {
1706		DBG("clocks missing\n");
1707		retval = -ENODEV;
1708		goto fail0;
1709	}
1710
1711	retval = device_register(&udc->gadget.dev);
1712	if (retval < 0)
1713		goto fail0;
1714
1715	/* don't do anything until we have both gadget driver and VBUS */
1716	clk_enable(udc->iclk);
1717	at91_udp_write(udc, AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
1718	at91_udp_write(udc, AT91_UDP_IDR, 0xffffffff);
1719	/* Clear all pending interrupts - UDP may be used by bootloader. */
1720	at91_udp_write(udc, AT91_UDP_ICR, 0xffffffff);
1721	clk_disable(udc->iclk);
1722
1723	/* request UDC and maybe VBUS irqs */
1724	udc->udp_irq = platform_get_irq(pdev, 0);
1725	if (request_irq(udc->udp_irq, at91_udc_irq,
1726			IRQF_DISABLED, driver_name, udc)) {
1727		DBG("request irq %d failed\n", udc->udp_irq);
1728		retval = -EBUSY;
1729		goto fail1;
1730	}
1731	if (udc->board.vbus_pin > 0) {
1732		/*
1733		 * Get the initial state of VBUS - we cannot expect
1734		 * a pending interrupt.
1735		 */
1736		udc->vbus = at91_get_gpio_value(udc->board.vbus_pin);
1737		if (request_irq(udc->board.vbus_pin, at91_vbus_irq,
1738				IRQF_DISABLED, driver_name, udc)) {
1739			DBG("request vbus irq %d failed\n",
1740					udc->board.vbus_pin);
1741			free_irq(udc->udp_irq, udc);
1742			retval = -EBUSY;
1743			goto fail1;
1744		}
1745	} else {
1746		DBG("no VBUS detection, assuming always-on\n");
1747		udc->vbus = 1;
1748	}
1749	dev_set_drvdata(dev, udc);
1750	device_init_wakeup(dev, 1);
1751	create_debug_file(udc);
1752
1753	INFO("%s version %s\n", driver_name, DRIVER_VERSION);
1754	return 0;
1755
1756fail1:
1757	device_unregister(&udc->gadget.dev);
1758fail0:
1759	release_mem_region(res->start, res->end - res->start + 1);
1760	DBG("%s probe failed, %d\n", driver_name, retval);
1761	return retval;
1762}
1763
1764static int __exit at91udc_remove(struct platform_device *pdev)
1765{
1766	struct at91_udc *udc = platform_get_drvdata(pdev);
1767	struct resource *res;
1768
1769	DBG("remove\n");
1770
1771	if (udc->driver)
1772		return -EBUSY;
1773
1774	pullup(udc, 0);
1775
1776	device_init_wakeup(&pdev->dev, 0);
1777	remove_debug_file(udc);
1778	if (udc->board.vbus_pin > 0)
1779		free_irq(udc->board.vbus_pin, udc);
1780	free_irq(udc->udp_irq, udc);
1781	device_unregister(&udc->gadget.dev);
1782
1783	iounmap(udc->udp_baseaddr);
1784	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1785	release_mem_region(res->start, res->end - res->start + 1);
1786
1787	clk_put(udc->iclk);
1788	clk_put(udc->fclk);
1789
1790	return 0;
1791}
1792
1793#ifdef CONFIG_PM
1794static int at91udc_suspend(struct platform_device *pdev, pm_message_t mesg)
1795{
1796	struct at91_udc *udc = platform_get_drvdata(pdev);
1797	int		wake = udc->driver && device_may_wakeup(&pdev->dev);
1798
1799	/* Unless we can act normally to the host (letting it wake us up
1800	 * whenever it has work for us) force disconnect.  Wakeup requires
1801	 * PLLB for USB events (signaling for reset, wakeup, or incoming
1802	 * tokens) and VBUS irqs (on systems which support them).
1803	 */
1804	if ((!udc->suspended && udc->addr)
1805			|| !wake
1806			|| at91_suspend_entering_slow_clock()) {
1807		pullup(udc, 0);
1808		wake = 0;
1809	} else
1810		enable_irq_wake(udc->udp_irq);
1811
1812	udc->active_suspend = wake;
1813	if (udc->board.vbus_pin > 0 && wake)
1814		enable_irq_wake(udc->board.vbus_pin);
1815	return 0;
1816}
1817
1818static int at91udc_resume(struct platform_device *pdev)
1819{
1820	struct at91_udc *udc = platform_get_drvdata(pdev);
1821
1822	if (udc->board.vbus_pin > 0 && udc->active_suspend)
1823		disable_irq_wake(udc->board.vbus_pin);
1824
1825	/* maybe reconnect to host; if so, clocks on */
1826	if (udc->active_suspend)
1827		disable_irq_wake(udc->udp_irq);
1828	else
1829		pullup(udc, 1);
1830	return 0;
1831}
1832#else
1833#define	at91udc_suspend	NULL
1834#define	at91udc_resume	NULL
1835#endif
1836
1837static struct platform_driver at91_udc_driver = {
1838	.remove		= __exit_p(at91udc_remove),
1839	.shutdown	= at91udc_shutdown,
1840	.suspend	= at91udc_suspend,
1841	.resume		= at91udc_resume,
1842	.driver		= {
1843		.name	= (char *) driver_name,
1844		.owner	= THIS_MODULE,
1845	},
1846};
1847
1848static int __init udc_init_module(void)
1849{
1850	return platform_driver_probe(&at91_udc_driver, at91udc_probe);
1851}
1852module_init(udc_init_module);
1853
1854static void __exit udc_exit_module(void)
1855{
1856	platform_driver_unregister(&at91_udc_driver);
1857}
1858module_exit(udc_exit_module);
1859
1860MODULE_DESCRIPTION("AT91 udc driver");
1861MODULE_AUTHOR("Thomas Rathbone, David Brownell");
1862MODULE_LICENSE("GPL");
1863