1 files changed, 215 insertions, 625 deletions

diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 547486ccd059..ba79dbf5adbc 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -26,26 +26,25 @@
  */
 struct usbhsg_request {
         struct usb_request      req;
-        struct list_head        node;
+        struct usbhs_pkt        pkt;
 };
 
 #define EP_NAME_SIZE 8
 struct usbhsg_gpriv;
-struct usbhsg_pipe_handle;
 struct usbhsg_uep {
         struct usb_ep            ep;
         struct usbhs_pipe       *pipe;
-        struct list_head         list;
 
         char ep_name[EP_NAME_SIZE];
 
         struct usbhsg_gpriv *gpriv;
-        struct usbhsg_pipe_handle *handler;
+        struct usbhs_pkt_handle *handler;
 };
 
 struct usbhsg_gpriv {
         struct usb_gadget        gadget;
         struct usbhs_mod         mod;
+        struct list_head         link;
 
         struct usbhsg_uep       *uep;
         int                      uep_size;
@@ -58,12 +57,6 @@ struct usbhsg_gpriv {
 #define USBHSG_STATUS_WEDGE             (1 << 2)
 };
 
-struct usbhsg_pipe_handle {
-        int (*prepare)(struct usbhsg_uep *uep, struct usbhsg_request *ureq);
-        int (*try_run)(struct usbhsg_uep *uep, struct usbhsg_request *ureq);
-        void (*irq_mask)(struct usbhsg_uep *uep, int enable);
-};
-
 struct usbhsg_recip_handle {
         char *name;
         int (*device)(struct usbhs_priv *priv, struct usbhsg_uep *uep,
@@ -100,7 +93,6 @@ struct usbhsg_recip_handle {
         container_of(r, struct usbhsg_request, req)
 
 #define usbhsg_ep_to_uep(e)             container_of(e, struct usbhsg_uep, ep)
-#define usbhsg_gpriv_to_lock(gp)        usbhs_priv_to_lock((gp)->mod.priv)
 #define usbhsg_gpriv_to_dev(gp)         usbhs_priv_to_dev((gp)->mod.priv)
 #define usbhsg_gpriv_to_priv(gp)        ((gp)->mod.priv)
 #define usbhsg_gpriv_to_dcp(gp)         ((gp)->uep)
@@ -110,6 +102,10 @@ struct usbhsg_recip_handle {
 #define usbhsg_pipe_to_uep(p)           ((p)->mod_private)
 #define usbhsg_is_dcp(u)                ((u) == usbhsg_gpriv_to_dcp((u)->gpriv))
 
+#define usbhsg_ureq_to_pkt(u)           (&(u)->pkt)
+#define usbhsg_pkt_to_ureq(i)   \
+        container_of(i, struct usbhsg_request, pkt)
+
 #define usbhsg_is_not_connected(gp) ((gp)->gadget.speed == USB_SPEED_UNKNOWN)
 
 /* status */
@@ -118,37 +114,18 @@ struct usbhsg_recip_handle {
 #define usbhsg_status_clr(gp, b) (gp->status &= ~b)
 #define usbhsg_status_has(gp, b) (gp->status &   b)
 
-/*
- *              usbhsg_trylock
- *
- * This driver don't use spin_try_lock
- * to avoid warning of CONFIG_DEBUG_SPINLOCK
- */
-static spinlock_t *usbhsg_trylock(struct usbhsg_gpriv *gpriv,
-                                  unsigned long *flags)
-{
-        spinlock_t *lock = usbhsg_gpriv_to_lock(gpriv);
-
-        /* check spin lock status
-         * to avoid deadlock/nest */
-        if (spin_is_locked(lock))
-                return NULL;
+/* controller */
+LIST_HEAD(the_controller_link);
 
-        spin_lock_irqsave(lock, *flags);
-
-        return lock;
-}
-
-static void usbhsg_unlock(spinlock_t *lock, unsigned long *flags)
-{
-        if (!lock)
-                return;
-
-        spin_unlock_irqrestore(lock, *flags);
-}
+#define usbhsg_for_each_controller(gpriv)\
+        list_for_each_entry(gpriv, &the_controller_link, link)
+#define usbhsg_controller_register(gpriv)\
+        list_add_tail(&(gpriv)->link, &the_controller_link)
+#define usbhsg_controller_unregister(gpriv)\
+        list_del_init(&(gpriv)->link)
 
 /*
- *              list push/pop
+ *              queue push/pop
  */
 static void usbhsg_queue_push(struct usbhsg_uep *uep,
                               struct usbhsg_request *ureq)
@@ -156,79 +133,17 @@ static void usbhsg_queue_push(struct usbhsg_uep *uep,
         struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
         struct device *dev = usbhsg_gpriv_to_dev(gpriv);
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+        struct usbhs_pkt *pkt = usbhsg_ureq_to_pkt(ureq);
+        struct usb_request *req = &ureq->req;
 
-        /*
-         *********  assume under spin lock  *********
-         */
-        list_del_init(&ureq->node);
-        list_add_tail(&ureq->node, &uep->list);
-        ureq->req.actual = 0;
-        ureq->req.status = -EINPROGRESS;
+        req->actual = 0;
+        req->status = -EINPROGRESS;
+        usbhs_pkt_push(pipe, pkt, uep->handler,
+                       req->buf, req->length, req->zero);
 
         dev_dbg(dev, "pipe %d : queue push (%d)\n",
                 usbhs_pipe_number(pipe),
-                ureq->req.length);
-}
-
-static struct usbhsg_request *usbhsg_queue_get(struct usbhsg_uep *uep)
-{
-        /*
-         *********  assume under spin lock  *********
-         */
-        if (list_empty(&uep->list))
-                return NULL;
-
-        return list_entry(uep->list.next, struct usbhsg_request, node);
-}
-
-#define usbhsg_queue_prepare(uep) __usbhsg_queue_handler(uep, 1);
-#define usbhsg_queue_handle(uep)  __usbhsg_queue_handler(uep, 0);
-static int __usbhsg_queue_handler(struct usbhsg_uep *uep, int prepare)
-{
-        struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
-        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
-        struct usbhsg_request *ureq;
-        spinlock_t *lock;
-        unsigned long flags;
-        int ret = 0;
-
-        if (!uep->handler) {
-                dev_err(dev, "no handler function\n");
-                return -EIO;
-        }
-
-        /*
-         * CAUTION [*queue handler*]
-         *
-         * This function will be called for start/restart queue operation.
-         * OTOH the most much worry for USB driver is spinlock nest.
-         * Specially it are
-         *   - usb_ep_ops  :: queue
-         *   - usb_request :: complete
-         *
-         * But the caller of this function need not care about spinlock.
-         * This function is using usbhsg_trylock for it.
-         * if "is_locked" is 1, this mean this function lock it.
-         * but if it is 0, this mean it is already under spin lock.
-         * see also
-         *   CAUTION [*endpoint queue*]
-         *   CAUTION [*request complete*]
-         */
-
-        /******************  spin try lock *******************/
-        lock = usbhsg_trylock(gpriv, &flags);
-
-        ureq = usbhsg_queue_get(uep);
-        if (ureq) {
-                if (prepare)
-                        ret = uep->handler->prepare(uep, ureq);
-                else
-                        ret = uep->handler->try_run(uep, ureq);
-        }
-        usbhsg_unlock(lock, &flags);
-        /********************  spin unlock ******************/
-
-        return ret;
+                req->length);
 }
 
 static void usbhsg_queue_pop(struct usbhsg_uep *uep,
@@ -239,289 +154,91 @@ static void usbhsg_queue_pop(struct usbhsg_uep *uep,
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
         struct device *dev = usbhsg_gpriv_to_dev(gpriv);
 
-        /*
-         *********  assume under spin lock  *********
-         */
-
-        /*
-         * CAUTION [*request complete*]
-         *
-         * There is a possibility not to be called in correct order
-         * if "complete" is called without spinlock.
-         *
-         * So, this function assume it is under spinlock,
-         * and call usb_request :: complete.
-         *
-         * But this "complete" will push next usb_request.
-         * It mean "usb_ep_ops :: queue" which is using spinlock is called
-         * under spinlock.
-         *
-         * To avoid dead-lock, this driver is using usbhsg_trylock.
-         *   CAUTION [*endpoint queue*]
-         *   CAUTION [*queue handler*]
-         */
-
         dev_dbg(dev, "pipe %d : queue pop\n", usbhs_pipe_number(pipe));
 
-        list_del_init(&ureq->node);
-
         ureq->req.status = status;
         ureq->req.complete(&uep->ep, &ureq->req);
-
-        /* more request ? */
-        if (0 == status)
-                usbhsg_queue_prepare(uep);
 }
 
-/*
- *              irq enable/disable function
- */
-#define usbhsg_irq_callback_ctrl(uep, status, enable)                   \
-        ({                                                              \
-                struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);  \
-                struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);      \
-                struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);  \
-                struct usbhs_mod *mod = usbhs_mod_get_current(priv);    \
-                if (!mod)                                               \
-                        return;                                         \
-                if (enable)                                             \
-                        mod->irq_##status |= (1 << usbhs_pipe_number(pipe)); \
-                else                                                    \
-                        mod->irq_##status &= ~(1 << usbhs_pipe_number(pipe)); \
-                usbhs_irq_callback_update(priv, mod);                   \
-        })
-
-static void usbhsg_irq_empty_ctrl(struct usbhsg_uep *uep, int enable)
+static void usbhsg_queue_done(struct usbhs_pkt *pkt)
 {
-        usbhsg_irq_callback_ctrl(uep, bempsts, enable);
-}
+        struct usbhs_pipe *pipe = pkt->pipe;
+        struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe);
+        struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt);
 
-static void usbhsg_irq_ready_ctrl(struct usbhsg_uep *uep, int enable)
-{
-        usbhsg_irq_callback_ctrl(uep, brdysts, enable);
-}
-
-/*
- *              handler function
- */
-static int usbhsg_try_run_ctrl_stage_end(struct usbhsg_uep *uep,
-                                         struct usbhsg_request *ureq)
-{
-        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
-
-        /*
-         *********  assume under spin lock  *********
-         */
+        ureq->req.actual = pkt->actual;
 
-        usbhs_dcp_control_transfer_done(pipe);
         usbhsg_queue_pop(uep, ureq, 0);
-
-        return 0;
 }
 
-static int usbhsg_try_run_send_packet(struct usbhsg_uep *uep,
-                                      struct usbhsg_request *ureq)
+/*
+ *              dma map/unmap
+ */
+static int usbhsg_dma_map(struct device *dev,
+                          struct usbhs_pkt *pkt,
+                          enum dma_data_direction dir)
 {
-        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+        struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt);
         struct usb_request *req = &ureq->req;
-        struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
-        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
-        void *buf;
-        int remainder, send;
-        int is_done = 0;
-        int enable;
-        int maxp;
 
-        /*
-         *********  assume under spin lock  *********
-         */
-
-        maxp            = usbhs_pipe_get_maxpacket(pipe);
-        buf             = req->buf    + req->actual;
-        remainder       = req->length - req->actual;
-
-        send = usbhs_fifo_write(pipe, buf, remainder);
-
-        /*
-         * send < 0 : pipe busy
-         * send = 0 : send zero packet
-         * send > 0 : send data
-         *
-         * send <= max_packet
-         */
-        if (send > 0)
-                req->actual += send;
-
-        /* send all packet ? */
-        if (send < remainder)
-                is_done = 0;            /* there are remainder data */
-        else if (send < maxp)
-                is_done = 1;            /* short packet */
-        else
-                is_done = !req->zero;   /* send zero packet ? */
-
-        dev_dbg(dev, "  send %d (%d/ %d/ %d/ %d)\n",
-                usbhs_pipe_number(pipe),
-                remainder, send, is_done, req->zero);
-
-        /*
-         * enable interrupt and send again in irq handler
-         * if it still have remainder data which should be sent.
-         */
-        enable = !is_done;
-        uep->handler->irq_mask(uep, enable);
-
-        /*
-         * usbhs_fifo_enable execute
-         *  - after callback_update,
-         *  - before queue_pop / stage_end
-         */
-        usbhs_fifo_enable(pipe);
-
-        /*
-         * all data were sent ?
-         */
-        if (is_done) {
-                /* it care below call in
-                   "function mode" */
-                if (usbhsg_is_dcp(uep))
-                        usbhs_dcp_control_transfer_done(pipe);
-
-                usbhsg_queue_pop(uep, ureq, 0);
+        if (pkt->dma != DMA_ADDR_INVALID) {
+                dev_err(dev, "dma is already mapped\n");
+                return -EIO;
         }
 
-        return 0;
-}
-
-static int usbhsg_prepare_send_packet(struct usbhsg_uep *uep,
-                                      struct usbhsg_request *ureq)
-{
-        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
-
-        /*
-         *********  assume under spin lock  *********
-         */
+        if (req->dma == DMA_ADDR_INVALID) {
+                pkt->dma = dma_map_single(dev, pkt->buf, pkt->length, dir);
+        } else {
+                dma_sync_single_for_device(dev, req->dma, req->length, dir);
+                pkt->dma = req->dma;
+        }
 
-        usbhs_fifo_prepare_write(pipe);
-        usbhsg_try_run_send_packet(uep, ureq);
+        if (dma_mapping_error(dev, pkt->dma)) {
+                dev_err(dev, "dma mapping error %x\n", pkt->dma);
+                return -EIO;
+        }
 
         return 0;
 }
 
-static int usbhsg_try_run_receive_packet(struct usbhsg_uep *uep,
-                                         struct usbhsg_request *ureq)
+static int usbhsg_dma_unmap(struct device *dev,
+                            struct usbhs_pkt *pkt,
+                            enum dma_data_direction dir)
 {
-        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+        struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt);
         struct usb_request *req = &ureq->req;
-        struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
-        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
-        void *buf;
-        int maxp;
-        int remainder, recv;
-        int is_done = 0;
-
-        /*
-         *********  assume under spin lock  *********
-         */
-
-        maxp            = usbhs_pipe_get_maxpacket(pipe);
-        buf             = req->buf    + req->actual;
-        remainder       = req->length - req->actual;
-
-        recv = usbhs_fifo_read(pipe, buf, remainder);
-        /*
-         * recv < 0  : pipe busy
-         * recv >= 0 : receive data
-         *
-         * recv <= max_packet
-         */
-        if (recv < 0)
-                return -EBUSY;
-
-        /* update parameters */
-        req->actual += recv;
-
-        if ((recv == remainder) ||      /* receive all data */
-            (recv < maxp))              /* short packet */
-                is_done = 1;
 
-        dev_dbg(dev, "  recv %d (%d/ %d/ %d/ %d)\n",
-                usbhs_pipe_number(pipe),
-                remainder, recv, is_done, req->zero);
+        if (pkt->dma == DMA_ADDR_INVALID) {
+                dev_err(dev, "dma is not mapped\n");
+                return -EIO;
+        }
 
-        /* read all data ? */
-        if (is_done) {
-                int disable = 0;
+        if (req->dma == DMA_ADDR_INVALID)
+                dma_unmap_single(dev, pkt->dma, pkt->length, dir);
+        else
+                dma_sync_single_for_cpu(dev, req->dma, req->length, dir);
 
-                uep->handler->irq_mask(uep, disable);
-                usbhs_fifo_disable(pipe);
-                usbhsg_queue_pop(uep, ureq, 0);
-        }
+        pkt->dma = DMA_ADDR_INVALID;
 
         return 0;
 }
 
-static int usbhsg_prepare_receive_packet(struct usbhsg_uep *uep,
-                                         struct usbhsg_request *ureq)
+static int usbhsg_dma_map_ctrl(struct usbhs_pkt *pkt, int map)
 {
-        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
-        int enable = 1;
-        int ret;
-
-        /*
-         *********  assume under spin lock  *********
-         */
-
-        ret = usbhs_fifo_prepare_read(pipe);
-        if (ret < 0)
-                return ret;
+        struct usbhs_pipe *pipe = pkt->pipe;
+        struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe);
+        struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
+        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
+        enum dma_data_direction dir;
 
-        /*
-         * data will be read in interrupt handler
-         */
-        uep->handler->irq_mask(uep, enable);
+        dir = usbhs_pipe_is_dir_in(pipe) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
 
-        return ret;
+        if (map)
+                return usbhsg_dma_map(dev, pkt, dir);
+        else
+                return usbhsg_dma_unmap(dev, pkt, dir);
 }
 
-static struct usbhsg_pipe_handle usbhsg_handler_send_by_empty = {
-        .prepare        = usbhsg_prepare_send_packet,
-        .try_run        = usbhsg_try_run_send_packet,
-        .irq_mask       = usbhsg_irq_empty_ctrl,
-};
-
-static struct usbhsg_pipe_handle usbhsg_handler_send_by_ready = {
-        .prepare        = usbhsg_prepare_send_packet,
-        .try_run        = usbhsg_try_run_send_packet,
-        .irq_mask       = usbhsg_irq_ready_ctrl,
-};
-
-static struct usbhsg_pipe_handle usbhsg_handler_recv_by_ready = {
-        .prepare        = usbhsg_prepare_receive_packet,
-        .try_run        = usbhsg_try_run_receive_packet,
-        .irq_mask       = usbhsg_irq_ready_ctrl,
-};
-
-static struct usbhsg_pipe_handle usbhsg_handler_ctrl_stage_end = {
-        .prepare        = usbhsg_try_run_ctrl_stage_end,
-        .try_run        = usbhsg_try_run_ctrl_stage_end,
-};
-
-/*
- * DCP pipe can NOT use "ready interrupt" for "send"
- * it should use "empty" interrupt.
- * see
- *   "Operation" - "Interrupt Function" - "BRDY Interrupt"
- *
- * on the other hand, normal pipe can use "ready interrupt" for "send"
- * even though it is single/double buffer
- */
-#define usbhsg_handler_send_ctrl        usbhsg_handler_send_by_empty
-#define usbhsg_handler_recv_ctrl        usbhsg_handler_recv_by_ready
-
-#define usbhsg_handler_send_packet      usbhsg_handler_send_by_ready
-#define usbhsg_handler_recv_packet      usbhsg_handler_recv_by_ready
-
 /*
  *              USB_TYPE_STANDARD / clear feature functions
  */
@@ -546,15 +263,13 @@ static int usbhsg_recip_handler_std_clear_endpoint(struct usbhs_priv *priv,
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
 
         if (!usbhsg_status_has(gpriv, USBHSG_STATUS_WEDGE)) {
-                usbhs_fifo_disable(pipe);
+                usbhs_pipe_disable(pipe);
                 usbhs_pipe_clear_sequence(pipe);
-                usbhs_fifo_enable(pipe);
+                usbhs_pipe_enable(pipe);
         }
 
         usbhsg_recip_handler_std_control_done(priv, uep, ctrl);
 
-        usbhsg_queue_prepare(uep);
-
         return 0;
 }
 
@@ -575,6 +290,7 @@ static int usbhsg_recip_run_handle(struct usbhs_priv *priv,
         struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
         struct device *dev = usbhsg_gpriv_to_dev(gpriv);
         struct usbhsg_uep *uep;
+        struct usbhs_pipe *pipe;
         int recip = ctrl->bRequestType & USB_RECIP_MASK;
         int nth = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
         int ret;
@@ -583,9 +299,11 @@ static int usbhsg_recip_run_handle(struct usbhs_priv *priv,
         char *msg;
 
         uep = usbhsg_gpriv_to_nth_uep(gpriv, nth);
-        if (!usbhsg_uep_to_pipe(uep)) {
+        pipe = usbhsg_uep_to_pipe(uep);
+        if (!pipe) {
                 dev_err(dev, "wrong recip request\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto usbhsg_recip_run_handle_end;
         }
 
         switch (recip) {
@@ -608,10 +326,20 @@ static int usbhsg_recip_run_handle(struct usbhs_priv *priv,
         }
 
         if (func) {
+                unsigned long flags;
+
                 dev_dbg(dev, "%s (pipe %d :%s)\n", handler->name, nth, msg);
+
+                /********************  spin lock ********************/
+                usbhs_lock(priv, flags);
                 ret = func(priv, uep, ctrl);
+                usbhs_unlock(priv, flags);
+                /********************  spin unlock ******************/
         }
 
+usbhsg_recip_run_handle_end:
+        usbhs_pkt_start(pipe);
+
         return ret;
 }
 
@@ -660,13 +388,13 @@ static int usbhsg_irq_ctrl_stage(struct usbhs_priv *priv,
 
         switch (stage) {
         case READ_DATA_STAGE:
-                dcp->handler = &usbhsg_handler_send_ctrl;
+                dcp->handler = &usbhs_fifo_pio_push_handler;
                 break;
         case WRITE_DATA_STAGE:
-                dcp->handler = &usbhsg_handler_recv_ctrl;
+                dcp->handler = &usbhs_fifo_pio_pop_handler;
                 break;
         case NODATA_STATUS_STAGE:
-                dcp->handler = &usbhsg_handler_ctrl_stage_end;
+                dcp->handler = &usbhs_ctrl_stage_end_handler;
                 break;
         default:
                 return ret;
@@ -695,128 +423,27 @@ static int usbhsg_irq_ctrl_stage(struct usbhs_priv *priv,
                 ret = gpriv->driver->setup(&gpriv->gadget, &ctrl);
 
         if (ret < 0)
-                usbhs_fifo_stall(pipe);
+                usbhs_pipe_stall(pipe);
 
         return ret;
 }
 
-static int usbhsg_irq_empty(struct usbhs_priv *priv,
-                            struct usbhs_irq_state *irq_state)
-{
-        struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
-        struct usbhsg_uep *uep;
-        struct usbhs_pipe *pipe;
-        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
-        int i, ret;
-
-        if (!irq_state->bempsts) {
-                dev_err(dev, "debug %s !!\n", __func__);
-                return -EIO;
-        }
-
-        dev_dbg(dev, "irq empty [0x%04x]\n", irq_state->bempsts);
-
-        /*
-         * search interrupted "pipe"
-         * not "uep".
-         */
-        usbhs_for_each_pipe_with_dcp(pipe, priv, i) {
-                if (!(irq_state->bempsts & (1 << i)))
-                        continue;
-
-                uep     = usbhsg_pipe_to_uep(pipe);
-                ret     = usbhsg_queue_handle(uep);
-                if (ret < 0)
-                        dev_err(dev, "send error %d : %d\n", i, ret);
-        }
-
-        return 0;
-}
-
-static int usbhsg_irq_ready(struct usbhs_priv *priv,
-                            struct usbhs_irq_state *irq_state)
-{
-        struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
-        struct usbhsg_uep *uep;
-        struct usbhs_pipe *pipe;
-        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
-        int i, ret;
-
-        if (!irq_state->brdysts) {
-                dev_err(dev, "debug %s !!\n", __func__);
-                return -EIO;
-        }
-
-        dev_dbg(dev, "irq ready [0x%04x]\n", irq_state->brdysts);
-
-        /*
-         * search interrupted "pipe"
-         * not "uep".
-         */
-        usbhs_for_each_pipe_with_dcp(pipe, priv, i) {
-                if (!(irq_state->brdysts & (1 << i)))
-                        continue;
-
-                uep     = usbhsg_pipe_to_uep(pipe);
-                ret     = usbhsg_queue_handle(uep);
-                if (ret < 0)
-                        dev_err(dev, "receive error %d : %d\n", i, ret);
-        }
-
-        return 0;
-}
-
 /*
  *
  *              usb_dcp_ops
  *
  */
-static int usbhsg_dcp_enable(struct usbhsg_uep *uep)
-{
-        struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
-        struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
-        struct usbhs_pipe *pipe;
-
-        /*
-         *********  assume under spin lock  *********
-         */
-
-        pipe = usbhs_dcp_malloc(priv);
-        if (!pipe)
-                return -EIO;
-
-        uep->pipe               = pipe;
-        uep->pipe->mod_private  = uep;
-        INIT_LIST_HEAD(&uep->list);
-
-        return 0;
-}
-
-#define usbhsg_dcp_disable usbhsg_pipe_disable
 static int usbhsg_pipe_disable(struct usbhsg_uep *uep)
 {
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
-        struct usbhsg_request *ureq;
-        int disable = 0;
-
-        /*
-         *********  assume under spin lock  *********
-         */
+        struct usbhs_pkt *pkt;
 
-        usbhs_fifo_disable(pipe);
-
-        /*
-         * disable pipe irq
-         */
-        usbhsg_irq_empty_ctrl(uep, disable);
-        usbhsg_irq_ready_ctrl(uep, disable);
+        usbhs_pipe_disable(pipe);
 
         while (1) {
-                ureq = usbhsg_queue_get(uep);
-                if (!ureq)
+                pkt = usbhs_pkt_pop(pipe, NULL);
+                if (!pkt)
                         break;
-
-                usbhsg_queue_pop(uep, ureq, -ECONNRESET);
         }
 
         return 0;
@@ -843,57 +470,44 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
         struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
         struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
         struct usbhs_pipe *pipe;
-        spinlock_t *lock;
-        unsigned long flags;
         int ret = -EIO;
 
         /*
          * if it already have pipe,
          * nothing to do
          */
-        if (uep->pipe)
+        if (uep->pipe) {
+                usbhs_pipe_clear(uep->pipe);
+                usbhs_pipe_clear_sequence(uep->pipe);
                 return 0;
-
-        /********************  spin lock ********************/
-        lock = usbhsg_trylock(gpriv, &flags);
+        }
 
         pipe = usbhs_pipe_malloc(priv, desc);
         if (pipe) {
                 uep->pipe               = pipe;
                 pipe->mod_private       = uep;
-                INIT_LIST_HEAD(&uep->list);
 
+                /*
+                 * usbhs_fifo_dma_push/pop_handler try to
+                 * use dmaengine if possible.
+                 * It will use pio handler if impossible.
+                 */
                 if (usb_endpoint_dir_in(desc))
-                        uep->handler = &usbhsg_handler_send_packet;
+                        uep->handler = &usbhs_fifo_dma_push_handler;
                 else
-                        uep->handler = &usbhsg_handler_recv_packet;
+                        uep->handler = &usbhs_fifo_dma_pop_handler;
 
                 ret = 0;
         }
 
-        usbhsg_unlock(lock, &flags);
-        /********************  spin unlock ******************/
-
         return ret;
 }
 
 static int usbhsg_ep_disable(struct usb_ep *ep)
 {
         struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
-        struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
-        spinlock_t *lock;
-        unsigned long flags;
-        int ret;
-
-        /********************  spin lock ********************/
-        lock = usbhsg_trylock(gpriv, &flags);
 
-        ret = usbhsg_pipe_disable(uep);
-
-        usbhsg_unlock(lock, &flags);
-        /********************  spin unlock ******************/
-
-        return ret;
+        return usbhsg_pipe_disable(uep);
 }
 
 static struct usb_request *usbhsg_ep_alloc_request(struct usb_ep *ep,
@@ -905,7 +519,10 @@ static struct usb_request *usbhsg_ep_alloc_request(struct usb_ep *ep,
         if (!ureq)
                 return NULL;
 
-        INIT_LIST_HEAD(&ureq->node);
+        usbhs_pkt_init(usbhsg_ureq_to_pkt(ureq));
+
+        ureq->req.dma = DMA_ADDR_INVALID;
+
         return &ureq->req;
 }
 
@@ -914,7 +531,7 @@ static void usbhsg_ep_free_request(struct usb_ep *ep,
 {
         struct usbhsg_request *ureq = usbhsg_req_to_ureq(req);
 
-        WARN_ON(!list_empty(&ureq->node));
+        WARN_ON(!list_empty(&ureq->pkt.node));
         kfree(ureq);
 }
 
@@ -925,69 +542,27 @@ static int usbhsg_ep_queue(struct usb_ep *ep, struct usb_request *req,
         struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
         struct usbhsg_request *ureq = usbhsg_req_to_ureq(req);
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
-        spinlock_t *lock;
-        unsigned long flags;
-        int ret = 0;
-
-        /*
-         * CAUTION [*endpoint queue*]
-         *
-         * This function will be called from usb_request :: complete
-         * or usb driver timing.
-         * If this function is called from usb_request :: complete,
-         * it is already under spinlock on this driver.
-         * but it is called frm usb driver, this function should call spinlock.
-         *
-         * This function is using usbshg_trylock to solve this issue.
-         * if "is_locked" is 1, this mean this function lock it.
-         * but if it is 0, this mean it is already under spin lock.
-         * see also
-         *   CAUTION [*queue handler*]
-         *   CAUTION [*request complete*]
-         */
-
-        /********************  spin lock ********************/
-        lock = usbhsg_trylock(gpriv, &flags);
 
         /* param check */
         if (usbhsg_is_not_connected(gpriv)      ||
             unlikely(!gpriv->driver)            ||
             unlikely(!pipe))
-                ret = -ESHUTDOWN;
-        else
-                usbhsg_queue_push(uep, ureq);
-
-        usbhsg_unlock(lock, &flags);
-        /********************  spin unlock ******************/
+                return -ESHUTDOWN;
 
-        usbhsg_queue_prepare(uep);
+        usbhsg_queue_push(uep, ureq);
 
-        return ret;
+        return 0;
 }
 
 static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
 {
         struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
         struct usbhsg_request *ureq = usbhsg_req_to_ureq(req);
-        struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
-        spinlock_t *lock;
-        unsigned long flags;
-
-        /*
-         * see
-         *   CAUTION [*queue handler*]
-         *   CAUTION [*endpoint queue*]
-         *   CAUTION [*request complete*]
-         */
-
-        /********************  spin lock ********************/
-        lock = usbhsg_trylock(gpriv, &flags);
+        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
 
+        usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq));
         usbhsg_queue_pop(uep, ureq, -ECONNRESET);
 
-        usbhsg_unlock(lock, &flags);
-        /********************  spin unlock ******************/
-
         return 0;
 }
 
@@ -996,42 +571,32 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
         struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
         struct usbhsg_gpriv *gpriv = usbhsg_uep_to_gpriv(uep);
+        struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
         struct device *dev = usbhsg_gpriv_to_dev(gpriv);
-        spinlock_t *lock;
         unsigned long flags;
-        int ret = -EAGAIN;
 
-        /*
-         * see
-         *   CAUTION [*queue handler*]
-         *   CAUTION [*endpoint queue*]
-         *   CAUTION [*request complete*]
-         */
+        usbhsg_pipe_disable(uep);
 
-        /********************  spin lock ********************/
-        lock = usbhsg_trylock(gpriv, &flags);
-        if (!usbhsg_queue_get(uep)) {
+        dev_dbg(dev, "set halt %d (pipe %d)\n",
+                halt, usbhs_pipe_number(pipe));
 
-                dev_dbg(dev, "set halt %d (pipe %d)\n",
-                        halt, usbhs_pipe_number(pipe));
-
-                if (halt)
-                        usbhs_fifo_stall(pipe);
-                else
-                        usbhs_fifo_disable(pipe);
+        /********************  spin lock ********************/
+        usbhs_lock(priv, flags);
 
-                if (halt && wedge)
-                        usbhsg_status_set(gpriv, USBHSG_STATUS_WEDGE);
-                else
-                        usbhsg_status_clr(gpriv, USBHSG_STATUS_WEDGE);
+        if (halt)
+                usbhs_pipe_stall(pipe);
+        else
+                usbhs_pipe_disable(pipe);
 
-                ret = 0;
-        }
+        if (halt && wedge)
+                usbhsg_status_set(gpriv, USBHSG_STATUS_WEDGE);
+        else
+                usbhsg_status_clr(gpriv, USBHSG_STATUS_WEDGE);
 
-        usbhsg_unlock(lock, &flags);
+        usbhs_unlock(priv, flags);
         /********************  spin unlock ******************/
 
-        return ret;
+        return 0;
 }
 
 static int usbhsg_ep_set_halt(struct usb_ep *ep, int value)
@@ -1067,28 +632,40 @@ static int usbhsg_try_start(struct usbhs_priv *priv, u32 status)
         struct usbhsg_uep *dcp = usbhsg_gpriv_to_dcp(gpriv);
         struct usbhs_mod *mod = usbhs_mod_get_current(priv);
         struct device *dev = usbhs_priv_to_dev(priv);
-        spinlock_t *lock;
         unsigned long flags;
+        int ret = 0;
 
         /********************  spin lock ********************/
-        lock = usbhsg_trylock(gpriv, &flags);
+        usbhs_lock(priv, flags);
 
-        /*
-         * enable interrupt and systems if ready
-         */
         usbhsg_status_set(gpriv, status);
         if (!(usbhsg_status_has(gpriv, USBHSG_STATUS_STARTED) &&
               usbhsg_status_has(gpriv, USBHSG_STATUS_REGISTERD)))
-                goto usbhsg_try_start_unlock;
+                ret = -1; /* not ready */
+
+        usbhs_unlock(priv, flags);
+        /********************  spin unlock ********************/
+
+        if (ret < 0)
+                return 0; /* not ready is not error */
 
+        /*
+         * enable interrupt and systems if ready
+         */
         dev_dbg(dev, "start gadget\n");
 
         /*
          * pipe initialize and enable DCP
          */
-        usbhs_pipe_init(priv);
+        usbhs_pipe_init(priv,
+                        usbhsg_queue_done,
+                        usbhsg_dma_map_ctrl);
+        usbhs_fifo_init(priv);
         usbhsg_uep_init(gpriv);
-        usbhsg_dcp_enable(dcp);
+
+        /* dcp init */
+        dcp->pipe               = usbhs_dcp_malloc(priv);
+        dcp->pipe->mod_private  = dcp;
 
         /*
          * system config enble
@@ -1105,16 +682,8 @@ static int usbhsg_try_start(struct usbhs_priv *priv, u32 status)
          */
         mod->irq_dev_state      = usbhsg_irq_dev_state;
         mod->irq_ctrl_stage     = usbhsg_irq_ctrl_stage;
-        mod->irq_empty          = usbhsg_irq_empty;
-        mod->irq_ready          = usbhsg_irq_ready;
-        mod->irq_bempsts        = 0;
-        mod->irq_brdysts        = 0;
         usbhs_irq_callback_update(priv, mod);
 
-usbhsg_try_start_unlock:
-        usbhsg_unlock(lock, &flags);
-        /********************  spin unlock ********************/
-
         return 0;
 }
 
@@ -1124,31 +693,33 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status)
         struct usbhs_mod *mod = usbhs_mod_get_current(priv);
         struct usbhsg_uep *dcp = usbhsg_gpriv_to_dcp(gpriv);
         struct device *dev = usbhs_priv_to_dev(priv);
-        spinlock_t *lock;
         unsigned long flags;
+        int ret = 0;
 
         /********************  spin lock ********************/
-        lock = usbhsg_trylock(gpriv, &flags);
+        usbhs_lock(priv, flags);
 
-        /*
-         * disable interrupt and systems if 1st try
-         */
         usbhsg_status_clr(gpriv, status);
         if (!usbhsg_status_has(gpriv, USBHSG_STATUS_STARTED) &&
             !usbhsg_status_has(gpriv, USBHSG_STATUS_REGISTERD))
-                goto usbhsg_try_stop_unlock;
+                ret = -1; /* already done */
+
+        usbhs_unlock(priv, flags);
+        /********************  spin unlock ********************/
+
+        if (ret < 0)
+                return 0; /* already done is not error */
+
+        /*
+         * disable interrupt and systems if 1st try
+         */
+        usbhs_fifo_quit(priv);
 
         /* disable all irq */
         mod->irq_dev_state      = NULL;
         mod->irq_ctrl_stage     = NULL;
-        mod->irq_empty          = NULL;
-        mod->irq_ready          = NULL;
-        mod->irq_bempsts        = 0;
-        mod->irq_brdysts        = 0;
         usbhs_irq_callback_update(priv, mod);
 
-        usbhsg_dcp_disable(dcp);
-
         gpriv->gadget.speed = USB_SPEED_UNKNOWN;
 
         /* disable sys */
@@ -1156,8 +727,7 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status)
         usbhs_sys_function_ctrl(priv, 0);
         usbhs_sys_usb_ctrl(priv, 0);
 
-        usbhsg_unlock(lock, &flags);
-        /********************  spin unlock ********************/
+        usbhsg_pipe_disable(dcp);
 
         if (gpriv->driver &&
             gpriv->driver->disconnect)
@@ -1166,11 +736,6 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status)
         dev_dbg(dev, "stop gadget\n");
 
         return 0;
-
-usbhsg_try_stop_unlock:
-        usbhsg_unlock(lock, &flags);
-
-        return 0;
 }
 
 /*
@@ -1178,11 +743,10 @@ usbhsg_try_stop_unlock:
  *              linux usb function
  *
  */
-struct usbhsg_gpriv *the_controller;
-int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+static int usbhsg_gadget_start(struct usb_gadget_driver *driver,
                             int (*bind)(struct usb_gadget *))
 {
-        struct usbhsg_gpriv *gpriv = the_controller;
+        struct usbhsg_gpriv *gpriv;
         struct usbhs_priv *priv;
         struct device *dev;
         int ret;
@@ -1192,10 +756,17 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
             !driver->setup      ||
             driver->speed != USB_SPEED_HIGH)
                 return -EINVAL;
-        if (!gpriv)
-                return -ENODEV;
-        if (gpriv->driver)
-                return -EBUSY;
+
+        /*
+         * find unused controller
+         */
+        usbhsg_for_each_controller(gpriv) {
+                if (!gpriv->driver)
+                        goto find_unused_controller;
+        }
+        return -ENODEV;
+
+find_unused_controller:
 
         dev  = usbhsg_gpriv_to_dev(gpriv);
         priv = usbhsg_gpriv_to_priv(gpriv);
@@ -1229,22 +800,28 @@ add_fail:
 
         return ret;
 }
-EXPORT_SYMBOL(usb_gadget_probe_driver);
 
-int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
+static int usbhsg_gadget_stop(struct usb_gadget_driver *driver)
 {
-        struct usbhsg_gpriv *gpriv = the_controller;
+        struct usbhsg_gpriv *gpriv;
         struct usbhs_priv *priv;
-        struct device *dev = usbhsg_gpriv_to_dev(gpriv);
-
-        if (!gpriv)
-                return -ENODEV;
+        struct device *dev;
 
         if (!driver             ||
-            !driver->unbind     ||
-            driver != gpriv->driver)
+            !driver->unbind)
                 return -EINVAL;
 
+        /*
+         * find controller
+         */
+        usbhsg_for_each_controller(gpriv) {
+                if (gpriv->driver == driver)
+                        goto find_matching_controller;
+        }
+        return -ENODEV;
+
+find_matching_controller:
+
         dev  = usbhsg_gpriv_to_dev(gpriv);
         priv = usbhsg_gpriv_to_priv(gpriv);
 
@@ -1260,7 +837,6 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 
         return 0;
 }
-EXPORT_SYMBOL(usb_gadget_unregister_driver);
 
 /*
  *              usb gadget ops
@@ -1275,6 +851,8 @@ static int usbhsg_get_frame(struct usb_gadget *gadget)
 
 static struct usb_gadget_ops usbhsg_gadget_ops = {
         .get_frame              = usbhsg_get_frame,
+        .start                  = usbhsg_gadget_start,
+        .stop                   = usbhsg_gadget_stop,
 };
 
 static int usbhsg_start(struct usbhs_priv *priv)
@@ -1294,6 +872,7 @@ int __devinit usbhs_mod_gadget_probe(struct usbhs_priv *priv)
         struct device *dev = usbhs_priv_to_dev(priv);
         int pipe_size = usbhs_get_dparam(priv, pipe_size);
         int i;
+        int ret;
 
         gpriv = kzalloc(sizeof(struct usbhsg_gpriv), GFP_KERNEL);
         if (!gpriv) {
@@ -1304,6 +883,7 @@ int __devinit usbhs_mod_gadget_probe(struct usbhs_priv *priv)
         uep = kzalloc(sizeof(struct usbhsg_uep) * pipe_size, GFP_KERNEL);
         if (!uep) {
                 dev_err(dev, "Could not allocate ep\n");
+                ret = -ENOMEM;
                 goto usbhs_mod_gadget_probe_err_gpriv;
         }
 
@@ -1350,7 +930,6 @@ int __devinit usbhs_mod_gadget_probe(struct usbhs_priv *priv)
                 uep->ep.name            = uep->ep_name;
                 uep->ep.ops             = &usbhsg_ep_ops;
                 INIT_LIST_HEAD(&uep->ep.ep_list);
-                INIT_LIST_HEAD(&uep->list);
 
                 /* init DCP */
                 if (usbhsg_is_dcp(uep)) {
@@ -1364,22 +943,33 @@ int __devinit usbhs_mod_gadget_probe(struct usbhs_priv *priv)
                 }
         }
 
-        the_controller = gpriv;
+        usbhsg_controller_register(gpriv);
+
+        ret = usb_add_gadget_udc(dev, &gpriv->gadget);
+        if (ret)
+                goto err_add_udc;
+
 
         dev_info(dev, "gadget probed\n");
 
         return 0;
+err_add_udc:
+        kfree(gpriv->uep);
 
 usbhs_mod_gadget_probe_err_gpriv:
         kfree(gpriv);
 
-        return -ENOMEM;
+        return ret;
 }
 
 void __devexit usbhs_mod_gadget_remove(struct usbhs_priv *priv)
 {
         struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
 
+        usb_del_gadget_udc(&gpriv->gadget);
+
+        usbhsg_controller_unregister(gpriv);
+
         kfree(gpriv->uep);
         kfree(gpriv);
 }