Loading...
1/*
2 * Driver for the NXP ISP1761 device controller
3 *
4 * Copyright 2014 Ideas on Board Oy
5 *
6 * Contacts:
7 * Laurent Pinchart <laurent.pinchart@ideasonboard.com>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * version 2 as published by the Free Software Foundation.
12 */
13
14#include <linux/interrupt.h>
15#include <linux/io.h>
16#include <linux/kernel.h>
17#include <linux/list.h>
18#include <linux/module.h>
19#include <linux/slab.h>
20#include <linux/timer.h>
21#include <linux/usb.h>
22
23#include "isp1760-core.h"
24#include "isp1760-regs.h"
25#include "isp1760-udc.h"
26
27#define ISP1760_VBUS_POLL_INTERVAL msecs_to_jiffies(500)
28
29struct isp1760_request {
30 struct usb_request req;
31 struct list_head queue;
32 struct isp1760_ep *ep;
33 unsigned int packet_size;
34};
35
36static inline struct isp1760_udc *gadget_to_udc(struct usb_gadget *gadget)
37{
38 return container_of(gadget, struct isp1760_udc, gadget);
39}
40
41static inline struct isp1760_ep *ep_to_udc_ep(struct usb_ep *ep)
42{
43 return container_of(ep, struct isp1760_ep, ep);
44}
45
46static inline struct isp1760_request *req_to_udc_req(struct usb_request *req)
47{
48 return container_of(req, struct isp1760_request, req);
49}
50
51static inline u32 isp1760_udc_read(struct isp1760_udc *udc, u16 reg)
52{
53 return isp1760_read32(udc->regs, reg);
54}
55
56static inline void isp1760_udc_write(struct isp1760_udc *udc, u16 reg, u32 val)
57{
58 isp1760_write32(udc->regs, reg, val);
59}
60
61/* -----------------------------------------------------------------------------
62 * Endpoint Management
63 */
64
65static struct isp1760_ep *isp1760_udc_find_ep(struct isp1760_udc *udc,
66 u16 index)
67{
68 unsigned int i;
69
70 if (index == 0)
71 return &udc->ep[0];
72
73 for (i = 1; i < ARRAY_SIZE(udc->ep); ++i) {
74 if (udc->ep[i].addr == index)
75 return udc->ep[i].desc ? &udc->ep[i] : NULL;
76 }
77
78 return NULL;
79}
80
81static void __isp1760_udc_select_ep(struct isp1760_ep *ep, int dir)
82{
83 isp1760_udc_write(ep->udc, DC_EPINDEX,
84 DC_ENDPIDX(ep->addr & USB_ENDPOINT_NUMBER_MASK) |
85 (dir == USB_DIR_IN ? DC_EPDIR : 0));
86}
87
88/**
89 * isp1760_udc_select_ep - Select an endpoint for register access
90 * @ep: The endpoint
91 *
92 * The ISP1761 endpoint registers are banked. This function selects the target
93 * endpoint for banked register access. The selection remains valid until the
94 * next call to this function, the next direct access to the EPINDEX register
95 * or the next reset, whichever comes first.
96 *
97 * Called with the UDC spinlock held.
98 */
99static void isp1760_udc_select_ep(struct isp1760_ep *ep)
100{
101 __isp1760_udc_select_ep(ep, ep->addr & USB_ENDPOINT_DIR_MASK);
102}
103
104/* Called with the UDC spinlock held. */
105static void isp1760_udc_ctrl_send_status(struct isp1760_ep *ep, int dir)
106{
107 struct isp1760_udc *udc = ep->udc;
108
109 /*
110 * Proceed to the status stage. The status stage data packet flows in
111 * the direction opposite to the data stage data packets, we thus need
112 * to select the OUT/IN endpoint for IN/OUT transfers.
113 */
114 isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) |
115 (dir == USB_DIR_IN ? 0 : DC_EPDIR));
116 isp1760_udc_write(udc, DC_CTRLFUNC, DC_STATUS);
117
118 /*
119 * The hardware will terminate the request automatically and go back to
120 * the setup stage without notifying us.
121 */
122 udc->ep0_state = ISP1760_CTRL_SETUP;
123}
124
125/* Called without the UDC spinlock held. */
126static void isp1760_udc_request_complete(struct isp1760_ep *ep,
127 struct isp1760_request *req,
128 int status)
129{
130 struct isp1760_udc *udc = ep->udc;
131 unsigned long flags;
132
133 dev_dbg(ep->udc->isp->dev, "completing request %p with status %d\n",
134 req, status);
135
136 req->ep = NULL;
137 req->req.status = status;
138 req->req.complete(&ep->ep, &req->req);
139
140 spin_lock_irqsave(&udc->lock, flags);
141
142 /*
143 * When completing control OUT requests, move to the status stage after
144 * calling the request complete callback. This gives the gadget an
145 * opportunity to stall the control transfer if needed.
146 */
147 if (status == 0 && ep->addr == 0 && udc->ep0_dir == USB_DIR_OUT)
148 isp1760_udc_ctrl_send_status(ep, USB_DIR_OUT);
149
150 spin_unlock_irqrestore(&udc->lock, flags);
151}
152
153static void isp1760_udc_ctrl_send_stall(struct isp1760_ep *ep)
154{
155 struct isp1760_udc *udc = ep->udc;
156 unsigned long flags;
157
158 dev_dbg(ep->udc->isp->dev, "%s(ep%02x)\n", __func__, ep->addr);
159
160 spin_lock_irqsave(&udc->lock, flags);
161
162 /* Stall both the IN and OUT endpoints. */
163 __isp1760_udc_select_ep(ep, USB_DIR_OUT);
164 isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
165 __isp1760_udc_select_ep(ep, USB_DIR_IN);
166 isp1760_udc_write(udc, DC_CTRLFUNC, DC_STALL);
167
168 /* A protocol stall completes the control transaction. */
169 udc->ep0_state = ISP1760_CTRL_SETUP;
170
171 spin_unlock_irqrestore(&udc->lock, flags);
172}
173
174/* -----------------------------------------------------------------------------
175 * Data Endpoints
176 */
177
178/* Called with the UDC spinlock held. */
179static bool isp1760_udc_receive(struct isp1760_ep *ep,
180 struct isp1760_request *req)
181{
182 struct isp1760_udc *udc = ep->udc;
183 unsigned int len;
184 u32 *buf;
185 int i;
186
187 isp1760_udc_select_ep(ep);
188 len = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
189
190 dev_dbg(udc->isp->dev, "%s: received %u bytes (%u/%u done)\n",
191 __func__, len, req->req.actual, req->req.length);
192
193 len = min(len, req->req.length - req->req.actual);
194
195 if (!len) {
196 /*
197 * There's no data to be read from the FIFO, acknowledge the RX
198 * interrupt by clearing the buffer.
199 *
200 * TODO: What if another packet arrives in the meantime ? The
201 * datasheet doesn't clearly document how this should be
202 * handled.
203 */
204 isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
205 return false;
206 }
207
208 buf = req->req.buf + req->req.actual;
209
210 /*
211 * Make sure not to read more than one extra byte, otherwise data from
212 * the next packet might be removed from the FIFO.
213 */
214 for (i = len; i > 2; i -= 4, ++buf)
215 *buf = le32_to_cpu(isp1760_udc_read(udc, DC_DATAPORT));
216 if (i > 0)
217 *(u16 *)buf = le16_to_cpu(readw(udc->regs + DC_DATAPORT));
218
219 req->req.actual += len;
220
221 /*
222 * TODO: The short_not_ok flag isn't supported yet, but isn't used by
223 * any gadget driver either.
224 */
225
226 dev_dbg(udc->isp->dev,
227 "%s: req %p actual/length %u/%u maxpacket %u packet size %u\n",
228 __func__, req, req->req.actual, req->req.length, ep->maxpacket,
229 len);
230
231 ep->rx_pending = false;
232
233 /*
234 * Complete the request if all data has been received or if a short
235 * packet has been received.
236 */
237 if (req->req.actual == req->req.length || len < ep->maxpacket) {
238 list_del(&req->queue);
239 return true;
240 }
241
242 return false;
243}
244
245static void isp1760_udc_transmit(struct isp1760_ep *ep,
246 struct isp1760_request *req)
247{
248 struct isp1760_udc *udc = ep->udc;
249 u32 *buf = req->req.buf + req->req.actual;
250 int i;
251
252 req->packet_size = min(req->req.length - req->req.actual,
253 ep->maxpacket);
254
255 dev_dbg(udc->isp->dev, "%s: transferring %u bytes (%u/%u done)\n",
256 __func__, req->packet_size, req->req.actual,
257 req->req.length);
258
259 __isp1760_udc_select_ep(ep, USB_DIR_IN);
260
261 if (req->packet_size)
262 isp1760_udc_write(udc, DC_BUFLEN, req->packet_size);
263
264 /*
265 * Make sure not to write more than one extra byte, otherwise extra data
266 * will stay in the FIFO and will be transmitted during the next control
267 * request. The endpoint control CLBUF bit is supposed to allow flushing
268 * the FIFO for this kind of conditions, but doesn't seem to work.
269 */
270 for (i = req->packet_size; i > 2; i -= 4, ++buf)
271 isp1760_udc_write(udc, DC_DATAPORT, cpu_to_le32(*buf));
272 if (i > 0)
273 writew(cpu_to_le16(*(u16 *)buf), udc->regs + DC_DATAPORT);
274
275 if (ep->addr == 0)
276 isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
277 if (!req->packet_size)
278 isp1760_udc_write(udc, DC_CTRLFUNC, DC_VENDP);
279}
280
281static void isp1760_ep_rx_ready(struct isp1760_ep *ep)
282{
283 struct isp1760_udc *udc = ep->udc;
284 struct isp1760_request *req;
285 bool complete;
286
287 spin_lock(&udc->lock);
288
289 if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_OUT) {
290 spin_unlock(&udc->lock);
291 dev_dbg(udc->isp->dev, "%s: invalid ep0 state %u\n", __func__,
292 udc->ep0_state);
293 return;
294 }
295
296 if (ep->addr != 0 && !ep->desc) {
297 spin_unlock(&udc->lock);
298 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
299 ep->addr);
300 return;
301 }
302
303 if (list_empty(&ep->queue)) {
304 ep->rx_pending = true;
305 spin_unlock(&udc->lock);
306 dev_dbg(udc->isp->dev, "%s: ep%02x (%p) has no request queued\n",
307 __func__, ep->addr, ep);
308 return;
309 }
310
311 req = list_first_entry(&ep->queue, struct isp1760_request,
312 queue);
313 complete = isp1760_udc_receive(ep, req);
314
315 spin_unlock(&udc->lock);
316
317 if (complete)
318 isp1760_udc_request_complete(ep, req, 0);
319}
320
321static void isp1760_ep_tx_complete(struct isp1760_ep *ep)
322{
323 struct isp1760_udc *udc = ep->udc;
324 struct isp1760_request *complete = NULL;
325 struct isp1760_request *req;
326 bool need_zlp;
327
328 spin_lock(&udc->lock);
329
330 if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_IN) {
331 spin_unlock(&udc->lock);
332 dev_dbg(udc->isp->dev, "TX IRQ: invalid endpoint state %u\n",
333 udc->ep0_state);
334 return;
335 }
336
337 if (list_empty(&ep->queue)) {
338 /*
339 * This can happen for the control endpoint when the reply to
340 * the GET_STATUS IN control request is sent directly by the
341 * setup IRQ handler. Just proceed to the status stage.
342 */
343 if (ep->addr == 0) {
344 isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
345 spin_unlock(&udc->lock);
346 return;
347 }
348
349 spin_unlock(&udc->lock);
350 dev_dbg(udc->isp->dev, "%s: ep%02x has no request queued\n",
351 __func__, ep->addr);
352 return;
353 }
354
355 req = list_first_entry(&ep->queue, struct isp1760_request,
356 queue);
357 req->req.actual += req->packet_size;
358
359 need_zlp = req->req.actual == req->req.length &&
360 !(req->req.length % ep->maxpacket) &&
361 req->packet_size && req->req.zero;
362
363 dev_dbg(udc->isp->dev,
364 "TX IRQ: req %p actual/length %u/%u maxpacket %u packet size %u zero %u need zlp %u\n",
365 req, req->req.actual, req->req.length, ep->maxpacket,
366 req->packet_size, req->req.zero, need_zlp);
367
368 /*
369 * Complete the request if all data has been sent and we don't need to
370 * transmit a zero length packet.
371 */
372 if (req->req.actual == req->req.length && !need_zlp) {
373 complete = req;
374 list_del(&req->queue);
375
376 if (ep->addr == 0)
377 isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
378
379 if (!list_empty(&ep->queue))
380 req = list_first_entry(&ep->queue,
381 struct isp1760_request, queue);
382 else
383 req = NULL;
384 }
385
386 /*
387 * Transmit the next packet or start the next request, if any.
388 *
389 * TODO: If the endpoint is stalled the next request shouldn't be
390 * started, but what about the next packet ?
391 */
392 if (req)
393 isp1760_udc_transmit(ep, req);
394
395 spin_unlock(&udc->lock);
396
397 if (complete)
398 isp1760_udc_request_complete(ep, complete, 0);
399}
400
401static int __isp1760_udc_set_halt(struct isp1760_ep *ep, bool halt)
402{
403 struct isp1760_udc *udc = ep->udc;
404
405 dev_dbg(udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
406 halt ? "set" : "clear", ep->addr);
407
408 if (ep->desc && usb_endpoint_xfer_isoc(ep->desc)) {
409 dev_dbg(udc->isp->dev, "%s: ep%02x is isochronous\n", __func__,
410 ep->addr);
411 return -EINVAL;
412 }
413
414 isp1760_udc_select_ep(ep);
415 isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
416
417 if (ep->addr == 0) {
418 /* When halting the control endpoint, stall both IN and OUT. */
419 __isp1760_udc_select_ep(ep, USB_DIR_IN);
420 isp1760_udc_write(udc, DC_CTRLFUNC, halt ? DC_STALL : 0);
421 } else if (!halt) {
422 /* Reset the data PID by cycling the endpoint enable bit. */
423 u16 eptype = isp1760_udc_read(udc, DC_EPTYPE);
424
425 isp1760_udc_write(udc, DC_EPTYPE, eptype & ~DC_EPENABLE);
426 isp1760_udc_write(udc, DC_EPTYPE, eptype);
427
428 /*
429 * Disabling the endpoint emptied the transmit FIFO, fill it
430 * again if a request is pending.
431 *
432 * TODO: Does the gadget framework require synchronizatino with
433 * the TX IRQ handler ?
434 */
435 if ((ep->addr & USB_DIR_IN) && !list_empty(&ep->queue)) {
436 struct isp1760_request *req;
437
438 req = list_first_entry(&ep->queue,
439 struct isp1760_request, queue);
440 isp1760_udc_transmit(ep, req);
441 }
442 }
443
444 ep->halted = halt;
445
446 return 0;
447}
448
449/* -----------------------------------------------------------------------------
450 * Control Endpoint
451 */
452
453static int isp1760_udc_get_status(struct isp1760_udc *udc,
454 const struct usb_ctrlrequest *req)
455{
456 struct isp1760_ep *ep;
457 u16 status;
458
459 if (req->wLength != cpu_to_le16(2) || req->wValue != cpu_to_le16(0))
460 return -EINVAL;
461
462 switch (req->bRequestType) {
463 case USB_DIR_IN | USB_RECIP_DEVICE:
464 status = udc->devstatus;
465 break;
466
467 case USB_DIR_IN | USB_RECIP_INTERFACE:
468 status = 0;
469 break;
470
471 case USB_DIR_IN | USB_RECIP_ENDPOINT:
472 ep = isp1760_udc_find_ep(udc, le16_to_cpu(req->wIndex));
473 if (!ep)
474 return -EINVAL;
475
476 status = 0;
477 if (ep->halted)
478 status |= 1 << USB_ENDPOINT_HALT;
479 break;
480
481 default:
482 return -EINVAL;
483 }
484
485 isp1760_udc_write(udc, DC_EPINDEX, DC_ENDPIDX(0) | DC_EPDIR);
486 isp1760_udc_write(udc, DC_BUFLEN, 2);
487
488 writew(cpu_to_le16(status), udc->regs + DC_DATAPORT);
489
490 isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
491
492 dev_dbg(udc->isp->dev, "%s: status 0x%04x\n", __func__, status);
493
494 return 0;
495}
496
497static int isp1760_udc_set_address(struct isp1760_udc *udc, u16 addr)
498{
499 if (addr > 127) {
500 dev_dbg(udc->isp->dev, "invalid device address %u\n", addr);
501 return -EINVAL;
502 }
503
504 if (udc->gadget.state != USB_STATE_DEFAULT &&
505 udc->gadget.state != USB_STATE_ADDRESS) {
506 dev_dbg(udc->isp->dev, "can't set address in state %u\n",
507 udc->gadget.state);
508 return -EINVAL;
509 }
510
511 usb_gadget_set_state(&udc->gadget, addr ? USB_STATE_ADDRESS :
512 USB_STATE_DEFAULT);
513
514 isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN | addr);
515
516 spin_lock(&udc->lock);
517 isp1760_udc_ctrl_send_status(&udc->ep[0], USB_DIR_OUT);
518 spin_unlock(&udc->lock);
519
520 return 0;
521}
522
523static bool isp1760_ep0_setup_standard(struct isp1760_udc *udc,
524 struct usb_ctrlrequest *req)
525{
526 bool stall;
527
528 switch (req->bRequest) {
529 case USB_REQ_GET_STATUS:
530 return isp1760_udc_get_status(udc, req);
531
532 case USB_REQ_CLEAR_FEATURE:
533 switch (req->bRequestType) {
534 case USB_DIR_OUT | USB_RECIP_DEVICE: {
535 /* TODO: Handle remote wakeup feature. */
536 return true;
537 }
538
539 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
540 u16 index = le16_to_cpu(req->wIndex);
541 struct isp1760_ep *ep;
542
543 if (req->wLength != cpu_to_le16(0) ||
544 req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
545 return true;
546
547 ep = isp1760_udc_find_ep(udc, index);
548 if (!ep)
549 return true;
550
551 spin_lock(&udc->lock);
552
553 /*
554 * If the endpoint is wedged only the gadget can clear
555 * the halt feature. Pretend success in that case, but
556 * keep the endpoint halted.
557 */
558 if (!ep->wedged)
559 stall = __isp1760_udc_set_halt(ep, false);
560 else
561 stall = false;
562
563 if (!stall)
564 isp1760_udc_ctrl_send_status(&udc->ep[0],
565 USB_DIR_OUT);
566
567 spin_unlock(&udc->lock);
568 return stall;
569 }
570
571 default:
572 return true;
573 }
574 break;
575
576 case USB_REQ_SET_FEATURE:
577 switch (req->bRequestType) {
578 case USB_DIR_OUT | USB_RECIP_DEVICE: {
579 /* TODO: Handle remote wakeup and test mode features */
580 return true;
581 }
582
583 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
584 u16 index = le16_to_cpu(req->wIndex);
585 struct isp1760_ep *ep;
586
587 if (req->wLength != cpu_to_le16(0) ||
588 req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
589 return true;
590
591 ep = isp1760_udc_find_ep(udc, index);
592 if (!ep)
593 return true;
594
595 spin_lock(&udc->lock);
596
597 stall = __isp1760_udc_set_halt(ep, true);
598 if (!stall)
599 isp1760_udc_ctrl_send_status(&udc->ep[0],
600 USB_DIR_OUT);
601
602 spin_unlock(&udc->lock);
603 return stall;
604 }
605
606 default:
607 return true;
608 }
609 break;
610
611 case USB_REQ_SET_ADDRESS:
612 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
613 return true;
614
615 return isp1760_udc_set_address(udc, le16_to_cpu(req->wValue));
616
617 case USB_REQ_SET_CONFIGURATION:
618 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
619 return true;
620
621 if (udc->gadget.state != USB_STATE_ADDRESS &&
622 udc->gadget.state != USB_STATE_CONFIGURED)
623 return true;
624
625 stall = udc->driver->setup(&udc->gadget, req) < 0;
626 if (stall)
627 return true;
628
629 usb_gadget_set_state(&udc->gadget, req->wValue ?
630 USB_STATE_CONFIGURED : USB_STATE_ADDRESS);
631
632 /*
633 * SET_CONFIGURATION (and SET_INTERFACE) must reset the halt
634 * feature on all endpoints. There is however no need to do so
635 * explicitly here as the gadget driver will disable and
636 * reenable endpoints, clearing the halt feature.
637 */
638 return false;
639
640 default:
641 return udc->driver->setup(&udc->gadget, req) < 0;
642 }
643}
644
645static void isp1760_ep0_setup(struct isp1760_udc *udc)
646{
647 union {
648 struct usb_ctrlrequest r;
649 u32 data[2];
650 } req;
651 unsigned int count;
652 bool stall = false;
653
654 spin_lock(&udc->lock);
655
656 isp1760_udc_write(udc, DC_EPINDEX, DC_EP0SETUP);
657
658 count = isp1760_udc_read(udc, DC_BUFLEN) & DC_DATACOUNT_MASK;
659 if (count != sizeof(req)) {
660 spin_unlock(&udc->lock);
661
662 dev_err(udc->isp->dev, "invalid length %u for setup packet\n",
663 count);
664
665 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
666 return;
667 }
668
669 req.data[0] = isp1760_udc_read(udc, DC_DATAPORT);
670 req.data[1] = isp1760_udc_read(udc, DC_DATAPORT);
671
672 if (udc->ep0_state != ISP1760_CTRL_SETUP) {
673 spin_unlock(&udc->lock);
674 dev_dbg(udc->isp->dev, "unexpected SETUP packet\n");
675 return;
676 }
677
678 /* Move to the data stage. */
679 if (!req.r.wLength)
680 udc->ep0_state = ISP1760_CTRL_STATUS;
681 else if (req.r.bRequestType & USB_DIR_IN)
682 udc->ep0_state = ISP1760_CTRL_DATA_IN;
683 else
684 udc->ep0_state = ISP1760_CTRL_DATA_OUT;
685
686 udc->ep0_dir = req.r.bRequestType & USB_DIR_IN;
687 udc->ep0_length = le16_to_cpu(req.r.wLength);
688
689 spin_unlock(&udc->lock);
690
691 dev_dbg(udc->isp->dev,
692 "%s: bRequestType 0x%02x bRequest 0x%02x wValue 0x%04x wIndex 0x%04x wLength 0x%04x\n",
693 __func__, req.r.bRequestType, req.r.bRequest,
694 le16_to_cpu(req.r.wValue), le16_to_cpu(req.r.wIndex),
695 le16_to_cpu(req.r.wLength));
696
697 if ((req.r.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
698 stall = isp1760_ep0_setup_standard(udc, &req.r);
699 else
700 stall = udc->driver->setup(&udc->gadget, &req.r) < 0;
701
702 if (stall)
703 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
704}
705
706/* -----------------------------------------------------------------------------
707 * Gadget Endpoint Operations
708 */
709
710static int isp1760_ep_enable(struct usb_ep *ep,
711 const struct usb_endpoint_descriptor *desc)
712{
713 struct isp1760_ep *uep = ep_to_udc_ep(ep);
714 struct isp1760_udc *udc = uep->udc;
715 unsigned long flags;
716 unsigned int type;
717
718 dev_dbg(uep->udc->isp->dev, "%s\n", __func__);
719
720 /*
721 * Validate the descriptor. The control endpoint can't be enabled
722 * manually.
723 */
724 if (desc->bDescriptorType != USB_DT_ENDPOINT ||
725 desc->bEndpointAddress == 0 ||
726 desc->bEndpointAddress != uep->addr ||
727 le16_to_cpu(desc->wMaxPacketSize) > ep->maxpacket) {
728 dev_dbg(udc->isp->dev,
729 "%s: invalid descriptor type %u addr %02x ep addr %02x max packet size %u/%u\n",
730 __func__, desc->bDescriptorType,
731 desc->bEndpointAddress, uep->addr,
732 le16_to_cpu(desc->wMaxPacketSize), ep->maxpacket);
733 return -EINVAL;
734 }
735
736 switch (usb_endpoint_type(desc)) {
737 case USB_ENDPOINT_XFER_ISOC:
738 type = DC_ENDPTYP_ISOC;
739 break;
740 case USB_ENDPOINT_XFER_BULK:
741 type = DC_ENDPTYP_BULK;
742 break;
743 case USB_ENDPOINT_XFER_INT:
744 type = DC_ENDPTYP_INTERRUPT;
745 break;
746 case USB_ENDPOINT_XFER_CONTROL:
747 default:
748 dev_dbg(udc->isp->dev, "%s: control endpoints unsupported\n",
749 __func__);
750 return -EINVAL;
751 }
752
753 spin_lock_irqsave(&udc->lock, flags);
754
755 uep->desc = desc;
756 uep->maxpacket = le16_to_cpu(desc->wMaxPacketSize);
757 uep->rx_pending = false;
758 uep->halted = false;
759 uep->wedged = false;
760
761 isp1760_udc_select_ep(uep);
762 isp1760_udc_write(udc, DC_EPMAXPKTSZ, uep->maxpacket);
763 isp1760_udc_write(udc, DC_BUFLEN, uep->maxpacket);
764 isp1760_udc_write(udc, DC_EPTYPE, DC_EPENABLE | type);
765
766 spin_unlock_irqrestore(&udc->lock, flags);
767
768 return 0;
769}
770
771static int isp1760_ep_disable(struct usb_ep *ep)
772{
773 struct isp1760_ep *uep = ep_to_udc_ep(ep);
774 struct isp1760_udc *udc = uep->udc;
775 struct isp1760_request *req, *nreq;
776 LIST_HEAD(req_list);
777 unsigned long flags;
778
779 dev_dbg(udc->isp->dev, "%s\n", __func__);
780
781 spin_lock_irqsave(&udc->lock, flags);
782
783 if (!uep->desc) {
784 dev_dbg(udc->isp->dev, "%s: endpoint not enabled\n", __func__);
785 spin_unlock_irqrestore(&udc->lock, flags);
786 return -EINVAL;
787 }
788
789 uep->desc = NULL;
790 uep->maxpacket = 0;
791
792 isp1760_udc_select_ep(uep);
793 isp1760_udc_write(udc, DC_EPTYPE, 0);
794
795 /* TODO Synchronize with the IRQ handler */
796
797 list_splice_init(&uep->queue, &req_list);
798
799 spin_unlock_irqrestore(&udc->lock, flags);
800
801 list_for_each_entry_safe(req, nreq, &req_list, queue) {
802 list_del(&req->queue);
803 isp1760_udc_request_complete(uep, req, -ESHUTDOWN);
804 }
805
806 return 0;
807}
808
809static struct usb_request *isp1760_ep_alloc_request(struct usb_ep *ep,
810 gfp_t gfp_flags)
811{
812 struct isp1760_request *req;
813
814 req = kzalloc(sizeof(*req), gfp_flags);
815 if (!req)
816 return NULL;
817
818 return &req->req;
819}
820
821static void isp1760_ep_free_request(struct usb_ep *ep, struct usb_request *_req)
822{
823 struct isp1760_request *req = req_to_udc_req(_req);
824
825 kfree(req);
826}
827
828static int isp1760_ep_queue(struct usb_ep *ep, struct usb_request *_req,
829 gfp_t gfp_flags)
830{
831 struct isp1760_request *req = req_to_udc_req(_req);
832 struct isp1760_ep *uep = ep_to_udc_ep(ep);
833 struct isp1760_udc *udc = uep->udc;
834 bool complete = false;
835 unsigned long flags;
836 int ret = 0;
837
838 _req->status = -EINPROGRESS;
839 _req->actual = 0;
840
841 spin_lock_irqsave(&udc->lock, flags);
842
843 dev_dbg(udc->isp->dev,
844 "%s: req %p (%u bytes%s) ep %p(0x%02x)\n", __func__, _req,
845 _req->length, _req->zero ? " (zlp)" : "", uep, uep->addr);
846
847 req->ep = uep;
848
849 if (uep->addr == 0) {
850 if (_req->length != udc->ep0_length &&
851 udc->ep0_state != ISP1760_CTRL_DATA_IN) {
852 dev_dbg(udc->isp->dev,
853 "%s: invalid length %u for req %p\n",
854 __func__, _req->length, req);
855 ret = -EINVAL;
856 goto done;
857 }
858
859 switch (udc->ep0_state) {
860 case ISP1760_CTRL_DATA_IN:
861 dev_dbg(udc->isp->dev, "%s: transmitting req %p\n",
862 __func__, req);
863
864 list_add_tail(&req->queue, &uep->queue);
865 isp1760_udc_transmit(uep, req);
866 break;
867
868 case ISP1760_CTRL_DATA_OUT:
869 list_add_tail(&req->queue, &uep->queue);
870 __isp1760_udc_select_ep(uep, USB_DIR_OUT);
871 isp1760_udc_write(udc, DC_CTRLFUNC, DC_DSEN);
872 break;
873
874 case ISP1760_CTRL_STATUS:
875 complete = true;
876 break;
877
878 default:
879 dev_dbg(udc->isp->dev, "%s: invalid ep0 state\n",
880 __func__);
881 ret = -EINVAL;
882 break;
883 }
884 } else if (uep->desc) {
885 bool empty = list_empty(&uep->queue);
886
887 list_add_tail(&req->queue, &uep->queue);
888 if ((uep->addr & USB_DIR_IN) && !uep->halted && empty)
889 isp1760_udc_transmit(uep, req);
890 else if (!(uep->addr & USB_DIR_IN) && uep->rx_pending)
891 complete = isp1760_udc_receive(uep, req);
892 } else {
893 dev_dbg(udc->isp->dev,
894 "%s: can't queue request to disabled ep%02x\n",
895 __func__, uep->addr);
896 ret = -ESHUTDOWN;
897 }
898
899done:
900 if (ret < 0)
901 req->ep = NULL;
902
903 spin_unlock_irqrestore(&udc->lock, flags);
904
905 if (complete)
906 isp1760_udc_request_complete(uep, req, 0);
907
908 return ret;
909}
910
911static int isp1760_ep_dequeue(struct usb_ep *ep, struct usb_request *_req)
912{
913 struct isp1760_request *req = req_to_udc_req(_req);
914 struct isp1760_ep *uep = ep_to_udc_ep(ep);
915 struct isp1760_udc *udc = uep->udc;
916 unsigned long flags;
917
918 dev_dbg(uep->udc->isp->dev, "%s(ep%02x)\n", __func__, uep->addr);
919
920 spin_lock_irqsave(&udc->lock, flags);
921
922 if (req->ep != uep)
923 req = NULL;
924 else
925 list_del(&req->queue);
926
927 spin_unlock_irqrestore(&udc->lock, flags);
928
929 if (!req)
930 return -EINVAL;
931
932 isp1760_udc_request_complete(uep, req, -ECONNRESET);
933 return 0;
934}
935
936static int __isp1760_ep_set_halt(struct isp1760_ep *uep, bool stall, bool wedge)
937{
938 struct isp1760_udc *udc = uep->udc;
939 int ret;
940
941 if (!uep->addr) {
942 /*
943 * Halting the control endpoint is only valid as a delayed error
944 * response to a SETUP packet. Make sure EP0 is in the right
945 * stage and that the gadget isn't trying to clear the halt
946 * condition.
947 */
948 if (WARN_ON(udc->ep0_state == ISP1760_CTRL_SETUP || !stall ||
949 wedge)) {
950 return -EINVAL;
951 }
952 }
953
954 if (uep->addr && !uep->desc) {
955 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
956 uep->addr);
957 return -EINVAL;
958 }
959
960 if (uep->addr & USB_DIR_IN) {
961 /* Refuse to halt IN endpoints with active transfers. */
962 if (!list_empty(&uep->queue)) {
963 dev_dbg(udc->isp->dev,
964 "%s: ep%02x has request pending\n", __func__,
965 uep->addr);
966 return -EAGAIN;
967 }
968 }
969
970 ret = __isp1760_udc_set_halt(uep, stall);
971 if (ret < 0)
972 return ret;
973
974 if (!uep->addr) {
975 /*
976 * Stalling EP0 completes the control transaction, move back to
977 * the SETUP state.
978 */
979 udc->ep0_state = ISP1760_CTRL_SETUP;
980 return 0;
981 }
982
983 if (wedge)
984 uep->wedged = true;
985 else if (!stall)
986 uep->wedged = false;
987
988 return 0;
989}
990
991static int isp1760_ep_set_halt(struct usb_ep *ep, int value)
992{
993 struct isp1760_ep *uep = ep_to_udc_ep(ep);
994 unsigned long flags;
995 int ret;
996
997 dev_dbg(uep->udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
998 value ? "set" : "clear", uep->addr);
999
1000 spin_lock_irqsave(&uep->udc->lock, flags);
1001 ret = __isp1760_ep_set_halt(uep, value, false);
1002 spin_unlock_irqrestore(&uep->udc->lock, flags);
1003
1004 return ret;
1005}
1006
1007static int isp1760_ep_set_wedge(struct usb_ep *ep)
1008{
1009 struct isp1760_ep *uep = ep_to_udc_ep(ep);
1010 unsigned long flags;
1011 int ret;
1012
1013 dev_dbg(uep->udc->isp->dev, "%s: set wedge on ep%02x)\n", __func__,
1014 uep->addr);
1015
1016 spin_lock_irqsave(&uep->udc->lock, flags);
1017 ret = __isp1760_ep_set_halt(uep, true, true);
1018 spin_unlock_irqrestore(&uep->udc->lock, flags);
1019
1020 return ret;
1021}
1022
1023static void isp1760_ep_fifo_flush(struct usb_ep *ep)
1024{
1025 struct isp1760_ep *uep = ep_to_udc_ep(ep);
1026 struct isp1760_udc *udc = uep->udc;
1027 unsigned long flags;
1028
1029 spin_lock_irqsave(&udc->lock, flags);
1030
1031 isp1760_udc_select_ep(uep);
1032
1033 /*
1034 * Set the CLBUF bit twice to flush both buffers in case double
1035 * buffering is enabled.
1036 */
1037 isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1038 isp1760_udc_write(udc, DC_CTRLFUNC, DC_CLBUF);
1039
1040 spin_unlock_irqrestore(&udc->lock, flags);
1041}
1042
1043static const struct usb_ep_ops isp1760_ep_ops = {
1044 .enable = isp1760_ep_enable,
1045 .disable = isp1760_ep_disable,
1046 .alloc_request = isp1760_ep_alloc_request,
1047 .free_request = isp1760_ep_free_request,
1048 .queue = isp1760_ep_queue,
1049 .dequeue = isp1760_ep_dequeue,
1050 .set_halt = isp1760_ep_set_halt,
1051 .set_wedge = isp1760_ep_set_wedge,
1052 .fifo_flush = isp1760_ep_fifo_flush,
1053};
1054
1055/* -----------------------------------------------------------------------------
1056 * Device States
1057 */
1058
1059/* Called with the UDC spinlock held. */
1060static void isp1760_udc_connect(struct isp1760_udc *udc)
1061{
1062 usb_gadget_set_state(&udc->gadget, USB_STATE_POWERED);
1063 mod_timer(&udc->vbus_timer, jiffies + ISP1760_VBUS_POLL_INTERVAL);
1064}
1065
1066/* Called with the UDC spinlock held. */
1067static void isp1760_udc_disconnect(struct isp1760_udc *udc)
1068{
1069 if (udc->gadget.state < USB_STATE_POWERED)
1070 return;
1071
1072 dev_dbg(udc->isp->dev, "Device disconnected in state %u\n",
1073 udc->gadget.state);
1074
1075 udc->gadget.speed = USB_SPEED_UNKNOWN;
1076 usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1077
1078 if (udc->driver->disconnect)
1079 udc->driver->disconnect(&udc->gadget);
1080
1081 del_timer(&udc->vbus_timer);
1082
1083 /* TODO Reset all endpoints ? */
1084}
1085
1086static void isp1760_udc_init_hw(struct isp1760_udc *udc)
1087{
1088 /*
1089 * The device controller currently shares its interrupt with the host
1090 * controller, the DC_IRQ polarity and signaling mode are ignored. Set
1091 * the to active-low level-triggered.
1092 *
1093 * Configure the control, in and out pipes to generate interrupts on
1094 * ACK tokens only (and NYET for the out pipe). The default
1095 * configuration also generates an interrupt on the first NACK token.
1096 */
1097 isp1760_udc_write(udc, DC_INTCONF, DC_CDBGMOD_ACK | DC_DDBGMODIN_ACK |
1098 DC_DDBGMODOUT_ACK_NYET);
1099
1100 isp1760_udc_write(udc, DC_INTENABLE, DC_IEPRXTX(7) | DC_IEPRXTX(6) |
1101 DC_IEPRXTX(5) | DC_IEPRXTX(4) | DC_IEPRXTX(3) |
1102 DC_IEPRXTX(2) | DC_IEPRXTX(1) | DC_IEPRXTX(0) |
1103 DC_IEP0SETUP | DC_IEVBUS | DC_IERESM | DC_IESUSP |
1104 DC_IEHS_STA | DC_IEBRST);
1105
1106 if (udc->connected)
1107 isp1760_set_pullup(udc->isp, true);
1108
1109 isp1760_udc_write(udc, DC_ADDRESS, DC_DEVEN);
1110}
1111
1112static void isp1760_udc_reset(struct isp1760_udc *udc)
1113{
1114 unsigned long flags;
1115
1116 spin_lock_irqsave(&udc->lock, flags);
1117
1118 /*
1119 * The bus reset has reset most registers to their default value,
1120 * reinitialize the UDC hardware.
1121 */
1122 isp1760_udc_init_hw(udc);
1123
1124 udc->ep0_state = ISP1760_CTRL_SETUP;
1125 udc->gadget.speed = USB_SPEED_FULL;
1126
1127 usb_gadget_udc_reset(&udc->gadget, udc->driver);
1128
1129 spin_unlock_irqrestore(&udc->lock, flags);
1130}
1131
1132static void isp1760_udc_suspend(struct isp1760_udc *udc)
1133{
1134 if (udc->gadget.state < USB_STATE_DEFAULT)
1135 return;
1136
1137 if (udc->driver->suspend)
1138 udc->driver->suspend(&udc->gadget);
1139}
1140
1141static void isp1760_udc_resume(struct isp1760_udc *udc)
1142{
1143 if (udc->gadget.state < USB_STATE_DEFAULT)
1144 return;
1145
1146 if (udc->driver->resume)
1147 udc->driver->resume(&udc->gadget);
1148}
1149
1150/* -----------------------------------------------------------------------------
1151 * Gadget Operations
1152 */
1153
1154static int isp1760_udc_get_frame(struct usb_gadget *gadget)
1155{
1156 struct isp1760_udc *udc = gadget_to_udc(gadget);
1157
1158 return isp1760_udc_read(udc, DC_FRAMENUM) & ((1 << 11) - 1);
1159}
1160
1161static int isp1760_udc_wakeup(struct usb_gadget *gadget)
1162{
1163 struct isp1760_udc *udc = gadget_to_udc(gadget);
1164
1165 dev_dbg(udc->isp->dev, "%s\n", __func__);
1166 return -ENOTSUPP;
1167}
1168
1169static int isp1760_udc_set_selfpowered(struct usb_gadget *gadget,
1170 int is_selfpowered)
1171{
1172 struct isp1760_udc *udc = gadget_to_udc(gadget);
1173
1174 if (is_selfpowered)
1175 udc->devstatus |= 1 << USB_DEVICE_SELF_POWERED;
1176 else
1177 udc->devstatus &= ~(1 << USB_DEVICE_SELF_POWERED);
1178
1179 return 0;
1180}
1181
1182static int isp1760_udc_pullup(struct usb_gadget *gadget, int is_on)
1183{
1184 struct isp1760_udc *udc = gadget_to_udc(gadget);
1185
1186 isp1760_set_pullup(udc->isp, is_on);
1187 udc->connected = is_on;
1188
1189 return 0;
1190}
1191
1192static int isp1760_udc_start(struct usb_gadget *gadget,
1193 struct usb_gadget_driver *driver)
1194{
1195 struct isp1760_udc *udc = gadget_to_udc(gadget);
1196 unsigned long flags;
1197
1198 /* The hardware doesn't support low speed. */
1199 if (driver->max_speed < USB_SPEED_FULL) {
1200 dev_err(udc->isp->dev, "Invalid gadget driver\n");
1201 return -EINVAL;
1202 }
1203
1204 spin_lock_irqsave(&udc->lock, flags);
1205
1206 if (udc->driver) {
1207 dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
1208 spin_unlock_irqrestore(&udc->lock, flags);
1209 return -EBUSY;
1210 }
1211
1212 udc->driver = driver;
1213
1214 spin_unlock_irqrestore(&udc->lock, flags);
1215
1216 dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
1217 driver->function);
1218
1219 udc->devstatus = 0;
1220 udc->connected = true;
1221
1222 usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1223
1224 /* DMA isn't supported yet, don't enable the DMA clock. */
1225 isp1760_udc_write(udc, DC_MODE, DC_GLINTENA);
1226
1227 isp1760_udc_init_hw(udc);
1228
1229 dev_dbg(udc->isp->dev, "UDC started with driver %s\n",
1230 driver->function);
1231
1232 return 0;
1233}
1234
1235static int isp1760_udc_stop(struct usb_gadget *gadget)
1236{
1237 struct isp1760_udc *udc = gadget_to_udc(gadget);
1238 unsigned long flags;
1239
1240 dev_dbg(udc->isp->dev, "%s\n", __func__);
1241
1242 del_timer_sync(&udc->vbus_timer);
1243
1244 isp1760_udc_write(udc, DC_MODE, 0);
1245
1246 spin_lock_irqsave(&udc->lock, flags);
1247 udc->driver = NULL;
1248 spin_unlock_irqrestore(&udc->lock, flags);
1249
1250 return 0;
1251}
1252
1253static struct usb_gadget_ops isp1760_udc_ops = {
1254 .get_frame = isp1760_udc_get_frame,
1255 .wakeup = isp1760_udc_wakeup,
1256 .set_selfpowered = isp1760_udc_set_selfpowered,
1257 .pullup = isp1760_udc_pullup,
1258 .udc_start = isp1760_udc_start,
1259 .udc_stop = isp1760_udc_stop,
1260};
1261
1262/* -----------------------------------------------------------------------------
1263 * Interrupt Handling
1264 */
1265
1266static irqreturn_t isp1760_udc_irq(int irq, void *dev)
1267{
1268 struct isp1760_udc *udc = dev;
1269 unsigned int i;
1270 u32 status;
1271
1272 status = isp1760_udc_read(udc, DC_INTERRUPT)
1273 & isp1760_udc_read(udc, DC_INTENABLE);
1274 isp1760_udc_write(udc, DC_INTERRUPT, status);
1275
1276 if (status & DC_IEVBUS) {
1277 dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
1278 /* The VBUS interrupt is only triggered when VBUS appears. */
1279 spin_lock(&udc->lock);
1280 isp1760_udc_connect(udc);
1281 spin_unlock(&udc->lock);
1282 }
1283
1284 if (status & DC_IEBRST) {
1285 dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
1286
1287 isp1760_udc_reset(udc);
1288 }
1289
1290 for (i = 0; i <= 7; ++i) {
1291 struct isp1760_ep *ep = &udc->ep[i*2];
1292
1293 if (status & DC_IEPTX(i)) {
1294 dev_dbg(udc->isp->dev, "%s(EPTX%u)\n", __func__, i);
1295 isp1760_ep_tx_complete(ep);
1296 }
1297
1298 if (status & DC_IEPRX(i)) {
1299 dev_dbg(udc->isp->dev, "%s(EPRX%u)\n", __func__, i);
1300 isp1760_ep_rx_ready(i ? ep - 1 : ep);
1301 }
1302 }
1303
1304 if (status & DC_IEP0SETUP) {
1305 dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
1306
1307 isp1760_ep0_setup(udc);
1308 }
1309
1310 if (status & DC_IERESM) {
1311 dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
1312 isp1760_udc_resume(udc);
1313 }
1314
1315 if (status & DC_IESUSP) {
1316 dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
1317
1318 spin_lock(&udc->lock);
1319 if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1320 isp1760_udc_disconnect(udc);
1321 else
1322 isp1760_udc_suspend(udc);
1323 spin_unlock(&udc->lock);
1324 }
1325
1326 if (status & DC_IEHS_STA) {
1327 dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
1328 udc->gadget.speed = USB_SPEED_HIGH;
1329 }
1330
1331 return status ? IRQ_HANDLED : IRQ_NONE;
1332}
1333
1334static void isp1760_udc_vbus_poll(unsigned long data)
1335{
1336 struct isp1760_udc *udc = (struct isp1760_udc *)data;
1337 unsigned long flags;
1338
1339 spin_lock_irqsave(&udc->lock, flags);
1340
1341 if (!(isp1760_udc_read(udc, DC_MODE) & DC_VBUSSTAT))
1342 isp1760_udc_disconnect(udc);
1343 else if (udc->gadget.state >= USB_STATE_POWERED)
1344 mod_timer(&udc->vbus_timer,
1345 jiffies + ISP1760_VBUS_POLL_INTERVAL);
1346
1347 spin_unlock_irqrestore(&udc->lock, flags);
1348}
1349
1350/* -----------------------------------------------------------------------------
1351 * Registration
1352 */
1353
1354static void isp1760_udc_init_eps(struct isp1760_udc *udc)
1355{
1356 unsigned int i;
1357
1358 INIT_LIST_HEAD(&udc->gadget.ep_list);
1359
1360 for (i = 0; i < ARRAY_SIZE(udc->ep); ++i) {
1361 struct isp1760_ep *ep = &udc->ep[i];
1362 unsigned int ep_num = (i + 1) / 2;
1363 bool is_in = !(i & 1);
1364
1365 ep->udc = udc;
1366
1367 INIT_LIST_HEAD(&ep->queue);
1368
1369 ep->addr = (ep_num && is_in ? USB_DIR_IN : USB_DIR_OUT)
1370 | ep_num;
1371 ep->desc = NULL;
1372
1373 sprintf(ep->name, "ep%u%s", ep_num,
1374 ep_num ? (is_in ? "in" : "out") : "");
1375
1376 ep->ep.ops = &isp1760_ep_ops;
1377 ep->ep.name = ep->name;
1378
1379 /*
1380 * Hardcode the maximum packet sizes for now, to 64 bytes for
1381 * the control endpoint and 512 bytes for all other endpoints.
1382 * This fits in the 8kB FIFO without double-buffering.
1383 */
1384 if (ep_num == 0) {
1385 usb_ep_set_maxpacket_limit(&ep->ep, 64);
1386 ep->ep.caps.type_control = true;
1387 ep->ep.caps.dir_in = true;
1388 ep->ep.caps.dir_out = true;
1389 ep->maxpacket = 64;
1390 udc->gadget.ep0 = &ep->ep;
1391 } else {
1392 usb_ep_set_maxpacket_limit(&ep->ep, 512);
1393 ep->ep.caps.type_iso = true;
1394 ep->ep.caps.type_bulk = true;
1395 ep->ep.caps.type_int = true;
1396 ep->maxpacket = 0;
1397 list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
1398 }
1399
1400 if (is_in)
1401 ep->ep.caps.dir_in = true;
1402 else
1403 ep->ep.caps.dir_out = true;
1404 }
1405}
1406
1407static int isp1760_udc_init(struct isp1760_udc *udc)
1408{
1409 u16 scratch;
1410 u32 chipid;
1411
1412 /*
1413 * Check that the controller is present by writing to the scratch
1414 * register, modifying the bus pattern by reading from the chip ID
1415 * register, and reading the scratch register value back. The chip ID
1416 * and scratch register contents must match the expected values.
1417 */
1418 isp1760_udc_write(udc, DC_SCRATCH, 0xbabe);
1419 chipid = isp1760_udc_read(udc, DC_CHIPID);
1420 scratch = isp1760_udc_read(udc, DC_SCRATCH);
1421
1422 if (scratch != 0xbabe) {
1423 dev_err(udc->isp->dev,
1424 "udc: scratch test failed (0x%04x/0x%08x)\n",
1425 scratch, chipid);
1426 return -ENODEV;
1427 }
1428
1429 if (chipid != 0x00011582 && chipid != 0x00158210) {
1430 dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
1431 return -ENODEV;
1432 }
1433
1434 /* Reset the device controller. */
1435 isp1760_udc_write(udc, DC_MODE, DC_SFRESET);
1436 usleep_range(10000, 11000);
1437 isp1760_udc_write(udc, DC_MODE, 0);
1438 usleep_range(10000, 11000);
1439
1440 return 0;
1441}
1442
1443int isp1760_udc_register(struct isp1760_device *isp, int irq,
1444 unsigned long irqflags)
1445{
1446 struct isp1760_udc *udc = &isp->udc;
1447 const char *devname;
1448 int ret;
1449
1450 udc->irq = -1;
1451 udc->isp = isp;
1452 udc->regs = isp->regs;
1453
1454 spin_lock_init(&udc->lock);
1455 setup_timer(&udc->vbus_timer, isp1760_udc_vbus_poll,
1456 (unsigned long)udc);
1457
1458 ret = isp1760_udc_init(udc);
1459 if (ret < 0)
1460 return ret;
1461
1462 devname = dev_name(isp->dev);
1463 udc->irqname = kmalloc(strlen(devname) + 7, GFP_KERNEL);
1464 if (!udc->irqname)
1465 return -ENOMEM;
1466
1467 sprintf(udc->irqname, "%s (udc)", devname);
1468
1469 ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
1470 udc->irqname, udc);
1471 if (ret < 0)
1472 goto error;
1473
1474 udc->irq = irq;
1475
1476 /*
1477 * Initialize the gadget static fields and register its device. Gadget
1478 * fields that vary during the life time of the gadget are initialized
1479 * by the UDC core.
1480 */
1481 udc->gadget.ops = &isp1760_udc_ops;
1482 udc->gadget.speed = USB_SPEED_UNKNOWN;
1483 udc->gadget.max_speed = USB_SPEED_HIGH;
1484 udc->gadget.name = "isp1761_udc";
1485
1486 isp1760_udc_init_eps(udc);
1487
1488 ret = usb_add_gadget_udc(isp->dev, &udc->gadget);
1489 if (ret < 0)
1490 goto error;
1491
1492 return 0;
1493
1494error:
1495 if (udc->irq >= 0)
1496 free_irq(udc->irq, udc);
1497 kfree(udc->irqname);
1498
1499 return ret;
1500}
1501
1502void isp1760_udc_unregister(struct isp1760_device *isp)
1503{
1504 struct isp1760_udc *udc = &isp->udc;
1505
1506 if (!udc->isp)
1507 return;
1508
1509 usb_del_gadget_udc(&udc->gadget);
1510
1511 free_irq(udc->irq, udc);
1512 kfree(udc->irqname);
1513}
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Driver for the NXP ISP1761 device controller
4 *
5 * Copyright 2021 Linaro, Rui Miguel Silva
6 * Copyright 2014 Ideas on Board Oy
7 *
8 * Contacts:
9 * Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 * Rui Miguel Silva <rui.silva@linaro.org>
11 */
12
13#include <linux/interrupt.h>
14#include <linux/io.h>
15#include <linux/kernel.h>
16#include <linux/list.h>
17#include <linux/module.h>
18#include <linux/slab.h>
19#include <linux/timer.h>
20#include <linux/usb.h>
21
22#include "isp1760-core.h"
23#include "isp1760-regs.h"
24#include "isp1760-udc.h"
25
26#define ISP1760_VBUS_POLL_INTERVAL msecs_to_jiffies(500)
27
28struct isp1760_request {
29 struct usb_request req;
30 struct list_head queue;
31 struct isp1760_ep *ep;
32 unsigned int packet_size;
33};
34
35static inline struct isp1760_udc *gadget_to_udc(struct usb_gadget *gadget)
36{
37 return container_of(gadget, struct isp1760_udc, gadget);
38}
39
40static inline struct isp1760_ep *ep_to_udc_ep(struct usb_ep *ep)
41{
42 return container_of(ep, struct isp1760_ep, ep);
43}
44
45static inline struct isp1760_request *req_to_udc_req(struct usb_request *req)
46{
47 return container_of(req, struct isp1760_request, req);
48}
49
50static u32 isp1760_udc_read(struct isp1760_udc *udc, u16 field)
51{
52 return isp1760_field_read(udc->fields, field);
53}
54
55static void isp1760_udc_write(struct isp1760_udc *udc, u16 field, u32 val)
56{
57 isp1760_field_write(udc->fields, field, val);
58}
59
60static u32 isp1760_udc_read_raw(struct isp1760_udc *udc, u16 reg)
61{
62 __le32 val;
63
64 regmap_raw_read(udc->regs, reg, &val, 4);
65
66 return le32_to_cpu(val);
67}
68
69static u16 isp1760_udc_read_raw16(struct isp1760_udc *udc, u16 reg)
70{
71 __le16 val;
72
73 regmap_raw_read(udc->regs, reg, &val, 2);
74
75 return le16_to_cpu(val);
76}
77
78static void isp1760_udc_write_raw(struct isp1760_udc *udc, u16 reg, u32 val)
79{
80 __le32 val_le = cpu_to_le32(val);
81
82 regmap_raw_write(udc->regs, reg, &val_le, 4);
83}
84
85static void isp1760_udc_write_raw16(struct isp1760_udc *udc, u16 reg, u16 val)
86{
87 __le16 val_le = cpu_to_le16(val);
88
89 regmap_raw_write(udc->regs, reg, &val_le, 2);
90}
91
92static void isp1760_udc_set(struct isp1760_udc *udc, u32 field)
93{
94 isp1760_udc_write(udc, field, 0xFFFFFFFF);
95}
96
97static void isp1760_udc_clear(struct isp1760_udc *udc, u32 field)
98{
99 isp1760_udc_write(udc, field, 0);
100}
101
102static bool isp1760_udc_is_set(struct isp1760_udc *udc, u32 field)
103{
104 return !!isp1760_udc_read(udc, field);
105}
106/* -----------------------------------------------------------------------------
107 * Endpoint Management
108 */
109
110static struct isp1760_ep *isp1760_udc_find_ep(struct isp1760_udc *udc,
111 u16 index)
112{
113 unsigned int i;
114
115 if (index == 0)
116 return &udc->ep[0];
117
118 for (i = 1; i < ARRAY_SIZE(udc->ep); ++i) {
119 if (udc->ep[i].addr == index)
120 return udc->ep[i].desc ? &udc->ep[i] : NULL;
121 }
122
123 return NULL;
124}
125
126static void __isp1760_udc_select_ep(struct isp1760_udc *udc,
127 struct isp1760_ep *ep, int dir)
128{
129 isp1760_udc_write(udc, DC_ENDPIDX, ep->addr & USB_ENDPOINT_NUMBER_MASK);
130
131 if (dir == USB_DIR_IN)
132 isp1760_udc_set(udc, DC_EPDIR);
133 else
134 isp1760_udc_clear(udc, DC_EPDIR);
135}
136
137/**
138 * isp1760_udc_select_ep - Select an endpoint for register access
139 * @ep: The endpoint
140 * @udc: Reference to the device controller
141 *
142 * The ISP1761 endpoint registers are banked. This function selects the target
143 * endpoint for banked register access. The selection remains valid until the
144 * next call to this function, the next direct access to the EPINDEX register
145 * or the next reset, whichever comes first.
146 *
147 * Called with the UDC spinlock held.
148 */
149static void isp1760_udc_select_ep(struct isp1760_udc *udc,
150 struct isp1760_ep *ep)
151{
152 __isp1760_udc_select_ep(udc, ep, ep->addr & USB_ENDPOINT_DIR_MASK);
153}
154
155/* Called with the UDC spinlock held. */
156static void isp1760_udc_ctrl_send_status(struct isp1760_ep *ep, int dir)
157{
158 struct isp1760_udc *udc = ep->udc;
159
160 /*
161 * Proceed to the status stage. The status stage data packet flows in
162 * the direction opposite to the data stage data packets, we thus need
163 * to select the OUT/IN endpoint for IN/OUT transfers.
164 */
165 if (dir == USB_DIR_IN)
166 isp1760_udc_clear(udc, DC_EPDIR);
167 else
168 isp1760_udc_set(udc, DC_EPDIR);
169
170 isp1760_udc_write(udc, DC_ENDPIDX, 1);
171 isp1760_udc_set(udc, DC_STATUS);
172
173 /*
174 * The hardware will terminate the request automatically and go back to
175 * the setup stage without notifying us.
176 */
177 udc->ep0_state = ISP1760_CTRL_SETUP;
178}
179
180/* Called without the UDC spinlock held. */
181static void isp1760_udc_request_complete(struct isp1760_ep *ep,
182 struct isp1760_request *req,
183 int status)
184{
185 struct isp1760_udc *udc = ep->udc;
186 unsigned long flags;
187
188 dev_dbg(ep->udc->isp->dev, "completing request %p with status %d\n",
189 req, status);
190
191 req->ep = NULL;
192 req->req.status = status;
193 req->req.complete(&ep->ep, &req->req);
194
195 spin_lock_irqsave(&udc->lock, flags);
196
197 /*
198 * When completing control OUT requests, move to the status stage after
199 * calling the request complete callback. This gives the gadget an
200 * opportunity to stall the control transfer if needed.
201 */
202 if (status == 0 && ep->addr == 0 && udc->ep0_dir == USB_DIR_OUT)
203 isp1760_udc_ctrl_send_status(ep, USB_DIR_OUT);
204
205 spin_unlock_irqrestore(&udc->lock, flags);
206}
207
208static void isp1760_udc_ctrl_send_stall(struct isp1760_ep *ep)
209{
210 struct isp1760_udc *udc = ep->udc;
211 unsigned long flags;
212
213 dev_dbg(ep->udc->isp->dev, "%s(ep%02x)\n", __func__, ep->addr);
214
215 spin_lock_irqsave(&udc->lock, flags);
216
217 /* Stall both the IN and OUT endpoints. */
218 __isp1760_udc_select_ep(udc, ep, USB_DIR_OUT);
219 isp1760_udc_set(udc, DC_STALL);
220 __isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
221 isp1760_udc_set(udc, DC_STALL);
222
223 /* A protocol stall completes the control transaction. */
224 udc->ep0_state = ISP1760_CTRL_SETUP;
225
226 spin_unlock_irqrestore(&udc->lock, flags);
227}
228
229/* -----------------------------------------------------------------------------
230 * Data Endpoints
231 */
232
233/* Called with the UDC spinlock held. */
234static bool isp1760_udc_receive(struct isp1760_ep *ep,
235 struct isp1760_request *req)
236{
237 struct isp1760_udc *udc = ep->udc;
238 unsigned int len;
239 u32 *buf;
240 int i;
241
242 isp1760_udc_select_ep(udc, ep);
243 len = isp1760_udc_read(udc, DC_BUFLEN);
244
245 dev_dbg(udc->isp->dev, "%s: received %u bytes (%u/%u done)\n",
246 __func__, len, req->req.actual, req->req.length);
247
248 len = min(len, req->req.length - req->req.actual);
249
250 if (!len) {
251 /*
252 * There's no data to be read from the FIFO, acknowledge the RX
253 * interrupt by clearing the buffer.
254 *
255 * TODO: What if another packet arrives in the meantime ? The
256 * datasheet doesn't clearly document how this should be
257 * handled.
258 */
259 isp1760_udc_set(udc, DC_CLBUF);
260 return false;
261 }
262
263 buf = req->req.buf + req->req.actual;
264
265 /*
266 * Make sure not to read more than one extra byte, otherwise data from
267 * the next packet might be removed from the FIFO.
268 */
269 for (i = len; i > 2; i -= 4, ++buf)
270 *buf = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
271 if (i > 0)
272 *(u16 *)buf = isp1760_udc_read_raw16(udc, ISP176x_DC_DATAPORT);
273
274 req->req.actual += len;
275
276 /*
277 * TODO: The short_not_ok flag isn't supported yet, but isn't used by
278 * any gadget driver either.
279 */
280
281 dev_dbg(udc->isp->dev,
282 "%s: req %p actual/length %u/%u maxpacket %u packet size %u\n",
283 __func__, req, req->req.actual, req->req.length, ep->maxpacket,
284 len);
285
286 ep->rx_pending = false;
287
288 /*
289 * Complete the request if all data has been received or if a short
290 * packet has been received.
291 */
292 if (req->req.actual == req->req.length || len < ep->maxpacket) {
293 list_del(&req->queue);
294 return true;
295 }
296
297 return false;
298}
299
300static void isp1760_udc_transmit(struct isp1760_ep *ep,
301 struct isp1760_request *req)
302{
303 struct isp1760_udc *udc = ep->udc;
304 u32 *buf = req->req.buf + req->req.actual;
305 int i;
306
307 req->packet_size = min(req->req.length - req->req.actual,
308 ep->maxpacket);
309
310 dev_dbg(udc->isp->dev, "%s: transferring %u bytes (%u/%u done)\n",
311 __func__, req->packet_size, req->req.actual,
312 req->req.length);
313
314 __isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
315
316 if (req->packet_size)
317 isp1760_udc_write(udc, DC_BUFLEN, req->packet_size);
318
319 /*
320 * Make sure not to write more than one extra byte, otherwise extra data
321 * will stay in the FIFO and will be transmitted during the next control
322 * request. The endpoint control CLBUF bit is supposed to allow flushing
323 * the FIFO for this kind of conditions, but doesn't seem to work.
324 */
325 for (i = req->packet_size; i > 2; i -= 4, ++buf)
326 isp1760_udc_write_raw(udc, ISP176x_DC_DATAPORT, *buf);
327 if (i > 0)
328 isp1760_udc_write_raw16(udc, ISP176x_DC_DATAPORT, *(u16 *)buf);
329
330 if (ep->addr == 0)
331 isp1760_udc_set(udc, DC_DSEN);
332 if (!req->packet_size)
333 isp1760_udc_set(udc, DC_VENDP);
334}
335
336static void isp1760_ep_rx_ready(struct isp1760_ep *ep)
337{
338 struct isp1760_udc *udc = ep->udc;
339 struct isp1760_request *req;
340 bool complete;
341
342 spin_lock(&udc->lock);
343
344 if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_OUT) {
345 spin_unlock(&udc->lock);
346 dev_dbg(udc->isp->dev, "%s: invalid ep0 state %u\n", __func__,
347 udc->ep0_state);
348 return;
349 }
350
351 if (ep->addr != 0 && !ep->desc) {
352 spin_unlock(&udc->lock);
353 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
354 ep->addr);
355 return;
356 }
357
358 if (list_empty(&ep->queue)) {
359 ep->rx_pending = true;
360 spin_unlock(&udc->lock);
361 dev_dbg(udc->isp->dev, "%s: ep%02x (%p) has no request queued\n",
362 __func__, ep->addr, ep);
363 return;
364 }
365
366 req = list_first_entry(&ep->queue, struct isp1760_request,
367 queue);
368 complete = isp1760_udc_receive(ep, req);
369
370 spin_unlock(&udc->lock);
371
372 if (complete)
373 isp1760_udc_request_complete(ep, req, 0);
374}
375
376static void isp1760_ep_tx_complete(struct isp1760_ep *ep)
377{
378 struct isp1760_udc *udc = ep->udc;
379 struct isp1760_request *complete = NULL;
380 struct isp1760_request *req;
381 bool need_zlp;
382
383 spin_lock(&udc->lock);
384
385 if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_IN) {
386 spin_unlock(&udc->lock);
387 dev_dbg(udc->isp->dev, "TX IRQ: invalid endpoint state %u\n",
388 udc->ep0_state);
389 return;
390 }
391
392 if (list_empty(&ep->queue)) {
393 /*
394 * This can happen for the control endpoint when the reply to
395 * the GET_STATUS IN control request is sent directly by the
396 * setup IRQ handler. Just proceed to the status stage.
397 */
398 if (ep->addr == 0) {
399 isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
400 spin_unlock(&udc->lock);
401 return;
402 }
403
404 spin_unlock(&udc->lock);
405 dev_dbg(udc->isp->dev, "%s: ep%02x has no request queued\n",
406 __func__, ep->addr);
407 return;
408 }
409
410 req = list_first_entry(&ep->queue, struct isp1760_request,
411 queue);
412 req->req.actual += req->packet_size;
413
414 need_zlp = req->req.actual == req->req.length &&
415 !(req->req.length % ep->maxpacket) &&
416 req->packet_size && req->req.zero;
417
418 dev_dbg(udc->isp->dev,
419 "TX IRQ: req %p actual/length %u/%u maxpacket %u packet size %u zero %u need zlp %u\n",
420 req, req->req.actual, req->req.length, ep->maxpacket,
421 req->packet_size, req->req.zero, need_zlp);
422
423 /*
424 * Complete the request if all data has been sent and we don't need to
425 * transmit a zero length packet.
426 */
427 if (req->req.actual == req->req.length && !need_zlp) {
428 complete = req;
429 list_del(&req->queue);
430
431 if (ep->addr == 0)
432 isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
433
434 if (!list_empty(&ep->queue))
435 req = list_first_entry(&ep->queue,
436 struct isp1760_request, queue);
437 else
438 req = NULL;
439 }
440
441 /*
442 * Transmit the next packet or start the next request, if any.
443 *
444 * TODO: If the endpoint is stalled the next request shouldn't be
445 * started, but what about the next packet ?
446 */
447 if (req)
448 isp1760_udc_transmit(ep, req);
449
450 spin_unlock(&udc->lock);
451
452 if (complete)
453 isp1760_udc_request_complete(ep, complete, 0);
454}
455
456static int __isp1760_udc_set_halt(struct isp1760_ep *ep, bool halt)
457{
458 struct isp1760_udc *udc = ep->udc;
459
460 dev_dbg(udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
461 halt ? "set" : "clear", ep->addr);
462
463 if (ep->desc && usb_endpoint_xfer_isoc(ep->desc)) {
464 dev_dbg(udc->isp->dev, "%s: ep%02x is isochronous\n", __func__,
465 ep->addr);
466 return -EINVAL;
467 }
468
469 isp1760_udc_select_ep(udc, ep);
470
471 if (halt)
472 isp1760_udc_set(udc, DC_STALL);
473 else
474 isp1760_udc_clear(udc, DC_STALL);
475
476 if (ep->addr == 0) {
477 /* When halting the control endpoint, stall both IN and OUT. */
478 __isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
479 if (halt)
480 isp1760_udc_set(udc, DC_STALL);
481 else
482 isp1760_udc_clear(udc, DC_STALL);
483 } else if (!halt) {
484 /* Reset the data PID by cycling the endpoint enable bit. */
485 isp1760_udc_clear(udc, DC_EPENABLE);
486 isp1760_udc_set(udc, DC_EPENABLE);
487
488 /*
489 * Disabling the endpoint emptied the transmit FIFO, fill it
490 * again if a request is pending.
491 *
492 * TODO: Does the gadget framework require synchronizatino with
493 * the TX IRQ handler ?
494 */
495 if ((ep->addr & USB_DIR_IN) && !list_empty(&ep->queue)) {
496 struct isp1760_request *req;
497
498 req = list_first_entry(&ep->queue,
499 struct isp1760_request, queue);
500 isp1760_udc_transmit(ep, req);
501 }
502 }
503
504 ep->halted = halt;
505
506 return 0;
507}
508
509/* -----------------------------------------------------------------------------
510 * Control Endpoint
511 */
512
513static int isp1760_udc_get_status(struct isp1760_udc *udc,
514 const struct usb_ctrlrequest *req)
515{
516 struct isp1760_ep *ep;
517 u16 status;
518
519 if (req->wLength != cpu_to_le16(2) || req->wValue != cpu_to_le16(0))
520 return -EINVAL;
521
522 switch (req->bRequestType) {
523 case USB_DIR_IN | USB_RECIP_DEVICE:
524 status = udc->devstatus;
525 break;
526
527 case USB_DIR_IN | USB_RECIP_INTERFACE:
528 status = 0;
529 break;
530
531 case USB_DIR_IN | USB_RECIP_ENDPOINT:
532 ep = isp1760_udc_find_ep(udc, le16_to_cpu(req->wIndex));
533 if (!ep)
534 return -EINVAL;
535
536 status = 0;
537 if (ep->halted)
538 status |= 1 << USB_ENDPOINT_HALT;
539 break;
540
541 default:
542 return -EINVAL;
543 }
544
545 isp1760_udc_set(udc, DC_EPDIR);
546 isp1760_udc_write(udc, DC_ENDPIDX, 1);
547
548 isp1760_udc_write(udc, DC_BUFLEN, 2);
549
550 isp1760_udc_write_raw16(udc, ISP176x_DC_DATAPORT, status);
551
552 isp1760_udc_set(udc, DC_DSEN);
553
554 dev_dbg(udc->isp->dev, "%s: status 0x%04x\n", __func__, status);
555
556 return 0;
557}
558
559static int isp1760_udc_set_address(struct isp1760_udc *udc, u16 addr)
560{
561 if (addr > 127) {
562 dev_dbg(udc->isp->dev, "invalid device address %u\n", addr);
563 return -EINVAL;
564 }
565
566 if (udc->gadget.state != USB_STATE_DEFAULT &&
567 udc->gadget.state != USB_STATE_ADDRESS) {
568 dev_dbg(udc->isp->dev, "can't set address in state %u\n",
569 udc->gadget.state);
570 return -EINVAL;
571 }
572
573 usb_gadget_set_state(&udc->gadget, addr ? USB_STATE_ADDRESS :
574 USB_STATE_DEFAULT);
575
576 isp1760_udc_write(udc, DC_DEVADDR, addr);
577 isp1760_udc_set(udc, DC_DEVEN);
578
579 spin_lock(&udc->lock);
580 isp1760_udc_ctrl_send_status(&udc->ep[0], USB_DIR_OUT);
581 spin_unlock(&udc->lock);
582
583 return 0;
584}
585
586static bool isp1760_ep0_setup_standard(struct isp1760_udc *udc,
587 struct usb_ctrlrequest *req)
588{
589 bool stall;
590
591 switch (req->bRequest) {
592 case USB_REQ_GET_STATUS:
593 return isp1760_udc_get_status(udc, req);
594
595 case USB_REQ_CLEAR_FEATURE:
596 switch (req->bRequestType) {
597 case USB_DIR_OUT | USB_RECIP_DEVICE: {
598 /* TODO: Handle remote wakeup feature. */
599 return true;
600 }
601
602 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
603 u16 index = le16_to_cpu(req->wIndex);
604 struct isp1760_ep *ep;
605
606 if (req->wLength != cpu_to_le16(0) ||
607 req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
608 return true;
609
610 ep = isp1760_udc_find_ep(udc, index);
611 if (!ep)
612 return true;
613
614 spin_lock(&udc->lock);
615
616 /*
617 * If the endpoint is wedged only the gadget can clear
618 * the halt feature. Pretend success in that case, but
619 * keep the endpoint halted.
620 */
621 if (!ep->wedged)
622 stall = __isp1760_udc_set_halt(ep, false);
623 else
624 stall = false;
625
626 if (!stall)
627 isp1760_udc_ctrl_send_status(&udc->ep[0],
628 USB_DIR_OUT);
629
630 spin_unlock(&udc->lock);
631 return stall;
632 }
633
634 default:
635 return true;
636 }
637 break;
638
639 case USB_REQ_SET_FEATURE:
640 switch (req->bRequestType) {
641 case USB_DIR_OUT | USB_RECIP_DEVICE: {
642 /* TODO: Handle remote wakeup and test mode features */
643 return true;
644 }
645
646 case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
647 u16 index = le16_to_cpu(req->wIndex);
648 struct isp1760_ep *ep;
649
650 if (req->wLength != cpu_to_le16(0) ||
651 req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
652 return true;
653
654 ep = isp1760_udc_find_ep(udc, index);
655 if (!ep)
656 return true;
657
658 spin_lock(&udc->lock);
659
660 stall = __isp1760_udc_set_halt(ep, true);
661 if (!stall)
662 isp1760_udc_ctrl_send_status(&udc->ep[0],
663 USB_DIR_OUT);
664
665 spin_unlock(&udc->lock);
666 return stall;
667 }
668
669 default:
670 return true;
671 }
672 break;
673
674 case USB_REQ_SET_ADDRESS:
675 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
676 return true;
677
678 return isp1760_udc_set_address(udc, le16_to_cpu(req->wValue));
679
680 case USB_REQ_SET_CONFIGURATION:
681 if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
682 return true;
683
684 if (udc->gadget.state != USB_STATE_ADDRESS &&
685 udc->gadget.state != USB_STATE_CONFIGURED)
686 return true;
687
688 stall = udc->driver->setup(&udc->gadget, req) < 0;
689 if (stall)
690 return true;
691
692 usb_gadget_set_state(&udc->gadget, req->wValue ?
693 USB_STATE_CONFIGURED : USB_STATE_ADDRESS);
694
695 /*
696 * SET_CONFIGURATION (and SET_INTERFACE) must reset the halt
697 * feature on all endpoints. There is however no need to do so
698 * explicitly here as the gadget driver will disable and
699 * reenable endpoints, clearing the halt feature.
700 */
701 return false;
702
703 default:
704 return udc->driver->setup(&udc->gadget, req) < 0;
705 }
706}
707
708static void isp1760_ep0_setup(struct isp1760_udc *udc)
709{
710 union {
711 struct usb_ctrlrequest r;
712 u32 data[2];
713 } req;
714 unsigned int count;
715 bool stall = false;
716
717 spin_lock(&udc->lock);
718
719 isp1760_udc_set(udc, DC_EP0SETUP);
720
721 count = isp1760_udc_read(udc, DC_BUFLEN);
722 if (count != sizeof(req)) {
723 spin_unlock(&udc->lock);
724
725 dev_err(udc->isp->dev, "invalid length %u for setup packet\n",
726 count);
727
728 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
729 return;
730 }
731
732 req.data[0] = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
733 req.data[1] = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
734
735 if (udc->ep0_state != ISP1760_CTRL_SETUP) {
736 spin_unlock(&udc->lock);
737 dev_dbg(udc->isp->dev, "unexpected SETUP packet\n");
738 return;
739 }
740
741 /* Move to the data stage. */
742 if (!req.r.wLength)
743 udc->ep0_state = ISP1760_CTRL_STATUS;
744 else if (req.r.bRequestType & USB_DIR_IN)
745 udc->ep0_state = ISP1760_CTRL_DATA_IN;
746 else
747 udc->ep0_state = ISP1760_CTRL_DATA_OUT;
748
749 udc->ep0_dir = req.r.bRequestType & USB_DIR_IN;
750 udc->ep0_length = le16_to_cpu(req.r.wLength);
751
752 spin_unlock(&udc->lock);
753
754 dev_dbg(udc->isp->dev,
755 "%s: bRequestType 0x%02x bRequest 0x%02x wValue 0x%04x wIndex 0x%04x wLength 0x%04x\n",
756 __func__, req.r.bRequestType, req.r.bRequest,
757 le16_to_cpu(req.r.wValue), le16_to_cpu(req.r.wIndex),
758 le16_to_cpu(req.r.wLength));
759
760 if ((req.r.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
761 stall = isp1760_ep0_setup_standard(udc, &req.r);
762 else
763 stall = udc->driver->setup(&udc->gadget, &req.r) < 0;
764
765 if (stall)
766 isp1760_udc_ctrl_send_stall(&udc->ep[0]);
767}
768
769/* -----------------------------------------------------------------------------
770 * Gadget Endpoint Operations
771 */
772
773static int isp1760_ep_enable(struct usb_ep *ep,
774 const struct usb_endpoint_descriptor *desc)
775{
776 struct isp1760_ep *uep = ep_to_udc_ep(ep);
777 struct isp1760_udc *udc = uep->udc;
778 unsigned long flags;
779 unsigned int type;
780
781 dev_dbg(uep->udc->isp->dev, "%s\n", __func__);
782
783 /*
784 * Validate the descriptor. The control endpoint can't be enabled
785 * manually.
786 */
787 if (desc->bDescriptorType != USB_DT_ENDPOINT ||
788 desc->bEndpointAddress == 0 ||
789 desc->bEndpointAddress != uep->addr ||
790 le16_to_cpu(desc->wMaxPacketSize) > ep->maxpacket) {
791 dev_dbg(udc->isp->dev,
792 "%s: invalid descriptor type %u addr %02x ep addr %02x max packet size %u/%u\n",
793 __func__, desc->bDescriptorType,
794 desc->bEndpointAddress, uep->addr,
795 le16_to_cpu(desc->wMaxPacketSize), ep->maxpacket);
796 return -EINVAL;
797 }
798
799 switch (usb_endpoint_type(desc)) {
800 case USB_ENDPOINT_XFER_ISOC:
801 type = ISP176x_DC_ENDPTYP_ISOC;
802 break;
803 case USB_ENDPOINT_XFER_BULK:
804 type = ISP176x_DC_ENDPTYP_BULK;
805 break;
806 case USB_ENDPOINT_XFER_INT:
807 type = ISP176x_DC_ENDPTYP_INTERRUPT;
808 break;
809 case USB_ENDPOINT_XFER_CONTROL:
810 default:
811 dev_dbg(udc->isp->dev, "%s: control endpoints unsupported\n",
812 __func__);
813 return -EINVAL;
814 }
815
816 spin_lock_irqsave(&udc->lock, flags);
817
818 uep->desc = desc;
819 uep->maxpacket = le16_to_cpu(desc->wMaxPacketSize);
820 uep->rx_pending = false;
821 uep->halted = false;
822 uep->wedged = false;
823
824 isp1760_udc_select_ep(udc, uep);
825
826 isp1760_udc_write(udc, DC_FFOSZ, uep->maxpacket);
827 isp1760_udc_write(udc, DC_BUFLEN, uep->maxpacket);
828
829 isp1760_udc_write(udc, DC_ENDPTYP, type);
830 isp1760_udc_set(udc, DC_EPENABLE);
831
832 spin_unlock_irqrestore(&udc->lock, flags);
833
834 return 0;
835}
836
837static int isp1760_ep_disable(struct usb_ep *ep)
838{
839 struct isp1760_ep *uep = ep_to_udc_ep(ep);
840 struct isp1760_udc *udc = uep->udc;
841 struct isp1760_request *req, *nreq;
842 LIST_HEAD(req_list);
843 unsigned long flags;
844
845 dev_dbg(udc->isp->dev, "%s\n", __func__);
846
847 spin_lock_irqsave(&udc->lock, flags);
848
849 if (!uep->desc) {
850 dev_dbg(udc->isp->dev, "%s: endpoint not enabled\n", __func__);
851 spin_unlock_irqrestore(&udc->lock, flags);
852 return -EINVAL;
853 }
854
855 uep->desc = NULL;
856 uep->maxpacket = 0;
857
858 isp1760_udc_select_ep(udc, uep);
859 isp1760_udc_clear(udc, DC_EPENABLE);
860 isp1760_udc_clear(udc, DC_ENDPTYP);
861
862 /* TODO Synchronize with the IRQ handler */
863
864 list_splice_init(&uep->queue, &req_list);
865
866 spin_unlock_irqrestore(&udc->lock, flags);
867
868 list_for_each_entry_safe(req, nreq, &req_list, queue) {
869 list_del(&req->queue);
870 isp1760_udc_request_complete(uep, req, -ESHUTDOWN);
871 }
872
873 return 0;
874}
875
876static struct usb_request *isp1760_ep_alloc_request(struct usb_ep *ep,
877 gfp_t gfp_flags)
878{
879 struct isp1760_request *req;
880
881 req = kzalloc(sizeof(*req), gfp_flags);
882 if (!req)
883 return NULL;
884
885 return &req->req;
886}
887
888static void isp1760_ep_free_request(struct usb_ep *ep, struct usb_request *_req)
889{
890 struct isp1760_request *req = req_to_udc_req(_req);
891
892 kfree(req);
893}
894
895static int isp1760_ep_queue(struct usb_ep *ep, struct usb_request *_req,
896 gfp_t gfp_flags)
897{
898 struct isp1760_request *req = req_to_udc_req(_req);
899 struct isp1760_ep *uep = ep_to_udc_ep(ep);
900 struct isp1760_udc *udc = uep->udc;
901 bool complete = false;
902 unsigned long flags;
903 int ret = 0;
904
905 _req->status = -EINPROGRESS;
906 _req->actual = 0;
907
908 spin_lock_irqsave(&udc->lock, flags);
909
910 dev_dbg(udc->isp->dev,
911 "%s: req %p (%u bytes%s) ep %p(0x%02x)\n", __func__, _req,
912 _req->length, _req->zero ? " (zlp)" : "", uep, uep->addr);
913
914 req->ep = uep;
915
916 if (uep->addr == 0) {
917 if (_req->length != udc->ep0_length &&
918 udc->ep0_state != ISP1760_CTRL_DATA_IN) {
919 dev_dbg(udc->isp->dev,
920 "%s: invalid length %u for req %p\n",
921 __func__, _req->length, req);
922 ret = -EINVAL;
923 goto done;
924 }
925
926 switch (udc->ep0_state) {
927 case ISP1760_CTRL_DATA_IN:
928 dev_dbg(udc->isp->dev, "%s: transmitting req %p\n",
929 __func__, req);
930
931 list_add_tail(&req->queue, &uep->queue);
932 isp1760_udc_transmit(uep, req);
933 break;
934
935 case ISP1760_CTRL_DATA_OUT:
936 list_add_tail(&req->queue, &uep->queue);
937 __isp1760_udc_select_ep(udc, uep, USB_DIR_OUT);
938 isp1760_udc_set(udc, DC_DSEN);
939 break;
940
941 case ISP1760_CTRL_STATUS:
942 complete = true;
943 break;
944
945 default:
946 dev_dbg(udc->isp->dev, "%s: invalid ep0 state\n",
947 __func__);
948 ret = -EINVAL;
949 break;
950 }
951 } else if (uep->desc) {
952 bool empty = list_empty(&uep->queue);
953
954 list_add_tail(&req->queue, &uep->queue);
955 if ((uep->addr & USB_DIR_IN) && !uep->halted && empty)
956 isp1760_udc_transmit(uep, req);
957 else if (!(uep->addr & USB_DIR_IN) && uep->rx_pending)
958 complete = isp1760_udc_receive(uep, req);
959 } else {
960 dev_dbg(udc->isp->dev,
961 "%s: can't queue request to disabled ep%02x\n",
962 __func__, uep->addr);
963 ret = -ESHUTDOWN;
964 }
965
966done:
967 if (ret < 0)
968 req->ep = NULL;
969
970 spin_unlock_irqrestore(&udc->lock, flags);
971
972 if (complete)
973 isp1760_udc_request_complete(uep, req, 0);
974
975 return ret;
976}
977
978static int isp1760_ep_dequeue(struct usb_ep *ep, struct usb_request *_req)
979{
980 struct isp1760_request *req = req_to_udc_req(_req);
981 struct isp1760_ep *uep = ep_to_udc_ep(ep);
982 struct isp1760_udc *udc = uep->udc;
983 unsigned long flags;
984
985 dev_dbg(uep->udc->isp->dev, "%s(ep%02x)\n", __func__, uep->addr);
986
987 spin_lock_irqsave(&udc->lock, flags);
988
989 if (req->ep != uep)
990 req = NULL;
991 else
992 list_del(&req->queue);
993
994 spin_unlock_irqrestore(&udc->lock, flags);
995
996 if (!req)
997 return -EINVAL;
998
999 isp1760_udc_request_complete(uep, req, -ECONNRESET);
1000 return 0;
1001}
1002
1003static int __isp1760_ep_set_halt(struct isp1760_ep *uep, bool stall, bool wedge)
1004{
1005 struct isp1760_udc *udc = uep->udc;
1006 int ret;
1007
1008 if (!uep->addr) {
1009 /*
1010 * Halting the control endpoint is only valid as a delayed error
1011 * response to a SETUP packet. Make sure EP0 is in the right
1012 * stage and that the gadget isn't trying to clear the halt
1013 * condition.
1014 */
1015 if (WARN_ON(udc->ep0_state == ISP1760_CTRL_SETUP || !stall ||
1016 wedge)) {
1017 return -EINVAL;
1018 }
1019 }
1020
1021 if (uep->addr && !uep->desc) {
1022 dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
1023 uep->addr);
1024 return -EINVAL;
1025 }
1026
1027 if (uep->addr & USB_DIR_IN) {
1028 /* Refuse to halt IN endpoints with active transfers. */
1029 if (!list_empty(&uep->queue)) {
1030 dev_dbg(udc->isp->dev,
1031 "%s: ep%02x has request pending\n", __func__,
1032 uep->addr);
1033 return -EAGAIN;
1034 }
1035 }
1036
1037 ret = __isp1760_udc_set_halt(uep, stall);
1038 if (ret < 0)
1039 return ret;
1040
1041 if (!uep->addr) {
1042 /*
1043 * Stalling EP0 completes the control transaction, move back to
1044 * the SETUP state.
1045 */
1046 udc->ep0_state = ISP1760_CTRL_SETUP;
1047 return 0;
1048 }
1049
1050 if (wedge)
1051 uep->wedged = true;
1052 else if (!stall)
1053 uep->wedged = false;
1054
1055 return 0;
1056}
1057
1058static int isp1760_ep_set_halt(struct usb_ep *ep, int value)
1059{
1060 struct isp1760_ep *uep = ep_to_udc_ep(ep);
1061 unsigned long flags;
1062 int ret;
1063
1064 dev_dbg(uep->udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
1065 value ? "set" : "clear", uep->addr);
1066
1067 spin_lock_irqsave(&uep->udc->lock, flags);
1068 ret = __isp1760_ep_set_halt(uep, value, false);
1069 spin_unlock_irqrestore(&uep->udc->lock, flags);
1070
1071 return ret;
1072}
1073
1074static int isp1760_ep_set_wedge(struct usb_ep *ep)
1075{
1076 struct isp1760_ep *uep = ep_to_udc_ep(ep);
1077 unsigned long flags;
1078 int ret;
1079
1080 dev_dbg(uep->udc->isp->dev, "%s: set wedge on ep%02x)\n", __func__,
1081 uep->addr);
1082
1083 spin_lock_irqsave(&uep->udc->lock, flags);
1084 ret = __isp1760_ep_set_halt(uep, true, true);
1085 spin_unlock_irqrestore(&uep->udc->lock, flags);
1086
1087 return ret;
1088}
1089
1090static void isp1760_ep_fifo_flush(struct usb_ep *ep)
1091{
1092 struct isp1760_ep *uep = ep_to_udc_ep(ep);
1093 struct isp1760_udc *udc = uep->udc;
1094 unsigned long flags;
1095
1096 spin_lock_irqsave(&udc->lock, flags);
1097
1098 isp1760_udc_select_ep(udc, uep);
1099
1100 /*
1101 * Set the CLBUF bit twice to flush both buffers in case double
1102 * buffering is enabled.
1103 */
1104 isp1760_udc_set(udc, DC_CLBUF);
1105 isp1760_udc_set(udc, DC_CLBUF);
1106
1107 spin_unlock_irqrestore(&udc->lock, flags);
1108}
1109
1110static const struct usb_ep_ops isp1760_ep_ops = {
1111 .enable = isp1760_ep_enable,
1112 .disable = isp1760_ep_disable,
1113 .alloc_request = isp1760_ep_alloc_request,
1114 .free_request = isp1760_ep_free_request,
1115 .queue = isp1760_ep_queue,
1116 .dequeue = isp1760_ep_dequeue,
1117 .set_halt = isp1760_ep_set_halt,
1118 .set_wedge = isp1760_ep_set_wedge,
1119 .fifo_flush = isp1760_ep_fifo_flush,
1120};
1121
1122/* -----------------------------------------------------------------------------
1123 * Device States
1124 */
1125
1126/* Called with the UDC spinlock held. */
1127static void isp1760_udc_connect(struct isp1760_udc *udc)
1128{
1129 usb_gadget_set_state(&udc->gadget, USB_STATE_POWERED);
1130 mod_timer(&udc->vbus_timer, jiffies + ISP1760_VBUS_POLL_INTERVAL);
1131}
1132
1133/* Called with the UDC spinlock held. */
1134static void isp1760_udc_disconnect(struct isp1760_udc *udc)
1135{
1136 if (udc->gadget.state < USB_STATE_POWERED)
1137 return;
1138
1139 dev_dbg(udc->isp->dev, "Device disconnected in state %u\n",
1140 udc->gadget.state);
1141
1142 udc->gadget.speed = USB_SPEED_UNKNOWN;
1143 usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1144
1145 if (udc->driver->disconnect)
1146 udc->driver->disconnect(&udc->gadget);
1147
1148 del_timer(&udc->vbus_timer);
1149
1150 /* TODO Reset all endpoints ? */
1151}
1152
1153static void isp1760_udc_init_hw(struct isp1760_udc *udc)
1154{
1155 u32 intconf = udc->is_isp1763 ? ISP1763_DC_INTCONF : ISP176x_DC_INTCONF;
1156 u32 intena = udc->is_isp1763 ? ISP1763_DC_INTENABLE :
1157 ISP176x_DC_INTENABLE;
1158
1159 /*
1160 * The device controller currently shares its interrupt with the host
1161 * controller, the DC_IRQ polarity and signaling mode are ignored. Set
1162 * the to active-low level-triggered.
1163 *
1164 * Configure the control, in and out pipes to generate interrupts on
1165 * ACK tokens only (and NYET for the out pipe). The default
1166 * configuration also generates an interrupt on the first NACK token.
1167 */
1168 isp1760_reg_write(udc->regs, intconf,
1169 ISP176x_DC_CDBGMOD_ACK | ISP176x_DC_DDBGMODIN_ACK |
1170 ISP176x_DC_DDBGMODOUT_ACK);
1171
1172 isp1760_reg_write(udc->regs, intena, DC_IEPRXTX(7) |
1173 DC_IEPRXTX(6) | DC_IEPRXTX(5) | DC_IEPRXTX(4) |
1174 DC_IEPRXTX(3) | DC_IEPRXTX(2) | DC_IEPRXTX(1) |
1175 DC_IEPRXTX(0) | ISP176x_DC_IEP0SETUP |
1176 ISP176x_DC_IEVBUS | ISP176x_DC_IERESM |
1177 ISP176x_DC_IESUSP | ISP176x_DC_IEHS_STA |
1178 ISP176x_DC_IEBRST);
1179
1180 if (udc->connected)
1181 isp1760_set_pullup(udc->isp, true);
1182
1183 isp1760_udc_set(udc, DC_DEVEN);
1184}
1185
1186static void isp1760_udc_reset(struct isp1760_udc *udc)
1187{
1188 unsigned long flags;
1189
1190 spin_lock_irqsave(&udc->lock, flags);
1191
1192 /*
1193 * The bus reset has reset most registers to their default value,
1194 * reinitialize the UDC hardware.
1195 */
1196 isp1760_udc_init_hw(udc);
1197
1198 udc->ep0_state = ISP1760_CTRL_SETUP;
1199 udc->gadget.speed = USB_SPEED_FULL;
1200
1201 usb_gadget_udc_reset(&udc->gadget, udc->driver);
1202
1203 spin_unlock_irqrestore(&udc->lock, flags);
1204}
1205
1206static void isp1760_udc_suspend(struct isp1760_udc *udc)
1207{
1208 if (udc->gadget.state < USB_STATE_DEFAULT)
1209 return;
1210
1211 if (udc->driver->suspend)
1212 udc->driver->suspend(&udc->gadget);
1213}
1214
1215static void isp1760_udc_resume(struct isp1760_udc *udc)
1216{
1217 if (udc->gadget.state < USB_STATE_DEFAULT)
1218 return;
1219
1220 if (udc->driver->resume)
1221 udc->driver->resume(&udc->gadget);
1222}
1223
1224/* -----------------------------------------------------------------------------
1225 * Gadget Operations
1226 */
1227
1228static int isp1760_udc_get_frame(struct usb_gadget *gadget)
1229{
1230 struct isp1760_udc *udc = gadget_to_udc(gadget);
1231
1232 return isp1760_udc_read(udc, DC_FRAMENUM);
1233}
1234
1235static int isp1760_udc_wakeup(struct usb_gadget *gadget)
1236{
1237 struct isp1760_udc *udc = gadget_to_udc(gadget);
1238
1239 dev_dbg(udc->isp->dev, "%s\n", __func__);
1240 return -ENOTSUPP;
1241}
1242
1243static int isp1760_udc_set_selfpowered(struct usb_gadget *gadget,
1244 int is_selfpowered)
1245{
1246 struct isp1760_udc *udc = gadget_to_udc(gadget);
1247
1248 if (is_selfpowered)
1249 udc->devstatus |= 1 << USB_DEVICE_SELF_POWERED;
1250 else
1251 udc->devstatus &= ~(1 << USB_DEVICE_SELF_POWERED);
1252
1253 return 0;
1254}
1255
1256static int isp1760_udc_pullup(struct usb_gadget *gadget, int is_on)
1257{
1258 struct isp1760_udc *udc = gadget_to_udc(gadget);
1259
1260 isp1760_set_pullup(udc->isp, is_on);
1261 udc->connected = is_on;
1262
1263 return 0;
1264}
1265
1266static int isp1760_udc_start(struct usb_gadget *gadget,
1267 struct usb_gadget_driver *driver)
1268{
1269 struct isp1760_udc *udc = gadget_to_udc(gadget);
1270 unsigned long flags;
1271
1272 /* The hardware doesn't support low speed. */
1273 if (driver->max_speed < USB_SPEED_FULL) {
1274 dev_err(udc->isp->dev, "Invalid gadget driver\n");
1275 return -EINVAL;
1276 }
1277
1278 spin_lock_irqsave(&udc->lock, flags);
1279
1280 if (udc->driver) {
1281 dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
1282 spin_unlock_irqrestore(&udc->lock, flags);
1283 return -EBUSY;
1284 }
1285
1286 udc->driver = driver;
1287
1288 spin_unlock_irqrestore(&udc->lock, flags);
1289
1290 dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
1291 driver->function);
1292
1293 udc->devstatus = 0;
1294 udc->connected = true;
1295
1296 usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1297
1298 /* DMA isn't supported yet, don't enable the DMA clock. */
1299 isp1760_udc_set(udc, DC_GLINTENA);
1300
1301 isp1760_udc_init_hw(udc);
1302
1303 dev_dbg(udc->isp->dev, "UDC started with driver %s\n",
1304 driver->function);
1305
1306 return 0;
1307}
1308
1309static int isp1760_udc_stop(struct usb_gadget *gadget)
1310{
1311 struct isp1760_udc *udc = gadget_to_udc(gadget);
1312 u32 mode_reg = udc->is_isp1763 ? ISP1763_DC_MODE : ISP176x_DC_MODE;
1313 unsigned long flags;
1314
1315 dev_dbg(udc->isp->dev, "%s\n", __func__);
1316
1317 del_timer_sync(&udc->vbus_timer);
1318
1319 isp1760_reg_write(udc->regs, mode_reg, 0);
1320
1321 spin_lock_irqsave(&udc->lock, flags);
1322 udc->driver = NULL;
1323 spin_unlock_irqrestore(&udc->lock, flags);
1324
1325 return 0;
1326}
1327
1328static const struct usb_gadget_ops isp1760_udc_ops = {
1329 .get_frame = isp1760_udc_get_frame,
1330 .wakeup = isp1760_udc_wakeup,
1331 .set_selfpowered = isp1760_udc_set_selfpowered,
1332 .pullup = isp1760_udc_pullup,
1333 .udc_start = isp1760_udc_start,
1334 .udc_stop = isp1760_udc_stop,
1335};
1336
1337/* -----------------------------------------------------------------------------
1338 * Interrupt Handling
1339 */
1340
1341static u32 isp1760_udc_irq_get_status(struct isp1760_udc *udc)
1342{
1343 u32 status;
1344
1345 if (udc->is_isp1763) {
1346 status = isp1760_reg_read(udc->regs, ISP1763_DC_INTERRUPT)
1347 & isp1760_reg_read(udc->regs, ISP1763_DC_INTENABLE);
1348 isp1760_reg_write(udc->regs, ISP1763_DC_INTERRUPT, status);
1349 } else {
1350 status = isp1760_reg_read(udc->regs, ISP176x_DC_INTERRUPT)
1351 & isp1760_reg_read(udc->regs, ISP176x_DC_INTENABLE);
1352 isp1760_reg_write(udc->regs, ISP176x_DC_INTERRUPT, status);
1353 }
1354
1355 return status;
1356}
1357
1358static irqreturn_t isp1760_udc_irq(int irq, void *dev)
1359{
1360 struct isp1760_udc *udc = dev;
1361 unsigned int i;
1362 u32 status;
1363
1364 status = isp1760_udc_irq_get_status(udc);
1365
1366 if (status & ISP176x_DC_IEVBUS) {
1367 dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
1368 /* The VBUS interrupt is only triggered when VBUS appears. */
1369 spin_lock(&udc->lock);
1370 isp1760_udc_connect(udc);
1371 spin_unlock(&udc->lock);
1372 }
1373
1374 if (status & ISP176x_DC_IEBRST) {
1375 dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
1376
1377 isp1760_udc_reset(udc);
1378 }
1379
1380 for (i = 0; i <= 7; ++i) {
1381 struct isp1760_ep *ep = &udc->ep[i*2];
1382
1383 if (status & DC_IEPTX(i)) {
1384 dev_dbg(udc->isp->dev, "%s(EPTX%u)\n", __func__, i);
1385 isp1760_ep_tx_complete(ep);
1386 }
1387
1388 if (status & DC_IEPRX(i)) {
1389 dev_dbg(udc->isp->dev, "%s(EPRX%u)\n", __func__, i);
1390 isp1760_ep_rx_ready(i ? ep - 1 : ep);
1391 }
1392 }
1393
1394 if (status & ISP176x_DC_IEP0SETUP) {
1395 dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
1396
1397 isp1760_ep0_setup(udc);
1398 }
1399
1400 if (status & ISP176x_DC_IERESM) {
1401 dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
1402 isp1760_udc_resume(udc);
1403 }
1404
1405 if (status & ISP176x_DC_IESUSP) {
1406 dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
1407
1408 spin_lock(&udc->lock);
1409 if (!isp1760_udc_is_set(udc, DC_VBUSSTAT))
1410 isp1760_udc_disconnect(udc);
1411 else
1412 isp1760_udc_suspend(udc);
1413 spin_unlock(&udc->lock);
1414 }
1415
1416 if (status & ISP176x_DC_IEHS_STA) {
1417 dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
1418 udc->gadget.speed = USB_SPEED_HIGH;
1419 }
1420
1421 return status ? IRQ_HANDLED : IRQ_NONE;
1422}
1423
1424static void isp1760_udc_vbus_poll(struct timer_list *t)
1425{
1426 struct isp1760_udc *udc = from_timer(udc, t, vbus_timer);
1427 unsigned long flags;
1428
1429 spin_lock_irqsave(&udc->lock, flags);
1430
1431 if (!(isp1760_udc_is_set(udc, DC_VBUSSTAT)))
1432 isp1760_udc_disconnect(udc);
1433 else if (udc->gadget.state >= USB_STATE_POWERED)
1434 mod_timer(&udc->vbus_timer,
1435 jiffies + ISP1760_VBUS_POLL_INTERVAL);
1436
1437 spin_unlock_irqrestore(&udc->lock, flags);
1438}
1439
1440/* -----------------------------------------------------------------------------
1441 * Registration
1442 */
1443
1444static void isp1760_udc_init_eps(struct isp1760_udc *udc)
1445{
1446 unsigned int i;
1447
1448 INIT_LIST_HEAD(&udc->gadget.ep_list);
1449
1450 for (i = 0; i < ARRAY_SIZE(udc->ep); ++i) {
1451 struct isp1760_ep *ep = &udc->ep[i];
1452 unsigned int ep_num = (i + 1) / 2;
1453 bool is_in = !(i & 1);
1454
1455 ep->udc = udc;
1456
1457 INIT_LIST_HEAD(&ep->queue);
1458
1459 ep->addr = (ep_num && is_in ? USB_DIR_IN : USB_DIR_OUT)
1460 | ep_num;
1461 ep->desc = NULL;
1462
1463 sprintf(ep->name, "ep%u%s", ep_num,
1464 ep_num ? (is_in ? "in" : "out") : "");
1465
1466 ep->ep.ops = &isp1760_ep_ops;
1467 ep->ep.name = ep->name;
1468
1469 /*
1470 * Hardcode the maximum packet sizes for now, to 64 bytes for
1471 * the control endpoint and 512 bytes for all other endpoints.
1472 * This fits in the 8kB FIFO without double-buffering.
1473 */
1474 if (ep_num == 0) {
1475 usb_ep_set_maxpacket_limit(&ep->ep, 64);
1476 ep->ep.caps.type_control = true;
1477 ep->ep.caps.dir_in = true;
1478 ep->ep.caps.dir_out = true;
1479 ep->maxpacket = 64;
1480 udc->gadget.ep0 = &ep->ep;
1481 } else {
1482 usb_ep_set_maxpacket_limit(&ep->ep, 512);
1483 ep->ep.caps.type_iso = true;
1484 ep->ep.caps.type_bulk = true;
1485 ep->ep.caps.type_int = true;
1486 ep->maxpacket = 0;
1487 list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
1488 }
1489
1490 if (is_in)
1491 ep->ep.caps.dir_in = true;
1492 else
1493 ep->ep.caps.dir_out = true;
1494 }
1495}
1496
1497static int isp1760_udc_init(struct isp1760_udc *udc)
1498{
1499 u32 mode_reg = udc->is_isp1763 ? ISP1763_DC_MODE : ISP176x_DC_MODE;
1500 u16 scratch;
1501 u32 chipid;
1502
1503 /*
1504 * Check that the controller is present by writing to the scratch
1505 * register, modifying the bus pattern by reading from the chip ID
1506 * register, and reading the scratch register value back. The chip ID
1507 * and scratch register contents must match the expected values.
1508 */
1509 isp1760_udc_write(udc, DC_SCRATCH, 0xbabe);
1510 chipid = isp1760_udc_read(udc, DC_CHIP_ID_HIGH) << 16;
1511 chipid |= isp1760_udc_read(udc, DC_CHIP_ID_LOW);
1512 scratch = isp1760_udc_read(udc, DC_SCRATCH);
1513
1514 if (scratch != 0xbabe) {
1515 dev_err(udc->isp->dev,
1516 "udc: scratch test failed (0x%04x/0x%08x)\n",
1517 scratch, chipid);
1518 return -ENODEV;
1519 }
1520
1521 if (chipid != 0x00011582 && chipid != 0x00158210 &&
1522 chipid != 0x00176320) {
1523 dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
1524 return -ENODEV;
1525 }
1526
1527 /* Reset the device controller. */
1528 isp1760_udc_set(udc, DC_SFRESET);
1529 usleep_range(10000, 11000);
1530 isp1760_reg_write(udc->regs, mode_reg, 0);
1531 usleep_range(10000, 11000);
1532
1533 return 0;
1534}
1535
1536int isp1760_udc_register(struct isp1760_device *isp, int irq,
1537 unsigned long irqflags)
1538{
1539 struct isp1760_udc *udc = &isp->udc;
1540 int ret;
1541
1542 udc->irq = -1;
1543 udc->isp = isp;
1544
1545 spin_lock_init(&udc->lock);
1546 timer_setup(&udc->vbus_timer, isp1760_udc_vbus_poll, 0);
1547
1548 ret = isp1760_udc_init(udc);
1549 if (ret < 0)
1550 return ret;
1551
1552 udc->irqname = kasprintf(GFP_KERNEL, "%s (udc)", dev_name(isp->dev));
1553 if (!udc->irqname)
1554 return -ENOMEM;
1555
1556 ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
1557 udc->irqname, udc);
1558 if (ret < 0)
1559 goto error;
1560
1561 udc->irq = irq;
1562
1563 /*
1564 * Initialize the gadget static fields and register its device. Gadget
1565 * fields that vary during the life time of the gadget are initialized
1566 * by the UDC core.
1567 */
1568 udc->gadget.ops = &isp1760_udc_ops;
1569 udc->gadget.speed = USB_SPEED_UNKNOWN;
1570 udc->gadget.max_speed = USB_SPEED_HIGH;
1571 udc->gadget.name = "isp1761_udc";
1572
1573 isp1760_udc_init_eps(udc);
1574
1575 ret = usb_add_gadget_udc(isp->dev, &udc->gadget);
1576 if (ret < 0)
1577 goto error;
1578
1579 return 0;
1580
1581error:
1582 if (udc->irq >= 0)
1583 free_irq(udc->irq, udc);
1584 kfree(udc->irqname);
1585
1586 return ret;
1587}
1588
1589void isp1760_udc_unregister(struct isp1760_device *isp)
1590{
1591 struct isp1760_udc *udc = &isp->udc;
1592
1593 if (!udc->isp)
1594 return;
1595
1596 usb_del_gadget_udc(&udc->gadget);
1597
1598 free_irq(udc->irq, udc);
1599 kfree(udc->irqname);
1600}