1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Driver for the NXP ISP1761 device controller
4  *
5  * Copyright 2021 Linaro, Rui Miguel Silva
6  * Copyright 2014 Ideas on Board Oy
7  *
8  * Contacts:
9  *	Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10  *	Rui Miguel Silva <rui.silva@linaro.org>
11  */
12 
13 #include <linux/interrupt.h>
14 #include <linux/io.h>
15 #include <linux/kernel.h>
16 #include <linux/list.h>
17 #include <linux/module.h>
18 #include <linux/slab.h>
19 #include <linux/timer.h>
20 #include <linux/usb.h>
21 
22 #include "isp1760-core.h"
23 #include "isp1760-regs.h"
24 #include "isp1760-udc.h"
25 
26 #define ISP1760_VBUS_POLL_INTERVAL	msecs_to_jiffies(500)
27 
28 struct isp1760_request {
29 	struct usb_request req;
30 	struct list_head queue;
31 	struct isp1760_ep *ep;
32 	unsigned int packet_size;
33 };
34 
gadget_to_udc(struct usb_gadget * gadget)35 static inline struct isp1760_udc *gadget_to_udc(struct usb_gadget *gadget)
36 {
37 	return container_of(gadget, struct isp1760_udc, gadget);
38 }
39 
ep_to_udc_ep(struct usb_ep * ep)40 static inline struct isp1760_ep *ep_to_udc_ep(struct usb_ep *ep)
41 {
42 	return container_of(ep, struct isp1760_ep, ep);
43 }
44 
req_to_udc_req(struct usb_request * req)45 static inline struct isp1760_request *req_to_udc_req(struct usb_request *req)
46 {
47 	return container_of(req, struct isp1760_request, req);
48 }
49 
isp1760_udc_read(struct isp1760_udc * udc,u16 field)50 static u32 isp1760_udc_read(struct isp1760_udc *udc, u16 field)
51 {
52 	return isp1760_field_read(udc->fields, field);
53 }
54 
isp1760_udc_write(struct isp1760_udc * udc,u16 field,u32 val)55 static void isp1760_udc_write(struct isp1760_udc *udc, u16 field, u32 val)
56 {
57 	isp1760_field_write(udc->fields, field, val);
58 }
59 
isp1760_udc_read_raw(struct isp1760_udc * udc,u16 reg)60 static u32 isp1760_udc_read_raw(struct isp1760_udc *udc, u16 reg)
61 {
62 	__le32 val;
63 
64 	regmap_raw_read(udc->regs, reg, &val, 4);
65 
66 	return le32_to_cpu(val);
67 }
68 
isp1760_udc_read_raw16(struct isp1760_udc * udc,u16 reg)69 static u16 isp1760_udc_read_raw16(struct isp1760_udc *udc, u16 reg)
70 {
71 	__le16 val;
72 
73 	regmap_raw_read(udc->regs, reg, &val, 2);
74 
75 	return le16_to_cpu(val);
76 }
77 
isp1760_udc_write_raw(struct isp1760_udc * udc,u16 reg,u32 val)78 static void isp1760_udc_write_raw(struct isp1760_udc *udc, u16 reg, u32 val)
79 {
80 	__le32 val_le = cpu_to_le32(val);
81 
82 	regmap_raw_write(udc->regs, reg, &val_le, 4);
83 }
84 
isp1760_udc_write_raw16(struct isp1760_udc * udc,u16 reg,u16 val)85 static void isp1760_udc_write_raw16(struct isp1760_udc *udc, u16 reg, u16 val)
86 {
87 	__le16 val_le = cpu_to_le16(val);
88 
89 	regmap_raw_write(udc->regs, reg, &val_le, 2);
90 }
91 
isp1760_udc_set(struct isp1760_udc * udc,u32 field)92 static void isp1760_udc_set(struct isp1760_udc *udc, u32 field)
93 {
94 	isp1760_udc_write(udc, field, 0xFFFFFFFF);
95 }
96 
isp1760_udc_clear(struct isp1760_udc * udc,u32 field)97 static void isp1760_udc_clear(struct isp1760_udc *udc, u32 field)
98 {
99 	isp1760_udc_write(udc, field, 0);
100 }
101 
isp1760_udc_is_set(struct isp1760_udc * udc,u32 field)102 static bool isp1760_udc_is_set(struct isp1760_udc *udc, u32 field)
103 {
104 	return !!isp1760_udc_read(udc, field);
105 }
106 /* -----------------------------------------------------------------------------
107  * Endpoint Management
108  */
109 
isp1760_udc_find_ep(struct isp1760_udc * udc,u16 index)110 static struct isp1760_ep *isp1760_udc_find_ep(struct isp1760_udc *udc,
111 					      u16 index)
112 {
113 	unsigned int i;
114 
115 	if (index == 0)
116 		return &udc->ep[0];
117 
118 	for (i = 1; i < ARRAY_SIZE(udc->ep); ++i) {
119 		if (udc->ep[i].addr == index)
120 			return udc->ep[i].desc ? &udc->ep[i] : NULL;
121 	}
122 
123 	return NULL;
124 }
125 
__isp1760_udc_select_ep(struct isp1760_udc * udc,struct isp1760_ep * ep,int dir)126 static void __isp1760_udc_select_ep(struct isp1760_udc *udc,
127 				    struct isp1760_ep *ep, int dir)
128 {
129 	isp1760_udc_write(udc, DC_ENDPIDX, ep->addr & USB_ENDPOINT_NUMBER_MASK);
130 
131 	if (dir == USB_DIR_IN)
132 		isp1760_udc_set(udc, DC_EPDIR);
133 	else
134 		isp1760_udc_clear(udc, DC_EPDIR);
135 }
136 
137 /**
138  * isp1760_udc_select_ep - Select an endpoint for register access
139  * @ep: The endpoint
140  * @udc: Reference to the device controller
141  *
142  * The ISP1761 endpoint registers are banked. This function selects the target
143  * endpoint for banked register access. The selection remains valid until the
144  * next call to this function, the next direct access to the EPINDEX register
145  * or the next reset, whichever comes first.
146  *
147  * Called with the UDC spinlock held.
148  */
isp1760_udc_select_ep(struct isp1760_udc * udc,struct isp1760_ep * ep)149 static void isp1760_udc_select_ep(struct isp1760_udc *udc,
150 				  struct isp1760_ep *ep)
151 {
152 	__isp1760_udc_select_ep(udc, ep, ep->addr & USB_ENDPOINT_DIR_MASK);
153 }
154 
155 /* Called with the UDC spinlock held. */
isp1760_udc_ctrl_send_status(struct isp1760_ep * ep,int dir)156 static void isp1760_udc_ctrl_send_status(struct isp1760_ep *ep, int dir)
157 {
158 	struct isp1760_udc *udc = ep->udc;
159 
160 	/*
161 	 * Proceed to the status stage. The status stage data packet flows in
162 	 * the direction opposite to the data stage data packets, we thus need
163 	 * to select the OUT/IN endpoint for IN/OUT transfers.
164 	 */
165 	if (dir == USB_DIR_IN)
166 		isp1760_udc_clear(udc, DC_EPDIR);
167 	else
168 		isp1760_udc_set(udc, DC_EPDIR);
169 
170 	isp1760_udc_write(udc, DC_ENDPIDX, 1);
171 	isp1760_udc_set(udc, DC_STATUS);
172 
173 	/*
174 	 * The hardware will terminate the request automatically and go back to
175 	 * the setup stage without notifying us.
176 	 */
177 	udc->ep0_state = ISP1760_CTRL_SETUP;
178 }
179 
180 /* Called without the UDC spinlock held. */
isp1760_udc_request_complete(struct isp1760_ep * ep,struct isp1760_request * req,int status)181 static void isp1760_udc_request_complete(struct isp1760_ep *ep,
182 					 struct isp1760_request *req,
183 					 int status)
184 {
185 	struct isp1760_udc *udc = ep->udc;
186 	unsigned long flags;
187 
188 	dev_dbg(ep->udc->isp->dev, "completing request %p with status %d\n",
189 		req, status);
190 
191 	req->ep = NULL;
192 	req->req.status = status;
193 	req->req.complete(&ep->ep, &req->req);
194 
195 	spin_lock_irqsave(&udc->lock, flags);
196 
197 	/*
198 	 * When completing control OUT requests, move to the status stage after
199 	 * calling the request complete callback. This gives the gadget an
200 	 * opportunity to stall the control transfer if needed.
201 	 */
202 	if (status == 0 && ep->addr == 0 && udc->ep0_dir == USB_DIR_OUT)
203 		isp1760_udc_ctrl_send_status(ep, USB_DIR_OUT);
204 
205 	spin_unlock_irqrestore(&udc->lock, flags);
206 }
207 
isp1760_udc_ctrl_send_stall(struct isp1760_ep * ep)208 static void isp1760_udc_ctrl_send_stall(struct isp1760_ep *ep)
209 {
210 	struct isp1760_udc *udc = ep->udc;
211 	unsigned long flags;
212 
213 	dev_dbg(ep->udc->isp->dev, "%s(ep%02x)\n", __func__, ep->addr);
214 
215 	spin_lock_irqsave(&udc->lock, flags);
216 
217 	/* Stall both the IN and OUT endpoints. */
218 	__isp1760_udc_select_ep(udc, ep, USB_DIR_OUT);
219 	isp1760_udc_set(udc, DC_STALL);
220 	__isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
221 	isp1760_udc_set(udc, DC_STALL);
222 
223 	/* A protocol stall completes the control transaction. */
224 	udc->ep0_state = ISP1760_CTRL_SETUP;
225 
226 	spin_unlock_irqrestore(&udc->lock, flags);
227 }
228 
229 /* -----------------------------------------------------------------------------
230  * Data Endpoints
231  */
232 
233 /* Called with the UDC spinlock held. */
isp1760_udc_receive(struct isp1760_ep * ep,struct isp1760_request * req)234 static bool isp1760_udc_receive(struct isp1760_ep *ep,
235 				struct isp1760_request *req)
236 {
237 	struct isp1760_udc *udc = ep->udc;
238 	unsigned int len;
239 	u32 *buf;
240 	int i;
241 
242 	isp1760_udc_select_ep(udc, ep);
243 	len = isp1760_udc_read(udc, DC_BUFLEN);
244 
245 	dev_dbg(udc->isp->dev, "%s: received %u bytes (%u/%u done)\n",
246 		__func__, len, req->req.actual, req->req.length);
247 
248 	len = min(len, req->req.length - req->req.actual);
249 
250 	if (!len) {
251 		/*
252 		 * There's no data to be read from the FIFO, acknowledge the RX
253 		 * interrupt by clearing the buffer.
254 		 *
255 		 * TODO: What if another packet arrives in the meantime ? The
256 		 * datasheet doesn't clearly document how this should be
257 		 * handled.
258 		 */
259 		isp1760_udc_set(udc, DC_CLBUF);
260 		return false;
261 	}
262 
263 	buf = req->req.buf + req->req.actual;
264 
265 	/*
266 	 * Make sure not to read more than one extra byte, otherwise data from
267 	 * the next packet might be removed from the FIFO.
268 	 */
269 	for (i = len; i > 2; i -= 4, ++buf)
270 		*buf = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
271 	if (i > 0)
272 		*(u16 *)buf = isp1760_udc_read_raw16(udc, ISP176x_DC_DATAPORT);
273 
274 	req->req.actual += len;
275 
276 	/*
277 	 * TODO: The short_not_ok flag isn't supported yet, but isn't used by
278 	 * any gadget driver either.
279 	 */
280 
281 	dev_dbg(udc->isp->dev,
282 		"%s: req %p actual/length %u/%u maxpacket %u packet size %u\n",
283 		__func__, req, req->req.actual, req->req.length, ep->maxpacket,
284 		len);
285 
286 	ep->rx_pending = false;
287 
288 	/*
289 	 * Complete the request if all data has been received or if a short
290 	 * packet has been received.
291 	 */
292 	if (req->req.actual == req->req.length || len < ep->maxpacket) {
293 		list_del(&req->queue);
294 		return true;
295 	}
296 
297 	return false;
298 }
299 
isp1760_udc_transmit(struct isp1760_ep * ep,struct isp1760_request * req)300 static void isp1760_udc_transmit(struct isp1760_ep *ep,
301 				 struct isp1760_request *req)
302 {
303 	struct isp1760_udc *udc = ep->udc;
304 	u32 *buf = req->req.buf + req->req.actual;
305 	int i;
306 
307 	req->packet_size = min(req->req.length - req->req.actual,
308 			       ep->maxpacket);
309 
310 	dev_dbg(udc->isp->dev, "%s: transferring %u bytes (%u/%u done)\n",
311 		__func__, req->packet_size, req->req.actual,
312 		req->req.length);
313 
314 	__isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
315 
316 	if (req->packet_size)
317 		isp1760_udc_write(udc, DC_BUFLEN, req->packet_size);
318 
319 	/*
320 	 * Make sure not to write more than one extra byte, otherwise extra data
321 	 * will stay in the FIFO and will be transmitted during the next control
322 	 * request. The endpoint control CLBUF bit is supposed to allow flushing
323 	 * the FIFO for this kind of conditions, but doesn't seem to work.
324 	 */
325 	for (i = req->packet_size; i > 2; i -= 4, ++buf)
326 		isp1760_udc_write_raw(udc, ISP176x_DC_DATAPORT, *buf);
327 	if (i > 0)
328 		isp1760_udc_write_raw16(udc, ISP176x_DC_DATAPORT, *(u16 *)buf);
329 
330 	if (ep->addr == 0)
331 		isp1760_udc_set(udc, DC_DSEN);
332 	if (!req->packet_size)
333 		isp1760_udc_set(udc, DC_VENDP);
334 }
335 
isp1760_ep_rx_ready(struct isp1760_ep * ep)336 static void isp1760_ep_rx_ready(struct isp1760_ep *ep)
337 {
338 	struct isp1760_udc *udc = ep->udc;
339 	struct isp1760_request *req;
340 	bool complete;
341 
342 	spin_lock(&udc->lock);
343 
344 	if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_OUT) {
345 		spin_unlock(&udc->lock);
346 		dev_dbg(udc->isp->dev, "%s: invalid ep0 state %u\n", __func__,
347 			udc->ep0_state);
348 		return;
349 	}
350 
351 	if (ep->addr != 0 && !ep->desc) {
352 		spin_unlock(&udc->lock);
353 		dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
354 			ep->addr);
355 		return;
356 	}
357 
358 	if (list_empty(&ep->queue)) {
359 		ep->rx_pending = true;
360 		spin_unlock(&udc->lock);
361 		dev_dbg(udc->isp->dev, "%s: ep%02x (%p) has no request queued\n",
362 			__func__, ep->addr, ep);
363 		return;
364 	}
365 
366 	req = list_first_entry(&ep->queue, struct isp1760_request,
367 			       queue);
368 	complete = isp1760_udc_receive(ep, req);
369 
370 	spin_unlock(&udc->lock);
371 
372 	if (complete)
373 		isp1760_udc_request_complete(ep, req, 0);
374 }
375 
isp1760_ep_tx_complete(struct isp1760_ep * ep)376 static void isp1760_ep_tx_complete(struct isp1760_ep *ep)
377 {
378 	struct isp1760_udc *udc = ep->udc;
379 	struct isp1760_request *complete = NULL;
380 	struct isp1760_request *req;
381 	bool need_zlp;
382 
383 	spin_lock(&udc->lock);
384 
385 	if (ep->addr == 0 && udc->ep0_state != ISP1760_CTRL_DATA_IN) {
386 		spin_unlock(&udc->lock);
387 		dev_dbg(udc->isp->dev, "TX IRQ: invalid endpoint state %u\n",
388 			udc->ep0_state);
389 		return;
390 	}
391 
392 	if (list_empty(&ep->queue)) {
393 		/*
394 		 * This can happen for the control endpoint when the reply to
395 		 * the GET_STATUS IN control request is sent directly by the
396 		 * setup IRQ handler. Just proceed to the status stage.
397 		 */
398 		if (ep->addr == 0) {
399 			isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
400 			spin_unlock(&udc->lock);
401 			return;
402 		}
403 
404 		spin_unlock(&udc->lock);
405 		dev_dbg(udc->isp->dev, "%s: ep%02x has no request queued\n",
406 			__func__, ep->addr);
407 		return;
408 	}
409 
410 	req = list_first_entry(&ep->queue, struct isp1760_request,
411 			       queue);
412 	req->req.actual += req->packet_size;
413 
414 	need_zlp = req->req.actual == req->req.length &&
415 		   !(req->req.length % ep->maxpacket) &&
416 		   req->packet_size && req->req.zero;
417 
418 	dev_dbg(udc->isp->dev,
419 		"TX IRQ: req %p actual/length %u/%u maxpacket %u packet size %u zero %u need zlp %u\n",
420 		 req, req->req.actual, req->req.length, ep->maxpacket,
421 		 req->packet_size, req->req.zero, need_zlp);
422 
423 	/*
424 	 * Complete the request if all data has been sent and we don't need to
425 	 * transmit a zero length packet.
426 	 */
427 	if (req->req.actual == req->req.length && !need_zlp) {
428 		complete = req;
429 		list_del(&req->queue);
430 
431 		if (ep->addr == 0)
432 			isp1760_udc_ctrl_send_status(ep, USB_DIR_IN);
433 
434 		if (!list_empty(&ep->queue))
435 			req = list_first_entry(&ep->queue,
436 					       struct isp1760_request, queue);
437 		else
438 			req = NULL;
439 	}
440 
441 	/*
442 	 * Transmit the next packet or start the next request, if any.
443 	 *
444 	 * TODO: If the endpoint is stalled the next request shouldn't be
445 	 * started, but what about the next packet ?
446 	 */
447 	if (req)
448 		isp1760_udc_transmit(ep, req);
449 
450 	spin_unlock(&udc->lock);
451 
452 	if (complete)
453 		isp1760_udc_request_complete(ep, complete, 0);
454 }
455 
__isp1760_udc_set_halt(struct isp1760_ep * ep,bool halt)456 static int __isp1760_udc_set_halt(struct isp1760_ep *ep, bool halt)
457 {
458 	struct isp1760_udc *udc = ep->udc;
459 
460 	dev_dbg(udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
461 		halt ? "set" : "clear", ep->addr);
462 
463 	if (ep->desc && usb_endpoint_xfer_isoc(ep->desc)) {
464 		dev_dbg(udc->isp->dev, "%s: ep%02x is isochronous\n", __func__,
465 			ep->addr);
466 		return -EINVAL;
467 	}
468 
469 	isp1760_udc_select_ep(udc, ep);
470 
471 	if (halt)
472 		isp1760_udc_set(udc, DC_STALL);
473 	else
474 		isp1760_udc_clear(udc, DC_STALL);
475 
476 	if (ep->addr == 0) {
477 		/* When halting the control endpoint, stall both IN and OUT. */
478 		__isp1760_udc_select_ep(udc, ep, USB_DIR_IN);
479 		if (halt)
480 			isp1760_udc_set(udc, DC_STALL);
481 		else
482 			isp1760_udc_clear(udc, DC_STALL);
483 	} else if (!halt) {
484 		/* Reset the data PID by cycling the endpoint enable bit. */
485 		isp1760_udc_clear(udc, DC_EPENABLE);
486 		isp1760_udc_set(udc, DC_EPENABLE);
487 
488 		/*
489 		 * Disabling the endpoint emptied the transmit FIFO, fill it
490 		 * again if a request is pending.
491 		 *
492 		 * TODO: Does the gadget framework require synchronizatino with
493 		 * the TX IRQ handler ?
494 		 */
495 		if ((ep->addr & USB_DIR_IN) && !list_empty(&ep->queue)) {
496 			struct isp1760_request *req;
497 
498 			req = list_first_entry(&ep->queue,
499 					       struct isp1760_request, queue);
500 			isp1760_udc_transmit(ep, req);
501 		}
502 	}
503 
504 	ep->halted = halt;
505 
506 	return 0;
507 }
508 
509 /* -----------------------------------------------------------------------------
510  * Control Endpoint
511  */
512 
isp1760_udc_get_status(struct isp1760_udc * udc,const struct usb_ctrlrequest * req)513 static int isp1760_udc_get_status(struct isp1760_udc *udc,
514 				  const struct usb_ctrlrequest *req)
515 {
516 	struct isp1760_ep *ep;
517 	u16 status;
518 
519 	if (req->wLength != cpu_to_le16(2) || req->wValue != cpu_to_le16(0))
520 		return -EINVAL;
521 
522 	switch (req->bRequestType) {
523 	case USB_DIR_IN | USB_RECIP_DEVICE:
524 		status = udc->devstatus;
525 		break;
526 
527 	case USB_DIR_IN | USB_RECIP_INTERFACE:
528 		status = 0;
529 		break;
530 
531 	case USB_DIR_IN | USB_RECIP_ENDPOINT:
532 		ep = isp1760_udc_find_ep(udc, le16_to_cpu(req->wIndex));
533 		if (!ep)
534 			return -EINVAL;
535 
536 		status = 0;
537 		if (ep->halted)
538 			status |= 1 << USB_ENDPOINT_HALT;
539 		break;
540 
541 	default:
542 		return -EINVAL;
543 	}
544 
545 	isp1760_udc_set(udc, DC_EPDIR);
546 	isp1760_udc_write(udc, DC_ENDPIDX, 1);
547 
548 	isp1760_udc_write(udc, DC_BUFLEN, 2);
549 
550 	isp1760_udc_write_raw16(udc, ISP176x_DC_DATAPORT, status);
551 
552 	isp1760_udc_set(udc, DC_DSEN);
553 
554 	dev_dbg(udc->isp->dev, "%s: status 0x%04x\n", __func__, status);
555 
556 	return 0;
557 }
558 
isp1760_udc_set_address(struct isp1760_udc * udc,u16 addr)559 static int isp1760_udc_set_address(struct isp1760_udc *udc, u16 addr)
560 {
561 	if (addr > 127) {
562 		dev_dbg(udc->isp->dev, "invalid device address %u\n", addr);
563 		return -EINVAL;
564 	}
565 
566 	if (udc->gadget.state != USB_STATE_DEFAULT &&
567 	    udc->gadget.state != USB_STATE_ADDRESS) {
568 		dev_dbg(udc->isp->dev, "can't set address in state %u\n",
569 			udc->gadget.state);
570 		return -EINVAL;
571 	}
572 
573 	usb_gadget_set_state(&udc->gadget, addr ? USB_STATE_ADDRESS :
574 			     USB_STATE_DEFAULT);
575 
576 	isp1760_udc_write(udc, DC_DEVADDR, addr);
577 	isp1760_udc_set(udc, DC_DEVEN);
578 
579 	spin_lock(&udc->lock);
580 	isp1760_udc_ctrl_send_status(&udc->ep[0], USB_DIR_OUT);
581 	spin_unlock(&udc->lock);
582 
583 	return 0;
584 }
585 
isp1760_ep0_setup_standard(struct isp1760_udc * udc,struct usb_ctrlrequest * req)586 static bool isp1760_ep0_setup_standard(struct isp1760_udc *udc,
587 				       struct usb_ctrlrequest *req)
588 {
589 	bool stall;
590 
591 	switch (req->bRequest) {
592 	case USB_REQ_GET_STATUS:
593 		return isp1760_udc_get_status(udc, req);
594 
595 	case USB_REQ_CLEAR_FEATURE:
596 		switch (req->bRequestType) {
597 		case USB_DIR_OUT | USB_RECIP_DEVICE: {
598 			/* TODO: Handle remote wakeup feature. */
599 			return true;
600 		}
601 
602 		case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
603 			u16 index = le16_to_cpu(req->wIndex);
604 			struct isp1760_ep *ep;
605 
606 			if (req->wLength != cpu_to_le16(0) ||
607 			    req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
608 				return true;
609 
610 			ep = isp1760_udc_find_ep(udc, index);
611 			if (!ep)
612 				return true;
613 
614 			spin_lock(&udc->lock);
615 
616 			/*
617 			 * If the endpoint is wedged only the gadget can clear
618 			 * the halt feature. Pretend success in that case, but
619 			 * keep the endpoint halted.
620 			 */
621 			if (!ep->wedged)
622 				stall = __isp1760_udc_set_halt(ep, false);
623 			else
624 				stall = false;
625 
626 			if (!stall)
627 				isp1760_udc_ctrl_send_status(&udc->ep[0],
628 							     USB_DIR_OUT);
629 
630 			spin_unlock(&udc->lock);
631 			return stall;
632 		}
633 
634 		default:
635 			return true;
636 		}
637 		break;
638 
639 	case USB_REQ_SET_FEATURE:
640 		switch (req->bRequestType) {
641 		case USB_DIR_OUT | USB_RECIP_DEVICE: {
642 			/* TODO: Handle remote wakeup and test mode features */
643 			return true;
644 		}
645 
646 		case USB_DIR_OUT | USB_RECIP_ENDPOINT: {
647 			u16 index = le16_to_cpu(req->wIndex);
648 			struct isp1760_ep *ep;
649 
650 			if (req->wLength != cpu_to_le16(0) ||
651 			    req->wValue != cpu_to_le16(USB_ENDPOINT_HALT))
652 				return true;
653 
654 			ep = isp1760_udc_find_ep(udc, index);
655 			if (!ep)
656 				return true;
657 
658 			spin_lock(&udc->lock);
659 
660 			stall = __isp1760_udc_set_halt(ep, true);
661 			if (!stall)
662 				isp1760_udc_ctrl_send_status(&udc->ep[0],
663 							     USB_DIR_OUT);
664 
665 			spin_unlock(&udc->lock);
666 			return stall;
667 		}
668 
669 		default:
670 			return true;
671 		}
672 		break;
673 
674 	case USB_REQ_SET_ADDRESS:
675 		if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
676 			return true;
677 
678 		return isp1760_udc_set_address(udc, le16_to_cpu(req->wValue));
679 
680 	case USB_REQ_SET_CONFIGURATION:
681 		if (req->bRequestType != (USB_DIR_OUT | USB_RECIP_DEVICE))
682 			return true;
683 
684 		if (udc->gadget.state != USB_STATE_ADDRESS &&
685 		    udc->gadget.state != USB_STATE_CONFIGURED)
686 			return true;
687 
688 		stall = udc->driver->setup(&udc->gadget, req) < 0;
689 		if (stall)
690 			return true;
691 
692 		usb_gadget_set_state(&udc->gadget, req->wValue ?
693 				     USB_STATE_CONFIGURED : USB_STATE_ADDRESS);
694 
695 		/*
696 		 * SET_CONFIGURATION (and SET_INTERFACE) must reset the halt
697 		 * feature on all endpoints. There is however no need to do so
698 		 * explicitly here as the gadget driver will disable and
699 		 * reenable endpoints, clearing the halt feature.
700 		 */
701 		return false;
702 
703 	default:
704 		return udc->driver->setup(&udc->gadget, req) < 0;
705 	}
706 }
707 
isp1760_ep0_setup(struct isp1760_udc * udc)708 static void isp1760_ep0_setup(struct isp1760_udc *udc)
709 {
710 	union {
711 		struct usb_ctrlrequest r;
712 		u32 data[2];
713 	} req;
714 	unsigned int count;
715 	bool stall = false;
716 
717 	spin_lock(&udc->lock);
718 
719 	isp1760_udc_set(udc, DC_EP0SETUP);
720 
721 	count = isp1760_udc_read(udc, DC_BUFLEN);
722 	if (count != sizeof(req)) {
723 		spin_unlock(&udc->lock);
724 
725 		dev_err(udc->isp->dev, "invalid length %u for setup packet\n",
726 			count);
727 
728 		isp1760_udc_ctrl_send_stall(&udc->ep[0]);
729 		return;
730 	}
731 
732 	req.data[0] = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
733 	req.data[1] = isp1760_udc_read_raw(udc, ISP176x_DC_DATAPORT);
734 
735 	if (udc->ep0_state != ISP1760_CTRL_SETUP) {
736 		spin_unlock(&udc->lock);
737 		dev_dbg(udc->isp->dev, "unexpected SETUP packet\n");
738 		return;
739 	}
740 
741 	/* Move to the data stage. */
742 	if (!req.r.wLength)
743 		udc->ep0_state = ISP1760_CTRL_STATUS;
744 	else if (req.r.bRequestType & USB_DIR_IN)
745 		udc->ep0_state = ISP1760_CTRL_DATA_IN;
746 	else
747 		udc->ep0_state = ISP1760_CTRL_DATA_OUT;
748 
749 	udc->ep0_dir = req.r.bRequestType & USB_DIR_IN;
750 	udc->ep0_length = le16_to_cpu(req.r.wLength);
751 
752 	spin_unlock(&udc->lock);
753 
754 	dev_dbg(udc->isp->dev,
755 		"%s: bRequestType 0x%02x bRequest 0x%02x wValue 0x%04x wIndex 0x%04x wLength 0x%04x\n",
756 		__func__, req.r.bRequestType, req.r.bRequest,
757 		le16_to_cpu(req.r.wValue), le16_to_cpu(req.r.wIndex),
758 		le16_to_cpu(req.r.wLength));
759 
760 	if ((req.r.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
761 		stall = isp1760_ep0_setup_standard(udc, &req.r);
762 	else
763 		stall = udc->driver->setup(&udc->gadget, &req.r) < 0;
764 
765 	if (stall)
766 		isp1760_udc_ctrl_send_stall(&udc->ep[0]);
767 }
768 
769 /* -----------------------------------------------------------------------------
770  * Gadget Endpoint Operations
771  */
772 
isp1760_ep_enable(struct usb_ep * ep,const struct usb_endpoint_descriptor * desc)773 static int isp1760_ep_enable(struct usb_ep *ep,
774 			     const struct usb_endpoint_descriptor *desc)
775 {
776 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
777 	struct isp1760_udc *udc = uep->udc;
778 	unsigned long flags;
779 	unsigned int type;
780 
781 	dev_dbg(uep->udc->isp->dev, "%s\n", __func__);
782 
783 	/*
784 	 * Validate the descriptor. The control endpoint can't be enabled
785 	 * manually.
786 	 */
787 	if (desc->bDescriptorType != USB_DT_ENDPOINT ||
788 	    desc->bEndpointAddress == 0 ||
789 	    desc->bEndpointAddress != uep->addr ||
790 	    le16_to_cpu(desc->wMaxPacketSize) > ep->maxpacket) {
791 		dev_dbg(udc->isp->dev,
792 			"%s: invalid descriptor type %u addr %02x ep addr %02x max packet size %u/%u\n",
793 			__func__, desc->bDescriptorType,
794 			desc->bEndpointAddress, uep->addr,
795 			le16_to_cpu(desc->wMaxPacketSize), ep->maxpacket);
796 		return -EINVAL;
797 	}
798 
799 	switch (usb_endpoint_type(desc)) {
800 	case USB_ENDPOINT_XFER_ISOC:
801 		type = ISP176x_DC_ENDPTYP_ISOC;
802 		break;
803 	case USB_ENDPOINT_XFER_BULK:
804 		type = ISP176x_DC_ENDPTYP_BULK;
805 		break;
806 	case USB_ENDPOINT_XFER_INT:
807 		type = ISP176x_DC_ENDPTYP_INTERRUPT;
808 		break;
809 	case USB_ENDPOINT_XFER_CONTROL:
810 	default:
811 		dev_dbg(udc->isp->dev, "%s: control endpoints unsupported\n",
812 			__func__);
813 		return -EINVAL;
814 	}
815 
816 	spin_lock_irqsave(&udc->lock, flags);
817 
818 	uep->desc = desc;
819 	uep->maxpacket = le16_to_cpu(desc->wMaxPacketSize);
820 	uep->rx_pending = false;
821 	uep->halted = false;
822 	uep->wedged = false;
823 
824 	isp1760_udc_select_ep(udc, uep);
825 
826 	isp1760_udc_write(udc, DC_FFOSZ, uep->maxpacket);
827 	isp1760_udc_write(udc, DC_BUFLEN, uep->maxpacket);
828 
829 	isp1760_udc_write(udc, DC_ENDPTYP, type);
830 	isp1760_udc_set(udc, DC_EPENABLE);
831 
832 	spin_unlock_irqrestore(&udc->lock, flags);
833 
834 	return 0;
835 }
836 
isp1760_ep_disable(struct usb_ep * ep)837 static int isp1760_ep_disable(struct usb_ep *ep)
838 {
839 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
840 	struct isp1760_udc *udc = uep->udc;
841 	struct isp1760_request *req, *nreq;
842 	LIST_HEAD(req_list);
843 	unsigned long flags;
844 
845 	dev_dbg(udc->isp->dev, "%s\n", __func__);
846 
847 	spin_lock_irqsave(&udc->lock, flags);
848 
849 	if (!uep->desc) {
850 		dev_dbg(udc->isp->dev, "%s: endpoint not enabled\n", __func__);
851 		spin_unlock_irqrestore(&udc->lock, flags);
852 		return -EINVAL;
853 	}
854 
855 	uep->desc = NULL;
856 	uep->maxpacket = 0;
857 
858 	isp1760_udc_select_ep(udc, uep);
859 	isp1760_udc_clear(udc, DC_EPENABLE);
860 	isp1760_udc_clear(udc, DC_ENDPTYP);
861 
862 	/* TODO Synchronize with the IRQ handler */
863 
864 	list_splice_init(&uep->queue, &req_list);
865 
866 	spin_unlock_irqrestore(&udc->lock, flags);
867 
868 	list_for_each_entry_safe(req, nreq, &req_list, queue) {
869 		list_del(&req->queue);
870 		isp1760_udc_request_complete(uep, req, -ESHUTDOWN);
871 	}
872 
873 	return 0;
874 }
875 
isp1760_ep_alloc_request(struct usb_ep * ep,gfp_t gfp_flags)876 static struct usb_request *isp1760_ep_alloc_request(struct usb_ep *ep,
877 						    gfp_t gfp_flags)
878 {
879 	struct isp1760_request *req;
880 
881 	req = kzalloc(sizeof(*req), gfp_flags);
882 	if (!req)
883 		return NULL;
884 
885 	return &req->req;
886 }
887 
isp1760_ep_free_request(struct usb_ep * ep,struct usb_request * _req)888 static void isp1760_ep_free_request(struct usb_ep *ep, struct usb_request *_req)
889 {
890 	struct isp1760_request *req = req_to_udc_req(_req);
891 
892 	kfree(req);
893 }
894 
isp1760_ep_queue(struct usb_ep * ep,struct usb_request * _req,gfp_t gfp_flags)895 static int isp1760_ep_queue(struct usb_ep *ep, struct usb_request *_req,
896 			    gfp_t gfp_flags)
897 {
898 	struct isp1760_request *req = req_to_udc_req(_req);
899 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
900 	struct isp1760_udc *udc = uep->udc;
901 	bool complete = false;
902 	unsigned long flags;
903 	int ret = 0;
904 
905 	_req->status = -EINPROGRESS;
906 	_req->actual = 0;
907 
908 	spin_lock_irqsave(&udc->lock, flags);
909 
910 	dev_dbg(udc->isp->dev,
911 		"%s: req %p (%u bytes%s) ep %p(0x%02x)\n", __func__, _req,
912 		_req->length, _req->zero ? " (zlp)" : "", uep, uep->addr);
913 
914 	req->ep = uep;
915 
916 	if (uep->addr == 0) {
917 		if (_req->length != udc->ep0_length &&
918 		    udc->ep0_state != ISP1760_CTRL_DATA_IN) {
919 			dev_dbg(udc->isp->dev,
920 				"%s: invalid length %u for req %p\n",
921 				__func__, _req->length, req);
922 			ret = -EINVAL;
923 			goto done;
924 		}
925 
926 		switch (udc->ep0_state) {
927 		case ISP1760_CTRL_DATA_IN:
928 			dev_dbg(udc->isp->dev, "%s: transmitting req %p\n",
929 				__func__, req);
930 
931 			list_add_tail(&req->queue, &uep->queue);
932 			isp1760_udc_transmit(uep, req);
933 			break;
934 
935 		case ISP1760_CTRL_DATA_OUT:
936 			list_add_tail(&req->queue, &uep->queue);
937 			__isp1760_udc_select_ep(udc, uep, USB_DIR_OUT);
938 			isp1760_udc_set(udc, DC_DSEN);
939 			break;
940 
941 		case ISP1760_CTRL_STATUS:
942 			complete = true;
943 			break;
944 
945 		default:
946 			dev_dbg(udc->isp->dev, "%s: invalid ep0 state\n",
947 				__func__);
948 			ret = -EINVAL;
949 			break;
950 		}
951 	} else if (uep->desc) {
952 		bool empty = list_empty(&uep->queue);
953 
954 		list_add_tail(&req->queue, &uep->queue);
955 		if ((uep->addr & USB_DIR_IN) && !uep->halted && empty)
956 			isp1760_udc_transmit(uep, req);
957 		else if (!(uep->addr & USB_DIR_IN) && uep->rx_pending)
958 			complete = isp1760_udc_receive(uep, req);
959 	} else {
960 		dev_dbg(udc->isp->dev,
961 			"%s: can't queue request to disabled ep%02x\n",
962 			__func__, uep->addr);
963 		ret = -ESHUTDOWN;
964 	}
965 
966 done:
967 	if (ret < 0)
968 		req->ep = NULL;
969 
970 	spin_unlock_irqrestore(&udc->lock, flags);
971 
972 	if (complete)
973 		isp1760_udc_request_complete(uep, req, 0);
974 
975 	return ret;
976 }
977 
isp1760_ep_dequeue(struct usb_ep * ep,struct usb_request * _req)978 static int isp1760_ep_dequeue(struct usb_ep *ep, struct usb_request *_req)
979 {
980 	struct isp1760_request *req = req_to_udc_req(_req);
981 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
982 	struct isp1760_udc *udc = uep->udc;
983 	unsigned long flags;
984 
985 	dev_dbg(uep->udc->isp->dev, "%s(ep%02x)\n", __func__, uep->addr);
986 
987 	spin_lock_irqsave(&udc->lock, flags);
988 
989 	if (req->ep != uep)
990 		req = NULL;
991 	else
992 		list_del(&req->queue);
993 
994 	spin_unlock_irqrestore(&udc->lock, flags);
995 
996 	if (!req)
997 		return -EINVAL;
998 
999 	isp1760_udc_request_complete(uep, req, -ECONNRESET);
1000 	return 0;
1001 }
1002 
__isp1760_ep_set_halt(struct isp1760_ep * uep,bool stall,bool wedge)1003 static int __isp1760_ep_set_halt(struct isp1760_ep *uep, bool stall, bool wedge)
1004 {
1005 	struct isp1760_udc *udc = uep->udc;
1006 	int ret;
1007 
1008 	if (!uep->addr) {
1009 		/*
1010 		 * Halting the control endpoint is only valid as a delayed error
1011 		 * response to a SETUP packet. Make sure EP0 is in the right
1012 		 * stage and that the gadget isn't trying to clear the halt
1013 		 * condition.
1014 		 */
1015 		if (WARN_ON(udc->ep0_state == ISP1760_CTRL_SETUP || !stall ||
1016 			     wedge)) {
1017 			return -EINVAL;
1018 		}
1019 	}
1020 
1021 	if (uep->addr && !uep->desc) {
1022 		dev_dbg(udc->isp->dev, "%s: ep%02x is disabled\n", __func__,
1023 			uep->addr);
1024 		return -EINVAL;
1025 	}
1026 
1027 	if (uep->addr & USB_DIR_IN) {
1028 		/* Refuse to halt IN endpoints with active transfers. */
1029 		if (!list_empty(&uep->queue)) {
1030 			dev_dbg(udc->isp->dev,
1031 				"%s: ep%02x has request pending\n", __func__,
1032 				uep->addr);
1033 			return -EAGAIN;
1034 		}
1035 	}
1036 
1037 	ret = __isp1760_udc_set_halt(uep, stall);
1038 	if (ret < 0)
1039 		return ret;
1040 
1041 	if (!uep->addr) {
1042 		/*
1043 		 * Stalling EP0 completes the control transaction, move back to
1044 		 * the SETUP state.
1045 		 */
1046 		udc->ep0_state = ISP1760_CTRL_SETUP;
1047 		return 0;
1048 	}
1049 
1050 	if (wedge)
1051 		uep->wedged = true;
1052 	else if (!stall)
1053 		uep->wedged = false;
1054 
1055 	return 0;
1056 }
1057 
isp1760_ep_set_halt(struct usb_ep * ep,int value)1058 static int isp1760_ep_set_halt(struct usb_ep *ep, int value)
1059 {
1060 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
1061 	unsigned long flags;
1062 	int ret;
1063 
1064 	dev_dbg(uep->udc->isp->dev, "%s: %s halt on ep%02x\n", __func__,
1065 		value ? "set" : "clear", uep->addr);
1066 
1067 	spin_lock_irqsave(&uep->udc->lock, flags);
1068 	ret = __isp1760_ep_set_halt(uep, value, false);
1069 	spin_unlock_irqrestore(&uep->udc->lock, flags);
1070 
1071 	return ret;
1072 }
1073 
isp1760_ep_set_wedge(struct usb_ep * ep)1074 static int isp1760_ep_set_wedge(struct usb_ep *ep)
1075 {
1076 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
1077 	unsigned long flags;
1078 	int ret;
1079 
1080 	dev_dbg(uep->udc->isp->dev, "%s: set wedge on ep%02x)\n", __func__,
1081 		uep->addr);
1082 
1083 	spin_lock_irqsave(&uep->udc->lock, flags);
1084 	ret = __isp1760_ep_set_halt(uep, true, true);
1085 	spin_unlock_irqrestore(&uep->udc->lock, flags);
1086 
1087 	return ret;
1088 }
1089 
isp1760_ep_fifo_flush(struct usb_ep * ep)1090 static void isp1760_ep_fifo_flush(struct usb_ep *ep)
1091 {
1092 	struct isp1760_ep *uep = ep_to_udc_ep(ep);
1093 	struct isp1760_udc *udc = uep->udc;
1094 	unsigned long flags;
1095 
1096 	spin_lock_irqsave(&udc->lock, flags);
1097 
1098 	isp1760_udc_select_ep(udc, uep);
1099 
1100 	/*
1101 	 * Set the CLBUF bit twice to flush both buffers in case double
1102 	 * buffering is enabled.
1103 	 */
1104 	isp1760_udc_set(udc, DC_CLBUF);
1105 	isp1760_udc_set(udc, DC_CLBUF);
1106 
1107 	spin_unlock_irqrestore(&udc->lock, flags);
1108 }
1109 
1110 static const struct usb_ep_ops isp1760_ep_ops = {
1111 	.enable = isp1760_ep_enable,
1112 	.disable = isp1760_ep_disable,
1113 	.alloc_request = isp1760_ep_alloc_request,
1114 	.free_request = isp1760_ep_free_request,
1115 	.queue = isp1760_ep_queue,
1116 	.dequeue = isp1760_ep_dequeue,
1117 	.set_halt = isp1760_ep_set_halt,
1118 	.set_wedge = isp1760_ep_set_wedge,
1119 	.fifo_flush = isp1760_ep_fifo_flush,
1120 };
1121 
1122 /* -----------------------------------------------------------------------------
1123  * Device States
1124  */
1125 
1126 /* Called with the UDC spinlock held. */
isp1760_udc_connect(struct isp1760_udc * udc)1127 static void isp1760_udc_connect(struct isp1760_udc *udc)
1128 {
1129 	usb_gadget_set_state(&udc->gadget, USB_STATE_POWERED);
1130 	mod_timer(&udc->vbus_timer, jiffies + ISP1760_VBUS_POLL_INTERVAL);
1131 }
1132 
1133 /* Called with the UDC spinlock held. */
isp1760_udc_disconnect(struct isp1760_udc * udc)1134 static void isp1760_udc_disconnect(struct isp1760_udc *udc)
1135 {
1136 	if (udc->gadget.state < USB_STATE_POWERED)
1137 		return;
1138 
1139 	dev_dbg(udc->isp->dev, "Device disconnected in state %u\n",
1140 		 udc->gadget.state);
1141 
1142 	udc->gadget.speed = USB_SPEED_UNKNOWN;
1143 	usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1144 
1145 	if (udc->driver->disconnect)
1146 		udc->driver->disconnect(&udc->gadget);
1147 
1148 	del_timer(&udc->vbus_timer);
1149 
1150 	/* TODO Reset all endpoints ? */
1151 }
1152 
isp1760_udc_init_hw(struct isp1760_udc * udc)1153 static void isp1760_udc_init_hw(struct isp1760_udc *udc)
1154 {
1155 	u32 intconf = udc->is_isp1763 ? ISP1763_DC_INTCONF : ISP176x_DC_INTCONF;
1156 	u32 intena = udc->is_isp1763 ? ISP1763_DC_INTENABLE :
1157 						ISP176x_DC_INTENABLE;
1158 
1159 	/*
1160 	 * The device controller currently shares its interrupt with the host
1161 	 * controller, the DC_IRQ polarity and signaling mode are ignored. Set
1162 	 * the to active-low level-triggered.
1163 	 *
1164 	 * Configure the control, in and out pipes to generate interrupts on
1165 	 * ACK tokens only (and NYET for the out pipe). The default
1166 	 * configuration also generates an interrupt on the first NACK token.
1167 	 */
1168 	isp1760_reg_write(udc->regs, intconf,
1169 			  ISP176x_DC_CDBGMOD_ACK | ISP176x_DC_DDBGMODIN_ACK |
1170 			  ISP176x_DC_DDBGMODOUT_ACK);
1171 
1172 	isp1760_reg_write(udc->regs, intena, DC_IEPRXTX(7) |
1173 			  DC_IEPRXTX(6) | DC_IEPRXTX(5) | DC_IEPRXTX(4) |
1174 			  DC_IEPRXTX(3) | DC_IEPRXTX(2) | DC_IEPRXTX(1) |
1175 			  DC_IEPRXTX(0) | ISP176x_DC_IEP0SETUP |
1176 			  ISP176x_DC_IEVBUS | ISP176x_DC_IERESM |
1177 			  ISP176x_DC_IESUSP | ISP176x_DC_IEHS_STA |
1178 			  ISP176x_DC_IEBRST);
1179 
1180 	if (udc->connected)
1181 		isp1760_set_pullup(udc->isp, true);
1182 
1183 	isp1760_udc_set(udc, DC_DEVEN);
1184 }
1185 
isp1760_udc_reset(struct isp1760_udc * udc)1186 static void isp1760_udc_reset(struct isp1760_udc *udc)
1187 {
1188 	unsigned long flags;
1189 
1190 	spin_lock_irqsave(&udc->lock, flags);
1191 
1192 	/*
1193 	 * The bus reset has reset most registers to their default value,
1194 	 * reinitialize the UDC hardware.
1195 	 */
1196 	isp1760_udc_init_hw(udc);
1197 
1198 	udc->ep0_state = ISP1760_CTRL_SETUP;
1199 	udc->gadget.speed = USB_SPEED_FULL;
1200 
1201 	usb_gadget_udc_reset(&udc->gadget, udc->driver);
1202 
1203 	spin_unlock_irqrestore(&udc->lock, flags);
1204 }
1205 
isp1760_udc_suspend(struct isp1760_udc * udc)1206 static void isp1760_udc_suspend(struct isp1760_udc *udc)
1207 {
1208 	if (udc->gadget.state < USB_STATE_DEFAULT)
1209 		return;
1210 
1211 	if (udc->driver->suspend)
1212 		udc->driver->suspend(&udc->gadget);
1213 }
1214 
isp1760_udc_resume(struct isp1760_udc * udc)1215 static void isp1760_udc_resume(struct isp1760_udc *udc)
1216 {
1217 	if (udc->gadget.state < USB_STATE_DEFAULT)
1218 		return;
1219 
1220 	if (udc->driver->resume)
1221 		udc->driver->resume(&udc->gadget);
1222 }
1223 
1224 /* -----------------------------------------------------------------------------
1225  * Gadget Operations
1226  */
1227 
isp1760_udc_get_frame(struct usb_gadget * gadget)1228 static int isp1760_udc_get_frame(struct usb_gadget *gadget)
1229 {
1230 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1231 
1232 	return isp1760_udc_read(udc, DC_FRAMENUM);
1233 }
1234 
isp1760_udc_wakeup(struct usb_gadget * gadget)1235 static int isp1760_udc_wakeup(struct usb_gadget *gadget)
1236 {
1237 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1238 
1239 	dev_dbg(udc->isp->dev, "%s\n", __func__);
1240 	return -ENOTSUPP;
1241 }
1242 
isp1760_udc_set_selfpowered(struct usb_gadget * gadget,int is_selfpowered)1243 static int isp1760_udc_set_selfpowered(struct usb_gadget *gadget,
1244 				       int is_selfpowered)
1245 {
1246 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1247 
1248 	if (is_selfpowered)
1249 		udc->devstatus |= 1 << USB_DEVICE_SELF_POWERED;
1250 	else
1251 		udc->devstatus &= ~(1 << USB_DEVICE_SELF_POWERED);
1252 
1253 	return 0;
1254 }
1255 
isp1760_udc_pullup(struct usb_gadget * gadget,int is_on)1256 static int isp1760_udc_pullup(struct usb_gadget *gadget, int is_on)
1257 {
1258 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1259 
1260 	isp1760_set_pullup(udc->isp, is_on);
1261 	udc->connected = is_on;
1262 
1263 	return 0;
1264 }
1265 
isp1760_udc_start(struct usb_gadget * gadget,struct usb_gadget_driver * driver)1266 static int isp1760_udc_start(struct usb_gadget *gadget,
1267 			     struct usb_gadget_driver *driver)
1268 {
1269 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1270 	unsigned long flags;
1271 
1272 	/* The hardware doesn't support low speed. */
1273 	if (driver->max_speed < USB_SPEED_FULL) {
1274 		dev_err(udc->isp->dev, "Invalid gadget driver\n");
1275 		return -EINVAL;
1276 	}
1277 
1278 	spin_lock_irqsave(&udc->lock, flags);
1279 
1280 	if (udc->driver) {
1281 		dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
1282 		spin_unlock_irqrestore(&udc->lock, flags);
1283 		return -EBUSY;
1284 	}
1285 
1286 	udc->driver = driver;
1287 
1288 	spin_unlock_irqrestore(&udc->lock, flags);
1289 
1290 	dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
1291 		driver->function);
1292 
1293 	udc->devstatus = 0;
1294 	udc->connected = true;
1295 
1296 	usb_gadget_set_state(&udc->gadget, USB_STATE_ATTACHED);
1297 
1298 	/* DMA isn't supported yet, don't enable the DMA clock. */
1299 	isp1760_udc_set(udc, DC_GLINTENA);
1300 
1301 	isp1760_udc_init_hw(udc);
1302 
1303 	dev_dbg(udc->isp->dev, "UDC started with driver %s\n",
1304 		driver->function);
1305 
1306 	return 0;
1307 }
1308 
isp1760_udc_stop(struct usb_gadget * gadget)1309 static int isp1760_udc_stop(struct usb_gadget *gadget)
1310 {
1311 	struct isp1760_udc *udc = gadget_to_udc(gadget);
1312 	u32 mode_reg = udc->is_isp1763 ? ISP1763_DC_MODE : ISP176x_DC_MODE;
1313 	unsigned long flags;
1314 
1315 	dev_dbg(udc->isp->dev, "%s\n", __func__);
1316 
1317 	del_timer_sync(&udc->vbus_timer);
1318 
1319 	isp1760_reg_write(udc->regs, mode_reg, 0);
1320 
1321 	spin_lock_irqsave(&udc->lock, flags);
1322 	udc->driver = NULL;
1323 	spin_unlock_irqrestore(&udc->lock, flags);
1324 
1325 	return 0;
1326 }
1327 
1328 static const struct usb_gadget_ops isp1760_udc_ops = {
1329 	.get_frame = isp1760_udc_get_frame,
1330 	.wakeup = isp1760_udc_wakeup,
1331 	.set_selfpowered = isp1760_udc_set_selfpowered,
1332 	.pullup = isp1760_udc_pullup,
1333 	.udc_start = isp1760_udc_start,
1334 	.udc_stop = isp1760_udc_stop,
1335 };
1336 
1337 /* -----------------------------------------------------------------------------
1338  * Interrupt Handling
1339  */
1340 
isp1760_udc_irq_get_status(struct isp1760_udc * udc)1341 static u32 isp1760_udc_irq_get_status(struct isp1760_udc *udc)
1342 {
1343 	u32 status;
1344 
1345 	if (udc->is_isp1763) {
1346 		status = isp1760_reg_read(udc->regs, ISP1763_DC_INTERRUPT)
1347 			& isp1760_reg_read(udc->regs, ISP1763_DC_INTENABLE);
1348 		isp1760_reg_write(udc->regs, ISP1763_DC_INTERRUPT, status);
1349 	} else {
1350 		status = isp1760_reg_read(udc->regs, ISP176x_DC_INTERRUPT)
1351 			& isp1760_reg_read(udc->regs, ISP176x_DC_INTENABLE);
1352 		isp1760_reg_write(udc->regs, ISP176x_DC_INTERRUPT, status);
1353 	}
1354 
1355 	return status;
1356 }
1357 
isp1760_udc_irq(int irq,void * dev)1358 static irqreturn_t isp1760_udc_irq(int irq, void *dev)
1359 {
1360 	struct isp1760_udc *udc = dev;
1361 	unsigned int i;
1362 	u32 status;
1363 
1364 	status = isp1760_udc_irq_get_status(udc);
1365 
1366 	if (status & ISP176x_DC_IEVBUS) {
1367 		dev_dbg(udc->isp->dev, "%s(VBUS)\n", __func__);
1368 		/* The VBUS interrupt is only triggered when VBUS appears. */
1369 		spin_lock(&udc->lock);
1370 		isp1760_udc_connect(udc);
1371 		spin_unlock(&udc->lock);
1372 	}
1373 
1374 	if (status & ISP176x_DC_IEBRST) {
1375 		dev_dbg(udc->isp->dev, "%s(BRST)\n", __func__);
1376 
1377 		isp1760_udc_reset(udc);
1378 	}
1379 
1380 	for (i = 0; i <= 7; ++i) {
1381 		struct isp1760_ep *ep = &udc->ep[i*2];
1382 
1383 		if (status & DC_IEPTX(i)) {
1384 			dev_dbg(udc->isp->dev, "%s(EPTX%u)\n", __func__, i);
1385 			isp1760_ep_tx_complete(ep);
1386 		}
1387 
1388 		if (status & DC_IEPRX(i)) {
1389 			dev_dbg(udc->isp->dev, "%s(EPRX%u)\n", __func__, i);
1390 			isp1760_ep_rx_ready(i ? ep - 1 : ep);
1391 		}
1392 	}
1393 
1394 	if (status & ISP176x_DC_IEP0SETUP) {
1395 		dev_dbg(udc->isp->dev, "%s(EP0SETUP)\n", __func__);
1396 
1397 		isp1760_ep0_setup(udc);
1398 	}
1399 
1400 	if (status & ISP176x_DC_IERESM) {
1401 		dev_dbg(udc->isp->dev, "%s(RESM)\n", __func__);
1402 		isp1760_udc_resume(udc);
1403 	}
1404 
1405 	if (status & ISP176x_DC_IESUSP) {
1406 		dev_dbg(udc->isp->dev, "%s(SUSP)\n", __func__);
1407 
1408 		spin_lock(&udc->lock);
1409 		if (!isp1760_udc_is_set(udc, DC_VBUSSTAT))
1410 			isp1760_udc_disconnect(udc);
1411 		else
1412 			isp1760_udc_suspend(udc);
1413 		spin_unlock(&udc->lock);
1414 	}
1415 
1416 	if (status & ISP176x_DC_IEHS_STA) {
1417 		dev_dbg(udc->isp->dev, "%s(HS_STA)\n", __func__);
1418 		udc->gadget.speed = USB_SPEED_HIGH;
1419 	}
1420 
1421 	return status ? IRQ_HANDLED : IRQ_NONE;
1422 }
1423 
isp1760_udc_vbus_poll(struct timer_list * t)1424 static void isp1760_udc_vbus_poll(struct timer_list *t)
1425 {
1426 	struct isp1760_udc *udc = from_timer(udc, t, vbus_timer);
1427 	unsigned long flags;
1428 
1429 	spin_lock_irqsave(&udc->lock, flags);
1430 
1431 	if (!(isp1760_udc_is_set(udc, DC_VBUSSTAT)))
1432 		isp1760_udc_disconnect(udc);
1433 	else if (udc->gadget.state >= USB_STATE_POWERED)
1434 		mod_timer(&udc->vbus_timer,
1435 			  jiffies + ISP1760_VBUS_POLL_INTERVAL);
1436 
1437 	spin_unlock_irqrestore(&udc->lock, flags);
1438 }
1439 
1440 /* -----------------------------------------------------------------------------
1441  * Registration
1442  */
1443 
isp1760_udc_init_eps(struct isp1760_udc * udc)1444 static void isp1760_udc_init_eps(struct isp1760_udc *udc)
1445 {
1446 	unsigned int i;
1447 
1448 	INIT_LIST_HEAD(&udc->gadget.ep_list);
1449 
1450 	for (i = 0; i < ARRAY_SIZE(udc->ep); ++i) {
1451 		struct isp1760_ep *ep = &udc->ep[i];
1452 		unsigned int ep_num = (i + 1) / 2;
1453 		bool is_in = !(i & 1);
1454 
1455 		ep->udc = udc;
1456 
1457 		INIT_LIST_HEAD(&ep->queue);
1458 
1459 		ep->addr = (ep_num && is_in ? USB_DIR_IN : USB_DIR_OUT)
1460 			 | ep_num;
1461 		ep->desc = NULL;
1462 
1463 		sprintf(ep->name, "ep%u%s", ep_num,
1464 			ep_num ? (is_in ? "in" : "out") : "");
1465 
1466 		ep->ep.ops = &isp1760_ep_ops;
1467 		ep->ep.name = ep->name;
1468 
1469 		/*
1470 		 * Hardcode the maximum packet sizes for now, to 64 bytes for
1471 		 * the control endpoint and 512 bytes for all other endpoints.
1472 		 * This fits in the 8kB FIFO without double-buffering.
1473 		 */
1474 		if (ep_num == 0) {
1475 			usb_ep_set_maxpacket_limit(&ep->ep, 64);
1476 			ep->ep.caps.type_control = true;
1477 			ep->ep.caps.dir_in = true;
1478 			ep->ep.caps.dir_out = true;
1479 			ep->maxpacket = 64;
1480 			udc->gadget.ep0 = &ep->ep;
1481 		} else {
1482 			usb_ep_set_maxpacket_limit(&ep->ep, 512);
1483 			ep->ep.caps.type_iso = true;
1484 			ep->ep.caps.type_bulk = true;
1485 			ep->ep.caps.type_int = true;
1486 			ep->maxpacket = 0;
1487 			list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
1488 		}
1489 
1490 		if (is_in)
1491 			ep->ep.caps.dir_in = true;
1492 		else
1493 			ep->ep.caps.dir_out = true;
1494 	}
1495 }
1496 
isp1760_udc_init(struct isp1760_udc * udc)1497 static int isp1760_udc_init(struct isp1760_udc *udc)
1498 {
1499 	u32 mode_reg = udc->is_isp1763 ? ISP1763_DC_MODE : ISP176x_DC_MODE;
1500 	u16 scratch;
1501 	u32 chipid;
1502 
1503 	/*
1504 	 * Check that the controller is present by writing to the scratch
1505 	 * register, modifying the bus pattern by reading from the chip ID
1506 	 * register, and reading the scratch register value back. The chip ID
1507 	 * and scratch register contents must match the expected values.
1508 	 */
1509 	isp1760_udc_write(udc, DC_SCRATCH, 0xbabe);
1510 	chipid = isp1760_udc_read(udc, DC_CHIP_ID_HIGH) << 16;
1511 	chipid |= isp1760_udc_read(udc, DC_CHIP_ID_LOW);
1512 	scratch = isp1760_udc_read(udc, DC_SCRATCH);
1513 
1514 	if (scratch != 0xbabe) {
1515 		dev_err(udc->isp->dev,
1516 			"udc: scratch test failed (0x%04x/0x%08x)\n",
1517 			scratch, chipid);
1518 		return -ENODEV;
1519 	}
1520 
1521 	if (chipid != 0x00011582 && chipid != 0x00158210 &&
1522 	    chipid != 0x00176320) {
1523 		dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
1524 		return -ENODEV;
1525 	}
1526 
1527 	/* Reset the device controller. */
1528 	isp1760_udc_set(udc, DC_SFRESET);
1529 	usleep_range(10000, 11000);
1530 	isp1760_reg_write(udc->regs, mode_reg, 0);
1531 	usleep_range(10000, 11000);
1532 
1533 	return 0;
1534 }
1535 
isp1760_udc_register(struct isp1760_device * isp,int irq,unsigned long irqflags)1536 int isp1760_udc_register(struct isp1760_device *isp, int irq,
1537 			 unsigned long irqflags)
1538 {
1539 	struct isp1760_udc *udc = &isp->udc;
1540 	int ret;
1541 
1542 	udc->irq = -1;
1543 	udc->isp = isp;
1544 
1545 	spin_lock_init(&udc->lock);
1546 	timer_setup(&udc->vbus_timer, isp1760_udc_vbus_poll, 0);
1547 
1548 	ret = isp1760_udc_init(udc);
1549 	if (ret < 0)
1550 		return ret;
1551 
1552 	udc->irqname = kasprintf(GFP_KERNEL, "%s (udc)", dev_name(isp->dev));
1553 	if (!udc->irqname)
1554 		return -ENOMEM;
1555 
1556 	ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
1557 			  udc->irqname, udc);
1558 	if (ret < 0)
1559 		goto error;
1560 
1561 	udc->irq = irq;
1562 
1563 	/*
1564 	 * Initialize the gadget static fields and register its device. Gadget
1565 	 * fields that vary during the life time of the gadget are initialized
1566 	 * by the UDC core.
1567 	 */
1568 	udc->gadget.ops = &isp1760_udc_ops;
1569 	udc->gadget.speed = USB_SPEED_UNKNOWN;
1570 	udc->gadget.max_speed = USB_SPEED_HIGH;
1571 	udc->gadget.name = "isp1761_udc";
1572 
1573 	isp1760_udc_init_eps(udc);
1574 
1575 	ret = usb_add_gadget_udc(isp->dev, &udc->gadget);
1576 	if (ret < 0)
1577 		goto error;
1578 
1579 	return 0;
1580 
1581 error:
1582 	if (udc->irq >= 0)
1583 		free_irq(udc->irq, udc);
1584 	kfree(udc->irqname);
1585 
1586 	return ret;
1587 }
1588 
isp1760_udc_unregister(struct isp1760_device * isp)1589 void isp1760_udc_unregister(struct isp1760_device *isp)
1590 {
1591 	struct isp1760_udc *udc = &isp->udc;
1592 
1593 	if (!udc->isp)
1594 		return;
1595 
1596 	usb_del_gadget_udc(&udc->gadget);
1597 
1598 	free_irq(udc->irq, udc);
1599 	kfree(udc->irqname);
1600 }
1601