ds2490.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	ds2490.c  USB to one wire bridge
   4 *
   5 * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
   6 */
   7
   8#include <linux/module.h>
   9#include <linux/kernel.h>
  10#include <linux/mod_devicetable.h>
  11#include <linux/usb.h>
  12#include <linux/slab.h>
  13
  14#include <linux/w1.h>
  15
  16/* USB Standard */
  17/* USB Control request vendor type */
  18#define VENDOR				0x40
  19
  20/* COMMAND TYPE CODES */
  21#define CONTROL_CMD			0x00
  22#define COMM_CMD			0x01
  23#define MODE_CMD			0x02
  24
  25/* CONTROL COMMAND CODES */
  26#define CTL_RESET_DEVICE		0x0000
  27#define CTL_START_EXE			0x0001
  28#define CTL_RESUME_EXE			0x0002
  29#define CTL_HALT_EXE_IDLE		0x0003
  30#define CTL_HALT_EXE_DONE		0x0004
  31#define CTL_FLUSH_COMM_CMDS		0x0007
  32#define CTL_FLUSH_RCV_BUFFER		0x0008
  33#define CTL_FLUSH_XMT_BUFFER		0x0009
  34#define CTL_GET_COMM_CMDS		0x000A
  35
  36/* MODE COMMAND CODES */
  37#define MOD_PULSE_EN			0x0000
  38#define MOD_SPEED_CHANGE_EN		0x0001
  39#define MOD_1WIRE_SPEED			0x0002
  40#define MOD_STRONG_PU_DURATION		0x0003
  41#define MOD_PULLDOWN_SLEWRATE		0x0004
  42#define MOD_PROG_PULSE_DURATION		0x0005
  43#define MOD_WRITE1_LOWTIME		0x0006
  44#define MOD_DSOW0_TREC			0x0007
  45
  46/* COMMUNICATION COMMAND CODES */
  47#define COMM_ERROR_ESCAPE		0x0601
  48#define COMM_SET_DURATION		0x0012
  49#define COMM_BIT_IO			0x0020
  50#define COMM_PULSE			0x0030
  51#define COMM_1_WIRE_RESET		0x0042
  52#define COMM_BYTE_IO			0x0052
  53#define COMM_MATCH_ACCESS		0x0064
  54#define COMM_BLOCK_IO			0x0074
  55#define COMM_READ_STRAIGHT		0x0080
  56#define COMM_DO_RELEASE			0x6092
  57#define COMM_SET_PATH			0x00A2
  58#define COMM_WRITE_SRAM_PAGE		0x00B2
  59#define COMM_WRITE_EPROM		0x00C4
  60#define COMM_READ_CRC_PROT_PAGE		0x00D4
  61#define COMM_READ_REDIRECT_PAGE_CRC	0x21E4
  62#define COMM_SEARCH_ACCESS		0x00F4
  63
  64/* Communication command bits */
  65#define COMM_TYPE			0x0008
  66#define COMM_SE				0x0008
  67#define COMM_D				0x0008
  68#define COMM_Z				0x0008
  69#define COMM_CH				0x0008
  70#define COMM_SM				0x0008
  71#define COMM_R				0x0008
  72#define COMM_IM				0x0001
  73
  74#define COMM_PS				0x4000
  75#define COMM_PST			0x4000
  76#define COMM_CIB			0x4000
  77#define COMM_RTS			0x4000
  78#define COMM_DT				0x2000
  79#define COMM_SPU			0x1000
  80#define COMM_F				0x0800
  81#define COMM_NTF			0x0400
  82#define COMM_ICP			0x0200
  83#define COMM_RST			0x0100
  84
  85#define PULSE_PROG			0x01
  86#define PULSE_SPUE			0x02
  87
  88#define BRANCH_MAIN			0xCC
  89#define BRANCH_AUX			0x33
  90
  91/* Status flags */
  92#define ST_SPUA				0x01  /* Strong Pull-up is active */
  93#define ST_PRGA				0x02  /* 12V programming pulse is being generated */
  94#define ST_12VP				0x04  /* external 12V programming voltage is present */
  95#define ST_PMOD				0x08  /* DS2490 powered from USB and external sources */
  96#define ST_HALT				0x10  /* DS2490 is currently halted */
  97#define ST_IDLE				0x20  /* DS2490 is currently idle */
  98#define ST_EPOF				0x80
  99/* Status transfer size, 16 bytes status, 16 byte result flags */
 100#define ST_SIZE				0x20
 101/* 1-wire data i/o fifo size, 128 bytes */
 102#define FIFO_SIZE			0x80
 103
 104/* Result Register flags */
 105#define RR_DETECT			0xA5 /* New device detected */
 106#define RR_NRS				0x01 /* Reset no presence or ... */
 107#define RR_SH				0x02 /* short on reset or set path */
 108#define RR_APP				0x04 /* alarming presence on reset */
 109#define RR_VPP				0x08 /* 12V expected not seen */
 110#define RR_CMP				0x10 /* compare error */
 111#define RR_CRC				0x20 /* CRC error detected */
 112#define RR_RDP				0x40 /* redirected page */
 113#define RR_EOS				0x80 /* end of search error */
 114
 115#define SPEED_NORMAL			0x00
 116#define SPEED_FLEXIBLE			0x01
 117#define SPEED_OVERDRIVE			0x02
 118
 119#define NUM_EP				4
 120#define EP_CONTROL			0
 121#define EP_STATUS			1
 122#define EP_DATA_OUT			2
 123#define EP_DATA_IN			3
 124
 125struct ds_device {
 126	struct list_head	ds_entry;
 127
 128	struct usb_device	*udev;
 129	struct usb_interface	*intf;
 130
 131	int			ep[NUM_EP];
 132
 133	/* Strong PullUp
 134	 * 0: pullup not active, else duration in milliseconds
 135	 */
 136	int			spu_sleep;
 137	/* spu_bit contains COMM_SPU or 0 depending on if the strong pullup
 138	 * should be active or not for writes.
 139	 */
 140	u16			spu_bit;
 141
 142	u8			st_buf[ST_SIZE];
 143	u8			byte_buf;
 144
 145	struct w1_bus_master	master;
 146};
 147
 148struct ds_status {
 149	u8			enable;
 150	u8			speed;
 151	u8			pullup_dur;
 152	u8			ppuls_dur;
 153	u8			pulldown_slew;
 154	u8			write1_time;
 155	u8			write0_time;
 156	u8			reserved0;
 157	u8			status;
 158	u8			command0;
 159	u8			command1;
 160	u8			command_buffer_status;
 161	u8			data_out_buffer_status;
 162	u8			data_in_buffer_status;
 163	u8			reserved1;
 164	u8			reserved2;
 165};
 166
 167static LIST_HEAD(ds_devices);
 168static DEFINE_MUTEX(ds_mutex);
 169
 170static int ds_send_control_cmd(struct ds_device *dev, u16 value, u16 index)
 171{
 172	int err;
 173
 174	err = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, dev->ep[EP_CONTROL]),
 175			CONTROL_CMD, VENDOR, value, index, NULL, 0, 1000);
 176	if (err < 0) {
 177		dev_err(&dev->udev->dev,
 178			"Failed to send command control message %x.%x: err=%d.\n",
 179			value, index, err);
 180		return err;
 181	}
 182
 183	return err;
 184}
 185
 186static int ds_send_control_mode(struct ds_device *dev, u16 value, u16 index)
 187{
 188	int err;
 189
 190	err = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, dev->ep[EP_CONTROL]),
 191			MODE_CMD, VENDOR, value, index, NULL, 0, 1000);
 192	if (err < 0) {
 193		dev_err(&dev->udev->dev,
 194			"Failed to send mode control message %x.%x: err=%d.\n",
 195			value, index, err);
 196		return err;
 197	}
 198
 199	return err;
 200}
 201
 202static int ds_send_control(struct ds_device *dev, u16 value, u16 index)
 203{
 204	int err;
 205
 206	err = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, dev->ep[EP_CONTROL]),
 207			COMM_CMD, VENDOR, value, index, NULL, 0, 1000);
 208	if (err < 0) {
 209		dev_err(&dev->udev->dev,
 210			"Failed to send control message %x.%x: err=%d.\n",
 211			value, index, err);
 212		return err;
 213	}
 214
 215	return err;
 216}
 217
 218static void ds_dump_status(struct ds_device *ds_dev, unsigned char *buf, int count)
 219{
 220	struct device *dev = &ds_dev->udev->dev;
 221	int i;
 222
 223	dev_info(dev, "ep_status=0x%x, count=%d, status=%*phC",
 224		ds_dev->ep[EP_STATUS], count, count, buf);
 225
 226	if (count >= 16) {
 227		dev_dbg(dev, "enable flag: 0x%02x", buf[0]);
 228		dev_dbg(dev, "1-wire speed: 0x%02x", buf[1]);
 229		dev_dbg(dev, "strong pullup duration: 0x%02x", buf[2]);
 230		dev_dbg(dev, "programming pulse duration: 0x%02x", buf[3]);
 231		dev_dbg(dev, "pulldown slew rate control: 0x%02x", buf[4]);
 232		dev_dbg(dev, "write-1 low time: 0x%02x", buf[5]);
 233		dev_dbg(dev, "data sample offset/write-0 recovery time: 0x%02x", buf[6]);
 234		dev_dbg(dev, "reserved (test register): 0x%02x", buf[7]);
 235		dev_dbg(dev, "device status flags: 0x%02x", buf[8]);
 236		dev_dbg(dev, "communication command byte 1: 0x%02x", buf[9]);
 237		dev_dbg(dev, "communication command byte 2: 0x%02x", buf[10]);
 238		dev_dbg(dev, "communication command buffer status: 0x%02x", buf[11]);
 239		dev_dbg(dev, "1-wire data output buffer status: 0x%02x", buf[12]);
 240		dev_dbg(dev, "1-wire data input buffer status: 0x%02x", buf[13]);
 241		dev_dbg(dev, "reserved: 0x%02x", buf[14]);
 242		dev_dbg(dev, "reserved: 0x%02x", buf[15]);
 243	}
 244
 245	for (i = 16; i < count; ++i) {
 246		if (buf[i] == RR_DETECT) {
 247			dev_dbg(dev, "New device detect.\n");
 248			continue;
 249		}
 250		dev_dbg(dev, "Result Register Value: 0x%02x", buf[i]);
 251		if (buf[i] & RR_NRS)
 252			dev_dbg(dev, "NRS: Reset no presence or ...\n");
 253		if (buf[i] & RR_SH)
 254			dev_dbg(dev, "SH: short on reset or set path\n");
 255		if (buf[i] & RR_APP)
 256			dev_dbg(dev, "APP: alarming presence on reset\n");
 257		if (buf[i] & RR_VPP)
 258			dev_dbg(dev, "VPP: 12V expected not seen\n");
 259		if (buf[i] & RR_CMP)
 260			dev_dbg(dev, "CMP: compare error\n");
 261		if (buf[i] & RR_CRC)
 262			dev_dbg(dev, "CRC: CRC error detected\n");
 263		if (buf[i] & RR_RDP)
 264			dev_dbg(dev, "RDP: redirected page\n");
 265		if (buf[i] & RR_EOS)
 266			dev_dbg(dev, "EOS: end of search error\n");
 267	}
 268}
 269
 270static int ds_recv_status(struct ds_device *dev, struct ds_status *st)
 271{
 272	int count, err;
 273
 274	if (st)
 275		memset(st, 0, sizeof(*st));
 276
 277	count = 0;
 278	err = usb_interrupt_msg(dev->udev,
 279				usb_rcvintpipe(dev->udev,
 280					       dev->ep[EP_STATUS]),
 281				dev->st_buf, sizeof(dev->st_buf),
 282				&count, 1000);
 283	if (err < 0) {
 284		dev_err(&dev->udev->dev,
 285			"Failed to read 1-wire data from 0x%x: err=%d.\n",
 286			dev->ep[EP_STATUS], err);
 287		return err;
 288	}
 289
 290	if (st && count >= sizeof(*st))
 291		memcpy(st, dev->st_buf, sizeof(*st));
 292
 293	return count;
 294}
 295
 296static void ds_reset_device(struct ds_device *dev)
 297{
 298	ds_send_control_cmd(dev, CTL_RESET_DEVICE, 0);
 299	/* Always allow strong pullup which allow individual writes to use
 300	 * the strong pullup.
 301	 */
 302	if (ds_send_control_mode(dev, MOD_PULSE_EN, PULSE_SPUE))
 303		dev_err(&dev->udev->dev,
 304			"%s: Error allowing strong pullup\n", __func__);
 305	/* Chip strong pullup time was cleared. */
 306	if (dev->spu_sleep) {
 307		/* lower 4 bits are 0, see ds_set_pullup */
 308		u8 del = dev->spu_sleep>>4;
 309
 310		if (ds_send_control(dev, COMM_SET_DURATION | COMM_IM, del))
 311			dev_err(&dev->udev->dev,
 312				"%s: Error setting duration\n", __func__);
 313	}
 314}
 315
 316static int ds_recv_data(struct ds_device *dev, unsigned char *buf, int size)
 317{
 318	int count, err;
 319
 320	/* Careful on size.  If size is less than what is available in
 321	 * the input buffer, the device fails the bulk transfer and
 322	 * clears the input buffer.  It could read the maximum size of
 323	 * the data buffer, but then do you return the first, last, or
 324	 * some set of the middle size bytes?  As long as the rest of
 325	 * the code is correct there will be size bytes waiting.  A
 326	 * call to ds_wait_status will wait until the device is idle
 327	 * and any data to be received would have been available.
 328	 */
 329	count = 0;
 330	err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN]),
 331				buf, size, &count, 1000);
 332	if (err < 0) {
 333		int recv_len;
 334
 335		dev_info(&dev->udev->dev, "Clearing ep0x%x.\n", dev->ep[EP_DATA_IN]);
 336		usb_clear_halt(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN]));
 337
 338		/* status might tell us why endpoint is stuck? */
 339		recv_len = ds_recv_status(dev, NULL);
 340		if (recv_len >= 0)
 341			ds_dump_status(dev, dev->st_buf, recv_len);
 342
 343		return err;
 344	}
 345
 346#if 0
 347	{
 348		int i;
 349
 350		printk("%s: count=%d: ", __func__, count);
 351		for (i = 0; i < count; ++i)
 352			printk("%02x ", buf[i]);
 353		printk("\n");
 354	}
 355#endif
 356	return count;
 357}
 358
 359static int ds_send_data(struct ds_device *dev, unsigned char *buf, int len)
 360{
 361	int count, err;
 362
 363	count = 0;
 364	err = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, dev->ep[EP_DATA_OUT]), buf, len, &count, 1000);
 365	if (err < 0) {
 366		dev_err(&dev->udev->dev, "Failed to write 1-wire data to ep0x%x: "
 367			"err=%d.\n", dev->ep[EP_DATA_OUT], err);
 368		return err;
 369	}
 370
 371	return err;
 372}
 373
 374#if 0
 375
 376int ds_stop_pulse(struct ds_device *dev, int limit)
 377{
 378	struct ds_status st;
 379	int count = 0, err = 0;
 380
 381	do {
 382		err = ds_send_control(dev, CTL_HALT_EXE_IDLE, 0);
 383		if (err)
 384			break;
 385		err = ds_send_control(dev, CTL_RESUME_EXE, 0);
 386		if (err)
 387			break;
 388		err = ds_recv_status(dev, &st);
 389		if (err)
 390			break;
 391
 392		if ((st.status & ST_SPUA) == 0) {
 393			err = ds_send_control_mode(dev, MOD_PULSE_EN, 0);
 394			if (err)
 395				break;
 396		}
 397	} while (++count < limit);
 398
 399	return err;
 400}
 401
 402int ds_detect(struct ds_device *dev, struct ds_status *st)
 403{
 404	int err;
 405
 406	err = ds_send_control_cmd(dev, CTL_RESET_DEVICE, 0);
 407	if (err)
 408		return err;
 409
 410	err = ds_send_control(dev, COMM_SET_DURATION | COMM_IM, 0);
 411	if (err)
 412		return err;
 413
 414	err = ds_send_control(dev, COMM_SET_DURATION | COMM_IM | COMM_TYPE, 0x40);
 415	if (err)
 416		return err;
 417
 418	err = ds_send_control_mode(dev, MOD_PULSE_EN, PULSE_PROG);
 419	if (err)
 420		return err;
 421
 422	err = ds_dump_status(dev, st);
 423
 424	return err;
 425}
 426
 427#endif  /*  0  */
 428
 429static int ds_wait_status(struct ds_device *dev, struct ds_status *st)
 430{
 431	int err, count = 0;
 432
 433	do {
 434		st->status = 0;
 435		err = ds_recv_status(dev, st);
 436#if 0
 437		if (err >= 0) {
 438			int i;
 439			printk("0x%x: count=%d, status: ", dev->ep[EP_STATUS], err);
 440			for (i = 0; i < err; ++i)
 441				printk("%02x ", dev->st_buf[i]);
 442			printk("\n");
 443		}
 444#endif
 445	} while (!(st->status & ST_IDLE) && !(err < 0) && ++count < 100);
 446
 447	if (err >= 16 && st->status & ST_EPOF) {
 448		dev_info(&dev->udev->dev, "Resetting device after ST_EPOF.\n");
 449		ds_reset_device(dev);
 450		/* Always dump the device status. */
 451		count = 101;
 452	}
 453
 454	/* Dump the status for errors or if there is extended return data.
 455	 * The extended status includes new device detection (maybe someone
 456	 * can do something with it).
 457	 */
 458	if (err > 16 || count >= 100 || err < 0)
 459		ds_dump_status(dev, dev->st_buf, err);
 460
 461	/* Extended data isn't an error.  Well, a short is, but the dump
 462	 * would have already told the user that and we can't do anything
 463	 * about it in software anyway.
 464	 */
 465	if (count >= 100 || err < 0)
 466		return -1;
 467	else
 468		return 0;
 469}
 470
 471static int ds_reset(struct ds_device *dev)
 472{
 473	int err;
 474
 475	/* Other potentionally interesting flags for reset.
 476	 *
 477	 * COMM_NTF: Return result register feedback.  This could be used to
 478	 * detect some conditions such as short, alarming presence, or
 479	 * detect if a new device was detected.
 480	 *
 481	 * COMM_SE which allows SPEED_NORMAL, SPEED_FLEXIBLE, SPEED_OVERDRIVE:
 482	 * Select the data transfer rate.
 483	 */
 484	err = ds_send_control(dev, COMM_1_WIRE_RESET | COMM_IM, SPEED_NORMAL);
 485	if (err)
 486		return err;
 487
 488	return 0;
 489}
 490
 491#if 0
 492static int ds_set_speed(struct ds_device *dev, int speed)
 493{
 494	int err;
 495
 496	if (speed != SPEED_NORMAL && speed != SPEED_FLEXIBLE && speed != SPEED_OVERDRIVE)
 497		return -EINVAL;
 498
 499	if (speed != SPEED_OVERDRIVE)
 500		speed = SPEED_FLEXIBLE;
 501
 502	speed &= 0xff;
 503
 504	err = ds_send_control_mode(dev, MOD_1WIRE_SPEED, speed);
 505	if (err)
 506		return err;
 507
 508	return err;
 509}
 510#endif  /*  0  */
 511
 512static int ds_set_pullup(struct ds_device *dev, int delay)
 513{
 514	int err = 0;
 515	u8 del = 1 + (u8)(delay >> 4);
 516	/* Just storing delay would not get the trunication and roundup. */
 517	int ms = del<<4;
 518
 519	/* Enable spu_bit if a delay is set. */
 520	dev->spu_bit = delay ? COMM_SPU : 0;
 521	/* If delay is zero, it has already been disabled, if the time is
 522	 * the same as the hardware was last programmed to, there is also
 523	 * nothing more to do.  Compare with the recalculated value ms
 524	 * rather than del or delay which can have a different value.
 525	 */
 526	if (delay == 0 || ms == dev->spu_sleep)
 527		return err;
 528
 529	err = ds_send_control(dev, COMM_SET_DURATION | COMM_IM, del);
 530	if (err)
 531		return err;
 532
 533	dev->spu_sleep = ms;
 534
 535	return err;
 536}
 537
 538static int ds_touch_bit(struct ds_device *dev, u8 bit, u8 *tbit)
 539{
 540	int err;
 541	struct ds_status st;
 542
 543	err = ds_send_control(dev, COMM_BIT_IO | COMM_IM | (bit ? COMM_D : 0),
 544		0);
 545	if (err)
 546		return err;
 547
 548	ds_wait_status(dev, &st);
 549
 550	err = ds_recv_data(dev, tbit, sizeof(*tbit));
 551	if (err < 0)
 552		return err;
 553
 554	return 0;
 555}
 556
 557#if 0
 558static int ds_write_bit(struct ds_device *dev, u8 bit)
 559{
 560	int err;
 561	struct ds_status st;
 562
 563	/* Set COMM_ICP to write without a readback.  Note, this will
 564	 * produce one time slot, a down followed by an up with COMM_D
 565	 * only determing the timing.
 566	 */
 567	err = ds_send_control(dev, COMM_BIT_IO | COMM_IM | COMM_ICP |
 568		(bit ? COMM_D : 0), 0);
 569	if (err)
 570		return err;
 571
 572	ds_wait_status(dev, &st);
 573
 574	return 0;
 575}
 576#endif
 577
 578static int ds_write_byte(struct ds_device *dev, u8 byte)
 579{
 580	int err;
 581	struct ds_status st;
 582
 583	err = ds_send_control(dev, COMM_BYTE_IO | COMM_IM | dev->spu_bit, byte);
 584	if (err)
 585		return err;
 586
 587	if (dev->spu_bit)
 588		msleep(dev->spu_sleep);
 589
 590	err = ds_wait_status(dev, &st);
 591	if (err)
 592		return err;
 593
 594	err = ds_recv_data(dev, &dev->byte_buf, 1);
 595	if (err < 0)
 596		return err;
 597
 598	return !(byte == dev->byte_buf);
 599}
 600
 601static int ds_read_byte(struct ds_device *dev, u8 *byte)
 602{
 603	int err;
 604	struct ds_status st;
 605
 606	err = ds_send_control(dev, COMM_BYTE_IO | COMM_IM, 0xff);
 607	if (err)
 608		return err;
 609
 610	ds_wait_status(dev, &st);
 611
 612	err = ds_recv_data(dev, byte, sizeof(*byte));
 613	if (err < 0)
 614		return err;
 615
 616	return 0;
 617}
 618
 619static int read_block_chunk(struct ds_device *dev, u8 *buf, int len)
 620{
 621	struct ds_status st;
 622	int err;
 623
 624	memset(buf, 0xFF, len);
 625
 626	err = ds_send_data(dev, buf, len);
 627	if (err < 0)
 628		return err;
 629
 630	err = ds_send_control(dev, COMM_BLOCK_IO | COMM_IM, len);
 631	if (err)
 632		return err;
 633
 634	ds_wait_status(dev, &st);
 635
 636	memset(buf, 0x00, len);
 637	err = ds_recv_data(dev, buf, len);
 638
 639	return err;
 640}
 641
 642static int ds_read_block(struct ds_device *dev, u8 *buf, int len)
 643{
 644	int err, to_read, rem = len;
 645
 646	if (len > 64 * 1024)
 647		return -E2BIG;
 648
 649	do {
 650		to_read = rem <= FIFO_SIZE ? rem : FIFO_SIZE;
 651		err = read_block_chunk(dev, &buf[len - rem], to_read);
 652		if (err < 0)
 653			return err;
 654		rem -= to_read;
 655	} while (rem);
 656
 657	return err;
 658}
 659
 660static int ds_write_block(struct ds_device *dev, u8 *buf, int len)
 661{
 662	int err;
 663	struct ds_status st;
 664
 665	err = ds_send_data(dev, buf, len);
 666	if (err < 0)
 667		return err;
 668
 669	err = ds_send_control(dev, COMM_BLOCK_IO | COMM_IM | dev->spu_bit, len);
 670	if (err)
 671		return err;
 672
 673	if (dev->spu_bit)
 674		msleep(dev->spu_sleep);
 675
 676	ds_wait_status(dev, &st);
 677
 678	err = ds_recv_data(dev, buf, len);
 679	if (err < 0)
 680		return err;
 681
 682	return !(err == len);
 683}
 684
 685static void ds9490r_search(void *data, struct w1_master *master,
 686	u8 search_type, w1_slave_found_callback callback)
 687{
 688	/* When starting with an existing id, the first id returned will
 689	 * be that device (if it is still on the bus most likely).
 690	 *
 691	 * If the number of devices found is less than or equal to the
 692	 * search_limit, that number of IDs will be returned.  If there are
 693	 * more, search_limit IDs will be returned followed by a non-zero
 694	 * discrepency value.
 695	 */
 696	struct ds_device *dev = data;
 697	int err;
 698	u16 value, index;
 699	struct ds_status st;
 700	int search_limit;
 701	int found = 0;
 702	int i;
 703
 704	/* DS18b20 spec, 13.16 ms per device, 75 per second, sleep for
 705	 * discovering 8 devices (1 bulk transfer and 1/2 FIFO size) at a time.
 706	 */
 707	const unsigned long jtime = msecs_to_jiffies(1000*8/75);
 708	/* FIFO 128 bytes, bulk packet size 64, read a multiple of the
 709	 * packet size.
 710	 */
 711	const size_t bufsize = 2 * 64;
 712	u64 *buf, *found_ids;
 713
 714	buf = kmalloc(bufsize, GFP_KERNEL);
 715	if (!buf)
 716		return;
 717
 718	/*
 719	 * We are holding the bus mutex during the scan, but adding devices via the
 720	 * callback needs the bus to be unlocked. So we queue up found ids here.
 721	 */
 722	found_ids = kmalloc_array(master->max_slave_count, sizeof(u64), GFP_KERNEL);
 723	if (!found_ids) {
 724		kfree(buf);
 725		return;
 726	}
 727
 728	mutex_lock(&master->bus_mutex);
 729
 730	/* address to start searching at */
 731	if (ds_send_data(dev, (u8 *)&master->search_id, 8) < 0)
 732		goto search_out;
 733	master->search_id = 0;
 734
 735	value = COMM_SEARCH_ACCESS | COMM_IM | COMM_RST | COMM_SM | COMM_F |
 736		COMM_RTS;
 737	search_limit = master->max_slave_count;
 738	if (search_limit > 255)
 739		search_limit = 0;
 740	index = search_type | (search_limit << 8);
 741	if (ds_send_control(dev, value, index) < 0)
 742		goto search_out;
 743
 744	do {
 745		schedule_timeout(jtime);
 746
 747		err = ds_recv_status(dev, &st);
 748		if (err < 0 || err < sizeof(st))
 749			break;
 750
 751		if (st.data_in_buffer_status) {
 752			/*
 753			 * Bulk in can receive partial ids, but when it does
 754			 * they fail crc and will be discarded anyway.
 755			 * That has only been seen when status in buffer
 756			 * is 0 and bulk is read anyway, so don't read
 757			 * bulk without first checking if status says there
 758			 * is data to read.
 759			 */
 760			err = ds_recv_data(dev, (u8 *)buf, bufsize);
 761			if (err < 0)
 762				break;
 763			for (i = 0; i < err/8; ++i) {
 764				found_ids[found++] = buf[i];
 765				/*
 766				 * can't know if there will be a discrepancy
 767				 * value after until the next id
 768				 */
 769				if (found == search_limit) {
 770					master->search_id = buf[i];
 771					break;
 772				}
 773			}
 774		}
 775
 776		if (test_bit(W1_ABORT_SEARCH, &master->flags))
 777			break;
 778	} while (!(st.status & (ST_IDLE | ST_HALT)));
 779
 780	/* only continue the search if some weren't found */
 781	if (found <= search_limit) {
 782		master->search_id = 0;
 783	} else if (!test_bit(W1_WARN_MAX_COUNT, &master->flags)) {
 784		/*
 785		 * Only max_slave_count will be scanned in a search,
 786		 * but it will start where it left off next search
 787		 * until all ids are identified and then it will start
 788		 * over.  A continued search will report the previous
 789		 * last id as the first id (provided it is still on the
 790		 * bus).
 791		 */
 792		dev_info(&dev->udev->dev, "%s: max_slave_count %d reached, "
 793			"will continue next search.\n", __func__,
 794			master->max_slave_count);
 795		set_bit(W1_WARN_MAX_COUNT, &master->flags);
 796	}
 797
 798search_out:
 799	mutex_unlock(&master->bus_mutex);
 800	kfree(buf);
 801
 802	for (i = 0; i < found; i++) /* run callback for all queued up IDs */
 803		callback(master, found_ids[i]);
 804	kfree(found_ids);
 805}
 806
 807#if 0
 808/*
 809 * FIXME: if this disabled code is ever used in the future all ds_send_data()
 810 * calls must be changed to use a DMAable buffer.
 811 */
 812static int ds_match_access(struct ds_device *dev, u64 init)
 813{
 814	int err;
 815	struct ds_status st;
 816
 817	err = ds_send_data(dev, (unsigned char *)&init, sizeof(init));
 818	if (err)
 819		return err;
 820
 821	ds_wait_status(dev, &st);
 822
 823	err = ds_send_control(dev, COMM_MATCH_ACCESS | COMM_IM | COMM_RST, 0x0055);
 824	if (err)
 825		return err;
 826
 827	ds_wait_status(dev, &st);
 828
 829	return 0;
 830}
 831
 832static int ds_set_path(struct ds_device *dev, u64 init)
 833{
 834	int err;
 835	struct ds_status st;
 836	u8 buf[9];
 837
 838	memcpy(buf, &init, 8);
 839	buf[8] = BRANCH_MAIN;
 840
 841	err = ds_send_data(dev, buf, sizeof(buf));
 842	if (err)
 843		return err;
 844
 845	ds_wait_status(dev, &st);
 846
 847	err = ds_send_control(dev, COMM_SET_PATH | COMM_IM | COMM_RST, 0);
 848	if (err)
 849		return err;
 850
 851	ds_wait_status(dev, &st);
 852
 853	return 0;
 854}
 855
 856#endif  /*  0  */
 857
 858static u8 ds9490r_touch_bit(void *data, u8 bit)
 859{
 860	struct ds_device *dev = data;
 861
 862	if (ds_touch_bit(dev, bit, &dev->byte_buf))
 863		return 0;
 864
 865	return dev->byte_buf;
 866}
 867
 868#if 0
 869static void ds9490r_write_bit(void *data, u8 bit)
 870{
 871	struct ds_device *dev = data;
 872
 873	ds_write_bit(dev, bit);
 874}
 875
 876static u8 ds9490r_read_bit(void *data)
 877{
 878	struct ds_device *dev = data;
 879	int err;
 880
 881	err = ds_touch_bit(dev, 1, &dev->byte_buf);
 882	if (err)
 883		return 0;
 884
 885	return dev->byte_buf & 1;
 886}
 887#endif
 888
 889static void ds9490r_write_byte(void *data, u8 byte)
 890{
 891	struct ds_device *dev = data;
 892
 893	ds_write_byte(dev, byte);
 894}
 895
 896static u8 ds9490r_read_byte(void *data)
 897{
 898	struct ds_device *dev = data;
 899	int err;
 900
 901	err = ds_read_byte(dev, &dev->byte_buf);
 902	if (err)
 903		return 0;
 904
 905	return dev->byte_buf;
 906}
 907
 908static void ds9490r_write_block(void *data, const u8 *buf, int len)
 909{
 910	struct ds_device *dev = data;
 911	u8 *tbuf;
 912
 913	if (len <= 0)
 914		return;
 915
 916	tbuf = kmemdup(buf, len, GFP_KERNEL);
 917	if (!tbuf)
 918		return;
 919
 920	ds_write_block(dev, tbuf, len);
 921
 922	kfree(tbuf);
 923}
 924
 925static u8 ds9490r_read_block(void *data, u8 *buf, int len)
 926{
 927	struct ds_device *dev = data;
 928	int err;
 929	u8 *tbuf;
 930
 931	if (len <= 0)
 932		return 0;
 933
 934	tbuf = kmalloc(len, GFP_KERNEL);
 935	if (!tbuf)
 936		return 0;
 937
 938	err = ds_read_block(dev, tbuf, len);
 939	if (err >= 0)
 940		memcpy(buf, tbuf, len);
 941
 942	kfree(tbuf);
 943
 944	return err >= 0 ? len : 0;
 945}
 946
 947static u8 ds9490r_reset(void *data)
 948{
 949	struct ds_device *dev = data;
 950	int err;
 951
 952	err = ds_reset(dev);
 953	if (err)
 954		return 1;
 955
 956	return 0;
 957}
 958
 959static u8 ds9490r_set_pullup(void *data, int delay)
 960{
 961	struct ds_device *dev = data;
 962
 963	if (ds_set_pullup(dev, delay))
 964		return 1;
 965
 966	return 0;
 967}
 968
 969static int ds_w1_init(struct ds_device *dev)
 970{
 971	memset(&dev->master, 0, sizeof(struct w1_bus_master));
 972
 973	/* Reset the device as it can be in a bad state.
 974	 * This is necessary because a block write will wait for data
 975	 * to be placed in the output buffer and block any later
 976	 * commands which will keep accumulating and the device will
 977	 * not be idle.  Another case is removing the ds2490 module
 978	 * while a bus search is in progress, somehow a few commands
 979	 * get through, but the input transfers fail leaving data in
 980	 * the input buffer.  This will cause the next read to fail
 981	 * see the note in ds_recv_data.
 982	 */
 983	ds_reset_device(dev);
 984
 985	dev->master.data	= dev;
 986	dev->master.touch_bit	= &ds9490r_touch_bit;
 987	/* read_bit and write_bit in w1_bus_master are expected to set and
 988	 * sample the line level.  For write_bit that means it is expected to
 989	 * set it to that value and leave it there.  ds2490 only supports an
 990	 * individual time slot at the lowest level.  The requirement from
 991	 * pulling the bus state down to reading the state is 15us, something
 992	 * that isn't realistic on the USB bus anyway.
 993	dev->master.read_bit	= &ds9490r_read_bit;
 994	dev->master.write_bit	= &ds9490r_write_bit;
 995	*/
 996	dev->master.read_byte	= &ds9490r_read_byte;
 997	dev->master.write_byte	= &ds9490r_write_byte;
 998	dev->master.read_block	= &ds9490r_read_block;
 999	dev->master.write_block	= &ds9490r_write_block;
1000	dev->master.reset_bus	= &ds9490r_reset;
1001	dev->master.set_pullup	= &ds9490r_set_pullup;
1002	dev->master.search	= &ds9490r_search;
1003
1004	return w1_add_master_device(&dev->master);
1005}
1006
1007static void ds_w1_fini(struct ds_device *dev)
1008{
1009	w1_remove_master_device(&dev->master);
1010}
1011
1012static int ds_probe(struct usb_interface *intf,
1013		    const struct usb_device_id *udev_id)
1014{
1015	struct usb_device *udev = interface_to_usbdev(intf);
1016	struct usb_endpoint_descriptor *endpoint;
1017	struct usb_host_interface *iface_desc;
1018	struct ds_device *dev;
1019	int i, err, alt;
1020
1021	dev = kzalloc(sizeof(struct ds_device), GFP_KERNEL);
1022	if (!dev)
1023		return -ENOMEM;
1024
1025	dev->udev = usb_get_dev(udev);
1026	if (!dev->udev) {
1027		err = -ENOMEM;
1028		goto err_out_free;
1029	}
1030	memset(dev->ep, 0, sizeof(dev->ep));
1031
1032	usb_set_intfdata(intf, dev);
1033
1034	err = usb_reset_configuration(dev->udev);
1035	if (err) {
1036		dev_err(&dev->udev->dev,
1037			"Failed to reset configuration: err=%d.\n", err);
1038		goto err_out_clear;
1039	}
1040
1041	/* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */
1042	alt = 3;
1043	err = usb_set_interface(dev->udev,
1044		intf->cur_altsetting->desc.bInterfaceNumber, alt);
1045	if (err) {
1046		dev_err(&dev->udev->dev, "Failed to set alternative setting %d "
1047			"for %d interface: err=%d.\n", alt,
1048			intf->cur_altsetting->desc.bInterfaceNumber, err);
1049		goto err_out_clear;
1050	}
1051
1052	iface_desc = intf->cur_altsetting;
1053	if (iface_desc->desc.bNumEndpoints != NUM_EP-1) {
1054		dev_err(&dev->udev->dev, "Num endpoints=%d. It is not DS9490R.\n",
1055			iface_desc->desc.bNumEndpoints);
1056		err = -EINVAL;
1057		goto err_out_clear;
1058	}
1059
1060	/*
1061	 * This loop doesn'd show control 0 endpoint,
1062	 * so we will fill only 1-3 endpoints entry.
1063	 */
1064	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
1065		endpoint = &iface_desc->endpoint[i].desc;
1066
1067		dev->ep[i+1] = endpoint->bEndpointAddress;
1068#if 0
1069		printk("%d: addr=%x, size=%d, dir=%s, type=%x\n",
1070			i, endpoint->bEndpointAddress, le16_to_cpu(endpoint->wMaxPacketSize),
1071			(endpoint->bEndpointAddress & USB_DIR_IN)?"IN":"OUT",
1072			endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1073#endif
1074	}
1075
1076	err = ds_w1_init(dev);
1077	if (err)
1078		goto err_out_clear;
1079
1080	mutex_lock(&ds_mutex);
1081	list_add_tail(&dev->ds_entry, &ds_devices);
1082	mutex_unlock(&ds_mutex);
1083
1084	return 0;
1085
1086err_out_clear:
1087	usb_set_intfdata(intf, NULL);
1088	usb_put_dev(dev->udev);
1089err_out_free:
1090	kfree(dev);
1091	return err;
1092}
1093
1094static void ds_disconnect(struct usb_interface *intf)
1095{
1096	struct ds_device *dev;
1097
1098	dev = usb_get_intfdata(intf);
1099	if (!dev)
1100		return;
1101
1102	mutex_lock(&ds_mutex);
1103	list_del(&dev->ds_entry);
1104	mutex_unlock(&ds_mutex);
1105
1106	ds_w1_fini(dev);
1107
1108	usb_set_intfdata(intf, NULL);
1109
1110	usb_put_dev(dev->udev);
1111	kfree(dev);
1112}
1113
1114static const struct usb_device_id ds_id_table[] = {
1115	{ USB_DEVICE(0x04fa, 0x2490) },
1116	{ },
1117};
1118MODULE_DEVICE_TABLE(usb, ds_id_table);
1119
1120static struct usb_driver ds_driver = {
1121	.name =		"DS9490R",
1122	.probe =	ds_probe,
1123	.disconnect =	ds_disconnect,
1124	.id_table =	ds_id_table,
1125};
1126module_usb_driver(ds_driver);
1127
1128MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
1129MODULE_DESCRIPTION("DS2490 USB <-> W1 bus master driver (DS9490*)");
1130MODULE_LICENSE("GPL");