drivers/usb/gadget/net2280.c

   1 /*
   2  * Driver for the PLX NET2280 USB device controller.
   3  * Specs and errata are available from <http://www.plxtech.com>.
   4  *
   5  * PLX Technology Inc. (formerly NetChip Technology) supported the
   6  * development of this driver.
   7  *
   8  *
   9  * CODE STATUS HIGHLIGHTS
  10  *
  11  * This driver should work well with most "gadget" drivers, including
  12  * the Mass Storage, Serial, and Ethernet/RNDIS gadget drivers
  13  * as well as Gadget Zero and Gadgetfs.
  14  *
  15  * DMA is enabled by default.  Drivers using transfer queues might use
  16  * DMA chaining to remove IRQ latencies between transfers.  (Except when
  17  * short OUT transfers happen.)  Drivers can use the req->no_interrupt
  18  * hint to completely eliminate some IRQs, if a later IRQ is guaranteed
  19  * and DMA chaining is enabled.
  20  *
  21  * Note that almost all the errata workarounds here are only needed for
  22  * rev1 chips.  Rev1a silicon (0110) fixes almost all of them.
  23  */
  24
  25 /*
  26  * Copyright (C) 2003 David Brownell
  27  * Copyright (C) 2003-2005 PLX Technology, Inc.
  28  *
  29  * Modified Seth Levy 2005 PLX Technology, Inc. to provide compatibility
  30  *      with 2282 chip
  31  *
  32  * This program is free software; you can redistribute it and/or modify
  33  * it under the terms of the GNU General Public License as published by
  34  * the Free Software Foundation; either version 2 of the License, or
  35  * (at your option) any later version.
  36  */
  37
  38 #undef  DEBUG           /* messages on error and most fault paths */
  39 #undef  VERBOSE         /* extra debug messages (success too) */
  40
  41 #include <linux/module.h>
  42 #include <linux/pci.h>
  43 #include <linux/dma-mapping.h>
  44 #include <linux/kernel.h>
  45 #include <linux/delay.h>
  46 #include <linux/ioport.h>
  47 #include <linux/slab.h>
  48 #include <linux/errno.h>
  49 #include <linux/init.h>
  50 #include <linux/timer.h>
  51 #include <linux/list.h>
  52 #include <linux/interrupt.h>
  53 #include <linux/moduleparam.h>
  54 #include <linux/device.h>
  55 #include <linux/usb/ch9.h>
  56 #include <linux/usb/gadget.h>
  57 #include <linux/prefetch.h>
  58
  59 #include <asm/byteorder.h>
  60 #include <asm/io.h>
  61 #include <asm/irq.h>
  62 #include <asm/unaligned.h>
  63
  64
  65 #define DRIVER_DESC             "PLX NET228x USB Peripheral Controller"
  66 #define DRIVER_VERSION          "2005 Sept 27"
  67
  68 #define DMA_ADDR_INVALID        (~(dma_addr_t)0)
  69 #define EP_DONTUSE              13      /* nonzero */
  70
  71 #define USE_RDK_LEDS            /* GPIO pins control three LEDs */
  72
  73
  74 static const char driver_name [] = "net2280";
  75 static const char driver_desc [] = DRIVER_DESC;
  76
  77 static const char ep0name [] = "ep0";
  78 static const char *const ep_name [] = {
  79         ep0name,
  80         "ep-a", "ep-b", "ep-c", "ep-d",
  81         "ep-e", "ep-f",
  82 };
  83
  84 /* use_dma -- general goodness, fewer interrupts, less cpu load (vs PIO)
  85  * use_dma_chaining -- dma descriptor queueing gives even more irq reduction
  86  *
  87  * The net2280 DMA engines are not tightly integrated with their FIFOs;
  88  * not all cases are (yet) handled well in this driver or the silicon.
  89  * Some gadget drivers work better with the dma support here than others.
  90  * These two parameters let you use PIO or more aggressive DMA.
  91  */
  92 static bool use_dma = 1;
  93 static bool use_dma_chaining = 0;
  94
  95 /* "modprobe net2280 use_dma=n" etc */
  96 module_param (use_dma, bool, S_IRUGO);
  97 module_param (use_dma_chaining, bool, S_IRUGO);
  98
  99
 100 /* mode 0 == ep-{a,b,c,d} 1K fifo each
 101  * mode 1 == ep-{a,b} 2K fifo each, ep-{c,d} unavailable
 102  * mode 2 == ep-a 2K fifo, ep-{b,c} 1K each, ep-d unavailable
 103  */
 104 static ushort fifo_mode = 0;
 105
 106 /* "modprobe net2280 fifo_mode=1" etc */
 107 module_param (fifo_mode, ushort, 0644);
 108
 109 /* enable_suspend -- When enabled, the driver will respond to
 110  * USB suspend requests by powering down the NET2280.  Otherwise,
 111  * USB suspend requests will be ignored.  This is acceptable for
 112  * self-powered devices
 113  */
 114 static bool enable_suspend = 0;
 115
 116 /* "modprobe net2280 enable_suspend=1" etc */
 117 module_param (enable_suspend, bool, S_IRUGO);
 118
 119 /* force full-speed operation */
 120 static bool full_speed;
 121 module_param(full_speed, bool, 0444);
 122 MODULE_PARM_DESC(full_speed, "force full-speed mode -- for testing only!");
 123
 124 #define DIR_STRING(bAddress) (((bAddress) & USB_DIR_IN) ? "in" : "out")
 125
 126 #if defined(CONFIG_USB_GADGET_DEBUG_FILES) || defined (DEBUG)
 127 static char *type_string (u8 bmAttributes)
 128 {
 129         switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
 130         case USB_ENDPOINT_XFER_BULK:    return "bulk";
 131         case USB_ENDPOINT_XFER_ISOC:    return "iso";
 132         case USB_ENDPOINT_XFER_INT:     return "intr";
 133         };
 134         return "control";
 135 }
 136 #endif
 137
 138 #include "net2280.h"
 139
 140 #define valid_bit       cpu_to_le32 (1 << VALID_BIT)
 141 #define dma_done_ie     cpu_to_le32 (1 << DMA_DONE_INTERRUPT_ENABLE)
 142
 143 /*-------------------------------------------------------------------------*/
 144
 145 static int
 146 net2280_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 147 {
 148         struct net2280          *dev;
 149         struct net2280_ep       *ep;
 150         u32                     max, tmp;
 151         unsigned long           flags;
 152
 153         ep = container_of (_ep, struct net2280_ep, ep);
 154         if (!_ep || !desc || ep->desc || _ep->name == ep0name
 155                         || desc->bDescriptorType != USB_DT_ENDPOINT)
 156                 return -EINVAL;
 157         dev = ep->dev;
 158         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 159                 return -ESHUTDOWN;
 160
 161         /* erratum 0119 workaround ties up an endpoint number */
 162         if ((desc->bEndpointAddress & 0x0f) == EP_DONTUSE)
 163                 return -EDOM;
 164
 165         /* sanity check ep-e/ep-f since their fifos are small */
 166         max = usb_endpoint_maxp (desc) & 0x1fff;
 167         if (ep->num > 4 && max > 64)
 168                 return -ERANGE;
 169
 170         spin_lock_irqsave (&dev->lock, flags);
 171         _ep->maxpacket = max & 0x7ff;
 172         ep->desc = desc;
 173
 174         /* ep_reset() has already been called */
 175         ep->stopped = 0;
 176         ep->wedged = 0;
 177         ep->out_overflow = 0;
 178
 179         /* set speed-dependent max packet; may kick in high bandwidth */
 180         set_idx_reg (dev->regs, REG_EP_MAXPKT (dev, ep->num), max);
 181
 182         /* FIFO lines can't go to different packets.  PIO is ok, so
 183          * use it instead of troublesome (non-bulk) multi-packet DMA.
 184          */
 185         if (ep->dma && (max % 4) != 0 && use_dma_chaining) {
 186                 DEBUG (ep->dev, "%s, no dma for maxpacket %d\n",
 187                         ep->ep.name, ep->ep.maxpacket);
 188                 ep->dma = NULL;
 189         }
 190
 191         /* set type, direction, address; reset fifo counters */
 192         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
 193         tmp = (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
 194         if (tmp == USB_ENDPOINT_XFER_INT) {
 195                 /* erratum 0105 workaround prevents hs NYET */
 196                 if (dev->chiprev == 0100
 197                                 && dev->gadget.speed == USB_SPEED_HIGH
 198                                 && !(desc->bEndpointAddress & USB_DIR_IN))
 199                         writel ((1 << CLEAR_NAK_OUT_PACKETS_MODE),
 200                                 &ep->regs->ep_rsp);
 201         } else if (tmp == USB_ENDPOINT_XFER_BULK) {
 202                 /* catch some particularly blatant driver bugs */
 203                 if ((dev->gadget.speed == USB_SPEED_HIGH
 204                                         && max != 512)
 205                                 || (dev->gadget.speed == USB_SPEED_FULL
 206                                         && max > 64)) {
 207                         spin_unlock_irqrestore (&dev->lock, flags);
 208                         return -ERANGE;
 209                 }
 210         }
 211         ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC) ? 1 : 0;
 212         tmp <<= ENDPOINT_TYPE;
 213         tmp |= desc->bEndpointAddress;
 214         tmp |= (4 << ENDPOINT_BYTE_COUNT);      /* default full fifo lines */
 215         tmp |= 1 << ENDPOINT_ENABLE;
 216         wmb ();
 217
 218         /* for OUT transfers, block the rx fifo until a read is posted */
 219         ep->is_in = (tmp & USB_DIR_IN) != 0;
 220         if (!ep->is_in)
 221                 writel ((1 << SET_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 222         else if (dev->pdev->device != 0x2280) {
 223                 /* Added for 2282, Don't use nak packets on an in endpoint,
 224                  * this was ignored on 2280
 225                  */
 226                 writel ((1 << CLEAR_NAK_OUT_PACKETS)
 227                         | (1 << CLEAR_NAK_OUT_PACKETS_MODE), &ep->regs->ep_rsp);
 228         }
 229
 230         writel (tmp, &ep->regs->ep_cfg);
 231
 232         /* enable irqs */
 233         if (!ep->dma) {                         /* pio, per-packet */
 234                 tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 235                 writel (tmp, &dev->regs->pciirqenb0);
 236
 237                 tmp = (1 << DATA_PACKET_RECEIVED_INTERRUPT_ENABLE)
 238                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT_ENABLE);
 239                 if (dev->pdev->device == 0x2280)
 240                         tmp |= readl (&ep->regs->ep_irqenb);
 241                 writel (tmp, &ep->regs->ep_irqenb);
 242         } else {                                /* dma, per-request */
 243                 tmp = (1 << (8 + ep->num));     /* completion */
 244                 tmp |= readl (&dev->regs->pciirqenb1);
 245                 writel (tmp, &dev->regs->pciirqenb1);
 246
 247                 /* for short OUT transfers, dma completions can't
 248                  * advance the queue; do it pio-style, by hand.
 249                  * NOTE erratum 0112 workaround #2
 250                  */
 251                 if ((desc->bEndpointAddress & USB_DIR_IN) == 0) {
 252                         tmp = (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT_ENABLE);
 253                         writel (tmp, &ep->regs->ep_irqenb);
 254
 255                         tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 256                         writel (tmp, &dev->regs->pciirqenb0);
 257                 }
 258         }
 259
 260         tmp = desc->bEndpointAddress;
 261         DEBUG (dev, "enabled %s (ep%d%s-%s) %s max %04x\n",
 262                 _ep->name, tmp & 0x0f, DIR_STRING (tmp),
 263                 type_string (desc->bmAttributes),
 264                 ep->dma ? "dma" : "pio", max);
 265
 266         /* pci writes may still be posted */
 267         spin_unlock_irqrestore (&dev->lock, flags);
 268         return 0;
 269 }
 270
 271 static int handshake (u32 __iomem *ptr, u32 mask, u32 done, int usec)
 272 {
 273         u32     result;
 274
 275         do {
 276                 result = readl (ptr);
 277                 if (result == ~(u32)0)          /* "device unplugged" */
 278                         return -ENODEV;
 279                 result &= mask;
 280                 if (result == done)
 281                         return 0;
 282                 udelay (1);
 283                 usec--;
 284         } while (usec > 0);
 285         return -ETIMEDOUT;
 286 }
 287
 288 static const struct usb_ep_ops net2280_ep_ops;
 289
 290 static void ep_reset (struct net2280_regs __iomem *regs, struct net2280_ep *ep)
 291 {
 292         u32             tmp;
 293
 294         ep->desc = NULL;
 295         INIT_LIST_HEAD (&ep->queue);
 296
 297         ep->ep.maxpacket = ~0;
 298         ep->ep.ops = &net2280_ep_ops;
 299
 300         /* disable the dma, irqs, endpoint... */
 301         if (ep->dma) {
 302                 writel (0, &ep->dma->dmactl);
 303                 writel (  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 304                         | (1 << DMA_TRANSACTION_DONE_INTERRUPT)
 305                         | (1 << DMA_ABORT)
 306                         , &ep->dma->dmastat);
 307
 308                 tmp = readl (&regs->pciirqenb0);
 309                 tmp &= ~(1 << ep->num);
 310                 writel (tmp, &regs->pciirqenb0);
 311         } else {
 312                 tmp = readl (&regs->pciirqenb1);
 313                 tmp &= ~(1 << (8 + ep->num));   /* completion */
 314                 writel (tmp, &regs->pciirqenb1);
 315         }
 316         writel (0, &ep->regs->ep_irqenb);
 317
 318         /* init to our chosen defaults, notably so that we NAK OUT
 319          * packets until the driver queues a read (+note erratum 0112)
 320          */
 321         if (!ep->is_in || ep->dev->pdev->device == 0x2280) {
 322                 tmp = (1 << SET_NAK_OUT_PACKETS_MODE)
 323                 | (1 << SET_NAK_OUT_PACKETS)
 324                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 325                 | (1 << CLEAR_INTERRUPT_MODE);
 326         } else {
 327                 /* added for 2282 */
 328                 tmp = (1 << CLEAR_NAK_OUT_PACKETS_MODE)
 329                 | (1 << CLEAR_NAK_OUT_PACKETS)
 330                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 331                 | (1 << CLEAR_INTERRUPT_MODE);
 332         }
 333
 334         if (ep->num != 0) {
 335                 tmp |= (1 << CLEAR_ENDPOINT_TOGGLE)
 336                         | (1 << CLEAR_ENDPOINT_HALT);
 337         }
 338         writel (tmp, &ep->regs->ep_rsp);
 339
 340         /* scrub most status bits, and flush any fifo state */
 341         if (ep->dev->pdev->device == 0x2280)
 342                 tmp = (1 << FIFO_OVERFLOW)
 343                         | (1 << FIFO_UNDERFLOW);
 344         else
 345                 tmp = 0;
 346
 347         writel (tmp | (1 << TIMEOUT)
 348                 | (1 << USB_STALL_SENT)
 349                 | (1 << USB_IN_NAK_SENT)
 350                 | (1 << USB_IN_ACK_RCVD)
 351                 | (1 << USB_OUT_PING_NAK_SENT)
 352                 | (1 << USB_OUT_ACK_SENT)
 353                 | (1 << FIFO_FLUSH)
 354                 | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
 355                 | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
 356                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 357                 | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
 358                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 359                 | (1 << DATA_IN_TOKEN_INTERRUPT)
 360                 , &ep->regs->ep_stat);
 361
 362         /* fifo size is handled separately */
 363 }
 364
 365 static void nuke (struct net2280_ep *);
 366
 367 static int net2280_disable (struct usb_ep *_ep)
 368 {
 369         struct net2280_ep       *ep;
 370         unsigned long           flags;
 371
 372         ep = container_of (_ep, struct net2280_ep, ep);
 373         if (!_ep || !ep->desc || _ep->name == ep0name)
 374                 return -EINVAL;
 375
 376         spin_lock_irqsave (&ep->dev->lock, flags);
 377         nuke (ep);
 378         ep_reset (ep->dev->regs, ep);
 379
 380         VDEBUG (ep->dev, "disabled %s %s\n",
 381                         ep->dma ? "dma" : "pio", _ep->name);
 382
 383         /* synch memory views with the device */
 384         (void) readl (&ep->regs->ep_cfg);
 385
 386         if (use_dma && !ep->dma && ep->num >= 1 && ep->num <= 4)
 387                 ep->dma = &ep->dev->dma [ep->num - 1];
 388
 389         spin_unlock_irqrestore (&ep->dev->lock, flags);
 390         return 0;
 391 }
 392
 393 /*-------------------------------------------------------------------------*/
 394
 395 static struct usb_request *
 396 net2280_alloc_request (struct usb_ep *_ep, gfp_t gfp_flags)
 397 {
 398         struct net2280_ep       *ep;
 399         struct net2280_request  *req;
 400
 401         if (!_ep)
 402                 return NULL;
 403         ep = container_of (_ep, struct net2280_ep, ep);
 404
 405         req = kzalloc(sizeof(*req), gfp_flags);
 406         if (!req)
 407                 return NULL;
 408
 409         req->req.dma = DMA_ADDR_INVALID;
 410         INIT_LIST_HEAD (&req->queue);
 411
 412         /* this dma descriptor may be swapped with the previous dummy */
 413         if (ep->dma) {
 414                 struct net2280_dma      *td;
 415
 416                 td = pci_pool_alloc (ep->dev->requests, gfp_flags,
 417                                 &req->td_dma);
 418                 if (!td) {
 419                         kfree (req);
 420                         return NULL;
 421                 }
 422                 td->dmacount = 0;       /* not VALID */
 423                 td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
 424                 td->dmadesc = td->dmaaddr;
 425                 req->td = td;
 426         }
 427         return &req->req;
 428 }
 429
 430 static void
 431 net2280_free_request (struct usb_ep *_ep, struct usb_request *_req)
 432 {
 433         struct net2280_ep       *ep;
 434         struct net2280_request  *req;
 435
 436         ep = container_of (_ep, struct net2280_ep, ep);
 437         if (!_ep || !_req)
 438                 return;
 439
 440         req = container_of (_req, struct net2280_request, req);
 441         WARN_ON (!list_empty (&req->queue));
 442         if (req->td)
 443                 pci_pool_free (ep->dev->requests, req->td, req->td_dma);
 444         kfree (req);
 445 }
 446
 447 /*-------------------------------------------------------------------------*/
 448
 449 /* load a packet into the fifo we use for usb IN transfers.
 450  * works for all endpoints.
 451  *
 452  * NOTE: pio with ep-a..ep-d could stuff multiple packets into the fifo
 453  * at a time, but this code is simpler because it knows it only writes
 454  * one packet.  ep-a..ep-d should use dma instead.
 455  */
 456 static void
 457 write_fifo (struct net2280_ep *ep, struct usb_request *req)
 458 {
 459         struct net2280_ep_regs  __iomem *regs = ep->regs;
 460         u8                      *buf;
 461         u32                     tmp;
 462         unsigned                count, total;
 463
 464         /* INVARIANT:  fifo is currently empty. (testable) */
 465
 466         if (req) {
 467                 buf = req->buf + req->actual;
 468                 prefetch (buf);
 469                 total = req->length - req->actual;
 470         } else {
 471                 total = 0;
 472                 buf = NULL;
 473         }
 474
 475         /* write just one packet at a time */
 476         count = ep->ep.maxpacket;
 477         if (count > total)      /* min() cannot be used on a bitfield */
 478                 count = total;
 479
 480         VDEBUG (ep->dev, "write %s fifo (IN) %d bytes%s req %p\n",
 481                         ep->ep.name, count,
 482                         (count != ep->ep.maxpacket) ? " (short)" : "",
 483                         req);
 484         while (count >= 4) {
 485                 /* NOTE be careful if you try to align these. fifo lines
 486                  * should normally be full (4 bytes) and successive partial
 487                  * lines are ok only in certain cases.
 488                  */
 489                 tmp = get_unaligned ((u32 *)buf);
 490                 cpu_to_le32s (&tmp);
 491                 writel (tmp, &regs->ep_data);
 492                 buf += 4;
 493                 count -= 4;
 494         }
 495
 496         /* last fifo entry is "short" unless we wrote a full packet.
 497          * also explicitly validate last word in (periodic) transfers
 498          * when maxpacket is not a multiple of 4 bytes.
 499          */
 500         if (count || total < ep->ep.maxpacket) {
 501                 tmp = count ? get_unaligned ((u32 *)buf) : count;
 502                 cpu_to_le32s (&tmp);
 503                 set_fifo_bytecount (ep, count & 0x03);
 504                 writel (tmp, &regs->ep_data);
 505         }
 506
 507         /* pci writes may still be posted */
 508 }
 509
 510 /* work around erratum 0106: PCI and USB race over the OUT fifo.
 511  * caller guarantees chiprev 0100, out endpoint is NAKing, and
 512  * there's no real data in the fifo.
 513  *
 514  * NOTE:  also used in cases where that erratum doesn't apply:
 515  * where the host wrote "too much" data to us.
 516  */
 517 static void out_flush (struct net2280_ep *ep)
 518 {
 519         u32     __iomem *statp;
 520         u32     tmp;
 521
 522         ASSERT_OUT_NAKING (ep);
 523
 524         statp = &ep->regs->ep_stat;
 525         writel (  (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 526                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 527                 , statp);
 528         writel ((1 << FIFO_FLUSH), statp);
 529         mb ();
 530         tmp = readl (statp);
 531         if (tmp & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 532                         /* high speed did bulk NYET; fifo isn't filling */
 533                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
 534                 unsigned        usec;
 535
 536                 usec = 50;              /* 64 byte bulk/interrupt */
 537                 handshake (statp, (1 << USB_OUT_PING_NAK_SENT),
 538                                 (1 << USB_OUT_PING_NAK_SENT), usec);
 539                 /* NAK done; now CLEAR_NAK_OUT_PACKETS is safe */
 540         }
 541 }
 542
 543 /* unload packet(s) from the fifo we use for usb OUT transfers.
 544  * returns true iff the request completed, because of short packet
 545  * or the request buffer having filled with full packets.
 546  *
 547  * for ep-a..ep-d this will read multiple packets out when they
 548  * have been accepted.
 549  */
 550 static int
 551 read_fifo (struct net2280_ep *ep, struct net2280_request *req)
 552 {
 553         struct net2280_ep_regs  __iomem *regs = ep->regs;
 554         u8                      *buf = req->req.buf + req->req.actual;
 555         unsigned                count, tmp, is_short;
 556         unsigned                cleanup = 0, prevent = 0;
 557
 558         /* erratum 0106 ... packets coming in during fifo reads might
 559          * be incompletely rejected.  not all cases have workarounds.
 560          */
 561         if (ep->dev->chiprev == 0x0100
 562                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
 563                 udelay (1);
 564                 tmp = readl (&ep->regs->ep_stat);
 565                 if ((tmp & (1 << NAK_OUT_PACKETS)))
 566                         cleanup = 1;
 567                 else if ((tmp & (1 << FIFO_FULL))) {
 568                         start_out_naking (ep);
 569                         prevent = 1;
 570                 }
 571                 /* else: hope we don't see the problem */
 572         }
 573
 574         /* never overflow the rx buffer. the fifo reads packets until
 575          * it sees a short one; we might not be ready for them all.
 576          */
 577         prefetchw (buf);
 578         count = readl (&regs->ep_avail);
 579         if (unlikely (count == 0)) {
 580                 udelay (1);
 581                 tmp = readl (&ep->regs->ep_stat);
 582                 count = readl (&regs->ep_avail);
 583                 /* handled that data already? */
 584                 if (count == 0 && (tmp & (1 << NAK_OUT_PACKETS)) == 0)
 585                         return 0;
 586         }
 587
 588         tmp = req->req.length - req->req.actual;
 589         if (count > tmp) {
 590                 /* as with DMA, data overflow gets flushed */
 591                 if ((tmp % ep->ep.maxpacket) != 0) {
 592                         ERROR (ep->dev,
 593                                 "%s out fifo %d bytes, expected %d\n",
 594                                 ep->ep.name, count, tmp);
 595                         req->req.status = -EOVERFLOW;
 596                         cleanup = 1;
 597                         /* NAK_OUT_PACKETS will be set, so flushing is safe;
 598                          * the next read will start with the next packet
 599                          */
 600                 } /* else it's a ZLP, no worries */
 601                 count = tmp;
 602         }
 603         req->req.actual += count;
 604
 605         is_short = (count == 0) || ((count % ep->ep.maxpacket) != 0);
 606
 607         VDEBUG (ep->dev, "read %s fifo (OUT) %d bytes%s%s%s req %p %d/%d\n",
 608                         ep->ep.name, count, is_short ? " (short)" : "",
 609                         cleanup ? " flush" : "", prevent ? " nak" : "",
 610                         req, req->req.actual, req->req.length);
 611
 612         while (count >= 4) {
 613                 tmp = readl (&regs->ep_data);
 614                 cpu_to_le32s (&tmp);
 615                 put_unaligned (tmp, (u32 *)buf);
 616                 buf += 4;
 617                 count -= 4;
 618         }
 619         if (count) {
 620                 tmp = readl (&regs->ep_data);
 621                 /* LE conversion is implicit here: */
 622                 do {
 623                         *buf++ = (u8) tmp;
 624                         tmp >>= 8;
 625                 } while (--count);
 626         }
 627         if (cleanup)
 628                 out_flush (ep);
 629         if (prevent) {
 630                 writel ((1 << CLEAR_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 631                 (void) readl (&ep->regs->ep_rsp);
 632         }
 633
 634         return is_short || ((req->req.actual == req->req.length)
 635                                 && !req->req.zero);
 636 }
 637
 638 /* fill out dma descriptor to match a given request */
 639 static void
 640 fill_dma_desc (struct net2280_ep *ep, struct net2280_request *req, int valid)
 641 {
 642         struct net2280_dma      *td = req->td;
 643         u32                     dmacount = req->req.length;
 644
 645         /* don't let DMA continue after a short OUT packet,
 646          * so overruns can't affect the next transfer.
 647          * in case of overruns on max-size packets, we can't
 648          * stop the fifo from filling but we can flush it.
 649          */
 650         if (ep->is_in)
 651                 dmacount |= (1 << DMA_DIRECTION);
 652         if ((!ep->is_in && (dmacount % ep->ep.maxpacket) != 0)
 653                         || ep->dev->pdev->device != 0x2280)
 654                 dmacount |= (1 << END_OF_CHAIN);
 655
 656         req->valid = valid;
 657         if (valid)
 658                 dmacount |= (1 << VALID_BIT);
 659         if (likely(!req->req.no_interrupt || !use_dma_chaining))
 660                 dmacount |= (1 << DMA_DONE_INTERRUPT_ENABLE);
 661
 662         /* td->dmadesc = previously set by caller */
 663         td->dmaaddr = cpu_to_le32 (req->req.dma);
 664
 665         /* 2280 may be polling VALID_BIT through ep->dma->dmadesc */
 666         wmb ();
 667         td->dmacount = cpu_to_le32(dmacount);
 668 }
 669
 670 static const u32 dmactl_default =
 671                   (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 672                 | (1 << DMA_CLEAR_COUNT_ENABLE)
 673                 /* erratum 0116 workaround part 1 (use POLLING) */
 674                 | (POLL_100_USEC << DESCRIPTOR_POLLING_RATE)
 675                 | (1 << DMA_VALID_BIT_POLLING_ENABLE)
 676                 | (1 << DMA_VALID_BIT_ENABLE)
 677                 | (1 << DMA_SCATTER_GATHER_ENABLE)
 678                 /* erratum 0116 workaround part 2 (no AUTOSTART) */
 679                 | (1 << DMA_ENABLE);
 680
 681 static inline void spin_stop_dma (struct net2280_dma_regs __iomem *dma)
 682 {
 683         handshake (&dma->dmactl, (1 << DMA_ENABLE), 0, 50);
 684 }
 685
 686 static inline void stop_dma (struct net2280_dma_regs __iomem *dma)
 687 {
 688         writel (readl (&dma->dmactl) & ~(1 << DMA_ENABLE), &dma->dmactl);
 689         spin_stop_dma (dma);
 690 }
 691
 692 static void start_queue (struct net2280_ep *ep, u32 dmactl, u32 td_dma)
 693 {
 694         struct net2280_dma_regs __iomem *dma = ep->dma;
 695         unsigned int tmp = (1 << VALID_BIT) | (ep->is_in << DMA_DIRECTION);
 696
 697         if (ep->dev->pdev->device != 0x2280)
 698                 tmp |= (1 << END_OF_CHAIN);
 699
 700         writel (tmp, &dma->dmacount);
 701         writel (readl (&dma->dmastat), &dma->dmastat);
 702
 703         writel (td_dma, &dma->dmadesc);
 704         writel (dmactl, &dma->dmactl);
 705
 706         /* erratum 0116 workaround part 3:  pci arbiter away from net2280 */
 707         (void) readl (&ep->dev->pci->pcimstctl);
 708
 709         writel ((1 << DMA_START), &dma->dmastat);
 710
 711         if (!ep->is_in)
 712                 stop_out_naking (ep);
 713 }
 714
 715 static void start_dma (struct net2280_ep *ep, struct net2280_request *req)
 716 {
 717         u32                     tmp;
 718         struct net2280_dma_regs __iomem *dma = ep->dma;
 719
 720         /* FIXME can't use DMA for ZLPs */
 721
 722         /* on this path we "know" there's no dma active (yet) */
 723         WARN_ON (readl (&dma->dmactl) & (1 << DMA_ENABLE));
 724         writel (0, &ep->dma->dmactl);
 725
 726         /* previous OUT packet might have been short */
 727         if (!ep->is_in && ((tmp = readl (&ep->regs->ep_stat))
 728                                 & (1 << NAK_OUT_PACKETS)) != 0) {
 729                 writel ((1 << SHORT_PACKET_TRANSFERRED_INTERRUPT),
 730                         &ep->regs->ep_stat);
 731
 732                 tmp = readl (&ep->regs->ep_avail);
 733                 if (tmp) {
 734                         writel (readl (&dma->dmastat), &dma->dmastat);
 735
 736                         /* transfer all/some fifo data */
 737                         writel (req->req.dma, &dma->dmaaddr);
 738                         tmp = min (tmp, req->req.length);
 739
 740                         /* dma irq, faking scatterlist status */
 741                         req->td->dmacount = cpu_to_le32 (req->req.length - tmp);
 742                         writel ((1 << DMA_DONE_INTERRUPT_ENABLE)
 743                                 | tmp, &dma->dmacount);
 744                         req->td->dmadesc = 0;
 745                         req->valid = 1;
 746
 747                         writel ((1 << DMA_ENABLE), &dma->dmactl);
 748                         writel ((1 << DMA_START), &dma->dmastat);
 749                         return;
 750                 }
 751         }
 752
 753         tmp = dmactl_default;
 754
 755         /* force packet boundaries between dma requests, but prevent the
 756          * controller from automagically writing a last "short" packet
 757          * (zero length) unless the driver explicitly said to do that.
 758          */
 759         if (ep->is_in) {
 760                 if (likely ((req->req.length % ep->ep.maxpacket) != 0
 761                                 || req->req.zero)) {
 762                         tmp |= (1 << DMA_FIFO_VALIDATE);
 763                         ep->in_fifo_validate = 1;
 764                 } else
 765                         ep->in_fifo_validate = 0;
 766         }
 767
 768         /* init req->td, pointing to the current dummy */
 769         req->td->dmadesc = cpu_to_le32 (ep->td_dma);
 770         fill_dma_desc (ep, req, 1);
 771
 772         if (!use_dma_chaining)
 773                 req->td->dmacount |= cpu_to_le32 (1 << END_OF_CHAIN);
 774
 775         start_queue (ep, tmp, req->td_dma);
 776 }
 777
 778 static inline void
 779 queue_dma (struct net2280_ep *ep, struct net2280_request *req, int valid)
 780 {
 781         struct net2280_dma      *end;
 782         dma_addr_t              tmp;
 783
 784         /* swap new dummy for old, link; fill and maybe activate */
 785         end = ep->dummy;
 786         ep->dummy = req->td;
 787         req->td = end;
 788
 789         tmp = ep->td_dma;
 790         ep->td_dma = req->td_dma;
 791         req->td_dma = tmp;
 792
 793         end->dmadesc = cpu_to_le32 (ep->td_dma);
 794
 795         fill_dma_desc (ep, req, valid);
 796 }
 797
 798 static void
 799 done (struct net2280_ep *ep, struct net2280_request *req, int status)
 800 {
 801         struct net2280          *dev;
 802         unsigned                stopped = ep->stopped;
 803
 804         list_del_init (&req->queue);
 805
 806         if (req->req.status == -EINPROGRESS)
 807                 req->req.status = status;
 808         else
 809                 status = req->req.status;
 810
 811         dev = ep->dev;
 812         if (ep->dma)
 813                 usb_gadget_unmap_request(&dev->gadget, &req->req, ep->is_in);
 814
 815         if (status && status != -ESHUTDOWN)
 816                 VDEBUG (dev, "complete %s req %p stat %d len %u/%u\n",
 817                         ep->ep.name, &req->req, status,
 818                         req->req.actual, req->req.length);
 819
 820         /* don't modify queue heads during completion callback */
 821         ep->stopped = 1;
 822         spin_unlock (&dev->lock);
 823         req->req.complete (&ep->ep, &req->req);
 824         spin_lock (&dev->lock);
 825         ep->stopped = stopped;
 826 }
 827
 828 /*-------------------------------------------------------------------------*/
 829
 830 static int
 831 net2280_queue (struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
 832 {
 833         struct net2280_request  *req;
 834         struct net2280_ep       *ep;
 835         struct net2280          *dev;
 836         unsigned long           flags;
 837
 838         /* we always require a cpu-view buffer, so that we can
 839          * always use pio (as fallback or whatever).
 840          */
 841         req = container_of (_req, struct net2280_request, req);
 842         if (!_req || !_req->complete || !_req->buf
 843                         || !list_empty (&req->queue))
 844                 return -EINVAL;
 845         if (_req->length > (~0 & DMA_BYTE_COUNT_MASK))
 846                 return -EDOM;
 847         ep = container_of (_ep, struct net2280_ep, ep);
 848         if (!_ep || (!ep->desc && ep->num != 0))
 849                 return -EINVAL;
 850         dev = ep->dev;
 851         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 852                 return -ESHUTDOWN;
 853
 854         /* FIXME implement PIO fallback for ZLPs with DMA */
 855         if (ep->dma && _req->length == 0)
 856                 return -EOPNOTSUPP;
 857
 858         /* set up dma mapping in case the caller didn't */
 859         if (ep->dma) {
 860                 int ret;
 861
 862                 ret = usb_gadget_map_request(&dev->gadget, _req,
 863                                 ep->is_in);
 864                 if (ret)
 865                         return ret;
 866         }
 867
 868 #if 0
 869         VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
 870                         _ep->name, _req, _req->length, _req->buf);
 871 #endif
 872
 873         spin_lock_irqsave (&dev->lock, flags);
 874
 875         _req->status = -EINPROGRESS;
 876         _req->actual = 0;
 877
 878         /* kickstart this i/o queue? */
 879         if (list_empty (&ep->queue) && !ep->stopped) {
 880                 /* use DMA if the endpoint supports it, else pio */
 881                 if (ep->dma)
 882                         start_dma (ep, req);
 883                 else {
 884                         /* maybe there's no control data, just status ack */
 885                         if (ep->num == 0 && _req->length == 0) {
 886                                 allow_status (ep);
 887                                 done (ep, req, 0);
 888                                 VDEBUG (dev, "%s status ack\n", ep->ep.name);
 889                                 goto done;
 890                         }
 891
 892                         /* PIO ... stuff the fifo, or unblock it.  */
 893                         if (ep->is_in)
 894                                 write_fifo (ep, _req);
 895                         else if (list_empty (&ep->queue)) {
 896                                 u32     s;
 897
 898                                 /* OUT FIFO might have packet(s) buffered */
 899                                 s = readl (&ep->regs->ep_stat);
 900                                 if ((s & (1 << FIFO_EMPTY)) == 0) {
 901                                         /* note:  _req->short_not_ok is
 902                                          * ignored here since PIO _always_
 903                                          * stops queue advance here, and
 904                                          * _req->status doesn't change for
 905                                          * short reads (only _req->actual)
 906                                          */
 907                                         if (read_fifo (ep, req)) {
 908                                                 done (ep, req, 0);
 909                                                 if (ep->num == 0)
 910                                                         allow_status (ep);
 911                                                 /* don't queue it */
 912                                                 req = NULL;
 913                                         } else
 914                                                 s = readl (&ep->regs->ep_stat);
 915                                 }
 916
 917                                 /* don't NAK, let the fifo fill */
 918                                 if (req && (s & (1 << NAK_OUT_PACKETS)))
 919                                         writel ((1 << CLEAR_NAK_OUT_PACKETS),
 920                                                         &ep->regs->ep_rsp);
 921                         }
 922                 }
 923
 924         } else if (ep->dma) {
 925                 int     valid = 1;
 926
 927                 if (ep->is_in) {
 928                         int     expect;
 929
 930                         /* preventing magic zlps is per-engine state, not
 931                          * per-transfer; irq logic must recover hiccups.
 932                          */
 933                         expect = likely (req->req.zero
 934                                 || (req->req.length % ep->ep.maxpacket) != 0);
 935                         if (expect != ep->in_fifo_validate)
 936                                 valid = 0;
 937                 }
 938                 queue_dma (ep, req, valid);
 939
 940         } /* else the irq handler advances the queue. */
 941
 942         ep->responded = 1;
 943         if (req)
 944                 list_add_tail (&req->queue, &ep->queue);
 945 done:
 946         spin_unlock_irqrestore (&dev->lock, flags);
 947
 948         /* pci writes may still be posted */
 949         return 0;
 950 }
 951
 952 static inline void
 953 dma_done (
 954         struct net2280_ep *ep,
 955         struct net2280_request *req,
 956         u32 dmacount,
 957         int status
 958 )
 959 {
 960         req->req.actual = req->req.length - (DMA_BYTE_COUNT_MASK & dmacount);
 961         done (ep, req, status);
 962 }
 963
 964 static void restart_dma (struct net2280_ep *ep);
 965
 966 static void scan_dma_completions (struct net2280_ep *ep)
 967 {
 968         /* only look at descriptors that were "naturally" retired,
 969          * so fifo and list head state won't matter
 970          */
 971         while (!list_empty (&ep->queue)) {
 972                 struct net2280_request  *req;
 973                 u32                     tmp;
 974
 975                 req = list_entry (ep->queue.next,
 976                                 struct net2280_request, queue);
 977                 if (!req->valid)
 978                         break;
 979                 rmb ();
 980                 tmp = le32_to_cpup (&req->td->dmacount);
 981                 if ((tmp & (1 << VALID_BIT)) != 0)
 982                         break;
 983
 984                 /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
 985                  * cases where DMA must be aborted; this code handles
 986                  * all non-abort DMA completions.
 987                  */
 988                 if (unlikely (req->td->dmadesc == 0)) {
 989                         /* paranoia */
 990                         tmp = readl (&ep->dma->dmacount);
 991                         if (tmp & DMA_BYTE_COUNT_MASK)
 992                                 break;
 993                         /* single transfer mode */
 994                         dma_done (ep, req, tmp, 0);
 995                         break;
 996                 } else if (!ep->is_in
 997                                 && (req->req.length % ep->ep.maxpacket) != 0) {
 998                         tmp = readl (&ep->regs->ep_stat);
 999
1000                         /* AVOID TROUBLE HERE by not issuing short reads from
1001                          * your gadget driver.  That helps avoids errata 0121,
1002                          * 0122, and 0124; not all cases trigger the warning.
1003                          */
1004                         if ((tmp & (1 << NAK_OUT_PACKETS)) == 0) {
1005                                 WARNING (ep->dev, "%s lost packet sync!\n",
1006                                                 ep->ep.name);
1007                                 req->req.status = -EOVERFLOW;
1008                         } else if ((tmp = readl (&ep->regs->ep_avail)) != 0) {
1009                                 /* fifo gets flushed later */
1010                                 ep->out_overflow = 1;
1011                                 DEBUG (ep->dev, "%s dma, discard %d len %d\n",
1012                                                 ep->ep.name, tmp,
1013                                                 req->req.length);
1014                                 req->req.status = -EOVERFLOW;
1015                         }
1016                 }
1017                 dma_done (ep, req, tmp, 0);
1018         }
1019 }
1020
1021 static void restart_dma (struct net2280_ep *ep)
1022 {
1023         struct net2280_request  *req;
1024         u32                     dmactl = dmactl_default;
1025
1026         if (ep->stopped)
1027                 return;
1028         req = list_entry (ep->queue.next, struct net2280_request, queue);
1029
1030         if (!use_dma_chaining) {
1031                 start_dma (ep, req);
1032                 return;
1033         }
1034
1035         /* the 2280 will be processing the queue unless queue hiccups after
1036          * the previous transfer:
1037          *  IN:   wanted automagic zlp, head doesn't (or vice versa)
1038          *        DMA_FIFO_VALIDATE doesn't init from dma descriptors.
1039          *  OUT:  was "usb-short", we must restart.
1040          */
1041         if (ep->is_in && !req->valid) {
1042                 struct net2280_request  *entry, *prev = NULL;
1043                 int                     reqmode, done = 0;
1044
1045                 DEBUG (ep->dev, "%s dma hiccup td %p\n", ep->ep.name, req->td);
1046                 ep->in_fifo_validate = likely (req->req.zero
1047                         || (req->req.length % ep->ep.maxpacket) != 0);
1048                 if (ep->in_fifo_validate)
1049                         dmactl |= (1 << DMA_FIFO_VALIDATE);
1050                 list_for_each_entry (entry, &ep->queue, queue) {
1051                         __le32          dmacount;
1052
1053                         if (entry == req)
1054                                 continue;
1055                         dmacount = entry->td->dmacount;
1056                         if (!done) {
1057                                 reqmode = likely (entry->req.zero
1058                                         || (entry->req.length
1059                                                 % ep->ep.maxpacket) != 0);
1060                                 if (reqmode == ep->in_fifo_validate) {
1061                                         entry->valid = 1;
1062                                         dmacount |= valid_bit;
1063                                         entry->td->dmacount = dmacount;
1064                                         prev = entry;
1065                                         continue;
1066                                 } else {
1067                                         /* force a hiccup */
1068                                         prev->td->dmacount |= dma_done_ie;
1069                                         done = 1;
1070                                 }
1071                         }
1072
1073                         /* walk the rest of the queue so unlinks behave */
1074                         entry->valid = 0;
1075                         dmacount &= ~valid_bit;
1076                         entry->td->dmacount = dmacount;
1077                         prev = entry;
1078                 }
1079         }
1080
1081         writel (0, &ep->dma->dmactl);
1082         start_queue (ep, dmactl, req->td_dma);
1083 }
1084
1085 static void abort_dma (struct net2280_ep *ep)
1086 {
1087         /* abort the current transfer */
1088         if (likely (!list_empty (&ep->queue))) {
1089                 /* FIXME work around errata 0121, 0122, 0124 */
1090                 writel ((1 << DMA_ABORT), &ep->dma->dmastat);
1091                 spin_stop_dma (ep->dma);
1092         } else
1093                 stop_dma (ep->dma);
1094         scan_dma_completions (ep);
1095 }
1096
1097 /* dequeue ALL requests */
1098 static void nuke (struct net2280_ep *ep)
1099 {
1100         struct net2280_request  *req;
1101
1102         /* called with spinlock held */
1103         ep->stopped = 1;
1104         if (ep->dma)
1105                 abort_dma (ep);
1106         while (!list_empty (&ep->queue)) {
1107                 req = list_entry (ep->queue.next,
1108                                 struct net2280_request,
1109                                 queue);
1110                 done (ep, req, -ESHUTDOWN);
1111         }
1112 }
1113
1114 /* dequeue JUST ONE request */
1115 static int net2280_dequeue (struct usb_ep *_ep, struct usb_request *_req)
1116 {
1117         struct net2280_ep       *ep;
1118         struct net2280_request  *req;
1119         unsigned long           flags;
1120         u32                     dmactl;
1121         int                     stopped;
1122
1123         ep = container_of (_ep, struct net2280_ep, ep);
1124         if (!_ep || (!ep->desc && ep->num != 0) || !_req)
1125                 return -EINVAL;
1126
1127         spin_lock_irqsave (&ep->dev->lock, flags);
1128         stopped = ep->stopped;
1129
1130         /* quiesce dma while we patch the queue */
1131         dmactl = 0;
1132         ep->stopped = 1;
1133         if (ep->dma) {
1134                 dmactl = readl (&ep->dma->dmactl);
1135                 /* WARNING erratum 0127 may kick in ... */
1136                 stop_dma (ep->dma);
1137                 scan_dma_completions (ep);
1138         }
1139
1140         /* make sure it's still queued on this endpoint */
1141         list_for_each_entry (req, &ep->queue, queue) {
1142                 if (&req->req == _req)
1143                         break;
1144         }
1145         if (&req->req != _req) {
1146                 spin_unlock_irqrestore (&ep->dev->lock, flags);
1147                 return -EINVAL;
1148         }
1149
1150         /* queue head may be partially complete. */
1151         if (ep->queue.next == &req->queue) {
1152                 if (ep->dma) {
1153                         DEBUG (ep->dev, "unlink (%s) dma\n", _ep->name);
1154                         _req->status = -ECONNRESET;
1155                         abort_dma (ep);
1156                         if (likely (ep->queue.next == &req->queue)) {
1157                                 // NOTE: misreports single-transfer mode
1158                                 req->td->dmacount = 0;  /* invalidate */
1159                                 dma_done (ep, req,
1160                                         readl (&ep->dma->dmacount),
1161                                         -ECONNRESET);
1162                         }
1163                 } else {
1164                         DEBUG (ep->dev, "unlink (%s) pio\n", _ep->name);
1165                         done (ep, req, -ECONNRESET);
1166                 }
1167                 req = NULL;
1168
1169         /* patch up hardware chaining data */
1170         } else if (ep->dma && use_dma_chaining) {
1171                 if (req->queue.prev == ep->queue.next) {
1172                         writel (le32_to_cpu (req->td->dmadesc),
1173                                 &ep->dma->dmadesc);
1174                         if (req->td->dmacount & dma_done_ie)
1175                                 writel (readl (&ep->dma->dmacount)
1176                                                 | le32_to_cpu(dma_done_ie),
1177                                         &ep->dma->dmacount);
1178                 } else {
1179                         struct net2280_request  *prev;
1180
1181                         prev = list_entry (req->queue.prev,
1182                                 struct net2280_request, queue);
1183                         prev->td->dmadesc = req->td->dmadesc;
1184                         if (req->td->dmacount & dma_done_ie)
1185                                 prev->td->dmacount |= dma_done_ie;
1186                 }
1187         }
1188
1189         if (req)
1190                 done (ep, req, -ECONNRESET);
1191         ep->stopped = stopped;
1192
1193         if (ep->dma) {
1194                 /* turn off dma on inactive queues */
1195                 if (list_empty (&ep->queue))
1196                         stop_dma (ep->dma);
1197                 else if (!ep->stopped) {
1198                         /* resume current request, or start new one */
1199                         if (req)
1200                                 writel (dmactl, &ep->dma->dmactl);
1201                         else
1202                                 start_dma (ep, list_entry (ep->queue.next,
1203                                         struct net2280_request, queue));
1204                 }
1205         }
1206
1207         spin_unlock_irqrestore (&ep->dev->lock, flags);
1208         return 0;
1209 }
1210
1211 /*-------------------------------------------------------------------------*/
1212
1213 static int net2280_fifo_status (struct usb_ep *_ep);
1214
1215 static int
1216 net2280_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedged)
1217 {
1218         struct net2280_ep       *ep;
1219         unsigned long           flags;
1220         int                     retval = 0;
1221
1222         ep = container_of (_ep, struct net2280_ep, ep);
1223         if (!_ep || (!ep->desc && ep->num != 0))
1224                 return -EINVAL;
1225         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1226                 return -ESHUTDOWN;
1227         if (ep->desc /* not ep0 */ && (ep->desc->bmAttributes & 0x03)
1228                                                 == USB_ENDPOINT_XFER_ISOC)
1229                 return -EINVAL;
1230
1231         spin_lock_irqsave (&ep->dev->lock, flags);
1232         if (!list_empty (&ep->queue))
1233                 retval = -EAGAIN;
1234         else if (ep->is_in && value && net2280_fifo_status (_ep) != 0)
1235                 retval = -EAGAIN;
1236         else {
1237                 VDEBUG (ep->dev, "%s %s %s\n", _ep->name,
1238                                 value ? "set" : "clear",
1239                                 wedged ? "wedge" : "halt");
1240                 /* set/clear, then synch memory views with the device */
1241                 if (value) {
1242                         if (ep->num == 0)
1243                                 ep->dev->protocol_stall = 1;
1244                         else
1245                                 set_halt (ep);
1246                         if (wedged)
1247                                 ep->wedged = 1;
1248                 } else {
1249                         clear_halt (ep);
1250                         ep->wedged = 0;
1251                 }
1252                 (void) readl (&ep->regs->ep_rsp);
1253         }
1254         spin_unlock_irqrestore (&ep->dev->lock, flags);
1255
1256         return retval;
1257 }
1258
1259 static int
1260 net2280_set_halt(struct usb_ep *_ep, int value)
1261 {
1262         return net2280_set_halt_and_wedge(_ep, value, 0);
1263 }
1264
1265 static int
1266 net2280_set_wedge(struct usb_ep *_ep)
1267 {
1268         if (!_ep || _ep->name == ep0name)
1269                 return -EINVAL;
1270         return net2280_set_halt_and_wedge(_ep, 1, 1);
1271 }
1272
1273 static int
1274 net2280_fifo_status (struct usb_ep *_ep)
1275 {
1276         struct net2280_ep       *ep;
1277         u32                     avail;
1278
1279         ep = container_of (_ep, struct net2280_ep, ep);
1280         if (!_ep || (!ep->desc && ep->num != 0))
1281                 return -ENODEV;
1282         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1283                 return -ESHUTDOWN;
1284
1285         avail = readl (&ep->regs->ep_avail) & ((1 << 12) - 1);
1286         if (avail > ep->fifo_size)
1287                 return -EOVERFLOW;
1288         if (ep->is_in)
1289                 avail = ep->fifo_size - avail;
1290         return avail;
1291 }
1292
1293 static void
1294 net2280_fifo_flush (struct usb_ep *_ep)
1295 {
1296         struct net2280_ep       *ep;
1297
1298         ep = container_of (_ep, struct net2280_ep, ep);
1299         if (!_ep || (!ep->desc && ep->num != 0))
1300                 return;
1301         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1302                 return;
1303
1304         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
1305         (void) readl (&ep->regs->ep_rsp);
1306 }
1307
1308 static const struct usb_ep_ops net2280_ep_ops = {
1309         .enable         = net2280_enable,
1310         .disable        = net2280_disable,
1311
1312         .alloc_request  = net2280_alloc_request,
1313         .free_request   = net2280_free_request,
1314
1315         .queue          = net2280_queue,
1316         .dequeue        = net2280_dequeue,
1317
1318         .set_halt       = net2280_set_halt,
1319         .set_wedge      = net2280_set_wedge,
1320         .fifo_status    = net2280_fifo_status,
1321         .fifo_flush     = net2280_fifo_flush,
1322 };
1323
1324 /*-------------------------------------------------------------------------*/
1325
1326 static int net2280_get_frame (struct usb_gadget *_gadget)
1327 {
1328         struct net2280          *dev;
1329         unsigned long           flags;
1330         u16                     retval;
1331
1332         if (!_gadget)
1333                 return -ENODEV;
1334         dev = container_of (_gadget, struct net2280, gadget);
1335         spin_lock_irqsave (&dev->lock, flags);
1336         retval = get_idx_reg (dev->regs, REG_FRAME) & 0x03ff;
1337         spin_unlock_irqrestore (&dev->lock, flags);
1338         return retval;
1339 }
1340
1341 static int net2280_wakeup (struct usb_gadget *_gadget)
1342 {
1343         struct net2280          *dev;
1344         u32                     tmp;
1345         unsigned long           flags;
1346
1347         if (!_gadget)
1348                 return 0;
1349         dev = container_of (_gadget, struct net2280, gadget);
1350
1351         spin_lock_irqsave (&dev->lock, flags);
1352         tmp = readl (&dev->usb->usbctl);
1353         if (tmp & (1 << DEVICE_REMOTE_WAKEUP_ENABLE))
1354                 writel (1 << GENERATE_RESUME, &dev->usb->usbstat);
1355         spin_unlock_irqrestore (&dev->lock, flags);
1356
1357         /* pci writes may still be posted */
1358         return 0;
1359 }
1360
1361 static int net2280_set_selfpowered (struct usb_gadget *_gadget, int value)
1362 {
1363         struct net2280          *dev;
1364         u32                     tmp;
1365         unsigned long           flags;
1366
1367         if (!_gadget)
1368                 return 0;
1369         dev = container_of (_gadget, struct net2280, gadget);
1370
1371         spin_lock_irqsave (&dev->lock, flags);
1372         tmp = readl (&dev->usb->usbctl);
1373         if (value)
1374                 tmp |= (1 << SELF_POWERED_STATUS);
1375         else
1376                 tmp &= ~(1 << SELF_POWERED_STATUS);
1377         writel (tmp, &dev->usb->usbctl);
1378         spin_unlock_irqrestore (&dev->lock, flags);
1379
1380         return 0;
1381 }
1382
1383 static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
1384 {
1385         struct net2280  *dev;
1386         u32             tmp;
1387         unsigned long   flags;
1388
1389         if (!_gadget)
1390                 return -ENODEV;
1391         dev = container_of (_gadget, struct net2280, gadget);
1392
1393         spin_lock_irqsave (&dev->lock, flags);
1394         tmp = readl (&dev->usb->usbctl);
1395         dev->softconnect = (is_on != 0);
1396         if (is_on)
1397                 tmp |= (1 << USB_DETECT_ENABLE);
1398         else
1399                 tmp &= ~(1 << USB_DETECT_ENABLE);
1400         writel (tmp, &dev->usb->usbctl);
1401         spin_unlock_irqrestore (&dev->lock, flags);
1402
1403         return 0;
1404 }
1405
1406 static int net2280_start(struct usb_gadget *_gadget,
1407                 struct usb_gadget_driver *driver);
1408 static int net2280_stop(struct usb_gadget *_gadget,
1409                 struct usb_gadget_driver *driver);
1410
1411 static const struct usb_gadget_ops net2280_ops = {
1412         .get_frame      = net2280_get_frame,
1413         .wakeup         = net2280_wakeup,
1414         .set_selfpowered = net2280_set_selfpowered,
1415         .pullup         = net2280_pullup,
1416         .udc_start      = net2280_start,
1417         .udc_stop       = net2280_stop,
1418 };
1419
1420 /*-------------------------------------------------------------------------*/
1421
1422 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
1423
1424 /* FIXME move these into procfs, and use seq_file.
1425  * Sysfs _still_ doesn't behave for arbitrarily sized files,
1426  * and also doesn't help products using this with 2.4 kernels.
1427  */
1428
1429 /* "function" sysfs attribute */
1430 static ssize_t
1431 show_function (struct device *_dev, struct device_attribute *attr, char *buf)
1432 {
1433         struct net2280  *dev = dev_get_drvdata (_dev);
1434
1435         if (!dev->driver
1436                         || !dev->driver->function
1437                         || strlen (dev->driver->function) > PAGE_SIZE)
1438                 return 0;
1439         return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
1440 }
1441 static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
1442
1443 static ssize_t net2280_show_registers(struct device *_dev,
1444                                 struct device_attribute *attr, char *buf)
1445 {
1446         struct net2280          *dev;
1447         char                    *next;
1448         unsigned                size, t;
1449         unsigned long           flags;
1450         int                     i;
1451         u32                     t1, t2;
1452         const char              *s;
1453
1454         dev = dev_get_drvdata (_dev);
1455         next = buf;
1456         size = PAGE_SIZE;
1457         spin_lock_irqsave (&dev->lock, flags);
1458
1459         if (dev->driver)
1460                 s = dev->driver->driver.name;
1461         else
1462                 s = "(none)";
1463
1464         /* Main Control Registers */
1465         t = scnprintf (next, size, "%s version " DRIVER_VERSION
1466                         ", chiprev %04x, dma %s\n\n"
1467                         "devinit %03x fifoctl %08x gadget '%s'\n"
1468                         "pci irqenb0 %02x irqenb1 %08x "
1469                         "irqstat0 %04x irqstat1 %08x\n",
1470                         driver_name, dev->chiprev,
1471                         use_dma
1472                                 ? (use_dma_chaining ? "chaining" : "enabled")
1473                                 : "disabled",
1474                         readl (&dev->regs->devinit),
1475                         readl (&dev->regs->fifoctl),
1476                         s,
1477                         readl (&dev->regs->pciirqenb0),
1478                         readl (&dev->regs->pciirqenb1),
1479                         readl (&dev->regs->irqstat0),
1480                         readl (&dev->regs->irqstat1));
1481         size -= t;
1482         next += t;
1483
1484         /* USB Control Registers */
1485         t1 = readl (&dev->usb->usbctl);
1486         t2 = readl (&dev->usb->usbstat);
1487         if (t1 & (1 << VBUS_PIN)) {
1488                 if (t2 & (1 << HIGH_SPEED))
1489                         s = "high speed";
1490                 else if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1491                         s = "powered";
1492                 else
1493                         s = "full speed";
1494                 /* full speed bit (6) not working?? */
1495         } else
1496                         s = "not attached";
1497         t = scnprintf (next, size,
1498                         "stdrsp %08x usbctl %08x usbstat %08x "
1499                                 "addr 0x%02x (%s)\n",
1500                         readl (&dev->usb->stdrsp), t1, t2,
1501                         readl (&dev->usb->ouraddr), s);
1502         size -= t;
1503         next += t;
1504
1505         /* PCI Master Control Registers */
1506
1507         /* DMA Control Registers */
1508
1509         /* Configurable EP Control Registers */
1510         for (i = 0; i < 7; i++) {
1511                 struct net2280_ep       *ep;
1512
1513                 ep = &dev->ep [i];
1514                 if (i && !ep->desc)
1515                         continue;
1516
1517                 t1 = readl (&ep->regs->ep_cfg);
1518                 t2 = readl (&ep->regs->ep_rsp) & 0xff;
1519                 t = scnprintf (next, size,
1520                                 "\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
1521                                         "irqenb %02x\n",
1522                                 ep->ep.name, t1, t2,
1523                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS))
1524                                         ? "NAK " : "",
1525                                 (t2 & (1 << CLEAR_EP_HIDE_STATUS_PHASE))
1526                                         ? "hide " : "",
1527                                 (t2 & (1 << CLEAR_EP_FORCE_CRC_ERROR))
1528                                         ? "CRC " : "",
1529                                 (t2 & (1 << CLEAR_INTERRUPT_MODE))
1530                                         ? "interrupt " : "",
1531                                 (t2 & (1<<CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE))
1532                                         ? "status " : "",
1533                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS_MODE))
1534                                         ? "NAKmode " : "",
1535                                 (t2 & (1 << CLEAR_ENDPOINT_TOGGLE))
1536                                         ? "DATA1 " : "DATA0 ",
1537                                 (t2 & (1 << CLEAR_ENDPOINT_HALT))
1538                                         ? "HALT " : "",
1539                                 readl (&ep->regs->ep_irqenb));
1540                 size -= t;
1541                 next += t;
1542
1543                 t = scnprintf (next, size,
1544                                 "\tstat %08x avail %04x "
1545                                 "(ep%d%s-%s)%s\n",
1546                                 readl (&ep->regs->ep_stat),
1547                                 readl (&ep->regs->ep_avail),
1548                                 t1 & 0x0f, DIR_STRING (t1),
1549                                 type_string (t1 >> 8),
1550                                 ep->stopped ? "*" : "");
1551                 size -= t;
1552                 next += t;
1553
1554                 if (!ep->dma)
1555                         continue;
1556
1557                 t = scnprintf (next, size,
1558                                 "  dma\tctl %08x stat %08x count %08x\n"
1559                                 "\taddr %08x desc %08x\n",
1560                                 readl (&ep->dma->dmactl),
1561                                 readl (&ep->dma->dmastat),
1562                                 readl (&ep->dma->dmacount),
1563                                 readl (&ep->dma->dmaaddr),
1564                                 readl (&ep->dma->dmadesc));
1565                 size -= t;
1566                 next += t;
1567
1568         }
1569
1570         /* Indexed Registers */
1571                 // none yet
1572
1573         /* Statistics */
1574         t = scnprintf (next, size, "\nirqs:  ");
1575         size -= t;
1576         next += t;
1577         for (i = 0; i < 7; i++) {
1578                 struct net2280_ep       *ep;
1579
1580                 ep = &dev->ep [i];
1581                 if (i && !ep->irqs)
1582                         continue;
1583                 t = scnprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
1584                 size -= t;
1585                 next += t;
1586
1587         }
1588         t = scnprintf (next, size, "\n");
1589         size -= t;
1590         next += t;
1591
1592         spin_unlock_irqrestore (&dev->lock, flags);
1593
1594         return PAGE_SIZE - size;
1595 }
1596 static DEVICE_ATTR(registers, S_IRUGO, net2280_show_registers, NULL);
1597
1598 static ssize_t
1599 show_queues (struct device *_dev, struct device_attribute *attr, char *buf)
1600 {
1601         struct net2280          *dev;
1602         char                    *next;
1603         unsigned                size;
1604         unsigned long           flags;
1605         int                     i;
1606
1607         dev = dev_get_drvdata (_dev);
1608         next = buf;
1609         size = PAGE_SIZE;
1610         spin_lock_irqsave (&dev->lock, flags);
1611
1612         for (i = 0; i < 7; i++) {
1613                 struct net2280_ep               *ep = &dev->ep [i];
1614                 struct net2280_request          *req;
1615                 int                             t;
1616
1617                 if (i != 0) {
1618                         const struct usb_endpoint_descriptor    *d;
1619
1620                         d = ep->desc;
1621                         if (!d)
1622                                 continue;
1623                         t = d->bEndpointAddress;
1624                         t = scnprintf (next, size,
1625                                 "\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
1626                                 ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
1627                                 (t & USB_DIR_IN) ? "in" : "out",
1628                                 ({ char *val;
1629                                  switch (d->bmAttributes & 0x03) {
1630                                  case USB_ENDPOINT_XFER_BULK:
1631                                         val = "bulk"; break;
1632                                  case USB_ENDPOINT_XFER_INT:
1633                                         val = "intr"; break;
1634                                  default:
1635                                         val = "iso"; break;
1636                                  }; val; }),
1637                                 usb_endpoint_maxp (d) & 0x1fff,
1638                                 ep->dma ? "dma" : "pio", ep->fifo_size
1639                                 );
1640                 } else /* ep0 should only have one transfer queued */
1641                         t = scnprintf (next, size, "ep0 max 64 pio %s\n",
1642                                         ep->is_in ? "in" : "out");
1643                 if (t <= 0 || t > size)
1644                         goto done;
1645                 size -= t;
1646                 next += t;
1647
1648                 if (list_empty (&ep->queue)) {
1649                         t = scnprintf (next, size, "\t(nothing queued)\n");
1650                         if (t <= 0 || t > size)
1651                                 goto done;
1652                         size -= t;
1653                         next += t;
1654                         continue;
1655                 }
1656                 list_for_each_entry (req, &ep->queue, queue) {
1657                         if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
1658                                 t = scnprintf (next, size,
1659                                         "\treq %p len %d/%d "
1660                                         "buf %p (dmacount %08x)\n",
1661                                         &req->req, req->req.actual,
1662                                         req->req.length, req->req.buf,
1663                                         readl (&ep->dma->dmacount));
1664                         else
1665                                 t = scnprintf (next, size,
1666                                         "\treq %p len %d/%d buf %p\n",
1667                                         &req->req, req->req.actual,
1668                                         req->req.length, req->req.buf);
1669                         if (t <= 0 || t > size)
1670                                 goto done;
1671                         size -= t;
1672                         next += t;
1673
1674                         if (ep->dma) {
1675                                 struct net2280_dma      *td;
1676
1677                                 td = req->td;
1678                                 t = scnprintf (next, size, "\t    td %08x "
1679                                         " count %08x buf %08x desc %08x\n",
1680                                         (u32) req->td_dma,
1681                                         le32_to_cpu (td->dmacount),
1682                                         le32_to_cpu (td->dmaaddr),
1683                                         le32_to_cpu (td->dmadesc));
1684                                 if (t <= 0 || t > size)
1685                                         goto done;
1686                                 size -= t;
1687                                 next += t;
1688                         }
1689                 }
1690         }
1691
1692 done:
1693         spin_unlock_irqrestore (&dev->lock, flags);
1694         return PAGE_SIZE - size;
1695 }
1696 static DEVICE_ATTR (queues, S_IRUGO, show_queues, NULL);
1697
1698
1699 #else
1700
1701 #define device_create_file(a,b) (0)
1702 #define device_remove_file(a,b) do { } while (0)
1703
1704 #endif
1705
1706 /*-------------------------------------------------------------------------*/
1707
1708 /* another driver-specific mode might be a request type doing dma
1709  * to/from another device fifo instead of to/from memory.
1710  */
1711
1712 static void set_fifo_mode (struct net2280 *dev, int mode)
1713 {
1714         /* keeping high bits preserves BAR2 */
1715         writel ((0xffff << PCI_BASE2_RANGE) | mode, &dev->regs->fifoctl);
1716
1717         /* always ep-{a,b,e,f} ... maybe not ep-c or ep-d */
1718         INIT_LIST_HEAD (&dev->gadget.ep_list);
1719         list_add_tail (&dev->ep [1].ep.ep_list, &dev->gadget.ep_list);
1720         list_add_tail (&dev->ep [2].ep.ep_list, &dev->gadget.ep_list);
1721         switch (mode) {
1722         case 0:
1723                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1724                 list_add_tail (&dev->ep [4].ep.ep_list, &dev->gadget.ep_list);
1725                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 1024;
1726                 break;
1727         case 1:
1728                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 2048;
1729                 break;
1730         case 2:
1731                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1732                 dev->ep [1].fifo_size = 2048;
1733                 dev->ep [2].fifo_size = 1024;
1734                 break;
1735         }
1736         /* fifo sizes for ep0, ep-c, ep-d, ep-e, and ep-f never change */
1737         list_add_tail (&dev->ep [5].ep.ep_list, &dev->gadget.ep_list);
1738         list_add_tail (&dev->ep [6].ep.ep_list, &dev->gadget.ep_list);
1739 }
1740
1741 /* keeping it simple:
1742  * - one bus driver, initted first;
1743  * - one function driver, initted second
1744  *
1745  * most of the work to support multiple net2280 controllers would
1746  * be to associate this gadget driver (yes?) with all of them, or
1747  * perhaps to bind specific drivers to specific devices.
1748  */
1749
1750 static void usb_reset (struct net2280 *dev)
1751 {
1752         u32     tmp;
1753
1754         dev->gadget.speed = USB_SPEED_UNKNOWN;
1755         (void) readl (&dev->usb->usbctl);
1756
1757         net2280_led_init (dev);
1758
1759         /* disable automatic responses, and irqs */
1760         writel (0, &dev->usb->stdrsp);
1761         writel (0, &dev->regs->pciirqenb0);
1762         writel (0, &dev->regs->pciirqenb1);
1763
1764         /* clear old dma and irq state */
1765         for (tmp = 0; tmp < 4; tmp++) {
1766                 struct net2280_ep       *ep = &dev->ep [tmp + 1];
1767
1768                 if (ep->dma)
1769                         abort_dma (ep);
1770         }
1771         writel (~0, &dev->regs->irqstat0),
1772         writel (~(1 << SUSPEND_REQUEST_INTERRUPT), &dev->regs->irqstat1),
1773
1774         /* reset, and enable pci */
1775         tmp = readl (&dev->regs->devinit)
1776                 | (1 << PCI_ENABLE)
1777                 | (1 << FIFO_SOFT_RESET)
1778                 | (1 << USB_SOFT_RESET)
1779                 | (1 << M8051_RESET);
1780         writel (tmp, &dev->regs->devinit);
1781
1782         /* standard fifo and endpoint allocations */
1783         set_fifo_mode (dev, (fifo_mode <= 2) ? fifo_mode : 0);
1784 }
1785
1786 static void usb_reinit (struct net2280 *dev)
1787 {
1788         u32     tmp;
1789         int     init_dma;
1790
1791         /* use_dma changes are ignored till next device re-init */
1792         init_dma = use_dma;
1793
1794         /* basic endpoint init */
1795         for (tmp = 0; tmp < 7; tmp++) {
1796                 struct net2280_ep       *ep = &dev->ep [tmp];
1797
1798                 ep->ep.name = ep_name [tmp];
1799                 ep->dev = dev;
1800                 ep->num = tmp;
1801
1802                 if (tmp > 0 && tmp <= 4) {
1803                         ep->fifo_size = 1024;
1804                         if (init_dma)
1805                                 ep->dma = &dev->dma [tmp - 1];
1806                 } else
1807                         ep->fifo_size = 64;
1808                 ep->regs = &dev->epregs [tmp];
1809                 ep_reset (dev->regs, ep);
1810         }
1811         dev->ep [0].ep.maxpacket = 64;
1812         dev->ep [5].ep.maxpacket = 64;
1813         dev->ep [6].ep.maxpacket = 64;
1814
1815         dev->gadget.ep0 = &dev->ep [0].ep;
1816         dev->ep [0].stopped = 0;
1817         INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
1818
1819         /* we want to prevent lowlevel/insecure access from the USB host,
1820          * but erratum 0119 means this enable bit is ignored
1821          */
1822         for (tmp = 0; tmp < 5; tmp++)
1823                 writel (EP_DONTUSE, &dev->dep [tmp].dep_cfg);
1824 }
1825
1826 static void ep0_start (struct net2280 *dev)
1827 {
1828         writel (  (1 << CLEAR_EP_HIDE_STATUS_PHASE)
1829                 | (1 << CLEAR_NAK_OUT_PACKETS)
1830                 | (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
1831                 , &dev->epregs [0].ep_rsp);
1832
1833         /*
1834          * hardware optionally handles a bunch of standard requests
1835          * that the API hides from drivers anyway.  have it do so.
1836          * endpoint status/features are handled in software, to
1837          * help pass tests for some dubious behavior.
1838          */
1839         writel (  (1 << SET_TEST_MODE)
1840                 | (1 << SET_ADDRESS)
1841                 | (1 << DEVICE_SET_CLEAR_DEVICE_REMOTE_WAKEUP)
1842                 | (1 << GET_DEVICE_STATUS)
1843                 | (1 << GET_INTERFACE_STATUS)
1844                 , &dev->usb->stdrsp);
1845         writel (  (1 << USB_ROOT_PORT_WAKEUP_ENABLE)
1846                 | (1 << SELF_POWERED_USB_DEVICE)
1847                 | (1 << REMOTE_WAKEUP_SUPPORT)
1848                 | (dev->softconnect << USB_DETECT_ENABLE)
1849                 | (1 << SELF_POWERED_STATUS)
1850                 , &dev->usb->usbctl);
1851
1852         /* enable irqs so we can see ep0 and general operation  */
1853         writel (  (1 << SETUP_PACKET_INTERRUPT_ENABLE)
1854                 | (1 << ENDPOINT_0_INTERRUPT_ENABLE)
1855                 , &dev->regs->pciirqenb0);
1856         writel (  (1 << PCI_INTERRUPT_ENABLE)
1857                 | (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT_ENABLE)
1858                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT_ENABLE)
1859                 | (1 << PCI_RETRY_ABORT_INTERRUPT_ENABLE)
1860                 | (1 << VBUS_INTERRUPT_ENABLE)
1861                 | (1 << ROOT_PORT_RESET_INTERRUPT_ENABLE)
1862                 | (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT_ENABLE)
1863                 , &dev->regs->pciirqenb1);
1864
1865         /* don't leave any writes posted */
1866         (void) readl (&dev->usb->usbctl);
1867 }
1868
1869 /* when a driver is successfully registered, it will receive
1870  * control requests including set_configuration(), which enables
1871  * non-control requests.  then usb traffic follows until a
1872  * disconnect is reported.  then a host may connect again, or
1873  * the driver might get unbound.
1874  */
1875 static int net2280_start(struct usb_gadget *_gadget,
1876                 struct usb_gadget_driver *driver)
1877 {
1878         struct net2280          *dev;
1879         int                     retval;
1880         unsigned                i;
1881
1882         /* insist on high speed support from the driver, since
1883          * (dev->usb->xcvrdiag & FORCE_FULL_SPEED_MODE)
1884          * "must not be used in normal operation"
1885          */
1886         if (!driver || driver->max_speed < USB_SPEED_HIGH
1887                         || !driver->setup)
1888                 return -EINVAL;
1889
1890         dev = container_of (_gadget, struct net2280, gadget);
1891
1892         for (i = 0; i < 7; i++)
1893                 dev->ep [i].irqs = 0;
1894
1895         /* hook up the driver ... */
1896         dev->softconnect = 1;
1897         driver->driver.bus = NULL;
1898         dev->driver = driver;
1899         dev->gadget.dev.driver = &driver->driver;
1900
1901         retval = device_create_file (&dev->pdev->dev, &dev_attr_function);
1902         if (retval) goto err_unbind;
1903         retval = device_create_file (&dev->pdev->dev, &dev_attr_queues);
1904         if (retval) goto err_func;
1905
1906         /* Enable force-full-speed testing mode, if desired */
1907         if (full_speed)
1908                 writel(1 << FORCE_FULL_SPEED_MODE, &dev->usb->xcvrdiag);
1909
1910         /* ... then enable host detection and ep0; and we're ready
1911          * for set_configuration as well as eventual disconnect.
1912          */
1913         net2280_led_active (dev, 1);
1914         ep0_start (dev);
1915
1916         DEBUG (dev, "%s ready, usbctl %08x stdrsp %08x\n",
1917                         driver->driver.name,
1918                         readl (&dev->usb->usbctl),
1919                         readl (&dev->usb->stdrsp));
1920
1921         /* pci writes may still be posted */
1922         return 0;
1923
1924 err_func:
1925         device_remove_file (&dev->pdev->dev, &dev_attr_function);
1926 err_unbind:
1927         driver->unbind (&dev->gadget);
1928         dev->gadget.dev.driver = NULL;
1929         dev->driver = NULL;
1930         return retval;
1931 }
1932
1933 static void
1934 stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
1935 {
1936         int                     i;
1937
1938         /* don't disconnect if it's not connected */
1939         if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1940                 driver = NULL;
1941
1942         /* stop hardware; prevent new request submissions;
1943          * and kill any outstanding requests.
1944          */
1945         usb_reset (dev);
1946         for (i = 0; i < 7; i++)
1947                 nuke (&dev->ep [i]);
1948
1949         /* report disconnect; the driver is already quiesced */
1950         if (driver) {
1951                 spin_unlock(&dev->lock);
1952                 driver->disconnect(&dev->gadget);
1953                 spin_lock(&dev->lock);
1954         }
1955
1956         usb_reinit (dev);
1957 }
1958
1959 static int net2280_stop(struct usb_gadget *_gadget,
1960                 struct usb_gadget_driver *driver)
1961 {
1962         struct net2280  *dev;
1963         unsigned long   flags;
1964
1965         dev = container_of (_gadget, struct net2280, gadget);
1966
1967         spin_lock_irqsave (&dev->lock, flags);
1968         stop_activity (dev, driver);
1969         spin_unlock_irqrestore (&dev->lock, flags);
1970
1971         dev->gadget.dev.driver = NULL;
1972         dev->driver = NULL;
1973
1974         net2280_led_active (dev, 0);
1975
1976         /* Disable full-speed test mode */
1977         writel(0, &dev->usb->xcvrdiag);
1978
1979         device_remove_file (&dev->pdev->dev, &dev_attr_function);
1980         device_remove_file (&dev->pdev->dev, &dev_attr_queues);
1981
1982         DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
1983         return 0;
1984 }
1985
1986 /*-------------------------------------------------------------------------*/
1987
1988 /* handle ep0, ep-e, ep-f with 64 byte packets: packet per irq.
1989  * also works for dma-capable endpoints, in pio mode or just
1990  * to manually advance the queue after short OUT transfers.
1991  */
1992 static void handle_ep_small (struct net2280_ep *ep)
1993 {
1994         struct net2280_request  *req;
1995         u32                     t;
1996         /* 0 error, 1 mid-data, 2 done */
1997         int                     mode = 1;
1998
1999         if (!list_empty (&ep->queue))
2000                 req = list_entry (ep->queue.next,
2001                         struct net2280_request, queue);
2002         else
2003                 req = NULL;
2004
2005         /* ack all, and handle what we care about */
2006         t = readl (&ep->regs->ep_stat);
2007         ep->irqs++;
2008 #if 0
2009         VDEBUG (ep->dev, "%s ack ep_stat %08x, req %p\n",
2010                         ep->ep.name, t, req ? &req->req : 0);
2011 #endif
2012         if (!ep->is_in || ep->dev->pdev->device == 0x2280)
2013                 writel (t & ~(1 << NAK_OUT_PACKETS), &ep->regs->ep_stat);
2014         else
2015                 /* Added for 2282 */
2016                 writel (t, &ep->regs->ep_stat);
2017
2018         /* for ep0, monitor token irqs to catch data stage length errors
2019          * and to synchronize on status.
2020          *
2021          * also, to defer reporting of protocol stalls ... here's where
2022          * data or status first appears, handling stalls here should never
2023          * cause trouble on the host side..
2024          *
2025          * control requests could be slightly faster without token synch for
2026          * status, but status can jam up that way.
2027          */
2028         if (unlikely (ep->num == 0)) {
2029                 if (ep->is_in) {
2030                         /* status; stop NAKing */
2031                         if (t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)) {
2032                                 if (ep->dev->protocol_stall) {
2033                                         ep->stopped = 1;
2034                                         set_halt (ep);
2035                                 }
2036                                 if (!req)
2037                                         allow_status (ep);
2038                                 mode = 2;
2039                         /* reply to extra IN data tokens with a zlp */
2040                         } else if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2041                                 if (ep->dev->protocol_stall) {
2042                                         ep->stopped = 1;
2043                                         set_halt (ep);
2044                                         mode = 2;
2045                                 } else if (ep->responded &&
2046                                                 !req && !ep->stopped)
2047                                         write_fifo (ep, NULL);
2048                         }
2049                 } else {
2050                         /* status; stop NAKing */
2051                         if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2052                                 if (ep->dev->protocol_stall) {
2053                                         ep->stopped = 1;
2054                                         set_halt (ep);
2055                                 }
2056                                 mode = 2;
2057                         /* an extra OUT token is an error */
2058                         } else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
2059                                         && req
2060                                         && req->req.actual == req->req.length)
2061                                         || (ep->responded && !req)) {
2062                                 ep->dev->protocol_stall = 1;
2063                                 set_halt (ep);
2064                                 ep->stopped = 1;
2065                                 if (req)
2066                                         done (ep, req, -EOVERFLOW);
2067                                 req = NULL;
2068                         }
2069                 }
2070         }
2071
2072         if (unlikely (!req))
2073                 return;
2074
2075         /* manual DMA queue advance after short OUT */
2076         if (likely (ep->dma != 0)) {
2077                 if (t & (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)) {
2078                         u32     count;
2079                         int     stopped = ep->stopped;
2080
2081                         /* TRANSFERRED works around OUT_DONE erratum 0112.
2082                          * we expect (N <= maxpacket) bytes; host wrote M.
2083                          * iff (M < N) we won't ever see a DMA interrupt.
2084                          */
2085                         ep->stopped = 1;
2086                         for (count = 0; ; t = readl (&ep->regs->ep_stat)) {
2087
2088                                 /* any preceding dma transfers must finish.
2089                                  * dma handles (M >= N), may empty the queue
2090                                  */
2091                                 scan_dma_completions (ep);
2092                                 if (unlikely (list_empty (&ep->queue)
2093                                                 || ep->out_overflow)) {
2094                                         req = NULL;
2095                                         break;
2096                                 }
2097                                 req = list_entry (ep->queue.next,
2098                                         struct net2280_request, queue);
2099
2100                                 /* here either (M < N), a "real" short rx;
2101                                  * or (M == N) and the queue didn't empty
2102                                  */
2103                                 if (likely (t & (1 << FIFO_EMPTY))) {
2104                                         count = readl (&ep->dma->dmacount);
2105                                         count &= DMA_BYTE_COUNT_MASK;
2106                                         if (readl (&ep->dma->dmadesc)
2107                                                         != req->td_dma)
2108                                                 req = NULL;
2109                                         break;
2110                                 }
2111                                 udelay(1);
2112                         }
2113
2114                         /* stop DMA, leave ep NAKing */
2115                         writel ((1 << DMA_ABORT), &ep->dma->dmastat);
2116                         spin_stop_dma (ep->dma);
2117
2118                         if (likely (req)) {
2119                                 req->td->dmacount = 0;
2120                                 t = readl (&ep->regs->ep_avail);
2121                                 dma_done (ep, req, count,
2122                                         (ep->out_overflow || t)
2123                                                 ? -EOVERFLOW : 0);
2124                         }
2125
2126                         /* also flush to prevent erratum 0106 trouble */
2127                         if (unlikely (ep->out_overflow
2128                                         || (ep->dev->chiprev == 0x0100
2129                                                 && ep->dev->gadget.speed
2130                                                         == USB_SPEED_FULL))) {
2131                                 out_flush (ep);
2132                                 ep->out_overflow = 0;
2133                         }
2134
2135                         /* (re)start dma if needed, stop NAKing */
2136                         ep->stopped = stopped;
2137                         if (!list_empty (&ep->queue))
2138                                 restart_dma (ep);
2139                 } else
2140                         DEBUG (ep->dev, "%s dma ep_stat %08x ??\n",
2141                                         ep->ep.name, t);
2142                 return;
2143
2144         /* data packet(s) received (in the fifo, OUT) */
2145         } else if (t & (1 << DATA_PACKET_RECEIVED_INTERRUPT)) {
2146                 if (read_fifo (ep, req) && ep->num != 0)
2147                         mode = 2;
2148
2149         /* data packet(s) transmitted (IN) */
2150         } else if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)) {
2151                 unsigned        len;
2152
2153                 len = req->req.length - req->req.actual;
2154                 if (len > ep->ep.maxpacket)
2155                         len = ep->ep.maxpacket;
2156                 req->req.actual += len;
2157
2158                 /* if we wrote it all, we're usually done */
2159                 if (req->req.actual == req->req.length) {
2160                         if (ep->num == 0) {
2161                                 /* send zlps until the status stage */
2162                         } else if (!req->req.zero || len != ep->ep.maxpacket)
2163                                 mode = 2;
2164                 }
2165
2166         /* there was nothing to do ...  */
2167         } else if (mode == 1)
2168                 return;
2169
2170         /* done */
2171         if (mode == 2) {
2172                 /* stream endpoints often resubmit/unlink in completion */
2173                 done (ep, req, 0);
2174
2175                 /* maybe advance queue to next request */
2176                 if (ep->num == 0) {
2177                         /* NOTE:  net2280 could let gadget driver start the
2178                          * status stage later. since not all controllers let
2179                          * them control that, the api doesn't (yet) allow it.
2180                          */
2181                         if (!ep->stopped)
2182                                 allow_status (ep);
2183                         req = NULL;
2184                 } else {
2185                         if (!list_empty (&ep->queue) && !ep->stopped)
2186                                 req = list_entry (ep->queue.next,
2187                                         struct net2280_request, queue);
2188                         else
2189                                 req = NULL;
2190                         if (req && !ep->is_in)
2191                                 stop_out_naking (ep);
2192                 }
2193         }
2194
2195         /* is there a buffer for the next packet?
2196          * for best streaming performance, make sure there is one.
2197          */
2198         if (req && !ep->stopped) {
2199
2200                 /* load IN fifo with next packet (may be zlp) */
2201                 if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT))
2202                         write_fifo (ep, &req->req);
2203         }
2204 }
2205
2206 static struct net2280_ep *
2207 get_ep_by_addr (struct net2280 *dev, u16 wIndex)
2208 {
2209         struct net2280_ep       *ep;
2210
2211         if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
2212                 return &dev->ep [0];
2213         list_for_each_entry (ep, &dev->gadget.ep_list, ep.ep_list) {
2214                 u8      bEndpointAddress;
2215
2216                 if (!ep->desc)
2217                         continue;
2218                 bEndpointAddress = ep->desc->bEndpointAddress;
2219                 if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
2220                         continue;
2221                 if ((wIndex & 0x0f) == (bEndpointAddress & 0x0f))
2222                         return ep;
2223         }
2224         return NULL;
2225 }
2226
2227 static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
2228 {
2229         struct net2280_ep       *ep;
2230         u32                     num, scratch;
2231
2232         /* most of these don't need individual acks */
2233         stat &= ~(1 << INTA_ASSERTED);
2234         if (!stat)
2235                 return;
2236         // DEBUG (dev, "irqstat0 %04x\n", stat);
2237
2238         /* starting a control request? */
2239         if (unlikely (stat & (1 << SETUP_PACKET_INTERRUPT))) {
2240                 union {
2241                         u32                     raw [2];
2242                         struct usb_ctrlrequest  r;
2243                 } u;
2244                 int                             tmp;
2245                 struct net2280_request          *req;
2246
2247                 if (dev->gadget.speed == USB_SPEED_UNKNOWN) {
2248                         if (readl (&dev->usb->usbstat) & (1 << HIGH_SPEED))
2249                                 dev->gadget.speed = USB_SPEED_HIGH;
2250                         else
2251                                 dev->gadget.speed = USB_SPEED_FULL;
2252                         net2280_led_speed (dev, dev->gadget.speed);
2253                         DEBUG(dev, "%s\n", usb_speed_string(dev->gadget.speed));
2254                 }
2255
2256                 ep = &dev->ep [0];
2257                 ep->irqs++;
2258
2259                 /* make sure any leftover request state is cleared */
2260                 stat &= ~(1 << ENDPOINT_0_INTERRUPT);
2261                 while (!list_empty (&ep->queue)) {
2262                         req = list_entry (ep->queue.next,
2263                                         struct net2280_request, queue);
2264                         done (ep, req, (req->req.actual == req->req.length)
2265                                                 ? 0 : -EPROTO);
2266                 }
2267                 ep->stopped = 0;
2268                 dev->protocol_stall = 0;
2269
2270                 if (ep->dev->pdev->device == 0x2280)
2271                         tmp = (1 << FIFO_OVERFLOW)
2272                                 | (1 << FIFO_UNDERFLOW);
2273                 else
2274                         tmp = 0;
2275
2276                 writel (tmp | (1 << TIMEOUT)
2277                         | (1 << USB_STALL_SENT)
2278                         | (1 << USB_IN_NAK_SENT)
2279                         | (1 << USB_IN_ACK_RCVD)
2280                         | (1 << USB_OUT_PING_NAK_SENT)
2281                         | (1 << USB_OUT_ACK_SENT)
2282                         | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
2283                         | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
2284                         | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2285                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2286                         | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2287                         | (1 << DATA_IN_TOKEN_INTERRUPT)
2288                         , &ep->regs->ep_stat);
2289                 u.raw [0] = readl (&dev->usb->setup0123);
2290                 u.raw [1] = readl (&dev->usb->setup4567);
2291
2292                 cpu_to_le32s (&u.raw [0]);
2293                 cpu_to_le32s (&u.raw [1]);
2294
2295                 tmp = 0;
2296
2297 #define w_value         le16_to_cpu(u.r.wValue)
2298 #define w_index         le16_to_cpu(u.r.wIndex)
2299 #define w_length        le16_to_cpu(u.r.wLength)
2300
2301                 /* ack the irq */
2302                 writel (1 << SETUP_PACKET_INTERRUPT, &dev->regs->irqstat0);
2303                 stat ^= (1 << SETUP_PACKET_INTERRUPT);
2304
2305                 /* watch control traffic at the token level, and force
2306                  * synchronization before letting the status stage happen.
2307                  * FIXME ignore tokens we'll NAK, until driver responds.
2308                  * that'll mean a lot less irqs for some drivers.
2309                  */
2310                 ep->is_in = (u.r.bRequestType & USB_DIR_IN) != 0;
2311                 if (ep->is_in) {
2312                         scratch = (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2313                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2314                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2315                         stop_out_naking (ep);
2316                 } else
2317                         scratch = (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2318                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2319                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2320                 writel (scratch, &dev->epregs [0].ep_irqenb);
2321
2322                 /* we made the hardware handle most lowlevel requests;
2323                  * everything else goes uplevel to the gadget code.
2324                  */
2325                 ep->responded = 1;
2326                 switch (u.r.bRequest) {
2327                 case USB_REQ_GET_STATUS: {
2328                         struct net2280_ep       *e;
2329                         __le32                  status;
2330
2331                         /* hw handles device and interface status */
2332                         if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
2333                                 goto delegate;
2334                         if ((e = get_ep_by_addr (dev, w_index)) == 0
2335                                         || w_length > 2)
2336                                 goto do_stall;
2337
2338                         if (readl (&e->regs->ep_rsp)
2339                                         & (1 << SET_ENDPOINT_HALT))
2340                                 status = cpu_to_le32 (1);
2341                         else
2342                                 status = cpu_to_le32 (0);
2343
2344                         /* don't bother with a request object! */
2345                         writel (0, &dev->epregs [0].ep_irqenb);
2346                         set_fifo_bytecount (ep, w_length);
2347                         writel ((__force u32)status, &dev->epregs [0].ep_data);
2348                         allow_status (ep);
2349                         VDEBUG (dev, "%s stat %02x\n", ep->ep.name, status);
2350                         goto next_endpoints;
2351                         }
2352                         break;
2353                 case USB_REQ_CLEAR_FEATURE: {
2354                         struct net2280_ep       *e;
2355
2356                         /* hw handles device features */
2357                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2358                                 goto delegate;
2359                         if (w_value != USB_ENDPOINT_HALT
2360                                         || w_length != 0)
2361                                 goto do_stall;
2362                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2363                                 goto do_stall;
2364                         if (e->wedged) {
2365                                 VDEBUG(dev, "%s wedged, halt not cleared\n",
2366                                                 ep->ep.name);
2367                         } else {
2368                                 VDEBUG(dev, "%s clear halt\n", ep->ep.name);
2369                                 clear_halt(e);
2370                         }
2371                         allow_status (ep);
2372                         goto next_endpoints;
2373                         }
2374                         break;
2375                 case USB_REQ_SET_FEATURE: {
2376                         struct net2280_ep       *e;
2377
2378                         /* hw handles device features */
2379                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2380                                 goto delegate;
2381                         if (w_value != USB_ENDPOINT_HALT
2382                                         || w_length != 0)
2383                                 goto do_stall;
2384                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2385                                 goto do_stall;
2386                         if (e->ep.name == ep0name)
2387                                 goto do_stall;
2388                         set_halt (e);
2389                         allow_status (ep);
2390                         VDEBUG (dev, "%s set halt\n", ep->ep.name);
2391                         goto next_endpoints;
2392                         }
2393                         break;
2394                 default:
2395 delegate:
2396                         VDEBUG (dev, "setup %02x.%02x v%04x i%04x l%04x "
2397                                 "ep_cfg %08x\n",
2398                                 u.r.bRequestType, u.r.bRequest,
2399                                 w_value, w_index, w_length,
2400                                 readl (&ep->regs->ep_cfg));
2401                         ep->responded = 0;
2402                         spin_unlock (&dev->lock);
2403                         tmp = dev->driver->setup (&dev->gadget, &u.r);
2404                         spin_lock (&dev->lock);
2405                 }
2406
2407                 /* stall ep0 on error */
2408                 if (tmp < 0) {
2409 do_stall:
2410                         VDEBUG (dev, "req %02x.%02x protocol STALL; stat %d\n",
2411                                         u.r.bRequestType, u.r.bRequest, tmp);
2412                         dev->protocol_stall = 1;
2413                 }
2414
2415                 /* some in/out token irq should follow; maybe stall then.
2416                  * driver must queue a request (even zlp) or halt ep0
2417                  * before the host times out.
2418                  */
2419         }
2420
2421 #undef  w_value
2422 #undef  w_index
2423 #undef  w_length
2424
2425 next_endpoints:
2426         /* endpoint data irq ? */
2427         scratch = stat & 0x7f;
2428         stat &= ~0x7f;
2429         for (num = 0; scratch; num++) {
2430                 u32             t;
2431
2432                 /* do this endpoint's FIFO and queue need tending? */
2433                 t = 1 << num;
2434                 if ((scratch & t) == 0)
2435                         continue;
2436                 scratch ^= t;
2437
2438                 ep = &dev->ep [num];
2439                 handle_ep_small (ep);
2440         }
2441
2442         if (stat)
2443                 DEBUG (dev, "unhandled irqstat0 %08x\n", stat);
2444 }
2445
2446 #define DMA_INTERRUPTS ( \
2447                   (1 << DMA_D_INTERRUPT) \
2448                 | (1 << DMA_C_INTERRUPT) \
2449                 | (1 << DMA_B_INTERRUPT) \
2450                 | (1 << DMA_A_INTERRUPT))
2451 #define PCI_ERROR_INTERRUPTS ( \
2452                   (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT) \
2453                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT) \
2454                 | (1 << PCI_RETRY_ABORT_INTERRUPT))
2455
2456 static void handle_stat1_irqs (struct net2280 *dev, u32 stat)
2457 {
2458         struct net2280_ep       *ep;
2459         u32                     tmp, num, mask, scratch;
2460
2461         /* after disconnect there's nothing else to do! */
2462         tmp = (1 << VBUS_INTERRUPT) | (1 << ROOT_PORT_RESET_INTERRUPT);
2463         mask = (1 << HIGH_SPEED) | (1 << FULL_SPEED);
2464
2465         /* VBUS disconnect is indicated by VBUS_PIN and VBUS_INTERRUPT set.
2466          * Root Port Reset is indicated by ROOT_PORT_RESET_INTERRUPT set and
2467          * both HIGH_SPEED and FULL_SPEED clear (as ROOT_PORT_RESET_INTERRUPT
2468          * only indicates a change in the reset state).
2469          */
2470         if (stat & tmp) {
2471                 writel (tmp, &dev->regs->irqstat1);
2472                 if ((((stat & (1 << ROOT_PORT_RESET_INTERRUPT))
2473                                         && ((readl (&dev->usb->usbstat) & mask)
2474                                                         == 0))
2475                                 || ((readl (&dev->usb->usbctl)
2476                                         & (1 << VBUS_PIN)) == 0)
2477                             ) && ( dev->gadget.speed != USB_SPEED_UNKNOWN)) {
2478                         DEBUG (dev, "disconnect %s\n",
2479                                         dev->driver->driver.name);
2480                         stop_activity (dev, dev->driver);
2481                         ep0_start (dev);
2482                         return;
2483                 }
2484                 stat &= ~tmp;
2485
2486                 /* vBUS can bounce ... one of many reasons to ignore the
2487                  * notion of hotplug events on bus connect/disconnect!
2488                  */
2489                 if (!stat)
2490                         return;
2491         }
2492
2493         /* NOTE: chip stays in PCI D0 state for now, but it could
2494          * enter D1 to save more power
2495          */
2496         tmp = (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT);
2497         if (stat & tmp) {
2498                 writel (tmp, &dev->regs->irqstat1);
2499                 if (stat & (1 << SUSPEND_REQUEST_INTERRUPT)) {
2500                         if (dev->driver->suspend)
2501                                 dev->driver->suspend (&dev->gadget);
2502                         if (!enable_suspend)
2503                                 stat &= ~(1 << SUSPEND_REQUEST_INTERRUPT);
2504                 } else {
2505                         if (dev->driver->resume)
2506                                 dev->driver->resume (&dev->gadget);
2507                         /* at high speed, note erratum 0133 */
2508                 }
2509                 stat &= ~tmp;
2510         }
2511
2512         /* clear any other status/irqs */
2513         if (stat)
2514                 writel (stat, &dev->regs->irqstat1);
2515
2516         /* some status we can just ignore */
2517         if (dev->pdev->device == 0x2280)
2518                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2519                           | (1 << SUSPEND_REQUEST_INTERRUPT)
2520                           | (1 << RESUME_INTERRUPT)
2521                           | (1 << SOF_INTERRUPT));
2522         else
2523                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2524                           | (1 << RESUME_INTERRUPT)
2525                           | (1 << SOF_DOWN_INTERRUPT)
2526                           | (1 << SOF_INTERRUPT));
2527
2528         if (!stat)
2529                 return;
2530         // DEBUG (dev, "irqstat1 %08x\n", stat);
2531
2532         /* DMA status, for ep-{a,b,c,d} */
2533         scratch = stat & DMA_INTERRUPTS;
2534         stat &= ~DMA_INTERRUPTS;
2535         scratch >>= 9;
2536         for (num = 0; scratch; num++) {
2537                 struct net2280_dma_regs __iomem *dma;
2538
2539                 tmp = 1 << num;
2540                 if ((tmp & scratch) == 0)
2541                         continue;
2542                 scratch ^= tmp;
2543
2544                 ep = &dev->ep [num + 1];
2545                 dma = ep->dma;
2546
2547                 if (!dma)
2548                         continue;
2549
2550                 /* clear ep's dma status */
2551                 tmp = readl (&dma->dmastat);
2552                 writel (tmp, &dma->dmastat);
2553
2554                 /* chaining should stop on abort, short OUT from fifo,
2555                  * or (stat0 codepath) short OUT transfer.
2556                  */
2557                 if (!use_dma_chaining) {
2558                         if ((tmp & (1 << DMA_TRANSACTION_DONE_INTERRUPT))
2559                                         == 0) {
2560                                 DEBUG (ep->dev, "%s no xact done? %08x\n",
2561                                         ep->ep.name, tmp);
2562                                 continue;
2563                         }
2564                         stop_dma (ep->dma);
2565                 }
2566
2567                 /* OUT transfers terminate when the data from the
2568                  * host is in our memory.  Process whatever's done.
2569                  * On this path, we know transfer's last packet wasn't
2570                  * less than req->length. NAK_OUT_PACKETS may be set,
2571                  * or the FIFO may already be holding new packets.
2572                  *
2573                  * IN transfers can linger in the FIFO for a very
2574                  * long time ... we ignore that for now, accounting
2575                  * precisely (like PIO does) needs per-packet irqs
2576                  */
2577                 scan_dma_completions (ep);
2578
2579                 /* disable dma on inactive queues; else maybe restart */
2580                 if (list_empty (&ep->queue)) {
2581                         if (use_dma_chaining)
2582                                 stop_dma (ep->dma);
2583                 } else {
2584                         tmp = readl (&dma->dmactl);
2585                         if (!use_dma_chaining
2586                                         || (tmp & (1 << DMA_ENABLE)) == 0)
2587                                 restart_dma (ep);
2588                         else if (ep->is_in && use_dma_chaining) {
2589                                 struct net2280_request  *req;
2590                                 __le32                  dmacount;
2591
2592                                 /* the descriptor at the head of the chain
2593                                  * may still have VALID_BIT clear; that's
2594                                  * used to trigger changing DMA_FIFO_VALIDATE
2595                                  * (affects automagic zlp writes).
2596                                  */
2597                                 req = list_entry (ep->queue.next,
2598                                                 struct net2280_request, queue);
2599                                 dmacount = req->td->dmacount;
2600                                 dmacount &= cpu_to_le32 (
2601                                                 (1 << VALID_BIT)
2602                                                 | DMA_BYTE_COUNT_MASK);
2603                                 if (dmacount && (dmacount & valid_bit) == 0)
2604                                         restart_dma (ep);
2605                         }
2606                 }
2607                 ep->irqs++;
2608         }
2609
2610         /* NOTE:  there are other PCI errors we might usefully notice.
2611          * if they appear very often, here's where to try recovering.
2612          */
2613         if (stat & PCI_ERROR_INTERRUPTS) {
2614                 ERROR (dev, "pci dma error; stat %08x\n", stat);
2615                 stat &= ~PCI_ERROR_INTERRUPTS;
2616                 /* these are fatal errors, but "maybe" they won't
2617                  * happen again ...
2618                  */
2619                 stop_activity (dev, dev->driver);
2620                 ep0_start (dev);
2621                 stat = 0;
2622         }
2623
2624         if (stat)
2625                 DEBUG (dev, "unhandled irqstat1 %08x\n", stat);
2626 }
2627
2628 static irqreturn_t net2280_irq (int irq, void *_dev)
2629 {
2630         struct net2280          *dev = _dev;
2631
2632         /* shared interrupt, not ours */
2633         if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
2634                 return IRQ_NONE;
2635
2636         spin_lock (&dev->lock);
2637
2638         /* handle disconnect, dma, and more */
2639         handle_stat1_irqs (dev, readl (&dev->regs->irqstat1));
2640
2641         /* control requests and PIO */
2642         handle_stat0_irqs (dev, readl (&dev->regs->irqstat0));
2643
2644         spin_unlock (&dev->lock);
2645
2646         return IRQ_HANDLED;
2647 }
2648
2649 /*-------------------------------------------------------------------------*/
2650
2651 static void gadget_release (struct device *_dev)
2652 {
2653         struct net2280  *dev = dev_get_drvdata (_dev);
2654
2655         kfree (dev);
2656 }
2657
2658 /* tear down the binding between this driver and the pci device */
2659
2660 static void net2280_remove (struct pci_dev *pdev)
2661 {
2662         struct net2280          *dev = pci_get_drvdata (pdev);
2663
2664         usb_del_gadget_udc(&dev->gadget);
2665
2666         BUG_ON(dev->driver);
2667
2668         /* then clean up the resources we allocated during probe() */
2669         net2280_led_shutdown (dev);
2670         if (dev->requests) {
2671                 int             i;
2672                 for (i = 1; i < 5; i++) {
2673                         if (!dev->ep [i].dummy)
2674                                 continue;
2675                         pci_pool_free (dev->requests, dev->ep [i].dummy,
2676                                         dev->ep [i].td_dma);
2677                 }
2678                 pci_pool_destroy (dev->requests);
2679         }
2680         if (dev->got_irq)
2681                 free_irq (pdev->irq, dev);
2682         if (dev->regs)
2683                 iounmap (dev->regs);
2684         if (dev->region)
2685                 release_mem_region (pci_resource_start (pdev, 0),
2686                                 pci_resource_len (pdev, 0));
2687         if (dev->enabled)
2688                 pci_disable_device (pdev);
2689         device_unregister (&dev->gadget.dev);
2690         device_remove_file (&pdev->dev, &dev_attr_registers);
2691         pci_set_drvdata (pdev, NULL);
2692
2693         INFO (dev, "unbind\n");
2694 }
2695
2696 /* wrap this driver around the specified device, but
2697  * don't respond over USB until a gadget driver binds to us.
2698  */
2699
2700 static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
2701 {
2702         struct net2280          *dev;
2703         unsigned long           resource, len;
2704         void                    __iomem *base = NULL;
2705         int                     retval, i;
2706
2707         /* alloc, and start init */
2708         dev = kzalloc (sizeof *dev, GFP_KERNEL);
2709         if (dev == NULL){
2710                 retval = -ENOMEM;
2711                 goto done;
2712         }
2713
2714         pci_set_drvdata (pdev, dev);
2715         spin_lock_init (&dev->lock);
2716         dev->pdev = pdev;
2717         dev->gadget.ops = &net2280_ops;
2718         dev->gadget.max_speed = USB_SPEED_HIGH;
2719
2720         /* the "gadget" abstracts/virtualizes the controller */
2721         dev_set_name(&dev->gadget.dev, "gadget");
2722         dev->gadget.dev.parent = &pdev->dev;
2723         dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
2724         dev->gadget.dev.release = gadget_release;
2725         dev->gadget.name = driver_name;
2726
2727         /* now all the pci goodies ... */
2728         if (pci_enable_device (pdev) < 0) {
2729                 retval = -ENODEV;
2730                 goto done;
2731         }
2732         dev->enabled = 1;
2733
2734         /* BAR 0 holds all the registers
2735          * BAR 1 is 8051 memory; unused here (note erratum 0103)
2736          * BAR 2 is fifo memory; unused here
2737          */
2738         resource = pci_resource_start (pdev, 0);
2739         len = pci_resource_len (pdev, 0);
2740         if (!request_mem_region (resource, len, driver_name)) {
2741                 DEBUG (dev, "controller already in use\n");
2742                 retval = -EBUSY;
2743                 goto done;
2744         }
2745         dev->region = 1;
2746
2747         /* FIXME provide firmware download interface to put
2748          * 8051 code into the chip, e.g. to turn on PCI PM.
2749          */
2750
2751         base = ioremap_nocache (resource, len);
2752         if (base == NULL) {
2753                 DEBUG (dev, "can't map memory\n");
2754                 retval = -EFAULT;
2755                 goto done;
2756         }
2757         dev->regs = (struct net2280_regs __iomem *) base;
2758         dev->usb = (struct net2280_usb_regs __iomem *) (base + 0x0080);
2759         dev->pci = (struct net2280_pci_regs __iomem *) (base + 0x0100);
2760         dev->dma = (struct net2280_dma_regs __iomem *) (base + 0x0180);
2761         dev->dep = (struct net2280_dep_regs __iomem *) (base + 0x0200);
2762         dev->epregs = (struct net2280_ep_regs __iomem *) (base + 0x0300);
2763
2764         /* put into initial config, link up all endpoints */
2765         writel (0, &dev->usb->usbctl);
2766         usb_reset (dev);
2767         usb_reinit (dev);
2768
2769         /* irq setup after old hardware is cleaned up */
2770         if (!pdev->irq) {
2771                 ERROR (dev, "No IRQ.  Check PCI setup!\n");
2772                 retval = -ENODEV;
2773                 goto done;
2774         }
2775
2776         if (request_irq (pdev->irq, net2280_irq, IRQF_SHARED, driver_name, dev)
2777                         != 0) {
2778                 ERROR (dev, "request interrupt %d failed\n", pdev->irq);
2779                 retval = -EBUSY;
2780                 goto done;
2781         }
2782         dev->got_irq = 1;
2783
2784         /* DMA setup */
2785         /* NOTE:  we know only the 32 LSBs of dma addresses may be nonzero */
2786         dev->requests = pci_pool_create ("requests", pdev,
2787                 sizeof (struct net2280_dma),
2788                 0 /* no alignment requirements */,
2789                 0 /* or page-crossing issues */);
2790         if (!dev->requests) {
2791                 DEBUG (dev, "can't get request pool\n");
2792                 retval = -ENOMEM;
2793                 goto done;
2794         }
2795         for (i = 1; i < 5; i++) {
2796                 struct net2280_dma      *td;
2797
2798                 td = pci_pool_alloc (dev->requests, GFP_KERNEL,
2799                                 &dev->ep [i].td_dma);
2800                 if (!td) {
2801                         DEBUG (dev, "can't get dummy %d\n", i);
2802                         retval = -ENOMEM;
2803                         goto done;
2804                 }
2805                 td->dmacount = 0;       /* not VALID */
2806                 td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
2807                 td->dmadesc = td->dmaaddr;
2808                 dev->ep [i].dummy = td;
2809         }
2810
2811         /* enable lower-overhead pci memory bursts during DMA */
2812         writel ( (1 << DMA_MEMORY_WRITE_AND_INVALIDATE_ENABLE)
2813                         // 256 write retries may not be enough...
2814                         // | (1 << PCI_RETRY_ABORT_ENABLE)
2815                         | (1 << DMA_READ_MULTIPLE_ENABLE)
2816                         | (1 << DMA_READ_LINE_ENABLE)
2817                         , &dev->pci->pcimstctl);
2818         /* erratum 0115 shouldn't appear: Linux inits PCI_LATENCY_TIMER */
2819         pci_set_master (pdev);
2820         pci_try_set_mwi (pdev);
2821
2822         /* ... also flushes any posted pci writes */
2823         dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
2824
2825         /* done */
2826         INFO (dev, "%s\n", driver_desc);
2827         INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
2828                         pdev->irq, base, dev->chiprev);
2829         INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
2830                         use_dma
2831                                 ? (use_dma_chaining ? "chaining" : "enabled")
2832                                 : "disabled");
2833         retval = device_register (&dev->gadget.dev);
2834         if (retval) goto done;
2835         retval = device_create_file (&pdev->dev, &dev_attr_registers);
2836         if (retval) goto done;
2837
2838         retval = usb_add_gadget_udc(&pdev->dev, &dev->gadget);
2839         if (retval)
2840                 goto done;
2841         return 0;
2842
2843 done:
2844         if (dev)
2845                 net2280_remove (pdev);
2846         return retval;
2847 }
2848
2849 /* make sure the board is quiescent; otherwise it will continue
2850  * generating IRQs across the upcoming reboot.
2851  */
2852
2853 static void net2280_shutdown (struct pci_dev *pdev)
2854 {
2855         struct net2280          *dev = pci_get_drvdata (pdev);
2856
2857         /* disable IRQs */
2858         writel (0, &dev->regs->pciirqenb0);
2859         writel (0, &dev->regs->pciirqenb1);
2860
2861         /* disable the pullup so the host will think we're gone */
2862         writel (0, &dev->usb->usbctl);
2863
2864         /* Disable full-speed test mode */
2865         writel(0, &dev->usb->xcvrdiag);
2866 }
2867
2868
2869 /*-------------------------------------------------------------------------*/
2870
2871 static const struct pci_device_id pci_ids [] = { {
2872         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2873         .class_mask =   ~0,
2874         .vendor =       0x17cc,
2875         .device =       0x2280,
2876         .subvendor =    PCI_ANY_ID,
2877         .subdevice =    PCI_ANY_ID,
2878 }, {
2879         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2880         .class_mask =   ~0,
2881         .vendor =       0x17cc,
2882         .device =       0x2282,
2883         .subvendor =    PCI_ANY_ID,
2884         .subdevice =    PCI_ANY_ID,
2885
2886 }, { /* end: all zeroes */ }
2887 };
2888 MODULE_DEVICE_TABLE (pci, pci_ids);
2889
2890 /* pci driver glue; this is a "new style" PCI driver module */
2891 static struct pci_driver net2280_pci_driver = {
2892         .name =         (char *) driver_name,
2893         .id_table =     pci_ids,
2894
2895         .probe =        net2280_probe,
2896         .remove =       net2280_remove,
2897         .shutdown =     net2280_shutdown,
2898
2899         /* FIXME add power management support */
2900 };
2901
2902 MODULE_DESCRIPTION (DRIVER_DESC);
2903 MODULE_AUTHOR ("David Brownell");
2904 MODULE_LICENSE ("GPL");
2905
2906 static int __init init (void)
2907 {
2908         if (!use_dma)
2909                 use_dma_chaining = 0;
2910         return pci_register_driver (&net2280_pci_driver);
2911 }
2912 module_init (init);
2913
2914 static void __exit cleanup (void)
2915 {
2916         pci_unregister_driver (&net2280_pci_driver);
2917 }
2918 module_exit (cleanup);