drivers/usb/gadget/net2280.c

   1 /*
   2  * Driver for the PLX NET2280 USB device controller.
   3  * Specs and errata are available from <http://www.plxtech.com>.
   4  *
   5  * PLX Technology Inc. (formerly NetChip Technology) supported the
   6  * development of this driver.
   7  *
   8  *
   9  * CODE STATUS HIGHLIGHTS
  10  *
  11  * This driver should work well with most "gadget" drivers, including
  12  * the File Storage, Serial, and Ethernet/RNDIS gadget drivers
  13  * as well as Gadget Zero and Gadgetfs.
  14  *
  15  * DMA is enabled by default.  Drivers using transfer queues might use
  16  * DMA chaining to remove IRQ latencies between transfers.  (Except when
  17  * short OUT transfers happen.)  Drivers can use the req->no_interrupt
  18  * hint to completely eliminate some IRQs, if a later IRQ is guaranteed
  19  * and DMA chaining is enabled.
  20  *
  21  * Note that almost all the errata workarounds here are only needed for
  22  * rev1 chips.  Rev1a silicon (0110) fixes almost all of them.
  23  */
  24
  25 /*
  26  * Copyright (C) 2003 David Brownell
  27  * Copyright (C) 2003-2005 PLX Technology, Inc.
  28  *
  29  * Modified Seth Levy 2005 PLX Technology, Inc. to provide compatibility
  30  *      with 2282 chip
  31  *
  32  * This program is free software; you can redistribute it and/or modify
  33  * it under the terms of the GNU General Public License as published by
  34  * the Free Software Foundation; either version 2 of the License, or
  35  * (at your option) any later version.
  36  *
  37  * This program is distributed in the hope that it will be useful,
  38  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  39  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  40  * GNU General Public License for more details.
  41  *
  42  * You should have received a copy of the GNU General Public License
  43  * along with this program; if not, write to the Free Software
  44  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  45  */
  46
  47 #undef  DEBUG           /* messages on error and most fault paths */
  48 #undef  VERBOSE         /* extra debug messages (success too) */
  49
  50 #include <linux/module.h>
  51 #include <linux/pci.h>
  52 #include <linux/dma-mapping.h>
  53 #include <linux/kernel.h>
  54 #include <linux/delay.h>
  55 #include <linux/ioport.h>
  56 #include <linux/slab.h>
  57 #include <linux/errno.h>
  58 #include <linux/init.h>
  59 #include <linux/timer.h>
  60 #include <linux/list.h>
  61 #include <linux/interrupt.h>
  62 #include <linux/moduleparam.h>
  63 #include <linux/device.h>
  64 #include <linux/usb/ch9.h>
  65 #include <linux/usb/gadget.h>
  66 #include <linux/prefetch.h>
  67
  68 #include <asm/byteorder.h>
  69 #include <asm/io.h>
  70 #include <asm/irq.h>
  71 #include <asm/system.h>
  72 #include <asm/unaligned.h>
  73
  74
  75 #define DRIVER_DESC             "PLX NET228x USB Peripheral Controller"
  76 #define DRIVER_VERSION          "2005 Sept 27"
  77
  78 #define DMA_ADDR_INVALID        (~(dma_addr_t)0)
  79 #define EP_DONTUSE              13      /* nonzero */
  80
  81 #define USE_RDK_LEDS            /* GPIO pins control three LEDs */
  82
  83
  84 static const char driver_name [] = "net2280";
  85 static const char driver_desc [] = DRIVER_DESC;
  86
  87 static const char ep0name [] = "ep0";
  88 static const char *const ep_name [] = {
  89         ep0name,
  90         "ep-a", "ep-b", "ep-c", "ep-d",
  91         "ep-e", "ep-f",
  92 };
  93
  94 /* use_dma -- general goodness, fewer interrupts, less cpu load (vs PIO)
  95  * use_dma_chaining -- dma descriptor queueing gives even more irq reduction
  96  *
  97  * The net2280 DMA engines are not tightly integrated with their FIFOs;
  98  * not all cases are (yet) handled well in this driver or the silicon.
  99  * Some gadget drivers work better with the dma support here than others.
 100  * These two parameters let you use PIO or more aggressive DMA.
 101  */
 102 static int use_dma = 1;
 103 static int use_dma_chaining = 0;
 104
 105 /* "modprobe net2280 use_dma=n" etc */
 106 module_param (use_dma, bool, S_IRUGO);
 107 module_param (use_dma_chaining, bool, S_IRUGO);
 108
 109
 110 /* mode 0 == ep-{a,b,c,d} 1K fifo each
 111  * mode 1 == ep-{a,b} 2K fifo each, ep-{c,d} unavailable
 112  * mode 2 == ep-a 2K fifo, ep-{b,c} 1K each, ep-d unavailable
 113  */
 114 static ushort fifo_mode = 0;
 115
 116 /* "modprobe net2280 fifo_mode=1" etc */
 117 module_param (fifo_mode, ushort, 0644);
 118
 119 /* enable_suspend -- When enabled, the driver will respond to
 120  * USB suspend requests by powering down the NET2280.  Otherwise,
 121  * USB suspend requests will be ignored.  This is acceptable for
 122  * self-powered devices
 123  */
 124 static int enable_suspend = 0;
 125
 126 /* "modprobe net2280 enable_suspend=1" etc */
 127 module_param (enable_suspend, bool, S_IRUGO);
 128
 129
 130 #define DIR_STRING(bAddress) (((bAddress) & USB_DIR_IN) ? "in" : "out")
 131
 132 #if defined(CONFIG_USB_GADGET_DEBUG_FILES) || defined (DEBUG)
 133 static char *type_string (u8 bmAttributes)
 134 {
 135         switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
 136         case USB_ENDPOINT_XFER_BULK:    return "bulk";
 137         case USB_ENDPOINT_XFER_ISOC:    return "iso";
 138         case USB_ENDPOINT_XFER_INT:     return "intr";
 139         };
 140         return "control";
 141 }
 142 #endif
 143
 144 #include "net2280.h"
 145
 146 #define valid_bit       cpu_to_le32 (1 << VALID_BIT)
 147 #define dma_done_ie     cpu_to_le32 (1 << DMA_DONE_INTERRUPT_ENABLE)
 148
 149 /*-------------------------------------------------------------------------*/
 150
 151 static int
 152 net2280_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 153 {
 154         struct net2280          *dev;
 155         struct net2280_ep       *ep;
 156         u32                     max, tmp;
 157         unsigned long           flags;
 158
 159         ep = container_of (_ep, struct net2280_ep, ep);
 160         if (!_ep || !desc || ep->desc || _ep->name == ep0name
 161                         || desc->bDescriptorType != USB_DT_ENDPOINT)
 162                 return -EINVAL;
 163         dev = ep->dev;
 164         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 165                 return -ESHUTDOWN;
 166
 167         /* erratum 0119 workaround ties up an endpoint number */
 168         if ((desc->bEndpointAddress & 0x0f) == EP_DONTUSE)
 169                 return -EDOM;
 170
 171         /* sanity check ep-e/ep-f since their fifos are small */
 172         max = le16_to_cpu (desc->wMaxPacketSize) & 0x1fff;
 173         if (ep->num > 4 && max > 64)
 174                 return -ERANGE;
 175
 176         spin_lock_irqsave (&dev->lock, flags);
 177         _ep->maxpacket = max & 0x7ff;
 178         ep->desc = desc;
 179
 180         /* ep_reset() has already been called */
 181         ep->stopped = 0;
 182         ep->wedged = 0;
 183         ep->out_overflow = 0;
 184
 185         /* set speed-dependent max packet; may kick in high bandwidth */
 186         set_idx_reg (dev->regs, REG_EP_MAXPKT (dev, ep->num), max);
 187
 188         /* FIFO lines can't go to different packets.  PIO is ok, so
 189          * use it instead of troublesome (non-bulk) multi-packet DMA.
 190          */
 191         if (ep->dma && (max % 4) != 0 && use_dma_chaining) {
 192                 DEBUG (ep->dev, "%s, no dma for maxpacket %d\n",
 193                         ep->ep.name, ep->ep.maxpacket);
 194                 ep->dma = NULL;
 195         }
 196
 197         /* set type, direction, address; reset fifo counters */
 198         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
 199         tmp = (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
 200         if (tmp == USB_ENDPOINT_XFER_INT) {
 201                 /* erratum 0105 workaround prevents hs NYET */
 202                 if (dev->chiprev == 0100
 203                                 && dev->gadget.speed == USB_SPEED_HIGH
 204                                 && !(desc->bEndpointAddress & USB_DIR_IN))
 205                         writel ((1 << CLEAR_NAK_OUT_PACKETS_MODE),
 206                                 &ep->regs->ep_rsp);
 207         } else if (tmp == USB_ENDPOINT_XFER_BULK) {
 208                 /* catch some particularly blatant driver bugs */
 209                 if ((dev->gadget.speed == USB_SPEED_HIGH
 210                                         && max != 512)
 211                                 || (dev->gadget.speed == USB_SPEED_FULL
 212                                         && max > 64)) {
 213                         spin_unlock_irqrestore (&dev->lock, flags);
 214                         return -ERANGE;
 215                 }
 216         }
 217         ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC) ? 1 : 0;
 218         tmp <<= ENDPOINT_TYPE;
 219         tmp |= desc->bEndpointAddress;
 220         tmp |= (4 << ENDPOINT_BYTE_COUNT);      /* default full fifo lines */
 221         tmp |= 1 << ENDPOINT_ENABLE;
 222         wmb ();
 223
 224         /* for OUT transfers, block the rx fifo until a read is posted */
 225         ep->is_in = (tmp & USB_DIR_IN) != 0;
 226         if (!ep->is_in)
 227                 writel ((1 << SET_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 228         else if (dev->pdev->device != 0x2280) {
 229                 /* Added for 2282, Don't use nak packets on an in endpoint,
 230                  * this was ignored on 2280
 231                  */
 232                 writel ((1 << CLEAR_NAK_OUT_PACKETS)
 233                         | (1 << CLEAR_NAK_OUT_PACKETS_MODE), &ep->regs->ep_rsp);
 234         }
 235
 236         writel (tmp, &ep->regs->ep_cfg);
 237
 238         /* enable irqs */
 239         if (!ep->dma) {                         /* pio, per-packet */
 240                 tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 241                 writel (tmp, &dev->regs->pciirqenb0);
 242
 243                 tmp = (1 << DATA_PACKET_RECEIVED_INTERRUPT_ENABLE)
 244                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT_ENABLE);
 245                 if (dev->pdev->device == 0x2280)
 246                         tmp |= readl (&ep->regs->ep_irqenb);
 247                 writel (tmp, &ep->regs->ep_irqenb);
 248         } else {                                /* dma, per-request */
 249                 tmp = (1 << (8 + ep->num));     /* completion */
 250                 tmp |= readl (&dev->regs->pciirqenb1);
 251                 writel (tmp, &dev->regs->pciirqenb1);
 252
 253                 /* for short OUT transfers, dma completions can't
 254                  * advance the queue; do it pio-style, by hand.
 255                  * NOTE erratum 0112 workaround #2
 256                  */
 257                 if ((desc->bEndpointAddress & USB_DIR_IN) == 0) {
 258                         tmp = (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT_ENABLE);
 259                         writel (tmp, &ep->regs->ep_irqenb);
 260
 261                         tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 262                         writel (tmp, &dev->regs->pciirqenb0);
 263                 }
 264         }
 265
 266         tmp = desc->bEndpointAddress;
 267         DEBUG (dev, "enabled %s (ep%d%s-%s) %s max %04x\n",
 268                 _ep->name, tmp & 0x0f, DIR_STRING (tmp),
 269                 type_string (desc->bmAttributes),
 270                 ep->dma ? "dma" : "pio", max);
 271
 272         /* pci writes may still be posted */
 273         spin_unlock_irqrestore (&dev->lock, flags);
 274         return 0;
 275 }
 276
 277 static int handshake (u32 __iomem *ptr, u32 mask, u32 done, int usec)
 278 {
 279         u32     result;
 280
 281         do {
 282                 result = readl (ptr);
 283                 if (result == ~(u32)0)          /* "device unplugged" */
 284                         return -ENODEV;
 285                 result &= mask;
 286                 if (result == done)
 287                         return 0;
 288                 udelay (1);
 289                 usec--;
 290         } while (usec > 0);
 291         return -ETIMEDOUT;
 292 }
 293
 294 static const struct usb_ep_ops net2280_ep_ops;
 295
 296 static void ep_reset (struct net2280_regs __iomem *regs, struct net2280_ep *ep)
 297 {
 298         u32             tmp;
 299
 300         ep->desc = NULL;
 301         INIT_LIST_HEAD (&ep->queue);
 302
 303         ep->ep.maxpacket = ~0;
 304         ep->ep.ops = &net2280_ep_ops;
 305
 306         /* disable the dma, irqs, endpoint... */
 307         if (ep->dma) {
 308                 writel (0, &ep->dma->dmactl);
 309                 writel (  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 310                         | (1 << DMA_TRANSACTION_DONE_INTERRUPT)
 311                         | (1 << DMA_ABORT)
 312                         , &ep->dma->dmastat);
 313
 314                 tmp = readl (&regs->pciirqenb0);
 315                 tmp &= ~(1 << ep->num);
 316                 writel (tmp, &regs->pciirqenb0);
 317         } else {
 318                 tmp = readl (&regs->pciirqenb1);
 319                 tmp &= ~(1 << (8 + ep->num));   /* completion */
 320                 writel (tmp, &regs->pciirqenb1);
 321         }
 322         writel (0, &ep->regs->ep_irqenb);
 323
 324         /* init to our chosen defaults, notably so that we NAK OUT
 325          * packets until the driver queues a read (+note erratum 0112)
 326          */
 327         if (!ep->is_in || ep->dev->pdev->device == 0x2280) {
 328                 tmp = (1 << SET_NAK_OUT_PACKETS_MODE)
 329                 | (1 << SET_NAK_OUT_PACKETS)
 330                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 331                 | (1 << CLEAR_INTERRUPT_MODE);
 332         } else {
 333                 /* added for 2282 */
 334                 tmp = (1 << CLEAR_NAK_OUT_PACKETS_MODE)
 335                 | (1 << CLEAR_NAK_OUT_PACKETS)
 336                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 337                 | (1 << CLEAR_INTERRUPT_MODE);
 338         }
 339
 340         if (ep->num != 0) {
 341                 tmp |= (1 << CLEAR_ENDPOINT_TOGGLE)
 342                         | (1 << CLEAR_ENDPOINT_HALT);
 343         }
 344         writel (tmp, &ep->regs->ep_rsp);
 345
 346         /* scrub most status bits, and flush any fifo state */
 347         if (ep->dev->pdev->device == 0x2280)
 348                 tmp = (1 << FIFO_OVERFLOW)
 349                         | (1 << FIFO_UNDERFLOW);
 350         else
 351                 tmp = 0;
 352
 353         writel (tmp | (1 << TIMEOUT)
 354                 | (1 << USB_STALL_SENT)
 355                 | (1 << USB_IN_NAK_SENT)
 356                 | (1 << USB_IN_ACK_RCVD)
 357                 | (1 << USB_OUT_PING_NAK_SENT)
 358                 | (1 << USB_OUT_ACK_SENT)
 359                 | (1 << FIFO_FLUSH)
 360                 | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
 361                 | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
 362                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 363                 | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
 364                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 365                 | (1 << DATA_IN_TOKEN_INTERRUPT)
 366                 , &ep->regs->ep_stat);
 367
 368         /* fifo size is handled separately */
 369 }
 370
 371 static void nuke (struct net2280_ep *);
 372
 373 static int net2280_disable (struct usb_ep *_ep)
 374 {
 375         struct net2280_ep       *ep;
 376         unsigned long           flags;
 377
 378         ep = container_of (_ep, struct net2280_ep, ep);
 379         if (!_ep || !ep->desc || _ep->name == ep0name)
 380                 return -EINVAL;
 381
 382         spin_lock_irqsave (&ep->dev->lock, flags);
 383         nuke (ep);
 384         ep_reset (ep->dev->regs, ep);
 385
 386         VDEBUG (ep->dev, "disabled %s %s\n",
 387                         ep->dma ? "dma" : "pio", _ep->name);
 388
 389         /* synch memory views with the device */
 390         (void) readl (&ep->regs->ep_cfg);
 391
 392         if (use_dma && !ep->dma && ep->num >= 1 && ep->num <= 4)
 393                 ep->dma = &ep->dev->dma [ep->num - 1];
 394
 395         spin_unlock_irqrestore (&ep->dev->lock, flags);
 396         return 0;
 397 }
 398
 399 /*-------------------------------------------------------------------------*/
 400
 401 static struct usb_request *
 402 net2280_alloc_request (struct usb_ep *_ep, gfp_t gfp_flags)
 403 {
 404         struct net2280_ep       *ep;
 405         struct net2280_request  *req;
 406
 407         if (!_ep)
 408                 return NULL;
 409         ep = container_of (_ep, struct net2280_ep, ep);
 410
 411         req = kzalloc(sizeof(*req), gfp_flags);
 412         if (!req)
 413                 return NULL;
 414
 415         req->req.dma = DMA_ADDR_INVALID;
 416         INIT_LIST_HEAD (&req->queue);
 417
 418         /* this dma descriptor may be swapped with the previous dummy */
 419         if (ep->dma) {
 420                 struct net2280_dma      *td;
 421
 422                 td = pci_pool_alloc (ep->dev->requests, gfp_flags,
 423                                 &req->td_dma);
 424                 if (!td) {
 425                         kfree (req);
 426                         return NULL;
 427                 }
 428                 td->dmacount = 0;       /* not VALID */
 429                 td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
 430                 td->dmadesc = td->dmaaddr;
 431                 req->td = td;
 432         }
 433         return &req->req;
 434 }
 435
 436 static void
 437 net2280_free_request (struct usb_ep *_ep, struct usb_request *_req)
 438 {
 439         struct net2280_ep       *ep;
 440         struct net2280_request  *req;
 441
 442         ep = container_of (_ep, struct net2280_ep, ep);
 443         if (!_ep || !_req)
 444                 return;
 445
 446         req = container_of (_req, struct net2280_request, req);
 447         WARN_ON (!list_empty (&req->queue));
 448         if (req->td)
 449                 pci_pool_free (ep->dev->requests, req->td, req->td_dma);
 450         kfree (req);
 451 }
 452
 453 /*-------------------------------------------------------------------------*/
 454
 455 /* load a packet into the fifo we use for usb IN transfers.
 456  * works for all endpoints.
 457  *
 458  * NOTE: pio with ep-a..ep-d could stuff multiple packets into the fifo
 459  * at a time, but this code is simpler because it knows it only writes
 460  * one packet.  ep-a..ep-d should use dma instead.
 461  */
 462 static void
 463 write_fifo (struct net2280_ep *ep, struct usb_request *req)
 464 {
 465         struct net2280_ep_regs  __iomem *regs = ep->regs;
 466         u8                      *buf;
 467         u32                     tmp;
 468         unsigned                count, total;
 469
 470         /* INVARIANT:  fifo is currently empty. (testable) */
 471
 472         if (req) {
 473                 buf = req->buf + req->actual;
 474                 prefetch (buf);
 475                 total = req->length - req->actual;
 476         } else {
 477                 total = 0;
 478                 buf = NULL;
 479         }
 480
 481         /* write just one packet at a time */
 482         count = ep->ep.maxpacket;
 483         if (count > total)      /* min() cannot be used on a bitfield */
 484                 count = total;
 485
 486         VDEBUG (ep->dev, "write %s fifo (IN) %d bytes%s req %p\n",
 487                         ep->ep.name, count,
 488                         (count != ep->ep.maxpacket) ? " (short)" : "",
 489                         req);
 490         while (count >= 4) {
 491                 /* NOTE be careful if you try to align these. fifo lines
 492                  * should normally be full (4 bytes) and successive partial
 493                  * lines are ok only in certain cases.
 494                  */
 495                 tmp = get_unaligned ((u32 *)buf);
 496                 cpu_to_le32s (&tmp);
 497                 writel (tmp, &regs->ep_data);
 498                 buf += 4;
 499                 count -= 4;
 500         }
 501
 502         /* last fifo entry is "short" unless we wrote a full packet.
 503          * also explicitly validate last word in (periodic) transfers
 504          * when maxpacket is not a multiple of 4 bytes.
 505          */
 506         if (count || total < ep->ep.maxpacket) {
 507                 tmp = count ? get_unaligned ((u32 *)buf) : count;
 508                 cpu_to_le32s (&tmp);
 509                 set_fifo_bytecount (ep, count & 0x03);
 510                 writel (tmp, &regs->ep_data);
 511         }
 512
 513         /* pci writes may still be posted */
 514 }
 515
 516 /* work around erratum 0106: PCI and USB race over the OUT fifo.
 517  * caller guarantees chiprev 0100, out endpoint is NAKing, and
 518  * there's no real data in the fifo.
 519  *
 520  * NOTE:  also used in cases where that erratum doesn't apply:
 521  * where the host wrote "too much" data to us.
 522  */
 523 static void out_flush (struct net2280_ep *ep)
 524 {
 525         u32     __iomem *statp;
 526         u32     tmp;
 527
 528         ASSERT_OUT_NAKING (ep);
 529
 530         statp = &ep->regs->ep_stat;
 531         writel (  (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 532                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 533                 , statp);
 534         writel ((1 << FIFO_FLUSH), statp);
 535         mb ();
 536         tmp = readl (statp);
 537         if (tmp & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 538                         /* high speed did bulk NYET; fifo isn't filling */
 539                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
 540                 unsigned        usec;
 541
 542                 usec = 50;              /* 64 byte bulk/interrupt */
 543                 handshake (statp, (1 << USB_OUT_PING_NAK_SENT),
 544                                 (1 << USB_OUT_PING_NAK_SENT), usec);
 545                 /* NAK done; now CLEAR_NAK_OUT_PACKETS is safe */
 546         }
 547 }
 548
 549 /* unload packet(s) from the fifo we use for usb OUT transfers.
 550  * returns true iff the request completed, because of short packet
 551  * or the request buffer having filled with full packets.
 552  *
 553  * for ep-a..ep-d this will read multiple packets out when they
 554  * have been accepted.
 555  */
 556 static int
 557 read_fifo (struct net2280_ep *ep, struct net2280_request *req)
 558 {
 559         struct net2280_ep_regs  __iomem *regs = ep->regs;
 560         u8                      *buf = req->req.buf + req->req.actual;
 561         unsigned                count, tmp, is_short;
 562         unsigned                cleanup = 0, prevent = 0;
 563
 564         /* erratum 0106 ... packets coming in during fifo reads might
 565          * be incompletely rejected.  not all cases have workarounds.
 566          */
 567         if (ep->dev->chiprev == 0x0100
 568                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
 569                 udelay (1);
 570                 tmp = readl (&ep->regs->ep_stat);
 571                 if ((tmp & (1 << NAK_OUT_PACKETS)))
 572                         cleanup = 1;
 573                 else if ((tmp & (1 << FIFO_FULL))) {
 574                         start_out_naking (ep);
 575                         prevent = 1;
 576                 }
 577                 /* else: hope we don't see the problem */
 578         }
 579
 580         /* never overflow the rx buffer. the fifo reads packets until
 581          * it sees a short one; we might not be ready for them all.
 582          */
 583         prefetchw (buf);
 584         count = readl (&regs->ep_avail);
 585         if (unlikely (count == 0)) {
 586                 udelay (1);
 587                 tmp = readl (&ep->regs->ep_stat);
 588                 count = readl (&regs->ep_avail);
 589                 /* handled that data already? */
 590                 if (count == 0 && (tmp & (1 << NAK_OUT_PACKETS)) == 0)
 591                         return 0;
 592         }
 593
 594         tmp = req->req.length - req->req.actual;
 595         if (count > tmp) {
 596                 /* as with DMA, data overflow gets flushed */
 597                 if ((tmp % ep->ep.maxpacket) != 0) {
 598                         ERROR (ep->dev,
 599                                 "%s out fifo %d bytes, expected %d\n",
 600                                 ep->ep.name, count, tmp);
 601                         req->req.status = -EOVERFLOW;
 602                         cleanup = 1;
 603                         /* NAK_OUT_PACKETS will be set, so flushing is safe;
 604                          * the next read will start with the next packet
 605                          */
 606                 } /* else it's a ZLP, no worries */
 607                 count = tmp;
 608         }
 609         req->req.actual += count;
 610
 611         is_short = (count == 0) || ((count % ep->ep.maxpacket) != 0);
 612
 613         VDEBUG (ep->dev, "read %s fifo (OUT) %d bytes%s%s%s req %p %d/%d\n",
 614                         ep->ep.name, count, is_short ? " (short)" : "",
 615                         cleanup ? " flush" : "", prevent ? " nak" : "",
 616                         req, req->req.actual, req->req.length);
 617
 618         while (count >= 4) {
 619                 tmp = readl (&regs->ep_data);
 620                 cpu_to_le32s (&tmp);
 621                 put_unaligned (tmp, (u32 *)buf);
 622                 buf += 4;
 623                 count -= 4;
 624         }
 625         if (count) {
 626                 tmp = readl (&regs->ep_data);
 627                 /* LE conversion is implicit here: */
 628                 do {
 629                         *buf++ = (u8) tmp;
 630                         tmp >>= 8;
 631                 } while (--count);
 632         }
 633         if (cleanup)
 634                 out_flush (ep);
 635         if (prevent) {
 636                 writel ((1 << CLEAR_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 637                 (void) readl (&ep->regs->ep_rsp);
 638         }
 639
 640         return is_short || ((req->req.actual == req->req.length)
 641                                 && !req->req.zero);
 642 }
 643
 644 /* fill out dma descriptor to match a given request */
 645 static void
 646 fill_dma_desc (struct net2280_ep *ep, struct net2280_request *req, int valid)
 647 {
 648         struct net2280_dma      *td = req->td;
 649         u32                     dmacount = req->req.length;
 650
 651         /* don't let DMA continue after a short OUT packet,
 652          * so overruns can't affect the next transfer.
 653          * in case of overruns on max-size packets, we can't
 654          * stop the fifo from filling but we can flush it.
 655          */
 656         if (ep->is_in)
 657                 dmacount |= (1 << DMA_DIRECTION);
 658         if ((!ep->is_in && (dmacount % ep->ep.maxpacket) != 0)
 659                         || ep->dev->pdev->device != 0x2280)
 660                 dmacount |= (1 << END_OF_CHAIN);
 661
 662         req->valid = valid;
 663         if (valid)
 664                 dmacount |= (1 << VALID_BIT);
 665         if (likely(!req->req.no_interrupt || !use_dma_chaining))
 666                 dmacount |= (1 << DMA_DONE_INTERRUPT_ENABLE);
 667
 668         /* td->dmadesc = previously set by caller */
 669         td->dmaaddr = cpu_to_le32 (req->req.dma);
 670
 671         /* 2280 may be polling VALID_BIT through ep->dma->dmadesc */
 672         wmb ();
 673         td->dmacount = cpu_to_le32(dmacount);
 674 }
 675
 676 static const u32 dmactl_default =
 677                   (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 678                 | (1 << DMA_CLEAR_COUNT_ENABLE)
 679                 /* erratum 0116 workaround part 1 (use POLLING) */
 680                 | (POLL_100_USEC << DESCRIPTOR_POLLING_RATE)
 681                 | (1 << DMA_VALID_BIT_POLLING_ENABLE)
 682                 | (1 << DMA_VALID_BIT_ENABLE)
 683                 | (1 << DMA_SCATTER_GATHER_ENABLE)
 684                 /* erratum 0116 workaround part 2 (no AUTOSTART) */
 685                 | (1 << DMA_ENABLE);
 686
 687 static inline void spin_stop_dma (struct net2280_dma_regs __iomem *dma)
 688 {
 689         handshake (&dma->dmactl, (1 << DMA_ENABLE), 0, 50);
 690 }
 691
 692 static inline void stop_dma (struct net2280_dma_regs __iomem *dma)
 693 {
 694         writel (readl (&dma->dmactl) & ~(1 << DMA_ENABLE), &dma->dmactl);
 695         spin_stop_dma (dma);
 696 }
 697
 698 static void start_queue (struct net2280_ep *ep, u32 dmactl, u32 td_dma)
 699 {
 700         struct net2280_dma_regs __iomem *dma = ep->dma;
 701         unsigned int tmp = (1 << VALID_BIT) | (ep->is_in << DMA_DIRECTION);
 702
 703         if (ep->dev->pdev->device != 0x2280)
 704                 tmp |= (1 << END_OF_CHAIN);
 705
 706         writel (tmp, &dma->dmacount);
 707         writel (readl (&dma->dmastat), &dma->dmastat);
 708
 709         writel (td_dma, &dma->dmadesc);
 710         writel (dmactl, &dma->dmactl);
 711
 712         /* erratum 0116 workaround part 3:  pci arbiter away from net2280 */
 713         (void) readl (&ep->dev->pci->pcimstctl);
 714
 715         writel ((1 << DMA_START), &dma->dmastat);
 716
 717         if (!ep->is_in)
 718                 stop_out_naking (ep);
 719 }
 720
 721 static void start_dma (struct net2280_ep *ep, struct net2280_request *req)
 722 {
 723         u32                     tmp;
 724         struct net2280_dma_regs __iomem *dma = ep->dma;
 725
 726         /* FIXME can't use DMA for ZLPs */
 727
 728         /* on this path we "know" there's no dma active (yet) */
 729         WARN_ON (readl (&dma->dmactl) & (1 << DMA_ENABLE));
 730         writel (0, &ep->dma->dmactl);
 731
 732         /* previous OUT packet might have been short */
 733         if (!ep->is_in && ((tmp = readl (&ep->regs->ep_stat))
 734                                 & (1 << NAK_OUT_PACKETS)) != 0) {
 735                 writel ((1 << SHORT_PACKET_TRANSFERRED_INTERRUPT),
 736                         &ep->regs->ep_stat);
 737
 738                 tmp = readl (&ep->regs->ep_avail);
 739                 if (tmp) {
 740                         writel (readl (&dma->dmastat), &dma->dmastat);
 741
 742                         /* transfer all/some fifo data */
 743                         writel (req->req.dma, &dma->dmaaddr);
 744                         tmp = min (tmp, req->req.length);
 745
 746                         /* dma irq, faking scatterlist status */
 747                         req->td->dmacount = cpu_to_le32 (req->req.length - tmp);
 748                         writel ((1 << DMA_DONE_INTERRUPT_ENABLE)
 749                                 | tmp, &dma->dmacount);
 750                         req->td->dmadesc = 0;
 751                         req->valid = 1;
 752
 753                         writel ((1 << DMA_ENABLE), &dma->dmactl);
 754                         writel ((1 << DMA_START), &dma->dmastat);
 755                         return;
 756                 }
 757         }
 758
 759         tmp = dmactl_default;
 760
 761         /* force packet boundaries between dma requests, but prevent the
 762          * controller from automagically writing a last "short" packet
 763          * (zero length) unless the driver explicitly said to do that.
 764          */
 765         if (ep->is_in) {
 766                 if (likely ((req->req.length % ep->ep.maxpacket) != 0
 767                                 || req->req.zero)) {
 768                         tmp |= (1 << DMA_FIFO_VALIDATE);
 769                         ep->in_fifo_validate = 1;
 770                 } else
 771                         ep->in_fifo_validate = 0;
 772         }
 773
 774         /* init req->td, pointing to the current dummy */
 775         req->td->dmadesc = cpu_to_le32 (ep->td_dma);
 776         fill_dma_desc (ep, req, 1);
 777
 778         if (!use_dma_chaining)
 779                 req->td->dmacount |= cpu_to_le32 (1 << END_OF_CHAIN);
 780
 781         start_queue (ep, tmp, req->td_dma);
 782 }
 783
 784 static inline void
 785 queue_dma (struct net2280_ep *ep, struct net2280_request *req, int valid)
 786 {
 787         struct net2280_dma      *end;
 788         dma_addr_t              tmp;
 789
 790         /* swap new dummy for old, link; fill and maybe activate */
 791         end = ep->dummy;
 792         ep->dummy = req->td;
 793         req->td = end;
 794
 795         tmp = ep->td_dma;
 796         ep->td_dma = req->td_dma;
 797         req->td_dma = tmp;
 798
 799         end->dmadesc = cpu_to_le32 (ep->td_dma);
 800
 801         fill_dma_desc (ep, req, valid);
 802 }
 803
 804 static void
 805 done (struct net2280_ep *ep, struct net2280_request *req, int status)
 806 {
 807         struct net2280          *dev;
 808         unsigned                stopped = ep->stopped;
 809
 810         list_del_init (&req->queue);
 811
 812         if (req->req.status == -EINPROGRESS)
 813                 req->req.status = status;
 814         else
 815                 status = req->req.status;
 816
 817         dev = ep->dev;
 818         if (req->mapped) {
 819                 pci_unmap_single (dev->pdev, req->req.dma, req->req.length,
 820                         ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
 821                 req->req.dma = DMA_ADDR_INVALID;
 822                 req->mapped = 0;
 823         }
 824
 825         if (status && status != -ESHUTDOWN)
 826                 VDEBUG (dev, "complete %s req %p stat %d len %u/%u\n",
 827                         ep->ep.name, &req->req, status,
 828                         req->req.actual, req->req.length);
 829
 830         /* don't modify queue heads during completion callback */
 831         ep->stopped = 1;
 832         spin_unlock (&dev->lock);
 833         req->req.complete (&ep->ep, &req->req);
 834         spin_lock (&dev->lock);
 835         ep->stopped = stopped;
 836 }
 837
 838 /*-------------------------------------------------------------------------*/
 839
 840 static int
 841 net2280_queue (struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
 842 {
 843         struct net2280_request  *req;
 844         struct net2280_ep       *ep;
 845         struct net2280          *dev;
 846         unsigned long           flags;
 847
 848         /* we always require a cpu-view buffer, so that we can
 849          * always use pio (as fallback or whatever).
 850          */
 851         req = container_of (_req, struct net2280_request, req);
 852         if (!_req || !_req->complete || !_req->buf
 853                         || !list_empty (&req->queue))
 854                 return -EINVAL;
 855         if (_req->length > (~0 & DMA_BYTE_COUNT_MASK))
 856                 return -EDOM;
 857         ep = container_of (_ep, struct net2280_ep, ep);
 858         if (!_ep || (!ep->desc && ep->num != 0))
 859                 return -EINVAL;
 860         dev = ep->dev;
 861         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 862                 return -ESHUTDOWN;
 863
 864         /* FIXME implement PIO fallback for ZLPs with DMA */
 865         if (ep->dma && _req->length == 0)
 866                 return -EOPNOTSUPP;
 867
 868         /* set up dma mapping in case the caller didn't */
 869         if (ep->dma && _req->dma == DMA_ADDR_INVALID) {
 870                 _req->dma = pci_map_single (dev->pdev, _req->buf, _req->length,
 871                         ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
 872                 req->mapped = 1;
 873         }
 874
 875 #if 0
 876         VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
 877                         _ep->name, _req, _req->length, _req->buf);
 878 #endif
 879
 880         spin_lock_irqsave (&dev->lock, flags);
 881
 882         _req->status = -EINPROGRESS;
 883         _req->actual = 0;
 884
 885         /* kickstart this i/o queue? */
 886         if (list_empty (&ep->queue) && !ep->stopped) {
 887                 /* use DMA if the endpoint supports it, else pio */
 888                 if (ep->dma)
 889                         start_dma (ep, req);
 890                 else {
 891                         /* maybe there's no control data, just status ack */
 892                         if (ep->num == 0 && _req->length == 0) {
 893                                 allow_status (ep);
 894                                 done (ep, req, 0);
 895                                 VDEBUG (dev, "%s status ack\n", ep->ep.name);
 896                                 goto done;
 897                         }
 898
 899                         /* PIO ... stuff the fifo, or unblock it.  */
 900                         if (ep->is_in)
 901                                 write_fifo (ep, _req);
 902                         else if (list_empty (&ep->queue)) {
 903                                 u32     s;
 904
 905                                 /* OUT FIFO might have packet(s) buffered */
 906                                 s = readl (&ep->regs->ep_stat);
 907                                 if ((s & (1 << FIFO_EMPTY)) == 0) {
 908                                         /* note:  _req->short_not_ok is
 909                                          * ignored here since PIO _always_
 910                                          * stops queue advance here, and
 911                                          * _req->status doesn't change for
 912                                          * short reads (only _req->actual)
 913                                          */
 914                                         if (read_fifo (ep, req)) {
 915                                                 done (ep, req, 0);
 916                                                 if (ep->num == 0)
 917                                                         allow_status (ep);
 918                                                 /* don't queue it */
 919                                                 req = NULL;
 920                                         } else
 921                                                 s = readl (&ep->regs->ep_stat);
 922                                 }
 923
 924                                 /* don't NAK, let the fifo fill */
 925                                 if (req && (s & (1 << NAK_OUT_PACKETS)))
 926                                         writel ((1 << CLEAR_NAK_OUT_PACKETS),
 927                                                         &ep->regs->ep_rsp);
 928                         }
 929                 }
 930
 931         } else if (ep->dma) {
 932                 int     valid = 1;
 933
 934                 if (ep->is_in) {
 935                         int     expect;
 936
 937                         /* preventing magic zlps is per-engine state, not
 938                          * per-transfer; irq logic must recover hiccups.
 939                          */
 940                         expect = likely (req->req.zero
 941                                 || (req->req.length % ep->ep.maxpacket) != 0);
 942                         if (expect != ep->in_fifo_validate)
 943                                 valid = 0;
 944                 }
 945                 queue_dma (ep, req, valid);
 946
 947         } /* else the irq handler advances the queue. */
 948
 949         ep->responded = 1;
 950         if (req)
 951                 list_add_tail (&req->queue, &ep->queue);
 952 done:
 953         spin_unlock_irqrestore (&dev->lock, flags);
 954
 955         /* pci writes may still be posted */
 956         return 0;
 957 }
 958
 959 static inline void
 960 dma_done (
 961         struct net2280_ep *ep,
 962         struct net2280_request *req,
 963         u32 dmacount,
 964         int status
 965 )
 966 {
 967         req->req.actual = req->req.length - (DMA_BYTE_COUNT_MASK & dmacount);
 968         done (ep, req, status);
 969 }
 970
 971 static void restart_dma (struct net2280_ep *ep);
 972
 973 static void scan_dma_completions (struct net2280_ep *ep)
 974 {
 975         /* only look at descriptors that were "naturally" retired,
 976          * so fifo and list head state won't matter
 977          */
 978         while (!list_empty (&ep->queue)) {
 979                 struct net2280_request  *req;
 980                 u32                     tmp;
 981
 982                 req = list_entry (ep->queue.next,
 983                                 struct net2280_request, queue);
 984                 if (!req->valid)
 985                         break;
 986                 rmb ();
 987                 tmp = le32_to_cpup (&req->td->dmacount);
 988                 if ((tmp & (1 << VALID_BIT)) != 0)
 989                         break;
 990
 991                 /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
 992                  * cases where DMA must be aborted; this code handles
 993                  * all non-abort DMA completions.
 994                  */
 995                 if (unlikely (req->td->dmadesc == 0)) {
 996                         /* paranoia */
 997                         tmp = readl (&ep->dma->dmacount);
 998                         if (tmp & DMA_BYTE_COUNT_MASK)
 999                                 break;
1000                         /* single transfer mode */
1001                         dma_done (ep, req, tmp, 0);
1002                         break;
1003                 } else if (!ep->is_in
1004                                 && (req->req.length % ep->ep.maxpacket) != 0) {
1005                         tmp = readl (&ep->regs->ep_stat);
1006
1007                         /* AVOID TROUBLE HERE by not issuing short reads from
1008                          * your gadget driver.  That helps avoids errata 0121,
1009                          * 0122, and 0124; not all cases trigger the warning.
1010                          */
1011                         if ((tmp & (1 << NAK_OUT_PACKETS)) == 0) {
1012                                 WARNING (ep->dev, "%s lost packet sync!\n",
1013                                                 ep->ep.name);
1014                                 req->req.status = -EOVERFLOW;
1015                         } else if ((tmp = readl (&ep->regs->ep_avail)) != 0) {
1016                                 /* fifo gets flushed later */
1017                                 ep->out_overflow = 1;
1018                                 DEBUG (ep->dev, "%s dma, discard %d len %d\n",
1019                                                 ep->ep.name, tmp,
1020                                                 req->req.length);
1021                                 req->req.status = -EOVERFLOW;
1022                         }
1023                 }
1024                 dma_done (ep, req, tmp, 0);
1025         }
1026 }
1027
1028 static void restart_dma (struct net2280_ep *ep)
1029 {
1030         struct net2280_request  *req;
1031         u32                     dmactl = dmactl_default;
1032
1033         if (ep->stopped)
1034                 return;
1035         req = list_entry (ep->queue.next, struct net2280_request, queue);
1036
1037         if (!use_dma_chaining) {
1038                 start_dma (ep, req);
1039                 return;
1040         }
1041
1042         /* the 2280 will be processing the queue unless queue hiccups after
1043          * the previous transfer:
1044          *  IN:   wanted automagic zlp, head doesn't (or vice versa)
1045          *        DMA_FIFO_VALIDATE doesn't init from dma descriptors.
1046          *  OUT:  was "usb-short", we must restart.
1047          */
1048         if (ep->is_in && !req->valid) {
1049                 struct net2280_request  *entry, *prev = NULL;
1050                 int                     reqmode, done = 0;
1051
1052                 DEBUG (ep->dev, "%s dma hiccup td %p\n", ep->ep.name, req->td);
1053                 ep->in_fifo_validate = likely (req->req.zero
1054                         || (req->req.length % ep->ep.maxpacket) != 0);
1055                 if (ep->in_fifo_validate)
1056                         dmactl |= (1 << DMA_FIFO_VALIDATE);
1057                 list_for_each_entry (entry, &ep->queue, queue) {
1058                         __le32          dmacount;
1059
1060                         if (entry == req)
1061                                 continue;
1062                         dmacount = entry->td->dmacount;
1063                         if (!done) {
1064                                 reqmode = likely (entry->req.zero
1065                                         || (entry->req.length
1066                                                 % ep->ep.maxpacket) != 0);
1067                                 if (reqmode == ep->in_fifo_validate) {
1068                                         entry->valid = 1;
1069                                         dmacount |= valid_bit;
1070                                         entry->td->dmacount = dmacount;
1071                                         prev = entry;
1072                                         continue;
1073                                 } else {
1074                                         /* force a hiccup */
1075                                         prev->td->dmacount |= dma_done_ie;
1076                                         done = 1;
1077                                 }
1078                         }
1079
1080                         /* walk the rest of the queue so unlinks behave */
1081                         entry->valid = 0;
1082                         dmacount &= ~valid_bit;
1083                         entry->td->dmacount = dmacount;
1084                         prev = entry;
1085                 }
1086         }
1087
1088         writel (0, &ep->dma->dmactl);
1089         start_queue (ep, dmactl, req->td_dma);
1090 }
1091
1092 static void abort_dma (struct net2280_ep *ep)
1093 {
1094         /* abort the current transfer */
1095         if (likely (!list_empty (&ep->queue))) {
1096                 /* FIXME work around errata 0121, 0122, 0124 */
1097                 writel ((1 << DMA_ABORT), &ep->dma->dmastat);
1098                 spin_stop_dma (ep->dma);
1099         } else
1100                 stop_dma (ep->dma);
1101         scan_dma_completions (ep);
1102 }
1103
1104 /* dequeue ALL requests */
1105 static void nuke (struct net2280_ep *ep)
1106 {
1107         struct net2280_request  *req;
1108
1109         /* called with spinlock held */
1110         ep->stopped = 1;
1111         if (ep->dma)
1112                 abort_dma (ep);
1113         while (!list_empty (&ep->queue)) {
1114                 req = list_entry (ep->queue.next,
1115                                 struct net2280_request,
1116                                 queue);
1117                 done (ep, req, -ESHUTDOWN);
1118         }
1119 }
1120
1121 /* dequeue JUST ONE request */
1122 static int net2280_dequeue (struct usb_ep *_ep, struct usb_request *_req)
1123 {
1124         struct net2280_ep       *ep;
1125         struct net2280_request  *req;
1126         unsigned long           flags;
1127         u32                     dmactl;
1128         int                     stopped;
1129
1130         ep = container_of (_ep, struct net2280_ep, ep);
1131         if (!_ep || (!ep->desc && ep->num != 0) || !_req)
1132                 return -EINVAL;
1133
1134         spin_lock_irqsave (&ep->dev->lock, flags);
1135         stopped = ep->stopped;
1136
1137         /* quiesce dma while we patch the queue */
1138         dmactl = 0;
1139         ep->stopped = 1;
1140         if (ep->dma) {
1141                 dmactl = readl (&ep->dma->dmactl);
1142                 /* WARNING erratum 0127 may kick in ... */
1143                 stop_dma (ep->dma);
1144                 scan_dma_completions (ep);
1145         }
1146
1147         /* make sure it's still queued on this endpoint */
1148         list_for_each_entry (req, &ep->queue, queue) {
1149                 if (&req->req == _req)
1150                         break;
1151         }
1152         if (&req->req != _req) {
1153                 spin_unlock_irqrestore (&ep->dev->lock, flags);
1154                 return -EINVAL;
1155         }
1156
1157         /* queue head may be partially complete. */
1158         if (ep->queue.next == &req->queue) {
1159                 if (ep->dma) {
1160                         DEBUG (ep->dev, "unlink (%s) dma\n", _ep->name);
1161                         _req->status = -ECONNRESET;
1162                         abort_dma (ep);
1163                         if (likely (ep->queue.next == &req->queue)) {
1164                                 // NOTE: misreports single-transfer mode
1165                                 req->td->dmacount = 0;  /* invalidate */
1166                                 dma_done (ep, req,
1167                                         readl (&ep->dma->dmacount),
1168                                         -ECONNRESET);
1169                         }
1170                 } else {
1171                         DEBUG (ep->dev, "unlink (%s) pio\n", _ep->name);
1172                         done (ep, req, -ECONNRESET);
1173                 }
1174                 req = NULL;
1175
1176         /* patch up hardware chaining data */
1177         } else if (ep->dma && use_dma_chaining) {
1178                 if (req->queue.prev == ep->queue.next) {
1179                         writel (le32_to_cpu (req->td->dmadesc),
1180                                 &ep->dma->dmadesc);
1181                         if (req->td->dmacount & dma_done_ie)
1182                                 writel (readl (&ep->dma->dmacount)
1183                                                 | le32_to_cpu(dma_done_ie),
1184                                         &ep->dma->dmacount);
1185                 } else {
1186                         struct net2280_request  *prev;
1187
1188                         prev = list_entry (req->queue.prev,
1189                                 struct net2280_request, queue);
1190                         prev->td->dmadesc = req->td->dmadesc;
1191                         if (req->td->dmacount & dma_done_ie)
1192                                 prev->td->dmacount |= dma_done_ie;
1193                 }
1194         }
1195
1196         if (req)
1197                 done (ep, req, -ECONNRESET);
1198         ep->stopped = stopped;
1199
1200         if (ep->dma) {
1201                 /* turn off dma on inactive queues */
1202                 if (list_empty (&ep->queue))
1203                         stop_dma (ep->dma);
1204                 else if (!ep->stopped) {
1205                         /* resume current request, or start new one */
1206                         if (req)
1207                                 writel (dmactl, &ep->dma->dmactl);
1208                         else
1209                                 start_dma (ep, list_entry (ep->queue.next,
1210                                         struct net2280_request, queue));
1211                 }
1212         }
1213
1214         spin_unlock_irqrestore (&ep->dev->lock, flags);
1215         return 0;
1216 }
1217
1218 /*-------------------------------------------------------------------------*/
1219
1220 static int net2280_fifo_status (struct usb_ep *_ep);
1221
1222 static int
1223 net2280_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedged)
1224 {
1225         struct net2280_ep       *ep;
1226         unsigned long           flags;
1227         int                     retval = 0;
1228
1229         ep = container_of (_ep, struct net2280_ep, ep);
1230         if (!_ep || (!ep->desc && ep->num != 0))
1231                 return -EINVAL;
1232         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1233                 return -ESHUTDOWN;
1234         if (ep->desc /* not ep0 */ && (ep->desc->bmAttributes & 0x03)
1235                                                 == USB_ENDPOINT_XFER_ISOC)
1236                 return -EINVAL;
1237
1238         spin_lock_irqsave (&ep->dev->lock, flags);
1239         if (!list_empty (&ep->queue))
1240                 retval = -EAGAIN;
1241         else if (ep->is_in && value && net2280_fifo_status (_ep) != 0)
1242                 retval = -EAGAIN;
1243         else {
1244                 VDEBUG (ep->dev, "%s %s %s\n", _ep->name,
1245                                 value ? "set" : "clear",
1246                                 wedged ? "wedge" : "halt");
1247                 /* set/clear, then synch memory views with the device */
1248                 if (value) {
1249                         if (ep->num == 0)
1250                                 ep->dev->protocol_stall = 1;
1251                         else
1252                                 set_halt (ep);
1253                         if (wedged)
1254                                 ep->wedged = 1;
1255                 } else {
1256                         clear_halt (ep);
1257                         ep->wedged = 0;
1258                 }
1259                 (void) readl (&ep->regs->ep_rsp);
1260         }
1261         spin_unlock_irqrestore (&ep->dev->lock, flags);
1262
1263         return retval;
1264 }
1265
1266 static int
1267 net2280_set_halt(struct usb_ep *_ep, int value)
1268 {
1269         return net2280_set_halt_and_wedge(_ep, value, 0);
1270 }
1271
1272 static int
1273 net2280_set_wedge(struct usb_ep *_ep)
1274 {
1275         if (!_ep || _ep->name == ep0name)
1276                 return -EINVAL;
1277         return net2280_set_halt_and_wedge(_ep, 1, 1);
1278 }
1279
1280 static int
1281 net2280_fifo_status (struct usb_ep *_ep)
1282 {
1283         struct net2280_ep       *ep;
1284         u32                     avail;
1285
1286         ep = container_of (_ep, struct net2280_ep, ep);
1287         if (!_ep || (!ep->desc && ep->num != 0))
1288                 return -ENODEV;
1289         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1290                 return -ESHUTDOWN;
1291
1292         avail = readl (&ep->regs->ep_avail) & ((1 << 12) - 1);
1293         if (avail > ep->fifo_size)
1294                 return -EOVERFLOW;
1295         if (ep->is_in)
1296                 avail = ep->fifo_size - avail;
1297         return avail;
1298 }
1299
1300 static void
1301 net2280_fifo_flush (struct usb_ep *_ep)
1302 {
1303         struct net2280_ep       *ep;
1304
1305         ep = container_of (_ep, struct net2280_ep, ep);
1306         if (!_ep || (!ep->desc && ep->num != 0))
1307                 return;
1308         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1309                 return;
1310
1311         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
1312         (void) readl (&ep->regs->ep_rsp);
1313 }
1314
1315 static const struct usb_ep_ops net2280_ep_ops = {
1316         .enable         = net2280_enable,
1317         .disable        = net2280_disable,
1318
1319         .alloc_request  = net2280_alloc_request,
1320         .free_request   = net2280_free_request,
1321
1322         .queue          = net2280_queue,
1323         .dequeue        = net2280_dequeue,
1324
1325         .set_halt       = net2280_set_halt,
1326         .set_wedge      = net2280_set_wedge,
1327         .fifo_status    = net2280_fifo_status,
1328         .fifo_flush     = net2280_fifo_flush,
1329 };
1330
1331 /*-------------------------------------------------------------------------*/
1332
1333 static int net2280_get_frame (struct usb_gadget *_gadget)
1334 {
1335         struct net2280          *dev;
1336         unsigned long           flags;
1337         u16                     retval;
1338
1339         if (!_gadget)
1340                 return -ENODEV;
1341         dev = container_of (_gadget, struct net2280, gadget);
1342         spin_lock_irqsave (&dev->lock, flags);
1343         retval = get_idx_reg (dev->regs, REG_FRAME) & 0x03ff;
1344         spin_unlock_irqrestore (&dev->lock, flags);
1345         return retval;
1346 }
1347
1348 static int net2280_wakeup (struct usb_gadget *_gadget)
1349 {
1350         struct net2280          *dev;
1351         u32                     tmp;
1352         unsigned long           flags;
1353
1354         if (!_gadget)
1355                 return 0;
1356         dev = container_of (_gadget, struct net2280, gadget);
1357
1358         spin_lock_irqsave (&dev->lock, flags);
1359         tmp = readl (&dev->usb->usbctl);
1360         if (tmp & (1 << DEVICE_REMOTE_WAKEUP_ENABLE))
1361                 writel (1 << GENERATE_RESUME, &dev->usb->usbstat);
1362         spin_unlock_irqrestore (&dev->lock, flags);
1363
1364         /* pci writes may still be posted */
1365         return 0;
1366 }
1367
1368 static int net2280_set_selfpowered (struct usb_gadget *_gadget, int value)
1369 {
1370         struct net2280          *dev;
1371         u32                     tmp;
1372         unsigned long           flags;
1373
1374         if (!_gadget)
1375                 return 0;
1376         dev = container_of (_gadget, struct net2280, gadget);
1377
1378         spin_lock_irqsave (&dev->lock, flags);
1379         tmp = readl (&dev->usb->usbctl);
1380         if (value)
1381                 tmp |= (1 << SELF_POWERED_STATUS);
1382         else
1383                 tmp &= ~(1 << SELF_POWERED_STATUS);
1384         writel (tmp, &dev->usb->usbctl);
1385         spin_unlock_irqrestore (&dev->lock, flags);
1386
1387         return 0;
1388 }
1389
1390 static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
1391 {
1392         struct net2280  *dev;
1393         u32             tmp;
1394         unsigned long   flags;
1395
1396         if (!_gadget)
1397                 return -ENODEV;
1398         dev = container_of (_gadget, struct net2280, gadget);
1399
1400         spin_lock_irqsave (&dev->lock, flags);
1401         tmp = readl (&dev->usb->usbctl);
1402         dev->softconnect = (is_on != 0);
1403         if (is_on)
1404                 tmp |= (1 << USB_DETECT_ENABLE);
1405         else
1406                 tmp &= ~(1 << USB_DETECT_ENABLE);
1407         writel (tmp, &dev->usb->usbctl);
1408         spin_unlock_irqrestore (&dev->lock, flags);
1409
1410         return 0;
1411 }
1412
1413 static const struct usb_gadget_ops net2280_ops = {
1414         .get_frame      = net2280_get_frame,
1415         .wakeup         = net2280_wakeup,
1416         .set_selfpowered = net2280_set_selfpowered,
1417         .pullup         = net2280_pullup,
1418 };
1419
1420 /*-------------------------------------------------------------------------*/
1421
1422 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
1423
1424 /* FIXME move these into procfs, and use seq_file.
1425  * Sysfs _still_ doesn't behave for arbitrarily sized files,
1426  * and also doesn't help products using this with 2.4 kernels.
1427  */
1428
1429 /* "function" sysfs attribute */
1430 static ssize_t
1431 show_function (struct device *_dev, struct device_attribute *attr, char *buf)
1432 {
1433         struct net2280  *dev = dev_get_drvdata (_dev);
1434
1435         if (!dev->driver
1436                         || !dev->driver->function
1437                         || strlen (dev->driver->function) > PAGE_SIZE)
1438                 return 0;
1439         return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
1440 }
1441 static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
1442
1443 static ssize_t net2280_show_registers(struct device *_dev,
1444                                 struct device_attribute *attr, char *buf)
1445 {
1446         struct net2280          *dev;
1447         char                    *next;
1448         unsigned                size, t;
1449         unsigned long           flags;
1450         int                     i;
1451         u32                     t1, t2;
1452         const char              *s;
1453
1454         dev = dev_get_drvdata (_dev);
1455         next = buf;
1456         size = PAGE_SIZE;
1457         spin_lock_irqsave (&dev->lock, flags);
1458
1459         if (dev->driver)
1460                 s = dev->driver->driver.name;
1461         else
1462                 s = "(none)";
1463
1464         /* Main Control Registers */
1465         t = scnprintf (next, size, "%s version " DRIVER_VERSION
1466                         ", chiprev %04x, dma %s\n\n"
1467                         "devinit %03x fifoctl %08x gadget '%s'\n"
1468                         "pci irqenb0 %02x irqenb1 %08x "
1469                         "irqstat0 %04x irqstat1 %08x\n",
1470                         driver_name, dev->chiprev,
1471                         use_dma
1472                                 ? (use_dma_chaining ? "chaining" : "enabled")
1473                                 : "disabled",
1474                         readl (&dev->regs->devinit),
1475                         readl (&dev->regs->fifoctl),
1476                         s,
1477                         readl (&dev->regs->pciirqenb0),
1478                         readl (&dev->regs->pciirqenb1),
1479                         readl (&dev->regs->irqstat0),
1480                         readl (&dev->regs->irqstat1));
1481         size -= t;
1482         next += t;
1483
1484         /* USB Control Registers */
1485         t1 = readl (&dev->usb->usbctl);
1486         t2 = readl (&dev->usb->usbstat);
1487         if (t1 & (1 << VBUS_PIN)) {
1488                 if (t2 & (1 << HIGH_SPEED))
1489                         s = "high speed";
1490                 else if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1491                         s = "powered";
1492                 else
1493                         s = "full speed";
1494                 /* full speed bit (6) not working?? */
1495         } else
1496                         s = "not attached";
1497         t = scnprintf (next, size,
1498                         "stdrsp %08x usbctl %08x usbstat %08x "
1499                                 "addr 0x%02x (%s)\n",
1500                         readl (&dev->usb->stdrsp), t1, t2,
1501                         readl (&dev->usb->ouraddr), s);
1502         size -= t;
1503         next += t;
1504
1505         /* PCI Master Control Registers */
1506
1507         /* DMA Control Registers */
1508
1509         /* Configurable EP Control Registers */
1510         for (i = 0; i < 7; i++) {
1511                 struct net2280_ep       *ep;
1512
1513                 ep = &dev->ep [i];
1514                 if (i && !ep->desc)
1515                         continue;
1516
1517                 t1 = readl (&ep->regs->ep_cfg);
1518                 t2 = readl (&ep->regs->ep_rsp) & 0xff;
1519                 t = scnprintf (next, size,
1520                                 "\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
1521                                         "irqenb %02x\n",
1522                                 ep->ep.name, t1, t2,
1523                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS))
1524                                         ? "NAK " : "",
1525                                 (t2 & (1 << CLEAR_EP_HIDE_STATUS_PHASE))
1526                                         ? "hide " : "",
1527                                 (t2 & (1 << CLEAR_EP_FORCE_CRC_ERROR))
1528                                         ? "CRC " : "",
1529                                 (t2 & (1 << CLEAR_INTERRUPT_MODE))
1530                                         ? "interrupt " : "",
1531                                 (t2 & (1<<CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE))
1532                                         ? "status " : "",
1533                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS_MODE))
1534                                         ? "NAKmode " : "",
1535                                 (t2 & (1 << CLEAR_ENDPOINT_TOGGLE))
1536                                         ? "DATA1 " : "DATA0 ",
1537                                 (t2 & (1 << CLEAR_ENDPOINT_HALT))
1538                                         ? "HALT " : "",
1539                                 readl (&ep->regs->ep_irqenb));
1540                 size -= t;
1541                 next += t;
1542
1543                 t = scnprintf (next, size,
1544                                 "\tstat %08x avail %04x "
1545                                 "(ep%d%s-%s)%s\n",
1546                                 readl (&ep->regs->ep_stat),
1547                                 readl (&ep->regs->ep_avail),
1548                                 t1 & 0x0f, DIR_STRING (t1),
1549                                 type_string (t1 >> 8),
1550                                 ep->stopped ? "*" : "");
1551                 size -= t;
1552                 next += t;
1553
1554                 if (!ep->dma)
1555                         continue;
1556
1557                 t = scnprintf (next, size,
1558                                 "  dma\tctl %08x stat %08x count %08x\n"
1559                                 "\taddr %08x desc %08x\n",
1560                                 readl (&ep->dma->dmactl),
1561                                 readl (&ep->dma->dmastat),
1562                                 readl (&ep->dma->dmacount),
1563                                 readl (&ep->dma->dmaaddr),
1564                                 readl (&ep->dma->dmadesc));
1565                 size -= t;
1566                 next += t;
1567
1568         }
1569
1570         /* Indexed Registers */
1571                 // none yet
1572
1573         /* Statistics */
1574         t = scnprintf (next, size, "\nirqs:  ");
1575         size -= t;
1576         next += t;
1577         for (i = 0; i < 7; i++) {
1578                 struct net2280_ep       *ep;
1579
1580                 ep = &dev->ep [i];
1581                 if (i && !ep->irqs)
1582                         continue;
1583                 t = scnprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
1584                 size -= t;
1585                 next += t;
1586
1587         }
1588         t = scnprintf (next, size, "\n");
1589         size -= t;
1590         next += t;
1591
1592         spin_unlock_irqrestore (&dev->lock, flags);
1593
1594         return PAGE_SIZE - size;
1595 }
1596 static DEVICE_ATTR(registers, S_IRUGO, net2280_show_registers, NULL);
1597
1598 static ssize_t
1599 show_queues (struct device *_dev, struct device_attribute *attr, char *buf)
1600 {
1601         struct net2280          *dev;
1602         char                    *next;
1603         unsigned                size;
1604         unsigned long           flags;
1605         int                     i;
1606
1607         dev = dev_get_drvdata (_dev);
1608         next = buf;
1609         size = PAGE_SIZE;
1610         spin_lock_irqsave (&dev->lock, flags);
1611
1612         for (i = 0; i < 7; i++) {
1613                 struct net2280_ep               *ep = &dev->ep [i];
1614                 struct net2280_request          *req;
1615                 int                             t;
1616
1617                 if (i != 0) {
1618                         const struct usb_endpoint_descriptor    *d;
1619
1620                         d = ep->desc;
1621                         if (!d)
1622                                 continue;
1623                         t = d->bEndpointAddress;
1624                         t = scnprintf (next, size,
1625                                 "\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
1626                                 ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
1627                                 (t & USB_DIR_IN) ? "in" : "out",
1628                                 ({ char *val;
1629                                  switch (d->bmAttributes & 0x03) {
1630                                  case USB_ENDPOINT_XFER_BULK:
1631                                         val = "bulk"; break;
1632                                  case USB_ENDPOINT_XFER_INT:
1633                                         val = "intr"; break;
1634                                  default:
1635                                         val = "iso"; break;
1636                                  }; val; }),
1637                                 le16_to_cpu (d->wMaxPacketSize) & 0x1fff,
1638                                 ep->dma ? "dma" : "pio", ep->fifo_size
1639                                 );
1640                 } else /* ep0 should only have one transfer queued */
1641                         t = scnprintf (next, size, "ep0 max 64 pio %s\n",
1642                                         ep->is_in ? "in" : "out");
1643                 if (t <= 0 || t > size)
1644                         goto done;
1645                 size -= t;
1646                 next += t;
1647
1648                 if (list_empty (&ep->queue)) {
1649                         t = scnprintf (next, size, "\t(nothing queued)\n");
1650                         if (t <= 0 || t > size)
1651                                 goto done;
1652                         size -= t;
1653                         next += t;
1654                         continue;
1655                 }
1656                 list_for_each_entry (req, &ep->queue, queue) {
1657                         if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
1658                                 t = scnprintf (next, size,
1659                                         "\treq %p len %d/%d "
1660                                         "buf %p (dmacount %08x)\n",
1661                                         &req->req, req->req.actual,
1662                                         req->req.length, req->req.buf,
1663                                         readl (&ep->dma->dmacount));
1664                         else
1665                                 t = scnprintf (next, size,
1666                                         "\treq %p len %d/%d buf %p\n",
1667                                         &req->req, req->req.actual,
1668                                         req->req.length, req->req.buf);
1669                         if (t <= 0 || t > size)
1670                                 goto done;
1671                         size -= t;
1672                         next += t;
1673
1674                         if (ep->dma) {
1675                                 struct net2280_dma      *td;
1676
1677                                 td = req->td;
1678                                 t = scnprintf (next, size, "\t    td %08x "
1679                                         " count %08x buf %08x desc %08x\n",
1680                                         (u32) req->td_dma,
1681                                         le32_to_cpu (td->dmacount),
1682                                         le32_to_cpu (td->dmaaddr),
1683                                         le32_to_cpu (td->dmadesc));
1684                                 if (t <= 0 || t > size)
1685                                         goto done;
1686                                 size -= t;
1687                                 next += t;
1688                         }
1689                 }
1690         }
1691
1692 done:
1693         spin_unlock_irqrestore (&dev->lock, flags);
1694         return PAGE_SIZE - size;
1695 }
1696 static DEVICE_ATTR (queues, S_IRUGO, show_queues, NULL);
1697
1698
1699 #else
1700
1701 #define device_create_file(a,b) (0)
1702 #define device_remove_file(a,b) do { } while (0)
1703
1704 #endif
1705
1706 /*-------------------------------------------------------------------------*/
1707
1708 /* another driver-specific mode might be a request type doing dma
1709  * to/from another device fifo instead of to/from memory.
1710  */
1711
1712 static void set_fifo_mode (struct net2280 *dev, int mode)
1713 {
1714         /* keeping high bits preserves BAR2 */
1715         writel ((0xffff << PCI_BASE2_RANGE) | mode, &dev->regs->fifoctl);
1716
1717         /* always ep-{a,b,e,f} ... maybe not ep-c or ep-d */
1718         INIT_LIST_HEAD (&dev->gadget.ep_list);
1719         list_add_tail (&dev->ep [1].ep.ep_list, &dev->gadget.ep_list);
1720         list_add_tail (&dev->ep [2].ep.ep_list, &dev->gadget.ep_list);
1721         switch (mode) {
1722         case 0:
1723                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1724                 list_add_tail (&dev->ep [4].ep.ep_list, &dev->gadget.ep_list);
1725                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 1024;
1726                 break;
1727         case 1:
1728                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 2048;
1729                 break;
1730         case 2:
1731                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1732                 dev->ep [1].fifo_size = 2048;
1733                 dev->ep [2].fifo_size = 1024;
1734                 break;
1735         }
1736         /* fifo sizes for ep0, ep-c, ep-d, ep-e, and ep-f never change */
1737         list_add_tail (&dev->ep [5].ep.ep_list, &dev->gadget.ep_list);
1738         list_add_tail (&dev->ep [6].ep.ep_list, &dev->gadget.ep_list);
1739 }
1740
1741 /* just declare this in any driver that really need it */
1742 extern int net2280_set_fifo_mode (struct usb_gadget *gadget, int mode);
1743
1744 /**
1745  * net2280_set_fifo_mode - change allocation of fifo buffers
1746  * @gadget: access to the net2280 device that will be updated
1747  * @mode: 0 for default, four 1kB buffers (ep-a through ep-d);
1748  *      1 for two 2kB buffers (ep-a and ep-b only);
1749  *      2 for one 2kB buffer (ep-a) and two 1kB ones (ep-b, ep-c).
1750  *
1751  * returns zero on success, else negative errno.  when this succeeds,
1752  * the contents of gadget->ep_list may have changed.
1753  *
1754  * you may only call this function when endpoints a-d are all disabled.
1755  * use it whenever extra hardware buffering can help performance, such
1756  * as before enabling "high bandwidth" interrupt endpoints that use
1757  * maxpacket bigger than 512 (when double buffering would otherwise
1758  * be unavailable).
1759  */
1760 int net2280_set_fifo_mode (struct usb_gadget *gadget, int mode)
1761 {
1762         int                     i;
1763         struct net2280          *dev;
1764         int                     status = 0;
1765         unsigned long           flags;
1766
1767         if (!gadget)
1768                 return -ENODEV;
1769         dev = container_of (gadget, struct net2280, gadget);
1770
1771         spin_lock_irqsave (&dev->lock, flags);
1772
1773         for (i = 1; i <= 4; i++)
1774                 if (dev->ep [i].desc) {
1775                         status = -EINVAL;
1776                         break;
1777                 }
1778         if (mode < 0 || mode > 2)
1779                 status = -EINVAL;
1780         if (status == 0)
1781                 set_fifo_mode (dev, mode);
1782         spin_unlock_irqrestore (&dev->lock, flags);
1783
1784         if (status == 0) {
1785                 if (mode == 1)
1786                         DEBUG (dev, "fifo:  ep-a 2K, ep-b 2K\n");
1787                 else if (mode == 2)
1788                         DEBUG (dev, "fifo:  ep-a 2K, ep-b 1K, ep-c 1K\n");
1789                 /* else all are 1K */
1790         }
1791         return status;
1792 }
1793 EXPORT_SYMBOL (net2280_set_fifo_mode);
1794
1795 /*-------------------------------------------------------------------------*/
1796
1797 /* keeping it simple:
1798  * - one bus driver, initted first;
1799  * - one function driver, initted second
1800  *
1801  * most of the work to support multiple net2280 controllers would
1802  * be to associate this gadget driver (yes?) with all of them, or
1803  * perhaps to bind specific drivers to specific devices.
1804  */
1805
1806 static struct net2280   *the_controller;
1807
1808 static void usb_reset (struct net2280 *dev)
1809 {
1810         u32     tmp;
1811
1812         dev->gadget.speed = USB_SPEED_UNKNOWN;
1813         (void) readl (&dev->usb->usbctl);
1814
1815         net2280_led_init (dev);
1816
1817         /* disable automatic responses, and irqs */
1818         writel (0, &dev->usb->stdrsp);
1819         writel (0, &dev->regs->pciirqenb0);
1820         writel (0, &dev->regs->pciirqenb1);
1821
1822         /* clear old dma and irq state */
1823         for (tmp = 0; tmp < 4; tmp++) {
1824                 struct net2280_ep       *ep = &dev->ep [tmp + 1];
1825
1826                 if (ep->dma)
1827                         abort_dma (ep);
1828         }
1829         writel (~0, &dev->regs->irqstat0),
1830         writel (~(1 << SUSPEND_REQUEST_INTERRUPT), &dev->regs->irqstat1),
1831
1832         /* reset, and enable pci */
1833         tmp = readl (&dev->regs->devinit)
1834                 | (1 << PCI_ENABLE)
1835                 | (1 << FIFO_SOFT_RESET)
1836                 | (1 << USB_SOFT_RESET)
1837                 | (1 << M8051_RESET);
1838         writel (tmp, &dev->regs->devinit);
1839
1840         /* standard fifo and endpoint allocations */
1841         set_fifo_mode (dev, (fifo_mode <= 2) ? fifo_mode : 0);
1842 }
1843
1844 static void usb_reinit (struct net2280 *dev)
1845 {
1846         u32     tmp;
1847         int     init_dma;
1848
1849         /* use_dma changes are ignored till next device re-init */
1850         init_dma = use_dma;
1851
1852         /* basic endpoint init */
1853         for (tmp = 0; tmp < 7; tmp++) {
1854                 struct net2280_ep       *ep = &dev->ep [tmp];
1855
1856                 ep->ep.name = ep_name [tmp];
1857                 ep->dev = dev;
1858                 ep->num = tmp;
1859
1860                 if (tmp > 0 && tmp <= 4) {
1861                         ep->fifo_size = 1024;
1862                         if (init_dma)
1863                                 ep->dma = &dev->dma [tmp - 1];
1864                 } else
1865                         ep->fifo_size = 64;
1866                 ep->regs = &dev->epregs [tmp];
1867                 ep_reset (dev->regs, ep);
1868         }
1869         dev->ep [0].ep.maxpacket = 64;
1870         dev->ep [5].ep.maxpacket = 64;
1871         dev->ep [6].ep.maxpacket = 64;
1872
1873         dev->gadget.ep0 = &dev->ep [0].ep;
1874         dev->ep [0].stopped = 0;
1875         INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
1876
1877         /* we want to prevent lowlevel/insecure access from the USB host,
1878          * but erratum 0119 means this enable bit is ignored
1879          */
1880         for (tmp = 0; tmp < 5; tmp++)
1881                 writel (EP_DONTUSE, &dev->dep [tmp].dep_cfg);
1882 }
1883
1884 static void ep0_start (struct net2280 *dev)
1885 {
1886         writel (  (1 << CLEAR_EP_HIDE_STATUS_PHASE)
1887                 | (1 << CLEAR_NAK_OUT_PACKETS)
1888                 | (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
1889                 , &dev->epregs [0].ep_rsp);
1890
1891         /*
1892          * hardware optionally handles a bunch of standard requests
1893          * that the API hides from drivers anyway.  have it do so.
1894          * endpoint status/features are handled in software, to
1895          * help pass tests for some dubious behavior.
1896          */
1897         writel (  (1 << SET_TEST_MODE)
1898                 | (1 << SET_ADDRESS)
1899                 | (1 << DEVICE_SET_CLEAR_DEVICE_REMOTE_WAKEUP)
1900                 | (1 << GET_DEVICE_STATUS)
1901                 | (1 << GET_INTERFACE_STATUS)
1902                 , &dev->usb->stdrsp);
1903         writel (  (1 << USB_ROOT_PORT_WAKEUP_ENABLE)
1904                 | (1 << SELF_POWERED_USB_DEVICE)
1905                 | (1 << REMOTE_WAKEUP_SUPPORT)
1906                 | (dev->softconnect << USB_DETECT_ENABLE)
1907                 | (1 << SELF_POWERED_STATUS)
1908                 , &dev->usb->usbctl);
1909
1910         /* enable irqs so we can see ep0 and general operation  */
1911         writel (  (1 << SETUP_PACKET_INTERRUPT_ENABLE)
1912                 | (1 << ENDPOINT_0_INTERRUPT_ENABLE)
1913                 , &dev->regs->pciirqenb0);
1914         writel (  (1 << PCI_INTERRUPT_ENABLE)
1915                 | (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT_ENABLE)
1916                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT_ENABLE)
1917                 | (1 << PCI_RETRY_ABORT_INTERRUPT_ENABLE)
1918                 | (1 << VBUS_INTERRUPT_ENABLE)
1919                 | (1 << ROOT_PORT_RESET_INTERRUPT_ENABLE)
1920                 | (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT_ENABLE)
1921                 , &dev->regs->pciirqenb1);
1922
1923         /* don't leave any writes posted */
1924         (void) readl (&dev->usb->usbctl);
1925 }
1926
1927 /* when a driver is successfully registered, it will receive
1928  * control requests including set_configuration(), which enables
1929  * non-control requests.  then usb traffic follows until a
1930  * disconnect is reported.  then a host may connect again, or
1931  * the driver might get unbound.
1932  */
1933 int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
1934                 int (*bind)(struct usb_gadget *))
1935 {
1936         struct net2280          *dev = the_controller;
1937         int                     retval;
1938         unsigned                i;
1939
1940         /* insist on high speed support from the driver, since
1941          * (dev->usb->xcvrdiag & FORCE_FULL_SPEED_MODE)
1942          * "must not be used in normal operation"
1943          */
1944         if (!driver
1945                         || driver->speed != USB_SPEED_HIGH
1946                         || !bind || !driver->setup)
1947                 return -EINVAL;
1948         if (!dev)
1949                 return -ENODEV;
1950         if (dev->driver)
1951                 return -EBUSY;
1952
1953         for (i = 0; i < 7; i++)
1954                 dev->ep [i].irqs = 0;
1955
1956         /* hook up the driver ... */
1957         dev->softconnect = 1;
1958         driver->driver.bus = NULL;
1959         dev->driver = driver;
1960         dev->gadget.dev.driver = &driver->driver;
1961         retval = bind(&dev->gadget);
1962         if (retval) {
1963                 DEBUG (dev, "bind to driver %s --> %d\n",
1964                                 driver->driver.name, retval);
1965                 dev->driver = NULL;
1966                 dev->gadget.dev.driver = NULL;
1967                 return retval;
1968         }
1969
1970         retval = device_create_file (&dev->pdev->dev, &dev_attr_function);
1971         if (retval) goto err_unbind;
1972         retval = device_create_file (&dev->pdev->dev, &dev_attr_queues);
1973         if (retval) goto err_func;
1974
1975         /* ... then enable host detection and ep0; and we're ready
1976          * for set_configuration as well as eventual disconnect.
1977          */
1978         net2280_led_active (dev, 1);
1979         ep0_start (dev);
1980
1981         DEBUG (dev, "%s ready, usbctl %08x stdrsp %08x\n",
1982                         driver->driver.name,
1983                         readl (&dev->usb->usbctl),
1984                         readl (&dev->usb->stdrsp));
1985
1986         /* pci writes may still be posted */
1987         return 0;
1988
1989 err_func:
1990         device_remove_file (&dev->pdev->dev, &dev_attr_function);
1991 err_unbind:
1992         driver->unbind (&dev->gadget);
1993         dev->gadget.dev.driver = NULL;
1994         dev->driver = NULL;
1995         return retval;
1996 }
1997 EXPORT_SYMBOL(usb_gadget_probe_driver);
1998
1999 static void
2000 stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
2001 {
2002         int                     i;
2003
2004         /* don't disconnect if it's not connected */
2005         if (dev->gadget.speed == USB_SPEED_UNKNOWN)
2006                 driver = NULL;
2007
2008         /* stop hardware; prevent new request submissions;
2009          * and kill any outstanding requests.
2010          */
2011         usb_reset (dev);
2012         for (i = 0; i < 7; i++)
2013                 nuke (&dev->ep [i]);
2014
2015         /* report disconnect; the driver is already quiesced */
2016         if (driver) {
2017                 spin_unlock (&dev->lock);
2018                 driver->disconnect (&dev->gadget);
2019                 spin_lock (&dev->lock);
2020         }
2021
2022         usb_reinit (dev);
2023 }
2024
2025 int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
2026 {
2027         struct net2280  *dev = the_controller;
2028         unsigned long   flags;
2029
2030         if (!dev)
2031                 return -ENODEV;
2032         if (!driver || driver != dev->driver || !driver->unbind)
2033                 return -EINVAL;
2034
2035         spin_lock_irqsave (&dev->lock, flags);
2036         stop_activity (dev, driver);
2037         spin_unlock_irqrestore (&dev->lock, flags);
2038
2039         net2280_pullup (&dev->gadget, 0);
2040
2041         driver->unbind (&dev->gadget);
2042         dev->gadget.dev.driver = NULL;
2043         dev->driver = NULL;
2044
2045         net2280_led_active (dev, 0);
2046         device_remove_file (&dev->pdev->dev, &dev_attr_function);
2047         device_remove_file (&dev->pdev->dev, &dev_attr_queues);
2048
2049         DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
2050         return 0;
2051 }
2052 EXPORT_SYMBOL (usb_gadget_unregister_driver);
2053
2054
2055 /*-------------------------------------------------------------------------*/
2056
2057 /* handle ep0, ep-e, ep-f with 64 byte packets: packet per irq.
2058  * also works for dma-capable endpoints, in pio mode or just
2059  * to manually advance the queue after short OUT transfers.
2060  */
2061 static void handle_ep_small (struct net2280_ep *ep)
2062 {
2063         struct net2280_request  *req;
2064         u32                     t;
2065         /* 0 error, 1 mid-data, 2 done */
2066         int                     mode = 1;
2067
2068         if (!list_empty (&ep->queue))
2069                 req = list_entry (ep->queue.next,
2070                         struct net2280_request, queue);
2071         else
2072                 req = NULL;
2073
2074         /* ack all, and handle what we care about */
2075         t = readl (&ep->regs->ep_stat);
2076         ep->irqs++;
2077 #if 0
2078         VDEBUG (ep->dev, "%s ack ep_stat %08x, req %p\n",
2079                         ep->ep.name, t, req ? &req->req : 0);
2080 #endif
2081         if (!ep->is_in || ep->dev->pdev->device == 0x2280)
2082                 writel (t & ~(1 << NAK_OUT_PACKETS), &ep->regs->ep_stat);
2083         else
2084                 /* Added for 2282 */
2085                 writel (t, &ep->regs->ep_stat);
2086
2087         /* for ep0, monitor token irqs to catch data stage length errors
2088          * and to synchronize on status.
2089          *
2090          * also, to defer reporting of protocol stalls ... here's where
2091          * data or status first appears, handling stalls here should never
2092          * cause trouble on the host side..
2093          *
2094          * control requests could be slightly faster without token synch for
2095          * status, but status can jam up that way.
2096          */
2097         if (unlikely (ep->num == 0)) {
2098                 if (ep->is_in) {
2099                         /* status; stop NAKing */
2100                         if (t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)) {
2101                                 if (ep->dev->protocol_stall) {
2102                                         ep->stopped = 1;
2103                                         set_halt (ep);
2104                                 }
2105                                 if (!req)
2106                                         allow_status (ep);
2107                                 mode = 2;
2108                         /* reply to extra IN data tokens with a zlp */
2109                         } else if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2110                                 if (ep->dev->protocol_stall) {
2111                                         ep->stopped = 1;
2112                                         set_halt (ep);
2113                                         mode = 2;
2114                                 } else if (ep->responded &&
2115                                                 !req && !ep->stopped)
2116                                         write_fifo (ep, NULL);
2117                         }
2118                 } else {
2119                         /* status; stop NAKing */
2120                         if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2121                                 if (ep->dev->protocol_stall) {
2122                                         ep->stopped = 1;
2123                                         set_halt (ep);
2124                                 }
2125                                 mode = 2;
2126                         /* an extra OUT token is an error */
2127                         } else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
2128                                         && req
2129                                         && req->req.actual == req->req.length)
2130                                         || (ep->responded && !req)) {
2131                                 ep->dev->protocol_stall = 1;
2132                                 set_halt (ep);
2133                                 ep->stopped = 1;
2134                                 if (req)
2135                                         done (ep, req, -EOVERFLOW);
2136                                 req = NULL;
2137                         }
2138                 }
2139         }
2140
2141         if (unlikely (!req))
2142                 return;
2143
2144         /* manual DMA queue advance after short OUT */
2145         if (likely (ep->dma != 0)) {
2146                 if (t & (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)) {
2147                         u32     count;
2148                         int     stopped = ep->stopped;
2149
2150                         /* TRANSFERRED works around OUT_DONE erratum 0112.
2151                          * we expect (N <= maxpacket) bytes; host wrote M.
2152                          * iff (M < N) we won't ever see a DMA interrupt.
2153                          */
2154                         ep->stopped = 1;
2155                         for (count = 0; ; t = readl (&ep->regs->ep_stat)) {
2156
2157                                 /* any preceding dma transfers must finish.
2158                                  * dma handles (M >= N), may empty the queue
2159                                  */
2160                                 scan_dma_completions (ep);
2161                                 if (unlikely (list_empty (&ep->queue)
2162                                                 || ep->out_overflow)) {
2163                                         req = NULL;
2164                                         break;
2165                                 }
2166                                 req = list_entry (ep->queue.next,
2167                                         struct net2280_request, queue);
2168
2169                                 /* here either (M < N), a "real" short rx;
2170                                  * or (M == N) and the queue didn't empty
2171                                  */
2172                                 if (likely (t & (1 << FIFO_EMPTY))) {
2173                                         count = readl (&ep->dma->dmacount);
2174                                         count &= DMA_BYTE_COUNT_MASK;
2175                                         if (readl (&ep->dma->dmadesc)
2176                                                         != req->td_dma)
2177                                                 req = NULL;
2178                                         break;
2179                                 }
2180                                 udelay(1);
2181                         }
2182
2183                         /* stop DMA, leave ep NAKing */
2184                         writel ((1 << DMA_ABORT), &ep->dma->dmastat);
2185                         spin_stop_dma (ep->dma);
2186
2187                         if (likely (req)) {
2188                                 req->td->dmacount = 0;
2189                                 t = readl (&ep->regs->ep_avail);
2190                                 dma_done (ep, req, count,
2191                                         (ep->out_overflow || t)
2192                                                 ? -EOVERFLOW : 0);
2193                         }
2194
2195                         /* also flush to prevent erratum 0106 trouble */
2196                         if (unlikely (ep->out_overflow
2197                                         || (ep->dev->chiprev == 0x0100
2198                                                 && ep->dev->gadget.speed
2199                                                         == USB_SPEED_FULL))) {
2200                                 out_flush (ep);
2201                                 ep->out_overflow = 0;
2202                         }
2203
2204                         /* (re)start dma if needed, stop NAKing */
2205                         ep->stopped = stopped;
2206                         if (!list_empty (&ep->queue))
2207                                 restart_dma (ep);
2208                 } else
2209                         DEBUG (ep->dev, "%s dma ep_stat %08x ??\n",
2210                                         ep->ep.name, t);
2211                 return;
2212
2213         /* data packet(s) received (in the fifo, OUT) */
2214         } else if (t & (1 << DATA_PACKET_RECEIVED_INTERRUPT)) {
2215                 if (read_fifo (ep, req) && ep->num != 0)
2216                         mode = 2;
2217
2218         /* data packet(s) transmitted (IN) */
2219         } else if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)) {
2220                 unsigned        len;
2221
2222                 len = req->req.length - req->req.actual;
2223                 if (len > ep->ep.maxpacket)
2224                         len = ep->ep.maxpacket;
2225                 req->req.actual += len;
2226
2227                 /* if we wrote it all, we're usually done */
2228                 if (req->req.actual == req->req.length) {
2229                         if (ep->num == 0) {
2230                                 /* send zlps until the status stage */
2231                         } else if (!req->req.zero || len != ep->ep.maxpacket)
2232                                 mode = 2;
2233                 }
2234
2235         /* there was nothing to do ...  */
2236         } else if (mode == 1)
2237                 return;
2238
2239         /* done */
2240         if (mode == 2) {
2241                 /* stream endpoints often resubmit/unlink in completion */
2242                 done (ep, req, 0);
2243
2244                 /* maybe advance queue to next request */
2245                 if (ep->num == 0) {
2246                         /* NOTE:  net2280 could let gadget driver start the
2247                          * status stage later. since not all controllers let
2248                          * them control that, the api doesn't (yet) allow it.
2249                          */
2250                         if (!ep->stopped)
2251                                 allow_status (ep);
2252                         req = NULL;
2253                 } else {
2254                         if (!list_empty (&ep->queue) && !ep->stopped)
2255                                 req = list_entry (ep->queue.next,
2256                                         struct net2280_request, queue);
2257                         else
2258                                 req = NULL;
2259                         if (req && !ep->is_in)
2260                                 stop_out_naking (ep);
2261                 }
2262         }
2263
2264         /* is there a buffer for the next packet?
2265          * for best streaming performance, make sure there is one.
2266          */
2267         if (req && !ep->stopped) {
2268
2269                 /* load IN fifo with next packet (may be zlp) */
2270                 if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT))
2271                         write_fifo (ep, &req->req);
2272         }
2273 }
2274
2275 static struct net2280_ep *
2276 get_ep_by_addr (struct net2280 *dev, u16 wIndex)
2277 {
2278         struct net2280_ep       *ep;
2279
2280         if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
2281                 return &dev->ep [0];
2282         list_for_each_entry (ep, &dev->gadget.ep_list, ep.ep_list) {
2283                 u8      bEndpointAddress;
2284
2285                 if (!ep->desc)
2286                         continue;
2287                 bEndpointAddress = ep->desc->bEndpointAddress;
2288                 if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
2289                         continue;
2290                 if ((wIndex & 0x0f) == (bEndpointAddress & 0x0f))
2291                         return ep;
2292         }
2293         return NULL;
2294 }
2295
2296 static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
2297 {
2298         struct net2280_ep       *ep;
2299         u32                     num, scratch;
2300
2301         /* most of these don't need individual acks */
2302         stat &= ~(1 << INTA_ASSERTED);
2303         if (!stat)
2304                 return;
2305         // DEBUG (dev, "irqstat0 %04x\n", stat);
2306
2307         /* starting a control request? */
2308         if (unlikely (stat & (1 << SETUP_PACKET_INTERRUPT))) {
2309                 union {
2310                         u32                     raw [2];
2311                         struct usb_ctrlrequest  r;
2312                 } u;
2313                 int                             tmp;
2314                 struct net2280_request          *req;
2315
2316                 if (dev->gadget.speed == USB_SPEED_UNKNOWN) {
2317                         if (readl (&dev->usb->usbstat) & (1 << HIGH_SPEED))
2318                                 dev->gadget.speed = USB_SPEED_HIGH;
2319                         else
2320                                 dev->gadget.speed = USB_SPEED_FULL;
2321                         net2280_led_speed (dev, dev->gadget.speed);
2322                         DEBUG (dev, "%s speed\n",
2323                                 (dev->gadget.speed == USB_SPEED_HIGH)
2324                                         ? "high" : "full");
2325                 }
2326
2327                 ep = &dev->ep [0];
2328                 ep->irqs++;
2329
2330                 /* make sure any leftover request state is cleared */
2331                 stat &= ~(1 << ENDPOINT_0_INTERRUPT);
2332                 while (!list_empty (&ep->queue)) {
2333                         req = list_entry (ep->queue.next,
2334                                         struct net2280_request, queue);
2335                         done (ep, req, (req->req.actual == req->req.length)
2336                                                 ? 0 : -EPROTO);
2337                 }
2338                 ep->stopped = 0;
2339                 dev->protocol_stall = 0;
2340
2341                 if (ep->dev->pdev->device == 0x2280)
2342                         tmp = (1 << FIFO_OVERFLOW)
2343                                 | (1 << FIFO_UNDERFLOW);
2344                 else
2345                         tmp = 0;
2346
2347                 writel (tmp | (1 << TIMEOUT)
2348                         | (1 << USB_STALL_SENT)
2349                         | (1 << USB_IN_NAK_SENT)
2350                         | (1 << USB_IN_ACK_RCVD)
2351                         | (1 << USB_OUT_PING_NAK_SENT)
2352                         | (1 << USB_OUT_ACK_SENT)
2353                         | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
2354                         | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
2355                         | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2356                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2357                         | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2358                         | (1 << DATA_IN_TOKEN_INTERRUPT)
2359                         , &ep->regs->ep_stat);
2360                 u.raw [0] = readl (&dev->usb->setup0123);
2361                 u.raw [1] = readl (&dev->usb->setup4567);
2362
2363                 cpu_to_le32s (&u.raw [0]);
2364                 cpu_to_le32s (&u.raw [1]);
2365
2366                 tmp = 0;
2367
2368 #define w_value         le16_to_cpu(u.r.wValue)
2369 #define w_index         le16_to_cpu(u.r.wIndex)
2370 #define w_length        le16_to_cpu(u.r.wLength)
2371
2372                 /* ack the irq */
2373                 writel (1 << SETUP_PACKET_INTERRUPT, &dev->regs->irqstat0);
2374                 stat ^= (1 << SETUP_PACKET_INTERRUPT);
2375
2376                 /* watch control traffic at the token level, and force
2377                  * synchronization before letting the status stage happen.
2378                  * FIXME ignore tokens we'll NAK, until driver responds.
2379                  * that'll mean a lot less irqs for some drivers.
2380                  */
2381                 ep->is_in = (u.r.bRequestType & USB_DIR_IN) != 0;
2382                 if (ep->is_in) {
2383                         scratch = (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2384                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2385                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2386                         stop_out_naking (ep);
2387                 } else
2388                         scratch = (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2389                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2390                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2391                 writel (scratch, &dev->epregs [0].ep_irqenb);
2392
2393                 /* we made the hardware handle most lowlevel requests;
2394                  * everything else goes uplevel to the gadget code.
2395                  */
2396                 ep->responded = 1;
2397                 switch (u.r.bRequest) {
2398                 case USB_REQ_GET_STATUS: {
2399                         struct net2280_ep       *e;
2400                         __le32                  status;
2401
2402                         /* hw handles device and interface status */
2403                         if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
2404                                 goto delegate;
2405                         if ((e = get_ep_by_addr (dev, w_index)) == 0
2406                                         || w_length > 2)
2407                                 goto do_stall;
2408
2409                         if (readl (&e->regs->ep_rsp)
2410                                         & (1 << SET_ENDPOINT_HALT))
2411                                 status = cpu_to_le32 (1);
2412                         else
2413                                 status = cpu_to_le32 (0);
2414
2415                         /* don't bother with a request object! */
2416                         writel (0, &dev->epregs [0].ep_irqenb);
2417                         set_fifo_bytecount (ep, w_length);
2418                         writel ((__force u32)status, &dev->epregs [0].ep_data);
2419                         allow_status (ep);
2420                         VDEBUG (dev, "%s stat %02x\n", ep->ep.name, status);
2421                         goto next_endpoints;
2422                         }
2423                         break;
2424                 case USB_REQ_CLEAR_FEATURE: {
2425                         struct net2280_ep       *e;
2426
2427                         /* hw handles device features */
2428                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2429                                 goto delegate;
2430                         if (w_value != USB_ENDPOINT_HALT
2431                                         || w_length != 0)
2432                                 goto do_stall;
2433                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2434                                 goto do_stall;
2435                         if (e->wedged) {
2436                                 VDEBUG(dev, "%s wedged, halt not cleared\n",
2437                                                 ep->ep.name);
2438                         } else {
2439                                 VDEBUG(dev, "%s clear halt\n", ep->ep.name);
2440                                 clear_halt(e);
2441                         }
2442                         allow_status (ep);
2443                         goto next_endpoints;
2444                         }
2445                         break;
2446                 case USB_REQ_SET_FEATURE: {
2447                         struct net2280_ep       *e;
2448
2449                         /* hw handles device features */
2450                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2451                                 goto delegate;
2452                         if (w_value != USB_ENDPOINT_HALT
2453                                         || w_length != 0)
2454                                 goto do_stall;
2455                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2456                                 goto do_stall;
2457                         if (e->ep.name == ep0name)
2458                                 goto do_stall;
2459                         set_halt (e);
2460                         allow_status (ep);
2461                         VDEBUG (dev, "%s set halt\n", ep->ep.name);
2462                         goto next_endpoints;
2463                         }
2464                         break;
2465                 default:
2466 delegate:
2467                         VDEBUG (dev, "setup %02x.%02x v%04x i%04x l%04x "
2468                                 "ep_cfg %08x\n",
2469                                 u.r.bRequestType, u.r.bRequest,
2470                                 w_value, w_index, w_length,
2471                                 readl (&ep->regs->ep_cfg));
2472                         ep->responded = 0;
2473                         spin_unlock (&dev->lock);
2474                         tmp = dev->driver->setup (&dev->gadget, &u.r);
2475                         spin_lock (&dev->lock);
2476                 }
2477
2478                 /* stall ep0 on error */
2479                 if (tmp < 0) {
2480 do_stall:
2481                         VDEBUG (dev, "req %02x.%02x protocol STALL; stat %d\n",
2482                                         u.r.bRequestType, u.r.bRequest, tmp);
2483                         dev->protocol_stall = 1;
2484                 }
2485
2486                 /* some in/out token irq should follow; maybe stall then.
2487                  * driver must queue a request (even zlp) or halt ep0
2488                  * before the host times out.
2489                  */
2490         }
2491
2492 #undef  w_value
2493 #undef  w_index
2494 #undef  w_length
2495
2496 next_endpoints:
2497         /* endpoint data irq ? */
2498         scratch = stat & 0x7f;
2499         stat &= ~0x7f;
2500         for (num = 0; scratch; num++) {
2501                 u32             t;
2502
2503                 /* do this endpoint's FIFO and queue need tending? */
2504                 t = 1 << num;
2505                 if ((scratch & t) == 0)
2506                         continue;
2507                 scratch ^= t;
2508
2509                 ep = &dev->ep [num];
2510                 handle_ep_small (ep);
2511         }
2512
2513         if (stat)
2514                 DEBUG (dev, "unhandled irqstat0 %08x\n", stat);
2515 }
2516
2517 #define DMA_INTERRUPTS ( \
2518                   (1 << DMA_D_INTERRUPT) \
2519                 | (1 << DMA_C_INTERRUPT) \
2520                 | (1 << DMA_B_INTERRUPT) \
2521                 | (1 << DMA_A_INTERRUPT))
2522 #define PCI_ERROR_INTERRUPTS ( \
2523                   (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT) \
2524                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT) \
2525                 | (1 << PCI_RETRY_ABORT_INTERRUPT))
2526
2527 static void handle_stat1_irqs (struct net2280 *dev, u32 stat)
2528 {
2529         struct net2280_ep       *ep;
2530         u32                     tmp, num, mask, scratch;
2531
2532         /* after disconnect there's nothing else to do! */
2533         tmp = (1 << VBUS_INTERRUPT) | (1 << ROOT_PORT_RESET_INTERRUPT);
2534         mask = (1 << HIGH_SPEED) | (1 << FULL_SPEED);
2535
2536         /* VBUS disconnect is indicated by VBUS_PIN and VBUS_INTERRUPT set.
2537          * Root Port Reset is indicated by ROOT_PORT_RESET_INTERRRUPT set and
2538          * both HIGH_SPEED and FULL_SPEED clear (as ROOT_PORT_RESET_INTERRUPT
2539          * only indicates a change in the reset state).
2540          */
2541         if (stat & tmp) {
2542                 writel (tmp, &dev->regs->irqstat1);
2543                 if ((((stat & (1 << ROOT_PORT_RESET_INTERRUPT))
2544                                         && ((readl (&dev->usb->usbstat) & mask)
2545                                                         == 0))
2546                                 || ((readl (&dev->usb->usbctl)
2547                                         & (1 << VBUS_PIN)) == 0)
2548                             ) && ( dev->gadget.speed != USB_SPEED_UNKNOWN)) {
2549                         DEBUG (dev, "disconnect %s\n",
2550                                         dev->driver->driver.name);
2551                         stop_activity (dev, dev->driver);
2552                         ep0_start (dev);
2553                         return;
2554                 }
2555                 stat &= ~tmp;
2556
2557                 /* vBUS can bounce ... one of many reasons to ignore the
2558                  * notion of hotplug events on bus connect/disconnect!
2559                  */
2560                 if (!stat)
2561                         return;
2562         }
2563
2564         /* NOTE: chip stays in PCI D0 state for now, but it could
2565          * enter D1 to save more power
2566          */
2567         tmp = (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT);
2568         if (stat & tmp) {
2569                 writel (tmp, &dev->regs->irqstat1);
2570                 if (stat & (1 << SUSPEND_REQUEST_INTERRUPT)) {
2571                         if (dev->driver->suspend)
2572                                 dev->driver->suspend (&dev->gadget);
2573                         if (!enable_suspend)
2574                                 stat &= ~(1 << SUSPEND_REQUEST_INTERRUPT);
2575                 } else {
2576                         if (dev->driver->resume)
2577                                 dev->driver->resume (&dev->gadget);
2578                         /* at high speed, note erratum 0133 */
2579                 }
2580                 stat &= ~tmp;
2581         }
2582
2583         /* clear any other status/irqs */
2584         if (stat)
2585                 writel (stat, &dev->regs->irqstat1);
2586
2587         /* some status we can just ignore */
2588         if (dev->pdev->device == 0x2280)
2589                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2590                           | (1 << SUSPEND_REQUEST_INTERRUPT)
2591                           | (1 << RESUME_INTERRUPT)
2592                           | (1 << SOF_INTERRUPT));
2593         else
2594                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2595                           | (1 << RESUME_INTERRUPT)
2596                           | (1 << SOF_DOWN_INTERRUPT)
2597                           | (1 << SOF_INTERRUPT));
2598
2599         if (!stat)
2600                 return;
2601         // DEBUG (dev, "irqstat1 %08x\n", stat);
2602
2603         /* DMA status, for ep-{a,b,c,d} */
2604         scratch = stat & DMA_INTERRUPTS;
2605         stat &= ~DMA_INTERRUPTS;
2606         scratch >>= 9;
2607         for (num = 0; scratch; num++) {
2608                 struct net2280_dma_regs __iomem *dma;
2609
2610                 tmp = 1 << num;
2611                 if ((tmp & scratch) == 0)
2612                         continue;
2613                 scratch ^= tmp;
2614
2615                 ep = &dev->ep [num + 1];
2616                 dma = ep->dma;
2617
2618                 if (!dma)
2619                         continue;
2620
2621                 /* clear ep's dma status */
2622                 tmp = readl (&dma->dmastat);
2623                 writel (tmp, &dma->dmastat);
2624
2625                 /* chaining should stop on abort, short OUT from fifo,
2626                  * or (stat0 codepath) short OUT transfer.
2627                  */
2628                 if (!use_dma_chaining) {
2629                         if ((tmp & (1 << DMA_TRANSACTION_DONE_INTERRUPT))
2630                                         == 0) {
2631                                 DEBUG (ep->dev, "%s no xact done? %08x\n",
2632                                         ep->ep.name, tmp);
2633                                 continue;
2634                         }
2635                         stop_dma (ep->dma);
2636                 }
2637
2638                 /* OUT transfers terminate when the data from the
2639                  * host is in our memory.  Process whatever's done.
2640                  * On this path, we know transfer's last packet wasn't
2641                  * less than req->length. NAK_OUT_PACKETS may be set,
2642                  * or the FIFO may already be holding new packets.
2643                  *
2644                  * IN transfers can linger in the FIFO for a very
2645                  * long time ... we ignore that for now, accounting
2646                  * precisely (like PIO does) needs per-packet irqs
2647                  */
2648                 scan_dma_completions (ep);
2649
2650                 /* disable dma on inactive queues; else maybe restart */
2651                 if (list_empty (&ep->queue)) {
2652                         if (use_dma_chaining)
2653                                 stop_dma (ep->dma);
2654                 } else {
2655                         tmp = readl (&dma->dmactl);
2656                         if (!use_dma_chaining
2657                                         || (tmp & (1 << DMA_ENABLE)) == 0)
2658                                 restart_dma (ep);
2659                         else if (ep->is_in && use_dma_chaining) {
2660                                 struct net2280_request  *req;
2661                                 __le32                  dmacount;
2662
2663                                 /* the descriptor at the head of the chain
2664                                  * may still have VALID_BIT clear; that's
2665                                  * used to trigger changing DMA_FIFO_VALIDATE
2666                                  * (affects automagic zlp writes).
2667                                  */
2668                                 req = list_entry (ep->queue.next,
2669                                                 struct net2280_request, queue);
2670                                 dmacount = req->td->dmacount;
2671                                 dmacount &= cpu_to_le32 (
2672                                                 (1 << VALID_BIT)
2673                                                 | DMA_BYTE_COUNT_MASK);
2674                                 if (dmacount && (dmacount & valid_bit) == 0)
2675                                         restart_dma (ep);
2676                         }
2677                 }
2678                 ep->irqs++;
2679         }
2680
2681         /* NOTE:  there are other PCI errors we might usefully notice.
2682          * if they appear very often, here's where to try recovering.
2683          */
2684         if (stat & PCI_ERROR_INTERRUPTS) {
2685                 ERROR (dev, "pci dma error; stat %08x\n", stat);
2686                 stat &= ~PCI_ERROR_INTERRUPTS;
2687                 /* these are fatal errors, but "maybe" they won't
2688                  * happen again ...
2689                  */
2690                 stop_activity (dev, dev->driver);
2691                 ep0_start (dev);
2692                 stat = 0;
2693         }
2694
2695         if (stat)
2696                 DEBUG (dev, "unhandled irqstat1 %08x\n", stat);
2697 }
2698
2699 static irqreturn_t net2280_irq (int irq, void *_dev)
2700 {
2701         struct net2280          *dev = _dev;
2702
2703         /* shared interrupt, not ours */
2704         if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
2705                 return IRQ_NONE;
2706
2707         spin_lock (&dev->lock);
2708
2709         /* handle disconnect, dma, and more */
2710         handle_stat1_irqs (dev, readl (&dev->regs->irqstat1));
2711
2712         /* control requests and PIO */
2713         handle_stat0_irqs (dev, readl (&dev->regs->irqstat0));
2714
2715         spin_unlock (&dev->lock);
2716
2717         return IRQ_HANDLED;
2718 }
2719
2720 /*-------------------------------------------------------------------------*/
2721
2722 static void gadget_release (struct device *_dev)
2723 {
2724         struct net2280  *dev = dev_get_drvdata (_dev);
2725
2726         kfree (dev);
2727 }
2728
2729 /* tear down the binding between this driver and the pci device */
2730
2731 static void net2280_remove (struct pci_dev *pdev)
2732 {
2733         struct net2280          *dev = pci_get_drvdata (pdev);
2734
2735         BUG_ON(dev->driver);
2736
2737         /* then clean up the resources we allocated during probe() */
2738         net2280_led_shutdown (dev);
2739         if (dev->requests) {
2740                 int             i;
2741                 for (i = 1; i < 5; i++) {
2742                         if (!dev->ep [i].dummy)
2743                                 continue;
2744                         pci_pool_free (dev->requests, dev->ep [i].dummy,
2745                                         dev->ep [i].td_dma);
2746                 }
2747                 pci_pool_destroy (dev->requests);
2748         }
2749         if (dev->got_irq)
2750                 free_irq (pdev->irq, dev);
2751         if (dev->regs)
2752                 iounmap (dev->regs);
2753         if (dev->region)
2754                 release_mem_region (pci_resource_start (pdev, 0),
2755                                 pci_resource_len (pdev, 0));
2756         if (dev->enabled)
2757                 pci_disable_device (pdev);
2758         device_unregister (&dev->gadget.dev);
2759         device_remove_file (&pdev->dev, &dev_attr_registers);
2760         pci_set_drvdata (pdev, NULL);
2761
2762         INFO (dev, "unbind\n");
2763
2764         the_controller = NULL;
2765 }
2766
2767 /* wrap this driver around the specified device, but
2768  * don't respond over USB until a gadget driver binds to us.
2769  */
2770
2771 static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
2772 {
2773         struct net2280          *dev;
2774         unsigned long           resource, len;
2775         void                    __iomem *base = NULL;
2776         int                     retval, i;
2777
2778         /* if you want to support more than one controller in a system,
2779          * usb_gadget_driver_{register,unregister}() must change.
2780          */
2781         if (the_controller) {
2782                 dev_warn (&pdev->dev, "ignoring\n");
2783                 return -EBUSY;
2784         }
2785
2786         /* alloc, and start init */
2787         dev = kzalloc (sizeof *dev, GFP_KERNEL);
2788         if (dev == NULL){
2789                 retval = -ENOMEM;
2790                 goto done;
2791         }
2792
2793         pci_set_drvdata (pdev, dev);
2794         spin_lock_init (&dev->lock);
2795         dev->pdev = pdev;
2796         dev->gadget.ops = &net2280_ops;
2797         dev->gadget.is_dualspeed = 1;
2798
2799         /* the "gadget" abstracts/virtualizes the controller */
2800         dev_set_name(&dev->gadget.dev, "gadget");
2801         dev->gadget.dev.parent = &pdev->dev;
2802         dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
2803         dev->gadget.dev.release = gadget_release;
2804         dev->gadget.name = driver_name;
2805
2806         /* now all the pci goodies ... */
2807         if (pci_enable_device (pdev) < 0) {
2808                 retval = -ENODEV;
2809                 goto done;
2810         }
2811         dev->enabled = 1;
2812
2813         /* BAR 0 holds all the registers
2814          * BAR 1 is 8051 memory; unused here (note erratum 0103)
2815          * BAR 2 is fifo memory; unused here
2816          */
2817         resource = pci_resource_start (pdev, 0);
2818         len = pci_resource_len (pdev, 0);
2819         if (!request_mem_region (resource, len, driver_name)) {
2820                 DEBUG (dev, "controller already in use\n");
2821                 retval = -EBUSY;
2822                 goto done;
2823         }
2824         dev->region = 1;
2825
2826         /* FIXME provide firmware download interface to put
2827          * 8051 code into the chip, e.g. to turn on PCI PM.
2828          */
2829
2830         base = ioremap_nocache (resource, len);
2831         if (base == NULL) {
2832                 DEBUG (dev, "can't map memory\n");
2833                 retval = -EFAULT;
2834                 goto done;
2835         }
2836         dev->regs = (struct net2280_regs __iomem *) base;
2837         dev->usb = (struct net2280_usb_regs __iomem *) (base + 0x0080);
2838         dev->pci = (struct net2280_pci_regs __iomem *) (base + 0x0100);
2839         dev->dma = (struct net2280_dma_regs __iomem *) (base + 0x0180);
2840         dev->dep = (struct net2280_dep_regs __iomem *) (base + 0x0200);
2841         dev->epregs = (struct net2280_ep_regs __iomem *) (base + 0x0300);
2842
2843         /* put into initial config, link up all endpoints */
2844         writel (0, &dev->usb->usbctl);
2845         usb_reset (dev);
2846         usb_reinit (dev);
2847
2848         /* irq setup after old hardware is cleaned up */
2849         if (!pdev->irq) {
2850                 ERROR (dev, "No IRQ.  Check PCI setup!\n");
2851                 retval = -ENODEV;
2852                 goto done;
2853         }
2854
2855         if (request_irq (pdev->irq, net2280_irq, IRQF_SHARED, driver_name, dev)
2856                         != 0) {
2857                 ERROR (dev, "request interrupt %d failed\n", pdev->irq);
2858                 retval = -EBUSY;
2859                 goto done;
2860         }
2861         dev->got_irq = 1;
2862
2863         /* DMA setup */
2864         /* NOTE:  we know only the 32 LSBs of dma addresses may be nonzero */
2865         dev->requests = pci_pool_create ("requests", pdev,
2866                 sizeof (struct net2280_dma),
2867                 0 /* no alignment requirements */,
2868                 0 /* or page-crossing issues */);
2869         if (!dev->requests) {
2870                 DEBUG (dev, "can't get request pool\n");
2871                 retval = -ENOMEM;
2872                 goto done;
2873         }
2874         for (i = 1; i < 5; i++) {
2875                 struct net2280_dma      *td;
2876
2877                 td = pci_pool_alloc (dev->requests, GFP_KERNEL,
2878                                 &dev->ep [i].td_dma);
2879                 if (!td) {
2880                         DEBUG (dev, "can't get dummy %d\n", i);
2881                         retval = -ENOMEM;
2882                         goto done;
2883                 }
2884                 td->dmacount = 0;       /* not VALID */
2885                 td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
2886                 td->dmadesc = td->dmaaddr;
2887                 dev->ep [i].dummy = td;
2888         }
2889
2890         /* enable lower-overhead pci memory bursts during DMA */
2891         writel ( (1 << DMA_MEMORY_WRITE_AND_INVALIDATE_ENABLE)
2892                         // 256 write retries may not be enough...
2893                         // | (1 << PCI_RETRY_ABORT_ENABLE)
2894                         | (1 << DMA_READ_MULTIPLE_ENABLE)
2895                         | (1 << DMA_READ_LINE_ENABLE)
2896                         , &dev->pci->pcimstctl);
2897         /* erratum 0115 shouldn't appear: Linux inits PCI_LATENCY_TIMER */
2898         pci_set_master (pdev);
2899         pci_try_set_mwi (pdev);
2900
2901         /* ... also flushes any posted pci writes */
2902         dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
2903
2904         /* done */
2905         INFO (dev, "%s\n", driver_desc);
2906         INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
2907                         pdev->irq, base, dev->chiprev);
2908         INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
2909                         use_dma
2910                                 ? (use_dma_chaining ? "chaining" : "enabled")
2911                                 : "disabled");
2912         the_controller = dev;
2913
2914         retval = device_register (&dev->gadget.dev);
2915         if (retval) goto done;
2916         retval = device_create_file (&pdev->dev, &dev_attr_registers);
2917         if (retval) goto done;
2918
2919         return 0;
2920
2921 done:
2922         if (dev)
2923                 net2280_remove (pdev);
2924         return retval;
2925 }
2926
2927 /* make sure the board is quiescent; otherwise it will continue
2928  * generating IRQs across the upcoming reboot.
2929  */
2930
2931 static void net2280_shutdown (struct pci_dev *pdev)
2932 {
2933         struct net2280          *dev = pci_get_drvdata (pdev);
2934
2935         /* disable IRQs */
2936         writel (0, &dev->regs->pciirqenb0);
2937         writel (0, &dev->regs->pciirqenb1);
2938
2939         /* disable the pullup so the host will think we're gone */
2940         writel (0, &dev->usb->usbctl);
2941 }
2942
2943
2944 /*-------------------------------------------------------------------------*/
2945
2946 static const struct pci_device_id pci_ids [] = { {
2947         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2948         .class_mask =   ~0,
2949         .vendor =       0x17cc,
2950         .device =       0x2280,
2951         .subvendor =    PCI_ANY_ID,
2952         .subdevice =    PCI_ANY_ID,
2953 }, {
2954         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2955         .class_mask =   ~0,
2956         .vendor =       0x17cc,
2957         .device =       0x2282,
2958         .subvendor =    PCI_ANY_ID,
2959         .subdevice =    PCI_ANY_ID,
2960
2961 }, { /* end: all zeroes */ }
2962 };
2963 MODULE_DEVICE_TABLE (pci, pci_ids);
2964
2965 /* pci driver glue; this is a "new style" PCI driver module */
2966 static struct pci_driver net2280_pci_driver = {
2967         .name =         (char *) driver_name,
2968         .id_table =     pci_ids,
2969
2970         .probe =        net2280_probe,
2971         .remove =       net2280_remove,
2972         .shutdown =     net2280_shutdown,
2973
2974         /* FIXME add power management support */
2975 };
2976
2977 MODULE_DESCRIPTION (DRIVER_DESC);
2978 MODULE_AUTHOR ("David Brownell");
2979 MODULE_LICENSE ("GPL");
2980
2981 static int __init init (void)
2982 {
2983         if (!use_dma)
2984                 use_dma_chaining = 0;
2985         return pci_register_driver (&net2280_pci_driver);
2986 }
2987 module_init (init);
2988
2989 static void __exit cleanup (void)
2990 {
2991         pci_unregister_driver (&net2280_pci_driver);
2992 }
2993 module_exit (cleanup);