drivers/usb/gadget/net2280.c

   1 /*
   2  * Driver for the PLX NET2280 USB device controller.
   3  * Specs and errata are available from <http://www.plxtech.com>.
   4  *
   5  * PLX Technology Inc. (formerly NetChip Technology) supported the
   6  * development of this driver.
   7  *
   8  *
   9  * CODE STATUS HIGHLIGHTS
  10  *
  11  * This driver should work well with most "gadget" drivers, including
  12  * the File Storage, Serial, and Ethernet/RNDIS gadget drivers
  13  * as well as Gadget Zero and Gadgetfs.
  14  *
  15  * DMA is enabled by default.  Drivers using transfer queues might use
  16  * DMA chaining to remove IRQ latencies between transfers.  (Except when
  17  * short OUT transfers happen.)  Drivers can use the req->no_interrupt
  18  * hint to completely eliminate some IRQs, if a later IRQ is guaranteed
  19  * and DMA chaining is enabled.
  20  *
  21  * Note that almost all the errata workarounds here are only needed for
  22  * rev1 chips.  Rev1a silicon (0110) fixes almost all of them.
  23  */
  24
  25 /*
  26  * Copyright (C) 2003 David Brownell
  27  * Copyright (C) 2003-2005 PLX Technology, Inc.
  28  *
  29  * Modified Seth Levy 2005 PLX Technology, Inc. to provide compatibility
  30  *      with 2282 chip
  31  *
  32  * This program is free software; you can redistribute it and/or modify
  33  * it under the terms of the GNU General Public License as published by
  34  * the Free Software Foundation; either version 2 of the License, or
  35  * (at your option) any later version.
  36  */
  37
  38 #undef  DEBUG           /* messages on error and most fault paths */
  39 #undef  VERBOSE         /* extra debug messages (success too) */
  40
  41 #include <linux/module.h>
  42 #include <linux/pci.h>
  43 #include <linux/dma-mapping.h>
  44 #include <linux/kernel.h>
  45 #include <linux/delay.h>
  46 #include <linux/ioport.h>
  47 #include <linux/slab.h>
  48 #include <linux/errno.h>
  49 #include <linux/init.h>
  50 #include <linux/timer.h>
  51 #include <linux/list.h>
  52 #include <linux/interrupt.h>
  53 #include <linux/moduleparam.h>
  54 #include <linux/device.h>
  55 #include <linux/usb/ch9.h>
  56 #include <linux/usb/gadget.h>
  57 #include <linux/prefetch.h>
  58
  59 #include <asm/byteorder.h>
  60 #include <asm/io.h>
  61 #include <asm/irq.h>
  62 #include <asm/system.h>
  63 #include <asm/unaligned.h>
  64
  65
  66 #define DRIVER_DESC             "PLX NET228x USB Peripheral Controller"
  67 #define DRIVER_VERSION          "2005 Sept 27"
  68
  69 #define DMA_ADDR_INVALID        (~(dma_addr_t)0)
  70 #define EP_DONTUSE              13      /* nonzero */
  71
  72 #define USE_RDK_LEDS            /* GPIO pins control three LEDs */
  73
  74
  75 static const char driver_name [] = "net2280";
  76 static const char driver_desc [] = DRIVER_DESC;
  77
  78 static const char ep0name [] = "ep0";
  79 static const char *const ep_name [] = {
  80         ep0name,
  81         "ep-a", "ep-b", "ep-c", "ep-d",
  82         "ep-e", "ep-f",
  83 };
  84
  85 /* use_dma -- general goodness, fewer interrupts, less cpu load (vs PIO)
  86  * use_dma_chaining -- dma descriptor queueing gives even more irq reduction
  87  *
  88  * The net2280 DMA engines are not tightly integrated with their FIFOs;
  89  * not all cases are (yet) handled well in this driver or the silicon.
  90  * Some gadget drivers work better with the dma support here than others.
  91  * These two parameters let you use PIO or more aggressive DMA.
  92  */
  93 static int use_dma = 1;
  94 static int use_dma_chaining = 0;
  95
  96 /* "modprobe net2280 use_dma=n" etc */
  97 module_param (use_dma, bool, S_IRUGO);
  98 module_param (use_dma_chaining, bool, S_IRUGO);
  99
 100
 101 /* mode 0 == ep-{a,b,c,d} 1K fifo each
 102  * mode 1 == ep-{a,b} 2K fifo each, ep-{c,d} unavailable
 103  * mode 2 == ep-a 2K fifo, ep-{b,c} 1K each, ep-d unavailable
 104  */
 105 static ushort fifo_mode = 0;
 106
 107 /* "modprobe net2280 fifo_mode=1" etc */
 108 module_param (fifo_mode, ushort, 0644);
 109
 110 /* enable_suspend -- When enabled, the driver will respond to
 111  * USB suspend requests by powering down the NET2280.  Otherwise,
 112  * USB suspend requests will be ignored.  This is acceptable for
 113  * self-powered devices
 114  */
 115 static int enable_suspend = 0;
 116
 117 /* "modprobe net2280 enable_suspend=1" etc */
 118 module_param (enable_suspend, bool, S_IRUGO);
 119
 120
 121 #define DIR_STRING(bAddress) (((bAddress) & USB_DIR_IN) ? "in" : "out")
 122
 123 #if defined(CONFIG_USB_GADGET_DEBUG_FILES) || defined (DEBUG)
 124 static char *type_string (u8 bmAttributes)
 125 {
 126         switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
 127         case USB_ENDPOINT_XFER_BULK:    return "bulk";
 128         case USB_ENDPOINT_XFER_ISOC:    return "iso";
 129         case USB_ENDPOINT_XFER_INT:     return "intr";
 130         };
 131         return "control";
 132 }
 133 #endif
 134
 135 #include "net2280.h"
 136
 137 #define valid_bit       cpu_to_le32 (1 << VALID_BIT)
 138 #define dma_done_ie     cpu_to_le32 (1 << DMA_DONE_INTERRUPT_ENABLE)
 139
 140 /*-------------------------------------------------------------------------*/
 141
 142 static int
 143 net2280_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 144 {
 145         struct net2280          *dev;
 146         struct net2280_ep       *ep;
 147         u32                     max, tmp;
 148         unsigned long           flags;
 149
 150         ep = container_of (_ep, struct net2280_ep, ep);
 151         if (!_ep || !desc || ep->desc || _ep->name == ep0name
 152                         || desc->bDescriptorType != USB_DT_ENDPOINT)
 153                 return -EINVAL;
 154         dev = ep->dev;
 155         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 156                 return -ESHUTDOWN;
 157
 158         /* erratum 0119 workaround ties up an endpoint number */
 159         if ((desc->bEndpointAddress & 0x0f) == EP_DONTUSE)
 160                 return -EDOM;
 161
 162         /* sanity check ep-e/ep-f since their fifos are small */
 163         max = usb_endpoint_maxp (desc) & 0x1fff;
 164         if (ep->num > 4 && max > 64)
 165                 return -ERANGE;
 166
 167         spin_lock_irqsave (&dev->lock, flags);
 168         _ep->maxpacket = max & 0x7ff;
 169         ep->desc = desc;
 170
 171         /* ep_reset() has already been called */
 172         ep->stopped = 0;
 173         ep->wedged = 0;
 174         ep->out_overflow = 0;
 175
 176         /* set speed-dependent max packet; may kick in high bandwidth */
 177         set_idx_reg (dev->regs, REG_EP_MAXPKT (dev, ep->num), max);
 178
 179         /* FIFO lines can't go to different packets.  PIO is ok, so
 180          * use it instead of troublesome (non-bulk) multi-packet DMA.
 181          */
 182         if (ep->dma && (max % 4) != 0 && use_dma_chaining) {
 183                 DEBUG (ep->dev, "%s, no dma for maxpacket %d\n",
 184                         ep->ep.name, ep->ep.maxpacket);
 185                 ep->dma = NULL;
 186         }
 187
 188         /* set type, direction, address; reset fifo counters */
 189         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
 190         tmp = (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
 191         if (tmp == USB_ENDPOINT_XFER_INT) {
 192                 /* erratum 0105 workaround prevents hs NYET */
 193                 if (dev->chiprev == 0100
 194                                 && dev->gadget.speed == USB_SPEED_HIGH
 195                                 && !(desc->bEndpointAddress & USB_DIR_IN))
 196                         writel ((1 << CLEAR_NAK_OUT_PACKETS_MODE),
 197                                 &ep->regs->ep_rsp);
 198         } else if (tmp == USB_ENDPOINT_XFER_BULK) {
 199                 /* catch some particularly blatant driver bugs */
 200                 if ((dev->gadget.speed == USB_SPEED_HIGH
 201                                         && max != 512)
 202                                 || (dev->gadget.speed == USB_SPEED_FULL
 203                                         && max > 64)) {
 204                         spin_unlock_irqrestore (&dev->lock, flags);
 205                         return -ERANGE;
 206                 }
 207         }
 208         ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC) ? 1 : 0;
 209         tmp <<= ENDPOINT_TYPE;
 210         tmp |= desc->bEndpointAddress;
 211         tmp |= (4 << ENDPOINT_BYTE_COUNT);      /* default full fifo lines */
 212         tmp |= 1 << ENDPOINT_ENABLE;
 213         wmb ();
 214
 215         /* for OUT transfers, block the rx fifo until a read is posted */
 216         ep->is_in = (tmp & USB_DIR_IN) != 0;
 217         if (!ep->is_in)
 218                 writel ((1 << SET_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 219         else if (dev->pdev->device != 0x2280) {
 220                 /* Added for 2282, Don't use nak packets on an in endpoint,
 221                  * this was ignored on 2280
 222                  */
 223                 writel ((1 << CLEAR_NAK_OUT_PACKETS)
 224                         | (1 << CLEAR_NAK_OUT_PACKETS_MODE), &ep->regs->ep_rsp);
 225         }
 226
 227         writel (tmp, &ep->regs->ep_cfg);
 228
 229         /* enable irqs */
 230         if (!ep->dma) {                         /* pio, per-packet */
 231                 tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 232                 writel (tmp, &dev->regs->pciirqenb0);
 233
 234                 tmp = (1 << DATA_PACKET_RECEIVED_INTERRUPT_ENABLE)
 235                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT_ENABLE);
 236                 if (dev->pdev->device == 0x2280)
 237                         tmp |= readl (&ep->regs->ep_irqenb);
 238                 writel (tmp, &ep->regs->ep_irqenb);
 239         } else {                                /* dma, per-request */
 240                 tmp = (1 << (8 + ep->num));     /* completion */
 241                 tmp |= readl (&dev->regs->pciirqenb1);
 242                 writel (tmp, &dev->regs->pciirqenb1);
 243
 244                 /* for short OUT transfers, dma completions can't
 245                  * advance the queue; do it pio-style, by hand.
 246                  * NOTE erratum 0112 workaround #2
 247                  */
 248                 if ((desc->bEndpointAddress & USB_DIR_IN) == 0) {
 249                         tmp = (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT_ENABLE);
 250                         writel (tmp, &ep->regs->ep_irqenb);
 251
 252                         tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 253                         writel (tmp, &dev->regs->pciirqenb0);
 254                 }
 255         }
 256
 257         tmp = desc->bEndpointAddress;
 258         DEBUG (dev, "enabled %s (ep%d%s-%s) %s max %04x\n",
 259                 _ep->name, tmp & 0x0f, DIR_STRING (tmp),
 260                 type_string (desc->bmAttributes),
 261                 ep->dma ? "dma" : "pio", max);
 262
 263         /* pci writes may still be posted */
 264         spin_unlock_irqrestore (&dev->lock, flags);
 265         return 0;
 266 }
 267
 268 static int handshake (u32 __iomem *ptr, u32 mask, u32 done, int usec)
 269 {
 270         u32     result;
 271
 272         do {
 273                 result = readl (ptr);
 274                 if (result == ~(u32)0)          /* "device unplugged" */
 275                         return -ENODEV;
 276                 result &= mask;
 277                 if (result == done)
 278                         return 0;
 279                 udelay (1);
 280                 usec--;
 281         } while (usec > 0);
 282         return -ETIMEDOUT;
 283 }
 284
 285 static const struct usb_ep_ops net2280_ep_ops;
 286
 287 static void ep_reset (struct net2280_regs __iomem *regs, struct net2280_ep *ep)
 288 {
 289         u32             tmp;
 290
 291         ep->desc = NULL;
 292         INIT_LIST_HEAD (&ep->queue);
 293
 294         ep->ep.maxpacket = ~0;
 295         ep->ep.ops = &net2280_ep_ops;
 296
 297         /* disable the dma, irqs, endpoint... */
 298         if (ep->dma) {
 299                 writel (0, &ep->dma->dmactl);
 300                 writel (  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 301                         | (1 << DMA_TRANSACTION_DONE_INTERRUPT)
 302                         | (1 << DMA_ABORT)
 303                         , &ep->dma->dmastat);
 304
 305                 tmp = readl (&regs->pciirqenb0);
 306                 tmp &= ~(1 << ep->num);
 307                 writel (tmp, &regs->pciirqenb0);
 308         } else {
 309                 tmp = readl (&regs->pciirqenb1);
 310                 tmp &= ~(1 << (8 + ep->num));   /* completion */
 311                 writel (tmp, &regs->pciirqenb1);
 312         }
 313         writel (0, &ep->regs->ep_irqenb);
 314
 315         /* init to our chosen defaults, notably so that we NAK OUT
 316          * packets until the driver queues a read (+note erratum 0112)
 317          */
 318         if (!ep->is_in || ep->dev->pdev->device == 0x2280) {
 319                 tmp = (1 << SET_NAK_OUT_PACKETS_MODE)
 320                 | (1 << SET_NAK_OUT_PACKETS)
 321                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 322                 | (1 << CLEAR_INTERRUPT_MODE);
 323         } else {
 324                 /* added for 2282 */
 325                 tmp = (1 << CLEAR_NAK_OUT_PACKETS_MODE)
 326                 | (1 << CLEAR_NAK_OUT_PACKETS)
 327                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 328                 | (1 << CLEAR_INTERRUPT_MODE);
 329         }
 330
 331         if (ep->num != 0) {
 332                 tmp |= (1 << CLEAR_ENDPOINT_TOGGLE)
 333                         | (1 << CLEAR_ENDPOINT_HALT);
 334         }
 335         writel (tmp, &ep->regs->ep_rsp);
 336
 337         /* scrub most status bits, and flush any fifo state */
 338         if (ep->dev->pdev->device == 0x2280)
 339                 tmp = (1 << FIFO_OVERFLOW)
 340                         | (1 << FIFO_UNDERFLOW);
 341         else
 342                 tmp = 0;
 343
 344         writel (tmp | (1 << TIMEOUT)
 345                 | (1 << USB_STALL_SENT)
 346                 | (1 << USB_IN_NAK_SENT)
 347                 | (1 << USB_IN_ACK_RCVD)
 348                 | (1 << USB_OUT_PING_NAK_SENT)
 349                 | (1 << USB_OUT_ACK_SENT)
 350                 | (1 << FIFO_FLUSH)
 351                 | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
 352                 | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
 353                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 354                 | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
 355                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 356                 | (1 << DATA_IN_TOKEN_INTERRUPT)
 357                 , &ep->regs->ep_stat);
 358
 359         /* fifo size is handled separately */
 360 }
 361
 362 static void nuke (struct net2280_ep *);
 363
 364 static int net2280_disable (struct usb_ep *_ep)
 365 {
 366         struct net2280_ep       *ep;
 367         unsigned long           flags;
 368
 369         ep = container_of (_ep, struct net2280_ep, ep);
 370         if (!_ep || !ep->desc || _ep->name == ep0name)
 371                 return -EINVAL;
 372
 373         spin_lock_irqsave (&ep->dev->lock, flags);
 374         nuke (ep);
 375         ep_reset (ep->dev->regs, ep);
 376
 377         VDEBUG (ep->dev, "disabled %s %s\n",
 378                         ep->dma ? "dma" : "pio", _ep->name);
 379
 380         /* synch memory views with the device */
 381         (void) readl (&ep->regs->ep_cfg);
 382
 383         if (use_dma && !ep->dma && ep->num >= 1 && ep->num <= 4)
 384                 ep->dma = &ep->dev->dma [ep->num - 1];
 385
 386         spin_unlock_irqrestore (&ep->dev->lock, flags);
 387         return 0;
 388 }
 389
 390 /*-------------------------------------------------------------------------*/
 391
 392 static struct usb_request *
 393 net2280_alloc_request (struct usb_ep *_ep, gfp_t gfp_flags)
 394 {
 395         struct net2280_ep       *ep;
 396         struct net2280_request  *req;
 397
 398         if (!_ep)
 399                 return NULL;
 400         ep = container_of (_ep, struct net2280_ep, ep);
 401
 402         req = kzalloc(sizeof(*req), gfp_flags);
 403         if (!req)
 404                 return NULL;
 405
 406         req->req.dma = DMA_ADDR_INVALID;
 407         INIT_LIST_HEAD (&req->queue);
 408
 409         /* this dma descriptor may be swapped with the previous dummy */
 410         if (ep->dma) {
 411                 struct net2280_dma      *td;
 412
 413                 td = pci_pool_alloc (ep->dev->requests, gfp_flags,
 414                                 &req->td_dma);
 415                 if (!td) {
 416                         kfree (req);
 417                         return NULL;
 418                 }
 419                 td->dmacount = 0;       /* not VALID */
 420                 td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
 421                 td->dmadesc = td->dmaaddr;
 422                 req->td = td;
 423         }
 424         return &req->req;
 425 }
 426
 427 static void
 428 net2280_free_request (struct usb_ep *_ep, struct usb_request *_req)
 429 {
 430         struct net2280_ep       *ep;
 431         struct net2280_request  *req;
 432
 433         ep = container_of (_ep, struct net2280_ep, ep);
 434         if (!_ep || !_req)
 435                 return;
 436
 437         req = container_of (_req, struct net2280_request, req);
 438         WARN_ON (!list_empty (&req->queue));
 439         if (req->td)
 440                 pci_pool_free (ep->dev->requests, req->td, req->td_dma);
 441         kfree (req);
 442 }
 443
 444 /*-------------------------------------------------------------------------*/
 445
 446 /* load a packet into the fifo we use for usb IN transfers.
 447  * works for all endpoints.
 448  *
 449  * NOTE: pio with ep-a..ep-d could stuff multiple packets into the fifo
 450  * at a time, but this code is simpler because it knows it only writes
 451  * one packet.  ep-a..ep-d should use dma instead.
 452  */
 453 static void
 454 write_fifo (struct net2280_ep *ep, struct usb_request *req)
 455 {
 456         struct net2280_ep_regs  __iomem *regs = ep->regs;
 457         u8                      *buf;
 458         u32                     tmp;
 459         unsigned                count, total;
 460
 461         /* INVARIANT:  fifo is currently empty. (testable) */
 462
 463         if (req) {
 464                 buf = req->buf + req->actual;
 465                 prefetch (buf);
 466                 total = req->length - req->actual;
 467         } else {
 468                 total = 0;
 469                 buf = NULL;
 470         }
 471
 472         /* write just one packet at a time */
 473         count = ep->ep.maxpacket;
 474         if (count > total)      /* min() cannot be used on a bitfield */
 475                 count = total;
 476
 477         VDEBUG (ep->dev, "write %s fifo (IN) %d bytes%s req %p\n",
 478                         ep->ep.name, count,
 479                         (count != ep->ep.maxpacket) ? " (short)" : "",
 480                         req);
 481         while (count >= 4) {
 482                 /* NOTE be careful if you try to align these. fifo lines
 483                  * should normally be full (4 bytes) and successive partial
 484                  * lines are ok only in certain cases.
 485                  */
 486                 tmp = get_unaligned ((u32 *)buf);
 487                 cpu_to_le32s (&tmp);
 488                 writel (tmp, &regs->ep_data);
 489                 buf += 4;
 490                 count -= 4;
 491         }
 492
 493         /* last fifo entry is "short" unless we wrote a full packet.
 494          * also explicitly validate last word in (periodic) transfers
 495          * when maxpacket is not a multiple of 4 bytes.
 496          */
 497         if (count || total < ep->ep.maxpacket) {
 498                 tmp = count ? get_unaligned ((u32 *)buf) : count;
 499                 cpu_to_le32s (&tmp);
 500                 set_fifo_bytecount (ep, count & 0x03);
 501                 writel (tmp, &regs->ep_data);
 502         }
 503
 504         /* pci writes may still be posted */
 505 }
 506
 507 /* work around erratum 0106: PCI and USB race over the OUT fifo.
 508  * caller guarantees chiprev 0100, out endpoint is NAKing, and
 509  * there's no real data in the fifo.
 510  *
 511  * NOTE:  also used in cases where that erratum doesn't apply:
 512  * where the host wrote "too much" data to us.
 513  */
 514 static void out_flush (struct net2280_ep *ep)
 515 {
 516         u32     __iomem *statp;
 517         u32     tmp;
 518
 519         ASSERT_OUT_NAKING (ep);
 520
 521         statp = &ep->regs->ep_stat;
 522         writel (  (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 523                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 524                 , statp);
 525         writel ((1 << FIFO_FLUSH), statp);
 526         mb ();
 527         tmp = readl (statp);
 528         if (tmp & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 529                         /* high speed did bulk NYET; fifo isn't filling */
 530                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
 531                 unsigned        usec;
 532
 533                 usec = 50;              /* 64 byte bulk/interrupt */
 534                 handshake (statp, (1 << USB_OUT_PING_NAK_SENT),
 535                                 (1 << USB_OUT_PING_NAK_SENT), usec);
 536                 /* NAK done; now CLEAR_NAK_OUT_PACKETS is safe */
 537         }
 538 }
 539
 540 /* unload packet(s) from the fifo we use for usb OUT transfers.
 541  * returns true iff the request completed, because of short packet
 542  * or the request buffer having filled with full packets.
 543  *
 544  * for ep-a..ep-d this will read multiple packets out when they
 545  * have been accepted.
 546  */
 547 static int
 548 read_fifo (struct net2280_ep *ep, struct net2280_request *req)
 549 {
 550         struct net2280_ep_regs  __iomem *regs = ep->regs;
 551         u8                      *buf = req->req.buf + req->req.actual;
 552         unsigned                count, tmp, is_short;
 553         unsigned                cleanup = 0, prevent = 0;
 554
 555         /* erratum 0106 ... packets coming in during fifo reads might
 556          * be incompletely rejected.  not all cases have workarounds.
 557          */
 558         if (ep->dev->chiprev == 0x0100
 559                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
 560                 udelay (1);
 561                 tmp = readl (&ep->regs->ep_stat);
 562                 if ((tmp & (1 << NAK_OUT_PACKETS)))
 563                         cleanup = 1;
 564                 else if ((tmp & (1 << FIFO_FULL))) {
 565                         start_out_naking (ep);
 566                         prevent = 1;
 567                 }
 568                 /* else: hope we don't see the problem */
 569         }
 570
 571         /* never overflow the rx buffer. the fifo reads packets until
 572          * it sees a short one; we might not be ready for them all.
 573          */
 574         prefetchw (buf);
 575         count = readl (&regs->ep_avail);
 576         if (unlikely (count == 0)) {
 577                 udelay (1);
 578                 tmp = readl (&ep->regs->ep_stat);
 579                 count = readl (&regs->ep_avail);
 580                 /* handled that data already? */
 581                 if (count == 0 && (tmp & (1 << NAK_OUT_PACKETS)) == 0)
 582                         return 0;
 583         }
 584
 585         tmp = req->req.length - req->req.actual;
 586         if (count > tmp) {
 587                 /* as with DMA, data overflow gets flushed */
 588                 if ((tmp % ep->ep.maxpacket) != 0) {
 589                         ERROR (ep->dev,
 590                                 "%s out fifo %d bytes, expected %d\n",
 591                                 ep->ep.name, count, tmp);
 592                         req->req.status = -EOVERFLOW;
 593                         cleanup = 1;
 594                         /* NAK_OUT_PACKETS will be set, so flushing is safe;
 595                          * the next read will start with the next packet
 596                          */
 597                 } /* else it's a ZLP, no worries */
 598                 count = tmp;
 599         }
 600         req->req.actual += count;
 601
 602         is_short = (count == 0) || ((count % ep->ep.maxpacket) != 0);
 603
 604         VDEBUG (ep->dev, "read %s fifo (OUT) %d bytes%s%s%s req %p %d/%d\n",
 605                         ep->ep.name, count, is_short ? " (short)" : "",
 606                         cleanup ? " flush" : "", prevent ? " nak" : "",
 607                         req, req->req.actual, req->req.length);
 608
 609         while (count >= 4) {
 610                 tmp = readl (&regs->ep_data);
 611                 cpu_to_le32s (&tmp);
 612                 put_unaligned (tmp, (u32 *)buf);
 613                 buf += 4;
 614                 count -= 4;
 615         }
 616         if (count) {
 617                 tmp = readl (&regs->ep_data);
 618                 /* LE conversion is implicit here: */
 619                 do {
 620                         *buf++ = (u8) tmp;
 621                         tmp >>= 8;
 622                 } while (--count);
 623         }
 624         if (cleanup)
 625                 out_flush (ep);
 626         if (prevent) {
 627                 writel ((1 << CLEAR_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 628                 (void) readl (&ep->regs->ep_rsp);
 629         }
 630
 631         return is_short || ((req->req.actual == req->req.length)
 632                                 && !req->req.zero);
 633 }
 634
 635 /* fill out dma descriptor to match a given request */
 636 static void
 637 fill_dma_desc (struct net2280_ep *ep, struct net2280_request *req, int valid)
 638 {
 639         struct net2280_dma      *td = req->td;
 640         u32                     dmacount = req->req.length;
 641
 642         /* don't let DMA continue after a short OUT packet,
 643          * so overruns can't affect the next transfer.
 644          * in case of overruns on max-size packets, we can't
 645          * stop the fifo from filling but we can flush it.
 646          */
 647         if (ep->is_in)
 648                 dmacount |= (1 << DMA_DIRECTION);
 649         if ((!ep->is_in && (dmacount % ep->ep.maxpacket) != 0)
 650                         || ep->dev->pdev->device != 0x2280)
 651                 dmacount |= (1 << END_OF_CHAIN);
 652
 653         req->valid = valid;
 654         if (valid)
 655                 dmacount |= (1 << VALID_BIT);
 656         if (likely(!req->req.no_interrupt || !use_dma_chaining))
 657                 dmacount |= (1 << DMA_DONE_INTERRUPT_ENABLE);
 658
 659         /* td->dmadesc = previously set by caller */
 660         td->dmaaddr = cpu_to_le32 (req->req.dma);
 661
 662         /* 2280 may be polling VALID_BIT through ep->dma->dmadesc */
 663         wmb ();
 664         td->dmacount = cpu_to_le32(dmacount);
 665 }
 666
 667 static const u32 dmactl_default =
 668                   (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 669                 | (1 << DMA_CLEAR_COUNT_ENABLE)
 670                 /* erratum 0116 workaround part 1 (use POLLING) */
 671                 | (POLL_100_USEC << DESCRIPTOR_POLLING_RATE)
 672                 | (1 << DMA_VALID_BIT_POLLING_ENABLE)
 673                 | (1 << DMA_VALID_BIT_ENABLE)
 674                 | (1 << DMA_SCATTER_GATHER_ENABLE)
 675                 /* erratum 0116 workaround part 2 (no AUTOSTART) */
 676                 | (1 << DMA_ENABLE);
 677
 678 static inline void spin_stop_dma (struct net2280_dma_regs __iomem *dma)
 679 {
 680         handshake (&dma->dmactl, (1 << DMA_ENABLE), 0, 50);
 681 }
 682
 683 static inline void stop_dma (struct net2280_dma_regs __iomem *dma)
 684 {
 685         writel (readl (&dma->dmactl) & ~(1 << DMA_ENABLE), &dma->dmactl);
 686         spin_stop_dma (dma);
 687 }
 688
 689 static void start_queue (struct net2280_ep *ep, u32 dmactl, u32 td_dma)
 690 {
 691         struct net2280_dma_regs __iomem *dma = ep->dma;
 692         unsigned int tmp = (1 << VALID_BIT) | (ep->is_in << DMA_DIRECTION);
 693
 694         if (ep->dev->pdev->device != 0x2280)
 695                 tmp |= (1 << END_OF_CHAIN);
 696
 697         writel (tmp, &dma->dmacount);
 698         writel (readl (&dma->dmastat), &dma->dmastat);
 699
 700         writel (td_dma, &dma->dmadesc);
 701         writel (dmactl, &dma->dmactl);
 702
 703         /* erratum 0116 workaround part 3:  pci arbiter away from net2280 */
 704         (void) readl (&ep->dev->pci->pcimstctl);
 705
 706         writel ((1 << DMA_START), &dma->dmastat);
 707
 708         if (!ep->is_in)
 709                 stop_out_naking (ep);
 710 }
 711
 712 static void start_dma (struct net2280_ep *ep, struct net2280_request *req)
 713 {
 714         u32                     tmp;
 715         struct net2280_dma_regs __iomem *dma = ep->dma;
 716
 717         /* FIXME can't use DMA for ZLPs */
 718
 719         /* on this path we "know" there's no dma active (yet) */
 720         WARN_ON (readl (&dma->dmactl) & (1 << DMA_ENABLE));
 721         writel (0, &ep->dma->dmactl);
 722
 723         /* previous OUT packet might have been short */
 724         if (!ep->is_in && ((tmp = readl (&ep->regs->ep_stat))
 725                                 & (1 << NAK_OUT_PACKETS)) != 0) {
 726                 writel ((1 << SHORT_PACKET_TRANSFERRED_INTERRUPT),
 727                         &ep->regs->ep_stat);
 728
 729                 tmp = readl (&ep->regs->ep_avail);
 730                 if (tmp) {
 731                         writel (readl (&dma->dmastat), &dma->dmastat);
 732
 733                         /* transfer all/some fifo data */
 734                         writel (req->req.dma, &dma->dmaaddr);
 735                         tmp = min (tmp, req->req.length);
 736
 737                         /* dma irq, faking scatterlist status */
 738                         req->td->dmacount = cpu_to_le32 (req->req.length - tmp);
 739                         writel ((1 << DMA_DONE_INTERRUPT_ENABLE)
 740                                 | tmp, &dma->dmacount);
 741                         req->td->dmadesc = 0;
 742                         req->valid = 1;
 743
 744                         writel ((1 << DMA_ENABLE), &dma->dmactl);
 745                         writel ((1 << DMA_START), &dma->dmastat);
 746                         return;
 747                 }
 748         }
 749
 750         tmp = dmactl_default;
 751
 752         /* force packet boundaries between dma requests, but prevent the
 753          * controller from automagically writing a last "short" packet
 754          * (zero length) unless the driver explicitly said to do that.
 755          */
 756         if (ep->is_in) {
 757                 if (likely ((req->req.length % ep->ep.maxpacket) != 0
 758                                 || req->req.zero)) {
 759                         tmp |= (1 << DMA_FIFO_VALIDATE);
 760                         ep->in_fifo_validate = 1;
 761                 } else
 762                         ep->in_fifo_validate = 0;
 763         }
 764
 765         /* init req->td, pointing to the current dummy */
 766         req->td->dmadesc = cpu_to_le32 (ep->td_dma);
 767         fill_dma_desc (ep, req, 1);
 768
 769         if (!use_dma_chaining)
 770                 req->td->dmacount |= cpu_to_le32 (1 << END_OF_CHAIN);
 771
 772         start_queue (ep, tmp, req->td_dma);
 773 }
 774
 775 static inline void
 776 queue_dma (struct net2280_ep *ep, struct net2280_request *req, int valid)
 777 {
 778         struct net2280_dma      *end;
 779         dma_addr_t              tmp;
 780
 781         /* swap new dummy for old, link; fill and maybe activate */
 782         end = ep->dummy;
 783         ep->dummy = req->td;
 784         req->td = end;
 785
 786         tmp = ep->td_dma;
 787         ep->td_dma = req->td_dma;
 788         req->td_dma = tmp;
 789
 790         end->dmadesc = cpu_to_le32 (ep->td_dma);
 791
 792         fill_dma_desc (ep, req, valid);
 793 }
 794
 795 static void
 796 done (struct net2280_ep *ep, struct net2280_request *req, int status)
 797 {
 798         struct net2280          *dev;
 799         unsigned                stopped = ep->stopped;
 800
 801         list_del_init (&req->queue);
 802
 803         if (req->req.status == -EINPROGRESS)
 804                 req->req.status = status;
 805         else
 806                 status = req->req.status;
 807
 808         dev = ep->dev;
 809         if (req->mapped) {
 810                 pci_unmap_single (dev->pdev, req->req.dma, req->req.length,
 811                         ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
 812                 req->req.dma = DMA_ADDR_INVALID;
 813                 req->mapped = 0;
 814         }
 815
 816         if (status && status != -ESHUTDOWN)
 817                 VDEBUG (dev, "complete %s req %p stat %d len %u/%u\n",
 818                         ep->ep.name, &req->req, status,
 819                         req->req.actual, req->req.length);
 820
 821         /* don't modify queue heads during completion callback */
 822         ep->stopped = 1;
 823         spin_unlock (&dev->lock);
 824         req->req.complete (&ep->ep, &req->req);
 825         spin_lock (&dev->lock);
 826         ep->stopped = stopped;
 827 }
 828
 829 /*-------------------------------------------------------------------------*/
 830
 831 static int
 832 net2280_queue (struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
 833 {
 834         struct net2280_request  *req;
 835         struct net2280_ep       *ep;
 836         struct net2280          *dev;
 837         unsigned long           flags;
 838
 839         /* we always require a cpu-view buffer, so that we can
 840          * always use pio (as fallback or whatever).
 841          */
 842         req = container_of (_req, struct net2280_request, req);
 843         if (!_req || !_req->complete || !_req->buf
 844                         || !list_empty (&req->queue))
 845                 return -EINVAL;
 846         if (_req->length > (~0 & DMA_BYTE_COUNT_MASK))
 847                 return -EDOM;
 848         ep = container_of (_ep, struct net2280_ep, ep);
 849         if (!_ep || (!ep->desc && ep->num != 0))
 850                 return -EINVAL;
 851         dev = ep->dev;
 852         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 853                 return -ESHUTDOWN;
 854
 855         /* FIXME implement PIO fallback for ZLPs with DMA */
 856         if (ep->dma && _req->length == 0)
 857                 return -EOPNOTSUPP;
 858
 859         /* set up dma mapping in case the caller didn't */
 860         if (ep->dma && _req->dma == DMA_ADDR_INVALID) {
 861                 _req->dma = pci_map_single (dev->pdev, _req->buf, _req->length,
 862                         ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
 863                 req->mapped = 1;
 864         }
 865
 866 #if 0
 867         VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
 868                         _ep->name, _req, _req->length, _req->buf);
 869 #endif
 870
 871         spin_lock_irqsave (&dev->lock, flags);
 872
 873         _req->status = -EINPROGRESS;
 874         _req->actual = 0;
 875
 876         /* kickstart this i/o queue? */
 877         if (list_empty (&ep->queue) && !ep->stopped) {
 878                 /* use DMA if the endpoint supports it, else pio */
 879                 if (ep->dma)
 880                         start_dma (ep, req);
 881                 else {
 882                         /* maybe there's no control data, just status ack */
 883                         if (ep->num == 0 && _req->length == 0) {
 884                                 allow_status (ep);
 885                                 done (ep, req, 0);
 886                                 VDEBUG (dev, "%s status ack\n", ep->ep.name);
 887                                 goto done;
 888                         }
 889
 890                         /* PIO ... stuff the fifo, or unblock it.  */
 891                         if (ep->is_in)
 892                                 write_fifo (ep, _req);
 893                         else if (list_empty (&ep->queue)) {
 894                                 u32     s;
 895
 896                                 /* OUT FIFO might have packet(s) buffered */
 897                                 s = readl (&ep->regs->ep_stat);
 898                                 if ((s & (1 << FIFO_EMPTY)) == 0) {
 899                                         /* note:  _req->short_not_ok is
 900                                          * ignored here since PIO _always_
 901                                          * stops queue advance here, and
 902                                          * _req->status doesn't change for
 903                                          * short reads (only _req->actual)
 904                                          */
 905                                         if (read_fifo (ep, req)) {
 906                                                 done (ep, req, 0);
 907                                                 if (ep->num == 0)
 908                                                         allow_status (ep);
 909                                                 /* don't queue it */
 910                                                 req = NULL;
 911                                         } else
 912                                                 s = readl (&ep->regs->ep_stat);
 913                                 }
 914
 915                                 /* don't NAK, let the fifo fill */
 916                                 if (req && (s & (1 << NAK_OUT_PACKETS)))
 917                                         writel ((1 << CLEAR_NAK_OUT_PACKETS),
 918                                                         &ep->regs->ep_rsp);
 919                         }
 920                 }
 921
 922         } else if (ep->dma) {
 923                 int     valid = 1;
 924
 925                 if (ep->is_in) {
 926                         int     expect;
 927
 928                         /* preventing magic zlps is per-engine state, not
 929                          * per-transfer; irq logic must recover hiccups.
 930                          */
 931                         expect = likely (req->req.zero
 932                                 || (req->req.length % ep->ep.maxpacket) != 0);
 933                         if (expect != ep->in_fifo_validate)
 934                                 valid = 0;
 935                 }
 936                 queue_dma (ep, req, valid);
 937
 938         } /* else the irq handler advances the queue. */
 939
 940         ep->responded = 1;
 941         if (req)
 942                 list_add_tail (&req->queue, &ep->queue);
 943 done:
 944         spin_unlock_irqrestore (&dev->lock, flags);
 945
 946         /* pci writes may still be posted */
 947         return 0;
 948 }
 949
 950 static inline void
 951 dma_done (
 952         struct net2280_ep *ep,
 953         struct net2280_request *req,
 954         u32 dmacount,
 955         int status
 956 )
 957 {
 958         req->req.actual = req->req.length - (DMA_BYTE_COUNT_MASK & dmacount);
 959         done (ep, req, status);
 960 }
 961
 962 static void restart_dma (struct net2280_ep *ep);
 963
 964 static void scan_dma_completions (struct net2280_ep *ep)
 965 {
 966         /* only look at descriptors that were "naturally" retired,
 967          * so fifo and list head state won't matter
 968          */
 969         while (!list_empty (&ep->queue)) {
 970                 struct net2280_request  *req;
 971                 u32                     tmp;
 972
 973                 req = list_entry (ep->queue.next,
 974                                 struct net2280_request, queue);
 975                 if (!req->valid)
 976                         break;
 977                 rmb ();
 978                 tmp = le32_to_cpup (&req->td->dmacount);
 979                 if ((tmp & (1 << VALID_BIT)) != 0)
 980                         break;
 981
 982                 /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
 983                  * cases where DMA must be aborted; this code handles
 984                  * all non-abort DMA completions.
 985                  */
 986                 if (unlikely (req->td->dmadesc == 0)) {
 987                         /* paranoia */
 988                         tmp = readl (&ep->dma->dmacount);
 989                         if (tmp & DMA_BYTE_COUNT_MASK)
 990                                 break;
 991                         /* single transfer mode */
 992                         dma_done (ep, req, tmp, 0);
 993                         break;
 994                 } else if (!ep->is_in
 995                                 && (req->req.length % ep->ep.maxpacket) != 0) {
 996                         tmp = readl (&ep->regs->ep_stat);
 997
 998                         /* AVOID TROUBLE HERE by not issuing short reads from
 999                          * your gadget driver.  That helps avoids errata 0121,
1000                          * 0122, and 0124; not all cases trigger the warning.
1001                          */
1002                         if ((tmp & (1 << NAK_OUT_PACKETS)) == 0) {
1003                                 WARNING (ep->dev, "%s lost packet sync!\n",
1004                                                 ep->ep.name);
1005                                 req->req.status = -EOVERFLOW;
1006                         } else if ((tmp = readl (&ep->regs->ep_avail)) != 0) {
1007                                 /* fifo gets flushed later */
1008                                 ep->out_overflow = 1;
1009                                 DEBUG (ep->dev, "%s dma, discard %d len %d\n",
1010                                                 ep->ep.name, tmp,
1011                                                 req->req.length);
1012                                 req->req.status = -EOVERFLOW;
1013                         }
1014                 }
1015                 dma_done (ep, req, tmp, 0);
1016         }
1017 }
1018
1019 static void restart_dma (struct net2280_ep *ep)
1020 {
1021         struct net2280_request  *req;
1022         u32                     dmactl = dmactl_default;
1023
1024         if (ep->stopped)
1025                 return;
1026         req = list_entry (ep->queue.next, struct net2280_request, queue);
1027
1028         if (!use_dma_chaining) {
1029                 start_dma (ep, req);
1030                 return;
1031         }
1032
1033         /* the 2280 will be processing the queue unless queue hiccups after
1034          * the previous transfer:
1035          *  IN:   wanted automagic zlp, head doesn't (or vice versa)
1036          *        DMA_FIFO_VALIDATE doesn't init from dma descriptors.
1037          *  OUT:  was "usb-short", we must restart.
1038          */
1039         if (ep->is_in && !req->valid) {
1040                 struct net2280_request  *entry, *prev = NULL;
1041                 int                     reqmode, done = 0;
1042
1043                 DEBUG (ep->dev, "%s dma hiccup td %p\n", ep->ep.name, req->td);
1044                 ep->in_fifo_validate = likely (req->req.zero
1045                         || (req->req.length % ep->ep.maxpacket) != 0);
1046                 if (ep->in_fifo_validate)
1047                         dmactl |= (1 << DMA_FIFO_VALIDATE);
1048                 list_for_each_entry (entry, &ep->queue, queue) {
1049                         __le32          dmacount;
1050
1051                         if (entry == req)
1052                                 continue;
1053                         dmacount = entry->td->dmacount;
1054                         if (!done) {
1055                                 reqmode = likely (entry->req.zero
1056                                         || (entry->req.length
1057                                                 % ep->ep.maxpacket) != 0);
1058                                 if (reqmode == ep->in_fifo_validate) {
1059                                         entry->valid = 1;
1060                                         dmacount |= valid_bit;
1061                                         entry->td->dmacount = dmacount;
1062                                         prev = entry;
1063                                         continue;
1064                                 } else {
1065                                         /* force a hiccup */
1066                                         prev->td->dmacount |= dma_done_ie;
1067                                         done = 1;
1068                                 }
1069                         }
1070
1071                         /* walk the rest of the queue so unlinks behave */
1072                         entry->valid = 0;
1073                         dmacount &= ~valid_bit;
1074                         entry->td->dmacount = dmacount;
1075                         prev = entry;
1076                 }
1077         }
1078
1079         writel (0, &ep->dma->dmactl);
1080         start_queue (ep, dmactl, req->td_dma);
1081 }
1082
1083 static void abort_dma (struct net2280_ep *ep)
1084 {
1085         /* abort the current transfer */
1086         if (likely (!list_empty (&ep->queue))) {
1087                 /* FIXME work around errata 0121, 0122, 0124 */
1088                 writel ((1 << DMA_ABORT), &ep->dma->dmastat);
1089                 spin_stop_dma (ep->dma);
1090         } else
1091                 stop_dma (ep->dma);
1092         scan_dma_completions (ep);
1093 }
1094
1095 /* dequeue ALL requests */
1096 static void nuke (struct net2280_ep *ep)
1097 {
1098         struct net2280_request  *req;
1099
1100         /* called with spinlock held */
1101         ep->stopped = 1;
1102         if (ep->dma)
1103                 abort_dma (ep);
1104         while (!list_empty (&ep->queue)) {
1105                 req = list_entry (ep->queue.next,
1106                                 struct net2280_request,
1107                                 queue);
1108                 done (ep, req, -ESHUTDOWN);
1109         }
1110 }
1111
1112 /* dequeue JUST ONE request */
1113 static int net2280_dequeue (struct usb_ep *_ep, struct usb_request *_req)
1114 {
1115         struct net2280_ep       *ep;
1116         struct net2280_request  *req;
1117         unsigned long           flags;
1118         u32                     dmactl;
1119         int                     stopped;
1120
1121         ep = container_of (_ep, struct net2280_ep, ep);
1122         if (!_ep || (!ep->desc && ep->num != 0) || !_req)
1123                 return -EINVAL;
1124
1125         spin_lock_irqsave (&ep->dev->lock, flags);
1126         stopped = ep->stopped;
1127
1128         /* quiesce dma while we patch the queue */
1129         dmactl = 0;
1130         ep->stopped = 1;
1131         if (ep->dma) {
1132                 dmactl = readl (&ep->dma->dmactl);
1133                 /* WARNING erratum 0127 may kick in ... */
1134                 stop_dma (ep->dma);
1135                 scan_dma_completions (ep);
1136         }
1137
1138         /* make sure it's still queued on this endpoint */
1139         list_for_each_entry (req, &ep->queue, queue) {
1140                 if (&req->req == _req)
1141                         break;
1142         }
1143         if (&req->req != _req) {
1144                 spin_unlock_irqrestore (&ep->dev->lock, flags);
1145                 return -EINVAL;
1146         }
1147
1148         /* queue head may be partially complete. */
1149         if (ep->queue.next == &req->queue) {
1150                 if (ep->dma) {
1151                         DEBUG (ep->dev, "unlink (%s) dma\n", _ep->name);
1152                         _req->status = -ECONNRESET;
1153                         abort_dma (ep);
1154                         if (likely (ep->queue.next == &req->queue)) {
1155                                 // NOTE: misreports single-transfer mode
1156                                 req->td->dmacount = 0;  /* invalidate */
1157                                 dma_done (ep, req,
1158                                         readl (&ep->dma->dmacount),
1159                                         -ECONNRESET);
1160                         }
1161                 } else {
1162                         DEBUG (ep->dev, "unlink (%s) pio\n", _ep->name);
1163                         done (ep, req, -ECONNRESET);
1164                 }
1165                 req = NULL;
1166
1167         /* patch up hardware chaining data */
1168         } else if (ep->dma && use_dma_chaining) {
1169                 if (req->queue.prev == ep->queue.next) {
1170                         writel (le32_to_cpu (req->td->dmadesc),
1171                                 &ep->dma->dmadesc);
1172                         if (req->td->dmacount & dma_done_ie)
1173                                 writel (readl (&ep->dma->dmacount)
1174                                                 | le32_to_cpu(dma_done_ie),
1175                                         &ep->dma->dmacount);
1176                 } else {
1177                         struct net2280_request  *prev;
1178
1179                         prev = list_entry (req->queue.prev,
1180                                 struct net2280_request, queue);
1181                         prev->td->dmadesc = req->td->dmadesc;
1182                         if (req->td->dmacount & dma_done_ie)
1183                                 prev->td->dmacount |= dma_done_ie;
1184                 }
1185         }
1186
1187         if (req)
1188                 done (ep, req, -ECONNRESET);
1189         ep->stopped = stopped;
1190
1191         if (ep->dma) {
1192                 /* turn off dma on inactive queues */
1193                 if (list_empty (&ep->queue))
1194                         stop_dma (ep->dma);
1195                 else if (!ep->stopped) {
1196                         /* resume current request, or start new one */
1197                         if (req)
1198                                 writel (dmactl, &ep->dma->dmactl);
1199                         else
1200                                 start_dma (ep, list_entry (ep->queue.next,
1201                                         struct net2280_request, queue));
1202                 }
1203         }
1204
1205         spin_unlock_irqrestore (&ep->dev->lock, flags);
1206         return 0;
1207 }
1208
1209 /*-------------------------------------------------------------------------*/
1210
1211 static int net2280_fifo_status (struct usb_ep *_ep);
1212
1213 static int
1214 net2280_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedged)
1215 {
1216         struct net2280_ep       *ep;
1217         unsigned long           flags;
1218         int                     retval = 0;
1219
1220         ep = container_of (_ep, struct net2280_ep, ep);
1221         if (!_ep || (!ep->desc && ep->num != 0))
1222                 return -EINVAL;
1223         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1224                 return -ESHUTDOWN;
1225         if (ep->desc /* not ep0 */ && (ep->desc->bmAttributes & 0x03)
1226                                                 == USB_ENDPOINT_XFER_ISOC)
1227                 return -EINVAL;
1228
1229         spin_lock_irqsave (&ep->dev->lock, flags);
1230         if (!list_empty (&ep->queue))
1231                 retval = -EAGAIN;
1232         else if (ep->is_in && value && net2280_fifo_status (_ep) != 0)
1233                 retval = -EAGAIN;
1234         else {
1235                 VDEBUG (ep->dev, "%s %s %s\n", _ep->name,
1236                                 value ? "set" : "clear",
1237                                 wedged ? "wedge" : "halt");
1238                 /* set/clear, then synch memory views with the device */
1239                 if (value) {
1240                         if (ep->num == 0)
1241                                 ep->dev->protocol_stall = 1;
1242                         else
1243                                 set_halt (ep);
1244                         if (wedged)
1245                                 ep->wedged = 1;
1246                 } else {
1247                         clear_halt (ep);
1248                         ep->wedged = 0;
1249                 }
1250                 (void) readl (&ep->regs->ep_rsp);
1251         }
1252         spin_unlock_irqrestore (&ep->dev->lock, flags);
1253
1254         return retval;
1255 }
1256
1257 static int
1258 net2280_set_halt(struct usb_ep *_ep, int value)
1259 {
1260         return net2280_set_halt_and_wedge(_ep, value, 0);
1261 }
1262
1263 static int
1264 net2280_set_wedge(struct usb_ep *_ep)
1265 {
1266         if (!_ep || _ep->name == ep0name)
1267                 return -EINVAL;
1268         return net2280_set_halt_and_wedge(_ep, 1, 1);
1269 }
1270
1271 static int
1272 net2280_fifo_status (struct usb_ep *_ep)
1273 {
1274         struct net2280_ep       *ep;
1275         u32                     avail;
1276
1277         ep = container_of (_ep, struct net2280_ep, ep);
1278         if (!_ep || (!ep->desc && ep->num != 0))
1279                 return -ENODEV;
1280         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1281                 return -ESHUTDOWN;
1282
1283         avail = readl (&ep->regs->ep_avail) & ((1 << 12) - 1);
1284         if (avail > ep->fifo_size)
1285                 return -EOVERFLOW;
1286         if (ep->is_in)
1287                 avail = ep->fifo_size - avail;
1288         return avail;
1289 }
1290
1291 static void
1292 net2280_fifo_flush (struct usb_ep *_ep)
1293 {
1294         struct net2280_ep       *ep;
1295
1296         ep = container_of (_ep, struct net2280_ep, ep);
1297         if (!_ep || (!ep->desc && ep->num != 0))
1298                 return;
1299         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1300                 return;
1301
1302         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
1303         (void) readl (&ep->regs->ep_rsp);
1304 }
1305
1306 static const struct usb_ep_ops net2280_ep_ops = {
1307         .enable         = net2280_enable,
1308         .disable        = net2280_disable,
1309
1310         .alloc_request  = net2280_alloc_request,
1311         .free_request   = net2280_free_request,
1312
1313         .queue          = net2280_queue,
1314         .dequeue        = net2280_dequeue,
1315
1316         .set_halt       = net2280_set_halt,
1317         .set_wedge      = net2280_set_wedge,
1318         .fifo_status    = net2280_fifo_status,
1319         .fifo_flush     = net2280_fifo_flush,
1320 };
1321
1322 /*-------------------------------------------------------------------------*/
1323
1324 static int net2280_get_frame (struct usb_gadget *_gadget)
1325 {
1326         struct net2280          *dev;
1327         unsigned long           flags;
1328         u16                     retval;
1329
1330         if (!_gadget)
1331                 return -ENODEV;
1332         dev = container_of (_gadget, struct net2280, gadget);
1333         spin_lock_irqsave (&dev->lock, flags);
1334         retval = get_idx_reg (dev->regs, REG_FRAME) & 0x03ff;
1335         spin_unlock_irqrestore (&dev->lock, flags);
1336         return retval;
1337 }
1338
1339 static int net2280_wakeup (struct usb_gadget *_gadget)
1340 {
1341         struct net2280          *dev;
1342         u32                     tmp;
1343         unsigned long           flags;
1344
1345         if (!_gadget)
1346                 return 0;
1347         dev = container_of (_gadget, struct net2280, gadget);
1348
1349         spin_lock_irqsave (&dev->lock, flags);
1350         tmp = readl (&dev->usb->usbctl);
1351         if (tmp & (1 << DEVICE_REMOTE_WAKEUP_ENABLE))
1352                 writel (1 << GENERATE_RESUME, &dev->usb->usbstat);
1353         spin_unlock_irqrestore (&dev->lock, flags);
1354
1355         /* pci writes may still be posted */
1356         return 0;
1357 }
1358
1359 static int net2280_set_selfpowered (struct usb_gadget *_gadget, int value)
1360 {
1361         struct net2280          *dev;
1362         u32                     tmp;
1363         unsigned long           flags;
1364
1365         if (!_gadget)
1366                 return 0;
1367         dev = container_of (_gadget, struct net2280, gadget);
1368
1369         spin_lock_irqsave (&dev->lock, flags);
1370         tmp = readl (&dev->usb->usbctl);
1371         if (value)
1372                 tmp |= (1 << SELF_POWERED_STATUS);
1373         else
1374                 tmp &= ~(1 << SELF_POWERED_STATUS);
1375         writel (tmp, &dev->usb->usbctl);
1376         spin_unlock_irqrestore (&dev->lock, flags);
1377
1378         return 0;
1379 }
1380
1381 static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
1382 {
1383         struct net2280  *dev;
1384         u32             tmp;
1385         unsigned long   flags;
1386
1387         if (!_gadget)
1388                 return -ENODEV;
1389         dev = container_of (_gadget, struct net2280, gadget);
1390
1391         spin_lock_irqsave (&dev->lock, flags);
1392         tmp = readl (&dev->usb->usbctl);
1393         dev->softconnect = (is_on != 0);
1394         if (is_on)
1395                 tmp |= (1 << USB_DETECT_ENABLE);
1396         else
1397                 tmp &= ~(1 << USB_DETECT_ENABLE);
1398         writel (tmp, &dev->usb->usbctl);
1399         spin_unlock_irqrestore (&dev->lock, flags);
1400
1401         return 0;
1402 }
1403
1404 static int net2280_start(struct usb_gadget *_gadget,
1405                 struct usb_gadget_driver *driver);
1406 static int net2280_stop(struct usb_gadget *_gadget,
1407                 struct usb_gadget_driver *driver);
1408
1409 static const struct usb_gadget_ops net2280_ops = {
1410         .get_frame      = net2280_get_frame,
1411         .wakeup         = net2280_wakeup,
1412         .set_selfpowered = net2280_set_selfpowered,
1413         .pullup         = net2280_pullup,
1414         .udc_start      = net2280_start,
1415         .udc_stop       = net2280_stop,
1416 };
1417
1418 /*-------------------------------------------------------------------------*/
1419
1420 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
1421
1422 /* FIXME move these into procfs, and use seq_file.
1423  * Sysfs _still_ doesn't behave for arbitrarily sized files,
1424  * and also doesn't help products using this with 2.4 kernels.
1425  */
1426
1427 /* "function" sysfs attribute */
1428 static ssize_t
1429 show_function (struct device *_dev, struct device_attribute *attr, char *buf)
1430 {
1431         struct net2280  *dev = dev_get_drvdata (_dev);
1432
1433         if (!dev->driver
1434                         || !dev->driver->function
1435                         || strlen (dev->driver->function) > PAGE_SIZE)
1436                 return 0;
1437         return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
1438 }
1439 static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
1440
1441 static ssize_t net2280_show_registers(struct device *_dev,
1442                                 struct device_attribute *attr, char *buf)
1443 {
1444         struct net2280          *dev;
1445         char                    *next;
1446         unsigned                size, t;
1447         unsigned long           flags;
1448         int                     i;
1449         u32                     t1, t2;
1450         const char              *s;
1451
1452         dev = dev_get_drvdata (_dev);
1453         next = buf;
1454         size = PAGE_SIZE;
1455         spin_lock_irqsave (&dev->lock, flags);
1456
1457         if (dev->driver)
1458                 s = dev->driver->driver.name;
1459         else
1460                 s = "(none)";
1461
1462         /* Main Control Registers */
1463         t = scnprintf (next, size, "%s version " DRIVER_VERSION
1464                         ", chiprev %04x, dma %s\n\n"
1465                         "devinit %03x fifoctl %08x gadget '%s'\n"
1466                         "pci irqenb0 %02x irqenb1 %08x "
1467                         "irqstat0 %04x irqstat1 %08x\n",
1468                         driver_name, dev->chiprev,
1469                         use_dma
1470                                 ? (use_dma_chaining ? "chaining" : "enabled")
1471                                 : "disabled",
1472                         readl (&dev->regs->devinit),
1473                         readl (&dev->regs->fifoctl),
1474                         s,
1475                         readl (&dev->regs->pciirqenb0),
1476                         readl (&dev->regs->pciirqenb1),
1477                         readl (&dev->regs->irqstat0),
1478                         readl (&dev->regs->irqstat1));
1479         size -= t;
1480         next += t;
1481
1482         /* USB Control Registers */
1483         t1 = readl (&dev->usb->usbctl);
1484         t2 = readl (&dev->usb->usbstat);
1485         if (t1 & (1 << VBUS_PIN)) {
1486                 if (t2 & (1 << HIGH_SPEED))
1487                         s = "high speed";
1488                 else if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1489                         s = "powered";
1490                 else
1491                         s = "full speed";
1492                 /* full speed bit (6) not working?? */
1493         } else
1494                         s = "not attached";
1495         t = scnprintf (next, size,
1496                         "stdrsp %08x usbctl %08x usbstat %08x "
1497                                 "addr 0x%02x (%s)\n",
1498                         readl (&dev->usb->stdrsp), t1, t2,
1499                         readl (&dev->usb->ouraddr), s);
1500         size -= t;
1501         next += t;
1502
1503         /* PCI Master Control Registers */
1504
1505         /* DMA Control Registers */
1506
1507         /* Configurable EP Control Registers */
1508         for (i = 0; i < 7; i++) {
1509                 struct net2280_ep       *ep;
1510
1511                 ep = &dev->ep [i];
1512                 if (i && !ep->desc)
1513                         continue;
1514
1515                 t1 = readl (&ep->regs->ep_cfg);
1516                 t2 = readl (&ep->regs->ep_rsp) & 0xff;
1517                 t = scnprintf (next, size,
1518                                 "\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
1519                                         "irqenb %02x\n",
1520                                 ep->ep.name, t1, t2,
1521                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS))
1522                                         ? "NAK " : "",
1523                                 (t2 & (1 << CLEAR_EP_HIDE_STATUS_PHASE))
1524                                         ? "hide " : "",
1525                                 (t2 & (1 << CLEAR_EP_FORCE_CRC_ERROR))
1526                                         ? "CRC " : "",
1527                                 (t2 & (1 << CLEAR_INTERRUPT_MODE))
1528                                         ? "interrupt " : "",
1529                                 (t2 & (1<<CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE))
1530                                         ? "status " : "",
1531                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS_MODE))
1532                                         ? "NAKmode " : "",
1533                                 (t2 & (1 << CLEAR_ENDPOINT_TOGGLE))
1534                                         ? "DATA1 " : "DATA0 ",
1535                                 (t2 & (1 << CLEAR_ENDPOINT_HALT))
1536                                         ? "HALT " : "",
1537                                 readl (&ep->regs->ep_irqenb));
1538                 size -= t;
1539                 next += t;
1540
1541                 t = scnprintf (next, size,
1542                                 "\tstat %08x avail %04x "
1543                                 "(ep%d%s-%s)%s\n",
1544                                 readl (&ep->regs->ep_stat),
1545                                 readl (&ep->regs->ep_avail),
1546                                 t1 & 0x0f, DIR_STRING (t1),
1547                                 type_string (t1 >> 8),
1548                                 ep->stopped ? "*" : "");
1549                 size -= t;
1550                 next += t;
1551
1552                 if (!ep->dma)
1553                         continue;
1554
1555                 t = scnprintf (next, size,
1556                                 "  dma\tctl %08x stat %08x count %08x\n"
1557                                 "\taddr %08x desc %08x\n",
1558                                 readl (&ep->dma->dmactl),
1559                                 readl (&ep->dma->dmastat),
1560                                 readl (&ep->dma->dmacount),
1561                                 readl (&ep->dma->dmaaddr),
1562                                 readl (&ep->dma->dmadesc));
1563                 size -= t;
1564                 next += t;
1565
1566         }
1567
1568         /* Indexed Registers */
1569                 // none yet
1570
1571         /* Statistics */
1572         t = scnprintf (next, size, "\nirqs:  ");
1573         size -= t;
1574         next += t;
1575         for (i = 0; i < 7; i++) {
1576                 struct net2280_ep       *ep;
1577
1578                 ep = &dev->ep [i];
1579                 if (i && !ep->irqs)
1580                         continue;
1581                 t = scnprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
1582                 size -= t;
1583                 next += t;
1584
1585         }
1586         t = scnprintf (next, size, "\n");
1587         size -= t;
1588         next += t;
1589
1590         spin_unlock_irqrestore (&dev->lock, flags);
1591
1592         return PAGE_SIZE - size;
1593 }
1594 static DEVICE_ATTR(registers, S_IRUGO, net2280_show_registers, NULL);
1595
1596 static ssize_t
1597 show_queues (struct device *_dev, struct device_attribute *attr, char *buf)
1598 {
1599         struct net2280          *dev;
1600         char                    *next;
1601         unsigned                size;
1602         unsigned long           flags;
1603         int                     i;
1604
1605         dev = dev_get_drvdata (_dev);
1606         next = buf;
1607         size = PAGE_SIZE;
1608         spin_lock_irqsave (&dev->lock, flags);
1609
1610         for (i = 0; i < 7; i++) {
1611                 struct net2280_ep               *ep = &dev->ep [i];
1612                 struct net2280_request          *req;
1613                 int                             t;
1614
1615                 if (i != 0) {
1616                         const struct usb_endpoint_descriptor    *d;
1617
1618                         d = ep->desc;
1619                         if (!d)
1620                                 continue;
1621                         t = d->bEndpointAddress;
1622                         t = scnprintf (next, size,
1623                                 "\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
1624                                 ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
1625                                 (t & USB_DIR_IN) ? "in" : "out",
1626                                 ({ char *val;
1627                                  switch (d->bmAttributes & 0x03) {
1628                                  case USB_ENDPOINT_XFER_BULK:
1629                                         val = "bulk"; break;
1630                                  case USB_ENDPOINT_XFER_INT:
1631                                         val = "intr"; break;
1632                                  default:
1633                                         val = "iso"; break;
1634                                  }; val; }),
1635                                 usb_endpoint_maxp (d) & 0x1fff,
1636                                 ep->dma ? "dma" : "pio", ep->fifo_size
1637                                 );
1638                 } else /* ep0 should only have one transfer queued */
1639                         t = scnprintf (next, size, "ep0 max 64 pio %s\n",
1640                                         ep->is_in ? "in" : "out");
1641                 if (t <= 0 || t > size)
1642                         goto done;
1643                 size -= t;
1644                 next += t;
1645
1646                 if (list_empty (&ep->queue)) {
1647                         t = scnprintf (next, size, "\t(nothing queued)\n");
1648                         if (t <= 0 || t > size)
1649                                 goto done;
1650                         size -= t;
1651                         next += t;
1652                         continue;
1653                 }
1654                 list_for_each_entry (req, &ep->queue, queue) {
1655                         if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
1656                                 t = scnprintf (next, size,
1657                                         "\treq %p len %d/%d "
1658                                         "buf %p (dmacount %08x)\n",
1659                                         &req->req, req->req.actual,
1660                                         req->req.length, req->req.buf,
1661                                         readl (&ep->dma->dmacount));
1662                         else
1663                                 t = scnprintf (next, size,
1664                                         "\treq %p len %d/%d buf %p\n",
1665                                         &req->req, req->req.actual,
1666                                         req->req.length, req->req.buf);
1667                         if (t <= 0 || t > size)
1668                                 goto done;
1669                         size -= t;
1670                         next += t;
1671
1672                         if (ep->dma) {
1673                                 struct net2280_dma      *td;
1674
1675                                 td = req->td;
1676                                 t = scnprintf (next, size, "\t    td %08x "
1677                                         " count %08x buf %08x desc %08x\n",
1678                                         (u32) req->td_dma,
1679                                         le32_to_cpu (td->dmacount),
1680                                         le32_to_cpu (td->dmaaddr),
1681                                         le32_to_cpu (td->dmadesc));
1682                                 if (t <= 0 || t > size)
1683                                         goto done;
1684                                 size -= t;
1685                                 next += t;
1686                         }
1687                 }
1688         }
1689
1690 done:
1691         spin_unlock_irqrestore (&dev->lock, flags);
1692         return PAGE_SIZE - size;
1693 }
1694 static DEVICE_ATTR (queues, S_IRUGO, show_queues, NULL);
1695
1696
1697 #else
1698
1699 #define device_create_file(a,b) (0)
1700 #define device_remove_file(a,b) do { } while (0)
1701
1702 #endif
1703
1704 /*-------------------------------------------------------------------------*/
1705
1706 /* another driver-specific mode might be a request type doing dma
1707  * to/from another device fifo instead of to/from memory.
1708  */
1709
1710 static void set_fifo_mode (struct net2280 *dev, int mode)
1711 {
1712         /* keeping high bits preserves BAR2 */
1713         writel ((0xffff << PCI_BASE2_RANGE) | mode, &dev->regs->fifoctl);
1714
1715         /* always ep-{a,b,e,f} ... maybe not ep-c or ep-d */
1716         INIT_LIST_HEAD (&dev->gadget.ep_list);
1717         list_add_tail (&dev->ep [1].ep.ep_list, &dev->gadget.ep_list);
1718         list_add_tail (&dev->ep [2].ep.ep_list, &dev->gadget.ep_list);
1719         switch (mode) {
1720         case 0:
1721                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1722                 list_add_tail (&dev->ep [4].ep.ep_list, &dev->gadget.ep_list);
1723                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 1024;
1724                 break;
1725         case 1:
1726                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 2048;
1727                 break;
1728         case 2:
1729                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1730                 dev->ep [1].fifo_size = 2048;
1731                 dev->ep [2].fifo_size = 1024;
1732                 break;
1733         }
1734         /* fifo sizes for ep0, ep-c, ep-d, ep-e, and ep-f never change */
1735         list_add_tail (&dev->ep [5].ep.ep_list, &dev->gadget.ep_list);
1736         list_add_tail (&dev->ep [6].ep.ep_list, &dev->gadget.ep_list);
1737 }
1738
1739 /* keeping it simple:
1740  * - one bus driver, initted first;
1741  * - one function driver, initted second
1742  *
1743  * most of the work to support multiple net2280 controllers would
1744  * be to associate this gadget driver (yes?) with all of them, or
1745  * perhaps to bind specific drivers to specific devices.
1746  */
1747
1748 static void usb_reset (struct net2280 *dev)
1749 {
1750         u32     tmp;
1751
1752         dev->gadget.speed = USB_SPEED_UNKNOWN;
1753         (void) readl (&dev->usb->usbctl);
1754
1755         net2280_led_init (dev);
1756
1757         /* disable automatic responses, and irqs */
1758         writel (0, &dev->usb->stdrsp);
1759         writel (0, &dev->regs->pciirqenb0);
1760         writel (0, &dev->regs->pciirqenb1);
1761
1762         /* clear old dma and irq state */
1763         for (tmp = 0; tmp < 4; tmp++) {
1764                 struct net2280_ep       *ep = &dev->ep [tmp + 1];
1765
1766                 if (ep->dma)
1767                         abort_dma (ep);
1768         }
1769         writel (~0, &dev->regs->irqstat0),
1770         writel (~(1 << SUSPEND_REQUEST_INTERRUPT), &dev->regs->irqstat1),
1771
1772         /* reset, and enable pci */
1773         tmp = readl (&dev->regs->devinit)
1774                 | (1 << PCI_ENABLE)
1775                 | (1 << FIFO_SOFT_RESET)
1776                 | (1 << USB_SOFT_RESET)
1777                 | (1 << M8051_RESET);
1778         writel (tmp, &dev->regs->devinit);
1779
1780         /* standard fifo and endpoint allocations */
1781         set_fifo_mode (dev, (fifo_mode <= 2) ? fifo_mode : 0);
1782 }
1783
1784 static void usb_reinit (struct net2280 *dev)
1785 {
1786         u32     tmp;
1787         int     init_dma;
1788
1789         /* use_dma changes are ignored till next device re-init */
1790         init_dma = use_dma;
1791
1792         /* basic endpoint init */
1793         for (tmp = 0; tmp < 7; tmp++) {
1794                 struct net2280_ep       *ep = &dev->ep [tmp];
1795
1796                 ep->ep.name = ep_name [tmp];
1797                 ep->dev = dev;
1798                 ep->num = tmp;
1799
1800                 if (tmp > 0 && tmp <= 4) {
1801                         ep->fifo_size = 1024;
1802                         if (init_dma)
1803                                 ep->dma = &dev->dma [tmp - 1];
1804                 } else
1805                         ep->fifo_size = 64;
1806                 ep->regs = &dev->epregs [tmp];
1807                 ep_reset (dev->regs, ep);
1808         }
1809         dev->ep [0].ep.maxpacket = 64;
1810         dev->ep [5].ep.maxpacket = 64;
1811         dev->ep [6].ep.maxpacket = 64;
1812
1813         dev->gadget.ep0 = &dev->ep [0].ep;
1814         dev->ep [0].stopped = 0;
1815         INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
1816
1817         /* we want to prevent lowlevel/insecure access from the USB host,
1818          * but erratum 0119 means this enable bit is ignored
1819          */
1820         for (tmp = 0; tmp < 5; tmp++)
1821                 writel (EP_DONTUSE, &dev->dep [tmp].dep_cfg);
1822 }
1823
1824 static void ep0_start (struct net2280 *dev)
1825 {
1826         writel (  (1 << CLEAR_EP_HIDE_STATUS_PHASE)
1827                 | (1 << CLEAR_NAK_OUT_PACKETS)
1828                 | (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
1829                 , &dev->epregs [0].ep_rsp);
1830
1831         /*
1832          * hardware optionally handles a bunch of standard requests
1833          * that the API hides from drivers anyway.  have it do so.
1834          * endpoint status/features are handled in software, to
1835          * help pass tests for some dubious behavior.
1836          */
1837         writel (  (1 << SET_TEST_MODE)
1838                 | (1 << SET_ADDRESS)
1839                 | (1 << DEVICE_SET_CLEAR_DEVICE_REMOTE_WAKEUP)
1840                 | (1 << GET_DEVICE_STATUS)
1841                 | (1 << GET_INTERFACE_STATUS)
1842                 , &dev->usb->stdrsp);
1843         writel (  (1 << USB_ROOT_PORT_WAKEUP_ENABLE)
1844                 | (1 << SELF_POWERED_USB_DEVICE)
1845                 | (1 << REMOTE_WAKEUP_SUPPORT)
1846                 | (dev->softconnect << USB_DETECT_ENABLE)
1847                 | (1 << SELF_POWERED_STATUS)
1848                 , &dev->usb->usbctl);
1849
1850         /* enable irqs so we can see ep0 and general operation  */
1851         writel (  (1 << SETUP_PACKET_INTERRUPT_ENABLE)
1852                 | (1 << ENDPOINT_0_INTERRUPT_ENABLE)
1853                 , &dev->regs->pciirqenb0);
1854         writel (  (1 << PCI_INTERRUPT_ENABLE)
1855                 | (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT_ENABLE)
1856                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT_ENABLE)
1857                 | (1 << PCI_RETRY_ABORT_INTERRUPT_ENABLE)
1858                 | (1 << VBUS_INTERRUPT_ENABLE)
1859                 | (1 << ROOT_PORT_RESET_INTERRUPT_ENABLE)
1860                 | (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT_ENABLE)
1861                 , &dev->regs->pciirqenb1);
1862
1863         /* don't leave any writes posted */
1864         (void) readl (&dev->usb->usbctl);
1865 }
1866
1867 /* when a driver is successfully registered, it will receive
1868  * control requests including set_configuration(), which enables
1869  * non-control requests.  then usb traffic follows until a
1870  * disconnect is reported.  then a host may connect again, or
1871  * the driver might get unbound.
1872  */
1873 static int net2280_start(struct usb_gadget *_gadget,
1874                 struct usb_gadget_driver *driver)
1875 {
1876         struct net2280          *dev;
1877         int                     retval;
1878         unsigned                i;
1879
1880         /* insist on high speed support from the driver, since
1881          * (dev->usb->xcvrdiag & FORCE_FULL_SPEED_MODE)
1882          * "must not be used in normal operation"
1883          */
1884         if (!driver || driver->speed < USB_SPEED_HIGH
1885                         || !driver->setup)
1886                 return -EINVAL;
1887
1888         dev = container_of (_gadget, struct net2280, gadget);
1889
1890         for (i = 0; i < 7; i++)
1891                 dev->ep [i].irqs = 0;
1892
1893         /* hook up the driver ... */
1894         dev->softconnect = 1;
1895         driver->driver.bus = NULL;
1896         dev->driver = driver;
1897         dev->gadget.dev.driver = &driver->driver;
1898
1899         retval = device_create_file (&dev->pdev->dev, &dev_attr_function);
1900         if (retval) goto err_unbind;
1901         retval = device_create_file (&dev->pdev->dev, &dev_attr_queues);
1902         if (retval) goto err_func;
1903
1904         /* ... then enable host detection and ep0; and we're ready
1905          * for set_configuration as well as eventual disconnect.
1906          */
1907         net2280_led_active (dev, 1);
1908         ep0_start (dev);
1909
1910         DEBUG (dev, "%s ready, usbctl %08x stdrsp %08x\n",
1911                         driver->driver.name,
1912                         readl (&dev->usb->usbctl),
1913                         readl (&dev->usb->stdrsp));
1914
1915         /* pci writes may still be posted */
1916         return 0;
1917
1918 err_func:
1919         device_remove_file (&dev->pdev->dev, &dev_attr_function);
1920 err_unbind:
1921         driver->unbind (&dev->gadget);
1922         dev->gadget.dev.driver = NULL;
1923         dev->driver = NULL;
1924         return retval;
1925 }
1926
1927 static void
1928 stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
1929 {
1930         int                     i;
1931
1932         /* don't disconnect if it's not connected */
1933         if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1934                 driver = NULL;
1935
1936         /* stop hardware; prevent new request submissions;
1937          * and kill any outstanding requests.
1938          */
1939         usb_reset (dev);
1940         for (i = 0; i < 7; i++)
1941                 nuke (&dev->ep [i]);
1942
1943         usb_reinit (dev);
1944 }
1945
1946 static int net2280_stop(struct usb_gadget *_gadget,
1947                 struct usb_gadget_driver *driver)
1948 {
1949         struct net2280  *dev;
1950         unsigned long   flags;
1951
1952         dev = container_of (_gadget, struct net2280, gadget);
1953
1954         spin_lock_irqsave (&dev->lock, flags);
1955         stop_activity (dev, driver);
1956         spin_unlock_irqrestore (&dev->lock, flags);
1957
1958         dev->gadget.dev.driver = NULL;
1959         dev->driver = NULL;
1960
1961         net2280_led_active (dev, 0);
1962         device_remove_file (&dev->pdev->dev, &dev_attr_function);
1963         device_remove_file (&dev->pdev->dev, &dev_attr_queues);
1964
1965         DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
1966         return 0;
1967 }
1968
1969 /*-------------------------------------------------------------------------*/
1970
1971 /* handle ep0, ep-e, ep-f with 64 byte packets: packet per irq.
1972  * also works for dma-capable endpoints, in pio mode or just
1973  * to manually advance the queue after short OUT transfers.
1974  */
1975 static void handle_ep_small (struct net2280_ep *ep)
1976 {
1977         struct net2280_request  *req;
1978         u32                     t;
1979         /* 0 error, 1 mid-data, 2 done */
1980         int                     mode = 1;
1981
1982         if (!list_empty (&ep->queue))
1983                 req = list_entry (ep->queue.next,
1984                         struct net2280_request, queue);
1985         else
1986                 req = NULL;
1987
1988         /* ack all, and handle what we care about */
1989         t = readl (&ep->regs->ep_stat);
1990         ep->irqs++;
1991 #if 0
1992         VDEBUG (ep->dev, "%s ack ep_stat %08x, req %p\n",
1993                         ep->ep.name, t, req ? &req->req : 0);
1994 #endif
1995         if (!ep->is_in || ep->dev->pdev->device == 0x2280)
1996                 writel (t & ~(1 << NAK_OUT_PACKETS), &ep->regs->ep_stat);
1997         else
1998                 /* Added for 2282 */
1999                 writel (t, &ep->regs->ep_stat);
2000
2001         /* for ep0, monitor token irqs to catch data stage length errors
2002          * and to synchronize on status.
2003          *
2004          * also, to defer reporting of protocol stalls ... here's where
2005          * data or status first appears, handling stalls here should never
2006          * cause trouble on the host side..
2007          *
2008          * control requests could be slightly faster without token synch for
2009          * status, but status can jam up that way.
2010          */
2011         if (unlikely (ep->num == 0)) {
2012                 if (ep->is_in) {
2013                         /* status; stop NAKing */
2014                         if (t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)) {
2015                                 if (ep->dev->protocol_stall) {
2016                                         ep->stopped = 1;
2017                                         set_halt (ep);
2018                                 }
2019                                 if (!req)
2020                                         allow_status (ep);
2021                                 mode = 2;
2022                         /* reply to extra IN data tokens with a zlp */
2023                         } else if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2024                                 if (ep->dev->protocol_stall) {
2025                                         ep->stopped = 1;
2026                                         set_halt (ep);
2027                                         mode = 2;
2028                                 } else if (ep->responded &&
2029                                                 !req && !ep->stopped)
2030                                         write_fifo (ep, NULL);
2031                         }
2032                 } else {
2033                         /* status; stop NAKing */
2034                         if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2035                                 if (ep->dev->protocol_stall) {
2036                                         ep->stopped = 1;
2037                                         set_halt (ep);
2038                                 }
2039                                 mode = 2;
2040                         /* an extra OUT token is an error */
2041                         } else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
2042                                         && req
2043                                         && req->req.actual == req->req.length)
2044                                         || (ep->responded && !req)) {
2045                                 ep->dev->protocol_stall = 1;
2046                                 set_halt (ep);
2047                                 ep->stopped = 1;
2048                                 if (req)
2049                                         done (ep, req, -EOVERFLOW);
2050                                 req = NULL;
2051                         }
2052                 }
2053         }
2054
2055         if (unlikely (!req))
2056                 return;
2057
2058         /* manual DMA queue advance after short OUT */
2059         if (likely (ep->dma != 0)) {
2060                 if (t & (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)) {
2061                         u32     count;
2062                         int     stopped = ep->stopped;
2063
2064                         /* TRANSFERRED works around OUT_DONE erratum 0112.
2065                          * we expect (N <= maxpacket) bytes; host wrote M.
2066                          * iff (M < N) we won't ever see a DMA interrupt.
2067                          */
2068                         ep->stopped = 1;
2069                         for (count = 0; ; t = readl (&ep->regs->ep_stat)) {
2070
2071                                 /* any preceding dma transfers must finish.
2072                                  * dma handles (M >= N), may empty the queue
2073                                  */
2074                                 scan_dma_completions (ep);
2075                                 if (unlikely (list_empty (&ep->queue)
2076                                                 || ep->out_overflow)) {
2077                                         req = NULL;
2078                                         break;
2079                                 }
2080                                 req = list_entry (ep->queue.next,
2081                                         struct net2280_request, queue);
2082
2083                                 /* here either (M < N), a "real" short rx;
2084                                  * or (M == N) and the queue didn't empty
2085                                  */
2086                                 if (likely (t & (1 << FIFO_EMPTY))) {
2087                                         count = readl (&ep->dma->dmacount);
2088                                         count &= DMA_BYTE_COUNT_MASK;
2089                                         if (readl (&ep->dma->dmadesc)
2090                                                         != req->td_dma)
2091                                                 req = NULL;
2092                                         break;
2093                                 }
2094                                 udelay(1);
2095                         }
2096
2097                         /* stop DMA, leave ep NAKing */
2098                         writel ((1 << DMA_ABORT), &ep->dma->dmastat);
2099                         spin_stop_dma (ep->dma);
2100
2101                         if (likely (req)) {
2102                                 req->td->dmacount = 0;
2103                                 t = readl (&ep->regs->ep_avail);
2104                                 dma_done (ep, req, count,
2105                                         (ep->out_overflow || t)
2106                                                 ? -EOVERFLOW : 0);
2107                         }
2108
2109                         /* also flush to prevent erratum 0106 trouble */
2110                         if (unlikely (ep->out_overflow
2111                                         || (ep->dev->chiprev == 0x0100
2112                                                 && ep->dev->gadget.speed
2113                                                         == USB_SPEED_FULL))) {
2114                                 out_flush (ep);
2115                                 ep->out_overflow = 0;
2116                         }
2117
2118                         /* (re)start dma if needed, stop NAKing */
2119                         ep->stopped = stopped;
2120                         if (!list_empty (&ep->queue))
2121                                 restart_dma (ep);
2122                 } else
2123                         DEBUG (ep->dev, "%s dma ep_stat %08x ??\n",
2124                                         ep->ep.name, t);
2125                 return;
2126
2127         /* data packet(s) received (in the fifo, OUT) */
2128         } else if (t & (1 << DATA_PACKET_RECEIVED_INTERRUPT)) {
2129                 if (read_fifo (ep, req) && ep->num != 0)
2130                         mode = 2;
2131
2132         /* data packet(s) transmitted (IN) */
2133         } else if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)) {
2134                 unsigned        len;
2135
2136                 len = req->req.length - req->req.actual;
2137                 if (len > ep->ep.maxpacket)
2138                         len = ep->ep.maxpacket;
2139                 req->req.actual += len;
2140
2141                 /* if we wrote it all, we're usually done */
2142                 if (req->req.actual == req->req.length) {
2143                         if (ep->num == 0) {
2144                                 /* send zlps until the status stage */
2145                         } else if (!req->req.zero || len != ep->ep.maxpacket)
2146                                 mode = 2;
2147                 }
2148
2149         /* there was nothing to do ...  */
2150         } else if (mode == 1)
2151                 return;
2152
2153         /* done */
2154         if (mode == 2) {
2155                 /* stream endpoints often resubmit/unlink in completion */
2156                 done (ep, req, 0);
2157
2158                 /* maybe advance queue to next request */
2159                 if (ep->num == 0) {
2160                         /* NOTE:  net2280 could let gadget driver start the
2161                          * status stage later. since not all controllers let
2162                          * them control that, the api doesn't (yet) allow it.
2163                          */
2164                         if (!ep->stopped)
2165                                 allow_status (ep);
2166                         req = NULL;
2167                 } else {
2168                         if (!list_empty (&ep->queue) && !ep->stopped)
2169                                 req = list_entry (ep->queue.next,
2170                                         struct net2280_request, queue);
2171                         else
2172                                 req = NULL;
2173                         if (req && !ep->is_in)
2174                                 stop_out_naking (ep);
2175                 }
2176         }
2177
2178         /* is there a buffer for the next packet?
2179          * for best streaming performance, make sure there is one.
2180          */
2181         if (req && !ep->stopped) {
2182
2183                 /* load IN fifo with next packet (may be zlp) */
2184                 if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT))
2185                         write_fifo (ep, &req->req);
2186         }
2187 }
2188
2189 static struct net2280_ep *
2190 get_ep_by_addr (struct net2280 *dev, u16 wIndex)
2191 {
2192         struct net2280_ep       *ep;
2193
2194         if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
2195                 return &dev->ep [0];
2196         list_for_each_entry (ep, &dev->gadget.ep_list, ep.ep_list) {
2197                 u8      bEndpointAddress;
2198
2199                 if (!ep->desc)
2200                         continue;
2201                 bEndpointAddress = ep->desc->bEndpointAddress;
2202                 if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
2203                         continue;
2204                 if ((wIndex & 0x0f) == (bEndpointAddress & 0x0f))
2205                         return ep;
2206         }
2207         return NULL;
2208 }
2209
2210 static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
2211 {
2212         struct net2280_ep       *ep;
2213         u32                     num, scratch;
2214
2215         /* most of these don't need individual acks */
2216         stat &= ~(1 << INTA_ASSERTED);
2217         if (!stat)
2218                 return;
2219         // DEBUG (dev, "irqstat0 %04x\n", stat);
2220
2221         /* starting a control request? */
2222         if (unlikely (stat & (1 << SETUP_PACKET_INTERRUPT))) {
2223                 union {
2224                         u32                     raw [2];
2225                         struct usb_ctrlrequest  r;
2226                 } u;
2227                 int                             tmp;
2228                 struct net2280_request          *req;
2229
2230                 if (dev->gadget.speed == USB_SPEED_UNKNOWN) {
2231                         if (readl (&dev->usb->usbstat) & (1 << HIGH_SPEED))
2232                                 dev->gadget.speed = USB_SPEED_HIGH;
2233                         else
2234                                 dev->gadget.speed = USB_SPEED_FULL;
2235                         net2280_led_speed (dev, dev->gadget.speed);
2236                         DEBUG(dev, "%s\n", usb_speed_string(dev->gadget.speed));
2237                 }
2238
2239                 ep = &dev->ep [0];
2240                 ep->irqs++;
2241
2242                 /* make sure any leftover request state is cleared */
2243                 stat &= ~(1 << ENDPOINT_0_INTERRUPT);
2244                 while (!list_empty (&ep->queue)) {
2245                         req = list_entry (ep->queue.next,
2246                                         struct net2280_request, queue);
2247                         done (ep, req, (req->req.actual == req->req.length)
2248                                                 ? 0 : -EPROTO);
2249                 }
2250                 ep->stopped = 0;
2251                 dev->protocol_stall = 0;
2252
2253                 if (ep->dev->pdev->device == 0x2280)
2254                         tmp = (1 << FIFO_OVERFLOW)
2255                                 | (1 << FIFO_UNDERFLOW);
2256                 else
2257                         tmp = 0;
2258
2259                 writel (tmp | (1 << TIMEOUT)
2260                         | (1 << USB_STALL_SENT)
2261                         | (1 << USB_IN_NAK_SENT)
2262                         | (1 << USB_IN_ACK_RCVD)
2263                         | (1 << USB_OUT_PING_NAK_SENT)
2264                         | (1 << USB_OUT_ACK_SENT)
2265                         | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
2266                         | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
2267                         | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2268                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2269                         | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2270                         | (1 << DATA_IN_TOKEN_INTERRUPT)
2271                         , &ep->regs->ep_stat);
2272                 u.raw [0] = readl (&dev->usb->setup0123);
2273                 u.raw [1] = readl (&dev->usb->setup4567);
2274
2275                 cpu_to_le32s (&u.raw [0]);
2276                 cpu_to_le32s (&u.raw [1]);
2277
2278                 tmp = 0;
2279
2280 #define w_value         le16_to_cpu(u.r.wValue)
2281 #define w_index         le16_to_cpu(u.r.wIndex)
2282 #define w_length        le16_to_cpu(u.r.wLength)
2283
2284                 /* ack the irq */
2285                 writel (1 << SETUP_PACKET_INTERRUPT, &dev->regs->irqstat0);
2286                 stat ^= (1 << SETUP_PACKET_INTERRUPT);
2287
2288                 /* watch control traffic at the token level, and force
2289                  * synchronization before letting the status stage happen.
2290                  * FIXME ignore tokens we'll NAK, until driver responds.
2291                  * that'll mean a lot less irqs for some drivers.
2292                  */
2293                 ep->is_in = (u.r.bRequestType & USB_DIR_IN) != 0;
2294                 if (ep->is_in) {
2295                         scratch = (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2296                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2297                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2298                         stop_out_naking (ep);
2299                 } else
2300                         scratch = (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2301                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2302                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2303                 writel (scratch, &dev->epregs [0].ep_irqenb);
2304
2305                 /* we made the hardware handle most lowlevel requests;
2306                  * everything else goes uplevel to the gadget code.
2307                  */
2308                 ep->responded = 1;
2309                 switch (u.r.bRequest) {
2310                 case USB_REQ_GET_STATUS: {
2311                         struct net2280_ep       *e;
2312                         __le32                  status;
2313
2314                         /* hw handles device and interface status */
2315                         if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
2316                                 goto delegate;
2317                         if ((e = get_ep_by_addr (dev, w_index)) == 0
2318                                         || w_length > 2)
2319                                 goto do_stall;
2320
2321                         if (readl (&e->regs->ep_rsp)
2322                                         & (1 << SET_ENDPOINT_HALT))
2323                                 status = cpu_to_le32 (1);
2324                         else
2325                                 status = cpu_to_le32 (0);
2326
2327                         /* don't bother with a request object! */
2328                         writel (0, &dev->epregs [0].ep_irqenb);
2329                         set_fifo_bytecount (ep, w_length);
2330                         writel ((__force u32)status, &dev->epregs [0].ep_data);
2331                         allow_status (ep);
2332                         VDEBUG (dev, "%s stat %02x\n", ep->ep.name, status);
2333                         goto next_endpoints;
2334                         }
2335                         break;
2336                 case USB_REQ_CLEAR_FEATURE: {
2337                         struct net2280_ep       *e;
2338
2339                         /* hw handles device features */
2340                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2341                                 goto delegate;
2342                         if (w_value != USB_ENDPOINT_HALT
2343                                         || w_length != 0)
2344                                 goto do_stall;
2345                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2346                                 goto do_stall;
2347                         if (e->wedged) {
2348                                 VDEBUG(dev, "%s wedged, halt not cleared\n",
2349                                                 ep->ep.name);
2350                         } else {
2351                                 VDEBUG(dev, "%s clear halt\n", ep->ep.name);
2352                                 clear_halt(e);
2353                         }
2354                         allow_status (ep);
2355                         goto next_endpoints;
2356                         }
2357                         break;
2358                 case USB_REQ_SET_FEATURE: {
2359                         struct net2280_ep       *e;
2360
2361                         /* hw handles device features */
2362                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2363                                 goto delegate;
2364                         if (w_value != USB_ENDPOINT_HALT
2365                                         || w_length != 0)
2366                                 goto do_stall;
2367                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2368                                 goto do_stall;
2369                         if (e->ep.name == ep0name)
2370                                 goto do_stall;
2371                         set_halt (e);
2372                         allow_status (ep);
2373                         VDEBUG (dev, "%s set halt\n", ep->ep.name);
2374                         goto next_endpoints;
2375                         }
2376                         break;
2377                 default:
2378 delegate:
2379                         VDEBUG (dev, "setup %02x.%02x v%04x i%04x l%04x "
2380                                 "ep_cfg %08x\n",
2381                                 u.r.bRequestType, u.r.bRequest,
2382                                 w_value, w_index, w_length,
2383                                 readl (&ep->regs->ep_cfg));
2384                         ep->responded = 0;
2385                         spin_unlock (&dev->lock);
2386                         tmp = dev->driver->setup (&dev->gadget, &u.r);
2387                         spin_lock (&dev->lock);
2388                 }
2389
2390                 /* stall ep0 on error */
2391                 if (tmp < 0) {
2392 do_stall:
2393                         VDEBUG (dev, "req %02x.%02x protocol STALL; stat %d\n",
2394                                         u.r.bRequestType, u.r.bRequest, tmp);
2395                         dev->protocol_stall = 1;
2396                 }
2397
2398                 /* some in/out token irq should follow; maybe stall then.
2399                  * driver must queue a request (even zlp) or halt ep0
2400                  * before the host times out.
2401                  */
2402         }
2403
2404 #undef  w_value
2405 #undef  w_index
2406 #undef  w_length
2407
2408 next_endpoints:
2409         /* endpoint data irq ? */
2410         scratch = stat & 0x7f;
2411         stat &= ~0x7f;
2412         for (num = 0; scratch; num++) {
2413                 u32             t;
2414
2415                 /* do this endpoint's FIFO and queue need tending? */
2416                 t = 1 << num;
2417                 if ((scratch & t) == 0)
2418                         continue;
2419                 scratch ^= t;
2420
2421                 ep = &dev->ep [num];
2422                 handle_ep_small (ep);
2423         }
2424
2425         if (stat)
2426                 DEBUG (dev, "unhandled irqstat0 %08x\n", stat);
2427 }
2428
2429 #define DMA_INTERRUPTS ( \
2430                   (1 << DMA_D_INTERRUPT) \
2431                 | (1 << DMA_C_INTERRUPT) \
2432                 | (1 << DMA_B_INTERRUPT) \
2433                 | (1 << DMA_A_INTERRUPT))
2434 #define PCI_ERROR_INTERRUPTS ( \
2435                   (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT) \
2436                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT) \
2437                 | (1 << PCI_RETRY_ABORT_INTERRUPT))
2438
2439 static void handle_stat1_irqs (struct net2280 *dev, u32 stat)
2440 {
2441         struct net2280_ep       *ep;
2442         u32                     tmp, num, mask, scratch;
2443
2444         /* after disconnect there's nothing else to do! */
2445         tmp = (1 << VBUS_INTERRUPT) | (1 << ROOT_PORT_RESET_INTERRUPT);
2446         mask = (1 << HIGH_SPEED) | (1 << FULL_SPEED);
2447
2448         /* VBUS disconnect is indicated by VBUS_PIN and VBUS_INTERRUPT set.
2449          * Root Port Reset is indicated by ROOT_PORT_RESET_INTERRUPT set and
2450          * both HIGH_SPEED and FULL_SPEED clear (as ROOT_PORT_RESET_INTERRUPT
2451          * only indicates a change in the reset state).
2452          */
2453         if (stat & tmp) {
2454                 writel (tmp, &dev->regs->irqstat1);
2455                 if ((((stat & (1 << ROOT_PORT_RESET_INTERRUPT))
2456                                         && ((readl (&dev->usb->usbstat) & mask)
2457                                                         == 0))
2458                                 || ((readl (&dev->usb->usbctl)
2459                                         & (1 << VBUS_PIN)) == 0)
2460                             ) && ( dev->gadget.speed != USB_SPEED_UNKNOWN)) {
2461                         DEBUG (dev, "disconnect %s\n",
2462                                         dev->driver->driver.name);
2463                         stop_activity (dev, dev->driver);
2464                         ep0_start (dev);
2465                         return;
2466                 }
2467                 stat &= ~tmp;
2468
2469                 /* vBUS can bounce ... one of many reasons to ignore the
2470                  * notion of hotplug events on bus connect/disconnect!
2471                  */
2472                 if (!stat)
2473                         return;
2474         }
2475
2476         /* NOTE: chip stays in PCI D0 state for now, but it could
2477          * enter D1 to save more power
2478          */
2479         tmp = (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT);
2480         if (stat & tmp) {
2481                 writel (tmp, &dev->regs->irqstat1);
2482                 if (stat & (1 << SUSPEND_REQUEST_INTERRUPT)) {
2483                         if (dev->driver->suspend)
2484                                 dev->driver->suspend (&dev->gadget);
2485                         if (!enable_suspend)
2486                                 stat &= ~(1 << SUSPEND_REQUEST_INTERRUPT);
2487                 } else {
2488                         if (dev->driver->resume)
2489                                 dev->driver->resume (&dev->gadget);
2490                         /* at high speed, note erratum 0133 */
2491                 }
2492                 stat &= ~tmp;
2493         }
2494
2495         /* clear any other status/irqs */
2496         if (stat)
2497                 writel (stat, &dev->regs->irqstat1);
2498
2499         /* some status we can just ignore */
2500         if (dev->pdev->device == 0x2280)
2501                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2502                           | (1 << SUSPEND_REQUEST_INTERRUPT)
2503                           | (1 << RESUME_INTERRUPT)
2504                           | (1 << SOF_INTERRUPT));
2505         else
2506                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2507                           | (1 << RESUME_INTERRUPT)
2508                           | (1 << SOF_DOWN_INTERRUPT)
2509                           | (1 << SOF_INTERRUPT));
2510
2511         if (!stat)
2512                 return;
2513         // DEBUG (dev, "irqstat1 %08x\n", stat);
2514
2515         /* DMA status, for ep-{a,b,c,d} */
2516         scratch = stat & DMA_INTERRUPTS;
2517         stat &= ~DMA_INTERRUPTS;
2518         scratch >>= 9;
2519         for (num = 0; scratch; num++) {
2520                 struct net2280_dma_regs __iomem *dma;
2521
2522                 tmp = 1 << num;
2523                 if ((tmp & scratch) == 0)
2524                         continue;
2525                 scratch ^= tmp;
2526
2527                 ep = &dev->ep [num + 1];
2528                 dma = ep->dma;
2529
2530                 if (!dma)
2531                         continue;
2532
2533                 /* clear ep's dma status */
2534                 tmp = readl (&dma->dmastat);
2535                 writel (tmp, &dma->dmastat);
2536
2537                 /* chaining should stop on abort, short OUT from fifo,
2538                  * or (stat0 codepath) short OUT transfer.
2539                  */
2540                 if (!use_dma_chaining) {
2541                         if ((tmp & (1 << DMA_TRANSACTION_DONE_INTERRUPT))
2542                                         == 0) {
2543                                 DEBUG (ep->dev, "%s no xact done? %08x\n",
2544                                         ep->ep.name, tmp);
2545                                 continue;
2546                         }
2547                         stop_dma (ep->dma);
2548                 }
2549
2550                 /* OUT transfers terminate when the data from the
2551                  * host is in our memory.  Process whatever's done.
2552                  * On this path, we know transfer's last packet wasn't
2553                  * less than req->length. NAK_OUT_PACKETS may be set,
2554                  * or the FIFO may already be holding new packets.
2555                  *
2556                  * IN transfers can linger in the FIFO for a very
2557                  * long time ... we ignore that for now, accounting
2558                  * precisely (like PIO does) needs per-packet irqs
2559                  */
2560                 scan_dma_completions (ep);
2561
2562                 /* disable dma on inactive queues; else maybe restart */
2563                 if (list_empty (&ep->queue)) {
2564                         if (use_dma_chaining)
2565                                 stop_dma (ep->dma);
2566                 } else {
2567                         tmp = readl (&dma->dmactl);
2568                         if (!use_dma_chaining
2569                                         || (tmp & (1 << DMA_ENABLE)) == 0)
2570                                 restart_dma (ep);
2571                         else if (ep->is_in && use_dma_chaining) {
2572                                 struct net2280_request  *req;
2573                                 __le32                  dmacount;
2574
2575                                 /* the descriptor at the head of the chain
2576                                  * may still have VALID_BIT clear; that's
2577                                  * used to trigger changing DMA_FIFO_VALIDATE
2578                                  * (affects automagic zlp writes).
2579                                  */
2580                                 req = list_entry (ep->queue.next,
2581                                                 struct net2280_request, queue);
2582                                 dmacount = req->td->dmacount;
2583                                 dmacount &= cpu_to_le32 (
2584                                                 (1 << VALID_BIT)
2585                                                 | DMA_BYTE_COUNT_MASK);
2586                                 if (dmacount && (dmacount & valid_bit) == 0)
2587                                         restart_dma (ep);
2588                         }
2589                 }
2590                 ep->irqs++;
2591         }
2592
2593         /* NOTE:  there are other PCI errors we might usefully notice.
2594          * if they appear very often, here's where to try recovering.
2595          */
2596         if (stat & PCI_ERROR_INTERRUPTS) {
2597                 ERROR (dev, "pci dma error; stat %08x\n", stat);
2598                 stat &= ~PCI_ERROR_INTERRUPTS;
2599                 /* these are fatal errors, but "maybe" they won't
2600                  * happen again ...
2601                  */
2602                 stop_activity (dev, dev->driver);
2603                 ep0_start (dev);
2604                 stat = 0;
2605         }
2606
2607         if (stat)
2608                 DEBUG (dev, "unhandled irqstat1 %08x\n", stat);
2609 }
2610
2611 static irqreturn_t net2280_irq (int irq, void *_dev)
2612 {
2613         struct net2280          *dev = _dev;
2614
2615         /* shared interrupt, not ours */
2616         if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
2617                 return IRQ_NONE;
2618
2619         spin_lock (&dev->lock);
2620
2621         /* handle disconnect, dma, and more */
2622         handle_stat1_irqs (dev, readl (&dev->regs->irqstat1));
2623
2624         /* control requests and PIO */
2625         handle_stat0_irqs (dev, readl (&dev->regs->irqstat0));
2626
2627         spin_unlock (&dev->lock);
2628
2629         return IRQ_HANDLED;
2630 }
2631
2632 /*-------------------------------------------------------------------------*/
2633
2634 static void gadget_release (struct device *_dev)
2635 {
2636         struct net2280  *dev = dev_get_drvdata (_dev);
2637
2638         kfree (dev);
2639 }
2640
2641 /* tear down the binding between this driver and the pci device */
2642
2643 static void net2280_remove (struct pci_dev *pdev)
2644 {
2645         struct net2280          *dev = pci_get_drvdata (pdev);
2646
2647         usb_del_gadget_udc(&dev->gadget);
2648
2649         BUG_ON(dev->driver);
2650
2651         /* then clean up the resources we allocated during probe() */
2652         net2280_led_shutdown (dev);
2653         if (dev->requests) {
2654                 int             i;
2655                 for (i = 1; i < 5; i++) {
2656                         if (!dev->ep [i].dummy)
2657                                 continue;
2658                         pci_pool_free (dev->requests, dev->ep [i].dummy,
2659                                         dev->ep [i].td_dma);
2660                 }
2661                 pci_pool_destroy (dev->requests);
2662         }
2663         if (dev->got_irq)
2664                 free_irq (pdev->irq, dev);
2665         if (dev->regs)
2666                 iounmap (dev->regs);
2667         if (dev->region)
2668                 release_mem_region (pci_resource_start (pdev, 0),
2669                                 pci_resource_len (pdev, 0));
2670         if (dev->enabled)
2671                 pci_disable_device (pdev);
2672         device_unregister (&dev->gadget.dev);
2673         device_remove_file (&pdev->dev, &dev_attr_registers);
2674         pci_set_drvdata (pdev, NULL);
2675
2676         INFO (dev, "unbind\n");
2677 }
2678
2679 /* wrap this driver around the specified device, but
2680  * don't respond over USB until a gadget driver binds to us.
2681  */
2682
2683 static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
2684 {
2685         struct net2280          *dev;
2686         unsigned long           resource, len;
2687         void                    __iomem *base = NULL;
2688         int                     retval, i;
2689
2690         /* alloc, and start init */
2691         dev = kzalloc (sizeof *dev, GFP_KERNEL);
2692         if (dev == NULL){
2693                 retval = -ENOMEM;
2694                 goto done;
2695         }
2696
2697         pci_set_drvdata (pdev, dev);
2698         spin_lock_init (&dev->lock);
2699         dev->pdev = pdev;
2700         dev->gadget.ops = &net2280_ops;
2701         dev->gadget.is_dualspeed = 1;
2702
2703         /* the "gadget" abstracts/virtualizes the controller */
2704         dev_set_name(&dev->gadget.dev, "gadget");
2705         dev->gadget.dev.parent = &pdev->dev;
2706         dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
2707         dev->gadget.dev.release = gadget_release;
2708         dev->gadget.name = driver_name;
2709
2710         /* now all the pci goodies ... */
2711         if (pci_enable_device (pdev) < 0) {
2712                 retval = -ENODEV;
2713                 goto done;
2714         }
2715         dev->enabled = 1;
2716
2717         /* BAR 0 holds all the registers
2718          * BAR 1 is 8051 memory; unused here (note erratum 0103)
2719          * BAR 2 is fifo memory; unused here
2720          */
2721         resource = pci_resource_start (pdev, 0);
2722         len = pci_resource_len (pdev, 0);
2723         if (!request_mem_region (resource, len, driver_name)) {
2724                 DEBUG (dev, "controller already in use\n");
2725                 retval = -EBUSY;
2726                 goto done;
2727         }
2728         dev->region = 1;
2729
2730         /* FIXME provide firmware download interface to put
2731          * 8051 code into the chip, e.g. to turn on PCI PM.
2732          */
2733
2734         base = ioremap_nocache (resource, len);
2735         if (base == NULL) {
2736                 DEBUG (dev, "can't map memory\n");
2737                 retval = -EFAULT;
2738                 goto done;
2739         }
2740         dev->regs = (struct net2280_regs __iomem *) base;
2741         dev->usb = (struct net2280_usb_regs __iomem *) (base + 0x0080);
2742         dev->pci = (struct net2280_pci_regs __iomem *) (base + 0x0100);
2743         dev->dma = (struct net2280_dma_regs __iomem *) (base + 0x0180);
2744         dev->dep = (struct net2280_dep_regs __iomem *) (base + 0x0200);
2745         dev->epregs = (struct net2280_ep_regs __iomem *) (base + 0x0300);
2746
2747         /* put into initial config, link up all endpoints */
2748         writel (0, &dev->usb->usbctl);
2749         usb_reset (dev);
2750         usb_reinit (dev);
2751
2752         /* irq setup after old hardware is cleaned up */
2753         if (!pdev->irq) {
2754                 ERROR (dev, "No IRQ.  Check PCI setup!\n");
2755                 retval = -ENODEV;
2756                 goto done;
2757         }
2758
2759         if (request_irq (pdev->irq, net2280_irq, IRQF_SHARED, driver_name, dev)
2760                         != 0) {
2761                 ERROR (dev, "request interrupt %d failed\n", pdev->irq);
2762                 retval = -EBUSY;
2763                 goto done;
2764         }
2765         dev->got_irq = 1;
2766
2767         /* DMA setup */
2768         /* NOTE:  we know only the 32 LSBs of dma addresses may be nonzero */
2769         dev->requests = pci_pool_create ("requests", pdev,
2770                 sizeof (struct net2280_dma),
2771                 0 /* no alignment requirements */,
2772                 0 /* or page-crossing issues */);
2773         if (!dev->requests) {
2774                 DEBUG (dev, "can't get request pool\n");
2775                 retval = -ENOMEM;
2776                 goto done;
2777         }
2778         for (i = 1; i < 5; i++) {
2779                 struct net2280_dma      *td;
2780
2781                 td = pci_pool_alloc (dev->requests, GFP_KERNEL,
2782                                 &dev->ep [i].td_dma);
2783                 if (!td) {
2784                         DEBUG (dev, "can't get dummy %d\n", i);
2785                         retval = -ENOMEM;
2786                         goto done;
2787                 }
2788                 td->dmacount = 0;       /* not VALID */
2789                 td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
2790                 td->dmadesc = td->dmaaddr;
2791                 dev->ep [i].dummy = td;
2792         }
2793
2794         /* enable lower-overhead pci memory bursts during DMA */
2795         writel ( (1 << DMA_MEMORY_WRITE_AND_INVALIDATE_ENABLE)
2796                         // 256 write retries may not be enough...
2797                         // | (1 << PCI_RETRY_ABORT_ENABLE)
2798                         | (1 << DMA_READ_MULTIPLE_ENABLE)
2799                         | (1 << DMA_READ_LINE_ENABLE)
2800                         , &dev->pci->pcimstctl);
2801         /* erratum 0115 shouldn't appear: Linux inits PCI_LATENCY_TIMER */
2802         pci_set_master (pdev);
2803         pci_try_set_mwi (pdev);
2804
2805         /* ... also flushes any posted pci writes */
2806         dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
2807
2808         /* done */
2809         INFO (dev, "%s\n", driver_desc);
2810         INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
2811                         pdev->irq, base, dev->chiprev);
2812         INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
2813                         use_dma
2814                                 ? (use_dma_chaining ? "chaining" : "enabled")
2815                                 : "disabled");
2816         retval = device_register (&dev->gadget.dev);
2817         if (retval) goto done;
2818         retval = device_create_file (&pdev->dev, &dev_attr_registers);
2819         if (retval) goto done;
2820
2821         retval = usb_add_gadget_udc(&pdev->dev, &dev->gadget);
2822         if (retval)
2823                 goto done;
2824         return 0;
2825
2826 done:
2827         if (dev)
2828                 net2280_remove (pdev);
2829         return retval;
2830 }
2831
2832 /* make sure the board is quiescent; otherwise it will continue
2833  * generating IRQs across the upcoming reboot.
2834  */
2835
2836 static void net2280_shutdown (struct pci_dev *pdev)
2837 {
2838         struct net2280          *dev = pci_get_drvdata (pdev);
2839
2840         /* disable IRQs */
2841         writel (0, &dev->regs->pciirqenb0);
2842         writel (0, &dev->regs->pciirqenb1);
2843
2844         /* disable the pullup so the host will think we're gone */
2845         writel (0, &dev->usb->usbctl);
2846 }
2847
2848
2849 /*-------------------------------------------------------------------------*/
2850
2851 static const struct pci_device_id pci_ids [] = { {
2852         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2853         .class_mask =   ~0,
2854         .vendor =       0x17cc,
2855         .device =       0x2280,
2856         .subvendor =    PCI_ANY_ID,
2857         .subdevice =    PCI_ANY_ID,
2858 }, {
2859         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2860         .class_mask =   ~0,
2861         .vendor =       0x17cc,
2862         .device =       0x2282,
2863         .subvendor =    PCI_ANY_ID,
2864         .subdevice =    PCI_ANY_ID,
2865
2866 }, { /* end: all zeroes */ }
2867 };
2868 MODULE_DEVICE_TABLE (pci, pci_ids);
2869
2870 /* pci driver glue; this is a "new style" PCI driver module */
2871 static struct pci_driver net2280_pci_driver = {
2872         .name =         (char *) driver_name,
2873         .id_table =     pci_ids,
2874
2875         .probe =        net2280_probe,
2876         .remove =       net2280_remove,
2877         .shutdown =     net2280_shutdown,
2878
2879         /* FIXME add power management support */
2880 };
2881
2882 MODULE_DESCRIPTION (DRIVER_DESC);
2883 MODULE_AUTHOR ("David Brownell");
2884 MODULE_LICENSE ("GPL");
2885
2886 static int __init init (void)
2887 {
2888         if (!use_dma)
2889                 use_dma_chaining = 0;
2890         return pci_register_driver (&net2280_pci_driver);
2891 }
2892 module_init (init);
2893
2894 static void __exit cleanup (void)
2895 {
2896         pci_unregister_driver (&net2280_pci_driver);
2897 }
2898 module_exit (cleanup);