Linux Audio

Check our new training course

Loading...
Note: File does not exist in v4.17.
   1/*
   2 * Driver for the PLX NET2280 USB device controller.
   3 * Specs and errata are available from <http://www.plxtech.com>.
   4 *
   5 * PLX Technology Inc. (formerly NetChip Technology) supported the
   6 * development of this driver.
   7 *
   8 *
   9 * CODE STATUS HIGHLIGHTS
  10 *
  11 * This driver should work well with most "gadget" drivers, including
  12 * the File Storage, Serial, and Ethernet/RNDIS gadget drivers
  13 * as well as Gadget Zero and Gadgetfs.
  14 *
  15 * DMA is enabled by default.  Drivers using transfer queues might use
  16 * DMA chaining to remove IRQ latencies between transfers.  (Except when
  17 * short OUT transfers happen.)  Drivers can use the req->no_interrupt
  18 * hint to completely eliminate some IRQs, if a later IRQ is guaranteed
  19 * and DMA chaining is enabled.
  20 *
  21 * Note that almost all the errata workarounds here are only needed for
  22 * rev1 chips.  Rev1a silicon (0110) fixes almost all of them.
  23 */
  24
  25/*
  26 * Copyright (C) 2003 David Brownell
  27 * Copyright (C) 2003-2005 PLX Technology, Inc.
  28 *
  29 * Modified Seth Levy 2005 PLX Technology, Inc. to provide compatibility
  30 *	with 2282 chip
  31 *
  32 * This program is free software; you can redistribute it and/or modify
  33 * it under the terms of the GNU General Public License as published by
  34 * the Free Software Foundation; either version 2 of the License, or
  35 * (at your option) any later version.
  36 *
  37 * This program is distributed in the hope that it will be useful,
  38 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  39 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  40 * GNU General Public License for more details.
  41 *
  42 * You should have received a copy of the GNU General Public License
  43 * along with this program; if not, write to the Free Software
  44 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  45 */
  46
  47#undef	DEBUG		/* messages on error and most fault paths */
  48#undef	VERBOSE		/* extra debug messages (success too) */
  49
  50#include <linux/module.h>
  51#include <linux/pci.h>
  52#include <linux/dma-mapping.h>
  53#include <linux/kernel.h>
  54#include <linux/delay.h>
  55#include <linux/ioport.h>
  56#include <linux/slab.h>
  57#include <linux/errno.h>
  58#include <linux/init.h>
  59#include <linux/timer.h>
  60#include <linux/list.h>
  61#include <linux/interrupt.h>
  62#include <linux/moduleparam.h>
  63#include <linux/device.h>
  64#include <linux/usb/ch9.h>
  65#include <linux/usb/gadget.h>
  66#include <linux/prefetch.h>
  67
  68#include <asm/byteorder.h>
  69#include <asm/io.h>
  70#include <asm/irq.h>
  71#include <asm/system.h>
  72#include <asm/unaligned.h>
  73
  74
  75#define	DRIVER_DESC		"PLX NET228x USB Peripheral Controller"
  76#define	DRIVER_VERSION		"2005 Sept 27"
  77
  78#define	DMA_ADDR_INVALID	(~(dma_addr_t)0)
  79#define	EP_DONTUSE		13	/* nonzero */
  80
  81#define USE_RDK_LEDS		/* GPIO pins control three LEDs */
  82
  83
  84static const char driver_name [] = "net2280";
  85static const char driver_desc [] = DRIVER_DESC;
  86
  87static const char ep0name [] = "ep0";
  88static const char *const ep_name [] = {
  89	ep0name,
  90	"ep-a", "ep-b", "ep-c", "ep-d",
  91	"ep-e", "ep-f",
  92};
  93
  94/* use_dma -- general goodness, fewer interrupts, less cpu load (vs PIO)
  95 * use_dma_chaining -- dma descriptor queueing gives even more irq reduction
  96 *
  97 * The net2280 DMA engines are not tightly integrated with their FIFOs;
  98 * not all cases are (yet) handled well in this driver or the silicon.
  99 * Some gadget drivers work better with the dma support here than others.
 100 * These two parameters let you use PIO or more aggressive DMA.
 101 */
 102static int use_dma = 1;
 103static int use_dma_chaining = 0;
 104
 105/* "modprobe net2280 use_dma=n" etc */
 106module_param (use_dma, bool, S_IRUGO);
 107module_param (use_dma_chaining, bool, S_IRUGO);
 108
 109
 110/* mode 0 == ep-{a,b,c,d} 1K fifo each
 111 * mode 1 == ep-{a,b} 2K fifo each, ep-{c,d} unavailable
 112 * mode 2 == ep-a 2K fifo, ep-{b,c} 1K each, ep-d unavailable
 113 */
 114static ushort fifo_mode = 0;
 115
 116/* "modprobe net2280 fifo_mode=1" etc */
 117module_param (fifo_mode, ushort, 0644);
 118
 119/* enable_suspend -- When enabled, the driver will respond to
 120 * USB suspend requests by powering down the NET2280.  Otherwise,
 121 * USB suspend requests will be ignored.  This is acceptable for
 122 * self-powered devices
 123 */
 124static int enable_suspend = 0;
 125
 126/* "modprobe net2280 enable_suspend=1" etc */
 127module_param (enable_suspend, bool, S_IRUGO);
 128
 129
 130#define	DIR_STRING(bAddress) (((bAddress) & USB_DIR_IN) ? "in" : "out")
 131
 132#if defined(CONFIG_USB_GADGET_DEBUG_FILES) || defined (DEBUG)
 133static char *type_string (u8 bmAttributes)
 134{
 135	switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
 136	case USB_ENDPOINT_XFER_BULK:	return "bulk";
 137	case USB_ENDPOINT_XFER_ISOC:	return "iso";
 138	case USB_ENDPOINT_XFER_INT:	return "intr";
 139	};
 140	return "control";
 141}
 142#endif
 143
 144#include "net2280.h"
 145
 146#define valid_bit	cpu_to_le32 (1 << VALID_BIT)
 147#define dma_done_ie	cpu_to_le32 (1 << DMA_DONE_INTERRUPT_ENABLE)
 148
 149/*-------------------------------------------------------------------------*/
 150
 151static int
 152net2280_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 153{
 154	struct net2280		*dev;
 155	struct net2280_ep	*ep;
 156	u32			max, tmp;
 157	unsigned long		flags;
 158
 159	ep = container_of (_ep, struct net2280_ep, ep);
 160	if (!_ep || !desc || ep->desc || _ep->name == ep0name
 161			|| desc->bDescriptorType != USB_DT_ENDPOINT)
 162		return -EINVAL;
 163	dev = ep->dev;
 164	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 165		return -ESHUTDOWN;
 166
 167	/* erratum 0119 workaround ties up an endpoint number */
 168	if ((desc->bEndpointAddress & 0x0f) == EP_DONTUSE)
 169		return -EDOM;
 170
 171	/* sanity check ep-e/ep-f since their fifos are small */
 172	max = le16_to_cpu (desc->wMaxPacketSize) & 0x1fff;
 173	if (ep->num > 4 && max > 64)
 174		return -ERANGE;
 175
 176	spin_lock_irqsave (&dev->lock, flags);
 177	_ep->maxpacket = max & 0x7ff;
 178	ep->desc = desc;
 179
 180	/* ep_reset() has already been called */
 181	ep->stopped = 0;
 182	ep->wedged = 0;
 183	ep->out_overflow = 0;
 184
 185	/* set speed-dependent max packet; may kick in high bandwidth */
 186	set_idx_reg (dev->regs, REG_EP_MAXPKT (dev, ep->num), max);
 187
 188	/* FIFO lines can't go to different packets.  PIO is ok, so
 189	 * use it instead of troublesome (non-bulk) multi-packet DMA.
 190	 */
 191	if (ep->dma && (max % 4) != 0 && use_dma_chaining) {
 192		DEBUG (ep->dev, "%s, no dma for maxpacket %d\n",
 193			ep->ep.name, ep->ep.maxpacket);
 194		ep->dma = NULL;
 195	}
 196
 197	/* set type, direction, address; reset fifo counters */
 198	writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
 199	tmp = (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
 200	if (tmp == USB_ENDPOINT_XFER_INT) {
 201		/* erratum 0105 workaround prevents hs NYET */
 202		if (dev->chiprev == 0100
 203				&& dev->gadget.speed == USB_SPEED_HIGH
 204				&& !(desc->bEndpointAddress & USB_DIR_IN))
 205			writel ((1 << CLEAR_NAK_OUT_PACKETS_MODE),
 206				&ep->regs->ep_rsp);
 207	} else if (tmp == USB_ENDPOINT_XFER_BULK) {
 208		/* catch some particularly blatant driver bugs */
 209		if ((dev->gadget.speed == USB_SPEED_HIGH
 210					&& max != 512)
 211				|| (dev->gadget.speed == USB_SPEED_FULL
 212					&& max > 64)) {
 213			spin_unlock_irqrestore (&dev->lock, flags);
 214			return -ERANGE;
 215		}
 216	}
 217	ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC) ? 1 : 0;
 218	tmp <<= ENDPOINT_TYPE;
 219	tmp |= desc->bEndpointAddress;
 220	tmp |= (4 << ENDPOINT_BYTE_COUNT);	/* default full fifo lines */
 221	tmp |= 1 << ENDPOINT_ENABLE;
 222	wmb ();
 223
 224	/* for OUT transfers, block the rx fifo until a read is posted */
 225	ep->is_in = (tmp & USB_DIR_IN) != 0;
 226	if (!ep->is_in)
 227		writel ((1 << SET_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 228	else if (dev->pdev->device != 0x2280) {
 229		/* Added for 2282, Don't use nak packets on an in endpoint,
 230		 * this was ignored on 2280
 231		 */
 232		writel ((1 << CLEAR_NAK_OUT_PACKETS)
 233			| (1 << CLEAR_NAK_OUT_PACKETS_MODE), &ep->regs->ep_rsp);
 234	}
 235
 236	writel (tmp, &ep->regs->ep_cfg);
 237
 238	/* enable irqs */
 239	if (!ep->dma) {				/* pio, per-packet */
 240		tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 241		writel (tmp, &dev->regs->pciirqenb0);
 242
 243		tmp = (1 << DATA_PACKET_RECEIVED_INTERRUPT_ENABLE)
 244			| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT_ENABLE);
 245		if (dev->pdev->device == 0x2280)
 246			tmp |= readl (&ep->regs->ep_irqenb);
 247		writel (tmp, &ep->regs->ep_irqenb);
 248	} else {				/* dma, per-request */
 249		tmp = (1 << (8 + ep->num));	/* completion */
 250		tmp |= readl (&dev->regs->pciirqenb1);
 251		writel (tmp, &dev->regs->pciirqenb1);
 252
 253		/* for short OUT transfers, dma completions can't
 254		 * advance the queue; do it pio-style, by hand.
 255		 * NOTE erratum 0112 workaround #2
 256		 */
 257		if ((desc->bEndpointAddress & USB_DIR_IN) == 0) {
 258			tmp = (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT_ENABLE);
 259			writel (tmp, &ep->regs->ep_irqenb);
 260
 261			tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 262			writel (tmp, &dev->regs->pciirqenb0);
 263		}
 264	}
 265
 266	tmp = desc->bEndpointAddress;
 267	DEBUG (dev, "enabled %s (ep%d%s-%s) %s max %04x\n",
 268		_ep->name, tmp & 0x0f, DIR_STRING (tmp),
 269		type_string (desc->bmAttributes),
 270		ep->dma ? "dma" : "pio", max);
 271
 272	/* pci writes may still be posted */
 273	spin_unlock_irqrestore (&dev->lock, flags);
 274	return 0;
 275}
 276
 277static int handshake (u32 __iomem *ptr, u32 mask, u32 done, int usec)
 278{
 279	u32	result;
 280
 281	do {
 282		result = readl (ptr);
 283		if (result == ~(u32)0)		/* "device unplugged" */
 284			return -ENODEV;
 285		result &= mask;
 286		if (result == done)
 287			return 0;
 288		udelay (1);
 289		usec--;
 290	} while (usec > 0);
 291	return -ETIMEDOUT;
 292}
 293
 294static const struct usb_ep_ops net2280_ep_ops;
 295
 296static void ep_reset (struct net2280_regs __iomem *regs, struct net2280_ep *ep)
 297{
 298	u32		tmp;
 299
 300	ep->desc = NULL;
 301	INIT_LIST_HEAD (&ep->queue);
 302
 303	ep->ep.maxpacket = ~0;
 304	ep->ep.ops = &net2280_ep_ops;
 305
 306	/* disable the dma, irqs, endpoint... */
 307	if (ep->dma) {
 308		writel (0, &ep->dma->dmactl);
 309		writel (  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 310			| (1 << DMA_TRANSACTION_DONE_INTERRUPT)
 311			| (1 << DMA_ABORT)
 312			, &ep->dma->dmastat);
 313
 314		tmp = readl (&regs->pciirqenb0);
 315		tmp &= ~(1 << ep->num);
 316		writel (tmp, &regs->pciirqenb0);
 317	} else {
 318		tmp = readl (&regs->pciirqenb1);
 319		tmp &= ~(1 << (8 + ep->num));	/* completion */
 320		writel (tmp, &regs->pciirqenb1);
 321	}
 322	writel (0, &ep->regs->ep_irqenb);
 323
 324	/* init to our chosen defaults, notably so that we NAK OUT
 325	 * packets until the driver queues a read (+note erratum 0112)
 326	 */
 327	if (!ep->is_in || ep->dev->pdev->device == 0x2280) {
 328		tmp = (1 << SET_NAK_OUT_PACKETS_MODE)
 329		| (1 << SET_NAK_OUT_PACKETS)
 330		| (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 331		| (1 << CLEAR_INTERRUPT_MODE);
 332	} else {
 333		/* added for 2282 */
 334		tmp = (1 << CLEAR_NAK_OUT_PACKETS_MODE)
 335		| (1 << CLEAR_NAK_OUT_PACKETS)
 336		| (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 337		| (1 << CLEAR_INTERRUPT_MODE);
 338	}
 339
 340	if (ep->num != 0) {
 341		tmp |= (1 << CLEAR_ENDPOINT_TOGGLE)
 342			| (1 << CLEAR_ENDPOINT_HALT);
 343	}
 344	writel (tmp, &ep->regs->ep_rsp);
 345
 346	/* scrub most status bits, and flush any fifo state */
 347	if (ep->dev->pdev->device == 0x2280)
 348		tmp = (1 << FIFO_OVERFLOW)
 349			| (1 << FIFO_UNDERFLOW);
 350	else
 351		tmp = 0;
 352
 353	writel (tmp | (1 << TIMEOUT)
 354		| (1 << USB_STALL_SENT)
 355		| (1 << USB_IN_NAK_SENT)
 356		| (1 << USB_IN_ACK_RCVD)
 357		| (1 << USB_OUT_PING_NAK_SENT)
 358		| (1 << USB_OUT_ACK_SENT)
 359		| (1 << FIFO_FLUSH)
 360		| (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
 361		| (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
 362		| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 363		| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
 364		| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 365		| (1 << DATA_IN_TOKEN_INTERRUPT)
 366		, &ep->regs->ep_stat);
 367
 368	/* fifo size is handled separately */
 369}
 370
 371static void nuke (struct net2280_ep *);
 372
 373static int net2280_disable (struct usb_ep *_ep)
 374{
 375	struct net2280_ep	*ep;
 376	unsigned long		flags;
 377
 378	ep = container_of (_ep, struct net2280_ep, ep);
 379	if (!_ep || !ep->desc || _ep->name == ep0name)
 380		return -EINVAL;
 381
 382	spin_lock_irqsave (&ep->dev->lock, flags);
 383	nuke (ep);
 384	ep_reset (ep->dev->regs, ep);
 385
 386	VDEBUG (ep->dev, "disabled %s %s\n",
 387			ep->dma ? "dma" : "pio", _ep->name);
 388
 389	/* synch memory views with the device */
 390	(void) readl (&ep->regs->ep_cfg);
 391
 392	if (use_dma && !ep->dma && ep->num >= 1 && ep->num <= 4)
 393		ep->dma = &ep->dev->dma [ep->num - 1];
 394
 395	spin_unlock_irqrestore (&ep->dev->lock, flags);
 396	return 0;
 397}
 398
 399/*-------------------------------------------------------------------------*/
 400
 401static struct usb_request *
 402net2280_alloc_request (struct usb_ep *_ep, gfp_t gfp_flags)
 403{
 404	struct net2280_ep	*ep;
 405	struct net2280_request	*req;
 406
 407	if (!_ep)
 408		return NULL;
 409	ep = container_of (_ep, struct net2280_ep, ep);
 410
 411	req = kzalloc(sizeof(*req), gfp_flags);
 412	if (!req)
 413		return NULL;
 414
 415	req->req.dma = DMA_ADDR_INVALID;
 416	INIT_LIST_HEAD (&req->queue);
 417
 418	/* this dma descriptor may be swapped with the previous dummy */
 419	if (ep->dma) {
 420		struct net2280_dma	*td;
 421
 422		td = pci_pool_alloc (ep->dev->requests, gfp_flags,
 423				&req->td_dma);
 424		if (!td) {
 425			kfree (req);
 426			return NULL;
 427		}
 428		td->dmacount = 0;	/* not VALID */
 429		td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
 430		td->dmadesc = td->dmaaddr;
 431		req->td = td;
 432	}
 433	return &req->req;
 434}
 435
 436static void
 437net2280_free_request (struct usb_ep *_ep, struct usb_request *_req)
 438{
 439	struct net2280_ep	*ep;
 440	struct net2280_request	*req;
 441
 442	ep = container_of (_ep, struct net2280_ep, ep);
 443	if (!_ep || !_req)
 444		return;
 445
 446	req = container_of (_req, struct net2280_request, req);
 447	WARN_ON (!list_empty (&req->queue));
 448	if (req->td)
 449		pci_pool_free (ep->dev->requests, req->td, req->td_dma);
 450	kfree (req);
 451}
 452
 453/*-------------------------------------------------------------------------*/
 454
 455/* load a packet into the fifo we use for usb IN transfers.
 456 * works for all endpoints.
 457 *
 458 * NOTE: pio with ep-a..ep-d could stuff multiple packets into the fifo
 459 * at a time, but this code is simpler because it knows it only writes
 460 * one packet.  ep-a..ep-d should use dma instead.
 461 */
 462static void
 463write_fifo (struct net2280_ep *ep, struct usb_request *req)
 464{
 465	struct net2280_ep_regs	__iomem *regs = ep->regs;
 466	u8			*buf;
 467	u32			tmp;
 468	unsigned		count, total;
 469
 470	/* INVARIANT:  fifo is currently empty. (testable) */
 471
 472	if (req) {
 473		buf = req->buf + req->actual;
 474		prefetch (buf);
 475		total = req->length - req->actual;
 476	} else {
 477		total = 0;
 478		buf = NULL;
 479	}
 480
 481	/* write just one packet at a time */
 482	count = ep->ep.maxpacket;
 483	if (count > total)	/* min() cannot be used on a bitfield */
 484		count = total;
 485
 486	VDEBUG (ep->dev, "write %s fifo (IN) %d bytes%s req %p\n",
 487			ep->ep.name, count,
 488			(count != ep->ep.maxpacket) ? " (short)" : "",
 489			req);
 490	while (count >= 4) {
 491		/* NOTE be careful if you try to align these. fifo lines
 492		 * should normally be full (4 bytes) and successive partial
 493		 * lines are ok only in certain cases.
 494		 */
 495		tmp = get_unaligned ((u32 *)buf);
 496		cpu_to_le32s (&tmp);
 497		writel (tmp, &regs->ep_data);
 498		buf += 4;
 499		count -= 4;
 500	}
 501
 502	/* last fifo entry is "short" unless we wrote a full packet.
 503	 * also explicitly validate last word in (periodic) transfers
 504	 * when maxpacket is not a multiple of 4 bytes.
 505	 */
 506	if (count || total < ep->ep.maxpacket) {
 507		tmp = count ? get_unaligned ((u32 *)buf) : count;
 508		cpu_to_le32s (&tmp);
 509		set_fifo_bytecount (ep, count & 0x03);
 510		writel (tmp, &regs->ep_data);
 511	}
 512
 513	/* pci writes may still be posted */
 514}
 515
 516/* work around erratum 0106: PCI and USB race over the OUT fifo.
 517 * caller guarantees chiprev 0100, out endpoint is NAKing, and
 518 * there's no real data in the fifo.
 519 *
 520 * NOTE:  also used in cases where that erratum doesn't apply:
 521 * where the host wrote "too much" data to us.
 522 */
 523static void out_flush (struct net2280_ep *ep)
 524{
 525	u32	__iomem *statp;
 526	u32	tmp;
 527
 528	ASSERT_OUT_NAKING (ep);
 529
 530	statp = &ep->regs->ep_stat;
 531	writel (  (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 532		| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 533		, statp);
 534	writel ((1 << FIFO_FLUSH), statp);
 535	mb ();
 536	tmp = readl (statp);
 537	if (tmp & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 538			/* high speed did bulk NYET; fifo isn't filling */
 539			&& ep->dev->gadget.speed == USB_SPEED_FULL) {
 540		unsigned	usec;
 541
 542		usec = 50;		/* 64 byte bulk/interrupt */
 543		handshake (statp, (1 << USB_OUT_PING_NAK_SENT),
 544				(1 << USB_OUT_PING_NAK_SENT), usec);
 545		/* NAK done; now CLEAR_NAK_OUT_PACKETS is safe */
 546	}
 547}
 548
 549/* unload packet(s) from the fifo we use for usb OUT transfers.
 550 * returns true iff the request completed, because of short packet
 551 * or the request buffer having filled with full packets.
 552 *
 553 * for ep-a..ep-d this will read multiple packets out when they
 554 * have been accepted.
 555 */
 556static int
 557read_fifo (struct net2280_ep *ep, struct net2280_request *req)
 558{
 559	struct net2280_ep_regs	__iomem *regs = ep->regs;
 560	u8			*buf = req->req.buf + req->req.actual;
 561	unsigned		count, tmp, is_short;
 562	unsigned		cleanup = 0, prevent = 0;
 563
 564	/* erratum 0106 ... packets coming in during fifo reads might
 565	 * be incompletely rejected.  not all cases have workarounds.
 566	 */
 567	if (ep->dev->chiprev == 0x0100
 568			&& ep->dev->gadget.speed == USB_SPEED_FULL) {
 569		udelay (1);
 570		tmp = readl (&ep->regs->ep_stat);
 571		if ((tmp & (1 << NAK_OUT_PACKETS)))
 572			cleanup = 1;
 573		else if ((tmp & (1 << FIFO_FULL))) {
 574			start_out_naking (ep);
 575			prevent = 1;
 576		}
 577		/* else: hope we don't see the problem */
 578	}
 579
 580	/* never overflow the rx buffer. the fifo reads packets until
 581	 * it sees a short one; we might not be ready for them all.
 582	 */
 583	prefetchw (buf);
 584	count = readl (&regs->ep_avail);
 585	if (unlikely (count == 0)) {
 586		udelay (1);
 587		tmp = readl (&ep->regs->ep_stat);
 588		count = readl (&regs->ep_avail);
 589		/* handled that data already? */
 590		if (count == 0 && (tmp & (1 << NAK_OUT_PACKETS)) == 0)
 591			return 0;
 592	}
 593
 594	tmp = req->req.length - req->req.actual;
 595	if (count > tmp) {
 596		/* as with DMA, data overflow gets flushed */
 597		if ((tmp % ep->ep.maxpacket) != 0) {
 598			ERROR (ep->dev,
 599				"%s out fifo %d bytes, expected %d\n",
 600				ep->ep.name, count, tmp);
 601			req->req.status = -EOVERFLOW;
 602			cleanup = 1;
 603			/* NAK_OUT_PACKETS will be set, so flushing is safe;
 604			 * the next read will start with the next packet
 605			 */
 606		} /* else it's a ZLP, no worries */
 607		count = tmp;
 608	}
 609	req->req.actual += count;
 610
 611	is_short = (count == 0) || ((count % ep->ep.maxpacket) != 0);
 612
 613	VDEBUG (ep->dev, "read %s fifo (OUT) %d bytes%s%s%s req %p %d/%d\n",
 614			ep->ep.name, count, is_short ? " (short)" : "",
 615			cleanup ? " flush" : "", prevent ? " nak" : "",
 616			req, req->req.actual, req->req.length);
 617
 618	while (count >= 4) {
 619		tmp = readl (&regs->ep_data);
 620		cpu_to_le32s (&tmp);
 621		put_unaligned (tmp, (u32 *)buf);
 622		buf += 4;
 623		count -= 4;
 624	}
 625	if (count) {
 626		tmp = readl (&regs->ep_data);
 627		/* LE conversion is implicit here: */
 628		do {
 629			*buf++ = (u8) tmp;
 630			tmp >>= 8;
 631		} while (--count);
 632	}
 633	if (cleanup)
 634		out_flush (ep);
 635	if (prevent) {
 636		writel ((1 << CLEAR_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 637		(void) readl (&ep->regs->ep_rsp);
 638	}
 639
 640	return is_short || ((req->req.actual == req->req.length)
 641				&& !req->req.zero);
 642}
 643
 644/* fill out dma descriptor to match a given request */
 645static void
 646fill_dma_desc (struct net2280_ep *ep, struct net2280_request *req, int valid)
 647{
 648	struct net2280_dma	*td = req->td;
 649	u32			dmacount = req->req.length;
 650
 651	/* don't let DMA continue after a short OUT packet,
 652	 * so overruns can't affect the next transfer.
 653	 * in case of overruns on max-size packets, we can't
 654	 * stop the fifo from filling but we can flush it.
 655	 */
 656	if (ep->is_in)
 657		dmacount |= (1 << DMA_DIRECTION);
 658	if ((!ep->is_in && (dmacount % ep->ep.maxpacket) != 0)
 659			|| ep->dev->pdev->device != 0x2280)
 660		dmacount |= (1 << END_OF_CHAIN);
 661
 662	req->valid = valid;
 663	if (valid)
 664		dmacount |= (1 << VALID_BIT);
 665	if (likely(!req->req.no_interrupt || !use_dma_chaining))
 666		dmacount |= (1 << DMA_DONE_INTERRUPT_ENABLE);
 667
 668	/* td->dmadesc = previously set by caller */
 669	td->dmaaddr = cpu_to_le32 (req->req.dma);
 670
 671	/* 2280 may be polling VALID_BIT through ep->dma->dmadesc */
 672	wmb ();
 673	td->dmacount = cpu_to_le32(dmacount);
 674}
 675
 676static const u32 dmactl_default =
 677		  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 678		| (1 << DMA_CLEAR_COUNT_ENABLE)
 679		/* erratum 0116 workaround part 1 (use POLLING) */
 680		| (POLL_100_USEC << DESCRIPTOR_POLLING_RATE)
 681		| (1 << DMA_VALID_BIT_POLLING_ENABLE)
 682		| (1 << DMA_VALID_BIT_ENABLE)
 683		| (1 << DMA_SCATTER_GATHER_ENABLE)
 684		/* erratum 0116 workaround part 2 (no AUTOSTART) */
 685		| (1 << DMA_ENABLE);
 686
 687static inline void spin_stop_dma (struct net2280_dma_regs __iomem *dma)
 688{
 689	handshake (&dma->dmactl, (1 << DMA_ENABLE), 0, 50);
 690}
 691
 692static inline void stop_dma (struct net2280_dma_regs __iomem *dma)
 693{
 694	writel (readl (&dma->dmactl) & ~(1 << DMA_ENABLE), &dma->dmactl);
 695	spin_stop_dma (dma);
 696}
 697
 698static void start_queue (struct net2280_ep *ep, u32 dmactl, u32 td_dma)
 699{
 700	struct net2280_dma_regs	__iomem *dma = ep->dma;
 701	unsigned int tmp = (1 << VALID_BIT) | (ep->is_in << DMA_DIRECTION);
 702
 703	if (ep->dev->pdev->device != 0x2280)
 704		tmp |= (1 << END_OF_CHAIN);
 705
 706	writel (tmp, &dma->dmacount);
 707	writel (readl (&dma->dmastat), &dma->dmastat);
 708
 709	writel (td_dma, &dma->dmadesc);
 710	writel (dmactl, &dma->dmactl);
 711
 712	/* erratum 0116 workaround part 3:  pci arbiter away from net2280 */
 713	(void) readl (&ep->dev->pci->pcimstctl);
 714
 715	writel ((1 << DMA_START), &dma->dmastat);
 716
 717	if (!ep->is_in)
 718		stop_out_naking (ep);
 719}
 720
 721static void start_dma (struct net2280_ep *ep, struct net2280_request *req)
 722{
 723	u32			tmp;
 724	struct net2280_dma_regs	__iomem *dma = ep->dma;
 725
 726	/* FIXME can't use DMA for ZLPs */
 727
 728	/* on this path we "know" there's no dma active (yet) */
 729	WARN_ON (readl (&dma->dmactl) & (1 << DMA_ENABLE));
 730	writel (0, &ep->dma->dmactl);
 731
 732	/* previous OUT packet might have been short */
 733	if (!ep->is_in && ((tmp = readl (&ep->regs->ep_stat))
 734				& (1 << NAK_OUT_PACKETS)) != 0) {
 735		writel ((1 << SHORT_PACKET_TRANSFERRED_INTERRUPT),
 736			&ep->regs->ep_stat);
 737
 738		tmp = readl (&ep->regs->ep_avail);
 739		if (tmp) {
 740			writel (readl (&dma->dmastat), &dma->dmastat);
 741
 742			/* transfer all/some fifo data */
 743			writel (req->req.dma, &dma->dmaaddr);
 744			tmp = min (tmp, req->req.length);
 745
 746			/* dma irq, faking scatterlist status */
 747			req->td->dmacount = cpu_to_le32 (req->req.length - tmp);
 748			writel ((1 << DMA_DONE_INTERRUPT_ENABLE)
 749				| tmp, &dma->dmacount);
 750			req->td->dmadesc = 0;
 751			req->valid = 1;
 752
 753			writel ((1 << DMA_ENABLE), &dma->dmactl);
 754			writel ((1 << DMA_START), &dma->dmastat);
 755			return;
 756		}
 757	}
 758
 759	tmp = dmactl_default;
 760
 761	/* force packet boundaries between dma requests, but prevent the
 762	 * controller from automagically writing a last "short" packet
 763	 * (zero length) unless the driver explicitly said to do that.
 764	 */
 765	if (ep->is_in) {
 766		if (likely ((req->req.length % ep->ep.maxpacket) != 0
 767				|| req->req.zero)) {
 768			tmp |= (1 << DMA_FIFO_VALIDATE);
 769			ep->in_fifo_validate = 1;
 770		} else
 771			ep->in_fifo_validate = 0;
 772	}
 773
 774	/* init req->td, pointing to the current dummy */
 775	req->td->dmadesc = cpu_to_le32 (ep->td_dma);
 776	fill_dma_desc (ep, req, 1);
 777
 778	if (!use_dma_chaining)
 779		req->td->dmacount |= cpu_to_le32 (1 << END_OF_CHAIN);
 780
 781	start_queue (ep, tmp, req->td_dma);
 782}
 783
 784static inline void
 785queue_dma (struct net2280_ep *ep, struct net2280_request *req, int valid)
 786{
 787	struct net2280_dma	*end;
 788	dma_addr_t		tmp;
 789
 790	/* swap new dummy for old, link; fill and maybe activate */
 791	end = ep->dummy;
 792	ep->dummy = req->td;
 793	req->td = end;
 794
 795	tmp = ep->td_dma;
 796	ep->td_dma = req->td_dma;
 797	req->td_dma = tmp;
 798
 799	end->dmadesc = cpu_to_le32 (ep->td_dma);
 800
 801	fill_dma_desc (ep, req, valid);
 802}
 803
 804static void
 805done (struct net2280_ep *ep, struct net2280_request *req, int status)
 806{
 807	struct net2280		*dev;
 808	unsigned		stopped = ep->stopped;
 809
 810	list_del_init (&req->queue);
 811
 812	if (req->req.status == -EINPROGRESS)
 813		req->req.status = status;
 814	else
 815		status = req->req.status;
 816
 817	dev = ep->dev;
 818	if (req->mapped) {
 819		pci_unmap_single (dev->pdev, req->req.dma, req->req.length,
 820			ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
 821		req->req.dma = DMA_ADDR_INVALID;
 822		req->mapped = 0;
 823	}
 824
 825	if (status && status != -ESHUTDOWN)
 826		VDEBUG (dev, "complete %s req %p stat %d len %u/%u\n",
 827			ep->ep.name, &req->req, status,
 828			req->req.actual, req->req.length);
 829
 830	/* don't modify queue heads during completion callback */
 831	ep->stopped = 1;
 832	spin_unlock (&dev->lock);
 833	req->req.complete (&ep->ep, &req->req);
 834	spin_lock (&dev->lock);
 835	ep->stopped = stopped;
 836}
 837
 838/*-------------------------------------------------------------------------*/
 839
 840static int
 841net2280_queue (struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
 842{
 843	struct net2280_request	*req;
 844	struct net2280_ep	*ep;
 845	struct net2280		*dev;
 846	unsigned long		flags;
 847
 848	/* we always require a cpu-view buffer, so that we can
 849	 * always use pio (as fallback or whatever).
 850	 */
 851	req = container_of (_req, struct net2280_request, req);
 852	if (!_req || !_req->complete || !_req->buf
 853			|| !list_empty (&req->queue))
 854		return -EINVAL;
 855	if (_req->length > (~0 & DMA_BYTE_COUNT_MASK))
 856		return -EDOM;
 857	ep = container_of (_ep, struct net2280_ep, ep);
 858	if (!_ep || (!ep->desc && ep->num != 0))
 859		return -EINVAL;
 860	dev = ep->dev;
 861	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 862		return -ESHUTDOWN;
 863
 864	/* FIXME implement PIO fallback for ZLPs with DMA */
 865	if (ep->dma && _req->length == 0)
 866		return -EOPNOTSUPP;
 867
 868	/* set up dma mapping in case the caller didn't */
 869	if (ep->dma && _req->dma == DMA_ADDR_INVALID) {
 870		_req->dma = pci_map_single (dev->pdev, _req->buf, _req->length,
 871			ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
 872		req->mapped = 1;
 873	}
 874
 875#if 0
 876	VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
 877			_ep->name, _req, _req->length, _req->buf);
 878#endif
 879
 880	spin_lock_irqsave (&dev->lock, flags);
 881
 882	_req->status = -EINPROGRESS;
 883	_req->actual = 0;
 884
 885	/* kickstart this i/o queue? */
 886	if (list_empty (&ep->queue) && !ep->stopped) {
 887		/* use DMA if the endpoint supports it, else pio */
 888		if (ep->dma)
 889			start_dma (ep, req);
 890		else {
 891			/* maybe there's no control data, just status ack */
 892			if (ep->num == 0 && _req->length == 0) {
 893				allow_status (ep);
 894				done (ep, req, 0);
 895				VDEBUG (dev, "%s status ack\n", ep->ep.name);
 896				goto done;
 897			}
 898
 899			/* PIO ... stuff the fifo, or unblock it.  */
 900			if (ep->is_in)
 901				write_fifo (ep, _req);
 902			else if (list_empty (&ep->queue)) {
 903				u32	s;
 904
 905				/* OUT FIFO might have packet(s) buffered */
 906				s = readl (&ep->regs->ep_stat);
 907				if ((s & (1 << FIFO_EMPTY)) == 0) {
 908					/* note:  _req->short_not_ok is
 909					 * ignored here since PIO _always_
 910					 * stops queue advance here, and
 911					 * _req->status doesn't change for
 912					 * short reads (only _req->actual)
 913					 */
 914					if (read_fifo (ep, req)) {
 915						done (ep, req, 0);
 916						if (ep->num == 0)
 917							allow_status (ep);
 918						/* don't queue it */
 919						req = NULL;
 920					} else
 921						s = readl (&ep->regs->ep_stat);
 922				}
 923
 924				/* don't NAK, let the fifo fill */
 925				if (req && (s & (1 << NAK_OUT_PACKETS)))
 926					writel ((1 << CLEAR_NAK_OUT_PACKETS),
 927							&ep->regs->ep_rsp);
 928			}
 929		}
 930
 931	} else if (ep->dma) {
 932		int	valid = 1;
 933
 934		if (ep->is_in) {
 935			int	expect;
 936
 937			/* preventing magic zlps is per-engine state, not
 938			 * per-transfer; irq logic must recover hiccups.
 939			 */
 940			expect = likely (req->req.zero
 941				|| (req->req.length % ep->ep.maxpacket) != 0);
 942			if (expect != ep->in_fifo_validate)
 943				valid = 0;
 944		}
 945		queue_dma (ep, req, valid);
 946
 947	} /* else the irq handler advances the queue. */
 948
 949	ep->responded = 1;
 950	if (req)
 951		list_add_tail (&req->queue, &ep->queue);
 952done:
 953	spin_unlock_irqrestore (&dev->lock, flags);
 954
 955	/* pci writes may still be posted */
 956	return 0;
 957}
 958
 959static inline void
 960dma_done (
 961	struct net2280_ep *ep,
 962	struct net2280_request *req,
 963	u32 dmacount,
 964	int status
 965)
 966{
 967	req->req.actual = req->req.length - (DMA_BYTE_COUNT_MASK & dmacount);
 968	done (ep, req, status);
 969}
 970
 971static void restart_dma (struct net2280_ep *ep);
 972
 973static void scan_dma_completions (struct net2280_ep *ep)
 974{
 975	/* only look at descriptors that were "naturally" retired,
 976	 * so fifo and list head state won't matter
 977	 */
 978	while (!list_empty (&ep->queue)) {
 979		struct net2280_request	*req;
 980		u32			tmp;
 981
 982		req = list_entry (ep->queue.next,
 983				struct net2280_request, queue);
 984		if (!req->valid)
 985			break;
 986		rmb ();
 987		tmp = le32_to_cpup (&req->td->dmacount);
 988		if ((tmp & (1 << VALID_BIT)) != 0)
 989			break;
 990
 991		/* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
 992		 * cases where DMA must be aborted; this code handles
 993		 * all non-abort DMA completions.
 994		 */
 995		if (unlikely (req->td->dmadesc == 0)) {
 996			/* paranoia */
 997			tmp = readl (&ep->dma->dmacount);
 998			if (tmp & DMA_BYTE_COUNT_MASK)
 999				break;
1000			/* single transfer mode */
1001			dma_done (ep, req, tmp, 0);
1002			break;
1003		} else if (!ep->is_in
1004				&& (req->req.length % ep->ep.maxpacket) != 0) {
1005			tmp = readl (&ep->regs->ep_stat);
1006
1007			/* AVOID TROUBLE HERE by not issuing short reads from
1008			 * your gadget driver.  That helps avoids errata 0121,
1009			 * 0122, and 0124; not all cases trigger the warning.
1010			 */
1011			if ((tmp & (1 << NAK_OUT_PACKETS)) == 0) {
1012				WARNING (ep->dev, "%s lost packet sync!\n",
1013						ep->ep.name);
1014				req->req.status = -EOVERFLOW;
1015			} else if ((tmp = readl (&ep->regs->ep_avail)) != 0) {
1016				/* fifo gets flushed later */
1017				ep->out_overflow = 1;
1018				DEBUG (ep->dev, "%s dma, discard %d len %d\n",
1019						ep->ep.name, tmp,
1020						req->req.length);
1021				req->req.status = -EOVERFLOW;
1022			}
1023		}
1024		dma_done (ep, req, tmp, 0);
1025	}
1026}
1027
1028static void restart_dma (struct net2280_ep *ep)
1029{
1030	struct net2280_request	*req;
1031	u32			dmactl = dmactl_default;
1032
1033	if (ep->stopped)
1034		return;
1035	req = list_entry (ep->queue.next, struct net2280_request, queue);
1036
1037	if (!use_dma_chaining) {
1038		start_dma (ep, req);
1039		return;
1040	}
1041
1042	/* the 2280 will be processing the queue unless queue hiccups after
1043	 * the previous transfer:
1044	 *  IN:   wanted automagic zlp, head doesn't (or vice versa)
1045	 *        DMA_FIFO_VALIDATE doesn't init from dma descriptors.
1046	 *  OUT:  was "usb-short", we must restart.
1047	 */
1048	if (ep->is_in && !req->valid) {
1049		struct net2280_request	*entry, *prev = NULL;
1050		int			reqmode, done = 0;
1051
1052		DEBUG (ep->dev, "%s dma hiccup td %p\n", ep->ep.name, req->td);
1053		ep->in_fifo_validate = likely (req->req.zero
1054			|| (req->req.length % ep->ep.maxpacket) != 0);
1055		if (ep->in_fifo_validate)
1056			dmactl |= (1 << DMA_FIFO_VALIDATE);
1057		list_for_each_entry (entry, &ep->queue, queue) {
1058			__le32		dmacount;
1059
1060			if (entry == req)
1061				continue;
1062			dmacount = entry->td->dmacount;
1063			if (!done) {
1064				reqmode = likely (entry->req.zero
1065					|| (entry->req.length
1066						% ep->ep.maxpacket) != 0);
1067				if (reqmode == ep->in_fifo_validate) {
1068					entry->valid = 1;
1069					dmacount |= valid_bit;
1070					entry->td->dmacount = dmacount;
1071					prev = entry;
1072					continue;
1073				} else {
1074					/* force a hiccup */
1075					prev->td->dmacount |= dma_done_ie;
1076					done = 1;
1077				}
1078			}
1079
1080			/* walk the rest of the queue so unlinks behave */
1081			entry->valid = 0;
1082			dmacount &= ~valid_bit;
1083			entry->td->dmacount = dmacount;
1084			prev = entry;
1085		}
1086	}
1087
1088	writel (0, &ep->dma->dmactl);
1089	start_queue (ep, dmactl, req->td_dma);
1090}
1091
1092static void abort_dma (struct net2280_ep *ep)
1093{
1094	/* abort the current transfer */
1095	if (likely (!list_empty (&ep->queue))) {
1096		/* FIXME work around errata 0121, 0122, 0124 */
1097		writel ((1 << DMA_ABORT), &ep->dma->dmastat);
1098		spin_stop_dma (ep->dma);
1099	} else
1100		stop_dma (ep->dma);
1101	scan_dma_completions (ep);
1102}
1103
1104/* dequeue ALL requests */
1105static void nuke (struct net2280_ep *ep)
1106{
1107	struct net2280_request	*req;
1108
1109	/* called with spinlock held */
1110	ep->stopped = 1;
1111	if (ep->dma)
1112		abort_dma (ep);
1113	while (!list_empty (&ep->queue)) {
1114		req = list_entry (ep->queue.next,
1115				struct net2280_request,
1116				queue);
1117		done (ep, req, -ESHUTDOWN);
1118	}
1119}
1120
1121/* dequeue JUST ONE request */
1122static int net2280_dequeue (struct usb_ep *_ep, struct usb_request *_req)
1123{
1124	struct net2280_ep	*ep;
1125	struct net2280_request	*req;
1126	unsigned long		flags;
1127	u32			dmactl;
1128	int			stopped;
1129
1130	ep = container_of (_ep, struct net2280_ep, ep);
1131	if (!_ep || (!ep->desc && ep->num != 0) || !_req)
1132		return -EINVAL;
1133
1134	spin_lock_irqsave (&ep->dev->lock, flags);
1135	stopped = ep->stopped;
1136
1137	/* quiesce dma while we patch the queue */
1138	dmactl = 0;
1139	ep->stopped = 1;
1140	if (ep->dma) {
1141		dmactl = readl (&ep->dma->dmactl);
1142		/* WARNING erratum 0127 may kick in ... */
1143		stop_dma (ep->dma);
1144		scan_dma_completions (ep);
1145	}
1146
1147	/* make sure it's still queued on this endpoint */
1148	list_for_each_entry (req, &ep->queue, queue) {
1149		if (&req->req == _req)
1150			break;
1151	}
1152	if (&req->req != _req) {
1153		spin_unlock_irqrestore (&ep->dev->lock, flags);
1154		return -EINVAL;
1155	}
1156
1157	/* queue head may be partially complete. */
1158	if (ep->queue.next == &req->queue) {
1159		if (ep->dma) {
1160			DEBUG (ep->dev, "unlink (%s) dma\n", _ep->name);
1161			_req->status = -ECONNRESET;
1162			abort_dma (ep);
1163			if (likely (ep->queue.next == &req->queue)) {
1164				// NOTE: misreports single-transfer mode
1165				req->td->dmacount = 0;	/* invalidate */
1166				dma_done (ep, req,
1167					readl (&ep->dma->dmacount),
1168					-ECONNRESET);
1169			}
1170		} else {
1171			DEBUG (ep->dev, "unlink (%s) pio\n", _ep->name);
1172			done (ep, req, -ECONNRESET);
1173		}
1174		req = NULL;
1175
1176	/* patch up hardware chaining data */
1177	} else if (ep->dma && use_dma_chaining) {
1178		if (req->queue.prev == ep->queue.next) {
1179			writel (le32_to_cpu (req->td->dmadesc),
1180				&ep->dma->dmadesc);
1181			if (req->td->dmacount & dma_done_ie)
1182				writel (readl (&ep->dma->dmacount)
1183						| le32_to_cpu(dma_done_ie),
1184					&ep->dma->dmacount);
1185		} else {
1186			struct net2280_request	*prev;
1187
1188			prev = list_entry (req->queue.prev,
1189				struct net2280_request, queue);
1190			prev->td->dmadesc = req->td->dmadesc;
1191			if (req->td->dmacount & dma_done_ie)
1192				prev->td->dmacount |= dma_done_ie;
1193		}
1194	}
1195
1196	if (req)
1197		done (ep, req, -ECONNRESET);
1198	ep->stopped = stopped;
1199
1200	if (ep->dma) {
1201		/* turn off dma on inactive queues */
1202		if (list_empty (&ep->queue))
1203			stop_dma (ep->dma);
1204		else if (!ep->stopped) {
1205			/* resume current request, or start new one */
1206			if (req)
1207				writel (dmactl, &ep->dma->dmactl);
1208			else
1209				start_dma (ep, list_entry (ep->queue.next,
1210					struct net2280_request, queue));
1211		}
1212	}
1213
1214	spin_unlock_irqrestore (&ep->dev->lock, flags);
1215	return 0;
1216}
1217
1218/*-------------------------------------------------------------------------*/
1219
1220static int net2280_fifo_status (struct usb_ep *_ep);
1221
1222static int
1223net2280_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedged)
1224{
1225	struct net2280_ep	*ep;
1226	unsigned long		flags;
1227	int			retval = 0;
1228
1229	ep = container_of (_ep, struct net2280_ep, ep);
1230	if (!_ep || (!ep->desc && ep->num != 0))
1231		return -EINVAL;
1232	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1233		return -ESHUTDOWN;
1234	if (ep->desc /* not ep0 */ && (ep->desc->bmAttributes & 0x03)
1235						== USB_ENDPOINT_XFER_ISOC)
1236		return -EINVAL;
1237
1238	spin_lock_irqsave (&ep->dev->lock, flags);
1239	if (!list_empty (&ep->queue))
1240		retval = -EAGAIN;
1241	else if (ep->is_in && value && net2280_fifo_status (_ep) != 0)
1242		retval = -EAGAIN;
1243	else {
1244		VDEBUG (ep->dev, "%s %s %s\n", _ep->name,
1245				value ? "set" : "clear",
1246				wedged ? "wedge" : "halt");
1247		/* set/clear, then synch memory views with the device */
1248		if (value) {
1249			if (ep->num == 0)
1250				ep->dev->protocol_stall = 1;
1251			else
1252				set_halt (ep);
1253			if (wedged)
1254				ep->wedged = 1;
1255		} else {
1256			clear_halt (ep);
1257			ep->wedged = 0;
1258		}
1259		(void) readl (&ep->regs->ep_rsp);
1260	}
1261	spin_unlock_irqrestore (&ep->dev->lock, flags);
1262
1263	return retval;
1264}
1265
1266static int
1267net2280_set_halt(struct usb_ep *_ep, int value)
1268{
1269	return net2280_set_halt_and_wedge(_ep, value, 0);
1270}
1271
1272static int
1273net2280_set_wedge(struct usb_ep *_ep)
1274{
1275	if (!_ep || _ep->name == ep0name)
1276		return -EINVAL;
1277	return net2280_set_halt_and_wedge(_ep, 1, 1);
1278}
1279
1280static int
1281net2280_fifo_status (struct usb_ep *_ep)
1282{
1283	struct net2280_ep	*ep;
1284	u32			avail;
1285
1286	ep = container_of (_ep, struct net2280_ep, ep);
1287	if (!_ep || (!ep->desc && ep->num != 0))
1288		return -ENODEV;
1289	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1290		return -ESHUTDOWN;
1291
1292	avail = readl (&ep->regs->ep_avail) & ((1 << 12) - 1);
1293	if (avail > ep->fifo_size)
1294		return -EOVERFLOW;
1295	if (ep->is_in)
1296		avail = ep->fifo_size - avail;
1297	return avail;
1298}
1299
1300static void
1301net2280_fifo_flush (struct usb_ep *_ep)
1302{
1303	struct net2280_ep	*ep;
1304
1305	ep = container_of (_ep, struct net2280_ep, ep);
1306	if (!_ep || (!ep->desc && ep->num != 0))
1307		return;
1308	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1309		return;
1310
1311	writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
1312	(void) readl (&ep->regs->ep_rsp);
1313}
1314
1315static const struct usb_ep_ops net2280_ep_ops = {
1316	.enable		= net2280_enable,
1317	.disable	= net2280_disable,
1318
1319	.alloc_request	= net2280_alloc_request,
1320	.free_request	= net2280_free_request,
1321
1322	.queue		= net2280_queue,
1323	.dequeue	= net2280_dequeue,
1324
1325	.set_halt	= net2280_set_halt,
1326	.set_wedge	= net2280_set_wedge,
1327	.fifo_status	= net2280_fifo_status,
1328	.fifo_flush	= net2280_fifo_flush,
1329};
1330
1331/*-------------------------------------------------------------------------*/
1332
1333static int net2280_get_frame (struct usb_gadget *_gadget)
1334{
1335	struct net2280		*dev;
1336	unsigned long		flags;
1337	u16			retval;
1338
1339	if (!_gadget)
1340		return -ENODEV;
1341	dev = container_of (_gadget, struct net2280, gadget);
1342	spin_lock_irqsave (&dev->lock, flags);
1343	retval = get_idx_reg (dev->regs, REG_FRAME) & 0x03ff;
1344	spin_unlock_irqrestore (&dev->lock, flags);
1345	return retval;
1346}
1347
1348static int net2280_wakeup (struct usb_gadget *_gadget)
1349{
1350	struct net2280		*dev;
1351	u32			tmp;
1352	unsigned long		flags;
1353
1354	if (!_gadget)
1355		return 0;
1356	dev = container_of (_gadget, struct net2280, gadget);
1357
1358	spin_lock_irqsave (&dev->lock, flags);
1359	tmp = readl (&dev->usb->usbctl);
1360	if (tmp & (1 << DEVICE_REMOTE_WAKEUP_ENABLE))
1361		writel (1 << GENERATE_RESUME, &dev->usb->usbstat);
1362	spin_unlock_irqrestore (&dev->lock, flags);
1363
1364	/* pci writes may still be posted */
1365	return 0;
1366}
1367
1368static int net2280_set_selfpowered (struct usb_gadget *_gadget, int value)
1369{
1370	struct net2280		*dev;
1371	u32			tmp;
1372	unsigned long		flags;
1373
1374	if (!_gadget)
1375		return 0;
1376	dev = container_of (_gadget, struct net2280, gadget);
1377
1378	spin_lock_irqsave (&dev->lock, flags);
1379	tmp = readl (&dev->usb->usbctl);
1380	if (value)
1381		tmp |= (1 << SELF_POWERED_STATUS);
1382	else
1383		tmp &= ~(1 << SELF_POWERED_STATUS);
1384	writel (tmp, &dev->usb->usbctl);
1385	spin_unlock_irqrestore (&dev->lock, flags);
1386
1387	return 0;
1388}
1389
1390static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
1391{
1392	struct net2280  *dev;
1393	u32             tmp;
1394	unsigned long   flags;
1395
1396	if (!_gadget)
1397		return -ENODEV;
1398	dev = container_of (_gadget, struct net2280, gadget);
1399
1400	spin_lock_irqsave (&dev->lock, flags);
1401	tmp = readl (&dev->usb->usbctl);
1402	dev->softconnect = (is_on != 0);
1403	if (is_on)
1404		tmp |= (1 << USB_DETECT_ENABLE);
1405	else
1406		tmp &= ~(1 << USB_DETECT_ENABLE);
1407	writel (tmp, &dev->usb->usbctl);
1408	spin_unlock_irqrestore (&dev->lock, flags);
1409
1410	return 0;
1411}
1412
1413static int net2280_start(struct usb_gadget_driver *driver,
1414		int (*bind)(struct usb_gadget *));
1415static int net2280_stop(struct usb_gadget_driver *driver);
1416
1417static const struct usb_gadget_ops net2280_ops = {
1418	.get_frame	= net2280_get_frame,
1419	.wakeup		= net2280_wakeup,
1420	.set_selfpowered = net2280_set_selfpowered,
1421	.pullup		= net2280_pullup,
1422	.start		= net2280_start,
1423	.stop		= net2280_stop,
1424};
1425
1426/*-------------------------------------------------------------------------*/
1427
1428#ifdef	CONFIG_USB_GADGET_DEBUG_FILES
1429
1430/* FIXME move these into procfs, and use seq_file.
1431 * Sysfs _still_ doesn't behave for arbitrarily sized files,
1432 * and also doesn't help products using this with 2.4 kernels.
1433 */
1434
1435/* "function" sysfs attribute */
1436static ssize_t
1437show_function (struct device *_dev, struct device_attribute *attr, char *buf)
1438{
1439	struct net2280	*dev = dev_get_drvdata (_dev);
1440
1441	if (!dev->driver
1442			|| !dev->driver->function
1443			|| strlen (dev->driver->function) > PAGE_SIZE)
1444		return 0;
1445	return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
1446}
1447static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
1448
1449static ssize_t net2280_show_registers(struct device *_dev,
1450				struct device_attribute *attr, char *buf)
1451{
1452	struct net2280		*dev;
1453	char			*next;
1454	unsigned		size, t;
1455	unsigned long		flags;
1456	int			i;
1457	u32			t1, t2;
1458	const char		*s;
1459
1460	dev = dev_get_drvdata (_dev);
1461	next = buf;
1462	size = PAGE_SIZE;
1463	spin_lock_irqsave (&dev->lock, flags);
1464
1465	if (dev->driver)
1466		s = dev->driver->driver.name;
1467	else
1468		s = "(none)";
1469
1470	/* Main Control Registers */
1471	t = scnprintf (next, size, "%s version " DRIVER_VERSION
1472			", chiprev %04x, dma %s\n\n"
1473			"devinit %03x fifoctl %08x gadget '%s'\n"
1474			"pci irqenb0 %02x irqenb1 %08x "
1475			"irqstat0 %04x irqstat1 %08x\n",
1476			driver_name, dev->chiprev,
1477			use_dma
1478				? (use_dma_chaining ? "chaining" : "enabled")
1479				: "disabled",
1480			readl (&dev->regs->devinit),
1481			readl (&dev->regs->fifoctl),
1482			s,
1483			readl (&dev->regs->pciirqenb0),
1484			readl (&dev->regs->pciirqenb1),
1485			readl (&dev->regs->irqstat0),
1486			readl (&dev->regs->irqstat1));
1487	size -= t;
1488	next += t;
1489
1490	/* USB Control Registers */
1491	t1 = readl (&dev->usb->usbctl);
1492	t2 = readl (&dev->usb->usbstat);
1493	if (t1 & (1 << VBUS_PIN)) {
1494		if (t2 & (1 << HIGH_SPEED))
1495			s = "high speed";
1496		else if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1497			s = "powered";
1498		else
1499			s = "full speed";
1500		/* full speed bit (6) not working?? */
1501	} else
1502			s = "not attached";
1503	t = scnprintf (next, size,
1504			"stdrsp %08x usbctl %08x usbstat %08x "
1505				"addr 0x%02x (%s)\n",
1506			readl (&dev->usb->stdrsp), t1, t2,
1507			readl (&dev->usb->ouraddr), s);
1508	size -= t;
1509	next += t;
1510
1511	/* PCI Master Control Registers */
1512
1513	/* DMA Control Registers */
1514
1515	/* Configurable EP Control Registers */
1516	for (i = 0; i < 7; i++) {
1517		struct net2280_ep	*ep;
1518
1519		ep = &dev->ep [i];
1520		if (i && !ep->desc)
1521			continue;
1522
1523		t1 = readl (&ep->regs->ep_cfg);
1524		t2 = readl (&ep->regs->ep_rsp) & 0xff;
1525		t = scnprintf (next, size,
1526				"\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
1527					"irqenb %02x\n",
1528				ep->ep.name, t1, t2,
1529				(t2 & (1 << CLEAR_NAK_OUT_PACKETS))
1530					? "NAK " : "",
1531				(t2 & (1 << CLEAR_EP_HIDE_STATUS_PHASE))
1532					? "hide " : "",
1533				(t2 & (1 << CLEAR_EP_FORCE_CRC_ERROR))
1534					? "CRC " : "",
1535				(t2 & (1 << CLEAR_INTERRUPT_MODE))
1536					? "interrupt " : "",
1537				(t2 & (1<<CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE))
1538					? "status " : "",
1539				(t2 & (1 << CLEAR_NAK_OUT_PACKETS_MODE))
1540					? "NAKmode " : "",
1541				(t2 & (1 << CLEAR_ENDPOINT_TOGGLE))
1542					? "DATA1 " : "DATA0 ",
1543				(t2 & (1 << CLEAR_ENDPOINT_HALT))
1544					? "HALT " : "",
1545				readl (&ep->regs->ep_irqenb));
1546		size -= t;
1547		next += t;
1548
1549		t = scnprintf (next, size,
1550				"\tstat %08x avail %04x "
1551				"(ep%d%s-%s)%s\n",
1552				readl (&ep->regs->ep_stat),
1553				readl (&ep->regs->ep_avail),
1554				t1 & 0x0f, DIR_STRING (t1),
1555				type_string (t1 >> 8),
1556				ep->stopped ? "*" : "");
1557		size -= t;
1558		next += t;
1559
1560		if (!ep->dma)
1561			continue;
1562
1563		t = scnprintf (next, size,
1564				"  dma\tctl %08x stat %08x count %08x\n"
1565				"\taddr %08x desc %08x\n",
1566				readl (&ep->dma->dmactl),
1567				readl (&ep->dma->dmastat),
1568				readl (&ep->dma->dmacount),
1569				readl (&ep->dma->dmaaddr),
1570				readl (&ep->dma->dmadesc));
1571		size -= t;
1572		next += t;
1573
1574	}
1575
1576	/* Indexed Registers */
1577		// none yet
1578
1579	/* Statistics */
1580	t = scnprintf (next, size, "\nirqs:  ");
1581	size -= t;
1582	next += t;
1583	for (i = 0; i < 7; i++) {
1584		struct net2280_ep	*ep;
1585
1586		ep = &dev->ep [i];
1587		if (i && !ep->irqs)
1588			continue;
1589		t = scnprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
1590		size -= t;
1591		next += t;
1592
1593	}
1594	t = scnprintf (next, size, "\n");
1595	size -= t;
1596	next += t;
1597
1598	spin_unlock_irqrestore (&dev->lock, flags);
1599
1600	return PAGE_SIZE - size;
1601}
1602static DEVICE_ATTR(registers, S_IRUGO, net2280_show_registers, NULL);
1603
1604static ssize_t
1605show_queues (struct device *_dev, struct device_attribute *attr, char *buf)
1606{
1607	struct net2280		*dev;
1608	char			*next;
1609	unsigned		size;
1610	unsigned long		flags;
1611	int			i;
1612
1613	dev = dev_get_drvdata (_dev);
1614	next = buf;
1615	size = PAGE_SIZE;
1616	spin_lock_irqsave (&dev->lock, flags);
1617
1618	for (i = 0; i < 7; i++) {
1619		struct net2280_ep		*ep = &dev->ep [i];
1620		struct net2280_request		*req;
1621		int				t;
1622
1623		if (i != 0) {
1624			const struct usb_endpoint_descriptor	*d;
1625
1626			d = ep->desc;
1627			if (!d)
1628				continue;
1629			t = d->bEndpointAddress;
1630			t = scnprintf (next, size,
1631				"\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
1632				ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
1633				(t & USB_DIR_IN) ? "in" : "out",
1634				({ char *val;
1635				 switch (d->bmAttributes & 0x03) {
1636				 case USB_ENDPOINT_XFER_BULK:
1637					val = "bulk"; break;
1638				 case USB_ENDPOINT_XFER_INT:
1639					val = "intr"; break;
1640				 default:
1641					val = "iso"; break;
1642				 }; val; }),
1643				le16_to_cpu (d->wMaxPacketSize) & 0x1fff,
1644				ep->dma ? "dma" : "pio", ep->fifo_size
1645				);
1646		} else /* ep0 should only have one transfer queued */
1647			t = scnprintf (next, size, "ep0 max 64 pio %s\n",
1648					ep->is_in ? "in" : "out");
1649		if (t <= 0 || t > size)
1650			goto done;
1651		size -= t;
1652		next += t;
1653
1654		if (list_empty (&ep->queue)) {
1655			t = scnprintf (next, size, "\t(nothing queued)\n");
1656			if (t <= 0 || t > size)
1657				goto done;
1658			size -= t;
1659			next += t;
1660			continue;
1661		}
1662		list_for_each_entry (req, &ep->queue, queue) {
1663			if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
1664				t = scnprintf (next, size,
1665					"\treq %p len %d/%d "
1666					"buf %p (dmacount %08x)\n",
1667					&req->req, req->req.actual,
1668					req->req.length, req->req.buf,
1669					readl (&ep->dma->dmacount));
1670			else
1671				t = scnprintf (next, size,
1672					"\treq %p len %d/%d buf %p\n",
1673					&req->req, req->req.actual,
1674					req->req.length, req->req.buf);
1675			if (t <= 0 || t > size)
1676				goto done;
1677			size -= t;
1678			next += t;
1679
1680			if (ep->dma) {
1681				struct net2280_dma	*td;
1682
1683				td = req->td;
1684				t = scnprintf (next, size, "\t    td %08x "
1685					" count %08x buf %08x desc %08x\n",
1686					(u32) req->td_dma,
1687					le32_to_cpu (td->dmacount),
1688					le32_to_cpu (td->dmaaddr),
1689					le32_to_cpu (td->dmadesc));
1690				if (t <= 0 || t > size)
1691					goto done;
1692				size -= t;
1693				next += t;
1694			}
1695		}
1696	}
1697
1698done:
1699	spin_unlock_irqrestore (&dev->lock, flags);
1700	return PAGE_SIZE - size;
1701}
1702static DEVICE_ATTR (queues, S_IRUGO, show_queues, NULL);
1703
1704
1705#else
1706
1707#define device_create_file(a,b)	(0)
1708#define device_remove_file(a,b)	do { } while (0)
1709
1710#endif
1711
1712/*-------------------------------------------------------------------------*/
1713
1714/* another driver-specific mode might be a request type doing dma
1715 * to/from another device fifo instead of to/from memory.
1716 */
1717
1718static void set_fifo_mode (struct net2280 *dev, int mode)
1719{
1720	/* keeping high bits preserves BAR2 */
1721	writel ((0xffff << PCI_BASE2_RANGE) | mode, &dev->regs->fifoctl);
1722
1723	/* always ep-{a,b,e,f} ... maybe not ep-c or ep-d */
1724	INIT_LIST_HEAD (&dev->gadget.ep_list);
1725	list_add_tail (&dev->ep [1].ep.ep_list, &dev->gadget.ep_list);
1726	list_add_tail (&dev->ep [2].ep.ep_list, &dev->gadget.ep_list);
1727	switch (mode) {
1728	case 0:
1729		list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1730		list_add_tail (&dev->ep [4].ep.ep_list, &dev->gadget.ep_list);
1731		dev->ep [1].fifo_size = dev->ep [2].fifo_size = 1024;
1732		break;
1733	case 1:
1734		dev->ep [1].fifo_size = dev->ep [2].fifo_size = 2048;
1735		break;
1736	case 2:
1737		list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1738		dev->ep [1].fifo_size = 2048;
1739		dev->ep [2].fifo_size = 1024;
1740		break;
1741	}
1742	/* fifo sizes for ep0, ep-c, ep-d, ep-e, and ep-f never change */
1743	list_add_tail (&dev->ep [5].ep.ep_list, &dev->gadget.ep_list);
1744	list_add_tail (&dev->ep [6].ep.ep_list, &dev->gadget.ep_list);
1745}
1746
1747/* keeping it simple:
1748 * - one bus driver, initted first;
1749 * - one function driver, initted second
1750 *
1751 * most of the work to support multiple net2280 controllers would
1752 * be to associate this gadget driver (yes?) with all of them, or
1753 * perhaps to bind specific drivers to specific devices.
1754 */
1755
1756static struct net2280	*the_controller;
1757
1758static void usb_reset (struct net2280 *dev)
1759{
1760	u32	tmp;
1761
1762	dev->gadget.speed = USB_SPEED_UNKNOWN;
1763	(void) readl (&dev->usb->usbctl);
1764
1765	net2280_led_init (dev);
1766
1767	/* disable automatic responses, and irqs */
1768	writel (0, &dev->usb->stdrsp);
1769	writel (0, &dev->regs->pciirqenb0);
1770	writel (0, &dev->regs->pciirqenb1);
1771
1772	/* clear old dma and irq state */
1773	for (tmp = 0; tmp < 4; tmp++) {
1774		struct net2280_ep	*ep = &dev->ep [tmp + 1];
1775
1776		if (ep->dma)
1777			abort_dma (ep);
1778	}
1779	writel (~0, &dev->regs->irqstat0),
1780	writel (~(1 << SUSPEND_REQUEST_INTERRUPT), &dev->regs->irqstat1),
1781
1782	/* reset, and enable pci */
1783	tmp = readl (&dev->regs->devinit)
1784		| (1 << PCI_ENABLE)
1785		| (1 << FIFO_SOFT_RESET)
1786		| (1 << USB_SOFT_RESET)
1787		| (1 << M8051_RESET);
1788	writel (tmp, &dev->regs->devinit);
1789
1790	/* standard fifo and endpoint allocations */
1791	set_fifo_mode (dev, (fifo_mode <= 2) ? fifo_mode : 0);
1792}
1793
1794static void usb_reinit (struct net2280 *dev)
1795{
1796	u32	tmp;
1797	int	init_dma;
1798
1799	/* use_dma changes are ignored till next device re-init */
1800	init_dma = use_dma;
1801
1802	/* basic endpoint init */
1803	for (tmp = 0; tmp < 7; tmp++) {
1804		struct net2280_ep	*ep = &dev->ep [tmp];
1805
1806		ep->ep.name = ep_name [tmp];
1807		ep->dev = dev;
1808		ep->num = tmp;
1809
1810		if (tmp > 0 && tmp <= 4) {
1811			ep->fifo_size = 1024;
1812			if (init_dma)
1813				ep->dma = &dev->dma [tmp - 1];
1814		} else
1815			ep->fifo_size = 64;
1816		ep->regs = &dev->epregs [tmp];
1817		ep_reset (dev->regs, ep);
1818	}
1819	dev->ep [0].ep.maxpacket = 64;
1820	dev->ep [5].ep.maxpacket = 64;
1821	dev->ep [6].ep.maxpacket = 64;
1822
1823	dev->gadget.ep0 = &dev->ep [0].ep;
1824	dev->ep [0].stopped = 0;
1825	INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
1826
1827	/* we want to prevent lowlevel/insecure access from the USB host,
1828	 * but erratum 0119 means this enable bit is ignored
1829	 */
1830	for (tmp = 0; tmp < 5; tmp++)
1831		writel (EP_DONTUSE, &dev->dep [tmp].dep_cfg);
1832}
1833
1834static void ep0_start (struct net2280 *dev)
1835{
1836	writel (  (1 << CLEAR_EP_HIDE_STATUS_PHASE)
1837		| (1 << CLEAR_NAK_OUT_PACKETS)
1838		| (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
1839		, &dev->epregs [0].ep_rsp);
1840
1841	/*
1842	 * hardware optionally handles a bunch of standard requests
1843	 * that the API hides from drivers anyway.  have it do so.
1844	 * endpoint status/features are handled in software, to
1845	 * help pass tests for some dubious behavior.
1846	 */
1847	writel (  (1 << SET_TEST_MODE)
1848		| (1 << SET_ADDRESS)
1849		| (1 << DEVICE_SET_CLEAR_DEVICE_REMOTE_WAKEUP)
1850		| (1 << GET_DEVICE_STATUS)
1851		| (1 << GET_INTERFACE_STATUS)
1852		, &dev->usb->stdrsp);
1853	writel (  (1 << USB_ROOT_PORT_WAKEUP_ENABLE)
1854		| (1 << SELF_POWERED_USB_DEVICE)
1855		| (1 << REMOTE_WAKEUP_SUPPORT)
1856		| (dev->softconnect << USB_DETECT_ENABLE)
1857		| (1 << SELF_POWERED_STATUS)
1858		, &dev->usb->usbctl);
1859
1860	/* enable irqs so we can see ep0 and general operation  */
1861	writel (  (1 << SETUP_PACKET_INTERRUPT_ENABLE)
1862		| (1 << ENDPOINT_0_INTERRUPT_ENABLE)
1863		, &dev->regs->pciirqenb0);
1864	writel (  (1 << PCI_INTERRUPT_ENABLE)
1865		| (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT_ENABLE)
1866		| (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT_ENABLE)
1867		| (1 << PCI_RETRY_ABORT_INTERRUPT_ENABLE)
1868		| (1 << VBUS_INTERRUPT_ENABLE)
1869		| (1 << ROOT_PORT_RESET_INTERRUPT_ENABLE)
1870		| (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT_ENABLE)
1871		, &dev->regs->pciirqenb1);
1872
1873	/* don't leave any writes posted */
1874	(void) readl (&dev->usb->usbctl);
1875}
1876
1877/* when a driver is successfully registered, it will receive
1878 * control requests including set_configuration(), which enables
1879 * non-control requests.  then usb traffic follows until a
1880 * disconnect is reported.  then a host may connect again, or
1881 * the driver might get unbound.
1882 */
1883static int net2280_start(struct usb_gadget_driver *driver,
1884		int (*bind)(struct usb_gadget *))
1885{
1886	struct net2280		*dev = the_controller;
1887	int			retval;
1888	unsigned		i;
1889
1890	/* insist on high speed support from the driver, since
1891	 * (dev->usb->xcvrdiag & FORCE_FULL_SPEED_MODE)
1892	 * "must not be used in normal operation"
1893	 */
1894	if (!driver
1895			|| driver->speed != USB_SPEED_HIGH
1896			|| !bind || !driver->setup)
1897		return -EINVAL;
1898	if (!dev)
1899		return -ENODEV;
1900	if (dev->driver)
1901		return -EBUSY;
1902
1903	for (i = 0; i < 7; i++)
1904		dev->ep [i].irqs = 0;
1905
1906	/* hook up the driver ... */
1907	dev->softconnect = 1;
1908	driver->driver.bus = NULL;
1909	dev->driver = driver;
1910	dev->gadget.dev.driver = &driver->driver;
1911	retval = bind(&dev->gadget);
1912	if (retval) {
1913		DEBUG (dev, "bind to driver %s --> %d\n",
1914				driver->driver.name, retval);
1915		dev->driver = NULL;
1916		dev->gadget.dev.driver = NULL;
1917		return retval;
1918	}
1919
1920	retval = device_create_file (&dev->pdev->dev, &dev_attr_function);
1921	if (retval) goto err_unbind;
1922	retval = device_create_file (&dev->pdev->dev, &dev_attr_queues);
1923	if (retval) goto err_func;
1924
1925	/* ... then enable host detection and ep0; and we're ready
1926	 * for set_configuration as well as eventual disconnect.
1927	 */
1928	net2280_led_active (dev, 1);
1929	ep0_start (dev);
1930
1931	DEBUG (dev, "%s ready, usbctl %08x stdrsp %08x\n",
1932			driver->driver.name,
1933			readl (&dev->usb->usbctl),
1934			readl (&dev->usb->stdrsp));
1935
1936	/* pci writes may still be posted */
1937	return 0;
1938
1939err_func:
1940	device_remove_file (&dev->pdev->dev, &dev_attr_function);
1941err_unbind:
1942	driver->unbind (&dev->gadget);
1943	dev->gadget.dev.driver = NULL;
1944	dev->driver = NULL;
1945	return retval;
1946}
1947
1948static void
1949stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
1950{
1951	int			i;
1952
1953	/* don't disconnect if it's not connected */
1954	if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1955		driver = NULL;
1956
1957	/* stop hardware; prevent new request submissions;
1958	 * and kill any outstanding requests.
1959	 */
1960	usb_reset (dev);
1961	for (i = 0; i < 7; i++)
1962		nuke (&dev->ep [i]);
1963
1964	/* report disconnect; the driver is already quiesced */
1965	if (driver) {
1966		spin_unlock (&dev->lock);
1967		driver->disconnect (&dev->gadget);
1968		spin_lock (&dev->lock);
1969	}
1970
1971	usb_reinit (dev);
1972}
1973
1974static int net2280_stop(struct usb_gadget_driver *driver)
1975{
1976	struct net2280	*dev = the_controller;
1977	unsigned long	flags;
1978
1979	if (!dev)
1980		return -ENODEV;
1981	if (!driver || driver != dev->driver || !driver->unbind)
1982		return -EINVAL;
1983
1984	spin_lock_irqsave (&dev->lock, flags);
1985	stop_activity (dev, driver);
1986	spin_unlock_irqrestore (&dev->lock, flags);
1987
1988	net2280_pullup (&dev->gadget, 0);
1989
1990	driver->unbind (&dev->gadget);
1991	dev->gadget.dev.driver = NULL;
1992	dev->driver = NULL;
1993
1994	net2280_led_active (dev, 0);
1995	device_remove_file (&dev->pdev->dev, &dev_attr_function);
1996	device_remove_file (&dev->pdev->dev, &dev_attr_queues);
1997
1998	DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
1999	return 0;
2000}
2001
2002/*-------------------------------------------------------------------------*/
2003
2004/* handle ep0, ep-e, ep-f with 64 byte packets: packet per irq.
2005 * also works for dma-capable endpoints, in pio mode or just
2006 * to manually advance the queue after short OUT transfers.
2007 */
2008static void handle_ep_small (struct net2280_ep *ep)
2009{
2010	struct net2280_request	*req;
2011	u32			t;
2012	/* 0 error, 1 mid-data, 2 done */
2013	int			mode = 1;
2014
2015	if (!list_empty (&ep->queue))
2016		req = list_entry (ep->queue.next,
2017			struct net2280_request, queue);
2018	else
2019		req = NULL;
2020
2021	/* ack all, and handle what we care about */
2022	t = readl (&ep->regs->ep_stat);
2023	ep->irqs++;
2024#if 0
2025	VDEBUG (ep->dev, "%s ack ep_stat %08x, req %p\n",
2026			ep->ep.name, t, req ? &req->req : 0);
2027#endif
2028	if (!ep->is_in || ep->dev->pdev->device == 0x2280)
2029		writel (t & ~(1 << NAK_OUT_PACKETS), &ep->regs->ep_stat);
2030	else
2031		/* Added for 2282 */
2032		writel (t, &ep->regs->ep_stat);
2033
2034	/* for ep0, monitor token irqs to catch data stage length errors
2035	 * and to synchronize on status.
2036	 *
2037	 * also, to defer reporting of protocol stalls ... here's where
2038	 * data or status first appears, handling stalls here should never
2039	 * cause trouble on the host side..
2040	 *
2041	 * control requests could be slightly faster without token synch for
2042	 * status, but status can jam up that way.
2043	 */
2044	if (unlikely (ep->num == 0)) {
2045		if (ep->is_in) {
2046			/* status; stop NAKing */
2047			if (t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)) {
2048				if (ep->dev->protocol_stall) {
2049					ep->stopped = 1;
2050					set_halt (ep);
2051				}
2052				if (!req)
2053					allow_status (ep);
2054				mode = 2;
2055			/* reply to extra IN data tokens with a zlp */
2056			} else if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2057				if (ep->dev->protocol_stall) {
2058					ep->stopped = 1;
2059					set_halt (ep);
2060					mode = 2;
2061				} else if (ep->responded &&
2062						!req && !ep->stopped)
2063					write_fifo (ep, NULL);
2064			}
2065		} else {
2066			/* status; stop NAKing */
2067			if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2068				if (ep->dev->protocol_stall) {
2069					ep->stopped = 1;
2070					set_halt (ep);
2071				}
2072				mode = 2;
2073			/* an extra OUT token is an error */
2074			} else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
2075					&& req
2076					&& req->req.actual == req->req.length)
2077					|| (ep->responded && !req)) {
2078				ep->dev->protocol_stall = 1;
2079				set_halt (ep);
2080				ep->stopped = 1;
2081				if (req)
2082					done (ep, req, -EOVERFLOW);
2083				req = NULL;
2084			}
2085		}
2086	}
2087
2088	if (unlikely (!req))
2089		return;
2090
2091	/* manual DMA queue advance after short OUT */
2092	if (likely (ep->dma != 0)) {
2093		if (t & (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)) {
2094			u32	count;
2095			int	stopped = ep->stopped;
2096
2097			/* TRANSFERRED works around OUT_DONE erratum 0112.
2098			 * we expect (N <= maxpacket) bytes; host wrote M.
2099			 * iff (M < N) we won't ever see a DMA interrupt.
2100			 */
2101			ep->stopped = 1;
2102			for (count = 0; ; t = readl (&ep->regs->ep_stat)) {
2103
2104				/* any preceding dma transfers must finish.
2105				 * dma handles (M >= N), may empty the queue
2106				 */
2107				scan_dma_completions (ep);
2108				if (unlikely (list_empty (&ep->queue)
2109						|| ep->out_overflow)) {
2110					req = NULL;
2111					break;
2112				}
2113				req = list_entry (ep->queue.next,
2114					struct net2280_request, queue);
2115
2116				/* here either (M < N), a "real" short rx;
2117				 * or (M == N) and the queue didn't empty
2118				 */
2119				if (likely (t & (1 << FIFO_EMPTY))) {
2120					count = readl (&ep->dma->dmacount);
2121					count &= DMA_BYTE_COUNT_MASK;
2122					if (readl (&ep->dma->dmadesc)
2123							!= req->td_dma)
2124						req = NULL;
2125					break;
2126				}
2127				udelay(1);
2128			}
2129
2130			/* stop DMA, leave ep NAKing */
2131			writel ((1 << DMA_ABORT), &ep->dma->dmastat);
2132			spin_stop_dma (ep->dma);
2133
2134			if (likely (req)) {
2135				req->td->dmacount = 0;
2136				t = readl (&ep->regs->ep_avail);
2137				dma_done (ep, req, count,
2138					(ep->out_overflow || t)
2139						? -EOVERFLOW : 0);
2140			}
2141
2142			/* also flush to prevent erratum 0106 trouble */
2143			if (unlikely (ep->out_overflow
2144					|| (ep->dev->chiprev == 0x0100
2145						&& ep->dev->gadget.speed
2146							== USB_SPEED_FULL))) {
2147				out_flush (ep);
2148				ep->out_overflow = 0;
2149			}
2150
2151			/* (re)start dma if needed, stop NAKing */
2152			ep->stopped = stopped;
2153			if (!list_empty (&ep->queue))
2154				restart_dma (ep);
2155		} else
2156			DEBUG (ep->dev, "%s dma ep_stat %08x ??\n",
2157					ep->ep.name, t);
2158		return;
2159
2160	/* data packet(s) received (in the fifo, OUT) */
2161	} else if (t & (1 << DATA_PACKET_RECEIVED_INTERRUPT)) {
2162		if (read_fifo (ep, req) && ep->num != 0)
2163			mode = 2;
2164
2165	/* data packet(s) transmitted (IN) */
2166	} else if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)) {
2167		unsigned	len;
2168
2169		len = req->req.length - req->req.actual;
2170		if (len > ep->ep.maxpacket)
2171			len = ep->ep.maxpacket;
2172		req->req.actual += len;
2173
2174		/* if we wrote it all, we're usually done */
2175		if (req->req.actual == req->req.length) {
2176			if (ep->num == 0) {
2177				/* send zlps until the status stage */
2178			} else if (!req->req.zero || len != ep->ep.maxpacket)
2179				mode = 2;
2180		}
2181
2182	/* there was nothing to do ...  */
2183	} else if (mode == 1)
2184		return;
2185
2186	/* done */
2187	if (mode == 2) {
2188		/* stream endpoints often resubmit/unlink in completion */
2189		done (ep, req, 0);
2190
2191		/* maybe advance queue to next request */
2192		if (ep->num == 0) {
2193			/* NOTE:  net2280 could let gadget driver start the
2194			 * status stage later. since not all controllers let
2195			 * them control that, the api doesn't (yet) allow it.
2196			 */
2197			if (!ep->stopped)
2198				allow_status (ep);
2199			req = NULL;
2200		} else {
2201			if (!list_empty (&ep->queue) && !ep->stopped)
2202				req = list_entry (ep->queue.next,
2203					struct net2280_request, queue);
2204			else
2205				req = NULL;
2206			if (req && !ep->is_in)
2207				stop_out_naking (ep);
2208		}
2209	}
2210
2211	/* is there a buffer for the next packet?
2212	 * for best streaming performance, make sure there is one.
2213	 */
2214	if (req && !ep->stopped) {
2215
2216		/* load IN fifo with next packet (may be zlp) */
2217		if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT))
2218			write_fifo (ep, &req->req);
2219	}
2220}
2221
2222static struct net2280_ep *
2223get_ep_by_addr (struct net2280 *dev, u16 wIndex)
2224{
2225	struct net2280_ep	*ep;
2226
2227	if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
2228		return &dev->ep [0];
2229	list_for_each_entry (ep, &dev->gadget.ep_list, ep.ep_list) {
2230		u8	bEndpointAddress;
2231
2232		if (!ep->desc)
2233			continue;
2234		bEndpointAddress = ep->desc->bEndpointAddress;
2235		if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
2236			continue;
2237		if ((wIndex & 0x0f) == (bEndpointAddress & 0x0f))
2238			return ep;
2239	}
2240	return NULL;
2241}
2242
2243static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
2244{
2245	struct net2280_ep	*ep;
2246	u32			num, scratch;
2247
2248	/* most of these don't need individual acks */
2249	stat &= ~(1 << INTA_ASSERTED);
2250	if (!stat)
2251		return;
2252	// DEBUG (dev, "irqstat0 %04x\n", stat);
2253
2254	/* starting a control request? */
2255	if (unlikely (stat & (1 << SETUP_PACKET_INTERRUPT))) {
2256		union {
2257			u32			raw [2];
2258			struct usb_ctrlrequest	r;
2259		} u;
2260		int				tmp;
2261		struct net2280_request		*req;
2262
2263		if (dev->gadget.speed == USB_SPEED_UNKNOWN) {
2264			if (readl (&dev->usb->usbstat) & (1 << HIGH_SPEED))
2265				dev->gadget.speed = USB_SPEED_HIGH;
2266			else
2267				dev->gadget.speed = USB_SPEED_FULL;
2268			net2280_led_speed (dev, dev->gadget.speed);
2269			DEBUG (dev, "%s speed\n",
2270				(dev->gadget.speed == USB_SPEED_HIGH)
2271					? "high" : "full");
2272		}
2273
2274		ep = &dev->ep [0];
2275		ep->irqs++;
2276
2277		/* make sure any leftover request state is cleared */
2278		stat &= ~(1 << ENDPOINT_0_INTERRUPT);
2279		while (!list_empty (&ep->queue)) {
2280			req = list_entry (ep->queue.next,
2281					struct net2280_request, queue);
2282			done (ep, req, (req->req.actual == req->req.length)
2283						? 0 : -EPROTO);
2284		}
2285		ep->stopped = 0;
2286		dev->protocol_stall = 0;
2287
2288		if (ep->dev->pdev->device == 0x2280)
2289			tmp = (1 << FIFO_OVERFLOW)
2290				| (1 << FIFO_UNDERFLOW);
2291		else
2292			tmp = 0;
2293
2294		writel (tmp | (1 << TIMEOUT)
2295			| (1 << USB_STALL_SENT)
2296			| (1 << USB_IN_NAK_SENT)
2297			| (1 << USB_IN_ACK_RCVD)
2298			| (1 << USB_OUT_PING_NAK_SENT)
2299			| (1 << USB_OUT_ACK_SENT)
2300			| (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
2301			| (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
2302			| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2303			| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2304			| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2305			| (1 << DATA_IN_TOKEN_INTERRUPT)
2306			, &ep->regs->ep_stat);
2307		u.raw [0] = readl (&dev->usb->setup0123);
2308		u.raw [1] = readl (&dev->usb->setup4567);
2309
2310		cpu_to_le32s (&u.raw [0]);
2311		cpu_to_le32s (&u.raw [1]);
2312
2313		tmp = 0;
2314
2315#define	w_value		le16_to_cpu(u.r.wValue)
2316#define	w_index		le16_to_cpu(u.r.wIndex)
2317#define	w_length	le16_to_cpu(u.r.wLength)
2318
2319		/* ack the irq */
2320		writel (1 << SETUP_PACKET_INTERRUPT, &dev->regs->irqstat0);
2321		stat ^= (1 << SETUP_PACKET_INTERRUPT);
2322
2323		/* watch control traffic at the token level, and force
2324		 * synchronization before letting the status stage happen.
2325		 * FIXME ignore tokens we'll NAK, until driver responds.
2326		 * that'll mean a lot less irqs for some drivers.
2327		 */
2328		ep->is_in = (u.r.bRequestType & USB_DIR_IN) != 0;
2329		if (ep->is_in) {
2330			scratch = (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2331				| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2332				| (1 << DATA_IN_TOKEN_INTERRUPT);
2333			stop_out_naking (ep);
2334		} else
2335			scratch = (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2336				| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2337				| (1 << DATA_IN_TOKEN_INTERRUPT);
2338		writel (scratch, &dev->epregs [0].ep_irqenb);
2339
2340		/* we made the hardware handle most lowlevel requests;
2341		 * everything else goes uplevel to the gadget code.
2342		 */
2343		ep->responded = 1;
2344		switch (u.r.bRequest) {
2345		case USB_REQ_GET_STATUS: {
2346			struct net2280_ep	*e;
2347			__le32			status;
2348
2349			/* hw handles device and interface status */
2350			if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
2351				goto delegate;
2352			if ((e = get_ep_by_addr (dev, w_index)) == 0
2353					|| w_length > 2)
2354				goto do_stall;
2355
2356			if (readl (&e->regs->ep_rsp)
2357					& (1 << SET_ENDPOINT_HALT))
2358				status = cpu_to_le32 (1);
2359			else
2360				status = cpu_to_le32 (0);
2361
2362			/* don't bother with a request object! */
2363			writel (0, &dev->epregs [0].ep_irqenb);
2364			set_fifo_bytecount (ep, w_length);
2365			writel ((__force u32)status, &dev->epregs [0].ep_data);
2366			allow_status (ep);
2367			VDEBUG (dev, "%s stat %02x\n", ep->ep.name, status);
2368			goto next_endpoints;
2369			}
2370			break;
2371		case USB_REQ_CLEAR_FEATURE: {
2372			struct net2280_ep	*e;
2373
2374			/* hw handles device features */
2375			if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2376				goto delegate;
2377			if (w_value != USB_ENDPOINT_HALT
2378					|| w_length != 0)
2379				goto do_stall;
2380			if ((e = get_ep_by_addr (dev, w_index)) == 0)
2381				goto do_stall;
2382			if (e->wedged) {
2383				VDEBUG(dev, "%s wedged, halt not cleared\n",
2384						ep->ep.name);
2385			} else {
2386				VDEBUG(dev, "%s clear halt\n", ep->ep.name);
2387				clear_halt(e);
2388			}
2389			allow_status (ep);
2390			goto next_endpoints;
2391			}
2392			break;
2393		case USB_REQ_SET_FEATURE: {
2394			struct net2280_ep	*e;
2395
2396			/* hw handles device features */
2397			if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2398				goto delegate;
2399			if (w_value != USB_ENDPOINT_HALT
2400					|| w_length != 0)
2401				goto do_stall;
2402			if ((e = get_ep_by_addr (dev, w_index)) == 0)
2403				goto do_stall;
2404			if (e->ep.name == ep0name)
2405				goto do_stall;
2406			set_halt (e);
2407			allow_status (ep);
2408			VDEBUG (dev, "%s set halt\n", ep->ep.name);
2409			goto next_endpoints;
2410			}
2411			break;
2412		default:
2413delegate:
2414			VDEBUG (dev, "setup %02x.%02x v%04x i%04x l%04x "
2415				"ep_cfg %08x\n",
2416				u.r.bRequestType, u.r.bRequest,
2417				w_value, w_index, w_length,
2418				readl (&ep->regs->ep_cfg));
2419			ep->responded = 0;
2420			spin_unlock (&dev->lock);
2421			tmp = dev->driver->setup (&dev->gadget, &u.r);
2422			spin_lock (&dev->lock);
2423		}
2424
2425		/* stall ep0 on error */
2426		if (tmp < 0) {
2427do_stall:
2428			VDEBUG (dev, "req %02x.%02x protocol STALL; stat %d\n",
2429					u.r.bRequestType, u.r.bRequest, tmp);
2430			dev->protocol_stall = 1;
2431		}
2432
2433		/* some in/out token irq should follow; maybe stall then.
2434		 * driver must queue a request (even zlp) or halt ep0
2435		 * before the host times out.
2436		 */
2437	}
2438
2439#undef	w_value
2440#undef	w_index
2441#undef	w_length
2442
2443next_endpoints:
2444	/* endpoint data irq ? */
2445	scratch = stat & 0x7f;
2446	stat &= ~0x7f;
2447	for (num = 0; scratch; num++) {
2448		u32		t;
2449
2450		/* do this endpoint's FIFO and queue need tending? */
2451		t = 1 << num;
2452		if ((scratch & t) == 0)
2453			continue;
2454		scratch ^= t;
2455
2456		ep = &dev->ep [num];
2457		handle_ep_small (ep);
2458	}
2459
2460	if (stat)
2461		DEBUG (dev, "unhandled irqstat0 %08x\n", stat);
2462}
2463
2464#define DMA_INTERRUPTS ( \
2465		  (1 << DMA_D_INTERRUPT) \
2466		| (1 << DMA_C_INTERRUPT) \
2467		| (1 << DMA_B_INTERRUPT) \
2468		| (1 << DMA_A_INTERRUPT))
2469#define	PCI_ERROR_INTERRUPTS ( \
2470		  (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT) \
2471		| (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT) \
2472		| (1 << PCI_RETRY_ABORT_INTERRUPT))
2473
2474static void handle_stat1_irqs (struct net2280 *dev, u32 stat)
2475{
2476	struct net2280_ep	*ep;
2477	u32			tmp, num, mask, scratch;
2478
2479	/* after disconnect there's nothing else to do! */
2480	tmp = (1 << VBUS_INTERRUPT) | (1 << ROOT_PORT_RESET_INTERRUPT);
2481	mask = (1 << HIGH_SPEED) | (1 << FULL_SPEED);
2482
2483	/* VBUS disconnect is indicated by VBUS_PIN and VBUS_INTERRUPT set.
2484	 * Root Port Reset is indicated by ROOT_PORT_RESET_INTERRRUPT set and
2485	 * both HIGH_SPEED and FULL_SPEED clear (as ROOT_PORT_RESET_INTERRUPT
2486	 * only indicates a change in the reset state).
2487	 */
2488	if (stat & tmp) {
2489		writel (tmp, &dev->regs->irqstat1);
2490		if ((((stat & (1 << ROOT_PORT_RESET_INTERRUPT))
2491					&& ((readl (&dev->usb->usbstat) & mask)
2492							== 0))
2493				|| ((readl (&dev->usb->usbctl)
2494					& (1 << VBUS_PIN)) == 0)
2495			    ) && ( dev->gadget.speed != USB_SPEED_UNKNOWN)) {
2496			DEBUG (dev, "disconnect %s\n",
2497					dev->driver->driver.name);
2498			stop_activity (dev, dev->driver);
2499			ep0_start (dev);
2500			return;
2501		}
2502		stat &= ~tmp;
2503
2504		/* vBUS can bounce ... one of many reasons to ignore the
2505		 * notion of hotplug events on bus connect/disconnect!
2506		 */
2507		if (!stat)
2508			return;
2509	}
2510
2511	/* NOTE: chip stays in PCI D0 state for now, but it could
2512	 * enter D1 to save more power
2513	 */
2514	tmp = (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT);
2515	if (stat & tmp) {
2516		writel (tmp, &dev->regs->irqstat1);
2517		if (stat & (1 << SUSPEND_REQUEST_INTERRUPT)) {
2518			if (dev->driver->suspend)
2519				dev->driver->suspend (&dev->gadget);
2520			if (!enable_suspend)
2521				stat &= ~(1 << SUSPEND_REQUEST_INTERRUPT);
2522		} else {
2523			if (dev->driver->resume)
2524				dev->driver->resume (&dev->gadget);
2525			/* at high speed, note erratum 0133 */
2526		}
2527		stat &= ~tmp;
2528	}
2529
2530	/* clear any other status/irqs */
2531	if (stat)
2532		writel (stat, &dev->regs->irqstat1);
2533
2534	/* some status we can just ignore */
2535	if (dev->pdev->device == 0x2280)
2536		stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2537			  | (1 << SUSPEND_REQUEST_INTERRUPT)
2538			  | (1 << RESUME_INTERRUPT)
2539			  | (1 << SOF_INTERRUPT));
2540	else
2541		stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2542			  | (1 << RESUME_INTERRUPT)
2543			  | (1 << SOF_DOWN_INTERRUPT)
2544			  | (1 << SOF_INTERRUPT));
2545
2546	if (!stat)
2547		return;
2548	// DEBUG (dev, "irqstat1 %08x\n", stat);
2549
2550	/* DMA status, for ep-{a,b,c,d} */
2551	scratch = stat & DMA_INTERRUPTS;
2552	stat &= ~DMA_INTERRUPTS;
2553	scratch >>= 9;
2554	for (num = 0; scratch; num++) {
2555		struct net2280_dma_regs	__iomem *dma;
2556
2557		tmp = 1 << num;
2558		if ((tmp & scratch) == 0)
2559			continue;
2560		scratch ^= tmp;
2561
2562		ep = &dev->ep [num + 1];
2563		dma = ep->dma;
2564
2565		if (!dma)
2566			continue;
2567
2568		/* clear ep's dma status */
2569		tmp = readl (&dma->dmastat);
2570		writel (tmp, &dma->dmastat);
2571
2572		/* chaining should stop on abort, short OUT from fifo,
2573		 * or (stat0 codepath) short OUT transfer.
2574		 */
2575		if (!use_dma_chaining) {
2576			if ((tmp & (1 << DMA_TRANSACTION_DONE_INTERRUPT))
2577					== 0) {
2578				DEBUG (ep->dev, "%s no xact done? %08x\n",
2579					ep->ep.name, tmp);
2580				continue;
2581			}
2582			stop_dma (ep->dma);
2583		}
2584
2585		/* OUT transfers terminate when the data from the
2586		 * host is in our memory.  Process whatever's done.
2587		 * On this path, we know transfer's last packet wasn't
2588		 * less than req->length. NAK_OUT_PACKETS may be set,
2589		 * or the FIFO may already be holding new packets.
2590		 *
2591		 * IN transfers can linger in the FIFO for a very
2592		 * long time ... we ignore that for now, accounting
2593		 * precisely (like PIO does) needs per-packet irqs
2594		 */
2595		scan_dma_completions (ep);
2596
2597		/* disable dma on inactive queues; else maybe restart */
2598		if (list_empty (&ep->queue)) {
2599			if (use_dma_chaining)
2600				stop_dma (ep->dma);
2601		} else {
2602			tmp = readl (&dma->dmactl);
2603			if (!use_dma_chaining
2604					|| (tmp & (1 << DMA_ENABLE)) == 0)
2605				restart_dma (ep);
2606			else if (ep->is_in && use_dma_chaining) {
2607				struct net2280_request	*req;
2608				__le32			dmacount;
2609
2610				/* the descriptor at the head of the chain
2611				 * may still have VALID_BIT clear; that's
2612				 * used to trigger changing DMA_FIFO_VALIDATE
2613				 * (affects automagic zlp writes).
2614				 */
2615				req = list_entry (ep->queue.next,
2616						struct net2280_request, queue);
2617				dmacount = req->td->dmacount;
2618				dmacount &= cpu_to_le32 (
2619						(1 << VALID_BIT)
2620						| DMA_BYTE_COUNT_MASK);
2621				if (dmacount && (dmacount & valid_bit) == 0)
2622					restart_dma (ep);
2623			}
2624		}
2625		ep->irqs++;
2626	}
2627
2628	/* NOTE:  there are other PCI errors we might usefully notice.
2629	 * if they appear very often, here's where to try recovering.
2630	 */
2631	if (stat & PCI_ERROR_INTERRUPTS) {
2632		ERROR (dev, "pci dma error; stat %08x\n", stat);
2633		stat &= ~PCI_ERROR_INTERRUPTS;
2634		/* these are fatal errors, but "maybe" they won't
2635		 * happen again ...
2636		 */
2637		stop_activity (dev, dev->driver);
2638		ep0_start (dev);
2639		stat = 0;
2640	}
2641
2642	if (stat)
2643		DEBUG (dev, "unhandled irqstat1 %08x\n", stat);
2644}
2645
2646static irqreturn_t net2280_irq (int irq, void *_dev)
2647{
2648	struct net2280		*dev = _dev;
2649
2650	/* shared interrupt, not ours */
2651	if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
2652		return IRQ_NONE;
2653
2654	spin_lock (&dev->lock);
2655
2656	/* handle disconnect, dma, and more */
2657	handle_stat1_irqs (dev, readl (&dev->regs->irqstat1));
2658
2659	/* control requests and PIO */
2660	handle_stat0_irqs (dev, readl (&dev->regs->irqstat0));
2661
2662	spin_unlock (&dev->lock);
2663
2664	return IRQ_HANDLED;
2665}
2666
2667/*-------------------------------------------------------------------------*/
2668
2669static void gadget_release (struct device *_dev)
2670{
2671	struct net2280	*dev = dev_get_drvdata (_dev);
2672
2673	kfree (dev);
2674}
2675
2676/* tear down the binding between this driver and the pci device */
2677
2678static void net2280_remove (struct pci_dev *pdev)
2679{
2680	struct net2280		*dev = pci_get_drvdata (pdev);
2681
2682	usb_del_gadget_udc(&dev->gadget);
2683
2684	BUG_ON(dev->driver);
2685
2686	/* then clean up the resources we allocated during probe() */
2687	net2280_led_shutdown (dev);
2688	if (dev->requests) {
2689		int		i;
2690		for (i = 1; i < 5; i++) {
2691			if (!dev->ep [i].dummy)
2692				continue;
2693			pci_pool_free (dev->requests, dev->ep [i].dummy,
2694					dev->ep [i].td_dma);
2695		}
2696		pci_pool_destroy (dev->requests);
2697	}
2698	if (dev->got_irq)
2699		free_irq (pdev->irq, dev);
2700	if (dev->regs)
2701		iounmap (dev->regs);
2702	if (dev->region)
2703		release_mem_region (pci_resource_start (pdev, 0),
2704				pci_resource_len (pdev, 0));
2705	if (dev->enabled)
2706		pci_disable_device (pdev);
2707	device_unregister (&dev->gadget.dev);
2708	device_remove_file (&pdev->dev, &dev_attr_registers);
2709	pci_set_drvdata (pdev, NULL);
2710
2711	INFO (dev, "unbind\n");
2712
2713	the_controller = NULL;
2714}
2715
2716/* wrap this driver around the specified device, but
2717 * don't respond over USB until a gadget driver binds to us.
2718 */
2719
2720static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
2721{
2722	struct net2280		*dev;
2723	unsigned long		resource, len;
2724	void			__iomem *base = NULL;
2725	int			retval, i;
2726
2727	/* if you want to support more than one controller in a system,
2728	 * usb_gadget_driver_{register,unregister}() must change.
2729	 */
2730	if (the_controller) {
2731		dev_warn (&pdev->dev, "ignoring\n");
2732		return -EBUSY;
2733	}
2734
2735	/* alloc, and start init */
2736	dev = kzalloc (sizeof *dev, GFP_KERNEL);
2737	if (dev == NULL){
2738		retval = -ENOMEM;
2739		goto done;
2740	}
2741
2742	pci_set_drvdata (pdev, dev);
2743	spin_lock_init (&dev->lock);
2744	dev->pdev = pdev;
2745	dev->gadget.ops = &net2280_ops;
2746	dev->gadget.is_dualspeed = 1;
2747
2748	/* the "gadget" abstracts/virtualizes the controller */
2749	dev_set_name(&dev->gadget.dev, "gadget");
2750	dev->gadget.dev.parent = &pdev->dev;
2751	dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
2752	dev->gadget.dev.release = gadget_release;
2753	dev->gadget.name = driver_name;
2754
2755	/* now all the pci goodies ... */
2756	if (pci_enable_device (pdev) < 0) {
2757	        retval = -ENODEV;
2758		goto done;
2759	}
2760	dev->enabled = 1;
2761
2762	/* BAR 0 holds all the registers
2763	 * BAR 1 is 8051 memory; unused here (note erratum 0103)
2764	 * BAR 2 is fifo memory; unused here
2765	 */
2766	resource = pci_resource_start (pdev, 0);
2767	len = pci_resource_len (pdev, 0);
2768	if (!request_mem_region (resource, len, driver_name)) {
2769		DEBUG (dev, "controller already in use\n");
2770		retval = -EBUSY;
2771		goto done;
2772	}
2773	dev->region = 1;
2774
2775	/* FIXME provide firmware download interface to put
2776	 * 8051 code into the chip, e.g. to turn on PCI PM.
2777	 */
2778
2779	base = ioremap_nocache (resource, len);
2780	if (base == NULL) {
2781		DEBUG (dev, "can't map memory\n");
2782		retval = -EFAULT;
2783		goto done;
2784	}
2785	dev->regs = (struct net2280_regs __iomem *) base;
2786	dev->usb = (struct net2280_usb_regs __iomem *) (base + 0x0080);
2787	dev->pci = (struct net2280_pci_regs __iomem *) (base + 0x0100);
2788	dev->dma = (struct net2280_dma_regs __iomem *) (base + 0x0180);
2789	dev->dep = (struct net2280_dep_regs __iomem *) (base + 0x0200);
2790	dev->epregs = (struct net2280_ep_regs __iomem *) (base + 0x0300);
2791
2792	/* put into initial config, link up all endpoints */
2793	writel (0, &dev->usb->usbctl);
2794	usb_reset (dev);
2795	usb_reinit (dev);
2796
2797	/* irq setup after old hardware is cleaned up */
2798	if (!pdev->irq) {
2799		ERROR (dev, "No IRQ.  Check PCI setup!\n");
2800		retval = -ENODEV;
2801		goto done;
2802	}
2803
2804	if (request_irq (pdev->irq, net2280_irq, IRQF_SHARED, driver_name, dev)
2805			!= 0) {
2806		ERROR (dev, "request interrupt %d failed\n", pdev->irq);
2807		retval = -EBUSY;
2808		goto done;
2809	}
2810	dev->got_irq = 1;
2811
2812	/* DMA setup */
2813	/* NOTE:  we know only the 32 LSBs of dma addresses may be nonzero */
2814	dev->requests = pci_pool_create ("requests", pdev,
2815		sizeof (struct net2280_dma),
2816		0 /* no alignment requirements */,
2817		0 /* or page-crossing issues */);
2818	if (!dev->requests) {
2819		DEBUG (dev, "can't get request pool\n");
2820		retval = -ENOMEM;
2821		goto done;
2822	}
2823	for (i = 1; i < 5; i++) {
2824		struct net2280_dma	*td;
2825
2826		td = pci_pool_alloc (dev->requests, GFP_KERNEL,
2827				&dev->ep [i].td_dma);
2828		if (!td) {
2829			DEBUG (dev, "can't get dummy %d\n", i);
2830			retval = -ENOMEM;
2831			goto done;
2832		}
2833		td->dmacount = 0;	/* not VALID */
2834		td->dmaaddr = cpu_to_le32 (DMA_ADDR_INVALID);
2835		td->dmadesc = td->dmaaddr;
2836		dev->ep [i].dummy = td;
2837	}
2838
2839	/* enable lower-overhead pci memory bursts during DMA */
2840	writel ( (1 << DMA_MEMORY_WRITE_AND_INVALIDATE_ENABLE)
2841			// 256 write retries may not be enough...
2842			// | (1 << PCI_RETRY_ABORT_ENABLE)
2843			| (1 << DMA_READ_MULTIPLE_ENABLE)
2844			| (1 << DMA_READ_LINE_ENABLE)
2845			, &dev->pci->pcimstctl);
2846	/* erratum 0115 shouldn't appear: Linux inits PCI_LATENCY_TIMER */
2847	pci_set_master (pdev);
2848	pci_try_set_mwi (pdev);
2849
2850	/* ... also flushes any posted pci writes */
2851	dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
2852
2853	/* done */
2854	INFO (dev, "%s\n", driver_desc);
2855	INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
2856			pdev->irq, base, dev->chiprev);
2857	INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
2858			use_dma
2859				? (use_dma_chaining ? "chaining" : "enabled")
2860				: "disabled");
2861	the_controller = dev;
2862
2863	retval = device_register (&dev->gadget.dev);
2864	if (retval) goto done;
2865	retval = device_create_file (&pdev->dev, &dev_attr_registers);
2866	if (retval) goto done;
2867
2868	retval = usb_add_gadget_udc(&pdev->dev, &dev->gadget);
2869	if (retval)
2870		goto done;
2871	return 0;
2872
2873done:
2874	if (dev)
2875		net2280_remove (pdev);
2876	return retval;
2877}
2878
2879/* make sure the board is quiescent; otherwise it will continue
2880 * generating IRQs across the upcoming reboot.
2881 */
2882
2883static void net2280_shutdown (struct pci_dev *pdev)
2884{
2885	struct net2280		*dev = pci_get_drvdata (pdev);
2886
2887	/* disable IRQs */
2888	writel (0, &dev->regs->pciirqenb0);
2889	writel (0, &dev->regs->pciirqenb1);
2890
2891	/* disable the pullup so the host will think we're gone */
2892	writel (0, &dev->usb->usbctl);
2893}
2894
2895
2896/*-------------------------------------------------------------------------*/
2897
2898static const struct pci_device_id pci_ids [] = { {
2899	.class =	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2900	.class_mask =	~0,
2901	.vendor =	0x17cc,
2902	.device =	0x2280,
2903	.subvendor =	PCI_ANY_ID,
2904	.subdevice =	PCI_ANY_ID,
2905}, {
2906	.class =	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2907	.class_mask =	~0,
2908	.vendor =	0x17cc,
2909	.device =	0x2282,
2910	.subvendor =	PCI_ANY_ID,
2911	.subdevice =	PCI_ANY_ID,
2912
2913}, { /* end: all zeroes */ }
2914};
2915MODULE_DEVICE_TABLE (pci, pci_ids);
2916
2917/* pci driver glue; this is a "new style" PCI driver module */
2918static struct pci_driver net2280_pci_driver = {
2919	.name =		(char *) driver_name,
2920	.id_table =	pci_ids,
2921
2922	.probe =	net2280_probe,
2923	.remove =	net2280_remove,
2924	.shutdown =	net2280_shutdown,
2925
2926	/* FIXME add power management support */
2927};
2928
2929MODULE_DESCRIPTION (DRIVER_DESC);
2930MODULE_AUTHOR ("David Brownell");
2931MODULE_LICENSE ("GPL");
2932
2933static int __init init (void)
2934{
2935	if (!use_dma)
2936		use_dma_chaining = 0;
2937	return pci_register_driver (&net2280_pci_driver);
2938}
2939module_init (init);
2940
2941static void __exit cleanup (void)
2942{
2943	pci_unregister_driver (&net2280_pci_driver);
2944}
2945module_exit (cleanup);