Linux Audio

Check our new training course

Linux kernel drivers training

Mar 31-Apr 9, 2025, special US time zones
Register
Loading...
Note: File does not exist in v4.6.
   1/*
   2 * Driver for the PLX NET2280 USB device controller.
   3 * Specs and errata are available from <http://www.plxtech.com>.
   4 *
   5 * PLX Technology Inc. (formerly NetChip Technology) supported the
   6 * development of this driver.
   7 *
   8 *
   9 * CODE STATUS HIGHLIGHTS
  10 *
  11 * This driver should work well with most "gadget" drivers, including
  12 * the Mass Storage, Serial, and Ethernet/RNDIS gadget drivers
  13 * as well as Gadget Zero and Gadgetfs.
  14 *
  15 * DMA is enabled by default.  Drivers using transfer queues might use
  16 * DMA chaining to remove IRQ latencies between transfers.  (Except when
  17 * short OUT transfers happen.)  Drivers can use the req->no_interrupt
  18 * hint to completely eliminate some IRQs, if a later IRQ is guaranteed
  19 * and DMA chaining is enabled.
  20 *
  21 * Note that almost all the errata workarounds here are only needed for
  22 * rev1 chips.  Rev1a silicon (0110) fixes almost all of them.
  23 */
  24
  25/*
  26 * Copyright (C) 2003 David Brownell
  27 * Copyright (C) 2003-2005 PLX Technology, Inc.
  28 *
  29 * Modified Seth Levy 2005 PLX Technology, Inc. to provide compatibility
  30 *	with 2282 chip
  31 *
  32 * This program is free software; you can redistribute it and/or modify
  33 * it under the terms of the GNU General Public License as published by
  34 * the Free Software Foundation; either version 2 of the License, or
  35 * (at your option) any later version.
  36 */
  37
  38#undef	DEBUG		/* messages on error and most fault paths */
  39#undef	VERBOSE		/* extra debug messages (success too) */
  40
  41#include <linux/module.h>
  42#include <linux/pci.h>
  43#include <linux/dma-mapping.h>
  44#include <linux/kernel.h>
  45#include <linux/delay.h>
  46#include <linux/ioport.h>
  47#include <linux/slab.h>
  48#include <linux/errno.h>
  49#include <linux/init.h>
  50#include <linux/timer.h>
  51#include <linux/list.h>
  52#include <linux/interrupt.h>
  53#include <linux/moduleparam.h>
  54#include <linux/device.h>
  55#include <linux/usb/ch9.h>
  56#include <linux/usb/gadget.h>
  57#include <linux/prefetch.h>
  58
  59#include <asm/byteorder.h>
  60#include <asm/io.h>
  61#include <asm/irq.h>
  62#include <asm/unaligned.h>
  63
  64
  65#define	DRIVER_DESC		"PLX NET228x USB Peripheral Controller"
  66#define	DRIVER_VERSION		"2005 Sept 27"
  67
  68#define	EP_DONTUSE		13	/* nonzero */
  69
  70#define USE_RDK_LEDS		/* GPIO pins control three LEDs */
  71
  72
  73static const char driver_name [] = "net2280";
  74static const char driver_desc [] = DRIVER_DESC;
  75
  76static const char ep0name [] = "ep0";
  77static const char *const ep_name [] = {
  78	ep0name,
  79	"ep-a", "ep-b", "ep-c", "ep-d",
  80	"ep-e", "ep-f",
  81};
  82
  83/* use_dma -- general goodness, fewer interrupts, less cpu load (vs PIO)
  84 * use_dma_chaining -- dma descriptor queueing gives even more irq reduction
  85 *
  86 * The net2280 DMA engines are not tightly integrated with their FIFOs;
  87 * not all cases are (yet) handled well in this driver or the silicon.
  88 * Some gadget drivers work better with the dma support here than others.
  89 * These two parameters let you use PIO or more aggressive DMA.
  90 */
  91static bool use_dma = 1;
  92static bool use_dma_chaining = 0;
  93
  94/* "modprobe net2280 use_dma=n" etc */
  95module_param (use_dma, bool, S_IRUGO);
  96module_param (use_dma_chaining, bool, S_IRUGO);
  97
  98
  99/* mode 0 == ep-{a,b,c,d} 1K fifo each
 100 * mode 1 == ep-{a,b} 2K fifo each, ep-{c,d} unavailable
 101 * mode 2 == ep-a 2K fifo, ep-{b,c} 1K each, ep-d unavailable
 102 */
 103static ushort fifo_mode = 0;
 104
 105/* "modprobe net2280 fifo_mode=1" etc */
 106module_param (fifo_mode, ushort, 0644);
 107
 108/* enable_suspend -- When enabled, the driver will respond to
 109 * USB suspend requests by powering down the NET2280.  Otherwise,
 110 * USB suspend requests will be ignored.  This is acceptable for
 111 * self-powered devices
 112 */
 113static bool enable_suspend = 0;
 114
 115/* "modprobe net2280 enable_suspend=1" etc */
 116module_param (enable_suspend, bool, S_IRUGO);
 117
 118/* force full-speed operation */
 119static bool full_speed;
 120module_param(full_speed, bool, 0444);
 121MODULE_PARM_DESC(full_speed, "force full-speed mode -- for testing only!");
 122
 123#define	DIR_STRING(bAddress) (((bAddress) & USB_DIR_IN) ? "in" : "out")
 124
 125#if defined(CONFIG_USB_GADGET_DEBUG_FILES) || defined (DEBUG)
 126static char *type_string (u8 bmAttributes)
 127{
 128	switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
 129	case USB_ENDPOINT_XFER_BULK:	return "bulk";
 130	case USB_ENDPOINT_XFER_ISOC:	return "iso";
 131	case USB_ENDPOINT_XFER_INT:	return "intr";
 132	}
 133	return "control";
 134}
 135#endif
 136
 137#include "net2280.h"
 138
 139#define valid_bit	cpu_to_le32 (1 << VALID_BIT)
 140#define dma_done_ie	cpu_to_le32 (1 << DMA_DONE_INTERRUPT_ENABLE)
 141
 142/*-------------------------------------------------------------------------*/
 143
 144static int
 145net2280_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 146{
 147	struct net2280		*dev;
 148	struct net2280_ep	*ep;
 149	u32			max, tmp;
 150	unsigned long		flags;
 151
 152	ep = container_of (_ep, struct net2280_ep, ep);
 153	if (!_ep || !desc || ep->desc || _ep->name == ep0name
 154			|| desc->bDescriptorType != USB_DT_ENDPOINT)
 155		return -EINVAL;
 156	dev = ep->dev;
 157	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 158		return -ESHUTDOWN;
 159
 160	/* erratum 0119 workaround ties up an endpoint number */
 161	if ((desc->bEndpointAddress & 0x0f) == EP_DONTUSE)
 162		return -EDOM;
 163
 164	/* sanity check ep-e/ep-f since their fifos are small */
 165	max = usb_endpoint_maxp (desc) & 0x1fff;
 166	if (ep->num > 4 && max > 64)
 167		return -ERANGE;
 168
 169	spin_lock_irqsave (&dev->lock, flags);
 170	_ep->maxpacket = max & 0x7ff;
 171	ep->desc = desc;
 172
 173	/* ep_reset() has already been called */
 174	ep->stopped = 0;
 175	ep->wedged = 0;
 176	ep->out_overflow = 0;
 177
 178	/* set speed-dependent max packet; may kick in high bandwidth */
 179	set_idx_reg (dev->regs, REG_EP_MAXPKT (dev, ep->num), max);
 180
 181	/* FIFO lines can't go to different packets.  PIO is ok, so
 182	 * use it instead of troublesome (non-bulk) multi-packet DMA.
 183	 */
 184	if (ep->dma && (max % 4) != 0 && use_dma_chaining) {
 185		DEBUG (ep->dev, "%s, no dma for maxpacket %d\n",
 186			ep->ep.name, ep->ep.maxpacket);
 187		ep->dma = NULL;
 188	}
 189
 190	/* set type, direction, address; reset fifo counters */
 191	writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
 192	tmp = (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
 193	if (tmp == USB_ENDPOINT_XFER_INT) {
 194		/* erratum 0105 workaround prevents hs NYET */
 195		if (dev->chiprev == 0100
 196				&& dev->gadget.speed == USB_SPEED_HIGH
 197				&& !(desc->bEndpointAddress & USB_DIR_IN))
 198			writel ((1 << CLEAR_NAK_OUT_PACKETS_MODE),
 199				&ep->regs->ep_rsp);
 200	} else if (tmp == USB_ENDPOINT_XFER_BULK) {
 201		/* catch some particularly blatant driver bugs */
 202		if ((dev->gadget.speed == USB_SPEED_HIGH
 203					&& max != 512)
 204				|| (dev->gadget.speed == USB_SPEED_FULL
 205					&& max > 64)) {
 206			spin_unlock_irqrestore (&dev->lock, flags);
 207			return -ERANGE;
 208		}
 209	}
 210	ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC) ? 1 : 0;
 211	tmp <<= ENDPOINT_TYPE;
 212	tmp |= desc->bEndpointAddress;
 213	tmp |= (4 << ENDPOINT_BYTE_COUNT);	/* default full fifo lines */
 214	tmp |= 1 << ENDPOINT_ENABLE;
 215	wmb ();
 216
 217	/* for OUT transfers, block the rx fifo until a read is posted */
 218	ep->is_in = (tmp & USB_DIR_IN) != 0;
 219	if (!ep->is_in)
 220		writel ((1 << SET_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 221	else if (dev->pdev->device != 0x2280) {
 222		/* Added for 2282, Don't use nak packets on an in endpoint,
 223		 * this was ignored on 2280
 224		 */
 225		writel ((1 << CLEAR_NAK_OUT_PACKETS)
 226			| (1 << CLEAR_NAK_OUT_PACKETS_MODE), &ep->regs->ep_rsp);
 227	}
 228
 229	writel (tmp, &ep->regs->ep_cfg);
 230
 231	/* enable irqs */
 232	if (!ep->dma) {				/* pio, per-packet */
 233		tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 234		writel (tmp, &dev->regs->pciirqenb0);
 235
 236		tmp = (1 << DATA_PACKET_RECEIVED_INTERRUPT_ENABLE)
 237			| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT_ENABLE);
 238		if (dev->pdev->device == 0x2280)
 239			tmp |= readl (&ep->regs->ep_irqenb);
 240		writel (tmp, &ep->regs->ep_irqenb);
 241	} else {				/* dma, per-request */
 242		tmp = (1 << (8 + ep->num));	/* completion */
 243		tmp |= readl (&dev->regs->pciirqenb1);
 244		writel (tmp, &dev->regs->pciirqenb1);
 245
 246		/* for short OUT transfers, dma completions can't
 247		 * advance the queue; do it pio-style, by hand.
 248		 * NOTE erratum 0112 workaround #2
 249		 */
 250		if ((desc->bEndpointAddress & USB_DIR_IN) == 0) {
 251			tmp = (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT_ENABLE);
 252			writel (tmp, &ep->regs->ep_irqenb);
 253
 254			tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
 255			writel (tmp, &dev->regs->pciirqenb0);
 256		}
 257	}
 258
 259	tmp = desc->bEndpointAddress;
 260	DEBUG (dev, "enabled %s (ep%d%s-%s) %s max %04x\n",
 261		_ep->name, tmp & 0x0f, DIR_STRING (tmp),
 262		type_string (desc->bmAttributes),
 263		ep->dma ? "dma" : "pio", max);
 264
 265	/* pci writes may still be posted */
 266	spin_unlock_irqrestore (&dev->lock, flags);
 267	return 0;
 268}
 269
 270static int handshake (u32 __iomem *ptr, u32 mask, u32 done, int usec)
 271{
 272	u32	result;
 273
 274	do {
 275		result = readl (ptr);
 276		if (result == ~(u32)0)		/* "device unplugged" */
 277			return -ENODEV;
 278		result &= mask;
 279		if (result == done)
 280			return 0;
 281		udelay (1);
 282		usec--;
 283	} while (usec > 0);
 284	return -ETIMEDOUT;
 285}
 286
 287static const struct usb_ep_ops net2280_ep_ops;
 288
 289static void ep_reset (struct net2280_regs __iomem *regs, struct net2280_ep *ep)
 290{
 291	u32		tmp;
 292
 293	ep->desc = NULL;
 294	INIT_LIST_HEAD (&ep->queue);
 295
 296	usb_ep_set_maxpacket_limit(&ep->ep, ~0);
 297	ep->ep.ops = &net2280_ep_ops;
 298
 299	/* disable the dma, irqs, endpoint... */
 300	if (ep->dma) {
 301		writel (0, &ep->dma->dmactl);
 302		writel (  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 303			| (1 << DMA_TRANSACTION_DONE_INTERRUPT)
 304			| (1 << DMA_ABORT)
 305			, &ep->dma->dmastat);
 306
 307		tmp = readl (&regs->pciirqenb0);
 308		tmp &= ~(1 << ep->num);
 309		writel (tmp, &regs->pciirqenb0);
 310	} else {
 311		tmp = readl (&regs->pciirqenb1);
 312		tmp &= ~(1 << (8 + ep->num));	/* completion */
 313		writel (tmp, &regs->pciirqenb1);
 314	}
 315	writel (0, &ep->regs->ep_irqenb);
 316
 317	/* init to our chosen defaults, notably so that we NAK OUT
 318	 * packets until the driver queues a read (+note erratum 0112)
 319	 */
 320	if (!ep->is_in || ep->dev->pdev->device == 0x2280) {
 321		tmp = (1 << SET_NAK_OUT_PACKETS_MODE)
 322		| (1 << SET_NAK_OUT_PACKETS)
 323		| (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 324		| (1 << CLEAR_INTERRUPT_MODE);
 325	} else {
 326		/* added for 2282 */
 327		tmp = (1 << CLEAR_NAK_OUT_PACKETS_MODE)
 328		| (1 << CLEAR_NAK_OUT_PACKETS)
 329		| (1 << CLEAR_EP_HIDE_STATUS_PHASE)
 330		| (1 << CLEAR_INTERRUPT_MODE);
 331	}
 332
 333	if (ep->num != 0) {
 334		tmp |= (1 << CLEAR_ENDPOINT_TOGGLE)
 335			| (1 << CLEAR_ENDPOINT_HALT);
 336	}
 337	writel (tmp, &ep->regs->ep_rsp);
 338
 339	/* scrub most status bits, and flush any fifo state */
 340	if (ep->dev->pdev->device == 0x2280)
 341		tmp = (1 << FIFO_OVERFLOW)
 342			| (1 << FIFO_UNDERFLOW);
 343	else
 344		tmp = 0;
 345
 346	writel (tmp | (1 << TIMEOUT)
 347		| (1 << USB_STALL_SENT)
 348		| (1 << USB_IN_NAK_SENT)
 349		| (1 << USB_IN_ACK_RCVD)
 350		| (1 << USB_OUT_PING_NAK_SENT)
 351		| (1 << USB_OUT_ACK_SENT)
 352		| (1 << FIFO_FLUSH)
 353		| (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
 354		| (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
 355		| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 356		| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
 357		| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 358		| (1 << DATA_IN_TOKEN_INTERRUPT)
 359		, &ep->regs->ep_stat);
 360
 361	/* fifo size is handled separately */
 362}
 363
 364static void nuke (struct net2280_ep *);
 365
 366static int net2280_disable (struct usb_ep *_ep)
 367{
 368	struct net2280_ep	*ep;
 369	unsigned long		flags;
 370
 371	ep = container_of (_ep, struct net2280_ep, ep);
 372	if (!_ep || !ep->desc || _ep->name == ep0name)
 373		return -EINVAL;
 374
 375	spin_lock_irqsave (&ep->dev->lock, flags);
 376	nuke (ep);
 377	ep_reset (ep->dev->regs, ep);
 378
 379	VDEBUG (ep->dev, "disabled %s %s\n",
 380			ep->dma ? "dma" : "pio", _ep->name);
 381
 382	/* synch memory views with the device */
 383	(void) readl (&ep->regs->ep_cfg);
 384
 385	if (use_dma && !ep->dma && ep->num >= 1 && ep->num <= 4)
 386		ep->dma = &ep->dev->dma [ep->num - 1];
 387
 388	spin_unlock_irqrestore (&ep->dev->lock, flags);
 389	return 0;
 390}
 391
 392/*-------------------------------------------------------------------------*/
 393
 394static struct usb_request *
 395net2280_alloc_request (struct usb_ep *_ep, gfp_t gfp_flags)
 396{
 397	struct net2280_ep	*ep;
 398	struct net2280_request	*req;
 399
 400	if (!_ep)
 401		return NULL;
 402	ep = container_of (_ep, struct net2280_ep, ep);
 403
 404	req = kzalloc(sizeof(*req), gfp_flags);
 405	if (!req)
 406		return NULL;
 407
 408	INIT_LIST_HEAD (&req->queue);
 409
 410	/* this dma descriptor may be swapped with the previous dummy */
 411	if (ep->dma) {
 412		struct net2280_dma	*td;
 413
 414		td = pci_pool_alloc (ep->dev->requests, gfp_flags,
 415				&req->td_dma);
 416		if (!td) {
 417			kfree (req);
 418			return NULL;
 419		}
 420		td->dmacount = 0;	/* not VALID */
 421		td->dmadesc = td->dmaaddr;
 422		req->td = td;
 423	}
 424	return &req->req;
 425}
 426
 427static void
 428net2280_free_request (struct usb_ep *_ep, struct usb_request *_req)
 429{
 430	struct net2280_ep	*ep;
 431	struct net2280_request	*req;
 432
 433	ep = container_of (_ep, struct net2280_ep, ep);
 434	if (!_ep || !_req)
 435		return;
 436
 437	req = container_of (_req, struct net2280_request, req);
 438	WARN_ON (!list_empty (&req->queue));
 439	if (req->td)
 440		pci_pool_free (ep->dev->requests, req->td, req->td_dma);
 441	kfree (req);
 442}
 443
 444/*-------------------------------------------------------------------------*/
 445
 446/* load a packet into the fifo we use for usb IN transfers.
 447 * works for all endpoints.
 448 *
 449 * NOTE: pio with ep-a..ep-d could stuff multiple packets into the fifo
 450 * at a time, but this code is simpler because it knows it only writes
 451 * one packet.  ep-a..ep-d should use dma instead.
 452 */
 453static void
 454write_fifo (struct net2280_ep *ep, struct usb_request *req)
 455{
 456	struct net2280_ep_regs	__iomem *regs = ep->regs;
 457	u8			*buf;
 458	u32			tmp;
 459	unsigned		count, total;
 460
 461	/* INVARIANT:  fifo is currently empty. (testable) */
 462
 463	if (req) {
 464		buf = req->buf + req->actual;
 465		prefetch (buf);
 466		total = req->length - req->actual;
 467	} else {
 468		total = 0;
 469		buf = NULL;
 470	}
 471
 472	/* write just one packet at a time */
 473	count = ep->ep.maxpacket;
 474	if (count > total)	/* min() cannot be used on a bitfield */
 475		count = total;
 476
 477	VDEBUG (ep->dev, "write %s fifo (IN) %d bytes%s req %p\n",
 478			ep->ep.name, count,
 479			(count != ep->ep.maxpacket) ? " (short)" : "",
 480			req);
 481	while (count >= 4) {
 482		/* NOTE be careful if you try to align these. fifo lines
 483		 * should normally be full (4 bytes) and successive partial
 484		 * lines are ok only in certain cases.
 485		 */
 486		tmp = get_unaligned ((u32 *)buf);
 487		cpu_to_le32s (&tmp);
 488		writel (tmp, &regs->ep_data);
 489		buf += 4;
 490		count -= 4;
 491	}
 492
 493	/* last fifo entry is "short" unless we wrote a full packet.
 494	 * also explicitly validate last word in (periodic) transfers
 495	 * when maxpacket is not a multiple of 4 bytes.
 496	 */
 497	if (count || total < ep->ep.maxpacket) {
 498		tmp = count ? get_unaligned ((u32 *)buf) : count;
 499		cpu_to_le32s (&tmp);
 500		set_fifo_bytecount (ep, count & 0x03);
 501		writel (tmp, &regs->ep_data);
 502	}
 503
 504	/* pci writes may still be posted */
 505}
 506
 507/* work around erratum 0106: PCI and USB race over the OUT fifo.
 508 * caller guarantees chiprev 0100, out endpoint is NAKing, and
 509 * there's no real data in the fifo.
 510 *
 511 * NOTE:  also used in cases where that erratum doesn't apply:
 512 * where the host wrote "too much" data to us.
 513 */
 514static void out_flush (struct net2280_ep *ep)
 515{
 516	u32	__iomem *statp;
 517	u32	tmp;
 518
 519	ASSERT_OUT_NAKING (ep);
 520
 521	statp = &ep->regs->ep_stat;
 522	writel (  (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 523		| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
 524		, statp);
 525	writel ((1 << FIFO_FLUSH), statp);
 526	mb ();
 527	tmp = readl (statp);
 528	if (tmp & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
 529			/* high speed did bulk NYET; fifo isn't filling */
 530			&& ep->dev->gadget.speed == USB_SPEED_FULL) {
 531		unsigned	usec;
 532
 533		usec = 50;		/* 64 byte bulk/interrupt */
 534		handshake (statp, (1 << USB_OUT_PING_NAK_SENT),
 535				(1 << USB_OUT_PING_NAK_SENT), usec);
 536		/* NAK done; now CLEAR_NAK_OUT_PACKETS is safe */
 537	}
 538}
 539
 540/* unload packet(s) from the fifo we use for usb OUT transfers.
 541 * returns true iff the request completed, because of short packet
 542 * or the request buffer having filled with full packets.
 543 *
 544 * for ep-a..ep-d this will read multiple packets out when they
 545 * have been accepted.
 546 */
 547static int
 548read_fifo (struct net2280_ep *ep, struct net2280_request *req)
 549{
 550	struct net2280_ep_regs	__iomem *regs = ep->regs;
 551	u8			*buf = req->req.buf + req->req.actual;
 552	unsigned		count, tmp, is_short;
 553	unsigned		cleanup = 0, prevent = 0;
 554
 555	/* erratum 0106 ... packets coming in during fifo reads might
 556	 * be incompletely rejected.  not all cases have workarounds.
 557	 */
 558	if (ep->dev->chiprev == 0x0100
 559			&& ep->dev->gadget.speed == USB_SPEED_FULL) {
 560		udelay (1);
 561		tmp = readl (&ep->regs->ep_stat);
 562		if ((tmp & (1 << NAK_OUT_PACKETS)))
 563			cleanup = 1;
 564		else if ((tmp & (1 << FIFO_FULL))) {
 565			start_out_naking (ep);
 566			prevent = 1;
 567		}
 568		/* else: hope we don't see the problem */
 569	}
 570
 571	/* never overflow the rx buffer. the fifo reads packets until
 572	 * it sees a short one; we might not be ready for them all.
 573	 */
 574	prefetchw (buf);
 575	count = readl (&regs->ep_avail);
 576	if (unlikely (count == 0)) {
 577		udelay (1);
 578		tmp = readl (&ep->regs->ep_stat);
 579		count = readl (&regs->ep_avail);
 580		/* handled that data already? */
 581		if (count == 0 && (tmp & (1 << NAK_OUT_PACKETS)) == 0)
 582			return 0;
 583	}
 584
 585	tmp = req->req.length - req->req.actual;
 586	if (count > tmp) {
 587		/* as with DMA, data overflow gets flushed */
 588		if ((tmp % ep->ep.maxpacket) != 0) {
 589			ERROR (ep->dev,
 590				"%s out fifo %d bytes, expected %d\n",
 591				ep->ep.name, count, tmp);
 592			req->req.status = -EOVERFLOW;
 593			cleanup = 1;
 594			/* NAK_OUT_PACKETS will be set, so flushing is safe;
 595			 * the next read will start with the next packet
 596			 */
 597		} /* else it's a ZLP, no worries */
 598		count = tmp;
 599	}
 600	req->req.actual += count;
 601
 602	is_short = (count == 0) || ((count % ep->ep.maxpacket) != 0);
 603
 604	VDEBUG (ep->dev, "read %s fifo (OUT) %d bytes%s%s%s req %p %d/%d\n",
 605			ep->ep.name, count, is_short ? " (short)" : "",
 606			cleanup ? " flush" : "", prevent ? " nak" : "",
 607			req, req->req.actual, req->req.length);
 608
 609	while (count >= 4) {
 610		tmp = readl (&regs->ep_data);
 611		cpu_to_le32s (&tmp);
 612		put_unaligned (tmp, (u32 *)buf);
 613		buf += 4;
 614		count -= 4;
 615	}
 616	if (count) {
 617		tmp = readl (&regs->ep_data);
 618		/* LE conversion is implicit here: */
 619		do {
 620			*buf++ = (u8) tmp;
 621			tmp >>= 8;
 622		} while (--count);
 623	}
 624	if (cleanup)
 625		out_flush (ep);
 626	if (prevent) {
 627		writel ((1 << CLEAR_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
 628		(void) readl (&ep->regs->ep_rsp);
 629	}
 630
 631	return is_short || ((req->req.actual == req->req.length)
 632				&& !req->req.zero);
 633}
 634
 635/* fill out dma descriptor to match a given request */
 636static void
 637fill_dma_desc (struct net2280_ep *ep, struct net2280_request *req, int valid)
 638{
 639	struct net2280_dma	*td = req->td;
 640	u32			dmacount = req->req.length;
 641
 642	/* don't let DMA continue after a short OUT packet,
 643	 * so overruns can't affect the next transfer.
 644	 * in case of overruns on max-size packets, we can't
 645	 * stop the fifo from filling but we can flush it.
 646	 */
 647	if (ep->is_in)
 648		dmacount |= (1 << DMA_DIRECTION);
 649	if ((!ep->is_in && (dmacount % ep->ep.maxpacket) != 0)
 650			|| ep->dev->pdev->device != 0x2280)
 651		dmacount |= (1 << END_OF_CHAIN);
 652
 653	req->valid = valid;
 654	if (valid)
 655		dmacount |= (1 << VALID_BIT);
 656	if (likely(!req->req.no_interrupt || !use_dma_chaining))
 657		dmacount |= (1 << DMA_DONE_INTERRUPT_ENABLE);
 658
 659	/* td->dmadesc = previously set by caller */
 660	td->dmaaddr = cpu_to_le32 (req->req.dma);
 661
 662	/* 2280 may be polling VALID_BIT through ep->dma->dmadesc */
 663	wmb ();
 664	td->dmacount = cpu_to_le32(dmacount);
 665}
 666
 667static const u32 dmactl_default =
 668		  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
 669		| (1 << DMA_CLEAR_COUNT_ENABLE)
 670		/* erratum 0116 workaround part 1 (use POLLING) */
 671		| (POLL_100_USEC << DESCRIPTOR_POLLING_RATE)
 672		| (1 << DMA_VALID_BIT_POLLING_ENABLE)
 673		| (1 << DMA_VALID_BIT_ENABLE)
 674		| (1 << DMA_SCATTER_GATHER_ENABLE)
 675		/* erratum 0116 workaround part 2 (no AUTOSTART) */
 676		| (1 << DMA_ENABLE);
 677
 678static inline void spin_stop_dma (struct net2280_dma_regs __iomem *dma)
 679{
 680	handshake (&dma->dmactl, (1 << DMA_ENABLE), 0, 50);
 681}
 682
 683static inline void stop_dma (struct net2280_dma_regs __iomem *dma)
 684{
 685	writel (readl (&dma->dmactl) & ~(1 << DMA_ENABLE), &dma->dmactl);
 686	spin_stop_dma (dma);
 687}
 688
 689static void start_queue (struct net2280_ep *ep, u32 dmactl, u32 td_dma)
 690{
 691	struct net2280_dma_regs	__iomem *dma = ep->dma;
 692	unsigned int tmp = (1 << VALID_BIT) | (ep->is_in << DMA_DIRECTION);
 693
 694	if (ep->dev->pdev->device != 0x2280)
 695		tmp |= (1 << END_OF_CHAIN);
 696
 697	writel (tmp, &dma->dmacount);
 698	writel (readl (&dma->dmastat), &dma->dmastat);
 699
 700	writel (td_dma, &dma->dmadesc);
 701	writel (dmactl, &dma->dmactl);
 702
 703	/* erratum 0116 workaround part 3:  pci arbiter away from net2280 */
 704	(void) readl (&ep->dev->pci->pcimstctl);
 705
 706	writel ((1 << DMA_START), &dma->dmastat);
 707
 708	if (!ep->is_in)
 709		stop_out_naking (ep);
 710}
 711
 712static void start_dma (struct net2280_ep *ep, struct net2280_request *req)
 713{
 714	u32			tmp;
 715	struct net2280_dma_regs	__iomem *dma = ep->dma;
 716
 717	/* FIXME can't use DMA for ZLPs */
 718
 719	/* on this path we "know" there's no dma active (yet) */
 720	WARN_ON (readl (&dma->dmactl) & (1 << DMA_ENABLE));
 721	writel (0, &ep->dma->dmactl);
 722
 723	/* previous OUT packet might have been short */
 724	if (!ep->is_in && ((tmp = readl (&ep->regs->ep_stat))
 725				& (1 << NAK_OUT_PACKETS)) != 0) {
 726		writel ((1 << SHORT_PACKET_TRANSFERRED_INTERRUPT),
 727			&ep->regs->ep_stat);
 728
 729		tmp = readl (&ep->regs->ep_avail);
 730		if (tmp) {
 731			writel (readl (&dma->dmastat), &dma->dmastat);
 732
 733			/* transfer all/some fifo data */
 734			writel (req->req.dma, &dma->dmaaddr);
 735			tmp = min (tmp, req->req.length);
 736
 737			/* dma irq, faking scatterlist status */
 738			req->td->dmacount = cpu_to_le32 (req->req.length - tmp);
 739			writel ((1 << DMA_DONE_INTERRUPT_ENABLE)
 740				| tmp, &dma->dmacount);
 741			req->td->dmadesc = 0;
 742			req->valid = 1;
 743
 744			writel ((1 << DMA_ENABLE), &dma->dmactl);
 745			writel ((1 << DMA_START), &dma->dmastat);
 746			return;
 747		}
 748	}
 749
 750	tmp = dmactl_default;
 751
 752	/* force packet boundaries between dma requests, but prevent the
 753	 * controller from automagically writing a last "short" packet
 754	 * (zero length) unless the driver explicitly said to do that.
 755	 */
 756	if (ep->is_in) {
 757		if (likely ((req->req.length % ep->ep.maxpacket) != 0
 758				|| req->req.zero)) {
 759			tmp |= (1 << DMA_FIFO_VALIDATE);
 760			ep->in_fifo_validate = 1;
 761		} else
 762			ep->in_fifo_validate = 0;
 763	}
 764
 765	/* init req->td, pointing to the current dummy */
 766	req->td->dmadesc = cpu_to_le32 (ep->td_dma);
 767	fill_dma_desc (ep, req, 1);
 768
 769	if (!use_dma_chaining)
 770		req->td->dmacount |= cpu_to_le32 (1 << END_OF_CHAIN);
 771
 772	start_queue (ep, tmp, req->td_dma);
 773}
 774
 775static inline void
 776queue_dma (struct net2280_ep *ep, struct net2280_request *req, int valid)
 777{
 778	struct net2280_dma	*end;
 779	dma_addr_t		tmp;
 780
 781	/* swap new dummy for old, link; fill and maybe activate */
 782	end = ep->dummy;
 783	ep->dummy = req->td;
 784	req->td = end;
 785
 786	tmp = ep->td_dma;
 787	ep->td_dma = req->td_dma;
 788	req->td_dma = tmp;
 789
 790	end->dmadesc = cpu_to_le32 (ep->td_dma);
 791
 792	fill_dma_desc (ep, req, valid);
 793}
 794
 795static void
 796done (struct net2280_ep *ep, struct net2280_request *req, int status)
 797{
 798	struct net2280		*dev;
 799	unsigned		stopped = ep->stopped;
 800
 801	list_del_init (&req->queue);
 802
 803	if (req->req.status == -EINPROGRESS)
 804		req->req.status = status;
 805	else
 806		status = req->req.status;
 807
 808	dev = ep->dev;
 809	if (ep->dma)
 810		usb_gadget_unmap_request(&dev->gadget, &req->req, ep->is_in);
 811
 812	if (status && status != -ESHUTDOWN)
 813		VDEBUG (dev, "complete %s req %p stat %d len %u/%u\n",
 814			ep->ep.name, &req->req, status,
 815			req->req.actual, req->req.length);
 816
 817	/* don't modify queue heads during completion callback */
 818	ep->stopped = 1;
 819	spin_unlock (&dev->lock);
 820	req->req.complete (&ep->ep, &req->req);
 821	spin_lock (&dev->lock);
 822	ep->stopped = stopped;
 823}
 824
 825/*-------------------------------------------------------------------------*/
 826
 827static int
 828net2280_queue (struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
 829{
 830	struct net2280_request	*req;
 831	struct net2280_ep	*ep;
 832	struct net2280		*dev;
 833	unsigned long		flags;
 834
 835	/* we always require a cpu-view buffer, so that we can
 836	 * always use pio (as fallback or whatever).
 837	 */
 838	req = container_of (_req, struct net2280_request, req);
 839	if (!_req || !_req->complete || !_req->buf
 840			|| !list_empty (&req->queue))
 841		return -EINVAL;
 842	if (_req->length > (~0 & DMA_BYTE_COUNT_MASK))
 843		return -EDOM;
 844	ep = container_of (_ep, struct net2280_ep, ep);
 845	if (!_ep || (!ep->desc && ep->num != 0))
 846		return -EINVAL;
 847	dev = ep->dev;
 848	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 849		return -ESHUTDOWN;
 850
 851	/* FIXME implement PIO fallback for ZLPs with DMA */
 852	if (ep->dma && _req->length == 0)
 853		return -EOPNOTSUPP;
 854
 855	/* set up dma mapping in case the caller didn't */
 856	if (ep->dma) {
 857		int ret;
 858
 859		ret = usb_gadget_map_request(&dev->gadget, _req,
 860				ep->is_in);
 861		if (ret)
 862			return ret;
 863	}
 864
 865#if 0
 866	VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
 867			_ep->name, _req, _req->length, _req->buf);
 868#endif
 869
 870	spin_lock_irqsave (&dev->lock, flags);
 871
 872	_req->status = -EINPROGRESS;
 873	_req->actual = 0;
 874
 875	/* kickstart this i/o queue? */
 876	if (list_empty (&ep->queue) && !ep->stopped) {
 877		/* use DMA if the endpoint supports it, else pio */
 878		if (ep->dma)
 879			start_dma (ep, req);
 880		else {
 881			/* maybe there's no control data, just status ack */
 882			if (ep->num == 0 && _req->length == 0) {
 883				allow_status (ep);
 884				done (ep, req, 0);
 885				VDEBUG (dev, "%s status ack\n", ep->ep.name);
 886				goto done;
 887			}
 888
 889			/* PIO ... stuff the fifo, or unblock it.  */
 890			if (ep->is_in)
 891				write_fifo (ep, _req);
 892			else if (list_empty (&ep->queue)) {
 893				u32	s;
 894
 895				/* OUT FIFO might have packet(s) buffered */
 896				s = readl (&ep->regs->ep_stat);
 897				if ((s & (1 << FIFO_EMPTY)) == 0) {
 898					/* note:  _req->short_not_ok is
 899					 * ignored here since PIO _always_
 900					 * stops queue advance here, and
 901					 * _req->status doesn't change for
 902					 * short reads (only _req->actual)
 903					 */
 904					if (read_fifo (ep, req)) {
 905						done (ep, req, 0);
 906						if (ep->num == 0)
 907							allow_status (ep);
 908						/* don't queue it */
 909						req = NULL;
 910					} else
 911						s = readl (&ep->regs->ep_stat);
 912				}
 913
 914				/* don't NAK, let the fifo fill */
 915				if (req && (s & (1 << NAK_OUT_PACKETS)))
 916					writel ((1 << CLEAR_NAK_OUT_PACKETS),
 917							&ep->regs->ep_rsp);
 918			}
 919		}
 920
 921	} else if (ep->dma) {
 922		int	valid = 1;
 923
 924		if (ep->is_in) {
 925			int	expect;
 926
 927			/* preventing magic zlps is per-engine state, not
 928			 * per-transfer; irq logic must recover hiccups.
 929			 */
 930			expect = likely (req->req.zero
 931				|| (req->req.length % ep->ep.maxpacket) != 0);
 932			if (expect != ep->in_fifo_validate)
 933				valid = 0;
 934		}
 935		queue_dma (ep, req, valid);
 936
 937	} /* else the irq handler advances the queue. */
 938
 939	ep->responded = 1;
 940	if (req)
 941		list_add_tail (&req->queue, &ep->queue);
 942done:
 943	spin_unlock_irqrestore (&dev->lock, flags);
 944
 945	/* pci writes may still be posted */
 946	return 0;
 947}
 948
 949static inline void
 950dma_done (
 951	struct net2280_ep *ep,
 952	struct net2280_request *req,
 953	u32 dmacount,
 954	int status
 955)
 956{
 957	req->req.actual = req->req.length - (DMA_BYTE_COUNT_MASK & dmacount);
 958	done (ep, req, status);
 959}
 960
 961static void restart_dma (struct net2280_ep *ep);
 962
 963static void scan_dma_completions (struct net2280_ep *ep)
 964{
 965	/* only look at descriptors that were "naturally" retired,
 966	 * so fifo and list head state won't matter
 967	 */
 968	while (!list_empty (&ep->queue)) {
 969		struct net2280_request	*req;
 970		u32			tmp;
 971
 972		req = list_entry (ep->queue.next,
 973				struct net2280_request, queue);
 974		if (!req->valid)
 975			break;
 976		rmb ();
 977		tmp = le32_to_cpup (&req->td->dmacount);
 978		if ((tmp & (1 << VALID_BIT)) != 0)
 979			break;
 980
 981		/* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
 982		 * cases where DMA must be aborted; this code handles
 983		 * all non-abort DMA completions.
 984		 */
 985		if (unlikely (req->td->dmadesc == 0)) {
 986			/* paranoia */
 987			tmp = readl (&ep->dma->dmacount);
 988			if (tmp & DMA_BYTE_COUNT_MASK)
 989				break;
 990			/* single transfer mode */
 991			dma_done (ep, req, tmp, 0);
 992			break;
 993		} else if (!ep->is_in
 994				&& (req->req.length % ep->ep.maxpacket) != 0) {
 995			tmp = readl (&ep->regs->ep_stat);
 996
 997			/* AVOID TROUBLE HERE by not issuing short reads from
 998			 * your gadget driver.  That helps avoids errata 0121,
 999			 * 0122, and 0124; not all cases trigger the warning.
1000			 */
1001			if ((tmp & (1 << NAK_OUT_PACKETS)) == 0) {
1002				WARNING (ep->dev, "%s lost packet sync!\n",
1003						ep->ep.name);
1004				req->req.status = -EOVERFLOW;
1005			} else if ((tmp = readl (&ep->regs->ep_avail)) != 0) {
1006				/* fifo gets flushed later */
1007				ep->out_overflow = 1;
1008				DEBUG (ep->dev, "%s dma, discard %d len %d\n",
1009						ep->ep.name, tmp,
1010						req->req.length);
1011				req->req.status = -EOVERFLOW;
1012			}
1013		}
1014		dma_done (ep, req, tmp, 0);
1015	}
1016}
1017
1018static void restart_dma (struct net2280_ep *ep)
1019{
1020	struct net2280_request	*req;
1021	u32			dmactl = dmactl_default;
1022
1023	if (ep->stopped)
1024		return;
1025	req = list_entry (ep->queue.next, struct net2280_request, queue);
1026
1027	if (!use_dma_chaining) {
1028		start_dma (ep, req);
1029		return;
1030	}
1031
1032	/* the 2280 will be processing the queue unless queue hiccups after
1033	 * the previous transfer:
1034	 *  IN:   wanted automagic zlp, head doesn't (or vice versa)
1035	 *        DMA_FIFO_VALIDATE doesn't init from dma descriptors.
1036	 *  OUT:  was "usb-short", we must restart.
1037	 */
1038	if (ep->is_in && !req->valid) {
1039		struct net2280_request	*entry, *prev = NULL;
1040		int			reqmode, done = 0;
1041
1042		DEBUG (ep->dev, "%s dma hiccup td %p\n", ep->ep.name, req->td);
1043		ep->in_fifo_validate = likely (req->req.zero
1044			|| (req->req.length % ep->ep.maxpacket) != 0);
1045		if (ep->in_fifo_validate)
1046			dmactl |= (1 << DMA_FIFO_VALIDATE);
1047		list_for_each_entry (entry, &ep->queue, queue) {
1048			__le32		dmacount;
1049
1050			if (entry == req)
1051				continue;
1052			dmacount = entry->td->dmacount;
1053			if (!done) {
1054				reqmode = likely (entry->req.zero
1055					|| (entry->req.length
1056						% ep->ep.maxpacket) != 0);
1057				if (reqmode == ep->in_fifo_validate) {
1058					entry->valid = 1;
1059					dmacount |= valid_bit;
1060					entry->td->dmacount = dmacount;
1061					prev = entry;
1062					continue;
1063				} else {
1064					/* force a hiccup */
1065					prev->td->dmacount |= dma_done_ie;
1066					done = 1;
1067				}
1068			}
1069
1070			/* walk the rest of the queue so unlinks behave */
1071			entry->valid = 0;
1072			dmacount &= ~valid_bit;
1073			entry->td->dmacount = dmacount;
1074			prev = entry;
1075		}
1076	}
1077
1078	writel (0, &ep->dma->dmactl);
1079	start_queue (ep, dmactl, req->td_dma);
1080}
1081
1082static void abort_dma (struct net2280_ep *ep)
1083{
1084	/* abort the current transfer */
1085	if (likely (!list_empty (&ep->queue))) {
1086		/* FIXME work around errata 0121, 0122, 0124 */
1087		writel ((1 << DMA_ABORT), &ep->dma->dmastat);
1088		spin_stop_dma (ep->dma);
1089	} else
1090		stop_dma (ep->dma);
1091	scan_dma_completions (ep);
1092}
1093
1094/* dequeue ALL requests */
1095static void nuke (struct net2280_ep *ep)
1096{
1097	struct net2280_request	*req;
1098
1099	/* called with spinlock held */
1100	ep->stopped = 1;
1101	if (ep->dma)
1102		abort_dma (ep);
1103	while (!list_empty (&ep->queue)) {
1104		req = list_entry (ep->queue.next,
1105				struct net2280_request,
1106				queue);
1107		done (ep, req, -ESHUTDOWN);
1108	}
1109}
1110
1111/* dequeue JUST ONE request */
1112static int net2280_dequeue (struct usb_ep *_ep, struct usb_request *_req)
1113{
1114	struct net2280_ep	*ep;
1115	struct net2280_request	*req;
1116	unsigned long		flags;
1117	u32			dmactl;
1118	int			stopped;
1119
1120	ep = container_of (_ep, struct net2280_ep, ep);
1121	if (!_ep || (!ep->desc && ep->num != 0) || !_req)
1122		return -EINVAL;
1123
1124	spin_lock_irqsave (&ep->dev->lock, flags);
1125	stopped = ep->stopped;
1126
1127	/* quiesce dma while we patch the queue */
1128	dmactl = 0;
1129	ep->stopped = 1;
1130	if (ep->dma) {
1131		dmactl = readl (&ep->dma->dmactl);
1132		/* WARNING erratum 0127 may kick in ... */
1133		stop_dma (ep->dma);
1134		scan_dma_completions (ep);
1135	}
1136
1137	/* make sure it's still queued on this endpoint */
1138	list_for_each_entry (req, &ep->queue, queue) {
1139		if (&req->req == _req)
1140			break;
1141	}
1142	if (&req->req != _req) {
1143		spin_unlock_irqrestore (&ep->dev->lock, flags);
1144		return -EINVAL;
1145	}
1146
1147	/* queue head may be partially complete. */
1148	if (ep->queue.next == &req->queue) {
1149		if (ep->dma) {
1150			DEBUG (ep->dev, "unlink (%s) dma\n", _ep->name);
1151			_req->status = -ECONNRESET;
1152			abort_dma (ep);
1153			if (likely (ep->queue.next == &req->queue)) {
1154				// NOTE: misreports single-transfer mode
1155				req->td->dmacount = 0;	/* invalidate */
1156				dma_done (ep, req,
1157					readl (&ep->dma->dmacount),
1158					-ECONNRESET);
1159			}
1160		} else {
1161			DEBUG (ep->dev, "unlink (%s) pio\n", _ep->name);
1162			done (ep, req, -ECONNRESET);
1163		}
1164		req = NULL;
1165
1166	/* patch up hardware chaining data */
1167	} else if (ep->dma && use_dma_chaining) {
1168		if (req->queue.prev == ep->queue.next) {
1169			writel (le32_to_cpu (req->td->dmadesc),
1170				&ep->dma->dmadesc);
1171			if (req->td->dmacount & dma_done_ie)
1172				writel (readl (&ep->dma->dmacount)
1173						| le32_to_cpu(dma_done_ie),
1174					&ep->dma->dmacount);
1175		} else {
1176			struct net2280_request	*prev;
1177
1178			prev = list_entry (req->queue.prev,
1179				struct net2280_request, queue);
1180			prev->td->dmadesc = req->td->dmadesc;
1181			if (req->td->dmacount & dma_done_ie)
1182				prev->td->dmacount |= dma_done_ie;
1183		}
1184	}
1185
1186	if (req)
1187		done (ep, req, -ECONNRESET);
1188	ep->stopped = stopped;
1189
1190	if (ep->dma) {
1191		/* turn off dma on inactive queues */
1192		if (list_empty (&ep->queue))
1193			stop_dma (ep->dma);
1194		else if (!ep->stopped) {
1195			/* resume current request, or start new one */
1196			if (req)
1197				writel (dmactl, &ep->dma->dmactl);
1198			else
1199				start_dma (ep, list_entry (ep->queue.next,
1200					struct net2280_request, queue));
1201		}
1202	}
1203
1204	spin_unlock_irqrestore (&ep->dev->lock, flags);
1205	return 0;
1206}
1207
1208/*-------------------------------------------------------------------------*/
1209
1210static int net2280_fifo_status (struct usb_ep *_ep);
1211
1212static int
1213net2280_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedged)
1214{
1215	struct net2280_ep	*ep;
1216	unsigned long		flags;
1217	int			retval = 0;
1218
1219	ep = container_of (_ep, struct net2280_ep, ep);
1220	if (!_ep || (!ep->desc && ep->num != 0))
1221		return -EINVAL;
1222	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1223		return -ESHUTDOWN;
1224	if (ep->desc /* not ep0 */ && (ep->desc->bmAttributes & 0x03)
1225						== USB_ENDPOINT_XFER_ISOC)
1226		return -EINVAL;
1227
1228	spin_lock_irqsave (&ep->dev->lock, flags);
1229	if (!list_empty (&ep->queue))
1230		retval = -EAGAIN;
1231	else if (ep->is_in && value && net2280_fifo_status (_ep) != 0)
1232		retval = -EAGAIN;
1233	else {
1234		VDEBUG (ep->dev, "%s %s %s\n", _ep->name,
1235				value ? "set" : "clear",
1236				wedged ? "wedge" : "halt");
1237		/* set/clear, then synch memory views with the device */
1238		if (value) {
1239			if (ep->num == 0)
1240				ep->dev->protocol_stall = 1;
1241			else
1242				set_halt (ep);
1243			if (wedged)
1244				ep->wedged = 1;
1245		} else {
1246			clear_halt (ep);
1247			ep->wedged = 0;
1248		}
1249		(void) readl (&ep->regs->ep_rsp);
1250	}
1251	spin_unlock_irqrestore (&ep->dev->lock, flags);
1252
1253	return retval;
1254}
1255
1256static int
1257net2280_set_halt(struct usb_ep *_ep, int value)
1258{
1259	return net2280_set_halt_and_wedge(_ep, value, 0);
1260}
1261
1262static int
1263net2280_set_wedge(struct usb_ep *_ep)
1264{
1265	if (!_ep || _ep->name == ep0name)
1266		return -EINVAL;
1267	return net2280_set_halt_and_wedge(_ep, 1, 1);
1268}
1269
1270static int
1271net2280_fifo_status (struct usb_ep *_ep)
1272{
1273	struct net2280_ep	*ep;
1274	u32			avail;
1275
1276	ep = container_of (_ep, struct net2280_ep, ep);
1277	if (!_ep || (!ep->desc && ep->num != 0))
1278		return -ENODEV;
1279	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1280		return -ESHUTDOWN;
1281
1282	avail = readl (&ep->regs->ep_avail) & ((1 << 12) - 1);
1283	if (avail > ep->fifo_size)
1284		return -EOVERFLOW;
1285	if (ep->is_in)
1286		avail = ep->fifo_size - avail;
1287	return avail;
1288}
1289
1290static void
1291net2280_fifo_flush (struct usb_ep *_ep)
1292{
1293	struct net2280_ep	*ep;
1294
1295	ep = container_of (_ep, struct net2280_ep, ep);
1296	if (!_ep || (!ep->desc && ep->num != 0))
1297		return;
1298	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1299		return;
1300
1301	writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
1302	(void) readl (&ep->regs->ep_rsp);
1303}
1304
1305static const struct usb_ep_ops net2280_ep_ops = {
1306	.enable		= net2280_enable,
1307	.disable	= net2280_disable,
1308
1309	.alloc_request	= net2280_alloc_request,
1310	.free_request	= net2280_free_request,
1311
1312	.queue		= net2280_queue,
1313	.dequeue	= net2280_dequeue,
1314
1315	.set_halt	= net2280_set_halt,
1316	.set_wedge	= net2280_set_wedge,
1317	.fifo_status	= net2280_fifo_status,
1318	.fifo_flush	= net2280_fifo_flush,
1319};
1320
1321/*-------------------------------------------------------------------------*/
1322
1323static int net2280_get_frame (struct usb_gadget *_gadget)
1324{
1325	struct net2280		*dev;
1326	unsigned long		flags;
1327	u16			retval;
1328
1329	if (!_gadget)
1330		return -ENODEV;
1331	dev = container_of (_gadget, struct net2280, gadget);
1332	spin_lock_irqsave (&dev->lock, flags);
1333	retval = get_idx_reg (dev->regs, REG_FRAME) & 0x03ff;
1334	spin_unlock_irqrestore (&dev->lock, flags);
1335	return retval;
1336}
1337
1338static int net2280_wakeup (struct usb_gadget *_gadget)
1339{
1340	struct net2280		*dev;
1341	u32			tmp;
1342	unsigned long		flags;
1343
1344	if (!_gadget)
1345		return 0;
1346	dev = container_of (_gadget, struct net2280, gadget);
1347
1348	spin_lock_irqsave (&dev->lock, flags);
1349	tmp = readl (&dev->usb->usbctl);
1350	if (tmp & (1 << DEVICE_REMOTE_WAKEUP_ENABLE))
1351		writel (1 << GENERATE_RESUME, &dev->usb->usbstat);
1352	spin_unlock_irqrestore (&dev->lock, flags);
1353
1354	/* pci writes may still be posted */
1355	return 0;
1356}
1357
1358static int net2280_set_selfpowered (struct usb_gadget *_gadget, int value)
1359{
1360	struct net2280		*dev;
1361	u32			tmp;
1362	unsigned long		flags;
1363
1364	if (!_gadget)
1365		return 0;
1366	dev = container_of (_gadget, struct net2280, gadget);
1367
1368	spin_lock_irqsave (&dev->lock, flags);
1369	tmp = readl (&dev->usb->usbctl);
1370	if (value)
1371		tmp |= (1 << SELF_POWERED_STATUS);
1372	else
1373		tmp &= ~(1 << SELF_POWERED_STATUS);
1374	writel (tmp, &dev->usb->usbctl);
1375	spin_unlock_irqrestore (&dev->lock, flags);
1376
1377	return 0;
1378}
1379
1380static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
1381{
1382	struct net2280  *dev;
1383	u32             tmp;
1384	unsigned long   flags;
1385
1386	if (!_gadget)
1387		return -ENODEV;
1388	dev = container_of (_gadget, struct net2280, gadget);
1389
1390	spin_lock_irqsave (&dev->lock, flags);
1391	tmp = readl (&dev->usb->usbctl);
1392	dev->softconnect = (is_on != 0);
1393	if (is_on)
1394		tmp |= (1 << USB_DETECT_ENABLE);
1395	else
1396		tmp &= ~(1 << USB_DETECT_ENABLE);
1397	writel (tmp, &dev->usb->usbctl);
1398	spin_unlock_irqrestore (&dev->lock, flags);
1399
1400	return 0;
1401}
1402
1403static int net2280_start(struct usb_gadget *_gadget,
1404		struct usb_gadget_driver *driver);
1405static int net2280_stop(struct usb_gadget *_gadget,
1406		struct usb_gadget_driver *driver);
1407
1408static const struct usb_gadget_ops net2280_ops = {
1409	.get_frame	= net2280_get_frame,
1410	.wakeup		= net2280_wakeup,
1411	.set_selfpowered = net2280_set_selfpowered,
1412	.pullup		= net2280_pullup,
1413	.udc_start	= net2280_start,
1414	.udc_stop	= net2280_stop,
1415};
1416
1417/*-------------------------------------------------------------------------*/
1418
1419#ifdef	CONFIG_USB_GADGET_DEBUG_FILES
1420
1421/* FIXME move these into procfs, and use seq_file.
1422 * Sysfs _still_ doesn't behave for arbitrarily sized files,
1423 * and also doesn't help products using this with 2.4 kernels.
1424 */
1425
1426/* "function" sysfs attribute */
1427static ssize_t function_show(struct device *_dev, struct device_attribute *attr,
1428			     char *buf)
1429{
1430	struct net2280	*dev = dev_get_drvdata (_dev);
1431
1432	if (!dev->driver
1433			|| !dev->driver->function
1434			|| strlen (dev->driver->function) > PAGE_SIZE)
1435		return 0;
1436	return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
1437}
1438static DEVICE_ATTR_RO(function);
1439
1440static ssize_t registers_show(struct device *_dev,
1441			      struct device_attribute *attr, char *buf)
1442{
1443	struct net2280		*dev;
1444	char			*next;
1445	unsigned		size, t;
1446	unsigned long		flags;
1447	int			i;
1448	u32			t1, t2;
1449	const char		*s;
1450
1451	dev = dev_get_drvdata (_dev);
1452	next = buf;
1453	size = PAGE_SIZE;
1454	spin_lock_irqsave (&dev->lock, flags);
1455
1456	if (dev->driver)
1457		s = dev->driver->driver.name;
1458	else
1459		s = "(none)";
1460
1461	/* Main Control Registers */
1462	t = scnprintf (next, size, "%s version " DRIVER_VERSION
1463			", chiprev %04x, dma %s\n\n"
1464			"devinit %03x fifoctl %08x gadget '%s'\n"
1465			"pci irqenb0 %02x irqenb1 %08x "
1466			"irqstat0 %04x irqstat1 %08x\n",
1467			driver_name, dev->chiprev,
1468			use_dma
1469				? (use_dma_chaining ? "chaining" : "enabled")
1470				: "disabled",
1471			readl (&dev->regs->devinit),
1472			readl (&dev->regs->fifoctl),
1473			s,
1474			readl (&dev->regs->pciirqenb0),
1475			readl (&dev->regs->pciirqenb1),
1476			readl (&dev->regs->irqstat0),
1477			readl (&dev->regs->irqstat1));
1478	size -= t;
1479	next += t;
1480
1481	/* USB Control Registers */
1482	t1 = readl (&dev->usb->usbctl);
1483	t2 = readl (&dev->usb->usbstat);
1484	if (t1 & (1 << VBUS_PIN)) {
1485		if (t2 & (1 << HIGH_SPEED))
1486			s = "high speed";
1487		else if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1488			s = "powered";
1489		else
1490			s = "full speed";
1491		/* full speed bit (6) not working?? */
1492	} else
1493			s = "not attached";
1494	t = scnprintf (next, size,
1495			"stdrsp %08x usbctl %08x usbstat %08x "
1496				"addr 0x%02x (%s)\n",
1497			readl (&dev->usb->stdrsp), t1, t2,
1498			readl (&dev->usb->ouraddr), s);
1499	size -= t;
1500	next += t;
1501
1502	/* PCI Master Control Registers */
1503
1504	/* DMA Control Registers */
1505
1506	/* Configurable EP Control Registers */
1507	for (i = 0; i < 7; i++) {
1508		struct net2280_ep	*ep;
1509
1510		ep = &dev->ep [i];
1511		if (i && !ep->desc)
1512			continue;
1513
1514		t1 = readl (&ep->regs->ep_cfg);
1515		t2 = readl (&ep->regs->ep_rsp) & 0xff;
1516		t = scnprintf (next, size,
1517				"\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
1518					"irqenb %02x\n",
1519				ep->ep.name, t1, t2,
1520				(t2 & (1 << CLEAR_NAK_OUT_PACKETS))
1521					? "NAK " : "",
1522				(t2 & (1 << CLEAR_EP_HIDE_STATUS_PHASE))
1523					? "hide " : "",
1524				(t2 & (1 << CLEAR_EP_FORCE_CRC_ERROR))
1525					? "CRC " : "",
1526				(t2 & (1 << CLEAR_INTERRUPT_MODE))
1527					? "interrupt " : "",
1528				(t2 & (1<<CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE))
1529					? "status " : "",
1530				(t2 & (1 << CLEAR_NAK_OUT_PACKETS_MODE))
1531					? "NAKmode " : "",
1532				(t2 & (1 << CLEAR_ENDPOINT_TOGGLE))
1533					? "DATA1 " : "DATA0 ",
1534				(t2 & (1 << CLEAR_ENDPOINT_HALT))
1535					? "HALT " : "",
1536				readl (&ep->regs->ep_irqenb));
1537		size -= t;
1538		next += t;
1539
1540		t = scnprintf (next, size,
1541				"\tstat %08x avail %04x "
1542				"(ep%d%s-%s)%s\n",
1543				readl (&ep->regs->ep_stat),
1544				readl (&ep->regs->ep_avail),
1545				t1 & 0x0f, DIR_STRING (t1),
1546				type_string (t1 >> 8),
1547				ep->stopped ? "*" : "");
1548		size -= t;
1549		next += t;
1550
1551		if (!ep->dma)
1552			continue;
1553
1554		t = scnprintf (next, size,
1555				"  dma\tctl %08x stat %08x count %08x\n"
1556				"\taddr %08x desc %08x\n",
1557				readl (&ep->dma->dmactl),
1558				readl (&ep->dma->dmastat),
1559				readl (&ep->dma->dmacount),
1560				readl (&ep->dma->dmaaddr),
1561				readl (&ep->dma->dmadesc));
1562		size -= t;
1563		next += t;
1564
1565	}
1566
1567	/* Indexed Registers */
1568		// none yet
1569
1570	/* Statistics */
1571	t = scnprintf (next, size, "\nirqs:  ");
1572	size -= t;
1573	next += t;
1574	for (i = 0; i < 7; i++) {
1575		struct net2280_ep	*ep;
1576
1577		ep = &dev->ep [i];
1578		if (i && !ep->irqs)
1579			continue;
1580		t = scnprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
1581		size -= t;
1582		next += t;
1583
1584	}
1585	t = scnprintf (next, size, "\n");
1586	size -= t;
1587	next += t;
1588
1589	spin_unlock_irqrestore (&dev->lock, flags);
1590
1591	return PAGE_SIZE - size;
1592}
1593static DEVICE_ATTR_RO(registers);
1594
1595static ssize_t queues_show(struct device *_dev, struct device_attribute *attr,
1596			   char *buf)
1597{
1598	struct net2280		*dev;
1599	char			*next;
1600	unsigned		size;
1601	unsigned long		flags;
1602	int			i;
1603
1604	dev = dev_get_drvdata (_dev);
1605	next = buf;
1606	size = PAGE_SIZE;
1607	spin_lock_irqsave (&dev->lock, flags);
1608
1609	for (i = 0; i < 7; i++) {
1610		struct net2280_ep		*ep = &dev->ep [i];
1611		struct net2280_request		*req;
1612		int				t;
1613
1614		if (i != 0) {
1615			const struct usb_endpoint_descriptor	*d;
1616
1617			d = ep->desc;
1618			if (!d)
1619				continue;
1620			t = d->bEndpointAddress;
1621			t = scnprintf (next, size,
1622				"\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
1623				ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
1624				(t & USB_DIR_IN) ? "in" : "out",
1625				({ char *val;
1626				 switch (d->bmAttributes & 0x03) {
1627				 case USB_ENDPOINT_XFER_BULK:
1628					val = "bulk"; break;
1629				 case USB_ENDPOINT_XFER_INT:
1630					val = "intr"; break;
1631				 default:
1632					val = "iso"; break;
1633				 } val; }),
1634				usb_endpoint_maxp (d) & 0x1fff,
1635				ep->dma ? "dma" : "pio", ep->fifo_size
1636				);
1637		} else /* ep0 should only have one transfer queued */
1638			t = scnprintf (next, size, "ep0 max 64 pio %s\n",
1639					ep->is_in ? "in" : "out");
1640		if (t <= 0 || t > size)
1641			goto done;
1642		size -= t;
1643		next += t;
1644
1645		if (list_empty (&ep->queue)) {
1646			t = scnprintf (next, size, "\t(nothing queued)\n");
1647			if (t <= 0 || t > size)
1648				goto done;
1649			size -= t;
1650			next += t;
1651			continue;
1652		}
1653		list_for_each_entry (req, &ep->queue, queue) {
1654			if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
1655				t = scnprintf (next, size,
1656					"\treq %p len %d/%d "
1657					"buf %p (dmacount %08x)\n",
1658					&req->req, req->req.actual,
1659					req->req.length, req->req.buf,
1660					readl (&ep->dma->dmacount));
1661			else
1662				t = scnprintf (next, size,
1663					"\treq %p len %d/%d buf %p\n",
1664					&req->req, req->req.actual,
1665					req->req.length, req->req.buf);
1666			if (t <= 0 || t > size)
1667				goto done;
1668			size -= t;
1669			next += t;
1670
1671			if (ep->dma) {
1672				struct net2280_dma	*td;
1673
1674				td = req->td;
1675				t = scnprintf (next, size, "\t    td %08x "
1676					" count %08x buf %08x desc %08x\n",
1677					(u32) req->td_dma,
1678					le32_to_cpu (td->dmacount),
1679					le32_to_cpu (td->dmaaddr),
1680					le32_to_cpu (td->dmadesc));
1681				if (t <= 0 || t > size)
1682					goto done;
1683				size -= t;
1684				next += t;
1685			}
1686		}
1687	}
1688
1689done:
1690	spin_unlock_irqrestore (&dev->lock, flags);
1691	return PAGE_SIZE - size;
1692}
1693static DEVICE_ATTR_RO(queues);
1694
1695
1696#else
1697
1698#define device_create_file(a,b)	(0)
1699#define device_remove_file(a,b)	do { } while (0)
1700
1701#endif
1702
1703/*-------------------------------------------------------------------------*/
1704
1705/* another driver-specific mode might be a request type doing dma
1706 * to/from another device fifo instead of to/from memory.
1707 */
1708
1709static void set_fifo_mode (struct net2280 *dev, int mode)
1710{
1711	/* keeping high bits preserves BAR2 */
1712	writel ((0xffff << PCI_BASE2_RANGE) | mode, &dev->regs->fifoctl);
1713
1714	/* always ep-{a,b,e,f} ... maybe not ep-c or ep-d */
1715	INIT_LIST_HEAD (&dev->gadget.ep_list);
1716	list_add_tail (&dev->ep [1].ep.ep_list, &dev->gadget.ep_list);
1717	list_add_tail (&dev->ep [2].ep.ep_list, &dev->gadget.ep_list);
1718	switch (mode) {
1719	case 0:
1720		list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1721		list_add_tail (&dev->ep [4].ep.ep_list, &dev->gadget.ep_list);
1722		dev->ep [1].fifo_size = dev->ep [2].fifo_size = 1024;
1723		break;
1724	case 1:
1725		dev->ep [1].fifo_size = dev->ep [2].fifo_size = 2048;
1726		break;
1727	case 2:
1728		list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1729		dev->ep [1].fifo_size = 2048;
1730		dev->ep [2].fifo_size = 1024;
1731		break;
1732	}
1733	/* fifo sizes for ep0, ep-c, ep-d, ep-e, and ep-f never change */
1734	list_add_tail (&dev->ep [5].ep.ep_list, &dev->gadget.ep_list);
1735	list_add_tail (&dev->ep [6].ep.ep_list, &dev->gadget.ep_list);
1736}
1737
1738/* keeping it simple:
1739 * - one bus driver, initted first;
1740 * - one function driver, initted second
1741 *
1742 * most of the work to support multiple net2280 controllers would
1743 * be to associate this gadget driver (yes?) with all of them, or
1744 * perhaps to bind specific drivers to specific devices.
1745 */
1746
1747static void usb_reset (struct net2280 *dev)
1748{
1749	u32	tmp;
1750
1751	dev->gadget.speed = USB_SPEED_UNKNOWN;
1752	(void) readl (&dev->usb->usbctl);
1753
1754	net2280_led_init (dev);
1755
1756	/* disable automatic responses, and irqs */
1757	writel (0, &dev->usb->stdrsp);
1758	writel (0, &dev->regs->pciirqenb0);
1759	writel (0, &dev->regs->pciirqenb1);
1760
1761	/* clear old dma and irq state */
1762	for (tmp = 0; tmp < 4; tmp++) {
1763		struct net2280_ep	*ep = &dev->ep [tmp + 1];
1764
1765		if (ep->dma)
1766			abort_dma (ep);
1767	}
1768	writel (~0, &dev->regs->irqstat0),
1769	writel (~(1 << SUSPEND_REQUEST_INTERRUPT), &dev->regs->irqstat1),
1770
1771	/* reset, and enable pci */
1772	tmp = readl (&dev->regs->devinit)
1773		| (1 << PCI_ENABLE)
1774		| (1 << FIFO_SOFT_RESET)
1775		| (1 << USB_SOFT_RESET)
1776		| (1 << M8051_RESET);
1777	writel (tmp, &dev->regs->devinit);
1778
1779	/* standard fifo and endpoint allocations */
1780	set_fifo_mode (dev, (fifo_mode <= 2) ? fifo_mode : 0);
1781}
1782
1783static void usb_reinit (struct net2280 *dev)
1784{
1785	u32	tmp;
1786	int	init_dma;
1787
1788	/* use_dma changes are ignored till next device re-init */
1789	init_dma = use_dma;
1790
1791	/* basic endpoint init */
1792	for (tmp = 0; tmp < 7; tmp++) {
1793		struct net2280_ep	*ep = &dev->ep [tmp];
1794
1795		ep->ep.name = ep_name [tmp];
1796		ep->dev = dev;
1797		ep->num = tmp;
1798
1799		if (tmp > 0 && tmp <= 4) {
1800			ep->fifo_size = 1024;
1801			if (init_dma)
1802				ep->dma = &dev->dma [tmp - 1];
1803		} else
1804			ep->fifo_size = 64;
1805		ep->regs = &dev->epregs [tmp];
1806		ep_reset (dev->regs, ep);
1807	}
1808	usb_ep_set_maxpacket_limit(&dev->ep [0].ep, 64);
1809	usb_ep_set_maxpacket_limit(&dev->ep [5].ep, 64);
1810	usb_ep_set_maxpacket_limit(&dev->ep [6].ep, 64);
1811
1812	dev->gadget.ep0 = &dev->ep [0].ep;
1813	dev->ep [0].stopped = 0;
1814	INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
1815
1816	/* we want to prevent lowlevel/insecure access from the USB host,
1817	 * but erratum 0119 means this enable bit is ignored
1818	 */
1819	for (tmp = 0; tmp < 5; tmp++)
1820		writel (EP_DONTUSE, &dev->dep [tmp].dep_cfg);
1821}
1822
1823static void ep0_start (struct net2280 *dev)
1824{
1825	writel (  (1 << CLEAR_EP_HIDE_STATUS_PHASE)
1826		| (1 << CLEAR_NAK_OUT_PACKETS)
1827		| (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
1828		, &dev->epregs [0].ep_rsp);
1829
1830	/*
1831	 * hardware optionally handles a bunch of standard requests
1832	 * that the API hides from drivers anyway.  have it do so.
1833	 * endpoint status/features are handled in software, to
1834	 * help pass tests for some dubious behavior.
1835	 */
1836	writel (  (1 << SET_TEST_MODE)
1837		| (1 << SET_ADDRESS)
1838		| (1 << DEVICE_SET_CLEAR_DEVICE_REMOTE_WAKEUP)
1839		| (1 << GET_DEVICE_STATUS)
1840		| (1 << GET_INTERFACE_STATUS)
1841		, &dev->usb->stdrsp);
1842	writel (  (1 << USB_ROOT_PORT_WAKEUP_ENABLE)
1843		| (1 << SELF_POWERED_USB_DEVICE)
1844		| (1 << REMOTE_WAKEUP_SUPPORT)
1845		| (dev->softconnect << USB_DETECT_ENABLE)
1846		| (1 << SELF_POWERED_STATUS)
1847		, &dev->usb->usbctl);
1848
1849	/* enable irqs so we can see ep0 and general operation  */
1850	writel (  (1 << SETUP_PACKET_INTERRUPT_ENABLE)
1851		| (1 << ENDPOINT_0_INTERRUPT_ENABLE)
1852		, &dev->regs->pciirqenb0);
1853	writel (  (1 << PCI_INTERRUPT_ENABLE)
1854		| (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT_ENABLE)
1855		| (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT_ENABLE)
1856		| (1 << PCI_RETRY_ABORT_INTERRUPT_ENABLE)
1857		| (1 << VBUS_INTERRUPT_ENABLE)
1858		| (1 << ROOT_PORT_RESET_INTERRUPT_ENABLE)
1859		| (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT_ENABLE)
1860		, &dev->regs->pciirqenb1);
1861
1862	/* don't leave any writes posted */
1863	(void) readl (&dev->usb->usbctl);
1864}
1865
1866/* when a driver is successfully registered, it will receive
1867 * control requests including set_configuration(), which enables
1868 * non-control requests.  then usb traffic follows until a
1869 * disconnect is reported.  then a host may connect again, or
1870 * the driver might get unbound.
1871 */
1872static int net2280_start(struct usb_gadget *_gadget,
1873		struct usb_gadget_driver *driver)
1874{
1875	struct net2280		*dev;
1876	int			retval;
1877	unsigned		i;
1878
1879	/* insist on high speed support from the driver, since
1880	 * (dev->usb->xcvrdiag & FORCE_FULL_SPEED_MODE)
1881	 * "must not be used in normal operation"
1882	 */
1883	if (!driver || driver->max_speed < USB_SPEED_HIGH
1884			|| !driver->setup)
1885		return -EINVAL;
1886
1887	dev = container_of (_gadget, struct net2280, gadget);
1888
1889	for (i = 0; i < 7; i++)
1890		dev->ep [i].irqs = 0;
1891
1892	/* hook up the driver ... */
1893	dev->softconnect = 1;
1894	driver->driver.bus = NULL;
1895	dev->driver = driver;
1896
1897	retval = device_create_file (&dev->pdev->dev, &dev_attr_function);
1898	if (retval) goto err_unbind;
1899	retval = device_create_file (&dev->pdev->dev, &dev_attr_queues);
1900	if (retval) goto err_func;
1901
1902	/* Enable force-full-speed testing mode, if desired */
1903	if (full_speed)
1904		writel(1 << FORCE_FULL_SPEED_MODE, &dev->usb->xcvrdiag);
1905
1906	/* ... then enable host detection and ep0; and we're ready
1907	 * for set_configuration as well as eventual disconnect.
1908	 */
1909	net2280_led_active (dev, 1);
1910	ep0_start (dev);
1911
1912	DEBUG (dev, "%s ready, usbctl %08x stdrsp %08x\n",
1913			driver->driver.name,
1914			readl (&dev->usb->usbctl),
1915			readl (&dev->usb->stdrsp));
1916
1917	/* pci writes may still be posted */
1918	return 0;
1919
1920err_func:
1921	device_remove_file (&dev->pdev->dev, &dev_attr_function);
1922err_unbind:
1923	dev->driver = NULL;
1924	return retval;
1925}
1926
1927static void
1928stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
1929{
1930	int			i;
1931
1932	/* don't disconnect if it's not connected */
1933	if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1934		driver = NULL;
1935
1936	/* stop hardware; prevent new request submissions;
1937	 * and kill any outstanding requests.
1938	 */
1939	usb_reset (dev);
1940	for (i = 0; i < 7; i++)
1941		nuke (&dev->ep [i]);
1942
1943	/* report disconnect; the driver is already quiesced */
1944	if (driver) {
1945		spin_unlock(&dev->lock);
1946		driver->disconnect(&dev->gadget);
1947		spin_lock(&dev->lock);
1948	}
1949
1950	usb_reinit (dev);
1951}
1952
1953static int net2280_stop(struct usb_gadget *_gadget,
1954		struct usb_gadget_driver *driver)
1955{
1956	struct net2280	*dev;
1957	unsigned long	flags;
1958
1959	dev = container_of (_gadget, struct net2280, gadget);
1960
1961	spin_lock_irqsave (&dev->lock, flags);
1962	stop_activity (dev, driver);
1963	spin_unlock_irqrestore (&dev->lock, flags);
1964
1965	dev->driver = NULL;
1966
1967	net2280_led_active (dev, 0);
1968
1969	/* Disable full-speed test mode */
1970	writel(0, &dev->usb->xcvrdiag);
1971
1972	device_remove_file (&dev->pdev->dev, &dev_attr_function);
1973	device_remove_file (&dev->pdev->dev, &dev_attr_queues);
1974
1975	DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
1976	return 0;
1977}
1978
1979/*-------------------------------------------------------------------------*/
1980
1981/* handle ep0, ep-e, ep-f with 64 byte packets: packet per irq.
1982 * also works for dma-capable endpoints, in pio mode or just
1983 * to manually advance the queue after short OUT transfers.
1984 */
1985static void handle_ep_small (struct net2280_ep *ep)
1986{
1987	struct net2280_request	*req;
1988	u32			t;
1989	/* 0 error, 1 mid-data, 2 done */
1990	int			mode = 1;
1991
1992	if (!list_empty (&ep->queue))
1993		req = list_entry (ep->queue.next,
1994			struct net2280_request, queue);
1995	else
1996		req = NULL;
1997
1998	/* ack all, and handle what we care about */
1999	t = readl (&ep->regs->ep_stat);
2000	ep->irqs++;
2001#if 0
2002	VDEBUG (ep->dev, "%s ack ep_stat %08x, req %p\n",
2003			ep->ep.name, t, req ? &req->req : 0);
2004#endif
2005	if (!ep->is_in || ep->dev->pdev->device == 0x2280)
2006		writel (t & ~(1 << NAK_OUT_PACKETS), &ep->regs->ep_stat);
2007	else
2008		/* Added for 2282 */
2009		writel (t, &ep->regs->ep_stat);
2010
2011	/* for ep0, monitor token irqs to catch data stage length errors
2012	 * and to synchronize on status.
2013	 *
2014	 * also, to defer reporting of protocol stalls ... here's where
2015	 * data or status first appears, handling stalls here should never
2016	 * cause trouble on the host side..
2017	 *
2018	 * control requests could be slightly faster without token synch for
2019	 * status, but status can jam up that way.
2020	 */
2021	if (unlikely (ep->num == 0)) {
2022		if (ep->is_in) {
2023			/* status; stop NAKing */
2024			if (t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)) {
2025				if (ep->dev->protocol_stall) {
2026					ep->stopped = 1;
2027					set_halt (ep);
2028				}
2029				if (!req)
2030					allow_status (ep);
2031				mode = 2;
2032			/* reply to extra IN data tokens with a zlp */
2033			} else if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2034				if (ep->dev->protocol_stall) {
2035					ep->stopped = 1;
2036					set_halt (ep);
2037					mode = 2;
2038				} else if (ep->responded &&
2039						!req && !ep->stopped)
2040					write_fifo (ep, NULL);
2041			}
2042		} else {
2043			/* status; stop NAKing */
2044			if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2045				if (ep->dev->protocol_stall) {
2046					ep->stopped = 1;
2047					set_halt (ep);
2048				}
2049				mode = 2;
2050			/* an extra OUT token is an error */
2051			} else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
2052					&& req
2053					&& req->req.actual == req->req.length)
2054					|| (ep->responded && !req)) {
2055				ep->dev->protocol_stall = 1;
2056				set_halt (ep);
2057				ep->stopped = 1;
2058				if (req)
2059					done (ep, req, -EOVERFLOW);
2060				req = NULL;
2061			}
2062		}
2063	}
2064
2065	if (unlikely (!req))
2066		return;
2067
2068	/* manual DMA queue advance after short OUT */
2069	if (likely (ep->dma)) {
2070		if (t & (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)) {
2071			u32	count;
2072			int	stopped = ep->stopped;
2073
2074			/* TRANSFERRED works around OUT_DONE erratum 0112.
2075			 * we expect (N <= maxpacket) bytes; host wrote M.
2076			 * iff (M < N) we won't ever see a DMA interrupt.
2077			 */
2078			ep->stopped = 1;
2079			for (count = 0; ; t = readl (&ep->regs->ep_stat)) {
2080
2081				/* any preceding dma transfers must finish.
2082				 * dma handles (M >= N), may empty the queue
2083				 */
2084				scan_dma_completions (ep);
2085				if (unlikely (list_empty (&ep->queue)
2086						|| ep->out_overflow)) {
2087					req = NULL;
2088					break;
2089				}
2090				req = list_entry (ep->queue.next,
2091					struct net2280_request, queue);
2092
2093				/* here either (M < N), a "real" short rx;
2094				 * or (M == N) and the queue didn't empty
2095				 */
2096				if (likely (t & (1 << FIFO_EMPTY))) {
2097					count = readl (&ep->dma->dmacount);
2098					count &= DMA_BYTE_COUNT_MASK;
2099					if (readl (&ep->dma->dmadesc)
2100							!= req->td_dma)
2101						req = NULL;
2102					break;
2103				}
2104				udelay(1);
2105			}
2106
2107			/* stop DMA, leave ep NAKing */
2108			writel ((1 << DMA_ABORT), &ep->dma->dmastat);
2109			spin_stop_dma (ep->dma);
2110
2111			if (likely (req)) {
2112				req->td->dmacount = 0;
2113				t = readl (&ep->regs->ep_avail);
2114				dma_done (ep, req, count,
2115					(ep->out_overflow || t)
2116						? -EOVERFLOW : 0);
2117			}
2118
2119			/* also flush to prevent erratum 0106 trouble */
2120			if (unlikely (ep->out_overflow
2121					|| (ep->dev->chiprev == 0x0100
2122						&& ep->dev->gadget.speed
2123							== USB_SPEED_FULL))) {
2124				out_flush (ep);
2125				ep->out_overflow = 0;
2126			}
2127
2128			/* (re)start dma if needed, stop NAKing */
2129			ep->stopped = stopped;
2130			if (!list_empty (&ep->queue))
2131				restart_dma (ep);
2132		} else
2133			DEBUG (ep->dev, "%s dma ep_stat %08x ??\n",
2134					ep->ep.name, t);
2135		return;
2136
2137	/* data packet(s) received (in the fifo, OUT) */
2138	} else if (t & (1 << DATA_PACKET_RECEIVED_INTERRUPT)) {
2139		if (read_fifo (ep, req) && ep->num != 0)
2140			mode = 2;
2141
2142	/* data packet(s) transmitted (IN) */
2143	} else if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)) {
2144		unsigned	len;
2145
2146		len = req->req.length - req->req.actual;
2147		if (len > ep->ep.maxpacket)
2148			len = ep->ep.maxpacket;
2149		req->req.actual += len;
2150
2151		/* if we wrote it all, we're usually done */
2152		if (req->req.actual == req->req.length) {
2153			if (ep->num == 0) {
2154				/* send zlps until the status stage */
2155			} else if (!req->req.zero || len != ep->ep.maxpacket)
2156				mode = 2;
2157		}
2158
2159	/* there was nothing to do ...  */
2160	} else if (mode == 1)
2161		return;
2162
2163	/* done */
2164	if (mode == 2) {
2165		/* stream endpoints often resubmit/unlink in completion */
2166		done (ep, req, 0);
2167
2168		/* maybe advance queue to next request */
2169		if (ep->num == 0) {
2170			/* NOTE:  net2280 could let gadget driver start the
2171			 * status stage later. since not all controllers let
2172			 * them control that, the api doesn't (yet) allow it.
2173			 */
2174			if (!ep->stopped)
2175				allow_status (ep);
2176			req = NULL;
2177		} else {
2178			if (!list_empty (&ep->queue) && !ep->stopped)
2179				req = list_entry (ep->queue.next,
2180					struct net2280_request, queue);
2181			else
2182				req = NULL;
2183			if (req && !ep->is_in)
2184				stop_out_naking (ep);
2185		}
2186	}
2187
2188	/* is there a buffer for the next packet?
2189	 * for best streaming performance, make sure there is one.
2190	 */
2191	if (req && !ep->stopped) {
2192
2193		/* load IN fifo with next packet (may be zlp) */
2194		if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT))
2195			write_fifo (ep, &req->req);
2196	}
2197}
2198
2199static struct net2280_ep *
2200get_ep_by_addr (struct net2280 *dev, u16 wIndex)
2201{
2202	struct net2280_ep	*ep;
2203
2204	if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
2205		return &dev->ep [0];
2206	list_for_each_entry (ep, &dev->gadget.ep_list, ep.ep_list) {
2207		u8	bEndpointAddress;
2208
2209		if (!ep->desc)
2210			continue;
2211		bEndpointAddress = ep->desc->bEndpointAddress;
2212		if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
2213			continue;
2214		if ((wIndex & 0x0f) == (bEndpointAddress & 0x0f))
2215			return ep;
2216	}
2217	return NULL;
2218}
2219
2220static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
2221{
2222	struct net2280_ep	*ep;
2223	u32			num, scratch;
2224
2225	/* most of these don't need individual acks */
2226	stat &= ~(1 << INTA_ASSERTED);
2227	if (!stat)
2228		return;
2229	// DEBUG (dev, "irqstat0 %04x\n", stat);
2230
2231	/* starting a control request? */
2232	if (unlikely (stat & (1 << SETUP_PACKET_INTERRUPT))) {
2233		union {
2234			u32			raw [2];
2235			struct usb_ctrlrequest	r;
2236		} u;
2237		int				tmp;
2238		struct net2280_request		*req;
2239
2240		if (dev->gadget.speed == USB_SPEED_UNKNOWN) {
2241			if (readl (&dev->usb->usbstat) & (1 << HIGH_SPEED))
2242				dev->gadget.speed = USB_SPEED_HIGH;
2243			else
2244				dev->gadget.speed = USB_SPEED_FULL;
2245			net2280_led_speed (dev, dev->gadget.speed);
2246			DEBUG(dev, "%s\n", usb_speed_string(dev->gadget.speed));
2247		}
2248
2249		ep = &dev->ep [0];
2250		ep->irqs++;
2251
2252		/* make sure any leftover request state is cleared */
2253		stat &= ~(1 << ENDPOINT_0_INTERRUPT);
2254		while (!list_empty (&ep->queue)) {
2255			req = list_entry (ep->queue.next,
2256					struct net2280_request, queue);
2257			done (ep, req, (req->req.actual == req->req.length)
2258						? 0 : -EPROTO);
2259		}
2260		ep->stopped = 0;
2261		dev->protocol_stall = 0;
2262
2263		if (ep->dev->pdev->device == 0x2280)
2264			tmp = (1 << FIFO_OVERFLOW)
2265				| (1 << FIFO_UNDERFLOW);
2266		else
2267			tmp = 0;
2268
2269		writel (tmp | (1 << TIMEOUT)
2270			| (1 << USB_STALL_SENT)
2271			| (1 << USB_IN_NAK_SENT)
2272			| (1 << USB_IN_ACK_RCVD)
2273			| (1 << USB_OUT_PING_NAK_SENT)
2274			| (1 << USB_OUT_ACK_SENT)
2275			| (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
2276			| (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
2277			| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2278			| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2279			| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2280			| (1 << DATA_IN_TOKEN_INTERRUPT)
2281			, &ep->regs->ep_stat);
2282		u.raw [0] = readl (&dev->usb->setup0123);
2283		u.raw [1] = readl (&dev->usb->setup4567);
2284
2285		cpu_to_le32s (&u.raw [0]);
2286		cpu_to_le32s (&u.raw [1]);
2287
2288		tmp = 0;
2289
2290#define	w_value		le16_to_cpu(u.r.wValue)
2291#define	w_index		le16_to_cpu(u.r.wIndex)
2292#define	w_length	le16_to_cpu(u.r.wLength)
2293
2294		/* ack the irq */
2295		writel (1 << SETUP_PACKET_INTERRUPT, &dev->regs->irqstat0);
2296		stat ^= (1 << SETUP_PACKET_INTERRUPT);
2297
2298		/* watch control traffic at the token level, and force
2299		 * synchronization before letting the status stage happen.
2300		 * FIXME ignore tokens we'll NAK, until driver responds.
2301		 * that'll mean a lot less irqs for some drivers.
2302		 */
2303		ep->is_in = (u.r.bRequestType & USB_DIR_IN) != 0;
2304		if (ep->is_in) {
2305			scratch = (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2306				| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2307				| (1 << DATA_IN_TOKEN_INTERRUPT);
2308			stop_out_naking (ep);
2309		} else
2310			scratch = (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2311				| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2312				| (1 << DATA_IN_TOKEN_INTERRUPT);
2313		writel (scratch, &dev->epregs [0].ep_irqenb);
2314
2315		/* we made the hardware handle most lowlevel requests;
2316		 * everything else goes uplevel to the gadget code.
2317		 */
2318		ep->responded = 1;
2319		switch (u.r.bRequest) {
2320		case USB_REQ_GET_STATUS: {
2321			struct net2280_ep	*e;
2322			__le32			status;
2323
2324			/* hw handles device and interface status */
2325			if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
2326				goto delegate;
2327			if ((e = get_ep_by_addr (dev, w_index)) == NULL
2328					|| w_length > 2)
2329				goto do_stall;
2330
2331			if (readl (&e->regs->ep_rsp)
2332					& (1 << SET_ENDPOINT_HALT))
2333				status = cpu_to_le32 (1);
2334			else
2335				status = cpu_to_le32 (0);
2336
2337			/* don't bother with a request object! */
2338			writel (0, &dev->epregs [0].ep_irqenb);
2339			set_fifo_bytecount (ep, w_length);
2340			writel ((__force u32)status, &dev->epregs [0].ep_data);
2341			allow_status (ep);
2342			VDEBUG (dev, "%s stat %02x\n", ep->ep.name, status);
2343			goto next_endpoints;
2344			}
2345			break;
2346		case USB_REQ_CLEAR_FEATURE: {
2347			struct net2280_ep	*e;
2348
2349			/* hw handles device features */
2350			if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2351				goto delegate;
2352			if (w_value != USB_ENDPOINT_HALT
2353					|| w_length != 0)
2354				goto do_stall;
2355			if ((e = get_ep_by_addr (dev, w_index)) == NULL)
2356				goto do_stall;
2357			if (e->wedged) {
2358				VDEBUG(dev, "%s wedged, halt not cleared\n",
2359						ep->ep.name);
2360			} else {
2361				VDEBUG(dev, "%s clear halt\n", ep->ep.name);
2362				clear_halt(e);
2363			}
2364			allow_status (ep);
2365			goto next_endpoints;
2366			}
2367			break;
2368		case USB_REQ_SET_FEATURE: {
2369			struct net2280_ep	*e;
2370
2371			/* hw handles device features */
2372			if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2373				goto delegate;
2374			if (w_value != USB_ENDPOINT_HALT
2375					|| w_length != 0)
2376				goto do_stall;
2377			if ((e = get_ep_by_addr (dev, w_index)) == NULL)
2378				goto do_stall;
2379			if (e->ep.name == ep0name)
2380				goto do_stall;
2381			set_halt (e);
2382			allow_status (ep);
2383			VDEBUG (dev, "%s set halt\n", ep->ep.name);
2384			goto next_endpoints;
2385			}
2386			break;
2387		default:
2388delegate:
2389			VDEBUG (dev, "setup %02x.%02x v%04x i%04x l%04x "
2390				"ep_cfg %08x\n",
2391				u.r.bRequestType, u.r.bRequest,
2392				w_value, w_index, w_length,
2393				readl (&ep->regs->ep_cfg));
2394			ep->responded = 0;
2395			spin_unlock (&dev->lock);
2396			tmp = dev->driver->setup (&dev->gadget, &u.r);
2397			spin_lock (&dev->lock);
2398		}
2399
2400		/* stall ep0 on error */
2401		if (tmp < 0) {
2402do_stall:
2403			VDEBUG (dev, "req %02x.%02x protocol STALL; stat %d\n",
2404					u.r.bRequestType, u.r.bRequest, tmp);
2405			dev->protocol_stall = 1;
2406		}
2407
2408		/* some in/out token irq should follow; maybe stall then.
2409		 * driver must queue a request (even zlp) or halt ep0
2410		 * before the host times out.
2411		 */
2412	}
2413
2414#undef	w_value
2415#undef	w_index
2416#undef	w_length
2417
2418next_endpoints:
2419	/* endpoint data irq ? */
2420	scratch = stat & 0x7f;
2421	stat &= ~0x7f;
2422	for (num = 0; scratch; num++) {
2423		u32		t;
2424
2425		/* do this endpoint's FIFO and queue need tending? */
2426		t = 1 << num;
2427		if ((scratch & t) == 0)
2428			continue;
2429		scratch ^= t;
2430
2431		ep = &dev->ep [num];
2432		handle_ep_small (ep);
2433	}
2434
2435	if (stat)
2436		DEBUG (dev, "unhandled irqstat0 %08x\n", stat);
2437}
2438
2439#define DMA_INTERRUPTS ( \
2440		  (1 << DMA_D_INTERRUPT) \
2441		| (1 << DMA_C_INTERRUPT) \
2442		| (1 << DMA_B_INTERRUPT) \
2443		| (1 << DMA_A_INTERRUPT))
2444#define	PCI_ERROR_INTERRUPTS ( \
2445		  (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT) \
2446		| (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT) \
2447		| (1 << PCI_RETRY_ABORT_INTERRUPT))
2448
2449static void handle_stat1_irqs (struct net2280 *dev, u32 stat)
2450{
2451	struct net2280_ep	*ep;
2452	u32			tmp, num, mask, scratch;
2453
2454	/* after disconnect there's nothing else to do! */
2455	tmp = (1 << VBUS_INTERRUPT) | (1 << ROOT_PORT_RESET_INTERRUPT);
2456	mask = (1 << HIGH_SPEED) | (1 << FULL_SPEED);
2457
2458	/* VBUS disconnect is indicated by VBUS_PIN and VBUS_INTERRUPT set.
2459	 * Root Port Reset is indicated by ROOT_PORT_RESET_INTERRUPT set and
2460	 * both HIGH_SPEED and FULL_SPEED clear (as ROOT_PORT_RESET_INTERRUPT
2461	 * only indicates a change in the reset state).
2462	 */
2463	if (stat & tmp) {
2464		writel (tmp, &dev->regs->irqstat1);
2465		if ((((stat & (1 << ROOT_PORT_RESET_INTERRUPT))
2466					&& ((readl (&dev->usb->usbstat) & mask)
2467							== 0))
2468				|| ((readl (&dev->usb->usbctl)
2469					& (1 << VBUS_PIN)) == 0)
2470			    ) && ( dev->gadget.speed != USB_SPEED_UNKNOWN)) {
2471			DEBUG (dev, "disconnect %s\n",
2472					dev->driver->driver.name);
2473			stop_activity (dev, dev->driver);
2474			ep0_start (dev);
2475			return;
2476		}
2477		stat &= ~tmp;
2478
2479		/* vBUS can bounce ... one of many reasons to ignore the
2480		 * notion of hotplug events on bus connect/disconnect!
2481		 */
2482		if (!stat)
2483			return;
2484	}
2485
2486	/* NOTE: chip stays in PCI D0 state for now, but it could
2487	 * enter D1 to save more power
2488	 */
2489	tmp = (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT);
2490	if (stat & tmp) {
2491		writel (tmp, &dev->regs->irqstat1);
2492		if (stat & (1 << SUSPEND_REQUEST_INTERRUPT)) {
2493			if (dev->driver->suspend)
2494				dev->driver->suspend (&dev->gadget);
2495			if (!enable_suspend)
2496				stat &= ~(1 << SUSPEND_REQUEST_INTERRUPT);
2497		} else {
2498			if (dev->driver->resume)
2499				dev->driver->resume (&dev->gadget);
2500			/* at high speed, note erratum 0133 */
2501		}
2502		stat &= ~tmp;
2503	}
2504
2505	/* clear any other status/irqs */
2506	if (stat)
2507		writel (stat, &dev->regs->irqstat1);
2508
2509	/* some status we can just ignore */
2510	if (dev->pdev->device == 0x2280)
2511		stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2512			  | (1 << SUSPEND_REQUEST_INTERRUPT)
2513			  | (1 << RESUME_INTERRUPT)
2514			  | (1 << SOF_INTERRUPT));
2515	else
2516		stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2517			  | (1 << RESUME_INTERRUPT)
2518			  | (1 << SOF_DOWN_INTERRUPT)
2519			  | (1 << SOF_INTERRUPT));
2520
2521	if (!stat)
2522		return;
2523	// DEBUG (dev, "irqstat1 %08x\n", stat);
2524
2525	/* DMA status, for ep-{a,b,c,d} */
2526	scratch = stat & DMA_INTERRUPTS;
2527	stat &= ~DMA_INTERRUPTS;
2528	scratch >>= 9;
2529	for (num = 0; scratch; num++) {
2530		struct net2280_dma_regs	__iomem *dma;
2531
2532		tmp = 1 << num;
2533		if ((tmp & scratch) == 0)
2534			continue;
2535		scratch ^= tmp;
2536
2537		ep = &dev->ep [num + 1];
2538		dma = ep->dma;
2539
2540		if (!dma)
2541			continue;
2542
2543		/* clear ep's dma status */
2544		tmp = readl (&dma->dmastat);
2545		writel (tmp, &dma->dmastat);
2546
2547		/* chaining should stop on abort, short OUT from fifo,
2548		 * or (stat0 codepath) short OUT transfer.
2549		 */
2550		if (!use_dma_chaining) {
2551			if ((tmp & (1 << DMA_TRANSACTION_DONE_INTERRUPT))
2552					== 0) {
2553				DEBUG (ep->dev, "%s no xact done? %08x\n",
2554					ep->ep.name, tmp);
2555				continue;
2556			}
2557			stop_dma (ep->dma);
2558		}
2559
2560		/* OUT transfers terminate when the data from the
2561		 * host is in our memory.  Process whatever's done.
2562		 * On this path, we know transfer's last packet wasn't
2563		 * less than req->length. NAK_OUT_PACKETS may be set,
2564		 * or the FIFO may already be holding new packets.
2565		 *
2566		 * IN transfers can linger in the FIFO for a very
2567		 * long time ... we ignore that for now, accounting
2568		 * precisely (like PIO does) needs per-packet irqs
2569		 */
2570		scan_dma_completions (ep);
2571
2572		/* disable dma on inactive queues; else maybe restart */
2573		if (list_empty (&ep->queue)) {
2574			if (use_dma_chaining)
2575				stop_dma (ep->dma);
2576		} else {
2577			tmp = readl (&dma->dmactl);
2578			if (!use_dma_chaining
2579					|| (tmp & (1 << DMA_ENABLE)) == 0)
2580				restart_dma (ep);
2581			else if (ep->is_in && use_dma_chaining) {
2582				struct net2280_request	*req;
2583				__le32			dmacount;
2584
2585				/* the descriptor at the head of the chain
2586				 * may still have VALID_BIT clear; that's
2587				 * used to trigger changing DMA_FIFO_VALIDATE
2588				 * (affects automagic zlp writes).
2589				 */
2590				req = list_entry (ep->queue.next,
2591						struct net2280_request, queue);
2592				dmacount = req->td->dmacount;
2593				dmacount &= cpu_to_le32 (
2594						(1 << VALID_BIT)
2595						| DMA_BYTE_COUNT_MASK);
2596				if (dmacount && (dmacount & valid_bit) == 0)
2597					restart_dma (ep);
2598			}
2599		}
2600		ep->irqs++;
2601	}
2602
2603	/* NOTE:  there are other PCI errors we might usefully notice.
2604	 * if they appear very often, here's where to try recovering.
2605	 */
2606	if (stat & PCI_ERROR_INTERRUPTS) {
2607		ERROR (dev, "pci dma error; stat %08x\n", stat);
2608		stat &= ~PCI_ERROR_INTERRUPTS;
2609		/* these are fatal errors, but "maybe" they won't
2610		 * happen again ...
2611		 */
2612		stop_activity (dev, dev->driver);
2613		ep0_start (dev);
2614		stat = 0;
2615	}
2616
2617	if (stat)
2618		DEBUG (dev, "unhandled irqstat1 %08x\n", stat);
2619}
2620
2621static irqreturn_t net2280_irq (int irq, void *_dev)
2622{
2623	struct net2280		*dev = _dev;
2624
2625	/* shared interrupt, not ours */
2626	if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
2627		return IRQ_NONE;
2628
2629	spin_lock (&dev->lock);
2630
2631	/* handle disconnect, dma, and more */
2632	handle_stat1_irqs (dev, readl (&dev->regs->irqstat1));
2633
2634	/* control requests and PIO */
2635	handle_stat0_irqs (dev, readl (&dev->regs->irqstat0));
2636
2637	spin_unlock (&dev->lock);
2638
2639	return IRQ_HANDLED;
2640}
2641
2642/*-------------------------------------------------------------------------*/
2643
2644static void gadget_release (struct device *_dev)
2645{
2646	struct net2280	*dev = dev_get_drvdata (_dev);
2647
2648	kfree (dev);
2649}
2650
2651/* tear down the binding between this driver and the pci device */
2652
2653static void net2280_remove (struct pci_dev *pdev)
2654{
2655	struct net2280		*dev = pci_get_drvdata (pdev);
2656
2657	usb_del_gadget_udc(&dev->gadget);
2658
2659	BUG_ON(dev->driver);
2660
2661	/* then clean up the resources we allocated during probe() */
2662	net2280_led_shutdown (dev);
2663	if (dev->requests) {
2664		int		i;
2665		for (i = 1; i < 5; i++) {
2666			if (!dev->ep [i].dummy)
2667				continue;
2668			pci_pool_free (dev->requests, dev->ep [i].dummy,
2669					dev->ep [i].td_dma);
2670		}
2671		pci_pool_destroy (dev->requests);
2672	}
2673	if (dev->got_irq)
2674		free_irq (pdev->irq, dev);
2675	if (dev->regs)
2676		iounmap (dev->regs);
2677	if (dev->region)
2678		release_mem_region (pci_resource_start (pdev, 0),
2679				pci_resource_len (pdev, 0));
2680	if (dev->enabled)
2681		pci_disable_device (pdev);
2682	device_remove_file (&pdev->dev, &dev_attr_registers);
2683
2684	INFO (dev, "unbind\n");
2685}
2686
2687/* wrap this driver around the specified device, but
2688 * don't respond over USB until a gadget driver binds to us.
2689 */
2690
2691static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
2692{
2693	struct net2280		*dev;
2694	unsigned long		resource, len;
2695	void			__iomem *base = NULL;
2696	int			retval, i;
2697
2698	/* alloc, and start init */
2699	dev = kzalloc (sizeof *dev, GFP_KERNEL);
2700	if (dev == NULL){
2701		retval = -ENOMEM;
2702		goto done;
2703	}
2704
2705	pci_set_drvdata (pdev, dev);
2706	spin_lock_init (&dev->lock);
2707	dev->pdev = pdev;
2708	dev->gadget.ops = &net2280_ops;
2709	dev->gadget.max_speed = USB_SPEED_HIGH;
2710
2711	/* the "gadget" abstracts/virtualizes the controller */
2712	dev->gadget.name = driver_name;
2713
2714	/* now all the pci goodies ... */
2715	if (pci_enable_device (pdev) < 0) {
2716	        retval = -ENODEV;
2717		goto done;
2718	}
2719	dev->enabled = 1;
2720
2721	/* BAR 0 holds all the registers
2722	 * BAR 1 is 8051 memory; unused here (note erratum 0103)
2723	 * BAR 2 is fifo memory; unused here
2724	 */
2725	resource = pci_resource_start (pdev, 0);
2726	len = pci_resource_len (pdev, 0);
2727	if (!request_mem_region (resource, len, driver_name)) {
2728		DEBUG (dev, "controller already in use\n");
2729		retval = -EBUSY;
2730		goto done;
2731	}
2732	dev->region = 1;
2733
2734	/* FIXME provide firmware download interface to put
2735	 * 8051 code into the chip, e.g. to turn on PCI PM.
2736	 */
2737
2738	base = ioremap_nocache (resource, len);
2739	if (base == NULL) {
2740		DEBUG (dev, "can't map memory\n");
2741		retval = -EFAULT;
2742		goto done;
2743	}
2744	dev->regs = (struct net2280_regs __iomem *) base;
2745	dev->usb = (struct net2280_usb_regs __iomem *) (base + 0x0080);
2746	dev->pci = (struct net2280_pci_regs __iomem *) (base + 0x0100);
2747	dev->dma = (struct net2280_dma_regs __iomem *) (base + 0x0180);
2748	dev->dep = (struct net2280_dep_regs __iomem *) (base + 0x0200);
2749	dev->epregs = (struct net2280_ep_regs __iomem *) (base + 0x0300);
2750
2751	/* put into initial config, link up all endpoints */
2752	writel (0, &dev->usb->usbctl);
2753	usb_reset (dev);
2754	usb_reinit (dev);
2755
2756	/* irq setup after old hardware is cleaned up */
2757	if (!pdev->irq) {
2758		ERROR (dev, "No IRQ.  Check PCI setup!\n");
2759		retval = -ENODEV;
2760		goto done;
2761	}
2762
2763	if (request_irq (pdev->irq, net2280_irq, IRQF_SHARED, driver_name, dev)
2764			!= 0) {
2765		ERROR (dev, "request interrupt %d failed\n", pdev->irq);
2766		retval = -EBUSY;
2767		goto done;
2768	}
2769	dev->got_irq = 1;
2770
2771	/* DMA setup */
2772	/* NOTE:  we know only the 32 LSBs of dma addresses may be nonzero */
2773	dev->requests = pci_pool_create ("requests", pdev,
2774		sizeof (struct net2280_dma),
2775		0 /* no alignment requirements */,
2776		0 /* or page-crossing issues */);
2777	if (!dev->requests) {
2778		DEBUG (dev, "can't get request pool\n");
2779		retval = -ENOMEM;
2780		goto done;
2781	}
2782	for (i = 1; i < 5; i++) {
2783		struct net2280_dma	*td;
2784
2785		td = pci_pool_alloc (dev->requests, GFP_KERNEL,
2786				&dev->ep [i].td_dma);
2787		if (!td) {
2788			DEBUG (dev, "can't get dummy %d\n", i);
2789			retval = -ENOMEM;
2790			goto done;
2791		}
2792		td->dmacount = 0;	/* not VALID */
2793		td->dmadesc = td->dmaaddr;
2794		dev->ep [i].dummy = td;
2795	}
2796
2797	/* enable lower-overhead pci memory bursts during DMA */
2798	writel ( (1 << DMA_MEMORY_WRITE_AND_INVALIDATE_ENABLE)
2799			// 256 write retries may not be enough...
2800			// | (1 << PCI_RETRY_ABORT_ENABLE)
2801			| (1 << DMA_READ_MULTIPLE_ENABLE)
2802			| (1 << DMA_READ_LINE_ENABLE)
2803			, &dev->pci->pcimstctl);
2804	/* erratum 0115 shouldn't appear: Linux inits PCI_LATENCY_TIMER */
2805	pci_set_master (pdev);
2806	pci_try_set_mwi (pdev);
2807
2808	/* ... also flushes any posted pci writes */
2809	dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
2810
2811	/* done */
2812	INFO (dev, "%s\n", driver_desc);
2813	INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
2814			pdev->irq, base, dev->chiprev);
2815	INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
2816			use_dma
2817				? (use_dma_chaining ? "chaining" : "enabled")
2818				: "disabled");
2819	retval = device_create_file (&pdev->dev, &dev_attr_registers);
2820	if (retval) goto done;
2821
2822	retval = usb_add_gadget_udc_release(&pdev->dev, &dev->gadget,
2823			gadget_release);
2824	if (retval)
2825		goto done;
2826	return 0;
2827
2828done:
2829	if (dev)
2830		net2280_remove (pdev);
2831	return retval;
2832}
2833
2834/* make sure the board is quiescent; otherwise it will continue
2835 * generating IRQs across the upcoming reboot.
2836 */
2837
2838static void net2280_shutdown (struct pci_dev *pdev)
2839{
2840	struct net2280		*dev = pci_get_drvdata (pdev);
2841
2842	/* disable IRQs */
2843	writel (0, &dev->regs->pciirqenb0);
2844	writel (0, &dev->regs->pciirqenb1);
2845
2846	/* disable the pullup so the host will think we're gone */
2847	writel (0, &dev->usb->usbctl);
2848
2849	/* Disable full-speed test mode */
2850	writel(0, &dev->usb->xcvrdiag);
2851}
2852
2853
2854/*-------------------------------------------------------------------------*/
2855
2856static const struct pci_device_id pci_ids [] = { {
2857	.class =	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2858	.class_mask =	~0,
2859	.vendor =	0x17cc,
2860	.device =	0x2280,
2861	.subvendor =	PCI_ANY_ID,
2862	.subdevice =	PCI_ANY_ID,
2863}, {
2864	.class =	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2865	.class_mask =	~0,
2866	.vendor =	0x17cc,
2867	.device =	0x2282,
2868	.subvendor =	PCI_ANY_ID,
2869	.subdevice =	PCI_ANY_ID,
2870
2871}, { /* end: all zeroes */ }
2872};
2873MODULE_DEVICE_TABLE (pci, pci_ids);
2874
2875/* pci driver glue; this is a "new style" PCI driver module */
2876static struct pci_driver net2280_pci_driver = {
2877	.name =		(char *) driver_name,
2878	.id_table =	pci_ids,
2879
2880	.probe =	net2280_probe,
2881	.remove =	net2280_remove,
2882	.shutdown =	net2280_shutdown,
2883
2884	/* FIXME add power management support */
2885};
2886
2887MODULE_DESCRIPTION (DRIVER_DESC);
2888MODULE_AUTHOR ("David Brownell");
2889MODULE_LICENSE ("GPL");
2890
2891static int __init init (void)
2892{
2893	if (!use_dma)
2894		use_dma_chaining = 0;
2895	return pci_register_driver (&net2280_pci_driver);
2896}
2897module_init (init);
2898
2899static void __exit cleanup (void)
2900{
2901	pci_unregister_driver (&net2280_pci_driver);
2902}
2903module_exit (cleanup);