[SCSI] aacraid: remove un-needed references to container id (cid)
[linux-2.6] / drivers / usb / gadget / net2280.c
1 /*
2  * Driver for the PLX NET2280 USB device controller.
3  * Specs and errata are available from <http://www.plxtech.com>.
4  *
5  * PLX Technology Inc. (formerly NetChip Technology) supported the
6  * development of this driver.
7  *
8  *
9  * CODE STATUS HIGHLIGHTS
10  *
11  * This driver should work well with most "gadget" drivers, including
12  * the File Storage, Serial, and Ethernet/RNDIS gadget drivers
13  * as well as Gadget Zero and Gadgetfs.
14  *
15  * DMA is enabled by default.  Drivers using transfer queues might use
16  * DMA chaining to remove IRQ latencies between transfers.  (Except when
17  * short OUT transfers happen.)  Drivers can use the req->no_interrupt
18  * hint to completely eliminate some IRQs, if a later IRQ is guaranteed
19  * and DMA chaining is enabled.
20  *
21  * Note that almost all the errata workarounds here are only needed for
22  * rev1 chips.  Rev1a silicon (0110) fixes almost all of them.
23  */
24
25 /*
26  * Copyright (C) 2003 David Brownell
27  * Copyright (C) 2003-2005 PLX Technology, Inc.
28  *
29  * Modified Seth Levy 2005 PLX Technology, Inc. to provide compatibility
30  *      with 2282 chip
31  *
32  * This program is free software; you can redistribute it and/or modify
33  * it under the terms of the GNU General Public License as published by
34  * the Free Software Foundation; either version 2 of the License, or
35  * (at your option) any later version.
36  *
37  * This program is distributed in the hope that it will be useful,
38  * but WITHOUT ANY WARRANTY; without even the implied warranty of
39  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
40  * GNU General Public License for more details.
41  *
42  * You should have received a copy of the GNU General Public License
43  * along with this program; if not, write to the Free Software
44  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
45  */
46
47 #undef  DEBUG           /* messages on error and most fault paths */
48 #undef  VERBOSE         /* extra debug messages (success too) */
49
50 #include <linux/module.h>
51 #include <linux/pci.h>
52 #include <linux/dma-mapping.h>
53 #include <linux/kernel.h>
54 #include <linux/delay.h>
55 #include <linux/ioport.h>
56 #include <linux/slab.h>
57 #include <linux/smp_lock.h>
58 #include <linux/errno.h>
59 #include <linux/init.h>
60 #include <linux/timer.h>
61 #include <linux/list.h>
62 #include <linux/interrupt.h>
63 #include <linux/moduleparam.h>
64 #include <linux/device.h>
65 #include <linux/usb/ch9.h>
66 #include <linux/usb_gadget.h>
67
68 #include <asm/byteorder.h>
69 #include <asm/io.h>
70 #include <asm/irq.h>
71 #include <asm/system.h>
72 #include <asm/unaligned.h>
73
74
75 #define DRIVER_DESC             "PLX NET228x USB Peripheral Controller"
76 #define DRIVER_VERSION          "2005 Sept 27"
77
78 #define DMA_ADDR_INVALID        (~(dma_addr_t)0)
79 #define EP_DONTUSE              13      /* nonzero */
80
81 #define USE_RDK_LEDS            /* GPIO pins control three LEDs */
82
83
84 static const char driver_name [] = "net2280";
85 static const char driver_desc [] = DRIVER_DESC;
86
87 static const char ep0name [] = "ep0";
88 static const char *const ep_name [] = {
89         ep0name,
90         "ep-a", "ep-b", "ep-c", "ep-d",
91         "ep-e", "ep-f",
92 };
93
94 /* use_dma -- general goodness, fewer interrupts, less cpu load (vs PIO)
95  * use_dma_chaining -- dma descriptor queueing gives even more irq reduction
96  *
97  * The net2280 DMA engines are not tightly integrated with their FIFOs;
98  * not all cases are (yet) handled well in this driver or the silicon.
99  * Some gadget drivers work better with the dma support here than others.
100  * These two parameters let you use PIO or more aggressive DMA.
101  */
102 static int use_dma = 1;
103 static int use_dma_chaining = 0;
104
105 /* "modprobe net2280 use_dma=n" etc */
106 module_param (use_dma, bool, S_IRUGO);
107 module_param (use_dma_chaining, bool, S_IRUGO);
108
109
110 /* mode 0 == ep-{a,b,c,d} 1K fifo each
111  * mode 1 == ep-{a,b} 2K fifo each, ep-{c,d} unavailable
112  * mode 2 == ep-a 2K fifo, ep-{b,c} 1K each, ep-d unavailable
113  */
114 static ushort fifo_mode = 0;
115
116 /* "modprobe net2280 fifo_mode=1" etc */
117 module_param (fifo_mode, ushort, 0644);
118
119 /* enable_suspend -- When enabled, the driver will respond to
120  * USB suspend requests by powering down the NET2280.  Otherwise,
121  * USB suspend requests will be ignored.  This is acceptible for
122  * self-powered devices
123  */
124 static int enable_suspend = 0;
125
126 /* "modprobe net2280 enable_suspend=1" etc */
127 module_param (enable_suspend, bool, S_IRUGO);
128
129
130 #define DIR_STRING(bAddress) (((bAddress) & USB_DIR_IN) ? "in" : "out")
131
132 #if defined(CONFIG_USB_GADGET_DEBUG_FILES) || defined (DEBUG)
133 static char *type_string (u8 bmAttributes)
134 {
135         switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
136         case USB_ENDPOINT_XFER_BULK:    return "bulk";
137         case USB_ENDPOINT_XFER_ISOC:    return "iso";
138         case USB_ENDPOINT_XFER_INT:     return "intr";
139         };
140         return "control";
141 }
142 #endif
143
144 #include "net2280.h"
145
146 #define valid_bit       __constant_cpu_to_le32 (1 << VALID_BIT)
147 #define dma_done_ie     __constant_cpu_to_le32 (1 << DMA_DONE_INTERRUPT_ENABLE)
148
149 /*-------------------------------------------------------------------------*/
150
151 static int
152 net2280_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
153 {
154         struct net2280          *dev;
155         struct net2280_ep       *ep;
156         u32                     max, tmp;
157         unsigned long           flags;
158
159         ep = container_of (_ep, struct net2280_ep, ep);
160         if (!_ep || !desc || ep->desc || _ep->name == ep0name
161                         || desc->bDescriptorType != USB_DT_ENDPOINT)
162                 return -EINVAL;
163         dev = ep->dev;
164         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
165                 return -ESHUTDOWN;
166
167         /* erratum 0119 workaround ties up an endpoint number */
168         if ((desc->bEndpointAddress & 0x0f) == EP_DONTUSE)
169                 return -EDOM;
170
171         /* sanity check ep-e/ep-f since their fifos are small */
172         max = le16_to_cpu (desc->wMaxPacketSize) & 0x1fff;
173         if (ep->num > 4 && max > 64)
174                 return -ERANGE;
175
176         spin_lock_irqsave (&dev->lock, flags);
177         _ep->maxpacket = max & 0x7ff;
178         ep->desc = desc;
179
180         /* ep_reset() has already been called */
181         ep->stopped = 0;
182         ep->out_overflow = 0;
183
184         /* set speed-dependent max packet; may kick in high bandwidth */
185         set_idx_reg (dev->regs, REG_EP_MAXPKT (dev, ep->num), max);
186
187         /* FIFO lines can't go to different packets.  PIO is ok, so
188          * use it instead of troublesome (non-bulk) multi-packet DMA.
189          */
190         if (ep->dma && (max % 4) != 0 && use_dma_chaining) {
191                 DEBUG (ep->dev, "%s, no dma for maxpacket %d\n",
192                         ep->ep.name, ep->ep.maxpacket);
193                 ep->dma = NULL;
194         }
195
196         /* set type, direction, address; reset fifo counters */
197         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
198         tmp = (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
199         if (tmp == USB_ENDPOINT_XFER_INT) {
200                 /* erratum 0105 workaround prevents hs NYET */
201                 if (dev->chiprev == 0100
202                                 && dev->gadget.speed == USB_SPEED_HIGH
203                                 && !(desc->bEndpointAddress & USB_DIR_IN))
204                         writel ((1 << CLEAR_NAK_OUT_PACKETS_MODE),
205                                 &ep->regs->ep_rsp);
206         } else if (tmp == USB_ENDPOINT_XFER_BULK) {
207                 /* catch some particularly blatant driver bugs */
208                 if ((dev->gadget.speed == USB_SPEED_HIGH
209                                         && max != 512)
210                                 || (dev->gadget.speed == USB_SPEED_FULL
211                                         && max > 64)) {
212                         spin_unlock_irqrestore (&dev->lock, flags);
213                         return -ERANGE;
214                 }
215         }
216         ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC) ? 1 : 0;
217         tmp <<= ENDPOINT_TYPE;
218         tmp |= desc->bEndpointAddress;
219         tmp |= (4 << ENDPOINT_BYTE_COUNT);      /* default full fifo lines */
220         tmp |= 1 << ENDPOINT_ENABLE;
221         wmb ();
222
223         /* for OUT transfers, block the rx fifo until a read is posted */
224         ep->is_in = (tmp & USB_DIR_IN) != 0;
225         if (!ep->is_in)
226                 writel ((1 << SET_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
227         else if (dev->pdev->device != 0x2280) {
228                 /* Added for 2282, Don't use nak packets on an in endpoint,
229                  * this was ignored on 2280
230                  */
231                 writel ((1 << CLEAR_NAK_OUT_PACKETS)
232                         | (1 << CLEAR_NAK_OUT_PACKETS_MODE), &ep->regs->ep_rsp);
233         }
234
235         writel (tmp, &ep->regs->ep_cfg);
236
237         /* enable irqs */
238         if (!ep->dma) {                         /* pio, per-packet */
239                 tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
240                 writel (tmp, &dev->regs->pciirqenb0);
241
242                 tmp = (1 << DATA_PACKET_RECEIVED_INTERRUPT_ENABLE)
243                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT_ENABLE);
244                 if (dev->pdev->device == 0x2280)
245                         tmp |= readl (&ep->regs->ep_irqenb);
246                 writel (tmp, &ep->regs->ep_irqenb);
247         } else {                                /* dma, per-request */
248                 tmp = (1 << (8 + ep->num));     /* completion */
249                 tmp |= readl (&dev->regs->pciirqenb1);
250                 writel (tmp, &dev->regs->pciirqenb1);
251
252                 /* for short OUT transfers, dma completions can't
253                  * advance the queue; do it pio-style, by hand.
254                  * NOTE erratum 0112 workaround #2
255                  */
256                 if ((desc->bEndpointAddress & USB_DIR_IN) == 0) {
257                         tmp = (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT_ENABLE);
258                         writel (tmp, &ep->regs->ep_irqenb);
259
260                         tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
261                         writel (tmp, &dev->regs->pciirqenb0);
262                 }
263         }
264
265         tmp = desc->bEndpointAddress;
266         DEBUG (dev, "enabled %s (ep%d%s-%s) %s max %04x\n",
267                 _ep->name, tmp & 0x0f, DIR_STRING (tmp),
268                 type_string (desc->bmAttributes),
269                 ep->dma ? "dma" : "pio", max);
270
271         /* pci writes may still be posted */
272         spin_unlock_irqrestore (&dev->lock, flags);
273         return 0;
274 }
275
276 static int handshake (u32 __iomem *ptr, u32 mask, u32 done, int usec)
277 {
278         u32     result;
279
280         do {
281                 result = readl (ptr);
282                 if (result == ~(u32)0)          /* "device unplugged" */
283                         return -ENODEV;
284                 result &= mask;
285                 if (result == done)
286                         return 0;
287                 udelay (1);
288                 usec--;
289         } while (usec > 0);
290         return -ETIMEDOUT;
291 }
292
293 static const struct usb_ep_ops net2280_ep_ops;
294
295 static void ep_reset (struct net2280_regs __iomem *regs, struct net2280_ep *ep)
296 {
297         u32             tmp;
298
299         ep->desc = NULL;
300         INIT_LIST_HEAD (&ep->queue);
301
302         ep->ep.maxpacket = ~0;
303         ep->ep.ops = &net2280_ep_ops;
304
305         /* disable the dma, irqs, endpoint... */
306         if (ep->dma) {
307                 writel (0, &ep->dma->dmactl);
308                 writel (  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
309                         | (1 << DMA_TRANSACTION_DONE_INTERRUPT)
310                         | (1 << DMA_ABORT)
311                         , &ep->dma->dmastat);
312
313                 tmp = readl (&regs->pciirqenb0);
314                 tmp &= ~(1 << ep->num);
315                 writel (tmp, &regs->pciirqenb0);
316         } else {
317                 tmp = readl (&regs->pciirqenb1);
318                 tmp &= ~(1 << (8 + ep->num));   /* completion */
319                 writel (tmp, &regs->pciirqenb1);
320         }
321         writel (0, &ep->regs->ep_irqenb);
322
323         /* init to our chosen defaults, notably so that we NAK OUT
324          * packets until the driver queues a read (+note erratum 0112)
325          */
326         if (!ep->is_in || ep->dev->pdev->device == 0x2280) {
327                 tmp = (1 << SET_NAK_OUT_PACKETS_MODE)
328                 | (1 << SET_NAK_OUT_PACKETS)
329                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
330                 | (1 << CLEAR_INTERRUPT_MODE);
331         } else {
332                 /* added for 2282 */
333                 tmp = (1 << CLEAR_NAK_OUT_PACKETS_MODE)
334                 | (1 << CLEAR_NAK_OUT_PACKETS)
335                 | (1 << CLEAR_EP_HIDE_STATUS_PHASE)
336                 | (1 << CLEAR_INTERRUPT_MODE);
337         }
338
339         if (ep->num != 0) {
340                 tmp |= (1 << CLEAR_ENDPOINT_TOGGLE)
341                         | (1 << CLEAR_ENDPOINT_HALT);
342         }
343         writel (tmp, &ep->regs->ep_rsp);
344
345         /* scrub most status bits, and flush any fifo state */
346         if (ep->dev->pdev->device == 0x2280)
347                 tmp = (1 << FIFO_OVERFLOW)
348                         | (1 << FIFO_UNDERFLOW);
349         else
350                 tmp = 0;
351
352         writel (tmp | (1 << TIMEOUT)
353                 | (1 << USB_STALL_SENT)
354                 | (1 << USB_IN_NAK_SENT)
355                 | (1 << USB_IN_ACK_RCVD)
356                 | (1 << USB_OUT_PING_NAK_SENT)
357                 | (1 << USB_OUT_ACK_SENT)
358                 | (1 << FIFO_FLUSH)
359                 | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
360                 | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
361                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
362                 | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
363                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
364                 | (1 << DATA_IN_TOKEN_INTERRUPT)
365                 , &ep->regs->ep_stat);
366
367         /* fifo size is handled separately */
368 }
369
370 static void nuke (struct net2280_ep *);
371
372 static int net2280_disable (struct usb_ep *_ep)
373 {
374         struct net2280_ep       *ep;
375         unsigned long           flags;
376
377         ep = container_of (_ep, struct net2280_ep, ep);
378         if (!_ep || !ep->desc || _ep->name == ep0name)
379                 return -EINVAL;
380
381         spin_lock_irqsave (&ep->dev->lock, flags);
382         nuke (ep);
383         ep_reset (ep->dev->regs, ep);
384
385         VDEBUG (ep->dev, "disabled %s %s\n",
386                         ep->dma ? "dma" : "pio", _ep->name);
387
388         /* synch memory views with the device */
389         (void) readl (&ep->regs->ep_cfg);
390
391         if (use_dma && !ep->dma && ep->num >= 1 && ep->num <= 4)
392                 ep->dma = &ep->dev->dma [ep->num - 1];
393
394         spin_unlock_irqrestore (&ep->dev->lock, flags);
395         return 0;
396 }
397
398 /*-------------------------------------------------------------------------*/
399
400 static struct usb_request *
401 net2280_alloc_request (struct usb_ep *_ep, gfp_t gfp_flags)
402 {
403         struct net2280_ep       *ep;
404         struct net2280_request  *req;
405
406         if (!_ep)
407                 return NULL;
408         ep = container_of (_ep, struct net2280_ep, ep);
409
410         req = kzalloc(sizeof(*req), gfp_flags);
411         if (!req)
412                 return NULL;
413
414         req->req.dma = DMA_ADDR_INVALID;
415         INIT_LIST_HEAD (&req->queue);
416
417         /* this dma descriptor may be swapped with the previous dummy */
418         if (ep->dma) {
419                 struct net2280_dma      *td;
420
421                 td = pci_pool_alloc (ep->dev->requests, gfp_flags,
422                                 &req->td_dma);
423                 if (!td) {
424                         kfree (req);
425                         return NULL;
426                 }
427                 td->dmacount = 0;       /* not VALID */
428                 td->dmaaddr = __constant_cpu_to_le32 (DMA_ADDR_INVALID);
429                 td->dmadesc = td->dmaaddr;
430                 req->td = td;
431         }
432         return &req->req;
433 }
434
435 static void
436 net2280_free_request (struct usb_ep *_ep, struct usb_request *_req)
437 {
438         struct net2280_ep       *ep;
439         struct net2280_request  *req;
440
441         ep = container_of (_ep, struct net2280_ep, ep);
442         if (!_ep || !_req)
443                 return;
444
445         req = container_of (_req, struct net2280_request, req);
446         WARN_ON (!list_empty (&req->queue));
447         if (req->td)
448                 pci_pool_free (ep->dev->requests, req->td, req->td_dma);
449         kfree (req);
450 }
451
452 /*-------------------------------------------------------------------------*/
453
454 /*
455  * dma-coherent memory allocation (for dma-capable endpoints)
456  *
457  * NOTE: the dma_*_coherent() API calls suck.  Most implementations are
458  * (a) page-oriented, so small buffers lose big; and (b) asymmetric with
459  * respect to calls with irqs disabled:  alloc is safe, free is not.
460  * We currently work around (b), but not (a).
461  */
462
463 static void *
464 net2280_alloc_buffer (
465         struct usb_ep           *_ep,
466         unsigned                bytes,
467         dma_addr_t              *dma,
468         gfp_t                   gfp_flags
469 )
470 {
471         void                    *retval;
472         struct net2280_ep       *ep;
473
474         ep = container_of (_ep, struct net2280_ep, ep);
475         if (!_ep)
476                 return NULL;
477         *dma = DMA_ADDR_INVALID;
478
479         if (ep->dma)
480                 retval = dma_alloc_coherent(&ep->dev->pdev->dev,
481                                 bytes, dma, gfp_flags);
482         else
483                 retval = kmalloc(bytes, gfp_flags);
484         return retval;
485 }
486
487 static DEFINE_SPINLOCK(buflock);
488 static LIST_HEAD(buffers);
489
490 struct free_record {
491         struct list_head        list;
492         struct device           *dev;
493         unsigned                bytes;
494         dma_addr_t              dma;
495 };
496
497 static void do_free(unsigned long ignored)
498 {
499         spin_lock_irq(&buflock);
500         while (!list_empty(&buffers)) {
501                 struct free_record      *buf;
502
503                 buf = list_entry(buffers.next, struct free_record, list);
504                 list_del(&buf->list);
505                 spin_unlock_irq(&buflock);
506
507                 dma_free_coherent(buf->dev, buf->bytes, buf, buf->dma);
508
509                 spin_lock_irq(&buflock);
510         }
511         spin_unlock_irq(&buflock);
512 }
513
514 static DECLARE_TASKLET(deferred_free, do_free, 0);
515
516 static void
517 net2280_free_buffer (
518         struct usb_ep *_ep,
519         void *address,
520         dma_addr_t dma,
521         unsigned bytes
522 ) {
523         /* free memory into the right allocator */
524         if (dma != DMA_ADDR_INVALID) {
525                 struct net2280_ep       *ep;
526                 struct free_record      *buf = address;
527                 unsigned long           flags;
528
529                 ep = container_of(_ep, struct net2280_ep, ep);
530                 if (!_ep)
531                         return;
532
533                 ep = container_of (_ep, struct net2280_ep, ep);
534                 buf->dev = &ep->dev->pdev->dev;
535                 buf->bytes = bytes;
536                 buf->dma = dma;
537
538                 spin_lock_irqsave(&buflock, flags);
539                 list_add_tail(&buf->list, &buffers);
540                 tasklet_schedule(&deferred_free);
541                 spin_unlock_irqrestore(&buflock, flags);
542         } else
543                 kfree (address);
544 }
545
546 /*-------------------------------------------------------------------------*/
547
548 /* load a packet into the fifo we use for usb IN transfers.
549  * works for all endpoints.
550  *
551  * NOTE: pio with ep-a..ep-d could stuff multiple packets into the fifo
552  * at a time, but this code is simpler because it knows it only writes
553  * one packet.  ep-a..ep-d should use dma instead.
554  */
555 static void
556 write_fifo (struct net2280_ep *ep, struct usb_request *req)
557 {
558         struct net2280_ep_regs  __iomem *regs = ep->regs;
559         u8                      *buf;
560         u32                     tmp;
561         unsigned                count, total;
562
563         /* INVARIANT:  fifo is currently empty. (testable) */
564
565         if (req) {
566                 buf = req->buf + req->actual;
567                 prefetch (buf);
568                 total = req->length - req->actual;
569         } else {
570                 total = 0;
571                 buf = NULL;
572         }
573
574         /* write just one packet at a time */
575         count = ep->ep.maxpacket;
576         if (count > total)      /* min() cannot be used on a bitfield */
577                 count = total;
578
579         VDEBUG (ep->dev, "write %s fifo (IN) %d bytes%s req %p\n",
580                         ep->ep.name, count,
581                         (count != ep->ep.maxpacket) ? " (short)" : "",
582                         req);
583         while (count >= 4) {
584                 /* NOTE be careful if you try to align these. fifo lines
585                  * should normally be full (4 bytes) and successive partial
586                  * lines are ok only in certain cases.
587                  */
588                 tmp = get_unaligned ((u32 *)buf);
589                 cpu_to_le32s (&tmp);
590                 writel (tmp, &regs->ep_data);
591                 buf += 4;
592                 count -= 4;
593         }
594
595         /* last fifo entry is "short" unless we wrote a full packet.
596          * also explicitly validate last word in (periodic) transfers
597          * when maxpacket is not a multiple of 4 bytes.
598          */
599         if (count || total < ep->ep.maxpacket) {
600                 tmp = count ? get_unaligned ((u32 *)buf) : count;
601                 cpu_to_le32s (&tmp);
602                 set_fifo_bytecount (ep, count & 0x03);
603                 writel (tmp, &regs->ep_data);
604         }
605
606         /* pci writes may still be posted */
607 }
608
609 /* work around erratum 0106: PCI and USB race over the OUT fifo.
610  * caller guarantees chiprev 0100, out endpoint is NAKing, and
611  * there's no real data in the fifo.
612  *
613  * NOTE:  also used in cases where that erratum doesn't apply:
614  * where the host wrote "too much" data to us.
615  */
616 static void out_flush (struct net2280_ep *ep)
617 {
618         u32     __iomem *statp;
619         u32     tmp;
620
621         ASSERT_OUT_NAKING (ep);
622
623         statp = &ep->regs->ep_stat;
624         writel (  (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
625                 | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
626                 , statp);
627         writel ((1 << FIFO_FLUSH), statp);
628         mb ();
629         tmp = readl (statp);
630         if (tmp & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
631                         /* high speed did bulk NYET; fifo isn't filling */
632                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
633                 unsigned        usec;
634
635                 usec = 50;              /* 64 byte bulk/interrupt */
636                 handshake (statp, (1 << USB_OUT_PING_NAK_SENT),
637                                 (1 << USB_OUT_PING_NAK_SENT), usec);
638                 /* NAK done; now CLEAR_NAK_OUT_PACKETS is safe */
639         }
640 }
641
642 /* unload packet(s) from the fifo we use for usb OUT transfers.
643  * returns true iff the request completed, because of short packet
644  * or the request buffer having filled with full packets.
645  *
646  * for ep-a..ep-d this will read multiple packets out when they
647  * have been accepted.
648  */
649 static int
650 read_fifo (struct net2280_ep *ep, struct net2280_request *req)
651 {
652         struct net2280_ep_regs  __iomem *regs = ep->regs;
653         u8                      *buf = req->req.buf + req->req.actual;
654         unsigned                count, tmp, is_short;
655         unsigned                cleanup = 0, prevent = 0;
656
657         /* erratum 0106 ... packets coming in during fifo reads might
658          * be incompletely rejected.  not all cases have workarounds.
659          */
660         if (ep->dev->chiprev == 0x0100
661                         && ep->dev->gadget.speed == USB_SPEED_FULL) {
662                 udelay (1);
663                 tmp = readl (&ep->regs->ep_stat);
664                 if ((tmp & (1 << NAK_OUT_PACKETS)))
665                         cleanup = 1;
666                 else if ((tmp & (1 << FIFO_FULL))) {
667                         start_out_naking (ep);
668                         prevent = 1;
669                 }
670                 /* else: hope we don't see the problem */
671         }
672
673         /* never overflow the rx buffer. the fifo reads packets until
674          * it sees a short one; we might not be ready for them all.
675          */
676         prefetchw (buf);
677         count = readl (&regs->ep_avail);
678         if (unlikely (count == 0)) {
679                 udelay (1);
680                 tmp = readl (&ep->regs->ep_stat);
681                 count = readl (&regs->ep_avail);
682                 /* handled that data already? */
683                 if (count == 0 && (tmp & (1 << NAK_OUT_PACKETS)) == 0)
684                         return 0;
685         }
686
687         tmp = req->req.length - req->req.actual;
688         if (count > tmp) {
689                 /* as with DMA, data overflow gets flushed */
690                 if ((tmp % ep->ep.maxpacket) != 0) {
691                         ERROR (ep->dev,
692                                 "%s out fifo %d bytes, expected %d\n",
693                                 ep->ep.name, count, tmp);
694                         req->req.status = -EOVERFLOW;
695                         cleanup = 1;
696                         /* NAK_OUT_PACKETS will be set, so flushing is safe;
697                          * the next read will start with the next packet
698                          */
699                 } /* else it's a ZLP, no worries */
700                 count = tmp;
701         }
702         req->req.actual += count;
703
704         is_short = (count == 0) || ((count % ep->ep.maxpacket) != 0);
705
706         VDEBUG (ep->dev, "read %s fifo (OUT) %d bytes%s%s%s req %p %d/%d\n",
707                         ep->ep.name, count, is_short ? " (short)" : "",
708                         cleanup ? " flush" : "", prevent ? " nak" : "",
709                         req, req->req.actual, req->req.length);
710
711         while (count >= 4) {
712                 tmp = readl (&regs->ep_data);
713                 cpu_to_le32s (&tmp);
714                 put_unaligned (tmp, (u32 *)buf);
715                 buf += 4;
716                 count -= 4;
717         }
718         if (count) {
719                 tmp = readl (&regs->ep_data);
720                 /* LE conversion is implicit here: */
721                 do {
722                         *buf++ = (u8) tmp;
723                         tmp >>= 8;
724                 } while (--count);
725         }
726         if (cleanup)
727                 out_flush (ep);
728         if (prevent) {
729                 writel ((1 << CLEAR_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
730                 (void) readl (&ep->regs->ep_rsp);
731         }
732
733         return is_short || ((req->req.actual == req->req.length)
734                                 && !req->req.zero);
735 }
736
737 /* fill out dma descriptor to match a given request */
738 static void
739 fill_dma_desc (struct net2280_ep *ep, struct net2280_request *req, int valid)
740 {
741         struct net2280_dma      *td = req->td;
742         u32                     dmacount = req->req.length;
743
744         /* don't let DMA continue after a short OUT packet,
745          * so overruns can't affect the next transfer.
746          * in case of overruns on max-size packets, we can't
747          * stop the fifo from filling but we can flush it.
748          */
749         if (ep->is_in)
750                 dmacount |= (1 << DMA_DIRECTION);
751         if ((!ep->is_in && (dmacount % ep->ep.maxpacket) != 0)
752                         || ep->dev->pdev->device != 0x2280)
753                 dmacount |= (1 << END_OF_CHAIN);
754
755         req->valid = valid;
756         if (valid)
757                 dmacount |= (1 << VALID_BIT);
758         if (likely(!req->req.no_interrupt || !use_dma_chaining))
759                 dmacount |= (1 << DMA_DONE_INTERRUPT_ENABLE);
760
761         /* td->dmadesc = previously set by caller */
762         td->dmaaddr = cpu_to_le32 (req->req.dma);
763
764         /* 2280 may be polling VALID_BIT through ep->dma->dmadesc */
765         wmb ();
766         td->dmacount = cpu_to_le32p (&dmacount);
767 }
768
769 static const u32 dmactl_default =
770                   (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
771                 | (1 << DMA_CLEAR_COUNT_ENABLE)
772                 /* erratum 0116 workaround part 1 (use POLLING) */
773                 | (POLL_100_USEC << DESCRIPTOR_POLLING_RATE)
774                 | (1 << DMA_VALID_BIT_POLLING_ENABLE)
775                 | (1 << DMA_VALID_BIT_ENABLE)
776                 | (1 << DMA_SCATTER_GATHER_ENABLE)
777                 /* erratum 0116 workaround part 2 (no AUTOSTART) */
778                 | (1 << DMA_ENABLE);
779
780 static inline void spin_stop_dma (struct net2280_dma_regs __iomem *dma)
781 {
782         handshake (&dma->dmactl, (1 << DMA_ENABLE), 0, 50);
783 }
784
785 static inline void stop_dma (struct net2280_dma_regs __iomem *dma)
786 {
787         writel (readl (&dma->dmactl) & ~(1 << DMA_ENABLE), &dma->dmactl);
788         spin_stop_dma (dma);
789 }
790
791 static void start_queue (struct net2280_ep *ep, u32 dmactl, u32 td_dma)
792 {
793         struct net2280_dma_regs __iomem *dma = ep->dma;
794         unsigned int tmp = (1 << VALID_BIT) | (ep->is_in << DMA_DIRECTION);
795
796         if (ep->dev->pdev->device != 0x2280)
797                 tmp |= (1 << END_OF_CHAIN);
798
799         writel (tmp, &dma->dmacount);
800         writel (readl (&dma->dmastat), &dma->dmastat);
801
802         writel (td_dma, &dma->dmadesc);
803         writel (dmactl, &dma->dmactl);
804
805         /* erratum 0116 workaround part 3:  pci arbiter away from net2280 */
806         (void) readl (&ep->dev->pci->pcimstctl);
807
808         writel ((1 << DMA_START), &dma->dmastat);
809
810         if (!ep->is_in)
811                 stop_out_naking (ep);
812 }
813
814 static void start_dma (struct net2280_ep *ep, struct net2280_request *req)
815 {
816         u32                     tmp;
817         struct net2280_dma_regs __iomem *dma = ep->dma;
818
819         /* FIXME can't use DMA for ZLPs */
820
821         /* on this path we "know" there's no dma active (yet) */
822         WARN_ON (readl (&dma->dmactl) & (1 << DMA_ENABLE));
823         writel (0, &ep->dma->dmactl);
824
825         /* previous OUT packet might have been short */
826         if (!ep->is_in && ((tmp = readl (&ep->regs->ep_stat))
827                                 & (1 << NAK_OUT_PACKETS)) != 0) {
828                 writel ((1 << SHORT_PACKET_TRANSFERRED_INTERRUPT),
829                         &ep->regs->ep_stat);
830
831                 tmp = readl (&ep->regs->ep_avail);
832                 if (tmp) {
833                         writel (readl (&dma->dmastat), &dma->dmastat);
834
835                         /* transfer all/some fifo data */
836                         writel (req->req.dma, &dma->dmaaddr);
837                         tmp = min (tmp, req->req.length);
838
839                         /* dma irq, faking scatterlist status */
840                         req->td->dmacount = cpu_to_le32 (req->req.length - tmp);
841                         writel ((1 << DMA_DONE_INTERRUPT_ENABLE)
842                                 | tmp, &dma->dmacount);
843                         req->td->dmadesc = 0;
844                         req->valid = 1;
845
846                         writel ((1 << DMA_ENABLE), &dma->dmactl);
847                         writel ((1 << DMA_START), &dma->dmastat);
848                         return;
849                 }
850         }
851
852         tmp = dmactl_default;
853
854         /* force packet boundaries between dma requests, but prevent the
855          * controller from automagically writing a last "short" packet
856          * (zero length) unless the driver explicitly said to do that.
857          */
858         if (ep->is_in) {
859                 if (likely ((req->req.length % ep->ep.maxpacket) != 0
860                                 || req->req.zero)) {
861                         tmp |= (1 << DMA_FIFO_VALIDATE);
862                         ep->in_fifo_validate = 1;
863                 } else
864                         ep->in_fifo_validate = 0;
865         }
866
867         /* init req->td, pointing to the current dummy */
868         req->td->dmadesc = cpu_to_le32 (ep->td_dma);
869         fill_dma_desc (ep, req, 1);
870
871         if (!use_dma_chaining)
872                 req->td->dmacount |= __constant_cpu_to_le32 (1 << END_OF_CHAIN);
873
874         start_queue (ep, tmp, req->td_dma);
875 }
876
877 static inline void
878 queue_dma (struct net2280_ep *ep, struct net2280_request *req, int valid)
879 {
880         struct net2280_dma      *end;
881         dma_addr_t              tmp;
882
883         /* swap new dummy for old, link; fill and maybe activate */
884         end = ep->dummy;
885         ep->dummy = req->td;
886         req->td = end;
887
888         tmp = ep->td_dma;
889         ep->td_dma = req->td_dma;
890         req->td_dma = tmp;
891
892         end->dmadesc = cpu_to_le32 (ep->td_dma);
893
894         fill_dma_desc (ep, req, valid);
895 }
896
897 static void
898 done (struct net2280_ep *ep, struct net2280_request *req, int status)
899 {
900         struct net2280          *dev;
901         unsigned                stopped = ep->stopped;
902
903         list_del_init (&req->queue);
904
905         if (req->req.status == -EINPROGRESS)
906                 req->req.status = status;
907         else
908                 status = req->req.status;
909
910         dev = ep->dev;
911         if (req->mapped) {
912                 pci_unmap_single (dev->pdev, req->req.dma, req->req.length,
913                         ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
914                 req->req.dma = DMA_ADDR_INVALID;
915                 req->mapped = 0;
916         }
917
918         if (status && status != -ESHUTDOWN)
919                 VDEBUG (dev, "complete %s req %p stat %d len %u/%u\n",
920                         ep->ep.name, &req->req, status,
921                         req->req.actual, req->req.length);
922
923         /* don't modify queue heads during completion callback */
924         ep->stopped = 1;
925         spin_unlock (&dev->lock);
926         req->req.complete (&ep->ep, &req->req);
927         spin_lock (&dev->lock);
928         ep->stopped = stopped;
929 }
930
931 /*-------------------------------------------------------------------------*/
932
933 static int
934 net2280_queue (struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
935 {
936         struct net2280_request  *req;
937         struct net2280_ep       *ep;
938         struct net2280          *dev;
939         unsigned long           flags;
940
941         /* we always require a cpu-view buffer, so that we can
942          * always use pio (as fallback or whatever).
943          */
944         req = container_of (_req, struct net2280_request, req);
945         if (!_req || !_req->complete || !_req->buf
946                         || !list_empty (&req->queue))
947                 return -EINVAL;
948         if (_req->length > (~0 & DMA_BYTE_COUNT_MASK))
949                 return -EDOM;
950         ep = container_of (_ep, struct net2280_ep, ep);
951         if (!_ep || (!ep->desc && ep->num != 0))
952                 return -EINVAL;
953         dev = ep->dev;
954         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
955                 return -ESHUTDOWN;
956
957         /* FIXME implement PIO fallback for ZLPs with DMA */
958         if (ep->dma && _req->length == 0)
959                 return -EOPNOTSUPP;
960
961         /* set up dma mapping in case the caller didn't */
962         if (ep->dma && _req->dma == DMA_ADDR_INVALID) {
963                 _req->dma = pci_map_single (dev->pdev, _req->buf, _req->length,
964                         ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
965                 req->mapped = 1;
966         }
967
968 #if 0
969         VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
970                         _ep->name, _req, _req->length, _req->buf);
971 #endif
972
973         spin_lock_irqsave (&dev->lock, flags);
974
975         _req->status = -EINPROGRESS;
976         _req->actual = 0;
977
978         /* kickstart this i/o queue? */
979         if (list_empty (&ep->queue) && !ep->stopped) {
980                 /* use DMA if the endpoint supports it, else pio */
981                 if (ep->dma)
982                         start_dma (ep, req);
983                 else {
984                         /* maybe there's no control data, just status ack */
985                         if (ep->num == 0 && _req->length == 0) {
986                                 allow_status (ep);
987                                 done (ep, req, 0);
988                                 VDEBUG (dev, "%s status ack\n", ep->ep.name);
989                                 goto done;
990                         }
991
992                         /* PIO ... stuff the fifo, or unblock it.  */
993                         if (ep->is_in)
994                                 write_fifo (ep, _req);
995                         else if (list_empty (&ep->queue)) {
996                                 u32     s;
997
998                                 /* OUT FIFO might have packet(s) buffered */
999                                 s = readl (&ep->regs->ep_stat);
1000                                 if ((s & (1 << FIFO_EMPTY)) == 0) {
1001                                         /* note:  _req->short_not_ok is
1002                                          * ignored here since PIO _always_
1003                                          * stops queue advance here, and
1004                                          * _req->status doesn't change for
1005                                          * short reads (only _req->actual)
1006                                          */
1007                                         if (read_fifo (ep, req)) {
1008                                                 done (ep, req, 0);
1009                                                 if (ep->num == 0)
1010                                                         allow_status (ep);
1011                                                 /* don't queue it */
1012                                                 req = NULL;
1013                                         } else
1014                                                 s = readl (&ep->regs->ep_stat);
1015                                 }
1016
1017                                 /* don't NAK, let the fifo fill */
1018                                 if (req && (s & (1 << NAK_OUT_PACKETS)))
1019                                         writel ((1 << CLEAR_NAK_OUT_PACKETS),
1020                                                         &ep->regs->ep_rsp);
1021                         }
1022                 }
1023
1024         } else if (ep->dma) {
1025                 int     valid = 1;
1026
1027                 if (ep->is_in) {
1028                         int     expect;
1029
1030                         /* preventing magic zlps is per-engine state, not
1031                          * per-transfer; irq logic must recover hiccups.
1032                          */
1033                         expect = likely (req->req.zero
1034                                 || (req->req.length % ep->ep.maxpacket) != 0);
1035                         if (expect != ep->in_fifo_validate)
1036                                 valid = 0;
1037                 }
1038                 queue_dma (ep, req, valid);
1039
1040         } /* else the irq handler advances the queue. */
1041
1042         ep->responded = 1;
1043         if (req)
1044                 list_add_tail (&req->queue, &ep->queue);
1045 done:
1046         spin_unlock_irqrestore (&dev->lock, flags);
1047
1048         /* pci writes may still be posted */
1049         return 0;
1050 }
1051
1052 static inline void
1053 dma_done (
1054         struct net2280_ep *ep,
1055         struct net2280_request *req,
1056         u32 dmacount,
1057         int status
1058 )
1059 {
1060         req->req.actual = req->req.length - (DMA_BYTE_COUNT_MASK & dmacount);
1061         done (ep, req, status);
1062 }
1063
1064 static void restart_dma (struct net2280_ep *ep);
1065
1066 static void scan_dma_completions (struct net2280_ep *ep)
1067 {
1068         /* only look at descriptors that were "naturally" retired,
1069          * so fifo and list head state won't matter
1070          */
1071         while (!list_empty (&ep->queue)) {
1072                 struct net2280_request  *req;
1073                 u32                     tmp;
1074
1075                 req = list_entry (ep->queue.next,
1076                                 struct net2280_request, queue);
1077                 if (!req->valid)
1078                         break;
1079                 rmb ();
1080                 tmp = le32_to_cpup (&req->td->dmacount);
1081                 if ((tmp & (1 << VALID_BIT)) != 0)
1082                         break;
1083
1084                 /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
1085                  * cases where DMA must be aborted; this code handles
1086                  * all non-abort DMA completions.
1087                  */
1088                 if (unlikely (req->td->dmadesc == 0)) {
1089                         /* paranoia */
1090                         tmp = readl (&ep->dma->dmacount);
1091                         if (tmp & DMA_BYTE_COUNT_MASK)
1092                                 break;
1093                         /* single transfer mode */
1094                         dma_done (ep, req, tmp, 0);
1095                         break;
1096                 } else if (!ep->is_in
1097                                 && (req->req.length % ep->ep.maxpacket) != 0) {
1098                         tmp = readl (&ep->regs->ep_stat);
1099
1100                         /* AVOID TROUBLE HERE by not issuing short reads from
1101                          * your gadget driver.  That helps avoids errata 0121,
1102                          * 0122, and 0124; not all cases trigger the warning.
1103                          */
1104                         if ((tmp & (1 << NAK_OUT_PACKETS)) == 0) {
1105                                 WARN (ep->dev, "%s lost packet sync!\n",
1106                                                 ep->ep.name);
1107                                 req->req.status = -EOVERFLOW;
1108                         } else if ((tmp = readl (&ep->regs->ep_avail)) != 0) {
1109                                 /* fifo gets flushed later */
1110                                 ep->out_overflow = 1;
1111                                 DEBUG (ep->dev, "%s dma, discard %d len %d\n",
1112                                                 ep->ep.name, tmp,
1113                                                 req->req.length);
1114                                 req->req.status = -EOVERFLOW;
1115                         }
1116                 }
1117                 dma_done (ep, req, tmp, 0);
1118         }
1119 }
1120
1121 static void restart_dma (struct net2280_ep *ep)
1122 {
1123         struct net2280_request  *req;
1124         u32                     dmactl = dmactl_default;
1125
1126         if (ep->stopped)
1127                 return;
1128         req = list_entry (ep->queue.next, struct net2280_request, queue);
1129
1130         if (!use_dma_chaining) {
1131                 start_dma (ep, req);
1132                 return;
1133         }
1134
1135         /* the 2280 will be processing the queue unless queue hiccups after
1136          * the previous transfer:
1137          *  IN:   wanted automagic zlp, head doesn't (or vice versa)
1138          *        DMA_FIFO_VALIDATE doesn't init from dma descriptors.
1139          *  OUT:  was "usb-short", we must restart.
1140          */
1141         if (ep->is_in && !req->valid) {
1142                 struct net2280_request  *entry, *prev = NULL;
1143                 int                     reqmode, done = 0;
1144
1145                 DEBUG (ep->dev, "%s dma hiccup td %p\n", ep->ep.name, req->td);
1146                 ep->in_fifo_validate = likely (req->req.zero
1147                         || (req->req.length % ep->ep.maxpacket) != 0);
1148                 if (ep->in_fifo_validate)
1149                         dmactl |= (1 << DMA_FIFO_VALIDATE);
1150                 list_for_each_entry (entry, &ep->queue, queue) {
1151                         __le32          dmacount;
1152
1153                         if (entry == req)
1154                                 continue;
1155                         dmacount = entry->td->dmacount;
1156                         if (!done) {
1157                                 reqmode = likely (entry->req.zero
1158                                         || (entry->req.length
1159                                                 % ep->ep.maxpacket) != 0);
1160                                 if (reqmode == ep->in_fifo_validate) {
1161                                         entry->valid = 1;
1162                                         dmacount |= valid_bit;
1163                                         entry->td->dmacount = dmacount;
1164                                         prev = entry;
1165                                         continue;
1166                                 } else {
1167                                         /* force a hiccup */
1168                                         prev->td->dmacount |= dma_done_ie;
1169                                         done = 1;
1170                                 }
1171                         }
1172
1173                         /* walk the rest of the queue so unlinks behave */
1174                         entry->valid = 0;
1175                         dmacount &= ~valid_bit;
1176                         entry->td->dmacount = dmacount;
1177                         prev = entry;
1178                 }
1179         }
1180
1181         writel (0, &ep->dma->dmactl);
1182         start_queue (ep, dmactl, req->td_dma);
1183 }
1184
1185 static void abort_dma (struct net2280_ep *ep)
1186 {
1187         /* abort the current transfer */
1188         if (likely (!list_empty (&ep->queue))) {
1189                 /* FIXME work around errata 0121, 0122, 0124 */
1190                 writel ((1 << DMA_ABORT), &ep->dma->dmastat);
1191                 spin_stop_dma (ep->dma);
1192         } else
1193                 stop_dma (ep->dma);
1194         scan_dma_completions (ep);
1195 }
1196
1197 /* dequeue ALL requests */
1198 static void nuke (struct net2280_ep *ep)
1199 {
1200         struct net2280_request  *req;
1201
1202         /* called with spinlock held */
1203         ep->stopped = 1;
1204         if (ep->dma)
1205                 abort_dma (ep);
1206         while (!list_empty (&ep->queue)) {
1207                 req = list_entry (ep->queue.next,
1208                                 struct net2280_request,
1209                                 queue);
1210                 done (ep, req, -ESHUTDOWN);
1211         }
1212 }
1213
1214 /* dequeue JUST ONE request */
1215 static int net2280_dequeue (struct usb_ep *_ep, struct usb_request *_req)
1216 {
1217         struct net2280_ep       *ep;
1218         struct net2280_request  *req;
1219         unsigned long           flags;
1220         u32                     dmactl;
1221         int                     stopped;
1222
1223         ep = container_of (_ep, struct net2280_ep, ep);
1224         if (!_ep || (!ep->desc && ep->num != 0) || !_req)
1225                 return -EINVAL;
1226
1227         spin_lock_irqsave (&ep->dev->lock, flags);
1228         stopped = ep->stopped;
1229
1230         /* quiesce dma while we patch the queue */
1231         dmactl = 0;
1232         ep->stopped = 1;
1233         if (ep->dma) {
1234                 dmactl = readl (&ep->dma->dmactl);
1235                 /* WARNING erratum 0127 may kick in ... */
1236                 stop_dma (ep->dma);
1237                 scan_dma_completions (ep);
1238         }
1239
1240         /* make sure it's still queued on this endpoint */
1241         list_for_each_entry (req, &ep->queue, queue) {
1242                 if (&req->req == _req)
1243                         break;
1244         }
1245         if (&req->req != _req) {
1246                 spin_unlock_irqrestore (&ep->dev->lock, flags);
1247                 return -EINVAL;
1248         }
1249
1250         /* queue head may be partially complete. */
1251         if (ep->queue.next == &req->queue) {
1252                 if (ep->dma) {
1253                         DEBUG (ep->dev, "unlink (%s) dma\n", _ep->name);
1254                         _req->status = -ECONNRESET;
1255                         abort_dma (ep);
1256                         if (likely (ep->queue.next == &req->queue)) {
1257                                 // NOTE: misreports single-transfer mode
1258                                 req->td->dmacount = 0;  /* invalidate */
1259                                 dma_done (ep, req,
1260                                         readl (&ep->dma->dmacount),
1261                                         -ECONNRESET);
1262                         }
1263                 } else {
1264                         DEBUG (ep->dev, "unlink (%s) pio\n", _ep->name);
1265                         done (ep, req, -ECONNRESET);
1266                 }
1267                 req = NULL;
1268
1269         /* patch up hardware chaining data */
1270         } else if (ep->dma && use_dma_chaining) {
1271                 if (req->queue.prev == ep->queue.next) {
1272                         writel (le32_to_cpu (req->td->dmadesc),
1273                                 &ep->dma->dmadesc);
1274                         if (req->td->dmacount & dma_done_ie)
1275                                 writel (readl (&ep->dma->dmacount)
1276                                                 | le32_to_cpu(dma_done_ie),
1277                                         &ep->dma->dmacount);
1278                 } else {
1279                         struct net2280_request  *prev;
1280
1281                         prev = list_entry (req->queue.prev,
1282                                 struct net2280_request, queue);
1283                         prev->td->dmadesc = req->td->dmadesc;
1284                         if (req->td->dmacount & dma_done_ie)
1285                                 prev->td->dmacount |= dma_done_ie;
1286                 }
1287         }
1288
1289         if (req)
1290                 done (ep, req, -ECONNRESET);
1291         ep->stopped = stopped;
1292
1293         if (ep->dma) {
1294                 /* turn off dma on inactive queues */
1295                 if (list_empty (&ep->queue))
1296                         stop_dma (ep->dma);
1297                 else if (!ep->stopped) {
1298                         /* resume current request, or start new one */
1299                         if (req)
1300                                 writel (dmactl, &ep->dma->dmactl);
1301                         else
1302                                 start_dma (ep, list_entry (ep->queue.next,
1303                                         struct net2280_request, queue));
1304                 }
1305         }
1306
1307         spin_unlock_irqrestore (&ep->dev->lock, flags);
1308         return 0;
1309 }
1310
1311 /*-------------------------------------------------------------------------*/
1312
1313 static int net2280_fifo_status (struct usb_ep *_ep);
1314
1315 static int
1316 net2280_set_halt (struct usb_ep *_ep, int value)
1317 {
1318         struct net2280_ep       *ep;
1319         unsigned long           flags;
1320         int                     retval = 0;
1321
1322         ep = container_of (_ep, struct net2280_ep, ep);
1323         if (!_ep || (!ep->desc && ep->num != 0))
1324                 return -EINVAL;
1325         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1326                 return -ESHUTDOWN;
1327         if (ep->desc /* not ep0 */ && (ep->desc->bmAttributes & 0x03)
1328                                                 == USB_ENDPOINT_XFER_ISOC)
1329                 return -EINVAL;
1330
1331         spin_lock_irqsave (&ep->dev->lock, flags);
1332         if (!list_empty (&ep->queue))
1333                 retval = -EAGAIN;
1334         else if (ep->is_in && value && net2280_fifo_status (_ep) != 0)
1335                 retval = -EAGAIN;
1336         else {
1337                 VDEBUG (ep->dev, "%s %s halt\n", _ep->name,
1338                                 value ? "set" : "clear");
1339                 /* set/clear, then synch memory views with the device */
1340                 if (value) {
1341                         if (ep->num == 0)
1342                                 ep->dev->protocol_stall = 1;
1343                         else
1344                                 set_halt (ep);
1345                 } else
1346                         clear_halt (ep);
1347                 (void) readl (&ep->regs->ep_rsp);
1348         }
1349         spin_unlock_irqrestore (&ep->dev->lock, flags);
1350
1351         return retval;
1352 }
1353
1354 static int
1355 net2280_fifo_status (struct usb_ep *_ep)
1356 {
1357         struct net2280_ep       *ep;
1358         u32                     avail;
1359
1360         ep = container_of (_ep, struct net2280_ep, ep);
1361         if (!_ep || (!ep->desc && ep->num != 0))
1362                 return -ENODEV;
1363         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1364                 return -ESHUTDOWN;
1365
1366         avail = readl (&ep->regs->ep_avail) & ((1 << 12) - 1);
1367         if (avail > ep->fifo_size)
1368                 return -EOVERFLOW;
1369         if (ep->is_in)
1370                 avail = ep->fifo_size - avail;
1371         return avail;
1372 }
1373
1374 static void
1375 net2280_fifo_flush (struct usb_ep *_ep)
1376 {
1377         struct net2280_ep       *ep;
1378
1379         ep = container_of (_ep, struct net2280_ep, ep);
1380         if (!_ep || (!ep->desc && ep->num != 0))
1381                 return;
1382         if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1383                 return;
1384
1385         writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
1386         (void) readl (&ep->regs->ep_rsp);
1387 }
1388
1389 static const struct usb_ep_ops net2280_ep_ops = {
1390         .enable         = net2280_enable,
1391         .disable        = net2280_disable,
1392
1393         .alloc_request  = net2280_alloc_request,
1394         .free_request   = net2280_free_request,
1395
1396         .alloc_buffer   = net2280_alloc_buffer,
1397         .free_buffer    = net2280_free_buffer,
1398
1399         .queue          = net2280_queue,
1400         .dequeue        = net2280_dequeue,
1401
1402         .set_halt       = net2280_set_halt,
1403         .fifo_status    = net2280_fifo_status,
1404         .fifo_flush     = net2280_fifo_flush,
1405 };
1406
1407 /*-------------------------------------------------------------------------*/
1408
1409 static int net2280_get_frame (struct usb_gadget *_gadget)
1410 {
1411         struct net2280          *dev;
1412         unsigned long           flags;
1413         u16                     retval;
1414
1415         if (!_gadget)
1416                 return -ENODEV;
1417         dev = container_of (_gadget, struct net2280, gadget);
1418         spin_lock_irqsave (&dev->lock, flags);
1419         retval = get_idx_reg (dev->regs, REG_FRAME) & 0x03ff;
1420         spin_unlock_irqrestore (&dev->lock, flags);
1421         return retval;
1422 }
1423
1424 static int net2280_wakeup (struct usb_gadget *_gadget)
1425 {
1426         struct net2280          *dev;
1427         u32                     tmp;
1428         unsigned long           flags;
1429
1430         if (!_gadget)
1431                 return 0;
1432         dev = container_of (_gadget, struct net2280, gadget);
1433
1434         spin_lock_irqsave (&dev->lock, flags);
1435         tmp = readl (&dev->usb->usbctl);
1436         if (tmp & (1 << DEVICE_REMOTE_WAKEUP_ENABLE))
1437                 writel (1 << GENERATE_RESUME, &dev->usb->usbstat);
1438         spin_unlock_irqrestore (&dev->lock, flags);
1439
1440         /* pci writes may still be posted */
1441         return 0;
1442 }
1443
1444 static int net2280_set_selfpowered (struct usb_gadget *_gadget, int value)
1445 {
1446         struct net2280          *dev;
1447         u32                     tmp;
1448         unsigned long           flags;
1449
1450         if (!_gadget)
1451                 return 0;
1452         dev = container_of (_gadget, struct net2280, gadget);
1453
1454         spin_lock_irqsave (&dev->lock, flags);
1455         tmp = readl (&dev->usb->usbctl);
1456         if (value)
1457                 tmp |= (1 << SELF_POWERED_STATUS);
1458         else
1459                 tmp &= ~(1 << SELF_POWERED_STATUS);
1460         writel (tmp, &dev->usb->usbctl);
1461         spin_unlock_irqrestore (&dev->lock, flags);
1462
1463         return 0;
1464 }
1465
1466 static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
1467 {
1468         struct net2280  *dev;
1469         u32             tmp;
1470         unsigned long   flags;
1471
1472         if (!_gadget)
1473                 return -ENODEV;
1474         dev = container_of (_gadget, struct net2280, gadget);
1475
1476         spin_lock_irqsave (&dev->lock, flags);
1477         tmp = readl (&dev->usb->usbctl);
1478         dev->softconnect = (is_on != 0);
1479         if (is_on)
1480                 tmp |= (1 << USB_DETECT_ENABLE);
1481         else
1482                 tmp &= ~(1 << USB_DETECT_ENABLE);
1483         writel (tmp, &dev->usb->usbctl);
1484         spin_unlock_irqrestore (&dev->lock, flags);
1485
1486         return 0;
1487 }
1488
1489 static const struct usb_gadget_ops net2280_ops = {
1490         .get_frame      = net2280_get_frame,
1491         .wakeup         = net2280_wakeup,
1492         .set_selfpowered = net2280_set_selfpowered,
1493         .pullup         = net2280_pullup,
1494 };
1495
1496 /*-------------------------------------------------------------------------*/
1497
1498 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
1499
1500 /* FIXME move these into procfs, and use seq_file.
1501  * Sysfs _still_ doesn't behave for arbitrarily sized files,
1502  * and also doesn't help products using this with 2.4 kernels.
1503  */
1504
1505 /* "function" sysfs attribute */
1506 static ssize_t
1507 show_function (struct device *_dev, struct device_attribute *attr, char *buf)
1508 {
1509         struct net2280  *dev = dev_get_drvdata (_dev);
1510
1511         if (!dev->driver
1512                         || !dev->driver->function
1513                         || strlen (dev->driver->function) > PAGE_SIZE)
1514                 return 0;
1515         return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
1516 }
1517 static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
1518
1519 static ssize_t
1520 show_registers (struct device *_dev, struct device_attribute *attr, char *buf)
1521 {
1522         struct net2280          *dev;
1523         char                    *next;
1524         unsigned                size, t;
1525         unsigned long           flags;
1526         int                     i;
1527         u32                     t1, t2;
1528         const char              *s;
1529
1530         dev = dev_get_drvdata (_dev);
1531         next = buf;
1532         size = PAGE_SIZE;
1533         spin_lock_irqsave (&dev->lock, flags);
1534
1535         if (dev->driver)
1536                 s = dev->driver->driver.name;
1537         else
1538                 s = "(none)";
1539
1540         /* Main Control Registers */
1541         t = scnprintf (next, size, "%s version " DRIVER_VERSION
1542                         ", chiprev %04x, dma %s\n\n"
1543                         "devinit %03x fifoctl %08x gadget '%s'\n"
1544                         "pci irqenb0 %02x irqenb1 %08x "
1545                         "irqstat0 %04x irqstat1 %08x\n",
1546                         driver_name, dev->chiprev,
1547                         use_dma
1548                                 ? (use_dma_chaining ? "chaining" : "enabled")
1549                                 : "disabled",
1550                         readl (&dev->regs->devinit),
1551                         readl (&dev->regs->fifoctl),
1552                         s,
1553                         readl (&dev->regs->pciirqenb0),
1554                         readl (&dev->regs->pciirqenb1),
1555                         readl (&dev->regs->irqstat0),
1556                         readl (&dev->regs->irqstat1));
1557         size -= t;
1558         next += t;
1559
1560         /* USB Control Registers */
1561         t1 = readl (&dev->usb->usbctl);
1562         t2 = readl (&dev->usb->usbstat);
1563         if (t1 & (1 << VBUS_PIN)) {
1564                 if (t2 & (1 << HIGH_SPEED))
1565                         s = "high speed";
1566                 else if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1567                         s = "powered";
1568                 else
1569                         s = "full speed";
1570                 /* full speed bit (6) not working?? */
1571         } else
1572                         s = "not attached";
1573         t = scnprintf (next, size,
1574                         "stdrsp %08x usbctl %08x usbstat %08x "
1575                                 "addr 0x%02x (%s)\n",
1576                         readl (&dev->usb->stdrsp), t1, t2,
1577                         readl (&dev->usb->ouraddr), s);
1578         size -= t;
1579         next += t;
1580
1581         /* PCI Master Control Registers */
1582
1583         /* DMA Control Registers */
1584
1585         /* Configurable EP Control Registers */
1586         for (i = 0; i < 7; i++) {
1587                 struct net2280_ep       *ep;
1588
1589                 ep = &dev->ep [i];
1590                 if (i && !ep->desc)
1591                         continue;
1592
1593                 t1 = readl (&ep->regs->ep_cfg);
1594                 t2 = readl (&ep->regs->ep_rsp) & 0xff;
1595                 t = scnprintf (next, size,
1596                                 "\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
1597                                         "irqenb %02x\n",
1598                                 ep->ep.name, t1, t2,
1599                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS))
1600                                         ? "NAK " : "",
1601                                 (t2 & (1 << CLEAR_EP_HIDE_STATUS_PHASE))
1602                                         ? "hide " : "",
1603                                 (t2 & (1 << CLEAR_EP_FORCE_CRC_ERROR))
1604                                         ? "CRC " : "",
1605                                 (t2 & (1 << CLEAR_INTERRUPT_MODE))
1606                                         ? "interrupt " : "",
1607                                 (t2 & (1<<CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE))
1608                                         ? "status " : "",
1609                                 (t2 & (1 << CLEAR_NAK_OUT_PACKETS_MODE))
1610                                         ? "NAKmode " : "",
1611                                 (t2 & (1 << CLEAR_ENDPOINT_TOGGLE))
1612                                         ? "DATA1 " : "DATA0 ",
1613                                 (t2 & (1 << CLEAR_ENDPOINT_HALT))
1614                                         ? "HALT " : "",
1615                                 readl (&ep->regs->ep_irqenb));
1616                 size -= t;
1617                 next += t;
1618
1619                 t = scnprintf (next, size,
1620                                 "\tstat %08x avail %04x "
1621                                 "(ep%d%s-%s)%s\n",
1622                                 readl (&ep->regs->ep_stat),
1623                                 readl (&ep->regs->ep_avail),
1624                                 t1 & 0x0f, DIR_STRING (t1),
1625                                 type_string (t1 >> 8),
1626                                 ep->stopped ? "*" : "");
1627                 size -= t;
1628                 next += t;
1629
1630                 if (!ep->dma)
1631                         continue;
1632
1633                 t = scnprintf (next, size,
1634                                 "  dma\tctl %08x stat %08x count %08x\n"
1635                                 "\taddr %08x desc %08x\n",
1636                                 readl (&ep->dma->dmactl),
1637                                 readl (&ep->dma->dmastat),
1638                                 readl (&ep->dma->dmacount),
1639                                 readl (&ep->dma->dmaaddr),
1640                                 readl (&ep->dma->dmadesc));
1641                 size -= t;
1642                 next += t;
1643
1644         }
1645
1646         /* Indexed Registers */
1647                 // none yet
1648
1649         /* Statistics */
1650         t = scnprintf (next, size, "\nirqs:  ");
1651         size -= t;
1652         next += t;
1653         for (i = 0; i < 7; i++) {
1654                 struct net2280_ep       *ep;
1655
1656                 ep = &dev->ep [i];
1657                 if (i && !ep->irqs)
1658                         continue;
1659                 t = scnprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
1660                 size -= t;
1661                 next += t;
1662
1663         }
1664         t = scnprintf (next, size, "\n");
1665         size -= t;
1666         next += t;
1667
1668         spin_unlock_irqrestore (&dev->lock, flags);
1669
1670         return PAGE_SIZE - size;
1671 }
1672 static DEVICE_ATTR (registers, S_IRUGO, show_registers, NULL);
1673
1674 static ssize_t
1675 show_queues (struct device *_dev, struct device_attribute *attr, char *buf)
1676 {
1677         struct net2280          *dev;
1678         char                    *next;
1679         unsigned                size;
1680         unsigned long           flags;
1681         int                     i;
1682
1683         dev = dev_get_drvdata (_dev);
1684         next = buf;
1685         size = PAGE_SIZE;
1686         spin_lock_irqsave (&dev->lock, flags);
1687
1688         for (i = 0; i < 7; i++) {
1689                 struct net2280_ep               *ep = &dev->ep [i];
1690                 struct net2280_request          *req;
1691                 int                             t;
1692
1693                 if (i != 0) {
1694                         const struct usb_endpoint_descriptor    *d;
1695
1696                         d = ep->desc;
1697                         if (!d)
1698                                 continue;
1699                         t = d->bEndpointAddress;
1700                         t = scnprintf (next, size,
1701                                 "\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
1702                                 ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
1703                                 (t & USB_DIR_IN) ? "in" : "out",
1704                                 ({ char *val;
1705                                  switch (d->bmAttributes & 0x03) {
1706                                  case USB_ENDPOINT_XFER_BULK:
1707                                         val = "bulk"; break;
1708                                  case USB_ENDPOINT_XFER_INT:
1709                                         val = "intr"; break;
1710                                  default:
1711                                         val = "iso"; break;
1712                                  }; val; }),
1713                                 le16_to_cpu (d->wMaxPacketSize) & 0x1fff,
1714                                 ep->dma ? "dma" : "pio", ep->fifo_size
1715                                 );
1716                 } else /* ep0 should only have one transfer queued */
1717                         t = scnprintf (next, size, "ep0 max 64 pio %s\n",
1718                                         ep->is_in ? "in" : "out");
1719                 if (t <= 0 || t > size)
1720                         goto done;
1721                 size -= t;
1722                 next += t;
1723
1724                 if (list_empty (&ep->queue)) {
1725                         t = scnprintf (next, size, "\t(nothing queued)\n");
1726                         if (t <= 0 || t > size)
1727                                 goto done;
1728                         size -= t;
1729                         next += t;
1730                         continue;
1731                 }
1732                 list_for_each_entry (req, &ep->queue, queue) {
1733                         if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
1734                                 t = scnprintf (next, size,
1735                                         "\treq %p len %d/%d "
1736                                         "buf %p (dmacount %08x)\n",
1737                                         &req->req, req->req.actual,
1738                                         req->req.length, req->req.buf,
1739                                         readl (&ep->dma->dmacount));
1740                         else
1741                                 t = scnprintf (next, size,
1742                                         "\treq %p len %d/%d buf %p\n",
1743                                         &req->req, req->req.actual,
1744                                         req->req.length, req->req.buf);
1745                         if (t <= 0 || t > size)
1746                                 goto done;
1747                         size -= t;
1748                         next += t;
1749
1750                         if (ep->dma) {
1751                                 struct net2280_dma      *td;
1752
1753                                 td = req->td;
1754                                 t = scnprintf (next, size, "\t    td %08x "
1755                                         " count %08x buf %08x desc %08x\n",
1756                                         (u32) req->td_dma,
1757                                         le32_to_cpu (td->dmacount),
1758                                         le32_to_cpu (td->dmaaddr),
1759                                         le32_to_cpu (td->dmadesc));
1760                                 if (t <= 0 || t > size)
1761                                         goto done;
1762                                 size -= t;
1763                                 next += t;
1764                         }
1765                 }
1766         }
1767
1768 done:
1769         spin_unlock_irqrestore (&dev->lock, flags);
1770         return PAGE_SIZE - size;
1771 }
1772 static DEVICE_ATTR (queues, S_IRUGO, show_queues, NULL);
1773
1774
1775 #else
1776
1777 #define device_create_file(a,b) (0)
1778 #define device_remove_file(a,b) do { } while (0)
1779
1780 #endif
1781
1782 /*-------------------------------------------------------------------------*/
1783
1784 /* another driver-specific mode might be a request type doing dma
1785  * to/from another device fifo instead of to/from memory.
1786  */
1787
1788 static void set_fifo_mode (struct net2280 *dev, int mode)
1789 {
1790         /* keeping high bits preserves BAR2 */
1791         writel ((0xffff << PCI_BASE2_RANGE) | mode, &dev->regs->fifoctl);
1792
1793         /* always ep-{a,b,e,f} ... maybe not ep-c or ep-d */
1794         INIT_LIST_HEAD (&dev->gadget.ep_list);
1795         list_add_tail (&dev->ep [1].ep.ep_list, &dev->gadget.ep_list);
1796         list_add_tail (&dev->ep [2].ep.ep_list, &dev->gadget.ep_list);
1797         switch (mode) {
1798         case 0:
1799                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1800                 list_add_tail (&dev->ep [4].ep.ep_list, &dev->gadget.ep_list);
1801                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 1024;
1802                 break;
1803         case 1:
1804                 dev->ep [1].fifo_size = dev->ep [2].fifo_size = 2048;
1805                 break;
1806         case 2:
1807                 list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1808                 dev->ep [1].fifo_size = 2048;
1809                 dev->ep [2].fifo_size = 1024;
1810                 break;
1811         }
1812         /* fifo sizes for ep0, ep-c, ep-d, ep-e, and ep-f never change */
1813         list_add_tail (&dev->ep [5].ep.ep_list, &dev->gadget.ep_list);
1814         list_add_tail (&dev->ep [6].ep.ep_list, &dev->gadget.ep_list);
1815 }
1816
1817 /* just declare this in any driver that really need it */
1818 extern int net2280_set_fifo_mode (struct usb_gadget *gadget, int mode);
1819
1820 /**
1821  * net2280_set_fifo_mode - change allocation of fifo buffers
1822  * @gadget: access to the net2280 device that will be updated
1823  * @mode: 0 for default, four 1kB buffers (ep-a through ep-d);
1824  *      1 for two 2kB buffers (ep-a and ep-b only);
1825  *      2 for one 2kB buffer (ep-a) and two 1kB ones (ep-b, ep-c).
1826  *
1827  * returns zero on success, else negative errno.  when this succeeds,
1828  * the contents of gadget->ep_list may have changed.
1829  *
1830  * you may only call this function when endpoints a-d are all disabled.
1831  * use it whenever extra hardware buffering can help performance, such
1832  * as before enabling "high bandwidth" interrupt endpoints that use
1833  * maxpacket bigger than 512 (when double buffering would otherwise
1834  * be unavailable).
1835  */
1836 int net2280_set_fifo_mode (struct usb_gadget *gadget, int mode)
1837 {
1838         int                     i;
1839         struct net2280          *dev;
1840         int                     status = 0;
1841         unsigned long           flags;
1842
1843         if (!gadget)
1844                 return -ENODEV;
1845         dev = container_of (gadget, struct net2280, gadget);
1846
1847         spin_lock_irqsave (&dev->lock, flags);
1848
1849         for (i = 1; i <= 4; i++)
1850                 if (dev->ep [i].desc) {
1851                         status = -EINVAL;
1852                         break;
1853                 }
1854         if (mode < 0 || mode > 2)
1855                 status = -EINVAL;
1856         if (status == 0)
1857                 set_fifo_mode (dev, mode);
1858         spin_unlock_irqrestore (&dev->lock, flags);
1859
1860         if (status == 0) {
1861                 if (mode == 1)
1862                         DEBUG (dev, "fifo:  ep-a 2K, ep-b 2K\n");
1863                 else if (mode == 2)
1864                         DEBUG (dev, "fifo:  ep-a 2K, ep-b 1K, ep-c 1K\n");
1865                 /* else all are 1K */
1866         }
1867         return status;
1868 }
1869 EXPORT_SYMBOL (net2280_set_fifo_mode);
1870
1871 /*-------------------------------------------------------------------------*/
1872
1873 /* keeping it simple:
1874  * - one bus driver, initted first;
1875  * - one function driver, initted second
1876  *
1877  * most of the work to support multiple net2280 controllers would
1878  * be to associate this gadget driver (yes?) with all of them, or
1879  * perhaps to bind specific drivers to specific devices.
1880  */
1881
1882 static struct net2280   *the_controller;
1883
1884 static void usb_reset (struct net2280 *dev)
1885 {
1886         u32     tmp;
1887
1888         dev->gadget.speed = USB_SPEED_UNKNOWN;
1889         (void) readl (&dev->usb->usbctl);
1890
1891         net2280_led_init (dev);
1892
1893         /* disable automatic responses, and irqs */
1894         writel (0, &dev->usb->stdrsp);
1895         writel (0, &dev->regs->pciirqenb0);
1896         writel (0, &dev->regs->pciirqenb1);
1897
1898         /* clear old dma and irq state */
1899         for (tmp = 0; tmp < 4; tmp++) {
1900                 struct net2280_ep       *ep = &dev->ep [tmp + 1];
1901
1902                 if (ep->dma)
1903                         abort_dma (ep);
1904         }
1905         writel (~0, &dev->regs->irqstat0),
1906         writel (~(1 << SUSPEND_REQUEST_INTERRUPT), &dev->regs->irqstat1),
1907
1908         /* reset, and enable pci */
1909         tmp = readl (&dev->regs->devinit)
1910                 | (1 << PCI_ENABLE)
1911                 | (1 << FIFO_SOFT_RESET)
1912                 | (1 << USB_SOFT_RESET)
1913                 | (1 << M8051_RESET);
1914         writel (tmp, &dev->regs->devinit);
1915
1916         /* standard fifo and endpoint allocations */
1917         set_fifo_mode (dev, (fifo_mode <= 2) ? fifo_mode : 0);
1918 }
1919
1920 static void usb_reinit (struct net2280 *dev)
1921 {
1922         u32     tmp;
1923         int     init_dma;
1924
1925         /* use_dma changes are ignored till next device re-init */
1926         init_dma = use_dma;
1927
1928         /* basic endpoint init */
1929         for (tmp = 0; tmp < 7; tmp++) {
1930                 struct net2280_ep       *ep = &dev->ep [tmp];
1931
1932                 ep->ep.name = ep_name [tmp];
1933                 ep->dev = dev;
1934                 ep->num = tmp;
1935
1936                 if (tmp > 0 && tmp <= 4) {
1937                         ep->fifo_size = 1024;
1938                         if (init_dma)
1939                                 ep->dma = &dev->dma [tmp - 1];
1940                 } else
1941                         ep->fifo_size = 64;
1942                 ep->regs = &dev->epregs [tmp];
1943                 ep_reset (dev->regs, ep);
1944         }
1945         dev->ep [0].ep.maxpacket = 64;
1946         dev->ep [5].ep.maxpacket = 64;
1947         dev->ep [6].ep.maxpacket = 64;
1948
1949         dev->gadget.ep0 = &dev->ep [0].ep;
1950         dev->ep [0].stopped = 0;
1951         INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
1952
1953         /* we want to prevent lowlevel/insecure access from the USB host,
1954          * but erratum 0119 means this enable bit is ignored
1955          */
1956         for (tmp = 0; tmp < 5; tmp++)
1957                 writel (EP_DONTUSE, &dev->dep [tmp].dep_cfg);
1958 }
1959
1960 static void ep0_start (struct net2280 *dev)
1961 {
1962         writel (  (1 << CLEAR_EP_HIDE_STATUS_PHASE)
1963                 | (1 << CLEAR_NAK_OUT_PACKETS)
1964                 | (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
1965                 , &dev->epregs [0].ep_rsp);
1966
1967         /*
1968          * hardware optionally handles a bunch of standard requests
1969          * that the API hides from drivers anyway.  have it do so.
1970          * endpoint status/features are handled in software, to
1971          * help pass tests for some dubious behavior.
1972          */
1973         writel (  (1 << SET_TEST_MODE)
1974                 | (1 << SET_ADDRESS)
1975                 | (1 << DEVICE_SET_CLEAR_DEVICE_REMOTE_WAKEUP)
1976                 | (1 << GET_DEVICE_STATUS)
1977                 | (1 << GET_INTERFACE_STATUS)
1978                 , &dev->usb->stdrsp);
1979         writel (  (1 << USB_ROOT_PORT_WAKEUP_ENABLE)
1980                 | (1 << SELF_POWERED_USB_DEVICE)
1981                 | (1 << REMOTE_WAKEUP_SUPPORT)
1982                 | (dev->softconnect << USB_DETECT_ENABLE)
1983                 | (1 << SELF_POWERED_STATUS)
1984                 , &dev->usb->usbctl);
1985
1986         /* enable irqs so we can see ep0 and general operation  */
1987         writel (  (1 << SETUP_PACKET_INTERRUPT_ENABLE)
1988                 | (1 << ENDPOINT_0_INTERRUPT_ENABLE)
1989                 , &dev->regs->pciirqenb0);
1990         writel (  (1 << PCI_INTERRUPT_ENABLE)
1991                 | (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT_ENABLE)
1992                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT_ENABLE)
1993                 | (1 << PCI_RETRY_ABORT_INTERRUPT_ENABLE)
1994                 | (1 << VBUS_INTERRUPT_ENABLE)
1995                 | (1 << ROOT_PORT_RESET_INTERRUPT_ENABLE)
1996                 | (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT_ENABLE)
1997                 , &dev->regs->pciirqenb1);
1998
1999         /* don't leave any writes posted */
2000         (void) readl (&dev->usb->usbctl);
2001 }
2002
2003 /* when a driver is successfully registered, it will receive
2004  * control requests including set_configuration(), which enables
2005  * non-control requests.  then usb traffic follows until a
2006  * disconnect is reported.  then a host may connect again, or
2007  * the driver might get unbound.
2008  */
2009 int usb_gadget_register_driver (struct usb_gadget_driver *driver)
2010 {
2011         struct net2280          *dev = the_controller;
2012         int                     retval;
2013         unsigned                i;
2014
2015         /* insist on high speed support from the driver, since
2016          * (dev->usb->xcvrdiag & FORCE_FULL_SPEED_MODE)
2017          * "must not be used in normal operation"
2018          */
2019         if (!driver
2020                         || driver->speed != USB_SPEED_HIGH
2021                         || !driver->bind
2022                         || !driver->setup)
2023                 return -EINVAL;
2024         if (!dev)
2025                 return -ENODEV;
2026         if (dev->driver)
2027                 return -EBUSY;
2028
2029         for (i = 0; i < 7; i++)
2030                 dev->ep [i].irqs = 0;
2031
2032         /* hook up the driver ... */
2033         dev->softconnect = 1;
2034         driver->driver.bus = NULL;
2035         dev->driver = driver;
2036         dev->gadget.dev.driver = &driver->driver;
2037         retval = driver->bind (&dev->gadget);
2038         if (retval) {
2039                 DEBUG (dev, "bind to driver %s --> %d\n",
2040                                 driver->driver.name, retval);
2041                 dev->driver = NULL;
2042                 dev->gadget.dev.driver = NULL;
2043                 return retval;
2044         }
2045
2046         retval = device_create_file (&dev->pdev->dev, &dev_attr_function);
2047         if (retval) goto err_unbind;
2048         retval = device_create_file (&dev->pdev->dev, &dev_attr_queues);
2049         if (retval) goto err_func;
2050
2051         /* ... then enable host detection and ep0; and we're ready
2052          * for set_configuration as well as eventual disconnect.
2053          */
2054         net2280_led_active (dev, 1);
2055         ep0_start (dev);
2056
2057         DEBUG (dev, "%s ready, usbctl %08x stdrsp %08x\n",
2058                         driver->driver.name,
2059                         readl (&dev->usb->usbctl),
2060                         readl (&dev->usb->stdrsp));
2061
2062         /* pci writes may still be posted */
2063         return 0;
2064
2065 err_func:
2066         device_remove_file (&dev->pdev->dev, &dev_attr_function);
2067 err_unbind:
2068         driver->unbind (&dev->gadget);
2069         dev->gadget.dev.driver = NULL;
2070         dev->driver = NULL;
2071         return retval;
2072 }
2073 EXPORT_SYMBOL (usb_gadget_register_driver);
2074
2075 static void
2076 stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
2077 {
2078         int                     i;
2079
2080         /* don't disconnect if it's not connected */
2081         if (dev->gadget.speed == USB_SPEED_UNKNOWN)
2082                 driver = NULL;
2083
2084         /* stop hardware; prevent new request submissions;
2085          * and kill any outstanding requests.
2086          */
2087         usb_reset (dev);
2088         for (i = 0; i < 7; i++)
2089                 nuke (&dev->ep [i]);
2090
2091         /* report disconnect; the driver is already quiesced */
2092         if (driver) {
2093                 spin_unlock (&dev->lock);
2094                 driver->disconnect (&dev->gadget);
2095                 spin_lock (&dev->lock);
2096         }
2097
2098         usb_reinit (dev);
2099 }
2100
2101 int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
2102 {
2103         struct net2280  *dev = the_controller;
2104         unsigned long   flags;
2105
2106         if (!dev)
2107                 return -ENODEV;
2108         if (!driver || driver != dev->driver || !driver->unbind)
2109                 return -EINVAL;
2110
2111         spin_lock_irqsave (&dev->lock, flags);
2112         stop_activity (dev, driver);
2113         spin_unlock_irqrestore (&dev->lock, flags);
2114
2115         net2280_pullup (&dev->gadget, 0);
2116
2117         driver->unbind (&dev->gadget);
2118         dev->gadget.dev.driver = NULL;
2119         dev->driver = NULL;
2120
2121         net2280_led_active (dev, 0);
2122         device_remove_file (&dev->pdev->dev, &dev_attr_function);
2123         device_remove_file (&dev->pdev->dev, &dev_attr_queues);
2124
2125         DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
2126         return 0;
2127 }
2128 EXPORT_SYMBOL (usb_gadget_unregister_driver);
2129
2130
2131 /*-------------------------------------------------------------------------*/
2132
2133 /* handle ep0, ep-e, ep-f with 64 byte packets: packet per irq.
2134  * also works for dma-capable endpoints, in pio mode or just
2135  * to manually advance the queue after short OUT transfers.
2136  */
2137 static void handle_ep_small (struct net2280_ep *ep)
2138 {
2139         struct net2280_request  *req;
2140         u32                     t;
2141         /* 0 error, 1 mid-data, 2 done */
2142         int                     mode = 1;
2143
2144         if (!list_empty (&ep->queue))
2145                 req = list_entry (ep->queue.next,
2146                         struct net2280_request, queue);
2147         else
2148                 req = NULL;
2149
2150         /* ack all, and handle what we care about */
2151         t = readl (&ep->regs->ep_stat);
2152         ep->irqs++;
2153 #if 0
2154         VDEBUG (ep->dev, "%s ack ep_stat %08x, req %p\n",
2155                         ep->ep.name, t, req ? &req->req : 0);
2156 #endif
2157         if (!ep->is_in || ep->dev->pdev->device == 0x2280)
2158                 writel (t & ~(1 << NAK_OUT_PACKETS), &ep->regs->ep_stat);
2159         else
2160                 /* Added for 2282 */
2161                 writel (t, &ep->regs->ep_stat);
2162
2163         /* for ep0, monitor token irqs to catch data stage length errors
2164          * and to synchronize on status.
2165          *
2166          * also, to defer reporting of protocol stalls ... here's where
2167          * data or status first appears, handling stalls here should never
2168          * cause trouble on the host side..
2169          *
2170          * control requests could be slightly faster without token synch for
2171          * status, but status can jam up that way.
2172          */
2173         if (unlikely (ep->num == 0)) {
2174                 if (ep->is_in) {
2175                         /* status; stop NAKing */
2176                         if (t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)) {
2177                                 if (ep->dev->protocol_stall) {
2178                                         ep->stopped = 1;
2179                                         set_halt (ep);
2180                                 }
2181                                 if (!req)
2182                                         allow_status (ep);
2183                                 mode = 2;
2184                         /* reply to extra IN data tokens with a zlp */
2185                         } else if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2186                                 if (ep->dev->protocol_stall) {
2187                                         ep->stopped = 1;
2188                                         set_halt (ep);
2189                                         mode = 2;
2190                                 } else if (ep->responded &&
2191                                                 !req && !ep->stopped)
2192                                         write_fifo (ep, NULL);
2193                         }
2194                 } else {
2195                         /* status; stop NAKing */
2196                         if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2197                                 if (ep->dev->protocol_stall) {
2198                                         ep->stopped = 1;
2199                                         set_halt (ep);
2200                                 }
2201                                 mode = 2;
2202                         /* an extra OUT token is an error */
2203                         } else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
2204                                         && req
2205                                         && req->req.actual == req->req.length)
2206                                         || (ep->responded && !req)) {
2207                                 ep->dev->protocol_stall = 1;
2208                                 set_halt (ep);
2209                                 ep->stopped = 1;
2210                                 if (req)
2211                                         done (ep, req, -EOVERFLOW);
2212                                 req = NULL;
2213                         }
2214                 }
2215         }
2216
2217         if (unlikely (!req))
2218                 return;
2219
2220         /* manual DMA queue advance after short OUT */
2221         if (likely (ep->dma != 0)) {
2222                 if (t & (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)) {
2223                         u32     count;
2224                         int     stopped = ep->stopped;
2225
2226                         /* TRANSFERRED works around OUT_DONE erratum 0112.
2227                          * we expect (N <= maxpacket) bytes; host wrote M.
2228                          * iff (M < N) we won't ever see a DMA interrupt.
2229                          */
2230                         ep->stopped = 1;
2231                         for (count = 0; ; t = readl (&ep->regs->ep_stat)) {
2232
2233                                 /* any preceding dma transfers must finish.
2234                                  * dma handles (M >= N), may empty the queue
2235                                  */
2236                                 scan_dma_completions (ep);
2237                                 if (unlikely (list_empty (&ep->queue)
2238                                                 || ep->out_overflow)) {
2239                                         req = NULL;
2240                                         break;
2241                                 }
2242                                 req = list_entry (ep->queue.next,
2243                                         struct net2280_request, queue);
2244
2245                                 /* here either (M < N), a "real" short rx;
2246                                  * or (M == N) and the queue didn't empty
2247                                  */
2248                                 if (likely (t & (1 << FIFO_EMPTY))) {
2249                                         count = readl (&ep->dma->dmacount);
2250                                         count &= DMA_BYTE_COUNT_MASK;
2251                                         if (readl (&ep->dma->dmadesc)
2252                                                         != req->td_dma)
2253                                                 req = NULL;
2254                                         break;
2255                                 }
2256                                 udelay(1);
2257                         }
2258
2259                         /* stop DMA, leave ep NAKing */
2260                         writel ((1 << DMA_ABORT), &ep->dma->dmastat);
2261                         spin_stop_dma (ep->dma);
2262
2263                         if (likely (req)) {
2264                                 req->td->dmacount = 0;
2265                                 t = readl (&ep->regs->ep_avail);
2266                                 dma_done (ep, req, count,
2267                                         (ep->out_overflow || t)
2268                                                 ? -EOVERFLOW : 0);
2269                         }
2270
2271                         /* also flush to prevent erratum 0106 trouble */
2272                         if (unlikely (ep->out_overflow
2273                                         || (ep->dev->chiprev == 0x0100
2274                                                 && ep->dev->gadget.speed
2275                                                         == USB_SPEED_FULL))) {
2276                                 out_flush (ep);
2277                                 ep->out_overflow = 0;
2278                         }
2279
2280                         /* (re)start dma if needed, stop NAKing */
2281                         ep->stopped = stopped;
2282                         if (!list_empty (&ep->queue))
2283                                 restart_dma (ep);
2284                 } else
2285                         DEBUG (ep->dev, "%s dma ep_stat %08x ??\n",
2286                                         ep->ep.name, t);
2287                 return;
2288
2289         /* data packet(s) received (in the fifo, OUT) */
2290         } else if (t & (1 << DATA_PACKET_RECEIVED_INTERRUPT)) {
2291                 if (read_fifo (ep, req) && ep->num != 0)
2292                         mode = 2;
2293
2294         /* data packet(s) transmitted (IN) */
2295         } else if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)) {
2296                 unsigned        len;
2297
2298                 len = req->req.length - req->req.actual;
2299                 if (len > ep->ep.maxpacket)
2300                         len = ep->ep.maxpacket;
2301                 req->req.actual += len;
2302
2303                 /* if we wrote it all, we're usually done */
2304                 if (req->req.actual == req->req.length) {
2305                         if (ep->num == 0) {
2306                                 /* send zlps until the status stage */
2307                         } else if (!req->req.zero || len != ep->ep.maxpacket)
2308                                 mode = 2;
2309                 }
2310
2311         /* there was nothing to do ...  */
2312         } else if (mode == 1)
2313                 return;
2314
2315         /* done */
2316         if (mode == 2) {
2317                 /* stream endpoints often resubmit/unlink in completion */
2318                 done (ep, req, 0);
2319
2320                 /* maybe advance queue to next request */
2321                 if (ep->num == 0) {
2322                         /* NOTE:  net2280 could let gadget driver start the
2323                          * status stage later. since not all controllers let
2324                          * them control that, the api doesn't (yet) allow it.
2325                          */
2326                         if (!ep->stopped)
2327                                 allow_status (ep);
2328                         req = NULL;
2329                 } else {
2330                         if (!list_empty (&ep->queue) && !ep->stopped)
2331                                 req = list_entry (ep->queue.next,
2332                                         struct net2280_request, queue);
2333                         else
2334                                 req = NULL;
2335                         if (req && !ep->is_in)
2336                                 stop_out_naking (ep);
2337                 }
2338         }
2339
2340         /* is there a buffer for the next packet?
2341          * for best streaming performance, make sure there is one.
2342          */
2343         if (req && !ep->stopped) {
2344
2345                 /* load IN fifo with next packet (may be zlp) */
2346                 if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT))
2347                         write_fifo (ep, &req->req);
2348         }
2349 }
2350
2351 static struct net2280_ep *
2352 get_ep_by_addr (struct net2280 *dev, u16 wIndex)
2353 {
2354         struct net2280_ep       *ep;
2355
2356         if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
2357                 return &dev->ep [0];
2358         list_for_each_entry (ep, &dev->gadget.ep_list, ep.ep_list) {
2359                 u8      bEndpointAddress;
2360
2361                 if (!ep->desc)
2362                         continue;
2363                 bEndpointAddress = ep->desc->bEndpointAddress;
2364                 if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
2365                         continue;
2366                 if ((wIndex & 0x0f) == (bEndpointAddress & 0x0f))
2367                         return ep;
2368         }
2369         return NULL;
2370 }
2371
2372 static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
2373 {
2374         struct net2280_ep       *ep;
2375         u32                     num, scratch;
2376
2377         /* most of these don't need individual acks */
2378         stat &= ~(1 << INTA_ASSERTED);
2379         if (!stat)
2380                 return;
2381         // DEBUG (dev, "irqstat0 %04x\n", stat);
2382
2383         /* starting a control request? */
2384         if (unlikely (stat & (1 << SETUP_PACKET_INTERRUPT))) {
2385                 union {
2386                         u32                     raw [2];
2387                         struct usb_ctrlrequest  r;
2388                 } u;
2389                 int                             tmp;
2390                 struct net2280_request          *req;
2391
2392                 if (dev->gadget.speed == USB_SPEED_UNKNOWN) {
2393                         if (readl (&dev->usb->usbstat) & (1 << HIGH_SPEED))
2394                                 dev->gadget.speed = USB_SPEED_HIGH;
2395                         else
2396                                 dev->gadget.speed = USB_SPEED_FULL;
2397                         net2280_led_speed (dev, dev->gadget.speed);
2398                         DEBUG (dev, "%s speed\n",
2399                                 (dev->gadget.speed == USB_SPEED_HIGH)
2400                                         ? "high" : "full");
2401                 }
2402
2403                 ep = &dev->ep [0];
2404                 ep->irqs++;
2405
2406                 /* make sure any leftover request state is cleared */
2407                 stat &= ~(1 << ENDPOINT_0_INTERRUPT);
2408                 while (!list_empty (&ep->queue)) {
2409                         req = list_entry (ep->queue.next,
2410                                         struct net2280_request, queue);
2411                         done (ep, req, (req->req.actual == req->req.length)
2412                                                 ? 0 : -EPROTO);
2413                 }
2414                 ep->stopped = 0;
2415                 dev->protocol_stall = 0;
2416
2417                 if (ep->dev->pdev->device == 0x2280)
2418                         tmp = (1 << FIFO_OVERFLOW)
2419                                 | (1 << FIFO_UNDERFLOW);
2420                 else
2421                         tmp = 0;
2422
2423                 writel (tmp | (1 << TIMEOUT)
2424                         | (1 << USB_STALL_SENT)
2425                         | (1 << USB_IN_NAK_SENT)
2426                         | (1 << USB_IN_ACK_RCVD)
2427                         | (1 << USB_OUT_PING_NAK_SENT)
2428                         | (1 << USB_OUT_ACK_SENT)
2429                         | (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
2430                         | (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
2431                         | (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2432                         | (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2433                         | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2434                         | (1 << DATA_IN_TOKEN_INTERRUPT)
2435                         , &ep->regs->ep_stat);
2436                 u.raw [0] = readl (&dev->usb->setup0123);
2437                 u.raw [1] = readl (&dev->usb->setup4567);
2438
2439                 cpu_to_le32s (&u.raw [0]);
2440                 cpu_to_le32s (&u.raw [1]);
2441
2442                 tmp = 0;
2443
2444 #define w_value         le16_to_cpup (&u.r.wValue)
2445 #define w_index         le16_to_cpup (&u.r.wIndex)
2446 #define w_length        le16_to_cpup (&u.r.wLength)
2447
2448                 /* ack the irq */
2449                 writel (1 << SETUP_PACKET_INTERRUPT, &dev->regs->irqstat0);
2450                 stat ^= (1 << SETUP_PACKET_INTERRUPT);
2451
2452                 /* watch control traffic at the token level, and force
2453                  * synchronization before letting the status stage happen.
2454                  * FIXME ignore tokens we'll NAK, until driver responds.
2455                  * that'll mean a lot less irqs for some drivers.
2456                  */
2457                 ep->is_in = (u.r.bRequestType & USB_DIR_IN) != 0;
2458                 if (ep->is_in) {
2459                         scratch = (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2460                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2461                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2462                         stop_out_naking (ep);
2463                 } else
2464                         scratch = (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2465                                 | (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2466                                 | (1 << DATA_IN_TOKEN_INTERRUPT);
2467                 writel (scratch, &dev->epregs [0].ep_irqenb);
2468
2469                 /* we made the hardware handle most lowlevel requests;
2470                  * everything else goes uplevel to the gadget code.
2471                  */
2472                 ep->responded = 1;
2473                 switch (u.r.bRequest) {
2474                 case USB_REQ_GET_STATUS: {
2475                         struct net2280_ep       *e;
2476                         __le32                  status;
2477
2478                         /* hw handles device and interface status */
2479                         if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
2480                                 goto delegate;
2481                         if ((e = get_ep_by_addr (dev, w_index)) == 0
2482                                         || w_length > 2)
2483                                 goto do_stall;
2484
2485                         if (readl (&e->regs->ep_rsp)
2486                                         & (1 << SET_ENDPOINT_HALT))
2487                                 status = __constant_cpu_to_le32 (1);
2488                         else
2489                                 status = __constant_cpu_to_le32 (0);
2490
2491                         /* don't bother with a request object! */
2492                         writel (0, &dev->epregs [0].ep_irqenb);
2493                         set_fifo_bytecount (ep, w_length);
2494                         writel ((__force u32)status, &dev->epregs [0].ep_data);
2495                         allow_status (ep);
2496                         VDEBUG (dev, "%s stat %02x\n", ep->ep.name, status);
2497                         goto next_endpoints;
2498                         }
2499                         break;
2500                 case USB_REQ_CLEAR_FEATURE: {
2501                         struct net2280_ep       *e;
2502
2503                         /* hw handles device features */
2504                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2505                                 goto delegate;
2506                         if (w_value != USB_ENDPOINT_HALT
2507                                         || w_length != 0)
2508                                 goto do_stall;
2509                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2510                                 goto do_stall;
2511                         clear_halt (e);
2512                         allow_status (ep);
2513                         VDEBUG (dev, "%s clear halt\n", ep->ep.name);
2514                         goto next_endpoints;
2515                         }
2516                         break;
2517                 case USB_REQ_SET_FEATURE: {
2518                         struct net2280_ep       *e;
2519
2520                         /* hw handles device features */
2521                         if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2522                                 goto delegate;
2523                         if (w_value != USB_ENDPOINT_HALT
2524                                         || w_length != 0)
2525                                 goto do_stall;
2526                         if ((e = get_ep_by_addr (dev, w_index)) == 0)
2527                                 goto do_stall;
2528                         set_halt (e);
2529                         allow_status (ep);
2530                         VDEBUG (dev, "%s set halt\n", ep->ep.name);
2531                         goto next_endpoints;
2532                         }
2533                         break;
2534                 default:
2535 delegate:
2536                         VDEBUG (dev, "setup %02x.%02x v%04x i%04x l%04x"
2537                                 "ep_cfg %08x\n",
2538                                 u.r.bRequestType, u.r.bRequest,
2539                                 w_value, w_index, w_length,
2540                                 readl (&ep->regs->ep_cfg));
2541                         ep->responded = 0;
2542                         spin_unlock (&dev->lock);
2543                         tmp = dev->driver->setup (&dev->gadget, &u.r);
2544                         spin_lock (&dev->lock);
2545                 }
2546
2547                 /* stall ep0 on error */
2548                 if (tmp < 0) {
2549 do_stall:
2550                         VDEBUG (dev, "req %02x.%02x protocol STALL; stat %d\n",
2551                                         u.r.bRequestType, u.r.bRequest, tmp);
2552                         dev->protocol_stall = 1;
2553                 }
2554
2555                 /* some in/out token irq should follow; maybe stall then.
2556                  * driver must queue a request (even zlp) or halt ep0
2557                  * before the host times out.
2558                  */
2559         }
2560
2561 #undef  w_value
2562 #undef  w_index
2563 #undef  w_length
2564
2565 next_endpoints:
2566         /* endpoint data irq ? */
2567         scratch = stat & 0x7f;
2568         stat &= ~0x7f;
2569         for (num = 0; scratch; num++) {
2570                 u32             t;
2571
2572                 /* do this endpoint's FIFO and queue need tending? */
2573                 t = 1 << num;
2574                 if ((scratch & t) == 0)
2575                         continue;
2576                 scratch ^= t;
2577
2578                 ep = &dev->ep [num];
2579                 handle_ep_small (ep);
2580         }
2581
2582         if (stat)
2583                 DEBUG (dev, "unhandled irqstat0 %08x\n", stat);
2584 }
2585
2586 #define DMA_INTERRUPTS ( \
2587                   (1 << DMA_D_INTERRUPT) \
2588                 | (1 << DMA_C_INTERRUPT) \
2589                 | (1 << DMA_B_INTERRUPT) \
2590                 | (1 << DMA_A_INTERRUPT))
2591 #define PCI_ERROR_INTERRUPTS ( \
2592                   (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT) \
2593                 | (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT) \
2594                 | (1 << PCI_RETRY_ABORT_INTERRUPT))
2595
2596 static void handle_stat1_irqs (struct net2280 *dev, u32 stat)
2597 {
2598         struct net2280_ep       *ep;
2599         u32                     tmp, num, mask, scratch;
2600
2601         /* after disconnect there's nothing else to do! */
2602         tmp = (1 << VBUS_INTERRUPT) | (1 << ROOT_PORT_RESET_INTERRUPT);
2603         mask = (1 << HIGH_SPEED) | (1 << FULL_SPEED);
2604
2605         /* VBUS disconnect is indicated by VBUS_PIN and VBUS_INTERRUPT set.
2606          * Root Port Reset is indicated by ROOT_PORT_RESET_INTERRRUPT set and
2607          * both HIGH_SPEED and FULL_SPEED clear (as ROOT_PORT_RESET_INTERRUPT
2608          * only indicates a change in the reset state).
2609          */
2610         if (stat & tmp) {
2611                 writel (tmp, &dev->regs->irqstat1);
2612                 if ((((stat & (1 << ROOT_PORT_RESET_INTERRUPT))
2613                                         && ((readl (&dev->usb->usbstat) & mask)
2614                                                         == 0))
2615                                 || ((readl (&dev->usb->usbctl)
2616                                         & (1 << VBUS_PIN)) == 0)
2617                             ) && ( dev->gadget.speed != USB_SPEED_UNKNOWN)) {
2618                         DEBUG (dev, "disconnect %s\n",
2619                                         dev->driver->driver.name);
2620                         stop_activity (dev, dev->driver);
2621                         ep0_start (dev);
2622                         return;
2623                 }
2624                 stat &= ~tmp;
2625
2626                 /* vBUS can bounce ... one of many reasons to ignore the
2627                  * notion of hotplug events on bus connect/disconnect!
2628                  */
2629                 if (!stat)
2630                         return;
2631         }
2632
2633         /* NOTE: chip stays in PCI D0 state for now, but it could
2634          * enter D1 to save more power
2635          */
2636         tmp = (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT);
2637         if (stat & tmp) {
2638                 writel (tmp, &dev->regs->irqstat1);
2639                 if (stat & (1 << SUSPEND_REQUEST_INTERRUPT)) {
2640                         if (dev->driver->suspend)
2641                                 dev->driver->suspend (&dev->gadget);
2642                         if (!enable_suspend)
2643                                 stat &= ~(1 << SUSPEND_REQUEST_INTERRUPT);
2644                 } else {
2645                         if (dev->driver->resume)
2646                                 dev->driver->resume (&dev->gadget);
2647                         /* at high speed, note erratum 0133 */
2648                 }
2649                 stat &= ~tmp;
2650         }
2651
2652         /* clear any other status/irqs */
2653         if (stat)
2654                 writel (stat, &dev->regs->irqstat1);
2655
2656         /* some status we can just ignore */
2657         if (dev->pdev->device == 0x2280)
2658                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2659                           | (1 << SUSPEND_REQUEST_INTERRUPT)
2660                           | (1 << RESUME_INTERRUPT)
2661                           | (1 << SOF_INTERRUPT));
2662         else
2663                 stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2664                           | (1 << RESUME_INTERRUPT)
2665                           | (1 << SOF_DOWN_INTERRUPT)
2666                           | (1 << SOF_INTERRUPT));
2667
2668         if (!stat)
2669                 return;
2670         // DEBUG (dev, "irqstat1 %08x\n", stat);
2671
2672         /* DMA status, for ep-{a,b,c,d} */
2673         scratch = stat & DMA_INTERRUPTS;
2674         stat &= ~DMA_INTERRUPTS;
2675         scratch >>= 9;
2676         for (num = 0; scratch; num++) {
2677                 struct net2280_dma_regs __iomem *dma;
2678
2679                 tmp = 1 << num;
2680                 if ((tmp & scratch) == 0)
2681                         continue;
2682                 scratch ^= tmp;
2683
2684                 ep = &dev->ep [num + 1];
2685                 dma = ep->dma;
2686
2687                 if (!dma)
2688                         continue;
2689
2690                 /* clear ep's dma status */
2691                 tmp = readl (&dma->dmastat);
2692                 writel (tmp, &dma->dmastat);
2693
2694                 /* chaining should stop on abort, short OUT from fifo,
2695                  * or (stat0 codepath) short OUT transfer.
2696                  */
2697                 if (!use_dma_chaining) {
2698                         if ((tmp & (1 << DMA_TRANSACTION_DONE_INTERRUPT))
2699                                         == 0) {
2700                                 DEBUG (ep->dev, "%s no xact done? %08x\n",
2701                                         ep->ep.name, tmp);
2702                                 continue;
2703                         }
2704                         stop_dma (ep->dma);
2705                 }
2706
2707                 /* OUT transfers terminate when the data from the
2708                  * host is in our memory.  Process whatever's done.
2709                  * On this path, we know transfer's last packet wasn't
2710                  * less than req->length. NAK_OUT_PACKETS may be set,
2711                  * or the FIFO may already be holding new packets.
2712                  *
2713                  * IN transfers can linger in the FIFO for a very
2714                  * long time ... we ignore that for now, accounting
2715                  * precisely (like PIO does) needs per-packet irqs
2716                  */
2717                 scan_dma_completions (ep);
2718
2719                 /* disable dma on inactive queues; else maybe restart */
2720                 if (list_empty (&ep->queue)) {
2721                         if (use_dma_chaining)
2722                                 stop_dma (ep->dma);
2723                 } else {
2724                         tmp = readl (&dma->dmactl);
2725                         if (!use_dma_chaining
2726                                         || (tmp & (1 << DMA_ENABLE)) == 0)
2727                                 restart_dma (ep);
2728                         else if (ep->is_in && use_dma_chaining) {
2729                                 struct net2280_request  *req;
2730                                 __le32                  dmacount;
2731
2732                                 /* the descriptor at the head of the chain
2733                                  * may still have VALID_BIT clear; that's
2734                                  * used to trigger changing DMA_FIFO_VALIDATE
2735                                  * (affects automagic zlp writes).
2736                                  */
2737                                 req = list_entry (ep->queue.next,
2738                                                 struct net2280_request, queue);
2739                                 dmacount = req->td->dmacount;
2740                                 dmacount &= __constant_cpu_to_le32 (
2741                                                 (1 << VALID_BIT)
2742                                                 | DMA_BYTE_COUNT_MASK);
2743                                 if (dmacount && (dmacount & valid_bit) == 0)
2744                                         restart_dma (ep);
2745                         }
2746                 }
2747                 ep->irqs++;
2748         }
2749
2750         /* NOTE:  there are other PCI errors we might usefully notice.
2751          * if they appear very often, here's where to try recovering.
2752          */
2753         if (stat & PCI_ERROR_INTERRUPTS) {
2754                 ERROR (dev, "pci dma error; stat %08x\n", stat);
2755                 stat &= ~PCI_ERROR_INTERRUPTS;
2756                 /* these are fatal errors, but "maybe" they won't
2757                  * happen again ...
2758                  */
2759                 stop_activity (dev, dev->driver);
2760                 ep0_start (dev);
2761                 stat = 0;
2762         }
2763
2764         if (stat)
2765                 DEBUG (dev, "unhandled irqstat1 %08x\n", stat);
2766 }
2767
2768 static irqreturn_t net2280_irq (int irq, void *_dev)
2769 {
2770         struct net2280          *dev = _dev;
2771
2772         /* shared interrupt, not ours */
2773         if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
2774                 return IRQ_NONE;
2775
2776         spin_lock (&dev->lock);
2777
2778         /* handle disconnect, dma, and more */
2779         handle_stat1_irqs (dev, readl (&dev->regs->irqstat1));
2780
2781         /* control requests and PIO */
2782         handle_stat0_irqs (dev, readl (&dev->regs->irqstat0));
2783
2784         spin_unlock (&dev->lock);
2785
2786         return IRQ_HANDLED;
2787 }
2788
2789 /*-------------------------------------------------------------------------*/
2790
2791 static void gadget_release (struct device *_dev)
2792 {
2793         struct net2280  *dev = dev_get_drvdata (_dev);
2794
2795         kfree (dev);
2796 }
2797
2798 /* tear down the binding between this driver and the pci device */
2799
2800 static void net2280_remove (struct pci_dev *pdev)
2801 {
2802         struct net2280          *dev = pci_get_drvdata (pdev);
2803
2804         BUG_ON(dev->driver);
2805
2806         /* then clean up the resources we allocated during probe() */
2807         net2280_led_shutdown (dev);
2808         if (dev->requests) {
2809                 int             i;
2810                 for (i = 1; i < 5; i++) {
2811                         if (!dev->ep [i].dummy)
2812                                 continue;
2813                         pci_pool_free (dev->requests, dev->ep [i].dummy,
2814                                         dev->ep [i].td_dma);
2815                 }
2816                 pci_pool_destroy (dev->requests);
2817         }
2818         if (dev->got_irq)
2819                 free_irq (pdev->irq, dev);
2820         if (dev->regs)
2821                 iounmap (dev->regs);
2822         if (dev->region)
2823                 release_mem_region (pci_resource_start (pdev, 0),
2824                                 pci_resource_len (pdev, 0));
2825         if (dev->enabled)
2826                 pci_disable_device (pdev);
2827         device_unregister (&dev->gadget.dev);
2828         device_remove_file (&pdev->dev, &dev_attr_registers);
2829         pci_set_drvdata (pdev, NULL);
2830
2831         INFO (dev, "unbind\n");
2832
2833         the_controller = NULL;
2834 }
2835
2836 /* wrap this driver around the specified device, but
2837  * don't respond over USB until a gadget driver binds to us.
2838  */
2839
2840 static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
2841 {
2842         struct net2280          *dev;
2843         unsigned long           resource, len;
2844         void                    __iomem *base = NULL;
2845         int                     retval, i;
2846
2847         /* if you want to support more than one controller in a system,
2848          * usb_gadget_driver_{register,unregister}() must change.
2849          */
2850         if (the_controller) {
2851                 dev_warn (&pdev->dev, "ignoring\n");
2852                 return -EBUSY;
2853         }
2854
2855         /* alloc, and start init */
2856         dev = kzalloc (sizeof *dev, GFP_KERNEL);
2857         if (dev == NULL){
2858                 retval = -ENOMEM;
2859                 goto done;
2860         }
2861
2862         pci_set_drvdata (pdev, dev);
2863         spin_lock_init (&dev->lock);
2864         dev->pdev = pdev;
2865         dev->gadget.ops = &net2280_ops;
2866         dev->gadget.is_dualspeed = 1;
2867
2868         /* the "gadget" abstracts/virtualizes the controller */
2869         strcpy (dev->gadget.dev.bus_id, "gadget");
2870         dev->gadget.dev.parent = &pdev->dev;
2871         dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
2872         dev->gadget.dev.release = gadget_release;
2873         dev->gadget.name = driver_name;
2874
2875         /* now all the pci goodies ... */
2876         if (pci_enable_device (pdev) < 0) {
2877                 retval = -ENODEV;
2878                 goto done;
2879         }
2880         dev->enabled = 1;
2881
2882         /* BAR 0 holds all the registers
2883          * BAR 1 is 8051 memory; unused here (note erratum 0103)
2884          * BAR 2 is fifo memory; unused here
2885          */
2886         resource = pci_resource_start (pdev, 0);
2887         len = pci_resource_len (pdev, 0);
2888         if (!request_mem_region (resource, len, driver_name)) {
2889                 DEBUG (dev, "controller already in use\n");
2890                 retval = -EBUSY;
2891                 goto done;
2892         }
2893         dev->region = 1;
2894
2895         /* FIXME provide firmware download interface to put
2896          * 8051 code into the chip, e.g. to turn on PCI PM.
2897          */
2898
2899         base = ioremap_nocache (resource, len);
2900         if (base == NULL) {
2901                 DEBUG (dev, "can't map memory\n");
2902                 retval = -EFAULT;
2903                 goto done;
2904         }
2905         dev->regs = (struct net2280_regs __iomem *) base;
2906         dev->usb = (struct net2280_usb_regs __iomem *) (base + 0x0080);
2907         dev->pci = (struct net2280_pci_regs __iomem *) (base + 0x0100);
2908         dev->dma = (struct net2280_dma_regs __iomem *) (base + 0x0180);
2909         dev->dep = (struct net2280_dep_regs __iomem *) (base + 0x0200);
2910         dev->epregs = (struct net2280_ep_regs __iomem *) (base + 0x0300);
2911
2912         /* put into initial config, link up all endpoints */
2913         writel (0, &dev->usb->usbctl);
2914         usb_reset (dev);
2915         usb_reinit (dev);
2916
2917         /* irq setup after old hardware is cleaned up */
2918         if (!pdev->irq) {
2919                 ERROR (dev, "No IRQ.  Check PCI setup!\n");
2920                 retval = -ENODEV;
2921                 goto done;
2922         }
2923
2924         if (request_irq (pdev->irq, net2280_irq, IRQF_SHARED, driver_name, dev)
2925                         != 0) {
2926                 ERROR (dev, "request interrupt %d failed\n", pdev->irq);
2927                 retval = -EBUSY;
2928                 goto done;
2929         }
2930         dev->got_irq = 1;
2931
2932         /* DMA setup */
2933         /* NOTE:  we know only the 32 LSBs of dma addresses may be nonzero */
2934         dev->requests = pci_pool_create ("requests", pdev,
2935                 sizeof (struct net2280_dma),
2936                 0 /* no alignment requirements */,
2937                 0 /* or page-crossing issues */);
2938         if (!dev->requests) {
2939                 DEBUG (dev, "can't get request pool\n");
2940                 retval = -ENOMEM;
2941                 goto done;
2942         }
2943         for (i = 1; i < 5; i++) {
2944                 struct net2280_dma      *td;
2945
2946                 td = pci_pool_alloc (dev->requests, GFP_KERNEL,
2947                                 &dev->ep [i].td_dma);
2948                 if (!td) {
2949                         DEBUG (dev, "can't get dummy %d\n", i);
2950                         retval = -ENOMEM;
2951                         goto done;
2952                 }
2953                 td->dmacount = 0;       /* not VALID */
2954                 td->dmaaddr = __constant_cpu_to_le32 (DMA_ADDR_INVALID);
2955                 td->dmadesc = td->dmaaddr;
2956                 dev->ep [i].dummy = td;
2957         }
2958
2959         /* enable lower-overhead pci memory bursts during DMA */
2960         writel ( (1 << DMA_MEMORY_WRITE_AND_INVALIDATE_ENABLE)
2961                         // 256 write retries may not be enough...
2962                         // | (1 << PCI_RETRY_ABORT_ENABLE)
2963                         | (1 << DMA_READ_MULTIPLE_ENABLE)
2964                         | (1 << DMA_READ_LINE_ENABLE)
2965                         , &dev->pci->pcimstctl);
2966         /* erratum 0115 shouldn't appear: Linux inits PCI_LATENCY_TIMER */
2967         pci_set_master (pdev);
2968         pci_set_mwi (pdev);
2969
2970         /* ... also flushes any posted pci writes */
2971         dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
2972
2973         /* done */
2974         INFO (dev, "%s\n", driver_desc);
2975         INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
2976                         pdev->irq, base, dev->chiprev);
2977         INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
2978                         use_dma
2979                                 ? (use_dma_chaining ? "chaining" : "enabled")
2980                                 : "disabled");
2981         the_controller = dev;
2982
2983         retval = device_register (&dev->gadget.dev);
2984         if (retval) goto done;
2985         retval = device_create_file (&pdev->dev, &dev_attr_registers);
2986         if (retval) goto done;
2987
2988         return 0;
2989
2990 done:
2991         if (dev)
2992                 net2280_remove (pdev);
2993         return retval;
2994 }
2995
2996 /* make sure the board is quiescent; otherwise it will continue
2997  * generating IRQs across the upcoming reboot.
2998  */
2999
3000 static void net2280_shutdown (struct pci_dev *pdev)
3001 {
3002         struct net2280          *dev = pci_get_drvdata (pdev);
3003
3004         /* disable IRQs */
3005         writel (0, &dev->regs->pciirqenb0);
3006         writel (0, &dev->regs->pciirqenb1);
3007
3008         /* disable the pullup so the host will think we're gone */
3009         writel (0, &dev->usb->usbctl);
3010 }
3011
3012
3013 /*-------------------------------------------------------------------------*/
3014
3015 static const struct pci_device_id pci_ids [] = { {
3016         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
3017         .class_mask =   ~0,
3018         .vendor =       0x17cc,
3019         .device =       0x2280,
3020         .subvendor =    PCI_ANY_ID,
3021         .subdevice =    PCI_ANY_ID,
3022 }, {
3023         .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
3024         .class_mask =   ~0,
3025         .vendor =       0x17cc,
3026         .device =       0x2282,
3027         .subvendor =    PCI_ANY_ID,
3028         .subdevice =    PCI_ANY_ID,
3029
3030 }, { /* end: all zeroes */ }
3031 };
3032 MODULE_DEVICE_TABLE (pci, pci_ids);
3033
3034 /* pci driver glue; this is a "new style" PCI driver module */
3035 static struct pci_driver net2280_pci_driver = {
3036         .name =         (char *) driver_name,
3037         .id_table =     pci_ids,
3038
3039         .probe =        net2280_probe,
3040         .remove =       net2280_remove,
3041         .shutdown =     net2280_shutdown,
3042
3043         /* FIXME add power management support */
3044 };
3045
3046 MODULE_DESCRIPTION (DRIVER_DESC);
3047 MODULE_AUTHOR ("David Brownell");
3048 MODULE_LICENSE ("GPL");
3049
3050 static int __init init (void)
3051 {
3052         if (!use_dma)
3053                 use_dma_chaining = 0;
3054         return pci_register_driver (&net2280_pci_driver);
3055 }
3056 module_init (init);
3057
3058 static void __exit cleanup (void)
3059 {
3060         pci_unregister_driver (&net2280_pci_driver);
3061 }
3062 module_exit (cleanup);