1/*
2 * Driver for the NetChip 2280 USB device controller.
3 * Specs and errata are available from <http://www.netchip.com>.
4 *
5 * NetChip Technology Inc. supported the development of this driver.
6 *
7 *
8 * CODE STATUS HIGHLIGHTS
9 *
10 * Used with a gadget driver like "zero.c" this enumerates fine to Windows
11 * or Linux hosts; handles disconnect, reconnect, and reset, for full or
12 * high speed operation; and passes USB-IF "chapter 9" tests.
13 *
14 * Handles standard stress loads from the Linux "usbtest" driver, with
15 * either DMA (default) or PIO (use_dma=n) used for ep-{a,b,c,d}.  Testing
16 * with "ttcp" (and the "ether.c" driver) behaves nicely too.
17 *
18 * DMA is enabled by default.  Drivers using transfer queues might use
19 * DMA chaining to remove IRQ latencies between transfers.  (Except when
20 * short OUT transfers happen.)  Drivers can use the req->no_interrupt
21 * hint to completely eliminate some IRQs, if a later IRQ is guaranteed
22 * and DMA chaining is enabled.
23 *
24 * Note that almost all the errata workarounds here are only needed for
25 * rev1 chips.  Rev1a silicon (0110) fixes almost all of them.
26 */
27
28/*
29 * Copyright (C) 2003 David Brownell
30 * Copyright (C) 2003 NetChip Technologies
31 *
32 * This program is free software; you can redistribute it and/or modify
33 * it under the terms of the GNU General Public License as published by
34 * the Free Software Foundation; either version 2 of the License, or
35 * (at your option) any later version.
36 *
37 * This program is distributed in the hope that it will be useful,
38 * but WITHOUT ANY WARRANTY; without even the implied warranty of
39 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
40 * GNU General Public License for more details.
41 *
42 * You should have received a copy of the GNU General Public License
43 * along with this program; if not, write to the Free Software
44 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
45 */
46
47#undef	DEBUG		/* messages on error and most fault paths */
48#undef	VERBOSE		/* extra debug messages (success too) */
49
50#include <linux/config.h>
51#include <linux/module.h>
52#include <linux/pci.h>
53#include <linux/kernel.h>
54#include <linux/delay.h>
55#include <linux/ioport.h>
56#include <linux/sched.h>
57#include <linux/slab.h>
58#include <linux/smp_lock.h>
59#include <linux/errno.h>
60#include <linux/init.h>
61#include <linux/timer.h>
62#include <linux/list.h>
63#include <linux/interrupt.h>
64
65#include <linux/usb_ch9.h>
66#include <linux/usb_gadget.h>
67
68#include <asm/byteorder.h>
69#include <asm/io.h>
70#include <asm/irq.h>
71#include <asm/system.h>
72#include <asm/unaligned.h>
73
74
75#define	DRIVER_DESC		"NetChip 2280 USB Peripheral Controller"
76#define	DRIVER_VERSION		"2004 Jan 14"
77
78#define	DMA_ADDR_INVALID	(~(dma_addr_t)0)
79#define	EP_DONTUSE		13	/* nonzero */
80
81#define USE_RDK_LEDS		/* GPIO pins control three LEDs */
82
83
84static const char driver_name [] = "net2280";
85static const char driver_desc [] = DRIVER_DESC;
86
87static const char ep0name [] = "ep0";
88static const char *ep_name [] = {
89	ep0name,
90	"ep-a", "ep-b", "ep-c", "ep-d",
91	"ep-e", "ep-f",
92};
93
94/* use_dma -- general goodness, fewer interrupts, less cpu load (vs PIO)
95 * use_dma_chaining -- dma descriptor queueing gives even more irq reduction
96 *
97 * The net2280 DMA engines are not tightly integrated with their FIFOs;
98 * not all cases are (yet) handled well in this driver or the silicon.
99 * Some gadget drivers work better with the dma support here than others.
100 * These two parameters let you use PIO or more aggressive DMA.
101 */
102static int use_dma = 1;
103static int use_dma_chaining = 0;
104
105MODULE_PARM (use_dma, "i");
106MODULE_PARM_DESC (use_dma, "true to use dma controllers");
107
108MODULE_PARM (use_dma_chaining, "i");
109MODULE_PARM_DESC (use_dma_chaining, "true to use dma descriptor queues");
110
111
112/* mode 0 == ep-{a,b,c,d} 1K fifo each
113 * mode 1 == ep-{a,b} 2K fifo each, ep-{c,d} unavailable
114 * mode 2 == ep-a 2K fifo, ep-{b,c} 1K each, ep-d unavailable
115 */
116static ushort fifo_mode = 0;
117
118MODULE_PARM (fifo_mode, "h");
119MODULE_PARM_DESC (fifo_mode, "net2280 fifo mode");
120
121
122#define	DIR_STRING(bAddress) (((bAddress) & USB_DIR_IN) ? "in" : "out")
123
124#if defined(USE_SYSFS_DEBUG_FILES) || defined (DEBUG)
125static char *type_string (u8 bmAttributes)
126{
127	switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
128	case USB_ENDPOINT_XFER_BULK:	return "bulk";
129	case USB_ENDPOINT_XFER_ISOC:	return "iso";
130	case USB_ENDPOINT_XFER_INT:	return "intr";
131	};
132	return "control";
133}
134#endif
135
136#include "net2280.h"
137
138#define valid_bit	__constant_cpu_to_le32 (1 << VALID_BIT)
139#define dma_done_ie	__constant_cpu_to_le32 (1 << DMA_DONE_INTERRUPT_ENABLE)
140
141/*-------------------------------------------------------------------------*/
142
143static int
144net2280_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
145{
146	struct net2280		*dev;
147	struct net2280_ep	*ep;
148	u32			max, tmp;
149	unsigned long		flags;
150
151	ep = container_of (_ep, struct net2280_ep, ep);
152	if (!_ep || !desc || ep->desc || _ep->name == ep0name
153			|| desc->bDescriptorType != USB_DT_ENDPOINT)
154		return -EINVAL;
155	dev = ep->dev;
156	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
157		return -ESHUTDOWN;
158
159	/* erratum 0119 workaround ties up an endpoint number */
160	if ((desc->bEndpointAddress & 0x0f) == EP_DONTUSE)
161		return -EDOM;
162
163	/* sanity check ep-e/ep-f since their fifos are small */
164	max = le16_to_cpu (desc->wMaxPacketSize) & 0x1fff;
165	if (ep->num > 4 && max > 64)
166		return -ERANGE;
167
168	spin_lock_irqsave (&dev->lock, flags);
169	_ep->maxpacket = max & 0x7ff;
170	ep->desc = desc;
171
172	/* ep_reset() has already been called */
173	ep->stopped = 0;
174	ep->out_overflow = 0;
175
176	/* set speed-dependent max packet; may kick in high bandwidth */
177	set_idx_reg (dev->regs, REG_EP_MAXPKT (dev, ep->num), max);
178
179	/* FIFO lines can't go to different packets.  PIO is ok, so
180	 * use it instead of troublesome (non-bulk) multi-packet DMA.
181	 */
182	if (ep->dma && (max % 4) != 0 && use_dma_chaining) {
183		DEBUG (ep->dev, "%s, no dma for maxpacket %d\n",
184			ep->ep.name, ep->ep.maxpacket);
185		ep->dma = 0;
186	}
187
188	/* set type, direction, address; reset fifo counters */
189	writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
190	tmp = (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
191	if (tmp == USB_ENDPOINT_XFER_INT) {
192		/* erratum 0105 workaround prevents hs NYET */
193		if (dev->chiprev == 0100
194				&& dev->gadget.speed == USB_SPEED_HIGH
195				&& !(desc->bEndpointAddress & USB_DIR_IN))
196			writel ((1 << CLEAR_NAK_OUT_PACKETS_MODE),
197				&ep->regs->ep_rsp);
198	} else if (tmp == USB_ENDPOINT_XFER_BULK) {
199		/* catch some particularly blatant driver bugs */
200		if ((dev->gadget.speed == USB_SPEED_HIGH
201					&& max != 512)
202				|| (dev->gadget.speed == USB_SPEED_FULL
203					&& max > 64)) {
204			spin_unlock_irqrestore (&dev->lock, flags);
205			return -ERANGE;
206		}
207	}
208	ep->is_iso = (tmp == USB_ENDPOINT_XFER_ISOC) ? 1 : 0;
209	tmp <<= ENDPOINT_TYPE;
210	tmp |= desc->bEndpointAddress;
211	tmp |= (4 << ENDPOINT_BYTE_COUNT);	/* default full fifo lines */
212	tmp |= 1 << ENDPOINT_ENABLE;
213	wmb ();
214
215	/* for OUT transfers, block the rx fifo until a read is posted */
216	ep->is_in = (tmp & USB_DIR_IN) != 0;
217	if (!ep->is_in)
218		writel ((1 << SET_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
219
220	writel (tmp, &ep->regs->ep_cfg);
221
222	/* enable irqs */
223	if (!ep->dma) {				/* pio, per-packet */
224		tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
225		writel (tmp, &dev->regs->pciirqenb0);
226
227		tmp = (1 << DATA_PACKET_RECEIVED_INTERRUPT_ENABLE)
228			| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT_ENABLE)
229			| readl (&ep->regs->ep_irqenb);
230		writel (tmp, &ep->regs->ep_irqenb);
231	} else {				/* dma, per-request */
232		tmp = (1 << (8 + ep->num));	/* completion */
233		tmp |= readl (&dev->regs->pciirqenb1);
234		writel (tmp, &dev->regs->pciirqenb1);
235
236		/* for short OUT transfers, dma completions can't
237		 * advance the queue; do it pio-style, by hand.
238		 * NOTE erratum 0112 workaround #2
239		 */
240		if ((desc->bEndpointAddress & USB_DIR_IN) == 0) {
241			tmp = (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT_ENABLE);
242			writel (tmp, &ep->regs->ep_irqenb);
243
244			tmp = (1 << ep->num) | readl (&dev->regs->pciirqenb0);
245			writel (tmp, &dev->regs->pciirqenb0);
246		}
247	}
248
249	tmp = desc->bEndpointAddress;
250	DEBUG (dev, "enabled %s (ep%d%s-%s) %s max %04x\n",
251		_ep->name, tmp & 0x0f, DIR_STRING (tmp),
252		type_string (desc->bmAttributes),
253		ep->dma ? "dma" : "pio", max);
254
255	/* pci writes may still be posted */
256	spin_unlock_irqrestore (&dev->lock, flags);
257	return 0;
258}
259
260static int handshake (u32 *ptr, u32 mask, u32 done, int usec)
261{
262	u32	result;
263
264	do {
265		result = readl (ptr);
266		if (result == ~(u32)0)		/* "device unplugged" */
267			return -ENODEV;
268		result &= mask;
269		if (result == done)
270			return 0;
271		udelay (1);
272		usec--;
273	} while (usec > 0);
274	return -ETIMEDOUT;
275}
276
277static struct usb_ep_ops net2280_ep_ops;
278
279static void ep_reset (struct net2280_regs *regs, struct net2280_ep *ep)
280{
281	u32		tmp;
282
283	ep->desc = 0;
284	INIT_LIST_HEAD (&ep->queue);
285
286	ep->ep.maxpacket = ~0;
287	ep->ep.ops = &net2280_ep_ops;
288
289	/* disable the dma, irqs, endpoint... */
290	if (ep->dma) {
291		writel (0, &ep->dma->dmactl);
292		writel (  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
293			| (1 << DMA_TRANSACTION_DONE_INTERRUPT)
294			| (1 << DMA_ABORT)
295			, &ep->dma->dmastat);
296
297		tmp = readl (&regs->pciirqenb0);
298		tmp &= ~(1 << ep->num);
299		writel (tmp, &regs->pciirqenb0);
300	} else {
301		tmp = readl (&regs->pciirqenb1);
302		tmp &= ~(1 << (8 + ep->num));	/* completion */
303		writel (tmp, &regs->pciirqenb1);
304	}
305	writel (0, &ep->regs->ep_irqenb);
306
307	/* init to our chosen defaults, notably so that we NAK OUT
308	 * packets until the driver queues a read (+note erratum 0112)
309	 */
310	writel (  (1 << SET_NAK_OUT_PACKETS_MODE)
311		| (1 << SET_NAK_OUT_PACKETS)
312		| (1 << CLEAR_EP_HIDE_STATUS_PHASE)
313		| (1 << CLEAR_INTERRUPT_MODE)
314		| (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
315		| (1 << CLEAR_ENDPOINT_TOGGLE)
316		| (1 << CLEAR_ENDPOINT_HALT)
317		, &ep->regs->ep_rsp);
318
319	/* scrub most status bits, and flush any fifo state */
320	writel (  (1 << TIMEOUT)
321		| (1 << USB_STALL_SENT)
322		| (1 << USB_IN_NAK_SENT)
323		| (1 << USB_IN_ACK_RCVD)
324		| (1 << USB_OUT_PING_NAK_SENT)
325		| (1 << USB_OUT_ACK_SENT)
326		| (1 << FIFO_OVERFLOW)
327		| (1 << FIFO_UNDERFLOW)
328		| (1 << FIFO_FLUSH)
329		| (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
330		| (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
331		| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
332		| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
333		| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
334		| (1 << DATA_IN_TOKEN_INTERRUPT)
335		, &ep->regs->ep_stat);
336
337	/* fifo size is handled separately */
338}
339
340static void nuke (struct net2280_ep *);
341
342static int net2280_disable (struct usb_ep *_ep)
343{
344	struct net2280_ep	*ep;
345	unsigned long		flags;
346
347	ep = container_of (_ep, struct net2280_ep, ep);
348	if (!_ep || !ep->desc || _ep->name == ep0name)
349		return -EINVAL;
350
351	spin_lock_irqsave (&ep->dev->lock, flags);
352	nuke (ep);
353	ep_reset (ep->dev->regs, ep);
354
355	VDEBUG (ep->dev, "disabled %s %s\n",
356			ep->dma ? "dma" : "pio", _ep->name);
357
358	/* synch memory views with the device */
359	(void) readl (&ep->regs->ep_cfg);
360
361	if (use_dma && !ep->dma && ep->num >= 1 && ep->num <= 4)
362		ep->dma = &ep->dev->dma [ep->num - 1];
363
364	spin_unlock_irqrestore (&ep->dev->lock, flags);
365	return 0;
366}
367
368/*-------------------------------------------------------------------------*/
369
370static struct usb_request *
371net2280_alloc_request (struct usb_ep *_ep, int gfp_flags)
372{
373	struct net2280_ep	*ep;
374	struct net2280_request	*req;
375
376	if (!_ep)
377		return 0;
378	ep = container_of (_ep, struct net2280_ep, ep);
379
380	req = kmalloc (sizeof *req, gfp_flags);
381	if (!req)
382		return 0;
383
384	memset (req, 0, sizeof *req);
385	req->req.dma = DMA_ADDR_INVALID;
386	INIT_LIST_HEAD (&req->queue);
387
388	/* this dma descriptor may be swapped with the previous dummy */
389	if (ep->dma) {
390		struct net2280_dma	*td;
391
392		td = pci_pool_alloc (ep->dev->requests, gfp_flags,
393				&req->td_dma);
394		if (!td) {
395			kfree (req);
396			return 0;
397		}
398		td->dmacount = 0;	/* not VALID */
399		td->dmaaddr = __constant_cpu_to_le32 (DMA_ADDR_INVALID);
400		td->dmadesc = td->dmaaddr;
401		req->td = td;
402	}
403	return &req->req;
404}
405
406static void
407net2280_free_request (struct usb_ep *_ep, struct usb_request *_req)
408{
409	struct net2280_ep	*ep;
410	struct net2280_request	*req;
411
412	ep = container_of (_ep, struct net2280_ep, ep);
413	if (!_ep || !_req)
414		return;
415
416	req = container_of (_req, struct net2280_request, req);
417	WARN_ON (!list_empty (&req->queue));
418	if (req->td)
419		pci_pool_free (ep->dev->requests, req->td, req->td_dma);
420	kfree (req);
421}
422
423/*-------------------------------------------------------------------------*/
424
425#undef USE_KMALLOC
426
427/* many common platforms have dma-coherent caches, which means that it's
428 * safe to use kmalloc() memory for all i/o buffers without using any
429 * cache flushing calls.  (unless you're trying to share cache lines
430 * between dma and non-dma activities, which is a slow idea in any case.)
431 *
432 * other platforms need more care, with 2.5 having a moderately general
433 * solution (which falls down for allocations smaller than one page)
434 * that improves significantly on the 2.4 PCI allocators by removing
435 * the restriction that memory never be freed in_interrupt().
436 */
437#if	defined(CONFIG_X86)
438#define USE_KMALLOC
439
440#elif	defined(CONFIG_PPC) && !defined(CONFIG_NOT_COHERENT_CACHE)
441#define USE_KMALLOC
442
443#elif	defined(CONFIG_MIPS) && !defined(CONFIG_NONCOHERENT_IO)
444#define USE_KMALLOC
445
446/* FIXME there are other cases, including an x86-64 one ...  */
447#endif
448
449/* allocating buffers this way eliminates dma mapping overhead, which
450 * on some platforms will mean eliminating a per-io buffer copy.  with
451 * some kinds of system caches, further tweaks may still be needed.
452 */
453static void *
454net2280_alloc_buffer (
455	struct usb_ep		*_ep,
456	unsigned		bytes,
457	dma_addr_t		*dma,
458	int			gfp_flags
459)
460{
461	void			*retval;
462	struct net2280_ep	*ep;
463
464	ep = container_of (_ep, struct net2280_ep, ep);
465	if (!_ep)
466		return 0;
467	*dma = DMA_ADDR_INVALID;
468
469#if	defined(USE_KMALLOC)
470	retval = kmalloc(bytes, gfp_flags);
471	if (retval)
472		*dma = virt_to_phys(retval);
473#else
474	if (ep->dma) {
475		/* one problem with this call is that it wastes memory on
476		 * typical 1/N page allocations: it allocates 1..N pages.
477		 * another is that it always uses GFP_ATOMIC.
478		 */
479#warning Using pci_alloc_consistent even with buffers smaller than a page.
480		retval = pci_alloc_consistent(ep->dev->pdev, bytes, dma);
481	} else
482		retval = kmalloc(bytes, gfp_flags);
483#endif
484	return retval;
485}
486
487static void
488net2280_free_buffer (
489	struct usb_ep *_ep,
490	void *buf,
491	dma_addr_t dma,
492	unsigned bytes
493) {
494	/* free memory into the right allocator */
495#ifndef	USE_KMALLOC
496	if (dma != DMA_ADDR_INVALID) {
497		struct net2280_ep	*ep;
498
499		ep = container_of(_ep, struct net2280_ep, ep);
500		if (!_ep)
501			return;
502		/* one problem with this call is that some platforms
503		 * don't allow it to be used in_irq().
504		 */
505		pci_free_consistent(ep->dev->pdev, bytes, buf, dma);
506	} else
507#endif
508		kfree (buf);
509}
510
511/*-------------------------------------------------------------------------*/
512
513/* load a packet into the fifo we use for usb IN transfers.
514 * works for all endpoints.
515 *
516 * NOTE: pio with ep-a..ep-d could stuff multiple packets into the fifo
517 * at a time, but this code is simpler because it knows it only writes
518 * one packet.  ep-a..ep-d should use dma instead.
519 */
520static void
521write_fifo (struct net2280_ep *ep, struct usb_request *req)
522{
523	struct net2280_ep_regs	*regs = ep->regs;
524	u8			*buf;
525	u32			tmp;
526	unsigned		count, total;
527
528	/* INVARIANT:  fifo is currently empty. (testable) */
529
530	if (req) {
531		buf = req->buf + req->actual;
532		prefetch (buf);
533		total = req->length - req->actual;
534	} else {
535		total = 0;
536		buf = 0;
537	}
538
539	/* write just one packet at a time */
540	count = min (ep->ep.maxpacket, total);
541	VDEBUG (ep->dev, "write %s fifo (IN) %d bytes%s req %p\n",
542			ep->ep.name, count,
543			(count != ep->ep.maxpacket) ? " (short)" : "",
544			req);
545	while (count >= 4) {
546		/* NOTE be careful if you try to align these. fifo lines
547		 * should normally be full (4 bytes) and successive partial
548		 * lines are ok only in certain cases.
549		 */
550		tmp = get_unaligned ((u32 *)buf);
551		cpu_to_le32s (&tmp);
552		writel (tmp, &regs->ep_data);
553		buf += 4;
554		count -= 4;
555	}
556
557	/* last fifo entry is "short" unless we wrote a full packet.
558	 * also explicitly validate last word in (periodic) transfers
559	 * when maxpacket is not a multiple of 4 bytes.
560	 */
561	if (count || total < ep->ep.maxpacket) {
562		tmp = count ? get_unaligned ((u32 *)buf) : count;
563		cpu_to_le32s (&tmp);
564		set_fifo_bytecount (ep, count & 0x03);
565		writel (tmp, &regs->ep_data);
566	}
567
568	/* pci writes may still be posted */
569}
570
571/* work around erratum 0106: PCI and USB race over the OUT fifo.
572 * caller guarantees chiprev 0100, out endpoint is NAKing, and
573 * there's no real data in the fifo.
574 *
575 * NOTE:  also used in cases where that erratum doesn't apply:
576 * where the host wrote "too much" data to us.
577 */
578static void out_flush (struct net2280_ep *ep)
579{
580	u32	*statp, tmp;
581
582	ASSERT_OUT_NAKING (ep);
583
584	statp = &ep->regs->ep_stat;
585	writel (  (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
586		| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
587		, statp);
588	writel ((1 << FIFO_FLUSH), statp);
589	mb ();
590	tmp = readl (statp);
591	if (tmp & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
592			/* high speed did bulk NYET; fifo isn't filling */
593			&& ep->dev->gadget.speed == USB_SPEED_FULL) {
594		unsigned	usec;
595
596		usec = 50;		/* 64 byte bulk/interrupt */
597		handshake (statp, (1 << USB_OUT_PING_NAK_SENT),
598				(1 << USB_OUT_PING_NAK_SENT), usec);
599		/* NAK done; now CLEAR_NAK_OUT_PACKETS is safe */
600	}
601}
602
603/* unload packet(s) from the fifo we use for usb OUT transfers.
604 * returns true iff the request completed, because of short packet
605 * or the request buffer having filled with full packets.
606 *
607 * for ep-a..ep-d this will read multiple packets out when they
608 * have been accepted.
609 */
610static int
611read_fifo (struct net2280_ep *ep, struct net2280_request *req)
612{
613	struct net2280_ep_regs	*regs = ep->regs;
614	u8			*buf = req->req.buf + req->req.actual;
615	unsigned		count, tmp, is_short;
616	unsigned		cleanup = 0, prevent = 0;
617
618	/* erratum 0106 ... packets coming in during fifo reads might
619	 * be incompletely rejected.  not all cases have workarounds.
620	 */
621	if (ep->dev->chiprev == 0x0100
622			&& ep->dev->gadget.speed == USB_SPEED_FULL) {
623		udelay (1);
624		tmp = readl (&ep->regs->ep_stat);
625		if ((tmp & (1 << NAK_OUT_PACKETS)))
626			cleanup = 1;
627		else if ((tmp & (1 << FIFO_FULL))) {
628			start_out_naking (ep);
629			prevent = 1;
630		}
631		/* else: hope we don't see the problem */
632	}
633
634	/* never overflow the rx buffer. the fifo reads packets until
635	 * it sees a short one; we might not be ready for them all.
636	 */
637	prefetchw (buf);
638	count = readl (&regs->ep_avail);
639	if (unlikely (count == 0)) {
640		udelay (1);
641		tmp = readl (&ep->regs->ep_stat);
642		count = readl (&regs->ep_avail);
643		/* handled that data already? */
644		if (count == 0 && (tmp & (1 << NAK_OUT_PACKETS)) == 0)
645			return 0;
646	}
647
648	tmp = req->req.length - req->req.actual;
649	if (count > tmp) {
650		/* as with DMA, data overflow gets flushed */
651		if ((tmp % ep->ep.maxpacket) != 0) {
652			ERROR (ep->dev,
653				"%s out fifo %d bytes, expected %d\n",
654				ep->ep.name, count, tmp);
655			req->req.status = -EOVERFLOW;
656			cleanup = 1;
657			/* NAK_OUT_PACKETS will be set, so flushing is safe;
658			 * the next read will start with the next packet
659			 */
660		} /* else it's a ZLP, no worries */
661		count = tmp;
662	}
663	req->req.actual += count;
664
665	is_short = (count == 0) || ((count % ep->ep.maxpacket) != 0);
666
667	VDEBUG (ep->dev, "read %s fifo (OUT) %d bytes%s%s%s req %p %d/%d\n",
668			ep->ep.name, count, is_short ? " (short)" : "",
669			cleanup ? " flush" : "", prevent ? " nak" : "",
670			req, req->req.actual, req->req.length);
671
672	while (count >= 4) {
673		tmp = readl (&regs->ep_data);
674		cpu_to_le32s (&tmp);
675		put_unaligned (tmp, (u32 *)buf);
676		buf += 4;
677		count -= 4;
678	}
679	if (count) {
680		tmp = readl (&regs->ep_data);
681		cpu_to_le32s (&tmp);
682		do {
683			*buf++ = (u8) tmp;
684			tmp >>= 8;
685		} while (--count);
686	}
687	if (cleanup)
688		out_flush (ep);
689	if (prevent) {
690		writel ((1 << CLEAR_NAK_OUT_PACKETS), &ep->regs->ep_rsp);
691		(void) readl (&ep->regs->ep_rsp);
692	}
693
694	return is_short || ((req->req.actual == req->req.length)
695				&& !req->req.zero);
696}
697
698/* fill out dma descriptor to match a given request */
699static void
700fill_dma_desc (struct net2280_ep *ep, struct net2280_request *req, int valid)
701{
702	struct net2280_dma	*td = req->td;
703	u32			dmacount = req->req.length;
704
705	/* don't let DMA continue after a short OUT packet,
706	 * so overruns can't affect the next transfer.
707	 * in case of overruns on max-size packets, we can't
708	 * stop the fifo from filling but we can flush it.
709	 */
710	if (ep->is_in)
711		dmacount |= (1 << DMA_DIRECTION);
712	else if ((dmacount % ep->ep.maxpacket) != 0)
713		dmacount |= (1 << END_OF_CHAIN);
714
715	req->valid = valid;
716	if (valid)
717		dmacount |= (1 << VALID_BIT);
718	if (likely(!req->req.no_interrupt || !use_dma_chaining))
719		dmacount |= (1 << DMA_DONE_INTERRUPT_ENABLE);
720
721	/* td->dmadesc = previously set by caller */
722	td->dmaaddr = cpu_to_le32p (&req->req.dma);
723
724	/* 2280 may be polling VALID_BIT through ep->dma->dmadesc */
725	wmb ();
726	td->dmacount = cpu_to_le32p (&dmacount);
727}
728
729static const u32 dmactl_default =
730		  (1 << DMA_SCATTER_GATHER_DONE_INTERRUPT)
731		| (1 << DMA_CLEAR_COUNT_ENABLE)
732		/* erratum 0116 workaround part 1 (use POLLING) */
733		| (POLL_100_USEC << DESCRIPTOR_POLLING_RATE)
734		| (1 << DMA_VALID_BIT_POLLING_ENABLE)
735		| (1 << DMA_VALID_BIT_ENABLE)
736		| (1 << DMA_SCATTER_GATHER_ENABLE)
737		/* erratum 0116 workaround part 2 (no AUTOSTART) */
738		| (1 << DMA_ENABLE);
739
740static inline void spin_stop_dma (struct net2280_dma_regs *dma)
741{
742	handshake (&dma->dmactl, (1 << DMA_ENABLE), 0, 50);
743}
744
745static inline void stop_dma (struct net2280_dma_regs *dma)
746{
747	writel (readl (&dma->dmactl) & ~(1 << DMA_ENABLE), &dma->dmactl);
748	spin_stop_dma (dma);
749}
750
751static void start_queue (struct net2280_ep *ep, u32 dmactl, u32 td_dma)
752{
753	struct net2280_dma_regs	*dma = ep->dma;
754
755	writel ((1 << VALID_BIT) | (ep->is_in << DMA_DIRECTION),
756			&dma->dmacount);
757	writel (readl (&dma->dmastat), &dma->dmastat);
758
759	writel (td_dma, &dma->dmadesc);
760	writel (dmactl, &dma->dmactl);
761
762	/* erratum 0116 workaround part 3:  pci arbiter away from net2280 */
763	(void) readl (&ep->dev->pci->pcimstctl);
764
765	writel ((1 << DMA_START), &dma->dmastat);
766
767	if (!ep->is_in)
768		stop_out_naking (ep);
769}
770
771static void start_dma (struct net2280_ep *ep, struct net2280_request *req)
772{
773	u32			tmp;
774	struct net2280_dma_regs	*dma = ep->dma;
775
776	/* FIXME can't use DMA for ZLPs */
777
778	/* on this path we "know" there's no dma active (yet) */
779	WARN_ON (readl (&dma->dmactl) & (1 << DMA_ENABLE));
780	writel (0, &ep->dma->dmactl);
781
782	/* previous OUT packet might have been short */
783	if (!ep->is_in && ((tmp = readl (&ep->regs->ep_stat))
784		 		& (1 << NAK_OUT_PACKETS)) != 0) {
785		writel ((1 << SHORT_PACKET_TRANSFERRED_INTERRUPT),
786			&ep->regs->ep_stat);
787
788		tmp = readl (&ep->regs->ep_avail);
789		if (tmp) {
790			writel (readl (&dma->dmastat), &dma->dmastat);
791
792			/* transfer all/some fifo data */
793			writel (req->req.dma, &dma->dmaaddr);
794			tmp = min (tmp, req->req.length);
795
796			/* dma irq, faking scatterlist status */
797			req->td->dmacount = cpu_to_le32 (req->req.length - tmp);
798			writel ((1 << DMA_DONE_INTERRUPT_ENABLE)
799				| tmp, &dma->dmacount);
800			req->td->dmadesc = 0;
801			req->valid = 1;
802
803			writel ((1 << DMA_ENABLE), &dma->dmactl);
804			writel ((1 << DMA_START), &dma->dmastat);
805			return;
806		}
807	}
808
809	tmp = dmactl_default;
810
811	/* force packet boundaries between dma requests, but prevent the
812	 * controller from automagically writing a last "short" packet
813	 * (zero length) unless the driver explicitly said to do that.
814	 */
815	if (ep->is_in) {
816		if (likely ((req->req.length % ep->ep.maxpacket) != 0
817				|| req->req.zero)) {
818			tmp |= (1 << DMA_FIFO_VALIDATE);
819			ep->in_fifo_validate = 1;
820		} else
821			ep->in_fifo_validate = 0;
822	}
823
824	/* init req->td, pointing to the current dummy */
825	req->td->dmadesc = cpu_to_le32 (ep->td_dma);
826	fill_dma_desc (ep, req, 1);
827
828	if (!use_dma_chaining)
829		req->td->dmacount |= __constant_cpu_to_le32 (1 << END_OF_CHAIN);
830
831	start_queue (ep, tmp, req->td_dma);
832}
833
834static inline void
835queue_dma (struct net2280_ep *ep, struct net2280_request *req, int valid)
836{
837	struct net2280_dma	*end;
838	dma_addr_t		tmp;
839
840	/* swap new dummy for old, link; fill and maybe activate */
841	end = ep->dummy;
842	ep->dummy = req->td;
843	req->td = end;
844
845	tmp = ep->td_dma;
846	ep->td_dma = req->td_dma;
847	req->td_dma = tmp;
848
849	end->dmadesc = cpu_to_le32 (ep->td_dma);
850
851	fill_dma_desc (ep, req, valid);
852}
853
854static void
855done (struct net2280_ep *ep, struct net2280_request *req, int status)
856{
857	struct net2280		*dev;
858	unsigned		stopped = ep->stopped;
859
860	list_del_init (&req->queue);
861
862	if (req->req.status == -EINPROGRESS)
863		req->req.status = status;
864	else
865		status = req->req.status;
866
867	dev = ep->dev;
868	if (req->mapped) {
869		pci_unmap_single (dev->pdev, req->req.dma, req->req.length,
870			ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
871		req->req.dma = DMA_ADDR_INVALID;
872		req->mapped = 0;
873	}
874
875	if (status && status != -ESHUTDOWN)
876		VDEBUG (dev, "complete %s req %p stat %d len %u/%u\n",
877			ep->ep.name, &req->req, status,
878			req->req.actual, req->req.length);
879
880	/* don't modify queue heads during completion callback */
881	ep->stopped = 1;
882	spin_unlock (&dev->lock);
883	req->req.complete (&ep->ep, &req->req);
884	spin_lock (&dev->lock);
885	ep->stopped = stopped;
886}
887
888/*-------------------------------------------------------------------------*/
889
890static int
891net2280_queue (struct usb_ep *_ep, struct usb_request *_req, int gfp_flags)
892{
893	struct net2280_request	*req;
894	struct net2280_ep	*ep;
895	struct net2280		*dev;
896	unsigned long		flags;
897
898	/* we always require a cpu-view buffer, so that we can
899	 * always use pio (as fallback or whatever).
900	 */
901	req = container_of (_req, struct net2280_request, req);
902	if (!_req || !_req->complete || !_req->buf
903			|| !list_empty (&req->queue))
904		return -EINVAL;
905	if (_req->length > (~0 & DMA_BYTE_COUNT_MASK))
906		return -EDOM;
907	ep = container_of (_ep, struct net2280_ep, ep);
908	if (!_ep || (!ep->desc && ep->num != 0))
909		return -EINVAL;
910	dev = ep->dev;
911	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
912		return -ESHUTDOWN;
913
914	/* FIXME implement PIO fallback for ZLPs with DMA */
915	if (ep->dma && _req->length == 0)
916		return -EOPNOTSUPP;
917
918	/* set up dma mapping in case the caller didn't */
919	if (ep->dma && _req->dma == DMA_ADDR_INVALID) {
920		_req->dma = pci_map_single (dev->pdev, _req->buf, _req->length,
921			ep->is_in ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
922		req->mapped = 1;
923	}
924
925#if 0
926	VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
927			_ep->name, _req, _req->length, _req->buf);
928#endif
929
930	spin_lock_irqsave (&dev->lock, flags);
931
932	_req->status = -EINPROGRESS;
933	_req->actual = 0;
934
935	/* kickstart this i/o queue? */
936	if (list_empty (&ep->queue) && !ep->stopped) {
937		/* use DMA if the endpoint supports it, else pio */
938		if (ep->dma)
939			start_dma (ep, req);
940		else {
941			/* maybe there's no control data, just status ack */
942			if (ep->num == 0 && _req->length == 0) {
943				allow_status (ep);
944				done (ep, req, 0);
945				VDEBUG (dev, "%s status ack\n", ep->ep.name);
946				goto done;
947			}
948
949			/* PIO ... stuff the fifo, or unblock it.  */
950			if (ep->is_in)
951				write_fifo (ep, _req);
952			else if (list_empty (&ep->queue)) {
953				u32	s;
954
955				/* OUT FIFO might have packet(s) buffered */
956				s = readl (&ep->regs->ep_stat);
957				if ((s & (1 << FIFO_EMPTY)) == 0) {
958					/* note:  _req->short_not_ok is
959					 * ignored here since PIO _always_
960					 * stops queue advance here, and
961					 * _req->status doesn't change for
962					 * short reads (only _req->actual)
963					 */
964					if (read_fifo (ep, req)) {
965						done (ep, req, 0);
966						if (ep->num == 0)
967							allow_status (ep);
968						/* don't queue it */
969						req = 0;
970					} else
971						s = readl (&ep->regs->ep_stat);
972				}
973
974				/* don't NAK, let the fifo fill */
975				if (req && (s & (1 << NAK_OUT_PACKETS)))
976					writel ((1 << CLEAR_NAK_OUT_PACKETS),
977							&ep->regs->ep_rsp);
978			}
979		}
980
981	} else if (ep->dma) {
982		int	valid = 1;
983
984		if (ep->is_in) {
985			int	expect;
986
987			/* preventing magic zlps is per-engine state, not
988			 * per-transfer; irq logic must recover hiccups.
989			 */
990			expect = likely (req->req.zero
991				|| (req->req.length % ep->ep.maxpacket) != 0);
992			if (expect != ep->in_fifo_validate)
993				valid = 0;
994		}
995		queue_dma (ep, req, valid);
996
997	} /* else the irq handler advances the queue. */
998
999	if (req)
1000		list_add_tail (&req->queue, &ep->queue);
1001done:
1002	spin_unlock_irqrestore (&dev->lock, flags);
1003
1004	/* pci writes may still be posted */
1005	return 0;
1006}
1007
1008static inline void
1009dma_done (
1010	struct net2280_ep *ep,
1011	struct net2280_request *req,
1012	u32 dmacount,
1013	int status
1014)
1015{
1016	req->req.actual = req->req.length - (DMA_BYTE_COUNT_MASK & dmacount);
1017	done (ep, req, status);
1018}
1019
1020static void restart_dma (struct net2280_ep *ep);
1021
1022static void scan_dma_completions (struct net2280_ep *ep)
1023{
1024	/* only look at descriptors that were "naturally" retired,
1025	 * so fifo and list head state won't matter
1026	 */
1027	while (!list_empty (&ep->queue)) {
1028		struct net2280_request	*req;
1029		u32			tmp;
1030
1031		req = list_entry (ep->queue.next,
1032				struct net2280_request, queue);
1033		if (!req->valid)
1034			break;
1035		rmb ();
1036		tmp = le32_to_cpup (&req->td->dmacount);
1037		if ((tmp & (1 << VALID_BIT)) != 0)
1038			break;
1039
1040		/* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
1041		 * cases where DMA must be aborted; this code handles
1042		 * all non-abort DMA completions.
1043		 */
1044		if (unlikely (req->td->dmadesc == 0)) {
1045			/* paranoia */
1046			tmp = readl (&ep->dma->dmacount);
1047			if (tmp & DMA_BYTE_COUNT_MASK)
1048				break;
1049			/* single transfer mode */
1050			dma_done (ep, req, tmp, 0);
1051			break;
1052		} else if (!ep->is_in
1053				&& (req->req.length % ep->ep.maxpacket) != 0) {
1054			tmp = readl (&ep->regs->ep_stat);
1055
1056			/* AVOID TROUBLE HERE by not issuing short reads from
1057			 * your gadget driver.  That helps avoids errata 0121,
1058			 * 0122, and 0124; not all cases trigger the warning.
1059			 */
1060			if ((tmp & (1 << NAK_OUT_PACKETS)) == 0) {
1061				WARN (ep->dev, "%s lost packet sync!\n",
1062						ep->ep.name);
1063				req->req.status = -EOVERFLOW;
1064			} else if ((tmp = readl (&ep->regs->ep_avail)) != 0) {
1065				/* fifo gets flushed later */
1066				ep->out_overflow = 1;
1067				DEBUG (ep->dev, "%s dma, discard %d len %d\n",
1068						ep->ep.name, tmp,
1069						req->req.length);
1070				req->req.status = -EOVERFLOW;
1071			}
1072		}
1073		dma_done (ep, req, tmp, 0);
1074	}
1075}
1076
1077static void restart_dma (struct net2280_ep *ep)
1078{
1079	struct net2280_request	*req;
1080	u32			dmactl = dmactl_default;
1081
1082	if (ep->stopped)
1083		return;
1084	req = list_entry (ep->queue.next, struct net2280_request, queue);
1085
1086	if (!use_dma_chaining) {
1087		start_dma (ep, req);
1088		return;
1089	}
1090
1091	/* the 2280 will be processing the queue unless queue hiccups after
1092	 * the previous transfer:
1093	 *  IN:   wanted automagic zlp, head doesn't (or vice versa)
1094	 *        DMA_FIFO_VALIDATE doesn't init from dma descriptors.
1095	 *  OUT:  was "usb-short", we must restart.
1096	 */
1097	if (ep->is_in && !req->valid) {
1098		struct net2280_request	*entry, *prev = 0;
1099		int			reqmode, done = 0;
1100
1101		DEBUG (ep->dev, "%s dma hiccup td %p\n", ep->ep.name, req->td);
1102		ep->in_fifo_validate = likely (req->req.zero
1103			|| (req->req.length % ep->ep.maxpacket) != 0);
1104		if (ep->in_fifo_validate)
1105			dmactl |= (1 << DMA_FIFO_VALIDATE);
1106		list_for_each_entry (entry, &ep->queue, queue) {
1107			u32		dmacount;
1108
1109			if (entry == req)
1110				continue;
1111			dmacount = entry->td->dmacount;
1112			if (!done) {
1113				reqmode = likely (entry->req.zero
1114					|| (entry->req.length
1115						% ep->ep.maxpacket) != 0);
1116				if (reqmode == ep->in_fifo_validate) {
1117					entry->valid = 1;
1118					dmacount |= valid_bit;
1119					entry->td->dmacount = dmacount;
1120					prev = entry;
1121					continue;
1122				} else {
1123					/* force a hiccup */
1124					prev->td->dmacount |= dma_done_ie;
1125					done = 1;
1126				}
1127			}
1128
1129			/* walk the rest of the queue so unlinks behave */
1130			entry->valid = 0;
1131			dmacount &= ~valid_bit;
1132			entry->td->dmacount = dmacount;
1133			prev = entry;
1134		}
1135	}
1136
1137	writel (0, &ep->dma->dmactl);
1138	start_queue (ep, dmactl, req->td_dma);
1139}
1140
1141static void abort_dma (struct net2280_ep *ep)
1142{
1143	/* abort the current transfer */
1144	if (likely (!list_empty (&ep->queue))) {
1145		/* FIXME work around errata 0121, 0122, 0124 */
1146		writel ((1 << DMA_ABORT), &ep->dma->dmastat);
1147		spin_stop_dma (ep->dma);
1148	} else
1149		stop_dma (ep->dma);
1150	scan_dma_completions (ep);
1151}
1152
1153/* dequeue ALL requests */
1154static void nuke (struct net2280_ep *ep)
1155{
1156	struct net2280_request	*req;
1157
1158	/* called with spinlock held */
1159	ep->stopped = 1;
1160	if (ep->dma)
1161		abort_dma (ep);
1162	while (!list_empty (&ep->queue)) {
1163		req = list_entry (ep->queue.next,
1164				struct net2280_request,
1165				queue);
1166		done (ep, req, -ESHUTDOWN);
1167	}
1168}
1169
1170/* dequeue JUST ONE request */
1171static int net2280_dequeue (struct usb_ep *_ep, struct usb_request *_req)
1172{
1173	struct net2280_ep	*ep;
1174	struct net2280_request	*req;
1175	unsigned long		flags;
1176	u32			dmactl;
1177	int			stopped;
1178
1179	ep = container_of (_ep, struct net2280_ep, ep);
1180	if (!_ep || (!ep->desc && ep->num != 0) || !_req)
1181		return -EINVAL;
1182
1183	spin_lock_irqsave (&ep->dev->lock, flags);
1184	stopped = ep->stopped;
1185
1186	/* quiesce dma while we patch the queue */
1187	dmactl = 0;
1188	ep->stopped = 1;
1189	if (ep->dma) {
1190		dmactl = readl (&ep->dma->dmactl);
1191		/* WARNING erratum 0127 may kick in ... */
1192		stop_dma (ep->dma);
1193		scan_dma_completions (ep);
1194	}
1195
1196	/* make sure it's still queued on this endpoint */
1197	list_for_each_entry (req, &ep->queue, queue) {
1198		if (&req->req == _req)
1199			break;
1200	}
1201	if (&req->req != _req) {
1202		spin_unlock_irqrestore (&ep->dev->lock, flags);
1203		return -EINVAL;
1204	}
1205
1206	/* queue head may be partially complete. */
1207	if (ep->queue.next == &req->queue) {
1208		if (ep->dma) {
1209			DEBUG (ep->dev, "unlink (%s) dma\n", _ep->name);
1210			_req->status = -ECONNRESET;
1211			abort_dma (ep);
1212			if (likely (ep->queue.next == &req->queue)) {
1213				// NOTE: misreports single-transfer mode
1214				req->td->dmacount = 0;	/* invalidate */
1215				dma_done (ep, req,
1216					readl (&ep->dma->dmacount),
1217					-ECONNRESET);
1218			}
1219		} else {
1220			DEBUG (ep->dev, "unlink (%s) pio\n", _ep->name);
1221			done (ep, req, -ECONNRESET);
1222		}
1223		req = 0;
1224
1225	/* patch up hardware chaining data */
1226	} else if (ep->dma && use_dma_chaining) {
1227		if (req->queue.prev == ep->queue.next) {
1228			writel (le32_to_cpu (req->td->dmadesc),
1229				&ep->dma->dmadesc);
1230			if (req->td->dmacount & dma_done_ie)
1231				writel (readl (&ep->dma->dmacount)
1232						| dma_done_ie,
1233					&ep->dma->dmacount);
1234		} else {
1235			struct net2280_request	*prev;
1236
1237			prev = list_entry (req->queue.prev,
1238				struct net2280_request, queue);
1239			prev->td->dmadesc = req->td->dmadesc;
1240			if (req->td->dmacount & dma_done_ie)
1241				prev->td->dmacount |= dma_done_ie;
1242		}
1243	}
1244
1245	if (req)
1246		done (ep, req, -ECONNRESET);
1247	ep->stopped = stopped;
1248
1249	if (ep->dma) {
1250		/* turn off dma on inactive queues */
1251		if (list_empty (&ep->queue))
1252			stop_dma (ep->dma);
1253		else if (!ep->stopped) {
1254			/* resume current request, or start new one */
1255			if (req)
1256				writel (dmactl, &ep->dma->dmactl);
1257			else
1258				start_dma (ep, list_entry (ep->queue.next,
1259					struct net2280_request, queue));
1260		}
1261	}
1262
1263	spin_unlock_irqrestore (&ep->dev->lock, flags);
1264	return req ? 0 : -EOPNOTSUPP;
1265}
1266
1267/*-------------------------------------------------------------------------*/
1268
1269static int net2280_fifo_status (struct usb_ep *_ep);
1270
1271static int
1272net2280_set_halt (struct usb_ep *_ep, int value)
1273{
1274	struct net2280_ep	*ep;
1275	unsigned long		flags;
1276	int			retval = 0;
1277
1278	ep = container_of (_ep, struct net2280_ep, ep);
1279	if (!_ep || (!ep->desc && ep->num != 0))
1280		return -EINVAL;
1281	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1282		return -ESHUTDOWN;
1283	if (ep->desc /* not ep0 */ && (ep->desc->bmAttributes & 0x03)
1284						== USB_ENDPOINT_XFER_ISOC)
1285		return -EINVAL;
1286
1287	spin_lock_irqsave (&ep->dev->lock, flags);
1288	if (!list_empty (&ep->queue))
1289		retval = -EAGAIN;
1290	else if (ep->is_in && value && net2280_fifo_status (_ep) != 0)
1291		retval = -EAGAIN;
1292	else {
1293		VDEBUG (ep->dev, "%s %s halt\n", _ep->name,
1294				value ? "set" : "clear");
1295		/* set/clear, then synch memory views with the device */
1296		if (value) {
1297			if (ep->num == 0)
1298				ep->dev->protocol_stall = 1;
1299			else
1300				set_halt (ep);
1301		} else
1302			clear_halt (ep);
1303		(void) readl (&ep->regs->ep_rsp);
1304	}
1305	spin_unlock_irqrestore (&ep->dev->lock, flags);
1306
1307	return retval;
1308}
1309
1310static int
1311net2280_fifo_status (struct usb_ep *_ep)
1312{
1313	struct net2280_ep	*ep;
1314	u32			avail;
1315
1316	ep = container_of (_ep, struct net2280_ep, ep);
1317	if (!_ep || (!ep->desc && ep->num != 0))
1318		return -ENODEV;
1319	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1320		return -ESHUTDOWN;
1321
1322	avail = readl (&ep->regs->ep_avail) & ((1 << 12) - 1);
1323	if (avail > ep->fifo_size)
1324		return -EOVERFLOW;
1325	if (ep->is_in)
1326		avail = ep->fifo_size - avail;
1327	return avail;
1328}
1329
1330static void
1331net2280_fifo_flush (struct usb_ep *_ep)
1332{
1333	struct net2280_ep	*ep;
1334
1335	ep = container_of (_ep, struct net2280_ep, ep);
1336	if (!_ep || (!ep->desc && ep->num != 0))
1337		return;
1338	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
1339		return;
1340
1341	writel ((1 << FIFO_FLUSH), &ep->regs->ep_stat);
1342	(void) readl (&ep->regs->ep_rsp);
1343}
1344
1345static struct usb_ep_ops net2280_ep_ops = {
1346	.enable		= net2280_enable,
1347	.disable	= net2280_disable,
1348
1349	.alloc_request	= net2280_alloc_request,
1350	.free_request	= net2280_free_request,
1351
1352	.alloc_buffer	= net2280_alloc_buffer,
1353	.free_buffer	= net2280_free_buffer,
1354
1355	.queue		= net2280_queue,
1356	.dequeue	= net2280_dequeue,
1357
1358	.set_halt	= net2280_set_halt,
1359	.fifo_status	= net2280_fifo_status,
1360	.fifo_flush	= net2280_fifo_flush,
1361};
1362
1363/*-------------------------------------------------------------------------*/
1364
1365static int net2280_get_frame (struct usb_gadget *_gadget)
1366{
1367	struct net2280		*dev;
1368	unsigned long		flags;
1369	u16			retval;
1370
1371	if (!_gadget)
1372		return -ENODEV;
1373	dev = container_of (_gadget, struct net2280, gadget);
1374	spin_lock_irqsave (&dev->lock, flags);
1375	retval = get_idx_reg (dev->regs, REG_FRAME) & 0x03ff;
1376	spin_unlock_irqrestore (&dev->lock, flags);
1377	return retval;
1378}
1379
1380static int net2280_wakeup (struct usb_gadget *_gadget)
1381{
1382	struct net2280		*dev;
1383	u32			tmp;
1384	unsigned long		flags;
1385
1386	if (!_gadget)
1387		return 0;
1388	dev = container_of (_gadget, struct net2280, gadget);
1389
1390	spin_lock_irqsave (&dev->lock, flags);
1391	tmp = readl (&dev->usb->usbctl);
1392	if (tmp & (1 << DEVICE_REMOTE_WAKEUP_ENABLE))
1393		writel (1 << GENERATE_RESUME, &dev->usb->usbstat);
1394	spin_unlock_irqrestore (&dev->lock, flags);
1395
1396	/* pci writes may still be posted */
1397	return 0;
1398}
1399
1400static int net2280_set_selfpowered (struct usb_gadget *_gadget, int value)
1401{
1402	struct net2280		*dev;
1403	u32			tmp;
1404	unsigned long		flags;
1405
1406	if (!_gadget)
1407		return 0;
1408	dev = container_of (_gadget, struct net2280, gadget);
1409
1410	spin_lock_irqsave (&dev->lock, flags);
1411	tmp = readl (&dev->usb->usbctl);
1412	if (value)
1413		tmp |= (1 << SELF_POWERED_STATUS);
1414	else
1415		tmp &= ~(1 << SELF_POWERED_STATUS);
1416	writel (tmp, &dev->usb->usbctl);
1417	spin_unlock_irqrestore (&dev->lock, flags);
1418
1419	return 0;
1420}
1421
1422static const struct usb_gadget_ops net2280_ops = {
1423	.get_frame	= net2280_get_frame,
1424	.wakeup		= net2280_wakeup,
1425	.set_selfpowered = net2280_set_selfpowered,
1426};
1427
1428/*-------------------------------------------------------------------------*/
1429
1430#ifdef	USE_SYSFS_DEBUG_FILES
1431
1432/* "function" sysfs attribute */
1433static ssize_t
1434show_function (struct device *_dev, char *buf)
1435{
1436	struct net2280	*dev = dev_get_drvdata (_dev);
1437
1438	if (!dev->driver
1439			|| !dev->driver->function
1440			|| strlen (dev->driver->function) > PAGE_SIZE)
1441		return 0;
1442	return snprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
1443}
1444static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
1445
1446static ssize_t
1447show_registers (struct device *_dev, char *buf)
1448{
1449	struct net2280		*dev;
1450	char			*next;
1451	unsigned		size, t;
1452	unsigned long		flags;
1453	int			i;
1454	u32			t1, t2;
1455	char			*s;
1456
1457	dev = dev_get_drvdata (_dev);
1458	next = buf;
1459	size = PAGE_SIZE;
1460	spin_lock_irqsave (&dev->lock, flags);
1461
1462	if (dev->driver)
1463		s = dev->driver->driver.name;
1464	else
1465		s = "(none)";
1466
1467	/* Main Control Registers */
1468	t = snprintf (next, size, "%s version " DRIVER_VERSION
1469			", chiprev %04x, dma %s\n\n"
1470			"devinit %03x fifoctl %08x gadget '%s'\n"
1471			"pci irqenb0 %02x irqenb1 %08x "
1472			"irqstat0 %04x irqstat1 %08x\n",
1473			driver_name, dev->chiprev,
1474			use_dma
1475				? (use_dma_chaining ? "chaining" : "enabled")
1476				: "disabled",
1477			readl (&dev->regs->devinit),
1478			readl (&dev->regs->fifoctl),
1479			s,
1480			readl (&dev->regs->pciirqenb0),
1481			readl (&dev->regs->pciirqenb1),
1482			readl (&dev->regs->irqstat0),
1483			readl (&dev->regs->irqstat1));
1484	size -= t;
1485	next += t;
1486
1487	/* USB Control Registers */
1488	t1 = readl (&dev->usb->usbctl);
1489	t2 = readl (&dev->usb->usbstat);
1490	if (t1 & (1 << VBUS_PIN)) {
1491		if (t2 & (1 << HIGH_SPEED))
1492			s = "high speed";
1493		else if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1494			s = "powered";
1495		else
1496			s = "full speed";
1497		/* full speed bit (6) not working?? */
1498	} else
1499			s = "not attached";
1500	t = snprintf (next, size,
1501			"stdrsp %08x usbctl %08x usbstat %08x "
1502				"addr 0x%02x (%s)\n",
1503			readl (&dev->usb->stdrsp), t1, t2,
1504			readl (&dev->usb->ouraddr), s);
1505	size -= t;
1506	next += t;
1507
1508	/* PCI Master Control Registers */
1509
1510	/* DMA Control Registers */
1511
1512	/* Configurable EP Control Registers */
1513	for (i = 0; i < 7; i++) {
1514		struct net2280_ep	*ep;
1515
1516		ep = &dev->ep [i];
1517		if (i && !ep->desc)
1518			continue;
1519
1520		t1 = readl (&ep->regs->ep_cfg);
1521		t2 = readl (&ep->regs->ep_rsp) & 0xff;
1522		t = snprintf (next, size,
1523				"\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
1524					"irqenb %02x\n",
1525				ep->ep.name, t1, t2,
1526				(t2 & (1 << CLEAR_NAK_OUT_PACKETS))
1527					? "NAK " : "",
1528				(t2 & (1 << CLEAR_EP_HIDE_STATUS_PHASE))
1529					? "hide " : "",
1530				(t2 & (1 << CLEAR_EP_FORCE_CRC_ERROR))
1531					? "CRC " : "",
1532				(t2 & (1 << CLEAR_INTERRUPT_MODE))
1533					? "interrupt " : "",
1534				(t2 & (1<<CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE))
1535					? "status " : "",
1536				(t2 & (1 << CLEAR_NAK_OUT_PACKETS_MODE))
1537					? "NAKmode " : "",
1538				(t2 & (1 << CLEAR_ENDPOINT_TOGGLE))
1539					? "DATA1 " : "DATA0 ",
1540				(t2 & (1 << CLEAR_ENDPOINT_HALT))
1541					? "HALT " : "",
1542				readl (&ep->regs->ep_irqenb));
1543		size -= t;
1544		next += t;
1545
1546		t = snprintf (next, size,
1547				"\tstat %08x avail %04x "
1548				"(ep%d%s-%s)%s\n",
1549				readl (&ep->regs->ep_stat),
1550				readl (&ep->regs->ep_avail),
1551				t1 & 0x0f, DIR_STRING (t1),
1552				type_string (t1 >> 8),
1553				ep->stopped ? "*" : "");
1554		size -= t;
1555		next += t;
1556
1557		if (!ep->dma)
1558			continue;
1559
1560		t = snprintf (next, size,
1561				"  dma\tctl %08x stat %08x count %08x\n"
1562				"\taddr %08x desc %08x\n",
1563				readl (&ep->dma->dmactl),
1564				readl (&ep->dma->dmastat),
1565				readl (&ep->dma->dmacount),
1566				readl (&ep->dma->dmaaddr),
1567				readl (&ep->dma->dmadesc));
1568		size -= t;
1569		next += t;
1570
1571	}
1572
1573	/* Indexed Registers */
1574		// none yet
1575
1576	/* Statistics */
1577	t = snprintf (next, size, "\nirqs:  ");
1578	size -= t;
1579	next += t;
1580	for (i = 0; i < 7; i++) {
1581		struct net2280_ep	*ep;
1582
1583		ep = &dev->ep [i];
1584		if (i && !ep->irqs)
1585			continue;
1586		t = snprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
1587		size -= t;
1588		next += t;
1589
1590	}
1591	t = snprintf (next, size, "\n");
1592	size -= t;
1593	next += t;
1594
1595	spin_unlock_irqrestore (&dev->lock, flags);
1596
1597	return PAGE_SIZE - size;
1598}
1599static DEVICE_ATTR (registers, S_IRUGO, show_registers, NULL);
1600
1601static ssize_t
1602show_queues (struct device *_dev, char *buf)
1603{
1604	struct net2280		*dev;
1605	char			*next;
1606	unsigned		size;
1607	unsigned long		flags;
1608	int			i;
1609
1610	dev = dev_get_drvdata (_dev);
1611	next = buf;
1612	size = PAGE_SIZE;
1613	spin_lock_irqsave (&dev->lock, flags);
1614
1615	for (i = 0; i < 7; i++) {
1616		struct net2280_ep		*ep = &dev->ep [i];
1617		struct net2280_request		*req;
1618		int				t;
1619
1620		if (i != 0) {
1621			const struct usb_endpoint_descriptor	*d;
1622
1623			d = ep->desc;
1624			if (!d)
1625				continue;
1626			t = d->bEndpointAddress;
1627			t = snprintf (next, size,
1628				"\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
1629				ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
1630				(t & USB_DIR_IN) ? "in" : "out",
1631				({ char *val;
1632				 switch (d->bmAttributes & 0x03) {
1633				 case USB_ENDPOINT_XFER_BULK:
1634				 	val = "bulk"; break;
1635				 case USB_ENDPOINT_XFER_INT:
1636				 	val = "intr"; break;
1637				 default:
1638				 	val = "iso"; break;
1639				 }; val; }),
1640				le16_to_cpu (d->wMaxPacketSize) & 0x1fff,
1641				ep->dma ? "dma" : "pio", ep->fifo_size
1642				);
1643		} else /* ep0 should only have one transfer queued */
1644			t = snprintf (next, size, "ep0 max 64 pio %s\n",
1645					ep->is_in ? "in" : "out");
1646		if (t <= 0 || t > size)
1647			goto done;
1648		size -= t;
1649		next += t;
1650
1651		if (list_empty (&ep->queue)) {
1652			t = snprintf (next, size, "\t(nothing queued)\n");
1653			if (t <= 0 || t > size)
1654				goto done;
1655			size -= t;
1656			next += t;
1657			continue;
1658		}
1659		list_for_each_entry (req, &ep->queue, queue) {
1660			if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
1661				t = snprintf (next, size,
1662					"\treq %p len %d/%d "
1663					"buf %p (dmacount %08x)\n",
1664					&req->req, req->req.actual,
1665					req->req.length, req->req.buf,
1666					readl (&ep->dma->dmacount));
1667			else
1668				t = snprintf (next, size,
1669					"\treq %p len %d/%d buf %p\n",
1670					&req->req, req->req.actual,
1671					req->req.length, req->req.buf);
1672			if (t <= 0 || t > size)
1673				goto done;
1674			size -= t;
1675			next += t;
1676
1677			if (ep->dma) {
1678				struct net2280_dma	*td;
1679
1680				td = req->td;
1681				t = snprintf (next, size, "\t    td %08x "
1682					" count %08x buf %08x desc %08x\n",
1683					req->td_dma, td->dmacount,
1684					td->dmaaddr, td->dmadesc);
1685				if (t <= 0 || t > size)
1686					goto done;
1687				size -= t;
1688				next += t;
1689			}
1690		}
1691	}
1692
1693done:
1694	spin_unlock_irqrestore (&dev->lock, flags);
1695	return PAGE_SIZE - size;
1696}
1697static DEVICE_ATTR (queues, S_IRUGO, show_queues, NULL);
1698
1699
1700#else
1701
1702#define device_create_file(a,b)	do {} while (0)
1703#define device_remove_file	device_create_file
1704
1705#endif
1706
1707/*-------------------------------------------------------------------------*/
1708
1709/* another driver-specific mode might be a request type doing dma
1710 * to/from another device fifo instead of to/from memory.
1711 */
1712
1713static void set_fifo_mode (struct net2280 *dev, int mode)
1714{
1715	/* keeping high bits preserves BAR2 */
1716	writel ((0xffff << PCI_BASE2_RANGE) | mode, &dev->regs->fifoctl);
1717
1718	/* always ep-{a,b,e,f} ... maybe not ep-c or ep-d */
1719	INIT_LIST_HEAD (&dev->gadget.ep_list);
1720	list_add_tail (&dev->ep [1].ep.ep_list, &dev->gadget.ep_list);
1721	list_add_tail (&dev->ep [2].ep.ep_list, &dev->gadget.ep_list);
1722	switch (mode) {
1723	case 0:
1724		list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1725		list_add_tail (&dev->ep [4].ep.ep_list, &dev->gadget.ep_list);
1726		dev->ep [1].fifo_size = dev->ep [2].fifo_size = 1024;
1727		break;
1728	case 1:
1729		dev->ep [1].fifo_size = dev->ep [2].fifo_size = 2048;
1730		break;
1731	case 2:
1732		list_add_tail (&dev->ep [3].ep.ep_list, &dev->gadget.ep_list);
1733		dev->ep [1].fifo_size = 2048;
1734		dev->ep [2].fifo_size = 1024;
1735		break;
1736	}
1737	/* fifo sizes for ep0, ep-c, ep-d, ep-e, and ep-f never change */
1738	list_add_tail (&dev->ep [5].ep.ep_list, &dev->gadget.ep_list);
1739	list_add_tail (&dev->ep [6].ep.ep_list, &dev->gadget.ep_list);
1740}
1741
1742/**
1743 * net2280_set_fifo_mode - change allocation of fifo buffers
1744 * @gadget: access to the net2280 device that will be updated
1745 * @mode: 0 for default, four 1kB buffers (ep-a through ep-d);
1746 * 	1 for two 2kB buffers (ep-a and ep-b only);
1747 * 	2 for one 2kB buffer (ep-a) and two 1kB ones (ep-b, ep-c).
1748 *
1749 * returns zero on success, else negative errno.  when this succeeds,
1750 * the contents of gadget->ep_list may have changed.
1751 *
1752 * you may only call this function when endpoints a-d are all disabled.
1753 * use it whenever extra hardware buffering can help performance, such
1754 * as before enabling "high bandwidth" interrupt endpoints that use
1755 * maxpacket bigger than 512 (when double buffering would otherwise
1756 * be unavailable).
1757 */
1758int net2280_set_fifo_mode (struct usb_gadget *gadget, int mode)
1759{
1760	int			i;
1761	struct net2280		*dev;
1762	int			status = 0;
1763	unsigned long		flags;
1764
1765	if (!gadget)
1766		return -ENODEV;
1767	dev = container_of (gadget, struct net2280, gadget);
1768
1769	spin_lock_irqsave (&dev->lock, flags);
1770
1771	for (i = 1; i <= 4; i++)
1772		if (dev->ep [i].desc) {
1773			status = -EINVAL;
1774			break;
1775		}
1776	if (mode < 0 || mode > 2)
1777		status = -EINVAL;
1778	if (status == 0)
1779		set_fifo_mode (dev, mode);
1780	spin_unlock_irqrestore (&dev->lock, flags);
1781
1782	if (status == 0) {
1783		if (mode == 1)
1784			DEBUG (dev, "fifo:  ep-a 2K, ep-b 2K\n");
1785		else if (mode == 2)
1786			DEBUG (dev, "fifo:  ep-a 2K, ep-b 1K, ep-c 1K\n");
1787		/* else all are 1K */
1788	}
1789	return status;
1790}
1791EXPORT_SYMBOL (net2280_set_fifo_mode);
1792
1793/*-------------------------------------------------------------------------*/
1794
1795/* keeping it simple:
1796 * - one bus driver, initted first;
1797 * - one function driver, initted second
1798 *
1799 * most of the work to support multiple net2280 controllers would
1800 * be to associate this gadget driver (yes?) with all of them, or
1801 * perhaps to bind specific drivers to specific devices.
1802 */
1803
1804static struct net2280	*the_controller;
1805
1806static void usb_reset (struct net2280 *dev)
1807{
1808	u32	tmp;
1809
1810	/* force immediate bus disconnect, and synch through pci */
1811	writel (0, &dev->usb->usbctl);
1812	dev->gadget.speed = USB_SPEED_UNKNOWN;
1813	(void) readl (&dev->usb->usbctl);
1814
1815	net2280_led_init (dev);
1816
1817	/* disable automatic responses, and irqs */
1818	writel (0, &dev->usb->stdrsp);
1819	writel (0, &dev->regs->pciirqenb0);
1820	writel (0, &dev->regs->pciirqenb1);
1821
1822	/* clear old dma and irq state */
1823	for (tmp = 0; tmp < 4; tmp++) {
1824		struct net2280_ep	*ep = &dev->ep [tmp + 1];
1825
1826		if (ep->dma)
1827			abort_dma (ep);
1828	}
1829	writel (~0, &dev->regs->irqstat0),
1830	writel (~(1 << SUSPEND_REQUEST_INTERRUPT), &dev->regs->irqstat1),
1831
1832	/* reset, and enable pci */
1833	tmp = readl (&dev->regs->devinit)
1834		| (1 << PCI_ENABLE)
1835		| (1 << FIFO_SOFT_RESET)
1836		| (1 << USB_SOFT_RESET)
1837		| (1 << M8051_RESET);
1838	writel (tmp, &dev->regs->devinit);
1839
1840	/* standard fifo and endpoint allocations */
1841	set_fifo_mode (dev, (fifo_mode <= 2) ? fifo_mode : 0);
1842}
1843
1844static void usb_reinit (struct net2280 *dev)
1845{
1846	u32	tmp;
1847	int	init_dma;
1848
1849	/* use_dma changes are ignored till next device re-init */
1850	init_dma = use_dma;
1851
1852	/* basic endpoint init */
1853	for (tmp = 0; tmp < 7; tmp++) {
1854		struct net2280_ep	*ep = &dev->ep [tmp];
1855
1856		ep->ep.name = ep_name [tmp];
1857		ep->dev = dev;
1858		ep->num = tmp;
1859
1860		if (tmp > 0 && tmp <= 4) {
1861			ep->fifo_size = 1024;
1862			if (init_dma)
1863				ep->dma = &dev->dma [tmp - 1];
1864		} else
1865			ep->fifo_size = 64;
1866		ep->regs = &dev->epregs [tmp];
1867		ep_reset (dev->regs, ep);
1868	}
1869	dev->ep [0].ep.maxpacket = 64;
1870	dev->ep [5].ep.maxpacket = 64;
1871	dev->ep [6].ep.maxpacket = 64;
1872
1873	dev->gadget.ep0 = &dev->ep [0].ep;
1874	dev->ep [0].stopped = 0;
1875	INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
1876
1877	/* we want to prevent lowlevel/insecure access from the USB host,
1878	 * but erratum 0119 means this enable bit is ignored
1879	 */
1880	for (tmp = 0; tmp < 5; tmp++)
1881		writel (EP_DONTUSE, &dev->dep [tmp].dep_cfg);
1882}
1883
1884static void ep0_start (struct net2280 *dev)
1885{
1886	writel (  (1 << CLEAR_EP_HIDE_STATUS_PHASE)
1887		| (1 << CLEAR_NAK_OUT_PACKETS)
1888		| (1 << CLEAR_CONTROL_STATUS_PHASE_HANDSHAKE)
1889		, &dev->epregs [0].ep_rsp);
1890
1891	/*
1892	 * hardware optionally handles a bunch of standard requests
1893	 * that the API hides from drivers anyway.  have it do so.
1894	 * endpoint status/features are handled in software, to
1895	 * help pass tests for some dubious behavior.
1896	 */
1897	writel (  (1 << SET_TEST_MODE)
1898		| (1 << SET_ADDRESS)
1899		| (1 << DEVICE_SET_CLEAR_DEVICE_REMOTE_WAKEUP)
1900		| (1 << GET_DEVICE_STATUS)
1901		| (1 << GET_INTERFACE_STATUS)
1902		, &dev->usb->stdrsp);
1903	writel (  (1 << USB_ROOT_PORT_WAKEUP_ENABLE)
1904		| (1 << SELF_POWERED_USB_DEVICE)
1905		| (1 << REMOTE_WAKEUP_SUPPORT)
1906		| (1 << USB_DETECT_ENABLE)
1907		| (1 << SELF_POWERED_STATUS)
1908		, &dev->usb->usbctl);
1909
1910	/* enable irqs so we can see ep0 and general operation  */
1911	writel (  (1 << SETUP_PACKET_INTERRUPT_ENABLE)
1912		| (1 << ENDPOINT_0_INTERRUPT_ENABLE)
1913		, &dev->regs->pciirqenb0);
1914	writel (  (1 << PCI_INTERRUPT_ENABLE)
1915		| (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT_ENABLE)
1916		| (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT_ENABLE)
1917		| (1 << PCI_RETRY_ABORT_INTERRUPT_ENABLE)
1918		| (1 << VBUS_INTERRUPT_ENABLE)
1919		| (1 << ROOT_PORT_RESET_INTERRUPT_ENABLE)
1920		, &dev->regs->pciirqenb1);
1921
1922	/* don't leave any writes posted */
1923	(void) readl (&dev->usb->usbctl);
1924}
1925
1926/* when a driver is successfully registered, it will receive
1927 * control requests including set_configuration(), which enables
1928 * non-control requests.  then usb traffic follows until a
1929 * disconnect is reported.  then a host may connect again, or
1930 * the driver might get unbound.
1931 */
1932int usb_gadget_register_driver (struct usb_gadget_driver *driver)
1933{
1934	struct net2280		*dev = the_controller;
1935	int			retval;
1936	unsigned		i;
1937
1938	/* insist on high speed support from the driver, since
1939	 * (dev->usb->xcvrdiag & FORCE_FULL_SPEED_MODE)
1940	 * "must not be used in normal operation"
1941	 */
1942	if (!driver
1943			|| driver->speed != USB_SPEED_HIGH
1944			|| !driver->bind
1945			|| !driver->unbind
1946			|| !driver->setup)
1947		return -EINVAL;
1948	if (!dev)
1949		return -ENODEV;
1950	if (dev->driver)
1951		return -EBUSY;
1952
1953	for (i = 0; i < 7; i++)
1954		dev->ep [i].irqs = 0;
1955
1956	/* hook up the driver ... */
1957	dev->driver = driver;
1958	retval = driver->bind (&dev->gadget);
1959	if (retval) {
1960		DEBUG (dev, "bind to driver %s --> %d\n",
1961				driver->driver.name, retval);
1962		dev->driver = 0;
1963		return retval;
1964	}
1965
1966	/* ... then enable host detection and ep0; and we're ready
1967	 * for set_configuration as well as eventual disconnect.
1968	 */
1969	net2280_led_active (dev, 1);
1970	ep0_start (dev);
1971
1972	DEBUG (dev, "%s ready, usbctl %08x stdrsp %08x\n",
1973			driver->driver.name,
1974			readl (&dev->usb->usbctl),
1975			readl (&dev->usb->stdrsp));
1976
1977	/* pci writes may still be posted */
1978	return 0;
1979}
1980EXPORT_SYMBOL (usb_gadget_register_driver);
1981
1982static void
1983stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
1984{
1985	int			i;
1986
1987	/* don't disconnect if it's not connected */
1988	if (dev->gadget.speed == USB_SPEED_UNKNOWN)
1989		driver = 0;
1990
1991	/* stop hardware; prevent new request submissions;
1992	 * and kill any outstanding requests.
1993	 */
1994	usb_reset (dev);
1995	for (i = 0; i < 7; i++)
1996		nuke (&dev->ep [i]);
1997
1998	/* report disconnect; the driver is already quiesced */
1999	if (driver) {
2000		spin_unlock (&dev->lock);
2001		driver->disconnect (&dev->gadget);
2002		spin_lock (&dev->lock);
2003	}
2004
2005	usb_reinit (dev);
2006}
2007
2008int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
2009{
2010	struct net2280	*dev = the_controller;
2011	unsigned long	flags;
2012
2013	if (!dev)
2014		return -ENODEV;
2015	if (!driver || driver != dev->driver)
2016		return -EINVAL;
2017
2018	spin_lock_irqsave (&dev->lock, flags);
2019	stop_activity (dev, driver);
2020	spin_unlock_irqrestore (&dev->lock, flags);
2021
2022	driver->unbind (&dev->gadget);
2023	dev->driver = 0;
2024
2025	net2280_led_active (dev, 0);
2026
2027	DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
2028	return 0;
2029}
2030EXPORT_SYMBOL (usb_gadget_unregister_driver);
2031
2032
2033/*-------------------------------------------------------------------------*/
2034
2035/* handle ep0, ep-e, ep-f with 64 byte packets: packet per irq.
2036 * also works for dma-capable endpoints, in pio mode or just
2037 * to manually advance the queue after short OUT transfers.
2038 */
2039static void handle_ep_small (struct net2280_ep *ep)
2040{
2041	struct net2280_request	*req;
2042	u32			t;
2043	/* 0 error, 1 mid-data, 2 done */
2044	int			mode = 1;
2045
2046	if (!list_empty (&ep->queue))
2047		req = list_entry (ep->queue.next,
2048			struct net2280_request, queue);
2049	else
2050		req = 0;
2051
2052	/* ack all, and handle what we care about */
2053	t = readl (&ep->regs->ep_stat);
2054	ep->irqs++;
2055#if 0
2056	VDEBUG (ep->dev, "%s ack ep_stat %08x, req %p\n",
2057			ep->ep.name, t, req ? &req->req : 0);
2058#endif
2059	writel (t & ~(1 << NAK_OUT_PACKETS), &ep->regs->ep_stat);
2060
2061	/* for ep0, monitor token irqs to catch data stage length errors
2062	 * and to synchronize on status.
2063	 *
2064	 * also, to defer reporting of protocol stalls ... here's where
2065	 * data or status first appears, handling stalls here should never
2066	 * cause trouble on the host side..
2067	 *
2068	 * control requests could be slightly faster without token synch for
2069	 * status, but status can jam up that way.
2070	 */
2071	if (unlikely (ep->num == 0)) {
2072		if (ep->is_in) {
2073			/* status; stop NAKing */
2074			if (t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT)) {
2075				if (ep->dev->protocol_stall) {
2076					ep->stopped = 1;
2077					set_halt (ep);
2078				}
2079				if (!req)
2080					allow_status (ep);
2081				mode = 2;
2082			/* reply to extra IN data tokens with a zlp */
2083			} else if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2084				if (ep->dev->protocol_stall) {
2085					ep->stopped = 1;
2086					set_halt (ep);
2087					mode = 2;
2088				} else if (!req && ep->stopped)
2089					write_fifo (ep, 0);
2090			}
2091		} else {
2092			/* status; stop NAKing */
2093			if (t & (1 << DATA_IN_TOKEN_INTERRUPT)) {
2094				if (ep->dev->protocol_stall) {
2095					ep->stopped = 1;
2096					set_halt (ep);
2097				}
2098				mode = 2;
2099			/* an extra OUT token is an error */
2100			} else if (((t & (1 << DATA_OUT_PING_TOKEN_INTERRUPT))
2101					&& req
2102					&& req->req.actual == req->req.length)
2103					|| !req) {
2104				ep->dev->protocol_stall = 1;
2105				set_halt (ep);
2106				ep->stopped = 1;
2107				if (req)
2108					done (ep, req, -EOVERFLOW);
2109				req = 0;
2110			}
2111		}
2112	}
2113
2114	if (unlikely (!req))
2115		return;
2116
2117	/* manual DMA queue advance after short OUT */
2118	if (likely (ep->dma != 0)) {
2119		if (t & (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)) {
2120			u32	count;
2121			int	stopped = ep->stopped;
2122
2123			/* TRANSFERRED works around OUT_DONE erratum 0112.
2124			 * we expect (N <= maxpacket) bytes; host wrote M.
2125			 * iff (M < N) we won't ever see a DMA interrupt.
2126			 */
2127			ep->stopped = 1;
2128			for (count = 0; ; t = readl (&ep->regs->ep_stat)) {
2129
2130				/* any preceding dma transfers must finish.
2131				 * dma handles (M >= N), may empty the queue
2132				 */
2133				scan_dma_completions (ep);
2134				if (unlikely (list_empty (&ep->queue)
2135						|| ep->out_overflow)) {
2136					req = 0;
2137					break;
2138				}
2139				req = list_entry (ep->queue.next,
2140					struct net2280_request, queue);
2141
2142				/* here either (M < N), a "real" short rx;
2143				 * or (M == N) and the queue didn't empty
2144				 */
2145				if (likely (t & (1 << FIFO_EMPTY))) {
2146					count = readl (&ep->dma->dmacount);
2147					count &= DMA_BYTE_COUNT_MASK;
2148					if (readl (&ep->dma->dmadesc)
2149							!= req->td_dma)
2150						req = 0;
2151					break;
2152				}
2153				udelay(1);
2154			}
2155
2156			/* stop DMA, leave ep NAKing */
2157			writel ((1 << DMA_ABORT), &ep->dma->dmastat);
2158			spin_stop_dma (ep->dma);
2159
2160			if (likely (req != 0)) {
2161				req->td->dmacount = 0;
2162				t = readl (&ep->regs->ep_avail);
2163				dma_done (ep, req, count, t);
2164			}
2165
2166			/* also flush to prevent erratum 0106 trouble */
2167			if (unlikely (ep->out_overflow
2168					|| (ep->dev->chiprev == 0x0100
2169						&& ep->dev->gadget.speed
2170							== USB_SPEED_FULL))) {
2171				out_flush (ep);
2172				ep->out_overflow = 0;
2173			}
2174
2175			/* (re)start dma if needed, stop NAKing */
2176			ep->stopped = stopped;
2177			if (!list_empty (&ep->queue))
2178				restart_dma (ep);
2179		} else
2180			DEBUG (ep->dev, "%s dma ep_stat %08x ??\n",
2181					ep->ep.name, t);
2182		return;
2183
2184	/* data packet(s) received (in the fifo, OUT) */
2185	} else if (t & (1 << DATA_PACKET_RECEIVED_INTERRUPT)) {
2186		if (read_fifo (ep, req) && ep->num != 0)
2187			mode = 2;
2188
2189	/* data packet(s) transmitted (IN) */
2190	} else if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)) {
2191		unsigned	len;
2192
2193		len = req->req.length - req->req.actual;
2194		len = min (ep->ep.maxpacket, len);
2195		req->req.actual += len;
2196
2197		/* if we wrote it all, we're usually done */
2198		if (req->req.actual == req->req.length) {
2199			if (ep->num == 0) {
2200				/* wait for control status */
2201				if (mode != 2)
2202					req = 0;
2203			} else if (!req->req.zero || len != ep->ep.maxpacket)
2204				mode = 2;
2205		}
2206
2207	/* there was nothing to do ...  */
2208	} else if (mode == 1)
2209		return;
2210
2211	/* done */
2212	if (mode == 2) {
2213		/* stream endpoints often resubmit/unlink in completion */
2214		done (ep, req, 0);
2215
2216		/* maybe advance queue to next request */
2217		if (ep->num == 0) {
2218			/* NOTE:  net2280 could let gadget driver start the
2219			 * status stage later. since not all controllers let
2220			 * them control that, the api doesn't (yet) allow it.
2221			 */
2222			if (!ep->stopped)
2223				allow_status (ep);
2224			req = 0;
2225		} else {
2226			if (!list_empty (&ep->queue) && !ep->stopped)
2227				req = list_entry (ep->queue.next,
2228					struct net2280_request, queue);
2229			else
2230				req = 0;
2231			if (req && !ep->is_in)
2232				stop_out_naking (ep);
2233		}
2234	}
2235
2236	/* is there a buffer for the next packet?
2237	 * for best streaming performance, make sure there is one.
2238	 */
2239	if (req && !ep->stopped) {
2240
2241		/* load IN fifo with next packet (may be zlp) */
2242		if (t & (1 << DATA_PACKET_TRANSMITTED_INTERRUPT))
2243			write_fifo (ep, &req->req);
2244	}
2245}
2246
2247static struct net2280_ep *
2248get_ep_by_addr (struct net2280 *dev, u16 wIndex)
2249{
2250	struct net2280_ep	*ep;
2251
2252	if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
2253		return &dev->ep [0];
2254	list_for_each_entry (ep, &dev->gadget.ep_list, ep.ep_list) {
2255		u8	bEndpointAddress;
2256
2257		if (!ep->desc)
2258			continue;
2259		bEndpointAddress = ep->desc->bEndpointAddress;
2260		if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
2261			continue;
2262		if ((wIndex & 0x0f) == (bEndpointAddress & 0x0f))
2263			return ep;
2264	}
2265	return 0;
2266}
2267
2268static void handle_stat0_irqs (struct net2280 *dev, u32 stat)
2269{
2270	struct net2280_ep	*ep;
2271	u32			num, scratch;
2272
2273	/* most of these don't need individual acks */
2274	stat &= ~(1 << INTA_ASSERTED);
2275	if (!stat)
2276		return;
2277	// DEBUG (dev, "irqstat0 %04x\n", stat);
2278
2279	/* starting a control request? */
2280	if (unlikely (stat & (1 << SETUP_PACKET_INTERRUPT))) {
2281		union {
2282			u32			raw [2];
2283			struct usb_ctrlrequest	r;
2284		} u;
2285		int				tmp = 0;
2286		struct net2280_request		*req;
2287
2288		if (dev->gadget.speed == USB_SPEED_UNKNOWN) {
2289			if (readl (&dev->usb->usbstat) & (1 << HIGH_SPEED))
2290				dev->gadget.speed = USB_SPEED_HIGH;
2291			else
2292				dev->gadget.speed = USB_SPEED_FULL;
2293			net2280_led_speed (dev, dev->gadget.speed);
2294			DEBUG (dev, "%s speed\n",
2295				(dev->gadget.speed == USB_SPEED_HIGH)
2296					? "high" : "full");
2297		}
2298
2299		ep = &dev->ep [0];
2300		ep->irqs++;
2301
2302		/* make sure any leftover request state is cleared */
2303		stat &= ~(1 << ENDPOINT_0_INTERRUPT);
2304		while (!list_empty (&ep->queue)) {
2305			req = list_entry (ep->queue.next,
2306					struct net2280_request, queue);
2307			done (ep, req, (req->req.actual == req->req.length)
2308						? 0 : -EPROTO);
2309		}
2310		ep->stopped = 0;
2311		dev->protocol_stall = 0;
2312		writel (  (1 << TIMEOUT)
2313			| (1 << USB_STALL_SENT)
2314			| (1 << USB_IN_NAK_SENT)
2315			| (1 << USB_IN_ACK_RCVD)
2316			| (1 << USB_OUT_PING_NAK_SENT)
2317			| (1 << USB_OUT_ACK_SENT)
2318			| (1 << FIFO_OVERFLOW)
2319			| (1 << FIFO_UNDERFLOW)
2320			| (1 << SHORT_PACKET_OUT_DONE_INTERRUPT)
2321			| (1 << SHORT_PACKET_TRANSFERRED_INTERRUPT)
2322			| (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2323			| (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2324			| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2325			| (1 << DATA_IN_TOKEN_INTERRUPT)
2326			, &ep->regs->ep_stat);
2327		u.raw [0] = readl (&dev->usb->setup0123);
2328		u.raw [1] = readl (&dev->usb->setup4567);
2329
2330		cpu_to_le32s (&u.raw [0]);
2331		cpu_to_le32s (&u.raw [1]);
2332
2333		le16_to_cpus (&u.r.wValue);
2334		le16_to_cpus (&u.r.wIndex);
2335		le16_to_cpus (&u.r.wLength);
2336
2337		/* ack the irq */
2338		writel (1 << SETUP_PACKET_INTERRUPT, &dev->regs->irqstat0);
2339		stat ^= (1 << SETUP_PACKET_INTERRUPT);
2340
2341		/* watch control traffic at the token level, and force
2342		 * synchronization before letting the status stage happen.
2343		 * FIXME ignore tokens we'll NAK, until driver responds.
2344		 * that'll mean a lot less irqs for some drivers.
2345		 */
2346		ep->is_in = (u.r.bRequestType & USB_DIR_IN) != 0;
2347		if (ep->is_in) {
2348			scratch = (1 << DATA_PACKET_TRANSMITTED_INTERRUPT)
2349				| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2350				| (1 << DATA_IN_TOKEN_INTERRUPT);
2351			stop_out_naking (ep);
2352		} else
2353			scratch = (1 << DATA_PACKET_RECEIVED_INTERRUPT)
2354				| (1 << DATA_OUT_PING_TOKEN_INTERRUPT)
2355				| (1 << DATA_IN_TOKEN_INTERRUPT);
2356		writel (scratch, &dev->epregs [0].ep_irqenb);
2357
2358		/* we made the hardware handle most lowlevel requests;
2359		 * everything else goes uplevel to the gadget code.
2360		 */
2361		switch (u.r.bRequest) {
2362		case USB_REQ_GET_STATUS: {
2363			struct net2280_ep	*e;
2364			u16			status;
2365
2366			/* hw handles device and interface status */
2367			if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
2368				goto delegate;
2369			if ((e = get_ep_by_addr (dev, u.r.wIndex)) == 0
2370					|| u.r.wLength > 2)
2371				goto do_stall;
2372
2373			if (readl (&e->regs->ep_rsp)
2374					& (1 << SET_ENDPOINT_HALT))
2375				status = __constant_cpu_to_le16 (1);
2376			else
2377				status = __constant_cpu_to_le16 (0);
2378
2379			/* don't bother with a request object! */
2380			writel (0, &dev->epregs [0].ep_irqenb);
2381			set_fifo_bytecount (ep, u.r.wLength);
2382			writel (status, &dev->epregs [0].ep_data);
2383			allow_status (ep);
2384			VDEBUG (dev, "%s stat %02x\n", ep->ep.name, status);
2385			goto next_endpoints;
2386			}
2387			break;
2388		case USB_REQ_CLEAR_FEATURE: {
2389			struct net2280_ep	*e;
2390
2391			/* hw handles device features */
2392			if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2393				goto delegate;
2394			if (u.r.wValue != 0 /* HALT feature */
2395					|| u.r.wLength != 0)
2396				goto do_stall;
2397			if ((e = get_ep_by_addr (dev, u.r.wIndex)) == 0)
2398				goto do_stall;
2399			clear_halt (e);
2400			allow_status (ep);
2401			VDEBUG (dev, "%s clear halt\n", ep->ep.name);
2402			goto next_endpoints;
2403			}
2404			break;
2405		case USB_REQ_SET_FEATURE: {
2406			struct net2280_ep	*e;
2407
2408			/* hw handles device features */
2409			if (u.r.bRequestType != USB_RECIP_ENDPOINT)
2410				goto delegate;
2411			if (u.r.wValue != 0 /* HALT feature */
2412					|| u.r.wLength != 0)
2413				goto do_stall;
2414			if ((e = get_ep_by_addr (dev, u.r.wIndex)) == 0)
2415				goto do_stall;
2416			set_halt (e);
2417			allow_status (ep);
2418			VDEBUG (dev, "%s set halt\n", ep->ep.name);
2419			goto next_endpoints;
2420			}
2421			break;
2422		default:
2423delegate:
2424			VDEBUG (dev, "setup %02x.%02x v%04x i%04x "
2425				"ep_cfg %08x\n",
2426				u.r.bRequestType, u.r.bRequest,
2427				u.r.wValue, u.r.wIndex,
2428				readl (&ep->regs->ep_cfg));
2429			spin_unlock (&dev->lock);
2430			tmp = dev->driver->setup (&dev->gadget, &u.r);
2431			spin_lock (&dev->lock);
2432		}
2433
2434		/* stall ep0 on error */
2435		if (tmp < 0) {
2436do_stall:
2437			VDEBUG (dev, "req %02x.%02x protocol STALL; stat %d\n",
2438					u.r.bRequestType, u.r.bRequest, tmp);
2439			dev->protocol_stall = 1;
2440		}
2441
2442		/* some in/out token irq should follow; maybe stall then.
2443		 * driver must queue a request (even zlp) or halt ep0
2444		 * before the host times out.
2445		 */
2446	}
2447
2448next_endpoints:
2449	/* endpoint data irq ? */
2450	scratch = stat & 0x7f;
2451	stat &= ~0x7f;
2452	for (num = 0; scratch; num++) {
2453		u32		t;
2454
2455		/* do this endpoint's FIFO and queue need tending? */
2456		t = 1 << num;
2457		if ((scratch & t) == 0)
2458			continue;
2459		scratch ^= t;
2460
2461		ep = &dev->ep [num];
2462		handle_ep_small (ep);
2463	}
2464
2465	if (stat)
2466		DEBUG (dev, "unhandled irqstat0 %08x\n", stat);
2467}
2468
2469#define DMA_INTERRUPTS ( \
2470		  (1 << DMA_D_INTERRUPT) \
2471		| (1 << DMA_C_INTERRUPT) \
2472		| (1 << DMA_B_INTERRUPT) \
2473		| (1 << DMA_A_INTERRUPT))
2474#define	PCI_ERROR_INTERRUPTS ( \
2475		  (1 << PCI_MASTER_ABORT_RECEIVED_INTERRUPT) \
2476		| (1 << PCI_TARGET_ABORT_RECEIVED_INTERRUPT) \
2477		| (1 << PCI_RETRY_ABORT_INTERRUPT))
2478
2479static void handle_stat1_irqs (struct net2280 *dev, u32 stat)
2480{
2481	struct net2280_ep	*ep;
2482	u32			tmp, num, scratch;
2483
2484	/* after disconnect there's nothing else to do! */
2485	tmp = (1 << VBUS_INTERRUPT) | (1 << ROOT_PORT_RESET_INTERRUPT);
2486	if (stat & tmp) {
2487		writel (tmp, &dev->regs->irqstat1);
2488		if (((stat & (1 << ROOT_PORT_RESET_INTERRUPT)) != 0
2489			|| (readl (&dev->usb->usbctl) & (1 << VBUS_PIN)) == 0
2490			) && dev->gadget.speed != USB_SPEED_UNKNOWN) {
2491			DEBUG (dev, "disconnect %s\n",
2492					dev->driver->driver.name);
2493			stop_activity (dev, dev->driver);
2494			ep0_start (dev);
2495			return;
2496		}
2497		stat &= ~tmp;
2498
2499		/* vBUS can bounce ... one of many reasons to ignore the
2500		 * notion of hotplug events on bus connect/disconnect!
2501		 */
2502		if (!stat)
2503			return;
2504	}
2505
2506	/* NOTE: we don't actually suspend the hardware; that starts to
2507	 * interact with PCI power management, and needs something like a
2508	 * controller->suspend() call to clear SUSPEND_REQUEST_INTERRUPT.
2509	 * we shouldn't see resume interrupts.
2510	 * for rev 0100, this also avoids erratum 0102.
2511	 */
2512	tmp = (1 << SUSPEND_REQUEST_CHANGE_INTERRUPT);
2513	if (stat & tmp) {
2514		if (dev->driver->suspend)
2515			dev->driver->suspend (&dev->gadget);
2516		stat &= ~tmp;
2517	}
2518	stat &= ~(1 << SUSPEND_REQUEST_INTERRUPT);
2519
2520	/* clear any other status/irqs */
2521	if (stat)
2522		writel (stat, &dev->regs->irqstat1);
2523
2524	/* some status we can just ignore */
2525	stat &= ~((1 << CONTROL_STATUS_INTERRUPT)
2526			| (1 << RESUME_INTERRUPT)
2527			| (1 << SOF_INTERRUPT));
2528	if (!stat)
2529		return;
2530	// DEBUG (dev, "irqstat1 %08x\n", stat);
2531
2532	/* DMA status, for ep-{a,b,c,d} */
2533	scratch = stat & DMA_INTERRUPTS;
2534	stat &= ~DMA_INTERRUPTS;
2535	scratch >>= 9;
2536	for (num = 0; scratch; num++) {
2537		struct net2280_dma_regs	*dma;
2538
2539		tmp = 1 << num;
2540		if ((tmp & scratch) == 0)
2541			continue;
2542		scratch ^= tmp;
2543
2544		ep = &dev->ep [num + 1];
2545		dma = ep->dma;
2546
2547		if (!dma)
2548			continue;
2549
2550		/* clear ep's dma status */
2551		tmp = readl (&dma->dmastat);
2552		writel (tmp, &dma->dmastat);
2553
2554		/* chaining should stop on abort, short OUT from fifo,
2555		 * or (stat0 codepath) short OUT transfer.
2556		 */
2557		if (!use_dma_chaining) {
2558			if ((tmp & (1 << DMA_TRANSACTION_DONE_INTERRUPT))
2559					== 0) {
2560				DEBUG (ep->dev, "%s no xact done? %08x\n",
2561					ep->ep.name, tmp);
2562				continue;
2563			}
2564			stop_dma (ep->dma);
2565		}
2566
2567		/* OUT transfers terminate when the data from the
2568		 * host is in our memory.  Process whatever's done.
2569		 * On this path, we know transfer's last packet wasn't
2570		 * less than req->length. NAK_OUT_PACKETS may be set,
2571		 * or the FIFO may already be holding new packets.
2572		 *
2573		 * IN transfers can linger in the FIFO for a very
2574		 * long time ... we ignore that for now, accounting
2575		 * precisely (like PIO does) needs per-packet irqs
2576		 */
2577		scan_dma_completions (ep);
2578
2579		/* disable dma on inactive queues; else maybe restart */
2580		if (list_empty (&ep->queue)) {
2581			if (use_dma_chaining)
2582				stop_dma (ep->dma);
2583		} else {
2584			tmp = readl (&dma->dmactl);
2585			if (!use_dma_chaining
2586					|| (tmp & (1 << DMA_ENABLE)) == 0)
2587				restart_dma (ep);
2588			else if (ep->is_in && use_dma_chaining) {
2589				struct net2280_request	*req;
2590				u32			dmacount;
2591
2592				/* the descriptor at the head of the chain
2593				 * may still have VALID_BIT clear; that's
2594				 * used to trigger changing DMA_FIFO_VALIDATE
2595				 * (affects automagic zlp writes).
2596				 */
2597				req = list_entry (ep->queue.next,
2598						struct net2280_request, queue);
2599				dmacount = req->td->dmacount;
2600				dmacount &= __constant_cpu_to_le32 (
2601						(1 << VALID_BIT)
2602						| DMA_BYTE_COUNT_MASK);
2603				if (dmacount && (dmacount & valid_bit) == 0)
2604					restart_dma (ep);
2605			}
2606		}
2607		ep->irqs++;
2608	}
2609
2610	/* NOTE:  there are other PCI errors we might usefully notice.
2611	 * if they appear very often, here's where to try recovering.
2612	 */
2613	if (stat & PCI_ERROR_INTERRUPTS) {
2614		ERROR (dev, "pci dma error; stat %08x\n", stat);
2615		stat &= ~PCI_ERROR_INTERRUPTS;
2616		/* these are fatal errors, but "maybe" they won't
2617		 * happen again ...
2618		 */
2619		stop_activity (dev, dev->driver);
2620		ep0_start (dev);
2621		stat = 0;
2622	}
2623
2624	if (stat)
2625		DEBUG (dev, "unhandled irqstat1 %08x\n", stat);
2626}
2627
2628static irqreturn_t net2280_irq (int irq, void *_dev, struct pt_regs * r)
2629{
2630	struct net2280		*dev = _dev;
2631
2632	spin_lock (&dev->lock);
2633
2634	/* handle disconnect, dma, and more */
2635	handle_stat1_irqs (dev, readl (&dev->regs->irqstat1));
2636
2637	/* control requests and PIO */
2638	handle_stat0_irqs (dev, readl (&dev->regs->irqstat0));
2639
2640	spin_unlock (&dev->lock);
2641
2642	return IRQ_HANDLED;
2643}
2644
2645/*-------------------------------------------------------------------------*/
2646
2647/* tear down the binding between this driver and the pci device */
2648
2649static void net2280_remove (struct pci_dev *pdev)
2650{
2651	struct net2280		*dev = pci_get_drvdata (pdev);
2652
2653	/* start with the driver above us */
2654	if (dev->driver) {
2655		/* should have been done already by driver model core */
2656		WARN (dev, "pci remove, driver '%s' is still registered\n",
2657				dev->driver->driver.name);
2658		usb_gadget_unregister_driver (dev->driver);
2659	}
2660
2661	/* then clean up the resources we allocated during probe() */
2662	net2280_led_shutdown (dev);
2663	if (dev->requests) {
2664		int		i;
2665		for (i = 1; i < 5; i++) {
2666			if (!dev->ep [i].dummy)
2667				continue;
2668			pci_pool_free (dev->requests, dev->ep [i].dummy,
2669					dev->ep [i].td_dma);
2670		}
2671		pci_pool_destroy (dev->requests);
2672	}
2673	if (dev->got_irq)
2674		free_irq (pdev->irq, dev);
2675	if (dev->regs)
2676		iounmap (dev->regs);
2677	if (dev->region)
2678		release_mem_region (pci_resource_start (pdev, 0),
2679				pci_resource_len (pdev, 0));
2680	if (dev->enabled)
2681		pci_disable_device (pdev);
2682	pci_set_drvdata (pdev, 0);
2683
2684	INFO (dev, "unbind from pci %s\n", pdev->slot_name);
2685
2686	kfree (dev);
2687	the_controller = 0;
2688}
2689
2690/* wrap this driver around the specified device, but
2691 * don't respond over USB until a gadget driver binds to us.
2692 */
2693
2694static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
2695{
2696	struct net2280		*dev;
2697	unsigned long		resource, len;
2698	void			*base = 0;
2699	int			retval, i;
2700	char			buf [8], *bufp;
2701
2702	/* if you want to support more than one controller in a system,
2703	 * usb_gadget_driver_{register,unregister}() must change.
2704	 */
2705	if (the_controller) {
2706		WARN (the_controller, "ignoring %s\n", pdev->slot_name);
2707		return -EBUSY;
2708	}
2709
2710	/* alloc, and start init */
2711	dev = kmalloc (sizeof *dev, SLAB_KERNEL);
2712	if (dev == NULL){
2713		retval = -ENOMEM;
2714		goto done;
2715	}
2716
2717	memset (dev, 0, sizeof *dev);
2718	spin_lock_init (&dev->lock);
2719	dev->pdev = pdev;
2720	dev->gadget.ops = &net2280_ops;
2721	dev->gadget.is_dualspeed = 1;
2722
2723	dev->gadget.dev.bus_id = pdev->slot_name;
2724	dev->gadget.name = driver_name;
2725
2726	/* now all the pci goodies ... */
2727	if (pci_enable_device (pdev) < 0) {
2728   	        retval = -ENODEV;
2729		goto done;
2730	}
2731	dev->enabled = 1;
2732
2733	/* BAR 0 holds all the registers
2734	 * BAR 1 is 8051 memory; unused here (note erratum 0103)
2735	 * BAR 2 is fifo memory; unused here
2736	 */
2737	resource = pci_resource_start (pdev, 0);
2738	len = pci_resource_len (pdev, 0);
2739	if (!request_mem_region (resource, len, driver_name)) {
2740		DEBUG (dev, "controller already in use\n");
2741		retval = -EBUSY;
2742		goto done;
2743	}
2744	dev->region = 1;
2745
2746	base = ioremap_nocache (resource, len);
2747	if (base == NULL) {
2748		DEBUG (dev, "can't map memory\n");
2749		retval = -EFAULT;
2750		goto done;
2751	}
2752	dev->regs = (struct net2280_regs *) base;
2753	dev->usb = (struct net2280_usb_regs *) (base + 0x0080);
2754	dev->pci = (struct net2280_pci_regs *) (base + 0x0100);
2755	dev->dma = (struct net2280_dma_regs *) (base + 0x0180);
2756	dev->dep = (struct net2280_dep_regs *) (base + 0x0200);
2757	dev->epregs = (struct net2280_ep_regs *) (base + 0x0300);
2758
2759	/* put into initial config, link up all endpoints */
2760	usb_reset (dev);
2761	usb_reinit (dev);
2762
2763	/* irq setup after old hardware is cleaned up */
2764	if (!pdev->irq) {
2765		ERROR (dev, "No IRQ.  Check PCI setup!\n");
2766		retval = -ENODEV;
2767		goto done;
2768	}
2769#ifndef __sparc__
2770	snprintf (buf, sizeof buf, "%d", pdev->irq);
2771	bufp = buf;
2772#else
2773	bufp = __irq_itoa(pdev->irq);
2774#endif
2775	if (request_irq (pdev->irq, net2280_irq, SA_SHIRQ, driver_name, dev)
2776			!= 0) {
2777		ERROR (dev, "request interrupt %s failed\n", bufp);
2778		retval = -EBUSY;
2779		goto done;
2780	}
2781	dev->got_irq = 1;
2782
2783	/* DMA setup */
2784	dev->requests = pci_pool_create ("requests", pdev,
2785		sizeof (struct net2280_dma),
2786		0 /* no alignment requirements */,
2787		0 /* or page-crossing issues */,
2788		SLAB_KERNEL /* 2.4 only */ );
2789	if (!dev->requests) {
2790		DEBUG (dev, "can't get request pool\n");
2791		retval = -ENOMEM;
2792		goto done;
2793	}
2794	for (i = 1; i < 5; i++) {
2795		struct net2280_dma	*td;
2796
2797		td = pci_pool_alloc (dev->requests, GFP_KERNEL,
2798				&dev->ep [i].td_dma);
2799		if (!td) {
2800			DEBUG (dev, "can't get dummy %d\n", i);
2801			retval = -ENOMEM;
2802			goto done;
2803		}
2804		td->dmacount = 0;	/* not VALID */
2805		td->dmaaddr = __constant_cpu_to_le32 (DMA_ADDR_INVALID);
2806		td->dmadesc = td->dmaaddr;
2807		dev->ep [i].dummy = td;
2808	}
2809
2810	/* enable lower-overhead pci memory bursts during DMA */
2811	writel ( (1 << DMA_MEMORY_WRITE_AND_INVALIDATE_ENABLE)
2812			// 256 write retries may not be enough...
2813			// | (1 << PCI_RETRY_ABORT_ENABLE)
2814			| (1 << DMA_READ_MULTIPLE_ENABLE)
2815			| (1 << DMA_READ_LINE_ENABLE)
2816			, &dev->pci->pcimstctl);
2817	/* erratum 0115 shouldn't appear: Linux inits PCI_LATENCY_TIMER */
2818	pci_set_master (pdev);
2819	pci_set_mwi (pdev);
2820
2821	/* ... also flushes any posted pci writes */
2822	dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
2823
2824	/* done */
2825	pci_set_drvdata (pdev, dev);
2826	INFO (dev, "%s\n", driver_desc);
2827	INFO (dev, "irq %s, pci mem %p, chip rev %04x\n",
2828			bufp, base, dev->chiprev);
2829	INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
2830			use_dma
2831				? (use_dma_chaining ? "chaining" : "enabled")
2832				: "disabled");
2833	the_controller = dev;
2834
2835	return 0;
2836
2837done:
2838	if (dev)
2839		net2280_remove (pdev);
2840	return retval;
2841}
2842
2843
2844/*-------------------------------------------------------------------------*/
2845
2846static struct pci_device_id pci_ids [] = { {
2847	.class = 	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
2848	.class_mask = 	~0,
2849	.vendor =	0x17cc,
2850	.device =	0x2280,
2851	.subvendor =	PCI_ANY_ID,
2852	.subdevice =	PCI_ANY_ID,
2853
2854}, { /* end: all zeroes */ }
2855};
2856MODULE_DEVICE_TABLE (pci, pci_ids);
2857
2858/* pci driver glue; this is a "new style" PCI driver module */
2859static struct pci_driver net2280_pci_driver = {
2860	.name =		(char *) driver_name,
2861	.id_table =	pci_ids,
2862
2863	.probe =	net2280_probe,
2864	.remove =	net2280_remove,
2865
2866	/* FIXME add power management support */
2867};
2868
2869MODULE_DESCRIPTION (DRIVER_DESC);
2870MODULE_AUTHOR ("David Brownell");
2871MODULE_LICENSE ("GPL");
2872
2873static int __init init (void)
2874{
2875	if (!use_dma)
2876		use_dma_chaining = 0;
2877	return pci_module_init (&net2280_pci_driver);
2878}
2879module_init (init);
2880
2881static void __exit cleanup (void)
2882{
2883	pci_unregister_driver (&net2280_pci_driver);
2884}
2885module_exit (cleanup);
2886