1/*
2 * Toshiba TC86C001 ("Goku-S") USB Device Controller driver
3 *
4 * Copyright (C) 2000-2002 Lineo
5 *      by Stuart Lynne, Tom Rushworth, and Bruce Balden
6 * Copyright (C) 2002 Toshiba Corporation
7 * Copyright (C) 2003 MontaVista Software (source@mvista.com)
8 *
9 * This file is licensed under the terms of the GNU General Public
10 * License version 2.  This program is licensed "as is" without any
11 * warranty of any kind, whether express or implied.
12 */
13
14/*
15 * This device has ep0 and three semi-configurable bulk/interrupt endpoints.
16 *
17 *  - Endpoint numbering is fixed: ep{1,2,3}-bulk
18 *  - Gadget drivers can choose ep maxpacket (8/16/32/64)
19 *  - Gadget drivers can choose direction (IN, OUT)
20 *  - DMA works with ep1 (OUT transfers) and ep2 (IN transfers).
21 */
22
23// #define	VERBOSE		/* extra debug messages (success too) */
24// #define	USB_TRACE	/* packet-level success messages */
25
26#include <linux/kernel.h>
27#include <linux/module.h>
28#include <linux/pci.h>
29#include <linux/delay.h>
30#include <linux/ioport.h>
31#include <linux/slab.h>
32#include <linux/errno.h>
33#include <linux/timer.h>
34#include <linux/list.h>
35#include <linux/interrupt.h>
36#include <linux/proc_fs.h>
37#include <linux/seq_file.h>
38#include <linux/device.h>
39#include <linux/usb/ch9.h>
40#include <linux/usb/gadget.h>
41#include <linux/prefetch.h>
42
43#include <asm/byteorder.h>
44#include <asm/io.h>
45#include <asm/irq.h>
46#include <asm/unaligned.h>
47
48
49#include "goku_udc.h"
50
51#define	DRIVER_DESC		"TC86C001 USB Device Controller"
52#define	DRIVER_VERSION		"30-Oct 2003"
53
54static const char driver_name [] = "goku_udc";
55static const char driver_desc [] = DRIVER_DESC;
56
57MODULE_AUTHOR("source@mvista.com");
58MODULE_DESCRIPTION(DRIVER_DESC);
59MODULE_LICENSE("GPL");
60
61
62/*
63 * IN dma behaves ok under testing, though the IN-dma abort paths don't
64 * seem to behave quite as expected.  Used by default.
65 *
66 * OUT dma documents design problems handling the common "short packet"
67 * transfer termination policy; it couldn't be enabled by default, even
68 * if the OUT-dma abort problems had a resolution.
69 */
70static unsigned use_dma = 1;
71
72#if 0
73//#include <linux/moduleparam.h>
74/* "modprobe goku_udc use_dma=1" etc
75 *	0 to disable dma
76 *	1 to use IN dma only (normal operation)
77 *	2 to use IN and OUT dma
78 */
79module_param(use_dma, uint, S_IRUGO);
80#endif
81
82/*-------------------------------------------------------------------------*/
83
84static void nuke(struct goku_ep *, int status);
85
86static inline void
87command(struct goku_udc_regs __iomem *regs, int command, unsigned epnum)
88{
89	writel(COMMAND_EP(epnum) | command, &regs->Command);
90	udelay(300);
91}
92
93static int
94goku_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
95{
96	struct goku_udc	*dev;
97	struct goku_ep	*ep;
98	u32		mode;
99	u16		max;
100	unsigned long	flags;
101
102	ep = container_of(_ep, struct goku_ep, ep);
103	if (!_ep || !desc
104			|| desc->bDescriptorType != USB_DT_ENDPOINT)
105		return -EINVAL;
106	dev = ep->dev;
107	if (ep == &dev->ep[0])
108		return -EINVAL;
109	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
110		return -ESHUTDOWN;
111	if (ep->num != usb_endpoint_num(desc))
112		return -EINVAL;
113
114	switch (usb_endpoint_type(desc)) {
115	case USB_ENDPOINT_XFER_BULK:
116	case USB_ENDPOINT_XFER_INT:
117		break;
118	default:
119		return -EINVAL;
120	}
121
122	if ((readl(ep->reg_status) & EPxSTATUS_EP_MASK)
123			!= EPxSTATUS_EP_INVALID)
124		return -EBUSY;
125
126	/* enabling the no-toggle interrupt mode would need an api hook */
127	mode = 0;
128	max = get_unaligned_le16(&desc->wMaxPacketSize);
129	switch (max) {
130	case 64:	mode++;
131	case 32:	mode++;
132	case 16:	mode++;
133	case 8:		mode <<= 3;
134			break;
135	default:
136		return -EINVAL;
137	}
138	mode |= 2 << 1;		/* bulk, or intr-with-toggle */
139
140	/* ep1/ep2 dma direction is chosen early; it works in the other
141	 * direction, with pio.  be cautious with out-dma.
142	 */
143	ep->is_in = usb_endpoint_dir_in(desc);
144	if (ep->is_in) {
145		mode |= 1;
146		ep->dma = (use_dma != 0) && (ep->num == UDC_MSTRD_ENDPOINT);
147	} else {
148		ep->dma = (use_dma == 2) && (ep->num == UDC_MSTWR_ENDPOINT);
149		if (ep->dma)
150			DBG(dev, "%s out-dma hides short packets\n",
151				ep->ep.name);
152	}
153
154	spin_lock_irqsave(&ep->dev->lock, flags);
155
156	/* ep1 and ep2 can do double buffering and/or dma */
157	if (ep->num < 3) {
158		struct goku_udc_regs __iomem	*regs = ep->dev->regs;
159		u32				tmp;
160
161		/* double buffer except (for now) with pio in */
162		tmp = ((ep->dma || !ep->is_in)
163				? 0x10	/* double buffered */
164				: 0x11	/* single buffer */
165			) << ep->num;
166		tmp |= readl(&regs->EPxSingle);
167		writel(tmp, &regs->EPxSingle);
168
169		tmp = (ep->dma ? 0x10/*dma*/ : 0x11/*pio*/) << ep->num;
170		tmp |= readl(&regs->EPxBCS);
171		writel(tmp, &regs->EPxBCS);
172	}
173	writel(mode, ep->reg_mode);
174	command(ep->dev->regs, COMMAND_RESET, ep->num);
175	ep->ep.maxpacket = max;
176	ep->stopped = 0;
177	ep->ep.desc = desc;
178	spin_unlock_irqrestore(&ep->dev->lock, flags);
179
180	DBG(dev, "enable %s %s %s maxpacket %u\n", ep->ep.name,
181		ep->is_in ? "IN" : "OUT",
182		ep->dma ? "dma" : "pio",
183		max);
184
185	return 0;
186}
187
188static void ep_reset(struct goku_udc_regs __iomem *regs, struct goku_ep *ep)
189{
190	struct goku_udc		*dev = ep->dev;
191
192	if (regs) {
193		command(regs, COMMAND_INVALID, ep->num);
194		if (ep->num) {
195			if (ep->num == UDC_MSTWR_ENDPOINT)
196				dev->int_enable &= ~(INT_MSTWREND
197							|INT_MSTWRTMOUT);
198			else if (ep->num == UDC_MSTRD_ENDPOINT)
199				dev->int_enable &= ~INT_MSTRDEND;
200			dev->int_enable &= ~INT_EPxDATASET (ep->num);
201		} else
202			dev->int_enable &= ~INT_EP0;
203		writel(dev->int_enable, &regs->int_enable);
204		readl(&regs->int_enable);
205		if (ep->num < 3) {
206			struct goku_udc_regs __iomem	*r = ep->dev->regs;
207			u32				tmp;
208
209			tmp = readl(&r->EPxSingle);
210			tmp &= ~(0x11 << ep->num);
211			writel(tmp, &r->EPxSingle);
212
213			tmp = readl(&r->EPxBCS);
214			tmp &= ~(0x11 << ep->num);
215			writel(tmp, &r->EPxBCS);
216		}
217		/* reset dma in case we're still using it */
218		if (ep->dma) {
219			u32	master;
220
221			master = readl(&regs->dma_master) & MST_RW_BITS;
222			if (ep->num == UDC_MSTWR_ENDPOINT) {
223				master &= ~MST_W_BITS;
224				master |= MST_WR_RESET;
225			} else {
226				master &= ~MST_R_BITS;
227				master |= MST_RD_RESET;
228			}
229			writel(master, &regs->dma_master);
230		}
231	}
232
233	usb_ep_set_maxpacket_limit(&ep->ep, MAX_FIFO_SIZE);
234	ep->ep.desc = NULL;
235	ep->stopped = 1;
236	ep->irqs = 0;
237	ep->dma = 0;
238}
239
240static int goku_ep_disable(struct usb_ep *_ep)
241{
242	struct goku_ep	*ep;
243	struct goku_udc	*dev;
244	unsigned long	flags;
245
246	ep = container_of(_ep, struct goku_ep, ep);
247	if (!_ep || !ep->ep.desc)
248		return -ENODEV;
249	dev = ep->dev;
250	if (dev->ep0state == EP0_SUSPEND)
251		return -EBUSY;
252
253	VDBG(dev, "disable %s\n", _ep->name);
254
255	spin_lock_irqsave(&dev->lock, flags);
256	nuke(ep, -ESHUTDOWN);
257	ep_reset(dev->regs, ep);
258	spin_unlock_irqrestore(&dev->lock, flags);
259
260	return 0;
261}
262
263/*-------------------------------------------------------------------------*/
264
265static struct usb_request *
266goku_alloc_request(struct usb_ep *_ep, gfp_t gfp_flags)
267{
268	struct goku_request	*req;
269
270	if (!_ep)
271		return NULL;
272	req = kzalloc(sizeof *req, gfp_flags);
273	if (!req)
274		return NULL;
275
276	INIT_LIST_HEAD(&req->queue);
277	return &req->req;
278}
279
280static void
281goku_free_request(struct usb_ep *_ep, struct usb_request *_req)
282{
283	struct goku_request	*req;
284
285	if (!_ep || !_req)
286		return;
287
288	req = container_of(_req, struct goku_request, req);
289	WARN_ON(!list_empty(&req->queue));
290	kfree(req);
291}
292
293/*-------------------------------------------------------------------------*/
294
295static void
296done(struct goku_ep *ep, struct goku_request *req, int status)
297{
298	struct goku_udc		*dev;
299	unsigned		stopped = ep->stopped;
300
301	list_del_init(&req->queue);
302
303	if (likely(req->req.status == -EINPROGRESS))
304		req->req.status = status;
305	else
306		status = req->req.status;
307
308	dev = ep->dev;
309
310	if (ep->dma)
311		usb_gadget_unmap_request(&dev->gadget, &req->req, ep->is_in);
312
313#ifndef USB_TRACE
314	if (status && status != -ESHUTDOWN)
315#endif
316		VDBG(dev, "complete %s req %p stat %d len %u/%u\n",
317			ep->ep.name, &req->req, status,
318			req->req.actual, req->req.length);
319
320	/* don't modify queue heads during completion callback */
321	ep->stopped = 1;
322	spin_unlock(&dev->lock);
323	usb_gadget_giveback_request(&ep->ep, &req->req);
324	spin_lock(&dev->lock);
325	ep->stopped = stopped;
326}
327
328/*-------------------------------------------------------------------------*/
329
330static inline int
331write_packet(u32 __iomem *fifo, u8 *buf, struct goku_request *req, unsigned max)
332{
333	unsigned	length, count;
334
335	length = min(req->req.length - req->req.actual, max);
336	req->req.actual += length;
337
338	count = length;
339	while (likely(count--))
340		writel(*buf++, fifo);
341	return length;
342}
343
344// return:  0 = still running, 1 = completed, negative = errno
345static int write_fifo(struct goku_ep *ep, struct goku_request *req)
346{
347	struct goku_udc	*dev = ep->dev;
348	u32		tmp;
349	u8		*buf;
350	unsigned	count;
351	int		is_last;
352
353	tmp = readl(&dev->regs->DataSet);
354	buf = req->req.buf + req->req.actual;
355	prefetch(buf);
356
357	dev = ep->dev;
358	if (unlikely(ep->num == 0 && dev->ep0state != EP0_IN))
359		return -EL2HLT;
360
361	/* NOTE:  just single-buffered PIO-IN for now.  */
362	if (unlikely((tmp & DATASET_A(ep->num)) != 0))
363		return 0;
364
365	/* clear our "packet available" irq */
366	if (ep->num != 0)
367		writel(~INT_EPxDATASET(ep->num), &dev->regs->int_status);
368
369	count = write_packet(ep->reg_fifo, buf, req, ep->ep.maxpacket);
370
371	/* last packet often short (sometimes a zlp, especially on ep0) */
372	if (unlikely(count != ep->ep.maxpacket)) {
373		writel(~(1<<ep->num), &dev->regs->EOP);
374		if (ep->num == 0) {
375			dev->ep[0].stopped = 1;
376			dev->ep0state = EP0_STATUS;
377		}
378		is_last = 1;
379	} else {
380		if (likely(req->req.length != req->req.actual)
381				|| req->req.zero)
382			is_last = 0;
383		else
384			is_last = 1;
385	}
386#if 0		/* printk seemed to trash is_last...*/
387//#ifdef USB_TRACE
388	VDBG(dev, "wrote %s %u bytes%s IN %u left %p\n",
389		ep->ep.name, count, is_last ? "/last" : "",
390		req->req.length - req->req.actual, req);
391#endif
392
393	/* requests complete when all IN data is in the FIFO,
394	 * or sometimes later, if a zlp was needed.
395	 */
396	if (is_last) {
397		done(ep, req, 0);
398		return 1;
399	}
400
401	return 0;
402}
403
404static int read_fifo(struct goku_ep *ep, struct goku_request *req)
405{
406	struct goku_udc_regs __iomem	*regs;
407	u32				size, set;
408	u8				*buf;
409	unsigned			bufferspace, is_short, dbuff;
410
411	regs = ep->dev->regs;
412top:
413	buf = req->req.buf + req->req.actual;
414	prefetchw(buf);
415
416	if (unlikely(ep->num == 0 && ep->dev->ep0state != EP0_OUT))
417		return -EL2HLT;
418
419	dbuff = (ep->num == 1 || ep->num == 2);
420	do {
421		/* ack dataset irq matching the status we'll handle */
422		if (ep->num != 0)
423			writel(~INT_EPxDATASET(ep->num), &regs->int_status);
424
425		set = readl(&regs->DataSet) & DATASET_AB(ep->num);
426		size = readl(&regs->EPxSizeLA[ep->num]);
427		bufferspace = req->req.length - req->req.actual;
428
429		/* usually do nothing without an OUT packet */
430		if (likely(ep->num != 0 || bufferspace != 0)) {
431			if (unlikely(set == 0))
432				break;
433			/* use ep1/ep2 double-buffering for OUT */
434			if (!(size & PACKET_ACTIVE))
435				size = readl(&regs->EPxSizeLB[ep->num]);
436			if (!(size & PACKET_ACTIVE))	/* "can't happen" */
437				break;
438			size &= DATASIZE;	/* EPxSizeH == 0 */
439
440		/* ep0out no-out-data case for set_config, etc */
441		} else
442			size = 0;
443
444		/* read all bytes from this packet */
445		req->req.actual += size;
446		is_short = (size < ep->ep.maxpacket);
447#ifdef USB_TRACE
448		VDBG(ep->dev, "read %s %u bytes%s OUT req %p %u/%u\n",
449			ep->ep.name, size, is_short ? "/S" : "",
450			req, req->req.actual, req->req.length);
451#endif
452		while (likely(size-- != 0)) {
453			u8	byte = (u8) readl(ep->reg_fifo);
454
455			if (unlikely(bufferspace == 0)) {
456				/* this happens when the driver's buffer
457				 * is smaller than what the host sent.
458				 * discard the extra data in this packet.
459				 */
460				if (req->req.status != -EOVERFLOW)
461					DBG(ep->dev, "%s overflow %u\n",
462						ep->ep.name, size);
463				req->req.status = -EOVERFLOW;
464			} else {
465				*buf++ = byte;
466				bufferspace--;
467			}
468		}
469
470		/* completion */
471		if (unlikely(is_short || req->req.actual == req->req.length)) {
472			if (unlikely(ep->num == 0)) {
473				/* non-control endpoints now usable? */
474				if (ep->dev->req_config)
475					writel(ep->dev->configured
476							? USBSTATE_CONFIGURED
477							: 0,
478						&regs->UsbState);
479				/* ep0out status stage */
480				writel(~(1<<0), &regs->EOP);
481				ep->stopped = 1;
482				ep->dev->ep0state = EP0_STATUS;
483			}
484			done(ep, req, 0);
485
486			/* empty the second buffer asap */
487			if (dbuff && !list_empty(&ep->queue)) {
488				req = list_entry(ep->queue.next,
489						struct goku_request, queue);
490				goto top;
491			}
492			return 1;
493		}
494	} while (dbuff);
495	return 0;
496}
497
498static inline void
499pio_irq_enable(struct goku_udc *dev,
500		struct goku_udc_regs __iomem *regs, int epnum)
501{
502	dev->int_enable |= INT_EPxDATASET (epnum);
503	writel(dev->int_enable, &regs->int_enable);
504	/* write may still be posted */
505}
506
507static inline void
508pio_irq_disable(struct goku_udc *dev,
509		struct goku_udc_regs __iomem *regs, int epnum)
510{
511	dev->int_enable &= ~INT_EPxDATASET (epnum);
512	writel(dev->int_enable, &regs->int_enable);
513	/* write may still be posted */
514}
515
516static inline void
517pio_advance(struct goku_ep *ep)
518{
519	struct goku_request	*req;
520
521	if (unlikely(list_empty (&ep->queue)))
522		return;
523	req = list_entry(ep->queue.next, struct goku_request, queue);
524	(ep->is_in ? write_fifo : read_fifo)(ep, req);
525}
526
527
528/*-------------------------------------------------------------------------*/
529
530// return:  0 = q running, 1 = q stopped, negative = errno
531static int start_dma(struct goku_ep *ep, struct goku_request *req)
532{
533	struct goku_udc_regs __iomem	*regs = ep->dev->regs;
534	u32				master;
535	u32				start = req->req.dma;
536	u32				end = start + req->req.length - 1;
537
538	master = readl(&regs->dma_master) & MST_RW_BITS;
539
540	/* re-init the bits affecting IN dma; careful with zlps */
541	if (likely(ep->is_in)) {
542		if (unlikely(master & MST_RD_ENA)) {
543			DBG (ep->dev, "start, IN active dma %03x!!\n",
544				master);
545//			return -EL2HLT;
546		}
547		writel(end, &regs->in_dma_end);
548		writel(start, &regs->in_dma_start);
549
550		master &= ~MST_R_BITS;
551		if (unlikely(req->req.length == 0))
552			master = MST_RD_ENA | MST_RD_EOPB;
553		else if ((req->req.length % ep->ep.maxpacket) != 0
554					|| req->req.zero)
555			master = MST_RD_ENA | MST_EOPB_ENA;
556		else
557			master = MST_RD_ENA | MST_EOPB_DIS;
558
559		ep->dev->int_enable |= INT_MSTRDEND;
560
561	/* Goku DMA-OUT merges short packets, which plays poorly with
562	 * protocols where short packets mark the transfer boundaries.
563	 * The chip supports a nonstandard policy with INT_MSTWRTMOUT,
564	 * ending transfers after 3 SOFs; we don't turn it on.
565	 */
566	} else {
567		if (unlikely(master & MST_WR_ENA)) {
568			DBG (ep->dev, "start, OUT active dma %03x!!\n",
569				master);
570//			return -EL2HLT;
571		}
572		writel(end, &regs->out_dma_end);
573		writel(start, &regs->out_dma_start);
574
575		master &= ~MST_W_BITS;
576		master |= MST_WR_ENA | MST_TIMEOUT_DIS;
577
578		ep->dev->int_enable |= INT_MSTWREND|INT_MSTWRTMOUT;
579	}
580
581	writel(master, &regs->dma_master);
582	writel(ep->dev->int_enable, &regs->int_enable);
583	return 0;
584}
585
586static void dma_advance(struct goku_udc *dev, struct goku_ep *ep)
587{
588	struct goku_request		*req;
589	struct goku_udc_regs __iomem	*regs = ep->dev->regs;
590	u32				master;
591
592	master = readl(&regs->dma_master);
593
594	if (unlikely(list_empty(&ep->queue))) {
595stop:
596		if (ep->is_in)
597			dev->int_enable &= ~INT_MSTRDEND;
598		else
599			dev->int_enable &= ~(INT_MSTWREND|INT_MSTWRTMOUT);
600		writel(dev->int_enable, &regs->int_enable);
601		return;
602	}
603	req = list_entry(ep->queue.next, struct goku_request, queue);
604
605	/* normal hw dma completion (not abort) */
606	if (likely(ep->is_in)) {
607		if (unlikely(master & MST_RD_ENA))
608			return;
609		req->req.actual = readl(&regs->in_dma_current);
610	} else {
611		if (unlikely(master & MST_WR_ENA))
612			return;
613
614		/* hardware merges short packets, and also hides packet
615		 * overruns.  a partial packet MAY be in the fifo here.
616		 */
617		req->req.actual = readl(&regs->out_dma_current);
618	}
619	req->req.actual -= req->req.dma;
620	req->req.actual++;
621
622#ifdef USB_TRACE
623	VDBG(dev, "done %s %s dma, %u/%u bytes, req %p\n",
624		ep->ep.name, ep->is_in ? "IN" : "OUT",
625		req->req.actual, req->req.length, req);
626#endif
627	done(ep, req, 0);
628	if (list_empty(&ep->queue))
629		goto stop;
630	req = list_entry(ep->queue.next, struct goku_request, queue);
631	(void) start_dma(ep, req);
632}
633
634static void abort_dma(struct goku_ep *ep, int status)
635{
636	struct goku_udc_regs __iomem	*regs = ep->dev->regs;
637	struct goku_request		*req;
638	u32				curr, master;
639
640	/* NAK future host requests, hoping the implicit delay lets the
641	 * dma engine finish reading (or writing) its latest packet and
642	 * empty the dma buffer (up to 16 bytes).
643	 *
644	 * This avoids needing to clean up a partial packet in the fifo;
645	 * we can't do that for IN without side effects to HALT and TOGGLE.
646	 */
647	command(regs, COMMAND_FIFO_DISABLE, ep->num);
648	req = list_entry(ep->queue.next, struct goku_request, queue);
649	master = readl(&regs->dma_master) & MST_RW_BITS;
650
651	/* FIXME using these resets isn't usably documented. this may
652	 * not work unless it's followed by disabling the endpoint.
653	 *
654	 * FIXME the OUT reset path doesn't even behave consistently.
655	 */
656	if (ep->is_in) {
657		if (unlikely((readl(&regs->dma_master) & MST_RD_ENA) == 0))
658			goto finished;
659		curr = readl(&regs->in_dma_current);
660
661		writel(curr, &regs->in_dma_end);
662		writel(curr, &regs->in_dma_start);
663
664		master &= ~MST_R_BITS;
665		master |= MST_RD_RESET;
666		writel(master, &regs->dma_master);
667
668		if (readl(&regs->dma_master) & MST_RD_ENA)
669			DBG(ep->dev, "IN dma active after reset!\n");
670
671	} else {
672		if (unlikely((readl(&regs->dma_master) & MST_WR_ENA) == 0))
673			goto finished;
674		curr = readl(&regs->out_dma_current);
675
676		writel(curr, &regs->out_dma_end);
677		writel(curr, &regs->out_dma_start);
678
679		master &= ~MST_W_BITS;
680		master |= MST_WR_RESET;
681		writel(master, &regs->dma_master);
682
683		if (readl(&regs->dma_master) & MST_WR_ENA)
684			DBG(ep->dev, "OUT dma active after reset!\n");
685	}
686	req->req.actual = (curr - req->req.dma) + 1;
687	req->req.status = status;
688
689	VDBG(ep->dev, "%s %s %s %d/%d\n", __func__, ep->ep.name,
690		ep->is_in ? "IN" : "OUT",
691		req->req.actual, req->req.length);
692
693	command(regs, COMMAND_FIFO_ENABLE, ep->num);
694
695	return;
696
697finished:
698	/* dma already completed; no abort needed */
699	command(regs, COMMAND_FIFO_ENABLE, ep->num);
700	req->req.actual = req->req.length;
701	req->req.status = 0;
702}
703
704/*-------------------------------------------------------------------------*/
705
706static int
707goku_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
708{
709	struct goku_request	*req;
710	struct goku_ep		*ep;
711	struct goku_udc		*dev;
712	unsigned long		flags;
713	int			status;
714
715	/* always require a cpu-view buffer so pio works */
716	req = container_of(_req, struct goku_request, req);
717	if (unlikely(!_req || !_req->complete
718			|| !_req->buf || !list_empty(&req->queue)))
719		return -EINVAL;
720	ep = container_of(_ep, struct goku_ep, ep);
721	if (unlikely(!_ep || (!ep->ep.desc && ep->num != 0)))
722		return -EINVAL;
723	dev = ep->dev;
724	if (unlikely(!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN))
725		return -ESHUTDOWN;
726
727	/* can't touch registers when suspended */
728	if (dev->ep0state == EP0_SUSPEND)
729		return -EBUSY;
730
731	/* set up dma mapping in case the caller didn't */
732	if (ep->dma) {
733		status = usb_gadget_map_request(&dev->gadget, &req->req,
734				ep->is_in);
735		if (status)
736			return status;
737	}
738
739#ifdef USB_TRACE
740	VDBG(dev, "%s queue req %p, len %u buf %p\n",
741			_ep->name, _req, _req->length, _req->buf);
742#endif
743
744	spin_lock_irqsave(&dev->lock, flags);
745
746	_req->status = -EINPROGRESS;
747	_req->actual = 0;
748
749	/* for ep0 IN without premature status, zlp is required and
750	 * writing EOP starts the status stage (OUT).
751	 */
752	if (unlikely(ep->num == 0 && ep->is_in))
753		_req->zero = 1;
754
755	/* kickstart this i/o queue? */
756	status = 0;
757	if (list_empty(&ep->queue) && likely(!ep->stopped)) {
758		/* dma:  done after dma completion IRQ (or error)
759		 * pio:  done after last fifo operation
760		 */
761		if (ep->dma)
762			status = start_dma(ep, req);
763		else
764			status = (ep->is_in ? write_fifo : read_fifo)(ep, req);
765
766		if (unlikely(status != 0)) {
767			if (status > 0)
768				status = 0;
769			req = NULL;
770		}
771
772	} /* else pio or dma irq handler advances the queue. */
773
774	if (likely(req != NULL))
775		list_add_tail(&req->queue, &ep->queue);
776
777	if (likely(!list_empty(&ep->queue))
778			&& likely(ep->num != 0)
779			&& !ep->dma
780			&& !(dev->int_enable & INT_EPxDATASET (ep->num)))
781		pio_irq_enable(dev, dev->regs, ep->num);
782
783	spin_unlock_irqrestore(&dev->lock, flags);
784
785	/* pci writes may still be posted */
786	return status;
787}
788
789/* dequeue ALL requests */
790static void nuke(struct goku_ep *ep, int status)
791{
792	struct goku_request	*req;
793
794	ep->stopped = 1;
795	if (list_empty(&ep->queue))
796		return;
797	if (ep->dma)
798		abort_dma(ep, status);
799	while (!list_empty(&ep->queue)) {
800		req = list_entry(ep->queue.next, struct goku_request, queue);
801		done(ep, req, status);
802	}
803}
804
805/* dequeue JUST ONE request */
806static int goku_dequeue(struct usb_ep *_ep, struct usb_request *_req)
807{
808	struct goku_request	*req;
809	struct goku_ep		*ep;
810	struct goku_udc		*dev;
811	unsigned long		flags;
812
813	ep = container_of(_ep, struct goku_ep, ep);
814	if (!_ep || !_req || (!ep->ep.desc && ep->num != 0))
815		return -EINVAL;
816	dev = ep->dev;
817	if (!dev->driver)
818		return -ESHUTDOWN;
819
820	/* we can't touch (dma) registers when suspended */
821	if (dev->ep0state == EP0_SUSPEND)
822		return -EBUSY;
823
824	VDBG(dev, "%s %s %s %s %p\n", __func__, _ep->name,
825		ep->is_in ? "IN" : "OUT",
826		ep->dma ? "dma" : "pio",
827		_req);
828
829	spin_lock_irqsave(&dev->lock, flags);
830
831	/* make sure it's actually queued on this endpoint */
832	list_for_each_entry (req, &ep->queue, queue) {
833		if (&req->req == _req)
834			break;
835	}
836	if (&req->req != _req) {
837		spin_unlock_irqrestore (&dev->lock, flags);
838		return -EINVAL;
839	}
840
841	if (ep->dma && ep->queue.next == &req->queue && !ep->stopped) {
842		abort_dma(ep, -ECONNRESET);
843		done(ep, req, -ECONNRESET);
844		dma_advance(dev, ep);
845	} else if (!list_empty(&req->queue))
846		done(ep, req, -ECONNRESET);
847	else
848		req = NULL;
849	spin_unlock_irqrestore(&dev->lock, flags);
850
851	return req ? 0 : -EOPNOTSUPP;
852}
853
854/*-------------------------------------------------------------------------*/
855
856static void goku_clear_halt(struct goku_ep *ep)
857{
858	// assert (ep->num !=0)
859	VDBG(ep->dev, "%s clear halt\n", ep->ep.name);
860	command(ep->dev->regs, COMMAND_SETDATA0, ep->num);
861	command(ep->dev->regs, COMMAND_STALL_CLEAR, ep->num);
862	if (ep->stopped) {
863		ep->stopped = 0;
864		if (ep->dma) {
865			struct goku_request	*req;
866
867			if (list_empty(&ep->queue))
868				return;
869			req = list_entry(ep->queue.next, struct goku_request,
870						queue);
871			(void) start_dma(ep, req);
872		} else
873			pio_advance(ep);
874	}
875}
876
877static int goku_set_halt(struct usb_ep *_ep, int value)
878{
879	struct goku_ep	*ep;
880	unsigned long	flags;
881	int		retval = 0;
882
883	if (!_ep)
884		return -ENODEV;
885	ep = container_of (_ep, struct goku_ep, ep);
886
887	if (ep->num == 0) {
888		if (value) {
889			ep->dev->ep0state = EP0_STALL;
890			ep->dev->ep[0].stopped = 1;
891		} else
892			return -EINVAL;
893
894	/* don't change EPxSTATUS_EP_INVALID to READY */
895	} else if (!ep->ep.desc) {
896		DBG(ep->dev, "%s %s inactive?\n", __func__, ep->ep.name);
897		return -EINVAL;
898	}
899
900	spin_lock_irqsave(&ep->dev->lock, flags);
901	if (!list_empty(&ep->queue))
902		retval = -EAGAIN;
903	else if (ep->is_in && value
904			/* data in (either) packet buffer? */
905			&& (readl(&ep->dev->regs->DataSet)
906					& DATASET_AB(ep->num)))
907		retval = -EAGAIN;
908	else if (!value)
909		goku_clear_halt(ep);
910	else {
911		ep->stopped = 1;
912		VDBG(ep->dev, "%s set halt\n", ep->ep.name);
913		command(ep->dev->regs, COMMAND_STALL, ep->num);
914		readl(ep->reg_status);
915	}
916	spin_unlock_irqrestore(&ep->dev->lock, flags);
917	return retval;
918}
919
920static int goku_fifo_status(struct usb_ep *_ep)
921{
922	struct goku_ep			*ep;
923	struct goku_udc_regs __iomem	*regs;
924	u32				size;
925
926	if (!_ep)
927		return -ENODEV;
928	ep = container_of(_ep, struct goku_ep, ep);
929
930	/* size is only reported sanely for OUT */
931	if (ep->is_in)
932		return -EOPNOTSUPP;
933
934	/* ignores 16-byte dma buffer; SizeH == 0 */
935	regs = ep->dev->regs;
936	size = readl(&regs->EPxSizeLA[ep->num]) & DATASIZE;
937	size += readl(&regs->EPxSizeLB[ep->num]) & DATASIZE;
938	VDBG(ep->dev, "%s %s %u\n", __func__, ep->ep.name, size);
939	return size;
940}
941
942static void goku_fifo_flush(struct usb_ep *_ep)
943{
944	struct goku_ep			*ep;
945	struct goku_udc_regs __iomem	*regs;
946	u32				size;
947
948	if (!_ep)
949		return;
950	ep = container_of(_ep, struct goku_ep, ep);
951	VDBG(ep->dev, "%s %s\n", __func__, ep->ep.name);
952
953	/* don't change EPxSTATUS_EP_INVALID to READY */
954	if (!ep->ep.desc && ep->num != 0) {
955		DBG(ep->dev, "%s %s inactive?\n", __func__, ep->ep.name);
956		return;
957	}
958
959	regs = ep->dev->regs;
960	size = readl(&regs->EPxSizeLA[ep->num]);
961	size &= DATASIZE;
962
963	/* Non-desirable behavior:  FIFO_CLEAR also clears the
964	 * endpoint halt feature.  For OUT, we _could_ just read
965	 * the bytes out (PIO, if !ep->dma); for in, no choice.
966	 */
967	if (size)
968		command(regs, COMMAND_FIFO_CLEAR, ep->num);
969}
970
971static struct usb_ep_ops goku_ep_ops = {
972	.enable		= goku_ep_enable,
973	.disable	= goku_ep_disable,
974
975	.alloc_request	= goku_alloc_request,
976	.free_request	= goku_free_request,
977
978	.queue		= goku_queue,
979	.dequeue	= goku_dequeue,
980
981	.set_halt	= goku_set_halt,
982	.fifo_status	= goku_fifo_status,
983	.fifo_flush	= goku_fifo_flush,
984};
985
986/*-------------------------------------------------------------------------*/
987
988static int goku_get_frame(struct usb_gadget *_gadget)
989{
990	return -EOPNOTSUPP;
991}
992
993static int goku_udc_start(struct usb_gadget *g,
994		struct usb_gadget_driver *driver);
995static int goku_udc_stop(struct usb_gadget *g);
996
997static const struct usb_gadget_ops goku_ops = {
998	.get_frame	= goku_get_frame,
999	.udc_start	= goku_udc_start,
1000	.udc_stop	= goku_udc_stop,
1001	// no remote wakeup
1002	// not selfpowered
1003};
1004
1005/*-------------------------------------------------------------------------*/
1006
1007static inline const char *dmastr(void)
1008{
1009	if (use_dma == 0)
1010		return "(dma disabled)";
1011	else if (use_dma == 2)
1012		return "(dma IN and OUT)";
1013	else
1014		return "(dma IN)";
1015}
1016
1017#ifdef CONFIG_USB_GADGET_DEBUG_FILES
1018
1019static const char proc_node_name [] = "driver/udc";
1020
1021#define FOURBITS "%s%s%s%s"
1022#define EIGHTBITS FOURBITS FOURBITS
1023
1024static void dump_intmask(struct seq_file *m, const char *label, u32 mask)
1025{
1026	/* int_status is the same format ... */
1027	seq_printf(m, "%s %05X =" FOURBITS EIGHTBITS EIGHTBITS "\n",
1028		   label, mask,
1029		   (mask & INT_PWRDETECT) ? " power" : "",
1030		   (mask & INT_SYSERROR) ? " sys" : "",
1031		   (mask & INT_MSTRDEND) ? " in-dma" : "",
1032		   (mask & INT_MSTWRTMOUT) ? " wrtmo" : "",
1033
1034		   (mask & INT_MSTWREND) ? " out-dma" : "",
1035		   (mask & INT_MSTWRSET) ? " wrset" : "",
1036		   (mask & INT_ERR) ? " err" : "",
1037		   (mask & INT_SOF) ? " sof" : "",
1038
1039		   (mask & INT_EP3NAK) ? " ep3nak" : "",
1040		   (mask & INT_EP2NAK) ? " ep2nak" : "",
1041		   (mask & INT_EP1NAK) ? " ep1nak" : "",
1042		   (mask & INT_EP3DATASET) ? " ep3" : "",
1043
1044		   (mask & INT_EP2DATASET) ? " ep2" : "",
1045		   (mask & INT_EP1DATASET) ? " ep1" : "",
1046		   (mask & INT_STATUSNAK) ? " ep0snak" : "",
1047		   (mask & INT_STATUS) ? " ep0status" : "",
1048
1049		   (mask & INT_SETUP) ? " setup" : "",
1050		   (mask & INT_ENDPOINT0) ? " ep0" : "",
1051		   (mask & INT_USBRESET) ? " reset" : "",
1052		   (mask & INT_SUSPEND) ? " suspend" : "");
1053}
1054
1055static const char *udc_ep_state(enum ep0state state)
1056{
1057	switch (state) {
1058	case EP0_DISCONNECT:
1059		return "ep0_disconnect";
1060	case EP0_IDLE:
1061		return "ep0_idle";
1062	case EP0_IN:
1063		return "ep0_in";
1064	case EP0_OUT:
1065		return "ep0_out";
1066	case EP0_STATUS:
1067		return "ep0_status";
1068	case EP0_STALL:
1069		return "ep0_stall";
1070	case EP0_SUSPEND:
1071		return "ep0_suspend";
1072	}
1073
1074	return "ep0_?";
1075}
1076
1077static const char *udc_ep_status(u32 status)
1078{
1079	switch (status & EPxSTATUS_EP_MASK) {
1080	case EPxSTATUS_EP_READY:
1081		return "ready";
1082	case EPxSTATUS_EP_DATAIN:
1083		return "packet";
1084	case EPxSTATUS_EP_FULL:
1085		return "full";
1086	case EPxSTATUS_EP_TX_ERR:	/* host will retry */
1087		return "tx_err";
1088	case EPxSTATUS_EP_RX_ERR:
1089		return "rx_err";
1090	case EPxSTATUS_EP_BUSY:		/* ep0 only */
1091		return "busy";
1092	case EPxSTATUS_EP_STALL:
1093		return "stall";
1094	case EPxSTATUS_EP_INVALID:	/* these "can't happen" */
1095		return "invalid";
1096	}
1097
1098	return "?";
1099}
1100
1101static int udc_proc_read(struct seq_file *m, void *v)
1102{
1103	struct goku_udc			*dev = m->private;
1104	struct goku_udc_regs __iomem	*regs = dev->regs;
1105	unsigned long			flags;
1106	int				i, is_usb_connected;
1107	u32				tmp;
1108
1109	local_irq_save(flags);
1110
1111	/* basic device status */
1112	tmp = readl(&regs->power_detect);
1113	is_usb_connected = tmp & PW_DETECT;
1114	seq_printf(m,
1115		   "%s - %s\n"
1116		   "%s version: %s %s\n"
1117		   "Gadget driver: %s\n"
1118		   "Host %s, %s\n"
1119		   "\n",
1120		   pci_name(dev->pdev), driver_desc,
1121		   driver_name, DRIVER_VERSION, dmastr(),
1122		   dev->driver ? dev->driver->driver.name : "(none)",
1123		   is_usb_connected
1124			   ? ((tmp & PW_PULLUP) ? "full speed" : "powered")
1125			   : "disconnected",
1126		   udc_ep_state(dev->ep0state));
1127
1128	dump_intmask(m, "int_status", readl(&regs->int_status));
1129	dump_intmask(m, "int_enable", readl(&regs->int_enable));
1130
1131	if (!is_usb_connected || !dev->driver || (tmp & PW_PULLUP) == 0)
1132		goto done;
1133
1134	/* registers for (active) device and ep0 */
1135	seq_printf(m, "\nirqs %lu\ndataset %02x single.bcs %02x.%02x state %x addr %u\n",
1136		   dev->irqs, readl(&regs->DataSet),
1137		   readl(&regs->EPxSingle), readl(&regs->EPxBCS),
1138		   readl(&regs->UsbState),
1139		   readl(&regs->address));
1140	if (seq_has_overflowed(m))
1141		goto done;
1142
1143	tmp = readl(&regs->dma_master);
1144	seq_printf(m, "dma %03X =" EIGHTBITS "%s %s\n",
1145		   tmp,
1146		   (tmp & MST_EOPB_DIS) ? " eopb-" : "",
1147		   (tmp & MST_EOPB_ENA) ? " eopb+" : "",
1148		   (tmp & MST_TIMEOUT_DIS) ? " tmo-" : "",
1149		   (tmp & MST_TIMEOUT_ENA) ? " tmo+" : "",
1150
1151		   (tmp & MST_RD_EOPB) ? " eopb" : "",
1152		   (tmp & MST_RD_RESET) ? " in_reset" : "",
1153		   (tmp & MST_WR_RESET) ? " out_reset" : "",
1154		   (tmp & MST_RD_ENA) ? " IN" : "",
1155
1156		   (tmp & MST_WR_ENA) ? " OUT" : "",
1157		   (tmp & MST_CONNECTION) ? "ep1in/ep2out" : "ep1out/ep2in");
1158	if (seq_has_overflowed(m))
1159		goto done;
1160
1161	/* dump endpoint queues */
1162	for (i = 0; i < 4; i++) {
1163		struct goku_ep		*ep = &dev->ep [i];
1164		struct goku_request	*req;
1165
1166		if (i && !ep->ep.desc)
1167			continue;
1168
1169		tmp = readl(ep->reg_status);
1170		seq_printf(m, "%s %s max %u %s, irqs %lu, status %02x (%s) " FOURBITS "\n",
1171			   ep->ep.name,
1172			   ep->is_in ? "in" : "out",
1173			   ep->ep.maxpacket,
1174			   ep->dma ? "dma" : "pio",
1175			   ep->irqs,
1176			   tmp, udc_ep_status(tmp),
1177			   (tmp & EPxSTATUS_TOGGLE) ? "data1" : "data0",
1178			   (tmp & EPxSTATUS_SUSPEND) ? " suspend" : "",
1179			   (tmp & EPxSTATUS_FIFO_DISABLE) ? " disable" : "",
1180			   (tmp & EPxSTATUS_STAGE_ERROR) ? " ep0stat" : "");
1181		if (seq_has_overflowed(m))
1182			goto done;
1183
1184		if (list_empty(&ep->queue)) {
1185			seq_puts(m, "\t(nothing queued)\n");
1186			if (seq_has_overflowed(m))
1187				goto done;
1188			continue;
1189		}
1190		list_for_each_entry(req, &ep->queue, queue) {
1191			if (ep->dma && req->queue.prev == &ep->queue) {
1192				if (i == UDC_MSTRD_ENDPOINT)
1193					tmp = readl(&regs->in_dma_current);
1194				else
1195					tmp = readl(&regs->out_dma_current);
1196				tmp -= req->req.dma;
1197				tmp++;
1198			} else
1199				tmp = req->req.actual;
1200
1201			seq_printf(m, "\treq %p len %u/%u buf %p\n",
1202				   &req->req, tmp, req->req.length,
1203				   req->req.buf);
1204			if (seq_has_overflowed(m))
1205				goto done;
1206		}
1207	}
1208
1209done:
1210	local_irq_restore(flags);
1211	return 0;
1212}
1213
1214/*
1215 * seq_file wrappers for procfile show routines.
1216 */
1217static int udc_proc_open(struct inode *inode, struct file *file)
1218{
1219	return single_open(file, udc_proc_read, PDE_DATA(file_inode(file)));
1220}
1221
1222static const struct file_operations udc_proc_fops = {
1223	.open		= udc_proc_open,
1224	.read		= seq_read,
1225	.llseek		= seq_lseek,
1226	.release	= single_release,
1227};
1228
1229#endif	/* CONFIG_USB_GADGET_DEBUG_FILES */
1230
1231/*-------------------------------------------------------------------------*/
1232
1233static void udc_reinit (struct goku_udc *dev)
1234{
1235	static char *names [] = { "ep0", "ep1-bulk", "ep2-bulk", "ep3-bulk" };
1236
1237	unsigned i;
1238
1239	INIT_LIST_HEAD (&dev->gadget.ep_list);
1240	dev->gadget.ep0 = &dev->ep [0].ep;
1241	dev->gadget.speed = USB_SPEED_UNKNOWN;
1242	dev->ep0state = EP0_DISCONNECT;
1243	dev->irqs = 0;
1244
1245	for (i = 0; i < 4; i++) {
1246		struct goku_ep	*ep = &dev->ep[i];
1247
1248		ep->num = i;
1249		ep->ep.name = names[i];
1250		ep->reg_fifo = &dev->regs->ep_fifo [i];
1251		ep->reg_status = &dev->regs->ep_status [i];
1252		ep->reg_mode = &dev->regs->ep_mode[i];
1253
1254		ep->ep.ops = &goku_ep_ops;
1255		list_add_tail (&ep->ep.ep_list, &dev->gadget.ep_list);
1256		ep->dev = dev;
1257		INIT_LIST_HEAD (&ep->queue);
1258
1259		ep_reset(NULL, ep);
1260	}
1261
1262	dev->ep[0].reg_mode = NULL;
1263	usb_ep_set_maxpacket_limit(&dev->ep[0].ep, MAX_EP0_SIZE);
1264	list_del_init (&dev->ep[0].ep.ep_list);
1265}
1266
1267static void udc_reset(struct goku_udc *dev)
1268{
1269	struct goku_udc_regs __iomem	*regs = dev->regs;
1270
1271	writel(0, &regs->power_detect);
1272	writel(0, &regs->int_enable);
1273	readl(&regs->int_enable);
1274	dev->int_enable = 0;
1275
1276	/* deassert reset, leave USB D+ at hi-Z (no pullup)
1277	 * don't let INT_PWRDETECT sequence begin
1278	 */
1279	udelay(250);
1280	writel(PW_RESETB, &regs->power_detect);
1281	readl(&regs->int_enable);
1282}
1283
1284static void ep0_start(struct goku_udc *dev)
1285{
1286	struct goku_udc_regs __iomem	*regs = dev->regs;
1287	unsigned			i;
1288
1289	VDBG(dev, "%s\n", __func__);
1290
1291	udc_reset(dev);
1292	udc_reinit (dev);
1293	//writel(MST_EOPB_ENA | MST_TIMEOUT_ENA, &regs->dma_master);
1294
1295	/* hw handles set_address, set_feature, get_status; maybe more */
1296	writel(   G_REQMODE_SET_INTF | G_REQMODE_GET_INTF
1297		| G_REQMODE_SET_CONF | G_REQMODE_GET_CONF
1298		| G_REQMODE_GET_DESC
1299		| G_REQMODE_CLEAR_FEAT
1300		, &regs->reqmode);
1301
1302	for (i = 0; i < 4; i++)
1303		dev->ep[i].irqs = 0;
1304
1305	/* can't modify descriptors after writing UsbReady */
1306	for (i = 0; i < DESC_LEN; i++)
1307		writel(0, &regs->descriptors[i]);
1308	writel(0, &regs->UsbReady);
1309
1310	/* expect ep0 requests when the host drops reset */
1311	writel(PW_RESETB | PW_PULLUP, &regs->power_detect);
1312	dev->int_enable = INT_DEVWIDE | INT_EP0;
1313	writel(dev->int_enable, &dev->regs->int_enable);
1314	readl(&regs->int_enable);
1315	dev->gadget.speed = USB_SPEED_FULL;
1316	dev->ep0state = EP0_IDLE;
1317}
1318
1319static void udc_enable(struct goku_udc *dev)
1320{
1321	/* start enumeration now, or after power detect irq */
1322	if (readl(&dev->regs->power_detect) & PW_DETECT)
1323		ep0_start(dev);
1324	else {
1325		DBG(dev, "%s\n", __func__);
1326		dev->int_enable = INT_PWRDETECT;
1327		writel(dev->int_enable, &dev->regs->int_enable);
1328	}
1329}
1330
1331/*-------------------------------------------------------------------------*/
1332
1333/* keeping it simple:
1334 * - one bus driver, initted first;
1335 * - one function driver, initted second
1336 */
1337
1338/* when a driver is successfully registered, it will receive
1339 * control requests including set_configuration(), which enables
1340 * non-control requests.  then usb traffic follows until a
1341 * disconnect is reported.  then a host may connect again, or
1342 * the driver might get unbound.
1343 */
1344static int goku_udc_start(struct usb_gadget *g,
1345		struct usb_gadget_driver *driver)
1346{
1347	struct goku_udc	*dev = to_goku_udc(g);
1348
1349	/* hook up the driver */
1350	driver->driver.bus = NULL;
1351	dev->driver = driver;
1352
1353	/*
1354	 * then enable host detection and ep0; and we're ready
1355	 * for set_configuration as well as eventual disconnect.
1356	 */
1357	udc_enable(dev);
1358
1359	return 0;
1360}
1361
1362static void stop_activity(struct goku_udc *dev)
1363{
1364	unsigned	i;
1365
1366	DBG (dev, "%s\n", __func__);
1367
1368	/* disconnect gadget driver after quiesceing hw and the driver */
1369	udc_reset (dev);
1370	for (i = 0; i < 4; i++)
1371		nuke(&dev->ep [i], -ESHUTDOWN);
1372
1373	if (dev->driver)
1374		udc_enable(dev);
1375}
1376
1377static int goku_udc_stop(struct usb_gadget *g)
1378{
1379	struct goku_udc	*dev = to_goku_udc(g);
1380	unsigned long	flags;
1381
1382	spin_lock_irqsave(&dev->lock, flags);
1383	dev->driver = NULL;
1384	stop_activity(dev);
1385	spin_unlock_irqrestore(&dev->lock, flags);
1386
1387	return 0;
1388}
1389
1390/*-------------------------------------------------------------------------*/
1391
1392static void ep0_setup(struct goku_udc *dev)
1393{
1394	struct goku_udc_regs __iomem	*regs = dev->regs;
1395	struct usb_ctrlrequest		ctrl;
1396	int				tmp;
1397
1398	/* read SETUP packet and enter DATA stage */
1399	ctrl.bRequestType = readl(&regs->bRequestType);
1400	ctrl.bRequest = readl(&regs->bRequest);
1401	ctrl.wValue  = cpu_to_le16((readl(&regs->wValueH)  << 8)
1402					| readl(&regs->wValueL));
1403	ctrl.wIndex  = cpu_to_le16((readl(&regs->wIndexH)  << 8)
1404					| readl(&regs->wIndexL));
1405	ctrl.wLength = cpu_to_le16((readl(&regs->wLengthH) << 8)
1406					| readl(&regs->wLengthL));
1407	writel(0, &regs->SetupRecv);
1408
1409	nuke(&dev->ep[0], 0);
1410	dev->ep[0].stopped = 0;
1411	if (likely(ctrl.bRequestType & USB_DIR_IN)) {
1412		dev->ep[0].is_in = 1;
1413		dev->ep0state = EP0_IN;
1414		/* detect early status stages */
1415		writel(ICONTROL_STATUSNAK, &dev->regs->IntControl);
1416	} else {
1417		dev->ep[0].is_in = 0;
1418		dev->ep0state = EP0_OUT;
1419
1420		/* NOTE:  CLEAR_FEATURE is done in software so that we can
1421		 * synchronize transfer restarts after bulk IN stalls.  data
1422		 * won't even enter the fifo until the halt is cleared.
1423		 */
1424		switch (ctrl.bRequest) {
1425		case USB_REQ_CLEAR_FEATURE:
1426			switch (ctrl.bRequestType) {
1427			case USB_RECIP_ENDPOINT:
1428				tmp = le16_to_cpu(ctrl.wIndex) & 0x0f;
1429				/* active endpoint */
1430				if (tmp > 3 ||
1431				    (!dev->ep[tmp].ep.desc && tmp != 0))
1432					goto stall;
1433				if (ctrl.wIndex & cpu_to_le16(
1434						USB_DIR_IN)) {
1435					if (!dev->ep[tmp].is_in)
1436						goto stall;
1437				} else {
1438					if (dev->ep[tmp].is_in)
1439						goto stall;
1440				}
1441				if (ctrl.wValue != cpu_to_le16(
1442						USB_ENDPOINT_HALT))
1443					goto stall;
1444				if (tmp)
1445					goku_clear_halt(&dev->ep[tmp]);
1446succeed:
1447				/* start ep0out status stage */
1448				writel(~(1<<0), &regs->EOP);
1449				dev->ep[0].stopped = 1;
1450				dev->ep0state = EP0_STATUS;
1451				return;
1452			case USB_RECIP_DEVICE:
1453				/* device remote wakeup: always clear */
1454				if (ctrl.wValue != cpu_to_le16(1))
1455					goto stall;
1456				VDBG(dev, "clear dev remote wakeup\n");
1457				goto succeed;
1458			case USB_RECIP_INTERFACE:
1459				goto stall;
1460			default:		/* pass to gadget driver */
1461				break;
1462			}
1463			break;
1464		default:
1465			break;
1466		}
1467	}
1468
1469#ifdef USB_TRACE
1470	VDBG(dev, "SETUP %02x.%02x v%04x i%04x l%04x\n",
1471		ctrl.bRequestType, ctrl.bRequest,
1472		le16_to_cpu(ctrl.wValue), le16_to_cpu(ctrl.wIndex),
1473		le16_to_cpu(ctrl.wLength));
1474#endif
1475
1476	/* hw wants to know when we're configured (or not) */
1477	dev->req_config = (ctrl.bRequest == USB_REQ_SET_CONFIGURATION
1478				&& ctrl.bRequestType == USB_RECIP_DEVICE);
1479	if (unlikely(dev->req_config))
1480		dev->configured = (ctrl.wValue != cpu_to_le16(0));
1481
1482	/* delegate everything to the gadget driver.
1483	 * it may respond after this irq handler returns.
1484	 */
1485	spin_unlock (&dev->lock);
1486	tmp = dev->driver->setup(&dev->gadget, &ctrl);
1487	spin_lock (&dev->lock);
1488	if (unlikely(tmp < 0)) {
1489stall:
1490#ifdef USB_TRACE
1491		VDBG(dev, "req %02x.%02x protocol STALL; err %d\n",
1492				ctrl.bRequestType, ctrl.bRequest, tmp);
1493#endif
1494		command(regs, COMMAND_STALL, 0);
1495		dev->ep[0].stopped = 1;
1496		dev->ep0state = EP0_STALL;
1497	}
1498
1499	/* expect at least one data or status stage irq */
1500}
1501
1502#define ACK(irqbit) { \
1503		stat &= ~irqbit; \
1504		writel(~irqbit, &regs->int_status); \
1505		handled = 1; \
1506		}
1507
1508static irqreturn_t goku_irq(int irq, void *_dev)
1509{
1510	struct goku_udc			*dev = _dev;
1511	struct goku_udc_regs __iomem	*regs = dev->regs;
1512	struct goku_ep			*ep;
1513	u32				stat, handled = 0;
1514	unsigned			i, rescans = 5;
1515
1516	spin_lock(&dev->lock);
1517
1518rescan:
1519	stat = readl(&regs->int_status) & dev->int_enable;
1520        if (!stat)
1521		goto done;
1522	dev->irqs++;
1523
1524	/* device-wide irqs */
1525	if (unlikely(stat & INT_DEVWIDE)) {
1526		if (stat & INT_SYSERROR) {
1527			ERROR(dev, "system error\n");
1528			stop_activity(dev);
1529			stat = 0;
1530			handled = 1;
1531			// FIXME have a neater way to prevent re-enumeration
1532			dev->driver = NULL;
1533			goto done;
1534		}
1535		if (stat & INT_PWRDETECT) {
1536			writel(~stat, &regs->int_status);
1537			if (readl(&dev->regs->power_detect) & PW_DETECT) {
1538				VDBG(dev, "connect\n");
1539				ep0_start(dev);
1540			} else {
1541				DBG(dev, "disconnect\n");
1542				if (dev->gadget.speed == USB_SPEED_FULL)
1543					stop_activity(dev);
1544				dev->ep0state = EP0_DISCONNECT;
1545				dev->int_enable = INT_DEVWIDE;
1546				writel(dev->int_enable, &dev->regs->int_enable);
1547			}
1548			stat = 0;
1549			handled = 1;
1550			goto done;
1551		}
1552		if (stat & INT_SUSPEND) {
1553			ACK(INT_SUSPEND);
1554			if (readl(&regs->ep_status[0]) & EPxSTATUS_SUSPEND) {
1555				switch (dev->ep0state) {
1556				case EP0_DISCONNECT:
1557				case EP0_SUSPEND:
1558					goto pm_next;
1559				default:
1560					break;
1561				}
1562				DBG(dev, "USB suspend\n");
1563				dev->ep0state = EP0_SUSPEND;
1564				if (dev->gadget.speed != USB_SPEED_UNKNOWN
1565						&& dev->driver
1566						&& dev->driver->suspend) {
1567					spin_unlock(&dev->lock);
1568					dev->driver->suspend(&dev->gadget);
1569					spin_lock(&dev->lock);
1570				}
1571			} else {
1572				if (dev->ep0state != EP0_SUSPEND) {
1573					DBG(dev, "bogus USB resume %d\n",
1574						dev->ep0state);
1575					goto pm_next;
1576				}
1577				DBG(dev, "USB resume\n");
1578				dev->ep0state = EP0_IDLE;
1579				if (dev->gadget.speed != USB_SPEED_UNKNOWN
1580						&& dev->driver
1581						&& dev->driver->resume) {
1582					spin_unlock(&dev->lock);
1583					dev->driver->resume(&dev->gadget);
1584					spin_lock(&dev->lock);
1585				}
1586			}
1587		}
1588pm_next:
1589		if (stat & INT_USBRESET) {		/* hub reset done */
1590			ACK(INT_USBRESET);
1591			INFO(dev, "USB reset done, gadget %s\n",
1592				dev->driver->driver.name);
1593		}
1594		// and INT_ERR on some endpoint's crc/bitstuff/... problem
1595	}
1596
1597	/* progress ep0 setup, data, or status stages.
1598	 * no transition {EP0_STATUS, EP0_STALL} --> EP0_IDLE; saves irqs
1599	 */
1600	if (stat & INT_SETUP) {
1601		ACK(INT_SETUP);
1602		dev->ep[0].irqs++;
1603		ep0_setup(dev);
1604	}
1605        if (stat & INT_STATUSNAK) {
1606		ACK(INT_STATUSNAK|INT_ENDPOINT0);
1607		if (dev->ep0state == EP0_IN) {
1608			ep = &dev->ep[0];
1609			ep->irqs++;
1610			nuke(ep, 0);
1611			writel(~(1<<0), &regs->EOP);
1612			dev->ep0state = EP0_STATUS;
1613		}
1614	}
1615        if (stat & INT_ENDPOINT0) {
1616		ACK(INT_ENDPOINT0);
1617		ep = &dev->ep[0];
1618		ep->irqs++;
1619		pio_advance(ep);
1620        }
1621
1622	/* dma completion */
1623        if (stat & INT_MSTRDEND) {	/* IN */
1624		ACK(INT_MSTRDEND);
1625		ep = &dev->ep[UDC_MSTRD_ENDPOINT];
1626		ep->irqs++;
1627		dma_advance(dev, ep);
1628        }
1629        if (stat & INT_MSTWREND) {	/* OUT */
1630		ACK(INT_MSTWREND);
1631		ep = &dev->ep[UDC_MSTWR_ENDPOINT];
1632		ep->irqs++;
1633		dma_advance(dev, ep);
1634        }
1635        if (stat & INT_MSTWRTMOUT) {	/* OUT */
1636		ACK(INT_MSTWRTMOUT);
1637		ep = &dev->ep[UDC_MSTWR_ENDPOINT];
1638		ep->irqs++;
1639		ERROR(dev, "%s write timeout ?\n", ep->ep.name);
1640		// reset dma? then dma_advance()
1641        }
1642
1643	/* pio */
1644	for (i = 1; i < 4; i++) {
1645		u32		tmp = INT_EPxDATASET(i);
1646
1647		if (!(stat & tmp))
1648			continue;
1649		ep = &dev->ep[i];
1650		pio_advance(ep);
1651		if (list_empty (&ep->queue))
1652			pio_irq_disable(dev, regs, i);
1653		stat &= ~tmp;
1654		handled = 1;
1655		ep->irqs++;
1656	}
1657
1658	if (rescans--)
1659		goto rescan;
1660
1661done:
1662	(void)readl(&regs->int_enable);
1663	spin_unlock(&dev->lock);
1664	if (stat)
1665		DBG(dev, "unhandled irq status: %05x (%05x, %05x)\n", stat,
1666				readl(&regs->int_status), dev->int_enable);
1667	return IRQ_RETVAL(handled);
1668}
1669
1670#undef ACK
1671
1672/*-------------------------------------------------------------------------*/
1673
1674static void gadget_release(struct device *_dev)
1675{
1676	struct goku_udc	*dev = dev_get_drvdata(_dev);
1677
1678	kfree(dev);
1679}
1680
1681/* tear down the binding between this driver and the pci device */
1682
1683static void goku_remove(struct pci_dev *pdev)
1684{
1685	struct goku_udc		*dev = pci_get_drvdata(pdev);
1686
1687	DBG(dev, "%s\n", __func__);
1688
1689	usb_del_gadget_udc(&dev->gadget);
1690
1691	BUG_ON(dev->driver);
1692
1693#ifdef CONFIG_USB_GADGET_DEBUG_FILES
1694	remove_proc_entry(proc_node_name, NULL);
1695#endif
1696	if (dev->regs)
1697		udc_reset(dev);
1698	if (dev->got_irq)
1699		free_irq(pdev->irq, dev);
1700	if (dev->regs)
1701		iounmap(dev->regs);
1702	if (dev->got_region)
1703		release_mem_region(pci_resource_start (pdev, 0),
1704				pci_resource_len (pdev, 0));
1705	if (dev->enabled)
1706		pci_disable_device(pdev);
1707
1708	dev->regs = NULL;
1709
1710	INFO(dev, "unbind\n");
1711}
1712
1713/* wrap this driver around the specified pci device, but
1714 * don't respond over USB until a gadget driver binds to us.
1715 */
1716
1717static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
1718{
1719	struct goku_udc		*dev = NULL;
1720	unsigned long		resource, len;
1721	void __iomem		*base = NULL;
1722	int			retval;
1723
1724	if (!pdev->irq) {
1725		printk(KERN_ERR "Check PCI %s IRQ setup!\n", pci_name(pdev));
1726		retval = -ENODEV;
1727		goto err;
1728	}
1729
1730	/* alloc, and start init */
1731	dev = kzalloc (sizeof *dev, GFP_KERNEL);
1732	if (dev == NULL){
1733		pr_debug("enomem %s\n", pci_name(pdev));
1734		retval = -ENOMEM;
1735		goto err;
1736	}
1737
1738	spin_lock_init(&dev->lock);
1739	dev->pdev = pdev;
1740	dev->gadget.ops = &goku_ops;
1741	dev->gadget.max_speed = USB_SPEED_FULL;
1742
1743	/* the "gadget" abstracts/virtualizes the controller */
1744	dev->gadget.name = driver_name;
1745
1746	/* now all the pci goodies ... */
1747	retval = pci_enable_device(pdev);
1748	if (retval < 0) {
1749		DBG(dev, "can't enable, %d\n", retval);
1750		goto err;
1751	}
1752	dev->enabled = 1;
1753
1754	resource = pci_resource_start(pdev, 0);
1755	len = pci_resource_len(pdev, 0);
1756	if (!request_mem_region(resource, len, driver_name)) {
1757		DBG(dev, "controller already in use\n");
1758		retval = -EBUSY;
1759		goto err;
1760	}
1761	dev->got_region = 1;
1762
1763	base = ioremap_nocache(resource, len);
1764	if (base == NULL) {
1765		DBG(dev, "can't map memory\n");
1766		retval = -EFAULT;
1767		goto err;
1768	}
1769	dev->regs = (struct goku_udc_regs __iomem *) base;
1770
1771	pci_set_drvdata(pdev, dev);
1772	INFO(dev, "%s\n", driver_desc);
1773	INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
1774	INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
1775
1776	/* init to known state, then setup irqs */
1777	udc_reset(dev);
1778	udc_reinit (dev);
1779	if (request_irq(pdev->irq, goku_irq, IRQF_SHARED,
1780			driver_name, dev) != 0) {
1781		DBG(dev, "request interrupt %d failed\n", pdev->irq);
1782		retval = -EBUSY;
1783		goto err;
1784	}
1785	dev->got_irq = 1;
1786	if (use_dma)
1787		pci_set_master(pdev);
1788
1789
1790#ifdef CONFIG_USB_GADGET_DEBUG_FILES
1791	proc_create_data(proc_node_name, 0, NULL, &udc_proc_fops, dev);
1792#endif
1793
1794	retval = usb_add_gadget_udc_release(&pdev->dev, &dev->gadget,
1795			gadget_release);
1796	if (retval)
1797		goto err;
1798
1799	return 0;
1800
1801err:
1802	if (dev)
1803		goku_remove (pdev);
1804	return retval;
1805}
1806
1807
1808/*-------------------------------------------------------------------------*/
1809
1810static const struct pci_device_id pci_ids[] = { {
1811	.class =	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
1812	.class_mask =	~0,
1813	.vendor =	0x102f,		/* Toshiba */
1814	.device =	0x0107,		/* this UDC */
1815	.subvendor =	PCI_ANY_ID,
1816	.subdevice =	PCI_ANY_ID,
1817
1818}, { /* end: all zeroes */ }
1819};
1820MODULE_DEVICE_TABLE (pci, pci_ids);
1821
1822static struct pci_driver goku_pci_driver = {
1823	.name =		(char *) driver_name,
1824	.id_table =	pci_ids,
1825
1826	.probe =	goku_probe,
1827	.remove =	goku_remove,
1828
1829	/* FIXME add power management support */
1830};
1831
1832module_pci_driver(goku_pci_driver);
1833