]> www.pilppa.org Git - linux-2.6-omap-h63xx.git/blob - drivers/usb/host/r8a66597-hcd.c
USB: r8a66597-hcd: fix NULL access
[linux-2.6-omap-h63xx.git] / drivers / usb / host / r8a66597-hcd.c
1 /*
2  * R8A66597 HCD (Host Controller Driver)
3  *
4  * Copyright (C) 2006-2007 Renesas Solutions Corp.
5  * Portions Copyright (C) 2004 Psion Teklogix (for NetBook PRO)
6  * Portions Copyright (C) 2004-2005 David Brownell
7  * Portions Copyright (C) 1999 Roman Weissgaerber
8  *
9  * Author : Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; version 2 of the License.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
23  *
24  */
25
26 #include <linux/module.h>
27 #include <linux/kernel.h>
28 #include <linux/sched.h>
29 #include <linux/smp_lock.h>
30 #include <linux/errno.h>
31 #include <linux/init.h>
32 #include <linux/timer.h>
33 #include <linux/delay.h>
34 #include <linux/list.h>
35 #include <linux/interrupt.h>
36 #include <linux/usb.h>
37 #include <linux/platform_device.h>
38
39 #include <asm/io.h>
40 #include <asm/irq.h>
41 #include <asm/system.h>
42
43 #include "../core/hcd.h"
44 #include "r8a66597.h"
45
46 MODULE_DESCRIPTION("R8A66597 USB Host Controller Driver");
47 MODULE_LICENSE("GPL");
48 MODULE_AUTHOR("Yoshihiro Shimoda");
49
50 #define DRIVER_VERSION  "29 May 2007"
51
52 static const char hcd_name[] = "r8a66597_hcd";
53
54 /* module parameters */
55 static unsigned short clock = XTAL12;
56 module_param(clock, ushort, 0644);
57 MODULE_PARM_DESC(clock, "input clock: 48MHz=32768, 24MHz=16384, 12MHz=0(default=0)");
58 static unsigned short vif = LDRV;
59 module_param(vif, ushort, 0644);
60 MODULE_PARM_DESC(vif, "input VIF: 3.3V=32768, 1.5V=0(default=32768)");
61 static unsigned short endian = 0;
62 module_param(endian, ushort, 0644);
63 MODULE_PARM_DESC(endian, "data endian: big=256, little=0(default=0)");
64 static unsigned short irq_sense = INTL;
65 module_param(irq_sense, ushort, 0644);
66 MODULE_PARM_DESC(irq_sense, "IRQ sense: low level=32, falling edge=0(default=32)");
67
68 static void packet_write(struct r8a66597 *r8a66597, u16 pipenum);
69 static int r8a66597_get_frame(struct usb_hcd *hcd);
70
71 /* this function must be called with interrupt disabled */
72 static void enable_pipe_irq(struct r8a66597 *r8a66597, u16 pipenum,
73                             unsigned long reg)
74 {
75         u16 tmp;
76
77         tmp = r8a66597_read(r8a66597, INTENB0);
78         r8a66597_bclr(r8a66597, BEMPE | NRDYE | BRDYE, INTENB0);
79         r8a66597_bset(r8a66597, 1 << pipenum, reg);
80         r8a66597_write(r8a66597, tmp, INTENB0);
81 }
82
83 /* this function must be called with interrupt disabled */
84 static void disable_pipe_irq(struct r8a66597 *r8a66597, u16 pipenum,
85                              unsigned long reg)
86 {
87         u16 tmp;
88
89         tmp = r8a66597_read(r8a66597, INTENB0);
90         r8a66597_bclr(r8a66597, BEMPE | NRDYE | BRDYE, INTENB0);
91         r8a66597_bclr(r8a66597, 1 << pipenum, reg);
92         r8a66597_write(r8a66597, tmp, INTENB0);
93 }
94
95 static void set_devadd_reg(struct r8a66597 *r8a66597, u8 r8a66597_address,
96                            u16 usbspd, u8 upphub, u8 hubport, int port)
97 {
98         u16 val;
99         unsigned long devadd_reg = get_devadd_addr(r8a66597_address);
100
101         val = (upphub << 11) | (hubport << 8) | (usbspd << 6) | (port & 0x0001);
102         r8a66597_write(r8a66597, val, devadd_reg);
103 }
104
105 static int enable_controller(struct r8a66597 *r8a66597)
106 {
107         u16 tmp;
108         int i = 0;
109
110         do {
111                 r8a66597_write(r8a66597, USBE, SYSCFG0);
112                 tmp = r8a66597_read(r8a66597, SYSCFG0);
113                 if (i++ > 1000) {
114                         err("register access fail.");
115                         return -ENXIO;
116                 }
117         } while ((tmp & USBE) != USBE);
118         r8a66597_bclr(r8a66597, USBE, SYSCFG0);
119         r8a66597_mdfy(r8a66597, clock, XTAL, SYSCFG0);
120
121         i = 0;
122         r8a66597_bset(r8a66597, XCKE, SYSCFG0);
123         do {
124                 msleep(1);
125                 tmp = r8a66597_read(r8a66597, SYSCFG0);
126                 if (i++ > 500) {
127                         err("register access fail.");
128                         return -ENXIO;
129                 }
130         } while ((tmp & SCKE) != SCKE);
131
132         r8a66597_bset(r8a66597, DCFM | DRPD, SYSCFG0);
133         r8a66597_bset(r8a66597, DRPD, SYSCFG1);
134
135         r8a66597_bset(r8a66597, vif & LDRV, PINCFG);
136         r8a66597_bset(r8a66597, HSE, SYSCFG0);
137         r8a66597_bset(r8a66597, HSE, SYSCFG1);
138         r8a66597_bset(r8a66597, USBE, SYSCFG0);
139
140         r8a66597_bset(r8a66597, BEMPE | NRDYE | BRDYE, INTENB0);
141         r8a66597_bset(r8a66597, irq_sense & INTL, SOFCFG);
142         r8a66597_bset(r8a66597, BRDY0, BRDYENB);
143         r8a66597_bset(r8a66597, BEMP0, BEMPENB);
144
145         r8a66597_write(r8a66597, BURST | CPU_ADR_RD_WR, DMA0CFG);
146         r8a66597_write(r8a66597, BURST | CPU_ADR_RD_WR, DMA1CFG);
147
148         r8a66597_bset(r8a66597, endian & BIGEND, CFIFOSEL);
149         r8a66597_bset(r8a66597, endian & BIGEND, D0FIFOSEL);
150         r8a66597_bset(r8a66597, endian & BIGEND, D1FIFOSEL);
151
152         r8a66597_bset(r8a66597, TRNENSEL, SOFCFG);
153
154         r8a66597_bset(r8a66597, SIGNE | SACKE, INTENB1);
155         r8a66597_bclr(r8a66597, DTCHE, INTENB1);
156         r8a66597_bset(r8a66597, ATTCHE, INTENB1);
157         r8a66597_bclr(r8a66597, DTCHE, INTENB2);
158         r8a66597_bset(r8a66597, ATTCHE, INTENB2);
159
160         return 0;
161 }
162
163 static void disable_controller(struct r8a66597 *r8a66597)
164 {
165         u16 tmp;
166
167         r8a66597_write(r8a66597, 0, INTENB0);
168         r8a66597_write(r8a66597, 0, INTENB1);
169         r8a66597_write(r8a66597, 0, INTENB2);
170         r8a66597_write(r8a66597, 0, INTSTS0);
171         r8a66597_write(r8a66597, 0, INTSTS1);
172         r8a66597_write(r8a66597, 0, INTSTS2);
173
174         r8a66597_port_power(r8a66597, 0, 0);
175         r8a66597_port_power(r8a66597, 1, 0);
176
177         do {
178                 tmp = r8a66597_read(r8a66597, SOFCFG) & EDGESTS;
179                 udelay(640);
180         } while (tmp == EDGESTS);
181
182         r8a66597_bclr(r8a66597, DCFM | DRPD, SYSCFG0);
183         r8a66597_bclr(r8a66597, DRPD, SYSCFG1);
184         r8a66597_bclr(r8a66597, HSE, SYSCFG0);
185         r8a66597_bclr(r8a66597, HSE, SYSCFG1);
186
187         r8a66597_bclr(r8a66597, SCKE, SYSCFG0);
188         udelay(1);
189         r8a66597_bclr(r8a66597, PLLC, SYSCFG0);
190         r8a66597_bclr(r8a66597, XCKE, SYSCFG0);
191         r8a66597_bclr(r8a66597, USBE, SYSCFG0);
192 }
193
194 static int get_parent_r8a66597_address(struct r8a66597 *r8a66597,
195                                        struct usb_device *udev)
196 {
197         struct r8a66597_device *dev;
198
199         if (udev->parent && udev->parent->devnum != 1)
200                 udev = udev->parent;
201
202         dev = dev_get_drvdata(&udev->dev);
203         if (dev)
204                 return dev->address;
205         else
206                 return 0;
207 }
208
209 static int is_child_device(char *devpath)
210 {
211         return (devpath[2] ? 1 : 0);
212 }
213
214 static int is_hub_limit(char *devpath)
215 {
216         return ((strlen(devpath) >= 4) ? 1 : 0);
217 }
218
219 static void get_port_number(char *devpath, u16 *root_port, u16 *hub_port)
220 {
221         if (root_port) {
222                 *root_port = (devpath[0] & 0x0F) - 1;
223                 if (*root_port >= R8A66597_MAX_ROOT_HUB)
224                         err("illegal root port number");
225         }
226         if (hub_port)
227                 *hub_port = devpath[2] & 0x0F;
228 }
229
230 static u16 get_r8a66597_usb_speed(enum usb_device_speed speed)
231 {
232         u16 usbspd = 0;
233
234         switch (speed) {
235         case USB_SPEED_LOW:
236                 usbspd = LSMODE;
237                 break;
238         case USB_SPEED_FULL:
239                 usbspd = FSMODE;
240                 break;
241         case USB_SPEED_HIGH:
242                 usbspd = HSMODE;
243                 break;
244         default:
245                 err("unknown speed");
246                 break;
247         }
248
249         return usbspd;
250 }
251
252 static void set_child_connect_map(struct r8a66597 *r8a66597, int address)
253 {
254         int idx;
255
256         idx = address / 32;
257         r8a66597->child_connect_map[idx] |= 1 << (address % 32);
258 }
259
260 static void put_child_connect_map(struct r8a66597 *r8a66597, int address)
261 {
262         int idx;
263
264         idx = address / 32;
265         r8a66597->child_connect_map[idx] &= ~(1 << (address % 32));
266 }
267
268 static void set_pipe_reg_addr(struct r8a66597_pipe *pipe, u8 dma_ch)
269 {
270         u16 pipenum = pipe->info.pipenum;
271         unsigned long fifoaddr[] = {D0FIFO, D1FIFO, CFIFO};
272         unsigned long fifosel[] = {D0FIFOSEL, D1FIFOSEL, CFIFOSEL};
273         unsigned long fifoctr[] = {D0FIFOCTR, D1FIFOCTR, CFIFOCTR};
274
275         if (dma_ch > R8A66597_PIPE_NO_DMA)      /* dma fifo not use? */
276                 dma_ch = R8A66597_PIPE_NO_DMA;
277
278         pipe->fifoaddr = fifoaddr[dma_ch];
279         pipe->fifosel = fifosel[dma_ch];
280         pipe->fifoctr = fifoctr[dma_ch];
281
282         if (pipenum == 0)
283                 pipe->pipectr = DCPCTR;
284         else
285                 pipe->pipectr = get_pipectr_addr(pipenum);
286
287         if (check_bulk_or_isoc(pipenum)) {
288                 pipe->pipetre = get_pipetre_addr(pipenum);
289                 pipe->pipetrn = get_pipetrn_addr(pipenum);
290         } else {
291                 pipe->pipetre = 0;
292                 pipe->pipetrn = 0;
293         }
294 }
295
296 static struct r8a66597_device *
297 get_urb_to_r8a66597_dev(struct r8a66597 *r8a66597, struct urb *urb)
298 {
299         if (usb_pipedevice(urb->pipe) == 0)
300                 return &r8a66597->device0;
301
302         return dev_get_drvdata(&urb->dev->dev);
303 }
304
305 static int make_r8a66597_device(struct r8a66597 *r8a66597,
306                                 struct urb *urb, u8 addr)
307 {
308         struct r8a66597_device *dev;
309         int usb_address = urb->setup_packet[2]; /* urb->pipe is address 0 */
310
311         dev = kzalloc(sizeof(struct r8a66597_device), GFP_KERNEL);
312         if (dev == NULL)
313                 return -ENOMEM;
314
315         dev_set_drvdata(&urb->dev->dev, dev);
316         dev->udev = urb->dev;
317         dev->address = addr;
318         dev->usb_address = usb_address;
319         dev->state = USB_STATE_ADDRESS;
320         dev->ep_in_toggle = 0;
321         dev->ep_out_toggle = 0;
322         INIT_LIST_HEAD(&dev->device_list);
323         list_add_tail(&dev->device_list, &r8a66597->child_device);
324
325         get_port_number(urb->dev->devpath, &dev->root_port, &dev->hub_port);
326         if (!is_child_device(urb->dev->devpath))
327                 r8a66597->root_hub[dev->root_port].dev = dev;
328
329         set_devadd_reg(r8a66597, dev->address,
330                        get_r8a66597_usb_speed(urb->dev->speed),
331                        get_parent_r8a66597_address(r8a66597, urb->dev),
332                        dev->hub_port, dev->root_port);
333
334         return 0;
335 }
336
337 /* this function must be called with interrupt disabled */
338 static u8 alloc_usb_address(struct r8a66597 *r8a66597, struct urb *urb)
339 {
340         u8 addr;        /* R8A66597's address */
341         struct r8a66597_device *dev;
342
343         if (is_hub_limit(urb->dev->devpath)) {
344                 err("Externel hub limit reached.");
345                 return 0;
346         }
347
348         dev = get_urb_to_r8a66597_dev(r8a66597, urb);
349         if (dev && dev->state >= USB_STATE_ADDRESS)
350                 return dev->address;
351
352         for (addr = 1; addr <= R8A66597_MAX_DEVICE; addr++) {
353                 if (r8a66597->address_map & (1 << addr))
354                         continue;
355
356                 dbg("alloc_address: r8a66597_addr=%d", addr);
357                 r8a66597->address_map |= 1 << addr;
358
359                 if (make_r8a66597_device(r8a66597, urb, addr) < 0)
360                         return 0;
361
362                 return addr;
363         }
364
365         err("cannot communicate with a USB device more than 10.(%x)",
366             r8a66597->address_map);
367
368         return 0;
369 }
370
371 /* this function must be called with interrupt disabled */
372 static void free_usb_address(struct r8a66597 *r8a66597,
373                              struct r8a66597_device *dev)
374 {
375         int port;
376
377         if (!dev)
378                 return;
379
380         dbg("free_addr: addr=%d", dev->address);
381
382         dev->state = USB_STATE_DEFAULT;
383         r8a66597->address_map &= ~(1 << dev->address);
384         dev->address = 0;
385         dev_set_drvdata(&dev->udev->dev, NULL);
386         list_del(&dev->device_list);
387         kfree(dev);
388
389         for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++) {
390                 if (r8a66597->root_hub[port].dev == dev) {
391                         r8a66597->root_hub[port].dev = NULL;
392                         break;
393                 }
394         }
395 }
396
397 static void r8a66597_reg_wait(struct r8a66597 *r8a66597, unsigned long reg,
398                               u16 mask, u16 loop)
399 {
400         u16 tmp;
401         int i = 0;
402
403         do {
404                 tmp = r8a66597_read(r8a66597, reg);
405                 if (i++ > 1000000) {
406                         err("register%lx, loop %x is timeout", reg, loop);
407                         break;
408                 }
409                 ndelay(1);
410         } while ((tmp & mask) != loop);
411 }
412
413 /* this function must be called with interrupt disabled */
414 static void pipe_start(struct r8a66597 *r8a66597, struct r8a66597_pipe *pipe)
415 {
416         u16 tmp;
417
418         tmp = r8a66597_read(r8a66597, pipe->pipectr) & PID;
419         if ((pipe->info.pipenum != 0) & ((tmp & PID_STALL) != 0)) /* stall? */
420                 r8a66597_mdfy(r8a66597, PID_NAK, PID, pipe->pipectr);
421         r8a66597_mdfy(r8a66597, PID_BUF, PID, pipe->pipectr);
422 }
423
424 /* this function must be called with interrupt disabled */
425 static void pipe_stop(struct r8a66597 *r8a66597, struct r8a66597_pipe *pipe)
426 {
427         u16 tmp;
428
429         tmp = r8a66597_read(r8a66597, pipe->pipectr) & PID;
430         if ((tmp & PID_STALL11) != PID_STALL11) /* force stall? */
431                 r8a66597_mdfy(r8a66597, PID_STALL, PID, pipe->pipectr);
432         r8a66597_mdfy(r8a66597, PID_NAK, PID, pipe->pipectr);
433         r8a66597_reg_wait(r8a66597, pipe->pipectr, PBUSY, 0);
434 }
435
436 /* this function must be called with interrupt disabled */
437 static void clear_all_buffer(struct r8a66597 *r8a66597,
438                              struct r8a66597_pipe *pipe)
439 {
440         u16 tmp;
441
442         if (!pipe || pipe->info.pipenum == 0)
443                 return;
444
445         pipe_stop(r8a66597, pipe);
446         r8a66597_bset(r8a66597, ACLRM, pipe->pipectr);
447         tmp = r8a66597_read(r8a66597, pipe->pipectr);
448         tmp = r8a66597_read(r8a66597, pipe->pipectr);
449         tmp = r8a66597_read(r8a66597, pipe->pipectr);
450         r8a66597_bclr(r8a66597, ACLRM, pipe->pipectr);
451 }
452
453 /* this function must be called with interrupt disabled */
454 static void r8a66597_pipe_toggle(struct r8a66597 *r8a66597,
455                                  struct r8a66597_pipe *pipe, int toggle)
456 {
457         if (toggle)
458                 r8a66597_bset(r8a66597, SQSET, pipe->pipectr);
459         else
460                 r8a66597_bset(r8a66597, SQCLR, pipe->pipectr);
461 }
462
463 /* this function must be called with interrupt disabled */
464 static inline void cfifo_change(struct r8a66597 *r8a66597, u16 pipenum)
465 {
466         r8a66597_mdfy(r8a66597, MBW | pipenum, MBW | CURPIPE, CFIFOSEL);
467         r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, pipenum);
468 }
469
470 /* this function must be called with interrupt disabled */
471 static inline void fifo_change_from_pipe(struct r8a66597 *r8a66597,
472                                          struct r8a66597_pipe *pipe)
473 {
474         cfifo_change(r8a66597, 0);
475         r8a66597_mdfy(r8a66597, MBW | 0, MBW | CURPIPE, D0FIFOSEL);
476         r8a66597_mdfy(r8a66597, MBW | 0, MBW | CURPIPE, D1FIFOSEL);
477
478         r8a66597_mdfy(r8a66597, MBW | pipe->info.pipenum, MBW | CURPIPE,
479                       pipe->fifosel);
480         r8a66597_reg_wait(r8a66597, pipe->fifosel, CURPIPE, pipe->info.pipenum);
481 }
482
483 static u16 r8a66597_get_pipenum(struct urb *urb, struct usb_host_endpoint *hep)
484 {
485         struct r8a66597_pipe *pipe = hep->hcpriv;
486
487         if (usb_pipeendpoint(urb->pipe) == 0)
488                 return 0;
489         else
490                 return pipe->info.pipenum;
491 }
492
493 static u16 get_urb_to_r8a66597_addr(struct r8a66597 *r8a66597, struct urb *urb)
494 {
495         struct r8a66597_device *dev = get_urb_to_r8a66597_dev(r8a66597, urb);
496
497         return (usb_pipedevice(urb->pipe) == 0) ? 0 : dev->address;
498 }
499
500 static unsigned short *get_toggle_pointer(struct r8a66597_device *dev,
501                                           int urb_pipe)
502 {
503         if (!dev)
504                 return NULL;
505
506         return usb_pipein(urb_pipe) ? &dev->ep_in_toggle : &dev->ep_out_toggle;
507 }
508
509 /* this function must be called with interrupt disabled */
510 static void pipe_toggle_set(struct r8a66597 *r8a66597,
511                             struct r8a66597_pipe *pipe,
512                             struct urb *urb, int set)
513 {
514         struct r8a66597_device *dev = get_urb_to_r8a66597_dev(r8a66597, urb);
515         unsigned char endpoint = usb_pipeendpoint(urb->pipe);
516         unsigned short *toggle = get_toggle_pointer(dev, urb->pipe);
517
518         if (!toggle)
519                 return;
520
521         if (set)
522                 *toggle |= 1 << endpoint;
523         else
524                 *toggle &= ~(1 << endpoint);
525 }
526
527 /* this function must be called with interrupt disabled */
528 static void pipe_toggle_save(struct r8a66597 *r8a66597,
529                              struct r8a66597_pipe *pipe,
530                              struct urb *urb)
531 {
532         if (r8a66597_read(r8a66597, pipe->pipectr) & SQMON)
533                 pipe_toggle_set(r8a66597, pipe, urb, 1);
534         else
535                 pipe_toggle_set(r8a66597, pipe, urb, 0);
536 }
537
538 /* this function must be called with interrupt disabled */
539 static void pipe_toggle_restore(struct r8a66597 *r8a66597,
540                                 struct r8a66597_pipe *pipe,
541                                 struct urb *urb)
542 {
543         struct r8a66597_device *dev = get_urb_to_r8a66597_dev(r8a66597, urb);
544         unsigned char endpoint = usb_pipeendpoint(urb->pipe);
545         unsigned short *toggle = get_toggle_pointer(dev, urb->pipe);
546
547         if (!toggle)
548                 return;
549
550         r8a66597_pipe_toggle(r8a66597, pipe, *toggle & (1 << endpoint));
551 }
552
553 /* this function must be called with interrupt disabled */
554 static void pipe_buffer_setting(struct r8a66597 *r8a66597,
555                                 struct r8a66597_pipe_info *info)
556 {
557         u16 val = 0;
558
559         if (info->pipenum == 0)
560                 return;
561
562         r8a66597_bset(r8a66597, ACLRM, get_pipectr_addr(info->pipenum));
563         r8a66597_bclr(r8a66597, ACLRM, get_pipectr_addr(info->pipenum));
564         r8a66597_write(r8a66597, info->pipenum, PIPESEL);
565         if (!info->dir_in)
566                 val |= R8A66597_DIR;
567         if (info->type == R8A66597_BULK && info->dir_in)
568                 val |= R8A66597_DBLB | R8A66597_SHTNAK;
569         val |= info->type | info->epnum;
570         r8a66597_write(r8a66597, val, PIPECFG);
571
572         r8a66597_write(r8a66597, (info->buf_bsize << 10) | (info->bufnum),
573                        PIPEBUF);
574         r8a66597_write(r8a66597, make_devsel(info->address) | info->maxpacket,
575                        PIPEMAXP);
576         if (info->interval)
577                 info->interval--;
578         r8a66597_write(r8a66597, info->interval, PIPEPERI);
579 }
580
581
582
583 /* this function must be called with interrupt disabled */
584 static void pipe_setting(struct r8a66597 *r8a66597, struct r8a66597_td *td)
585 {
586         struct r8a66597_pipe_info *info;
587         struct urb *urb = td->urb;
588
589         if (td->pipenum > 0) {
590                 info = &td->pipe->info;
591                 cfifo_change(r8a66597, 0);
592                 pipe_buffer_setting(r8a66597, info);
593
594                 if (!usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
595                                    usb_pipeout(urb->pipe)) &&
596                     !usb_pipecontrol(urb->pipe)) {
597                         r8a66597_pipe_toggle(r8a66597, td->pipe, 0);
598                         pipe_toggle_set(r8a66597, td->pipe, urb, 0);
599                         clear_all_buffer(r8a66597, td->pipe);
600                         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
601                                       usb_pipeout(urb->pipe), 1);
602                 }
603                 pipe_toggle_restore(r8a66597, td->pipe, urb);
604         }
605 }
606
607 /* this function must be called with interrupt disabled */
608 static u16 get_empty_pipenum(struct r8a66597 *r8a66597,
609                              struct usb_endpoint_descriptor *ep)
610 {
611         u16 array[R8A66597_MAX_NUM_PIPE], i = 0, min;
612
613         memset(array, 0, sizeof(array));
614         switch(ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
615         case USB_ENDPOINT_XFER_BULK:
616                 if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
617                         array[i++] = 4;
618                 else {
619                         array[i++] = 3;
620                         array[i++] = 5;
621                 }
622                 break;
623         case USB_ENDPOINT_XFER_INT:
624                 if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK) {
625                         array[i++] = 6;
626                         array[i++] = 7;
627                         array[i++] = 8;
628                 } else
629                         array[i++] = 9;
630                 break;
631         case USB_ENDPOINT_XFER_ISOC:
632                 if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
633                         array[i++] = 2;
634                 else
635                         array[i++] = 1;
636                 break;
637         default:
638                 err("Illegal type");
639                 return 0;
640         }
641
642         i = 1;
643         min = array[0];
644         while (array[i] != 0) {
645                 if (r8a66597->pipe_cnt[min] > r8a66597->pipe_cnt[array[i]])
646                         min = array[i];
647                 i++;
648         }
649
650         return min;
651 }
652
653 static u16 get_r8a66597_type(__u8 type)
654 {
655         u16 r8a66597_type;
656
657         switch(type) {
658         case USB_ENDPOINT_XFER_BULK:
659                 r8a66597_type = R8A66597_BULK;
660                 break;
661         case USB_ENDPOINT_XFER_INT:
662                 r8a66597_type = R8A66597_INT;
663                 break;
664         case USB_ENDPOINT_XFER_ISOC:
665                 r8a66597_type = R8A66597_ISO;
666                 break;
667         default:
668                 err("Illegal type");
669                 r8a66597_type = 0x0000;
670                 break;
671         }
672
673         return r8a66597_type;
674 }
675
676 static u16 get_bufnum(u16 pipenum)
677 {
678         u16 bufnum = 0;
679
680         if (pipenum == 0)
681                 bufnum = 0;
682         else if (check_bulk_or_isoc(pipenum))
683                 bufnum = 8 + (pipenum - 1) * R8A66597_BUF_BSIZE*2;
684         else if (check_interrupt(pipenum))
685                 bufnum = 4 + (pipenum - 6);
686         else
687                 err("Illegal pipenum (%d)", pipenum);
688
689         return bufnum;
690 }
691
692 static u16 get_buf_bsize(u16 pipenum)
693 {
694         u16 buf_bsize = 0;
695
696         if (pipenum == 0)
697                 buf_bsize = 3;
698         else if (check_bulk_or_isoc(pipenum))
699                 buf_bsize = R8A66597_BUF_BSIZE - 1;
700         else if (check_interrupt(pipenum))
701                 buf_bsize = 0;
702         else
703                 err("Illegal pipenum (%d)", pipenum);
704
705         return buf_bsize;
706 }
707
708 /* this function must be called with interrupt disabled */
709 static void enable_r8a66597_pipe_dma(struct r8a66597 *r8a66597,
710                                      struct r8a66597_device *dev,
711                                      struct r8a66597_pipe *pipe,
712                                      struct urb *urb)
713 {
714         int i;
715         struct r8a66597_pipe_info *info = &pipe->info;
716
717         if ((pipe->info.pipenum != 0) && (info->type != R8A66597_INT)) {
718                 for (i = 0; i < R8A66597_MAX_DMA_CHANNEL; i++) {
719                         if ((r8a66597->dma_map & (1 << i)) != 0)
720                                 continue;
721
722                         info("address %d, EndpointAddress 0x%02x use DMA FIFO",
723                              usb_pipedevice(urb->pipe),
724                              info->dir_in ? USB_ENDPOINT_DIR_MASK + info->epnum
725                                             : info->epnum);
726
727                         r8a66597->dma_map |= 1 << i;
728                         dev->dma_map |= 1 << i;
729                         set_pipe_reg_addr(pipe, i);
730
731                         cfifo_change(r8a66597, 0);
732                         r8a66597_mdfy(r8a66597, MBW | pipe->info.pipenum,
733                                       MBW | CURPIPE, pipe->fifosel);
734
735                         r8a66597_reg_wait(r8a66597, pipe->fifosel, CURPIPE,
736                                           pipe->info.pipenum);
737                         r8a66597_bset(r8a66597, BCLR, pipe->fifoctr);
738                         break;
739                 }
740         }
741 }
742
743 /* this function must be called with interrupt disabled */
744 static void enable_r8a66597_pipe(struct r8a66597 *r8a66597, struct urb *urb,
745                                  struct usb_host_endpoint *hep,
746                                  struct r8a66597_pipe_info *info)
747 {
748         struct r8a66597_device *dev = get_urb_to_r8a66597_dev(r8a66597, urb);
749         struct r8a66597_pipe *pipe = hep->hcpriv;
750
751         dbg("enable_pipe:");
752
753         pipe->info = *info;
754         set_pipe_reg_addr(pipe, R8A66597_PIPE_NO_DMA);
755         r8a66597->pipe_cnt[pipe->info.pipenum]++;
756         dev->pipe_cnt[pipe->info.pipenum]++;
757
758         enable_r8a66597_pipe_dma(r8a66597, dev, pipe, urb);
759 }
760
761 /* this function must be called with interrupt disabled */
762 static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
763 {
764         struct r8a66597_td *td, *next;
765         struct urb *urb;
766         struct list_head *list = &r8a66597->pipe_queue[pipenum];
767
768         if (list_empty(list))
769                 return;
770
771         list_for_each_entry_safe(td, next, list, queue) {
772                 if (!td)
773                         continue;
774                 if (td->address != address)
775                         continue;
776
777                 urb = td->urb;
778                 list_del(&td->queue);
779                 kfree(td);
780
781                 if (urb) {
782                         urb->status = -ENODEV;
783                         urb->hcpriv = NULL;
784                         spin_unlock(&r8a66597->lock);
785                         usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb);
786                         spin_lock(&r8a66597->lock);
787                 }
788                 break;
789         }
790 }
791
792 /* this function must be called with interrupt disabled */
793 static void disable_r8a66597_pipe_all(struct r8a66597 *r8a66597,
794                                       struct r8a66597_device *dev)
795 {
796         int check_ep0 = 0;
797         u16 pipenum;
798
799         if (!dev)
800                 return;
801
802         for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
803                 if (!dev->pipe_cnt[pipenum])
804                         continue;
805
806                 if (!check_ep0) {
807                         check_ep0 = 1;
808                         force_dequeue(r8a66597, 0, dev->address);
809                 }
810
811                 r8a66597->pipe_cnt[pipenum] -= dev->pipe_cnt[pipenum];
812                 dev->pipe_cnt[pipenum] = 0;
813                 force_dequeue(r8a66597, pipenum, dev->address);
814         }
815
816         dbg("disable_pipe");
817
818         r8a66597->dma_map &= ~(dev->dma_map);
819         dev->dma_map = 0;
820 }
821
822 /* this function must be called with interrupt disabled */
823 static void init_pipe_info(struct r8a66597 *r8a66597, struct urb *urb,
824                            struct usb_host_endpoint *hep,
825                            struct usb_endpoint_descriptor *ep)
826 {
827         struct r8a66597_pipe_info info;
828
829         info.pipenum = get_empty_pipenum(r8a66597, ep);
830         info.address = get_urb_to_r8a66597_addr(r8a66597, urb);
831         info.epnum = ep->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
832         info.maxpacket = ep->wMaxPacketSize;
833         info.type = get_r8a66597_type(ep->bmAttributes
834                                       & USB_ENDPOINT_XFERTYPE_MASK);
835         info.bufnum = get_bufnum(info.pipenum);
836         info.buf_bsize = get_buf_bsize(info.pipenum);
837         info.interval = ep->bInterval;
838         if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
839                 info.dir_in = 1;
840         else
841                 info.dir_in = 0;
842
843         enable_r8a66597_pipe(r8a66597, urb, hep, &info);
844 }
845
846 static void init_pipe_config(struct r8a66597 *r8a66597, struct urb *urb)
847 {
848         struct r8a66597_device *dev;
849
850         dev = get_urb_to_r8a66597_dev(r8a66597, urb);
851         dev->state = USB_STATE_CONFIGURED;
852 }
853
854 static void pipe_irq_enable(struct r8a66597 *r8a66597, struct urb *urb,
855                             u16 pipenum)
856 {
857         if (pipenum == 0 && usb_pipeout(urb->pipe))
858                 enable_irq_empty(r8a66597, pipenum);
859         else
860                 enable_irq_ready(r8a66597, pipenum);
861
862         if (!usb_pipeisoc(urb->pipe))
863                 enable_irq_nrdy(r8a66597, pipenum);
864 }
865
866 static void pipe_irq_disable(struct r8a66597 *r8a66597, u16 pipenum)
867 {
868         disable_irq_ready(r8a66597, pipenum);
869         disable_irq_nrdy(r8a66597, pipenum);
870 }
871
872 /* this function must be called with interrupt disabled */
873 static void r8a66597_usb_preconnect(struct r8a66597 *r8a66597, int port)
874 {
875         r8a66597->root_hub[port].port |= (1 << USB_PORT_FEAT_CONNECTION)
876                                          | (1 << USB_PORT_FEAT_C_CONNECTION);
877         r8a66597_write(r8a66597, (u16)~DTCH, get_intsts_reg(port));
878         r8a66597_bset(r8a66597, DTCHE, get_intenb_reg(port));
879 }
880
881 /* this function must be called with interrupt disabled */
882 static void r8a66597_usb_connect(struct r8a66597 *r8a66597, int port)
883 {
884         u16 speed = get_rh_usb_speed(r8a66597, port);
885         struct r8a66597_root_hub *rh = &r8a66597->root_hub[port];
886
887         if (speed == HSMODE)
888                 rh->port |= (1 << USB_PORT_FEAT_HIGHSPEED);
889         else if (speed == LSMODE)
890                 rh->port |= (1 << USB_PORT_FEAT_LOWSPEED);
891
892         rh->port &= ~(1 << USB_PORT_FEAT_RESET);
893         rh->port |= 1 << USB_PORT_FEAT_ENABLE;
894 }
895
896 /* this function must be called with interrupt disabled */
897 static void r8a66597_usb_disconnect(struct r8a66597 *r8a66597, int port)
898 {
899         struct r8a66597_device *dev = r8a66597->root_hub[port].dev;
900
901         r8a66597->root_hub[port].port &= ~(1 << USB_PORT_FEAT_CONNECTION);
902         r8a66597->root_hub[port].port |= (1 << USB_PORT_FEAT_C_CONNECTION);
903
904         disable_r8a66597_pipe_all(r8a66597, dev);
905         free_usb_address(r8a66597, dev);
906
907         r8a66597_bset(r8a66597, ATTCHE, get_intenb_reg(port));
908 }
909
910 /* this function must be called with interrupt disabled */
911 static void prepare_setup_packet(struct r8a66597 *r8a66597,
912                                  struct r8a66597_td *td)
913 {
914         int i;
915         u16 *p = (u16 *)td->urb->setup_packet;
916         unsigned long setup_addr = USBREQ;
917
918         r8a66597_write(r8a66597, make_devsel(td->address) | td->maxpacket,
919                        DCPMAXP);
920         r8a66597_write(r8a66597, (u16)~(SIGN | SACK), INTSTS1);
921
922         for (i = 0; i < 4; i++) {
923                 r8a66597_write(r8a66597, p[i], setup_addr);
924                 setup_addr += 2;
925         }
926         r8a66597_write(r8a66597, SUREQ, DCPCTR);
927 }
928
929 /* this function must be called with interrupt disabled */
930 static void prepare_packet_read(struct r8a66597 *r8a66597,
931                                 struct r8a66597_td *td)
932 {
933         struct urb *urb = td->urb;
934
935         if (usb_pipecontrol(urb->pipe)) {
936                 r8a66597_bclr(r8a66597, R8A66597_DIR, DCPCFG);
937                 r8a66597_mdfy(r8a66597, 0, ISEL | CURPIPE, CFIFOSEL);
938                 r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, 0);
939                 if (urb->actual_length == 0) {
940                         r8a66597_pipe_toggle(r8a66597, td->pipe, 1);
941                         r8a66597_write(r8a66597, BCLR, CFIFOCTR);
942                 }
943                 pipe_irq_disable(r8a66597, td->pipenum);
944                 pipe_start(r8a66597, td->pipe);
945                 pipe_irq_enable(r8a66597, urb, td->pipenum);
946         } else {
947                 if (urb->actual_length == 0) {
948                         pipe_irq_disable(r8a66597, td->pipenum);
949                         pipe_setting(r8a66597, td);
950                         pipe_stop(r8a66597, td->pipe);
951                         r8a66597_write(r8a66597, (u16)~(1 << td->pipenum),
952                                        BRDYSTS);
953
954                         if (td->pipe->pipetre) {
955                                 r8a66597_write(r8a66597, TRCLR,
956                                                 td->pipe->pipetre);
957                                 r8a66597_write(r8a66597,
958                                                (urb->transfer_buffer_length
959                                                + td->maxpacket - 1)
960                                                / td->maxpacket,
961                                                td->pipe->pipetrn);
962                                 r8a66597_bset(r8a66597, TRENB,
963                                               td->pipe->pipetre);
964                         }
965
966                         pipe_start(r8a66597, td->pipe);
967                         pipe_irq_enable(r8a66597, urb, td->pipenum);
968                 }
969         }
970 }
971
972 /* this function must be called with interrupt disabled */
973 static void prepare_packet_write(struct r8a66597 *r8a66597,
974                                  struct r8a66597_td *td)
975 {
976         u16 tmp;
977         struct urb *urb = td->urb;
978
979         if (usb_pipecontrol(urb->pipe)) {
980                 pipe_stop(r8a66597, td->pipe);
981                 r8a66597_bset(r8a66597, R8A66597_DIR, DCPCFG);
982                 r8a66597_mdfy(r8a66597, ISEL, ISEL | CURPIPE, CFIFOSEL);
983                 r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, 0);
984                 if (urb->actual_length == 0) {
985                         r8a66597_pipe_toggle(r8a66597, td->pipe, 1);
986                         r8a66597_write(r8a66597, BCLR, CFIFOCTR);
987                 }
988         } else {
989                 if (urb->actual_length == 0)
990                         pipe_setting(r8a66597, td);
991                 if (td->pipe->pipetre)
992                         r8a66597_bclr(r8a66597, TRENB, td->pipe->pipetre);
993         }
994         r8a66597_write(r8a66597, (u16)~(1 << td->pipenum), BRDYSTS);
995
996         fifo_change_from_pipe(r8a66597, td->pipe);
997         tmp = r8a66597_read(r8a66597, td->pipe->fifoctr);
998         if (unlikely((tmp & FRDY) == 0))
999                 pipe_irq_enable(r8a66597, urb, td->pipenum);
1000         else
1001                 packet_write(r8a66597, td->pipenum);
1002         pipe_start(r8a66597, td->pipe);
1003 }
1004
1005 /* this function must be called with interrupt disabled */
1006 static void prepare_status_packet(struct r8a66597 *r8a66597,
1007                                   struct r8a66597_td *td)
1008 {
1009         struct urb *urb = td->urb;
1010
1011         r8a66597_pipe_toggle(r8a66597, td->pipe, 1);
1012
1013         if (urb->setup_packet[0] & USB_ENDPOINT_DIR_MASK) {
1014                 r8a66597_bset(r8a66597, R8A66597_DIR, DCPCFG);
1015                 r8a66597_mdfy(r8a66597, ISEL, ISEL | CURPIPE, CFIFOSEL);
1016                 r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, 0);
1017                 r8a66597_write(r8a66597, BVAL | BCLR, CFIFOCTR);
1018                 r8a66597_write(r8a66597, (u16)~BEMP0, BEMPSTS);
1019                 enable_irq_empty(r8a66597, 0);
1020         } else {
1021                 r8a66597_bclr(r8a66597, R8A66597_DIR, DCPCFG);
1022                 r8a66597_mdfy(r8a66597, 0, ISEL | CURPIPE, CFIFOSEL);
1023                 r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, 0);
1024                 r8a66597_write(r8a66597, BCLR, CFIFOCTR);
1025                 r8a66597_write(r8a66597, (u16)~BRDY0, BRDYSTS);
1026                 r8a66597_write(r8a66597, (u16)~BEMP0, BEMPSTS);
1027                 enable_irq_ready(r8a66597, 0);
1028         }
1029         enable_irq_nrdy(r8a66597, 0);
1030         pipe_start(r8a66597, td->pipe);
1031 }
1032
1033 /* this function must be called with interrupt disabled */
1034 static int start_transfer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
1035 {
1036         BUG_ON(!td);
1037
1038         switch (td->type) {
1039         case USB_PID_SETUP:
1040                 if (td->urb->setup_packet[1] == USB_REQ_SET_ADDRESS) {
1041                         td->set_address = 1;
1042                         td->urb->setup_packet[2] = alloc_usb_address(r8a66597,
1043                                                                      td->urb);
1044                         if (td->urb->setup_packet[2] == 0)
1045                                 return -EPIPE;
1046                 }
1047                 prepare_setup_packet(r8a66597, td);
1048                 break;
1049         case USB_PID_IN:
1050                 prepare_packet_read(r8a66597, td);
1051                 break;
1052         case USB_PID_OUT:
1053                 prepare_packet_write(r8a66597, td);
1054                 break;
1055         case USB_PID_ACK:
1056                 prepare_status_packet(r8a66597, td);
1057                 break;
1058         default:
1059                 err("invalid type.");
1060                 break;
1061         }
1062
1063         return 0;
1064 }
1065
1066 static int check_transfer_finish(struct r8a66597_td *td, struct urb *urb)
1067 {
1068         if (usb_pipeisoc(urb->pipe)) {
1069                 if (urb->number_of_packets == td->iso_cnt)
1070                         return 1;
1071         }
1072
1073         /* control or bulk or interrupt */
1074         if ((urb->transfer_buffer_length <= urb->actual_length) ||
1075             (td->short_packet) || (td->zero_packet))
1076                 return 1;
1077
1078         return 0;
1079 }
1080
1081 /* this function must be called with interrupt disabled */
1082 static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
1083 {
1084         unsigned long time;
1085
1086         BUG_ON(!td);
1087
1088         if (!list_empty(&r8a66597->pipe_queue[td->pipenum]) &&
1089             !usb_pipecontrol(td->urb->pipe) && usb_pipein(td->urb->pipe)) {
1090                 r8a66597->timeout_map |= 1 << td->pipenum;
1091                 switch (usb_pipetype(td->urb->pipe)) {
1092                 case PIPE_INTERRUPT:
1093                 case PIPE_ISOCHRONOUS:
1094                         time = 30;
1095                         break;
1096                 default:
1097                         time = 300;
1098                         break;
1099                 }
1100
1101                 mod_timer(&r8a66597->td_timer[td->pipenum],
1102                           jiffies + msecs_to_jiffies(time));
1103         }
1104 }
1105
1106 /* this function must be called with interrupt disabled */
1107 static void done(struct r8a66597 *r8a66597, struct r8a66597_td *td,
1108                  u16 pipenum, struct urb *urb)
1109 {
1110         int restart = 0;
1111         struct usb_hcd *hcd = r8a66597_to_hcd(r8a66597);
1112
1113         r8a66597->timeout_map &= ~(1 << pipenum);
1114
1115         if (likely(td)) {
1116                 if (td->set_address && urb->status != 0)
1117                         r8a66597->address_map &= ~(1 << urb->setup_packet[2]);
1118
1119                 pipe_toggle_save(r8a66597, td->pipe, urb);
1120                 list_del(&td->queue);
1121                 kfree(td);
1122         }
1123
1124         if (!list_empty(&r8a66597->pipe_queue[pipenum]))
1125                 restart = 1;
1126
1127         if (likely(urb)) {
1128                 if (usb_pipeisoc(urb->pipe))
1129                         urb->start_frame = r8a66597_get_frame(hcd);
1130
1131                 urb->hcpriv = NULL;
1132                 spin_unlock(&r8a66597->lock);
1133                 usb_hcd_giveback_urb(hcd, urb);
1134                 spin_lock(&r8a66597->lock);
1135         }
1136
1137         if (restart) {
1138                 td = r8a66597_get_td(r8a66597, pipenum);
1139                 if (unlikely(!td))
1140                         return;
1141
1142                 start_transfer(r8a66597, td);
1143                 set_td_timer(r8a66597, td);
1144         }
1145 }
1146
1147 /* this function must be called with interrupt disabled */
1148 static void finish_request(struct r8a66597 *r8a66597, struct r8a66597_td *td,
1149                            u16 pipenum, struct urb *urb)
1150 __releases(r8a66597->lock) __acquires(r8a66597->lock)
1151 {
1152         done(r8a66597, td, pipenum, urb);
1153 }
1154
1155 static void packet_read(struct r8a66597 *r8a66597, u16 pipenum)
1156 {
1157         u16 tmp;
1158         int rcv_len, bufsize, urb_len, size;
1159         u16 *buf;
1160         struct r8a66597_td *td = r8a66597_get_td(r8a66597, pipenum);
1161         struct urb *urb;
1162         int finish = 0;
1163
1164         if (unlikely(!td))
1165                 return;
1166         urb = td->urb;
1167
1168         fifo_change_from_pipe(r8a66597, td->pipe);
1169         tmp = r8a66597_read(r8a66597, td->pipe->fifoctr);
1170         if (unlikely((tmp & FRDY) == 0)) {
1171                 urb->status = -EPIPE;
1172                 pipe_stop(r8a66597, td->pipe);
1173                 pipe_irq_disable(r8a66597, pipenum);
1174                 err("in fifo not ready (%d)", pipenum);
1175                 finish_request(r8a66597, td, pipenum, td->urb);
1176                 return;
1177         }
1178
1179         /* prepare parameters */
1180         rcv_len = tmp & DTLN;
1181         bufsize = td->maxpacket;
1182         if (usb_pipeisoc(urb->pipe)) {
1183                 buf = (u16 *)(urb->transfer_buffer +
1184                                 urb->iso_frame_desc[td->iso_cnt].offset);
1185                 urb_len = urb->iso_frame_desc[td->iso_cnt].length;
1186         } else {
1187                 buf = (void *)urb->transfer_buffer + urb->actual_length;
1188                 urb_len = urb->transfer_buffer_length - urb->actual_length;
1189         }
1190         if (rcv_len < bufsize)
1191                 size = min(rcv_len, urb_len);
1192         else
1193                 size = min(bufsize, urb_len);
1194
1195         /* update parameters */
1196         urb->actual_length += size;
1197         if (rcv_len == 0)
1198                 td->zero_packet = 1;
1199         if ((size % td->maxpacket) > 0) {
1200                 td->short_packet = 1;
1201                 if (urb->transfer_buffer_length != urb->actual_length &&
1202                     urb->transfer_flags & URB_SHORT_NOT_OK)
1203                         td->urb->status = -EREMOTEIO;
1204         }
1205         if (usb_pipeisoc(urb->pipe)) {
1206                 urb->iso_frame_desc[td->iso_cnt].actual_length = size;
1207                 urb->iso_frame_desc[td->iso_cnt].status = 0;
1208                 td->iso_cnt++;
1209         }
1210
1211         /* check transfer finish */
1212         if (check_transfer_finish(td, urb)) {
1213                 pipe_stop(r8a66597, td->pipe);
1214                 pipe_irq_disable(r8a66597, pipenum);
1215                 finish = 1;
1216         }
1217
1218         /* read fifo */
1219         if (urb->transfer_buffer) {
1220                 if (size == 0)
1221                         r8a66597_write(r8a66597, BCLR, td->pipe->fifoctr);
1222                 else
1223                         r8a66597_read_fifo(r8a66597, td->pipe->fifoaddr,
1224                                            buf, size);
1225         }
1226
1227         if (finish && pipenum != 0) {
1228                 if (td->urb->status == -EINPROGRESS)
1229                         td->urb->status = 0;
1230                 finish_request(r8a66597, td, pipenum, urb);
1231         }
1232 }
1233
1234 static void packet_write(struct r8a66597 *r8a66597, u16 pipenum)
1235 {
1236         u16 tmp;
1237         int bufsize, size;
1238         u16 *buf;
1239         struct r8a66597_td *td = r8a66597_get_td(r8a66597, pipenum);
1240         struct urb *urb;
1241
1242         if (unlikely(!td))
1243                 return;
1244         urb = td->urb;
1245
1246         fifo_change_from_pipe(r8a66597, td->pipe);
1247         tmp = r8a66597_read(r8a66597, td->pipe->fifoctr);
1248         if (unlikely((tmp & FRDY) == 0)) {
1249                 urb->status = -EPIPE;
1250                 pipe_stop(r8a66597, td->pipe);
1251                 pipe_irq_disable(r8a66597, pipenum);
1252                 err("out write fifo not ready. (%d)", pipenum);
1253                 finish_request(r8a66597, td, pipenum, td->urb);
1254                 return;
1255         }
1256
1257         /* prepare parameters */
1258         bufsize = td->maxpacket;
1259         if (usb_pipeisoc(urb->pipe)) {
1260                 buf = (u16 *)(urb->transfer_buffer +
1261                                 urb->iso_frame_desc[td->iso_cnt].offset);
1262                 size = min(bufsize,
1263                            (int)urb->iso_frame_desc[td->iso_cnt].length);
1264         } else {
1265                 buf = (u16 *)(urb->transfer_buffer + urb->actual_length);
1266                 size = min((int)bufsize,
1267                            urb->transfer_buffer_length - urb->actual_length);
1268         }
1269
1270         /* write fifo */
1271         if (pipenum > 0)
1272                 r8a66597_write(r8a66597, (u16)~(1 << pipenum), BEMPSTS);
1273         if (urb->transfer_buffer) {
1274                 r8a66597_write_fifo(r8a66597, td->pipe->fifoaddr, buf, size);
1275                 if (!usb_pipebulk(urb->pipe) || td->maxpacket != size)
1276                         r8a66597_write(r8a66597, BVAL, td->pipe->fifoctr);
1277         }
1278
1279         /* update parameters */
1280         urb->actual_length += size;
1281         if (usb_pipeisoc(urb->pipe)) {
1282                 urb->iso_frame_desc[td->iso_cnt].actual_length = size;
1283                 urb->iso_frame_desc[td->iso_cnt].status = 0;
1284                 td->iso_cnt++;
1285         }
1286
1287         /* check transfer finish */
1288         if (check_transfer_finish(td, urb)) {
1289                 disable_irq_ready(r8a66597, pipenum);
1290                 enable_irq_empty(r8a66597, pipenum);
1291                 if (!usb_pipeisoc(urb->pipe))
1292                         enable_irq_nrdy(r8a66597, pipenum);
1293         } else
1294                 pipe_irq_enable(r8a66597, urb, pipenum);
1295 }
1296
1297
1298 static void check_next_phase(struct r8a66597 *r8a66597)
1299 {
1300         struct r8a66597_td *td = r8a66597_get_td(r8a66597, 0);
1301         struct urb *urb;
1302         u8 finish = 0;
1303
1304         if (unlikely(!td))
1305                 return;
1306         urb = td->urb;
1307
1308         switch (td->type) {
1309         case USB_PID_IN:
1310         case USB_PID_OUT:
1311                 if (urb->status != -EINPROGRESS) {
1312                         finish = 1;
1313                         break;
1314                 }
1315                 if (check_transfer_finish(td, urb))
1316                         td->type = USB_PID_ACK;
1317                 break;
1318         case USB_PID_SETUP:
1319                 if (urb->status != -EINPROGRESS)
1320                         finish = 1;
1321                 else if (urb->transfer_buffer_length == urb->actual_length) {
1322                         td->type = USB_PID_ACK;
1323                         urb->status = 0;
1324                 } else if (usb_pipeout(urb->pipe))
1325                         td->type = USB_PID_OUT;
1326                 else
1327                         td->type = USB_PID_IN;
1328                 break;
1329         case USB_PID_ACK:
1330                 finish = 1;
1331                 if (urb->status == -EINPROGRESS)
1332                         urb->status = 0;
1333                 break;
1334         }
1335
1336         if (finish)
1337                 finish_request(r8a66597, td, 0, urb);
1338         else
1339                 start_transfer(r8a66597, td);
1340 }
1341
1342 static void set_urb_error(struct r8a66597 *r8a66597, u16 pipenum)
1343 {
1344         struct r8a66597_td *td = r8a66597_get_td(r8a66597, pipenum);
1345
1346         if (td && td->urb) {
1347                 u16 pid = r8a66597_read(r8a66597, td->pipe->pipectr) & PID;
1348
1349                 if (pid == PID_NAK)
1350                         td->urb->status = -ECONNRESET;
1351                 else
1352                         td->urb->status = -EPIPE;
1353         }
1354 }
1355
1356 static void irq_pipe_ready(struct r8a66597 *r8a66597)
1357 {
1358         u16 check;
1359         u16 pipenum;
1360         u16 mask;
1361         struct r8a66597_td *td;
1362
1363         mask = r8a66597_read(r8a66597, BRDYSTS)
1364                & r8a66597_read(r8a66597, BRDYENB);
1365         r8a66597_write(r8a66597, (u16)~mask, BRDYSTS);
1366         if (mask & BRDY0) {
1367                 td = r8a66597_get_td(r8a66597, 0);
1368                 if (td && td->type == USB_PID_IN)
1369                         packet_read(r8a66597, 0);
1370                 else
1371                         pipe_irq_disable(r8a66597, 0);
1372                 check_next_phase(r8a66597);
1373         }
1374
1375         for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
1376                 check = 1 << pipenum;
1377                 if (mask & check) {
1378                         td = r8a66597_get_td(r8a66597, pipenum);
1379                         if (unlikely(!td))
1380                                 continue;
1381
1382                         if (td->type == USB_PID_IN)
1383                                 packet_read(r8a66597, pipenum);
1384                         else if (td->type == USB_PID_OUT)
1385                                 packet_write(r8a66597, pipenum);
1386                 }
1387         }
1388 }
1389
1390 static void irq_pipe_empty(struct r8a66597 *r8a66597)
1391 {
1392         u16 tmp;
1393         u16 check;
1394         u16 pipenum;
1395         u16 mask;
1396         struct r8a66597_td *td;
1397
1398         mask = r8a66597_read(r8a66597, BEMPSTS)
1399                & r8a66597_read(r8a66597, BEMPENB);
1400         r8a66597_write(r8a66597, (u16)~mask, BEMPSTS);
1401         if (mask & BEMP0) {
1402                 cfifo_change(r8a66597, 0);
1403                 td = r8a66597_get_td(r8a66597, 0);
1404                 if (td && td->type != USB_PID_OUT)
1405                         disable_irq_empty(r8a66597, 0);
1406                 check_next_phase(r8a66597);
1407         }
1408
1409         for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
1410                 check = 1 << pipenum;
1411                 if (mask &  check) {
1412                         struct r8a66597_td *td;
1413                         td = r8a66597_get_td(r8a66597, pipenum);
1414                         if (unlikely(!td))
1415                                 continue;
1416
1417                         tmp = r8a66597_read(r8a66597, td->pipe->pipectr);
1418                         if ((tmp & INBUFM) == 0) {
1419                                 disable_irq_empty(r8a66597, pipenum);
1420                                 pipe_irq_disable(r8a66597, pipenum);
1421                                 if (td->urb->status == -EINPROGRESS)
1422                                         td->urb->status = 0;
1423                                 finish_request(r8a66597, td, pipenum, td->urb);
1424                         }
1425                 }
1426         }
1427 }
1428
1429 static void irq_pipe_nrdy(struct r8a66597 *r8a66597)
1430 {
1431         u16 check;
1432         u16 pipenum;
1433         u16 mask;
1434
1435         mask = r8a66597_read(r8a66597, NRDYSTS)
1436                & r8a66597_read(r8a66597, NRDYENB);
1437         r8a66597_write(r8a66597, (u16)~mask, NRDYSTS);
1438         if (mask & NRDY0) {
1439                 cfifo_change(r8a66597, 0);
1440                 set_urb_error(r8a66597, 0);
1441                 pipe_irq_disable(r8a66597, 0);
1442                 check_next_phase(r8a66597);
1443         }
1444
1445         for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
1446                 check = 1 << pipenum;
1447                 if (mask & check) {
1448                         struct r8a66597_td *td;
1449                         td = r8a66597_get_td(r8a66597, pipenum);
1450                         if (unlikely(!td))
1451                                 continue;
1452
1453                         set_urb_error(r8a66597, pipenum);
1454                         pipe_irq_disable(r8a66597, pipenum);
1455                         pipe_stop(r8a66597, td->pipe);
1456                         finish_request(r8a66597, td, pipenum, td->urb);
1457                 }
1458         }
1459 }
1460
1461 static void start_root_hub_sampling(struct r8a66597 *r8a66597, int port)
1462 {
1463         struct r8a66597_root_hub *rh = &r8a66597->root_hub[port];
1464
1465         rh->old_syssts = r8a66597_read(r8a66597, get_syssts_reg(port)) & LNST;
1466         rh->scount = R8A66597_MAX_SAMPLING;
1467         mod_timer(&r8a66597->rh_timer, jiffies + msecs_to_jiffies(50));
1468 }
1469
1470 static irqreturn_t r8a66597_irq(struct usb_hcd *hcd)
1471 {
1472         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1473         u16 intsts0, intsts1, intsts2;
1474         u16 intenb0, intenb1, intenb2;
1475         u16 mask0, mask1, mask2;
1476
1477         spin_lock(&r8a66597->lock);
1478
1479         intsts0 = r8a66597_read(r8a66597, INTSTS0);
1480         intsts1 = r8a66597_read(r8a66597, INTSTS1);
1481         intsts2 = r8a66597_read(r8a66597, INTSTS2);
1482         intenb0 = r8a66597_read(r8a66597, INTENB0);
1483         intenb1 = r8a66597_read(r8a66597, INTENB1);
1484         intenb2 = r8a66597_read(r8a66597, INTENB2);
1485
1486         mask2 = intsts2 & intenb2;
1487         mask1 = intsts1 & intenb1;
1488         mask0 = intsts0 & intenb0 & (BEMP | NRDY | BRDY);
1489         if (mask2) {
1490                 if (mask2 & ATTCH) {
1491                         r8a66597_write(r8a66597, (u16)~ATTCH, INTSTS2);
1492                         r8a66597_bclr(r8a66597, ATTCHE, INTENB2);
1493
1494                         /* start usb bus sampling */
1495                         start_root_hub_sampling(r8a66597, 1);
1496                 }
1497                 if (mask2 & DTCH) {
1498                         r8a66597_write(r8a66597, (u16)~DTCH, INTSTS2);
1499                         r8a66597_bclr(r8a66597, DTCHE, INTENB2);
1500                         r8a66597_usb_disconnect(r8a66597, 1);
1501                 }
1502         }
1503
1504         if (mask1) {
1505                 if (mask1 & ATTCH) {
1506                         r8a66597_write(r8a66597, (u16)~ATTCH, INTSTS1);
1507                         r8a66597_bclr(r8a66597, ATTCHE, INTENB1);
1508
1509                         /* start usb bus sampling */
1510                         start_root_hub_sampling(r8a66597, 0);
1511                 }
1512                 if (mask1 & DTCH) {
1513                         r8a66597_write(r8a66597, (u16)~DTCH, INTSTS1);
1514                         r8a66597_bclr(r8a66597, DTCHE, INTENB1);
1515                         r8a66597_usb_disconnect(r8a66597, 0);
1516                 }
1517                 if (mask1 & SIGN) {
1518                         r8a66597_write(r8a66597, (u16)~SIGN, INTSTS1);
1519                         set_urb_error(r8a66597, 0);
1520                         check_next_phase(r8a66597);
1521                 }
1522                 if (mask1 & SACK) {
1523                         r8a66597_write(r8a66597, (u16)~SACK, INTSTS1);
1524                         check_next_phase(r8a66597);
1525                 }
1526         }
1527         if (mask0) {
1528                 if (mask0 & BRDY)
1529                         irq_pipe_ready(r8a66597);
1530                 if (mask0 & BEMP)
1531                         irq_pipe_empty(r8a66597);
1532                 if (mask0 & NRDY)
1533                         irq_pipe_nrdy(r8a66597);
1534         }
1535
1536         spin_unlock(&r8a66597->lock);
1537         return IRQ_HANDLED;
1538 }
1539
1540 /* this function must be called with interrupt disabled */
1541 static void r8a66597_root_hub_control(struct r8a66597 *r8a66597, int port)
1542 {
1543         u16 tmp;
1544         struct r8a66597_root_hub *rh = &r8a66597->root_hub[port];
1545
1546         if (rh->port & (1 << USB_PORT_FEAT_RESET)) {
1547                 unsigned long dvstctr_reg = get_dvstctr_reg(port);
1548
1549                 tmp = r8a66597_read(r8a66597, dvstctr_reg);
1550                 if ((tmp & USBRST) == USBRST) {
1551                         r8a66597_mdfy(r8a66597, UACT, USBRST | UACT,
1552                                       dvstctr_reg);
1553                         mod_timer(&r8a66597->rh_timer,
1554                                   jiffies + msecs_to_jiffies(50));
1555                 } else
1556                         r8a66597_usb_connect(r8a66597, port);
1557         }
1558
1559         if (rh->scount > 0) {
1560                 tmp = r8a66597_read(r8a66597, get_syssts_reg(port)) & LNST;
1561                 if (tmp == rh->old_syssts) {
1562                         rh->scount--;
1563                         if (rh->scount == 0) {
1564                                 if (tmp == FS_JSTS) {
1565                                         r8a66597_bset(r8a66597, HSE,
1566                                                       get_syscfg_reg(port));
1567                                         r8a66597_usb_preconnect(r8a66597, port);
1568                                 } else if (tmp == LS_JSTS) {
1569                                         r8a66597_bclr(r8a66597, HSE,
1570                                                       get_syscfg_reg(port));
1571                                         r8a66597_usb_preconnect(r8a66597, port);
1572                                 } else if (tmp == SE0)
1573                                         r8a66597_bset(r8a66597, ATTCHE,
1574                                                       get_intenb_reg(port));
1575                         } else {
1576                                 mod_timer(&r8a66597->rh_timer,
1577                                           jiffies + msecs_to_jiffies(50));
1578                         }
1579                 } else {
1580                         rh->scount = R8A66597_MAX_SAMPLING;
1581                         rh->old_syssts = tmp;
1582                         mod_timer(&r8a66597->rh_timer,
1583                                   jiffies + msecs_to_jiffies(50));
1584                 }
1585         }
1586 }
1587
1588 static void r8a66597_td_timer(unsigned long _r8a66597)
1589 {
1590         struct r8a66597 *r8a66597 = (struct r8a66597 *)_r8a66597;
1591         unsigned long flags;
1592         u16 pipenum;
1593         struct r8a66597_td *td, *new_td = NULL;
1594         struct r8a66597_pipe *pipe;
1595
1596         spin_lock_irqsave(&r8a66597->lock, flags);
1597         for (pipenum = 0; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
1598                 if (!(r8a66597->timeout_map & (1 << pipenum)))
1599                         continue;
1600                 if (timer_pending(&r8a66597->td_timer[pipenum]))
1601                         continue;
1602
1603                 td = r8a66597_get_td(r8a66597, pipenum);
1604                 if (!td) {
1605                         r8a66597->timeout_map &= ~(1 << pipenum);
1606                         continue;
1607                 }
1608
1609                 if (td->urb->actual_length) {
1610                         set_td_timer(r8a66597, td);
1611                         break;
1612                 }
1613
1614                 pipe = td->pipe;
1615                 pipe_stop(r8a66597, pipe);
1616
1617                 new_td = td;
1618                 do {
1619                         list_move_tail(&new_td->queue,
1620                                        &r8a66597->pipe_queue[pipenum]);
1621                         new_td = r8a66597_get_td(r8a66597, pipenum);
1622                         if (!new_td) {
1623                                 new_td = td;
1624                                 break;
1625                         }
1626                 } while (td != new_td && td->address == new_td->address);
1627
1628                 start_transfer(r8a66597, new_td);
1629
1630                 if (td == new_td)
1631                         r8a66597->timeout_map &= ~(1 << pipenum);
1632                 else
1633                         set_td_timer(r8a66597, new_td);
1634                 break;
1635         }
1636         spin_unlock_irqrestore(&r8a66597->lock, flags);
1637 }
1638
1639 static void r8a66597_timer(unsigned long _r8a66597)
1640 {
1641         struct r8a66597 *r8a66597 = (struct r8a66597 *)_r8a66597;
1642         unsigned long flags;
1643
1644         spin_lock_irqsave(&r8a66597->lock, flags);
1645
1646         r8a66597_root_hub_control(r8a66597, 0);
1647         r8a66597_root_hub_control(r8a66597, 1);
1648
1649         spin_unlock_irqrestore(&r8a66597->lock, flags);
1650 }
1651
1652 static int check_pipe_config(struct r8a66597 *r8a66597, struct urb *urb)
1653 {
1654         struct r8a66597_device *dev = get_urb_to_r8a66597_dev(r8a66597, urb);
1655
1656         if (dev && dev->address && dev->state != USB_STATE_CONFIGURED &&
1657             (urb->dev->state == USB_STATE_CONFIGURED))
1658                 return 1;
1659         else
1660                 return 0;
1661 }
1662
1663 static int r8a66597_start(struct usb_hcd *hcd)
1664 {
1665         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1666         int ret;
1667
1668         hcd->state = HC_STATE_RUNNING;
1669         if ((ret = enable_controller(r8a66597)) < 0)
1670                 return ret;
1671
1672         return 0;
1673 }
1674
1675 static void r8a66597_stop(struct usb_hcd *hcd)
1676 {
1677         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1678
1679         disable_controller(r8a66597);
1680 }
1681
1682 static void set_address_zero(struct r8a66597 *r8a66597, struct urb *urb)
1683 {
1684         unsigned int usb_address = usb_pipedevice(urb->pipe);
1685         u16 root_port, hub_port;
1686
1687         if (usb_address == 0) {
1688                 get_port_number(urb->dev->devpath,
1689                                 &root_port, &hub_port);
1690                 set_devadd_reg(r8a66597, 0,
1691                                get_r8a66597_usb_speed(urb->dev->speed),
1692                                get_parent_r8a66597_address(r8a66597, urb->dev),
1693                                hub_port, root_port);
1694         }
1695 }
1696
1697 static struct r8a66597_td *r8a66597_make_td(struct r8a66597 *r8a66597,
1698                                             struct urb *urb,
1699                                             struct usb_host_endpoint *hep,
1700                                             gfp_t mem_flags)
1701 {
1702         struct r8a66597_td *td;
1703         u16 pipenum;
1704
1705         td = kzalloc(sizeof(struct r8a66597_td), mem_flags);
1706         if (td == NULL)
1707                 return NULL;
1708
1709         pipenum = r8a66597_get_pipenum(urb, hep);
1710         td->pipenum = pipenum;
1711         td->pipe = hep->hcpriv;
1712         td->urb = urb;
1713         td->address = get_urb_to_r8a66597_addr(r8a66597, urb);
1714         td->maxpacket = usb_maxpacket(urb->dev, urb->pipe,
1715                                       !usb_pipein(urb->pipe));
1716         if (usb_pipecontrol(urb->pipe))
1717                 td->type = USB_PID_SETUP;
1718         else if (usb_pipein(urb->pipe))
1719                 td->type = USB_PID_IN;
1720         else
1721                 td->type = USB_PID_OUT;
1722         INIT_LIST_HEAD(&td->queue);
1723
1724         return td;
1725 }
1726
1727 static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
1728                                 struct usb_host_endpoint *hep,
1729                                 struct urb *urb,
1730                                 gfp_t mem_flags)
1731 {
1732         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1733         struct r8a66597_td *td = NULL;
1734         int ret = 0, request = 0;
1735         unsigned long flags;
1736
1737         spin_lock_irqsave(&r8a66597->lock, flags);
1738         if (!get_urb_to_r8a66597_dev(r8a66597, urb)) {
1739                 ret = -ENODEV;
1740                 goto error;
1741         }
1742
1743         if (!hep->hcpriv) {
1744                 hep->hcpriv = kzalloc(sizeof(struct r8a66597_pipe), mem_flags);
1745                 if (!hep->hcpriv) {
1746                         ret = -ENOMEM;
1747                         goto error;
1748                 }
1749                 set_pipe_reg_addr(hep->hcpriv, R8A66597_PIPE_NO_DMA);
1750                 if (usb_pipeendpoint(urb->pipe))
1751                         init_pipe_info(r8a66597, urb, hep, &hep->desc);
1752         }
1753
1754         if (unlikely(check_pipe_config(r8a66597, urb)))
1755                 init_pipe_config(r8a66597, urb);
1756
1757         set_address_zero(r8a66597, urb);
1758         td = r8a66597_make_td(r8a66597, urb, hep, mem_flags);
1759         if (td == NULL) {
1760                 ret = -ENOMEM;
1761                 goto error;
1762         }
1763         if (list_empty(&r8a66597->pipe_queue[td->pipenum]))
1764                 request = 1;
1765         list_add_tail(&td->queue, &r8a66597->pipe_queue[td->pipenum]);
1766
1767         spin_lock(&urb->lock);
1768         if (urb->status != -EINPROGRESS) {
1769                 spin_unlock(&urb->lock);
1770                 ret = -EPIPE;
1771                 goto error;
1772         }
1773         urb->hcpriv = td;
1774         spin_unlock(&urb->lock);
1775
1776         if (request) {
1777                 ret = start_transfer(r8a66597, td);
1778                 if (ret < 0) {
1779                         list_del(&td->queue);
1780                         kfree(td);
1781                 }
1782         } else
1783                 set_td_timer(r8a66597, td);
1784
1785 error:
1786         spin_unlock_irqrestore(&r8a66597->lock, flags);
1787         return ret;
1788 }
1789
1790 static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
1791 {
1792         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1793         struct r8a66597_td *td;
1794         unsigned long flags;
1795
1796         spin_lock_irqsave(&r8a66597->lock, flags);
1797         if (urb->hcpriv) {
1798                 td = urb->hcpriv;
1799                 pipe_stop(r8a66597, td->pipe);
1800                 pipe_irq_disable(r8a66597, td->pipenum);
1801                 disable_irq_empty(r8a66597, td->pipenum);
1802                 done(r8a66597, td, td->pipenum, urb);
1803         }
1804         spin_unlock_irqrestore(&r8a66597->lock, flags);
1805         return 0;
1806 }
1807
1808 static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
1809                                       struct usb_host_endpoint *hep)
1810 {
1811         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1812         struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv;
1813         struct r8a66597_td *td;
1814         struct urb *urb = NULL;
1815         u16 pipenum;
1816         unsigned long flags;
1817
1818         if (pipe == NULL)
1819                 return;
1820         pipenum = pipe->info.pipenum;
1821
1822         if (pipenum == 0) {
1823                 kfree(hep->hcpriv);
1824                 hep->hcpriv = NULL;
1825                 return;
1826         }
1827
1828         spin_lock_irqsave(&r8a66597->lock, flags);
1829         pipe_stop(r8a66597, pipe);
1830         pipe_irq_disable(r8a66597, pipenum);
1831         disable_irq_empty(r8a66597, pipenum);
1832         td = r8a66597_get_td(r8a66597, pipenum);
1833         if (td)
1834                 urb = td->urb;
1835         done(r8a66597, td, pipenum, urb);
1836         kfree(hep->hcpriv);
1837         hep->hcpriv = NULL;
1838         spin_unlock_irqrestore(&r8a66597->lock, flags);
1839 }
1840
1841 static int r8a66597_get_frame(struct usb_hcd *hcd)
1842 {
1843         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1844         return r8a66597_read(r8a66597, FRMNUM) & 0x03FF;
1845 }
1846
1847 static void collect_usb_address_map(struct usb_device *udev, unsigned long *map)
1848 {
1849         int chix;
1850
1851         if (udev->state == USB_STATE_CONFIGURED &&
1852             udev->parent && udev->parent->devnum > 1 &&
1853             udev->parent->descriptor.bDeviceClass == USB_CLASS_HUB)
1854                 map[udev->devnum/32] |= (1 << (udev->devnum % 32));
1855
1856         for (chix = 0; chix < udev->maxchild; chix++) {
1857                 struct usb_device *childdev = udev->children[chix];
1858
1859                 if (childdev)
1860                         collect_usb_address_map(childdev, map);
1861         }
1862 }
1863
1864 /* this function must be called with interrupt disabled */
1865 static struct r8a66597_device *get_r8a66597_device(struct r8a66597 *r8a66597,
1866                                                    int addr)
1867 {
1868         struct r8a66597_device *dev;
1869         struct list_head *list = &r8a66597->child_device;
1870
1871         list_for_each_entry(dev, list, device_list) {
1872                 if (!dev)
1873                         continue;
1874                 if (dev->usb_address != addr)
1875                         continue;
1876
1877                 return dev;
1878         }
1879
1880         err("get_r8a66597_device fail.(%d)\n", addr);
1881         return NULL;
1882 }
1883
1884 static void update_usb_address_map(struct r8a66597 *r8a66597,
1885                                    struct usb_device *root_hub,
1886                                    unsigned long *map)
1887 {
1888         int i, j, addr;
1889         unsigned long diff;
1890         unsigned long flags;
1891
1892         for (i = 0; i < 4; i++) {
1893                 diff = r8a66597->child_connect_map[i] ^ map[i];
1894                 if (!diff)
1895                         continue;
1896
1897                 for (j = 0; j < 32; j++) {
1898                         if (!(diff & (1 << j)))
1899                                 continue;
1900
1901                         addr = i * 32 + j;
1902                         if (map[i] & (1 << j))
1903                                 set_child_connect_map(r8a66597, addr);
1904                         else {
1905                                 struct r8a66597_device *dev;
1906
1907                                 spin_lock_irqsave(&r8a66597->lock, flags);
1908                                 dev = get_r8a66597_device(r8a66597, addr);
1909                                 disable_r8a66597_pipe_all(r8a66597, dev);
1910                                 free_usb_address(r8a66597, dev);
1911                                 put_child_connect_map(r8a66597, addr);
1912                                 spin_unlock_irqrestore(&r8a66597->lock, flags);
1913                         }
1914                 }
1915         }
1916 }
1917
1918 static void r8a66597_check_detect_child(struct r8a66597 *r8a66597,
1919                                         struct usb_hcd *hcd)
1920 {
1921         struct usb_bus *bus;
1922         unsigned long now_map[4];
1923
1924         memset(now_map, 0, sizeof(now_map));
1925
1926         list_for_each_entry(bus, &usb_bus_list, bus_list) {
1927                 if (!bus->root_hub)
1928                         continue;
1929
1930                 if (bus->busnum != hcd->self.busnum)
1931                         continue;
1932
1933                 collect_usb_address_map(bus->root_hub, now_map);
1934                 update_usb_address_map(r8a66597, bus->root_hub, now_map);
1935         }
1936 }
1937
1938 static int r8a66597_hub_status_data(struct usb_hcd *hcd, char *buf)
1939 {
1940         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1941         unsigned long flags;
1942         int i;
1943
1944         r8a66597_check_detect_child(r8a66597, hcd);
1945
1946         spin_lock_irqsave(&r8a66597->lock, flags);
1947
1948         *buf = 0;       /* initialize (no change) */
1949
1950         for (i = 0; i < R8A66597_MAX_ROOT_HUB; i++) {
1951                 if (r8a66597->root_hub[i].port & 0xffff0000)
1952                         *buf |= 1 << (i + 1);
1953         }
1954
1955         spin_unlock_irqrestore(&r8a66597->lock, flags);
1956
1957         return (*buf != 0);
1958 }
1959
1960 static void r8a66597_hub_descriptor(struct r8a66597 *r8a66597,
1961                                     struct usb_hub_descriptor *desc)
1962 {
1963         desc->bDescriptorType = 0x29;
1964         desc->bHubContrCurrent = 0;
1965         desc->bNbrPorts = R8A66597_MAX_ROOT_HUB;
1966         desc->bDescLength = 9;
1967         desc->bPwrOn2PwrGood = 0;
1968         desc->wHubCharacteristics = cpu_to_le16(0x0011);
1969         desc->bitmap[0] = ((1 << R8A66597_MAX_ROOT_HUB) - 1) << 1;
1970         desc->bitmap[1] = ~0;
1971 }
1972
1973 static int r8a66597_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
1974                                 u16 wIndex, char *buf, u16 wLength)
1975 {
1976         struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
1977         int ret;
1978         int port = (wIndex & 0x00FF) - 1;
1979         struct r8a66597_root_hub *rh = &r8a66597->root_hub[port];
1980         unsigned long flags;
1981
1982         ret = 0;
1983
1984         spin_lock_irqsave(&r8a66597->lock, flags);
1985         switch (typeReq) {
1986         case ClearHubFeature:
1987         case SetHubFeature:
1988                 switch (wValue) {
1989                 case C_HUB_OVER_CURRENT:
1990                 case C_HUB_LOCAL_POWER:
1991                         break;
1992                 default:
1993                         goto error;
1994                 }
1995                 break;
1996         case ClearPortFeature:
1997                 if (wIndex > R8A66597_MAX_ROOT_HUB)
1998                         goto error;
1999                 if (wLength != 0)
2000                         goto error;
2001
2002                 switch (wValue) {
2003                 case USB_PORT_FEAT_ENABLE:
2004                         rh->port &= (1 << USB_PORT_FEAT_POWER);
2005                         break;
2006                 case USB_PORT_FEAT_SUSPEND:
2007                         break;
2008                 case USB_PORT_FEAT_POWER:
2009                         r8a66597_port_power(r8a66597, port, 0);
2010                         break;
2011                 case USB_PORT_FEAT_C_ENABLE:
2012                 case USB_PORT_FEAT_C_SUSPEND:
2013                 case USB_PORT_FEAT_C_CONNECTION:
2014                 case USB_PORT_FEAT_C_OVER_CURRENT:
2015                 case USB_PORT_FEAT_C_RESET:
2016                         break;
2017                 default:
2018                         goto error;
2019                 }
2020                 rh->port &= ~(1 << wValue);
2021                 break;
2022         case GetHubDescriptor:
2023                 r8a66597_hub_descriptor(r8a66597,
2024                                         (struct usb_hub_descriptor *)buf);
2025                 break;
2026         case GetHubStatus:
2027                 *buf = 0x00;
2028                 break;
2029         case GetPortStatus:
2030                 if (wIndex > R8A66597_MAX_ROOT_HUB)
2031                         goto error;
2032                 *(u32 *)buf = rh->port;
2033                 break;
2034         case SetPortFeature:
2035                 if (wIndex > R8A66597_MAX_ROOT_HUB)
2036                         goto error;
2037                 if (wLength != 0)
2038                         goto error;
2039
2040                 switch (wValue) {
2041                 case USB_PORT_FEAT_SUSPEND:
2042                         break;
2043                 case USB_PORT_FEAT_POWER:
2044                         r8a66597_port_power(r8a66597, port, 1);
2045                         rh->port |= (1 << USB_PORT_FEAT_POWER);
2046                         break;
2047                 case USB_PORT_FEAT_RESET: {
2048                         struct r8a66597_device *dev = rh->dev;
2049
2050                         rh->port |= (1 << USB_PORT_FEAT_RESET);
2051
2052                         disable_r8a66597_pipe_all(r8a66597, dev);
2053                         free_usb_address(r8a66597, dev);
2054
2055                         r8a66597_mdfy(r8a66597, USBRST, USBRST | UACT,
2056                                       get_dvstctr_reg(port));
2057                         mod_timer(&r8a66597->rh_timer,
2058                                   jiffies + msecs_to_jiffies(50));
2059                         }
2060                         break;
2061                 default:
2062                         goto error;
2063                 }
2064                 rh->port |= 1 << wValue;
2065                 break;
2066         default:
2067 error:
2068                 ret = -EPIPE;
2069                 break;
2070         }
2071
2072         spin_unlock_irqrestore(&r8a66597->lock, flags);
2073         return ret;
2074 }
2075
2076 static struct hc_driver r8a66597_hc_driver = {
2077         .description =          hcd_name,
2078         .hcd_priv_size =        sizeof(struct r8a66597),
2079         .irq =                  r8a66597_irq,
2080
2081         /*
2082          * generic hardware linkage
2083          */
2084         .flags =                HCD_USB2,
2085
2086         .start =                r8a66597_start,
2087         .stop =                 r8a66597_stop,
2088
2089         /*
2090          * managing i/o requests and associated device resources
2091          */
2092         .urb_enqueue =          r8a66597_urb_enqueue,
2093         .urb_dequeue =          r8a66597_urb_dequeue,
2094         .endpoint_disable =     r8a66597_endpoint_disable,
2095
2096         /*
2097          * periodic schedule support
2098          */
2099         .get_frame_number =     r8a66597_get_frame,
2100
2101         /*
2102          * root hub support
2103          */
2104         .hub_status_data =      r8a66597_hub_status_data,
2105         .hub_control =          r8a66597_hub_control,
2106 };
2107
2108 #if defined(CONFIG_PM)
2109 static int r8a66597_suspend(struct platform_device *pdev, pm_message_t state)
2110 {
2111         pdev->dev.power.power_state = state;
2112         return 0;
2113 }
2114
2115 static int r8a66597_resume(struct platform_device *pdev)
2116 {
2117         pdev->dev.power.power_state = PMSG_ON;
2118         return 0;
2119 }
2120 #else   /* if defined(CONFIG_PM) */
2121 #define r8a66597_suspend        NULL
2122 #define r8a66597_resume         NULL
2123 #endif
2124
2125 static int __init_or_module r8a66597_remove(struct platform_device *pdev)
2126 {
2127         struct r8a66597         *r8a66597 = dev_get_drvdata(&pdev->dev);
2128         struct usb_hcd          *hcd = r8a66597_to_hcd(r8a66597);
2129
2130         del_timer_sync(&r8a66597->rh_timer);
2131         iounmap((void *)r8a66597->reg);
2132         usb_remove_hcd(hcd);
2133         usb_put_hcd(hcd);
2134         return 0;
2135 }
2136
2137 #define resource_len(r) (((r)->end - (r)->start) + 1)
2138 static int __init r8a66597_probe(struct platform_device *pdev)
2139 {
2140         struct resource *res = NULL;
2141         int irq = -1;
2142         void __iomem *reg = NULL;
2143         struct usb_hcd *hcd = NULL;
2144         struct r8a66597 *r8a66597;
2145         int ret = 0;
2146         int i;
2147
2148         if (pdev->dev.dma_mask) {
2149                 ret = -EINVAL;
2150                 err("dma not support");
2151                 goto clean_up;
2152         }
2153
2154         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
2155                                            (char *)hcd_name);
2156         if (!res) {
2157                 ret = -ENODEV;
2158                 err("platform_get_resource_byname error.");
2159                 goto clean_up;
2160         }
2161
2162         irq = platform_get_irq(pdev, 0);
2163         if (irq < 0) {
2164                 ret = -ENODEV;
2165                 err("platform_get_irq error.");
2166                 goto clean_up;
2167         }
2168
2169         reg = ioremap(res->start, resource_len(res));
2170         if (reg == NULL) {
2171                 ret = -ENOMEM;
2172                 err("ioremap error.");
2173                 goto clean_up;
2174         }
2175
2176         /* initialize hcd */
2177         hcd = usb_create_hcd(&r8a66597_hc_driver, &pdev->dev, (char *)hcd_name);
2178         if (!hcd) {
2179                 ret = -ENOMEM;
2180                 err("Failed to create hcd");
2181                 goto clean_up;
2182         }
2183         r8a66597 = hcd_to_r8a66597(hcd);
2184         memset(r8a66597, 0, sizeof(struct r8a66597));
2185         dev_set_drvdata(&pdev->dev, r8a66597);
2186
2187         spin_lock_init(&r8a66597->lock);
2188         init_timer(&r8a66597->rh_timer);
2189         r8a66597->rh_timer.function = r8a66597_timer;
2190         r8a66597->rh_timer.data = (unsigned long)r8a66597;
2191         r8a66597->reg = (unsigned long)reg;
2192
2193         for (i = 0; i < R8A66597_MAX_NUM_PIPE; i++) {
2194                 INIT_LIST_HEAD(&r8a66597->pipe_queue[i]);
2195                 init_timer(&r8a66597->td_timer[i]);
2196                 r8a66597->td_timer[i].function = r8a66597_td_timer;
2197                 r8a66597->td_timer[i].data = (unsigned long)r8a66597;
2198         }
2199         INIT_LIST_HEAD(&r8a66597->child_device);
2200
2201         hcd->rsrc_start = res->start;
2202         ret = usb_add_hcd(hcd, irq, 0);
2203         if (ret != 0) {
2204                 err("Failed to add hcd");
2205                 goto clean_up;
2206         }
2207
2208         return 0;
2209
2210 clean_up:
2211         if (reg)
2212                 iounmap(reg);
2213         if (res)
2214                 release_mem_region(res->start, 1);
2215
2216         return ret;
2217 }
2218
2219 static struct platform_driver r8a66597_driver = {
2220         .probe =        r8a66597_probe,
2221         .remove =       r8a66597_remove,
2222         .suspend =      r8a66597_suspend,
2223         .resume =       r8a66597_resume,
2224         .driver         = {
2225                 .name = (char *) hcd_name,
2226         },
2227 };
2228
2229 static int __init r8a66597_init(void)
2230 {
2231         if (usb_disabled())
2232                 return -ENODEV;
2233
2234         info("driver %s, %s", hcd_name, DRIVER_VERSION);
2235         return platform_driver_register(&r8a66597_driver);
2236 }
2237 module_init(r8a66597_init);
2238
2239 static void __exit r8a66597_cleanup(void)
2240 {
2241         platform_driver_unregister(&r8a66597_driver);
2242 }
2243 module_exit(r8a66597_cleanup);
2244