keyspan_pda: use request_firmware()

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

6 files changed, 2502 insertions, 0 deletions

diff --git a/firmware/Makefile b/firmware/Makefile
index db1b01a7a66..dd76fa5ab3f 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -49,6 +49,8 @@ fw-shipped- := keyspan/mpr.fw keyspan/usa18x.fw keyspan/usa19.fw	\
 	keyspan/usa28.fw keyspan/usa28xa.fw keyspan/usa28xb.fw		\
 	keyspan/usa28x.fw keyspan/usa49w.fw keyspan/usa49wlc.fw
 endif
+fw-shipped-$(CONFIG_USB_SERIAL_KEYSPAN_PDA) += keyspan_pda/keyspan_pda.fw
+fw-shipped-$(CONFIG_USB_SERIAL_XIRCOM) += keyspan_pda/xircom_pgs.fw
 
 fw-shipped-all := $(fw-shipped-y) $(fw-shipped-m) $(fw-shipped-)
 
diff --git a/firmware/WHENCE b/firmware/WHENCE
index d66291a78f0..b5be4bc8800 100644
--- a/firmware/WHENCE
+++ b/firmware/WHENCE
@@ -119,3 +119,17 @@ Original licence information:
 	part, requires the inclusion of this statement."
 
 --------------------------------------------------------------------------
+
+Driver: keyspan_pda -- USB Keyspan PDA single-port serial device
+
+File: keyspan_pda/keyspan_pda.fw
+Source: keyspan_pda/keyspan_pda.S
+
+File: keyspan_pda/xircom_pgs.fw
+Source: keyspan_pda/xircom_pgs.S
+
+Licence: GPLv2+
+
+Compiled from original 8051 source into Intel HEX, used in our binary ihex form.
+
+--------------------------------------------------------------------------
diff --git a/firmware/keyspan_pda/keyspan_pda.HEX b/firmware/keyspan_pda/keyspan_pda.HEX
new file mode 100644
index 00000000000..6fcf02bb4b2
--- /dev/null
+++ b/firmware/keyspan_pda/keyspan_pda.HEX
@@ -0,0 +1,83 @@
+:03000000020200F9
+:0400230002055F0073
+:0400430002010000B6
+:050030000000000000CB
+:10010000020296000200000002000000020000004F
+:1001100002000000020000000200000002000000D7
+:1001200002000000020000000204610002048900D5
+:1002000075815EE4F532F533F530F531F534C20031
+:10021000C201A90074FE901000F0A3D9FC74FD90F7
+:100220001100F0A3D9FC7402907F9DF07400907FC0
+:1002300097F07486907F9EF0907F957403F0907F86
+:10024000AFE0D2E0F07401907FABF0907FAEF09021
+:100250007FAC7404F0907FAD7404F0907FC9F074AB
+:1002600084907F98F07400F59875C8307B059120D4
+:10027000D2CA759850D2E8D2AFD2AC7400F586904D
+:100280007FD67402F0792E7A007B00DBFEDAFAD991
+:10029000F67406F080FEC086C082C083C084C0852C
+:1002A000C0E0E591C2E4F591907FAB7401F0907FDE
+:1002B000E8E0F9A3E0FAA3E0FBA3E0FCE95460B4B2
+:1002C0000003020339B4406EBA000B12042040034D
+:1002D00002040202040ABA010302040ABA02030277
+:1002E000040ABA0303020444BA041EBB000A907F46
+:1002F00095E04402F0020402907F98E054FDF090F3
+:100300007F95E054FDF0020402BA050302040ABA24
+:100310000619BB0008E533D395320203DEBB0108A2
+:10032000E532C395330203DE02040ABA07058B34B3
+:1003300002040202040A02040ABA0020B9801090E2
+:100340007F00E4F0A3F0907FB57402F0020402B9DC
+:10035000820280EBB9810280E602040ABA010FBB77
+:10036000000302040ABB010302040202040ABA03E6
+:100370000FBB000302040ABB010302040202040AC9
+:10038000BA0656BC010F907FD47406F0907FD574E6
+:1003900012F0020402BC0212BB006F907FD47406FC
+:1003A000F0907FD57424F0020402BC03297404C3C6
+:1003B0009B40576055EB2B9006442582F5827400D4
+:1003C0003583F583E0F9A3E0FA907FD4E9F0907FDC
+:1003D000D5EAF002040202040ABA080F7401907F01
+:1003E00000F07401907FB5F0020402BA0903020420
+:1003F00002BA0A0574000203DEBA0B030204020209
+:10040000040A907FB47402F08009907FB4E0440144
+:10041000F08000D0E0D085D084D083D082D08632E6
+:10042000EB20E71EC3940A5019EB2324FEF58274D7
+:10043000053400F583E0F5CBF5CDA3E0F5CAF5CCA6
+:10044000C322D322B94111EB64FF5484FB907F98FF
+:10045000E0547B4BF0020402907F9BE064FF0203B8
+:10046000DEC086C082C083C084C085C0E0E591C282
+:10047000E4F591907FA97404F01205A0D0E0D08536
+:10048000D084D083D082D08632C086C082C083C060
+:1004900084C085C0E0E591C2E4F591907FAA740420
+:1004A000F0907FC9E0F9E4F586907DC075851085F0
+:1004B0003284E005860584F0E584B53302800905C1
+:1004C000320586A3D9EC8000907FC9F0B131D0E02D
+:1004D000D085D084D083D082D08632E4F586907FD8
+:1004E000BCE020E14B907D00E532F0A3E533F0A3C2
+:1004F000E530F0A3E531F0A3E430000104F0A305FA
+:10050000869010007910E0A30586F0A30586D9F641
+:10051000058674FCF0A305869011007910E0A30510
+:1005200086F0A30586D9F6E4F586907FBD7426F0A3
+:1005300022200013E532B53301220533758310857F
+:100540003382E0F599D2007400B5340122E533D34B
+:100550009532C3953440F5753400D2010205A0C030
+:1005600086C082C083C084C085C0E0309907C2992C
+:10057000C20012053430980512058AC298D0E0D026
+:1005800085D084D083D082D0863275831185308225
+:100590000582E599F0E582B53101220530B1A0224E
+:1005A000907FB8E020E138200136E530B5310122F6
+:1005B000E4F5867583110586907E00F0A3058679A3
+:1005C00001E530B5310280100531853182E00586C4
+:1005D000F0A3058609B940E9907FB9E96001F022EE
+:1005E000C201E4F586907E007401F0A37402F090DD
+:1005F0007FB9F022C299F5993099FDC29922E55E42
+:10060000F63CFD8FFEC8FF64FFB2FFD9FFEDFFF39C
+:10061000FFFA12010001FFFFFF40CD06040189AB84
+:1006200001020301090220000101008032090400D7
+:100630000002FFFFFF0007058203400001070502DB
+:1006400002400000064C0650067206A0040300009B
+:100650002203410043004D00450020007500730057
+:100660006200200077006900640067006500740084
+:1006700073002E03410043004D004500200055004B
+:1006800053004200200073006500720069006100A1
+:100690006C0020007700690064006700650074004A
+:0606A000060334003700E0
+:00000001FF
diff --git a/firmware/keyspan_pda/keyspan_pda.S b/firmware/keyspan_pda/keyspan_pda.S
new file mode 100644
index 00000000000..418fe69aa5e
--- /dev/null
+++ b/firmware/keyspan_pda/keyspan_pda.S
@@ -0,0 +1,1124 @@
+/*  $Id: loop.s,v 1.23 2000/03/20 09:49:06 warner Exp $
+ * 
+ *  Firmware for the Keyspan PDA Serial Adapter, a USB serial port based on
+ *  the EzUSB microcontroller.
+ * 
+ *  (C) Copyright 2000 Brian Warner <warner@lothar.com>
+ * 
+ * 	This program is free software; you can redistribute it and/or modify
+ * 	it under the terms of the GNU General Public License as published by
+ * 	the Free Software Foundation; either version 2 of the License, or
+ * 	(at your option) any later version.
+ * 
+ *  "Keyspan PDA Serial Adapter" is probably a copyright of Keyspan, the
+ *  company.
+ * 
+ *  This serial adapter is basically an EzUSB chip and an RS-232 line driver
+ *  in a little widget that has a DB-9 on one end and a USB plug on the other.
+ *  It uses the EzUSB's internal UART0 (using the pins from Port C) and timer2
+ *  as a baud-rate generator. The wiring is:
+ *   PC0/RxD0 <- rxd (DB9 pin 2)         PC4 <- dsr pin 6
+ *   PC1/TxD0 -> txd pin 3               PC5 <- ri  pin 9
+ *   PC2      -> rts pin 7               PC6 <- dcd pin 1
+ *   PC3      <- cts pin 8               PC7 -> dtr pin 4
+ *   PB1 -> line driver standby
+ *
+ *  The EzUSB register constants below come from their excellent documentation
+ *  and sample code (which used to be available at www.anchorchips.com, but
+ *  that has now been absorbed into Cypress' site and the CD-ROM contents
+ *  don't appear to be available online anymore). If we get multiple
+ *  EzUSB-based drivers into the kernel, it might be useful to pull them out
+ *  into a separate .h file.
+ * 
+ * THEORY OF OPERATION:
+ *
+ *   There are two 256-byte ring buffers, one for tx, one for rx.
+ *
+ *   EP2out is pure tx data. When it appears, the data is copied into the tx
+ *   ring and serial transmission is started if it wasn't already running. The
+ *   "tx buffer empty" interrupt may kick off another character if the ring
+ *   still has data. If the host is tx-blocked because the ring filled up,
+ *   it will request a "tx unthrottle" interrupt. If sending a serial character
+ *   empties the ring below the desired threshold, we set a bit that will send
+ *   up the tx unthrottle message as soon as the rx buffer becomes free.
+ *
+ *   EP2in (interrupt) is used to send both rx chars and rx status messages
+ *   (only "tx unthrottle" at this time) back up to the host. The first byte
+ *   of the rx message indicates data (0) or status msg (1). Status messages
+ *   are sent before any data.
+ *
+ *   Incoming serial characters are put into the rx ring by the serial
+ *   interrupt, and the EP2in buffer sent if it wasn't already in transit.
+ *   When the EP2in buffer returns, the interrupt prompts us to send more
+ *   rx chars (or status messages) if they are pending.
+ *
+ *   Device control happens through "vendor specific" control messages on EP0.
+ *   All messages are destined for the "Interface" (with the index always 0,
+ *   so that if their two-port device might someday use similar firmware, we
+ *   can use index=1 to refer to the second port). The messages defined are:
+ *
+ *    bRequest = 0 : set baud/bits/parity
+ *               1 : unused
+ *               2 : reserved for setting HW flow control (CTSRTS)
+ *               3 : get/set "modem info" (pin states: DTR, RTS, DCD, RI, etc)
+ *               4 : set break (on/off)
+ *               5 : reserved for requesting interrupts on pin state change
+ *               6 : query buffer room or chars in tx buffer
+ *               7 : request tx unthrottle interrupt
+ *
+ *  The host-side driver is set to recognize the device ID values stashed in
+ *  serial EEPROM (0x06cd, 0x0103), program this firmware into place, then
+ *  start it running. This firmware will use EzUSB's "renumeration" trick by
+ *  simulating a bus disconnect, then reconnect with a different device ID
+ *  (encoded in the desc_device descriptor below). The host driver then
+ *  recognizes the new device ID and glues it to the real serial driver code.
+ *
+ * USEFUL DOCS:
+ *  EzUSB Technical Reference Manual: <http://www.anchorchips.com>
+ *  8051 manuals: everywhere, but try www.dalsemi.com because the EzUSB is
+ *   basically the Dallas enhanced 8051 code. Remember that the EzUSB IO ports
+ *   use totally different registers!
+ *  USB 1.1 spec: www.usb.org
+ *
+ * HOW TO BUILD:
+ *  gcc -x assembler-with-cpp -P -E -o keyspan_pda.asm keyspan_pda.s
+ *  as31 -l keyspan_pda.asm
+ *  mv keyspan_pda.obj keyspan_pda.hex
+ *  perl ezusb_convert.pl keyspan_pda < keyspan_pda.hex > keyspan_pda_fw.h
+ * Get as31 from <http://www.pjrc.com/tech/8051/index.html>, and hack on it
+ * a bit to make it build.
+ *
+ * THANKS:
+ *  Greg Kroah-Hartman, for coordinating the whole usb-serial thing.
+ *  AnchorChips, for making such an incredibly useful little microcontroller.
+ *  KeySpan, for making a handy, cheap ($40) widget that was so easy to take
+ *           apart and trace with an ohmmeter.
+ *
+ * TODO:
+ *  lots. grep for TODO. Interrupt safety needs stress-testing. Better flow
+ *  control. Interrupting host upon change in DCD, etc, counting transitions.
+ *  Need to find a safe device id to use (the one used by the Keyspan firmware
+ *  under Windows would be ideal.. can anyone figure out what it is?). Parity.
+ *  More baud rates. Oh, and the string-descriptor-length silicon bug
+ *  workaround should be implemented, but I'm lazy, and the consequence is
+ *  that the device name strings that show up in your kernel log will have
+ *  lots of trailing binary garbage in them (appears as ????). Device strings
+ *  should be made more accurate.
+ *
+ * Questions, bugs, patches to Brian.
+ *
+ *  -Brian Warner <warner@lothar.com>
+ *
+ */
+	
+#define HIGH(x) (((x) & 0xff00) / 256)
+#define LOW(x) ((x) & 0xff)
+
+#define dpl1 0x84
+#define dph1 0x85
+#define dps 0x86
+
+;;; our bit assignments
+#define TX_RUNNING 0
+#define DO_TX_UNTHROTTLE 1
+	
+	;; stack from 0x60 to 0x7f: should really set SP to 0x60-1, not 0x60
+#define STACK #0x60-1
+
+#define EXIF 0x91
+#define EIE 0xe8
+	.flag EUSB, EIE.0
+	.flag ES0, IE.4
+
+#define EP0CS #0x7fb4
+#define EP0STALLbit #0x01
+#define IN0BUF #0x7f00
+#define IN0BC #0x7fb5
+#define OUT0BUF #0x7ec0
+#define OUT0BC #0x7fc5		
+#define IN2BUF #0x7e00
+#define IN2BC #0x7fb9
+#define IN2CS #0x7fb8
+#define OUT2BC #0x7fc9
+#define OUT2CS #0x7fc8
+#define OUT2BUF #0x7dc0
+#define IN4BUF #0x7d00
+#define IN4BC #0x7fbd
+#define IN4CS #0x7fbc
+#define OEB #0x7f9d
+#define OUTB #0x7f97
+#define OEC #0x7f9e
+#define OUTC #0x7f98
+#define PINSC #0x7f9b
+#define PORTCCFG #0x7f95
+#define IN07IRQ #0x7fa9
+#define OUT07IRQ #0x7faa
+#define IN07IEN #0x7fac
+#define OUT07IEN #0x7fad
+#define USBIRQ #0x7fab
+#define USBIEN #0x7fae
+#define USBBAV #0x7faf
+#define USBCS #0x7fd6
+#define SUDPTRH #0x7fd4
+#define SUDPTRL #0x7fd5
+#define SETUPDAT #0x7fe8
+		
+	;; usb interrupt : enable is EIE.0 (0xe8), flag is EXIF.4 (0x91)
+
+	.org 0
+	ljmp start
+	;; interrupt vectors
+	.org 23H
+	ljmp serial_int
+	.byte 0
+	
+	.org 43H
+	ljmp USB_Jump_Table
+	.byte 0			; filled in by the USB core
+
+;;; local variables. These are not initialized properly: do it by hand.
+	.org 30H
+rx_ring_in:	.byte 0
+rx_ring_out:	.byte 0
+tx_ring_in:	.byte 0
+tx_ring_out:	.byte 0
+tx_unthrottle_threshold:	.byte 0
+		
+	.org 0x100H		; wants to be on a page boundary
+USB_Jump_Table:
+	ljmp	ISR_Sudav	; Setup Data Available
+	.byte 0
+	ljmp	0		; Start of Frame
+	.byte 0
+	ljmp	0		; Setup Data Loading
+	.byte 0
+	ljmp	0		; Global Suspend
+	.byte 	0
+	ljmp	0		; USB Reset  	
+	.byte	0
+	ljmp	0		; Reserved
+	.byte	0
+	ljmp	0		; End Point 0 In
+	.byte	0
+	ljmp	0		; End Point 0 Out
+	.byte	0
+	ljmp	0		; End Point 1 In
+	.byte	0
+	ljmp	0		; End Point 1 Out
+	.byte	0
+	ljmp	ISR_Ep2in
+	.byte	0
+	ljmp	ISR_Ep2out
+	.byte	0
+
+
+	.org 0x200
+		
+start:	mov SP,STACK-1 ; set stack
+	;; clear local variables
+	clr a
+	mov tx_ring_in, a
+	mov tx_ring_out, a
+	mov rx_ring_in, a
+	mov rx_ring_out, a
+	mov tx_unthrottle_threshold, a
+	clr TX_RUNNING
+	clr DO_TX_UNTHROTTLE
+	
+	;; clear fifo with "fe"
+	mov r1, 0
+	mov a, #0xfe
+	mov dptr, #tx_ring
+clear_tx_ring_loop:
+	movx @dptr, a
+	inc dptr
+	djnz r1, clear_tx_ring_loop
+
+	mov a, #0xfd
+	mov dptr, #rx_ring
+clear_rx_ring_loop:
+	movx @dptr, a
+	inc dptr
+	djnz r1, clear_rx_ring_loop
+
+;;; turn on the RS-232 driver chip (bring the STANDBY pin low)
+	;; set OEB.1
+	mov a, #02H
+	mov dptr,OEB
+	movx @dptr,a
+	;; clear PB1
+	mov a, #00H
+	mov dptr,OUTB
+	movx @dptr,a
+	;; set OEC.[127]
+	mov a, #0x86
+	mov dptr,OEC
+	movx @dptr,a
+	;; set PORTCCFG.[01] to route TxD0,RxD0 to serial port
+	mov dptr, PORTCCFG
+	mov a, #0x03
+	movx @dptr, a
+	
+	;; set up interrupts, autovectoring
+	mov dptr, USBBAV
+	movx a,@dptr
+	setb acc.0		; AVEN bit to 0
+	movx @dptr, a
+
+	mov a,#0x01		; enable SUDAV:	setup data available (for ep0)
+	mov dptr, USBIRQ
+	movx @dptr, a		; clear SUDAVI
+	mov dptr, USBIEN
+	movx @dptr, a
+	
+	mov dptr, IN07IEN
+	mov a,#0x04		; enable IN2 int
+	movx @dptr, a
+	
+	mov dptr, OUT07IEN
+	mov a,#0x04		; enable OUT2 int
+	movx @dptr, a
+	mov dptr, OUT2BC
+	movx @dptr, a		; arm OUT2
+
+	mov a, #0x84		; turn on RTS, DTR
+	mov dptr,OUTC
+	movx @dptr, a
+	;; setup the serial port. 9600 8N1.
+	mov a,#01010011		; mode 1, enable rx, clear int
+	mov SCON, a
+	;;  using timer2, in 16-bit baud-rate-generator mode
+	;;   (xtal 12MHz, internal fosc 24MHz)
+	;;  RCAP2H,RCAP2L = 65536 - fosc/(32*baud)
+	;;  57600: 0xFFF2.F, say 0xFFF3
+	;;   9600: 0xFFB1.E, say 0xFFB2
+	;;    300: 0xF63C
+#define BAUD 9600
+#define BAUD_TIMEOUT(rate) (65536 - (24 * 1000 * 1000) / (32 * rate))
+#define BAUD_HIGH(rate) HIGH(BAUD_TIMEOUT(rate))
+#define BAUD_LOW(rate) LOW(BAUD_TIMEOUT(rate))
+		
+	mov T2CON, #030h	; rclk=1,tclk=1,cp=0,tr2=0(enable later)
+	mov r3, #5
+	acall set_baud
+	setb TR2
+	mov SCON, #050h
+	
+#if 0
+	mov r1, #0x40
+	mov a, #0x41
+send:	
+	mov SBUF, a
+	inc a
+	anl a, #0x3F
+	orl a, #0x40
+;	xrl a, #0x02
+wait1:	
+	jnb TI, wait1
+	clr TI
+	djnz r1, send
+;done:	sjmp done
+
+#endif
+	
+	setb EUSB
+	setb EA
+	setb ES0
+	;acall dump_stat
+
+	;; hey, what say we RENUMERATE! (TRM p.62)
+	mov a, #0
+	mov dps, a
+	mov dptr, USBCS
+	mov a, #0x02		; DISCON=0, DISCOE=0, RENUM=1
+	movx @dptr, a
+	;; now presence pin is floating, simulating disconnect. wait 0.5s
+	mov r1, #46
+renum_wait1:
+	mov r2, #0
+renum_wait2:
+	mov r3, #0
+renum_wait3:
+	djnz r3, renum_wait3
+	djnz r2, renum_wait2
+	djnz r1, renum_wait1	; wait about n*(256^2) 6MHz clocks
+	mov a, #0x06		; DISCON=0, DISCOE=1, RENUM=1
+	movx @dptr, a
+	;; we are back online. the host device will now re-query us
+	
+	
+main:	sjmp main
+
+	
+
+ISR_Sudav:
+	push dps
+	push dpl
+	push dph
+	push dpl1
+	push dph1
+	push acc
+	mov a,EXIF
+	clr acc.4
+	mov EXIF,a		; clear INT2 first
+	mov dptr, USBIRQ	; clear USB int
+	mov a,#01h
+	movx @dptr,a
+
+	;; get request type
+	mov dptr, SETUPDAT
+	movx a, @dptr
+	mov r1, a		; r1 = bmRequestType
+	inc dptr
+	movx a, @dptr
+	mov r2, a		; r2 = bRequest
+	inc dptr
+	movx a, @dptr
+	mov r3, a		; r3 = wValueL
+	inc dptr
+	movx a, @dptr
+	mov r4, a		; r4 = wValueH
+
+	;; main switch on bmRequest.type: standard or vendor
+	mov a, r1
+	anl a, #0x60
+	cjne a, #0x00, setup_bmreq_type_not_standard
+	;; standard request: now main switch is on bRequest
+	ljmp setup_bmreq_is_standard
+	
+setup_bmreq_type_not_standard:	
+	;; a still has bmreq&0x60
+	cjne a, #0x40, setup_bmreq_type_not_vendor
+	;; Anchor reserves bRequest 0xa0-0xaf, we use small ones
+	;; switch on bRequest. bmRequest will always be 0x41 or 0xc1
+	cjne r2, #0x00, setup_ctrl_not_00
+	;; 00 is set baud, wValue[0] has baud rate index
+	lcall set_baud		; index in r3, carry set if error
+	jc setup_bmreq_type_not_standard__do_stall
+	ljmp setup_done_ack
+setup_bmreq_type_not_standard__do_stall:
+	ljmp setup_stall
+setup_ctrl_not_00:
+	cjne r2, #0x01, setup_ctrl_not_01
+	;; 01 is reserved for set bits (parity). TODO
+	ljmp setup_stall
+setup_ctrl_not_01:
+	cjne r2, #0x02, setup_ctrl_not_02
+	;; 02 is set HW flow control. TODO
+	ljmp setup_stall
+setup_ctrl_not_02:
+	cjne r2, #0x03, setup_ctrl_not_03
+	;; 03 is control pins (RTS, DTR).
+	ljmp control_pins	; will jump to setup_done_ack,
+				;  or setup_return_one_byte
+setup_ctrl_not_03:
+	cjne r2, #0x04, setup_ctrl_not_04
+	;; 04 is send break (really "turn break on/off"). TODO
+	cjne r3, #0x00, setup_ctrl_do_break_on
+	;; do break off: restore PORTCCFG.1 to reconnect TxD0 to serial port
+	mov dptr, PORTCCFG
+	movx a, @dptr
+	orl a, #0x02
+	movx @dptr, a
+	ljmp setup_done_ack
+setup_ctrl_do_break_on:
+	;; do break on: clear PORTCCFG.0, set TxD high(?) (b1 low)
+	mov dptr, OUTC
+	movx a, @dptr
+	anl a, #0xfd		; ~0x02
+	movx @dptr, a
+	mov dptr, PORTCCFG
+	movx a, @dptr
+	anl a, #0xfd		; ~0x02
+	movx @dptr, a
+	ljmp setup_done_ack
+setup_ctrl_not_04:
+	cjne r2, #0x05, setup_ctrl_not_05
+	;; 05 is set desired interrupt bitmap. TODO
+	ljmp setup_stall
+setup_ctrl_not_05:
+	cjne r2, #0x06, setup_ctrl_not_06
+	;; 06 is query room
+	cjne r3, #0x00, setup_ctrl_06_not_00
+	;; 06, wValue[0]=0 is query write_room
+	mov a, tx_ring_out
+	setb c
+	subb a, tx_ring_in	; out-1-in = 255 - (in-out)
+	ljmp setup_return_one_byte
+setup_ctrl_06_not_00:
+	cjne r3, #0x01, setup_ctrl_06_not_01
+	;; 06, wValue[0]=1 is query chars_in_buffer
+	mov a, tx_ring_in
+	clr c
+	subb a, tx_ring_out	; in-out
+	ljmp setup_return_one_byte
+setup_ctrl_06_not_01:	
+	ljmp setup_stall
+setup_ctrl_not_06:
+	cjne r2, #0x07, setup_ctrl_not_07
+	;; 07 is request tx unthrottle interrupt
+	mov tx_unthrottle_threshold, r3; wValue[0] is threshold value
+	ljmp setup_done_ack
+setup_ctrl_not_07:
+	ljmp setup_stall
+	
+setup_bmreq_type_not_vendor:
+	ljmp setup_stall
+
+
+setup_bmreq_is_standard:	
+	cjne r2, #0x00, setup_breq_not_00
+	;; 00:	Get_Status (sub-switch on bmRequestType: device, ep, int)
+	cjne r1, #0x80, setup_Get_Status_not_device
+	;; Get_Status(device)
+	;;  are we self-powered? no. can we do remote wakeup? no
+	;;   so return two zero bytes. This is reusable
+setup_return_two_zero_bytes:
+	mov dptr, IN0BUF
+	clr a
+	movx @dptr, a
+	inc dptr
+	movx @dptr, a
+	mov dptr, IN0BC
+	mov a, #2
+	movx @dptr, a
+	ljmp setup_done_ack
+setup_Get_Status_not_device:
+	cjne r1, #0x82, setup_Get_Status_not_endpoint
+	;; Get_Status(endpoint)
+	;;  must get stall bit for ep[wIndexL], return two bytes, bit in lsb 0
+	;; for now: cheat. TODO
+	sjmp setup_return_two_zero_bytes
+setup_Get_Status_not_endpoint:
+	cjne r1, #0x81, setup_Get_Status_not_interface
+	;; Get_Status(interface): return two zeros
+	sjmp setup_return_two_zero_bytes
+setup_Get_Status_not_interface:	
+	ljmp setup_stall
+	
+setup_breq_not_00:
+	cjne r2, #0x01, setup_breq_not_01
+	;; 01:	Clear_Feature (sub-switch on wValueL: stall, remote wakeup)
+	cjne r3, #0x00, setup_Clear_Feature_not_stall
+	;; Clear_Feature(stall). should clear a stall bit. TODO
+	ljmp setup_stall
+setup_Clear_Feature_not_stall:
+	cjne r3, #0x01, setup_Clear_Feature_not_rwake
+	;; Clear_Feature(remote wakeup). ignored.
+	ljmp setup_done_ack
+setup_Clear_Feature_not_rwake:
+	ljmp setup_stall
+	
+setup_breq_not_01:
+	cjne r2, #0x03, setup_breq_not_03
+	;; 03:	Set_Feature (sub-switch on wValueL: stall, remote wakeup)
+	cjne r3, #0x00, setup_Set_Feature_not_stall
+	;; Set_Feature(stall). Should set a stall bit. TODO
+	ljmp setup_stall
+setup_Set_Feature_not_stall:
+	cjne r3, #0x01, setup_Set_Feature_not_rwake
+	;; Set_Feature(remote wakeup). ignored.
+	ljmp setup_done_ack
+setup_Set_Feature_not_rwake:
+	ljmp setup_stall
+	
+setup_breq_not_03:	
+	cjne r2, #0x06, setup_breq_not_06
+	;; 06:	Get_Descriptor (s-switch on wValueH: dev, config[n], string[n])
+	cjne r4, #0x01, setup_Get_Descriptor_not_device
+	;; Get_Descriptor(device)
+	mov dptr, SUDPTRH
+	mov a, #HIGH(desc_device)
+	movx @dptr, a
+	mov dptr, SUDPTRL
+	mov a, #LOW(desc_device)
+	movx @dptr, a
+	ljmp setup_done_ack
+setup_Get_Descriptor_not_device:
+	cjne r4, #0x02, setup_Get_Descriptor_not_config
+	;; Get_Descriptor(config[n])
+	cjne r3, #0x00, setup_stall; only handle n==0
+	;; Get_Descriptor(config[0])
+	mov dptr, SUDPTRH
+	mov a, #HIGH(desc_config1)
+	movx @dptr, a
+	mov dptr, SUDPTRL
+	mov a, #LOW(desc_config1)
+	movx @dptr, a
+	ljmp setup_done_ack
+setup_Get_Descriptor_not_config:
+	cjne r4, #0x03, setup_Get_Descriptor_not_string
+	;; Get_Descriptor(string[wValueL])
+	;;  if (wValueL >= maxstrings) stall
+	mov a, #((desc_strings_end-desc_strings)/2)
+	clr c
+	subb a,r3		; a=4, r3 = 0..3 . if a<=0 then stall
+	jc  setup_stall
+	jz  setup_stall
+	mov a, r3
+	add a, r3		; a = 2*wValueL
+	mov dptr, #desc_strings
+	add a, dpl
+	mov dpl, a
+	mov a, #0
+	addc a, dph
+	mov dph, a		; dph = desc_strings[a]. big endian! (handy)
+	;; it looks like my adapter uses a revision of the EZUSB that
+	;; contains "rev D errata number 8", as hinted in the EzUSB example
+	;; code. I cannot find an actual errata description on the Cypress
+	;; web site, but from the example code it looks like this bug causes
+	;; the length of string descriptors to be read incorrectly, possibly
+	;; sending back more characters than the descriptor has. The workaround
+	;; is to manually send out all of the data. The consequence of not
+	;; using the workaround is that the strings gathered by the kernel
+	;; driver are too long and are filled with trailing garbage (including
+	;; leftover strings). Writing this out by hand is a nuisance, so for
+	;; now I will just live with the bug.
+	movx a, @dptr
+	mov r1, a
+	inc dptr
+	movx a, @dptr
+	mov r2, a
+	mov dptr, SUDPTRH
+	mov a, r1
+	movx @dptr, a
+	mov dptr, SUDPTRL
+	mov a, r2
+	movx @dptr, a
+	;; done
+	ljmp setup_done_ack
+	
+setup_Get_Descriptor_not_string:
+	ljmp setup_stall
+	
+setup_breq_not_06:
+	cjne r2, #0x08, setup_breq_not_08
+	;; Get_Configuration. always 1. return one byte.
+	;; this is reusable
+	mov a, #1
+setup_return_one_byte:	
+	mov dptr, IN0BUF
+	movx @dptr, a
+	mov a, #1
+	mov dptr, IN0BC
+	movx @dptr, a
+	ljmp setup_done_ack
+setup_breq_not_08:
+	cjne r2, #0x09, setup_breq_not_09
+	;; 09: Set_Configuration. ignored.
+	ljmp setup_done_ack
+setup_breq_not_09:
+	cjne r2, #0x0a, setup_breq_not_0a
+	;; 0a: Get_Interface. get the current altsetting for int[wIndexL]
+	;;  since we only have one interface, ignore wIndexL, return a 0
+	mov a, #0
+	ljmp setup_return_one_byte
+setup_breq_not_0a:
+	cjne r2, #0x0b, setup_breq_not_0b
+	;; 0b: Set_Interface. set altsetting for interface[wIndexL]. ignored
+	ljmp setup_done_ack
+setup_breq_not_0b:
+	ljmp setup_stall
+
+		
+setup_done_ack:	
+	;; now clear HSNAK
+	mov dptr, EP0CS
+	mov a, #0x02
+	movx @dptr, a
+	sjmp setup_done
+setup_stall:	
+	;; unhandled. STALL
+	;EP0CS |= bmEPSTALL
+	mov dptr, EP0CS
+	movx a, @dptr
+	orl a, EP0STALLbit
+	movx @dptr, a
+	sjmp setup_done
+	
+setup_done:	
+	pop acc
+	pop dph1
+	pop dpl1
+	pop dph
+	pop dpl
+	pop dps
+	reti
+
+;;; ==============================================================
+	
+set_baud:			; baud index in r3
+	;; verify a < 10
+	mov a, r3
+	jb ACC.7, set_baud__badbaud
+	clr c
+	subb a, #10
+	jnc set_baud__badbaud
+	mov a, r3
+	rl a			; a = index*2
+	add a, #LOW(baud_table)
+	mov dpl, a
+	mov a, #HIGH(baud_table)
+	addc a, #0
+	mov dph, a
+	;; TODO: shut down xmit/receive
+	;; TODO: wait for current xmit char to leave
+	;; TODO: shut down timer to avoid partial-char glitch
+	movx a,@dptr		; BAUD_HIGH
+	mov RCAP2H, a
+	mov TH2, a
+	inc dptr
+	movx a,@dptr		; BAUD_LOW
+	mov RCAP2L, a
+	mov TL2, a
+	;; TODO: restart xmit/receive
+	;; TODO: reenable interrupts, resume tx if pending
+	clr c			; c=0: success
+	ret
+set_baud__badbaud:
+	setb c			; c=1: failure
+	ret
+	
+;;; ==================================================
+control_pins:
+	cjne r1, #0x41, control_pins_in
+control_pins_out:
+	mov a, r3 ; wValue[0] holds new bits:	b7 is new DTR, b2 is new RTS
+	xrl a, #0xff		; 1 means active, 0V, +12V ?
+	anl a, #0x84
+	mov r3, a
+	mov dptr, OUTC
+	movx a, @dptr		; only change bits 7 and 2
+	anl a, #0x7b		; ~0x84
+	orl a, r3
+	movx @dptr, a		; other pins are inputs, bits ignored
+	ljmp setup_done_ack
+control_pins_in:
+	mov dptr, PINSC
+	movx a, @dptr
+	xrl a, #0xff
+	ljmp setup_return_one_byte
+
+;;; ========================================
+	
+ISR_Ep2in:
+	push dps
+	push dpl
+	push dph
+	push dpl1
+	push dph1
+	push acc
+	mov a,EXIF
+	clr acc.4
+	mov EXIF,a		; clear INT2 first
+	mov dptr, IN07IRQ	; clear USB int
+	mov a,#04h
+	movx @dptr,a
+
+	;; do stuff
+	lcall start_in
+	
+	pop acc
+	pop dph1
+	pop dpl1
+	pop dph
+	pop dpl
+	pop dps
+	reti
+
+ISR_Ep2out:
+	push dps
+	push dpl
+	push dph
+	push dpl1
+	push dph1
+	push acc
+	mov a,EXIF
+	clr acc.4
+	mov EXIF,a		; clear INT2 first
+	mov dptr, OUT07IRQ	; clear USB int
+	mov a,#04h
+	movx @dptr,a
+
+	;; do stuff
+
+	;; copy data into buffer. for now, assume we will have enough space
+	mov dptr, OUT2BC	; get byte count
+	movx a,@dptr
+	mov r1, a
+	clr a
+	mov dps, a
+	mov dptr, OUT2BUF	; load DPTR0 with source
+	mov dph1, #HIGH(tx_ring)	; load DPTR1 with target
+	mov dpl1, tx_ring_in
+OUT_loop:
+	movx a,@dptr		; read
+	inc dps			; switch to DPTR1: target
+	inc dpl1		; target = tx_ring_in+1
+	movx @dptr,a		; store
+	mov a,dpl1
+	cjne a, tx_ring_out, OUT_no_overflow
+	sjmp OUT_overflow
+OUT_no_overflow:	
+	inc tx_ring_in		; tx_ring_in++
+	inc dps			; switch to DPTR0: source
+	inc dptr
+	djnz r1, OUT_loop
+	sjmp OUT_done
+OUT_overflow:
+	;; signal overflow
+	;; fall through
+OUT_done:	
+	;; ack
+	mov dptr,OUT2BC
+	movx @dptr,a
+
+	;; start tx
+	acall maybe_start_tx
+	;acall dump_stat
+	
+	pop acc
+	pop dph1
+	pop dpl1
+	pop dph
+	pop dpl
+	pop dps
+	reti
+
+dump_stat:
+	;; fill in EP4in with a debugging message:
+	;;   tx_ring_in, tx_ring_out, rx_ring_in, rx_ring_out
+	;;   tx_active
+	;;   tx_ring[0..15]
+	;;   0xfc
+	;;   rx_ring[0..15]
+	clr a
+	mov dps, a
+	
+	mov dptr, IN4CS
+	movx a, @dptr
+	jb acc.1, dump_stat__done; busy: cannot dump, old one still pending
+	mov dptr, IN4BUF
+	
+	mov a, tx_ring_in
+	movx @dptr, a
+	inc dptr
+	mov a, tx_ring_out
+	movx @dptr, a
+	inc dptr
+
+	mov a, rx_ring_in
+	movx @dptr, a
+	inc dptr
+	mov a, rx_ring_out
+	movx @dptr, a
+	inc dptr
+	
+	clr a
+	jnb TX_RUNNING, dump_stat__no_tx_running
+	inc a
+dump_stat__no_tx_running:
+	movx @dptr, a
+	inc dptr
+	;; tx_ring[0..15]
+	inc dps
+	mov dptr, #tx_ring	; DPTR1: source
+	mov r1, #16
+dump_stat__tx_ring_loop:
+	movx a, @dptr
+	inc dptr
+	inc dps
+	movx @dptr, a
+	inc dptr
+	inc dps
+	djnz r1, dump_stat__tx_ring_loop
+	inc dps
+	
+	mov a, #0xfc
+	movx @dptr, a
+	inc dptr
+	
+	;; rx_ring[0..15]
+	inc dps
+	mov dptr, #rx_ring	; DPTR1: source
+	mov r1, #16
+dump_stat__rx_ring_loop:
+	movx a, @dptr
+	inc dptr
+	inc dps
+	movx @dptr, a
+	inc dptr
+	inc dps
+	djnz r1, dump_stat__rx_ring_loop
+	
+	;; now send it
+	clr a
+	mov dps, a
+	mov dptr, IN4BC
+	mov a, #38
+	movx @dptr, a
+dump_stat__done:	
+	ret
+		
+;;; ============================================================
+	
+maybe_start_tx:
+	;; make sure the tx process is running.
+	jb TX_RUNNING, start_tx_done
+start_tx:
+	;; is there work to be done?
+	mov a, tx_ring_in
+	cjne a,tx_ring_out, start_tx__work
+	ret			; no work
+start_tx__work:	
+	;; tx was not running. send the first character, setup the TI int
+	inc tx_ring_out		; [++tx_ring_out]
+	mov dph, #HIGH(tx_ring)
+	mov dpl, tx_ring_out
+	movx a, @dptr
+	mov sbuf, a
+	setb TX_RUNNING
+start_tx_done:
+	;; can we unthrottle the host tx process?
+	;;  step 1: do we care?
+	mov a, #0
+	cjne a, tx_unthrottle_threshold, start_tx__maybe_unthrottle_tx
+	;; nope
+start_tx_really_done:
+	ret
+start_tx__maybe_unthrottle_tx:
+	;;  step 2: is there now room?
+	mov a, tx_ring_out
+	setb c
+	subb a, tx_ring_in
+	;; a is now write_room. If thresh >= a, we can unthrottle
+	clr c
+	subb a, tx_unthrottle_threshold
+	jc start_tx_really_done	; nope
+	;; yes, we can unthrottle. remove the threshold and mark a request
+	mov tx_unthrottle_threshold, #0
+	setb DO_TX_UNTHROTTLE
+	;; prod rx, which will actually send the message when in2 becomes free
+	ljmp start_in
+	
+
+serial_int:
+	push dps
+	push dpl
+	push dph
+	push dpl1
+	push dph1
+	push acc
+	jnb TI, serial_int__not_tx
+	;; tx finished. send another character if we have one
+	clr TI			; clear int
+	clr TX_RUNNING
+	lcall start_tx
+serial_int__not_tx:
+	jnb RI, serial_int__not_rx
+	lcall get_rx_char
+	clr RI			; clear int
+serial_int__not_rx:	
+	;; return
+	pop acc
+	pop dph1
+	pop dpl1
+	pop dph
+	pop dpl
+	pop dps
+	reti
+
+get_rx_char:
+	mov dph, #HIGH(rx_ring)
+	mov dpl, rx_ring_in
+	inc dpl			; target = rx_ring_in+1
+	mov a, sbuf
+	movx @dptr, a
+	;; check for overflow before incrementing rx_ring_in
+	mov a, dpl
+	cjne a, rx_ring_out, get_rx_char__no_overflow
+	;; signal overflow
+	ret
+get_rx_char__no_overflow:	
+	inc rx_ring_in
+	;; kick off USB INpipe
+	acall start_in
+	ret
+
+start_in:
+	;; check if the inpipe is already running.
+	mov dptr, IN2CS
+	movx a, @dptr
+	jb acc.1, start_in__done; int will handle it
+	jb DO_TX_UNTHROTTLE, start_in__do_tx_unthrottle
+	;; see if there is any work to do. a serial interrupt might occur
+	;; during this sequence?
+	mov a, rx_ring_in
+	cjne a, rx_ring_out, start_in__have_work
+	ret			; nope
+start_in__have_work:	
+	;; now copy as much data as possible into the pipe. 63 bytes max.
+	clr a
+	mov dps, a
+	mov dph, #HIGH(rx_ring)	; load DPTR0 with source
+	inc dps
+	mov dptr, IN2BUF	; load DPTR1 with target
+	movx @dptr, a		; in[0] signals that rest of IN is rx data
+	inc dptr
+	inc dps
+	;; loop until we run out of data, or we have copied 64 bytes
+	mov r1, #1		; INbuf size counter
+start_in__loop:
+	mov a, rx_ring_in
+	cjne a, rx_ring_out, start_inlocal_irq_enablell_copying
+	sjmp start_in__kick
+start_inlocal_irq_enablell_copying:
+	inc rx_ring_out
+	mov dpl, rx_ring_out
+	movx a, @dptr
+	inc dps
+	movx @dptr, a		; write into IN buffer
+	inc dptr
+	inc dps
+	inc r1
+	cjne r1, #64, start_in__loop; loop
+start_in__kick:
+	;; either we ran out of data, or we copied 64 bytes. r1 has byte count
+	;; kick off IN
+	mov dptr, IN2BC
+	mov a, r1
+	jz start_in__done
+	movx @dptr, a
+	;; done
+start_in__done:
+	;acall dump_stat
+	ret
+start_in__do_tx_unthrottle:
+	;; special sequence: send a tx unthrottle message
+	clr DO_TX_UNTHROTTLE
+	clr a
+	mov dps, a
+	mov dptr, IN2BUF
+	mov a, #1
+	movx @dptr, a
+	inc dptr
+	mov a, #2
+	movx @dptr, a
+	mov dptr, IN2BC
+	movx @dptr, a